# Flog Txt Version 1
# Analyzer Version: 3.0.2
# Analyzer Build Date: Jul  9 2019 16:03:52
# Log Creation Date: 26.07.2019 17:39:19.423

Process:
	id = "1"
	image_name = "a.exe"
	filename = "c:\\users\\fd1hvy\\desktop\\a.exe"
	page_root = "0x9138000"
	os_pid = "0xcd8"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "analysis_target"
	parent_id = "0"
	os_parent_pid = "0x0"
	cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\a.exe\" "
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 1
	os_tid = 0xd08

	[0035.807] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000
	[0035.807] GetProcAddress (hModule=0x75e90000, lpProcName="VirtualAlloc") returned 0x75ea6970
	[0035.807] GetProcAddress (hModule=0x75e90000, lpProcName="VirtualFree") returned 0x75ea69d0
	[0035.807] GetProcAddress (hModule=0x75e90000, lpProcName="VirtualProtect") returned 0x75ea6a30
	[0035.807] VirtualAlloc (lpAddress=0x0, dwSize=0x1800, flAllocationType=0x1000, flProtect=0x4) returned 0x30000
	[0035.845] VirtualAlloc (lpAddress=0x0, dwSize=0x190e, flAllocationType=0x1000, flProtect=0x4) returned 0x1c0000
	[0035.846] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0035.846] VirtualAlloc (lpAddress=0x0, dwSize=0xb0e, flAllocationType=0x1000, flProtect=0x4) returned 0x1c0000
	[0035.846] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0035.846] VirtualAlloc (lpAddress=0x0, dwSize=0x70e, flAllocationType=0x1000, flProtect=0x4) returned 0x1c0000
	[0035.847] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0035.847] VirtualAlloc (lpAddress=0x0, dwSize=0x917b6, flAllocationType=0x1000, flProtect=0x4) returned 0x600000
	[0035.889] VirtualFree (lpAddress=0x600000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0035.892] VirtualFree (lpAddress=0x30000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0035.892] GetModuleHandleA (lpModuleName="user32.dll") returned 0x0
	[0035.892] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74b70000
	[0038.675] GetProcAddress (hModule=0x74b70000, lpProcName="RegisterClassExA") returned 0x74b88260
	[0038.675] GetProcAddress (hModule=0x74b70000, lpProcName="PeekMessageA") returned 0x74b887a0
	[0038.675] GetProcAddress (hModule=0x74b70000, lpProcName="SendMessageA") returned 0x74b80630
	[0038.675] GetProcAddress (hModule=0x74b70000, lpProcName="LoadCursorA") returned 0x74b9ab70
	[0038.675] GetProcAddress (hModule=0x74b70000, lpProcName="GetSystemMetrics") returned 0x74b9ddc0
	[0038.675] GetProcAddress (hModule=0x74b70000, lpProcName="GetMessageA") returned 0x74b8bdf0
	[0038.675] GetProcAddress (hModule=0x74b70000, lpProcName="GetDlgItemTextA") returned 0x74bef2d0
	[0038.675] GetProcAddress (hModule=0x74b70000, lpProcName="EndPaint") returned 0x74ba32d0
	[0038.675] GetProcAddress (hModule=0x74b70000, lpProcName="SystemParametersInfoA") returned 0x74b85060
	[0038.675] GetProcAddress (hModule=0x74b70000, lpProcName="TranslateMessage") returned 0x74b9f900
	[0038.675] GetProcAddress (hModule=0x74b70000, lpProcName="UpdateWindow") returned 0x74b82b80
	[0038.675] GetProcAddress (hModule=0x74b70000, lpProcName="MessageBoxA") returned 0x74bdd740
	[0038.675] GetProcAddress (hModule=0x74b70000, lpProcName="DispatchMessageA") returned 0x74b8fd80
	[0038.675] GetProcAddress (hModule=0x74b70000, lpProcName="DefWindowProcA") returned 0x77c35680
	[0038.675] GetProcAddress (hModule=0x74b70000, lpProcName="CreateWindowExA") returned 0x74b91470
	[0038.676] GetProcAddress (hModule=0x74b70000, lpProcName="BeginPaint") returned 0x74ba2fb0
	[0038.676] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000
	[0038.676] GetProcAddress (hModule=0x75e90000, lpProcName="lstrlenA") returned 0x75ea6c50
	[0038.676] GetProcAddress (hModule=0x75e90000, lpProcName="CloseHandle") returned 0x75efeab0
	[0038.676] GetProcAddress (hModule=0x75e90000, lpProcName="CopyFileA") returned 0x75edceb0
	[0038.676] GetProcAddress (hModule=0x75e90000, lpProcName="CreateFileA") returned 0x75efed00
	[0038.676] GetProcAddress (hModule=0x75e90000, lpProcName="ExitProcess") returned 0x75ea3cb0
	[0038.676] GetProcAddress (hModule=0x75e90000, lpProcName="FindClose") returned 0x75efed70
	[0038.676] GetProcAddress (hModule=0x75e90000, lpProcName="FindFirstFileA") returned 0x75efedb0
	[0038.676] GetProcAddress (hModule=0x75e90000, lpProcName="FindNextFileA") returned 0x75efee20
	[0038.676] GetProcAddress (hModule=0x75e90000, lpProcName="FindResourceA") returned 0x75ee27c0
	[0038.676] GetProcAddress (hModule=0x75e90000, lpProcName="FreeResource") returned 0x75ea4c80
	[0038.676] GetProcAddress (hModule=0x75e90000, lpProcName="GetCommandLineA") returned 0x75ea4cb0
	[0038.676] GetProcAddress (hModule=0x75e90000, lpProcName="GetEnvironmentVariableA") returned 0x75ea4f90
	[0038.676] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileAttributesA") returned 0x75efeee0
	[0038.676] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileSize") returned 0x75efef30
	[0038.676] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileTime") returned 0x75efef50
	[0038.677] GetProcAddress (hModule=0x75e90000, lpProcName="GetLogicalDrives") returned 0x75ea0d20
	[0038.677] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleFileNameA") returned 0x75ea5070
	[0038.677] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleHandleA") returned 0x75ea50b0
	[0038.677] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcessHeap") returned 0x75ea51f0
	[0038.677] GetProcAddress (hModule=0x75e90000, lpProcName="GetTempPathA") returned 0x75efefe0
	[0038.677] GetProcAddress (hModule=0x75e90000, lpProcName="GetWindowsDirectoryA") returned 0x75ea5710
	[0038.677] GetProcAddress (hModule=0x75e90000, lpProcName="GlobalFree") returned 0x75ea1ee0
	[0038.677] GetProcAddress (hModule=0x75e90000, lpProcName="HeapAlloc") returned 0x77bf2dc0
	[0038.677] GetProcAddress (hModule=0x75e90000, lpProcName="LoadResource") returned 0x75ea5b00
	[0038.677] GetProcAddress (hModule=0x75e90000, lpProcName="LockResource") returned 0x75ea5bc0
	[0038.677] GetProcAddress (hModule=0x75e90000, lpProcName="MoveFileA") returned 0x75ede410
	[0038.677] GetProcAddress (hModule=0x75e90000, lpProcName="ReadFile") returned 0x75eff090
	[0038.677] GetProcAddress (hModule=0x75e90000, lpProcName="RtlMoveMemory") returned 0x77c35ad0
	[0038.677] GetProcAddress (hModule=0x75e90000, lpProcName="SetErrorMode") returned 0x75ea6500
	[0038.677] GetProcAddress (hModule=0x75e90000, lpProcName="SetFilePointer") returned 0x75eff120
	[0038.677] GetProcAddress (hModule=0x75e90000, lpProcName="SetFileTime") returned 0x75eff140
	[0038.678] GetProcAddress (hModule=0x75e90000, lpProcName="SizeofResource") returned 0x75ea6740
	[0038.678] GetProcAddress (hModule=0x75e90000, lpProcName="WriteFile") returned 0x75eff180
	[0038.678] GetProcAddress (hModule=0x75e90000, lpProcName="lstrcatA") returned 0x75ee70c0
	[0038.678] GetProcAddress (hModule=0x75e90000, lpProcName="lstrcmpA") returned 0x75ea6b90
	[0038.678] GetProcAddress (hModule=0x75e90000, lpProcName="lstrcmpiA") returned 0x75ea6bd0
	[0038.678] GetProcAddress (hModule=0x75e90000, lpProcName="lstrcpyA") returned 0x75ee7060
	[0038.678] GetModuleHandleA (lpModuleName="shell32.dll") returned 0x0
	[0038.678] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x76480000
	[0046.095] GetProcAddress (hModule=0x76480000, lpProcName="ShellExecuteA") returned 0x76683ef0
	[0046.096] GetProcAddress (hModule=0x76480000, lpProcName="SHGetSpecialFolderPathA") returned 0x766dcc90
	[0046.096] GetModuleHandleA (lpModuleName="advapi32.dll") returned 0x761b0000
	[0046.096] GetProcAddress (hModule=0x761b0000, lpProcName="RegCreateKeyExA") returned 0x761cf560
	[0046.096] GetProcAddress (hModule=0x761b0000, lpProcName="CryptCreateHash") returned 0x761ceed0
	[0046.096] GetProcAddress (hModule=0x761b0000, lpProcName="CryptDestroyHash") returned 0x761cf0e0
	[0046.096] GetProcAddress (hModule=0x761b0000, lpProcName="CryptGetHashParam") returned 0x761cee70
	[0046.096] GetProcAddress (hModule=0x761b0000, lpProcName="RegSetValueExA") returned 0x761cffc0
	[0046.096] GetProcAddress (hModule=0x761b0000, lpProcName="RegDeleteKeyA") returned 0x761cf8c0
	[0046.096] GetProcAddress (hModule=0x761b0000, lpProcName="CryptAcquireContextA") returned 0x761cfc40
	[0046.096] GetProcAddress (hModule=0x761b0000, lpProcName="RegCloseKey") returned 0x761ced60
	[0046.096] GetProcAddress (hModule=0x761b0000, lpProcName="CryptReleaseContext") returned 0x761cfbc0
	[0046.096] GetProcAddress (hModule=0x761b0000, lpProcName="CryptHashData") returned 0x761ceef0
	[0046.097] GetModuleHandleA (lpModuleName="shlwapi.dll") returned 0x75f60000
	[0046.097] GetProcAddress (hModule=0x75f60000, lpProcName="PathFindFileNameA") returned 0x75f74640
	[0046.097] GetProcAddress (hModule=0x75f60000, lpProcName="PathFindExtensionA") returned 0x75f7bfe0
	[0046.097] GetProcAddress (hModule=0x75f60000, lpProcName="PathAddBackslashA") returned 0x75f77700
	[0046.097] GetProcAddress (hModule=0x75f60000, lpProcName="PathMatchSpecA") returned 0x75f7c2a0
	[0046.097] GetModuleHandleA (lpModuleName="gdi32.dll") returned 0x75b70000
	[0046.097] GetProcAddress (hModule=0x75b70000, lpProcName="CreateFontIndirectA") returned 0x75b74880
	[0046.097] GetModuleHandleA (lpModuleName="comctl32.dll") returned 0x0
	[0046.638] LoadLibraryA (lpLibFileName="comctl32.dll") returned 0x74490000
	[0046.660] GetProcAddress (hModule=0x74490000, lpProcName="InitCommonControls") returned 0x744ae450
	[0046.660] VirtualProtect (in: lpAddress=0x400000, dwSize=0x400, flNewProtect=0x4, lpflOldProtect=0x19ff58 | out: lpflOldProtect=0x19ff58*=0x2) returned 1
	[0046.660] VirtualProtect (in: lpAddress=0x401000, dwSize=0x2000, flNewProtect=0x20, lpflOldProtect=0x49a5e8 | out: lpflOldProtect=0x49a5e8*=0x40) returned 1
	[0046.661] VirtualProtect (in: lpAddress=0x403000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x49a5f4 | out: lpflOldProtect=0x49a5f4*=0x4) returned 1
	[0046.661] VirtualProtect (in: lpAddress=0x404000, dwSize=0x4000, flNewProtect=0x4, lpflOldProtect=0x49a600 | out: lpflOldProtect=0x49a600*=0x4) returned 1
	[0046.661] VirtualProtect (in: lpAddress=0x400000, dwSize=0x400, flNewProtect=0x2, lpflOldProtect=0x19ff60 | out: lpflOldProtect=0x19ff60*=0x4) returned 1
	[0046.661] GetProcessHeap () returned 0x7b0000
	[0046.661] FindResourceA (hModule=0x0, lpName=0xe, lpType=0x2) returned 0x4083b0
	[0046.661] SizeofResource (hModule=0x0, hResInfo=0x4083b0) returned 0x5da
	[0046.661] LoadResource (hModule=0x0, hResInfo=0x4083b0) returned 0x47dcd4
	[0046.661] LockResource (hResData=0x47dcd4) returned 0x47dcd4
	[0046.662] RtlMoveMemory (in: Destination=0x406db9, Source=0x47dcd4, Length=0x10 | out: Destination=0x406db9) 
	[0046.662] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0x1d6) returned 0x7c7a10
	[0046.662] RtlMoveMemory (in: Destination=0x7c7a10, Source=0x47dce8, Length=0x1d6 | out: Destination=0x7c7a10) 
	[0046.662] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0x39f) returned 0x7ce980
	[0046.662] RtlMoveMemory (in: Destination=0x7ce980, Source=0x47dec2, Length=0x39f | out: Destination=0x7ce980) 
	[0046.662] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0x4) returned 0x7c4b40
	[0046.662] RtlMoveMemory (in: Destination=0x7c4b40, Source=0x47e265, Length=0x4 | out: Destination=0x7c4b40) 
	[0046.662] RtlMoveMemory (in: Destination=0x406dc9, Source=0x47e269, Length=0x10 | out: Destination=0x406dc9) 
	[0046.662] RtlMoveMemory (in: Destination=0x407529, Source=0x47e279, Length=0x5 | out: Destination=0x407529) 
	[0046.662] RtlMoveMemory (in: Destination=0x406dd9, Source=0x47e27e, Length=0x10 | out: Destination=0x406dd9) 
	[0046.662] RtlMoveMemory (in: Destination=0x406de9, Source=0x47e28e, Length=0x10 | out: Destination=0x406de9) 
	[0046.662] RtlMoveMemory (in: Destination=0x407525, Source=0x47e29e, Length=0x4 | out: Destination=0x407525) 
	[0046.662] RtlMoveMemory (in: Destination=0x4065a5, Source=0x47e2a2, Length=0x4 | out: Destination=0x4065a5) 
	[0046.662] RtlMoveMemory (in: Destination=0x4065a9, Source=0x47e2a6, Length=0x4 | out: Destination=0x4065a9) 
	[0046.662] RtlMoveMemory (in: Destination=0x4065ad, Source=0x47e2aa, Length=0x4 | out: Destination=0x4065ad) 
	[0046.662] FreeResource (hResData=0x47dcd4) returned 0
	[0046.662] GetTempPathA (in: nBufferLength=0x200, lpBuffer=0x404e50 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\") returned 0x23
	[0046.662] lstrcpyA (in: lpString1=0x405950, lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\"
	[0046.662] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x405450, nSize=0x500 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\a.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\a.exe")) returned 0x1d
	[0046.662] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0x1fc2e9) returned 0x21b9020
	[0046.667] GetWindowsDirectoryA (in: lpBuffer=0x40755e, uSize=0x200 | out: lpBuffer="C:\\WINDOWS") returned 0xa
	[0046.667] PathAddBackslashA (in: pszPath="C:\\WINDOWS" | out: pszPath="C:\\WINDOWS\\") returned=""
	[0046.668] lstrcatA (in: lpString1="C:\\WINDOWS\\", lpString2="explorer.exe" | out: lpString1="C:\\WINDOWS\\explorer.exe") returned="C:\\WINDOWS\\explorer.exe"
	[0046.668] CreateFileA (lpFileName="C:\\WINDOWS\\explorer.exe" (normalized: "c:\\windows\\explorer.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0046.668] GetFileTime (in: hFile=0x1d4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556 | out: lpCreationTime=0x407546*(dwLowDateTime=0x46742519, dwHighDateTime=0x1d2fa08), lpLastAccessTime=0x40754e*(dwLowDateTime=0x75f1db39, dwHighDateTime=0x1d2fa09), lpLastWriteTime=0x407556*(dwLowDateTime=0x46742519, dwHighDateTime=0x1d2fa08)) returned 1
	[0046.668] CloseHandle (hObject=0x1d4) returned 1
	[0046.668] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", lpString2="Bho61CXU8if3yfw" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Bho61CXU8if3yfw") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Bho61CXU8if3yfw"
	[0046.668] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Bho61CXU8if3yfw", lpString2=".exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Bho61CXU8if3yfw.exe") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Bho61CXU8if3yfw.exe"
	[0046.668] CopyFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\a.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\a.exe"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Bho61CXU8if3yfw.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\bho61cxu8if3yfw.exe"), bFailIfExists=1) returned 1
	[0047.062] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Bho61CXU8if3yfw.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\bho61cxu8if3yfw.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0047.062] SetFileTime (hFile=0x1d4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0047.062] CloseHandle (hObject=0x1d4) returned 1
	[0047.062] RegCreateKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", Reserved=0x0, lpClass="REG_SZ", dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x19ff64, lpdwDisposition=0x19ff68 | out: phkResult=0x19ff64*=0x1d4, lpdwDisposition=0x19ff68*=0x2) returned 0x0
	[0047.062] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Bho61CXU8if3yfw.exe") returned 54
	[0047.062] RegSetValueExA (in: hKey=0x1d4, lpValueName="malwrHNT", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Bho61CXU8if3yfw.exe", cbData=0x36 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Bho61CXU8if3yfw.exe") returned 0x0
	[0047.063] RegCloseKey (hKey=0x1d4) returned 0x0
	[0047.063] lstrcpyA (in: lpString1=0x4065b9, lpString2="." | out: lpString1=".") returned="."
	[0047.063] lstrcatA (in: lpString1=".", lpString2="exe" | out: lpString1=".exe") returned=".exe"
	[0047.063] RegCreateKeyExA (in: hKey=0x80000000, lpSubKey=".exe", Reserved=0x0, lpClass="REG_SZ", dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x19ff60, lpdwDisposition=0x19ff64 | out: phkResult=0x19ff60*=0x1fe, lpdwDisposition=0x19ff64*=0x2) returned 0x0
	[0047.064] lstrlenA (lpString="OYVKGNYIKFTUGXY") returned 15
	[0047.064] RegSetValueExA (in: hKey=0x1fe, lpValueName="", Reserved=0x0, dwType=0x1, lpData="OYVKGNYIKFTUGXY", cbData=0xf | out: lpData="OYVKGNYIKFTUGXY") returned 0x0
	[0047.065] RegCloseKey (hKey=0x1fe) returned 0x0
	[0047.065] RegCreateKeyExA (in: hKey=0x80000000, lpSubKey="OYVKGNYIKFTUGXY", Reserved=0x0, lpClass="REG_SZ", dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x19ff60, lpdwDisposition=0x19ff64 | out: phkResult=0x19ff60*=0x1da, lpdwDisposition=0x19ff64*=0x1) returned 0x0
	[0047.462] lstrlenA (lpString="FUCKED!") returned 7
	[0047.462] RegSetValueExA (in: hKey=0x1da, lpValueName="", Reserved=0x0, dwType=0x1, lpData="FUCKED!", cbData=0x7 | out: lpData="FUCKED!") returned 0x0
	[0047.462] RegCloseKey (hKey=0x1da) returned 0x0
	[0047.462] lstrcpyA (in: lpString1=0x4065b9, lpString2="OYVKGNYIKFTUGXY" | out: lpString1="OYVKGNYIKFTUGXY") returned="OYVKGNYIKFTUGXY"
	[0047.462] lstrcatA (in: lpString1="OYVKGNYIKFTUGXY", lpString2="\\DefaultIcon" | out: lpString1="OYVKGNYIKFTUGXY\\DefaultIcon") returned="OYVKGNYIKFTUGXY\\DefaultIcon"
	[0047.462] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Bho61CXU8if3yfw.exe", lpString2=",0" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Bho61CXU8if3yfw.exe,0") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Bho61CXU8if3yfw.exe,0"
	[0047.462] RegCreateKeyExA (in: hKey=0x80000000, lpSubKey="OYVKGNYIKFTUGXY\\DefaultIcon", Reserved=0x0, lpClass="REG_SZ", dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x19ff60, lpdwDisposition=0x19ff64 | out: phkResult=0x19ff60*=0x1fe, lpdwDisposition=0x19ff64*=0x1) returned 0x0
	[0047.463] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Bho61CXU8if3yfw.exe,0") returned 56
	[0047.463] RegSetValueExA (in: hKey=0x1fe, lpValueName="", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Bho61CXU8if3yfw.exe,0", cbData=0x38 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Bho61CXU8if3yfw.exe,0") returned 0x0
	[0047.463] RegCloseKey (hKey=0x1fe) returned 0x0
	[0047.464] lstrcpyA (in: lpString1=0x4065b9, lpString2="OYVKGNYIKFTUGXY" | out: lpString1="OYVKGNYIKFTUGXY") returned="OYVKGNYIKFTUGXY"
	[0047.464] lstrcatA (in: lpString1="OYVKGNYIKFTUGXY", lpString2="\\shell\\open\\command" | out: lpString1="OYVKGNYIKFTUGXY\\shell\\open\\command") returned="OYVKGNYIKFTUGXY\\shell\\open\\command"
	[0047.464] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Bho61CXU8if3yfw.exe,0") returned 56
	[0047.464] RegCreateKeyExA (in: hKey=0x80000000, lpSubKey="OYVKGNYIKFTUGXY\\shell\\open\\command", Reserved=0x0, lpClass="REG_SZ", dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x19ff60, lpdwDisposition=0x19ff64 | out: phkResult=0x19ff60*=0x202, lpdwDisposition=0x19ff64*=0x1) returned 0x0
	[0047.465] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Bho61CXU8if3yfw.exe") returned 54
	[0047.465] RegSetValueExA (in: hKey=0x202, lpValueName="", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Bho61CXU8if3yfw.exe", cbData=0x36 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Bho61CXU8if3yfw.exe") returned 0x0
	[0047.465] RegCloseKey (hKey=0x202) returned 0x0
	[0047.465] SetErrorMode (uMode=0x1) returned 0x0
	[0047.465] GetLogicalDrives () returned 0x4
	[0047.465] FindFirstFileA (in: lpFileName="C:\\*.*", lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19ff60, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x7cba90
	[0047.465] lstrcmpA (lpString1=".", lpString2="$GetCurrent") returned 1
	[0047.468] lstrcmpA (lpString1="..", lpString2="$GetCurrent") returned 1
	[0047.469] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*"
	[0047.469] lstrcatA (in: lpString1="C:\\", lpString2="$GetCurrent" | out: lpString1="C:\\$GetCurrent") returned="C:\\$GetCurrent"
	[0047.469] lstrlenA (lpString="C:\\$GetCurrent") returned 14
	[0047.469] FindFirstFileA (in: lpFileName="C:\\$GetCurrent\\*.*", lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19febc, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cb590
	[0047.470] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0047.470] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19febc, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0047.470] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0047.470] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0047.470] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19febc, dwReserved1=0x20000, cFileName="Logs", cAlternateFileName="")) returned 1
	[0047.470] lstrcmpA (lpString1=".", lpString2="Logs") returned -1
	[0047.470] lstrcmpA (lpString1="..", lpString2="Logs") returned -1
	[0047.470] PathFindFileNameA (pszPath="C:\\$GetCurrent\\*.*") returned="*.*"
	[0047.470] lstrcatA (in: lpString1="C:\\$GetCurrent\\", lpString2="Logs" | out: lpString1="C:\\$GetCurrent\\Logs") returned="C:\\$GetCurrent\\Logs"
	[0047.471] lstrlenA (lpString="C:\\$GetCurrent\\Logs") returned 19
	[0047.471] FindFirstFileA (in: lpFileName="C:\\$GetCurrent\\Logs\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffffe, dwReserved1=0x7ced28, cFileName=".", cAlternateFileName="")) returned 0x7cb790
	[0047.473] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0047.473] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffffe, dwReserved1=0x7ced28, cFileName="..", cAlternateFileName="")) returned 1
	[0047.473] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0047.473] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0047.473] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0xfffffffe, dwReserved1=0x7ced28, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1
	[0047.473] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0047.473] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1
	[0047.473] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1
	[0047.473] lstrcmpiA (lpString1="", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned -1
	[0047.473] PathFindFileNameA (pszPath="C:\\$GetCurrent\\Logs\\*.*") returned="*.*"
	[0047.473] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\$GetCurrent\\Logs\\" | out: lpString1="C:\\$GetCurrent\\Logs\\") returned="C:\\$GetCurrent\\Logs\\"
	[0047.473] PathAddBackslashA (in: pszPath="C:\\$GetCurrent\\Logs\\" | out: pszPath="C:\\$GetCurrent\\Logs\\") returned=""
	[0047.473] lstrcatA (in: lpString1="C:\\$GetCurrent\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\$GetCurrent\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\$GetCurrent\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0047.473] GetFileAttributesA (lpFileName="C:\\$GetCurrent\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\$getcurrent\\logs\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0047.474] CreateFileA (lpFileName="C:\\$GetCurrent\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\$getcurrent\\logs\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0047.475] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0047.475] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0047.476] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0047.476] CloseHandle (hObject=0x208) returned 1
	[0047.477] lstrcatA (in: lpString1="C:\\$GetCurrent\\Logs\\", lpString2="downlevel_2017_09_07_02_02_39_766.log" | out: lpString1="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log"
	[0047.477] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.zip") returned 0
	[0047.477] lstrlenA (lpString="*.zip") returned 5
	[0047.477] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.rar") returned 0
	[0047.477] lstrlenA (lpString="*.rar") returned 5
	[0047.477] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.7z") returned 0
	[0047.477] lstrlenA (lpString="*.7z") returned 4
	[0047.477] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.tar") returned 0
	[0047.477] lstrlenA (lpString="*.tar") returned 5
	[0047.477] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.gzip") returned 0
	[0047.477] lstrlenA (lpString="*.gzip") returned 6
	[0047.477] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.jpg") returned 0
	[0047.477] lstrlenA (lpString="*.jpg") returned 5
	[0047.477] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.jpeg") returned 0
	[0047.477] lstrlenA (lpString="*.jpeg") returned 6
	[0047.477] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.bmp") returned 0
	[0047.477] lstrlenA (lpString="*.bmp") returned 5
	[0047.477] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.gif") returned 0
	[0047.477] lstrlenA (lpString="*.gif") returned 5
	[0047.477] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.png") returned 0
	[0047.477] lstrlenA (lpString="*.png") returned 5
	[0047.477] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.doc") returned 0
	[0047.477] lstrlenA (lpString="*.doc") returned 5
	[0047.477] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.docx") returned 0
	[0047.477] lstrlenA (lpString="*.docx") returned 6
	[0047.477] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.xls") returned 0
	[0047.478] lstrlenA (lpString="*.xls") returned 5
	[0047.478] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.xlsx") returned 0
	[0047.478] lstrlenA (lpString="*.xlsx") returned 6
	[0047.478] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.ppt") returned 0
	[0047.478] lstrlenA (lpString="*.ppt") returned 5
	[0047.478] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.pptx") returned 0
	[0047.478] lstrlenA (lpString="*.pptx") returned 6
	[0047.478] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.txt") returned 0
	[0047.478] lstrlenA (lpString="*.txt") returned 5
	[0047.478] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.pdf") returned 0
	[0047.478] lstrlenA (lpString="*.pdf") returned 5
	[0047.478] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.htm") returned 0
	[0047.478] lstrlenA (lpString="*.htm") returned 5
	[0047.478] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.html") returned 0
	[0047.478] lstrlenA (lpString="*.html") returned 6
	[0047.478] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.mdb") returned 0
	[0047.478] lstrlenA (lpString="*.mdb") returned 5
	[0047.478] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.pfx") returned 0
	[0047.478] lstrlenA (lpString="*.pfx") returned 5
	[0047.478] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.md") returned 0
	[0047.478] lstrlenA (lpString="*.md") returned 4
	[0047.478] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.lnk") returned 0
	[0047.478] lstrlenA (lpString="*.lnk") returned 5
	[0047.478] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.torrent") returned 0
	[0047.478] lstrlenA (lpString="*.torrent") returned 9
	[0047.478] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.mov") returned 0
	[0047.478] lstrlenA (lpString="*.mov") returned 5
	[0047.478] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.3gp") returned 0
	[0047.478] lstrlenA (lpString="*.3gp") returned 5
	[0047.478] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.mpeg") returned 0
	[0047.478] lstrlenA (lpString="*.mpeg") returned 6
	[0047.478] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.mpg") returned 0
	[0047.478] lstrlenA (lpString="*.mpg") returned 5
	[0047.478] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.flv") returned 0
	[0047.478] lstrlenA (lpString="*.flv") returned 5
	[0047.478] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.avi") returned 0
	[0047.478] lstrlenA (lpString="*.avi") returned 5
	[0047.479] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.mp4") returned 0
	[0047.479] lstrlenA (lpString="*.mp4") returned 5
	[0047.479] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.wmv") returned 0
	[0047.479] lstrlenA (lpString="*.wmv") returned 5
	[0047.479] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.mkv") returned 0
	[0047.479] lstrlenA (lpString="*.mkv") returned 5
	[0047.479] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.mp3") returned 0
	[0047.479] lstrlenA (lpString="*.mp3") returned 5
	[0047.479] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.wav") returned 0
	[0047.479] lstrlenA (lpString="*.wav") returned 5
	[0047.479] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.flac") returned 0
	[0047.479] lstrlenA (lpString="*.flac") returned 6
	[0047.479] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.wma") returned 0
	[0047.479] lstrlenA (lpString="*.wma") returned 5
	[0047.479] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.au3") returned 0
	[0047.479] lstrlenA (lpString="*.au3") returned 5
	[0047.479] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.ahk") returned 0
	[0047.479] lstrlenA (lpString="*.ahk") returned 5
	[0047.479] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.c") returned 0
	[0047.479] lstrlenA (lpString="*.c") returned 3
	[0047.479] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.cc") returned 0
	[0047.479] lstrlenA (lpString="*.cc") returned 4
	[0047.479] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.cpp") returned 0
	[0047.479] lstrlenA (lpString="*.cpp") returned 5
	[0047.479] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.cxx") returned 0
	[0047.479] lstrlenA (lpString="*.cxx") returned 5
	[0047.479] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.c++") returned 0
	[0047.479] lstrlenA (lpString="*.c++") returned 5
	[0047.479] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.cs") returned 0
	[0047.479] lstrlenA (lpString="*.cs") returned 4
	[0047.479] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.vb") returned 0
	[0047.479] lstrlenA (lpString="*.vb") returned 4
	[0047.479] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.bas") returned 0
	[0047.479] lstrlenA (lpString="*.bas") returned 5
	[0047.479] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.csproj") returned 0
	[0047.479] lstrlenA (lpString="*.csproj") returned 8
	[0047.479] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.vbproj") returned 0
	[0047.480] lstrlenA (lpString="*.vbproj") returned 8
	[0047.480] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.vcxproj") returned 0
	[0047.480] lstrlenA (lpString="*.vcxproj") returned 9
	[0047.480] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.manifest") returned 0
	[0047.480] lstrlenA (lpString="*.manifest") returned 10
	[0047.480] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.php") returned 0
	[0047.480] lstrlenA (lpString="*.php") returned 5
	[0047.480] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.vbe") returned 0
	[0047.480] lstrlenA (lpString="*.vbe") returned 5
	[0047.480] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.vba") returned 0
	[0047.480] lstrlenA (lpString="*.vba") returned 5
	[0047.480] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.vbs") returned 0
	[0047.480] lstrlenA (lpString="*.vbs") returned 5
	[0047.480] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.bat") returned 0
	[0047.480] lstrlenA (lpString="*.bat") returned 5
	[0047.480] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.cmd") returned 0
	[0047.480] lstrlenA (lpString="*.cmd") returned 5
	[0047.480] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.js") returned 0
	[0047.480] lstrlenA (lpString="*.js") returned 4
	[0047.480] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.jscript") returned 0
	[0047.480] lstrlenA (lpString="*.jscript") returned 9
	[0047.480] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.hta") returned 0
	[0047.480] lstrlenA (lpString="*.hta") returned 5
	[0047.480] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.php7") returned 0
	[0047.480] lstrlenA (lpString="*.php7") returned 6
	[0047.480] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.db") returned 0
	[0047.480] lstrlenA (lpString="*.db") returned 4
	[0047.480] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.swf") returned 0
	[0047.480] lstrlenA (lpString="*.swf") returned 5
	[0047.480] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.eml") returned 0
	[0047.480] lstrlenA (lpString="*.eml") returned 5
	[0047.480] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.part") returned 0
	[0047.480] lstrlenA (lpString="*.part") returned 6
	[0047.480] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.nfo") returned 0
	[0047.480] lstrlenA (lpString="*.nfo") returned 5
	[0047.480] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.rsa") returned 0
	[0047.481] lstrlenA (lpString="*.rsa") returned 5
	[0047.481] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.key") returned 0
	[0047.481] lstrlenA (lpString="*.key") returned 5
	[0047.481] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.aes") returned 0
	[0047.481] lstrlenA (lpString="*.aes") returned 5
	[0047.481] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.blob") returned 0
	[0047.481] lstrlenA (lpString="*.blob") returned 6
	[0047.481] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.btc") returned 0
	[0047.481] lstrlenA (lpString="*.btc") returned 5
	[0047.481] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.wallet") returned 0
	[0047.481] lstrlenA (lpString="*.wallet") returned 8
	[0047.481] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x1, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1
	[0047.481] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0047.481] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="oobe_2017_09_07_03_08_57_737.log") returned -1
	[0047.481] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="oobe_2017_09_07_03_08_57_737.log") returned -1
	[0047.481] lstrcmpiA (lpString1="", lpString2="oobe_2017_09_07_03_08_57_737.log") returned -1
	[0047.481] PathFindFileNameA (pszPath="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned="downlevel_2017_09_07_02_02_39_766.log"
	[0047.481] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\$GetCurrent\\Logs\\" | out: lpString1="C:\\$GetCurrent\\Logs\\") returned="C:\\$GetCurrent\\Logs\\"
	[0047.481] PathAddBackslashA (in: pszPath="C:\\$GetCurrent\\Logs\\" | out: pszPath="C:\\$GetCurrent\\Logs\\") returned=""
	[0047.481] lstrcatA (in: lpString1="C:\\$GetCurrent\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\$GetCurrent\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\$GetCurrent\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0047.481] GetFileAttributesA (lpFileName="C:\\$GetCurrent\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\$getcurrent\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0047.481] lstrcatA (in: lpString1="C:\\$GetCurrent\\Logs\\", lpString2="oobe_2017_09_07_03_08_57_737.log" | out: lpString1="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log"
	[0047.481] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.zip") returned 0
	[0047.481] lstrlenA (lpString="*.zip") returned 5
	[0047.481] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.rar") returned 0
	[0047.481] lstrlenA (lpString="*.rar") returned 5
	[0047.481] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.7z") returned 0
	[0047.481] lstrlenA (lpString="*.7z") returned 4
	[0047.481] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.tar") returned 0
	[0047.481] lstrlenA (lpString="*.tar") returned 5
	[0047.481] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.gzip") returned 0
	[0047.481] lstrlenA (lpString="*.gzip") returned 6
	[0047.481] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.jpg") returned 0
	[0047.482] lstrlenA (lpString="*.jpg") returned 5
	[0047.482] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.jpeg") returned 0
	[0047.482] lstrlenA (lpString="*.jpeg") returned 6
	[0047.482] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.bmp") returned 0
	[0047.482] lstrlenA (lpString="*.bmp") returned 5
	[0047.482] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.gif") returned 0
	[0047.482] lstrlenA (lpString="*.gif") returned 5
	[0047.482] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.png") returned 0
	[0047.482] lstrlenA (lpString="*.png") returned 5
	[0047.482] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.doc") returned 0
	[0047.482] lstrlenA (lpString="*.doc") returned 5
	[0047.482] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.docx") returned 0
	[0047.482] lstrlenA (lpString="*.docx") returned 6
	[0047.482] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.xls") returned 0
	[0047.482] lstrlenA (lpString="*.xls") returned 5
	[0047.482] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.xlsx") returned 0
	[0047.482] lstrlenA (lpString="*.xlsx") returned 6
	[0047.482] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.ppt") returned 0
	[0047.482] lstrlenA (lpString="*.ppt") returned 5
	[0047.482] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.pptx") returned 0
	[0047.482] lstrlenA (lpString="*.pptx") returned 6
	[0047.482] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.txt") returned 0
	[0047.482] lstrlenA (lpString="*.txt") returned 5
	[0047.482] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.pdf") returned 0
	[0047.482] lstrlenA (lpString="*.pdf") returned 5
	[0047.482] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.htm") returned 0
	[0047.482] lstrlenA (lpString="*.htm") returned 5
	[0047.482] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.html") returned 0
	[0047.482] lstrlenA (lpString="*.html") returned 6
	[0047.482] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.mdb") returned 0
	[0047.482] lstrlenA (lpString="*.mdb") returned 5
	[0047.482] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.pfx") returned 0
	[0047.482] lstrlenA (lpString="*.pfx") returned 5
	[0047.482] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.md") returned 0
	[0047.482] lstrlenA (lpString="*.md") returned 4
	[0047.482] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.lnk") returned 0
	[0047.482] lstrlenA (lpString="*.lnk") returned 5
	[0047.483] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.torrent") returned 0
	[0047.483] lstrlenA (lpString="*.torrent") returned 9
	[0047.483] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.mov") returned 0
	[0047.483] lstrlenA (lpString="*.mov") returned 5
	[0047.483] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.3gp") returned 0
	[0047.483] lstrlenA (lpString="*.3gp") returned 5
	[0047.483] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.mpeg") returned 0
	[0047.483] lstrlenA (lpString="*.mpeg") returned 6
	[0047.483] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.mpg") returned 0
	[0047.483] lstrlenA (lpString="*.mpg") returned 5
	[0047.483] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.flv") returned 0
	[0047.483] lstrlenA (lpString="*.flv") returned 5
	[0047.483] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.avi") returned 0
	[0047.483] lstrlenA (lpString="*.avi") returned 5
	[0047.483] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.mp4") returned 0
	[0047.483] lstrlenA (lpString="*.mp4") returned 5
	[0047.483] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.wmv") returned 0
	[0047.483] lstrlenA (lpString="*.wmv") returned 5
	[0047.483] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.mkv") returned 0
	[0047.483] lstrlenA (lpString="*.mkv") returned 5
	[0047.483] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.mp3") returned 0
	[0047.483] lstrlenA (lpString="*.mp3") returned 5
	[0047.483] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.wav") returned 0
	[0047.483] lstrlenA (lpString="*.wav") returned 5
	[0047.483] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.flac") returned 0
	[0047.483] lstrlenA (lpString="*.flac") returned 6
	[0047.483] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.wma") returned 0
	[0047.483] lstrlenA (lpString="*.wma") returned 5
	[0047.483] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.au3") returned 0
	[0047.483] lstrlenA (lpString="*.au3") returned 5
	[0047.483] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.ahk") returned 0
	[0047.483] lstrlenA (lpString="*.ahk") returned 5
	[0047.483] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.c") returned 0
	[0047.483] lstrlenA (lpString="*.c") returned 3
	[0047.483] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.cc") returned 0
	[0047.483] lstrlenA (lpString="*.cc") returned 4
	[0047.483] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.cpp") returned 0
	[0047.483] lstrlenA (lpString="*.cpp") returned 5
	[0047.484] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.cxx") returned 0
	[0047.484] lstrlenA (lpString="*.cxx") returned 5
	[0047.484] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.c++") returned 0
	[0047.484] lstrlenA (lpString="*.c++") returned 5
	[0047.484] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.cs") returned 0
	[0047.484] lstrlenA (lpString="*.cs") returned 4
	[0047.484] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.vb") returned 0
	[0047.484] lstrlenA (lpString="*.vb") returned 4
	[0047.484] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.bas") returned 0
	[0047.484] lstrlenA (lpString="*.bas") returned 5
	[0047.484] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.csproj") returned 0
	[0047.484] lstrlenA (lpString="*.csproj") returned 8
	[0047.484] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.vbproj") returned 0
	[0047.484] lstrlenA (lpString="*.vbproj") returned 8
	[0047.484] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.vcxproj") returned 0
	[0047.484] lstrlenA (lpString="*.vcxproj") returned 9
	[0047.484] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.manifest") returned 0
	[0047.484] lstrlenA (lpString="*.manifest") returned 10
	[0047.484] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.php") returned 0
	[0047.484] lstrlenA (lpString="*.php") returned 5
	[0047.484] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.vbe") returned 0
	[0047.484] lstrlenA (lpString="*.vbe") returned 5
	[0047.484] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.vba") returned 0
	[0047.484] lstrlenA (lpString="*.vba") returned 5
	[0047.484] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.vbs") returned 0
	[0047.484] lstrlenA (lpString="*.vbs") returned 5
	[0047.484] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.bat") returned 0
	[0047.484] lstrlenA (lpString="*.bat") returned 5
	[0047.484] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.cmd") returned 0
	[0047.484] lstrlenA (lpString="*.cmd") returned 5
	[0047.484] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.js") returned 0
	[0047.484] lstrlenA (lpString="*.js") returned 4
	[0047.484] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.jscript") returned 0
	[0047.484] lstrlenA (lpString="*.jscript") returned 9
	[0047.484] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.hta") returned 0
	[0047.484] lstrlenA (lpString="*.hta") returned 5
	[0047.484] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.php7") returned 0
	[0047.485] lstrlenA (lpString="*.php7") returned 6
	[0047.485] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.db") returned 0
	[0047.485] lstrlenA (lpString="*.db") returned 4
	[0047.485] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.swf") returned 0
	[0047.485] lstrlenA (lpString="*.swf") returned 5
	[0047.485] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.eml") returned 0
	[0047.485] lstrlenA (lpString="*.eml") returned 5
	[0047.485] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.part") returned 0
	[0047.485] lstrlenA (lpString="*.part") returned 6
	[0047.485] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.nfo") returned 0
	[0047.485] lstrlenA (lpString="*.nfo") returned 5
	[0047.485] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.rsa") returned 0
	[0047.485] lstrlenA (lpString="*.rsa") returned 5
	[0047.485] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.key") returned 0
	[0047.485] lstrlenA (lpString="*.key") returned 5
	[0047.485] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.aes") returned 0
	[0047.485] lstrlenA (lpString="*.aes") returned 5
	[0047.485] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.blob") returned 0
	[0047.485] lstrlenA (lpString="*.blob") returned 6
	[0047.485] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.btc") returned 0
	[0047.485] lstrlenA (lpString="*.btc") returned 5
	[0047.485] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.wallet") returned 0
	[0047.485] lstrlenA (lpString="*.wallet") returned 8
	[0047.485] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1
	[0047.485] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0047.485] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PartnerSetupCompleteResult.log") returned -1
	[0047.485] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PartnerSetupCompleteResult.log") returned -1
	[0047.485] lstrcmpiA (lpString1="", lpString2="PartnerSetupCompleteResult.log") returned -1
	[0047.485] PathFindFileNameA (pszPath="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned="oobe_2017_09_07_03_08_57_737.log"
	[0047.485] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\$GetCurrent\\Logs\\" | out: lpString1="C:\\$GetCurrent\\Logs\\") returned="C:\\$GetCurrent\\Logs\\"
	[0047.485] PathAddBackslashA (in: pszPath="C:\\$GetCurrent\\Logs\\" | out: pszPath="C:\\$GetCurrent\\Logs\\") returned=""
	[0047.485] lstrcatA (in: lpString1="C:\\$GetCurrent\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\$GetCurrent\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\$GetCurrent\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0047.485] GetFileAttributesA (lpFileName="C:\\$GetCurrent\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\$getcurrent\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0047.485] lstrcatA (in: lpString1="C:\\$GetCurrent\\Logs\\", lpString2="PartnerSetupCompleteResult.log" | out: lpString1="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log"
	[0047.485] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.zip") returned 0
	[0047.486] lstrlenA (lpString="*.zip") returned 5
	[0047.486] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.rar") returned 0
	[0047.486] lstrlenA (lpString="*.rar") returned 5
	[0047.486] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.7z") returned 0
	[0047.486] lstrlenA (lpString="*.7z") returned 4
	[0047.486] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.tar") returned 0
	[0047.486] lstrlenA (lpString="*.tar") returned 5
	[0047.486] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.gzip") returned 0
	[0047.486] lstrlenA (lpString="*.gzip") returned 6
	[0047.486] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.jpg") returned 0
	[0047.486] lstrlenA (lpString="*.jpg") returned 5
	[0047.486] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.jpeg") returned 0
	[0047.486] lstrlenA (lpString="*.jpeg") returned 6
	[0047.486] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.bmp") returned 0
	[0047.486] lstrlenA (lpString="*.bmp") returned 5
	[0047.486] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.gif") returned 0
	[0047.486] lstrlenA (lpString="*.gif") returned 5
	[0047.486] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.png") returned 0
	[0047.486] lstrlenA (lpString="*.png") returned 5
	[0047.486] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.doc") returned 0
	[0047.486] lstrlenA (lpString="*.doc") returned 5
	[0047.486] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.docx") returned 0
	[0047.486] lstrlenA (lpString="*.docx") returned 6
	[0047.486] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.xls") returned 0
	[0047.486] lstrlenA (lpString="*.xls") returned 5
	[0047.486] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.xlsx") returned 0
	[0047.486] lstrlenA (lpString="*.xlsx") returned 6
	[0047.486] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.ppt") returned 0
	[0047.486] lstrlenA (lpString="*.ppt") returned 5
	[0047.486] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.pptx") returned 0
	[0047.486] lstrlenA (lpString="*.pptx") returned 6
	[0047.486] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.txt") returned 0
	[0047.486] lstrlenA (lpString="*.txt") returned 5
	[0047.486] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.pdf") returned 0
	[0047.486] lstrlenA (lpString="*.pdf") returned 5
	[0047.486] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.htm") returned 0
	[0047.487] lstrlenA (lpString="*.htm") returned 5
	[0047.487] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.html") returned 0
	[0047.487] lstrlenA (lpString="*.html") returned 6
	[0047.487] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.mdb") returned 0
	[0047.487] lstrlenA (lpString="*.mdb") returned 5
	[0047.487] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.pfx") returned 0
	[0047.487] lstrlenA (lpString="*.pfx") returned 5
	[0047.487] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.md") returned 0
	[0047.487] lstrlenA (lpString="*.md") returned 4
	[0047.487] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.lnk") returned 0
	[0047.487] lstrlenA (lpString="*.lnk") returned 5
	[0047.487] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.torrent") returned 0
	[0047.487] lstrlenA (lpString="*.torrent") returned 9
	[0047.487] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.mov") returned 0
	[0047.487] lstrlenA (lpString="*.mov") returned 5
	[0047.487] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.3gp") returned 0
	[0047.487] lstrlenA (lpString="*.3gp") returned 5
	[0047.487] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.mpeg") returned 0
	[0047.487] lstrlenA (lpString="*.mpeg") returned 6
	[0047.487] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.mpg") returned 0
	[0047.487] lstrlenA (lpString="*.mpg") returned 5
	[0047.487] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.flv") returned 0
	[0047.487] lstrlenA (lpString="*.flv") returned 5
	[0047.487] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.avi") returned 0
	[0047.487] lstrlenA (lpString="*.avi") returned 5
	[0047.487] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.mp4") returned 0
	[0047.487] lstrlenA (lpString="*.mp4") returned 5
	[0047.487] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.wmv") returned 0
	[0047.487] lstrlenA (lpString="*.wmv") returned 5
	[0047.487] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.mkv") returned 0
	[0047.487] lstrlenA (lpString="*.mkv") returned 5
	[0047.487] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.mp3") returned 0
	[0047.487] lstrlenA (lpString="*.mp3") returned 5
	[0047.487] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.wav") returned 0
	[0047.487] lstrlenA (lpString="*.wav") returned 5
	[0047.487] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.flac") returned 0
	[0047.487] lstrlenA (lpString="*.flac") returned 6
	[0047.488] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.wma") returned 0
	[0047.488] lstrlenA (lpString="*.wma") returned 5
	[0047.488] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.au3") returned 0
	[0047.488] lstrlenA (lpString="*.au3") returned 5
	[0047.488] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.ahk") returned 0
	[0047.488] lstrlenA (lpString="*.ahk") returned 5
	[0047.488] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.c") returned 0
	[0047.488] lstrlenA (lpString="*.c") returned 3
	[0047.488] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.cc") returned 0
	[0047.488] lstrlenA (lpString="*.cc") returned 4
	[0047.488] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.cpp") returned 0
	[0047.488] lstrlenA (lpString="*.cpp") returned 5
	[0047.488] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.cxx") returned 0
	[0047.488] lstrlenA (lpString="*.cxx") returned 5
	[0047.488] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.c++") returned 0
	[0047.488] lstrlenA (lpString="*.c++") returned 5
	[0047.488] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.cs") returned 0
	[0047.488] lstrlenA (lpString="*.cs") returned 4
	[0047.488] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.vb") returned 0
	[0047.488] lstrlenA (lpString="*.vb") returned 4
	[0047.488] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.bas") returned 0
	[0047.488] lstrlenA (lpString="*.bas") returned 5
	[0047.488] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.csproj") returned 0
	[0047.488] lstrlenA (lpString="*.csproj") returned 8
	[0047.488] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.vbproj") returned 0
	[0047.488] lstrlenA (lpString="*.vbproj") returned 8
	[0047.488] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.vcxproj") returned 0
	[0047.488] lstrlenA (lpString="*.vcxproj") returned 9
	[0047.488] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.manifest") returned 0
	[0047.488] lstrlenA (lpString="*.manifest") returned 10
	[0047.488] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.php") returned 0
	[0047.488] lstrlenA (lpString="*.php") returned 5
	[0047.488] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.vbe") returned 0
	[0047.488] lstrlenA (lpString="*.vbe") returned 5
	[0047.488] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.vba") returned 0
	[0047.488] lstrlenA (lpString="*.vba") returned 5
	[0047.488] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.vbs") returned 0
	[0047.489] lstrlenA (lpString="*.vbs") returned 5
	[0047.489] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.bat") returned 0
	[0047.489] lstrlenA (lpString="*.bat") returned 5
	[0047.489] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.cmd") returned 0
	[0047.489] lstrlenA (lpString="*.cmd") returned 5
	[0047.489] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.js") returned 0
	[0047.489] lstrlenA (lpString="*.js") returned 4
	[0047.489] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.jscript") returned 0
	[0047.489] lstrlenA (lpString="*.jscript") returned 9
	[0047.489] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.hta") returned 0
	[0047.489] lstrlenA (lpString="*.hta") returned 5
	[0047.489] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.php7") returned 0
	[0047.489] lstrlenA (lpString="*.php7") returned 6
	[0047.489] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.db") returned 0
	[0047.489] lstrlenA (lpString="*.db") returned 4
	[0047.489] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.swf") returned 0
	[0047.489] lstrlenA (lpString="*.swf") returned 5
	[0047.489] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.eml") returned 0
	[0047.489] lstrlenA (lpString="*.eml") returned 5
	[0047.489] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.part") returned 0
	[0047.489] lstrlenA (lpString="*.part") returned 6
	[0047.489] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.nfo") returned 0
	[0047.489] lstrlenA (lpString="*.nfo") returned 5
	[0047.489] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.rsa") returned 0
	[0047.489] lstrlenA (lpString="*.rsa") returned 5
	[0047.489] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.key") returned 0
	[0047.489] lstrlenA (lpString="*.key") returned 5
	[0047.489] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.aes") returned 0
	[0047.489] lstrlenA (lpString="*.aes") returned 5
	[0047.489] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.blob") returned 0
	[0047.489] lstrlenA (lpString="*.blob") returned 6
	[0047.489] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.btc") returned 0
	[0047.489] lstrlenA (lpString="*.btc") returned 5
	[0047.489] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.wallet") returned 0
	[0047.489] lstrlenA (lpString="*.wallet") returned 8
	[0047.489] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 0
	[0047.490] FindClose (in: hFindFile=0x7cb790 | out: hFindFile=0x7cb790) returned 1
	[0047.490] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d0d38, dwReserved1=0x7b00c0, cFileName="SafeOS", cAlternateFileName="")) returned 1
	[0047.490] lstrcmpA (lpString1=".", lpString2="SafeOS") returned -1
	[0047.490] lstrcmpA (lpString1="..", lpString2="SafeOS") returned -1
	[0047.490] PathFindFileNameA (pszPath="C:\\$GetCurrent\\*.*") returned="*.*"
	[0047.490] lstrcatA (in: lpString1="C:\\$GetCurrent\\", lpString2="SafeOS" | out: lpString1="C:\\$GetCurrent\\SafeOS") returned="C:\\$GetCurrent\\SafeOS"
	[0047.490] lstrlenA (lpString="C:\\$GetCurrent\\SafeOS") returned 21
	[0047.490] FindFirstFileA (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbad0
	[0047.492] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0047.492] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0047.492] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0047.493] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0047.493] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1
	[0047.493] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0047.493] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="GetCurrentOOBE.dll") returned -1
	[0047.493] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="GetCurrentOOBE.dll") returned 1
	[0047.493] lstrcmpiA (lpString1="", lpString2="GetCurrentOOBE.dll") returned -1
	[0047.493] PathFindFileNameA (pszPath="C:\\$GetCurrent\\SafeOS\\*.*") returned="*.*"
	[0047.493] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\$GetCurrent\\SafeOS\\" | out: lpString1="C:\\$GetCurrent\\SafeOS\\") returned="C:\\$GetCurrent\\SafeOS\\"
	[0047.493] PathAddBackslashA (in: pszPath="C:\\$GetCurrent\\SafeOS\\" | out: pszPath="C:\\$GetCurrent\\SafeOS\\") returned=""
	[0047.493] lstrcatA (in: lpString1="C:\\$GetCurrent\\SafeOS\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\$GetCurrent\\SafeOS\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\$GetCurrent\\SafeOS\\HOW-TO-DECRYPT-FILES.HTM"
	[0047.493] GetFileAttributesA (lpFileName="C:\\$GetCurrent\\SafeOS\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\$getcurrent\\safeos\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0047.493] CreateFileA (lpFileName="C:\\$GetCurrent\\SafeOS\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\$getcurrent\\safeos\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0047.493] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0047.493] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0047.494] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0047.494] CloseHandle (hObject=0x208) returned 1
	[0047.494] lstrcatA (in: lpString1="C:\\$GetCurrent\\SafeOS\\", lpString2="GetCurrentOOBE.dll" | out: lpString1="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll"
	[0047.495] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.zip") returned 0
	[0047.495] lstrlenA (lpString="*.zip") returned 5
	[0047.495] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.rar") returned 0
	[0047.495] lstrlenA (lpString="*.rar") returned 5
	[0047.495] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.7z") returned 0
	[0047.495] lstrlenA (lpString="*.7z") returned 4
	[0047.495] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.tar") returned 0
	[0047.495] lstrlenA (lpString="*.tar") returned 5
	[0047.495] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.gzip") returned 0
	[0047.495] lstrlenA (lpString="*.gzip") returned 6
	[0047.495] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.jpg") returned 0
	[0047.495] lstrlenA (lpString="*.jpg") returned 5
	[0047.495] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.jpeg") returned 0
	[0047.495] lstrlenA (lpString="*.jpeg") returned 6
	[0047.495] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.bmp") returned 0
	[0047.495] lstrlenA (lpString="*.bmp") returned 5
	[0047.495] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.gif") returned 0
	[0047.495] lstrlenA (lpString="*.gif") returned 5
	[0047.495] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.png") returned 0
	[0047.495] lstrlenA (lpString="*.png") returned 5
	[0047.495] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.doc") returned 0
	[0047.495] lstrlenA (lpString="*.doc") returned 5
	[0047.495] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.docx") returned 0
	[0047.495] lstrlenA (lpString="*.docx") returned 6
	[0047.495] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.xls") returned 0
	[0047.495] lstrlenA (lpString="*.xls") returned 5
	[0047.495] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.xlsx") returned 0
	[0047.495] lstrlenA (lpString="*.xlsx") returned 6
	[0047.495] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.ppt") returned 0
	[0047.495] lstrlenA (lpString="*.ppt") returned 5
	[0047.495] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.pptx") returned 0
	[0047.495] lstrlenA (lpString="*.pptx") returned 6
	[0047.495] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.txt") returned 0
	[0047.495] lstrlenA (lpString="*.txt") returned 5
	[0047.495] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.pdf") returned 0
	[0047.495] lstrlenA (lpString="*.pdf") returned 5
	[0047.496] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.htm") returned 0
	[0047.496] lstrlenA (lpString="*.htm") returned 5
	[0047.496] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.html") returned 0
	[0047.496] lstrlenA (lpString="*.html") returned 6
	[0047.496] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.mdb") returned 0
	[0047.496] lstrlenA (lpString="*.mdb") returned 5
	[0047.496] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.pfx") returned 0
	[0047.496] lstrlenA (lpString="*.pfx") returned 5
	[0047.496] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.md") returned 0
	[0047.496] lstrlenA (lpString="*.md") returned 4
	[0047.496] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.lnk") returned 0
	[0047.496] lstrlenA (lpString="*.lnk") returned 5
	[0047.496] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.torrent") returned 0
	[0047.496] lstrlenA (lpString="*.torrent") returned 9
	[0047.496] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.mov") returned 0
	[0047.496] lstrlenA (lpString="*.mov") returned 5
	[0047.496] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.3gp") returned 0
	[0047.496] lstrlenA (lpString="*.3gp") returned 5
	[0047.496] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.mpeg") returned 0
	[0047.496] lstrlenA (lpString="*.mpeg") returned 6
	[0047.496] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.mpg") returned 0
	[0047.496] lstrlenA (lpString="*.mpg") returned 5
	[0047.496] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.flv") returned 0
	[0047.496] lstrlenA (lpString="*.flv") returned 5
	[0047.496] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.avi") returned 0
	[0047.496] lstrlenA (lpString="*.avi") returned 5
	[0047.496] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.mp4") returned 0
	[0047.496] lstrlenA (lpString="*.mp4") returned 5
	[0047.496] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.wmv") returned 0
	[0047.496] lstrlenA (lpString="*.wmv") returned 5
	[0047.496] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.mkv") returned 0
	[0047.496] lstrlenA (lpString="*.mkv") returned 5
	[0047.496] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.mp3") returned 0
	[0047.496] lstrlenA (lpString="*.mp3") returned 5
	[0047.496] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.wav") returned 0
	[0047.496] lstrlenA (lpString="*.wav") returned 5
	[0047.496] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.flac") returned 0
	[0047.497] lstrlenA (lpString="*.flac") returned 6
	[0047.497] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.wma") returned 0
	[0047.497] lstrlenA (lpString="*.wma") returned 5
	[0047.497] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.au3") returned 0
	[0047.497] lstrlenA (lpString="*.au3") returned 5
	[0047.497] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.ahk") returned 0
	[0047.497] lstrlenA (lpString="*.ahk") returned 5
	[0047.497] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.c") returned 0
	[0047.497] lstrlenA (lpString="*.c") returned 3
	[0047.497] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.cc") returned 0
	[0047.497] lstrlenA (lpString="*.cc") returned 4
	[0047.497] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.cpp") returned 0
	[0047.497] lstrlenA (lpString="*.cpp") returned 5
	[0047.497] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.cxx") returned 0
	[0047.497] lstrlenA (lpString="*.cxx") returned 5
	[0047.497] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.c++") returned 0
	[0047.497] lstrlenA (lpString="*.c++") returned 5
	[0047.497] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.cs") returned 0
	[0047.497] lstrlenA (lpString="*.cs") returned 4
	[0047.497] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.vb") returned 0
	[0047.497] lstrlenA (lpString="*.vb") returned 4
	[0047.497] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.bas") returned 0
	[0047.497] lstrlenA (lpString="*.bas") returned 5
	[0047.497] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.csproj") returned 0
	[0047.497] lstrlenA (lpString="*.csproj") returned 8
	[0047.497] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.vbproj") returned 0
	[0047.497] lstrlenA (lpString="*.vbproj") returned 8
	[0047.497] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.vcxproj") returned 0
	[0047.497] lstrlenA (lpString="*.vcxproj") returned 9
	[0047.497] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.manifest") returned 0
	[0047.497] lstrlenA (lpString="*.manifest") returned 10
	[0047.497] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.php") returned 0
	[0047.497] lstrlenA (lpString="*.php") returned 5
	[0047.497] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.vbe") returned 0
	[0047.497] lstrlenA (lpString="*.vbe") returned 5
	[0047.497] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.vba") returned 0
	[0047.498] lstrlenA (lpString="*.vba") returned 5
	[0047.498] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.vbs") returned 0
	[0047.498] lstrlenA (lpString="*.vbs") returned 5
	[0047.498] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.bat") returned 0
	[0047.498] lstrlenA (lpString="*.bat") returned 5
	[0047.498] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.cmd") returned 0
	[0047.498] lstrlenA (lpString="*.cmd") returned 5
	[0047.498] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.js") returned 0
	[0047.498] lstrlenA (lpString="*.js") returned 4
	[0047.498] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.jscript") returned 0
	[0047.498] lstrlenA (lpString="*.jscript") returned 9
	[0047.498] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.hta") returned 0
	[0047.498] lstrlenA (lpString="*.hta") returned 5
	[0047.498] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.php7") returned 0
	[0047.498] lstrlenA (lpString="*.php7") returned 6
	[0047.498] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.db") returned 0
	[0047.498] lstrlenA (lpString="*.db") returned 4
	[0047.498] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.swf") returned 0
	[0047.498] lstrlenA (lpString="*.swf") returned 5
	[0047.498] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.eml") returned 0
	[0047.498] lstrlenA (lpString="*.eml") returned 5
	[0047.498] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.part") returned 0
	[0047.498] lstrlenA (lpString="*.part") returned 6
	[0047.498] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.nfo") returned 0
	[0047.498] lstrlenA (lpString="*.nfo") returned 5
	[0047.498] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.rsa") returned 0
	[0047.498] lstrlenA (lpString="*.rsa") returned 5
	[0047.498] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.key") returned 0
	[0047.498] lstrlenA (lpString="*.key") returned 5
	[0047.498] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.aes") returned 0
	[0047.498] lstrlenA (lpString="*.aes") returned 5
	[0047.498] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.blob") returned 0
	[0047.498] lstrlenA (lpString="*.blob") returned 6
	[0047.498] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.btc") returned 0
	[0047.498] lstrlenA (lpString="*.btc") returned 5
	[0047.498] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.wallet") returned 0
	[0047.498] lstrlenA (lpString="*.wallet") returned 8
	[0047.499] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x1, cFileName="GetCurrentRollback.ini", cAlternateFileName="GETCUR~1.INI")) returned 1
	[0047.499] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0047.499] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="GetCurrentRollback.ini") returned -1
	[0047.499] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="GetCurrentRollback.ini") returned 1
	[0047.499] lstrcmpiA (lpString1="", lpString2="GetCurrentRollback.ini") returned -1
	[0047.499] PathFindFileNameA (pszPath="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned="GetCurrentOOBE.dll"
	[0047.499] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\$GetCurrent\\SafeOS\\" | out: lpString1="C:\\$GetCurrent\\SafeOS\\") returned="C:\\$GetCurrent\\SafeOS\\"
	[0047.499] PathAddBackslashA (in: pszPath="C:\\$GetCurrent\\SafeOS\\" | out: pszPath="C:\\$GetCurrent\\SafeOS\\") returned=""
	[0047.499] lstrcatA (in: lpString1="C:\\$GetCurrent\\SafeOS\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\$GetCurrent\\SafeOS\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\$GetCurrent\\SafeOS\\HOW-TO-DECRYPT-FILES.HTM"
	[0047.499] GetFileAttributesA (lpFileName="C:\\$GetCurrent\\SafeOS\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\$getcurrent\\safeos\\how-to-decrypt-files.htm")) returned 0x20
	[0047.499] lstrcatA (in: lpString1="C:\\$GetCurrent\\SafeOS\\", lpString2="GetCurrentRollback.ini" | out: lpString1="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini"
	[0047.499] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.zip") returned 0
	[0047.499] lstrlenA (lpString="*.zip") returned 5
	[0047.499] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.rar") returned 0
	[0047.499] lstrlenA (lpString="*.rar") returned 5
	[0047.499] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.7z") returned 0
	[0047.499] lstrlenA (lpString="*.7z") returned 4
	[0047.499] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.tar") returned 0
	[0047.499] lstrlenA (lpString="*.tar") returned 5
	[0047.499] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.gzip") returned 0
	[0047.499] lstrlenA (lpString="*.gzip") returned 6
	[0047.499] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.jpg") returned 0
	[0047.499] lstrlenA (lpString="*.jpg") returned 5
	[0047.499] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.jpeg") returned 0
	[0047.499] lstrlenA (lpString="*.jpeg") returned 6
	[0047.499] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.bmp") returned 0
	[0047.499] lstrlenA (lpString="*.bmp") returned 5
	[0047.499] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.gif") returned 0
	[0047.499] lstrlenA (lpString="*.gif") returned 5
	[0047.499] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.png") returned 0
	[0047.499] lstrlenA (lpString="*.png") returned 5
	[0047.499] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.doc") returned 0
	[0047.499] lstrlenA (lpString="*.doc") returned 5
	[0047.500] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.docx") returned 0
	[0047.500] lstrlenA (lpString="*.docx") returned 6
	[0047.500] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.xls") returned 0
	[0047.500] lstrlenA (lpString="*.xls") returned 5
	[0047.500] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.xlsx") returned 0
	[0047.500] lstrlenA (lpString="*.xlsx") returned 6
	[0047.500] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.ppt") returned 0
	[0047.500] lstrlenA (lpString="*.ppt") returned 5
	[0047.500] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.pptx") returned 0
	[0047.500] lstrlenA (lpString="*.pptx") returned 6
	[0047.500] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.txt") returned 0
	[0047.500] lstrlenA (lpString="*.txt") returned 5
	[0047.500] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.pdf") returned 0
	[0047.500] lstrlenA (lpString="*.pdf") returned 5
	[0047.500] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.htm") returned 0
	[0047.500] lstrlenA (lpString="*.htm") returned 5
	[0047.500] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.html") returned 0
	[0047.500] lstrlenA (lpString="*.html") returned 6
	[0047.500] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.mdb") returned 0
	[0047.500] lstrlenA (lpString="*.mdb") returned 5
	[0047.500] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.pfx") returned 0
	[0047.500] lstrlenA (lpString="*.pfx") returned 5
	[0047.500] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.md") returned 0
	[0047.500] lstrlenA (lpString="*.md") returned 4
	[0047.500] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.lnk") returned 0
	[0047.500] lstrlenA (lpString="*.lnk") returned 5
	[0047.500] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.torrent") returned 0
	[0047.500] lstrlenA (lpString="*.torrent") returned 9
	[0047.500] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.mov") returned 0
	[0047.500] lstrlenA (lpString="*.mov") returned 5
	[0047.500] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.3gp") returned 0
	[0047.500] lstrlenA (lpString="*.3gp") returned 5
	[0047.500] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.mpeg") returned 0
	[0047.500] lstrlenA (lpString="*.mpeg") returned 6
	[0047.500] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.mpg") returned 0
	[0047.500] lstrlenA (lpString="*.mpg") returned 5
	[0047.501] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.flv") returned 0
	[0047.501] lstrlenA (lpString="*.flv") returned 5
	[0047.501] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.avi") returned 0
	[0047.501] lstrlenA (lpString="*.avi") returned 5
	[0047.501] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.mp4") returned 0
	[0047.501] lstrlenA (lpString="*.mp4") returned 5
	[0047.501] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.wmv") returned 0
	[0047.501] lstrlenA (lpString="*.wmv") returned 5
	[0047.501] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.mkv") returned 0
	[0047.501] lstrlenA (lpString="*.mkv") returned 5
	[0047.501] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.mp3") returned 0
	[0047.501] lstrlenA (lpString="*.mp3") returned 5
	[0047.501] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.wav") returned 0
	[0047.501] lstrlenA (lpString="*.wav") returned 5
	[0047.501] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.flac") returned 0
	[0047.501] lstrlenA (lpString="*.flac") returned 6
	[0047.501] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.wma") returned 0
	[0047.501] lstrlenA (lpString="*.wma") returned 5
	[0047.501] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.au3") returned 0
	[0047.501] lstrlenA (lpString="*.au3") returned 5
	[0047.501] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.ahk") returned 0
	[0047.501] lstrlenA (lpString="*.ahk") returned 5
	[0047.501] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.c") returned 0
	[0047.501] lstrlenA (lpString="*.c") returned 3
	[0047.501] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.cc") returned 0
	[0047.501] lstrlenA (lpString="*.cc") returned 4
	[0047.501] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.cpp") returned 0
	[0047.501] lstrlenA (lpString="*.cpp") returned 5
	[0047.501] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.cxx") returned 0
	[0047.501] lstrlenA (lpString="*.cxx") returned 5
	[0047.501] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.c++") returned 0
	[0047.501] lstrlenA (lpString="*.c++") returned 5
	[0047.501] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.cs") returned 0
	[0047.501] lstrlenA (lpString="*.cs") returned 4
	[0047.501] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.vb") returned 0
	[0047.501] lstrlenA (lpString="*.vb") returned 4
	[0047.501] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.bas") returned 0
	[0047.502] lstrlenA (lpString="*.bas") returned 5
	[0047.502] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.csproj") returned 0
	[0047.502] lstrlenA (lpString="*.csproj") returned 8
	[0047.502] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.vbproj") returned 0
	[0047.502] lstrlenA (lpString="*.vbproj") returned 8
	[0047.502] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.vcxproj") returned 0
	[0047.502] lstrlenA (lpString="*.vcxproj") returned 9
	[0047.502] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.manifest") returned 0
	[0047.502] lstrlenA (lpString="*.manifest") returned 10
	[0047.502] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.php") returned 0
	[0047.502] lstrlenA (lpString="*.php") returned 5
	[0047.502] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.vbe") returned 0
	[0047.502] lstrlenA (lpString="*.vbe") returned 5
	[0047.502] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.vba") returned 0
	[0047.502] lstrlenA (lpString="*.vba") returned 5
	[0047.502] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.vbs") returned 0
	[0047.502] lstrlenA (lpString="*.vbs") returned 5
	[0047.502] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.bat") returned 0
	[0047.502] lstrlenA (lpString="*.bat") returned 5
	[0047.502] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.cmd") returned 0
	[0047.502] lstrlenA (lpString="*.cmd") returned 5
	[0047.502] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.js") returned 0
	[0047.502] lstrlenA (lpString="*.js") returned 4
	[0047.502] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.jscript") returned 0
	[0047.502] lstrlenA (lpString="*.jscript") returned 9
	[0047.502] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.hta") returned 0
	[0047.502] lstrlenA (lpString="*.hta") returned 5
	[0047.502] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.php7") returned 0
	[0047.502] lstrlenA (lpString="*.php7") returned 6
	[0047.502] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.db") returned 0
	[0047.502] lstrlenA (lpString="*.db") returned 4
	[0047.502] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.swf") returned 0
	[0047.502] lstrlenA (lpString="*.swf") returned 5
	[0047.502] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.eml") returned 0
	[0047.502] lstrlenA (lpString="*.eml") returned 5
	[0047.502] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.part") returned 0
	[0047.503] lstrlenA (lpString="*.part") returned 6
	[0047.503] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.nfo") returned 0
	[0047.503] lstrlenA (lpString="*.nfo") returned 5
	[0047.503] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.rsa") returned 0
	[0047.503] lstrlenA (lpString="*.rsa") returned 5
	[0047.503] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.key") returned 0
	[0047.503] lstrlenA (lpString="*.key") returned 5
	[0047.503] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.aes") returned 0
	[0047.503] lstrlenA (lpString="*.aes") returned 5
	[0047.503] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.blob") returned 0
	[0047.503] lstrlenA (lpString="*.blob") returned 6
	[0047.503] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.btc") returned 0
	[0047.503] lstrlenA (lpString="*.btc") returned 5
	[0047.503] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.wallet") returned 0
	[0047.503] lstrlenA (lpString="*.wallet") returned 8
	[0047.503] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1
	[0047.503] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0047.503] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PartnerSetupComplete.cmd") returned -1
	[0047.503] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PartnerSetupComplete.cmd") returned -1
	[0047.503] lstrcmpiA (lpString1="", lpString2="PartnerSetupComplete.cmd") returned -1
	[0047.503] PathFindFileNameA (pszPath="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned="GetCurrentRollback.ini"
	[0047.503] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\$GetCurrent\\SafeOS\\" | out: lpString1="C:\\$GetCurrent\\SafeOS\\") returned="C:\\$GetCurrent\\SafeOS\\"
	[0047.503] PathAddBackslashA (in: pszPath="C:\\$GetCurrent\\SafeOS\\" | out: pszPath="C:\\$GetCurrent\\SafeOS\\") returned=""
	[0047.503] lstrcatA (in: lpString1="C:\\$GetCurrent\\SafeOS\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\$GetCurrent\\SafeOS\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\$GetCurrent\\SafeOS\\HOW-TO-DECRYPT-FILES.HTM"
	[0047.503] GetFileAttributesA (lpFileName="C:\\$GetCurrent\\SafeOS\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\$getcurrent\\safeos\\how-to-decrypt-files.htm")) returned 0x20
	[0047.503] lstrcatA (in: lpString1="C:\\$GetCurrent\\SafeOS\\", lpString2="PartnerSetupComplete.cmd" | out: lpString1="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd"
	[0047.503] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.zip") returned 0
	[0047.503] lstrlenA (lpString="*.zip") returned 5
	[0047.503] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.rar") returned 0
	[0047.503] lstrlenA (lpString="*.rar") returned 5
	[0047.503] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.7z") returned 0
	[0047.503] lstrlenA (lpString="*.7z") returned 4
	[0047.503] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.tar") returned 0
	[0047.503] lstrlenA (lpString="*.tar") returned 5
	[0047.504] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.gzip") returned 0
	[0047.504] lstrlenA (lpString="*.gzip") returned 6
	[0047.504] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.jpg") returned 0
	[0047.504] lstrlenA (lpString="*.jpg") returned 5
	[0047.504] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.jpeg") returned 0
	[0047.504] lstrlenA (lpString="*.jpeg") returned 6
	[0047.504] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.bmp") returned 0
	[0047.504] lstrlenA (lpString="*.bmp") returned 5
	[0047.504] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.gif") returned 0
	[0047.504] lstrlenA (lpString="*.gif") returned 5
	[0047.504] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.png") returned 0
	[0047.504] lstrlenA (lpString="*.png") returned 5
	[0047.504] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.doc") returned 0
	[0047.504] lstrlenA (lpString="*.doc") returned 5
	[0047.504] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.docx") returned 0
	[0047.504] lstrlenA (lpString="*.docx") returned 6
	[0047.504] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.xls") returned 0
	[0047.504] lstrlenA (lpString="*.xls") returned 5
	[0047.504] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.xlsx") returned 0
	[0047.504] lstrlenA (lpString="*.xlsx") returned 6
	[0047.504] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.ppt") returned 0
	[0047.504] lstrlenA (lpString="*.ppt") returned 5
	[0047.504] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.pptx") returned 0
	[0047.504] lstrlenA (lpString="*.pptx") returned 6
	[0047.504] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.txt") returned 0
	[0047.504] lstrlenA (lpString="*.txt") returned 5
	[0047.504] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.pdf") returned 0
	[0047.504] lstrlenA (lpString="*.pdf") returned 5
	[0047.504] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.htm") returned 0
	[0047.504] lstrlenA (lpString="*.htm") returned 5
	[0047.504] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.html") returned 0
	[0047.504] lstrlenA (lpString="*.html") returned 6
	[0047.504] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.mdb") returned 0
	[0047.504] lstrlenA (lpString="*.mdb") returned 5
	[0047.504] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.pfx") returned 0
	[0047.504] lstrlenA (lpString="*.pfx") returned 5
	[0047.504] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.md") returned 0
	[0047.505] lstrlenA (lpString="*.md") returned 4
	[0047.505] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.lnk") returned 0
	[0047.505] lstrlenA (lpString="*.lnk") returned 5
	[0047.505] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.torrent") returned 0
	[0047.505] lstrlenA (lpString="*.torrent") returned 9
	[0047.505] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.mov") returned 0
	[0047.505] lstrlenA (lpString="*.mov") returned 5
	[0047.505] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.3gp") returned 0
	[0047.505] lstrlenA (lpString="*.3gp") returned 5
	[0047.505] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.mpeg") returned 0
	[0047.505] lstrlenA (lpString="*.mpeg") returned 6
	[0047.505] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.mpg") returned 0
	[0047.505] lstrlenA (lpString="*.mpg") returned 5
	[0047.505] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.flv") returned 0
	[0047.505] lstrlenA (lpString="*.flv") returned 5
	[0047.505] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.avi") returned 0
	[0047.505] lstrlenA (lpString="*.avi") returned 5
	[0047.505] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.mp4") returned 0
	[0047.505] lstrlenA (lpString="*.mp4") returned 5
	[0047.505] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.wmv") returned 0
	[0047.505] lstrlenA (lpString="*.wmv") returned 5
	[0047.505] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.mkv") returned 0
	[0047.505] lstrlenA (lpString="*.mkv") returned 5
	[0047.505] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.mp3") returned 0
	[0047.505] lstrlenA (lpString="*.mp3") returned 5
	[0047.505] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.wav") returned 0
	[0047.505] lstrlenA (lpString="*.wav") returned 5
	[0047.505] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.flac") returned 0
	[0047.505] lstrlenA (lpString="*.flac") returned 6
	[0047.505] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.wma") returned 0
	[0047.505] lstrlenA (lpString="*.wma") returned 5
	[0047.505] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.au3") returned 0
	[0047.505] lstrlenA (lpString="*.au3") returned 5
	[0047.505] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.ahk") returned 0
	[0047.505] lstrlenA (lpString="*.ahk") returned 5
	[0047.505] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.c") returned 0
	[0047.505] lstrlenA (lpString="*.c") returned 3
	[0047.532] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.cc") returned 0
	[0047.532] lstrlenA (lpString="*.cc") returned 4
	[0047.532] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.cpp") returned 0
	[0047.532] lstrlenA (lpString="*.cpp") returned 5
	[0047.532] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.cxx") returned 0
	[0047.532] lstrlenA (lpString="*.cxx") returned 5
	[0047.532] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.c++") returned 0
	[0047.532] lstrlenA (lpString="*.c++") returned 5
	[0047.533] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.cs") returned 0
	[0047.533] lstrlenA (lpString="*.cs") returned 4
	[0047.533] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.vb") returned 0
	[0047.533] lstrlenA (lpString="*.vb") returned 4
	[0047.533] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.bas") returned 0
	[0047.533] lstrlenA (lpString="*.bas") returned 5
	[0047.533] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.csproj") returned 0
	[0047.533] lstrlenA (lpString="*.csproj") returned 8
	[0047.533] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.vbproj") returned 0
	[0047.533] lstrlenA (lpString="*.vbproj") returned 8
	[0047.533] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.vcxproj") returned 0
	[0047.533] lstrlenA (lpString="*.vcxproj") returned 9
	[0047.533] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.manifest") returned 0
	[0047.533] lstrlenA (lpString="*.manifest") returned 10
	[0047.533] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.php") returned 0
	[0047.533] lstrlenA (lpString="*.php") returned 5
	[0047.533] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.vbe") returned 0
	[0047.533] lstrlenA (lpString="*.vbe") returned 5
	[0047.533] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.vba") returned 0
	[0047.533] lstrlenA (lpString="*.vba") returned 5
	[0047.533] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.vbs") returned 0
	[0047.533] lstrlenA (lpString="*.vbs") returned 5
	[0047.533] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.bat") returned 0
	[0047.533] lstrlenA (lpString="*.bat") returned 5
	[0047.533] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.cmd") returned 1
	[0047.533] lstrlenA (lpString="*.cmd") returned 5
	[0047.533] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" | out: lpString1="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd"
	[0047.533] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" | out: lpString1="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd"
	[0047.533] lstrcatA (in: lpString1="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", lpString2="." | out: lpString1="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.") returned="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd."
	[0047.533] lstrcatA (in: lpString1="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.", lpString2="exe" | out: lpString1="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.exe") returned="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.exe"
	[0047.533] CreateFileA (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0047.534] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x241
	[0047.534] GetFileTime (in: hFile=0x208, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x54acc791, dwHighDateTime=0x1d3273a), lpLastAccessTime=0x407536*(dwLowDateTime=0x54acc791, dwHighDateTime=0x1d3273a), lpLastWriteTime=0x40753e*(dwLowDateTime=0x54acc791, dwHighDateTime=0x1d3273a)) returned 1
	[0047.534] SetFilePointer (in: hFile=0x208, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0047.534] ReadFile (in: hFile=0x208, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1ff, lpOverlapped=0x0) returned 1
	[0047.559] PathFindFileNameA (pszPath="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned="PartnerSetupComplete.cmd"
	[0047.559] SetFilePointer (in: hFile=0x208, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0047.559] WriteFile (in: hFile=0x208, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1ff, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1ff, lpOverlapped=0x0) returned 1
	[0047.559] SetFileTime (hFile=0x208, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.560] CloseHandle (hObject=0x208) returned 1
	[0047.560] MoveFileA (lpExistingFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), lpNewFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.exe" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.exe")) returned 1
	[0047.561] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x1, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1
	[0047.561] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0047.561] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="preoobe.cmd") returned -1
	[0047.561] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="preoobe.cmd") returned -1
	[0047.561] lstrcmpiA (lpString1="", lpString2="preoobe.cmd") returned -1
	[0047.561] PathFindFileNameA (pszPath="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned="PartnerSetupComplete.cmd"
	[0047.561] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\$GetCurrent\\SafeOS\\" | out: lpString1="C:\\$GetCurrent\\SafeOS\\") returned="C:\\$GetCurrent\\SafeOS\\"
	[0047.561] PathAddBackslashA (in: pszPath="C:\\$GetCurrent\\SafeOS\\" | out: pszPath="C:\\$GetCurrent\\SafeOS\\") returned=""
	[0047.561] lstrcatA (in: lpString1="C:\\$GetCurrent\\SafeOS\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\$GetCurrent\\SafeOS\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\$GetCurrent\\SafeOS\\HOW-TO-DECRYPT-FILES.HTM"
	[0047.561] GetFileAttributesA (lpFileName="C:\\$GetCurrent\\SafeOS\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\$getcurrent\\safeos\\how-to-decrypt-files.htm")) returned 0x20
	[0047.561] lstrcatA (in: lpString1="C:\\$GetCurrent\\SafeOS\\", lpString2="preoobe.cmd" | out: lpString1="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned="C:\\$GetCurrent\\SafeOS\\preoobe.cmd"
	[0047.561] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.zip") returned 0
	[0047.561] lstrlenA (lpString="*.zip") returned 5
	[0047.561] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.rar") returned 0
	[0047.561] lstrlenA (lpString="*.rar") returned 5
	[0047.561] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.7z") returned 0
	[0047.561] lstrlenA (lpString="*.7z") returned 4
	[0047.561] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.tar") returned 0
	[0047.561] lstrlenA (lpString="*.tar") returned 5
	[0047.562] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.gzip") returned 0
	[0047.562] lstrlenA (lpString="*.gzip") returned 6
	[0047.562] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.jpg") returned 0
	[0047.562] lstrlenA (lpString="*.jpg") returned 5
	[0047.562] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.jpeg") returned 0
	[0047.562] lstrlenA (lpString="*.jpeg") returned 6
	[0047.562] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.bmp") returned 0
	[0047.562] lstrlenA (lpString="*.bmp") returned 5
	[0047.562] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.gif") returned 0
	[0047.562] lstrlenA (lpString="*.gif") returned 5
	[0047.562] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.png") returned 0
	[0047.562] lstrlenA (lpString="*.png") returned 5
	[0047.562] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.doc") returned 0
	[0047.562] lstrlenA (lpString="*.doc") returned 5
	[0047.562] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.docx") returned 0
	[0047.562] lstrlenA (lpString="*.docx") returned 6
	[0047.562] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.xls") returned 0
	[0047.562] lstrlenA (lpString="*.xls") returned 5
	[0047.562] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.xlsx") returned 0
	[0047.562] lstrlenA (lpString="*.xlsx") returned 6
	[0047.562] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.ppt") returned 0
	[0047.562] lstrlenA (lpString="*.ppt") returned 5
	[0047.562] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.pptx") returned 0
	[0047.562] lstrlenA (lpString="*.pptx") returned 6
	[0047.562] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.txt") returned 0
	[0047.562] lstrlenA (lpString="*.txt") returned 5
	[0047.562] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.pdf") returned 0
	[0047.562] lstrlenA (lpString="*.pdf") returned 5
	[0047.562] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.htm") returned 0
	[0047.562] lstrlenA (lpString="*.htm") returned 5
	[0047.562] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.html") returned 0
	[0047.562] lstrlenA (lpString="*.html") returned 6
	[0047.562] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.mdb") returned 0
	[0047.562] lstrlenA (lpString="*.mdb") returned 5
	[0047.562] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.pfx") returned 0
	[0047.562] lstrlenA (lpString="*.pfx") returned 5
	[0047.562] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.md") returned 0
	[0047.563] lstrlenA (lpString="*.md") returned 4
	[0047.563] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.lnk") returned 0
	[0047.563] lstrlenA (lpString="*.lnk") returned 5
	[0047.563] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.torrent") returned 0
	[0047.563] lstrlenA (lpString="*.torrent") returned 9
	[0047.563] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.mov") returned 0
	[0047.563] lstrlenA (lpString="*.mov") returned 5
	[0047.563] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.3gp") returned 0
	[0047.563] lstrlenA (lpString="*.3gp") returned 5
	[0047.563] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.mpeg") returned 0
	[0047.563] lstrlenA (lpString="*.mpeg") returned 6
	[0047.563] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.mpg") returned 0
	[0047.563] lstrlenA (lpString="*.mpg") returned 5
	[0047.563] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.flv") returned 0
	[0047.563] lstrlenA (lpString="*.flv") returned 5
	[0047.563] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.avi") returned 0
	[0047.563] lstrlenA (lpString="*.avi") returned 5
	[0047.563] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.mp4") returned 0
	[0047.563] lstrlenA (lpString="*.mp4") returned 5
	[0047.563] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.wmv") returned 0
	[0047.563] lstrlenA (lpString="*.wmv") returned 5
	[0047.563] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.mkv") returned 0
	[0047.563] lstrlenA (lpString="*.mkv") returned 5
	[0047.563] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.mp3") returned 0
	[0047.563] lstrlenA (lpString="*.mp3") returned 5
	[0047.563] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.wav") returned 0
	[0047.563] lstrlenA (lpString="*.wav") returned 5
	[0047.563] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.flac") returned 0
	[0047.563] lstrlenA (lpString="*.flac") returned 6
	[0047.563] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.wma") returned 0
	[0047.563] lstrlenA (lpString="*.wma") returned 5
	[0047.563] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.au3") returned 0
	[0047.563] lstrlenA (lpString="*.au3") returned 5
	[0047.563] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.ahk") returned 0
	[0047.563] lstrlenA (lpString="*.ahk") returned 5
	[0047.563] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.c") returned 0
	[0047.563] lstrlenA (lpString="*.c") returned 3
	[0047.564] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.cc") returned 0
	[0047.564] lstrlenA (lpString="*.cc") returned 4
	[0047.564] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.cpp") returned 0
	[0047.564] lstrlenA (lpString="*.cpp") returned 5
	[0047.564] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.cxx") returned 0
	[0047.564] lstrlenA (lpString="*.cxx") returned 5
	[0047.564] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.c++") returned 0
	[0047.564] lstrlenA (lpString="*.c++") returned 5
	[0047.564] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.cs") returned 0
	[0047.564] lstrlenA (lpString="*.cs") returned 4
	[0047.564] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.vb") returned 0
	[0047.564] lstrlenA (lpString="*.vb") returned 4
	[0047.564] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.bas") returned 0
	[0047.564] lstrlenA (lpString="*.bas") returned 5
	[0047.564] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.csproj") returned 0
	[0047.564] lstrlenA (lpString="*.csproj") returned 8
	[0047.564] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.vbproj") returned 0
	[0047.564] lstrlenA (lpString="*.vbproj") returned 8
	[0047.564] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.vcxproj") returned 0
	[0047.564] lstrlenA (lpString="*.vcxproj") returned 9
	[0047.564] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.manifest") returned 0
	[0047.564] lstrlenA (lpString="*.manifest") returned 10
	[0047.564] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.php") returned 0
	[0047.564] lstrlenA (lpString="*.php") returned 5
	[0047.564] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.vbe") returned 0
	[0047.564] lstrlenA (lpString="*.vbe") returned 5
	[0047.564] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.vba") returned 0
	[0047.564] lstrlenA (lpString="*.vba") returned 5
	[0047.564] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.vbs") returned 0
	[0047.564] lstrlenA (lpString="*.vbs") returned 5
	[0047.564] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.bat") returned 0
	[0047.564] lstrlenA (lpString="*.bat") returned 5
	[0047.564] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.cmd") returned 1
	[0047.564] lstrlenA (lpString="*.cmd") returned 5
	[0047.564] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" | out: lpString1="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned="C:\\$GetCurrent\\SafeOS\\preoobe.cmd"
	[0047.564] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" | out: lpString1="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned="C:\\$GetCurrent\\SafeOS\\preoobe.cmd"
	[0047.565] lstrcatA (in: lpString1="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", lpString2="." | out: lpString1="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.") returned="C:\\$GetCurrent\\SafeOS\\preoobe.cmd."
	[0047.565] lstrcatA (in: lpString1="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.", lpString2="exe" | out: lpString1="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.exe") returned="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.exe"
	[0047.565] CreateFileA (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0047.624] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4a
	[0047.624] GetFileTime (in: hFile=0x208, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9575af11, dwHighDateTime=0x1d3273b), lpLastAccessTime=0x407536*(dwLowDateTime=0x9575af11, dwHighDateTime=0x1d3273b), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9577d1ec, dwHighDateTime=0x1d3273b)) returned 1
	[0047.624] SetFilePointer (in: hFile=0x208, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0047.624] ReadFile (in: hFile=0x208, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x8, lpOverlapped=0x0) returned 1
	[0047.625] PathFindFileNameA (pszPath="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned="preoobe.cmd"
	[0047.625] SetFilePointer (in: hFile=0x208, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0047.625] WriteFile (in: hFile=0x208, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x8, lpOverlapped=0x0) returned 1
	[0047.625] SetFileTime (hFile=0x208, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.625] CloseHandle (hObject=0x208) returned 1
	[0047.627] MoveFileA (lpExistingFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), lpNewFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.exe" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.exe")) returned 1
	[0047.628] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x1c, dwReserved1=0x1, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1
	[0047.628] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0047.628] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SetupComplete.cmd") returned -1
	[0047.629] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SetupComplete.cmd") returned -1
	[0047.629] lstrcmpiA (lpString1="", lpString2="SetupComplete.cmd") returned -1
	[0047.629] PathFindFileNameA (pszPath="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned="preoobe.cmd"
	[0047.629] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\$GetCurrent\\SafeOS\\" | out: lpString1="C:\\$GetCurrent\\SafeOS\\") returned="C:\\$GetCurrent\\SafeOS\\"
	[0047.629] PathAddBackslashA (in: pszPath="C:\\$GetCurrent\\SafeOS\\" | out: pszPath="C:\\$GetCurrent\\SafeOS\\") returned=""
	[0047.629] lstrcatA (in: lpString1="C:\\$GetCurrent\\SafeOS\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\$GetCurrent\\SafeOS\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\$GetCurrent\\SafeOS\\HOW-TO-DECRYPT-FILES.HTM"
	[0047.629] GetFileAttributesA (lpFileName="C:\\$GetCurrent\\SafeOS\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\$getcurrent\\safeos\\how-to-decrypt-files.htm")) returned 0x20
	[0047.629] lstrcatA (in: lpString1="C:\\$GetCurrent\\SafeOS\\", lpString2="SetupComplete.cmd" | out: lpString1="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd"
	[0047.629] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.zip") returned 0
	[0047.629] lstrlenA (lpString="*.zip") returned 5
	[0047.629] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.rar") returned 0
	[0047.629] lstrlenA (lpString="*.rar") returned 5
	[0047.629] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.7z") returned 0
	[0047.629] lstrlenA (lpString="*.7z") returned 4
	[0047.629] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.tar") returned 0
	[0047.629] lstrlenA (lpString="*.tar") returned 5
	[0047.629] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.gzip") returned 0
	[0047.629] lstrlenA (lpString="*.gzip") returned 6
	[0047.629] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.jpg") returned 0
	[0047.629] lstrlenA (lpString="*.jpg") returned 5
	[0047.629] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.jpeg") returned 0
	[0047.629] lstrlenA (lpString="*.jpeg") returned 6
	[0047.629] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.bmp") returned 0
	[0047.629] lstrlenA (lpString="*.bmp") returned 5
	[0047.629] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.gif") returned 0
	[0047.629] lstrlenA (lpString="*.gif") returned 5
	[0047.629] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.png") returned 0
	[0047.630] lstrlenA (lpString="*.png") returned 5
	[0047.630] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.doc") returned 0
	[0047.630] lstrlenA (lpString="*.doc") returned 5
	[0047.630] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.docx") returned 0
	[0047.630] lstrlenA (lpString="*.docx") returned 6
	[0047.630] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.xls") returned 0
	[0047.630] lstrlenA (lpString="*.xls") returned 5
	[0047.630] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.xlsx") returned 0
	[0047.630] lstrlenA (lpString="*.xlsx") returned 6
	[0047.630] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.ppt") returned 0
	[0047.630] lstrlenA (lpString="*.ppt") returned 5
	[0047.630] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.pptx") returned 0
	[0047.630] lstrlenA (lpString="*.pptx") returned 6
	[0047.630] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.txt") returned 0
	[0047.630] lstrlenA (lpString="*.txt") returned 5
	[0047.630] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.pdf") returned 0
	[0047.630] lstrlenA (lpString="*.pdf") returned 5
	[0047.630] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.htm") returned 0
	[0047.630] lstrlenA (lpString="*.htm") returned 5
	[0047.630] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.html") returned 0
	[0047.630] lstrlenA (lpString="*.html") returned 6
	[0047.630] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.mdb") returned 0
	[0047.630] lstrlenA (lpString="*.mdb") returned 5
	[0047.630] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.pfx") returned 0
	[0047.630] lstrlenA (lpString="*.pfx") returned 5
	[0047.630] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.md") returned 0
	[0047.630] lstrlenA (lpString="*.md") returned 4
	[0047.630] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.lnk") returned 0
	[0047.630] lstrlenA (lpString="*.lnk") returned 5
	[0047.630] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.torrent") returned 0
	[0047.630] lstrlenA (lpString="*.torrent") returned 9
	[0047.630] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.mov") returned 0
	[0047.630] lstrlenA (lpString="*.mov") returned 5
	[0047.630] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.3gp") returned 0
	[0047.630] lstrlenA (lpString="*.3gp") returned 5
	[0047.630] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.mpeg") returned 0
	[0047.630] lstrlenA (lpString="*.mpeg") returned 6
	[0047.631] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.mpg") returned 0
	[0047.631] lstrlenA (lpString="*.mpg") returned 5
	[0047.631] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.flv") returned 0
	[0047.631] lstrlenA (lpString="*.flv") returned 5
	[0047.631] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.avi") returned 0
	[0047.631] lstrlenA (lpString="*.avi") returned 5
	[0047.631] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.mp4") returned 0
	[0047.631] lstrlenA (lpString="*.mp4") returned 5
	[0047.631] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.wmv") returned 0
	[0047.631] lstrlenA (lpString="*.wmv") returned 5
	[0047.631] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.mkv") returned 0
	[0047.631] lstrlenA (lpString="*.mkv") returned 5
	[0047.631] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.mp3") returned 0
	[0047.631] lstrlenA (lpString="*.mp3") returned 5
	[0047.631] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.wav") returned 0
	[0047.631] lstrlenA (lpString="*.wav") returned 5
	[0047.631] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.flac") returned 0
	[0047.631] lstrlenA (lpString="*.flac") returned 6
	[0047.631] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.wma") returned 0
	[0047.631] lstrlenA (lpString="*.wma") returned 5
	[0047.631] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.au3") returned 0
	[0047.631] lstrlenA (lpString="*.au3") returned 5
	[0047.631] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.ahk") returned 0
	[0047.631] lstrlenA (lpString="*.ahk") returned 5
	[0047.631] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.c") returned 0
	[0047.631] lstrlenA (lpString="*.c") returned 3
	[0047.631] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.cc") returned 0
	[0047.631] lstrlenA (lpString="*.cc") returned 4
	[0047.631] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.cpp") returned 0
	[0047.631] lstrlenA (lpString="*.cpp") returned 5
	[0047.631] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.cxx") returned 0
	[0047.632] lstrlenA (lpString="*.cxx") returned 5
	[0047.632] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.c++") returned 0
	[0047.632] lstrlenA (lpString="*.c++") returned 5
	[0047.632] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.cs") returned 0
	[0047.632] lstrlenA (lpString="*.cs") returned 4
	[0047.632] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.vb") returned 0
	[0047.632] lstrlenA (lpString="*.vb") returned 4
	[0047.632] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.bas") returned 0
	[0047.632] lstrlenA (lpString="*.bas") returned 5
	[0047.632] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.csproj") returned 0
	[0047.632] lstrlenA (lpString="*.csproj") returned 8
	[0047.632] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.vbproj") returned 0
	[0047.632] lstrlenA (lpString="*.vbproj") returned 8
	[0047.632] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.vcxproj") returned 0
	[0047.632] lstrlenA (lpString="*.vcxproj") returned 9
	[0047.632] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.manifest") returned 0
	[0047.632] lstrlenA (lpString="*.manifest") returned 10
	[0047.632] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.php") returned 0
	[0047.632] lstrlenA (lpString="*.php") returned 5
	[0047.632] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.vbe") returned 0
	[0047.632] lstrlenA (lpString="*.vbe") returned 5
	[0047.632] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.vba") returned 0
	[0047.632] lstrlenA (lpString="*.vba") returned 5
	[0047.632] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.vbs") returned 0
	[0047.632] lstrlenA (lpString="*.vbs") returned 5
	[0047.632] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.bat") returned 0
	[0047.632] lstrlenA (lpString="*.bat") returned 5
	[0047.632] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.cmd") returned 1
	[0047.632] lstrlenA (lpString="*.cmd") returned 5
	[0047.632] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" | out: lpString1="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd"
	[0047.632] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" | out: lpString1="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd"
	[0047.632] lstrcatA (in: lpString1="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", lpString2="." | out: lpString1="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.") returned="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd."
	[0047.632] lstrcatA (in: lpString1="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.", lpString2="exe" | out: lpString1="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.exe") returned="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.exe"
	[0047.632] CreateFileA (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0047.633] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x133
	[0047.633] GetFileTime (in: hFile=0x208, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x957833a7, dwHighDateTime=0x1d3273b), lpLastAccessTime=0x407536*(dwLowDateTime=0x957833a7, dwHighDateTime=0x1d3273b), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9578472e, dwHighDateTime=0x1d3273b)) returned 1
	[0047.633] SetFilePointer (in: hFile=0x208, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0047.633] ReadFile (in: hFile=0x208, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xf1, lpOverlapped=0x0) returned 1
	[0047.634] PathFindFileNameA (pszPath="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned="SetupComplete.cmd"
	[0047.635] SetFilePointer (in: hFile=0x208, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0047.635] WriteFile (in: hFile=0x208, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xf1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xf1, lpOverlapped=0x0) returned 1
	[0047.635] SetFileTime (hFile=0x208, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.635] CloseHandle (hObject=0x208) returned 1
	[0047.635] MoveFileA (lpExistingFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), lpNewFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.exe" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.exe")) returned 1
	[0047.636] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x1c, dwReserved1=0x1, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0
	[0047.636] FindClose (in: hFindFile=0x7cbad0 | out: hFindFile=0x7cbad0) returned 1
	[0047.636] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d0d38, dwReserved1=0x7b00c0, cFileName="SafeOS", cAlternateFileName="")) returned 0
	[0047.636] FindClose (in: hFindFile=0x7cb590 | out: hFindFile=0x7cb590) returned 1
	[0047.637] FindNextFileA (in: hFindFile=0x7cba90, lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7cfd30, dwReserved1=0x7b00c0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1
	[0047.637] lstrcmpA (lpString1=".", lpString2="$Recycle.Bin") returned 1
	[0047.637] lstrcmpA (lpString1="..", lpString2="$Recycle.Bin") returned 1
	[0047.637] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*"
	[0047.637] lstrcatA (in: lpString1="C:\\", lpString2="$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin"
	[0047.637] lstrlenA (lpString="C:\\$Recycle.Bin") returned 15
	[0047.637] FindFirstFileA (in: lpFileName="C:\\$Recycle.Bin\\*.*", lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffffe, dwReserved1=0x7ced28, cFileName=".", cAlternateFileName="")) returned 0x7cb850
	[0047.637] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0047.637] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffffe, dwReserved1=0x7ced28, cFileName="..", cAlternateFileName="")) returned 1
	[0047.638] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0047.638] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0047.638] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffffe, dwReserved1=0x7ced28, cFileName="S-1-5-18", cAlternateFileName="")) returned 1
	[0047.638] lstrcmpA (lpString1=".", lpString2="S-1-5-18") returned -1
	[0047.638] lstrcmpA (lpString1="..", lpString2="S-1-5-18") returned -1
	[0047.638] PathFindFileNameA (pszPath="C:\\$Recycle.Bin\\*.*") returned="*.*"
	[0047.638] lstrcatA (in: lpString1="C:\\$Recycle.Bin\\", lpString2="S-1-5-18" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18") returned="C:\\$Recycle.Bin\\S-1-5-18"
	[0047.638] lstrlenA (lpString="C:\\$Recycle.Bin\\S-1-5-18") returned 24
	[0047.638] FindFirstFileA (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffffe, dwReserved1=0x7cfd30, cFileName=".", cAlternateFileName="")) returned 0x7cb990
	[0047.638] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0047.638] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffffe, dwReserved1=0x7cfd30, cFileName="..", cAlternateFileName="")) returned 1
	[0047.638] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0047.638] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0047.638] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0xfffffffe, dwReserved1=0x7cfd30, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0047.638] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0047.638] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="desktop.ini") returned 1
	[0047.638] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="desktop.ini") returned 1
	[0047.638] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1
	[0047.638] PathFindFileNameA (pszPath="C:\\$Recycle.Bin\\S-1-5-18\\*.*") returned="*.*"
	[0047.638] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\$Recycle.Bin\\S-1-5-18\\" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\") returned="C:\\$Recycle.Bin\\S-1-5-18\\"
	[0047.638] PathAddBackslashA (in: pszPath="C:\\$Recycle.Bin\\S-1-5-18\\" | out: pszPath="C:\\$Recycle.Bin\\S-1-5-18\\") returned=""
	[0047.638] lstrcatA (in: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\$Recycle.Bin\\S-1-5-18\\HOW-TO-DECRYPT-FILES.HTM"
	[0047.639] GetFileAttributesA (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\$recycle.bin\\s-1-5-18\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0047.639] CreateFileA (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\$recycle.bin\\s-1-5-18\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0047.640] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0047.640] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0047.641] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0047.641] CloseHandle (hObject=0x208) returned 1
	[0047.641] lstrcatA (in: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\", lpString2="desktop.ini" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini"
	[0047.641] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.zip") returned 0
	[0047.641] lstrlenA (lpString="*.zip") returned 5
	[0047.641] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.rar") returned 0
	[0047.641] lstrlenA (lpString="*.rar") returned 5
	[0047.641] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.7z") returned 0
	[0047.641] lstrlenA (lpString="*.7z") returned 4
	[0047.641] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.tar") returned 0
	[0047.641] lstrlenA (lpString="*.tar") returned 5
	[0047.641] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.gzip") returned 0
	[0047.641] lstrlenA (lpString="*.gzip") returned 6
	[0047.641] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.jpg") returned 0
	[0047.641] lstrlenA (lpString="*.jpg") returned 5
	[0047.641] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.jpeg") returned 0
	[0047.641] lstrlenA (lpString="*.jpeg") returned 6
	[0047.641] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.bmp") returned 0
	[0047.641] lstrlenA (lpString="*.bmp") returned 5
	[0047.641] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.gif") returned 0
	[0047.641] lstrlenA (lpString="*.gif") returned 5
	[0047.641] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.png") returned 0
	[0047.641] lstrlenA (lpString="*.png") returned 5
	[0047.641] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.doc") returned 0
	[0047.641] lstrlenA (lpString="*.doc") returned 5
	[0047.641] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.docx") returned 0
	[0047.641] lstrlenA (lpString="*.docx") returned 6
	[0047.641] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.xls") returned 0
	[0047.641] lstrlenA (lpString="*.xls") returned 5
	[0047.642] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.xlsx") returned 0
	[0047.642] lstrlenA (lpString="*.xlsx") returned 6
	[0047.642] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.ppt") returned 0
	[0047.642] lstrlenA (lpString="*.ppt") returned 5
	[0047.642] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.pptx") returned 0
	[0047.642] lstrlenA (lpString="*.pptx") returned 6
	[0047.642] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.txt") returned 0
	[0047.642] lstrlenA (lpString="*.txt") returned 5
	[0047.642] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.pdf") returned 0
	[0047.642] lstrlenA (lpString="*.pdf") returned 5
	[0047.642] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.htm") returned 0
	[0047.642] lstrlenA (lpString="*.htm") returned 5
	[0047.642] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.html") returned 0
	[0047.642] lstrlenA (lpString="*.html") returned 6
	[0047.642] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.mdb") returned 0
	[0047.642] lstrlenA (lpString="*.mdb") returned 5
	[0047.642] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.pfx") returned 0
	[0047.642] lstrlenA (lpString="*.pfx") returned 5
	[0047.642] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.md") returned 0
	[0047.642] lstrlenA (lpString="*.md") returned 4
	[0047.642] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.lnk") returned 0
	[0047.642] lstrlenA (lpString="*.lnk") returned 5
	[0047.642] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.torrent") returned 0
	[0047.642] lstrlenA (lpString="*.torrent") returned 9
	[0047.642] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.mov") returned 0
	[0047.642] lstrlenA (lpString="*.mov") returned 5
	[0047.642] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.3gp") returned 0
	[0047.642] lstrlenA (lpString="*.3gp") returned 5
	[0047.642] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.mpeg") returned 0
	[0047.642] lstrlenA (lpString="*.mpeg") returned 6
	[0047.642] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.mpg") returned 0
	[0047.642] lstrlenA (lpString="*.mpg") returned 5
	[0047.642] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.flv") returned 0
	[0047.642] lstrlenA (lpString="*.flv") returned 5
	[0047.642] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.avi") returned 0
	[0047.642] lstrlenA (lpString="*.avi") returned 5
	[0047.642] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.mp4") returned 0
	[0047.643] lstrlenA (lpString="*.mp4") returned 5
	[0047.643] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.wmv") returned 0
	[0047.643] lstrlenA (lpString="*.wmv") returned 5
	[0047.643] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.mkv") returned 0
	[0047.643] lstrlenA (lpString="*.mkv") returned 5
	[0047.643] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.mp3") returned 0
	[0047.643] lstrlenA (lpString="*.mp3") returned 5
	[0047.643] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.wav") returned 0
	[0047.643] lstrlenA (lpString="*.wav") returned 5
	[0047.643] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.flac") returned 0
	[0047.643] lstrlenA (lpString="*.flac") returned 6
	[0047.643] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.wma") returned 0
	[0047.643] lstrlenA (lpString="*.wma") returned 5
	[0047.643] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.au3") returned 0
	[0047.643] lstrlenA (lpString="*.au3") returned 5
	[0047.643] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.ahk") returned 0
	[0047.643] lstrlenA (lpString="*.ahk") returned 5
	[0047.643] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.c") returned 0
	[0047.643] lstrlenA (lpString="*.c") returned 3
	[0047.643] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.cc") returned 0
	[0047.643] lstrlenA (lpString="*.cc") returned 4
	[0047.643] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.cpp") returned 0
	[0047.643] lstrlenA (lpString="*.cpp") returned 5
	[0047.643] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.cxx") returned 0
	[0047.643] lstrlenA (lpString="*.cxx") returned 5
	[0047.643] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.c++") returned 0
	[0047.643] lstrlenA (lpString="*.c++") returned 5
	[0047.643] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.cs") returned 0
	[0047.643] lstrlenA (lpString="*.cs") returned 4
	[0047.643] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.vb") returned 0
	[0047.643] lstrlenA (lpString="*.vb") returned 4
	[0047.643] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.bas") returned 0
	[0047.643] lstrlenA (lpString="*.bas") returned 5
	[0047.643] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.csproj") returned 0
	[0047.643] lstrlenA (lpString="*.csproj") returned 8
	[0047.643] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.vbproj") returned 0
	[0047.643] lstrlenA (lpString="*.vbproj") returned 8
	[0047.643] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.vcxproj") returned 0
	[0047.644] lstrlenA (lpString="*.vcxproj") returned 9
	[0047.644] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.manifest") returned 0
	[0047.644] lstrlenA (lpString="*.manifest") returned 10
	[0047.644] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.php") returned 0
	[0047.644] lstrlenA (lpString="*.php") returned 5
	[0047.644] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.vbe") returned 0
	[0047.644] lstrlenA (lpString="*.vbe") returned 5
	[0047.644] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.vba") returned 0
	[0047.644] lstrlenA (lpString="*.vba") returned 5
	[0047.644] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.vbs") returned 0
	[0047.644] lstrlenA (lpString="*.vbs") returned 5
	[0047.644] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.bat") returned 0
	[0047.644] lstrlenA (lpString="*.bat") returned 5
	[0047.644] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.cmd") returned 0
	[0047.644] lstrlenA (lpString="*.cmd") returned 5
	[0047.644] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.js") returned 0
	[0047.644] lstrlenA (lpString="*.js") returned 4
	[0047.644] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.jscript") returned 0
	[0047.644] lstrlenA (lpString="*.jscript") returned 9
	[0047.644] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.hta") returned 0
	[0047.644] lstrlenA (lpString="*.hta") returned 5
	[0047.644] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.php7") returned 0
	[0047.644] lstrlenA (lpString="*.php7") returned 6
	[0047.644] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.db") returned 0
	[0047.644] lstrlenA (lpString="*.db") returned 4
	[0047.644] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.swf") returned 0
	[0047.644] lstrlenA (lpString="*.swf") returned 5
	[0047.644] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.eml") returned 0
	[0047.644] lstrlenA (lpString="*.eml") returned 5
	[0047.644] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.part") returned 0
	[0047.644] lstrlenA (lpString="*.part") returned 6
	[0047.644] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.nfo") returned 0
	[0047.644] lstrlenA (lpString="*.nfo") returned 5
	[0047.644] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.rsa") returned 0
	[0047.644] lstrlenA (lpString="*.rsa") returned 5
	[0047.644] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.key") returned 0
	[0047.644] lstrlenA (lpString="*.key") returned 5
	[0047.645] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.aes") returned 0
	[0047.645] lstrlenA (lpString="*.aes") returned 5
	[0047.645] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.blob") returned 0
	[0047.645] lstrlenA (lpString="*.blob") returned 6
	[0047.645] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.btc") returned 0
	[0047.645] lstrlenA (lpString="*.btc") returned 5
	[0047.645] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.wallet") returned 0
	[0047.645] lstrlenA (lpString="*.wallet") returned 8
	[0047.645] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0xfffffffe, dwReserved1=0x7cfd30, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0047.645] FindClose (in: hFindFile=0x7cb990 | out: hFindFile=0x7cb990) returned 1
	[0047.645] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d1d40, dwReserved1=0x7b00c0, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0047.645] lstrcmpA (lpString1=".", lpString2="S-1-5-21-1051304884-625712362-2192934891-1000") returned -1
	[0047.645] lstrcmpA (lpString1="..", lpString2="S-1-5-21-1051304884-625712362-2192934891-1000") returned -1
	[0047.645] PathFindFileNameA (pszPath="C:\\$Recycle.Bin\\*.*") returned="*.*"
	[0047.645] lstrcatA (in: lpString1="C:\\$Recycle.Bin\\", lpString2="S-1-5-21-1051304884-625712362-2192934891-1000" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000") returned="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000"
	[0047.645] lstrlenA (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000") returned 61
	[0047.645] FindFirstFileA (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x7cb810
	[0047.645] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0047.645] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1
	[0047.645] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0047.645] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0047.645] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x1, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0047.646] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0047.646] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="desktop.ini") returned 1
	[0047.646] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="desktop.ini") returned 1
	[0047.646] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1
	[0047.646] PathFindFileNameA (pszPath="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*.*") returned="*.*"
	[0047.646] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\") returned="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\"
	[0047.646] PathAddBackslashA (in: pszPath="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\" | out: pszPath="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\") returned=""
	[0047.646] lstrcatA (in: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\HOW-TO-DECRYPT-FILES.HTM"
	[0047.646] GetFileAttributesA (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0047.646] CreateFileA (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0047.647] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0047.647] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0047.648] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0047.648] CloseHandle (hObject=0x208) returned 1
	[0047.648] lstrcatA (in: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\", lpString2="desktop.ini" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"
	[0047.648] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.zip") returned 0
	[0047.648] lstrlenA (lpString="*.zip") returned 5
	[0047.648] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.rar") returned 0
	[0047.648] lstrlenA (lpString="*.rar") returned 5
	[0047.648] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.7z") returned 0
	[0047.648] lstrlenA (lpString="*.7z") returned 4
	[0047.648] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.tar") returned 0
	[0047.648] lstrlenA (lpString="*.tar") returned 5
	[0047.648] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.gzip") returned 0
	[0047.649] lstrlenA (lpString="*.gzip") returned 6
	[0047.649] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.jpg") returned 0
	[0047.649] lstrlenA (lpString="*.jpg") returned 5
	[0047.649] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.jpeg") returned 0
	[0047.649] lstrlenA (lpString="*.jpeg") returned 6
	[0047.649] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.bmp") returned 0
	[0047.649] lstrlenA (lpString="*.bmp") returned 5
	[0047.649] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.gif") returned 0
	[0047.649] lstrlenA (lpString="*.gif") returned 5
	[0047.649] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.png") returned 0
	[0047.649] lstrlenA (lpString="*.png") returned 5
	[0047.649] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.doc") returned 0
	[0047.649] lstrlenA (lpString="*.doc") returned 5
	[0047.649] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.docx") returned 0
	[0047.649] lstrlenA (lpString="*.docx") returned 6
	[0047.649] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.xls") returned 0
	[0047.649] lstrlenA (lpString="*.xls") returned 5
	[0047.649] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.xlsx") returned 0
	[0047.649] lstrlenA (lpString="*.xlsx") returned 6
	[0047.649] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.ppt") returned 0
	[0047.649] lstrlenA (lpString="*.ppt") returned 5
	[0047.649] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.pptx") returned 0
	[0047.649] lstrlenA (lpString="*.pptx") returned 6
	[0047.649] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.txt") returned 0
	[0047.649] lstrlenA (lpString="*.txt") returned 5
	[0047.649] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.pdf") returned 0
	[0047.649] lstrlenA (lpString="*.pdf") returned 5
	[0047.649] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.htm") returned 0
	[0047.649] lstrlenA (lpString="*.htm") returned 5
	[0047.649] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.html") returned 0
	[0047.649] lstrlenA (lpString="*.html") returned 6
	[0047.649] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.mdb") returned 0
	[0047.649] lstrlenA (lpString="*.mdb") returned 5
	[0047.649] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.pfx") returned 0
	[0047.650] lstrlenA (lpString="*.pfx") returned 5
	[0047.650] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.md") returned 0
	[0047.650] lstrlenA (lpString="*.md") returned 4
	[0047.650] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.lnk") returned 0
	[0047.650] lstrlenA (lpString="*.lnk") returned 5
	[0047.650] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.torrent") returned 0
	[0047.650] lstrlenA (lpString="*.torrent") returned 9
	[0047.650] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.mov") returned 0
	[0047.650] lstrlenA (lpString="*.mov") returned 5
	[0047.650] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.3gp") returned 0
	[0047.650] lstrlenA (lpString="*.3gp") returned 5
	[0047.650] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.mpeg") returned 0
	[0047.650] lstrlenA (lpString="*.mpeg") returned 6
	[0047.650] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.mpg") returned 0
	[0047.650] lstrlenA (lpString="*.mpg") returned 5
	[0047.650] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.flv") returned 0
	[0047.650] lstrlenA (lpString="*.flv") returned 5
	[0047.650] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.avi") returned 0
	[0047.650] lstrlenA (lpString="*.avi") returned 5
	[0047.650] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.mp4") returned 0
	[0047.650] lstrlenA (lpString="*.mp4") returned 5
	[0047.650] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.wmv") returned 0
	[0047.650] lstrlenA (lpString="*.wmv") returned 5
	[0047.650] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.mkv") returned 0
	[0047.650] lstrlenA (lpString="*.mkv") returned 5
	[0047.650] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.mp3") returned 0
	[0047.650] lstrlenA (lpString="*.mp3") returned 5
	[0047.650] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.wav") returned 0
	[0047.650] lstrlenA (lpString="*.wav") returned 5
	[0047.650] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.flac") returned 0
	[0047.650] lstrlenA (lpString="*.flac") returned 6
	[0047.650] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.wma") returned 0
	[0047.650] lstrlenA (lpString="*.wma") returned 5
	[0047.651] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.au3") returned 0
	[0047.651] lstrlenA (lpString="*.au3") returned 5
	[0047.651] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.ahk") returned 0
	[0047.651] lstrlenA (lpString="*.ahk") returned 5
	[0047.651] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.c") returned 0
	[0047.651] lstrlenA (lpString="*.c") returned 3
	[0047.651] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.cc") returned 0
	[0047.651] lstrlenA (lpString="*.cc") returned 4
	[0047.651] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.cpp") returned 0
	[0047.651] lstrlenA (lpString="*.cpp") returned 5
	[0047.651] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.cxx") returned 0
	[0047.651] lstrlenA (lpString="*.cxx") returned 5
	[0047.651] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.c++") returned 0
	[0047.651] lstrlenA (lpString="*.c++") returned 5
	[0047.651] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.cs") returned 0
	[0047.651] lstrlenA (lpString="*.cs") returned 4
	[0047.651] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.vb") returned 0
	[0047.651] lstrlenA (lpString="*.vb") returned 4
	[0047.651] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.bas") returned 0
	[0047.651] lstrlenA (lpString="*.bas") returned 5
	[0047.651] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.csproj") returned 0
	[0047.651] lstrlenA (lpString="*.csproj") returned 8
	[0047.651] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.vbproj") returned 0
	[0047.651] lstrlenA (lpString="*.vbproj") returned 8
	[0047.651] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.vcxproj") returned 0
	[0047.651] lstrlenA (lpString="*.vcxproj") returned 9
	[0047.651] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.manifest") returned 0
	[0047.651] lstrlenA (lpString="*.manifest") returned 10
	[0047.651] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.php") returned 0
	[0047.651] lstrlenA (lpString="*.php") returned 5
	[0047.651] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.vbe") returned 0
	[0047.651] lstrlenA (lpString="*.vbe") returned 5
	[0047.651] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.vba") returned 0
	[0047.651] lstrlenA (lpString="*.vba") returned 5
	[0047.651] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.vbs") returned 0
	[0047.652] lstrlenA (lpString="*.vbs") returned 5
	[0047.652] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.bat") returned 0
	[0047.652] lstrlenA (lpString="*.bat") returned 5
	[0047.652] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.cmd") returned 0
	[0047.652] lstrlenA (lpString="*.cmd") returned 5
	[0047.652] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.js") returned 0
	[0047.652] lstrlenA (lpString="*.js") returned 4
	[0047.652] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.jscript") returned 0
	[0047.652] lstrlenA (lpString="*.jscript") returned 9
	[0047.652] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.hta") returned 0
	[0047.652] lstrlenA (lpString="*.hta") returned 5
	[0047.652] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.php7") returned 0
	[0047.652] lstrlenA (lpString="*.php7") returned 6
	[0047.652] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.db") returned 0
	[0047.652] lstrlenA (lpString="*.db") returned 4
	[0047.652] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.swf") returned 0
	[0047.652] lstrlenA (lpString="*.swf") returned 5
	[0047.652] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.eml") returned 0
	[0047.652] lstrlenA (lpString="*.eml") returned 5
	[0047.652] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.part") returned 0
	[0047.652] lstrlenA (lpString="*.part") returned 6
	[0047.652] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.nfo") returned 0
	[0047.652] lstrlenA (lpString="*.nfo") returned 5
	[0047.652] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.rsa") returned 0
	[0047.652] lstrlenA (lpString="*.rsa") returned 5
	[0047.652] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.key") returned 0
	[0047.652] lstrlenA (lpString="*.key") returned 5
	[0047.652] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.aes") returned 0
	[0047.652] lstrlenA (lpString="*.aes") returned 5
	[0047.652] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.blob") returned 0
	[0047.652] lstrlenA (lpString="*.blob") returned 6
	[0047.652] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.btc") returned 0
	[0047.652] lstrlenA (lpString="*.btc") returned 5
	[0047.652] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.wallet") returned 0
	[0047.652] lstrlenA (lpString="*.wallet") returned 8
	[0047.652] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x1, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0047.652] FindClose (in: hFindFile=0x7cb810 | out: hFindFile=0x7cb810) returned 1
	[0047.653] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d1d40, dwReserved1=0x7b00c0, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0
	[0047.653] FindClose (in: hFindFile=0x7cb850 | out: hFindFile=0x7cb850) returned 1
	[0047.653] FindNextFileA (in: hFindFile=0x7cba90, lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d0d38, dwReserved1=0x7b00c0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1
	[0047.653] PeekMessageA (in: lpMsg=0x19fe0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fe0c) returned 0
	[0047.653] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="$WINRE_BACKUP_PARTITION.MARKER") returned 1
	[0047.653] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="$WINRE_BACKUP_PARTITION.MARKER") returned 1
	[0047.653] lstrcmpiA (lpString1="", lpString2="$WINRE_BACKUP_PARTITION.MARKER") returned -1
	[0047.653] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*"
	[0047.653] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\"
	[0047.653] PathAddBackslashA (in: pszPath="C:\\" | out: pszPath="C:\\") returned=""
	[0047.653] lstrcatA (in: lpString1="C:\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\HOW-TO-DECRYPT-FILES.HTM"
	[0047.653] GetFileAttributesA (lpFileName="C:\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0047.653] CreateFileA (lpFileName="C:\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0047.654] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0047.654] WriteFile (in: hFile=0x1d8, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0047.655] SetFileTime (hFile=0x1d8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0047.655] CloseHandle (hObject=0x1d8) returned 1
	[0047.656] lstrcatA (in: lpString1="C:\\", lpString2="$WINRE_BACKUP_PARTITION.MARKER" | out: lpString1="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned="C:\\$WINRE_BACKUP_PARTITION.MARKER"
	[0047.656] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.zip") returned 0
	[0047.656] lstrlenA (lpString="*.zip") returned 5
	[0047.656] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.rar") returned 0
	[0047.656] lstrlenA (lpString="*.rar") returned 5
	[0047.656] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.7z") returned 0
	[0047.656] lstrlenA (lpString="*.7z") returned 4
	[0047.656] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.tar") returned 0
	[0047.656] lstrlenA (lpString="*.tar") returned 5
	[0047.656] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.gzip") returned 0
	[0047.656] lstrlenA (lpString="*.gzip") returned 6
	[0047.656] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.jpg") returned 0
	[0047.656] lstrlenA (lpString="*.jpg") returned 5
	[0047.656] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.jpeg") returned 0
	[0047.656] lstrlenA (lpString="*.jpeg") returned 6
	[0047.656] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.bmp") returned 0
	[0047.656] lstrlenA (lpString="*.bmp") returned 5
	[0047.656] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.gif") returned 0
	[0047.656] lstrlenA (lpString="*.gif") returned 5
	[0047.656] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.png") returned 0
	[0047.656] lstrlenA (lpString="*.png") returned 5
	[0047.656] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.doc") returned 0
	[0047.656] lstrlenA (lpString="*.doc") returned 5
	[0047.656] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.docx") returned 0
	[0047.656] lstrlenA (lpString="*.docx") returned 6
	[0047.656] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.xls") returned 0
	[0047.656] lstrlenA (lpString="*.xls") returned 5
	[0047.656] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.xlsx") returned 0
	[0047.657] lstrlenA (lpString="*.xlsx") returned 6
	[0047.657] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.ppt") returned 0
	[0047.657] lstrlenA (lpString="*.ppt") returned 5
	[0047.657] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.pptx") returned 0
	[0047.657] lstrlenA (lpString="*.pptx") returned 6
	[0047.657] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.txt") returned 0
	[0047.657] lstrlenA (lpString="*.txt") returned 5
	[0047.657] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.pdf") returned 0
	[0047.657] lstrlenA (lpString="*.pdf") returned 5
	[0047.657] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.htm") returned 0
	[0047.657] lstrlenA (lpString="*.htm") returned 5
	[0047.657] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.html") returned 0
	[0047.657] lstrlenA (lpString="*.html") returned 6
	[0047.657] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.mdb") returned 0
	[0047.657] lstrlenA (lpString="*.mdb") returned 5
	[0047.657] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.pfx") returned 0
	[0047.657] lstrlenA (lpString="*.pfx") returned 5
	[0047.657] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.md") returned 0
	[0047.657] lstrlenA (lpString="*.md") returned 4
	[0047.657] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.lnk") returned 0
	[0047.657] lstrlenA (lpString="*.lnk") returned 5
	[0047.657] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.torrent") returned 0
	[0047.657] lstrlenA (lpString="*.torrent") returned 9
	[0047.657] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.mov") returned 0
	[0047.657] lstrlenA (lpString="*.mov") returned 5
	[0047.657] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.3gp") returned 0
	[0047.657] lstrlenA (lpString="*.3gp") returned 5
	[0047.657] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.mpeg") returned 0
	[0047.657] lstrlenA (lpString="*.mpeg") returned 6
	[0047.657] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.mpg") returned 0
	[0047.657] lstrlenA (lpString="*.mpg") returned 5
	[0047.657] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.flv") returned 0
	[0047.658] lstrlenA (lpString="*.flv") returned 5
	[0047.658] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.avi") returned 0
	[0047.658] lstrlenA (lpString="*.avi") returned 5
	[0047.658] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.mp4") returned 0
	[0047.658] lstrlenA (lpString="*.mp4") returned 5
	[0047.658] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.wmv") returned 0
	[0047.658] lstrlenA (lpString="*.wmv") returned 5
	[0047.658] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.mkv") returned 0
	[0047.658] lstrlenA (lpString="*.mkv") returned 5
	[0047.658] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.mp3") returned 0
	[0047.658] lstrlenA (lpString="*.mp3") returned 5
	[0047.658] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.wav") returned 0
	[0047.658] lstrlenA (lpString="*.wav") returned 5
	[0047.658] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.flac") returned 0
	[0047.658] lstrlenA (lpString="*.flac") returned 6
	[0047.658] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.wma") returned 0
	[0047.658] lstrlenA (lpString="*.wma") returned 5
	[0047.658] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.au3") returned 0
	[0047.658] lstrlenA (lpString="*.au3") returned 5
	[0047.658] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.ahk") returned 0
	[0047.658] lstrlenA (lpString="*.ahk") returned 5
	[0047.658] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.c") returned 0
	[0047.658] lstrlenA (lpString="*.c") returned 3
	[0047.658] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.cc") returned 0
	[0047.658] lstrlenA (lpString="*.cc") returned 4
	[0047.658] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.cpp") returned 0
	[0047.658] lstrlenA (lpString="*.cpp") returned 5
	[0047.658] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.cxx") returned 0
	[0047.658] lstrlenA (lpString="*.cxx") returned 5
	[0047.658] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.c++") returned 0
	[0047.658] lstrlenA (lpString="*.c++") returned 5
	[0047.658] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.cs") returned 0
	[0047.659] lstrlenA (lpString="*.cs") returned 4
	[0047.659] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.vb") returned 0
	[0047.659] lstrlenA (lpString="*.vb") returned 4
	[0047.659] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.bas") returned 0
	[0047.659] lstrlenA (lpString="*.bas") returned 5
	[0047.659] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.csproj") returned 0
	[0047.659] lstrlenA (lpString="*.csproj") returned 8
	[0047.659] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.vbproj") returned 0
	[0047.659] lstrlenA (lpString="*.vbproj") returned 8
	[0047.659] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.vcxproj") returned 0
	[0047.659] lstrlenA (lpString="*.vcxproj") returned 9
	[0047.659] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.manifest") returned 0
	[0047.659] lstrlenA (lpString="*.manifest") returned 10
	[0047.659] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.php") returned 0
	[0047.659] lstrlenA (lpString="*.php") returned 5
	[0047.659] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.vbe") returned 0
	[0047.659] lstrlenA (lpString="*.vbe") returned 5
	[0047.659] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.vba") returned 0
	[0047.659] lstrlenA (lpString="*.vba") returned 5
	[0047.659] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.vbs") returned 0
	[0047.659] lstrlenA (lpString="*.vbs") returned 5
	[0047.659] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.bat") returned 0
	[0047.659] lstrlenA (lpString="*.bat") returned 5
	[0047.659] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.cmd") returned 0
	[0047.659] lstrlenA (lpString="*.cmd") returned 5
	[0047.659] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.js") returned 0
	[0047.659] lstrlenA (lpString="*.js") returned 4
	[0047.659] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.jscript") returned 0
	[0047.659] lstrlenA (lpString="*.jscript") returned 9
	[0047.659] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.hta") returned 0
	[0047.659] lstrlenA (lpString="*.hta") returned 5
	[0047.659] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.php7") returned 0
	[0047.659] lstrlenA (lpString="*.php7") returned 6
	[0047.659] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.db") returned 0
	[0047.659] lstrlenA (lpString="*.db") returned 4
	[0047.660] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.swf") returned 0
	[0047.660] lstrlenA (lpString="*.swf") returned 5
	[0047.660] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.eml") returned 0
	[0047.660] lstrlenA (lpString="*.eml") returned 5
	[0047.660] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.part") returned 0
	[0047.660] lstrlenA (lpString="*.part") returned 6
	[0047.660] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.nfo") returned 0
	[0047.660] lstrlenA (lpString="*.nfo") returned 5
	[0047.660] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.rsa") returned 0
	[0047.660] lstrlenA (lpString="*.rsa") returned 5
	[0047.660] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.key") returned 0
	[0047.660] lstrlenA (lpString="*.key") returned 5
	[0047.660] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.aes") returned 0
	[0047.660] lstrlenA (lpString="*.aes") returned 5
	[0047.660] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.blob") returned 0
	[0047.660] lstrlenA (lpString="*.blob") returned 6
	[0047.660] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.btc") returned 0
	[0047.660] lstrlenA (lpString="*.btc") returned 5
	[0047.660] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.wallet") returned 0
	[0047.660] lstrlenA (lpString="*.wallet") returned 8
	[0047.660] FindNextFileA (in: hFindFile=0x7cba90, lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1
	[0047.660] lstrcmpA (lpString1=".", lpString2="588bce7c90097ed212") returned -1
	[0047.660] lstrcmpA (lpString1="..", lpString2="588bce7c90097ed212") returned -1
	[0047.660] PathFindFileNameA (pszPath="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned="$WINRE_BACKUP_PARTITION.MARKER"
	[0047.660] lstrcatA (in: lpString1="C:\\", lpString2="588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0047.660] lstrlenA (lpString="C:\\588bce7c90097ed212") returned 21
	[0047.660] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\*.*", lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c6e50, dwReserved1=0x48, cFileName=".", cAlternateFileName="")) returned 0x7cb950
	[0047.850] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0047.850] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c6e50, dwReserved1=0x48, cFileName="..", cAlternateFileName="")) returned 1
	[0047.850] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0047.850] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0047.850] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c6e50, dwReserved1=0x48, cFileName="1025", cAlternateFileName="")) returned 1
	[0047.850] lstrcmpA (lpString1=".", lpString2="1025") returned -1
	[0047.850] lstrcmpA (lpString1="..", lpString2="1025") returned -1
	[0047.850] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*"
	[0047.850] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1025" | out: lpString1="C:\\588bce7c90097ed212\\1025") returned="C:\\588bce7c90097ed212\\1025"
	[0047.850] lstrlenA (lpString="C:\\588bce7c90097ed212\\1025") returned 26
	[0047.851] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffffe, dwReserved1=0x7cfd30, cFileName=".", cAlternateFileName="")) returned 0x7cb850
	[0047.851] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0047.851] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffffe, dwReserved1=0x7cfd30, cFileName="..", cAlternateFileName="")) returned 1
	[0047.851] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0047.851] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0047.851] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0xfffffffe, dwReserved1=0x7cfd30, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0047.851] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0047.851] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="eula.rtf") returned -1
	[0047.851] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="eula.rtf") returned 1
	[0047.851] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1
	[0047.852] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1025\\*.*") returned="*.*"
	[0047.852] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1025\\" | out: lpString1="C:\\588bce7c90097ed212\\1025\\") returned="C:\\588bce7c90097ed212\\1025\\"
	[0047.852] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1025\\" | out: pszPath="C:\\588bce7c90097ed212\\1025\\") returned=""
	[0047.852] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1025\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1025\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1025\\HOW-TO-DECRYPT-FILES.HTM"
	[0047.852] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1025\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1025\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0047.852] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1025\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1025\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0047.853] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0047.853] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0047.854] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0047.854] CloseHandle (hObject=0x208) returned 1
	[0047.855] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1025\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned="C:\\588bce7c90097ed212\\1025\\eula.rtf"
	[0047.855] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.zip") returned 0
	[0047.855] lstrlenA (lpString="*.zip") returned 5
	[0047.855] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.rar") returned 0
	[0047.855] lstrlenA (lpString="*.rar") returned 5
	[0047.855] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.7z") returned 0
	[0047.855] lstrlenA (lpString="*.7z") returned 4
	[0047.855] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.tar") returned 0
	[0047.855] lstrlenA (lpString="*.tar") returned 5
	[0047.855] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.gzip") returned 0
	[0047.855] lstrlenA (lpString="*.gzip") returned 6
	[0047.855] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.jpg") returned 0
	[0047.855] lstrlenA (lpString="*.jpg") returned 5
	[0047.855] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.jpeg") returned 0
	[0047.855] lstrlenA (lpString="*.jpeg") returned 6
	[0047.855] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.bmp") returned 0
	[0047.855] lstrlenA (lpString="*.bmp") returned 5
	[0047.855] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.gif") returned 0
	[0047.855] lstrlenA (lpString="*.gif") returned 5
	[0047.855] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.png") returned 0
	[0047.855] lstrlenA (lpString="*.png") returned 5
	[0047.855] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.doc") returned 0
	[0047.855] lstrlenA (lpString="*.doc") returned 5
	[0047.855] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.docx") returned 0
	[0047.855] lstrlenA (lpString="*.docx") returned 6
	[0047.855] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.xls") returned 0
	[0047.855] lstrlenA (lpString="*.xls") returned 5
	[0047.855] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.xlsx") returned 0
	[0047.855] lstrlenA (lpString="*.xlsx") returned 6
	[0047.855] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.ppt") returned 0
	[0047.855] lstrlenA (lpString="*.ppt") returned 5
	[0047.855] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.pptx") returned 0
	[0047.855] lstrlenA (lpString="*.pptx") returned 6
	[0047.855] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.txt") returned 0
	[0047.855] lstrlenA (lpString="*.txt") returned 5
	[0047.856] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.pdf") returned 0
	[0047.856] lstrlenA (lpString="*.pdf") returned 5
	[0047.856] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.htm") returned 0
	[0047.856] lstrlenA (lpString="*.htm") returned 5
	[0047.856] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.html") returned 0
	[0047.856] lstrlenA (lpString="*.html") returned 6
	[0047.856] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.mdb") returned 0
	[0047.856] lstrlenA (lpString="*.mdb") returned 5
	[0047.856] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.pfx") returned 0
	[0047.856] lstrlenA (lpString="*.pfx") returned 5
	[0047.856] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.md") returned 0
	[0047.856] lstrlenA (lpString="*.md") returned 4
	[0047.856] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.lnk") returned 0
	[0047.856] lstrlenA (lpString="*.lnk") returned 5
	[0047.856] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.torrent") returned 0
	[0047.856] lstrlenA (lpString="*.torrent") returned 9
	[0047.856] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.mov") returned 0
	[0047.856] lstrlenA (lpString="*.mov") returned 5
	[0047.856] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.3gp") returned 0
	[0047.856] lstrlenA (lpString="*.3gp") returned 5
	[0047.856] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.mpeg") returned 0
	[0047.856] lstrlenA (lpString="*.mpeg") returned 6
	[0047.856] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.mpg") returned 0
	[0047.856] lstrlenA (lpString="*.mpg") returned 5
	[0047.856] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.flv") returned 0
	[0047.856] lstrlenA (lpString="*.flv") returned 5
	[0047.856] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.avi") returned 0
	[0047.856] lstrlenA (lpString="*.avi") returned 5
	[0047.856] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.mp4") returned 0
	[0047.856] lstrlenA (lpString="*.mp4") returned 5
	[0047.856] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.wmv") returned 0
	[0047.856] lstrlenA (lpString="*.wmv") returned 5
	[0047.856] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.mkv") returned 0
	[0047.856] lstrlenA (lpString="*.mkv") returned 5
	[0047.856] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.mp3") returned 0
	[0047.856] lstrlenA (lpString="*.mp3") returned 5
	[0047.856] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.wav") returned 0
	[0047.857] lstrlenA (lpString="*.wav") returned 5
	[0047.857] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.flac") returned 0
	[0047.857] lstrlenA (lpString="*.flac") returned 6
	[0047.857] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.wma") returned 0
	[0047.857] lstrlenA (lpString="*.wma") returned 5
	[0047.857] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.au3") returned 0
	[0047.857] lstrlenA (lpString="*.au3") returned 5
	[0047.857] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.ahk") returned 0
	[0047.857] lstrlenA (lpString="*.ahk") returned 5
	[0047.857] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.c") returned 0
	[0047.857] lstrlenA (lpString="*.c") returned 3
	[0047.857] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.cc") returned 0
	[0047.857] lstrlenA (lpString="*.cc") returned 4
	[0047.857] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.cpp") returned 0
	[0047.857] lstrlenA (lpString="*.cpp") returned 5
	[0047.857] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.cxx") returned 0
	[0047.857] lstrlenA (lpString="*.cxx") returned 5
	[0047.857] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.c++") returned 0
	[0047.857] lstrlenA (lpString="*.c++") returned 5
	[0047.857] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.cs") returned 0
	[0047.857] lstrlenA (lpString="*.cs") returned 4
	[0047.857] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.vb") returned 0
	[0047.857] lstrlenA (lpString="*.vb") returned 4
	[0047.857] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.bas") returned 0
	[0047.857] lstrlenA (lpString="*.bas") returned 5
	[0047.857] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.csproj") returned 0
	[0047.857] lstrlenA (lpString="*.csproj") returned 8
	[0047.857] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.vbproj") returned 0
	[0047.857] lstrlenA (lpString="*.vbproj") returned 8
	[0047.857] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.vcxproj") returned 0
	[0047.857] lstrlenA (lpString="*.vcxproj") returned 9
	[0047.857] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.manifest") returned 0
	[0047.857] lstrlenA (lpString="*.manifest") returned 10
	[0047.857] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.php") returned 0
	[0047.857] lstrlenA (lpString="*.php") returned 5
	[0047.857] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.vbe") returned 0
	[0047.857] lstrlenA (lpString="*.vbe") returned 5
	[0047.858] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.vba") returned 0
	[0047.858] lstrlenA (lpString="*.vba") returned 5
	[0047.858] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.vbs") returned 0
	[0047.858] lstrlenA (lpString="*.vbs") returned 5
	[0047.858] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.bat") returned 0
	[0047.858] lstrlenA (lpString="*.bat") returned 5
	[0047.858] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.cmd") returned 0
	[0047.858] lstrlenA (lpString="*.cmd") returned 5
	[0047.858] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.js") returned 0
	[0047.858] lstrlenA (lpString="*.js") returned 4
	[0047.858] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.jscript") returned 0
	[0047.858] lstrlenA (lpString="*.jscript") returned 9
	[0047.858] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.hta") returned 0
	[0047.858] lstrlenA (lpString="*.hta") returned 5
	[0047.858] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.php7") returned 0
	[0047.858] lstrlenA (lpString="*.php7") returned 6
	[0047.858] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.db") returned 0
	[0047.858] lstrlenA (lpString="*.db") returned 4
	[0047.858] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.swf") returned 0
	[0047.858] lstrlenA (lpString="*.swf") returned 5
	[0047.858] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.eml") returned 0
	[0047.858] lstrlenA (lpString="*.eml") returned 5
	[0047.858] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.part") returned 0
	[0047.858] lstrlenA (lpString="*.part") returned 6
	[0047.858] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.nfo") returned 0
	[0047.858] lstrlenA (lpString="*.nfo") returned 5
	[0047.858] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.rsa") returned 0
	[0047.858] lstrlenA (lpString="*.rsa") returned 5
	[0047.858] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.key") returned 0
	[0047.858] lstrlenA (lpString="*.key") returned 5
	[0047.858] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.aes") returned 0
	[0047.858] lstrlenA (lpString="*.aes") returned 5
	[0047.858] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.blob") returned 0
	[0047.858] lstrlenA (lpString="*.blob") returned 6
	[0047.858] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.btc") returned 0
	[0047.858] lstrlenA (lpString="*.btc") returned 5
	[0047.859] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.wallet") returned 0
	[0047.859] lstrlenA (lpString="*.wallet") returned 8
	[0047.859] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0047.859] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0047.859] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="LocalizedData.xml") returned -1
	[0047.859] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="LocalizedData.xml") returned -1
	[0047.859] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1
	[0047.859] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned="eula.rtf"
	[0047.859] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1025\\" | out: lpString1="C:\\588bce7c90097ed212\\1025\\") returned="C:\\588bce7c90097ed212\\1025\\"
	[0047.859] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1025\\" | out: pszPath="C:\\588bce7c90097ed212\\1025\\") returned=""
	[0047.859] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1025\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1025\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1025\\HOW-TO-DECRYPT-FILES.HTM"
	[0047.859] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1025\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1025\\how-to-decrypt-files.htm")) returned 0x20
	[0047.859] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1025\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml"
	[0047.859] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.zip") returned 0
	[0047.859] lstrlenA (lpString="*.zip") returned 5
	[0047.859] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.rar") returned 0
	[0047.859] lstrlenA (lpString="*.rar") returned 5
	[0047.859] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.7z") returned 0
	[0047.859] lstrlenA (lpString="*.7z") returned 4
	[0047.859] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.tar") returned 0
	[0047.859] lstrlenA (lpString="*.tar") returned 5
	[0047.859] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.gzip") returned 0
	[0047.859] lstrlenA (lpString="*.gzip") returned 6
	[0047.859] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.jpg") returned 0
	[0047.859] lstrlenA (lpString="*.jpg") returned 5
	[0047.859] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.jpeg") returned 0
	[0047.859] lstrlenA (lpString="*.jpeg") returned 6
	[0047.859] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.bmp") returned 0
	[0047.859] lstrlenA (lpString="*.bmp") returned 5
	[0047.859] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.gif") returned 0
	[0047.859] lstrlenA (lpString="*.gif") returned 5
	[0047.859] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.png") returned 0
	[0047.859] lstrlenA (lpString="*.png") returned 5
	[0047.860] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.doc") returned 0
	[0047.860] lstrlenA (lpString="*.doc") returned 5
	[0047.860] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.docx") returned 0
	[0047.860] lstrlenA (lpString="*.docx") returned 6
	[0047.860] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.xls") returned 0
	[0047.860] lstrlenA (lpString="*.xls") returned 5
	[0047.860] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.xlsx") returned 0
	[0047.860] lstrlenA (lpString="*.xlsx") returned 6
	[0047.860] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.ppt") returned 0
	[0047.860] lstrlenA (lpString="*.ppt") returned 5
	[0047.860] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.pptx") returned 0
	[0047.860] lstrlenA (lpString="*.pptx") returned 6
	[0047.860] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.txt") returned 0
	[0047.860] lstrlenA (lpString="*.txt") returned 5
	[0047.860] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.pdf") returned 0
	[0047.860] lstrlenA (lpString="*.pdf") returned 5
	[0047.860] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.htm") returned 0
	[0047.860] lstrlenA (lpString="*.htm") returned 5
	[0047.860] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.html") returned 0
	[0047.860] lstrlenA (lpString="*.html") returned 6
	[0047.860] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.mdb") returned 0
	[0047.860] lstrlenA (lpString="*.mdb") returned 5
	[0047.860] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.pfx") returned 0
	[0047.860] lstrlenA (lpString="*.pfx") returned 5
	[0047.860] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.md") returned 0
	[0047.860] lstrlenA (lpString="*.md") returned 4
	[0047.860] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.lnk") returned 0
	[0047.860] lstrlenA (lpString="*.lnk") returned 5
	[0047.860] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.torrent") returned 0
	[0047.860] lstrlenA (lpString="*.torrent") returned 9
	[0047.860] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.mov") returned 0
	[0047.860] lstrlenA (lpString="*.mov") returned 5
	[0047.860] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.3gp") returned 0
	[0047.860] lstrlenA (lpString="*.3gp") returned 5
	[0047.860] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.mpeg") returned 0
	[0047.860] lstrlenA (lpString="*.mpeg") returned 6
	[0047.861] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.mpg") returned 0
	[0047.861] lstrlenA (lpString="*.mpg") returned 5
	[0047.861] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.flv") returned 0
	[0047.861] lstrlenA (lpString="*.flv") returned 5
	[0047.861] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.avi") returned 0
	[0047.861] lstrlenA (lpString="*.avi") returned 5
	[0047.861] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.mp4") returned 0
	[0047.861] lstrlenA (lpString="*.mp4") returned 5
	[0047.861] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.wmv") returned 0
	[0047.861] lstrlenA (lpString="*.wmv") returned 5
	[0047.861] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.mkv") returned 0
	[0047.861] lstrlenA (lpString="*.mkv") returned 5
	[0047.861] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.mp3") returned 0
	[0047.861] lstrlenA (lpString="*.mp3") returned 5
	[0047.861] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.wav") returned 0
	[0047.861] lstrlenA (lpString="*.wav") returned 5
	[0047.861] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.flac") returned 0
	[0047.861] lstrlenA (lpString="*.flac") returned 6
	[0047.861] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.wma") returned 0
	[0047.861] lstrlenA (lpString="*.wma") returned 5
	[0047.861] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.au3") returned 0
	[0047.861] lstrlenA (lpString="*.au3") returned 5
	[0047.861] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.ahk") returned 0
	[0047.861] lstrlenA (lpString="*.ahk") returned 5
	[0047.861] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.c") returned 0
	[0047.861] lstrlenA (lpString="*.c") returned 3
	[0047.861] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.cc") returned 0
	[0047.861] lstrlenA (lpString="*.cc") returned 4
	[0047.861] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.cpp") returned 0
	[0047.861] lstrlenA (lpString="*.cpp") returned 5
	[0047.861] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.cxx") returned 0
	[0047.861] lstrlenA (lpString="*.cxx") returned 5
	[0047.861] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.c++") returned 0
	[0047.861] lstrlenA (lpString="*.c++") returned 5
	[0047.861] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.cs") returned 0
	[0047.861] lstrlenA (lpString="*.cs") returned 4
	[0047.862] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.vb") returned 0
	[0047.862] lstrlenA (lpString="*.vb") returned 4
	[0047.862] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.bas") returned 0
	[0047.862] lstrlenA (lpString="*.bas") returned 5
	[0047.862] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.csproj") returned 0
	[0047.862] lstrlenA (lpString="*.csproj") returned 8
	[0047.862] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.vbproj") returned 0
	[0047.862] lstrlenA (lpString="*.vbproj") returned 8
	[0047.862] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.vcxproj") returned 0
	[0047.862] lstrlenA (lpString="*.vcxproj") returned 9
	[0047.862] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.manifest") returned 0
	[0047.862] lstrlenA (lpString="*.manifest") returned 10
	[0047.862] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.php") returned 0
	[0047.862] lstrlenA (lpString="*.php") returned 5
	[0047.862] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.vbe") returned 0
	[0047.862] lstrlenA (lpString="*.vbe") returned 5
	[0047.862] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.vba") returned 0
	[0047.862] lstrlenA (lpString="*.vba") returned 5
	[0047.862] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.vbs") returned 0
	[0047.862] lstrlenA (lpString="*.vbs") returned 5
	[0047.862] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.bat") returned 0
	[0047.862] lstrlenA (lpString="*.bat") returned 5
	[0047.862] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.cmd") returned 0
	[0047.862] lstrlenA (lpString="*.cmd") returned 5
	[0047.862] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.js") returned 0
	[0047.862] lstrlenA (lpString="*.js") returned 4
	[0047.862] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.jscript") returned 0
	[0047.862] lstrlenA (lpString="*.jscript") returned 9
	[0047.862] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.hta") returned 0
	[0047.862] lstrlenA (lpString="*.hta") returned 5
	[0047.862] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.php7") returned 0
	[0047.862] lstrlenA (lpString="*.php7") returned 6
	[0047.862] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.db") returned 0
	[0047.862] lstrlenA (lpString="*.db") returned 4
	[0047.862] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.swf") returned 0
	[0047.862] lstrlenA (lpString="*.swf") returned 5
	[0047.862] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.eml") returned 0
	[0047.863] lstrlenA (lpString="*.eml") returned 5
	[0047.863] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.part") returned 0
	[0047.863] lstrlenA (lpString="*.part") returned 6
	[0047.863] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.nfo") returned 0
	[0047.863] lstrlenA (lpString="*.nfo") returned 5
	[0047.863] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.rsa") returned 0
	[0047.863] lstrlenA (lpString="*.rsa") returned 5
	[0047.863] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.key") returned 0
	[0047.863] lstrlenA (lpString="*.key") returned 5
	[0047.863] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.aes") returned 0
	[0047.863] lstrlenA (lpString="*.aes") returned 5
	[0047.863] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.blob") returned 0
	[0047.863] lstrlenA (lpString="*.blob") returned 6
	[0047.863] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.btc") returned 0
	[0047.863] lstrlenA (lpString="*.btc") returned 5
	[0047.863] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.wallet") returned 0
	[0047.863] lstrlenA (lpString="*.wallet") returned 8
	[0047.863] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0047.863] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0047.863] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SetupResources.dll") returned -1
	[0047.863] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SetupResources.dll") returned -1
	[0047.863] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1
	[0047.863] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned="LocalizedData.xml"
	[0047.863] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1025\\" | out: lpString1="C:\\588bce7c90097ed212\\1025\\") returned="C:\\588bce7c90097ed212\\1025\\"
	[0047.863] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1025\\" | out: pszPath="C:\\588bce7c90097ed212\\1025\\") returned=""
	[0047.863] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1025\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1025\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1025\\HOW-TO-DECRYPT-FILES.HTM"
	[0047.863] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1025\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1025\\how-to-decrypt-files.htm")) returned 0x20
	[0047.863] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1025\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1025\\SetupResources.dll"
	[0047.863] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.zip") returned 0
	[0047.863] lstrlenA (lpString="*.zip") returned 5
	[0047.863] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.rar") returned 0
	[0047.863] lstrlenA (lpString="*.rar") returned 5
	[0047.863] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.7z") returned 0
	[0047.863] lstrlenA (lpString="*.7z") returned 4
	[0047.864] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.tar") returned 0
	[0047.864] lstrlenA (lpString="*.tar") returned 5
	[0047.864] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.gzip") returned 0
	[0047.864] lstrlenA (lpString="*.gzip") returned 6
	[0047.864] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.jpg") returned 0
	[0047.864] lstrlenA (lpString="*.jpg") returned 5
	[0047.864] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.jpeg") returned 0
	[0047.864] lstrlenA (lpString="*.jpeg") returned 6
	[0047.864] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.bmp") returned 0
	[0047.864] lstrlenA (lpString="*.bmp") returned 5
	[0047.864] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.gif") returned 0
	[0047.864] lstrlenA (lpString="*.gif") returned 5
	[0047.864] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.png") returned 0
	[0047.864] lstrlenA (lpString="*.png") returned 5
	[0047.864] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.doc") returned 0
	[0047.864] lstrlenA (lpString="*.doc") returned 5
	[0047.864] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.docx") returned 0
	[0047.864] lstrlenA (lpString="*.docx") returned 6
	[0047.864] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.xls") returned 0
	[0047.864] lstrlenA (lpString="*.xls") returned 5
	[0047.864] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.xlsx") returned 0
	[0047.864] lstrlenA (lpString="*.xlsx") returned 6
	[0047.864] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.ppt") returned 0
	[0047.864] lstrlenA (lpString="*.ppt") returned 5
	[0047.864] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.pptx") returned 0
	[0047.864] lstrlenA (lpString="*.pptx") returned 6
	[0047.864] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.txt") returned 0
	[0047.864] lstrlenA (lpString="*.txt") returned 5
	[0047.864] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.pdf") returned 0
	[0047.864] lstrlenA (lpString="*.pdf") returned 5
	[0047.864] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.htm") returned 0
	[0047.864] lstrlenA (lpString="*.htm") returned 5
	[0047.864] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.html") returned 0
	[0047.864] lstrlenA (lpString="*.html") returned 6
	[0047.864] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.mdb") returned 0
	[0047.864] lstrlenA (lpString="*.mdb") returned 5
	[0047.864] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.pfx") returned 0
	[0047.865] lstrlenA (lpString="*.pfx") returned 5
	[0047.865] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.md") returned 0
	[0047.865] lstrlenA (lpString="*.md") returned 4
	[0047.865] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.lnk") returned 0
	[0047.865] lstrlenA (lpString="*.lnk") returned 5
	[0047.865] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.torrent") returned 0
	[0047.865] lstrlenA (lpString="*.torrent") returned 9
	[0047.865] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.mov") returned 0
	[0047.865] lstrlenA (lpString="*.mov") returned 5
	[0047.865] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.3gp") returned 0
	[0047.865] lstrlenA (lpString="*.3gp") returned 5
	[0047.865] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.mpeg") returned 0
	[0047.865] lstrlenA (lpString="*.mpeg") returned 6
	[0047.865] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.mpg") returned 0
	[0047.865] lstrlenA (lpString="*.mpg") returned 5
	[0047.866] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.flv") returned 0
	[0047.866] lstrlenA (lpString="*.flv") returned 5
	[0047.866] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.avi") returned 0
	[0047.866] lstrlenA (lpString="*.avi") returned 5
	[0047.866] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.mp4") returned 0
	[0047.866] lstrlenA (lpString="*.mp4") returned 5
	[0047.866] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.wmv") returned 0
	[0047.866] lstrlenA (lpString="*.wmv") returned 5
	[0047.866] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.mkv") returned 0
	[0047.866] lstrlenA (lpString="*.mkv") returned 5
	[0047.866] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.mp3") returned 0
	[0047.866] lstrlenA (lpString="*.mp3") returned 5
	[0047.866] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.wav") returned 0
	[0047.866] lstrlenA (lpString="*.wav") returned 5
	[0047.866] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.flac") returned 0
	[0047.866] lstrlenA (lpString="*.flac") returned 6
	[0047.866] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.wma") returned 0
	[0047.866] lstrlenA (lpString="*.wma") returned 5
	[0047.866] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.au3") returned 0
	[0047.866] lstrlenA (lpString="*.au3") returned 5
	[0047.866] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.ahk") returned 0
	[0047.866] lstrlenA (lpString="*.ahk") returned 5
	[0047.866] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.c") returned 0
	[0047.866] lstrlenA (lpString="*.c") returned 3
	[0047.866] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.cc") returned 0
	[0047.866] lstrlenA (lpString="*.cc") returned 4
	[0047.866] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.cpp") returned 0
	[0047.866] lstrlenA (lpString="*.cpp") returned 5
	[0047.866] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.cxx") returned 0
	[0047.866] lstrlenA (lpString="*.cxx") returned 5
	[0047.866] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.c++") returned 0
	[0047.866] lstrlenA (lpString="*.c++") returned 5
	[0047.866] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.cs") returned 0
	[0047.866] lstrlenA (lpString="*.cs") returned 4
	[0047.866] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.vb") returned 0
	[0047.866] lstrlenA (lpString="*.vb") returned 4
	[0047.866] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.bas") returned 0
	[0047.867] lstrlenA (lpString="*.bas") returned 5
	[0047.867] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.csproj") returned 0
	[0047.867] lstrlenA (lpString="*.csproj") returned 8
	[0047.867] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.vbproj") returned 0
	[0047.867] lstrlenA (lpString="*.vbproj") returned 8
	[0047.867] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.vcxproj") returned 0
	[0047.867] lstrlenA (lpString="*.vcxproj") returned 9
	[0047.867] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.manifest") returned 0
	[0047.867] lstrlenA (lpString="*.manifest") returned 10
	[0047.867] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.php") returned 0
	[0047.867] lstrlenA (lpString="*.php") returned 5
	[0047.867] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.vbe") returned 0
	[0047.867] lstrlenA (lpString="*.vbe") returned 5
	[0047.867] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.vba") returned 0
	[0047.867] lstrlenA (lpString="*.vba") returned 5
	[0047.867] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.vbs") returned 0
	[0047.867] lstrlenA (lpString="*.vbs") returned 5
	[0047.867] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.bat") returned 0
	[0047.867] lstrlenA (lpString="*.bat") returned 5
	[0047.867] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.cmd") returned 0
	[0047.867] lstrlenA (lpString="*.cmd") returned 5
	[0047.867] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.js") returned 0
	[0047.867] lstrlenA (lpString="*.js") returned 4
	[0047.867] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.jscript") returned 0
	[0047.867] lstrlenA (lpString="*.jscript") returned 9
	[0047.867] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.hta") returned 0
	[0047.867] lstrlenA (lpString="*.hta") returned 5
	[0047.867] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.php7") returned 0
	[0047.867] lstrlenA (lpString="*.php7") returned 6
	[0047.867] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.db") returned 0
	[0047.867] lstrlenA (lpString="*.db") returned 4
	[0047.867] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.swf") returned 0
	[0047.867] lstrlenA (lpString="*.swf") returned 5
	[0047.867] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.eml") returned 0
	[0047.867] lstrlenA (lpString="*.eml") returned 5
	[0047.867] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.part") returned 0
	[0047.867] lstrlenA (lpString="*.part") returned 6
	[0047.868] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.nfo") returned 0
	[0047.868] lstrlenA (lpString="*.nfo") returned 5
	[0047.868] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.rsa") returned 0
	[0047.868] lstrlenA (lpString="*.rsa") returned 5
	[0047.868] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.key") returned 0
	[0047.868] lstrlenA (lpString="*.key") returned 5
	[0047.868] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.aes") returned 0
	[0047.868] lstrlenA (lpString="*.aes") returned 5
	[0047.868] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.blob") returned 0
	[0047.868] lstrlenA (lpString="*.blob") returned 6
	[0047.868] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.btc") returned 0
	[0047.868] lstrlenA (lpString="*.btc") returned 5
	[0047.868] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.wallet") returned 0
	[0047.868] lstrlenA (lpString="*.wallet") returned 8
	[0047.868] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0047.868] FindClose (in: hFindFile=0x7cb850 | out: hFindFile=0x7cb850) returned 1
	[0047.868] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d1d40, dwReserved1=0x7b00c0, cFileName="1028", cAlternateFileName="")) returned 1
	[0047.868] lstrcmpA (lpString1=".", lpString2="1028") returned -1
	[0047.868] lstrcmpA (lpString1="..", lpString2="1028") returned -1
	[0047.868] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*"
	[0047.868] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1028" | out: lpString1="C:\\588bce7c90097ed212\\1028") returned="C:\\588bce7c90097ed212\\1028"
	[0047.868] lstrlenA (lpString="C:\\588bce7c90097ed212\\1028") returned 26
	[0047.868] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb750
	[0047.869] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0047.869] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0047.869] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0047.869] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0047.869] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0047.869] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0047.869] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="eula.rtf") returned -1
	[0047.869] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="eula.rtf") returned 1
	[0047.869] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1
	[0047.869] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1028\\*.*") returned="*.*"
	[0047.869] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1028\\" | out: lpString1="C:\\588bce7c90097ed212\\1028\\") returned="C:\\588bce7c90097ed212\\1028\\"
	[0047.869] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1028\\" | out: pszPath="C:\\588bce7c90097ed212\\1028\\") returned=""
	[0047.869] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1028\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1028\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1028\\HOW-TO-DECRYPT-FILES.HTM"
	[0047.869] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1028\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1028\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0047.869] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1028\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1028\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0047.872] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0047.872] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0047.873] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0047.873] CloseHandle (hObject=0x208) returned 1
	[0047.873] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1028\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned="C:\\588bce7c90097ed212\\1028\\eula.rtf"
	[0047.873] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.zip") returned 0
	[0047.873] lstrlenA (lpString="*.zip") returned 5
	[0047.873] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.rar") returned 0
	[0047.873] lstrlenA (lpString="*.rar") returned 5
	[0047.873] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.7z") returned 0
	[0047.873] lstrlenA (lpString="*.7z") returned 4
	[0047.873] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.tar") returned 0
	[0047.873] lstrlenA (lpString="*.tar") returned 5
	[0047.873] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.gzip") returned 0
	[0047.873] lstrlenA (lpString="*.gzip") returned 6
	[0047.873] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.jpg") returned 0
	[0047.873] lstrlenA (lpString="*.jpg") returned 5
	[0047.873] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.jpeg") returned 0
	[0047.873] lstrlenA (lpString="*.jpeg") returned 6
	[0047.873] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.bmp") returned 0
	[0047.873] lstrlenA (lpString="*.bmp") returned 5
	[0047.873] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.gif") returned 0
	[0047.873] lstrlenA (lpString="*.gif") returned 5
	[0047.873] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.png") returned 0
	[0047.873] lstrlenA (lpString="*.png") returned 5
	[0047.873] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.doc") returned 0
	[0047.873] lstrlenA (lpString="*.doc") returned 5
	[0047.874] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.docx") returned 0
	[0047.874] lstrlenA (lpString="*.docx") returned 6
	[0047.874] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.xls") returned 0
	[0047.874] lstrlenA (lpString="*.xls") returned 5
	[0047.874] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.xlsx") returned 0
	[0047.874] lstrlenA (lpString="*.xlsx") returned 6
	[0047.874] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.ppt") returned 0
	[0047.874] lstrlenA (lpString="*.ppt") returned 5
	[0047.874] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.pptx") returned 0
	[0047.874] lstrlenA (lpString="*.pptx") returned 6
	[0047.874] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.txt") returned 0
	[0047.874] lstrlenA (lpString="*.txt") returned 5
	[0047.874] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.pdf") returned 0
	[0047.874] lstrlenA (lpString="*.pdf") returned 5
	[0047.874] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.htm") returned 0
	[0047.874] lstrlenA (lpString="*.htm") returned 5
	[0047.874] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.html") returned 0
	[0047.874] lstrlenA (lpString="*.html") returned 6
	[0047.874] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.mdb") returned 0
	[0047.874] lstrlenA (lpString="*.mdb") returned 5
	[0047.874] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.pfx") returned 0
	[0047.874] lstrlenA (lpString="*.pfx") returned 5
	[0047.874] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.md") returned 0
	[0047.874] lstrlenA (lpString="*.md") returned 4
	[0047.874] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.lnk") returned 0
	[0047.874] lstrlenA (lpString="*.lnk") returned 5
	[0047.874] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.torrent") returned 0
	[0047.874] lstrlenA (lpString="*.torrent") returned 9
	[0047.874] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.mov") returned 0
	[0047.874] lstrlenA (lpString="*.mov") returned 5
	[0047.874] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.3gp") returned 0
	[0047.874] lstrlenA (lpString="*.3gp") returned 5
	[0047.874] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.mpeg") returned 0
	[0047.874] lstrlenA (lpString="*.mpeg") returned 6
	[0047.874] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.mpg") returned 0
	[0047.874] lstrlenA (lpString="*.mpg") returned 5
	[0047.874] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.flv") returned 0
	[0047.875] lstrlenA (lpString="*.flv") returned 5
	[0047.875] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.avi") returned 0
	[0047.875] lstrlenA (lpString="*.avi") returned 5
	[0047.875] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.mp4") returned 0
	[0047.875] lstrlenA (lpString="*.mp4") returned 5
	[0047.875] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.wmv") returned 0
	[0047.875] lstrlenA (lpString="*.wmv") returned 5
	[0047.875] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.mkv") returned 0
	[0047.875] lstrlenA (lpString="*.mkv") returned 5
	[0047.875] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.mp3") returned 0
	[0047.875] lstrlenA (lpString="*.mp3") returned 5
	[0047.875] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.wav") returned 0
	[0047.875] lstrlenA (lpString="*.wav") returned 5
	[0047.875] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.flac") returned 0
	[0047.875] lstrlenA (lpString="*.flac") returned 6
	[0047.875] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.wma") returned 0
	[0047.875] lstrlenA (lpString="*.wma") returned 5
	[0047.875] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.au3") returned 0
	[0047.875] lstrlenA (lpString="*.au3") returned 5
	[0047.875] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.ahk") returned 0
	[0047.875] lstrlenA (lpString="*.ahk") returned 5
	[0047.875] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.c") returned 0
	[0047.875] lstrlenA (lpString="*.c") returned 3
	[0047.875] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.cc") returned 0
	[0047.875] lstrlenA (lpString="*.cc") returned 4
	[0047.875] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.cpp") returned 0
	[0047.875] lstrlenA (lpString="*.cpp") returned 5
	[0047.875] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.cxx") returned 0
	[0047.875] lstrlenA (lpString="*.cxx") returned 5
	[0047.875] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.c++") returned 0
	[0047.875] lstrlenA (lpString="*.c++") returned 5
	[0047.875] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.cs") returned 0
	[0047.875] lstrlenA (lpString="*.cs") returned 4
	[0047.875] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.vb") returned 0
	[0047.875] lstrlenA (lpString="*.vb") returned 4
	[0047.875] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.bas") returned 0
	[0047.875] lstrlenA (lpString="*.bas") returned 5
	[0047.876] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.csproj") returned 0
	[0047.876] lstrlenA (lpString="*.csproj") returned 8
	[0047.876] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.vbproj") returned 0
	[0047.876] lstrlenA (lpString="*.vbproj") returned 8
	[0047.876] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.vcxproj") returned 0
	[0047.876] lstrlenA (lpString="*.vcxproj") returned 9
	[0047.876] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.manifest") returned 0
	[0047.876] lstrlenA (lpString="*.manifest") returned 10
	[0047.876] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.php") returned 0
	[0047.876] lstrlenA (lpString="*.php") returned 5
	[0047.876] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.vbe") returned 0
	[0047.876] lstrlenA (lpString="*.vbe") returned 5
	[0047.876] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.vba") returned 0
	[0047.876] lstrlenA (lpString="*.vba") returned 5
	[0047.876] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.vbs") returned 0
	[0047.876] lstrlenA (lpString="*.vbs") returned 5
	[0047.876] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.bat") returned 0
	[0047.876] lstrlenA (lpString="*.bat") returned 5
	[0047.876] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.cmd") returned 0
	[0047.876] lstrlenA (lpString="*.cmd") returned 5
	[0047.876] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.js") returned 0
	[0047.876] lstrlenA (lpString="*.js") returned 4
	[0047.876] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.jscript") returned 0
	[0047.876] lstrlenA (lpString="*.jscript") returned 9
	[0047.876] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.hta") returned 0
	[0047.876] lstrlenA (lpString="*.hta") returned 5
	[0047.876] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.php7") returned 0
	[0047.876] lstrlenA (lpString="*.php7") returned 6
	[0047.876] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.db") returned 0
	[0047.876] lstrlenA (lpString="*.db") returned 4
	[0047.876] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.swf") returned 0
	[0047.876] lstrlenA (lpString="*.swf") returned 5
	[0047.876] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.eml") returned 0
	[0047.876] lstrlenA (lpString="*.eml") returned 5
	[0047.876] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.part") returned 0
	[0047.876] lstrlenA (lpString="*.part") returned 6
	[0047.876] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.nfo") returned 0
	[0047.876] lstrlenA (lpString="*.nfo") returned 5
	[0047.877] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.rsa") returned 0
	[0047.877] lstrlenA (lpString="*.rsa") returned 5
	[0047.877] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.key") returned 0
	[0047.877] lstrlenA (lpString="*.key") returned 5
	[0047.877] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.aes") returned 0
	[0047.877] lstrlenA (lpString="*.aes") returned 5
	[0047.877] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.blob") returned 0
	[0047.877] lstrlenA (lpString="*.blob") returned 6
	[0047.877] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.btc") returned 0
	[0047.877] lstrlenA (lpString="*.btc") returned 5
	[0047.877] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.wallet") returned 0
	[0047.877] lstrlenA (lpString="*.wallet") returned 8
	[0047.877] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0047.877] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0047.877] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="LocalizedData.xml") returned -1
	[0047.877] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="LocalizedData.xml") returned -1
	[0047.877] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1
	[0047.877] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned="eula.rtf"
	[0047.877] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1028\\" | out: lpString1="C:\\588bce7c90097ed212\\1028\\") returned="C:\\588bce7c90097ed212\\1028\\"
	[0047.877] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1028\\" | out: pszPath="C:\\588bce7c90097ed212\\1028\\") returned=""
	[0047.877] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1028\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1028\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1028\\HOW-TO-DECRYPT-FILES.HTM"
	[0047.877] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1028\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1028\\how-to-decrypt-files.htm")) returned 0x20
	[0047.877] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1028\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml"
	[0047.877] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.zip") returned 0
	[0047.877] lstrlenA (lpString="*.zip") returned 5
	[0047.877] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.rar") returned 0
	[0047.877] lstrlenA (lpString="*.rar") returned 5
	[0047.877] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.7z") returned 0
	[0047.877] lstrlenA (lpString="*.7z") returned 4
	[0047.877] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.tar") returned 0
	[0047.877] lstrlenA (lpString="*.tar") returned 5
	[0047.877] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.gzip") returned 0
	[0047.877] lstrlenA (lpString="*.gzip") returned 6
	[0047.877] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.jpg") returned 0
	[0047.878] lstrlenA (lpString="*.jpg") returned 5
	[0047.878] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.jpeg") returned 0
	[0047.878] lstrlenA (lpString="*.jpeg") returned 6
	[0047.878] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.bmp") returned 0
	[0047.878] lstrlenA (lpString="*.bmp") returned 5
	[0047.878] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.gif") returned 0
	[0047.878] lstrlenA (lpString="*.gif") returned 5
	[0047.878] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.png") returned 0
	[0047.878] lstrlenA (lpString="*.png") returned 5
	[0047.878] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.doc") returned 0
	[0047.878] lstrlenA (lpString="*.doc") returned 5
	[0047.878] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.docx") returned 0
	[0047.878] lstrlenA (lpString="*.docx") returned 6
	[0047.878] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.xls") returned 0
	[0047.878] lstrlenA (lpString="*.xls") returned 5
	[0047.878] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.xlsx") returned 0
	[0047.878] lstrlenA (lpString="*.xlsx") returned 6
	[0047.878] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.ppt") returned 0
	[0047.878] lstrlenA (lpString="*.ppt") returned 5
	[0047.878] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.pptx") returned 0
	[0047.878] lstrlenA (lpString="*.pptx") returned 6
	[0047.878] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.txt") returned 0
	[0047.878] lstrlenA (lpString="*.txt") returned 5
	[0047.878] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.pdf") returned 0
	[0047.878] lstrlenA (lpString="*.pdf") returned 5
	[0047.878] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.htm") returned 0
	[0047.878] lstrlenA (lpString="*.htm") returned 5
	[0047.878] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.html") returned 0
	[0047.878] lstrlenA (lpString="*.html") returned 6
	[0047.878] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.mdb") returned 0
	[0047.878] lstrlenA (lpString="*.mdb") returned 5
	[0047.878] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.pfx") returned 0
	[0047.878] lstrlenA (lpString="*.pfx") returned 5
	[0047.878] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.md") returned 0
	[0047.878] lstrlenA (lpString="*.md") returned 4
	[0047.878] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.lnk") returned 0
	[0047.878] lstrlenA (lpString="*.lnk") returned 5
	[0047.879] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.torrent") returned 0
	[0047.879] lstrlenA (lpString="*.torrent") returned 9
	[0047.879] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.mov") returned 0
	[0047.879] lstrlenA (lpString="*.mov") returned 5
	[0047.879] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.3gp") returned 0
	[0047.879] lstrlenA (lpString="*.3gp") returned 5
	[0047.879] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.mpeg") returned 0
	[0047.879] lstrlenA (lpString="*.mpeg") returned 6
	[0047.879] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.mpg") returned 0
	[0047.879] lstrlenA (lpString="*.mpg") returned 5
	[0047.879] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.flv") returned 0
	[0047.879] lstrlenA (lpString="*.flv") returned 5
	[0047.879] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.avi") returned 0
	[0047.879] lstrlenA (lpString="*.avi") returned 5
	[0047.879] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.mp4") returned 0
	[0047.879] lstrlenA (lpString="*.mp4") returned 5
	[0047.879] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.wmv") returned 0
	[0047.879] lstrlenA (lpString="*.wmv") returned 5
	[0047.879] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.mkv") returned 0
	[0047.879] lstrlenA (lpString="*.mkv") returned 5
	[0047.879] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.mp3") returned 0
	[0047.879] lstrlenA (lpString="*.mp3") returned 5
	[0047.879] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.wav") returned 0
	[0047.879] lstrlenA (lpString="*.wav") returned 5
	[0047.879] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.flac") returned 0
	[0047.879] lstrlenA (lpString="*.flac") returned 6
	[0047.879] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.wma") returned 0
	[0047.879] lstrlenA (lpString="*.wma") returned 5
	[0047.879] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.au3") returned 0
	[0047.879] lstrlenA (lpString="*.au3") returned 5
	[0047.879] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.ahk") returned 0
	[0047.879] lstrlenA (lpString="*.ahk") returned 5
	[0047.879] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.c") returned 0
	[0047.879] lstrlenA (lpString="*.c") returned 3
	[0047.879] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.cc") returned 0
	[0047.879] lstrlenA (lpString="*.cc") returned 4
	[0047.879] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.cpp") returned 0
	[0047.880] lstrlenA (lpString="*.cpp") returned 5
	[0047.880] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.cxx") returned 0
	[0047.880] lstrlenA (lpString="*.cxx") returned 5
	[0047.880] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.c++") returned 0
	[0047.880] lstrlenA (lpString="*.c++") returned 5
	[0047.880] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.cs") returned 0
	[0047.880] lstrlenA (lpString="*.cs") returned 4
	[0047.880] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.vb") returned 0
	[0047.880] lstrlenA (lpString="*.vb") returned 4
	[0047.880] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.bas") returned 0
	[0047.880] lstrlenA (lpString="*.bas") returned 5
	[0047.880] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.csproj") returned 0
	[0047.880] lstrlenA (lpString="*.csproj") returned 8
	[0047.880] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.vbproj") returned 0
	[0047.880] lstrlenA (lpString="*.vbproj") returned 8
	[0047.880] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.vcxproj") returned 0
	[0047.880] lstrlenA (lpString="*.vcxproj") returned 9
	[0047.880] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.manifest") returned 0
	[0047.880] lstrlenA (lpString="*.manifest") returned 10
	[0047.880] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.php") returned 0
	[0047.880] lstrlenA (lpString="*.php") returned 5
	[0047.880] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.vbe") returned 0
	[0047.880] lstrlenA (lpString="*.vbe") returned 5
	[0047.880] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.vba") returned 0
	[0047.880] lstrlenA (lpString="*.vba") returned 5
	[0047.880] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.vbs") returned 0
	[0047.880] lstrlenA (lpString="*.vbs") returned 5
	[0047.880] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.bat") returned 0
	[0047.880] lstrlenA (lpString="*.bat") returned 5
	[0047.880] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.cmd") returned 0
	[0047.880] lstrlenA (lpString="*.cmd") returned 5
	[0047.880] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.js") returned 0
	[0047.880] lstrlenA (lpString="*.js") returned 4
	[0047.880] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.jscript") returned 0
	[0047.880] lstrlenA (lpString="*.jscript") returned 9
	[0047.880] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.hta") returned 0
	[0047.880] lstrlenA (lpString="*.hta") returned 5
	[0047.880] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.php7") returned 0
	[0047.881] lstrlenA (lpString="*.php7") returned 6
	[0047.881] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.db") returned 0
	[0047.881] lstrlenA (lpString="*.db") returned 4
	[0047.881] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.swf") returned 0
	[0047.881] lstrlenA (lpString="*.swf") returned 5
	[0047.881] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.eml") returned 0
	[0047.881] lstrlenA (lpString="*.eml") returned 5
	[0047.881] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.part") returned 0
	[0047.881] lstrlenA (lpString="*.part") returned 6
	[0047.881] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.nfo") returned 0
	[0047.881] lstrlenA (lpString="*.nfo") returned 5
	[0047.881] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.rsa") returned 0
	[0047.881] lstrlenA (lpString="*.rsa") returned 5
	[0047.881] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.key") returned 0
	[0047.881] lstrlenA (lpString="*.key") returned 5
	[0047.881] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.aes") returned 0
	[0047.881] lstrlenA (lpString="*.aes") returned 5
	[0047.881] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.blob") returned 0
	[0047.881] lstrlenA (lpString="*.blob") returned 6
	[0047.881] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.btc") returned 0
	[0047.881] lstrlenA (lpString="*.btc") returned 5
	[0047.881] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.wallet") returned 0
	[0047.881] lstrlenA (lpString="*.wallet") returned 8
	[0047.881] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0047.881] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0047.881] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SetupResources.dll") returned -1
	[0047.881] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SetupResources.dll") returned -1
	[0047.881] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1
	[0047.881] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned="LocalizedData.xml"
	[0047.881] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1028\\" | out: lpString1="C:\\588bce7c90097ed212\\1028\\") returned="C:\\588bce7c90097ed212\\1028\\"
	[0047.881] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1028\\" | out: pszPath="C:\\588bce7c90097ed212\\1028\\") returned=""
	[0047.881] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1028\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1028\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1028\\HOW-TO-DECRYPT-FILES.HTM"
	[0047.882] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1028\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1028\\how-to-decrypt-files.htm")) returned 0x20
	[0047.882] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1028\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1028\\SetupResources.dll"
	[0047.882] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.zip") returned 0
	[0047.882] lstrlenA (lpString="*.zip") returned 5
	[0047.882] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.rar") returned 0
	[0047.882] lstrlenA (lpString="*.rar") returned 5
	[0047.882] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.7z") returned 0
	[0047.882] lstrlenA (lpString="*.7z") returned 4
	[0047.882] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.tar") returned 0
	[0047.882] lstrlenA (lpString="*.tar") returned 5
	[0047.882] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.gzip") returned 0
	[0047.882] lstrlenA (lpString="*.gzip") returned 6
	[0047.882] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.jpg") returned 0
	[0047.882] lstrlenA (lpString="*.jpg") returned 5
	[0047.882] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.jpeg") returned 0
	[0047.882] lstrlenA (lpString="*.jpeg") returned 6
	[0047.882] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.bmp") returned 0
	[0047.882] lstrlenA (lpString="*.bmp") returned 5
	[0047.882] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.gif") returned 0
	[0047.882] lstrlenA (lpString="*.gif") returned 5
	[0047.882] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.png") returned 0
	[0047.882] lstrlenA (lpString="*.png") returned 5
	[0047.882] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.doc") returned 0
	[0047.882] lstrlenA (lpString="*.doc") returned 5
	[0047.882] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.docx") returned 0
	[0047.882] lstrlenA (lpString="*.docx") returned 6
	[0047.882] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.xls") returned 0
	[0047.882] lstrlenA (lpString="*.xls") returned 5
	[0047.882] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.xlsx") returned 0
	[0047.882] lstrlenA (lpString="*.xlsx") returned 6
	[0047.882] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.ppt") returned 0
	[0047.882] lstrlenA (lpString="*.ppt") returned 5
	[0047.882] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.pptx") returned 0
	[0047.882] lstrlenA (lpString="*.pptx") returned 6
	[0047.882] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.txt") returned 0
	[0047.883] lstrlenA (lpString="*.txt") returned 5
	[0047.883] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.pdf") returned 0
	[0047.883] lstrlenA (lpString="*.pdf") returned 5
	[0047.883] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.htm") returned 0
	[0047.883] lstrlenA (lpString="*.htm") returned 5
	[0047.883] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.html") returned 0
	[0047.883] lstrlenA (lpString="*.html") returned 6
	[0047.883] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.mdb") returned 0
	[0047.883] lstrlenA (lpString="*.mdb") returned 5
	[0047.883] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.pfx") returned 0
	[0047.883] lstrlenA (lpString="*.pfx") returned 5
	[0047.883] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.md") returned 0
	[0047.883] lstrlenA (lpString="*.md") returned 4
	[0047.883] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.lnk") returned 0
	[0047.883] lstrlenA (lpString="*.lnk") returned 5
	[0047.883] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.torrent") returned 0
	[0047.883] lstrlenA (lpString="*.torrent") returned 9
	[0047.883] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.mov") returned 0
	[0047.883] lstrlenA (lpString="*.mov") returned 5
	[0047.883] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.3gp") returned 0
	[0047.883] lstrlenA (lpString="*.3gp") returned 5
	[0047.883] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.mpeg") returned 0
	[0047.883] lstrlenA (lpString="*.mpeg") returned 6
	[0047.883] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.mpg") returned 0
	[0047.883] lstrlenA (lpString="*.mpg") returned 5
	[0047.883] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.flv") returned 0
	[0047.883] lstrlenA (lpString="*.flv") returned 5
	[0047.883] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.avi") returned 0
	[0047.883] lstrlenA (lpString="*.avi") returned 5
	[0047.883] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.mp4") returned 0
	[0047.883] lstrlenA (lpString="*.mp4") returned 5
	[0047.883] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.wmv") returned 0
	[0047.883] lstrlenA (lpString="*.wmv") returned 5
	[0047.883] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.mkv") returned 0
	[0047.883] lstrlenA (lpString="*.mkv") returned 5
	[0047.883] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.mp3") returned 0
	[0047.883] lstrlenA (lpString="*.mp3") returned 5
	[0047.884] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.wav") returned 0
	[0047.884] lstrlenA (lpString="*.wav") returned 5
	[0047.884] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.flac") returned 0
	[0047.884] lstrlenA (lpString="*.flac") returned 6
	[0047.884] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.wma") returned 0
	[0047.884] lstrlenA (lpString="*.wma") returned 5
	[0047.884] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.au3") returned 0
	[0047.884] lstrlenA (lpString="*.au3") returned 5
	[0047.884] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.ahk") returned 0
	[0047.884] lstrlenA (lpString="*.ahk") returned 5
	[0047.884] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.c") returned 0
	[0047.884] lstrlenA (lpString="*.c") returned 3
	[0047.884] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.cc") returned 0
	[0047.884] lstrlenA (lpString="*.cc") returned 4
	[0047.884] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.cpp") returned 0
	[0047.884] lstrlenA (lpString="*.cpp") returned 5
	[0047.884] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.cxx") returned 0
	[0047.884] lstrlenA (lpString="*.cxx") returned 5
	[0047.884] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.c++") returned 0
	[0047.884] lstrlenA (lpString="*.c++") returned 5
	[0047.884] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.cs") returned 0
	[0047.884] lstrlenA (lpString="*.cs") returned 4
	[0047.884] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.vb") returned 0
	[0047.884] lstrlenA (lpString="*.vb") returned 4
	[0047.884] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.bas") returned 0
	[0047.884] lstrlenA (lpString="*.bas") returned 5
	[0047.884] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.csproj") returned 0
	[0047.884] lstrlenA (lpString="*.csproj") returned 8
	[0047.884] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.vbproj") returned 0
	[0047.884] lstrlenA (lpString="*.vbproj") returned 8
	[0047.884] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.vcxproj") returned 0
	[0047.884] lstrlenA (lpString="*.vcxproj") returned 9
	[0047.884] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.manifest") returned 0
	[0047.884] lstrlenA (lpString="*.manifest") returned 10
	[0047.884] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.php") returned 0
	[0047.884] lstrlenA (lpString="*.php") returned 5
	[0047.884] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.vbe") returned 0
	[0047.885] lstrlenA (lpString="*.vbe") returned 5
	[0047.885] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.vba") returned 0
	[0047.885] lstrlenA (lpString="*.vba") returned 5
	[0047.885] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.vbs") returned 0
	[0047.885] lstrlenA (lpString="*.vbs") returned 5
	[0047.885] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.bat") returned 0
	[0047.885] lstrlenA (lpString="*.bat") returned 5
	[0047.885] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.cmd") returned 0
	[0047.885] lstrlenA (lpString="*.cmd") returned 5
	[0047.885] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.js") returned 0
	[0047.885] lstrlenA (lpString="*.js") returned 4
	[0047.885] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.jscript") returned 0
	[0047.885] lstrlenA (lpString="*.jscript") returned 9
	[0047.885] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.hta") returned 0
	[0047.885] lstrlenA (lpString="*.hta") returned 5
	[0047.885] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.php7") returned 0
	[0047.885] lstrlenA (lpString="*.php7") returned 6
	[0047.885] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.db") returned 0
	[0047.885] lstrlenA (lpString="*.db") returned 4
	[0047.885] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.swf") returned 0
	[0047.885] lstrlenA (lpString="*.swf") returned 5
	[0047.885] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.eml") returned 0
	[0047.885] lstrlenA (lpString="*.eml") returned 5
	[0047.885] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.part") returned 0
	[0047.885] lstrlenA (lpString="*.part") returned 6
	[0047.885] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.nfo") returned 0
	[0047.885] lstrlenA (lpString="*.nfo") returned 5
	[0047.885] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.rsa") returned 0
	[0047.885] lstrlenA (lpString="*.rsa") returned 5
	[0047.885] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.key") returned 0
	[0047.885] lstrlenA (lpString="*.key") returned 5
	[0047.885] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.aes") returned 0
	[0047.885] lstrlenA (lpString="*.aes") returned 5
	[0047.885] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.blob") returned 0
	[0047.885] lstrlenA (lpString="*.blob") returned 6
	[0047.885] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.btc") returned 0
	[0047.885] lstrlenA (lpString="*.btc") returned 5
	[0047.885] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.wallet") returned 0
	[0047.886] lstrlenA (lpString="*.wallet") returned 8
	[0047.886] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0047.886] FindClose (in: hFindFile=0x7cb750 | out: hFindFile=0x7cb750) returned 1
	[0047.886] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d1d40, dwReserved1=0x7b00c0, cFileName="1029", cAlternateFileName="")) returned 1
	[0047.886] lstrcmpA (lpString1=".", lpString2="1029") returned -1
	[0047.886] lstrcmpA (lpString1="..", lpString2="1029") returned -1
	[0047.886] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*"
	[0047.886] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1029" | out: lpString1="C:\\588bce7c90097ed212\\1029") returned="C:\\588bce7c90097ed212\\1029"
	[0047.886] lstrlenA (lpString="C:\\588bce7c90097ed212\\1029") returned 26
	[0047.886] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb650
	[0047.933] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0047.933] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0047.933] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0047.933] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0047.934] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0047.934] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0047.934] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="eula.rtf") returned -1
	[0047.934] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="eula.rtf") returned 1
	[0047.934] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1
	[0047.934] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1029\\*.*") returned="*.*"
	[0047.934] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1029\\" | out: lpString1="C:\\588bce7c90097ed212\\1029\\") returned="C:\\588bce7c90097ed212\\1029\\"
	[0047.934] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1029\\" | out: pszPath="C:\\588bce7c90097ed212\\1029\\") returned=""
	[0047.934] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1029\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1029\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1029\\HOW-TO-DECRYPT-FILES.HTM"
	[0047.934] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1029\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1029\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0047.934] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1029\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1029\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0047.936] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0047.936] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0047.937] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0047.938] CloseHandle (hObject=0x208) returned 1
	[0047.938] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1029\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned="C:\\588bce7c90097ed212\\1029\\eula.rtf"
	[0047.938] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.zip") returned 0
	[0047.938] lstrlenA (lpString="*.zip") returned 5
	[0047.938] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.rar") returned 0
	[0047.938] lstrlenA (lpString="*.rar") returned 5
	[0047.938] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.7z") returned 0
	[0047.938] lstrlenA (lpString="*.7z") returned 4
	[0047.938] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.tar") returned 0
	[0047.938] lstrlenA (lpString="*.tar") returned 5
	[0047.938] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.gzip") returned 0
	[0047.938] lstrlenA (lpString="*.gzip") returned 6
	[0047.938] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.jpg") returned 0
	[0047.938] lstrlenA (lpString="*.jpg") returned 5
	[0047.938] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.jpeg") returned 0
	[0047.939] lstrlenA (lpString="*.jpeg") returned 6
	[0047.939] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.bmp") returned 0
	[0047.939] lstrlenA (lpString="*.bmp") returned 5
	[0047.939] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.gif") returned 0
	[0047.939] lstrlenA (lpString="*.gif") returned 5
	[0047.939] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.png") returned 0
	[0047.939] lstrlenA (lpString="*.png") returned 5
	[0047.939] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.doc") returned 0
	[0047.939] lstrlenA (lpString="*.doc") returned 5
	[0047.939] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.docx") returned 0
	[0047.939] lstrlenA (lpString="*.docx") returned 6
	[0047.939] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.xls") returned 0
	[0047.939] lstrlenA (lpString="*.xls") returned 5
	[0047.939] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.xlsx") returned 0
	[0047.939] lstrlenA (lpString="*.xlsx") returned 6
	[0047.939] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.ppt") returned 0
	[0047.939] lstrlenA (lpString="*.ppt") returned 5
	[0047.939] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.pptx") returned 0
	[0047.939] lstrlenA (lpString="*.pptx") returned 6
	[0047.939] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.txt") returned 0
	[0047.939] lstrlenA (lpString="*.txt") returned 5
	[0047.939] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.pdf") returned 0
	[0047.939] lstrlenA (lpString="*.pdf") returned 5
	[0047.939] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.htm") returned 0
	[0047.939] lstrlenA (lpString="*.htm") returned 5
	[0047.939] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.html") returned 0
	[0047.939] lstrlenA (lpString="*.html") returned 6
	[0047.939] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.mdb") returned 0
	[0047.939] lstrlenA (lpString="*.mdb") returned 5
	[0047.939] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.pfx") returned 0
	[0047.939] lstrlenA (lpString="*.pfx") returned 5
	[0047.939] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.md") returned 0
	[0047.939] lstrlenA (lpString="*.md") returned 4
	[0047.939] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.lnk") returned 0
	[0047.939] lstrlenA (lpString="*.lnk") returned 5
	[0047.939] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.torrent") returned 0
	[0047.940] lstrlenA (lpString="*.torrent") returned 9
	[0047.940] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.mov") returned 0
	[0047.940] lstrlenA (lpString="*.mov") returned 5
	[0047.940] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.3gp") returned 0
	[0047.940] lstrlenA (lpString="*.3gp") returned 5
	[0047.940] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.mpeg") returned 0
	[0047.940] lstrlenA (lpString="*.mpeg") returned 6
	[0047.940] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.mpg") returned 0
	[0047.940] lstrlenA (lpString="*.mpg") returned 5
	[0047.940] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.flv") returned 0
	[0047.940] lstrlenA (lpString="*.flv") returned 5
	[0047.940] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.avi") returned 0
	[0047.940] lstrlenA (lpString="*.avi") returned 5
	[0047.940] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.mp4") returned 0
	[0047.940] lstrlenA (lpString="*.mp4") returned 5
	[0047.940] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.wmv") returned 0
	[0047.940] lstrlenA (lpString="*.wmv") returned 5
	[0047.940] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.mkv") returned 0
	[0047.940] lstrlenA (lpString="*.mkv") returned 5
	[0047.940] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.mp3") returned 0
	[0047.940] lstrlenA (lpString="*.mp3") returned 5
	[0047.940] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.wav") returned 0
	[0047.940] lstrlenA (lpString="*.wav") returned 5
	[0047.940] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.flac") returned 0
	[0047.940] lstrlenA (lpString="*.flac") returned 6
	[0047.940] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.wma") returned 0
	[0047.940] lstrlenA (lpString="*.wma") returned 5
	[0047.940] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.au3") returned 0
	[0047.940] lstrlenA (lpString="*.au3") returned 5
	[0047.940] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.ahk") returned 0
	[0047.940] lstrlenA (lpString="*.ahk") returned 5
	[0047.940] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.c") returned 0
	[0047.940] lstrlenA (lpString="*.c") returned 3
	[0047.940] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.cc") returned 0
	[0047.940] lstrlenA (lpString="*.cc") returned 4
	[0047.940] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.cpp") returned 0
	[0047.940] lstrlenA (lpString="*.cpp") returned 5
	[0047.941] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.cxx") returned 0
	[0047.941] lstrlenA (lpString="*.cxx") returned 5
	[0047.941] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.c++") returned 0
	[0047.941] lstrlenA (lpString="*.c++") returned 5
	[0047.941] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.cs") returned 0
	[0047.941] lstrlenA (lpString="*.cs") returned 4
	[0047.941] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.vb") returned 0
	[0047.941] lstrlenA (lpString="*.vb") returned 4
	[0047.941] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.bas") returned 0
	[0047.941] lstrlenA (lpString="*.bas") returned 5
	[0047.941] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.csproj") returned 0
	[0047.941] lstrlenA (lpString="*.csproj") returned 8
	[0047.941] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.vbproj") returned 0
	[0047.941] lstrlenA (lpString="*.vbproj") returned 8
	[0047.941] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.vcxproj") returned 0
	[0047.941] lstrlenA (lpString="*.vcxproj") returned 9
	[0047.941] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.manifest") returned 0
	[0047.941] lstrlenA (lpString="*.manifest") returned 10
	[0047.941] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.php") returned 0
	[0047.941] lstrlenA (lpString="*.php") returned 5
	[0047.941] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.vbe") returned 0
	[0047.941] lstrlenA (lpString="*.vbe") returned 5
	[0047.941] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.vba") returned 0
	[0047.941] lstrlenA (lpString="*.vba") returned 5
	[0047.941] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.vbs") returned 0
	[0047.941] lstrlenA (lpString="*.vbs") returned 5
	[0047.941] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.bat") returned 0
	[0047.941] lstrlenA (lpString="*.bat") returned 5
	[0047.941] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.cmd") returned 0
	[0047.941] lstrlenA (lpString="*.cmd") returned 5
	[0047.941] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.js") returned 0
	[0047.941] lstrlenA (lpString="*.js") returned 4
	[0047.941] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.jscript") returned 0
	[0047.941] lstrlenA (lpString="*.jscript") returned 9
	[0047.941] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.hta") returned 0
	[0047.941] lstrlenA (lpString="*.hta") returned 5
	[0047.941] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.php7") returned 0
	[0047.942] lstrlenA (lpString="*.php7") returned 6
	[0047.942] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.db") returned 0
	[0047.942] lstrlenA (lpString="*.db") returned 4
	[0047.942] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.swf") returned 0
	[0047.942] lstrlenA (lpString="*.swf") returned 5
	[0047.942] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.eml") returned 0
	[0047.942] lstrlenA (lpString="*.eml") returned 5
	[0047.942] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.part") returned 0
	[0047.942] lstrlenA (lpString="*.part") returned 6
	[0047.942] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.nfo") returned 0
	[0047.942] lstrlenA (lpString="*.nfo") returned 5
	[0047.942] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.rsa") returned 0
	[0047.942] lstrlenA (lpString="*.rsa") returned 5
	[0047.942] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.key") returned 0
	[0047.942] lstrlenA (lpString="*.key") returned 5
	[0047.942] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.aes") returned 0
	[0047.942] lstrlenA (lpString="*.aes") returned 5
	[0047.942] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.blob") returned 0
	[0047.942] lstrlenA (lpString="*.blob") returned 6
	[0047.942] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.btc") returned 0
	[0047.942] lstrlenA (lpString="*.btc") returned 5
	[0047.942] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.wallet") returned 0
	[0047.942] lstrlenA (lpString="*.wallet") returned 8
	[0047.942] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0047.942] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0047.942] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="LocalizedData.xml") returned -1
	[0047.942] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="LocalizedData.xml") returned -1
	[0047.942] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1
	[0047.942] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned="eula.rtf"
	[0047.942] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1029\\" | out: lpString1="C:\\588bce7c90097ed212\\1029\\") returned="C:\\588bce7c90097ed212\\1029\\"
	[0047.942] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1029\\" | out: pszPath="C:\\588bce7c90097ed212\\1029\\") returned=""
	[0047.942] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1029\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1029\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1029\\HOW-TO-DECRYPT-FILES.HTM"
	[0047.942] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1029\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1029\\how-to-decrypt-files.htm")) returned 0x20
	[0047.943] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1029\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml"
	[0047.943] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.zip") returned 0
	[0047.943] lstrlenA (lpString="*.zip") returned 5
	[0047.943] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.rar") returned 0
	[0047.943] lstrlenA (lpString="*.rar") returned 5
	[0047.943] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.7z") returned 0
	[0047.943] lstrlenA (lpString="*.7z") returned 4
	[0047.943] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.tar") returned 0
	[0047.943] lstrlenA (lpString="*.tar") returned 5
	[0047.943] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.gzip") returned 0
	[0047.943] lstrlenA (lpString="*.gzip") returned 6
	[0047.943] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.jpg") returned 0
	[0047.943] lstrlenA (lpString="*.jpg") returned 5
	[0047.943] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.jpeg") returned 0
	[0047.943] lstrlenA (lpString="*.jpeg") returned 6
	[0047.943] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.bmp") returned 0
	[0047.943] lstrlenA (lpString="*.bmp") returned 5
	[0047.943] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.gif") returned 0
	[0047.943] lstrlenA (lpString="*.gif") returned 5
	[0047.943] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.png") returned 0
	[0047.943] lstrlenA (lpString="*.png") returned 5
	[0047.943] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.doc") returned 0
	[0047.943] lstrlenA (lpString="*.doc") returned 5
	[0047.943] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.docx") returned 0
	[0047.943] lstrlenA (lpString="*.docx") returned 6
	[0047.943] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.xls") returned 0
	[0047.943] lstrlenA (lpString="*.xls") returned 5
	[0047.943] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.xlsx") returned 0
	[0047.944] lstrlenA (lpString="*.xlsx") returned 6
	[0047.944] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.ppt") returned 0
	[0047.944] lstrlenA (lpString="*.ppt") returned 5
	[0047.944] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.pptx") returned 0
	[0047.944] lstrlenA (lpString="*.pptx") returned 6
	[0047.944] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.txt") returned 0
	[0047.944] lstrlenA (lpString="*.txt") returned 5
	[0047.944] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.pdf") returned 0
	[0047.944] lstrlenA (lpString="*.pdf") returned 5
	[0047.944] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.htm") returned 0
	[0047.944] lstrlenA (lpString="*.htm") returned 5
	[0047.944] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.html") returned 0
	[0047.944] lstrlenA (lpString="*.html") returned 6
	[0047.944] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.mdb") returned 0
	[0047.944] lstrlenA (lpString="*.mdb") returned 5
	[0047.944] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.pfx") returned 0
	[0047.944] lstrlenA (lpString="*.pfx") returned 5
	[0047.944] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.md") returned 0
	[0047.944] lstrlenA (lpString="*.md") returned 4
	[0047.944] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.lnk") returned 0
	[0047.944] lstrlenA (lpString="*.lnk") returned 5
	[0047.944] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.torrent") returned 0
	[0047.944] lstrlenA (lpString="*.torrent") returned 9
	[0047.944] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.mov") returned 0
	[0047.944] lstrlenA (lpString="*.mov") returned 5
	[0047.944] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.3gp") returned 0
	[0047.944] lstrlenA (lpString="*.3gp") returned 5
	[0047.944] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.mpeg") returned 0
	[0047.944] lstrlenA (lpString="*.mpeg") returned 6
	[0047.944] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.mpg") returned 0
	[0047.944] lstrlenA (lpString="*.mpg") returned 5
	[0047.944] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.flv") returned 0
	[0047.944] lstrlenA (lpString="*.flv") returned 5
	[0047.944] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.avi") returned 0
	[0047.944] lstrlenA (lpString="*.avi") returned 5
	[0047.944] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.mp4") returned 0
	[0047.944] lstrlenA (lpString="*.mp4") returned 5
	[0047.945] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.wmv") returned 0
	[0047.945] lstrlenA (lpString="*.wmv") returned 5
	[0047.945] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.mkv") returned 0
	[0047.945] lstrlenA (lpString="*.mkv") returned 5
	[0047.945] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.mp3") returned 0
	[0047.945] lstrlenA (lpString="*.mp3") returned 5
	[0047.945] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.wav") returned 0
	[0047.945] lstrlenA (lpString="*.wav") returned 5
	[0047.945] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.flac") returned 0
	[0047.945] lstrlenA (lpString="*.flac") returned 6
	[0047.945] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.wma") returned 0
	[0047.945] lstrlenA (lpString="*.wma") returned 5
	[0047.945] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.au3") returned 0
	[0047.945] lstrlenA (lpString="*.au3") returned 5
	[0047.945] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.ahk") returned 0
	[0047.945] lstrlenA (lpString="*.ahk") returned 5
	[0047.945] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.c") returned 0
	[0047.945] lstrlenA (lpString="*.c") returned 3
	[0047.945] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.cc") returned 0
	[0047.945] lstrlenA (lpString="*.cc") returned 4
	[0047.945] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.cpp") returned 0
	[0047.945] lstrlenA (lpString="*.cpp") returned 5
	[0047.945] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.cxx") returned 0
	[0047.945] lstrlenA (lpString="*.cxx") returned 5
	[0047.945] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.c++") returned 0
	[0047.945] lstrlenA (lpString="*.c++") returned 5
	[0047.945] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.cs") returned 0
	[0047.945] lstrlenA (lpString="*.cs") returned 4
	[0047.945] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.vb") returned 0
	[0047.945] lstrlenA (lpString="*.vb") returned 4
	[0047.945] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.bas") returned 0
	[0047.945] lstrlenA (lpString="*.bas") returned 5
	[0047.945] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.csproj") returned 0
	[0047.945] lstrlenA (lpString="*.csproj") returned 8
	[0047.945] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.vbproj") returned 0
	[0047.945] lstrlenA (lpString="*.vbproj") returned 8
	[0047.946] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.vcxproj") returned 0
	[0047.946] lstrlenA (lpString="*.vcxproj") returned 9
	[0047.946] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.manifest") returned 0
	[0047.946] lstrlenA (lpString="*.manifest") returned 10
	[0047.946] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.php") returned 0
	[0047.946] lstrlenA (lpString="*.php") returned 5
	[0047.946] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.vbe") returned 0
	[0047.946] lstrlenA (lpString="*.vbe") returned 5
	[0047.946] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.vba") returned 0
	[0047.946] lstrlenA (lpString="*.vba") returned 5
	[0047.946] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.vbs") returned 0
	[0047.946] lstrlenA (lpString="*.vbs") returned 5
	[0047.946] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.bat") returned 0
	[0047.946] lstrlenA (lpString="*.bat") returned 5
	[0047.946] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.cmd") returned 0
	[0047.946] lstrlenA (lpString="*.cmd") returned 5
	[0047.946] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.js") returned 0
	[0047.946] lstrlenA (lpString="*.js") returned 4
	[0047.946] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.jscript") returned 0
	[0047.946] lstrlenA (lpString="*.jscript") returned 9
	[0047.946] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.hta") returned 0
	[0047.946] lstrlenA (lpString="*.hta") returned 5
	[0047.946] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.php7") returned 0
	[0047.946] lstrlenA (lpString="*.php7") returned 6
	[0047.946] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.db") returned 0
	[0047.946] lstrlenA (lpString="*.db") returned 4
	[0047.946] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.swf") returned 0
	[0047.946] lstrlenA (lpString="*.swf") returned 5
	[0047.946] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.eml") returned 0
	[0047.946] lstrlenA (lpString="*.eml") returned 5
	[0047.946] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.part") returned 0
	[0047.946] lstrlenA (lpString="*.part") returned 6
	[0047.946] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.nfo") returned 0
	[0047.946] lstrlenA (lpString="*.nfo") returned 5
	[0047.946] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.rsa") returned 0
	[0047.946] lstrlenA (lpString="*.rsa") returned 5
	[0047.947] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.key") returned 0
	[0047.947] lstrlenA (lpString="*.key") returned 5
	[0047.947] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.aes") returned 0
	[0047.947] lstrlenA (lpString="*.aes") returned 5
	[0047.947] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.blob") returned 0
	[0047.947] lstrlenA (lpString="*.blob") returned 6
	[0047.947] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.btc") returned 0
	[0047.947] lstrlenA (lpString="*.btc") returned 5
	[0047.947] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.wallet") returned 0
	[0047.947] lstrlenA (lpString="*.wallet") returned 8
	[0047.947] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0047.947] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0047.947] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SetupResources.dll") returned -1
	[0047.947] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SetupResources.dll") returned -1
	[0047.947] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1
	[0047.947] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned="LocalizedData.xml"
	[0047.947] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1029\\" | out: lpString1="C:\\588bce7c90097ed212\\1029\\") returned="C:\\588bce7c90097ed212\\1029\\"
	[0047.947] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1029\\" | out: pszPath="C:\\588bce7c90097ed212\\1029\\") returned=""
	[0047.947] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1029\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1029\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1029\\HOW-TO-DECRYPT-FILES.HTM"
	[0047.947] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1029\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1029\\how-to-decrypt-files.htm")) returned 0x20
	[0047.947] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1029\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1029\\SetupResources.dll"
	[0047.947] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.zip") returned 0
	[0047.947] lstrlenA (lpString="*.zip") returned 5
	[0047.947] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.rar") returned 0
	[0047.947] lstrlenA (lpString="*.rar") returned 5
	[0047.947] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.7z") returned 0
	[0047.947] lstrlenA (lpString="*.7z") returned 4
	[0047.947] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.tar") returned 0
	[0047.947] lstrlenA (lpString="*.tar") returned 5
	[0047.947] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.gzip") returned 0
	[0047.947] lstrlenA (lpString="*.gzip") returned 6
	[0047.947] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.jpg") returned 0
	[0047.947] lstrlenA (lpString="*.jpg") returned 5
	[0047.948] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.jpeg") returned 0
	[0047.948] lstrlenA (lpString="*.jpeg") returned 6
	[0047.948] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.bmp") returned 0
	[0047.948] lstrlenA (lpString="*.bmp") returned 5
	[0047.948] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.gif") returned 0
	[0047.948] lstrlenA (lpString="*.gif") returned 5
	[0047.948] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.png") returned 0
	[0047.948] lstrlenA (lpString="*.png") returned 5
	[0047.948] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.doc") returned 0
	[0047.948] lstrlenA (lpString="*.doc") returned 5
	[0047.948] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.docx") returned 0
	[0047.948] lstrlenA (lpString="*.docx") returned 6
	[0047.948] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.xls") returned 0
	[0047.948] lstrlenA (lpString="*.xls") returned 5
	[0047.948] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.xlsx") returned 0
	[0047.948] lstrlenA (lpString="*.xlsx") returned 6
	[0047.948] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.ppt") returned 0
	[0047.948] lstrlenA (lpString="*.ppt") returned 5
	[0047.948] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.pptx") returned 0
	[0047.948] lstrlenA (lpString="*.pptx") returned 6
	[0047.948] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.txt") returned 0
	[0047.948] lstrlenA (lpString="*.txt") returned 5
	[0047.948] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.pdf") returned 0
	[0047.948] lstrlenA (lpString="*.pdf") returned 5
	[0047.948] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.htm") returned 0
	[0047.948] lstrlenA (lpString="*.htm") returned 5
	[0047.948] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.html") returned 0
	[0047.948] lstrlenA (lpString="*.html") returned 6
	[0047.948] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.mdb") returned 0
	[0047.948] lstrlenA (lpString="*.mdb") returned 5
	[0047.948] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.pfx") returned 0
	[0047.948] lstrlenA (lpString="*.pfx") returned 5
	[0047.948] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.md") returned 0
	[0047.948] lstrlenA (lpString="*.md") returned 4
	[0047.948] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.lnk") returned 0
	[0047.948] lstrlenA (lpString="*.lnk") returned 5
	[0047.949] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.torrent") returned 0
	[0047.949] lstrlenA (lpString="*.torrent") returned 9
	[0047.949] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.mov") returned 0
	[0047.949] lstrlenA (lpString="*.mov") returned 5
	[0047.949] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.3gp") returned 0
	[0047.949] lstrlenA (lpString="*.3gp") returned 5
	[0047.949] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.mpeg") returned 0
	[0047.949] lstrlenA (lpString="*.mpeg") returned 6
	[0047.949] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.mpg") returned 0
	[0047.949] lstrlenA (lpString="*.mpg") returned 5
	[0047.949] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.flv") returned 0
	[0047.949] lstrlenA (lpString="*.flv") returned 5
	[0047.949] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.avi") returned 0
	[0047.949] lstrlenA (lpString="*.avi") returned 5
	[0047.949] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.mp4") returned 0
	[0047.949] lstrlenA (lpString="*.mp4") returned 5
	[0047.949] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.wmv") returned 0
	[0047.949] lstrlenA (lpString="*.wmv") returned 5
	[0047.949] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.mkv") returned 0
	[0047.949] lstrlenA (lpString="*.mkv") returned 5
	[0047.949] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.mp3") returned 0
	[0047.949] lstrlenA (lpString="*.mp3") returned 5
	[0047.949] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.wav") returned 0
	[0047.949] lstrlenA (lpString="*.wav") returned 5
	[0047.949] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.flac") returned 0
	[0047.949] lstrlenA (lpString="*.flac") returned 6
	[0047.949] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.wma") returned 0
	[0047.949] lstrlenA (lpString="*.wma") returned 5
	[0047.949] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.au3") returned 0
	[0047.949] lstrlenA (lpString="*.au3") returned 5
	[0047.949] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.ahk") returned 0
	[0047.949] lstrlenA (lpString="*.ahk") returned 5
	[0047.949] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.c") returned 0
	[0047.949] lstrlenA (lpString="*.c") returned 3
	[0047.949] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.cc") returned 0
	[0047.949] lstrlenA (lpString="*.cc") returned 4
	[0047.949] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.cpp") returned 0
	[0047.950] lstrlenA (lpString="*.cpp") returned 5
	[0047.950] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.cxx") returned 0
	[0047.950] lstrlenA (lpString="*.cxx") returned 5
	[0047.950] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.c++") returned 0
	[0047.950] lstrlenA (lpString="*.c++") returned 5
	[0047.950] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.cs") returned 0
	[0047.950] lstrlenA (lpString="*.cs") returned 4
	[0047.950] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.vb") returned 0
	[0047.950] lstrlenA (lpString="*.vb") returned 4
	[0047.950] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.bas") returned 0
	[0047.950] lstrlenA (lpString="*.bas") returned 5
	[0047.950] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.csproj") returned 0
	[0047.950] lstrlenA (lpString="*.csproj") returned 8
	[0047.950] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.vbproj") returned 0
	[0047.950] lstrlenA (lpString="*.vbproj") returned 8
	[0047.950] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.vcxproj") returned 0
	[0047.950] lstrlenA (lpString="*.vcxproj") returned 9
	[0047.950] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.manifest") returned 0
	[0047.950] lstrlenA (lpString="*.manifest") returned 10
	[0047.950] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.php") returned 0
	[0047.950] lstrlenA (lpString="*.php") returned 5
	[0047.950] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.vbe") returned 0
	[0047.950] lstrlenA (lpString="*.vbe") returned 5
	[0047.950] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.vba") returned 0
	[0047.950] lstrlenA (lpString="*.vba") returned 5
	[0047.950] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.vbs") returned 0
	[0047.950] lstrlenA (lpString="*.vbs") returned 5
	[0047.950] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.bat") returned 0
	[0047.950] lstrlenA (lpString="*.bat") returned 5
	[0047.950] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.cmd") returned 0
	[0047.950] lstrlenA (lpString="*.cmd") returned 5
	[0047.950] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.js") returned 0
	[0047.950] lstrlenA (lpString="*.js") returned 4
	[0047.950] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.jscript") returned 0
	[0047.950] lstrlenA (lpString="*.jscript") returned 9
	[0047.950] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.hta") returned 0
	[0047.951] lstrlenA (lpString="*.hta") returned 5
	[0047.951] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.php7") returned 0
	[0047.951] lstrlenA (lpString="*.php7") returned 6
	[0047.951] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.db") returned 0
	[0047.951] lstrlenA (lpString="*.db") returned 4
	[0047.951] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.swf") returned 0
	[0047.951] lstrlenA (lpString="*.swf") returned 5
	[0047.951] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.eml") returned 0
	[0047.951] lstrlenA (lpString="*.eml") returned 5
	[0047.951] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.part") returned 0
	[0047.951] lstrlenA (lpString="*.part") returned 6
	[0047.951] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.nfo") returned 0
	[0047.951] lstrlenA (lpString="*.nfo") returned 5
	[0047.951] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.rsa") returned 0
	[0047.951] lstrlenA (lpString="*.rsa") returned 5
	[0047.951] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.key") returned 0
	[0047.951] lstrlenA (lpString="*.key") returned 5
	[0047.951] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.aes") returned 0
	[0047.951] lstrlenA (lpString="*.aes") returned 5
	[0047.951] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.blob") returned 0
	[0047.951] lstrlenA (lpString="*.blob") returned 6
	[0047.951] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.btc") returned 0
	[0047.951] lstrlenA (lpString="*.btc") returned 5
	[0047.951] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.wallet") returned 0
	[0047.951] lstrlenA (lpString="*.wallet") returned 8
	[0047.951] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0047.951] FindClose (in: hFindFile=0x7cb650 | out: hFindFile=0x7cb650) returned 1
	[0047.951] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d1d40, dwReserved1=0x7b00c0, cFileName="1030", cAlternateFileName="")) returned 1
	[0047.951] lstrcmpA (lpString1=".", lpString2="1030") returned -1
	[0047.951] lstrcmpA (lpString1="..", lpString2="1030") returned -1
	[0047.951] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*"
	[0047.951] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1030" | out: lpString1="C:\\588bce7c90097ed212\\1030") returned="C:\\588bce7c90097ed212\\1030"
	[0047.952] lstrlenA (lpString="C:\\588bce7c90097ed212\\1030") returned 26
	[0047.952] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb850
	[0047.952] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0047.952] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0047.952] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0047.952] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0047.952] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0047.952] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0047.952] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="eula.rtf") returned -1
	[0047.952] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="eula.rtf") returned 1
	[0047.952] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1
	[0047.952] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1030\\*.*") returned="*.*"
	[0047.952] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1030\\" | out: lpString1="C:\\588bce7c90097ed212\\1030\\") returned="C:\\588bce7c90097ed212\\1030\\"
	[0047.952] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1030\\" | out: pszPath="C:\\588bce7c90097ed212\\1030\\") returned=""
	[0047.953] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1030\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1030\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1030\\HOW-TO-DECRYPT-FILES.HTM"
	[0047.953] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1030\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1030\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0047.953] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1030\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1030\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0047.954] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0047.954] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0047.955] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0047.955] CloseHandle (hObject=0x208) returned 1
	[0047.955] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1030\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned="C:\\588bce7c90097ed212\\1030\\eula.rtf"
	[0047.955] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.zip") returned 0
	[0047.955] lstrlenA (lpString="*.zip") returned 5
	[0047.955] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.rar") returned 0
	[0047.955] lstrlenA (lpString="*.rar") returned 5
	[0047.955] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.7z") returned 0
	[0047.956] lstrlenA (lpString="*.7z") returned 4
	[0047.956] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.tar") returned 0
	[0047.956] lstrlenA (lpString="*.tar") returned 5
	[0047.956] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.gzip") returned 0
	[0047.956] lstrlenA (lpString="*.gzip") returned 6
	[0047.956] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.jpg") returned 0
	[0047.956] lstrlenA (lpString="*.jpg") returned 5
	[0047.956] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.jpeg") returned 0
	[0047.956] lstrlenA (lpString="*.jpeg") returned 6
	[0047.956] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.bmp") returned 0
	[0047.956] lstrlenA (lpString="*.bmp") returned 5
	[0047.956] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.gif") returned 0
	[0047.956] lstrlenA (lpString="*.gif") returned 5
	[0047.956] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.png") returned 0
	[0047.956] lstrlenA (lpString="*.png") returned 5
	[0047.956] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.doc") returned 0
	[0047.956] lstrlenA (lpString="*.doc") returned 5
	[0047.956] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.docx") returned 0
	[0047.956] lstrlenA (lpString="*.docx") returned 6
	[0047.956] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.xls") returned 0
	[0047.956] lstrlenA (lpString="*.xls") returned 5
	[0047.956] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.xlsx") returned 0
	[0047.956] lstrlenA (lpString="*.xlsx") returned 6
	[0047.956] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.ppt") returned 0
	[0047.956] lstrlenA (lpString="*.ppt") returned 5
	[0047.956] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.pptx") returned 0
	[0047.956] lstrlenA (lpString="*.pptx") returned 6
	[0047.956] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.txt") returned 0
	[0047.956] lstrlenA (lpString="*.txt") returned 5
	[0047.956] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.pdf") returned 0
	[0047.956] lstrlenA (lpString="*.pdf") returned 5
	[0047.956] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.htm") returned 0
	[0047.956] lstrlenA (lpString="*.htm") returned 5
	[0047.956] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.html") returned 0
	[0047.956] lstrlenA (lpString="*.html") returned 6
	[0047.956] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.mdb") returned 0
	[0047.956] lstrlenA (lpString="*.mdb") returned 5
	[0047.957] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.pfx") returned 0
	[0047.957] lstrlenA (lpString="*.pfx") returned 5
	[0047.957] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.md") returned 0
	[0047.957] lstrlenA (lpString="*.md") returned 4
	[0047.957] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.lnk") returned 0
	[0047.957] lstrlenA (lpString="*.lnk") returned 5
	[0047.957] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.torrent") returned 0
	[0047.957] lstrlenA (lpString="*.torrent") returned 9
	[0047.957] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.mov") returned 0
	[0047.957] lstrlenA (lpString="*.mov") returned 5
	[0047.957] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.3gp") returned 0
	[0047.957] lstrlenA (lpString="*.3gp") returned 5
	[0047.957] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.mpeg") returned 0
	[0047.957] lstrlenA (lpString="*.mpeg") returned 6
	[0047.957] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.mpg") returned 0
	[0047.957] lstrlenA (lpString="*.mpg") returned 5
	[0047.957] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.flv") returned 0
	[0047.957] lstrlenA (lpString="*.flv") returned 5
	[0047.957] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.avi") returned 0
	[0047.957] lstrlenA (lpString="*.avi") returned 5
	[0047.957] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.mp4") returned 0
	[0047.957] lstrlenA (lpString="*.mp4") returned 5
	[0047.957] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.wmv") returned 0
	[0047.957] lstrlenA (lpString="*.wmv") returned 5
	[0047.957] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.mkv") returned 0
	[0047.957] lstrlenA (lpString="*.mkv") returned 5
	[0047.957] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.mp3") returned 0
	[0047.957] lstrlenA (lpString="*.mp3") returned 5
	[0047.957] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.wav") returned 0
	[0047.957] lstrlenA (lpString="*.wav") returned 5
	[0047.957] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.flac") returned 0
	[0047.957] lstrlenA (lpString="*.flac") returned 6
	[0047.957] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.wma") returned 0
	[0047.957] lstrlenA (lpString="*.wma") returned 5
	[0047.957] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.au3") returned 0
	[0047.957] lstrlenA (lpString="*.au3") returned 5
	[0047.957] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.ahk") returned 0
	[0047.958] lstrlenA (lpString="*.ahk") returned 5
	[0047.958] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.c") returned 0
	[0047.958] lstrlenA (lpString="*.c") returned 3
	[0047.958] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.cc") returned 0
	[0047.958] lstrlenA (lpString="*.cc") returned 4
	[0047.958] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.cpp") returned 0
	[0047.958] lstrlenA (lpString="*.cpp") returned 5
	[0047.958] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.cxx") returned 0
	[0047.958] lstrlenA (lpString="*.cxx") returned 5
	[0047.958] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.c++") returned 0
	[0047.958] lstrlenA (lpString="*.c++") returned 5
	[0047.958] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.cs") returned 0
	[0047.958] lstrlenA (lpString="*.cs") returned 4
	[0047.958] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.vb") returned 0
	[0047.958] lstrlenA (lpString="*.vb") returned 4
	[0047.958] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.bas") returned 0
	[0047.958] lstrlenA (lpString="*.bas") returned 5
	[0047.958] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.csproj") returned 0
	[0047.958] lstrlenA (lpString="*.csproj") returned 8
	[0047.958] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.vbproj") returned 0
	[0047.958] lstrlenA (lpString="*.vbproj") returned 8
	[0047.958] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.vcxproj") returned 0
	[0047.958] lstrlenA (lpString="*.vcxproj") returned 9
	[0047.958] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.manifest") returned 0
	[0047.958] lstrlenA (lpString="*.manifest") returned 10
	[0047.958] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.php") returned 0
	[0047.958] lstrlenA (lpString="*.php") returned 5
	[0047.958] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.vbe") returned 0
	[0047.958] lstrlenA (lpString="*.vbe") returned 5
	[0047.958] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.vba") returned 0
	[0047.958] lstrlenA (lpString="*.vba") returned 5
	[0047.958] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.vbs") returned 0
	[0047.958] lstrlenA (lpString="*.vbs") returned 5
	[0047.958] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.bat") returned 0
	[0047.958] lstrlenA (lpString="*.bat") returned 5
	[0047.958] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.cmd") returned 0
	[0047.958] lstrlenA (lpString="*.cmd") returned 5
	[0047.959] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.js") returned 0
	[0047.959] lstrlenA (lpString="*.js") returned 4
	[0047.959] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.jscript") returned 0
	[0047.959] lstrlenA (lpString="*.jscript") returned 9
	[0047.960] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.hta") returned 0
	[0047.960] lstrlenA (lpString="*.hta") returned 5
	[0047.960] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.php7") returned 0
	[0047.960] lstrlenA (lpString="*.php7") returned 6
	[0047.961] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.db") returned 0
	[0047.961] lstrlenA (lpString="*.db") returned 4
	[0047.961] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.swf") returned 0
	[0047.961] lstrlenA (lpString="*.swf") returned 5
	[0047.961] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.eml") returned 0
	[0047.961] lstrlenA (lpString="*.eml") returned 5
	[0047.961] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.part") returned 0
	[0047.961] lstrlenA (lpString="*.part") returned 6
	[0047.961] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.nfo") returned 0
	[0047.961] lstrlenA (lpString="*.nfo") returned 5
	[0047.961] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.rsa") returned 0
	[0047.961] lstrlenA (lpString="*.rsa") returned 5
	[0047.961] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.key") returned 0
	[0047.961] lstrlenA (lpString="*.key") returned 5
	[0047.961] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.aes") returned 0
	[0047.961] lstrlenA (lpString="*.aes") returned 5
	[0047.961] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.blob") returned 0
	[0047.961] lstrlenA (lpString="*.blob") returned 6
	[0047.961] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.btc") returned 0
	[0047.961] lstrlenA (lpString="*.btc") returned 5
	[0047.961] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.wallet") returned 0
	[0047.961] lstrlenA (lpString="*.wallet") returned 8
	[0047.961] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0047.961] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0047.961] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="LocalizedData.xml") returned -1
	[0047.961] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="LocalizedData.xml") returned -1
	[0047.961] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1
	[0047.961] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned="eula.rtf"
	[0047.961] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1030\\" | out: lpString1="C:\\588bce7c90097ed212\\1030\\") returned="C:\\588bce7c90097ed212\\1030\\"
	[0047.961] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1030\\" | out: pszPath="C:\\588bce7c90097ed212\\1030\\") returned=""
	[0047.961] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1030\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1030\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1030\\HOW-TO-DECRYPT-FILES.HTM"
	[0047.961] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1030\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1030\\how-to-decrypt-files.htm")) returned 0x20
	[0047.961] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1030\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml"
	[0047.962] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.zip") returned 0
	[0047.962] lstrlenA (lpString="*.zip") returned 5
	[0047.962] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.rar") returned 0
	[0047.962] lstrlenA (lpString="*.rar") returned 5
	[0047.962] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.7z") returned 0
	[0047.962] lstrlenA (lpString="*.7z") returned 4
	[0047.962] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.tar") returned 0
	[0047.962] lstrlenA (lpString="*.tar") returned 5
	[0047.962] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.gzip") returned 0
	[0047.962] lstrlenA (lpString="*.gzip") returned 6
	[0047.962] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.jpg") returned 0
	[0047.962] lstrlenA (lpString="*.jpg") returned 5
	[0047.962] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.jpeg") returned 0
	[0047.962] lstrlenA (lpString="*.jpeg") returned 6
	[0047.962] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.bmp") returned 0
	[0047.962] lstrlenA (lpString="*.bmp") returned 5
	[0047.962] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.gif") returned 0
	[0047.962] lstrlenA (lpString="*.gif") returned 5
	[0047.962] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.png") returned 0
	[0047.962] lstrlenA (lpString="*.png") returned 5
	[0047.962] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.doc") returned 0
	[0047.962] lstrlenA (lpString="*.doc") returned 5
	[0047.962] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.docx") returned 0
	[0047.962] lstrlenA (lpString="*.docx") returned 6
	[0047.962] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.xls") returned 0
	[0047.962] lstrlenA (lpString="*.xls") returned 5
	[0047.962] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.xlsx") returned 0
	[0047.962] lstrlenA (lpString="*.xlsx") returned 6
	[0047.962] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.ppt") returned 0
	[0047.962] lstrlenA (lpString="*.ppt") returned 5
	[0047.962] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.pptx") returned 0
	[0047.962] lstrlenA (lpString="*.pptx") returned 6
	[0047.962] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.txt") returned 0
	[0047.962] lstrlenA (lpString="*.txt") returned 5
	[0047.962] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.pdf") returned 0
	[0047.963] lstrlenA (lpString="*.pdf") returned 5
	[0047.963] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.htm") returned 0
	[0047.963] lstrlenA (lpString="*.htm") returned 5
	[0047.963] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.html") returned 0
	[0047.963] lstrlenA (lpString="*.html") returned 6
	[0047.963] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.mdb") returned 0
	[0047.963] lstrlenA (lpString="*.mdb") returned 5
	[0047.963] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.pfx") returned 0
	[0047.963] lstrlenA (lpString="*.pfx") returned 5
	[0047.963] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.md") returned 0
	[0047.963] lstrlenA (lpString="*.md") returned 4
	[0047.963] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.lnk") returned 0
	[0047.963] lstrlenA (lpString="*.lnk") returned 5
	[0047.963] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.torrent") returned 0
	[0047.963] lstrlenA (lpString="*.torrent") returned 9
	[0047.963] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.mov") returned 0
	[0047.963] lstrlenA (lpString="*.mov") returned 5
	[0047.963] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.3gp") returned 0
	[0047.963] lstrlenA (lpString="*.3gp") returned 5
	[0047.963] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.mpeg") returned 0
	[0047.963] lstrlenA (lpString="*.mpeg") returned 6
	[0047.963] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.mpg") returned 0
	[0047.963] lstrlenA (lpString="*.mpg") returned 5
	[0047.963] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.flv") returned 0
	[0047.963] lstrlenA (lpString="*.flv") returned 5
	[0047.963] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.avi") returned 0
	[0047.963] lstrlenA (lpString="*.avi") returned 5
	[0047.963] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.mp4") returned 0
	[0047.963] lstrlenA (lpString="*.mp4") returned 5
	[0047.963] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.wmv") returned 0
	[0047.963] lstrlenA (lpString="*.wmv") returned 5
	[0047.963] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.mkv") returned 0
	[0047.963] lstrlenA (lpString="*.mkv") returned 5
	[0047.963] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.mp3") returned 0
	[0047.963] lstrlenA (lpString="*.mp3") returned 5
	[0047.963] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.wav") returned 0
	[0047.963] lstrlenA (lpString="*.wav") returned 5
	[0047.964] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.flac") returned 0
	[0047.964] lstrlenA (lpString="*.flac") returned 6
	[0047.964] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.wma") returned 0
	[0047.964] lstrlenA (lpString="*.wma") returned 5
	[0047.964] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.au3") returned 0
	[0047.964] lstrlenA (lpString="*.au3") returned 5
	[0047.964] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.ahk") returned 0
	[0047.964] lstrlenA (lpString="*.ahk") returned 5
	[0047.964] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.c") returned 0
	[0047.964] lstrlenA (lpString="*.c") returned 3
	[0047.964] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.cc") returned 0
	[0047.964] lstrlenA (lpString="*.cc") returned 4
	[0047.964] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.cpp") returned 0
	[0047.964] lstrlenA (lpString="*.cpp") returned 5
	[0047.964] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.cxx") returned 0
	[0047.964] lstrlenA (lpString="*.cxx") returned 5
	[0047.964] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.c++") returned 0
	[0047.964] lstrlenA (lpString="*.c++") returned 5
	[0047.964] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.cs") returned 0
	[0047.964] lstrlenA (lpString="*.cs") returned 4
	[0047.964] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.vb") returned 0
	[0047.964] lstrlenA (lpString="*.vb") returned 4
	[0047.964] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.bas") returned 0
	[0047.964] lstrlenA (lpString="*.bas") returned 5
	[0047.964] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.csproj") returned 0
	[0047.964] lstrlenA (lpString="*.csproj") returned 8
	[0047.964] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.vbproj") returned 0
	[0047.964] lstrlenA (lpString="*.vbproj") returned 8
	[0047.964] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.vcxproj") returned 0
	[0047.964] lstrlenA (lpString="*.vcxproj") returned 9
	[0047.964] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.manifest") returned 0
	[0047.964] lstrlenA (lpString="*.manifest") returned 10
	[0047.964] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.php") returned 0
	[0047.964] lstrlenA (lpString="*.php") returned 5
	[0047.964] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.vbe") returned 0
	[0047.964] lstrlenA (lpString="*.vbe") returned 5
	[0047.965] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.vba") returned 0
	[0047.965] lstrlenA (lpString="*.vba") returned 5
	[0047.965] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.vbs") returned 0
	[0047.965] lstrlenA (lpString="*.vbs") returned 5
	[0047.965] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.bat") returned 0
	[0047.965] lstrlenA (lpString="*.bat") returned 5
	[0047.965] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.cmd") returned 0
	[0047.965] lstrlenA (lpString="*.cmd") returned 5
	[0047.965] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.js") returned 0
	[0047.965] lstrlenA (lpString="*.js") returned 4
	[0047.965] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.jscript") returned 0
	[0047.965] lstrlenA (lpString="*.jscript") returned 9
	[0047.965] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.hta") returned 0
	[0047.965] lstrlenA (lpString="*.hta") returned 5
	[0047.965] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.php7") returned 0
	[0047.965] lstrlenA (lpString="*.php7") returned 6
	[0047.965] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.db") returned 0
	[0047.965] lstrlenA (lpString="*.db") returned 4
	[0047.965] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.swf") returned 0
	[0047.965] lstrlenA (lpString="*.swf") returned 5
	[0047.965] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.eml") returned 0
	[0047.965] lstrlenA (lpString="*.eml") returned 5
	[0047.965] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.part") returned 0
	[0047.965] lstrlenA (lpString="*.part") returned 6
	[0047.965] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.nfo") returned 0
	[0047.965] lstrlenA (lpString="*.nfo") returned 5
	[0047.965] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.rsa") returned 0
	[0047.965] lstrlenA (lpString="*.rsa") returned 5
	[0047.965] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.key") returned 0
	[0047.965] lstrlenA (lpString="*.key") returned 5
	[0047.965] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.aes") returned 0
	[0047.965] lstrlenA (lpString="*.aes") returned 5
	[0047.965] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.blob") returned 0
	[0047.965] lstrlenA (lpString="*.blob") returned 6
	[0047.965] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.btc") returned 0
	[0047.965] lstrlenA (lpString="*.btc") returned 5
	[0047.965] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.wallet") returned 0
	[0047.966] lstrlenA (lpString="*.wallet") returned 8
	[0047.966] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0047.966] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0047.966] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SetupResources.dll") returned -1
	[0047.966] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SetupResources.dll") returned -1
	[0047.966] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1
	[0047.966] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned="LocalizedData.xml"
	[0047.966] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1030\\" | out: lpString1="C:\\588bce7c90097ed212\\1030\\") returned="C:\\588bce7c90097ed212\\1030\\"
	[0047.966] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1030\\" | out: pszPath="C:\\588bce7c90097ed212\\1030\\") returned=""
	[0047.966] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1030\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1030\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1030\\HOW-TO-DECRYPT-FILES.HTM"
	[0047.966] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1030\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1030\\how-to-decrypt-files.htm")) returned 0x20
	[0047.966] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1030\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1030\\SetupResources.dll"
	[0047.966] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.zip") returned 0
	[0047.966] lstrlenA (lpString="*.zip") returned 5
	[0047.966] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.rar") returned 0
	[0047.966] lstrlenA (lpString="*.rar") returned 5
	[0047.966] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.7z") returned 0
	[0047.966] lstrlenA (lpString="*.7z") returned 4
	[0047.966] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.tar") returned 0
	[0047.966] lstrlenA (lpString="*.tar") returned 5
	[0047.966] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.gzip") returned 0
	[0047.966] lstrlenA (lpString="*.gzip") returned 6
	[0047.966] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.jpg") returned 0
	[0047.966] lstrlenA (lpString="*.jpg") returned 5
	[0047.966] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.jpeg") returned 0
	[0047.966] lstrlenA (lpString="*.jpeg") returned 6
	[0047.966] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.bmp") returned 0
	[0047.966] lstrlenA (lpString="*.bmp") returned 5
	[0047.966] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.gif") returned 0
	[0047.966] lstrlenA (lpString="*.gif") returned 5
	[0047.966] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.png") returned 0
	[0047.966] lstrlenA (lpString="*.png") returned 5
	[0047.966] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.doc") returned 0
	[0047.967] lstrlenA (lpString="*.doc") returned 5
	[0047.967] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.docx") returned 0
	[0047.967] lstrlenA (lpString="*.docx") returned 6
	[0047.967] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.xls") returned 0
	[0047.967] lstrlenA (lpString="*.xls") returned 5
	[0047.967] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.xlsx") returned 0
	[0047.967] lstrlenA (lpString="*.xlsx") returned 6
	[0047.967] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.ppt") returned 0
	[0047.967] lstrlenA (lpString="*.ppt") returned 5
	[0047.967] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.pptx") returned 0
	[0047.967] lstrlenA (lpString="*.pptx") returned 6
	[0047.967] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.txt") returned 0
	[0047.967] lstrlenA (lpString="*.txt") returned 5
	[0047.967] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.pdf") returned 0
	[0047.967] lstrlenA (lpString="*.pdf") returned 5
	[0047.967] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.htm") returned 0
	[0047.967] lstrlenA (lpString="*.htm") returned 5
	[0047.967] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.html") returned 0
	[0047.967] lstrlenA (lpString="*.html") returned 6
	[0047.967] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.mdb") returned 0
	[0047.967] lstrlenA (lpString="*.mdb") returned 5
	[0047.967] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.pfx") returned 0
	[0047.967] lstrlenA (lpString="*.pfx") returned 5
	[0047.967] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.md") returned 0
	[0047.967] lstrlenA (lpString="*.md") returned 4
	[0047.967] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.lnk") returned 0
	[0047.967] lstrlenA (lpString="*.lnk") returned 5
	[0047.967] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.torrent") returned 0
	[0047.967] lstrlenA (lpString="*.torrent") returned 9
	[0047.967] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.mov") returned 0
	[0047.967] lstrlenA (lpString="*.mov") returned 5
	[0047.967] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.3gp") returned 0
	[0047.967] lstrlenA (lpString="*.3gp") returned 5
	[0047.967] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.mpeg") returned 0
	[0047.967] lstrlenA (lpString="*.mpeg") returned 6
	[0047.968] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.mpg") returned 0
	[0047.968] lstrlenA (lpString="*.mpg") returned 5
	[0047.968] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.flv") returned 0
	[0047.968] lstrlenA (lpString="*.flv") returned 5
	[0047.968] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.avi") returned 0
	[0047.968] lstrlenA (lpString="*.avi") returned 5
	[0047.968] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.mp4") returned 0
	[0047.968] lstrlenA (lpString="*.mp4") returned 5
	[0047.968] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.wmv") returned 0
	[0047.968] lstrlenA (lpString="*.wmv") returned 5
	[0047.968] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.mkv") returned 0
	[0047.968] lstrlenA (lpString="*.mkv") returned 5
	[0047.968] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.mp3") returned 0
	[0047.968] lstrlenA (lpString="*.mp3") returned 5
	[0047.968] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.wav") returned 0
	[0047.968] lstrlenA (lpString="*.wav") returned 5
	[0047.968] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.flac") returned 0
	[0047.968] lstrlenA (lpString="*.flac") returned 6
	[0047.968] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.wma") returned 0
	[0047.968] lstrlenA (lpString="*.wma") returned 5
	[0047.968] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.au3") returned 0
	[0047.968] lstrlenA (lpString="*.au3") returned 5
	[0047.968] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.ahk") returned 0
	[0047.968] lstrlenA (lpString="*.ahk") returned 5
	[0047.968] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.c") returned 0
	[0047.968] lstrlenA (lpString="*.c") returned 3
	[0047.968] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.cc") returned 0
	[0047.968] lstrlenA (lpString="*.cc") returned 4
	[0047.968] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.cpp") returned 0
	[0047.968] lstrlenA (lpString="*.cpp") returned 5
	[0047.968] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.cxx") returned 0
	[0047.968] lstrlenA (lpString="*.cxx") returned 5
	[0047.968] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.c++") returned 0
	[0047.968] lstrlenA (lpString="*.c++") returned 5
	[0047.968] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.cs") returned 0
	[0047.968] lstrlenA (lpString="*.cs") returned 4
	[0047.969] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.vb") returned 0
	[0047.969] lstrlenA (lpString="*.vb") returned 4
	[0047.969] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.bas") returned 0
	[0047.969] lstrlenA (lpString="*.bas") returned 5
	[0047.969] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.csproj") returned 0
	[0047.969] lstrlenA (lpString="*.csproj") returned 8
	[0047.969] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.vbproj") returned 0
	[0047.969] lstrlenA (lpString="*.vbproj") returned 8
	[0047.969] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.vcxproj") returned 0
	[0047.969] lstrlenA (lpString="*.vcxproj") returned 9
	[0047.969] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.manifest") returned 0
	[0047.969] lstrlenA (lpString="*.manifest") returned 10
	[0047.969] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.php") returned 0
	[0047.969] lstrlenA (lpString="*.php") returned 5
	[0047.969] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.vbe") returned 0
	[0047.969] lstrlenA (lpString="*.vbe") returned 5
	[0047.969] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.vba") returned 0
	[0047.969] lstrlenA (lpString="*.vba") returned 5
	[0047.969] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.vbs") returned 0
	[0047.969] lstrlenA (lpString="*.vbs") returned 5
	[0047.969] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.bat") returned 0
	[0047.969] lstrlenA (lpString="*.bat") returned 5
	[0047.969] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.cmd") returned 0
	[0047.969] lstrlenA (lpString="*.cmd") returned 5
	[0047.969] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.js") returned 0
	[0047.969] lstrlenA (lpString="*.js") returned 4
	[0047.969] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.jscript") returned 0
	[0047.969] lstrlenA (lpString="*.jscript") returned 9
	[0047.969] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.hta") returned 0
	[0047.969] lstrlenA (lpString="*.hta") returned 5
	[0047.969] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.php7") returned 0
	[0047.969] lstrlenA (lpString="*.php7") returned 6
	[0047.969] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.db") returned 0
	[0047.969] lstrlenA (lpString="*.db") returned 4
	[0047.969] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.swf") returned 0
	[0047.969] lstrlenA (lpString="*.swf") returned 5
	[0047.970] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.eml") returned 0
	[0047.970] lstrlenA (lpString="*.eml") returned 5
	[0047.970] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.part") returned 0
	[0047.970] lstrlenA (lpString="*.part") returned 6
	[0047.970] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.nfo") returned 0
	[0047.970] lstrlenA (lpString="*.nfo") returned 5
	[0047.970] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.rsa") returned 0
	[0047.970] lstrlenA (lpString="*.rsa") returned 5
	[0047.970] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.key") returned 0
	[0047.970] lstrlenA (lpString="*.key") returned 5
	[0047.970] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.aes") returned 0
	[0047.970] lstrlenA (lpString="*.aes") returned 5
	[0047.970] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.blob") returned 0
	[0047.970] lstrlenA (lpString="*.blob") returned 6
	[0047.970] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.btc") returned 0
	[0047.970] lstrlenA (lpString="*.btc") returned 5
	[0047.970] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.wallet") returned 0
	[0047.970] lstrlenA (lpString="*.wallet") returned 8
	[0047.970] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0047.970] FindClose (in: hFindFile=0x7cb850 | out: hFindFile=0x7cb850) returned 1
	[0047.970] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d1d40, dwReserved1=0x7b00c0, cFileName="1031", cAlternateFileName="")) returned 1
	[0047.970] lstrcmpA (lpString1=".", lpString2="1031") returned -1
	[0047.970] lstrcmpA (lpString1="..", lpString2="1031") returned -1
	[0047.970] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*"
	[0047.970] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1031" | out: lpString1="C:\\588bce7c90097ed212\\1031") returned="C:\\588bce7c90097ed212\\1031"
	[0047.970] lstrlenA (lpString="C:\\588bce7c90097ed212\\1031") returned 26
	[0047.970] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb650
	[0048.024] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0048.024] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0048.024] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0048.024] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0048.024] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0048.024] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.025] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="eula.rtf") returned -1
	[0048.025] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="eula.rtf") returned 1
	[0048.025] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1
	[0048.025] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1031\\*.*") returned="*.*"
	[0048.025] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1031\\" | out: lpString1="C:\\588bce7c90097ed212\\1031\\") returned="C:\\588bce7c90097ed212\\1031\\"
	[0048.025] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1031\\" | out: pszPath="C:\\588bce7c90097ed212\\1031\\") returned=""
	[0048.025] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1031\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1031\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1031\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.025] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1031\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1031\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0048.025] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1031\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1031\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0048.027] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0048.027] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0048.028] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0048.028] CloseHandle (hObject=0x208) returned 1
	[0048.032] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1031\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned="C:\\588bce7c90097ed212\\1031\\eula.rtf"
	[0048.032] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.zip") returned 0
	[0048.032] lstrlenA (lpString="*.zip") returned 5
	[0048.032] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.rar") returned 0
	[0048.032] lstrlenA (lpString="*.rar") returned 5
	[0048.032] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.7z") returned 0
	[0048.032] lstrlenA (lpString="*.7z") returned 4
	[0048.032] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.tar") returned 0
	[0048.032] lstrlenA (lpString="*.tar") returned 5
	[0048.032] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.gzip") returned 0
	[0048.032] lstrlenA (lpString="*.gzip") returned 6
	[0048.032] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.jpg") returned 0
	[0048.032] lstrlenA (lpString="*.jpg") returned 5
	[0048.032] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.jpeg") returned 0
	[0048.032] lstrlenA (lpString="*.jpeg") returned 6
	[0048.032] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.bmp") returned 0
	[0048.032] lstrlenA (lpString="*.bmp") returned 5
	[0048.032] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.gif") returned 0
	[0048.032] lstrlenA (lpString="*.gif") returned 5
	[0048.032] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.png") returned 0
	[0048.032] lstrlenA (lpString="*.png") returned 5
	[0048.032] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.doc") returned 0
	[0048.032] lstrlenA (lpString="*.doc") returned 5
	[0048.032] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.docx") returned 0
	[0048.032] lstrlenA (lpString="*.docx") returned 6
	[0048.033] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.xls") returned 0
	[0048.033] lstrlenA (lpString="*.xls") returned 5
	[0048.033] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.xlsx") returned 0
	[0048.033] lstrlenA (lpString="*.xlsx") returned 6
	[0048.033] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.ppt") returned 0
	[0048.033] lstrlenA (lpString="*.ppt") returned 5
	[0048.033] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.pptx") returned 0
	[0048.033] lstrlenA (lpString="*.pptx") returned 6
	[0048.033] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.txt") returned 0
	[0048.033] lstrlenA (lpString="*.txt") returned 5
	[0048.033] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.pdf") returned 0
	[0048.033] lstrlenA (lpString="*.pdf") returned 5
	[0048.033] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.htm") returned 0
	[0048.033] lstrlenA (lpString="*.htm") returned 5
	[0048.033] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.html") returned 0
	[0048.033] lstrlenA (lpString="*.html") returned 6
	[0048.033] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.mdb") returned 0
	[0048.033] lstrlenA (lpString="*.mdb") returned 5
	[0048.033] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.pfx") returned 0
	[0048.033] lstrlenA (lpString="*.pfx") returned 5
	[0048.033] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.md") returned 0
	[0048.033] lstrlenA (lpString="*.md") returned 4
	[0048.033] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.lnk") returned 0
	[0048.033] lstrlenA (lpString="*.lnk") returned 5
	[0048.033] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.torrent") returned 0
	[0048.033] lstrlenA (lpString="*.torrent") returned 9
	[0048.033] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.mov") returned 0
	[0048.033] lstrlenA (lpString="*.mov") returned 5
	[0048.033] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.3gp") returned 0
	[0048.033] lstrlenA (lpString="*.3gp") returned 5
	[0048.033] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.mpeg") returned 0
	[0048.033] lstrlenA (lpString="*.mpeg") returned 6
	[0048.033] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.mpg") returned 0
	[0048.033] lstrlenA (lpString="*.mpg") returned 5
	[0048.033] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.flv") returned 0
	[0048.033] lstrlenA (lpString="*.flv") returned 5
	[0048.033] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.avi") returned 0
	[0048.033] lstrlenA (lpString="*.avi") returned 5
	[0048.034] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.mp4") returned 0
	[0048.034] lstrlenA (lpString="*.mp4") returned 5
	[0048.034] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.wmv") returned 0
	[0048.034] lstrlenA (lpString="*.wmv") returned 5
	[0048.034] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.mkv") returned 0
	[0048.034] lstrlenA (lpString="*.mkv") returned 5
	[0048.034] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.mp3") returned 0
	[0048.034] lstrlenA (lpString="*.mp3") returned 5
	[0048.034] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.wav") returned 0
	[0048.034] lstrlenA (lpString="*.wav") returned 5
	[0048.034] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.flac") returned 0
	[0048.034] lstrlenA (lpString="*.flac") returned 6
	[0048.034] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.wma") returned 0
	[0048.034] lstrlenA (lpString="*.wma") returned 5
	[0048.034] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.au3") returned 0
	[0048.034] lstrlenA (lpString="*.au3") returned 5
	[0048.034] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.ahk") returned 0
	[0048.034] lstrlenA (lpString="*.ahk") returned 5
	[0048.034] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.c") returned 0
	[0048.034] lstrlenA (lpString="*.c") returned 3
	[0048.034] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.cc") returned 0
	[0048.034] lstrlenA (lpString="*.cc") returned 4
	[0048.034] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.cpp") returned 0
	[0048.034] lstrlenA (lpString="*.cpp") returned 5
	[0048.034] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.cxx") returned 0
	[0048.034] lstrlenA (lpString="*.cxx") returned 5
	[0048.034] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.c++") returned 0
	[0048.034] lstrlenA (lpString="*.c++") returned 5
	[0048.034] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.cs") returned 0
	[0048.034] lstrlenA (lpString="*.cs") returned 4
	[0048.034] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.vb") returned 0
	[0048.034] lstrlenA (lpString="*.vb") returned 4
	[0048.034] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.bas") returned 0
	[0048.034] lstrlenA (lpString="*.bas") returned 5
	[0048.034] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.csproj") returned 0
	[0048.035] lstrlenA (lpString="*.csproj") returned 8
	[0048.035] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.vbproj") returned 0
	[0048.035] lstrlenA (lpString="*.vbproj") returned 8
	[0048.035] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.vcxproj") returned 0
	[0048.035] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.035] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.manifest") returned 0
	[0048.035] lstrlenA (lpString="*.manifest") returned 10
	[0048.035] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.php") returned 0
	[0048.035] lstrlenA (lpString="*.php") returned 5
	[0048.035] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.vbe") returned 0
	[0048.035] lstrlenA (lpString="*.vbe") returned 5
	[0048.035] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.vba") returned 0
	[0048.035] lstrlenA (lpString="*.vba") returned 5
	[0048.035] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.vbs") returned 0
	[0048.035] lstrlenA (lpString="*.vbs") returned 5
	[0048.035] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.bat") returned 0
	[0048.035] lstrlenA (lpString="*.bat") returned 5
	[0048.035] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.cmd") returned 0
	[0048.035] lstrlenA (lpString="*.cmd") returned 5
	[0048.035] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.js") returned 0
	[0048.035] lstrlenA (lpString="*.js") returned 4
	[0048.035] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.jscript") returned 0
	[0048.035] lstrlenA (lpString="*.jscript") returned 9
	[0048.035] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.hta") returned 0
	[0048.035] lstrlenA (lpString="*.hta") returned 5
	[0048.035] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.php7") returned 0
	[0048.035] lstrlenA (lpString="*.php7") returned 6
	[0048.035] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.db") returned 0
	[0048.035] lstrlenA (lpString="*.db") returned 4
	[0048.035] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.swf") returned 0
	[0048.035] lstrlenA (lpString="*.swf") returned 5
	[0048.035] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.eml") returned 0
	[0048.035] lstrlenA (lpString="*.eml") returned 5
	[0048.035] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.part") returned 0
	[0048.035] lstrlenA (lpString="*.part") returned 6
	[0048.035] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.nfo") returned 0
	[0048.035] lstrlenA (lpString="*.nfo") returned 5
	[0048.036] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.rsa") returned 0
	[0048.036] lstrlenA (lpString="*.rsa") returned 5
	[0048.036] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.key") returned 0
	[0048.036] lstrlenA (lpString="*.key") returned 5
	[0048.036] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.aes") returned 0
	[0048.036] lstrlenA (lpString="*.aes") returned 5
	[0048.036] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.blob") returned 0
	[0048.036] lstrlenA (lpString="*.blob") returned 6
	[0048.036] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.btc") returned 0
	[0048.036] lstrlenA (lpString="*.btc") returned 5
	[0048.036] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.wallet") returned 0
	[0048.036] lstrlenA (lpString="*.wallet") returned 8
	[0048.036] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0048.036] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.036] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="LocalizedData.xml") returned -1
	[0048.036] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="LocalizedData.xml") returned -1
	[0048.036] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1
	[0048.036] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned="eula.rtf"
	[0048.036] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1031\\" | out: lpString1="C:\\588bce7c90097ed212\\1031\\") returned="C:\\588bce7c90097ed212\\1031\\"
	[0048.036] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1031\\" | out: pszPath="C:\\588bce7c90097ed212\\1031\\") returned=""
	[0048.036] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1031\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1031\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1031\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.036] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1031\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1031\\how-to-decrypt-files.htm")) returned 0x20
	[0048.036] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1031\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml"
	[0048.036] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.zip") returned 0
	[0048.036] lstrlenA (lpString="*.zip") returned 5
	[0048.036] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.rar") returned 0
	[0048.036] lstrlenA (lpString="*.rar") returned 5
	[0048.036] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.7z") returned 0
	[0048.036] lstrlenA (lpString="*.7z") returned 4
	[0048.036] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.tar") returned 0
	[0048.036] lstrlenA (lpString="*.tar") returned 5
	[0048.036] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.gzip") returned 0
	[0048.036] lstrlenA (lpString="*.gzip") returned 6
	[0048.037] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.jpg") returned 0
	[0048.037] lstrlenA (lpString="*.jpg") returned 5
	[0048.037] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.jpeg") returned 0
	[0048.037] lstrlenA (lpString="*.jpeg") returned 6
	[0048.037] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.bmp") returned 0
	[0048.037] lstrlenA (lpString="*.bmp") returned 5
	[0048.037] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.gif") returned 0
	[0048.037] lstrlenA (lpString="*.gif") returned 5
	[0048.037] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.png") returned 0
	[0048.037] lstrlenA (lpString="*.png") returned 5
	[0048.037] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.doc") returned 0
	[0048.037] lstrlenA (lpString="*.doc") returned 5
	[0048.037] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.docx") returned 0
	[0048.037] lstrlenA (lpString="*.docx") returned 6
	[0048.037] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.xls") returned 0
	[0048.037] lstrlenA (lpString="*.xls") returned 5
	[0048.037] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.xlsx") returned 0
	[0048.037] lstrlenA (lpString="*.xlsx") returned 6
	[0048.037] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.ppt") returned 0
	[0048.037] lstrlenA (lpString="*.ppt") returned 5
	[0048.037] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.pptx") returned 0
	[0048.037] lstrlenA (lpString="*.pptx") returned 6
	[0048.037] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.txt") returned 0
	[0048.037] lstrlenA (lpString="*.txt") returned 5
	[0048.037] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.pdf") returned 0
	[0048.038] lstrlenA (lpString="*.pdf") returned 5
	[0048.038] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.htm") returned 0
	[0048.038] lstrlenA (lpString="*.htm") returned 5
	[0048.038] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.html") returned 0
	[0048.038] lstrlenA (lpString="*.html") returned 6
	[0048.038] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.mdb") returned 0
	[0048.038] lstrlenA (lpString="*.mdb") returned 5
	[0048.038] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.pfx") returned 0
	[0048.038] lstrlenA (lpString="*.pfx") returned 5
	[0048.038] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.md") returned 0
	[0048.038] lstrlenA (lpString="*.md") returned 4
	[0048.038] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.lnk") returned 0
	[0048.038] lstrlenA (lpString="*.lnk") returned 5
	[0048.038] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.torrent") returned 0
	[0048.038] lstrlenA (lpString="*.torrent") returned 9
	[0048.038] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.mov") returned 0
	[0048.038] lstrlenA (lpString="*.mov") returned 5
	[0048.038] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.3gp") returned 0
	[0048.038] lstrlenA (lpString="*.3gp") returned 5
	[0048.038] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.mpeg") returned 0
	[0048.038] lstrlenA (lpString="*.mpeg") returned 6
	[0048.038] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.mpg") returned 0
	[0048.038] lstrlenA (lpString="*.mpg") returned 5
	[0048.038] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.flv") returned 0
	[0048.038] lstrlenA (lpString="*.flv") returned 5
	[0048.038] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.avi") returned 0
	[0048.038] lstrlenA (lpString="*.avi") returned 5
	[0048.038] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.mp4") returned 0
	[0048.038] lstrlenA (lpString="*.mp4") returned 5
	[0048.038] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.wmv") returned 0
	[0048.038] lstrlenA (lpString="*.wmv") returned 5
	[0048.038] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.mkv") returned 0
	[0048.038] lstrlenA (lpString="*.mkv") returned 5
	[0048.038] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.mp3") returned 0
	[0048.038] lstrlenA (lpString="*.mp3") returned 5
	[0048.039] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.wav") returned 0
	[0048.039] lstrlenA (lpString="*.wav") returned 5
	[0048.039] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.flac") returned 0
	[0048.039] lstrlenA (lpString="*.flac") returned 6
	[0048.039] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.wma") returned 0
	[0048.039] lstrlenA (lpString="*.wma") returned 5
	[0048.039] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.au3") returned 0
	[0048.039] lstrlenA (lpString="*.au3") returned 5
	[0048.039] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.ahk") returned 0
	[0048.039] lstrlenA (lpString="*.ahk") returned 5
	[0048.039] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.c") returned 0
	[0048.039] lstrlenA (lpString="*.c") returned 3
	[0048.039] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.cc") returned 0
	[0048.039] lstrlenA (lpString="*.cc") returned 4
	[0048.039] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.cpp") returned 0
	[0048.039] lstrlenA (lpString="*.cpp") returned 5
	[0048.039] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.cxx") returned 0
	[0048.039] lstrlenA (lpString="*.cxx") returned 5
	[0048.039] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.c++") returned 0
	[0048.039] lstrlenA (lpString="*.c++") returned 5
	[0048.039] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.cs") returned 0
	[0048.039] lstrlenA (lpString="*.cs") returned 4
	[0048.039] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.vb") returned 0
	[0048.039] lstrlenA (lpString="*.vb") returned 4
	[0048.039] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.bas") returned 0
	[0048.039] lstrlenA (lpString="*.bas") returned 5
	[0048.039] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.csproj") returned 0
	[0048.039] lstrlenA (lpString="*.csproj") returned 8
	[0048.039] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.vbproj") returned 0
	[0048.039] lstrlenA (lpString="*.vbproj") returned 8
	[0048.039] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.vcxproj") returned 0
	[0048.039] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.039] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.manifest") returned 0
	[0048.039] lstrlenA (lpString="*.manifest") returned 10
	[0048.039] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.php") returned 0
	[0048.039] lstrlenA (lpString="*.php") returned 5
	[0048.039] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.vbe") returned 0
	[0048.040] lstrlenA (lpString="*.vbe") returned 5
	[0048.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.vba") returned 0
	[0048.040] lstrlenA (lpString="*.vba") returned 5
	[0048.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.vbs") returned 0
	[0048.040] lstrlenA (lpString="*.vbs") returned 5
	[0048.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.bat") returned 0
	[0048.040] lstrlenA (lpString="*.bat") returned 5
	[0048.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.cmd") returned 0
	[0048.040] lstrlenA (lpString="*.cmd") returned 5
	[0048.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.js") returned 0
	[0048.040] lstrlenA (lpString="*.js") returned 4
	[0048.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.jscript") returned 0
	[0048.040] lstrlenA (lpString="*.jscript") returned 9
	[0048.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.hta") returned 0
	[0048.040] lstrlenA (lpString="*.hta") returned 5
	[0048.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.php7") returned 0
	[0048.040] lstrlenA (lpString="*.php7") returned 6
	[0048.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.db") returned 0
	[0048.040] lstrlenA (lpString="*.db") returned 4
	[0048.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.swf") returned 0
	[0048.040] lstrlenA (lpString="*.swf") returned 5
	[0048.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.eml") returned 0
	[0048.040] lstrlenA (lpString="*.eml") returned 5
	[0048.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.part") returned 0
	[0048.040] lstrlenA (lpString="*.part") returned 6
	[0048.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.nfo") returned 0
	[0048.040] lstrlenA (lpString="*.nfo") returned 5
	[0048.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.rsa") returned 0
	[0048.040] lstrlenA (lpString="*.rsa") returned 5
	[0048.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.key") returned 0
	[0048.040] lstrlenA (lpString="*.key") returned 5
	[0048.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.aes") returned 0
	[0048.040] lstrlenA (lpString="*.aes") returned 5
	[0048.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.blob") returned 0
	[0048.040] lstrlenA (lpString="*.blob") returned 6
	[0048.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.btc") returned 0
	[0048.040] lstrlenA (lpString="*.btc") returned 5
	[0048.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.wallet") returned 0
	[0048.041] lstrlenA (lpString="*.wallet") returned 8
	[0048.041] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0048.041] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.041] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SetupResources.dll") returned -1
	[0048.041] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SetupResources.dll") returned -1
	[0048.041] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1
	[0048.041] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned="LocalizedData.xml"
	[0048.041] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1031\\" | out: lpString1="C:\\588bce7c90097ed212\\1031\\") returned="C:\\588bce7c90097ed212\\1031\\"
	[0048.041] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1031\\" | out: pszPath="C:\\588bce7c90097ed212\\1031\\") returned=""
	[0048.041] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1031\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1031\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1031\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.041] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1031\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1031\\how-to-decrypt-files.htm")) returned 0x20
	[0048.041] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1031\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1031\\SetupResources.dll"
	[0048.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.zip") returned 0
	[0048.041] lstrlenA (lpString="*.zip") returned 5
	[0048.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.rar") returned 0
	[0048.041] lstrlenA (lpString="*.rar") returned 5
	[0048.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.7z") returned 0
	[0048.041] lstrlenA (lpString="*.7z") returned 4
	[0048.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.tar") returned 0
	[0048.041] lstrlenA (lpString="*.tar") returned 5
	[0048.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.gzip") returned 0
	[0048.041] lstrlenA (lpString="*.gzip") returned 6
	[0048.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.jpg") returned 0
	[0048.041] lstrlenA (lpString="*.jpg") returned 5
	[0048.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.jpeg") returned 0
	[0048.041] lstrlenA (lpString="*.jpeg") returned 6
	[0048.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.bmp") returned 0
	[0048.041] lstrlenA (lpString="*.bmp") returned 5
	[0048.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.gif") returned 0
	[0048.041] lstrlenA (lpString="*.gif") returned 5
	[0048.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.png") returned 0
	[0048.041] lstrlenA (lpString="*.png") returned 5
	[0048.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.doc") returned 0
	[0048.042] lstrlenA (lpString="*.doc") returned 5
	[0048.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.docx") returned 0
	[0048.042] lstrlenA (lpString="*.docx") returned 6
	[0048.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.xls") returned 0
	[0048.042] lstrlenA (lpString="*.xls") returned 5
	[0048.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.xlsx") returned 0
	[0048.042] lstrlenA (lpString="*.xlsx") returned 6
	[0048.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.ppt") returned 0
	[0048.042] lstrlenA (lpString="*.ppt") returned 5
	[0048.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.pptx") returned 0
	[0048.042] lstrlenA (lpString="*.pptx") returned 6
	[0048.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.txt") returned 0
	[0048.042] lstrlenA (lpString="*.txt") returned 5
	[0048.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.pdf") returned 0
	[0048.042] lstrlenA (lpString="*.pdf") returned 5
	[0048.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.htm") returned 0
	[0048.042] lstrlenA (lpString="*.htm") returned 5
	[0048.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.html") returned 0
	[0048.042] lstrlenA (lpString="*.html") returned 6
	[0048.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.mdb") returned 0
	[0048.042] lstrlenA (lpString="*.mdb") returned 5
	[0048.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.pfx") returned 0
	[0048.042] lstrlenA (lpString="*.pfx") returned 5
	[0048.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.md") returned 0
	[0048.042] lstrlenA (lpString="*.md") returned 4
	[0048.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.lnk") returned 0
	[0048.042] lstrlenA (lpString="*.lnk") returned 5
	[0048.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.torrent") returned 0
	[0048.042] lstrlenA (lpString="*.torrent") returned 9
	[0048.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.mov") returned 0
	[0048.042] lstrlenA (lpString="*.mov") returned 5
	[0048.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.3gp") returned 0
	[0048.042] lstrlenA (lpString="*.3gp") returned 5
	[0048.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.mpeg") returned 0
	[0048.042] lstrlenA (lpString="*.mpeg") returned 6
	[0048.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.mpg") returned 0
	[0048.043] lstrlenA (lpString="*.mpg") returned 5
	[0048.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.flv") returned 0
	[0048.043] lstrlenA (lpString="*.flv") returned 5
	[0048.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.avi") returned 0
	[0048.043] lstrlenA (lpString="*.avi") returned 5
	[0048.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.mp4") returned 0
	[0048.043] lstrlenA (lpString="*.mp4") returned 5
	[0048.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.wmv") returned 0
	[0048.043] lstrlenA (lpString="*.wmv") returned 5
	[0048.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.mkv") returned 0
	[0048.043] lstrlenA (lpString="*.mkv") returned 5
	[0048.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.mp3") returned 0
	[0048.043] lstrlenA (lpString="*.mp3") returned 5
	[0048.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.wav") returned 0
	[0048.043] lstrlenA (lpString="*.wav") returned 5
	[0048.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.flac") returned 0
	[0048.043] lstrlenA (lpString="*.flac") returned 6
	[0048.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.wma") returned 0
	[0048.043] lstrlenA (lpString="*.wma") returned 5
	[0048.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.au3") returned 0
	[0048.043] lstrlenA (lpString="*.au3") returned 5
	[0048.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.ahk") returned 0
	[0048.043] lstrlenA (lpString="*.ahk") returned 5
	[0048.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.c") returned 0
	[0048.043] lstrlenA (lpString="*.c") returned 3
	[0048.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.cc") returned 0
	[0048.043] lstrlenA (lpString="*.cc") returned 4
	[0048.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.cpp") returned 0
	[0048.043] lstrlenA (lpString="*.cpp") returned 5
	[0048.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.cxx") returned 0
	[0048.043] lstrlenA (lpString="*.cxx") returned 5
	[0048.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.c++") returned 0
	[0048.043] lstrlenA (lpString="*.c++") returned 5
	[0048.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.cs") returned 0
	[0048.043] lstrlenA (lpString="*.cs") returned 4
	[0048.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.vb") returned 0
	[0048.043] lstrlenA (lpString="*.vb") returned 4
	[0048.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.bas") returned 0
	[0048.044] lstrlenA (lpString="*.bas") returned 5
	[0048.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.csproj") returned 0
	[0048.044] lstrlenA (lpString="*.csproj") returned 8
	[0048.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.vbproj") returned 0
	[0048.044] lstrlenA (lpString="*.vbproj") returned 8
	[0048.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.vcxproj") returned 0
	[0048.044] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.manifest") returned 0
	[0048.044] lstrlenA (lpString="*.manifest") returned 10
	[0048.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.php") returned 0
	[0048.044] lstrlenA (lpString="*.php") returned 5
	[0048.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.vbe") returned 0
	[0048.044] lstrlenA (lpString="*.vbe") returned 5
	[0048.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.vba") returned 0
	[0048.044] lstrlenA (lpString="*.vba") returned 5
	[0048.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.vbs") returned 0
	[0048.044] lstrlenA (lpString="*.vbs") returned 5
	[0048.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.bat") returned 0
	[0048.044] lstrlenA (lpString="*.bat") returned 5
	[0048.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.cmd") returned 0
	[0048.044] lstrlenA (lpString="*.cmd") returned 5
	[0048.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.js") returned 0
	[0048.044] lstrlenA (lpString="*.js") returned 4
	[0048.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.jscript") returned 0
	[0048.044] lstrlenA (lpString="*.jscript") returned 9
	[0048.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.hta") returned 0
	[0048.044] lstrlenA (lpString="*.hta") returned 5
	[0048.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.php7") returned 0
	[0048.044] lstrlenA (lpString="*.php7") returned 6
	[0048.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.db") returned 0
	[0048.044] lstrlenA (lpString="*.db") returned 4
	[0048.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.swf") returned 0
	[0048.044] lstrlenA (lpString="*.swf") returned 5
	[0048.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.eml") returned 0
	[0048.044] lstrlenA (lpString="*.eml") returned 5
	[0048.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.part") returned 0
	[0048.045] lstrlenA (lpString="*.part") returned 6
	[0048.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.nfo") returned 0
	[0048.045] lstrlenA (lpString="*.nfo") returned 5
	[0048.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.rsa") returned 0
	[0048.045] lstrlenA (lpString="*.rsa") returned 5
	[0048.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.key") returned 0
	[0048.045] lstrlenA (lpString="*.key") returned 5
	[0048.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.aes") returned 0
	[0048.045] lstrlenA (lpString="*.aes") returned 5
	[0048.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.blob") returned 0
	[0048.045] lstrlenA (lpString="*.blob") returned 6
	[0048.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.btc") returned 0
	[0048.045] lstrlenA (lpString="*.btc") returned 5
	[0048.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.wallet") returned 0
	[0048.045] lstrlenA (lpString="*.wallet") returned 8
	[0048.045] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0048.045] FindClose (in: hFindFile=0x7cb650 | out: hFindFile=0x7cb650) returned 1
	[0048.045] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d1d40, dwReserved1=0x7b00c0, cFileName="1032", cAlternateFileName="")) returned 1
	[0048.045] lstrcmpA (lpString1=".", lpString2="1032") returned -1
	[0048.045] lstrcmpA (lpString1="..", lpString2="1032") returned -1
	[0048.045] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*"
	[0048.045] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1032" | out: lpString1="C:\\588bce7c90097ed212\\1032") returned="C:\\588bce7c90097ed212\\1032"
	[0048.045] lstrlenA (lpString="C:\\588bce7c90097ed212\\1032") returned 26
	[0048.045] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb790
	[0048.046] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0048.046] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0048.046] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0048.046] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0048.046] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0048.046] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.046] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="eula.rtf") returned -1
	[0048.046] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="eula.rtf") returned 1
	[0048.046] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1
	[0048.046] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1032\\*.*") returned="*.*"
	[0048.046] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1032\\" | out: lpString1="C:\\588bce7c90097ed212\\1032\\") returned="C:\\588bce7c90097ed212\\1032\\"
	[0048.046] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1032\\" | out: pszPath="C:\\588bce7c90097ed212\\1032\\") returned=""
	[0048.046] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1032\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1032\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1032\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.046] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1032\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1032\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0048.046] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1032\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1032\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0048.048] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0048.048] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0048.049] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0048.049] CloseHandle (hObject=0x208) returned 1
	[0048.049] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1032\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned="C:\\588bce7c90097ed212\\1032\\eula.rtf"
	[0048.049] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.zip") returned 0
	[0048.049] lstrlenA (lpString="*.zip") returned 5
	[0048.049] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.rar") returned 0
	[0048.049] lstrlenA (lpString="*.rar") returned 5
	[0048.049] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.7z") returned 0
	[0048.049] lstrlenA (lpString="*.7z") returned 4
	[0048.049] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.tar") returned 0
	[0048.049] lstrlenA (lpString="*.tar") returned 5
	[0048.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.gzip") returned 0
	[0048.050] lstrlenA (lpString="*.gzip") returned 6
	[0048.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.jpg") returned 0
	[0048.050] lstrlenA (lpString="*.jpg") returned 5
	[0048.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.jpeg") returned 0
	[0048.050] lstrlenA (lpString="*.jpeg") returned 6
	[0048.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.bmp") returned 0
	[0048.050] lstrlenA (lpString="*.bmp") returned 5
	[0048.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.gif") returned 0
	[0048.050] lstrlenA (lpString="*.gif") returned 5
	[0048.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.png") returned 0
	[0048.050] lstrlenA (lpString="*.png") returned 5
	[0048.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.doc") returned 0
	[0048.050] lstrlenA (lpString="*.doc") returned 5
	[0048.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.docx") returned 0
	[0048.050] lstrlenA (lpString="*.docx") returned 6
	[0048.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.xls") returned 0
	[0048.050] lstrlenA (lpString="*.xls") returned 5
	[0048.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.xlsx") returned 0
	[0048.050] lstrlenA (lpString="*.xlsx") returned 6
	[0048.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.ppt") returned 0
	[0048.050] lstrlenA (lpString="*.ppt") returned 5
	[0048.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.pptx") returned 0
	[0048.050] lstrlenA (lpString="*.pptx") returned 6
	[0048.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.txt") returned 0
	[0048.050] lstrlenA (lpString="*.txt") returned 5
	[0048.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.pdf") returned 0
	[0048.050] lstrlenA (lpString="*.pdf") returned 5
	[0048.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.htm") returned 0
	[0048.050] lstrlenA (lpString="*.htm") returned 5
	[0048.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.html") returned 0
	[0048.050] lstrlenA (lpString="*.html") returned 6
	[0048.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.mdb") returned 0
	[0048.050] lstrlenA (lpString="*.mdb") returned 5
	[0048.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.pfx") returned 0
	[0048.050] lstrlenA (lpString="*.pfx") returned 5
	[0048.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.md") returned 0
	[0048.051] lstrlenA (lpString="*.md") returned 4
	[0048.051] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.lnk") returned 0
	[0048.051] lstrlenA (lpString="*.lnk") returned 5
	[0048.051] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.torrent") returned 0
	[0048.051] lstrlenA (lpString="*.torrent") returned 9
	[0048.051] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.mov") returned 0
	[0048.051] lstrlenA (lpString="*.mov") returned 5
	[0048.051] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.3gp") returned 0
	[0048.051] lstrlenA (lpString="*.3gp") returned 5
	[0048.051] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.mpeg") returned 0
	[0048.051] lstrlenA (lpString="*.mpeg") returned 6
	[0048.051] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.mpg") returned 0
	[0048.051] lstrlenA (lpString="*.mpg") returned 5
	[0048.051] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.flv") returned 0
	[0048.051] lstrlenA (lpString="*.flv") returned 5
	[0048.051] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.avi") returned 0
	[0048.051] lstrlenA (lpString="*.avi") returned 5
	[0048.051] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.mp4") returned 0
	[0048.051] lstrlenA (lpString="*.mp4") returned 5
	[0048.051] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.wmv") returned 0
	[0048.051] lstrlenA (lpString="*.wmv") returned 5
	[0048.051] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.mkv") returned 0
	[0048.051] lstrlenA (lpString="*.mkv") returned 5
	[0048.051] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.mp3") returned 0
	[0048.051] lstrlenA (lpString="*.mp3") returned 5
	[0048.051] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.wav") returned 0
	[0048.051] lstrlenA (lpString="*.wav") returned 5
	[0048.051] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.flac") returned 0
	[0048.051] lstrlenA (lpString="*.flac") returned 6
	[0048.051] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.wma") returned 0
	[0048.051] lstrlenA (lpString="*.wma") returned 5
	[0048.051] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.au3") returned 0
	[0048.051] lstrlenA (lpString="*.au3") returned 5
	[0048.051] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.ahk") returned 0
	[0048.051] lstrlenA (lpString="*.ahk") returned 5
	[0048.051] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.c") returned 0
	[0048.051] lstrlenA (lpString="*.c") returned 3
	[0048.051] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.cc") returned 0
	[0048.052] lstrlenA (lpString="*.cc") returned 4
	[0048.052] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.cpp") returned 0
	[0048.052] lstrlenA (lpString="*.cpp") returned 5
	[0048.052] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.cxx") returned 0
	[0048.052] lstrlenA (lpString="*.cxx") returned 5
	[0048.052] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.c++") returned 0
	[0048.052] lstrlenA (lpString="*.c++") returned 5
	[0048.052] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.cs") returned 0
	[0048.052] lstrlenA (lpString="*.cs") returned 4
	[0048.052] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.vb") returned 0
	[0048.052] lstrlenA (lpString="*.vb") returned 4
	[0048.052] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.bas") returned 0
	[0048.052] lstrlenA (lpString="*.bas") returned 5
	[0048.052] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.csproj") returned 0
	[0048.052] lstrlenA (lpString="*.csproj") returned 8
	[0048.052] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.vbproj") returned 0
	[0048.052] lstrlenA (lpString="*.vbproj") returned 8
	[0048.052] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.vcxproj") returned 0
	[0048.052] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.052] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.manifest") returned 0
	[0048.052] lstrlenA (lpString="*.manifest") returned 10
	[0048.052] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.php") returned 0
	[0048.052] lstrlenA (lpString="*.php") returned 5
	[0048.052] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.vbe") returned 0
	[0048.052] lstrlenA (lpString="*.vbe") returned 5
	[0048.052] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.vba") returned 0
	[0048.052] lstrlenA (lpString="*.vba") returned 5
	[0048.052] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.vbs") returned 0
	[0048.052] lstrlenA (lpString="*.vbs") returned 5
	[0048.052] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.bat") returned 0
	[0048.052] lstrlenA (lpString="*.bat") returned 5
	[0048.052] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.cmd") returned 0
	[0048.054] lstrlenA (lpString="*.cmd") returned 5
	[0048.054] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.js") returned 0
	[0048.054] lstrlenA (lpString="*.js") returned 4
	[0048.054] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.jscript") returned 0
	[0048.054] lstrlenA (lpString="*.jscript") returned 9
	[0048.054] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.hta") returned 0
	[0048.054] lstrlenA (lpString="*.hta") returned 5
	[0048.054] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.php7") returned 0
	[0048.054] lstrlenA (lpString="*.php7") returned 6
	[0048.054] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.db") returned 0
	[0048.054] lstrlenA (lpString="*.db") returned 4
	[0048.055] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.swf") returned 0
	[0048.055] lstrlenA (lpString="*.swf") returned 5
	[0048.055] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.eml") returned 0
	[0048.055] lstrlenA (lpString="*.eml") returned 5
	[0048.055] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.part") returned 0
	[0048.055] lstrlenA (lpString="*.part") returned 6
	[0048.055] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.nfo") returned 0
	[0048.055] lstrlenA (lpString="*.nfo") returned 5
	[0048.055] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.rsa") returned 0
	[0048.055] lstrlenA (lpString="*.rsa") returned 5
	[0048.055] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.key") returned 0
	[0048.055] lstrlenA (lpString="*.key") returned 5
	[0048.055] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.aes") returned 0
	[0048.055] lstrlenA (lpString="*.aes") returned 5
	[0048.055] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.blob") returned 0
	[0048.055] lstrlenA (lpString="*.blob") returned 6
	[0048.055] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.btc") returned 0
	[0048.055] lstrlenA (lpString="*.btc") returned 5
	[0048.055] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.wallet") returned 0
	[0048.055] lstrlenA (lpString="*.wallet") returned 8
	[0048.055] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0048.055] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.055] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="LocalizedData.xml") returned -1
	[0048.055] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="LocalizedData.xml") returned -1
	[0048.055] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1
	[0048.055] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned="eula.rtf"
	[0048.055] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1032\\" | out: lpString1="C:\\588bce7c90097ed212\\1032\\") returned="C:\\588bce7c90097ed212\\1032\\"
	[0048.055] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1032\\" | out: pszPath="C:\\588bce7c90097ed212\\1032\\") returned=""
	[0048.055] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1032\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1032\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1032\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.055] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1032\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1032\\how-to-decrypt-files.htm")) returned 0x20
	[0048.055] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1032\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml"
	[0048.055] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.zip") returned 0
	[0048.055] lstrlenA (lpString="*.zip") returned 5
	[0048.056] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.rar") returned 0
	[0048.056] lstrlenA (lpString="*.rar") returned 5
	[0048.056] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.7z") returned 0
	[0048.056] lstrlenA (lpString="*.7z") returned 4
	[0048.056] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.tar") returned 0
	[0048.056] lstrlenA (lpString="*.tar") returned 5
	[0048.056] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.gzip") returned 0
	[0048.056] lstrlenA (lpString="*.gzip") returned 6
	[0048.056] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.jpg") returned 0
	[0048.056] lstrlenA (lpString="*.jpg") returned 5
	[0048.056] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.jpeg") returned 0
	[0048.056] lstrlenA (lpString="*.jpeg") returned 6
	[0048.056] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.bmp") returned 0
	[0048.056] lstrlenA (lpString="*.bmp") returned 5
	[0048.056] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.gif") returned 0
	[0048.056] lstrlenA (lpString="*.gif") returned 5
	[0048.056] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.png") returned 0
	[0048.056] lstrlenA (lpString="*.png") returned 5
	[0048.056] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.doc") returned 0
	[0048.056] lstrlenA (lpString="*.doc") returned 5
	[0048.056] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.docx") returned 0
	[0048.056] lstrlenA (lpString="*.docx") returned 6
	[0048.056] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.xls") returned 0
	[0048.056] lstrlenA (lpString="*.xls") returned 5
	[0048.056] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.xlsx") returned 0
	[0048.056] lstrlenA (lpString="*.xlsx") returned 6
	[0048.056] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.ppt") returned 0
	[0048.056] lstrlenA (lpString="*.ppt") returned 5
	[0048.056] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.pptx") returned 0
	[0048.056] lstrlenA (lpString="*.pptx") returned 6
	[0048.056] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.txt") returned 0
	[0048.056] lstrlenA (lpString="*.txt") returned 5
	[0048.057] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.pdf") returned 0
	[0048.057] lstrlenA (lpString="*.pdf") returned 5
	[0048.057] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.htm") returned 0
	[0048.057] lstrlenA (lpString="*.htm") returned 5
	[0048.057] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.html") returned 0
	[0048.057] lstrlenA (lpString="*.html") returned 6
	[0048.057] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.mdb") returned 0
	[0048.057] lstrlenA (lpString="*.mdb") returned 5
	[0048.057] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.pfx") returned 0
	[0048.057] lstrlenA (lpString="*.pfx") returned 5
	[0048.057] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.md") returned 0
	[0048.057] lstrlenA (lpString="*.md") returned 4
	[0048.057] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.lnk") returned 0
	[0048.057] lstrlenA (lpString="*.lnk") returned 5
	[0048.057] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.torrent") returned 0
	[0048.057] lstrlenA (lpString="*.torrent") returned 9
	[0048.057] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.mov") returned 0
	[0048.057] lstrlenA (lpString="*.mov") returned 5
	[0048.057] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.3gp") returned 0
	[0048.057] lstrlenA (lpString="*.3gp") returned 5
	[0048.057] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.mpeg") returned 0
	[0048.057] lstrlenA (lpString="*.mpeg") returned 6
	[0048.057] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.mpg") returned 0
	[0048.057] lstrlenA (lpString="*.mpg") returned 5
	[0048.057] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.flv") returned 0
	[0048.057] lstrlenA (lpString="*.flv") returned 5
	[0048.057] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.avi") returned 0
	[0048.057] lstrlenA (lpString="*.avi") returned 5
	[0048.057] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.mp4") returned 0
	[0048.057] lstrlenA (lpString="*.mp4") returned 5
	[0048.057] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.wmv") returned 0
	[0048.057] lstrlenA (lpString="*.wmv") returned 5
	[0048.057] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.mkv") returned 0
	[0048.057] lstrlenA (lpString="*.mkv") returned 5
	[0048.057] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.mp3") returned 0
	[0048.057] lstrlenA (lpString="*.mp3") returned 5
	[0048.057] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.wav") returned 0
	[0048.058] lstrlenA (lpString="*.wav") returned 5
	[0048.058] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.flac") returned 0
	[0048.058] lstrlenA (lpString="*.flac") returned 6
	[0048.058] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.wma") returned 0
	[0048.058] lstrlenA (lpString="*.wma") returned 5
	[0048.058] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.au3") returned 0
	[0048.058] lstrlenA (lpString="*.au3") returned 5
	[0048.058] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.ahk") returned 0
	[0048.058] lstrlenA (lpString="*.ahk") returned 5
	[0048.058] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.c") returned 0
	[0048.058] lstrlenA (lpString="*.c") returned 3
	[0048.058] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.cc") returned 0
	[0048.058] lstrlenA (lpString="*.cc") returned 4
	[0048.058] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.cpp") returned 0
	[0048.058] lstrlenA (lpString="*.cpp") returned 5
	[0048.058] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.cxx") returned 0
	[0048.058] lstrlenA (lpString="*.cxx") returned 5
	[0048.058] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.c++") returned 0
	[0048.058] lstrlenA (lpString="*.c++") returned 5
	[0048.058] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.cs") returned 0
	[0048.058] lstrlenA (lpString="*.cs") returned 4
	[0048.058] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.vb") returned 0
	[0048.058] lstrlenA (lpString="*.vb") returned 4
	[0048.058] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.bas") returned 0
	[0048.058] lstrlenA (lpString="*.bas") returned 5
	[0048.058] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.csproj") returned 0
	[0048.058] lstrlenA (lpString="*.csproj") returned 8
	[0048.058] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.vbproj") returned 0
	[0048.058] lstrlenA (lpString="*.vbproj") returned 8
	[0048.058] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.vcxproj") returned 0
	[0048.058] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.058] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.manifest") returned 0
	[0048.058] lstrlenA (lpString="*.manifest") returned 10
	[0048.058] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.php") returned 0
	[0048.058] lstrlenA (lpString="*.php") returned 5
	[0048.058] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.vbe") returned 0
	[0048.058] lstrlenA (lpString="*.vbe") returned 5
	[0048.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.vba") returned 0
	[0048.059] lstrlenA (lpString="*.vba") returned 5
	[0048.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.vbs") returned 0
	[0048.059] lstrlenA (lpString="*.vbs") returned 5
	[0048.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.bat") returned 0
	[0048.059] lstrlenA (lpString="*.bat") returned 5
	[0048.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.cmd") returned 0
	[0048.059] lstrlenA (lpString="*.cmd") returned 5
	[0048.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.js") returned 0
	[0048.059] lstrlenA (lpString="*.js") returned 4
	[0048.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.jscript") returned 0
	[0048.059] lstrlenA (lpString="*.jscript") returned 9
	[0048.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.hta") returned 0
	[0048.059] lstrlenA (lpString="*.hta") returned 5
	[0048.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.php7") returned 0
	[0048.059] lstrlenA (lpString="*.php7") returned 6
	[0048.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.db") returned 0
	[0048.059] lstrlenA (lpString="*.db") returned 4
	[0048.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.swf") returned 0
	[0048.059] lstrlenA (lpString="*.swf") returned 5
	[0048.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.eml") returned 0
	[0048.059] lstrlenA (lpString="*.eml") returned 5
	[0048.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.part") returned 0
	[0048.059] lstrlenA (lpString="*.part") returned 6
	[0048.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.nfo") returned 0
	[0048.059] lstrlenA (lpString="*.nfo") returned 5
	[0048.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.rsa") returned 0
	[0048.059] lstrlenA (lpString="*.rsa") returned 5
	[0048.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.key") returned 0
	[0048.059] lstrlenA (lpString="*.key") returned 5
	[0048.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.aes") returned 0
	[0048.059] lstrlenA (lpString="*.aes") returned 5
	[0048.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.blob") returned 0
	[0048.059] lstrlenA (lpString="*.blob") returned 6
	[0048.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.btc") returned 0
	[0048.059] lstrlenA (lpString="*.btc") returned 5
	[0048.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.wallet") returned 0
	[0048.060] lstrlenA (lpString="*.wallet") returned 8
	[0048.060] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0048.060] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.060] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SetupResources.dll") returned -1
	[0048.060] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SetupResources.dll") returned -1
	[0048.060] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1
	[0048.060] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned="LocalizedData.xml"
	[0048.060] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1032\\" | out: lpString1="C:\\588bce7c90097ed212\\1032\\") returned="C:\\588bce7c90097ed212\\1032\\"
	[0048.060] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1032\\" | out: pszPath="C:\\588bce7c90097ed212\\1032\\") returned=""
	[0048.060] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1032\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1032\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1032\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.060] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1032\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1032\\how-to-decrypt-files.htm")) returned 0x20
	[0048.060] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1032\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1032\\SetupResources.dll"
	[0048.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.zip") returned 0
	[0048.060] lstrlenA (lpString="*.zip") returned 5
	[0048.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.rar") returned 0
	[0048.060] lstrlenA (lpString="*.rar") returned 5
	[0048.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.7z") returned 0
	[0048.060] lstrlenA (lpString="*.7z") returned 4
	[0048.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.tar") returned 0
	[0048.060] lstrlenA (lpString="*.tar") returned 5
	[0048.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.gzip") returned 0
	[0048.060] lstrlenA (lpString="*.gzip") returned 6
	[0048.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.jpg") returned 0
	[0048.060] lstrlenA (lpString="*.jpg") returned 5
	[0048.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.jpeg") returned 0
	[0048.060] lstrlenA (lpString="*.jpeg") returned 6
	[0048.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.bmp") returned 0
	[0048.060] lstrlenA (lpString="*.bmp") returned 5
	[0048.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.gif") returned 0
	[0048.060] lstrlenA (lpString="*.gif") returned 5
	[0048.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.png") returned 0
	[0048.060] lstrlenA (lpString="*.png") returned 5
	[0048.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.doc") returned 0
	[0048.061] lstrlenA (lpString="*.doc") returned 5
	[0048.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.docx") returned 0
	[0048.061] lstrlenA (lpString="*.docx") returned 6
	[0048.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.xls") returned 0
	[0048.061] lstrlenA (lpString="*.xls") returned 5
	[0048.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.xlsx") returned 0
	[0048.061] lstrlenA (lpString="*.xlsx") returned 6
	[0048.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.ppt") returned 0
	[0048.061] lstrlenA (lpString="*.ppt") returned 5
	[0048.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.pptx") returned 0
	[0048.061] lstrlenA (lpString="*.pptx") returned 6
	[0048.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.txt") returned 0
	[0048.061] lstrlenA (lpString="*.txt") returned 5
	[0048.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.pdf") returned 0
	[0048.061] lstrlenA (lpString="*.pdf") returned 5
	[0048.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.htm") returned 0
	[0048.061] lstrlenA (lpString="*.htm") returned 5
	[0048.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.html") returned 0
	[0048.061] lstrlenA (lpString="*.html") returned 6
	[0048.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.mdb") returned 0
	[0048.061] lstrlenA (lpString="*.mdb") returned 5
	[0048.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.pfx") returned 0
	[0048.061] lstrlenA (lpString="*.pfx") returned 5
	[0048.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.md") returned 0
	[0048.061] lstrlenA (lpString="*.md") returned 4
	[0048.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.lnk") returned 0
	[0048.061] lstrlenA (lpString="*.lnk") returned 5
	[0048.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.torrent") returned 0
	[0048.061] lstrlenA (lpString="*.torrent") returned 9
	[0048.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.mov") returned 0
	[0048.061] lstrlenA (lpString="*.mov") returned 5
	[0048.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.3gp") returned 0
	[0048.061] lstrlenA (lpString="*.3gp") returned 5
	[0048.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.mpeg") returned 0
	[0048.061] lstrlenA (lpString="*.mpeg") returned 6
	[0048.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.mpg") returned 0
	[0048.061] lstrlenA (lpString="*.mpg") returned 5
	[0048.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.flv") returned 0
	[0048.062] lstrlenA (lpString="*.flv") returned 5
	[0048.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.avi") returned 0
	[0048.062] lstrlenA (lpString="*.avi") returned 5
	[0048.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.mp4") returned 0
	[0048.062] lstrlenA (lpString="*.mp4") returned 5
	[0048.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.wmv") returned 0
	[0048.062] lstrlenA (lpString="*.wmv") returned 5
	[0048.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.mkv") returned 0
	[0048.062] lstrlenA (lpString="*.mkv") returned 5
	[0048.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.mp3") returned 0
	[0048.062] lstrlenA (lpString="*.mp3") returned 5
	[0048.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.wav") returned 0
	[0048.062] lstrlenA (lpString="*.wav") returned 5
	[0048.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.flac") returned 0
	[0048.062] lstrlenA (lpString="*.flac") returned 6
	[0048.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.wma") returned 0
	[0048.062] lstrlenA (lpString="*.wma") returned 5
	[0048.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.au3") returned 0
	[0048.062] lstrlenA (lpString="*.au3") returned 5
	[0048.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.ahk") returned 0
	[0048.062] lstrlenA (lpString="*.ahk") returned 5
	[0048.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.c") returned 0
	[0048.062] lstrlenA (lpString="*.c") returned 3
	[0048.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.cc") returned 0
	[0048.062] lstrlenA (lpString="*.cc") returned 4
	[0048.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.cpp") returned 0
	[0048.062] lstrlenA (lpString="*.cpp") returned 5
	[0048.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.cxx") returned 0
	[0048.062] lstrlenA (lpString="*.cxx") returned 5
	[0048.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.c++") returned 0
	[0048.062] lstrlenA (lpString="*.c++") returned 5
	[0048.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.cs") returned 0
	[0048.062] lstrlenA (lpString="*.cs") returned 4
	[0048.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.vb") returned 0
	[0048.062] lstrlenA (lpString="*.vb") returned 4
	[0048.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.bas") returned 0
	[0048.063] lstrlenA (lpString="*.bas") returned 5
	[0048.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.csproj") returned 0
	[0048.063] lstrlenA (lpString="*.csproj") returned 8
	[0048.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.vbproj") returned 0
	[0048.063] lstrlenA (lpString="*.vbproj") returned 8
	[0048.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.vcxproj") returned 0
	[0048.063] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.manifest") returned 0
	[0048.063] lstrlenA (lpString="*.manifest") returned 10
	[0048.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.php") returned 0
	[0048.063] lstrlenA (lpString="*.php") returned 5
	[0048.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.vbe") returned 0
	[0048.063] lstrlenA (lpString="*.vbe") returned 5
	[0048.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.vba") returned 0
	[0048.063] lstrlenA (lpString="*.vba") returned 5
	[0048.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.vbs") returned 0
	[0048.063] lstrlenA (lpString="*.vbs") returned 5
	[0048.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.bat") returned 0
	[0048.063] lstrlenA (lpString="*.bat") returned 5
	[0048.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.cmd") returned 0
	[0048.063] lstrlenA (lpString="*.cmd") returned 5
	[0048.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.js") returned 0
	[0048.063] lstrlenA (lpString="*.js") returned 4
	[0048.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.jscript") returned 0
	[0048.063] lstrlenA (lpString="*.jscript") returned 9
	[0048.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.hta") returned 0
	[0048.063] lstrlenA (lpString="*.hta") returned 5
	[0048.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.php7") returned 0
	[0048.063] lstrlenA (lpString="*.php7") returned 6
	[0048.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.db") returned 0
	[0048.063] lstrlenA (lpString="*.db") returned 4
	[0048.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.swf") returned 0
	[0048.063] lstrlenA (lpString="*.swf") returned 5
	[0048.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.eml") returned 0
	[0048.063] lstrlenA (lpString="*.eml") returned 5
	[0048.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.part") returned 0
	[0048.063] lstrlenA (lpString="*.part") returned 6
	[0048.064] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.nfo") returned 0
	[0048.064] lstrlenA (lpString="*.nfo") returned 5
	[0048.064] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.rsa") returned 0
	[0048.064] lstrlenA (lpString="*.rsa") returned 5
	[0048.064] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.key") returned 0
	[0048.064] lstrlenA (lpString="*.key") returned 5
	[0048.064] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.aes") returned 0
	[0048.064] lstrlenA (lpString="*.aes") returned 5
	[0048.064] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.blob") returned 0
	[0048.064] lstrlenA (lpString="*.blob") returned 6
	[0048.064] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.btc") returned 0
	[0048.064] lstrlenA (lpString="*.btc") returned 5
	[0048.064] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.wallet") returned 0
	[0048.064] lstrlenA (lpString="*.wallet") returned 8
	[0048.064] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0048.064] FindClose (in: hFindFile=0x7cb790 | out: hFindFile=0x7cb790) returned 1
	[0048.064] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d1d40, dwReserved1=0x7b00c0, cFileName="1033", cAlternateFileName="")) returned 1
	[0048.064] lstrcmpA (lpString1=".", lpString2="1033") returned -1
	[0048.064] lstrcmpA (lpString1="..", lpString2="1033") returned -1
	[0048.064] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*"
	[0048.064] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1033" | out: lpString1="C:\\588bce7c90097ed212\\1033") returned="C:\\588bce7c90097ed212\\1033"
	[0048.064] lstrlenA (lpString="C:\\588bce7c90097ed212\\1033") returned 26
	[0048.064] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbad0
	[0048.095] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0048.095] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0048.096] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0048.096] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0048.096] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0048.096] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.096] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="eula.rtf") returned -1
	[0048.096] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="eula.rtf") returned 1
	[0048.096] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1
	[0048.096] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1033\\*.*") returned="*.*"
	[0048.096] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1033\\" | out: lpString1="C:\\588bce7c90097ed212\\1033\\") returned="C:\\588bce7c90097ed212\\1033\\"
	[0048.096] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1033\\" | out: pszPath="C:\\588bce7c90097ed212\\1033\\") returned=""
	[0048.096] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1033\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1033\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1033\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.096] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1033\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1033\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0048.096] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1033\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1033\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0048.098] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0048.098] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0048.099] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0048.099] CloseHandle (hObject=0x208) returned 1
	[0048.100] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1033\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned="C:\\588bce7c90097ed212\\1033\\eula.rtf"
	[0048.100] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.zip") returned 0
	[0048.100] lstrlenA (lpString="*.zip") returned 5
	[0048.100] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.rar") returned 0
	[0048.100] lstrlenA (lpString="*.rar") returned 5
	[0048.100] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.7z") returned 0
	[0048.100] lstrlenA (lpString="*.7z") returned 4
	[0048.100] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.tar") returned 0
	[0048.100] lstrlenA (lpString="*.tar") returned 5
	[0048.100] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.gzip") returned 0
	[0048.100] lstrlenA (lpString="*.gzip") returned 6
	[0048.100] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.jpg") returned 0
	[0048.100] lstrlenA (lpString="*.jpg") returned 5
	[0048.100] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.jpeg") returned 0
	[0048.100] lstrlenA (lpString="*.jpeg") returned 6
	[0048.100] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.bmp") returned 0
	[0048.100] lstrlenA (lpString="*.bmp") returned 5
	[0048.100] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.gif") returned 0
	[0048.100] lstrlenA (lpString="*.gif") returned 5
	[0048.100] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.png") returned 0
	[0048.100] lstrlenA (lpString="*.png") returned 5
	[0048.100] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.doc") returned 0
	[0048.100] lstrlenA (lpString="*.doc") returned 5
	[0048.100] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.docx") returned 0
	[0048.100] lstrlenA (lpString="*.docx") returned 6
	[0048.100] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.xls") returned 0
	[0048.100] lstrlenA (lpString="*.xls") returned 5
	[0048.100] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.xlsx") returned 0
	[0048.100] lstrlenA (lpString="*.xlsx") returned 6
	[0048.100] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.ppt") returned 0
	[0048.101] lstrlenA (lpString="*.ppt") returned 5
	[0048.101] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.pptx") returned 0
	[0048.101] lstrlenA (lpString="*.pptx") returned 6
	[0048.101] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.txt") returned 0
	[0048.101] lstrlenA (lpString="*.txt") returned 5
	[0048.101] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.pdf") returned 0
	[0048.101] lstrlenA (lpString="*.pdf") returned 5
	[0048.101] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.htm") returned 0
	[0048.101] lstrlenA (lpString="*.htm") returned 5
	[0048.101] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.html") returned 0
	[0048.101] lstrlenA (lpString="*.html") returned 6
	[0048.101] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.mdb") returned 0
	[0048.101] lstrlenA (lpString="*.mdb") returned 5
	[0048.101] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.pfx") returned 0
	[0048.101] lstrlenA (lpString="*.pfx") returned 5
	[0048.101] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.md") returned 0
	[0048.101] lstrlenA (lpString="*.md") returned 4
	[0048.101] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.lnk") returned 0
	[0048.101] lstrlenA (lpString="*.lnk") returned 5
	[0048.101] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.torrent") returned 0
	[0048.101] lstrlenA (lpString="*.torrent") returned 9
	[0048.101] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.mov") returned 0
	[0048.101] lstrlenA (lpString="*.mov") returned 5
	[0048.101] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.3gp") returned 0
	[0048.101] lstrlenA (lpString="*.3gp") returned 5
	[0048.101] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.mpeg") returned 0
	[0048.101] lstrlenA (lpString="*.mpeg") returned 6
	[0048.101] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.mpg") returned 0
	[0048.101] lstrlenA (lpString="*.mpg") returned 5
	[0048.101] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.flv") returned 0
	[0048.101] lstrlenA (lpString="*.flv") returned 5
	[0048.101] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.avi") returned 0
	[0048.101] lstrlenA (lpString="*.avi") returned 5
	[0048.101] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.mp4") returned 0
	[0048.101] lstrlenA (lpString="*.mp4") returned 5
	[0048.101] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.wmv") returned 0
	[0048.101] lstrlenA (lpString="*.wmv") returned 5
	[0048.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.mkv") returned 0
	[0048.102] lstrlenA (lpString="*.mkv") returned 5
	[0048.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.mp3") returned 0
	[0048.102] lstrlenA (lpString="*.mp3") returned 5
	[0048.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.wav") returned 0
	[0048.102] lstrlenA (lpString="*.wav") returned 5
	[0048.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.flac") returned 0
	[0048.102] lstrlenA (lpString="*.flac") returned 6
	[0048.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.wma") returned 0
	[0048.102] lstrlenA (lpString="*.wma") returned 5
	[0048.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.au3") returned 0
	[0048.102] lstrlenA (lpString="*.au3") returned 5
	[0048.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.ahk") returned 0
	[0048.102] lstrlenA (lpString="*.ahk") returned 5
	[0048.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.c") returned 0
	[0048.102] lstrlenA (lpString="*.c") returned 3
	[0048.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.cc") returned 0
	[0048.102] lstrlenA (lpString="*.cc") returned 4
	[0048.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.cpp") returned 0
	[0048.102] lstrlenA (lpString="*.cpp") returned 5
	[0048.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.cxx") returned 0
	[0048.102] lstrlenA (lpString="*.cxx") returned 5
	[0048.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.c++") returned 0
	[0048.102] lstrlenA (lpString="*.c++") returned 5
	[0048.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.cs") returned 0
	[0048.102] lstrlenA (lpString="*.cs") returned 4
	[0048.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.vb") returned 0
	[0048.102] lstrlenA (lpString="*.vb") returned 4
	[0048.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.bas") returned 0
	[0048.102] lstrlenA (lpString="*.bas") returned 5
	[0048.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.csproj") returned 0
	[0048.102] lstrlenA (lpString="*.csproj") returned 8
	[0048.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.vbproj") returned 0
	[0048.102] lstrlenA (lpString="*.vbproj") returned 8
	[0048.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.vcxproj") returned 0
	[0048.102] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.manifest") returned 0
	[0048.103] lstrlenA (lpString="*.manifest") returned 10
	[0048.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.php") returned 0
	[0048.103] lstrlenA (lpString="*.php") returned 5
	[0048.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.vbe") returned 0
	[0048.103] lstrlenA (lpString="*.vbe") returned 5
	[0048.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.vba") returned 0
	[0048.103] lstrlenA (lpString="*.vba") returned 5
	[0048.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.vbs") returned 0
	[0048.103] lstrlenA (lpString="*.vbs") returned 5
	[0048.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.bat") returned 0
	[0048.103] lstrlenA (lpString="*.bat") returned 5
	[0048.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.cmd") returned 0
	[0048.103] lstrlenA (lpString="*.cmd") returned 5
	[0048.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.js") returned 0
	[0048.103] lstrlenA (lpString="*.js") returned 4
	[0048.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.jscript") returned 0
	[0048.103] lstrlenA (lpString="*.jscript") returned 9
	[0048.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.hta") returned 0
	[0048.103] lstrlenA (lpString="*.hta") returned 5
	[0048.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.php7") returned 0
	[0048.103] lstrlenA (lpString="*.php7") returned 6
	[0048.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.db") returned 0
	[0048.103] lstrlenA (lpString="*.db") returned 4
	[0048.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.swf") returned 0
	[0048.103] lstrlenA (lpString="*.swf") returned 5
	[0048.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.eml") returned 0
	[0048.103] lstrlenA (lpString="*.eml") returned 5
	[0048.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.part") returned 0
	[0048.103] lstrlenA (lpString="*.part") returned 6
	[0048.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.nfo") returned 0
	[0048.103] lstrlenA (lpString="*.nfo") returned 5
	[0048.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.rsa") returned 0
	[0048.103] lstrlenA (lpString="*.rsa") returned 5
	[0048.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.key") returned 0
	[0048.103] lstrlenA (lpString="*.key") returned 5
	[0048.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.aes") returned 0
	[0048.103] lstrlenA (lpString="*.aes") returned 5
	[0048.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.blob") returned 0
	[0048.104] lstrlenA (lpString="*.blob") returned 6
	[0048.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.btc") returned 0
	[0048.104] lstrlenA (lpString="*.btc") returned 5
	[0048.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.wallet") returned 0
	[0048.104] lstrlenA (lpString="*.wallet") returned 8
	[0048.104] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0048.104] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.104] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="LocalizedData.xml") returned -1
	[0048.104] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="LocalizedData.xml") returned -1
	[0048.104] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1
	[0048.104] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned="eula.rtf"
	[0048.104] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1033\\" | out: lpString1="C:\\588bce7c90097ed212\\1033\\") returned="C:\\588bce7c90097ed212\\1033\\"
	[0048.104] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1033\\" | out: pszPath="C:\\588bce7c90097ed212\\1033\\") returned=""
	[0048.104] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1033\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1033\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1033\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.104] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1033\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1033\\how-to-decrypt-files.htm")) returned 0x20
	[0048.104] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1033\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml"
	[0048.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.zip") returned 0
	[0048.104] lstrlenA (lpString="*.zip") returned 5
	[0048.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.rar") returned 0
	[0048.104] lstrlenA (lpString="*.rar") returned 5
	[0048.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.7z") returned 0
	[0048.104] lstrlenA (lpString="*.7z") returned 4
	[0048.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.tar") returned 0
	[0048.104] lstrlenA (lpString="*.tar") returned 5
	[0048.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.gzip") returned 0
	[0048.104] lstrlenA (lpString="*.gzip") returned 6
	[0048.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.jpg") returned 0
	[0048.104] lstrlenA (lpString="*.jpg") returned 5
	[0048.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.jpeg") returned 0
	[0048.104] lstrlenA (lpString="*.jpeg") returned 6
	[0048.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.bmp") returned 0
	[0048.105] lstrlenA (lpString="*.bmp") returned 5
	[0048.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.gif") returned 0
	[0048.105] lstrlenA (lpString="*.gif") returned 5
	[0048.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.png") returned 0
	[0048.105] lstrlenA (lpString="*.png") returned 5
	[0048.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.doc") returned 0
	[0048.105] lstrlenA (lpString="*.doc") returned 5
	[0048.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.docx") returned 0
	[0048.105] lstrlenA (lpString="*.docx") returned 6
	[0048.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.xls") returned 0
	[0048.105] lstrlenA (lpString="*.xls") returned 5
	[0048.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.xlsx") returned 0
	[0048.105] lstrlenA (lpString="*.xlsx") returned 6
	[0048.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.ppt") returned 0
	[0048.105] lstrlenA (lpString="*.ppt") returned 5
	[0048.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.pptx") returned 0
	[0048.105] lstrlenA (lpString="*.pptx") returned 6
	[0048.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.txt") returned 0
	[0048.105] lstrlenA (lpString="*.txt") returned 5
	[0048.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.pdf") returned 0
	[0048.105] lstrlenA (lpString="*.pdf") returned 5
	[0048.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.htm") returned 0
	[0048.105] lstrlenA (lpString="*.htm") returned 5
	[0048.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.html") returned 0
	[0048.105] lstrlenA (lpString="*.html") returned 6
	[0048.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.mdb") returned 0
	[0048.105] lstrlenA (lpString="*.mdb") returned 5
	[0048.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.pfx") returned 0
	[0048.105] lstrlenA (lpString="*.pfx") returned 5
	[0048.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.md") returned 0
	[0048.105] lstrlenA (lpString="*.md") returned 4
	[0048.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.lnk") returned 0
	[0048.105] lstrlenA (lpString="*.lnk") returned 5
	[0048.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.torrent") returned 0
	[0048.105] lstrlenA (lpString="*.torrent") returned 9
	[0048.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.mov") returned 0
	[0048.106] lstrlenA (lpString="*.mov") returned 5
	[0048.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.3gp") returned 0
	[0048.106] lstrlenA (lpString="*.3gp") returned 5
	[0048.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.mpeg") returned 0
	[0048.106] lstrlenA (lpString="*.mpeg") returned 6
	[0048.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.mpg") returned 0
	[0048.106] lstrlenA (lpString="*.mpg") returned 5
	[0048.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.flv") returned 0
	[0048.106] lstrlenA (lpString="*.flv") returned 5
	[0048.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.avi") returned 0
	[0048.106] lstrlenA (lpString="*.avi") returned 5
	[0048.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.mp4") returned 0
	[0048.106] lstrlenA (lpString="*.mp4") returned 5
	[0048.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.wmv") returned 0
	[0048.106] lstrlenA (lpString="*.wmv") returned 5
	[0048.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.mkv") returned 0
	[0048.106] lstrlenA (lpString="*.mkv") returned 5
	[0048.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.mp3") returned 0
	[0048.106] lstrlenA (lpString="*.mp3") returned 5
	[0048.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.wav") returned 0
	[0048.106] lstrlenA (lpString="*.wav") returned 5
	[0048.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.flac") returned 0
	[0048.106] lstrlenA (lpString="*.flac") returned 6
	[0048.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.wma") returned 0
	[0048.106] lstrlenA (lpString="*.wma") returned 5
	[0048.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.au3") returned 0
	[0048.106] lstrlenA (lpString="*.au3") returned 5
	[0048.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.ahk") returned 0
	[0048.106] lstrlenA (lpString="*.ahk") returned 5
	[0048.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.c") returned 0
	[0048.106] lstrlenA (lpString="*.c") returned 3
	[0048.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.cc") returned 0
	[0048.106] lstrlenA (lpString="*.cc") returned 4
	[0048.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.cpp") returned 0
	[0048.106] lstrlenA (lpString="*.cpp") returned 5
	[0048.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.cxx") returned 0
	[0048.106] lstrlenA (lpString="*.cxx") returned 5
	[0048.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.c++") returned 0
	[0048.107] lstrlenA (lpString="*.c++") returned 5
	[0048.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.cs") returned 0
	[0048.107] lstrlenA (lpString="*.cs") returned 4
	[0048.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.vb") returned 0
	[0048.107] lstrlenA (lpString="*.vb") returned 4
	[0048.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.bas") returned 0
	[0048.107] lstrlenA (lpString="*.bas") returned 5
	[0048.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.csproj") returned 0
	[0048.107] lstrlenA (lpString="*.csproj") returned 8
	[0048.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.vbproj") returned 0
	[0048.107] lstrlenA (lpString="*.vbproj") returned 8
	[0048.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.vcxproj") returned 0
	[0048.107] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.manifest") returned 0
	[0048.107] lstrlenA (lpString="*.manifest") returned 10
	[0048.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.php") returned 0
	[0048.107] lstrlenA (lpString="*.php") returned 5
	[0048.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.vbe") returned 0
	[0048.107] lstrlenA (lpString="*.vbe") returned 5
	[0048.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.vba") returned 0
	[0048.107] lstrlenA (lpString="*.vba") returned 5
	[0048.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.vbs") returned 0
	[0048.107] lstrlenA (lpString="*.vbs") returned 5
	[0048.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.bat") returned 0
	[0048.107] lstrlenA (lpString="*.bat") returned 5
	[0048.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.cmd") returned 0
	[0048.107] lstrlenA (lpString="*.cmd") returned 5
	[0048.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.js") returned 0
	[0048.107] lstrlenA (lpString="*.js") returned 4
	[0048.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.jscript") returned 0
	[0048.107] lstrlenA (lpString="*.jscript") returned 9
	[0048.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.hta") returned 0
	[0048.107] lstrlenA (lpString="*.hta") returned 5
	[0048.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.php7") returned 0
	[0048.107] lstrlenA (lpString="*.php7") returned 6
	[0048.108] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.db") returned 0
	[0048.108] lstrlenA (lpString="*.db") returned 4
	[0048.108] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.swf") returned 0
	[0048.108] lstrlenA (lpString="*.swf") returned 5
	[0048.108] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.eml") returned 0
	[0048.108] lstrlenA (lpString="*.eml") returned 5
	[0048.108] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.part") returned 0
	[0048.108] lstrlenA (lpString="*.part") returned 6
	[0048.108] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.nfo") returned 0
	[0048.108] lstrlenA (lpString="*.nfo") returned 5
	[0048.108] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.rsa") returned 0
	[0048.108] lstrlenA (lpString="*.rsa") returned 5
	[0048.108] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.key") returned 0
	[0048.108] lstrlenA (lpString="*.key") returned 5
	[0048.108] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.aes") returned 0
	[0048.108] lstrlenA (lpString="*.aes") returned 5
	[0048.108] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.blob") returned 0
	[0048.108] lstrlenA (lpString="*.blob") returned 6
	[0048.108] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.btc") returned 0
	[0048.108] lstrlenA (lpString="*.btc") returned 5
	[0048.108] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.wallet") returned 0
	[0048.108] lstrlenA (lpString="*.wallet") returned 8
	[0048.108] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0048.108] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.108] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SetupResources.dll") returned -1
	[0048.108] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SetupResources.dll") returned -1
	[0048.108] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1
	[0048.108] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned="LocalizedData.xml"
	[0048.108] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1033\\" | out: lpString1="C:\\588bce7c90097ed212\\1033\\") returned="C:\\588bce7c90097ed212\\1033\\"
	[0048.108] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1033\\" | out: pszPath="C:\\588bce7c90097ed212\\1033\\") returned=""
	[0048.108] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1033\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1033\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1033\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.108] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1033\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1033\\how-to-decrypt-files.htm")) returned 0x20
	[0048.108] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1033\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1033\\SetupResources.dll"
	[0048.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.zip") returned 0
	[0048.109] lstrlenA (lpString="*.zip") returned 5
	[0048.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.rar") returned 0
	[0048.109] lstrlenA (lpString="*.rar") returned 5
	[0048.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.7z") returned 0
	[0048.109] lstrlenA (lpString="*.7z") returned 4
	[0048.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.tar") returned 0
	[0048.109] lstrlenA (lpString="*.tar") returned 5
	[0048.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.gzip") returned 0
	[0048.109] lstrlenA (lpString="*.gzip") returned 6
	[0048.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.jpg") returned 0
	[0048.109] lstrlenA (lpString="*.jpg") returned 5
	[0048.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.jpeg") returned 0
	[0048.109] lstrlenA (lpString="*.jpeg") returned 6
	[0048.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.bmp") returned 0
	[0048.109] lstrlenA (lpString="*.bmp") returned 5
	[0048.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.gif") returned 0
	[0048.109] lstrlenA (lpString="*.gif") returned 5
	[0048.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.png") returned 0
	[0048.109] lstrlenA (lpString="*.png") returned 5
	[0048.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.doc") returned 0
	[0048.109] lstrlenA (lpString="*.doc") returned 5
	[0048.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.docx") returned 0
	[0048.109] lstrlenA (lpString="*.docx") returned 6
	[0048.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.xls") returned 0
	[0048.109] lstrlenA (lpString="*.xls") returned 5
	[0048.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.xlsx") returned 0
	[0048.109] lstrlenA (lpString="*.xlsx") returned 6
	[0048.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.ppt") returned 0
	[0048.109] lstrlenA (lpString="*.ppt") returned 5
	[0048.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.pptx") returned 0
	[0048.109] lstrlenA (lpString="*.pptx") returned 6
	[0048.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.txt") returned 0
	[0048.109] lstrlenA (lpString="*.txt") returned 5
	[0048.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.pdf") returned 0
	[0048.109] lstrlenA (lpString="*.pdf") returned 5
	[0048.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.htm") returned 0
	[0048.110] lstrlenA (lpString="*.htm") returned 5
	[0048.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.html") returned 0
	[0048.110] lstrlenA (lpString="*.html") returned 6
	[0048.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.mdb") returned 0
	[0048.110] lstrlenA (lpString="*.mdb") returned 5
	[0048.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.pfx") returned 0
	[0048.110] lstrlenA (lpString="*.pfx") returned 5
	[0048.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.md") returned 0
	[0048.110] lstrlenA (lpString="*.md") returned 4
	[0048.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.lnk") returned 0
	[0048.110] lstrlenA (lpString="*.lnk") returned 5
	[0048.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.torrent") returned 0
	[0048.110] lstrlenA (lpString="*.torrent") returned 9
	[0048.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.mov") returned 0
	[0048.110] lstrlenA (lpString="*.mov") returned 5
	[0048.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.3gp") returned 0
	[0048.110] lstrlenA (lpString="*.3gp") returned 5
	[0048.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.mpeg") returned 0
	[0048.110] lstrlenA (lpString="*.mpeg") returned 6
	[0048.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.mpg") returned 0
	[0048.110] lstrlenA (lpString="*.mpg") returned 5
	[0048.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.flv") returned 0
	[0048.110] lstrlenA (lpString="*.flv") returned 5
	[0048.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.avi") returned 0
	[0048.110] lstrlenA (lpString="*.avi") returned 5
	[0048.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.mp4") returned 0
	[0048.110] lstrlenA (lpString="*.mp4") returned 5
	[0048.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.wmv") returned 0
	[0048.110] lstrlenA (lpString="*.wmv") returned 5
	[0048.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.mkv") returned 0
	[0048.110] lstrlenA (lpString="*.mkv") returned 5
	[0048.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.mp3") returned 0
	[0048.110] lstrlenA (lpString="*.mp3") returned 5
	[0048.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.wav") returned 0
	[0048.110] lstrlenA (lpString="*.wav") returned 5
	[0048.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.flac") returned 0
	[0048.110] lstrlenA (lpString="*.flac") returned 6
	[0048.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.wma") returned 0
	[0048.111] lstrlenA (lpString="*.wma") returned 5
	[0048.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.au3") returned 0
	[0048.111] lstrlenA (lpString="*.au3") returned 5
	[0048.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.ahk") returned 0
	[0048.111] lstrlenA (lpString="*.ahk") returned 5
	[0048.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.c") returned 0
	[0048.111] lstrlenA (lpString="*.c") returned 3
	[0048.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.cc") returned 0
	[0048.111] lstrlenA (lpString="*.cc") returned 4
	[0048.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.cpp") returned 0
	[0048.111] lstrlenA (lpString="*.cpp") returned 5
	[0048.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.cxx") returned 0
	[0048.111] lstrlenA (lpString="*.cxx") returned 5
	[0048.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.c++") returned 0
	[0048.111] lstrlenA (lpString="*.c++") returned 5
	[0048.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.cs") returned 0
	[0048.111] lstrlenA (lpString="*.cs") returned 4
	[0048.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.vb") returned 0
	[0048.111] lstrlenA (lpString="*.vb") returned 4
	[0048.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.bas") returned 0
	[0048.111] lstrlenA (lpString="*.bas") returned 5
	[0048.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.csproj") returned 0
	[0048.111] lstrlenA (lpString="*.csproj") returned 8
	[0048.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.vbproj") returned 0
	[0048.111] lstrlenA (lpString="*.vbproj") returned 8
	[0048.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.vcxproj") returned 0
	[0048.111] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.manifest") returned 0
	[0048.111] lstrlenA (lpString="*.manifest") returned 10
	[0048.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.php") returned 0
	[0048.111] lstrlenA (lpString="*.php") returned 5
	[0048.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.vbe") returned 0
	[0048.111] lstrlenA (lpString="*.vbe") returned 5
	[0048.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.vba") returned 0
	[0048.111] lstrlenA (lpString="*.vba") returned 5
	[0048.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.vbs") returned 0
	[0048.111] lstrlenA (lpString="*.vbs") returned 5
	[0048.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.bat") returned 0
	[0048.112] lstrlenA (lpString="*.bat") returned 5
	[0048.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.cmd") returned 0
	[0048.112] lstrlenA (lpString="*.cmd") returned 5
	[0048.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.js") returned 0
	[0048.112] lstrlenA (lpString="*.js") returned 4
	[0048.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.jscript") returned 0
	[0048.112] lstrlenA (lpString="*.jscript") returned 9
	[0048.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.hta") returned 0
	[0048.112] lstrlenA (lpString="*.hta") returned 5
	[0048.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.php7") returned 0
	[0048.112] lstrlenA (lpString="*.php7") returned 6
	[0048.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.db") returned 0
	[0048.112] lstrlenA (lpString="*.db") returned 4
	[0048.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.swf") returned 0
	[0048.112] lstrlenA (lpString="*.swf") returned 5
	[0048.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.eml") returned 0
	[0048.112] lstrlenA (lpString="*.eml") returned 5
	[0048.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.part") returned 0
	[0048.112] lstrlenA (lpString="*.part") returned 6
	[0048.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.nfo") returned 0
	[0048.112] lstrlenA (lpString="*.nfo") returned 5
	[0048.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.rsa") returned 0
	[0048.112] lstrlenA (lpString="*.rsa") returned 5
	[0048.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.key") returned 0
	[0048.112] lstrlenA (lpString="*.key") returned 5
	[0048.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.aes") returned 0
	[0048.112] lstrlenA (lpString="*.aes") returned 5
	[0048.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.blob") returned 0
	[0048.112] lstrlenA (lpString="*.blob") returned 6
	[0048.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.btc") returned 0
	[0048.112] lstrlenA (lpString="*.btc") returned 5
	[0048.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.wallet") returned 0
	[0048.112] lstrlenA (lpString="*.wallet") returned 8
	[0048.112] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0048.112] FindClose (in: hFindFile=0x7cbad0 | out: hFindFile=0x7cbad0) returned 1
	[0048.113] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d1d40, dwReserved1=0x7b00c0, cFileName="1035", cAlternateFileName="")) returned 1
	[0048.113] lstrcmpA (lpString1=".", lpString2="1035") returned -1
	[0048.113] lstrcmpA (lpString1="..", lpString2="1035") returned -1
	[0048.113] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*"
	[0048.113] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1035" | out: lpString1="C:\\588bce7c90097ed212\\1035") returned="C:\\588bce7c90097ed212\\1035"
	[0048.113] lstrlenA (lpString="C:\\588bce7c90097ed212\\1035") returned 26
	[0048.113] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbbd0
	[0048.113] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0048.113] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0048.114] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0048.114] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0048.114] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0048.114] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.114] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="eula.rtf") returned -1
	[0048.114] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="eula.rtf") returned 1
	[0048.114] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1
	[0048.114] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1035\\*.*") returned="*.*"
	[0048.114] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1035\\" | out: lpString1="C:\\588bce7c90097ed212\\1035\\") returned="C:\\588bce7c90097ed212\\1035\\"
	[0048.114] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1035\\" | out: pszPath="C:\\588bce7c90097ed212\\1035\\") returned=""
	[0048.114] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1035\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1035\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1035\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.114] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1035\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1035\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0048.114] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1035\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1035\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0048.116] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0048.116] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0048.117] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0048.117] CloseHandle (hObject=0x208) returned 1
	[0048.117] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1035\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned="C:\\588bce7c90097ed212\\1035\\eula.rtf"
	[0048.118] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.zip") returned 0
	[0048.118] lstrlenA (lpString="*.zip") returned 5
	[0048.118] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.rar") returned 0
	[0048.118] lstrlenA (lpString="*.rar") returned 5
	[0048.118] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.7z") returned 0
	[0048.118] lstrlenA (lpString="*.7z") returned 4
	[0048.118] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.tar") returned 0
	[0048.118] lstrlenA (lpString="*.tar") returned 5
	[0048.118] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.gzip") returned 0
	[0048.118] lstrlenA (lpString="*.gzip") returned 6
	[0048.118] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.jpg") returned 0
	[0048.118] lstrlenA (lpString="*.jpg") returned 5
	[0048.118] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.jpeg") returned 0
	[0048.118] lstrlenA (lpString="*.jpeg") returned 6
	[0048.118] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.bmp") returned 0
	[0048.118] lstrlenA (lpString="*.bmp") returned 5
	[0048.118] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.gif") returned 0
	[0048.118] lstrlenA (lpString="*.gif") returned 5
	[0048.118] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.png") returned 0
	[0048.118] lstrlenA (lpString="*.png") returned 5
	[0048.118] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.doc") returned 0
	[0048.118] lstrlenA (lpString="*.doc") returned 5
	[0048.118] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.docx") returned 0
	[0048.118] lstrlenA (lpString="*.docx") returned 6
	[0048.118] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.xls") returned 0
	[0048.118] lstrlenA (lpString="*.xls") returned 5
	[0048.118] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.xlsx") returned 0
	[0048.118] lstrlenA (lpString="*.xlsx") returned 6
	[0048.118] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.ppt") returned 0
	[0048.118] lstrlenA (lpString="*.ppt") returned 5
	[0048.118] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.pptx") returned 0
	[0048.118] lstrlenA (lpString="*.pptx") returned 6
	[0048.118] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.txt") returned 0
	[0048.118] lstrlenA (lpString="*.txt") returned 5
	[0048.118] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.pdf") returned 0
	[0048.118] lstrlenA (lpString="*.pdf") returned 5
	[0048.118] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.htm") returned 0
	[0048.119] lstrlenA (lpString="*.htm") returned 5
	[0048.119] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.html") returned 0
	[0048.119] lstrlenA (lpString="*.html") returned 6
	[0048.119] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.mdb") returned 0
	[0048.119] lstrlenA (lpString="*.mdb") returned 5
	[0048.119] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.pfx") returned 0
	[0048.119] lstrlenA (lpString="*.pfx") returned 5
	[0048.119] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.md") returned 0
	[0048.119] lstrlenA (lpString="*.md") returned 4
	[0048.119] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.lnk") returned 0
	[0048.119] lstrlenA (lpString="*.lnk") returned 5
	[0048.119] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.torrent") returned 0
	[0048.119] lstrlenA (lpString="*.torrent") returned 9
	[0048.119] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.mov") returned 0
	[0048.119] lstrlenA (lpString="*.mov") returned 5
	[0048.119] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.3gp") returned 0
	[0048.119] lstrlenA (lpString="*.3gp") returned 5
	[0048.119] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.mpeg") returned 0
	[0048.119] lstrlenA (lpString="*.mpeg") returned 6
	[0048.119] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.mpg") returned 0
	[0048.119] lstrlenA (lpString="*.mpg") returned 5
	[0048.119] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.flv") returned 0
	[0048.119] lstrlenA (lpString="*.flv") returned 5
	[0048.119] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.avi") returned 0
	[0048.119] lstrlenA (lpString="*.avi") returned 5
	[0048.119] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.mp4") returned 0
	[0048.119] lstrlenA (lpString="*.mp4") returned 5
	[0048.119] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.wmv") returned 0
	[0048.119] lstrlenA (lpString="*.wmv") returned 5
	[0048.119] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.mkv") returned 0
	[0048.119] lstrlenA (lpString="*.mkv") returned 5
	[0048.119] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.mp3") returned 0
	[0048.119] lstrlenA (lpString="*.mp3") returned 5
	[0048.119] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.wav") returned 0
	[0048.119] lstrlenA (lpString="*.wav") returned 5
	[0048.119] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.flac") returned 0
	[0048.119] lstrlenA (lpString="*.flac") returned 6
	[0048.120] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.wma") returned 0
	[0048.120] lstrlenA (lpString="*.wma") returned 5
	[0048.120] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.au3") returned 0
	[0048.120] lstrlenA (lpString="*.au3") returned 5
	[0048.120] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.ahk") returned 0
	[0048.120] lstrlenA (lpString="*.ahk") returned 5
	[0048.120] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.c") returned 0
	[0048.120] lstrlenA (lpString="*.c") returned 3
	[0048.120] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.cc") returned 0
	[0048.120] lstrlenA (lpString="*.cc") returned 4
	[0048.120] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.cpp") returned 0
	[0048.120] lstrlenA (lpString="*.cpp") returned 5
	[0048.120] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.cxx") returned 0
	[0048.120] lstrlenA (lpString="*.cxx") returned 5
	[0048.120] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.c++") returned 0
	[0048.120] lstrlenA (lpString="*.c++") returned 5
	[0048.120] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.cs") returned 0
	[0048.120] lstrlenA (lpString="*.cs") returned 4
	[0048.120] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.vb") returned 0
	[0048.120] lstrlenA (lpString="*.vb") returned 4
	[0048.120] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.bas") returned 0
	[0048.120] lstrlenA (lpString="*.bas") returned 5
	[0048.120] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.csproj") returned 0
	[0048.120] lstrlenA (lpString="*.csproj") returned 8
	[0048.120] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.vbproj") returned 0
	[0048.120] lstrlenA (lpString="*.vbproj") returned 8
	[0048.120] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.vcxproj") returned 0
	[0048.120] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.120] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.manifest") returned 0
	[0048.120] lstrlenA (lpString="*.manifest") returned 10
	[0048.120] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.php") returned 0
	[0048.120] lstrlenA (lpString="*.php") returned 5
	[0048.120] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.vbe") returned 0
	[0048.120] lstrlenA (lpString="*.vbe") returned 5
	[0048.120] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.vba") returned 0
	[0048.120] lstrlenA (lpString="*.vba") returned 5
	[0048.120] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.vbs") returned 0
	[0048.120] lstrlenA (lpString="*.vbs") returned 5
	[0048.121] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.bat") returned 0
	[0048.121] lstrlenA (lpString="*.bat") returned 5
	[0048.121] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.cmd") returned 0
	[0048.121] lstrlenA (lpString="*.cmd") returned 5
	[0048.121] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.js") returned 0
	[0048.121] lstrlenA (lpString="*.js") returned 4
	[0048.121] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.jscript") returned 0
	[0048.121] lstrlenA (lpString="*.jscript") returned 9
	[0048.121] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.hta") returned 0
	[0048.121] lstrlenA (lpString="*.hta") returned 5
	[0048.121] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.php7") returned 0
	[0048.121] lstrlenA (lpString="*.php7") returned 6
	[0048.121] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.db") returned 0
	[0048.121] lstrlenA (lpString="*.db") returned 4
	[0048.121] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.swf") returned 0
	[0048.121] lstrlenA (lpString="*.swf") returned 5
	[0048.121] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.eml") returned 0
	[0048.121] lstrlenA (lpString="*.eml") returned 5
	[0048.121] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.part") returned 0
	[0048.121] lstrlenA (lpString="*.part") returned 6
	[0048.121] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.nfo") returned 0
	[0048.121] lstrlenA (lpString="*.nfo") returned 5
	[0048.121] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.rsa") returned 0
	[0048.121] lstrlenA (lpString="*.rsa") returned 5
	[0048.121] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.key") returned 0
	[0048.121] lstrlenA (lpString="*.key") returned 5
	[0048.121] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.aes") returned 0
	[0048.121] lstrlenA (lpString="*.aes") returned 5
	[0048.121] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.blob") returned 0
	[0048.121] lstrlenA (lpString="*.blob") returned 6
	[0048.121] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.btc") returned 0
	[0048.121] lstrlenA (lpString="*.btc") returned 5
	[0048.121] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.wallet") returned 0
	[0048.121] lstrlenA (lpString="*.wallet") returned 8
	[0048.121] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0048.121] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.121] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="LocalizedData.xml") returned -1
	[0048.122] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="LocalizedData.xml") returned -1
	[0048.122] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1
	[0048.122] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned="eula.rtf"
	[0048.122] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1035\\" | out: lpString1="C:\\588bce7c90097ed212\\1035\\") returned="C:\\588bce7c90097ed212\\1035\\"
	[0048.122] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1035\\" | out: pszPath="C:\\588bce7c90097ed212\\1035\\") returned=""
	[0048.122] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1035\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1035\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1035\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.122] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1035\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1035\\how-to-decrypt-files.htm")) returned 0x20
	[0048.122] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1035\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml"
	[0048.122] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.zip") returned 0
	[0048.122] lstrlenA (lpString="*.zip") returned 5
	[0048.122] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.rar") returned 0
	[0048.122] lstrlenA (lpString="*.rar") returned 5
	[0048.122] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.7z") returned 0
	[0048.122] lstrlenA (lpString="*.7z") returned 4
	[0048.122] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.tar") returned 0
	[0048.122] lstrlenA (lpString="*.tar") returned 5
	[0048.122] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.gzip") returned 0
	[0048.122] lstrlenA (lpString="*.gzip") returned 6
	[0048.122] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.jpg") returned 0
	[0048.122] lstrlenA (lpString="*.jpg") returned 5
	[0048.122] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.jpeg") returned 0
	[0048.122] lstrlenA (lpString="*.jpeg") returned 6
	[0048.122] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.bmp") returned 0
	[0048.122] lstrlenA (lpString="*.bmp") returned 5
	[0048.122] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.gif") returned 0
	[0048.122] lstrlenA (lpString="*.gif") returned 5
	[0048.122] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.png") returned 0
	[0048.122] lstrlenA (lpString="*.png") returned 5
	[0048.122] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.doc") returned 0
	[0048.122] lstrlenA (lpString="*.doc") returned 5
	[0048.122] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.docx") returned 0
	[0048.122] lstrlenA (lpString="*.docx") returned 6
	[0048.122] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.xls") returned 0
	[0048.123] lstrlenA (lpString="*.xls") returned 5
	[0048.123] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.xlsx") returned 0
	[0048.123] lstrlenA (lpString="*.xlsx") returned 6
	[0048.123] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.ppt") returned 0
	[0048.123] lstrlenA (lpString="*.ppt") returned 5
	[0048.123] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.pptx") returned 0
	[0048.123] lstrlenA (lpString="*.pptx") returned 6
	[0048.123] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.txt") returned 0
	[0048.123] lstrlenA (lpString="*.txt") returned 5
	[0048.123] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.pdf") returned 0
	[0048.123] lstrlenA (lpString="*.pdf") returned 5
	[0048.123] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.htm") returned 0
	[0048.123] lstrlenA (lpString="*.htm") returned 5
	[0048.123] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.html") returned 0
	[0048.123] lstrlenA (lpString="*.html") returned 6
	[0048.123] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.mdb") returned 0
	[0048.123] lstrlenA (lpString="*.mdb") returned 5
	[0048.123] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.pfx") returned 0
	[0048.123] lstrlenA (lpString="*.pfx") returned 5
	[0048.123] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.md") returned 0
	[0048.123] lstrlenA (lpString="*.md") returned 4
	[0048.123] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.lnk") returned 0
	[0048.123] lstrlenA (lpString="*.lnk") returned 5
	[0048.123] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.torrent") returned 0
	[0048.123] lstrlenA (lpString="*.torrent") returned 9
	[0048.123] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.mov") returned 0
	[0048.123] lstrlenA (lpString="*.mov") returned 5
	[0048.123] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.3gp") returned 0
	[0048.123] lstrlenA (lpString="*.3gp") returned 5
	[0048.123] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.mpeg") returned 0
	[0048.123] lstrlenA (lpString="*.mpeg") returned 6
	[0048.123] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.mpg") returned 0
	[0048.123] lstrlenA (lpString="*.mpg") returned 5
	[0048.123] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.flv") returned 0
	[0048.123] lstrlenA (lpString="*.flv") returned 5
	[0048.123] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.avi") returned 0
	[0048.123] lstrlenA (lpString="*.avi") returned 5
	[0048.123] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.mp4") returned 0
	[0048.124] lstrlenA (lpString="*.mp4") returned 5
	[0048.124] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.wmv") returned 0
	[0048.124] lstrlenA (lpString="*.wmv") returned 5
	[0048.124] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.mkv") returned 0
	[0048.124] lstrlenA (lpString="*.mkv") returned 5
	[0048.124] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.mp3") returned 0
	[0048.124] lstrlenA (lpString="*.mp3") returned 5
	[0048.124] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.wav") returned 0
	[0048.124] lstrlenA (lpString="*.wav") returned 5
	[0048.124] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.flac") returned 0
	[0048.124] lstrlenA (lpString="*.flac") returned 6
	[0048.124] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.wma") returned 0
	[0048.124] lstrlenA (lpString="*.wma") returned 5
	[0048.124] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.au3") returned 0
	[0048.124] lstrlenA (lpString="*.au3") returned 5
	[0048.124] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.ahk") returned 0
	[0048.124] lstrlenA (lpString="*.ahk") returned 5
	[0048.124] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.c") returned 0
	[0048.124] lstrlenA (lpString="*.c") returned 3
	[0048.124] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.cc") returned 0
	[0048.124] lstrlenA (lpString="*.cc") returned 4
	[0048.124] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.cpp") returned 0
	[0048.124] lstrlenA (lpString="*.cpp") returned 5
	[0048.124] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.cxx") returned 0
	[0048.124] lstrlenA (lpString="*.cxx") returned 5
	[0048.124] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.c++") returned 0
	[0048.124] lstrlenA (lpString="*.c++") returned 5
	[0048.124] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.cs") returned 0
	[0048.124] lstrlenA (lpString="*.cs") returned 4
	[0048.124] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.vb") returned 0
	[0048.124] lstrlenA (lpString="*.vb") returned 4
	[0048.124] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.bas") returned 0
	[0048.124] lstrlenA (lpString="*.bas") returned 5
	[0048.124] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.csproj") returned 0
	[0048.124] lstrlenA (lpString="*.csproj") returned 8
	[0048.124] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.vbproj") returned 0
	[0048.125] lstrlenA (lpString="*.vbproj") returned 8
	[0048.125] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.vcxproj") returned 0
	[0048.125] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.125] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.manifest") returned 0
	[0048.125] lstrlenA (lpString="*.manifest") returned 10
	[0048.125] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.php") returned 0
	[0048.125] lstrlenA (lpString="*.php") returned 5
	[0048.125] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.vbe") returned 0
	[0048.125] lstrlenA (lpString="*.vbe") returned 5
	[0048.125] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.vba") returned 0
	[0048.125] lstrlenA (lpString="*.vba") returned 5
	[0048.125] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.vbs") returned 0
	[0048.125] lstrlenA (lpString="*.vbs") returned 5
	[0048.125] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.bat") returned 0
	[0048.125] lstrlenA (lpString="*.bat") returned 5
	[0048.125] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.cmd") returned 0
	[0048.125] lstrlenA (lpString="*.cmd") returned 5
	[0048.125] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.js") returned 0
	[0048.125] lstrlenA (lpString="*.js") returned 4
	[0048.125] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.jscript") returned 0
	[0048.125] lstrlenA (lpString="*.jscript") returned 9
	[0048.125] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.hta") returned 0
	[0048.125] lstrlenA (lpString="*.hta") returned 5
	[0048.125] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.php7") returned 0
	[0048.125] lstrlenA (lpString="*.php7") returned 6
	[0048.125] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.db") returned 0
	[0048.125] lstrlenA (lpString="*.db") returned 4
	[0048.125] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.swf") returned 0
	[0048.125] lstrlenA (lpString="*.swf") returned 5
	[0048.125] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.eml") returned 0
	[0048.125] lstrlenA (lpString="*.eml") returned 5
	[0048.125] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.part") returned 0
	[0048.125] lstrlenA (lpString="*.part") returned 6
	[0048.125] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.nfo") returned 0
	[0048.126] lstrlenA (lpString="*.nfo") returned 5
	[0048.126] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.rsa") returned 0
	[0048.126] lstrlenA (lpString="*.rsa") returned 5
	[0048.126] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.key") returned 0
	[0048.126] lstrlenA (lpString="*.key") returned 5
	[0048.126] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.aes") returned 0
	[0048.126] lstrlenA (lpString="*.aes") returned 5
	[0048.126] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.blob") returned 0
	[0048.126] lstrlenA (lpString="*.blob") returned 6
	[0048.126] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.btc") returned 0
	[0048.126] lstrlenA (lpString="*.btc") returned 5
	[0048.126] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.wallet") returned 0
	[0048.126] lstrlenA (lpString="*.wallet") returned 8
	[0048.126] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0048.126] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.126] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SetupResources.dll") returned -1
	[0048.126] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SetupResources.dll") returned -1
	[0048.126] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1
	[0048.126] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned="LocalizedData.xml"
	[0048.126] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1035\\" | out: lpString1="C:\\588bce7c90097ed212\\1035\\") returned="C:\\588bce7c90097ed212\\1035\\"
	[0048.126] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1035\\" | out: pszPath="C:\\588bce7c90097ed212\\1035\\") returned=""
	[0048.126] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1035\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1035\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1035\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.126] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1035\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1035\\how-to-decrypt-files.htm")) returned 0x20
	[0048.126] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1035\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1035\\SetupResources.dll"
	[0048.126] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.zip") returned 0
	[0048.126] lstrlenA (lpString="*.zip") returned 5
	[0048.126] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.rar") returned 0
	[0048.126] lstrlenA (lpString="*.rar") returned 5
	[0048.126] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.7z") returned 0
	[0048.126] lstrlenA (lpString="*.7z") returned 4
	[0048.126] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.tar") returned 0
	[0048.126] lstrlenA (lpString="*.tar") returned 5
	[0048.126] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.gzip") returned 0
	[0048.126] lstrlenA (lpString="*.gzip") returned 6
	[0048.127] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.jpg") returned 0
	[0048.127] lstrlenA (lpString="*.jpg") returned 5
	[0048.127] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.jpeg") returned 0
	[0048.127] lstrlenA (lpString="*.jpeg") returned 6
	[0048.127] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.bmp") returned 0
	[0048.127] lstrlenA (lpString="*.bmp") returned 5
	[0048.127] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.gif") returned 0
	[0048.127] lstrlenA (lpString="*.gif") returned 5
	[0048.127] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.png") returned 0
	[0048.127] lstrlenA (lpString="*.png") returned 5
	[0048.127] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.doc") returned 0
	[0048.127] lstrlenA (lpString="*.doc") returned 5
	[0048.127] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.docx") returned 0
	[0048.127] lstrlenA (lpString="*.docx") returned 6
	[0048.127] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.xls") returned 0
	[0048.127] lstrlenA (lpString="*.xls") returned 5
	[0048.127] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.xlsx") returned 0
	[0048.127] lstrlenA (lpString="*.xlsx") returned 6
	[0048.127] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.ppt") returned 0
	[0048.127] lstrlenA (lpString="*.ppt") returned 5
	[0048.127] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.pptx") returned 0
	[0048.127] lstrlenA (lpString="*.pptx") returned 6
	[0048.127] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.txt") returned 0
	[0048.127] lstrlenA (lpString="*.txt") returned 5
	[0048.127] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.pdf") returned 0
	[0048.127] lstrlenA (lpString="*.pdf") returned 5
	[0048.127] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.htm") returned 0
	[0048.127] lstrlenA (lpString="*.htm") returned 5
	[0048.127] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.html") returned 0
	[0048.127] lstrlenA (lpString="*.html") returned 6
	[0048.127] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.mdb") returned 0
	[0048.127] lstrlenA (lpString="*.mdb") returned 5
	[0048.127] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.pfx") returned 0
	[0048.127] lstrlenA (lpString="*.pfx") returned 5
	[0048.127] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.md") returned 0
	[0048.127] lstrlenA (lpString="*.md") returned 4
	[0048.127] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.lnk") returned 0
	[0048.128] lstrlenA (lpString="*.lnk") returned 5
	[0048.128] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.torrent") returned 0
	[0048.128] lstrlenA (lpString="*.torrent") returned 9
	[0048.128] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.mov") returned 0
	[0048.128] lstrlenA (lpString="*.mov") returned 5
	[0048.128] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.3gp") returned 0
	[0048.128] lstrlenA (lpString="*.3gp") returned 5
	[0048.128] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.mpeg") returned 0
	[0048.128] lstrlenA (lpString="*.mpeg") returned 6
	[0048.128] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.mpg") returned 0
	[0048.128] lstrlenA (lpString="*.mpg") returned 5
	[0048.128] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.flv") returned 0
	[0048.128] lstrlenA (lpString="*.flv") returned 5
	[0048.128] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.avi") returned 0
	[0048.128] lstrlenA (lpString="*.avi") returned 5
	[0048.128] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.mp4") returned 0
	[0048.128] lstrlenA (lpString="*.mp4") returned 5
	[0048.128] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.wmv") returned 0
	[0048.128] lstrlenA (lpString="*.wmv") returned 5
	[0048.128] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.mkv") returned 0
	[0048.128] lstrlenA (lpString="*.mkv") returned 5
	[0048.128] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.mp3") returned 0
	[0048.128] lstrlenA (lpString="*.mp3") returned 5
	[0048.128] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.wav") returned 0
	[0048.128] lstrlenA (lpString="*.wav") returned 5
	[0048.128] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.flac") returned 0
	[0048.128] lstrlenA (lpString="*.flac") returned 6
	[0048.128] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.wma") returned 0
	[0048.128] lstrlenA (lpString="*.wma") returned 5
	[0048.128] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.au3") returned 0
	[0048.128] lstrlenA (lpString="*.au3") returned 5
	[0048.128] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.ahk") returned 0
	[0048.128] lstrlenA (lpString="*.ahk") returned 5
	[0048.128] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.c") returned 0
	[0048.128] lstrlenA (lpString="*.c") returned 3
	[0048.128] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.cc") returned 0
	[0048.129] lstrlenA (lpString="*.cc") returned 4
	[0048.129] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.cpp") returned 0
	[0048.129] lstrlenA (lpString="*.cpp") returned 5
	[0048.129] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.cxx") returned 0
	[0048.129] lstrlenA (lpString="*.cxx") returned 5
	[0048.129] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.c++") returned 0
	[0048.129] lstrlenA (lpString="*.c++") returned 5
	[0048.129] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.cs") returned 0
	[0048.129] lstrlenA (lpString="*.cs") returned 4
	[0048.129] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.vb") returned 0
	[0048.129] lstrlenA (lpString="*.vb") returned 4
	[0048.129] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.bas") returned 0
	[0048.129] lstrlenA (lpString="*.bas") returned 5
	[0048.129] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.csproj") returned 0
	[0048.129] lstrlenA (lpString="*.csproj") returned 8
	[0048.129] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.vbproj") returned 0
	[0048.129] lstrlenA (lpString="*.vbproj") returned 8
	[0048.129] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.vcxproj") returned 0
	[0048.129] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.129] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.manifest") returned 0
	[0048.129] lstrlenA (lpString="*.manifest") returned 10
	[0048.129] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.php") returned 0
	[0048.129] lstrlenA (lpString="*.php") returned 5
	[0048.129] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.vbe") returned 0
	[0048.129] lstrlenA (lpString="*.vbe") returned 5
	[0048.129] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.vba") returned 0
	[0048.129] lstrlenA (lpString="*.vba") returned 5
	[0048.129] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.vbs") returned 0
	[0048.129] lstrlenA (lpString="*.vbs") returned 5
	[0048.129] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.bat") returned 0
	[0048.129] lstrlenA (lpString="*.bat") returned 5
	[0048.129] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.cmd") returned 0
	[0048.129] lstrlenA (lpString="*.cmd") returned 5
	[0048.129] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.js") returned 0
	[0048.129] lstrlenA (lpString="*.js") returned 4
	[0048.129] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.jscript") returned 0
	[0048.129] lstrlenA (lpString="*.jscript") returned 9
	[0048.130] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.hta") returned 0
	[0048.130] lstrlenA (lpString="*.hta") returned 5
	[0048.130] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.php7") returned 0
	[0048.130] lstrlenA (lpString="*.php7") returned 6
	[0048.130] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.db") returned 0
	[0048.130] lstrlenA (lpString="*.db") returned 4
	[0048.130] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.swf") returned 0
	[0048.130] lstrlenA (lpString="*.swf") returned 5
	[0048.130] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.eml") returned 0
	[0048.130] lstrlenA (lpString="*.eml") returned 5
	[0048.130] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.part") returned 0
	[0048.130] lstrlenA (lpString="*.part") returned 6
	[0048.130] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.nfo") returned 0
	[0048.130] lstrlenA (lpString="*.nfo") returned 5
	[0048.130] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.rsa") returned 0
	[0048.130] lstrlenA (lpString="*.rsa") returned 5
	[0048.130] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.key") returned 0
	[0048.130] lstrlenA (lpString="*.key") returned 5
	[0048.130] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.aes") returned 0
	[0048.130] lstrlenA (lpString="*.aes") returned 5
	[0048.130] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.blob") returned 0
	[0048.130] lstrlenA (lpString="*.blob") returned 6
	[0048.130] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.btc") returned 0
	[0048.130] lstrlenA (lpString="*.btc") returned 5
	[0048.130] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.wallet") returned 0
	[0048.130] lstrlenA (lpString="*.wallet") returned 8
	[0048.130] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0048.130] FindClose (in: hFindFile=0x7cbbd0 | out: hFindFile=0x7cbbd0) returned 1
	[0048.130] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d1d40, dwReserved1=0x7b00c0, cFileName="1036", cAlternateFileName="")) returned 1
	[0048.130] lstrcmpA (lpString1=".", lpString2="1036") returned -1
	[0048.130] lstrcmpA (lpString1="..", lpString2="1036") returned -1
	[0048.130] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*"
	[0048.236] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1036" | out: lpString1="C:\\588bce7c90097ed212\\1036") returned="C:\\588bce7c90097ed212\\1036"
	[0048.236] lstrlenA (lpString="C:\\588bce7c90097ed212\\1036") returned 26
	[0048.236] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbad0
	[0048.237] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0048.237] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0048.237] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0048.237] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0048.237] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0048.237] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.237] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="eula.rtf") returned -1
	[0048.237] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="eula.rtf") returned 1
	[0048.237] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1
	[0048.237] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1036\\*.*") returned="*.*"
	[0048.237] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1036\\" | out: lpString1="C:\\588bce7c90097ed212\\1036\\") returned="C:\\588bce7c90097ed212\\1036\\"
	[0048.237] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1036\\" | out: pszPath="C:\\588bce7c90097ed212\\1036\\") returned=""
	[0048.237] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1036\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1036\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1036\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.237] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1036\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1036\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0048.237] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1036\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1036\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0048.239] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0048.239] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0048.240] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0048.240] CloseHandle (hObject=0x208) returned 1
	[0048.240] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1036\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned="C:\\588bce7c90097ed212\\1036\\eula.rtf"
	[0048.240] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.zip") returned 0
	[0048.240] lstrlenA (lpString="*.zip") returned 5
	[0048.240] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.rar") returned 0
	[0048.240] lstrlenA (lpString="*.rar") returned 5
	[0048.240] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.7z") returned 0
	[0048.240] lstrlenA (lpString="*.7z") returned 4
	[0048.240] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.tar") returned 0
	[0048.240] lstrlenA (lpString="*.tar") returned 5
	[0048.240] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.gzip") returned 0
	[0048.240] lstrlenA (lpString="*.gzip") returned 6
	[0048.240] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.jpg") returned 0
	[0048.241] lstrlenA (lpString="*.jpg") returned 5
	[0048.241] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.jpeg") returned 0
	[0048.241] lstrlenA (lpString="*.jpeg") returned 6
	[0048.241] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.bmp") returned 0
	[0048.241] lstrlenA (lpString="*.bmp") returned 5
	[0048.241] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.gif") returned 0
	[0048.241] lstrlenA (lpString="*.gif") returned 5
	[0048.241] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.png") returned 0
	[0048.241] lstrlenA (lpString="*.png") returned 5
	[0048.241] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.doc") returned 0
	[0048.241] lstrlenA (lpString="*.doc") returned 5
	[0048.241] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.docx") returned 0
	[0048.241] lstrlenA (lpString="*.docx") returned 6
	[0048.241] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.xls") returned 0
	[0048.241] lstrlenA (lpString="*.xls") returned 5
	[0048.241] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.xlsx") returned 0
	[0048.241] lstrlenA (lpString="*.xlsx") returned 6
	[0048.241] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.ppt") returned 0
	[0048.241] lstrlenA (lpString="*.ppt") returned 5
	[0048.241] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.pptx") returned 0
	[0048.241] lstrlenA (lpString="*.pptx") returned 6
	[0048.241] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.txt") returned 0
	[0048.241] lstrlenA (lpString="*.txt") returned 5
	[0048.241] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.pdf") returned 0
	[0048.241] lstrlenA (lpString="*.pdf") returned 5
	[0048.241] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.htm") returned 0
	[0048.241] lstrlenA (lpString="*.htm") returned 5
	[0048.241] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.html") returned 0
	[0048.241] lstrlenA (lpString="*.html") returned 6
	[0048.241] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.mdb") returned 0
	[0048.241] lstrlenA (lpString="*.mdb") returned 5
	[0048.241] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.pfx") returned 0
	[0048.241] lstrlenA (lpString="*.pfx") returned 5
	[0048.241] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.md") returned 0
	[0048.241] lstrlenA (lpString="*.md") returned 4
	[0048.241] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.lnk") returned 0
	[0048.241] lstrlenA (lpString="*.lnk") returned 5
	[0048.242] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.torrent") returned 0
	[0048.242] lstrlenA (lpString="*.torrent") returned 9
	[0048.242] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.mov") returned 0
	[0048.242] lstrlenA (lpString="*.mov") returned 5
	[0048.242] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.3gp") returned 0
	[0048.242] lstrlenA (lpString="*.3gp") returned 5
	[0048.242] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.mpeg") returned 0
	[0048.242] lstrlenA (lpString="*.mpeg") returned 6
	[0048.242] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.mpg") returned 0
	[0048.242] lstrlenA (lpString="*.mpg") returned 5
	[0048.242] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.flv") returned 0
	[0048.242] lstrlenA (lpString="*.flv") returned 5
	[0048.242] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.avi") returned 0
	[0048.242] lstrlenA (lpString="*.avi") returned 5
	[0048.242] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.mp4") returned 0
	[0048.242] lstrlenA (lpString="*.mp4") returned 5
	[0048.242] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.wmv") returned 0
	[0048.242] lstrlenA (lpString="*.wmv") returned 5
	[0048.242] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.mkv") returned 0
	[0048.242] lstrlenA (lpString="*.mkv") returned 5
	[0048.242] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.mp3") returned 0
	[0048.242] lstrlenA (lpString="*.mp3") returned 5
	[0048.242] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.wav") returned 0
	[0048.242] lstrlenA (lpString="*.wav") returned 5
	[0048.242] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.flac") returned 0
	[0048.242] lstrlenA (lpString="*.flac") returned 6
	[0048.242] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.wma") returned 0
	[0048.242] lstrlenA (lpString="*.wma") returned 5
	[0048.242] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.au3") returned 0
	[0048.242] lstrlenA (lpString="*.au3") returned 5
	[0048.242] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.ahk") returned 0
	[0048.242] lstrlenA (lpString="*.ahk") returned 5
	[0048.242] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.c") returned 0
	[0048.242] lstrlenA (lpString="*.c") returned 3
	[0048.242] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.cc") returned 0
	[0048.242] lstrlenA (lpString="*.cc") returned 4
	[0048.242] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.cpp") returned 0
	[0048.243] lstrlenA (lpString="*.cpp") returned 5
	[0048.245] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.cxx") returned 0
	[0048.245] lstrlenA (lpString="*.cxx") returned 5
	[0048.245] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.c++") returned 0
	[0048.245] lstrlenA (lpString="*.c++") returned 5
	[0048.245] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.cs") returned 0
	[0048.245] lstrlenA (lpString="*.cs") returned 4
	[0048.245] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.vb") returned 0
	[0048.245] lstrlenA (lpString="*.vb") returned 4
	[0048.245] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.bas") returned 0
	[0048.245] lstrlenA (lpString="*.bas") returned 5
	[0048.245] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.csproj") returned 0
	[0048.245] lstrlenA (lpString="*.csproj") returned 8
	[0048.245] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.vbproj") returned 0
	[0048.245] lstrlenA (lpString="*.vbproj") returned 8
	[0048.245] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.vcxproj") returned 0
	[0048.245] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.245] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.manifest") returned 0
	[0048.245] lstrlenA (lpString="*.manifest") returned 10
	[0048.245] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.php") returned 0
	[0048.245] lstrlenA (lpString="*.php") returned 5
	[0048.245] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.vbe") returned 0
	[0048.245] lstrlenA (lpString="*.vbe") returned 5
	[0048.245] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.vba") returned 0
	[0048.245] lstrlenA (lpString="*.vba") returned 5
	[0048.245] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.vbs") returned 0
	[0048.245] lstrlenA (lpString="*.vbs") returned 5
	[0048.245] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.bat") returned 0
	[0048.245] lstrlenA (lpString="*.bat") returned 5
	[0048.245] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.cmd") returned 0
	[0048.245] lstrlenA (lpString="*.cmd") returned 5
	[0048.245] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.js") returned 0
	[0048.245] lstrlenA (lpString="*.js") returned 4
	[0048.245] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.jscript") returned 0
	[0048.245] lstrlenA (lpString="*.jscript") returned 9
	[0048.246] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.hta") returned 0
	[0048.246] lstrlenA (lpString="*.hta") returned 5
	[0048.246] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.php7") returned 0
	[0048.246] lstrlenA (lpString="*.php7") returned 6
	[0048.246] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.db") returned 0
	[0048.246] lstrlenA (lpString="*.db") returned 4
	[0048.246] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.swf") returned 0
	[0048.246] lstrlenA (lpString="*.swf") returned 5
	[0048.246] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.eml") returned 0
	[0048.246] lstrlenA (lpString="*.eml") returned 5
	[0048.246] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.part") returned 0
	[0048.246] lstrlenA (lpString="*.part") returned 6
	[0048.246] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.nfo") returned 0
	[0048.246] lstrlenA (lpString="*.nfo") returned 5
	[0048.246] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.rsa") returned 0
	[0048.246] lstrlenA (lpString="*.rsa") returned 5
	[0048.246] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.key") returned 0
	[0048.246] lstrlenA (lpString="*.key") returned 5
	[0048.246] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.aes") returned 0
	[0048.246] lstrlenA (lpString="*.aes") returned 5
	[0048.246] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.blob") returned 0
	[0048.246] lstrlenA (lpString="*.blob") returned 6
	[0048.246] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.btc") returned 0
	[0048.246] lstrlenA (lpString="*.btc") returned 5
	[0048.246] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.wallet") returned 0
	[0048.246] lstrlenA (lpString="*.wallet") returned 8
	[0048.246] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0048.246] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.246] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="LocalizedData.xml") returned -1
	[0048.246] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="LocalizedData.xml") returned -1
	[0048.246] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1
	[0048.246] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned="eula.rtf"
	[0048.246] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1036\\" | out: lpString1="C:\\588bce7c90097ed212\\1036\\") returned="C:\\588bce7c90097ed212\\1036\\"
	[0048.246] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1036\\" | out: pszPath="C:\\588bce7c90097ed212\\1036\\") returned=""
	[0048.247] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1036\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1036\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1036\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.247] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1036\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1036\\how-to-decrypt-files.htm")) returned 0x20
	[0048.247] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1036\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml"
	[0048.247] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.zip") returned 0
	[0048.247] lstrlenA (lpString="*.zip") returned 5
	[0048.247] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.rar") returned 0
	[0048.247] lstrlenA (lpString="*.rar") returned 5
	[0048.247] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.7z") returned 0
	[0048.247] lstrlenA (lpString="*.7z") returned 4
	[0048.247] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.tar") returned 0
	[0048.247] lstrlenA (lpString="*.tar") returned 5
	[0048.247] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.gzip") returned 0
	[0048.247] lstrlenA (lpString="*.gzip") returned 6
	[0048.247] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.jpg") returned 0
	[0048.247] lstrlenA (lpString="*.jpg") returned 5
	[0048.247] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.jpeg") returned 0
	[0048.247] lstrlenA (lpString="*.jpeg") returned 6
	[0048.247] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.bmp") returned 0
	[0048.247] lstrlenA (lpString="*.bmp") returned 5
	[0048.247] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.gif") returned 0
	[0048.247] lstrlenA (lpString="*.gif") returned 5
	[0048.247] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.png") returned 0
	[0048.247] lstrlenA (lpString="*.png") returned 5
	[0048.247] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.doc") returned 0
	[0048.247] lstrlenA (lpString="*.doc") returned 5
	[0048.247] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.docx") returned 0
	[0048.247] lstrlenA (lpString="*.docx") returned 6
	[0048.247] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.xls") returned 0
	[0048.247] lstrlenA (lpString="*.xls") returned 5
	[0048.247] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.xlsx") returned 0
	[0048.247] lstrlenA (lpString="*.xlsx") returned 6
	[0048.247] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.ppt") returned 0
	[0048.247] lstrlenA (lpString="*.ppt") returned 5
	[0048.248] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.pptx") returned 0
	[0048.248] lstrlenA (lpString="*.pptx") returned 6
	[0048.248] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.txt") returned 0
	[0048.248] lstrlenA (lpString="*.txt") returned 5
	[0048.248] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.pdf") returned 0
	[0048.248] lstrlenA (lpString="*.pdf") returned 5
	[0048.248] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.htm") returned 0
	[0048.248] lstrlenA (lpString="*.htm") returned 5
	[0048.248] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.html") returned 0
	[0048.248] lstrlenA (lpString="*.html") returned 6
	[0048.248] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.mdb") returned 0
	[0048.248] lstrlenA (lpString="*.mdb") returned 5
	[0048.248] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.pfx") returned 0
	[0048.248] lstrlenA (lpString="*.pfx") returned 5
	[0048.248] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.md") returned 0
	[0048.248] lstrlenA (lpString="*.md") returned 4
	[0048.248] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.lnk") returned 0
	[0048.248] lstrlenA (lpString="*.lnk") returned 5
	[0048.248] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.torrent") returned 0
	[0048.248] lstrlenA (lpString="*.torrent") returned 9
	[0048.248] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.mov") returned 0
	[0048.248] lstrlenA (lpString="*.mov") returned 5
	[0048.248] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.3gp") returned 0
	[0048.248] lstrlenA (lpString="*.3gp") returned 5
	[0048.248] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.mpeg") returned 0
	[0048.248] lstrlenA (lpString="*.mpeg") returned 6
	[0048.248] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.mpg") returned 0
	[0048.248] lstrlenA (lpString="*.mpg") returned 5
	[0048.248] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.flv") returned 0
	[0048.248] lstrlenA (lpString="*.flv") returned 5
	[0048.248] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.avi") returned 0
	[0048.248] lstrlenA (lpString="*.avi") returned 5
	[0048.248] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.mp4") returned 0
	[0048.248] lstrlenA (lpString="*.mp4") returned 5
	[0048.248] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.wmv") returned 0
	[0048.248] lstrlenA (lpString="*.wmv") returned 5
	[0048.248] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.mkv") returned 0
	[0048.248] lstrlenA (lpString="*.mkv") returned 5
	[0048.249] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.mp3") returned 0
	[0048.249] lstrlenA (lpString="*.mp3") returned 5
	[0048.249] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.wav") returned 0
	[0048.249] lstrlenA (lpString="*.wav") returned 5
	[0048.249] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.flac") returned 0
	[0048.249] lstrlenA (lpString="*.flac") returned 6
	[0048.249] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.wma") returned 0
	[0048.249] lstrlenA (lpString="*.wma") returned 5
	[0048.249] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.au3") returned 0
	[0048.249] lstrlenA (lpString="*.au3") returned 5
	[0048.249] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.ahk") returned 0
	[0048.249] lstrlenA (lpString="*.ahk") returned 5
	[0048.249] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.c") returned 0
	[0048.249] lstrlenA (lpString="*.c") returned 3
	[0048.249] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.cc") returned 0
	[0048.249] lstrlenA (lpString="*.cc") returned 4
	[0048.249] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.cpp") returned 0
	[0048.249] lstrlenA (lpString="*.cpp") returned 5
	[0048.249] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.cxx") returned 0
	[0048.249] lstrlenA (lpString="*.cxx") returned 5
	[0048.249] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.c++") returned 0
	[0048.249] lstrlenA (lpString="*.c++") returned 5
	[0048.249] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.cs") returned 0
	[0048.249] lstrlenA (lpString="*.cs") returned 4
	[0048.249] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.vb") returned 0
	[0048.249] lstrlenA (lpString="*.vb") returned 4
	[0048.249] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.bas") returned 0
	[0048.249] lstrlenA (lpString="*.bas") returned 5
	[0048.249] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.csproj") returned 0
	[0048.249] lstrlenA (lpString="*.csproj") returned 8
	[0048.249] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.vbproj") returned 0
	[0048.249] lstrlenA (lpString="*.vbproj") returned 8
	[0048.249] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.vcxproj") returned 0
	[0048.249] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.249] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.manifest") returned 0
	[0048.249] lstrlenA (lpString="*.manifest") returned 10
	[0048.249] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.php") returned 0
	[0048.249] lstrlenA (lpString="*.php") returned 5
	[0048.250] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.vbe") returned 0
	[0048.250] lstrlenA (lpString="*.vbe") returned 5
	[0048.250] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.vba") returned 0
	[0048.250] lstrlenA (lpString="*.vba") returned 5
	[0048.250] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.vbs") returned 0
	[0048.250] lstrlenA (lpString="*.vbs") returned 5
	[0048.250] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.bat") returned 0
	[0048.250] lstrlenA (lpString="*.bat") returned 5
	[0048.250] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.cmd") returned 0
	[0048.250] lstrlenA (lpString="*.cmd") returned 5
	[0048.250] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.js") returned 0
	[0048.250] lstrlenA (lpString="*.js") returned 4
	[0048.250] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.jscript") returned 0
	[0048.250] lstrlenA (lpString="*.jscript") returned 9
	[0048.250] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.hta") returned 0
	[0048.250] lstrlenA (lpString="*.hta") returned 5
	[0048.250] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.php7") returned 0
	[0048.250] lstrlenA (lpString="*.php7") returned 6
	[0048.250] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.db") returned 0
	[0048.250] lstrlenA (lpString="*.db") returned 4
	[0048.250] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.swf") returned 0
	[0048.250] lstrlenA (lpString="*.swf") returned 5
	[0048.250] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.eml") returned 0
	[0048.250] lstrlenA (lpString="*.eml") returned 5
	[0048.250] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.part") returned 0
	[0048.250] lstrlenA (lpString="*.part") returned 6
	[0048.250] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.nfo") returned 0
	[0048.250] lstrlenA (lpString="*.nfo") returned 5
	[0048.250] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.rsa") returned 0
	[0048.250] lstrlenA (lpString="*.rsa") returned 5
	[0048.250] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.key") returned 0
	[0048.250] lstrlenA (lpString="*.key") returned 5
	[0048.250] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.aes") returned 0
	[0048.250] lstrlenA (lpString="*.aes") returned 5
	[0048.250] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.blob") returned 0
	[0048.250] lstrlenA (lpString="*.blob") returned 6
	[0048.251] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.btc") returned 0
	[0048.251] lstrlenA (lpString="*.btc") returned 5
	[0048.251] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.wallet") returned 0
	[0048.251] lstrlenA (lpString="*.wallet") returned 8
	[0048.251] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0048.251] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.251] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SetupResources.dll") returned -1
	[0048.251] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SetupResources.dll") returned -1
	[0048.251] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1
	[0048.251] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned="LocalizedData.xml"
	[0048.251] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1036\\" | out: lpString1="C:\\588bce7c90097ed212\\1036\\") returned="C:\\588bce7c90097ed212\\1036\\"
	[0048.251] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1036\\" | out: pszPath="C:\\588bce7c90097ed212\\1036\\") returned=""
	[0048.251] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1036\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1036\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1036\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.251] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1036\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1036\\how-to-decrypt-files.htm")) returned 0x20
	[0048.251] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1036\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1036\\SetupResources.dll"
	[0048.251] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.zip") returned 0
	[0048.251] lstrlenA (lpString="*.zip") returned 5
	[0048.251] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.rar") returned 0
	[0048.251] lstrlenA (lpString="*.rar") returned 5
	[0048.251] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.7z") returned 0
	[0048.251] lstrlenA (lpString="*.7z") returned 4
	[0048.251] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.tar") returned 0
	[0048.251] lstrlenA (lpString="*.tar") returned 5
	[0048.251] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.gzip") returned 0
	[0048.251] lstrlenA (lpString="*.gzip") returned 6
	[0048.251] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.jpg") returned 0
	[0048.251] lstrlenA (lpString="*.jpg") returned 5
	[0048.251] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.jpeg") returned 0
	[0048.251] lstrlenA (lpString="*.jpeg") returned 6
	[0048.251] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.bmp") returned 0
	[0048.251] lstrlenA (lpString="*.bmp") returned 5
	[0048.251] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.gif") returned 0
	[0048.251] lstrlenA (lpString="*.gif") returned 5
	[0048.251] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.png") returned 0
	[0048.252] lstrlenA (lpString="*.png") returned 5
	[0048.252] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.doc") returned 0
	[0048.252] lstrlenA (lpString="*.doc") returned 5
	[0048.252] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.docx") returned 0
	[0048.252] lstrlenA (lpString="*.docx") returned 6
	[0048.252] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.xls") returned 0
	[0048.252] lstrlenA (lpString="*.xls") returned 5
	[0048.252] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.xlsx") returned 0
	[0048.252] lstrlenA (lpString="*.xlsx") returned 6
	[0048.252] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.ppt") returned 0
	[0048.252] lstrlenA (lpString="*.ppt") returned 5
	[0048.252] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.pptx") returned 0
	[0048.252] lstrlenA (lpString="*.pptx") returned 6
	[0048.252] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.txt") returned 0
	[0048.252] lstrlenA (lpString="*.txt") returned 5
	[0048.252] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.pdf") returned 0
	[0048.252] lstrlenA (lpString="*.pdf") returned 5
	[0048.252] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.htm") returned 0
	[0048.252] lstrlenA (lpString="*.htm") returned 5
	[0048.252] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.html") returned 0
	[0048.252] lstrlenA (lpString="*.html") returned 6
	[0048.252] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.mdb") returned 0
	[0048.252] lstrlenA (lpString="*.mdb") returned 5
	[0048.252] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.pfx") returned 0
	[0048.252] lstrlenA (lpString="*.pfx") returned 5
	[0048.252] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.md") returned 0
	[0048.252] lstrlenA (lpString="*.md") returned 4
	[0048.252] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.lnk") returned 0
	[0048.252] lstrlenA (lpString="*.lnk") returned 5
	[0048.252] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.torrent") returned 0
	[0048.252] lstrlenA (lpString="*.torrent") returned 9
	[0048.252] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.mov") returned 0
	[0048.252] lstrlenA (lpString="*.mov") returned 5
	[0048.252] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.3gp") returned 0
	[0048.252] lstrlenA (lpString="*.3gp") returned 5
	[0048.252] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.mpeg") returned 0
	[0048.252] lstrlenA (lpString="*.mpeg") returned 6
	[0048.252] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.mpg") returned 0
	[0048.253] lstrlenA (lpString="*.mpg") returned 5
	[0048.253] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.flv") returned 0
	[0048.253] lstrlenA (lpString="*.flv") returned 5
	[0048.253] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.avi") returned 0
	[0048.253] lstrlenA (lpString="*.avi") returned 5
	[0048.253] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.mp4") returned 0
	[0048.253] lstrlenA (lpString="*.mp4") returned 5
	[0048.253] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.wmv") returned 0
	[0048.253] lstrlenA (lpString="*.wmv") returned 5
	[0048.253] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.mkv") returned 0
	[0048.253] lstrlenA (lpString="*.mkv") returned 5
	[0048.253] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.mp3") returned 0
	[0048.253] lstrlenA (lpString="*.mp3") returned 5
	[0048.253] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.wav") returned 0
	[0048.253] lstrlenA (lpString="*.wav") returned 5
	[0048.253] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.flac") returned 0
	[0048.253] lstrlenA (lpString="*.flac") returned 6
	[0048.253] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.wma") returned 0
	[0048.253] lstrlenA (lpString="*.wma") returned 5
	[0048.253] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.au3") returned 0
	[0048.253] lstrlenA (lpString="*.au3") returned 5
	[0048.253] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.ahk") returned 0
	[0048.253] lstrlenA (lpString="*.ahk") returned 5
	[0048.253] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.c") returned 0
	[0048.253] lstrlenA (lpString="*.c") returned 3
	[0048.253] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.cc") returned 0
	[0048.253] lstrlenA (lpString="*.cc") returned 4
	[0048.253] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.cpp") returned 0
	[0048.253] lstrlenA (lpString="*.cpp") returned 5
	[0048.253] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.cxx") returned 0
	[0048.253] lstrlenA (lpString="*.cxx") returned 5
	[0048.253] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.c++") returned 0
	[0048.253] lstrlenA (lpString="*.c++") returned 5
	[0048.253] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.cs") returned 0
	[0048.253] lstrlenA (lpString="*.cs") returned 4
	[0048.253] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.vb") returned 0
	[0048.253] lstrlenA (lpString="*.vb") returned 4
	[0048.254] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.bas") returned 0
	[0048.254] lstrlenA (lpString="*.bas") returned 5
	[0048.254] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.csproj") returned 0
	[0048.254] lstrlenA (lpString="*.csproj") returned 8
	[0048.254] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.vbproj") returned 0
	[0048.254] lstrlenA (lpString="*.vbproj") returned 8
	[0048.254] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.vcxproj") returned 0
	[0048.254] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.254] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.manifest") returned 0
	[0048.254] lstrlenA (lpString="*.manifest") returned 10
	[0048.254] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.php") returned 0
	[0048.254] lstrlenA (lpString="*.php") returned 5
	[0048.254] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.vbe") returned 0
	[0048.254] lstrlenA (lpString="*.vbe") returned 5
	[0048.254] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.vba") returned 0
	[0048.254] lstrlenA (lpString="*.vba") returned 5
	[0048.254] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.vbs") returned 0
	[0048.254] lstrlenA (lpString="*.vbs") returned 5
	[0048.254] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.bat") returned 0
	[0048.254] lstrlenA (lpString="*.bat") returned 5
	[0048.254] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.cmd") returned 0
	[0048.254] lstrlenA (lpString="*.cmd") returned 5
	[0048.254] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.js") returned 0
	[0048.254] lstrlenA (lpString="*.js") returned 4
	[0048.254] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.jscript") returned 0
	[0048.254] lstrlenA (lpString="*.jscript") returned 9
	[0048.254] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.hta") returned 0
	[0048.254] lstrlenA (lpString="*.hta") returned 5
	[0048.254] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.php7") returned 0
	[0048.254] lstrlenA (lpString="*.php7") returned 6
	[0048.254] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.db") returned 0
	[0048.254] lstrlenA (lpString="*.db") returned 4
	[0048.254] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.swf") returned 0
	[0048.254] lstrlenA (lpString="*.swf") returned 5
	[0048.254] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.eml") returned 0
	[0048.254] lstrlenA (lpString="*.eml") returned 5
	[0048.254] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.part") returned 0
	[0048.255] lstrlenA (lpString="*.part") returned 6
	[0048.255] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.nfo") returned 0
	[0048.255] lstrlenA (lpString="*.nfo") returned 5
	[0048.255] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.rsa") returned 0
	[0048.255] lstrlenA (lpString="*.rsa") returned 5
	[0048.255] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.key") returned 0
	[0048.255] lstrlenA (lpString="*.key") returned 5
	[0048.255] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.aes") returned 0
	[0048.255] lstrlenA (lpString="*.aes") returned 5
	[0048.255] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.blob") returned 0
	[0048.255] lstrlenA (lpString="*.blob") returned 6
	[0048.255] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.btc") returned 0
	[0048.255] lstrlenA (lpString="*.btc") returned 5
	[0048.255] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.wallet") returned 0
	[0048.255] lstrlenA (lpString="*.wallet") returned 8
	[0048.255] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0048.255] FindClose (in: hFindFile=0x7cbad0 | out: hFindFile=0x7cbad0) returned 1
	[0048.255] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d1d40, dwReserved1=0x7b00c0, cFileName="1037", cAlternateFileName="")) returned 1
	[0048.255] lstrcmpA (lpString1=".", lpString2="1037") returned -1
	[0048.255] lstrcmpA (lpString1="..", lpString2="1037") returned -1
	[0048.255] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*"
	[0048.255] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1037" | out: lpString1="C:\\588bce7c90097ed212\\1037") returned="C:\\588bce7c90097ed212\\1037"
	[0048.255] lstrlenA (lpString="C:\\588bce7c90097ed212\\1037") returned 26
	[0048.255] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbb90
	[0048.255] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0048.255] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0048.256] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0048.256] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0048.256] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0048.256] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.256] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="eula.rtf") returned -1
	[0048.257] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="eula.rtf") returned 1
	[0048.257] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1
	[0048.257] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1037\\*.*") returned="*.*"
	[0048.257] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1037\\" | out: lpString1="C:\\588bce7c90097ed212\\1037\\") returned="C:\\588bce7c90097ed212\\1037\\"
	[0048.257] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1037\\" | out: pszPath="C:\\588bce7c90097ed212\\1037\\") returned=""
	[0048.257] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1037\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1037\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1037\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.257] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1037\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1037\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0048.257] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1037\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1037\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0048.259] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0048.259] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0048.259] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0048.260] CloseHandle (hObject=0x208) returned 1
	[0048.260] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1037\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned="C:\\588bce7c90097ed212\\1037\\eula.rtf"
	[0048.260] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.zip") returned 0
	[0048.260] lstrlenA (lpString="*.zip") returned 5
	[0048.260] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.rar") returned 0
	[0048.260] lstrlenA (lpString="*.rar") returned 5
	[0048.260] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.7z") returned 0
	[0048.260] lstrlenA (lpString="*.7z") returned 4
	[0048.260] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.tar") returned 0
	[0048.260] lstrlenA (lpString="*.tar") returned 5
	[0048.260] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.gzip") returned 0
	[0048.260] lstrlenA (lpString="*.gzip") returned 6
	[0048.260] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.jpg") returned 0
	[0048.260] lstrlenA (lpString="*.jpg") returned 5
	[0048.260] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.jpeg") returned 0
	[0048.260] lstrlenA (lpString="*.jpeg") returned 6
	[0048.260] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.bmp") returned 0
	[0048.260] lstrlenA (lpString="*.bmp") returned 5
	[0048.260] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.gif") returned 0
	[0048.260] lstrlenA (lpString="*.gif") returned 5
	[0048.260] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.png") returned 0
	[0048.260] lstrlenA (lpString="*.png") returned 5
	[0048.260] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.doc") returned 0
	[0048.260] lstrlenA (lpString="*.doc") returned 5
	[0048.260] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.docx") returned 0
	[0048.260] lstrlenA (lpString="*.docx") returned 6
	[0048.260] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.xls") returned 0
	[0048.260] lstrlenA (lpString="*.xls") returned 5
	[0048.260] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.xlsx") returned 0
	[0048.261] lstrlenA (lpString="*.xlsx") returned 6
	[0048.261] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.ppt") returned 0
	[0048.261] lstrlenA (lpString="*.ppt") returned 5
	[0048.261] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.pptx") returned 0
	[0048.261] lstrlenA (lpString="*.pptx") returned 6
	[0048.261] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.txt") returned 0
	[0048.261] lstrlenA (lpString="*.txt") returned 5
	[0048.261] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.pdf") returned 0
	[0048.261] lstrlenA (lpString="*.pdf") returned 5
	[0048.261] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.htm") returned 0
	[0048.261] lstrlenA (lpString="*.htm") returned 5
	[0048.261] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.html") returned 0
	[0048.261] lstrlenA (lpString="*.html") returned 6
	[0048.261] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.mdb") returned 0
	[0048.261] lstrlenA (lpString="*.mdb") returned 5
	[0048.261] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.pfx") returned 0
	[0048.261] lstrlenA (lpString="*.pfx") returned 5
	[0048.261] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.md") returned 0
	[0048.261] lstrlenA (lpString="*.md") returned 4
	[0048.261] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.lnk") returned 0
	[0048.261] lstrlenA (lpString="*.lnk") returned 5
	[0048.261] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.torrent") returned 0
	[0048.261] lstrlenA (lpString="*.torrent") returned 9
	[0048.261] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.mov") returned 0
	[0048.261] lstrlenA (lpString="*.mov") returned 5
	[0048.261] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.3gp") returned 0
	[0048.261] lstrlenA (lpString="*.3gp") returned 5
	[0048.261] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.mpeg") returned 0
	[0048.261] lstrlenA (lpString="*.mpeg") returned 6
	[0048.261] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.mpg") returned 0
	[0048.261] lstrlenA (lpString="*.mpg") returned 5
	[0048.261] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.flv") returned 0
	[0048.261] lstrlenA (lpString="*.flv") returned 5
	[0048.261] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.avi") returned 0
	[0048.261] lstrlenA (lpString="*.avi") returned 5
	[0048.261] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.mp4") returned 0
	[0048.261] lstrlenA (lpString="*.mp4") returned 5
	[0048.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.wmv") returned 0
	[0048.262] lstrlenA (lpString="*.wmv") returned 5
	[0048.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.mkv") returned 0
	[0048.262] lstrlenA (lpString="*.mkv") returned 5
	[0048.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.mp3") returned 0
	[0048.262] lstrlenA (lpString="*.mp3") returned 5
	[0048.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.wav") returned 0
	[0048.262] lstrlenA (lpString="*.wav") returned 5
	[0048.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.flac") returned 0
	[0048.262] lstrlenA (lpString="*.flac") returned 6
	[0048.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.wma") returned 0
	[0048.262] lstrlenA (lpString="*.wma") returned 5
	[0048.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.au3") returned 0
	[0048.262] lstrlenA (lpString="*.au3") returned 5
	[0048.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.ahk") returned 0
	[0048.262] lstrlenA (lpString="*.ahk") returned 5
	[0048.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.c") returned 0
	[0048.262] lstrlenA (lpString="*.c") returned 3
	[0048.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.cc") returned 0
	[0048.262] lstrlenA (lpString="*.cc") returned 4
	[0048.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.cpp") returned 0
	[0048.262] lstrlenA (lpString="*.cpp") returned 5
	[0048.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.cxx") returned 0
	[0048.262] lstrlenA (lpString="*.cxx") returned 5
	[0048.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.c++") returned 0
	[0048.262] lstrlenA (lpString="*.c++") returned 5
	[0048.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.cs") returned 0
	[0048.262] lstrlenA (lpString="*.cs") returned 4
	[0048.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.vb") returned 0
	[0048.262] lstrlenA (lpString="*.vb") returned 4
	[0048.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.bas") returned 0
	[0048.262] lstrlenA (lpString="*.bas") returned 5
	[0048.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.csproj") returned 0
	[0048.262] lstrlenA (lpString="*.csproj") returned 8
	[0048.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.vbproj") returned 0
	[0048.262] lstrlenA (lpString="*.vbproj") returned 8
	[0048.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.vcxproj") returned 0
	[0048.263] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.263] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.manifest") returned 0
	[0048.263] lstrlenA (lpString="*.manifest") returned 10
	[0048.263] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.php") returned 0
	[0048.263] lstrlenA (lpString="*.php") returned 5
	[0048.263] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.vbe") returned 0
	[0048.263] lstrlenA (lpString="*.vbe") returned 5
	[0048.263] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.vba") returned 0
	[0048.263] lstrlenA (lpString="*.vba") returned 5
	[0048.263] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.vbs") returned 0
	[0048.263] lstrlenA (lpString="*.vbs") returned 5
	[0048.263] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.bat") returned 0
	[0048.263] lstrlenA (lpString="*.bat") returned 5
	[0048.263] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.cmd") returned 0
	[0048.263] lstrlenA (lpString="*.cmd") returned 5
	[0048.263] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.js") returned 0
	[0048.263] lstrlenA (lpString="*.js") returned 4
	[0048.263] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.jscript") returned 0
	[0048.263] lstrlenA (lpString="*.jscript") returned 9
	[0048.263] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.hta") returned 0
	[0048.263] lstrlenA (lpString="*.hta") returned 5
	[0048.263] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.php7") returned 0
	[0048.263] lstrlenA (lpString="*.php7") returned 6
	[0048.263] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.db") returned 0
	[0048.263] lstrlenA (lpString="*.db") returned 4
	[0048.263] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.swf") returned 0
	[0048.263] lstrlenA (lpString="*.swf") returned 5
	[0048.263] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.eml") returned 0
	[0048.263] lstrlenA (lpString="*.eml") returned 5
	[0048.263] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.part") returned 0
	[0048.263] lstrlenA (lpString="*.part") returned 6
	[0048.263] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.nfo") returned 0
	[0048.263] lstrlenA (lpString="*.nfo") returned 5
	[0048.263] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.rsa") returned 0
	[0048.263] lstrlenA (lpString="*.rsa") returned 5
	[0048.263] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.key") returned 0
	[0048.263] lstrlenA (lpString="*.key") returned 5
	[0048.264] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.aes") returned 0
	[0048.264] lstrlenA (lpString="*.aes") returned 5
	[0048.264] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.blob") returned 0
	[0048.264] lstrlenA (lpString="*.blob") returned 6
	[0048.264] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.btc") returned 0
	[0048.264] lstrlenA (lpString="*.btc") returned 5
	[0048.264] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.wallet") returned 0
	[0048.264] lstrlenA (lpString="*.wallet") returned 8
	[0048.264] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0048.264] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.264] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="LocalizedData.xml") returned -1
	[0048.264] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="LocalizedData.xml") returned -1
	[0048.264] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1
	[0048.264] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned="eula.rtf"
	[0048.264] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1037\\" | out: lpString1="C:\\588bce7c90097ed212\\1037\\") returned="C:\\588bce7c90097ed212\\1037\\"
	[0048.264] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1037\\" | out: pszPath="C:\\588bce7c90097ed212\\1037\\") returned=""
	[0048.264] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1037\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1037\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1037\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.264] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1037\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1037\\how-to-decrypt-files.htm")) returned 0x20
	[0048.264] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1037\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml"
	[0048.264] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.zip") returned 0
	[0048.264] lstrlenA (lpString="*.zip") returned 5
	[0048.264] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.rar") returned 0
	[0048.264] lstrlenA (lpString="*.rar") returned 5
	[0048.264] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.7z") returned 0
	[0048.264] lstrlenA (lpString="*.7z") returned 4
	[0048.264] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.tar") returned 0
	[0048.264] lstrlenA (lpString="*.tar") returned 5
	[0048.264] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.gzip") returned 0
	[0048.264] lstrlenA (lpString="*.gzip") returned 6
	[0048.264] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.jpg") returned 0
	[0048.264] lstrlenA (lpString="*.jpg") returned 5
	[0048.264] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.jpeg") returned 0
	[0048.264] lstrlenA (lpString="*.jpeg") returned 6
	[0048.264] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.bmp") returned 0
	[0048.265] lstrlenA (lpString="*.bmp") returned 5
	[0048.265] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.gif") returned 0
	[0048.265] lstrlenA (lpString="*.gif") returned 5
	[0048.265] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.png") returned 0
	[0048.265] lstrlenA (lpString="*.png") returned 5
	[0048.265] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.doc") returned 0
	[0048.265] lstrlenA (lpString="*.doc") returned 5
	[0048.265] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.docx") returned 0
	[0048.265] lstrlenA (lpString="*.docx") returned 6
	[0048.265] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.xls") returned 0
	[0048.265] lstrlenA (lpString="*.xls") returned 5
	[0048.265] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.xlsx") returned 0
	[0048.265] lstrlenA (lpString="*.xlsx") returned 6
	[0048.265] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.ppt") returned 0
	[0048.265] lstrlenA (lpString="*.ppt") returned 5
	[0048.265] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.pptx") returned 0
	[0048.265] lstrlenA (lpString="*.pptx") returned 6
	[0048.265] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.txt") returned 0
	[0048.265] lstrlenA (lpString="*.txt") returned 5
	[0048.265] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.pdf") returned 0
	[0048.265] lstrlenA (lpString="*.pdf") returned 5
	[0048.265] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.htm") returned 0
	[0048.265] lstrlenA (lpString="*.htm") returned 5
	[0048.265] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.html") returned 0
	[0048.265] lstrlenA (lpString="*.html") returned 6
	[0048.265] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.mdb") returned 0
	[0048.265] lstrlenA (lpString="*.mdb") returned 5
	[0048.265] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.pfx") returned 0
	[0048.265] lstrlenA (lpString="*.pfx") returned 5
	[0048.265] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.md") returned 0
	[0048.265] lstrlenA (lpString="*.md") returned 4
	[0048.265] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.lnk") returned 0
	[0048.265] lstrlenA (lpString="*.lnk") returned 5
	[0048.265] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.torrent") returned 0
	[0048.265] lstrlenA (lpString="*.torrent") returned 9
	[0048.265] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.mov") returned 0
	[0048.265] lstrlenA (lpString="*.mov") returned 5
	[0048.266] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.3gp") returned 0
	[0048.266] lstrlenA (lpString="*.3gp") returned 5
	[0048.266] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.mpeg") returned 0
	[0048.266] lstrlenA (lpString="*.mpeg") returned 6
	[0048.266] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.mpg") returned 0
	[0048.266] lstrlenA (lpString="*.mpg") returned 5
	[0048.266] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.flv") returned 0
	[0048.266] lstrlenA (lpString="*.flv") returned 5
	[0048.266] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.avi") returned 0
	[0048.266] lstrlenA (lpString="*.avi") returned 5
	[0048.266] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.mp4") returned 0
	[0048.266] lstrlenA (lpString="*.mp4") returned 5
	[0048.266] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.wmv") returned 0
	[0048.266] lstrlenA (lpString="*.wmv") returned 5
	[0048.266] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.mkv") returned 0
	[0048.266] lstrlenA (lpString="*.mkv") returned 5
	[0048.266] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.mp3") returned 0
	[0048.266] lstrlenA (lpString="*.mp3") returned 5
	[0048.266] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.wav") returned 0
	[0048.266] lstrlenA (lpString="*.wav") returned 5
	[0048.266] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.flac") returned 0
	[0048.266] lstrlenA (lpString="*.flac") returned 6
	[0048.266] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.wma") returned 0
	[0048.266] lstrlenA (lpString="*.wma") returned 5
	[0048.266] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.au3") returned 0
	[0048.266] lstrlenA (lpString="*.au3") returned 5
	[0048.266] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.ahk") returned 0
	[0048.266] lstrlenA (lpString="*.ahk") returned 5
	[0048.266] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.c") returned 0
	[0048.266] lstrlenA (lpString="*.c") returned 3
	[0048.266] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.cc") returned 0
	[0048.266] lstrlenA (lpString="*.cc") returned 4
	[0048.266] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.cpp") returned 0
	[0048.266] lstrlenA (lpString="*.cpp") returned 5
	[0048.266] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.cxx") returned 0
	[0048.266] lstrlenA (lpString="*.cxx") returned 5
	[0048.266] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.c++") returned 0
	[0048.267] lstrlenA (lpString="*.c++") returned 5
	[0048.267] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.cs") returned 0
	[0048.267] lstrlenA (lpString="*.cs") returned 4
	[0048.267] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.vb") returned 0
	[0048.267] lstrlenA (lpString="*.vb") returned 4
	[0048.267] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.bas") returned 0
	[0048.267] lstrlenA (lpString="*.bas") returned 5
	[0048.267] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.csproj") returned 0
	[0048.267] lstrlenA (lpString="*.csproj") returned 8
	[0048.267] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.vbproj") returned 0
	[0048.267] lstrlenA (lpString="*.vbproj") returned 8
	[0048.267] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.vcxproj") returned 0
	[0048.267] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.267] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.manifest") returned 0
	[0048.267] lstrlenA (lpString="*.manifest") returned 10
	[0048.267] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.php") returned 0
	[0048.267] lstrlenA (lpString="*.php") returned 5
	[0048.267] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.vbe") returned 0
	[0048.267] lstrlenA (lpString="*.vbe") returned 5
	[0048.267] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.vba") returned 0
	[0048.267] lstrlenA (lpString="*.vba") returned 5
	[0048.267] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.vbs") returned 0
	[0048.267] lstrlenA (lpString="*.vbs") returned 5
	[0048.267] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.bat") returned 0
	[0048.267] lstrlenA (lpString="*.bat") returned 5
	[0048.267] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.cmd") returned 0
	[0048.267] lstrlenA (lpString="*.cmd") returned 5
	[0048.267] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.js") returned 0
	[0048.267] lstrlenA (lpString="*.js") returned 4
	[0048.267] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.jscript") returned 0
	[0048.267] lstrlenA (lpString="*.jscript") returned 9
	[0048.267] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.hta") returned 0
	[0048.267] lstrlenA (lpString="*.hta") returned 5
	[0048.267] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.php7") returned 0
	[0048.267] lstrlenA (lpString="*.php7") returned 6
	[0048.267] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.db") returned 0
	[0048.267] lstrlenA (lpString="*.db") returned 4
	[0048.268] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.swf") returned 0
	[0048.268] lstrlenA (lpString="*.swf") returned 5
	[0048.268] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.eml") returned 0
	[0048.268] lstrlenA (lpString="*.eml") returned 5
	[0048.268] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.part") returned 0
	[0048.268] lstrlenA (lpString="*.part") returned 6
	[0048.268] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.nfo") returned 0
	[0048.268] lstrlenA (lpString="*.nfo") returned 5
	[0048.268] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.rsa") returned 0
	[0048.268] lstrlenA (lpString="*.rsa") returned 5
	[0048.268] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.key") returned 0
	[0048.268] lstrlenA (lpString="*.key") returned 5
	[0048.268] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.aes") returned 0
	[0048.268] lstrlenA (lpString="*.aes") returned 5
	[0048.268] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.blob") returned 0
	[0048.268] lstrlenA (lpString="*.blob") returned 6
	[0048.268] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.btc") returned 0
	[0048.268] lstrlenA (lpString="*.btc") returned 5
	[0048.268] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.wallet") returned 0
	[0048.268] lstrlenA (lpString="*.wallet") returned 8
	[0048.268] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0048.268] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.268] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SetupResources.dll") returned -1
	[0048.268] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SetupResources.dll") returned -1
	[0048.268] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1
	[0048.268] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned="LocalizedData.xml"
	[0048.268] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1037\\" | out: lpString1="C:\\588bce7c90097ed212\\1037\\") returned="C:\\588bce7c90097ed212\\1037\\"
	[0048.268] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1037\\" | out: pszPath="C:\\588bce7c90097ed212\\1037\\") returned=""
	[0048.268] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1037\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1037\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1037\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.268] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1037\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1037\\how-to-decrypt-files.htm")) returned 0x20
	[0048.268] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1037\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1037\\SetupResources.dll"
	[0048.268] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.zip") returned 0
	[0048.268] lstrlenA (lpString="*.zip") returned 5
	[0048.269] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.rar") returned 0
	[0048.269] lstrlenA (lpString="*.rar") returned 5
	[0048.269] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.7z") returned 0
	[0048.269] lstrlenA (lpString="*.7z") returned 4
	[0048.269] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.tar") returned 0
	[0048.269] lstrlenA (lpString="*.tar") returned 5
	[0048.269] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.gzip") returned 0
	[0048.269] lstrlenA (lpString="*.gzip") returned 6
	[0048.269] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.jpg") returned 0
	[0048.269] lstrlenA (lpString="*.jpg") returned 5
	[0048.269] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.jpeg") returned 0
	[0048.269] lstrlenA (lpString="*.jpeg") returned 6
	[0048.269] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.bmp") returned 0
	[0048.269] lstrlenA (lpString="*.bmp") returned 5
	[0048.269] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.gif") returned 0
	[0048.269] lstrlenA (lpString="*.gif") returned 5
	[0048.269] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.png") returned 0
	[0048.269] lstrlenA (lpString="*.png") returned 5
	[0048.269] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.doc") returned 0
	[0048.269] lstrlenA (lpString="*.doc") returned 5
	[0048.269] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.docx") returned 0
	[0048.269] lstrlenA (lpString="*.docx") returned 6
	[0048.269] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.xls") returned 0
	[0048.269] lstrlenA (lpString="*.xls") returned 5
	[0048.269] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.xlsx") returned 0
	[0048.269] lstrlenA (lpString="*.xlsx") returned 6
	[0048.269] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.ppt") returned 0
	[0048.269] lstrlenA (lpString="*.ppt") returned 5
	[0048.269] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.pptx") returned 0
	[0048.269] lstrlenA (lpString="*.pptx") returned 6
	[0048.269] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.txt") returned 0
	[0048.269] lstrlenA (lpString="*.txt") returned 5
	[0048.269] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.pdf") returned 0
	[0048.269] lstrlenA (lpString="*.pdf") returned 5
	[0048.269] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.htm") returned 0
	[0048.269] lstrlenA (lpString="*.htm") returned 5
	[0048.269] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.html") returned 0
	[0048.270] lstrlenA (lpString="*.html") returned 6
	[0048.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.mdb") returned 0
	[0048.270] lstrlenA (lpString="*.mdb") returned 5
	[0048.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.pfx") returned 0
	[0048.270] lstrlenA (lpString="*.pfx") returned 5
	[0048.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.md") returned 0
	[0048.270] lstrlenA (lpString="*.md") returned 4
	[0048.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.lnk") returned 0
	[0048.270] lstrlenA (lpString="*.lnk") returned 5
	[0048.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.torrent") returned 0
	[0048.270] lstrlenA (lpString="*.torrent") returned 9
	[0048.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.mov") returned 0
	[0048.270] lstrlenA (lpString="*.mov") returned 5
	[0048.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.3gp") returned 0
	[0048.270] lstrlenA (lpString="*.3gp") returned 5
	[0048.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.mpeg") returned 0
	[0048.270] lstrlenA (lpString="*.mpeg") returned 6
	[0048.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.mpg") returned 0
	[0048.270] lstrlenA (lpString="*.mpg") returned 5
	[0048.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.flv") returned 0
	[0048.270] lstrlenA (lpString="*.flv") returned 5
	[0048.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.avi") returned 0
	[0048.270] lstrlenA (lpString="*.avi") returned 5
	[0048.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.mp4") returned 0
	[0048.270] lstrlenA (lpString="*.mp4") returned 5
	[0048.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.wmv") returned 0
	[0048.270] lstrlenA (lpString="*.wmv") returned 5
	[0048.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.mkv") returned 0
	[0048.270] lstrlenA (lpString="*.mkv") returned 5
	[0048.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.mp3") returned 0
	[0048.270] lstrlenA (lpString="*.mp3") returned 5
	[0048.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.wav") returned 0
	[0048.270] lstrlenA (lpString="*.wav") returned 5
	[0048.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.flac") returned 0
	[0048.270] lstrlenA (lpString="*.flac") returned 6
	[0048.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.wma") returned 0
	[0048.271] lstrlenA (lpString="*.wma") returned 5
	[0048.271] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.au3") returned 0
	[0048.271] lstrlenA (lpString="*.au3") returned 5
	[0048.271] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.ahk") returned 0
	[0048.271] lstrlenA (lpString="*.ahk") returned 5
	[0048.271] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.c") returned 0
	[0048.271] lstrlenA (lpString="*.c") returned 3
	[0048.271] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.cc") returned 0
	[0048.271] lstrlenA (lpString="*.cc") returned 4
	[0048.271] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.cpp") returned 0
	[0048.271] lstrlenA (lpString="*.cpp") returned 5
	[0048.271] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.cxx") returned 0
	[0048.271] lstrlenA (lpString="*.cxx") returned 5
	[0048.271] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.c++") returned 0
	[0048.271] lstrlenA (lpString="*.c++") returned 5
	[0048.271] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.cs") returned 0
	[0048.271] lstrlenA (lpString="*.cs") returned 4
	[0048.271] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.vb") returned 0
	[0048.271] lstrlenA (lpString="*.vb") returned 4
	[0048.271] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.bas") returned 0
	[0048.271] lstrlenA (lpString="*.bas") returned 5
	[0048.271] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.csproj") returned 0
	[0048.271] lstrlenA (lpString="*.csproj") returned 8
	[0048.271] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.vbproj") returned 0
	[0048.271] lstrlenA (lpString="*.vbproj") returned 8
	[0048.271] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.vcxproj") returned 0
	[0048.343] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.343] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.manifest") returned 0
	[0048.343] lstrlenA (lpString="*.manifest") returned 10
	[0048.343] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.php") returned 0
	[0048.343] lstrlenA (lpString="*.php") returned 5
	[0048.343] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.vbe") returned 0
	[0048.343] lstrlenA (lpString="*.vbe") returned 5
	[0048.343] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.vba") returned 0
	[0048.343] lstrlenA (lpString="*.vba") returned 5
	[0048.343] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.vbs") returned 0
	[0048.343] lstrlenA (lpString="*.vbs") returned 5
	[0048.343] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.bat") returned 0
	[0048.344] lstrlenA (lpString="*.bat") returned 5
	[0048.344] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.cmd") returned 0
	[0048.344] lstrlenA (lpString="*.cmd") returned 5
	[0048.344] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.js") returned 0
	[0048.344] lstrlenA (lpString="*.js") returned 4
	[0048.344] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.jscript") returned 0
	[0048.344] lstrlenA (lpString="*.jscript") returned 9
	[0048.344] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.hta") returned 0
	[0048.344] lstrlenA (lpString="*.hta") returned 5
	[0048.344] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.php7") returned 0
	[0048.344] lstrlenA (lpString="*.php7") returned 6
	[0048.344] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.db") returned 0
	[0048.344] lstrlenA (lpString="*.db") returned 4
	[0048.344] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.swf") returned 0
	[0048.344] lstrlenA (lpString="*.swf") returned 5
	[0048.344] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.eml") returned 0
	[0048.344] lstrlenA (lpString="*.eml") returned 5
	[0048.344] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.part") returned 0
	[0048.344] lstrlenA (lpString="*.part") returned 6
	[0048.344] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.nfo") returned 0
	[0048.344] lstrlenA (lpString="*.nfo") returned 5
	[0048.344] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.rsa") returned 0
	[0048.344] lstrlenA (lpString="*.rsa") returned 5
	[0048.344] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.key") returned 0
	[0048.344] lstrlenA (lpString="*.key") returned 5
	[0048.344] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.aes") returned 0
	[0048.344] lstrlenA (lpString="*.aes") returned 5
	[0048.344] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.blob") returned 0
	[0048.344] lstrlenA (lpString="*.blob") returned 6
	[0048.344] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.btc") returned 0
	[0048.344] lstrlenA (lpString="*.btc") returned 5
	[0048.344] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.wallet") returned 0
	[0048.344] lstrlenA (lpString="*.wallet") returned 8
	[0048.344] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0048.345] FindClose (in: hFindFile=0x7cbb90 | out: hFindFile=0x7cbb90) returned 1
	[0048.345] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d1d40, dwReserved1=0x7b00c0, cFileName="1038", cAlternateFileName="")) returned 1
	[0048.345] lstrcmpA (lpString1=".", lpString2="1038") returned -1
	[0048.345] lstrcmpA (lpString1="..", lpString2="1038") returned -1
	[0048.345] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*"
	[0048.345] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1038" | out: lpString1="C:\\588bce7c90097ed212\\1038") returned="C:\\588bce7c90097ed212\\1038"
	[0048.345] lstrlenA (lpString="C:\\588bce7c90097ed212\\1038") returned 26
	[0048.345] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb590
	[0048.345] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0048.345] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0048.345] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0048.346] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0048.346] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0048.346] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.346] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="eula.rtf") returned -1
	[0048.346] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="eula.rtf") returned 1
	[0048.346] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1
	[0048.346] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1038\\*.*") returned="*.*"
	[0048.346] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1038\\" | out: lpString1="C:\\588bce7c90097ed212\\1038\\") returned="C:\\588bce7c90097ed212\\1038\\"
	[0048.346] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1038\\" | out: pszPath="C:\\588bce7c90097ed212\\1038\\") returned=""
	[0048.346] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1038\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1038\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1038\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.346] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1038\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1038\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0048.346] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1038\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1038\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0048.348] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0048.348] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0048.349] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0048.349] CloseHandle (hObject=0x208) returned 1
	[0048.349] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1038\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned="C:\\588bce7c90097ed212\\1038\\eula.rtf"
	[0048.349] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.zip") returned 0
	[0048.349] lstrlenA (lpString="*.zip") returned 5
	[0048.349] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.rar") returned 0
	[0048.349] lstrlenA (lpString="*.rar") returned 5
	[0048.349] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.7z") returned 0
	[0048.349] lstrlenA (lpString="*.7z") returned 4
	[0048.349] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.tar") returned 0
	[0048.349] lstrlenA (lpString="*.tar") returned 5
	[0048.350] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.gzip") returned 0
	[0048.350] lstrlenA (lpString="*.gzip") returned 6
	[0048.350] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.jpg") returned 0
	[0048.350] lstrlenA (lpString="*.jpg") returned 5
	[0048.350] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.jpeg") returned 0
	[0048.350] lstrlenA (lpString="*.jpeg") returned 6
	[0048.350] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.bmp") returned 0
	[0048.350] lstrlenA (lpString="*.bmp") returned 5
	[0048.350] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.gif") returned 0
	[0048.350] lstrlenA (lpString="*.gif") returned 5
	[0048.350] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.png") returned 0
	[0048.350] lstrlenA (lpString="*.png") returned 5
	[0048.350] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.doc") returned 0
	[0048.350] lstrlenA (lpString="*.doc") returned 5
	[0048.350] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.docx") returned 0
	[0048.350] lstrlenA (lpString="*.docx") returned 6
	[0048.350] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.xls") returned 0
	[0048.350] lstrlenA (lpString="*.xls") returned 5
	[0048.350] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.xlsx") returned 0
	[0048.350] lstrlenA (lpString="*.xlsx") returned 6
	[0048.350] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.ppt") returned 0
	[0048.350] lstrlenA (lpString="*.ppt") returned 5
	[0048.350] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.pptx") returned 0
	[0048.350] lstrlenA (lpString="*.pptx") returned 6
	[0048.350] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.txt") returned 0
	[0048.350] lstrlenA (lpString="*.txt") returned 5
	[0048.350] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.pdf") returned 0
	[0048.350] lstrlenA (lpString="*.pdf") returned 5
	[0048.350] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.htm") returned 0
	[0048.350] lstrlenA (lpString="*.htm") returned 5
	[0048.350] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.html") returned 0
	[0048.350] lstrlenA (lpString="*.html") returned 6
	[0048.350] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.mdb") returned 0
	[0048.350] lstrlenA (lpString="*.mdb") returned 5
	[0048.350] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.pfx") returned 0
	[0048.350] lstrlenA (lpString="*.pfx") returned 5
	[0048.350] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.md") returned 0
	[0048.351] lstrlenA (lpString="*.md") returned 4
	[0048.351] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.lnk") returned 0
	[0048.351] lstrlenA (lpString="*.lnk") returned 5
	[0048.351] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.torrent") returned 0
	[0048.351] lstrlenA (lpString="*.torrent") returned 9
	[0048.351] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.mov") returned 0
	[0048.351] lstrlenA (lpString="*.mov") returned 5
	[0048.351] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.3gp") returned 0
	[0048.351] lstrlenA (lpString="*.3gp") returned 5
	[0048.351] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.mpeg") returned 0
	[0048.351] lstrlenA (lpString="*.mpeg") returned 6
	[0048.351] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.mpg") returned 0
	[0048.351] lstrlenA (lpString="*.mpg") returned 5
	[0048.351] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.flv") returned 0
	[0048.351] lstrlenA (lpString="*.flv") returned 5
	[0048.351] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.avi") returned 0
	[0048.351] lstrlenA (lpString="*.avi") returned 5
	[0048.351] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.mp4") returned 0
	[0048.351] lstrlenA (lpString="*.mp4") returned 5
	[0048.351] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.wmv") returned 0
	[0048.351] lstrlenA (lpString="*.wmv") returned 5
	[0048.351] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.mkv") returned 0
	[0048.351] lstrlenA (lpString="*.mkv") returned 5
	[0048.351] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.mp3") returned 0
	[0048.351] lstrlenA (lpString="*.mp3") returned 5
	[0048.351] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.wav") returned 0
	[0048.351] lstrlenA (lpString="*.wav") returned 5
	[0048.351] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.flac") returned 0
	[0048.351] lstrlenA (lpString="*.flac") returned 6
	[0048.351] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.wma") returned 0
	[0048.351] lstrlenA (lpString="*.wma") returned 5
	[0048.351] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.au3") returned 0
	[0048.351] lstrlenA (lpString="*.au3") returned 5
	[0048.351] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.ahk") returned 0
	[0048.351] lstrlenA (lpString="*.ahk") returned 5
	[0048.351] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.c") returned 0
	[0048.351] lstrlenA (lpString="*.c") returned 3
	[0048.352] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.cc") returned 0
	[0048.352] lstrlenA (lpString="*.cc") returned 4
	[0048.352] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.cpp") returned 0
	[0048.352] lstrlenA (lpString="*.cpp") returned 5
	[0048.352] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.cxx") returned 0
	[0048.352] lstrlenA (lpString="*.cxx") returned 5
	[0048.352] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.c++") returned 0
	[0048.352] lstrlenA (lpString="*.c++") returned 5
	[0048.352] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.cs") returned 0
	[0048.352] lstrlenA (lpString="*.cs") returned 4
	[0048.352] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.vb") returned 0
	[0048.352] lstrlenA (lpString="*.vb") returned 4
	[0048.352] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.bas") returned 0
	[0048.352] lstrlenA (lpString="*.bas") returned 5
	[0048.352] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.csproj") returned 0
	[0048.352] lstrlenA (lpString="*.csproj") returned 8
	[0048.352] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.vbproj") returned 0
	[0048.352] lstrlenA (lpString="*.vbproj") returned 8
	[0048.352] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.vcxproj") returned 0
	[0048.352] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.352] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.manifest") returned 0
	[0048.352] lstrlenA (lpString="*.manifest") returned 10
	[0048.352] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.php") returned 0
	[0048.352] lstrlenA (lpString="*.php") returned 5
	[0048.352] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.vbe") returned 0
	[0048.352] lstrlenA (lpString="*.vbe") returned 5
	[0048.352] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.vba") returned 0
	[0048.352] lstrlenA (lpString="*.vba") returned 5
	[0048.352] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.vbs") returned 0
	[0048.352] lstrlenA (lpString="*.vbs") returned 5
	[0048.352] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.bat") returned 0
	[0048.352] lstrlenA (lpString="*.bat") returned 5
	[0048.352] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.cmd") returned 0
	[0048.352] lstrlenA (lpString="*.cmd") returned 5
	[0048.352] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.js") returned 0
	[0048.352] lstrlenA (lpString="*.js") returned 4
	[0048.353] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.jscript") returned 0
	[0048.353] lstrlenA (lpString="*.jscript") returned 9
	[0048.353] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.hta") returned 0
	[0048.353] lstrlenA (lpString="*.hta") returned 5
	[0048.353] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.php7") returned 0
	[0048.353] lstrlenA (lpString="*.php7") returned 6
	[0048.353] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.db") returned 0
	[0048.353] lstrlenA (lpString="*.db") returned 4
	[0048.353] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.swf") returned 0
	[0048.353] lstrlenA (lpString="*.swf") returned 5
	[0048.353] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.eml") returned 0
	[0048.353] lstrlenA (lpString="*.eml") returned 5
	[0048.353] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.part") returned 0
	[0048.353] lstrlenA (lpString="*.part") returned 6
	[0048.353] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.nfo") returned 0
	[0048.353] lstrlenA (lpString="*.nfo") returned 5
	[0048.353] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.rsa") returned 0
	[0048.353] lstrlenA (lpString="*.rsa") returned 5
	[0048.353] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.key") returned 0
	[0048.353] lstrlenA (lpString="*.key") returned 5
	[0048.353] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.aes") returned 0
	[0048.353] lstrlenA (lpString="*.aes") returned 5
	[0048.353] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.blob") returned 0
	[0048.353] lstrlenA (lpString="*.blob") returned 6
	[0048.353] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.btc") returned 0
	[0048.353] lstrlenA (lpString="*.btc") returned 5
	[0048.353] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.wallet") returned 0
	[0048.353] lstrlenA (lpString="*.wallet") returned 8
	[0048.353] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0048.353] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.353] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="LocalizedData.xml") returned -1
	[0048.353] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="LocalizedData.xml") returned -1
	[0048.353] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1
	[0048.353] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned="eula.rtf"
	[0048.353] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1038\\" | out: lpString1="C:\\588bce7c90097ed212\\1038\\") returned="C:\\588bce7c90097ed212\\1038\\"
	[0048.354] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1038\\" | out: pszPath="C:\\588bce7c90097ed212\\1038\\") returned=""
	[0048.354] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1038\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1038\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1038\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.354] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1038\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1038\\how-to-decrypt-files.htm")) returned 0x20
	[0048.354] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1038\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml"
	[0048.354] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.zip") returned 0
	[0048.354] lstrlenA (lpString="*.zip") returned 5
	[0048.354] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.rar") returned 0
	[0048.354] lstrlenA (lpString="*.rar") returned 5
	[0048.354] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.7z") returned 0
	[0048.354] lstrlenA (lpString="*.7z") returned 4
	[0048.354] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.tar") returned 0
	[0048.354] lstrlenA (lpString="*.tar") returned 5
	[0048.354] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.gzip") returned 0
	[0048.354] lstrlenA (lpString="*.gzip") returned 6
	[0048.354] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.jpg") returned 0
	[0048.354] lstrlenA (lpString="*.jpg") returned 5
	[0048.354] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.jpeg") returned 0
	[0048.354] lstrlenA (lpString="*.jpeg") returned 6
	[0048.354] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.bmp") returned 0
	[0048.354] lstrlenA (lpString="*.bmp") returned 5
	[0048.354] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.gif") returned 0
	[0048.354] lstrlenA (lpString="*.gif") returned 5
	[0048.354] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.png") returned 0
	[0048.354] lstrlenA (lpString="*.png") returned 5
	[0048.354] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.doc") returned 0
	[0048.354] lstrlenA (lpString="*.doc") returned 5
	[0048.354] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.docx") returned 0
	[0048.354] lstrlenA (lpString="*.docx") returned 6
	[0048.354] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.xls") returned 0
	[0048.354] lstrlenA (lpString="*.xls") returned 5
	[0048.354] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.xlsx") returned 0
	[0048.354] lstrlenA (lpString="*.xlsx") returned 6
	[0048.355] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.ppt") returned 0
	[0048.355] lstrlenA (lpString="*.ppt") returned 5
	[0048.355] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.pptx") returned 0
	[0048.355] lstrlenA (lpString="*.pptx") returned 6
	[0048.355] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.txt") returned 0
	[0048.355] lstrlenA (lpString="*.txt") returned 5
	[0048.355] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.pdf") returned 0
	[0048.355] lstrlenA (lpString="*.pdf") returned 5
	[0048.355] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.htm") returned 0
	[0048.355] lstrlenA (lpString="*.htm") returned 5
	[0048.355] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.html") returned 0
	[0048.355] lstrlenA (lpString="*.html") returned 6
	[0048.355] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.mdb") returned 0
	[0048.355] lstrlenA (lpString="*.mdb") returned 5
	[0048.355] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.pfx") returned 0
	[0048.355] lstrlenA (lpString="*.pfx") returned 5
	[0048.355] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.md") returned 0
	[0048.355] lstrlenA (lpString="*.md") returned 4
	[0048.355] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.lnk") returned 0
	[0048.355] lstrlenA (lpString="*.lnk") returned 5
	[0048.355] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.torrent") returned 0
	[0048.355] lstrlenA (lpString="*.torrent") returned 9
	[0048.355] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.mov") returned 0
	[0048.355] lstrlenA (lpString="*.mov") returned 5
	[0048.355] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.3gp") returned 0
	[0048.355] lstrlenA (lpString="*.3gp") returned 5
	[0048.355] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.mpeg") returned 0
	[0048.355] lstrlenA (lpString="*.mpeg") returned 6
	[0048.355] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.mpg") returned 0
	[0048.355] lstrlenA (lpString="*.mpg") returned 5
	[0048.355] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.flv") returned 0
	[0048.355] lstrlenA (lpString="*.flv") returned 5
	[0048.355] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.avi") returned 0
	[0048.355] lstrlenA (lpString="*.avi") returned 5
	[0048.355] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.mp4") returned 0
	[0048.355] lstrlenA (lpString="*.mp4") returned 5
	[0048.355] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.wmv") returned 0
	[0048.356] lstrlenA (lpString="*.wmv") returned 5
	[0048.356] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.mkv") returned 0
	[0048.356] lstrlenA (lpString="*.mkv") returned 5
	[0048.356] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.mp3") returned 0
	[0048.356] lstrlenA (lpString="*.mp3") returned 5
	[0048.356] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.wav") returned 0
	[0048.356] lstrlenA (lpString="*.wav") returned 5
	[0048.356] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.flac") returned 0
	[0048.356] lstrlenA (lpString="*.flac") returned 6
	[0048.356] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.wma") returned 0
	[0048.356] lstrlenA (lpString="*.wma") returned 5
	[0048.356] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.au3") returned 0
	[0048.356] lstrlenA (lpString="*.au3") returned 5
	[0048.356] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.ahk") returned 0
	[0048.356] lstrlenA (lpString="*.ahk") returned 5
	[0048.356] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.c") returned 0
	[0048.356] lstrlenA (lpString="*.c") returned 3
	[0048.356] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.cc") returned 0
	[0048.356] lstrlenA (lpString="*.cc") returned 4
	[0048.356] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.cpp") returned 0
	[0048.356] lstrlenA (lpString="*.cpp") returned 5
	[0048.356] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.cxx") returned 0
	[0048.356] lstrlenA (lpString="*.cxx") returned 5
	[0048.356] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.c++") returned 0
	[0048.356] lstrlenA (lpString="*.c++") returned 5
	[0048.356] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.cs") returned 0
	[0048.356] lstrlenA (lpString="*.cs") returned 4
	[0048.356] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.vb") returned 0
	[0048.356] lstrlenA (lpString="*.vb") returned 4
	[0048.356] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.bas") returned 0
	[0048.356] lstrlenA (lpString="*.bas") returned 5
	[0048.356] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.csproj") returned 0
	[0048.356] lstrlenA (lpString="*.csproj") returned 8
	[0048.356] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.vbproj") returned 0
	[0048.356] lstrlenA (lpString="*.vbproj") returned 8
	[0048.356] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.vcxproj") returned 0
	[0048.356] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.357] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.manifest") returned 0
	[0048.357] lstrlenA (lpString="*.manifest") returned 10
	[0048.357] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.php") returned 0
	[0048.357] lstrlenA (lpString="*.php") returned 5
	[0048.357] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.vbe") returned 0
	[0048.357] lstrlenA (lpString="*.vbe") returned 5
	[0048.357] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.vba") returned 0
	[0048.357] lstrlenA (lpString="*.vba") returned 5
	[0048.357] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.vbs") returned 0
	[0048.357] lstrlenA (lpString="*.vbs") returned 5
	[0048.357] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.bat") returned 0
	[0048.357] lstrlenA (lpString="*.bat") returned 5
	[0048.357] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.cmd") returned 0
	[0048.357] lstrlenA (lpString="*.cmd") returned 5
	[0048.357] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.js") returned 0
	[0048.357] lstrlenA (lpString="*.js") returned 4
	[0048.357] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.jscript") returned 0
	[0048.357] lstrlenA (lpString="*.jscript") returned 9
	[0048.357] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.hta") returned 0
	[0048.357] lstrlenA (lpString="*.hta") returned 5
	[0048.357] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.php7") returned 0
	[0048.357] lstrlenA (lpString="*.php7") returned 6
	[0048.357] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.db") returned 0
	[0048.357] lstrlenA (lpString="*.db") returned 4
	[0048.357] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.swf") returned 0
	[0048.357] lstrlenA (lpString="*.swf") returned 5
	[0048.357] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.eml") returned 0
	[0048.357] lstrlenA (lpString="*.eml") returned 5
	[0048.357] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.part") returned 0
	[0048.357] lstrlenA (lpString="*.part") returned 6
	[0048.357] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.nfo") returned 0
	[0048.357] lstrlenA (lpString="*.nfo") returned 5
	[0048.357] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.rsa") returned 0
	[0048.357] lstrlenA (lpString="*.rsa") returned 5
	[0048.357] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.key") returned 0
	[0048.357] lstrlenA (lpString="*.key") returned 5
	[0048.358] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.aes") returned 0
	[0048.358] lstrlenA (lpString="*.aes") returned 5
	[0048.358] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.blob") returned 0
	[0048.358] lstrlenA (lpString="*.blob") returned 6
	[0048.358] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.btc") returned 0
	[0048.358] lstrlenA (lpString="*.btc") returned 5
	[0048.358] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.wallet") returned 0
	[0048.358] lstrlenA (lpString="*.wallet") returned 8
	[0048.358] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0048.358] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.358] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SetupResources.dll") returned -1
	[0048.358] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SetupResources.dll") returned -1
	[0048.358] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1
	[0048.358] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned="LocalizedData.xml"
	[0048.358] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1038\\" | out: lpString1="C:\\588bce7c90097ed212\\1038\\") returned="C:\\588bce7c90097ed212\\1038\\"
	[0048.358] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1038\\" | out: pszPath="C:\\588bce7c90097ed212\\1038\\") returned=""
	[0048.358] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1038\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1038\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1038\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.358] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1038\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1038\\how-to-decrypt-files.htm")) returned 0x20
	[0048.358] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1038\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1038\\SetupResources.dll"
	[0048.358] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.zip") returned 0
	[0048.358] lstrlenA (lpString="*.zip") returned 5
	[0048.358] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.rar") returned 0
	[0048.358] lstrlenA (lpString="*.rar") returned 5
	[0048.358] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.7z") returned 0
	[0048.358] lstrlenA (lpString="*.7z") returned 4
	[0048.358] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.tar") returned 0
	[0048.358] lstrlenA (lpString="*.tar") returned 5
	[0048.358] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.gzip") returned 0
	[0048.358] lstrlenA (lpString="*.gzip") returned 6
	[0048.358] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.jpg") returned 0
	[0048.358] lstrlenA (lpString="*.jpg") returned 5
	[0048.358] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.jpeg") returned 0
	[0048.359] lstrlenA (lpString="*.jpeg") returned 6
	[0048.359] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.bmp") returned 0
	[0048.359] lstrlenA (lpString="*.bmp") returned 5
	[0048.359] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.gif") returned 0
	[0048.359] lstrlenA (lpString="*.gif") returned 5
	[0048.359] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.png") returned 0
	[0048.359] lstrlenA (lpString="*.png") returned 5
	[0048.359] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.doc") returned 0
	[0048.359] lstrlenA (lpString="*.doc") returned 5
	[0048.359] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.docx") returned 0
	[0048.359] lstrlenA (lpString="*.docx") returned 6
	[0048.359] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.xls") returned 0
	[0048.359] lstrlenA (lpString="*.xls") returned 5
	[0048.359] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.xlsx") returned 0
	[0048.359] lstrlenA (lpString="*.xlsx") returned 6
	[0048.359] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.ppt") returned 0
	[0048.359] lstrlenA (lpString="*.ppt") returned 5
	[0048.359] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.pptx") returned 0
	[0048.359] lstrlenA (lpString="*.pptx") returned 6
	[0048.359] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.txt") returned 0
	[0048.359] lstrlenA (lpString="*.txt") returned 5
	[0048.359] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.pdf") returned 0
	[0048.359] lstrlenA (lpString="*.pdf") returned 5
	[0048.359] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.htm") returned 0
	[0048.359] lstrlenA (lpString="*.htm") returned 5
	[0048.359] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.html") returned 0
	[0048.359] lstrlenA (lpString="*.html") returned 6
	[0048.359] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.mdb") returned 0
	[0048.359] lstrlenA (lpString="*.mdb") returned 5
	[0048.359] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.pfx") returned 0
	[0048.359] lstrlenA (lpString="*.pfx") returned 5
	[0048.359] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.md") returned 0
	[0048.359] lstrlenA (lpString="*.md") returned 4
	[0048.359] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.lnk") returned 0
	[0048.359] lstrlenA (lpString="*.lnk") returned 5
	[0048.359] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.torrent") returned 0
	[0048.359] lstrlenA (lpString="*.torrent") returned 9
	[0048.360] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.mov") returned 0
	[0048.360] lstrlenA (lpString="*.mov") returned 5
	[0048.360] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.3gp") returned 0
	[0048.360] lstrlenA (lpString="*.3gp") returned 5
	[0048.360] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.mpeg") returned 0
	[0048.360] lstrlenA (lpString="*.mpeg") returned 6
	[0048.360] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.mpg") returned 0
	[0048.360] lstrlenA (lpString="*.mpg") returned 5
	[0048.360] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.flv") returned 0
	[0048.360] lstrlenA (lpString="*.flv") returned 5
	[0048.360] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.avi") returned 0
	[0048.360] lstrlenA (lpString="*.avi") returned 5
	[0048.360] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.mp4") returned 0
	[0048.360] lstrlenA (lpString="*.mp4") returned 5
	[0048.360] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.wmv") returned 0
	[0048.360] lstrlenA (lpString="*.wmv") returned 5
	[0048.360] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.mkv") returned 0
	[0048.360] lstrlenA (lpString="*.mkv") returned 5
	[0048.360] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.mp3") returned 0
	[0048.360] lstrlenA (lpString="*.mp3") returned 5
	[0048.360] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.wav") returned 0
	[0048.360] lstrlenA (lpString="*.wav") returned 5
	[0048.360] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.flac") returned 0
	[0048.360] lstrlenA (lpString="*.flac") returned 6
	[0048.360] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.wma") returned 0
	[0048.360] lstrlenA (lpString="*.wma") returned 5
	[0048.360] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.au3") returned 0
	[0048.361] lstrlenA (lpString="*.au3") returned 5
	[0048.361] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.ahk") returned 0
	[0048.361] lstrlenA (lpString="*.ahk") returned 5
	[0048.361] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.c") returned 0
	[0048.361] lstrlenA (lpString="*.c") returned 3
	[0048.361] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.cc") returned 0
	[0048.361] lstrlenA (lpString="*.cc") returned 4
	[0048.361] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.cpp") returned 0
	[0048.361] lstrlenA (lpString="*.cpp") returned 5
	[0048.361] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.cxx") returned 0
	[0048.361] lstrlenA (lpString="*.cxx") returned 5
	[0048.361] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.c++") returned 0
	[0048.361] lstrlenA (lpString="*.c++") returned 5
	[0048.361] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.cs") returned 0
	[0048.361] lstrlenA (lpString="*.cs") returned 4
	[0048.361] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.vb") returned 0
	[0048.361] lstrlenA (lpString="*.vb") returned 4
	[0048.361] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.bas") returned 0
	[0048.361] lstrlenA (lpString="*.bas") returned 5
	[0048.361] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.csproj") returned 0
	[0048.361] lstrlenA (lpString="*.csproj") returned 8
	[0048.361] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.vbproj") returned 0
	[0048.361] lstrlenA (lpString="*.vbproj") returned 8
	[0048.361] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.vcxproj") returned 0
	[0048.361] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.361] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.manifest") returned 0
	[0048.361] lstrlenA (lpString="*.manifest") returned 10
	[0048.361] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.php") returned 0
	[0048.361] lstrlenA (lpString="*.php") returned 5
	[0048.361] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.vbe") returned 0
	[0048.361] lstrlenA (lpString="*.vbe") returned 5
	[0048.361] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.vba") returned 0
	[0048.361] lstrlenA (lpString="*.vba") returned 5
	[0048.361] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.vbs") returned 0
	[0048.361] lstrlenA (lpString="*.vbs") returned 5
	[0048.361] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.bat") returned 0
	[0048.361] lstrlenA (lpString="*.bat") returned 5
	[0048.362] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.cmd") returned 0
	[0048.362] lstrlenA (lpString="*.cmd") returned 5
	[0048.362] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.js") returned 0
	[0048.362] lstrlenA (lpString="*.js") returned 4
	[0048.362] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.jscript") returned 0
	[0048.362] lstrlenA (lpString="*.jscript") returned 9
	[0048.362] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.hta") returned 0
	[0048.362] lstrlenA (lpString="*.hta") returned 5
	[0048.362] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.php7") returned 0
	[0048.362] lstrlenA (lpString="*.php7") returned 6
	[0048.362] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.db") returned 0
	[0048.362] lstrlenA (lpString="*.db") returned 4
	[0048.362] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.swf") returned 0
	[0048.362] lstrlenA (lpString="*.swf") returned 5
	[0048.362] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.eml") returned 0
	[0048.362] lstrlenA (lpString="*.eml") returned 5
	[0048.362] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.part") returned 0
	[0048.362] lstrlenA (lpString="*.part") returned 6
	[0048.362] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.nfo") returned 0
	[0048.362] lstrlenA (lpString="*.nfo") returned 5
	[0048.362] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.rsa") returned 0
	[0048.362] lstrlenA (lpString="*.rsa") returned 5
	[0048.362] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.key") returned 0
	[0048.362] lstrlenA (lpString="*.key") returned 5
	[0048.362] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.aes") returned 0
	[0048.362] lstrlenA (lpString="*.aes") returned 5
	[0048.362] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.blob") returned 0
	[0048.362] lstrlenA (lpString="*.blob") returned 6
	[0048.362] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.btc") returned 0
	[0048.362] lstrlenA (lpString="*.btc") returned 5
	[0048.362] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.wallet") returned 0
	[0048.362] lstrlenA (lpString="*.wallet") returned 8
	[0048.362] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0048.362] FindClose (in: hFindFile=0x7cb590 | out: hFindFile=0x7cb590) returned 1
	[0048.363] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d1d40, dwReserved1=0x7b00c0, cFileName="1040", cAlternateFileName="")) returned 1
	[0048.363] lstrcmpA (lpString1=".", lpString2="1040") returned -1
	[0048.363] lstrcmpA (lpString1="..", lpString2="1040") returned -1
	[0048.363] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*"
	[0048.363] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1040" | out: lpString1="C:\\588bce7c90097ed212\\1040") returned="C:\\588bce7c90097ed212\\1040"
	[0048.363] lstrlenA (lpString="C:\\588bce7c90097ed212\\1040") returned 26
	[0048.363] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890
	[0048.364] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0048.364] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0048.364] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0048.364] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0048.364] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0048.364] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.364] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="eula.rtf") returned -1
	[0048.364] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="eula.rtf") returned 1
	[0048.364] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1
	[0048.364] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1040\\*.*") returned="*.*"
	[0048.364] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1040\\" | out: lpString1="C:\\588bce7c90097ed212\\1040\\") returned="C:\\588bce7c90097ed212\\1040\\"
	[0048.364] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1040\\" | out: pszPath="C:\\588bce7c90097ed212\\1040\\") returned=""
	[0048.364] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1040\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1040\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1040\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.364] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1040\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1040\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0048.364] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1040\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1040\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0048.367] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0048.367] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0048.367] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0048.368] CloseHandle (hObject=0x208) returned 1
	[0048.368] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1040\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned="C:\\588bce7c90097ed212\\1040\\eula.rtf"
	[0048.368] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.zip") returned 0
	[0048.368] lstrlenA (lpString="*.zip") returned 5
	[0048.368] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.rar") returned 0
	[0048.368] lstrlenA (lpString="*.rar") returned 5
	[0048.368] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.7z") returned 0
	[0048.368] lstrlenA (lpString="*.7z") returned 4
	[0048.369] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.tar") returned 0
	[0048.369] lstrlenA (lpString="*.tar") returned 5
	[0048.369] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.gzip") returned 0
	[0048.369] lstrlenA (lpString="*.gzip") returned 6
	[0048.369] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.jpg") returned 0
	[0048.369] lstrlenA (lpString="*.jpg") returned 5
	[0048.369] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.jpeg") returned 0
	[0048.369] lstrlenA (lpString="*.jpeg") returned 6
	[0048.369] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.bmp") returned 0
	[0048.369] lstrlenA (lpString="*.bmp") returned 5
	[0048.369] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.gif") returned 0
	[0048.369] lstrlenA (lpString="*.gif") returned 5
	[0048.369] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.png") returned 0
	[0048.369] lstrlenA (lpString="*.png") returned 5
	[0048.369] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.doc") returned 0
	[0048.369] lstrlenA (lpString="*.doc") returned 5
	[0048.369] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.docx") returned 0
	[0048.369] lstrlenA (lpString="*.docx") returned 6
	[0048.369] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.xls") returned 0
	[0048.369] lstrlenA (lpString="*.xls") returned 5
	[0048.369] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.xlsx") returned 0
	[0048.369] lstrlenA (lpString="*.xlsx") returned 6
	[0048.369] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.ppt") returned 0
	[0048.369] lstrlenA (lpString="*.ppt") returned 5
	[0048.369] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.pptx") returned 0
	[0048.369] lstrlenA (lpString="*.pptx") returned 6
	[0048.369] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.txt") returned 0
	[0048.369] lstrlenA (lpString="*.txt") returned 5
	[0048.369] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.pdf") returned 0
	[0048.369] lstrlenA (lpString="*.pdf") returned 5
	[0048.369] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.htm") returned 0
	[0048.369] lstrlenA (lpString="*.htm") returned 5
	[0048.369] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.html") returned 0
	[0048.369] lstrlenA (lpString="*.html") returned 6
	[0048.369] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.mdb") returned 0
	[0048.369] lstrlenA (lpString="*.mdb") returned 5
	[0048.370] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.pfx") returned 0
	[0048.370] lstrlenA (lpString="*.pfx") returned 5
	[0048.370] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.md") returned 0
	[0048.370] lstrlenA (lpString="*.md") returned 4
	[0048.370] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.lnk") returned 0
	[0048.370] lstrlenA (lpString="*.lnk") returned 5
	[0048.370] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.torrent") returned 0
	[0048.370] lstrlenA (lpString="*.torrent") returned 9
	[0048.370] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.mov") returned 0
	[0048.370] lstrlenA (lpString="*.mov") returned 5
	[0048.370] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.3gp") returned 0
	[0048.370] lstrlenA (lpString="*.3gp") returned 5
	[0048.370] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.mpeg") returned 0
	[0048.370] lstrlenA (lpString="*.mpeg") returned 6
	[0048.370] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.mpg") returned 0
	[0048.370] lstrlenA (lpString="*.mpg") returned 5
	[0048.370] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.flv") returned 0
	[0048.370] lstrlenA (lpString="*.flv") returned 5
	[0048.370] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.avi") returned 0
	[0048.370] lstrlenA (lpString="*.avi") returned 5
	[0048.370] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.mp4") returned 0
	[0048.370] lstrlenA (lpString="*.mp4") returned 5
	[0048.370] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.wmv") returned 0
	[0048.370] lstrlenA (lpString="*.wmv") returned 5
	[0048.370] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.mkv") returned 0
	[0048.370] lstrlenA (lpString="*.mkv") returned 5
	[0048.370] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.mp3") returned 0
	[0048.370] lstrlenA (lpString="*.mp3") returned 5
	[0048.370] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.wav") returned 0
	[0048.370] lstrlenA (lpString="*.wav") returned 5
	[0048.370] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.flac") returned 0
	[0048.370] lstrlenA (lpString="*.flac") returned 6
	[0048.370] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.wma") returned 0
	[0048.370] lstrlenA (lpString="*.wma") returned 5
	[0048.370] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.au3") returned 0
	[0048.371] lstrlenA (lpString="*.au3") returned 5
	[0048.371] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.ahk") returned 0
	[0048.371] lstrlenA (lpString="*.ahk") returned 5
	[0048.371] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.c") returned 0
	[0048.371] lstrlenA (lpString="*.c") returned 3
	[0048.371] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.cc") returned 0
	[0048.371] lstrlenA (lpString="*.cc") returned 4
	[0048.371] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.cpp") returned 0
	[0048.371] lstrlenA (lpString="*.cpp") returned 5
	[0048.371] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.cxx") returned 0
	[0048.371] lstrlenA (lpString="*.cxx") returned 5
	[0048.371] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.c++") returned 0
	[0048.371] lstrlenA (lpString="*.c++") returned 5
	[0048.371] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.cs") returned 0
	[0048.371] lstrlenA (lpString="*.cs") returned 4
	[0048.371] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.vb") returned 0
	[0048.371] lstrlenA (lpString="*.vb") returned 4
	[0048.371] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.bas") returned 0
	[0048.371] lstrlenA (lpString="*.bas") returned 5
	[0048.371] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.csproj") returned 0
	[0048.371] lstrlenA (lpString="*.csproj") returned 8
	[0048.371] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.vbproj") returned 0
	[0048.371] lstrlenA (lpString="*.vbproj") returned 8
	[0048.371] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.vcxproj") returned 0
	[0048.371] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.371] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.manifest") returned 0
	[0048.371] lstrlenA (lpString="*.manifest") returned 10
	[0048.371] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.php") returned 0
	[0048.371] lstrlenA (lpString="*.php") returned 5
	[0048.371] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.vbe") returned 0
	[0048.371] lstrlenA (lpString="*.vbe") returned 5
	[0048.371] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.vba") returned 0
	[0048.371] lstrlenA (lpString="*.vba") returned 5
	[0048.371] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.vbs") returned 0
	[0048.371] lstrlenA (lpString="*.vbs") returned 5
	[0048.371] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.bat") returned 0
	[0048.371] lstrlenA (lpString="*.bat") returned 5
	[0048.371] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.cmd") returned 0
	[0048.372] lstrlenA (lpString="*.cmd") returned 5
	[0048.372] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.js") returned 0
	[0048.372] lstrlenA (lpString="*.js") returned 4
	[0048.372] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.jscript") returned 0
	[0048.372] lstrlenA (lpString="*.jscript") returned 9
	[0048.372] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.hta") returned 0
	[0048.372] lstrlenA (lpString="*.hta") returned 5
	[0048.372] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.php7") returned 0
	[0048.372] lstrlenA (lpString="*.php7") returned 6
	[0048.372] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.db") returned 0
	[0048.372] lstrlenA (lpString="*.db") returned 4
	[0048.372] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.swf") returned 0
	[0048.372] lstrlenA (lpString="*.swf") returned 5
	[0048.372] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.eml") returned 0
	[0048.372] lstrlenA (lpString="*.eml") returned 5
	[0048.372] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.part") returned 0
	[0048.372] lstrlenA (lpString="*.part") returned 6
	[0048.372] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.nfo") returned 0
	[0048.372] lstrlenA (lpString="*.nfo") returned 5
	[0048.372] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.rsa") returned 0
	[0048.372] lstrlenA (lpString="*.rsa") returned 5
	[0048.372] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.key") returned 0
	[0048.372] lstrlenA (lpString="*.key") returned 5
	[0048.372] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.aes") returned 0
	[0048.372] lstrlenA (lpString="*.aes") returned 5
	[0048.372] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.blob") returned 0
	[0048.372] lstrlenA (lpString="*.blob") returned 6
	[0048.372] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.btc") returned 0
	[0048.372] lstrlenA (lpString="*.btc") returned 5
	[0048.372] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.wallet") returned 0
	[0048.372] lstrlenA (lpString="*.wallet") returned 8
	[0048.372] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0048.372] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.372] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="LocalizedData.xml") returned -1
	[0048.372] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="LocalizedData.xml") returned -1
	[0048.372] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1
	[0048.373] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned="eula.rtf"
	[0048.373] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1040\\" | out: lpString1="C:\\588bce7c90097ed212\\1040\\") returned="C:\\588bce7c90097ed212\\1040\\"
	[0048.373] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1040\\" | out: pszPath="C:\\588bce7c90097ed212\\1040\\") returned=""
	[0048.373] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1040\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1040\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1040\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.373] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1040\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1040\\how-to-decrypt-files.htm")) returned 0x20
	[0048.373] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1040\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml"
	[0048.373] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.zip") returned 0
	[0048.373] lstrlenA (lpString="*.zip") returned 5
	[0048.373] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.rar") returned 0
	[0048.373] lstrlenA (lpString="*.rar") returned 5
	[0048.373] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.7z") returned 0
	[0048.373] lstrlenA (lpString="*.7z") returned 4
	[0048.373] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.tar") returned 0
	[0048.373] lstrlenA (lpString="*.tar") returned 5
	[0048.373] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.gzip") returned 0
	[0048.373] lstrlenA (lpString="*.gzip") returned 6
	[0048.373] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.jpg") returned 0
	[0048.373] lstrlenA (lpString="*.jpg") returned 5
	[0048.373] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.jpeg") returned 0
	[0048.373] lstrlenA (lpString="*.jpeg") returned 6
	[0048.373] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.bmp") returned 0
	[0048.373] lstrlenA (lpString="*.bmp") returned 5
	[0048.373] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.gif") returned 0
	[0048.373] lstrlenA (lpString="*.gif") returned 5
	[0048.373] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.png") returned 0
	[0048.373] lstrlenA (lpString="*.png") returned 5
	[0048.373] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.doc") returned 0
	[0048.373] lstrlenA (lpString="*.doc") returned 5
	[0048.373] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.docx") returned 0
	[0048.373] lstrlenA (lpString="*.docx") returned 6
	[0048.373] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.xls") returned 0
	[0048.373] lstrlenA (lpString="*.xls") returned 5
	[0048.373] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.xlsx") returned 0
	[0048.374] lstrlenA (lpString="*.xlsx") returned 6
	[0048.374] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.ppt") returned 0
	[0048.374] lstrlenA (lpString="*.ppt") returned 5
	[0048.374] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.pptx") returned 0
	[0048.374] lstrlenA (lpString="*.pptx") returned 6
	[0048.374] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.txt") returned 0
	[0048.374] lstrlenA (lpString="*.txt") returned 5
	[0048.374] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.pdf") returned 0
	[0048.374] lstrlenA (lpString="*.pdf") returned 5
	[0048.374] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.htm") returned 0
	[0048.374] lstrlenA (lpString="*.htm") returned 5
	[0048.374] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.html") returned 0
	[0048.374] lstrlenA (lpString="*.html") returned 6
	[0048.374] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.mdb") returned 0
	[0048.374] lstrlenA (lpString="*.mdb") returned 5
	[0048.374] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.pfx") returned 0
	[0048.374] lstrlenA (lpString="*.pfx") returned 5
	[0048.374] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.md") returned 0
	[0048.374] lstrlenA (lpString="*.md") returned 4
	[0048.374] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.lnk") returned 0
	[0048.374] lstrlenA (lpString="*.lnk") returned 5
	[0048.374] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.torrent") returned 0
	[0048.374] lstrlenA (lpString="*.torrent") returned 9
	[0048.374] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.mov") returned 0
	[0048.374] lstrlenA (lpString="*.mov") returned 5
	[0048.374] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.3gp") returned 0
	[0048.374] lstrlenA (lpString="*.3gp") returned 5
	[0048.374] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.mpeg") returned 0
	[0048.374] lstrlenA (lpString="*.mpeg") returned 6
	[0048.374] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.mpg") returned 0
	[0048.374] lstrlenA (lpString="*.mpg") returned 5
	[0048.374] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.flv") returned 0
	[0048.374] lstrlenA (lpString="*.flv") returned 5
	[0048.374] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.avi") returned 0
	[0048.374] lstrlenA (lpString="*.avi") returned 5
	[0048.375] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.mp4") returned 0
	[0048.375] lstrlenA (lpString="*.mp4") returned 5
	[0048.375] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.wmv") returned 0
	[0048.375] lstrlenA (lpString="*.wmv") returned 5
	[0048.375] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.mkv") returned 0
	[0048.375] lstrlenA (lpString="*.mkv") returned 5
	[0048.375] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.mp3") returned 0
	[0048.375] lstrlenA (lpString="*.mp3") returned 5
	[0048.375] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.wav") returned 0
	[0048.375] lstrlenA (lpString="*.wav") returned 5
	[0048.375] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.flac") returned 0
	[0048.375] lstrlenA (lpString="*.flac") returned 6
	[0048.375] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.wma") returned 0
	[0048.375] lstrlenA (lpString="*.wma") returned 5
	[0048.375] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.au3") returned 0
	[0048.375] lstrlenA (lpString="*.au3") returned 5
	[0048.375] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.ahk") returned 0
	[0048.375] lstrlenA (lpString="*.ahk") returned 5
	[0048.375] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.c") returned 0
	[0048.375] lstrlenA (lpString="*.c") returned 3
	[0048.375] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.cc") returned 0
	[0048.375] lstrlenA (lpString="*.cc") returned 4
	[0048.375] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.cpp") returned 0
	[0048.375] lstrlenA (lpString="*.cpp") returned 5
	[0048.375] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.cxx") returned 0
	[0048.375] lstrlenA (lpString="*.cxx") returned 5
	[0048.375] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.c++") returned 0
	[0048.375] lstrlenA (lpString="*.c++") returned 5
	[0048.375] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.cs") returned 0
	[0048.375] lstrlenA (lpString="*.cs") returned 4
	[0048.375] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.vb") returned 0
	[0048.375] lstrlenA (lpString="*.vb") returned 4
	[0048.375] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.bas") returned 0
	[0048.375] lstrlenA (lpString="*.bas") returned 5
	[0048.375] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.csproj") returned 0
	[0048.375] lstrlenA (lpString="*.csproj") returned 8
	[0048.376] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.vbproj") returned 0
	[0048.376] lstrlenA (lpString="*.vbproj") returned 8
	[0048.376] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.vcxproj") returned 0
	[0048.376] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.376] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.manifest") returned 0
	[0048.376] lstrlenA (lpString="*.manifest") returned 10
	[0048.376] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.php") returned 0
	[0048.376] lstrlenA (lpString="*.php") returned 5
	[0048.376] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.vbe") returned 0
	[0048.376] lstrlenA (lpString="*.vbe") returned 5
	[0048.376] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.vba") returned 0
	[0048.376] lstrlenA (lpString="*.vba") returned 5
	[0048.376] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.vbs") returned 0
	[0048.376] lstrlenA (lpString="*.vbs") returned 5
	[0048.376] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.bat") returned 0
	[0048.376] lstrlenA (lpString="*.bat") returned 5
	[0048.376] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.cmd") returned 0
	[0048.376] lstrlenA (lpString="*.cmd") returned 5
	[0048.376] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.js") returned 0
	[0048.376] lstrlenA (lpString="*.js") returned 4
	[0048.376] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.jscript") returned 0
	[0048.376] lstrlenA (lpString="*.jscript") returned 9
	[0048.376] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.hta") returned 0
	[0048.376] lstrlenA (lpString="*.hta") returned 5
	[0048.376] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.php7") returned 0
	[0048.376] lstrlenA (lpString="*.php7") returned 6
	[0048.376] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.db") returned 0
	[0048.376] lstrlenA (lpString="*.db") returned 4
	[0048.376] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.swf") returned 0
	[0048.376] lstrlenA (lpString="*.swf") returned 5
	[0048.376] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.eml") returned 0
	[0048.376] lstrlenA (lpString="*.eml") returned 5
	[0048.376] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.part") returned 0
	[0048.376] lstrlenA (lpString="*.part") returned 6
	[0048.376] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.nfo") returned 0
	[0048.376] lstrlenA (lpString="*.nfo") returned 5
	[0048.376] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.rsa") returned 0
	[0048.376] lstrlenA (lpString="*.rsa") returned 5
	[0048.377] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.key") returned 0
	[0048.377] lstrlenA (lpString="*.key") returned 5
	[0048.377] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.aes") returned 0
	[0048.377] lstrlenA (lpString="*.aes") returned 5
	[0048.377] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.blob") returned 0
	[0048.377] lstrlenA (lpString="*.blob") returned 6
	[0048.377] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.btc") returned 0
	[0048.377] lstrlenA (lpString="*.btc") returned 5
	[0048.377] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.wallet") returned 0
	[0048.377] lstrlenA (lpString="*.wallet") returned 8
	[0048.377] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0048.377] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.377] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SetupResources.dll") returned -1
	[0048.377] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SetupResources.dll") returned -1
	[0048.377] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1
	[0048.377] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned="LocalizedData.xml"
	[0048.377] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1040\\" | out: lpString1="C:\\588bce7c90097ed212\\1040\\") returned="C:\\588bce7c90097ed212\\1040\\"
	[0048.377] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1040\\" | out: pszPath="C:\\588bce7c90097ed212\\1040\\") returned=""
	[0048.377] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1040\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1040\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1040\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.377] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1040\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1040\\how-to-decrypt-files.htm")) returned 0x20
	[0048.377] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1040\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1040\\SetupResources.dll"
	[0048.377] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.zip") returned 0
	[0048.377] lstrlenA (lpString="*.zip") returned 5
	[0048.377] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.rar") returned 0
	[0048.377] lstrlenA (lpString="*.rar") returned 5
	[0048.377] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.7z") returned 0
	[0048.377] lstrlenA (lpString="*.7z") returned 4
	[0048.377] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.tar") returned 0
	[0048.377] lstrlenA (lpString="*.tar") returned 5
	[0048.377] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.gzip") returned 0
	[0048.377] lstrlenA (lpString="*.gzip") returned 6
	[0048.377] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.jpg") returned 0
	[0048.377] lstrlenA (lpString="*.jpg") returned 5
	[0048.377] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.jpeg") returned 0
	[0048.378] lstrlenA (lpString="*.jpeg") returned 6
	[0048.378] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.bmp") returned 0
	[0048.378] lstrlenA (lpString="*.bmp") returned 5
	[0048.378] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.gif") returned 0
	[0048.378] lstrlenA (lpString="*.gif") returned 5
	[0048.378] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.png") returned 0
	[0048.378] lstrlenA (lpString="*.png") returned 5
	[0048.378] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.doc") returned 0
	[0048.378] lstrlenA (lpString="*.doc") returned 5
	[0048.378] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.docx") returned 0
	[0048.378] lstrlenA (lpString="*.docx") returned 6
	[0048.378] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.xls") returned 0
	[0048.378] lstrlenA (lpString="*.xls") returned 5
	[0048.378] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.xlsx") returned 0
	[0048.378] lstrlenA (lpString="*.xlsx") returned 6
	[0048.378] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.ppt") returned 0
	[0048.378] lstrlenA (lpString="*.ppt") returned 5
	[0048.378] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.pptx") returned 0
	[0048.378] lstrlenA (lpString="*.pptx") returned 6
	[0048.378] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.txt") returned 0
	[0048.378] lstrlenA (lpString="*.txt") returned 5
	[0048.378] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.pdf") returned 0
	[0048.378] lstrlenA (lpString="*.pdf") returned 5
	[0048.378] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.htm") returned 0
	[0048.378] lstrlenA (lpString="*.htm") returned 5
	[0048.378] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.html") returned 0
	[0048.378] lstrlenA (lpString="*.html") returned 6
	[0048.378] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.mdb") returned 0
	[0048.378] lstrlenA (lpString="*.mdb") returned 5
	[0048.378] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.pfx") returned 0
	[0048.378] lstrlenA (lpString="*.pfx") returned 5
	[0048.378] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.md") returned 0
	[0048.378] lstrlenA (lpString="*.md") returned 4
	[0048.378] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.lnk") returned 0
	[0048.379] lstrlenA (lpString="*.lnk") returned 5
	[0048.379] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.torrent") returned 0
	[0048.379] lstrlenA (lpString="*.torrent") returned 9
	[0048.379] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.mov") returned 0
	[0048.379] lstrlenA (lpString="*.mov") returned 5
	[0048.379] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.3gp") returned 0
	[0048.379] lstrlenA (lpString="*.3gp") returned 5
	[0048.379] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.mpeg") returned 0
	[0048.379] lstrlenA (lpString="*.mpeg") returned 6
	[0048.379] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.mpg") returned 0
	[0048.379] lstrlenA (lpString="*.mpg") returned 5
	[0048.379] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.flv") returned 0
	[0048.379] lstrlenA (lpString="*.flv") returned 5
	[0048.379] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.avi") returned 0
	[0048.379] lstrlenA (lpString="*.avi") returned 5
	[0048.379] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.mp4") returned 0
	[0048.379] lstrlenA (lpString="*.mp4") returned 5
	[0048.379] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.wmv") returned 0
	[0048.379] lstrlenA (lpString="*.wmv") returned 5
	[0048.379] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.mkv") returned 0
	[0048.379] lstrlenA (lpString="*.mkv") returned 5
	[0048.379] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.mp3") returned 0
	[0048.379] lstrlenA (lpString="*.mp3") returned 5
	[0048.379] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.wav") returned 0
	[0048.379] lstrlenA (lpString="*.wav") returned 5
	[0048.379] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.flac") returned 0
	[0048.379] lstrlenA (lpString="*.flac") returned 6
	[0048.379] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.wma") returned 0
	[0048.379] lstrlenA (lpString="*.wma") returned 5
	[0048.379] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.au3") returned 0
	[0048.379] lstrlenA (lpString="*.au3") returned 5
	[0048.379] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.ahk") returned 0
	[0048.379] lstrlenA (lpString="*.ahk") returned 5
	[0048.379] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.c") returned 0
	[0048.379] lstrlenA (lpString="*.c") returned 3
	[0048.379] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.cc") returned 0
	[0048.379] lstrlenA (lpString="*.cc") returned 4
	[0048.379] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.cpp") returned 0
	[0048.380] lstrlenA (lpString="*.cpp") returned 5
	[0048.380] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.cxx") returned 0
	[0048.380] lstrlenA (lpString="*.cxx") returned 5
	[0048.380] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.c++") returned 0
	[0048.380] lstrlenA (lpString="*.c++") returned 5
	[0048.380] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.cs") returned 0
	[0048.380] lstrlenA (lpString="*.cs") returned 4
	[0048.380] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.vb") returned 0
	[0048.380] lstrlenA (lpString="*.vb") returned 4
	[0048.380] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.bas") returned 0
	[0048.380] lstrlenA (lpString="*.bas") returned 5
	[0048.380] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.csproj") returned 0
	[0048.380] lstrlenA (lpString="*.csproj") returned 8
	[0048.380] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.vbproj") returned 0
	[0048.380] lstrlenA (lpString="*.vbproj") returned 8
	[0048.380] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.vcxproj") returned 0
	[0048.380] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.380] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.manifest") returned 0
	[0048.380] lstrlenA (lpString="*.manifest") returned 10
	[0048.380] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.php") returned 0
	[0048.380] lstrlenA (lpString="*.php") returned 5
	[0048.380] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.vbe") returned 0
	[0048.380] lstrlenA (lpString="*.vbe") returned 5
	[0048.380] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.vba") returned 0
	[0048.380] lstrlenA (lpString="*.vba") returned 5
	[0048.380] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.vbs") returned 0
	[0048.380] lstrlenA (lpString="*.vbs") returned 5
	[0048.380] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.bat") returned 0
	[0048.380] lstrlenA (lpString="*.bat") returned 5
	[0048.380] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.cmd") returned 0
	[0048.380] lstrlenA (lpString="*.cmd") returned 5
	[0048.380] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.js") returned 0
	[0048.380] lstrlenA (lpString="*.js") returned 4
	[0048.380] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.jscript") returned 0
	[0048.380] lstrlenA (lpString="*.jscript") returned 9
	[0048.380] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.hta") returned 0
	[0048.380] lstrlenA (lpString="*.hta") returned 5
	[0048.381] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.php7") returned 0
	[0048.381] lstrlenA (lpString="*.php7") returned 6
	[0048.381] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.db") returned 0
	[0048.429] lstrlenA (lpString="*.db") returned 4
	[0048.429] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.swf") returned 0
	[0048.429] lstrlenA (lpString="*.swf") returned 5
	[0048.429] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.eml") returned 0
	[0048.429] lstrlenA (lpString="*.eml") returned 5
	[0048.429] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.part") returned 0
	[0048.429] lstrlenA (lpString="*.part") returned 6
	[0048.429] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.nfo") returned 0
	[0048.429] lstrlenA (lpString="*.nfo") returned 5
	[0048.429] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.rsa") returned 0
	[0048.429] lstrlenA (lpString="*.rsa") returned 5
	[0048.429] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.key") returned 0
	[0048.429] lstrlenA (lpString="*.key") returned 5
	[0048.429] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.aes") returned 0
	[0048.429] lstrlenA (lpString="*.aes") returned 5
	[0048.429] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.blob") returned 0
	[0048.429] lstrlenA (lpString="*.blob") returned 6
	[0048.430] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.btc") returned 0
	[0048.430] lstrlenA (lpString="*.btc") returned 5
	[0048.430] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.wallet") returned 0
	[0048.430] lstrlenA (lpString="*.wallet") returned 8
	[0048.430] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0048.430] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1
	[0048.430] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d1d40, dwReserved1=0x7b00c0, cFileName="1041", cAlternateFileName="")) returned 1
	[0048.430] lstrcmpA (lpString1=".", lpString2="1041") returned -1
	[0048.430] lstrcmpA (lpString1="..", lpString2="1041") returned -1
	[0048.430] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*"
	[0048.430] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1041" | out: lpString1="C:\\588bce7c90097ed212\\1041") returned="C:\\588bce7c90097ed212\\1041"
	[0048.430] lstrlenA (lpString="C:\\588bce7c90097ed212\\1041") returned 26
	[0048.430] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb810
	[0048.431] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0048.431] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0048.431] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0048.431] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0048.431] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0048.431] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.431] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="eula.rtf") returned -1
	[0048.431] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="eula.rtf") returned 1
	[0048.431] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1
	[0048.431] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1041\\*.*") returned="*.*"
	[0048.431] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1041\\" | out: lpString1="C:\\588bce7c90097ed212\\1041\\") returned="C:\\588bce7c90097ed212\\1041\\"
	[0048.431] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1041\\" | out: pszPath="C:\\588bce7c90097ed212\\1041\\") returned=""
	[0048.431] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1041\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1041\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1041\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.431] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1041\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1041\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0048.431] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1041\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1041\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0048.433] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0048.433] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0048.434] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0048.434] CloseHandle (hObject=0x208) returned 1
	[0048.434] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1041\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned="C:\\588bce7c90097ed212\\1041\\eula.rtf"
	[0048.434] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.zip") returned 0
	[0048.434] lstrlenA (lpString="*.zip") returned 5
	[0048.434] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.rar") returned 0
	[0048.434] lstrlenA (lpString="*.rar") returned 5
	[0048.434] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.7z") returned 0
	[0048.434] lstrlenA (lpString="*.7z") returned 4
	[0048.434] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.tar") returned 0
	[0048.434] lstrlenA (lpString="*.tar") returned 5
	[0048.434] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.gzip") returned 0
	[0048.434] lstrlenA (lpString="*.gzip") returned 6
	[0048.435] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.jpg") returned 0
	[0048.435] lstrlenA (lpString="*.jpg") returned 5
	[0048.435] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.jpeg") returned 0
	[0048.435] lstrlenA (lpString="*.jpeg") returned 6
	[0048.435] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.bmp") returned 0
	[0048.435] lstrlenA (lpString="*.bmp") returned 5
	[0048.435] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.gif") returned 0
	[0048.435] lstrlenA (lpString="*.gif") returned 5
	[0048.435] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.png") returned 0
	[0048.435] lstrlenA (lpString="*.png") returned 5
	[0048.435] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.doc") returned 0
	[0048.435] lstrlenA (lpString="*.doc") returned 5
	[0048.435] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.docx") returned 0
	[0048.435] lstrlenA (lpString="*.docx") returned 6
	[0048.435] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.xls") returned 0
	[0048.435] lstrlenA (lpString="*.xls") returned 5
	[0048.435] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.xlsx") returned 0
	[0048.435] lstrlenA (lpString="*.xlsx") returned 6
	[0048.435] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.ppt") returned 0
	[0048.435] lstrlenA (lpString="*.ppt") returned 5
	[0048.435] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.pptx") returned 0
	[0048.435] lstrlenA (lpString="*.pptx") returned 6
	[0048.435] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.txt") returned 0
	[0048.435] lstrlenA (lpString="*.txt") returned 5
	[0048.435] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.pdf") returned 0
	[0048.435] lstrlenA (lpString="*.pdf") returned 5
	[0048.435] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.htm") returned 0
	[0048.435] lstrlenA (lpString="*.htm") returned 5
	[0048.435] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.html") returned 0
	[0048.435] lstrlenA (lpString="*.html") returned 6
	[0048.435] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.mdb") returned 0
	[0048.435] lstrlenA (lpString="*.mdb") returned 5
	[0048.435] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.pfx") returned 0
	[0048.435] lstrlenA (lpString="*.pfx") returned 5
	[0048.435] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.md") returned 0
	[0048.435] lstrlenA (lpString="*.md") returned 4
	[0048.435] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.lnk") returned 0
	[0048.436] lstrlenA (lpString="*.lnk") returned 5
	[0048.436] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.torrent") returned 0
	[0048.436] lstrlenA (lpString="*.torrent") returned 9
	[0048.436] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.mov") returned 0
	[0048.436] lstrlenA (lpString="*.mov") returned 5
	[0048.436] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.3gp") returned 0
	[0048.436] lstrlenA (lpString="*.3gp") returned 5
	[0048.436] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.mpeg") returned 0
	[0048.436] lstrlenA (lpString="*.mpeg") returned 6
	[0048.436] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.mpg") returned 0
	[0048.436] lstrlenA (lpString="*.mpg") returned 5
	[0048.436] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.flv") returned 0
	[0048.436] lstrlenA (lpString="*.flv") returned 5
	[0048.436] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.avi") returned 0
	[0048.436] lstrlenA (lpString="*.avi") returned 5
	[0048.436] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.mp4") returned 0
	[0048.436] lstrlenA (lpString="*.mp4") returned 5
	[0048.436] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.wmv") returned 0
	[0048.436] lstrlenA (lpString="*.wmv") returned 5
	[0048.436] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.mkv") returned 0
	[0048.436] lstrlenA (lpString="*.mkv") returned 5
	[0048.436] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.mp3") returned 0
	[0048.436] lstrlenA (lpString="*.mp3") returned 5
	[0048.436] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.wav") returned 0
	[0048.436] lstrlenA (lpString="*.wav") returned 5
	[0048.436] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.flac") returned 0
	[0048.436] lstrlenA (lpString="*.flac") returned 6
	[0048.436] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.wma") returned 0
	[0048.436] lstrlenA (lpString="*.wma") returned 5
	[0048.436] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.au3") returned 0
	[0048.436] lstrlenA (lpString="*.au3") returned 5
	[0048.436] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.ahk") returned 0
	[0048.436] lstrlenA (lpString="*.ahk") returned 5
	[0048.436] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.c") returned 0
	[0048.436] lstrlenA (lpString="*.c") returned 3
	[0048.436] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.cc") returned 0
	[0048.436] lstrlenA (lpString="*.cc") returned 4
	[0048.436] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.cpp") returned 0
	[0048.437] lstrlenA (lpString="*.cpp") returned 5
	[0048.437] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.cxx") returned 0
	[0048.437] lstrlenA (lpString="*.cxx") returned 5
	[0048.437] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.c++") returned 0
	[0048.437] lstrlenA (lpString="*.c++") returned 5
	[0048.437] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.cs") returned 0
	[0048.437] lstrlenA (lpString="*.cs") returned 4
	[0048.437] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.vb") returned 0
	[0048.437] lstrlenA (lpString="*.vb") returned 4
	[0048.437] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.bas") returned 0
	[0048.437] lstrlenA (lpString="*.bas") returned 5
	[0048.437] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.csproj") returned 0
	[0048.437] lstrlenA (lpString="*.csproj") returned 8
	[0048.437] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.vbproj") returned 0
	[0048.437] lstrlenA (lpString="*.vbproj") returned 8
	[0048.437] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.vcxproj") returned 0
	[0048.437] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.437] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.manifest") returned 0
	[0048.437] lstrlenA (lpString="*.manifest") returned 10
	[0048.437] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.php") returned 0
	[0048.437] lstrlenA (lpString="*.php") returned 5
	[0048.437] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.vbe") returned 0
	[0048.437] lstrlenA (lpString="*.vbe") returned 5
	[0048.437] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.vba") returned 0
	[0048.437] lstrlenA (lpString="*.vba") returned 5
	[0048.437] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.vbs") returned 0
	[0048.437] lstrlenA (lpString="*.vbs") returned 5
	[0048.437] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.bat") returned 0
	[0048.437] lstrlenA (lpString="*.bat") returned 5
	[0048.437] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.cmd") returned 0
	[0048.437] lstrlenA (lpString="*.cmd") returned 5
	[0048.437] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.js") returned 0
	[0048.437] lstrlenA (lpString="*.js") returned 4
	[0048.437] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.jscript") returned 0
	[0048.437] lstrlenA (lpString="*.jscript") returned 9
	[0048.437] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.hta") returned 0
	[0048.437] lstrlenA (lpString="*.hta") returned 5
	[0048.437] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.php7") returned 0
	[0048.438] lstrlenA (lpString="*.php7") returned 6
	[0048.438] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.db") returned 0
	[0048.438] lstrlenA (lpString="*.db") returned 4
	[0048.438] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.swf") returned 0
	[0048.438] lstrlenA (lpString="*.swf") returned 5
	[0048.438] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.eml") returned 0
	[0048.438] lstrlenA (lpString="*.eml") returned 5
	[0048.438] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.part") returned 0
	[0048.438] lstrlenA (lpString="*.part") returned 6
	[0048.438] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.nfo") returned 0
	[0048.438] lstrlenA (lpString="*.nfo") returned 5
	[0048.438] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.rsa") returned 0
	[0048.438] lstrlenA (lpString="*.rsa") returned 5
	[0048.438] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.key") returned 0
	[0048.438] lstrlenA (lpString="*.key") returned 5
	[0048.438] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.aes") returned 0
	[0048.438] lstrlenA (lpString="*.aes") returned 5
	[0048.438] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.blob") returned 0
	[0048.438] lstrlenA (lpString="*.blob") returned 6
	[0048.438] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.btc") returned 0
	[0048.438] lstrlenA (lpString="*.btc") returned 5
	[0048.438] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.wallet") returned 0
	[0048.438] lstrlenA (lpString="*.wallet") returned 8
	[0048.438] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0048.438] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.438] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="LocalizedData.xml") returned -1
	[0048.438] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="LocalizedData.xml") returned -1
	[0048.438] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1
	[0048.438] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned="eula.rtf"
	[0048.438] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1041\\" | out: lpString1="C:\\588bce7c90097ed212\\1041\\") returned="C:\\588bce7c90097ed212\\1041\\"
	[0048.438] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1041\\" | out: pszPath="C:\\588bce7c90097ed212\\1041\\") returned=""
	[0048.438] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1041\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1041\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1041\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.438] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1041\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1041\\how-to-decrypt-files.htm")) returned 0x20
	[0048.439] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1041\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml"
	[0048.439] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.zip") returned 0
	[0048.439] lstrlenA (lpString="*.zip") returned 5
	[0048.439] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.rar") returned 0
	[0048.439] lstrlenA (lpString="*.rar") returned 5
	[0048.439] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.7z") returned 0
	[0048.439] lstrlenA (lpString="*.7z") returned 4
	[0048.439] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.tar") returned 0
	[0048.439] lstrlenA (lpString="*.tar") returned 5
	[0048.439] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.gzip") returned 0
	[0048.439] lstrlenA (lpString="*.gzip") returned 6
	[0048.439] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.jpg") returned 0
	[0048.439] lstrlenA (lpString="*.jpg") returned 5
	[0048.439] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.jpeg") returned 0
	[0048.439] lstrlenA (lpString="*.jpeg") returned 6
	[0048.439] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.bmp") returned 0
	[0048.439] lstrlenA (lpString="*.bmp") returned 5
	[0048.439] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.gif") returned 0
	[0048.439] lstrlenA (lpString="*.gif") returned 5
	[0048.439] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.png") returned 0
	[0048.439] lstrlenA (lpString="*.png") returned 5
	[0048.439] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.doc") returned 0
	[0048.439] lstrlenA (lpString="*.doc") returned 5
	[0048.439] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.docx") returned 0
	[0048.439] lstrlenA (lpString="*.docx") returned 6
	[0048.439] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.xls") returned 0
	[0048.439] lstrlenA (lpString="*.xls") returned 5
	[0048.439] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.xlsx") returned 0
	[0048.439] lstrlenA (lpString="*.xlsx") returned 6
	[0048.439] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.ppt") returned 0
	[0048.439] lstrlenA (lpString="*.ppt") returned 5
	[0048.439] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.pptx") returned 0
	[0048.439] lstrlenA (lpString="*.pptx") returned 6
	[0048.439] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.txt") returned 0
	[0048.439] lstrlenA (lpString="*.txt") returned 5
	[0048.439] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.pdf") returned 0
	[0048.439] lstrlenA (lpString="*.pdf") returned 5
	[0048.440] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.htm") returned 0
	[0048.440] lstrlenA (lpString="*.htm") returned 5
	[0048.440] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.html") returned 0
	[0048.440] lstrlenA (lpString="*.html") returned 6
	[0048.440] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.mdb") returned 0
	[0048.440] lstrlenA (lpString="*.mdb") returned 5
	[0048.440] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.pfx") returned 0
	[0048.440] lstrlenA (lpString="*.pfx") returned 5
	[0048.440] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.md") returned 0
	[0048.440] lstrlenA (lpString="*.md") returned 4
	[0048.440] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.lnk") returned 0
	[0048.440] lstrlenA (lpString="*.lnk") returned 5
	[0048.440] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.torrent") returned 0
	[0048.440] lstrlenA (lpString="*.torrent") returned 9
	[0048.440] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.mov") returned 0
	[0048.440] lstrlenA (lpString="*.mov") returned 5
	[0048.440] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.3gp") returned 0
	[0048.440] lstrlenA (lpString="*.3gp") returned 5
	[0048.440] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.mpeg") returned 0
	[0048.440] lstrlenA (lpString="*.mpeg") returned 6
	[0048.440] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.mpg") returned 0
	[0048.440] lstrlenA (lpString="*.mpg") returned 5
	[0048.440] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.flv") returned 0
	[0048.440] lstrlenA (lpString="*.flv") returned 5
	[0048.440] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.avi") returned 0
	[0048.440] lstrlenA (lpString="*.avi") returned 5
	[0048.440] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.mp4") returned 0
	[0048.440] lstrlenA (lpString="*.mp4") returned 5
	[0048.440] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.wmv") returned 0
	[0048.440] lstrlenA (lpString="*.wmv") returned 5
	[0048.440] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.mkv") returned 0
	[0048.440] lstrlenA (lpString="*.mkv") returned 5
	[0048.440] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.mp3") returned 0
	[0048.440] lstrlenA (lpString="*.mp3") returned 5
	[0048.440] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.wav") returned 0
	[0048.440] lstrlenA (lpString="*.wav") returned 5
	[0048.440] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.flac") returned 0
	[0048.440] lstrlenA (lpString="*.flac") returned 6
	[0048.441] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.wma") returned 0
	[0048.441] lstrlenA (lpString="*.wma") returned 5
	[0048.441] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.au3") returned 0
	[0048.441] lstrlenA (lpString="*.au3") returned 5
	[0048.441] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.ahk") returned 0
	[0048.441] lstrlenA (lpString="*.ahk") returned 5
	[0048.441] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.c") returned 0
	[0048.441] lstrlenA (lpString="*.c") returned 3
	[0048.441] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.cc") returned 0
	[0048.441] lstrlenA (lpString="*.cc") returned 4
	[0048.441] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.cpp") returned 0
	[0048.441] lstrlenA (lpString="*.cpp") returned 5
	[0048.441] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.cxx") returned 0
	[0048.441] lstrlenA (lpString="*.cxx") returned 5
	[0048.441] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.c++") returned 0
	[0048.441] lstrlenA (lpString="*.c++") returned 5
	[0048.441] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.cs") returned 0
	[0048.441] lstrlenA (lpString="*.cs") returned 4
	[0048.441] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.vb") returned 0
	[0048.441] lstrlenA (lpString="*.vb") returned 4
	[0048.441] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.bas") returned 0
	[0048.441] lstrlenA (lpString="*.bas") returned 5
	[0048.441] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.csproj") returned 0
	[0048.441] lstrlenA (lpString="*.csproj") returned 8
	[0048.441] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.vbproj") returned 0
	[0048.441] lstrlenA (lpString="*.vbproj") returned 8
	[0048.441] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.vcxproj") returned 0
	[0048.441] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.441] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.manifest") returned 0
	[0048.441] lstrlenA (lpString="*.manifest") returned 10
	[0048.441] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.php") returned 0
	[0048.441] lstrlenA (lpString="*.php") returned 5
	[0048.441] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.vbe") returned 0
	[0048.441] lstrlenA (lpString="*.vbe") returned 5
	[0048.441] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.vba") returned 0
	[0048.441] lstrlenA (lpString="*.vba") returned 5
	[0048.442] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.vbs") returned 0
	[0048.442] lstrlenA (lpString="*.vbs") returned 5
	[0048.442] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.bat") returned 0
	[0048.442] lstrlenA (lpString="*.bat") returned 5
	[0048.442] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.cmd") returned 0
	[0048.442] lstrlenA (lpString="*.cmd") returned 5
	[0048.442] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.js") returned 0
	[0048.442] lstrlenA (lpString="*.js") returned 4
	[0048.442] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.jscript") returned 0
	[0048.442] lstrlenA (lpString="*.jscript") returned 9
	[0048.442] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.hta") returned 0
	[0048.442] lstrlenA (lpString="*.hta") returned 5
	[0048.442] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.php7") returned 0
	[0048.442] lstrlenA (lpString="*.php7") returned 6
	[0048.442] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.db") returned 0
	[0048.442] lstrlenA (lpString="*.db") returned 4
	[0048.442] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.swf") returned 0
	[0048.442] lstrlenA (lpString="*.swf") returned 5
	[0048.442] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.eml") returned 0
	[0048.442] lstrlenA (lpString="*.eml") returned 5
	[0048.442] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.part") returned 0
	[0048.442] lstrlenA (lpString="*.part") returned 6
	[0048.442] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.nfo") returned 0
	[0048.442] lstrlenA (lpString="*.nfo") returned 5
	[0048.442] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.rsa") returned 0
	[0048.442] lstrlenA (lpString="*.rsa") returned 5
	[0048.442] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.key") returned 0
	[0048.442] lstrlenA (lpString="*.key") returned 5
	[0048.442] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.aes") returned 0
	[0048.442] lstrlenA (lpString="*.aes") returned 5
	[0048.442] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.blob") returned 0
	[0048.442] lstrlenA (lpString="*.blob") returned 6
	[0048.442] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.btc") returned 0
	[0048.442] lstrlenA (lpString="*.btc") returned 5
	[0048.442] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.wallet") returned 0
	[0048.442] lstrlenA (lpString="*.wallet") returned 8
	[0048.442] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0048.443] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.443] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SetupResources.dll") returned -1
	[0048.443] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SetupResources.dll") returned -1
	[0048.443] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1
	[0048.443] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned="LocalizedData.xml"
	[0048.443] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1041\\" | out: lpString1="C:\\588bce7c90097ed212\\1041\\") returned="C:\\588bce7c90097ed212\\1041\\"
	[0048.443] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1041\\" | out: pszPath="C:\\588bce7c90097ed212\\1041\\") returned=""
	[0048.443] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1041\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1041\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1041\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.443] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1041\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1041\\how-to-decrypt-files.htm")) returned 0x20
	[0048.443] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1041\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1041\\SetupResources.dll"
	[0048.443] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.zip") returned 0
	[0048.443] lstrlenA (lpString="*.zip") returned 5
	[0048.443] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.rar") returned 0
	[0048.443] lstrlenA (lpString="*.rar") returned 5
	[0048.443] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.7z") returned 0
	[0048.443] lstrlenA (lpString="*.7z") returned 4
	[0048.443] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.tar") returned 0
	[0048.443] lstrlenA (lpString="*.tar") returned 5
	[0048.443] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.gzip") returned 0
	[0048.443] lstrlenA (lpString="*.gzip") returned 6
	[0048.443] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.jpg") returned 0
	[0048.443] lstrlenA (lpString="*.jpg") returned 5
	[0048.443] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.jpeg") returned 0
	[0048.443] lstrlenA (lpString="*.jpeg") returned 6
	[0048.443] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.bmp") returned 0
	[0048.444] lstrlenA (lpString="*.bmp") returned 5
	[0048.444] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.gif") returned 0
	[0048.444] lstrlenA (lpString="*.gif") returned 5
	[0048.444] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.png") returned 0
	[0048.444] lstrlenA (lpString="*.png") returned 5
	[0048.444] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.doc") returned 0
	[0048.444] lstrlenA (lpString="*.doc") returned 5
	[0048.444] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.docx") returned 0
	[0048.444] lstrlenA (lpString="*.docx") returned 6
	[0048.444] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.xls") returned 0
	[0048.444] lstrlenA (lpString="*.xls") returned 5
	[0048.444] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.xlsx") returned 0
	[0048.444] lstrlenA (lpString="*.xlsx") returned 6
	[0048.444] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.ppt") returned 0
	[0048.444] lstrlenA (lpString="*.ppt") returned 5
	[0048.444] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.pptx") returned 0
	[0048.444] lstrlenA (lpString="*.pptx") returned 6
	[0048.444] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.txt") returned 0
	[0048.444] lstrlenA (lpString="*.txt") returned 5
	[0048.444] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.pdf") returned 0
	[0048.444] lstrlenA (lpString="*.pdf") returned 5
	[0048.444] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.htm") returned 0
	[0048.444] lstrlenA (lpString="*.htm") returned 5
	[0048.444] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.html") returned 0
	[0048.444] lstrlenA (lpString="*.html") returned 6
	[0048.444] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.mdb") returned 0
	[0048.444] lstrlenA (lpString="*.mdb") returned 5
	[0048.444] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.pfx") returned 0
	[0048.444] lstrlenA (lpString="*.pfx") returned 5
	[0048.444] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.md") returned 0
	[0048.444] lstrlenA (lpString="*.md") returned 4
	[0048.444] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.lnk") returned 0
	[0048.444] lstrlenA (lpString="*.lnk") returned 5
	[0048.444] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.torrent") returned 0
	[0048.444] lstrlenA (lpString="*.torrent") returned 9
	[0048.444] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.mov") returned 0
	[0048.445] lstrlenA (lpString="*.mov") returned 5
	[0048.445] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.3gp") returned 0
	[0048.445] lstrlenA (lpString="*.3gp") returned 5
	[0048.445] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.mpeg") returned 0
	[0048.445] lstrlenA (lpString="*.mpeg") returned 6
	[0048.445] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.mpg") returned 0
	[0048.445] lstrlenA (lpString="*.mpg") returned 5
	[0048.445] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.flv") returned 0
	[0048.445] lstrlenA (lpString="*.flv") returned 5
	[0048.445] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.avi") returned 0
	[0048.445] lstrlenA (lpString="*.avi") returned 5
	[0048.445] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.mp4") returned 0
	[0048.445] lstrlenA (lpString="*.mp4") returned 5
	[0048.445] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.wmv") returned 0
	[0048.445] lstrlenA (lpString="*.wmv") returned 5
	[0048.445] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.mkv") returned 0
	[0048.445] lstrlenA (lpString="*.mkv") returned 5
	[0048.445] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.mp3") returned 0
	[0048.445] lstrlenA (lpString="*.mp3") returned 5
	[0048.445] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.wav") returned 0
	[0048.445] lstrlenA (lpString="*.wav") returned 5
	[0048.445] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.flac") returned 0
	[0048.445] lstrlenA (lpString="*.flac") returned 6
	[0048.445] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.wma") returned 0
	[0048.445] lstrlenA (lpString="*.wma") returned 5
	[0048.445] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.au3") returned 0
	[0048.445] lstrlenA (lpString="*.au3") returned 5
	[0048.445] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.ahk") returned 0
	[0048.445] lstrlenA (lpString="*.ahk") returned 5
	[0048.445] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.c") returned 0
	[0048.445] lstrlenA (lpString="*.c") returned 3
	[0048.445] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.cc") returned 0
	[0048.445] lstrlenA (lpString="*.cc") returned 4
	[0048.445] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.cpp") returned 0
	[0048.445] lstrlenA (lpString="*.cpp") returned 5
	[0048.445] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.cxx") returned 0
	[0048.445] lstrlenA (lpString="*.cxx") returned 5
	[0048.445] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.c++") returned 0
	[0048.445] lstrlenA (lpString="*.c++") returned 5
	[0048.446] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.cs") returned 0
	[0048.446] lstrlenA (lpString="*.cs") returned 4
	[0048.446] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.vb") returned 0
	[0048.446] lstrlenA (lpString="*.vb") returned 4
	[0048.446] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.bas") returned 0
	[0048.446] lstrlenA (lpString="*.bas") returned 5
	[0048.446] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.csproj") returned 0
	[0048.446] lstrlenA (lpString="*.csproj") returned 8
	[0048.446] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.vbproj") returned 0
	[0048.446] lstrlenA (lpString="*.vbproj") returned 8
	[0048.446] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.vcxproj") returned 0
	[0048.446] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.446] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.manifest") returned 0
	[0048.446] lstrlenA (lpString="*.manifest") returned 10
	[0048.446] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.php") returned 0
	[0048.446] lstrlenA (lpString="*.php") returned 5
	[0048.446] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.vbe") returned 0
	[0048.446] lstrlenA (lpString="*.vbe") returned 5
	[0048.446] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.vba") returned 0
	[0048.446] lstrlenA (lpString="*.vba") returned 5
	[0048.446] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.vbs") returned 0
	[0048.446] lstrlenA (lpString="*.vbs") returned 5
	[0048.446] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.bat") returned 0
	[0048.446] lstrlenA (lpString="*.bat") returned 5
	[0048.446] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.cmd") returned 0
	[0048.446] lstrlenA (lpString="*.cmd") returned 5
	[0048.446] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.js") returned 0
	[0048.446] lstrlenA (lpString="*.js") returned 4
	[0048.446] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.jscript") returned 0
	[0048.446] lstrlenA (lpString="*.jscript") returned 9
	[0048.446] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.hta") returned 0
	[0048.446] lstrlenA (lpString="*.hta") returned 5
	[0048.446] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.php7") returned 0
	[0048.446] lstrlenA (lpString="*.php7") returned 6
	[0048.446] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.db") returned 0
	[0048.446] lstrlenA (lpString="*.db") returned 4
	[0048.447] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.swf") returned 0
	[0048.447] lstrlenA (lpString="*.swf") returned 5
	[0048.447] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.eml") returned 0
	[0048.447] lstrlenA (lpString="*.eml") returned 5
	[0048.447] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.part") returned 0
	[0048.447] lstrlenA (lpString="*.part") returned 6
	[0048.447] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.nfo") returned 0
	[0048.447] lstrlenA (lpString="*.nfo") returned 5
	[0048.447] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.rsa") returned 0
	[0048.447] lstrlenA (lpString="*.rsa") returned 5
	[0048.447] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.key") returned 0
	[0048.447] lstrlenA (lpString="*.key") returned 5
	[0048.447] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.aes") returned 0
	[0048.447] lstrlenA (lpString="*.aes") returned 5
	[0048.447] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.blob") returned 0
	[0048.447] lstrlenA (lpString="*.blob") returned 6
	[0048.447] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.btc") returned 0
	[0048.447] lstrlenA (lpString="*.btc") returned 5
	[0048.447] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.wallet") returned 0
	[0048.447] lstrlenA (lpString="*.wallet") returned 8
	[0048.447] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0048.447] FindClose (in: hFindFile=0x7cb810 | out: hFindFile=0x7cb810) returned 1
	[0048.447] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d1d40, dwReserved1=0x7b00c0, cFileName="1042", cAlternateFileName="")) returned 1
	[0048.447] lstrcmpA (lpString1=".", lpString2="1042") returned -1
	[0048.447] lstrcmpA (lpString1="..", lpString2="1042") returned -1
	[0048.447] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*"
	[0048.447] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1042" | out: lpString1="C:\\588bce7c90097ed212\\1042") returned="C:\\588bce7c90097ed212\\1042"
	[0048.447] lstrlenA (lpString="C:\\588bce7c90097ed212\\1042") returned 26
	[0048.447] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb6d0
	[0048.448] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0048.448] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0048.448] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0048.448] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0048.448] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0048.448] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.448] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="eula.rtf") returned -1
	[0048.448] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="eula.rtf") returned 1
	[0048.448] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1
	[0048.448] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1042\\*.*") returned="*.*"
	[0048.448] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1042\\" | out: lpString1="C:\\588bce7c90097ed212\\1042\\") returned="C:\\588bce7c90097ed212\\1042\\"
	[0048.448] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1042\\" | out: pszPath="C:\\588bce7c90097ed212\\1042\\") returned=""
	[0048.448] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1042\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1042\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1042\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.448] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1042\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1042\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0048.448] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1042\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1042\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0048.450] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0048.450] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0048.450] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0048.451] CloseHandle (hObject=0x208) returned 1
	[0048.451] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1042\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned="C:\\588bce7c90097ed212\\1042\\eula.rtf"
	[0048.451] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.zip") returned 0
	[0048.451] lstrlenA (lpString="*.zip") returned 5
	[0048.451] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.rar") returned 0
	[0048.451] lstrlenA (lpString="*.rar") returned 5
	[0048.451] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.7z") returned 0
	[0048.451] lstrlenA (lpString="*.7z") returned 4
	[0048.451] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.tar") returned 0
	[0048.451] lstrlenA (lpString="*.tar") returned 5
	[0048.451] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.gzip") returned 0
	[0048.451] lstrlenA (lpString="*.gzip") returned 6
	[0048.451] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.jpg") returned 0
	[0048.451] lstrlenA (lpString="*.jpg") returned 5
	[0048.451] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.jpeg") returned 0
	[0048.451] lstrlenA (lpString="*.jpeg") returned 6
	[0048.451] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.bmp") returned 0
	[0048.451] lstrlenA (lpString="*.bmp") returned 5
	[0048.451] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.gif") returned 0
	[0048.451] lstrlenA (lpString="*.gif") returned 5
	[0048.451] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.png") returned 0
	[0048.451] lstrlenA (lpString="*.png") returned 5
	[0048.451] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.doc") returned 0
	[0048.451] lstrlenA (lpString="*.doc") returned 5
	[0048.451] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.docx") returned 0
	[0048.451] lstrlenA (lpString="*.docx") returned 6
	[0048.451] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.xls") returned 0
	[0048.451] lstrlenA (lpString="*.xls") returned 5
	[0048.451] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.xlsx") returned 0
	[0048.452] lstrlenA (lpString="*.xlsx") returned 6
	[0048.452] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.ppt") returned 0
	[0048.452] lstrlenA (lpString="*.ppt") returned 5
	[0048.452] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.pptx") returned 0
	[0048.452] lstrlenA (lpString="*.pptx") returned 6
	[0048.452] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.txt") returned 0
	[0048.452] lstrlenA (lpString="*.txt") returned 5
	[0048.452] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.pdf") returned 0
	[0048.452] lstrlenA (lpString="*.pdf") returned 5
	[0048.452] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.htm") returned 0
	[0048.452] lstrlenA (lpString="*.htm") returned 5
	[0048.452] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.html") returned 0
	[0048.452] lstrlenA (lpString="*.html") returned 6
	[0048.452] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.mdb") returned 0
	[0048.452] lstrlenA (lpString="*.mdb") returned 5
	[0048.452] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.pfx") returned 0
	[0048.452] lstrlenA (lpString="*.pfx") returned 5
	[0048.452] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.md") returned 0
	[0048.452] lstrlenA (lpString="*.md") returned 4
	[0048.452] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.lnk") returned 0
	[0048.452] lstrlenA (lpString="*.lnk") returned 5
	[0048.452] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.torrent") returned 0
	[0048.452] lstrlenA (lpString="*.torrent") returned 9
	[0048.452] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.mov") returned 0
	[0048.452] lstrlenA (lpString="*.mov") returned 5
	[0048.452] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.3gp") returned 0
	[0048.452] lstrlenA (lpString="*.3gp") returned 5
	[0048.452] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.mpeg") returned 0
	[0048.452] lstrlenA (lpString="*.mpeg") returned 6
	[0048.452] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.mpg") returned 0
	[0048.452] lstrlenA (lpString="*.mpg") returned 5
	[0048.452] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.flv") returned 0
	[0048.452] lstrlenA (lpString="*.flv") returned 5
	[0048.452] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.avi") returned 0
	[0048.452] lstrlenA (lpString="*.avi") returned 5
	[0048.452] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.mp4") returned 0
	[0048.454] lstrlenA (lpString="*.mp4") returned 5
	[0048.454] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.wmv") returned 0
	[0048.454] lstrlenA (lpString="*.wmv") returned 5
	[0048.454] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.mkv") returned 0
	[0048.454] lstrlenA (lpString="*.mkv") returned 5
	[0048.454] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.mp3") returned 0
	[0048.454] lstrlenA (lpString="*.mp3") returned 5
	[0048.454] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.wav") returned 0
	[0048.454] lstrlenA (lpString="*.wav") returned 5
	[0048.454] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.flac") returned 0
	[0048.454] lstrlenA (lpString="*.flac") returned 6
	[0048.454] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.wma") returned 0
	[0048.454] lstrlenA (lpString="*.wma") returned 5
	[0048.454] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.au3") returned 0
	[0048.454] lstrlenA (lpString="*.au3") returned 5
	[0048.454] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.ahk") returned 0
	[0048.454] lstrlenA (lpString="*.ahk") returned 5
	[0048.454] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.c") returned 0
	[0048.454] lstrlenA (lpString="*.c") returned 3
	[0048.454] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.cc") returned 0
	[0048.454] lstrlenA (lpString="*.cc") returned 4
	[0048.454] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.cpp") returned 0
	[0048.455] lstrlenA (lpString="*.cpp") returned 5
	[0048.455] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.cxx") returned 0
	[0048.455] lstrlenA (lpString="*.cxx") returned 5
	[0048.455] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.c++") returned 0
	[0048.455] lstrlenA (lpString="*.c++") returned 5
	[0048.455] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.cs") returned 0
	[0048.455] lstrlenA (lpString="*.cs") returned 4
	[0048.455] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.vb") returned 0
	[0048.455] lstrlenA (lpString="*.vb") returned 4
	[0048.455] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.bas") returned 0
	[0048.455] lstrlenA (lpString="*.bas") returned 5
	[0048.455] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.csproj") returned 0
	[0048.455] lstrlenA (lpString="*.csproj") returned 8
	[0048.455] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.vbproj") returned 0
	[0048.455] lstrlenA (lpString="*.vbproj") returned 8
	[0048.455] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.vcxproj") returned 0
	[0048.455] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.455] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.manifest") returned 0
	[0048.455] lstrlenA (lpString="*.manifest") returned 10
	[0048.455] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.php") returned 0
	[0048.455] lstrlenA (lpString="*.php") returned 5
	[0048.455] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.vbe") returned 0
	[0048.455] lstrlenA (lpString="*.vbe") returned 5
	[0048.455] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.vba") returned 0
	[0048.455] lstrlenA (lpString="*.vba") returned 5
	[0048.455] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.vbs") returned 0
	[0048.455] lstrlenA (lpString="*.vbs") returned 5
	[0048.455] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.bat") returned 0
	[0048.455] lstrlenA (lpString="*.bat") returned 5
	[0048.455] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.cmd") returned 0
	[0048.456] lstrlenA (lpString="*.cmd") returned 5
	[0048.456] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.js") returned 0
	[0048.456] lstrlenA (lpString="*.js") returned 4
	[0048.456] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.jscript") returned 0
	[0048.456] lstrlenA (lpString="*.jscript") returned 9
	[0048.456] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.hta") returned 0
	[0048.456] lstrlenA (lpString="*.hta") returned 5
	[0048.456] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.php7") returned 0
	[0048.456] lstrlenA (lpString="*.php7") returned 6
	[0048.456] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.db") returned 0
	[0048.456] lstrlenA (lpString="*.db") returned 4
	[0048.456] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.swf") returned 0
	[0048.456] lstrlenA (lpString="*.swf") returned 5
	[0048.456] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.eml") returned 0
	[0048.456] lstrlenA (lpString="*.eml") returned 5
	[0048.456] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.part") returned 0
	[0048.456] lstrlenA (lpString="*.part") returned 6
	[0048.456] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.nfo") returned 0
	[0048.456] lstrlenA (lpString="*.nfo") returned 5
	[0048.456] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.rsa") returned 0
	[0048.456] lstrlenA (lpString="*.rsa") returned 5
	[0048.456] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.key") returned 0
	[0048.456] lstrlenA (lpString="*.key") returned 5
	[0048.456] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.aes") returned 0
	[0048.456] lstrlenA (lpString="*.aes") returned 5
	[0048.456] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.blob") returned 0
	[0048.456] lstrlenA (lpString="*.blob") returned 6
	[0048.456] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.btc") returned 0
	[0048.456] lstrlenA (lpString="*.btc") returned 5
	[0048.456] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.wallet") returned 0
	[0048.457] lstrlenA (lpString="*.wallet") returned 8
	[0048.457] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0048.457] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.457] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="LocalizedData.xml") returned -1
	[0048.457] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="LocalizedData.xml") returned -1
	[0048.457] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1
	[0048.457] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned="eula.rtf"
	[0048.457] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1042\\" | out: lpString1="C:\\588bce7c90097ed212\\1042\\") returned="C:\\588bce7c90097ed212\\1042\\"
	[0048.457] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1042\\" | out: pszPath="C:\\588bce7c90097ed212\\1042\\") returned=""
	[0048.457] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1042\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1042\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1042\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.457] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1042\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1042\\how-to-decrypt-files.htm")) returned 0x20
	[0048.457] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1042\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml"
	[0048.457] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.zip") returned 0
	[0048.457] lstrlenA (lpString="*.zip") returned 5
	[0048.457] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.rar") returned 0
	[0048.457] lstrlenA (lpString="*.rar") returned 5
	[0048.457] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.7z") returned 0
	[0048.457] lstrlenA (lpString="*.7z") returned 4
	[0048.457] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.tar") returned 0
	[0048.457] lstrlenA (lpString="*.tar") returned 5
	[0048.457] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.gzip") returned 0
	[0048.457] lstrlenA (lpString="*.gzip") returned 6
	[0048.457] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.jpg") returned 0
	[0048.457] lstrlenA (lpString="*.jpg") returned 5
	[0048.457] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.jpeg") returned 0
	[0048.457] lstrlenA (lpString="*.jpeg") returned 6
	[0048.458] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.bmp") returned 0
	[0048.458] lstrlenA (lpString="*.bmp") returned 5
	[0048.458] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.gif") returned 0
	[0048.458] lstrlenA (lpString="*.gif") returned 5
	[0048.458] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.png") returned 0
	[0048.458] lstrlenA (lpString="*.png") returned 5
	[0048.458] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.doc") returned 0
	[0048.458] lstrlenA (lpString="*.doc") returned 5
	[0048.458] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.docx") returned 0
	[0048.458] lstrlenA (lpString="*.docx") returned 6
	[0048.458] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.xls") returned 0
	[0048.458] lstrlenA (lpString="*.xls") returned 5
	[0048.458] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.xlsx") returned 0
	[0048.458] lstrlenA (lpString="*.xlsx") returned 6
	[0048.458] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.ppt") returned 0
	[0048.458] lstrlenA (lpString="*.ppt") returned 5
	[0048.458] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.pptx") returned 0
	[0048.458] lstrlenA (lpString="*.pptx") returned 6
	[0048.458] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.txt") returned 0
	[0048.458] lstrlenA (lpString="*.txt") returned 5
	[0048.458] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.pdf") returned 0
	[0048.458] lstrlenA (lpString="*.pdf") returned 5
	[0048.458] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.htm") returned 0
	[0048.458] lstrlenA (lpString="*.htm") returned 5
	[0048.458] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.html") returned 0
	[0048.458] lstrlenA (lpString="*.html") returned 6
	[0048.458] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.mdb") returned 0
	[0048.458] lstrlenA (lpString="*.mdb") returned 5
	[0048.458] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.pfx") returned 0
	[0048.459] lstrlenA (lpString="*.pfx") returned 5
	[0048.459] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.md") returned 0
	[0048.459] lstrlenA (lpString="*.md") returned 4
	[0048.459] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.lnk") returned 0
	[0048.459] lstrlenA (lpString="*.lnk") returned 5
	[0048.459] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.torrent") returned 0
	[0048.459] lstrlenA (lpString="*.torrent") returned 9
	[0048.459] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.mov") returned 0
	[0048.459] lstrlenA (lpString="*.mov") returned 5
	[0048.459] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.3gp") returned 0
	[0048.459] lstrlenA (lpString="*.3gp") returned 5
	[0048.459] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.mpeg") returned 0
	[0048.459] lstrlenA (lpString="*.mpeg") returned 6
	[0048.459] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.mpg") returned 0
	[0048.459] lstrlenA (lpString="*.mpg") returned 5
	[0048.459] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.flv") returned 0
	[0048.459] lstrlenA (lpString="*.flv") returned 5
	[0048.459] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.avi") returned 0
	[0048.459] lstrlenA (lpString="*.avi") returned 5
	[0048.459] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.mp4") returned 0
	[0048.459] lstrlenA (lpString="*.mp4") returned 5
	[0048.459] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.wmv") returned 0
	[0048.460] lstrlenA (lpString="*.wmv") returned 5
	[0048.460] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.mkv") returned 0
	[0048.460] lstrlenA (lpString="*.mkv") returned 5
	[0048.460] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.mp3") returned 0
	[0048.460] lstrlenA (lpString="*.mp3") returned 5
	[0048.460] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.wav") returned 0
	[0048.460] lstrlenA (lpString="*.wav") returned 5
	[0048.460] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.flac") returned 0
	[0048.460] lstrlenA (lpString="*.flac") returned 6
	[0048.460] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.wma") returned 0
	[0048.460] lstrlenA (lpString="*.wma") returned 5
	[0048.460] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.au3") returned 0
	[0048.460] lstrlenA (lpString="*.au3") returned 5
	[0048.460] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.ahk") returned 0
	[0048.460] lstrlenA (lpString="*.ahk") returned 5
	[0048.460] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.c") returned 0
	[0048.460] lstrlenA (lpString="*.c") returned 3
	[0048.460] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.cc") returned 0
	[0048.460] lstrlenA (lpString="*.cc") returned 4
	[0048.460] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.cpp") returned 0
	[0048.460] lstrlenA (lpString="*.cpp") returned 5
	[0048.460] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.cxx") returned 0
	[0048.460] lstrlenA (lpString="*.cxx") returned 5
	[0048.460] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.c++") returned 0
	[0048.460] lstrlenA (lpString="*.c++") returned 5
	[0048.460] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.cs") returned 0
	[0048.460] lstrlenA (lpString="*.cs") returned 4
	[0048.460] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.vb") returned 0
	[0048.460] lstrlenA (lpString="*.vb") returned 4
	[0048.460] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.bas") returned 0
	[0048.460] lstrlenA (lpString="*.bas") returned 5
	[0048.460] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.csproj") returned 0
	[0048.460] lstrlenA (lpString="*.csproj") returned 8
	[0048.461] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.vbproj") returned 0
	[0048.461] lstrlenA (lpString="*.vbproj") returned 8
	[0048.461] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.vcxproj") returned 0
	[0048.461] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.461] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.manifest") returned 0
	[0048.461] lstrlenA (lpString="*.manifest") returned 10
	[0048.461] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.php") returned 0
	[0048.461] lstrlenA (lpString="*.php") returned 5
	[0048.461] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.vbe") returned 0
	[0048.461] lstrlenA (lpString="*.vbe") returned 5
	[0048.461] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.vba") returned 0
	[0048.461] lstrlenA (lpString="*.vba") returned 5
	[0048.461] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.vbs") returned 0
	[0048.461] lstrlenA (lpString="*.vbs") returned 5
	[0048.461] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.bat") returned 0
	[0048.461] lstrlenA (lpString="*.bat") returned 5
	[0048.461] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.cmd") returned 0
	[0048.461] lstrlenA (lpString="*.cmd") returned 5
	[0048.461] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.js") returned 0
	[0048.461] lstrlenA (lpString="*.js") returned 4
	[0048.461] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.jscript") returned 0
	[0048.461] lstrlenA (lpString="*.jscript") returned 9
	[0048.461] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.hta") returned 0
	[0048.461] lstrlenA (lpString="*.hta") returned 5
	[0048.461] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.php7") returned 0
	[0048.461] lstrlenA (lpString="*.php7") returned 6
	[0048.461] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.db") returned 0
	[0048.461] lstrlenA (lpString="*.db") returned 4
	[0048.461] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.swf") returned 0
	[0048.461] lstrlenA (lpString="*.swf") returned 5
	[0048.461] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.eml") returned 0
	[0048.461] lstrlenA (lpString="*.eml") returned 5
	[0048.461] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.part") returned 0
	[0048.461] lstrlenA (lpString="*.part") returned 6
	[0048.462] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.nfo") returned 0
	[0048.462] lstrlenA (lpString="*.nfo") returned 5
	[0048.462] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.rsa") returned 0
	[0048.462] lstrlenA (lpString="*.rsa") returned 5
	[0048.462] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.key") returned 0
	[0048.462] lstrlenA (lpString="*.key") returned 5
	[0048.462] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.aes") returned 0
	[0048.462] lstrlenA (lpString="*.aes") returned 5
	[0048.463] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.blob") returned 0
	[0048.463] lstrlenA (lpString="*.blob") returned 6
	[0048.463] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.btc") returned 0
	[0048.463] lstrlenA (lpString="*.btc") returned 5
	[0048.463] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.wallet") returned 0
	[0048.463] lstrlenA (lpString="*.wallet") returned 8
	[0048.463] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0048.463] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.463] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SetupResources.dll") returned -1
	[0048.463] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SetupResources.dll") returned -1
	[0048.463] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1
	[0048.463] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned="LocalizedData.xml"
	[0048.463] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1042\\" | out: lpString1="C:\\588bce7c90097ed212\\1042\\") returned="C:\\588bce7c90097ed212\\1042\\"
	[0048.463] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1042\\" | out: pszPath="C:\\588bce7c90097ed212\\1042\\") returned=""
	[0048.463] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1042\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1042\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1042\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.463] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1042\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1042\\how-to-decrypt-files.htm")) returned 0x20
	[0048.463] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1042\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1042\\SetupResources.dll"
	[0048.463] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.zip") returned 0
	[0048.463] lstrlenA (lpString="*.zip") returned 5
	[0048.463] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.rar") returned 0
	[0048.463] lstrlenA (lpString="*.rar") returned 5
	[0048.464] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.7z") returned 0
	[0048.464] lstrlenA (lpString="*.7z") returned 4
	[0048.464] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.tar") returned 0
	[0048.464] lstrlenA (lpString="*.tar") returned 5
	[0048.464] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.gzip") returned 0
	[0048.464] lstrlenA (lpString="*.gzip") returned 6
	[0048.464] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.jpg") returned 0
	[0048.464] lstrlenA (lpString="*.jpg") returned 5
	[0048.464] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.jpeg") returned 0
	[0048.464] lstrlenA (lpString="*.jpeg") returned 6
	[0048.464] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.bmp") returned 0
	[0048.464] lstrlenA (lpString="*.bmp") returned 5
	[0048.464] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.gif") returned 0
	[0048.464] lstrlenA (lpString="*.gif") returned 5
	[0048.464] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.png") returned 0
	[0048.464] lstrlenA (lpString="*.png") returned 5
	[0048.464] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.doc") returned 0
	[0048.464] lstrlenA (lpString="*.doc") returned 5
	[0048.464] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.docx") returned 0
	[0048.464] lstrlenA (lpString="*.docx") returned 6
	[0048.464] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.xls") returned 0
	[0048.464] lstrlenA (lpString="*.xls") returned 5
	[0048.464] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.xlsx") returned 0
	[0048.464] lstrlenA (lpString="*.xlsx") returned 6
	[0048.464] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.ppt") returned 0
	[0048.464] lstrlenA (lpString="*.ppt") returned 5
	[0048.464] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.pptx") returned 0
	[0048.464] lstrlenA (lpString="*.pptx") returned 6
	[0048.464] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.txt") returned 0
	[0048.464] lstrlenA (lpString="*.txt") returned 5
	[0048.464] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.pdf") returned 0
	[0048.464] lstrlenA (lpString="*.pdf") returned 5
	[0048.465] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.htm") returned 0
	[0048.465] lstrlenA (lpString="*.htm") returned 5
	[0048.465] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.html") returned 0
	[0048.465] lstrlenA (lpString="*.html") returned 6
	[0048.465] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.mdb") returned 0
	[0048.465] lstrlenA (lpString="*.mdb") returned 5
	[0048.465] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.pfx") returned 0
	[0048.465] lstrlenA (lpString="*.pfx") returned 5
	[0048.465] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.md") returned 0
	[0048.465] lstrlenA (lpString="*.md") returned 4
	[0048.465] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.lnk") returned 0
	[0048.465] lstrlenA (lpString="*.lnk") returned 5
	[0048.465] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.torrent") returned 0
	[0048.465] lstrlenA (lpString="*.torrent") returned 9
	[0048.465] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.mov") returned 0
	[0048.465] lstrlenA (lpString="*.mov") returned 5
	[0048.465] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.3gp") returned 0
	[0048.465] lstrlenA (lpString="*.3gp") returned 5
	[0048.465] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.mpeg") returned 0
	[0048.465] lstrlenA (lpString="*.mpeg") returned 6
	[0048.465] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.mpg") returned 0
	[0048.465] lstrlenA (lpString="*.mpg") returned 5
	[0048.465] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.flv") returned 0
	[0048.465] lstrlenA (lpString="*.flv") returned 5
	[0048.465] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.avi") returned 0
	[0048.465] lstrlenA (lpString="*.avi") returned 5
	[0048.465] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.mp4") returned 0
	[0048.465] lstrlenA (lpString="*.mp4") returned 5
	[0048.465] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.wmv") returned 0
	[0048.465] lstrlenA (lpString="*.wmv") returned 5
	[0048.465] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.mkv") returned 0
	[0048.465] lstrlenA (lpString="*.mkv") returned 5
	[0048.465] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.mp3") returned 0
	[0048.465] lstrlenA (lpString="*.mp3") returned 5
	[0048.465] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.wav") returned 0
	[0048.466] lstrlenA (lpString="*.wav") returned 5
	[0048.466] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.flac") returned 0
	[0048.466] lstrlenA (lpString="*.flac") returned 6
	[0048.466] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.wma") returned 0
	[0048.466] lstrlenA (lpString="*.wma") returned 5
	[0048.466] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.au3") returned 0
	[0048.466] lstrlenA (lpString="*.au3") returned 5
	[0048.466] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.ahk") returned 0
	[0048.466] lstrlenA (lpString="*.ahk") returned 5
	[0048.466] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.c") returned 0
	[0048.466] lstrlenA (lpString="*.c") returned 3
	[0048.466] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.cc") returned 0
	[0048.466] lstrlenA (lpString="*.cc") returned 4
	[0048.466] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.cpp") returned 0
	[0048.466] lstrlenA (lpString="*.cpp") returned 5
	[0048.466] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.cxx") returned 0
	[0048.466] lstrlenA (lpString="*.cxx") returned 5
	[0048.466] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.c++") returned 0
	[0048.466] lstrlenA (lpString="*.c++") returned 5
	[0048.466] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.cs") returned 0
	[0048.466] lstrlenA (lpString="*.cs") returned 4
	[0048.466] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.vb") returned 0
	[0048.466] lstrlenA (lpString="*.vb") returned 4
	[0048.466] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.bas") returned 0
	[0048.466] lstrlenA (lpString="*.bas") returned 5
	[0048.466] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.csproj") returned 0
	[0048.466] lstrlenA (lpString="*.csproj") returned 8
	[0048.466] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.vbproj") returned 0
	[0048.466] lstrlenA (lpString="*.vbproj") returned 8
	[0048.466] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.vcxproj") returned 0
	[0048.466] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.466] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.manifest") returned 0
	[0048.466] lstrlenA (lpString="*.manifest") returned 10
	[0048.466] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.php") returned 0
	[0048.466] lstrlenA (lpString="*.php") returned 5
	[0048.466] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.vbe") returned 0
	[0048.467] lstrlenA (lpString="*.vbe") returned 5
	[0048.467] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.vba") returned 0
	[0048.467] lstrlenA (lpString="*.vba") returned 5
	[0048.467] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.vbs") returned 0
	[0048.467] lstrlenA (lpString="*.vbs") returned 5
	[0048.467] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.bat") returned 0
	[0048.467] lstrlenA (lpString="*.bat") returned 5
	[0048.467] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.cmd") returned 0
	[0048.467] lstrlenA (lpString="*.cmd") returned 5
	[0048.467] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.js") returned 0
	[0048.467] lstrlenA (lpString="*.js") returned 4
	[0048.467] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.jscript") returned 0
	[0048.467] lstrlenA (lpString="*.jscript") returned 9
	[0048.467] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.hta") returned 0
	[0048.467] lstrlenA (lpString="*.hta") returned 5
	[0048.467] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.php7") returned 0
	[0048.467] lstrlenA (lpString="*.php7") returned 6
	[0048.467] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.db") returned 0
	[0048.467] lstrlenA (lpString="*.db") returned 4
	[0048.467] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.swf") returned 0
	[0048.467] lstrlenA (lpString="*.swf") returned 5
	[0048.467] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.eml") returned 0
	[0048.467] lstrlenA (lpString="*.eml") returned 5
	[0048.467] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.part") returned 0
	[0048.467] lstrlenA (lpString="*.part") returned 6
	[0048.467] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.nfo") returned 0
	[0048.467] lstrlenA (lpString="*.nfo") returned 5
	[0048.467] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.rsa") returned 0
	[0048.467] lstrlenA (lpString="*.rsa") returned 5
	[0048.467] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.key") returned 0
	[0048.467] lstrlenA (lpString="*.key") returned 5
	[0048.467] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.aes") returned 0
	[0048.467] lstrlenA (lpString="*.aes") returned 5
	[0048.467] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.blob") returned 0
	[0048.467] lstrlenA (lpString="*.blob") returned 6
	[0048.467] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.btc") returned 0
	[0048.467] lstrlenA (lpString="*.btc") returned 5
	[0048.467] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.wallet") returned 0
	[0048.468] lstrlenA (lpString="*.wallet") returned 8
	[0048.468] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0048.468] FindClose (in: hFindFile=0x7cb6d0 | out: hFindFile=0x7cb6d0) returned 1
	[0048.468] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d1d40, dwReserved1=0x7b00c0, cFileName="1043", cAlternateFileName="")) returned 1
	[0048.468] lstrcmpA (lpString1=".", lpString2="1043") returned -1
	[0048.468] lstrcmpA (lpString1="..", lpString2="1043") returned -1
	[0048.468] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*"
	[0048.468] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1043" | out: lpString1="C:\\588bce7c90097ed212\\1043") returned="C:\\588bce7c90097ed212\\1043"
	[0048.468] lstrlenA (lpString="C:\\588bce7c90097ed212\\1043") returned 26
	[0048.468] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbc50
	[0048.468] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0048.468] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0048.468] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0048.468] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0048.468] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0048.468] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.468] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="eula.rtf") returned -1
	[0048.468] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="eula.rtf") returned 1
	[0048.468] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1
	[0048.468] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1043\\*.*") returned="*.*"
	[0048.468] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1043\\" | out: lpString1="C:\\588bce7c90097ed212\\1043\\") returned="C:\\588bce7c90097ed212\\1043\\"
	[0048.468] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1043\\" | out: pszPath="C:\\588bce7c90097ed212\\1043\\") returned=""
	[0048.469] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1043\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1043\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1043\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.469] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1043\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1043\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0048.469] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1043\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1043\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0048.524] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0048.524] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0048.525] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0048.525] CloseHandle (hObject=0x208) returned 1
	[0048.526] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1043\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned="C:\\588bce7c90097ed212\\1043\\eula.rtf"
	[0048.526] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.zip") returned 0
	[0048.526] lstrlenA (lpString="*.zip") returned 5
	[0048.526] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.rar") returned 0
	[0048.526] lstrlenA (lpString="*.rar") returned 5
	[0048.526] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.7z") returned 0
	[0048.526] lstrlenA (lpString="*.7z") returned 4
	[0048.526] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.tar") returned 0
	[0048.526] lstrlenA (lpString="*.tar") returned 5
	[0048.526] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.gzip") returned 0
	[0048.526] lstrlenA (lpString="*.gzip") returned 6
	[0048.526] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.jpg") returned 0
	[0048.526] lstrlenA (lpString="*.jpg") returned 5
	[0048.526] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.jpeg") returned 0
	[0048.526] lstrlenA (lpString="*.jpeg") returned 6
	[0048.526] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.bmp") returned 0
	[0048.526] lstrlenA (lpString="*.bmp") returned 5
	[0048.526] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.gif") returned 0
	[0048.526] lstrlenA (lpString="*.gif") returned 5
	[0048.526] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.png") returned 0
	[0048.526] lstrlenA (lpString="*.png") returned 5
	[0048.526] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.doc") returned 0
	[0048.526] lstrlenA (lpString="*.doc") returned 5
	[0048.526] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.docx") returned 0
	[0048.526] lstrlenA (lpString="*.docx") returned 6
	[0048.526] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.xls") returned 0
	[0048.526] lstrlenA (lpString="*.xls") returned 5
	[0048.526] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.xlsx") returned 0
	[0048.526] lstrlenA (lpString="*.xlsx") returned 6
	[0048.526] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.ppt") returned 0
	[0048.527] lstrlenA (lpString="*.ppt") returned 5
	[0048.527] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.pptx") returned 0
	[0048.527] lstrlenA (lpString="*.pptx") returned 6
	[0048.527] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.txt") returned 0
	[0048.527] lstrlenA (lpString="*.txt") returned 5
	[0048.527] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.pdf") returned 0
	[0048.527] lstrlenA (lpString="*.pdf") returned 5
	[0048.527] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.htm") returned 0
	[0048.527] lstrlenA (lpString="*.htm") returned 5
	[0048.527] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.html") returned 0
	[0048.527] lstrlenA (lpString="*.html") returned 6
	[0048.527] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.mdb") returned 0
	[0048.527] lstrlenA (lpString="*.mdb") returned 5
	[0048.527] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.pfx") returned 0
	[0048.527] lstrlenA (lpString="*.pfx") returned 5
	[0048.527] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.md") returned 0
	[0048.527] lstrlenA (lpString="*.md") returned 4
	[0048.527] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.lnk") returned 0
	[0048.527] lstrlenA (lpString="*.lnk") returned 5
	[0048.527] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.torrent") returned 0
	[0048.527] lstrlenA (lpString="*.torrent") returned 9
	[0048.527] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.mov") returned 0
	[0048.527] lstrlenA (lpString="*.mov") returned 5
	[0048.527] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.3gp") returned 0
	[0048.527] lstrlenA (lpString="*.3gp") returned 5
	[0048.527] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.mpeg") returned 0
	[0048.527] lstrlenA (lpString="*.mpeg") returned 6
	[0048.527] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.mpg") returned 0
	[0048.527] lstrlenA (lpString="*.mpg") returned 5
	[0048.527] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.flv") returned 0
	[0048.527] lstrlenA (lpString="*.flv") returned 5
	[0048.527] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.avi") returned 0
	[0048.527] lstrlenA (lpString="*.avi") returned 5
	[0048.527] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.mp4") returned 0
	[0048.527] lstrlenA (lpString="*.mp4") returned 5
	[0048.527] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.wmv") returned 0
	[0048.527] lstrlenA (lpString="*.wmv") returned 5
	[0048.528] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.mkv") returned 0
	[0048.528] lstrlenA (lpString="*.mkv") returned 5
	[0048.528] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.mp3") returned 0
	[0048.528] lstrlenA (lpString="*.mp3") returned 5
	[0048.528] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.wav") returned 0
	[0048.528] lstrlenA (lpString="*.wav") returned 5
	[0048.528] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.flac") returned 0
	[0048.528] lstrlenA (lpString="*.flac") returned 6
	[0048.528] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.wma") returned 0
	[0048.528] lstrlenA (lpString="*.wma") returned 5
	[0048.528] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.au3") returned 0
	[0048.528] lstrlenA (lpString="*.au3") returned 5
	[0048.528] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.ahk") returned 0
	[0048.528] lstrlenA (lpString="*.ahk") returned 5
	[0048.528] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.c") returned 0
	[0048.528] lstrlenA (lpString="*.c") returned 3
	[0048.528] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.cc") returned 0
	[0048.528] lstrlenA (lpString="*.cc") returned 4
	[0048.528] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.cpp") returned 0
	[0048.528] lstrlenA (lpString="*.cpp") returned 5
	[0048.528] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.cxx") returned 0
	[0048.528] lstrlenA (lpString="*.cxx") returned 5
	[0048.528] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.c++") returned 0
	[0048.528] lstrlenA (lpString="*.c++") returned 5
	[0048.528] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.cs") returned 0
	[0048.528] lstrlenA (lpString="*.cs") returned 4
	[0048.528] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.vb") returned 0
	[0048.528] lstrlenA (lpString="*.vb") returned 4
	[0048.528] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.bas") returned 0
	[0048.528] lstrlenA (lpString="*.bas") returned 5
	[0048.528] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.csproj") returned 0
	[0048.528] lstrlenA (lpString="*.csproj") returned 8
	[0048.528] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.vbproj") returned 0
	[0048.528] lstrlenA (lpString="*.vbproj") returned 8
	[0048.528] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.vcxproj") returned 0
	[0048.528] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.528] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.manifest") returned 0
	[0048.528] lstrlenA (lpString="*.manifest") returned 10
	[0048.529] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.php") returned 0
	[0048.529] lstrlenA (lpString="*.php") returned 5
	[0048.529] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.vbe") returned 0
	[0048.529] lstrlenA (lpString="*.vbe") returned 5
	[0048.529] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.vba") returned 0
	[0048.529] lstrlenA (lpString="*.vba") returned 5
	[0048.529] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.vbs") returned 0
	[0048.529] lstrlenA (lpString="*.vbs") returned 5
	[0048.529] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.bat") returned 0
	[0048.529] lstrlenA (lpString="*.bat") returned 5
	[0048.529] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.cmd") returned 0
	[0048.529] lstrlenA (lpString="*.cmd") returned 5
	[0048.529] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.js") returned 0
	[0048.529] lstrlenA (lpString="*.js") returned 4
	[0048.529] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.jscript") returned 0
	[0048.529] lstrlenA (lpString="*.jscript") returned 9
	[0048.529] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.hta") returned 0
	[0048.529] lstrlenA (lpString="*.hta") returned 5
	[0048.529] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.php7") returned 0
	[0048.529] lstrlenA (lpString="*.php7") returned 6
	[0048.529] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.db") returned 0
	[0048.529] lstrlenA (lpString="*.db") returned 4
	[0048.529] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.swf") returned 0
	[0048.529] lstrlenA (lpString="*.swf") returned 5
	[0048.529] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.eml") returned 0
	[0048.529] lstrlenA (lpString="*.eml") returned 5
	[0048.529] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.part") returned 0
	[0048.529] lstrlenA (lpString="*.part") returned 6
	[0048.529] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.nfo") returned 0
	[0048.529] lstrlenA (lpString="*.nfo") returned 5
	[0048.529] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.rsa") returned 0
	[0048.529] lstrlenA (lpString="*.rsa") returned 5
	[0048.529] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.key") returned 0
	[0048.529] lstrlenA (lpString="*.key") returned 5
	[0048.529] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.aes") returned 0
	[0048.529] lstrlenA (lpString="*.aes") returned 5
	[0048.529] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.blob") returned 0
	[0048.530] lstrlenA (lpString="*.blob") returned 6
	[0048.530] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.btc") returned 0
	[0048.530] lstrlenA (lpString="*.btc") returned 5
	[0048.530] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.wallet") returned 0
	[0048.530] lstrlenA (lpString="*.wallet") returned 8
	[0048.530] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0048.530] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.530] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="LocalizedData.xml") returned -1
	[0048.530] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="LocalizedData.xml") returned -1
	[0048.530] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1
	[0048.530] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned="eula.rtf"
	[0048.530] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1043\\" | out: lpString1="C:\\588bce7c90097ed212\\1043\\") returned="C:\\588bce7c90097ed212\\1043\\"
	[0048.530] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1043\\" | out: pszPath="C:\\588bce7c90097ed212\\1043\\") returned=""
	[0048.530] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1043\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1043\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1043\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.530] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1043\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1043\\how-to-decrypt-files.htm")) returned 0x20
	[0048.530] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1043\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml"
	[0048.530] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.zip") returned 0
	[0048.530] lstrlenA (lpString="*.zip") returned 5
	[0048.530] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.rar") returned 0
	[0048.530] lstrlenA (lpString="*.rar") returned 5
	[0048.530] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.7z") returned 0
	[0048.530] lstrlenA (lpString="*.7z") returned 4
	[0048.530] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.tar") returned 0
	[0048.530] lstrlenA (lpString="*.tar") returned 5
	[0048.530] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.gzip") returned 0
	[0048.530] lstrlenA (lpString="*.gzip") returned 6
	[0048.530] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.jpg") returned 0
	[0048.530] lstrlenA (lpString="*.jpg") returned 5
	[0048.531] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.jpeg") returned 0
	[0048.531] lstrlenA (lpString="*.jpeg") returned 6
	[0048.531] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.bmp") returned 0
	[0048.531] lstrlenA (lpString="*.bmp") returned 5
	[0048.531] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.gif") returned 0
	[0048.531] lstrlenA (lpString="*.gif") returned 5
	[0048.531] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.png") returned 0
	[0048.531] lstrlenA (lpString="*.png") returned 5
	[0048.531] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.doc") returned 0
	[0048.531] lstrlenA (lpString="*.doc") returned 5
	[0048.531] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.docx") returned 0
	[0048.531] lstrlenA (lpString="*.docx") returned 6
	[0048.531] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.xls") returned 0
	[0048.531] lstrlenA (lpString="*.xls") returned 5
	[0048.531] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.xlsx") returned 0
	[0048.531] lstrlenA (lpString="*.xlsx") returned 6
	[0048.531] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.ppt") returned 0
	[0048.531] lstrlenA (lpString="*.ppt") returned 5
	[0048.531] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.pptx") returned 0
	[0048.531] lstrlenA (lpString="*.pptx") returned 6
	[0048.531] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.txt") returned 0
	[0048.531] lstrlenA (lpString="*.txt") returned 5
	[0048.531] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.pdf") returned 0
	[0048.531] lstrlenA (lpString="*.pdf") returned 5
	[0048.531] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.htm") returned 0
	[0048.531] lstrlenA (lpString="*.htm") returned 5
	[0048.531] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.html") returned 0
	[0048.531] lstrlenA (lpString="*.html") returned 6
	[0048.531] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.mdb") returned 0
	[0048.531] lstrlenA (lpString="*.mdb") returned 5
	[0048.531] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.pfx") returned 0
	[0048.531] lstrlenA (lpString="*.pfx") returned 5
	[0048.531] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.md") returned 0
	[0048.531] lstrlenA (lpString="*.md") returned 4
	[0048.531] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.lnk") returned 0
	[0048.531] lstrlenA (lpString="*.lnk") returned 5
	[0048.531] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.torrent") returned 0
	[0048.532] lstrlenA (lpString="*.torrent") returned 9
	[0048.532] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.mov") returned 0
	[0048.532] lstrlenA (lpString="*.mov") returned 5
	[0048.532] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.3gp") returned 0
	[0048.532] lstrlenA (lpString="*.3gp") returned 5
	[0048.532] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.mpeg") returned 0
	[0048.532] lstrlenA (lpString="*.mpeg") returned 6
	[0048.532] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.mpg") returned 0
	[0048.532] lstrlenA (lpString="*.mpg") returned 5
	[0048.532] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.flv") returned 0
	[0048.532] lstrlenA (lpString="*.flv") returned 5
	[0048.532] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.avi") returned 0
	[0048.532] lstrlenA (lpString="*.avi") returned 5
	[0048.532] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.mp4") returned 0
	[0048.532] lstrlenA (lpString="*.mp4") returned 5
	[0048.532] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.wmv") returned 0
	[0048.532] lstrlenA (lpString="*.wmv") returned 5
	[0048.532] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.mkv") returned 0
	[0048.532] lstrlenA (lpString="*.mkv") returned 5
	[0048.532] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.mp3") returned 0
	[0048.532] lstrlenA (lpString="*.mp3") returned 5
	[0048.532] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.wav") returned 0
	[0048.532] lstrlenA (lpString="*.wav") returned 5
	[0048.532] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.flac") returned 0
	[0048.532] lstrlenA (lpString="*.flac") returned 6
	[0048.532] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.wma") returned 0
	[0048.532] lstrlenA (lpString="*.wma") returned 5
	[0048.532] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.au3") returned 0
	[0048.532] lstrlenA (lpString="*.au3") returned 5
	[0048.532] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.ahk") returned 0
	[0048.532] lstrlenA (lpString="*.ahk") returned 5
	[0048.532] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.c") returned 0
	[0048.532] lstrlenA (lpString="*.c") returned 3
	[0048.532] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.cc") returned 0
	[0048.532] lstrlenA (lpString="*.cc") returned 4
	[0048.532] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.cpp") returned 0
	[0048.532] lstrlenA (lpString="*.cpp") returned 5
	[0048.532] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.cxx") returned 0
	[0048.532] lstrlenA (lpString="*.cxx") returned 5
	[0048.533] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.c++") returned 0
	[0048.533] lstrlenA (lpString="*.c++") returned 5
	[0048.533] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.cs") returned 0
	[0048.533] lstrlenA (lpString="*.cs") returned 4
	[0048.533] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.vb") returned 0
	[0048.533] lstrlenA (lpString="*.vb") returned 4
	[0048.533] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.bas") returned 0
	[0048.533] lstrlenA (lpString="*.bas") returned 5
	[0048.533] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.csproj") returned 0
	[0048.533] lstrlenA (lpString="*.csproj") returned 8
	[0048.533] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.vbproj") returned 0
	[0048.533] lstrlenA (lpString="*.vbproj") returned 8
	[0048.533] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.vcxproj") returned 0
	[0048.533] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.533] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.manifest") returned 0
	[0048.533] lstrlenA (lpString="*.manifest") returned 10
	[0048.533] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.php") returned 0
	[0048.533] lstrlenA (lpString="*.php") returned 5
	[0048.533] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.vbe") returned 0
	[0048.533] lstrlenA (lpString="*.vbe") returned 5
	[0048.533] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.vba") returned 0
	[0048.533] lstrlenA (lpString="*.vba") returned 5
	[0048.533] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.vbs") returned 0
	[0048.533] lstrlenA (lpString="*.vbs") returned 5
	[0048.533] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.bat") returned 0
	[0048.533] lstrlenA (lpString="*.bat") returned 5
	[0048.533] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.cmd") returned 0
	[0048.533] lstrlenA (lpString="*.cmd") returned 5
	[0048.533] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.js") returned 0
	[0048.533] lstrlenA (lpString="*.js") returned 4
	[0048.533] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.jscript") returned 0
	[0048.533] lstrlenA (lpString="*.jscript") returned 9
	[0048.533] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.hta") returned 0
	[0048.533] lstrlenA (lpString="*.hta") returned 5
	[0048.533] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.php7") returned 0
	[0048.533] lstrlenA (lpString="*.php7") returned 6
	[0048.533] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.db") returned 0
	[0048.534] lstrlenA (lpString="*.db") returned 4
	[0048.534] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.swf") returned 0
	[0048.534] lstrlenA (lpString="*.swf") returned 5
	[0048.534] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.eml") returned 0
	[0048.534] lstrlenA (lpString="*.eml") returned 5
	[0048.534] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.part") returned 0
	[0048.534] lstrlenA (lpString="*.part") returned 6
	[0048.534] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.nfo") returned 0
	[0048.534] lstrlenA (lpString="*.nfo") returned 5
	[0048.534] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.rsa") returned 0
	[0048.534] lstrlenA (lpString="*.rsa") returned 5
	[0048.534] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.key") returned 0
	[0048.534] lstrlenA (lpString="*.key") returned 5
	[0048.534] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.aes") returned 0
	[0048.534] lstrlenA (lpString="*.aes") returned 5
	[0048.534] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.blob") returned 0
	[0048.534] lstrlenA (lpString="*.blob") returned 6
	[0048.534] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.btc") returned 0
	[0048.534] lstrlenA (lpString="*.btc") returned 5
	[0048.534] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.wallet") returned 0
	[0048.534] lstrlenA (lpString="*.wallet") returned 8
	[0048.534] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0048.534] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.534] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SetupResources.dll") returned -1
	[0048.534] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SetupResources.dll") returned -1
	[0048.534] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1
	[0048.534] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned="LocalizedData.xml"
	[0048.534] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1043\\" | out: lpString1="C:\\588bce7c90097ed212\\1043\\") returned="C:\\588bce7c90097ed212\\1043\\"
	[0048.534] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1043\\" | out: pszPath="C:\\588bce7c90097ed212\\1043\\") returned=""
	[0048.534] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1043\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1043\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1043\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.534] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1043\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1043\\how-to-decrypt-files.htm")) returned 0x20
	[0048.534] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1043\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1043\\SetupResources.dll"
	[0048.534] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.zip") returned 0
	[0048.534] lstrlenA (lpString="*.zip") returned 5
	[0048.534] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.rar") returned 0
	[0048.535] lstrlenA (lpString="*.rar") returned 5
	[0048.535] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.7z") returned 0
	[0048.535] lstrlenA (lpString="*.7z") returned 4
	[0048.535] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.tar") returned 0
	[0048.535] lstrlenA (lpString="*.tar") returned 5
	[0048.535] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.gzip") returned 0
	[0048.535] lstrlenA (lpString="*.gzip") returned 6
	[0048.535] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.jpg") returned 0
	[0048.535] lstrlenA (lpString="*.jpg") returned 5
	[0048.535] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.jpeg") returned 0
	[0048.535] lstrlenA (lpString="*.jpeg") returned 6
	[0048.535] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.bmp") returned 0
	[0048.535] lstrlenA (lpString="*.bmp") returned 5
	[0048.535] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.gif") returned 0
	[0048.535] lstrlenA (lpString="*.gif") returned 5
	[0048.535] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.png") returned 0
	[0048.535] lstrlenA (lpString="*.png") returned 5
	[0048.535] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.doc") returned 0
	[0048.535] lstrlenA (lpString="*.doc") returned 5
	[0048.535] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.docx") returned 0
	[0048.535] lstrlenA (lpString="*.docx") returned 6
	[0048.535] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.xls") returned 0
	[0048.535] lstrlenA (lpString="*.xls") returned 5
	[0048.535] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.xlsx") returned 0
	[0048.535] lstrlenA (lpString="*.xlsx") returned 6
	[0048.535] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.ppt") returned 0
	[0048.535] lstrlenA (lpString="*.ppt") returned 5
	[0048.535] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.pptx") returned 0
	[0048.535] lstrlenA (lpString="*.pptx") returned 6
	[0048.535] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.txt") returned 0
	[0048.535] lstrlenA (lpString="*.txt") returned 5
	[0048.535] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.pdf") returned 0
	[0048.535] lstrlenA (lpString="*.pdf") returned 5
	[0048.535] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.htm") returned 0
	[0048.535] lstrlenA (lpString="*.htm") returned 5
	[0048.535] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.html") returned 0
	[0048.535] lstrlenA (lpString="*.html") returned 6
	[0048.536] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.mdb") returned 0
	[0048.536] lstrlenA (lpString="*.mdb") returned 5
	[0048.536] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.pfx") returned 0
	[0048.536] lstrlenA (lpString="*.pfx") returned 5
	[0048.536] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.md") returned 0
	[0048.536] lstrlenA (lpString="*.md") returned 4
	[0048.536] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.lnk") returned 0
	[0048.536] lstrlenA (lpString="*.lnk") returned 5
	[0048.536] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.torrent") returned 0
	[0048.536] lstrlenA (lpString="*.torrent") returned 9
	[0048.536] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.mov") returned 0
	[0048.536] lstrlenA (lpString="*.mov") returned 5
	[0048.536] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.3gp") returned 0
	[0048.536] lstrlenA (lpString="*.3gp") returned 5
	[0048.536] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.mpeg") returned 0
	[0048.536] lstrlenA (lpString="*.mpeg") returned 6
	[0048.536] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.mpg") returned 0
	[0048.536] lstrlenA (lpString="*.mpg") returned 5
	[0048.536] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.flv") returned 0
	[0048.536] lstrlenA (lpString="*.flv") returned 5
	[0048.536] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.avi") returned 0
	[0048.536] lstrlenA (lpString="*.avi") returned 5
	[0048.536] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.mp4") returned 0
	[0048.536] lstrlenA (lpString="*.mp4") returned 5
	[0048.536] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.wmv") returned 0
	[0048.536] lstrlenA (lpString="*.wmv") returned 5
	[0048.536] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.mkv") returned 0
	[0048.536] lstrlenA (lpString="*.mkv") returned 5
	[0048.536] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.mp3") returned 0
	[0048.536] lstrlenA (lpString="*.mp3") returned 5
	[0048.536] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.wav") returned 0
	[0048.536] lstrlenA (lpString="*.wav") returned 5
	[0048.536] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.flac") returned 0
	[0048.536] lstrlenA (lpString="*.flac") returned 6
	[0048.536] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.wma") returned 0
	[0048.536] lstrlenA (lpString="*.wma") returned 5
	[0048.536] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.au3") returned 0
	[0048.536] lstrlenA (lpString="*.au3") returned 5
	[0048.537] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.ahk") returned 0
	[0048.537] lstrlenA (lpString="*.ahk") returned 5
	[0048.537] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.c") returned 0
	[0048.537] lstrlenA (lpString="*.c") returned 3
	[0048.537] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.cc") returned 0
	[0048.537] lstrlenA (lpString="*.cc") returned 4
	[0048.537] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.cpp") returned 0
	[0048.537] lstrlenA (lpString="*.cpp") returned 5
	[0048.537] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.cxx") returned 0
	[0048.537] lstrlenA (lpString="*.cxx") returned 5
	[0048.537] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.c++") returned 0
	[0048.537] lstrlenA (lpString="*.c++") returned 5
	[0048.537] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.cs") returned 0
	[0048.537] lstrlenA (lpString="*.cs") returned 4
	[0048.537] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.vb") returned 0
	[0048.537] lstrlenA (lpString="*.vb") returned 4
	[0048.537] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.bas") returned 0
	[0048.537] lstrlenA (lpString="*.bas") returned 5
	[0048.537] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.csproj") returned 0
	[0048.537] lstrlenA (lpString="*.csproj") returned 8
	[0048.537] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.vbproj") returned 0
	[0048.537] lstrlenA (lpString="*.vbproj") returned 8
	[0048.537] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.vcxproj") returned 0
	[0048.537] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.537] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.manifest") returned 0
	[0048.537] lstrlenA (lpString="*.manifest") returned 10
	[0048.537] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.php") returned 0
	[0048.537] lstrlenA (lpString="*.php") returned 5
	[0048.537] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.vbe") returned 0
	[0048.537] lstrlenA (lpString="*.vbe") returned 5
	[0048.537] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.vba") returned 0
	[0048.537] lstrlenA (lpString="*.vba") returned 5
	[0048.537] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.vbs") returned 0
	[0048.537] lstrlenA (lpString="*.vbs") returned 5
	[0048.537] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.bat") returned 0
	[0048.537] lstrlenA (lpString="*.bat") returned 5
	[0048.538] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.cmd") returned 0
	[0048.538] lstrlenA (lpString="*.cmd") returned 5
	[0048.538] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.js") returned 0
	[0048.538] lstrlenA (lpString="*.js") returned 4
	[0048.538] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.jscript") returned 0
	[0048.538] lstrlenA (lpString="*.jscript") returned 9
	[0048.538] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.hta") returned 0
	[0048.538] lstrlenA (lpString="*.hta") returned 5
	[0048.538] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.php7") returned 0
	[0048.538] lstrlenA (lpString="*.php7") returned 6
	[0048.538] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.db") returned 0
	[0048.538] lstrlenA (lpString="*.db") returned 4
	[0048.538] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.swf") returned 0
	[0048.538] lstrlenA (lpString="*.swf") returned 5
	[0048.538] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.eml") returned 0
	[0048.538] lstrlenA (lpString="*.eml") returned 5
	[0048.538] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.part") returned 0
	[0048.538] lstrlenA (lpString="*.part") returned 6
	[0048.538] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.nfo") returned 0
	[0048.538] lstrlenA (lpString="*.nfo") returned 5
	[0048.538] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.rsa") returned 0
	[0048.538] lstrlenA (lpString="*.rsa") returned 5
	[0048.538] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.key") returned 0
	[0048.538] lstrlenA (lpString="*.key") returned 5
	[0048.538] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.aes") returned 0
	[0048.538] lstrlenA (lpString="*.aes") returned 5
	[0048.538] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.blob") returned 0
	[0048.538] lstrlenA (lpString="*.blob") returned 6
	[0048.538] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.btc") returned 0
	[0048.538] lstrlenA (lpString="*.btc") returned 5
	[0048.538] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.wallet") returned 0
	[0048.538] lstrlenA (lpString="*.wallet") returned 8
	[0048.538] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0048.538] FindClose (in: hFindFile=0x7cbc50 | out: hFindFile=0x7cbc50) returned 1
	[0048.539] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d1d40, dwReserved1=0x7b00c0, cFileName="1044", cAlternateFileName="")) returned 1
	[0048.539] lstrcmpA (lpString1=".", lpString2="1044") returned -1
	[0048.539] lstrcmpA (lpString1="..", lpString2="1044") returned -1
	[0048.539] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*"
	[0048.539] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1044" | out: lpString1="C:\\588bce7c90097ed212\\1044") returned="C:\\588bce7c90097ed212\\1044"
	[0048.539] lstrlenA (lpString="C:\\588bce7c90097ed212\\1044") returned 26
	[0048.539] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbb90
	[0048.539] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0048.539] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0048.539] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0048.540] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0048.540] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0048.540] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.540] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="eula.rtf") returned -1
	[0048.540] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="eula.rtf") returned 1
	[0048.540] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1
	[0048.540] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1044\\*.*") returned="*.*"
	[0048.540] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1044\\" | out: lpString1="C:\\588bce7c90097ed212\\1044\\") returned="C:\\588bce7c90097ed212\\1044\\"
	[0048.540] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1044\\" | out: pszPath="C:\\588bce7c90097ed212\\1044\\") returned=""
	[0048.540] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1044\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1044\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1044\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.540] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1044\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1044\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0048.540] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1044\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1044\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0048.542] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0048.542] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0048.543] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0048.543] CloseHandle (hObject=0x208) returned 1
	[0048.543] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1044\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned="C:\\588bce7c90097ed212\\1044\\eula.rtf"
	[0048.543] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.zip") returned 0
	[0048.543] lstrlenA (lpString="*.zip") returned 5
	[0048.544] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.rar") returned 0
	[0048.544] lstrlenA (lpString="*.rar") returned 5
	[0048.544] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.7z") returned 0
	[0048.544] lstrlenA (lpString="*.7z") returned 4
	[0048.544] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.tar") returned 0
	[0048.544] lstrlenA (lpString="*.tar") returned 5
	[0048.544] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.gzip") returned 0
	[0048.544] lstrlenA (lpString="*.gzip") returned 6
	[0048.544] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.jpg") returned 0
	[0048.544] lstrlenA (lpString="*.jpg") returned 5
	[0048.544] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.jpeg") returned 0
	[0048.544] lstrlenA (lpString="*.jpeg") returned 6
	[0048.544] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.bmp") returned 0
	[0048.544] lstrlenA (lpString="*.bmp") returned 5
	[0048.544] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.gif") returned 0
	[0048.544] lstrlenA (lpString="*.gif") returned 5
	[0048.544] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.png") returned 0
	[0048.544] lstrlenA (lpString="*.png") returned 5
	[0048.544] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.doc") returned 0
	[0048.544] lstrlenA (lpString="*.doc") returned 5
	[0048.544] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.docx") returned 0
	[0048.544] lstrlenA (lpString="*.docx") returned 6
	[0048.544] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.xls") returned 0
	[0048.544] lstrlenA (lpString="*.xls") returned 5
	[0048.544] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.xlsx") returned 0
	[0048.544] lstrlenA (lpString="*.xlsx") returned 6
	[0048.544] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.ppt") returned 0
	[0048.544] lstrlenA (lpString="*.ppt") returned 5
	[0048.544] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.pptx") returned 0
	[0048.544] lstrlenA (lpString="*.pptx") returned 6
	[0048.544] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.txt") returned 0
	[0048.544] lstrlenA (lpString="*.txt") returned 5
	[0048.544] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.pdf") returned 0
	[0048.544] lstrlenA (lpString="*.pdf") returned 5
	[0048.544] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.htm") returned 0
	[0048.544] lstrlenA (lpString="*.htm") returned 5
	[0048.544] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.html") returned 0
	[0048.545] lstrlenA (lpString="*.html") returned 6
	[0048.545] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.mdb") returned 0
	[0048.545] lstrlenA (lpString="*.mdb") returned 5
	[0048.545] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.pfx") returned 0
	[0048.545] lstrlenA (lpString="*.pfx") returned 5
	[0048.545] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.md") returned 0
	[0048.545] lstrlenA (lpString="*.md") returned 4
	[0048.545] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.lnk") returned 0
	[0048.545] lstrlenA (lpString="*.lnk") returned 5
	[0048.545] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.torrent") returned 0
	[0048.545] lstrlenA (lpString="*.torrent") returned 9
	[0048.545] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.mov") returned 0
	[0048.545] lstrlenA (lpString="*.mov") returned 5
	[0048.545] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.3gp") returned 0
	[0048.545] lstrlenA (lpString="*.3gp") returned 5
	[0048.545] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.mpeg") returned 0
	[0048.545] lstrlenA (lpString="*.mpeg") returned 6
	[0048.545] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.mpg") returned 0
	[0048.545] lstrlenA (lpString="*.mpg") returned 5
	[0048.545] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.flv") returned 0
	[0048.545] lstrlenA (lpString="*.flv") returned 5
	[0048.545] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.avi") returned 0
	[0048.545] lstrlenA (lpString="*.avi") returned 5
	[0048.545] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.mp4") returned 0
	[0048.545] lstrlenA (lpString="*.mp4") returned 5
	[0048.545] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.wmv") returned 0
	[0048.545] lstrlenA (lpString="*.wmv") returned 5
	[0048.545] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.mkv") returned 0
	[0048.545] lstrlenA (lpString="*.mkv") returned 5
	[0048.545] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.mp3") returned 0
	[0048.545] lstrlenA (lpString="*.mp3") returned 5
	[0048.545] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.wav") returned 0
	[0048.545] lstrlenA (lpString="*.wav") returned 5
	[0048.545] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.flac") returned 0
	[0048.545] lstrlenA (lpString="*.flac") returned 6
	[0048.545] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.wma") returned 0
	[0048.545] lstrlenA (lpString="*.wma") returned 5
	[0048.546] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.au3") returned 0
	[0048.546] lstrlenA (lpString="*.au3") returned 5
	[0048.546] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.ahk") returned 0
	[0048.546] lstrlenA (lpString="*.ahk") returned 5
	[0048.546] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.c") returned 0
	[0048.546] lstrlenA (lpString="*.c") returned 3
	[0048.546] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.cc") returned 0
	[0048.546] lstrlenA (lpString="*.cc") returned 4
	[0048.546] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.cpp") returned 0
	[0048.546] lstrlenA (lpString="*.cpp") returned 5
	[0048.546] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.cxx") returned 0
	[0048.546] lstrlenA (lpString="*.cxx") returned 5
	[0048.546] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.c++") returned 0
	[0048.546] lstrlenA (lpString="*.c++") returned 5
	[0048.546] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.cs") returned 0
	[0048.546] lstrlenA (lpString="*.cs") returned 4
	[0048.546] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.vb") returned 0
	[0048.546] lstrlenA (lpString="*.vb") returned 4
	[0048.546] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.bas") returned 0
	[0048.546] lstrlenA (lpString="*.bas") returned 5
	[0048.546] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.csproj") returned 0
	[0048.546] lstrlenA (lpString="*.csproj") returned 8
	[0048.546] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.vbproj") returned 0
	[0048.546] lstrlenA (lpString="*.vbproj") returned 8
	[0048.546] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.vcxproj") returned 0
	[0048.546] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.546] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.manifest") returned 0
	[0048.546] lstrlenA (lpString="*.manifest") returned 10
	[0048.546] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.php") returned 0
	[0048.546] lstrlenA (lpString="*.php") returned 5
	[0048.546] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.vbe") returned 0
	[0048.546] lstrlenA (lpString="*.vbe") returned 5
	[0048.546] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.vba") returned 0
	[0048.546] lstrlenA (lpString="*.vba") returned 5
	[0048.546] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.vbs") returned 0
	[0048.546] lstrlenA (lpString="*.vbs") returned 5
	[0048.546] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.bat") returned 0
	[0048.546] lstrlenA (lpString="*.bat") returned 5
	[0048.547] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.cmd") returned 0
	[0048.547] lstrlenA (lpString="*.cmd") returned 5
	[0048.547] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.js") returned 0
	[0048.547] lstrlenA (lpString="*.js") returned 4
	[0048.547] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.jscript") returned 0
	[0048.547] lstrlenA (lpString="*.jscript") returned 9
	[0048.547] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.hta") returned 0
	[0048.547] lstrlenA (lpString="*.hta") returned 5
	[0048.547] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.php7") returned 0
	[0048.547] lstrlenA (lpString="*.php7") returned 6
	[0048.547] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.db") returned 0
	[0048.547] lstrlenA (lpString="*.db") returned 4
	[0048.547] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.swf") returned 0
	[0048.547] lstrlenA (lpString="*.swf") returned 5
	[0048.547] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.eml") returned 0
	[0048.547] lstrlenA (lpString="*.eml") returned 5
	[0048.547] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.part") returned 0
	[0048.547] lstrlenA (lpString="*.part") returned 6
	[0048.547] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.nfo") returned 0
	[0048.547] lstrlenA (lpString="*.nfo") returned 5
	[0048.547] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.rsa") returned 0
	[0048.547] lstrlenA (lpString="*.rsa") returned 5
	[0048.547] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.key") returned 0
	[0048.547] lstrlenA (lpString="*.key") returned 5
	[0048.547] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.aes") returned 0
	[0048.547] lstrlenA (lpString="*.aes") returned 5
	[0048.547] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.blob") returned 0
	[0048.547] lstrlenA (lpString="*.blob") returned 6
	[0048.547] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.btc") returned 0
	[0048.547] lstrlenA (lpString="*.btc") returned 5
	[0048.547] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.wallet") returned 0
	[0048.547] lstrlenA (lpString="*.wallet") returned 8
	[0048.547] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0048.547] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.547] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="LocalizedData.xml") returned -1
	[0048.547] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="LocalizedData.xml") returned -1
	[0048.547] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1
	[0048.548] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned="eula.rtf"
	[0048.548] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1044\\" | out: lpString1="C:\\588bce7c90097ed212\\1044\\") returned="C:\\588bce7c90097ed212\\1044\\"
	[0048.548] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1044\\" | out: pszPath="C:\\588bce7c90097ed212\\1044\\") returned=""
	[0048.548] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1044\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1044\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1044\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.548] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1044\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1044\\how-to-decrypt-files.htm")) returned 0x20
	[0048.548] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1044\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml"
	[0048.548] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.zip") returned 0
	[0048.548] lstrlenA (lpString="*.zip") returned 5
	[0048.548] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.rar") returned 0
	[0048.548] lstrlenA (lpString="*.rar") returned 5
	[0048.548] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.7z") returned 0
	[0048.548] lstrlenA (lpString="*.7z") returned 4
	[0048.548] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.tar") returned 0
	[0048.548] lstrlenA (lpString="*.tar") returned 5
	[0048.548] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.gzip") returned 0
	[0048.548] lstrlenA (lpString="*.gzip") returned 6
	[0048.548] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.jpg") returned 0
	[0048.548] lstrlenA (lpString="*.jpg") returned 5
	[0048.548] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.jpeg") returned 0
	[0048.548] lstrlenA (lpString="*.jpeg") returned 6
	[0048.548] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.bmp") returned 0
	[0048.548] lstrlenA (lpString="*.bmp") returned 5
	[0048.548] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.gif") returned 0
	[0048.548] lstrlenA (lpString="*.gif") returned 5
	[0048.548] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.png") returned 0
	[0048.548] lstrlenA (lpString="*.png") returned 5
	[0048.548] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.doc") returned 0
	[0048.548] lstrlenA (lpString="*.doc") returned 5
	[0048.548] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.docx") returned 0
	[0048.548] lstrlenA (lpString="*.docx") returned 6
	[0048.548] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.xls") returned 0
	[0048.548] lstrlenA (lpString="*.xls") returned 5
	[0048.548] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.xlsx") returned 0
	[0048.548] lstrlenA (lpString="*.xlsx") returned 6
	[0048.549] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.ppt") returned 0
	[0048.549] lstrlenA (lpString="*.ppt") returned 5
	[0048.549] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.pptx") returned 0
	[0048.549] lstrlenA (lpString="*.pptx") returned 6
	[0048.549] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.txt") returned 0
	[0048.549] lstrlenA (lpString="*.txt") returned 5
	[0048.549] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.pdf") returned 0
	[0048.549] lstrlenA (lpString="*.pdf") returned 5
	[0048.549] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.htm") returned 0
	[0048.549] lstrlenA (lpString="*.htm") returned 5
	[0048.549] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.html") returned 0
	[0048.549] lstrlenA (lpString="*.html") returned 6
	[0048.549] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.mdb") returned 0
	[0048.549] lstrlenA (lpString="*.mdb") returned 5
	[0048.549] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.pfx") returned 0
	[0048.549] lstrlenA (lpString="*.pfx") returned 5
	[0048.549] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.md") returned 0
	[0048.549] lstrlenA (lpString="*.md") returned 4
	[0048.549] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.lnk") returned 0
	[0048.549] lstrlenA (lpString="*.lnk") returned 5
	[0048.549] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.torrent") returned 0
	[0048.549] lstrlenA (lpString="*.torrent") returned 9
	[0048.549] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.mov") returned 0
	[0048.549] lstrlenA (lpString="*.mov") returned 5
	[0048.549] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.3gp") returned 0
	[0048.549] lstrlenA (lpString="*.3gp") returned 5
	[0048.549] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.mpeg") returned 0
	[0048.549] lstrlenA (lpString="*.mpeg") returned 6
	[0048.549] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.mpg") returned 0
	[0048.549] lstrlenA (lpString="*.mpg") returned 5
	[0048.549] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.flv") returned 0
	[0048.549] lstrlenA (lpString="*.flv") returned 5
	[0048.549] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.avi") returned 0
	[0048.549] lstrlenA (lpString="*.avi") returned 5
	[0048.549] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.mp4") returned 0
	[0048.549] lstrlenA (lpString="*.mp4") returned 5
	[0048.550] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.wmv") returned 0
	[0048.550] lstrlenA (lpString="*.wmv") returned 5
	[0048.550] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.mkv") returned 0
	[0048.550] lstrlenA (lpString="*.mkv") returned 5
	[0048.550] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.mp3") returned 0
	[0048.550] lstrlenA (lpString="*.mp3") returned 5
	[0048.550] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.wav") returned 0
	[0048.550] lstrlenA (lpString="*.wav") returned 5
	[0048.550] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.flac") returned 0
	[0048.550] lstrlenA (lpString="*.flac") returned 6
	[0048.550] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.wma") returned 0
	[0048.550] lstrlenA (lpString="*.wma") returned 5
	[0048.550] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.au3") returned 0
	[0048.550] lstrlenA (lpString="*.au3") returned 5
	[0048.550] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.ahk") returned 0
	[0048.550] lstrlenA (lpString="*.ahk") returned 5
	[0048.550] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.c") returned 0
	[0048.550] lstrlenA (lpString="*.c") returned 3
	[0048.550] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.cc") returned 0
	[0048.550] lstrlenA (lpString="*.cc") returned 4
	[0048.550] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.cpp") returned 0
	[0048.550] lstrlenA (lpString="*.cpp") returned 5
	[0048.550] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.cxx") returned 0
	[0048.550] lstrlenA (lpString="*.cxx") returned 5
	[0048.550] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.c++") returned 0
	[0048.550] lstrlenA (lpString="*.c++") returned 5
	[0048.550] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.cs") returned 0
	[0048.550] lstrlenA (lpString="*.cs") returned 4
	[0048.550] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.vb") returned 0
	[0048.550] lstrlenA (lpString="*.vb") returned 4
	[0048.550] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.bas") returned 0
	[0048.550] lstrlenA (lpString="*.bas") returned 5
	[0048.550] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.csproj") returned 0
	[0048.550] lstrlenA (lpString="*.csproj") returned 8
	[0048.550] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.vbproj") returned 0
	[0048.550] lstrlenA (lpString="*.vbproj") returned 8
	[0048.551] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.vcxproj") returned 0
	[0048.551] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.551] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.manifest") returned 0
	[0048.551] lstrlenA (lpString="*.manifest") returned 10
	[0048.551] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.php") returned 0
	[0048.551] lstrlenA (lpString="*.php") returned 5
	[0048.551] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.vbe") returned 0
	[0048.551] lstrlenA (lpString="*.vbe") returned 5
	[0048.551] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.vba") returned 0
	[0048.551] lstrlenA (lpString="*.vba") returned 5
	[0048.551] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.vbs") returned 0
	[0048.551] lstrlenA (lpString="*.vbs") returned 5
	[0048.551] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.bat") returned 0
	[0048.551] lstrlenA (lpString="*.bat") returned 5
	[0048.551] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.cmd") returned 0
	[0048.551] lstrlenA (lpString="*.cmd") returned 5
	[0048.551] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.js") returned 0
	[0048.551] lstrlenA (lpString="*.js") returned 4
	[0048.551] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.jscript") returned 0
	[0048.551] lstrlenA (lpString="*.jscript") returned 9
	[0048.551] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.hta") returned 0
	[0048.551] lstrlenA (lpString="*.hta") returned 5
	[0048.551] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.php7") returned 0
	[0048.551] lstrlenA (lpString="*.php7") returned 6
	[0048.551] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.db") returned 0
	[0048.551] lstrlenA (lpString="*.db") returned 4
	[0048.551] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.swf") returned 0
	[0048.551] lstrlenA (lpString="*.swf") returned 5
	[0048.551] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.eml") returned 0
	[0048.551] lstrlenA (lpString="*.eml") returned 5
	[0048.551] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.part") returned 0
	[0048.551] lstrlenA (lpString="*.part") returned 6
	[0048.551] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.nfo") returned 0
	[0048.551] lstrlenA (lpString="*.nfo") returned 5
	[0048.551] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.rsa") returned 0
	[0048.551] lstrlenA (lpString="*.rsa") returned 5
	[0048.551] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.key") returned 0
	[0048.552] lstrlenA (lpString="*.key") returned 5
	[0048.552] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.aes") returned 0
	[0048.552] lstrlenA (lpString="*.aes") returned 5
	[0048.552] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.blob") returned 0
	[0048.552] lstrlenA (lpString="*.blob") returned 6
	[0048.552] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.btc") returned 0
	[0048.552] lstrlenA (lpString="*.btc") returned 5
	[0048.552] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.wallet") returned 0
	[0048.552] lstrlenA (lpString="*.wallet") returned 8
	[0048.552] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0048.552] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.552] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SetupResources.dll") returned -1
	[0048.552] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SetupResources.dll") returned -1
	[0048.552] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1
	[0048.552] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned="LocalizedData.xml"
	[0048.552] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1044\\" | out: lpString1="C:\\588bce7c90097ed212\\1044\\") returned="C:\\588bce7c90097ed212\\1044\\"
	[0048.552] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1044\\" | out: pszPath="C:\\588bce7c90097ed212\\1044\\") returned=""
	[0048.552] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1044\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1044\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1044\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.552] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1044\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1044\\how-to-decrypt-files.htm")) returned 0x20
	[0048.552] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1044\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1044\\SetupResources.dll"
	[0048.552] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.zip") returned 0
	[0048.552] lstrlenA (lpString="*.zip") returned 5
	[0048.552] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.rar") returned 0
	[0048.552] lstrlenA (lpString="*.rar") returned 5
	[0048.552] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.7z") returned 0
	[0048.552] lstrlenA (lpString="*.7z") returned 4
	[0048.552] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.tar") returned 0
	[0048.552] lstrlenA (lpString="*.tar") returned 5
	[0048.552] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.gzip") returned 0
	[0048.554] lstrlenA (lpString="*.gzip") returned 6
	[0048.554] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.jpg") returned 0
	[0048.554] lstrlenA (lpString="*.jpg") returned 5
	[0048.554] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.jpeg") returned 0
	[0048.554] lstrlenA (lpString="*.jpeg") returned 6
	[0048.554] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.bmp") returned 0
	[0048.554] lstrlenA (lpString="*.bmp") returned 5
	[0048.554] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.gif") returned 0
	[0048.554] lstrlenA (lpString="*.gif") returned 5
	[0048.554] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.png") returned 0
	[0048.554] lstrlenA (lpString="*.png") returned 5
	[0048.554] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.doc") returned 0
	[0048.555] lstrlenA (lpString="*.doc") returned 5
	[0048.555] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.docx") returned 0
	[0048.555] lstrlenA (lpString="*.docx") returned 6
	[0048.555] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.xls") returned 0
	[0048.555] lstrlenA (lpString="*.xls") returned 5
	[0048.555] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.xlsx") returned 0
	[0048.555] lstrlenA (lpString="*.xlsx") returned 6
	[0048.555] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.ppt") returned 0
	[0048.555] lstrlenA (lpString="*.ppt") returned 5
	[0048.555] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.pptx") returned 0
	[0048.555] lstrlenA (lpString="*.pptx") returned 6
	[0048.555] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.txt") returned 0
	[0048.555] lstrlenA (lpString="*.txt") returned 5
	[0048.555] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.pdf") returned 0
	[0048.555] lstrlenA (lpString="*.pdf") returned 5
	[0048.555] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.htm") returned 0
	[0048.555] lstrlenA (lpString="*.htm") returned 5
	[0048.555] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.html") returned 0
	[0048.555] lstrlenA (lpString="*.html") returned 6
	[0048.555] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.mdb") returned 0
	[0048.555] lstrlenA (lpString="*.mdb") returned 5
	[0048.555] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.pfx") returned 0
	[0048.555] lstrlenA (lpString="*.pfx") returned 5
	[0048.555] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.md") returned 0
	[0048.555] lstrlenA (lpString="*.md") returned 4
	[0048.555] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.lnk") returned 0
	[0048.555] lstrlenA (lpString="*.lnk") returned 5
	[0048.555] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.torrent") returned 0
	[0048.555] lstrlenA (lpString="*.torrent") returned 9
	[0048.555] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.mov") returned 0
	[0048.555] lstrlenA (lpString="*.mov") returned 5
	[0048.555] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.3gp") returned 0
	[0048.555] lstrlenA (lpString="*.3gp") returned 5
	[0048.555] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.mpeg") returned 0
	[0048.555] lstrlenA (lpString="*.mpeg") returned 6
	[0048.555] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.mpg") returned 0
	[0048.555] lstrlenA (lpString="*.mpg") returned 5
	[0048.556] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.flv") returned 0
	[0048.556] lstrlenA (lpString="*.flv") returned 5
	[0048.556] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.avi") returned 0
	[0048.556] lstrlenA (lpString="*.avi") returned 5
	[0048.556] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.mp4") returned 0
	[0048.556] lstrlenA (lpString="*.mp4") returned 5
	[0048.556] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.wmv") returned 0
	[0048.556] lstrlenA (lpString="*.wmv") returned 5
	[0048.556] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.mkv") returned 0
	[0048.556] lstrlenA (lpString="*.mkv") returned 5
	[0048.556] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.mp3") returned 0
	[0048.556] lstrlenA (lpString="*.mp3") returned 5
	[0048.556] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.wav") returned 0
	[0048.556] lstrlenA (lpString="*.wav") returned 5
	[0048.556] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.flac") returned 0
	[0048.556] lstrlenA (lpString="*.flac") returned 6
	[0048.556] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.wma") returned 0
	[0048.556] lstrlenA (lpString="*.wma") returned 5
	[0048.556] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.au3") returned 0
	[0048.556] lstrlenA (lpString="*.au3") returned 5
	[0048.556] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.ahk") returned 0
	[0048.556] lstrlenA (lpString="*.ahk") returned 5
	[0048.556] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.c") returned 0
	[0048.556] lstrlenA (lpString="*.c") returned 3
	[0048.556] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.cc") returned 0
	[0048.556] lstrlenA (lpString="*.cc") returned 4
	[0048.556] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.cpp") returned 0
	[0048.556] lstrlenA (lpString="*.cpp") returned 5
	[0048.556] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.cxx") returned 0
	[0048.556] lstrlenA (lpString="*.cxx") returned 5
	[0048.556] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.c++") returned 0
	[0048.556] lstrlenA (lpString="*.c++") returned 5
	[0048.556] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.cs") returned 0
	[0048.556] lstrlenA (lpString="*.cs") returned 4
	[0048.556] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.vb") returned 0
	[0048.556] lstrlenA (lpString="*.vb") returned 4
	[0048.556] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.bas") returned 0
	[0048.557] lstrlenA (lpString="*.bas") returned 5
	[0048.557] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.csproj") returned 0
	[0048.557] lstrlenA (lpString="*.csproj") returned 8
	[0048.557] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.vbproj") returned 0
	[0048.557] lstrlenA (lpString="*.vbproj") returned 8
	[0048.557] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.vcxproj") returned 0
	[0048.557] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.557] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.manifest") returned 0
	[0048.557] lstrlenA (lpString="*.manifest") returned 10
	[0048.557] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.php") returned 0
	[0048.557] lstrlenA (lpString="*.php") returned 5
	[0048.557] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.vbe") returned 0
	[0048.557] lstrlenA (lpString="*.vbe") returned 5
	[0048.557] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.vba") returned 0
	[0048.557] lstrlenA (lpString="*.vba") returned 5
	[0048.557] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.vbs") returned 0
	[0048.557] lstrlenA (lpString="*.vbs") returned 5
	[0048.557] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.bat") returned 0
	[0048.557] lstrlenA (lpString="*.bat") returned 5
	[0048.557] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.cmd") returned 0
	[0048.557] lstrlenA (lpString="*.cmd") returned 5
	[0048.557] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.js") returned 0
	[0048.557] lstrlenA (lpString="*.js") returned 4
	[0048.557] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.jscript") returned 0
	[0048.557] lstrlenA (lpString="*.jscript") returned 9
	[0048.557] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.hta") returned 0
	[0048.557] lstrlenA (lpString="*.hta") returned 5
	[0048.557] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.php7") returned 0
	[0048.557] lstrlenA (lpString="*.php7") returned 6
	[0048.557] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.db") returned 0
	[0048.557] lstrlenA (lpString="*.db") returned 4
	[0048.557] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.swf") returned 0
	[0048.557] lstrlenA (lpString="*.swf") returned 5
	[0048.557] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.eml") returned 0
	[0048.557] lstrlenA (lpString="*.eml") returned 5
	[0048.557] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.part") returned 0
	[0048.557] lstrlenA (lpString="*.part") returned 6
	[0048.558] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.nfo") returned 0
	[0048.558] lstrlenA (lpString="*.nfo") returned 5
	[0048.558] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.rsa") returned 0
	[0048.558] lstrlenA (lpString="*.rsa") returned 5
	[0048.558] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.key") returned 0
	[0048.558] lstrlenA (lpString="*.key") returned 5
	[0048.558] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.aes") returned 0
	[0048.558] lstrlenA (lpString="*.aes") returned 5
	[0048.558] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.blob") returned 0
	[0048.558] lstrlenA (lpString="*.blob") returned 6
	[0048.558] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.btc") returned 0
	[0048.558] lstrlenA (lpString="*.btc") returned 5
	[0048.558] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.wallet") returned 0
	[0048.558] lstrlenA (lpString="*.wallet") returned 8
	[0048.558] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0048.558] FindClose (in: hFindFile=0x7cbb90 | out: hFindFile=0x7cbb90) returned 1
	[0048.558] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d1d40, dwReserved1=0x7b00c0, cFileName="1045", cAlternateFileName="")) returned 1
	[0048.558] lstrcmpA (lpString1=".", lpString2="1045") returned -1
	[0048.558] lstrcmpA (lpString1="..", lpString2="1045") returned -1
	[0048.558] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*"
	[0048.558] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1045" | out: lpString1="C:\\588bce7c90097ed212\\1045") returned="C:\\588bce7c90097ed212\\1045"
	[0048.558] lstrlenA (lpString="C:\\588bce7c90097ed212\\1045") returned 26
	[0048.558] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbad0
	[0048.966] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0048.966] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0048.966] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0048.966] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0048.966] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0048.966] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.966] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="eula.rtf") returned -1
	[0048.966] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="eula.rtf") returned 1
	[0048.966] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1
	[0048.966] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1045\\*.*") returned="*.*"
	[0048.966] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1045\\" | out: lpString1="C:\\588bce7c90097ed212\\1045\\") returned="C:\\588bce7c90097ed212\\1045\\"
	[0048.966] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1045\\" | out: pszPath="C:\\588bce7c90097ed212\\1045\\") returned=""
	[0048.966] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1045\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1045\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1045\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.966] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1045\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1045\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0048.967] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1045\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1045\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0048.969] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0048.969] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0048.970] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0048.970] CloseHandle (hObject=0x208) returned 1
	[0048.971] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1045\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned="C:\\588bce7c90097ed212\\1045\\eula.rtf"
	[0048.971] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.zip") returned 0
	[0048.971] lstrlenA (lpString="*.zip") returned 5
	[0048.971] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.rar") returned 0
	[0048.971] lstrlenA (lpString="*.rar") returned 5
	[0048.971] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.7z") returned 0
	[0048.971] lstrlenA (lpString="*.7z") returned 4
	[0048.971] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.tar") returned 0
	[0048.971] lstrlenA (lpString="*.tar") returned 5
	[0048.971] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.gzip") returned 0
	[0048.971] lstrlenA (lpString="*.gzip") returned 6
	[0048.971] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.jpg") returned 0
	[0048.971] lstrlenA (lpString="*.jpg") returned 5
	[0048.971] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.jpeg") returned 0
	[0048.971] lstrlenA (lpString="*.jpeg") returned 6
	[0048.971] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.bmp") returned 0
	[0048.971] lstrlenA (lpString="*.bmp") returned 5
	[0048.971] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.gif") returned 0
	[0048.971] lstrlenA (lpString="*.gif") returned 5
	[0048.971] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.png") returned 0
	[0048.971] lstrlenA (lpString="*.png") returned 5
	[0048.971] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.doc") returned 0
	[0048.971] lstrlenA (lpString="*.doc") returned 5
	[0048.971] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.docx") returned 0
	[0048.971] lstrlenA (lpString="*.docx") returned 6
	[0048.971] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.xls") returned 0
	[0048.971] lstrlenA (lpString="*.xls") returned 5
	[0048.971] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.xlsx") returned 0
	[0048.971] lstrlenA (lpString="*.xlsx") returned 6
	[0048.971] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.ppt") returned 0
	[0048.971] lstrlenA (lpString="*.ppt") returned 5
	[0048.971] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.pptx") returned 0
	[0048.971] lstrlenA (lpString="*.pptx") returned 6
	[0048.971] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.txt") returned 0
	[0048.971] lstrlenA (lpString="*.txt") returned 5
	[0048.972] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.pdf") returned 0
	[0048.972] lstrlenA (lpString="*.pdf") returned 5
	[0048.972] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.htm") returned 0
	[0048.972] lstrlenA (lpString="*.htm") returned 5
	[0048.972] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.html") returned 0
	[0048.972] lstrlenA (lpString="*.html") returned 6
	[0048.972] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.mdb") returned 0
	[0048.972] lstrlenA (lpString="*.mdb") returned 5
	[0048.972] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.pfx") returned 0
	[0048.972] lstrlenA (lpString="*.pfx") returned 5
	[0048.972] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.md") returned 0
	[0048.972] lstrlenA (lpString="*.md") returned 4
	[0048.972] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.lnk") returned 0
	[0048.972] lstrlenA (lpString="*.lnk") returned 5
	[0048.972] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.torrent") returned 0
	[0048.972] lstrlenA (lpString="*.torrent") returned 9
	[0048.972] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.mov") returned 0
	[0048.972] lstrlenA (lpString="*.mov") returned 5
	[0048.972] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.3gp") returned 0
	[0048.972] lstrlenA (lpString="*.3gp") returned 5
	[0048.972] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.mpeg") returned 0
	[0048.972] lstrlenA (lpString="*.mpeg") returned 6
	[0048.972] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.mpg") returned 0
	[0048.972] lstrlenA (lpString="*.mpg") returned 5
	[0048.972] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.flv") returned 0
	[0048.972] lstrlenA (lpString="*.flv") returned 5
	[0048.972] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.avi") returned 0
	[0048.972] lstrlenA (lpString="*.avi") returned 5
	[0048.972] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.mp4") returned 0
	[0048.972] lstrlenA (lpString="*.mp4") returned 5
	[0048.972] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.wmv") returned 0
	[0048.972] lstrlenA (lpString="*.wmv") returned 5
	[0048.972] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.mkv") returned 0
	[0048.972] lstrlenA (lpString="*.mkv") returned 5
	[0048.972] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.mp3") returned 0
	[0048.972] lstrlenA (lpString="*.mp3") returned 5
	[0048.972] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.wav") returned 0
	[0048.973] lstrlenA (lpString="*.wav") returned 5
	[0048.973] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.flac") returned 0
	[0048.973] lstrlenA (lpString="*.flac") returned 6
	[0048.973] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.wma") returned 0
	[0048.973] lstrlenA (lpString="*.wma") returned 5
	[0048.973] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.au3") returned 0
	[0048.973] lstrlenA (lpString="*.au3") returned 5
	[0048.973] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.ahk") returned 0
	[0048.973] lstrlenA (lpString="*.ahk") returned 5
	[0048.973] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.c") returned 0
	[0048.973] lstrlenA (lpString="*.c") returned 3
	[0048.973] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.cc") returned 0
	[0048.973] lstrlenA (lpString="*.cc") returned 4
	[0048.973] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.cpp") returned 0
	[0048.973] lstrlenA (lpString="*.cpp") returned 5
	[0048.973] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.cxx") returned 0
	[0048.973] lstrlenA (lpString="*.cxx") returned 5
	[0048.973] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.c++") returned 0
	[0048.973] lstrlenA (lpString="*.c++") returned 5
	[0048.973] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.cs") returned 0
	[0048.973] lstrlenA (lpString="*.cs") returned 4
	[0048.973] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.vb") returned 0
	[0048.973] lstrlenA (lpString="*.vb") returned 4
	[0048.973] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.bas") returned 0
	[0048.973] lstrlenA (lpString="*.bas") returned 5
	[0048.973] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.csproj") returned 0
	[0048.973] lstrlenA (lpString="*.csproj") returned 8
	[0048.973] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.vbproj") returned 0
	[0048.973] lstrlenA (lpString="*.vbproj") returned 8
	[0048.973] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.vcxproj") returned 0
	[0048.973] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.973] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.manifest") returned 0
	[0048.973] lstrlenA (lpString="*.manifest") returned 10
	[0048.973] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.php") returned 0
	[0048.973] lstrlenA (lpString="*.php") returned 5
	[0048.973] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.vbe") returned 0
	[0048.973] lstrlenA (lpString="*.vbe") returned 5
	[0048.973] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.vba") returned 0
	[0048.974] lstrlenA (lpString="*.vba") returned 5
	[0048.974] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.vbs") returned 0
	[0048.974] lstrlenA (lpString="*.vbs") returned 5
	[0048.974] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.bat") returned 0
	[0048.974] lstrlenA (lpString="*.bat") returned 5
	[0048.974] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.cmd") returned 0
	[0048.974] lstrlenA (lpString="*.cmd") returned 5
	[0048.974] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.js") returned 0
	[0048.974] lstrlenA (lpString="*.js") returned 4
	[0048.974] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.jscript") returned 0
	[0048.974] lstrlenA (lpString="*.jscript") returned 9
	[0048.974] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.hta") returned 0
	[0048.974] lstrlenA (lpString="*.hta") returned 5
	[0048.974] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.php7") returned 0
	[0048.974] lstrlenA (lpString="*.php7") returned 6
	[0048.974] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.db") returned 0
	[0048.974] lstrlenA (lpString="*.db") returned 4
	[0048.974] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.swf") returned 0
	[0048.974] lstrlenA (lpString="*.swf") returned 5
	[0048.974] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.eml") returned 0
	[0048.975] lstrlenA (lpString="*.eml") returned 5
	[0048.975] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.part") returned 0
	[0048.975] lstrlenA (lpString="*.part") returned 6
	[0048.975] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.nfo") returned 0
	[0048.975] lstrlenA (lpString="*.nfo") returned 5
	[0048.975] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.rsa") returned 0
	[0048.975] lstrlenA (lpString="*.rsa") returned 5
	[0048.975] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.key") returned 0
	[0048.975] lstrlenA (lpString="*.key") returned 5
	[0048.975] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.aes") returned 0
	[0048.975] lstrlenA (lpString="*.aes") returned 5
	[0048.975] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.blob") returned 0
	[0048.975] lstrlenA (lpString="*.blob") returned 6
	[0048.975] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.btc") returned 0
	[0048.975] lstrlenA (lpString="*.btc") returned 5
	[0048.975] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.wallet") returned 0
	[0048.975] lstrlenA (lpString="*.wallet") returned 8
	[0048.975] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0048.975] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.975] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="LocalizedData.xml") returned -1
	[0048.975] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="LocalizedData.xml") returned -1
	[0048.975] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1
	[0048.975] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned="eula.rtf"
	[0048.975] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1045\\" | out: lpString1="C:\\588bce7c90097ed212\\1045\\") returned="C:\\588bce7c90097ed212\\1045\\"
	[0048.975] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1045\\" | out: pszPath="C:\\588bce7c90097ed212\\1045\\") returned=""
	[0048.975] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1045\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1045\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1045\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.975] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1045\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1045\\how-to-decrypt-files.htm")) returned 0x20
	[0048.975] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1045\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml"
	[0048.975] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.zip") returned 0
	[0048.975] lstrlenA (lpString="*.zip") returned 5
	[0048.975] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.rar") returned 0
	[0048.975] lstrlenA (lpString="*.rar") returned 5
	[0048.976] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.7z") returned 0
	[0048.976] lstrlenA (lpString="*.7z") returned 4
	[0048.976] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.tar") returned 0
	[0048.976] lstrlenA (lpString="*.tar") returned 5
	[0048.976] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.gzip") returned 0
	[0048.976] lstrlenA (lpString="*.gzip") returned 6
	[0048.976] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.jpg") returned 0
	[0048.976] lstrlenA (lpString="*.jpg") returned 5
	[0048.976] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.jpeg") returned 0
	[0048.976] lstrlenA (lpString="*.jpeg") returned 6
	[0048.976] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.bmp") returned 0
	[0048.976] lstrlenA (lpString="*.bmp") returned 5
	[0048.976] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.gif") returned 0
	[0048.976] lstrlenA (lpString="*.gif") returned 5
	[0048.976] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.png") returned 0
	[0048.976] lstrlenA (lpString="*.png") returned 5
	[0048.976] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.doc") returned 0
	[0048.976] lstrlenA (lpString="*.doc") returned 5
	[0048.976] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.docx") returned 0
	[0048.976] lstrlenA (lpString="*.docx") returned 6
	[0048.976] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.xls") returned 0
	[0048.976] lstrlenA (lpString="*.xls") returned 5
	[0048.976] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.xlsx") returned 0
	[0048.976] lstrlenA (lpString="*.xlsx") returned 6
	[0048.976] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.ppt") returned 0
	[0048.976] lstrlenA (lpString="*.ppt") returned 5
	[0048.976] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.pptx") returned 0
	[0048.976] lstrlenA (lpString="*.pptx") returned 6
	[0048.976] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.txt") returned 0
	[0048.976] lstrlenA (lpString="*.txt") returned 5
	[0048.976] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.pdf") returned 0
	[0048.976] lstrlenA (lpString="*.pdf") returned 5
	[0048.976] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.htm") returned 0
	[0048.976] lstrlenA (lpString="*.htm") returned 5
	[0048.976] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.html") returned 0
	[0048.976] lstrlenA (lpString="*.html") returned 6
	[0048.976] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.mdb") returned 0
	[0048.977] lstrlenA (lpString="*.mdb") returned 5
	[0048.977] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.pfx") returned 0
	[0048.977] lstrlenA (lpString="*.pfx") returned 5
	[0048.977] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.md") returned 0
	[0048.977] lstrlenA (lpString="*.md") returned 4
	[0048.977] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.lnk") returned 0
	[0048.977] lstrlenA (lpString="*.lnk") returned 5
	[0048.977] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.torrent") returned 0
	[0048.977] lstrlenA (lpString="*.torrent") returned 9
	[0048.977] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.mov") returned 0
	[0048.977] lstrlenA (lpString="*.mov") returned 5
	[0048.977] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.3gp") returned 0
	[0048.977] lstrlenA (lpString="*.3gp") returned 5
	[0048.977] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.mpeg") returned 0
	[0048.977] lstrlenA (lpString="*.mpeg") returned 6
	[0048.977] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.mpg") returned 0
	[0048.977] lstrlenA (lpString="*.mpg") returned 5
	[0048.977] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.flv") returned 0
	[0048.977] lstrlenA (lpString="*.flv") returned 5
	[0048.977] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.avi") returned 0
	[0048.977] lstrlenA (lpString="*.avi") returned 5
	[0048.977] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.mp4") returned 0
	[0048.977] lstrlenA (lpString="*.mp4") returned 5
	[0048.977] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.wmv") returned 0
	[0048.977] lstrlenA (lpString="*.wmv") returned 5
	[0048.977] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.mkv") returned 0
	[0048.977] lstrlenA (lpString="*.mkv") returned 5
	[0048.977] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.mp3") returned 0
	[0048.977] lstrlenA (lpString="*.mp3") returned 5
	[0048.977] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.wav") returned 0
	[0048.977] lstrlenA (lpString="*.wav") returned 5
	[0048.977] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.flac") returned 0
	[0048.977] lstrlenA (lpString="*.flac") returned 6
	[0048.977] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.wma") returned 0
	[0048.977] lstrlenA (lpString="*.wma") returned 5
	[0048.977] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.au3") returned 0
	[0048.977] lstrlenA (lpString="*.au3") returned 5
	[0048.977] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.ahk") returned 0
	[0048.978] lstrlenA (lpString="*.ahk") returned 5
	[0048.978] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.c") returned 0
	[0048.978] lstrlenA (lpString="*.c") returned 3
	[0048.978] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.cc") returned 0
	[0048.978] lstrlenA (lpString="*.cc") returned 4
	[0048.978] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.cpp") returned 0
	[0048.978] lstrlenA (lpString="*.cpp") returned 5
	[0048.978] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.cxx") returned 0
	[0048.978] lstrlenA (lpString="*.cxx") returned 5
	[0048.978] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.c++") returned 0
	[0048.978] lstrlenA (lpString="*.c++") returned 5
	[0048.978] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.cs") returned 0
	[0048.978] lstrlenA (lpString="*.cs") returned 4
	[0048.978] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.vb") returned 0
	[0048.978] lstrlenA (lpString="*.vb") returned 4
	[0048.978] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.bas") returned 0
	[0048.978] lstrlenA (lpString="*.bas") returned 5
	[0048.978] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.csproj") returned 0
	[0048.978] lstrlenA (lpString="*.csproj") returned 8
	[0048.978] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.vbproj") returned 0
	[0048.978] lstrlenA (lpString="*.vbproj") returned 8
	[0048.978] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.vcxproj") returned 0
	[0048.978] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.978] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.manifest") returned 0
	[0048.978] lstrlenA (lpString="*.manifest") returned 10
	[0048.978] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.php") returned 0
	[0048.978] lstrlenA (lpString="*.php") returned 5
	[0048.978] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.vbe") returned 0
	[0048.978] lstrlenA (lpString="*.vbe") returned 5
	[0048.978] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.vba") returned 0
	[0048.978] lstrlenA (lpString="*.vba") returned 5
	[0048.978] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.vbs") returned 0
	[0048.978] lstrlenA (lpString="*.vbs") returned 5
	[0048.978] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.bat") returned 0
	[0048.978] lstrlenA (lpString="*.bat") returned 5
	[0048.978] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.cmd") returned 0
	[0048.979] lstrlenA (lpString="*.cmd") returned 5
	[0048.979] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.js") returned 0
	[0048.979] lstrlenA (lpString="*.js") returned 4
	[0048.979] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.jscript") returned 0
	[0048.979] lstrlenA (lpString="*.jscript") returned 9
	[0048.979] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.hta") returned 0
	[0048.979] lstrlenA (lpString="*.hta") returned 5
	[0048.979] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.php7") returned 0
	[0048.979] lstrlenA (lpString="*.php7") returned 6
	[0048.979] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.db") returned 0
	[0048.979] lstrlenA (lpString="*.db") returned 4
	[0048.979] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.swf") returned 0
	[0048.979] lstrlenA (lpString="*.swf") returned 5
	[0048.979] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.eml") returned 0
	[0048.979] lstrlenA (lpString="*.eml") returned 5
	[0048.979] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.part") returned 0
	[0048.979] lstrlenA (lpString="*.part") returned 6
	[0048.979] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.nfo") returned 0
	[0048.979] lstrlenA (lpString="*.nfo") returned 5
	[0048.979] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.rsa") returned 0
	[0048.979] lstrlenA (lpString="*.rsa") returned 5
	[0048.979] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.key") returned 0
	[0048.979] lstrlenA (lpString="*.key") returned 5
	[0048.979] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.aes") returned 0
	[0048.979] lstrlenA (lpString="*.aes") returned 5
	[0048.979] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.blob") returned 0
	[0048.979] lstrlenA (lpString="*.blob") returned 6
	[0048.979] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.btc") returned 0
	[0048.979] lstrlenA (lpString="*.btc") returned 5
	[0048.979] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.wallet") returned 0
	[0048.979] lstrlenA (lpString="*.wallet") returned 8
	[0048.979] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0048.979] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.979] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SetupResources.dll") returned -1
	[0048.979] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SetupResources.dll") returned -1
	[0048.979] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1
	[0048.979] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned="LocalizedData.xml"
	[0048.980] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1045\\" | out: lpString1="C:\\588bce7c90097ed212\\1045\\") returned="C:\\588bce7c90097ed212\\1045\\"
	[0048.980] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1045\\" | out: pszPath="C:\\588bce7c90097ed212\\1045\\") returned=""
	[0048.980] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1045\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1045\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1045\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.980] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1045\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1045\\how-to-decrypt-files.htm")) returned 0x20
	[0048.980] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1045\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1045\\SetupResources.dll"
	[0048.980] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.zip") returned 0
	[0048.980] lstrlenA (lpString="*.zip") returned 5
	[0048.980] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.rar") returned 0
	[0048.980] lstrlenA (lpString="*.rar") returned 5
	[0048.980] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.7z") returned 0
	[0048.980] lstrlenA (lpString="*.7z") returned 4
	[0048.980] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.tar") returned 0
	[0048.980] lstrlenA (lpString="*.tar") returned 5
	[0048.980] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.gzip") returned 0
	[0048.980] lstrlenA (lpString="*.gzip") returned 6
	[0048.980] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.jpg") returned 0
	[0048.980] lstrlenA (lpString="*.jpg") returned 5
	[0048.980] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.jpeg") returned 0
	[0048.980] lstrlenA (lpString="*.jpeg") returned 6
	[0048.980] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.bmp") returned 0
	[0048.980] lstrlenA (lpString="*.bmp") returned 5
	[0048.980] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.gif") returned 0
	[0048.980] lstrlenA (lpString="*.gif") returned 5
	[0048.980] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.png") returned 0
	[0048.980] lstrlenA (lpString="*.png") returned 5
	[0048.980] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.doc") returned 0
	[0048.980] lstrlenA (lpString="*.doc") returned 5
	[0048.980] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.docx") returned 0
	[0048.980] lstrlenA (lpString="*.docx") returned 6
	[0048.980] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.xls") returned 0
	[0048.980] lstrlenA (lpString="*.xls") returned 5
	[0048.980] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.xlsx") returned 0
	[0048.980] lstrlenA (lpString="*.xlsx") returned 6
	[0048.980] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.ppt") returned 0
	[0048.980] lstrlenA (lpString="*.ppt") returned 5
	[0048.981] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.pptx") returned 0
	[0048.981] lstrlenA (lpString="*.pptx") returned 6
	[0048.981] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.txt") returned 0
	[0048.981] lstrlenA (lpString="*.txt") returned 5
	[0048.981] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.pdf") returned 0
	[0048.981] lstrlenA (lpString="*.pdf") returned 5
	[0048.981] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.htm") returned 0
	[0048.981] lstrlenA (lpString="*.htm") returned 5
	[0048.981] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.html") returned 0
	[0048.981] lstrlenA (lpString="*.html") returned 6
	[0048.981] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.mdb") returned 0
	[0048.981] lstrlenA (lpString="*.mdb") returned 5
	[0048.981] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.pfx") returned 0
	[0048.981] lstrlenA (lpString="*.pfx") returned 5
	[0048.981] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.md") returned 0
	[0048.981] lstrlenA (lpString="*.md") returned 4
	[0048.981] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.lnk") returned 0
	[0048.981] lstrlenA (lpString="*.lnk") returned 5
	[0048.981] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.torrent") returned 0
	[0048.981] lstrlenA (lpString="*.torrent") returned 9
	[0048.981] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.mov") returned 0
	[0048.981] lstrlenA (lpString="*.mov") returned 5
	[0048.982] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.3gp") returned 0
	[0048.982] lstrlenA (lpString="*.3gp") returned 5
	[0048.982] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.mpeg") returned 0
	[0048.982] lstrlenA (lpString="*.mpeg") returned 6
	[0048.982] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.mpg") returned 0
	[0048.982] lstrlenA (lpString="*.mpg") returned 5
	[0048.982] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.flv") returned 0
	[0048.982] lstrlenA (lpString="*.flv") returned 5
	[0048.982] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.avi") returned 0
	[0048.982] lstrlenA (lpString="*.avi") returned 5
	[0048.982] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.mp4") returned 0
	[0048.982] lstrlenA (lpString="*.mp4") returned 5
	[0048.982] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.wmv") returned 0
	[0048.982] lstrlenA (lpString="*.wmv") returned 5
	[0048.982] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.mkv") returned 0
	[0048.982] lstrlenA (lpString="*.mkv") returned 5
	[0048.982] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.mp3") returned 0
	[0048.982] lstrlenA (lpString="*.mp3") returned 5
	[0048.982] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.wav") returned 0
	[0048.982] lstrlenA (lpString="*.wav") returned 5
	[0048.982] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.flac") returned 0
	[0048.982] lstrlenA (lpString="*.flac") returned 6
	[0048.982] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.wma") returned 0
	[0048.982] lstrlenA (lpString="*.wma") returned 5
	[0048.982] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.au3") returned 0
	[0048.982] lstrlenA (lpString="*.au3") returned 5
	[0048.982] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.ahk") returned 0
	[0048.982] lstrlenA (lpString="*.ahk") returned 5
	[0048.982] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.c") returned 0
	[0048.982] lstrlenA (lpString="*.c") returned 3
	[0048.982] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.cc") returned 0
	[0048.982] lstrlenA (lpString="*.cc") returned 4
	[0048.982] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.cpp") returned 0
	[0048.983] lstrlenA (lpString="*.cpp") returned 5
	[0048.983] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.cxx") returned 0
	[0048.983] lstrlenA (lpString="*.cxx") returned 5
	[0048.983] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.c++") returned 0
	[0048.983] lstrlenA (lpString="*.c++") returned 5
	[0048.983] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.cs") returned 0
	[0048.983] lstrlenA (lpString="*.cs") returned 4
	[0048.983] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.vb") returned 0
	[0048.983] lstrlenA (lpString="*.vb") returned 4
	[0048.983] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.bas") returned 0
	[0048.983] lstrlenA (lpString="*.bas") returned 5
	[0048.983] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.csproj") returned 0
	[0048.983] lstrlenA (lpString="*.csproj") returned 8
	[0048.983] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.vbproj") returned 0
	[0048.983] lstrlenA (lpString="*.vbproj") returned 8
	[0048.983] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.vcxproj") returned 0
	[0048.983] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.983] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.manifest") returned 0
	[0048.983] lstrlenA (lpString="*.manifest") returned 10
	[0048.983] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.php") returned 0
	[0048.983] lstrlenA (lpString="*.php") returned 5
	[0048.983] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.vbe") returned 0
	[0048.983] lstrlenA (lpString="*.vbe") returned 5
	[0048.983] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.vba") returned 0
	[0048.983] lstrlenA (lpString="*.vba") returned 5
	[0048.983] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.vbs") returned 0
	[0048.983] lstrlenA (lpString="*.vbs") returned 5
	[0048.983] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.bat") returned 0
	[0048.983] lstrlenA (lpString="*.bat") returned 5
	[0048.983] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.cmd") returned 0
	[0048.983] lstrlenA (lpString="*.cmd") returned 5
	[0048.983] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.js") returned 0
	[0048.983] lstrlenA (lpString="*.js") returned 4
	[0048.983] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.jscript") returned 0
	[0048.983] lstrlenA (lpString="*.jscript") returned 9
	[0048.983] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.hta") returned 0
	[0048.983] lstrlenA (lpString="*.hta") returned 5
	[0048.983] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.php7") returned 0
	[0048.984] lstrlenA (lpString="*.php7") returned 6
	[0048.984] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.db") returned 0
	[0048.984] lstrlenA (lpString="*.db") returned 4
	[0048.984] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.swf") returned 0
	[0048.984] lstrlenA (lpString="*.swf") returned 5
	[0048.984] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.eml") returned 0
	[0048.984] lstrlenA (lpString="*.eml") returned 5
	[0048.984] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.part") returned 0
	[0048.984] lstrlenA (lpString="*.part") returned 6
	[0048.984] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.nfo") returned 0
	[0048.984] lstrlenA (lpString="*.nfo") returned 5
	[0048.984] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.rsa") returned 0
	[0048.984] lstrlenA (lpString="*.rsa") returned 5
	[0048.984] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.key") returned 0
	[0048.984] lstrlenA (lpString="*.key") returned 5
	[0048.984] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.aes") returned 0
	[0048.984] lstrlenA (lpString="*.aes") returned 5
	[0048.984] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.blob") returned 0
	[0048.984] lstrlenA (lpString="*.blob") returned 6
	[0048.984] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.btc") returned 0
	[0048.984] lstrlenA (lpString="*.btc") returned 5
	[0048.984] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.wallet") returned 0
	[0048.984] lstrlenA (lpString="*.wallet") returned 8
	[0048.984] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0048.984] FindClose (in: hFindFile=0x7cbad0 | out: hFindFile=0x7cbad0) returned 1
	[0048.984] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d1d40, dwReserved1=0x7b00c0, cFileName="1046", cAlternateFileName="")) returned 1
	[0048.984] lstrcmpA (lpString1=".", lpString2="1046") returned -1
	[0048.984] lstrcmpA (lpString1="..", lpString2="1046") returned -1
	[0048.984] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*"
	[0048.984] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1046" | out: lpString1="C:\\588bce7c90097ed212\\1046") returned="C:\\588bce7c90097ed212\\1046"
	[0048.984] lstrlenA (lpString="C:\\588bce7c90097ed212\\1046") returned 26
	[0048.984] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb590
	[0048.985] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0048.985] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0048.985] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0048.985] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0048.985] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0048.985] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.985] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="eula.rtf") returned -1
	[0048.985] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="eula.rtf") returned 1
	[0048.985] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1
	[0048.985] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1046\\*.*") returned="*.*"
	[0048.985] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1046\\" | out: lpString1="C:\\588bce7c90097ed212\\1046\\") returned="C:\\588bce7c90097ed212\\1046\\"
	[0048.985] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1046\\" | out: pszPath="C:\\588bce7c90097ed212\\1046\\") returned=""
	[0048.986] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1046\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1046\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1046\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.986] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1046\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1046\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0048.986] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1046\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1046\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0048.988] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0048.988] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0048.988] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0048.989] CloseHandle (hObject=0x208) returned 1
	[0048.989] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1046\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned="C:\\588bce7c90097ed212\\1046\\eula.rtf"
	[0048.989] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.zip") returned 0
	[0048.989] lstrlenA (lpString="*.zip") returned 5
	[0048.989] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.rar") returned 0
	[0048.989] lstrlenA (lpString="*.rar") returned 5
	[0048.989] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.7z") returned 0
	[0048.989] lstrlenA (lpString="*.7z") returned 4
	[0048.989] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.tar") returned 0
	[0048.989] lstrlenA (lpString="*.tar") returned 5
	[0048.989] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.gzip") returned 0
	[0048.989] lstrlenA (lpString="*.gzip") returned 6
	[0048.989] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.jpg") returned 0
	[0048.989] lstrlenA (lpString="*.jpg") returned 5
	[0048.989] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.jpeg") returned 0
	[0048.989] lstrlenA (lpString="*.jpeg") returned 6
	[0048.989] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.bmp") returned 0
	[0048.989] lstrlenA (lpString="*.bmp") returned 5
	[0048.989] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.gif") returned 0
	[0048.989] lstrlenA (lpString="*.gif") returned 5
	[0048.989] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.png") returned 0
	[0048.989] lstrlenA (lpString="*.png") returned 5
	[0048.989] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.doc") returned 0
	[0048.989] lstrlenA (lpString="*.doc") returned 5
	[0048.989] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.docx") returned 0
	[0048.989] lstrlenA (lpString="*.docx") returned 6
	[0048.989] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.xls") returned 0
	[0048.989] lstrlenA (lpString="*.xls") returned 5
	[0048.990] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.xlsx") returned 0
	[0048.990] lstrlenA (lpString="*.xlsx") returned 6
	[0048.990] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.ppt") returned 0
	[0048.990] lstrlenA (lpString="*.ppt") returned 5
	[0048.990] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.pptx") returned 0
	[0048.990] lstrlenA (lpString="*.pptx") returned 6
	[0048.990] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.txt") returned 0
	[0048.990] lstrlenA (lpString="*.txt") returned 5
	[0048.990] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.pdf") returned 0
	[0048.990] lstrlenA (lpString="*.pdf") returned 5
	[0048.990] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.htm") returned 0
	[0048.990] lstrlenA (lpString="*.htm") returned 5
	[0048.990] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.html") returned 0
	[0048.990] lstrlenA (lpString="*.html") returned 6
	[0048.990] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.mdb") returned 0
	[0048.990] lstrlenA (lpString="*.mdb") returned 5
	[0048.990] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.pfx") returned 0
	[0048.990] lstrlenA (lpString="*.pfx") returned 5
	[0048.990] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.md") returned 0
	[0048.990] lstrlenA (lpString="*.md") returned 4
	[0048.990] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.lnk") returned 0
	[0048.990] lstrlenA (lpString="*.lnk") returned 5
	[0048.990] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.torrent") returned 0
	[0048.990] lstrlenA (lpString="*.torrent") returned 9
	[0048.990] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.mov") returned 0
	[0048.990] lstrlenA (lpString="*.mov") returned 5
	[0048.990] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.3gp") returned 0
	[0048.990] lstrlenA (lpString="*.3gp") returned 5
	[0048.990] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.mpeg") returned 0
	[0048.990] lstrlenA (lpString="*.mpeg") returned 6
	[0048.990] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.mpg") returned 0
	[0048.990] lstrlenA (lpString="*.mpg") returned 5
	[0048.990] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.flv") returned 0
	[0048.990] lstrlenA (lpString="*.flv") returned 5
	[0048.990] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.avi") returned 0
	[0048.990] lstrlenA (lpString="*.avi") returned 5
	[0048.990] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.mp4") returned 0
	[0048.991] lstrlenA (lpString="*.mp4") returned 5
	[0048.991] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.wmv") returned 0
	[0048.991] lstrlenA (lpString="*.wmv") returned 5
	[0048.991] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.mkv") returned 0
	[0048.991] lstrlenA (lpString="*.mkv") returned 5
	[0048.991] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.mp3") returned 0
	[0048.991] lstrlenA (lpString="*.mp3") returned 5
	[0048.991] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.wav") returned 0
	[0048.991] lstrlenA (lpString="*.wav") returned 5
	[0048.991] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.flac") returned 0
	[0048.991] lstrlenA (lpString="*.flac") returned 6
	[0048.991] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.wma") returned 0
	[0048.991] lstrlenA (lpString="*.wma") returned 5
	[0048.991] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.au3") returned 0
	[0048.991] lstrlenA (lpString="*.au3") returned 5
	[0048.991] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.ahk") returned 0
	[0048.991] lstrlenA (lpString="*.ahk") returned 5
	[0048.991] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.c") returned 0
	[0048.991] lstrlenA (lpString="*.c") returned 3
	[0048.991] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.cc") returned 0
	[0048.991] lstrlenA (lpString="*.cc") returned 4
	[0048.991] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.cpp") returned 0
	[0048.991] lstrlenA (lpString="*.cpp") returned 5
	[0048.991] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.cxx") returned 0
	[0048.991] lstrlenA (lpString="*.cxx") returned 5
	[0048.991] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.c++") returned 0
	[0048.991] lstrlenA (lpString="*.c++") returned 5
	[0048.991] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.cs") returned 0
	[0048.991] lstrlenA (lpString="*.cs") returned 4
	[0048.991] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.vb") returned 0
	[0048.991] lstrlenA (lpString="*.vb") returned 4
	[0048.991] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.bas") returned 0
	[0048.991] lstrlenA (lpString="*.bas") returned 5
	[0048.991] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.csproj") returned 0
	[0048.991] lstrlenA (lpString="*.csproj") returned 8
	[0048.991] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.vbproj") returned 0
	[0048.991] lstrlenA (lpString="*.vbproj") returned 8
	[0048.991] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.vcxproj") returned 0
	[0048.992] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.992] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.manifest") returned 0
	[0048.992] lstrlenA (lpString="*.manifest") returned 10
	[0048.992] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.php") returned 0
	[0048.992] lstrlenA (lpString="*.php") returned 5
	[0048.992] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.vbe") returned 0
	[0048.992] lstrlenA (lpString="*.vbe") returned 5
	[0048.992] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.vba") returned 0
	[0048.992] lstrlenA (lpString="*.vba") returned 5
	[0048.992] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.vbs") returned 0
	[0048.992] lstrlenA (lpString="*.vbs") returned 5
	[0048.992] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.bat") returned 0
	[0048.992] lstrlenA (lpString="*.bat") returned 5
	[0048.992] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.cmd") returned 0
	[0048.992] lstrlenA (lpString="*.cmd") returned 5
	[0048.992] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.js") returned 0
	[0048.992] lstrlenA (lpString="*.js") returned 4
	[0048.992] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.jscript") returned 0
	[0048.992] lstrlenA (lpString="*.jscript") returned 9
	[0048.992] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.hta") returned 0
	[0048.992] lstrlenA (lpString="*.hta") returned 5
	[0048.992] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.php7") returned 0
	[0048.992] lstrlenA (lpString="*.php7") returned 6
	[0048.992] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.db") returned 0
	[0048.992] lstrlenA (lpString="*.db") returned 4
	[0048.992] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.swf") returned 0
	[0048.992] lstrlenA (lpString="*.swf") returned 5
	[0048.992] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.eml") returned 0
	[0048.992] lstrlenA (lpString="*.eml") returned 5
	[0048.992] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.part") returned 0
	[0048.992] lstrlenA (lpString="*.part") returned 6
	[0048.992] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.nfo") returned 0
	[0048.992] lstrlenA (lpString="*.nfo") returned 5
	[0048.992] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.rsa") returned 0
	[0048.992] lstrlenA (lpString="*.rsa") returned 5
	[0048.992] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.key") returned 0
	[0048.992] lstrlenA (lpString="*.key") returned 5
	[0048.992] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.aes") returned 0
	[0048.993] lstrlenA (lpString="*.aes") returned 5
	[0048.993] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.blob") returned 0
	[0048.993] lstrlenA (lpString="*.blob") returned 6
	[0048.993] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.btc") returned 0
	[0048.993] lstrlenA (lpString="*.btc") returned 5
	[0048.993] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.wallet") returned 0
	[0048.993] lstrlenA (lpString="*.wallet") returned 8
	[0048.993] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0048.993] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.993] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="LocalizedData.xml") returned -1
	[0048.993] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="LocalizedData.xml") returned -1
	[0048.993] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1
	[0048.993] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned="eula.rtf"
	[0048.993] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1046\\" | out: lpString1="C:\\588bce7c90097ed212\\1046\\") returned="C:\\588bce7c90097ed212\\1046\\"
	[0048.993] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1046\\" | out: pszPath="C:\\588bce7c90097ed212\\1046\\") returned=""
	[0048.993] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1046\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1046\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1046\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.993] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1046\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1046\\how-to-decrypt-files.htm")) returned 0x20
	[0048.993] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1046\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml"
	[0048.993] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.zip") returned 0
	[0048.993] lstrlenA (lpString="*.zip") returned 5
	[0048.993] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.rar") returned 0
	[0048.993] lstrlenA (lpString="*.rar") returned 5
	[0048.993] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.7z") returned 0
	[0048.993] lstrlenA (lpString="*.7z") returned 4
	[0048.993] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.tar") returned 0
	[0048.993] lstrlenA (lpString="*.tar") returned 5
	[0048.993] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.gzip") returned 0
	[0048.993] lstrlenA (lpString="*.gzip") returned 6
	[0048.993] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.jpg") returned 0
	[0048.993] lstrlenA (lpString="*.jpg") returned 5
	[0048.993] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.jpeg") returned 0
	[0048.993] lstrlenA (lpString="*.jpeg") returned 6
	[0048.993] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.bmp") returned 0
	[0048.993] lstrlenA (lpString="*.bmp") returned 5
	[0048.994] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.gif") returned 0
	[0048.994] lstrlenA (lpString="*.gif") returned 5
	[0048.994] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.png") returned 0
	[0048.994] lstrlenA (lpString="*.png") returned 5
	[0048.994] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.doc") returned 0
	[0048.994] lstrlenA (lpString="*.doc") returned 5
	[0048.994] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.docx") returned 0
	[0048.994] lstrlenA (lpString="*.docx") returned 6
	[0048.994] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.xls") returned 0
	[0048.994] lstrlenA (lpString="*.xls") returned 5
	[0048.994] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.xlsx") returned 0
	[0048.994] lstrlenA (lpString="*.xlsx") returned 6
	[0048.994] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.ppt") returned 0
	[0048.994] lstrlenA (lpString="*.ppt") returned 5
	[0048.994] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.pptx") returned 0
	[0048.994] lstrlenA (lpString="*.pptx") returned 6
	[0048.994] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.txt") returned 0
	[0048.994] lstrlenA (lpString="*.txt") returned 5
	[0048.994] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.pdf") returned 0
	[0048.994] lstrlenA (lpString="*.pdf") returned 5
	[0048.994] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.htm") returned 0
	[0048.994] lstrlenA (lpString="*.htm") returned 5
	[0048.994] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.html") returned 0
	[0048.994] lstrlenA (lpString="*.html") returned 6
	[0048.994] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.mdb") returned 0
	[0048.994] lstrlenA (lpString="*.mdb") returned 5
	[0048.994] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.pfx") returned 0
	[0048.994] lstrlenA (lpString="*.pfx") returned 5
	[0048.994] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.md") returned 0
	[0048.994] lstrlenA (lpString="*.md") returned 4
	[0048.994] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.lnk") returned 0
	[0048.994] lstrlenA (lpString="*.lnk") returned 5
	[0048.994] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.torrent") returned 0
	[0048.994] lstrlenA (lpString="*.torrent") returned 9
	[0048.994] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.mov") returned 0
	[0048.994] lstrlenA (lpString="*.mov") returned 5
	[0048.994] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.3gp") returned 0
	[0048.994] lstrlenA (lpString="*.3gp") returned 5
	[0048.995] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.mpeg") returned 0
	[0048.995] lstrlenA (lpString="*.mpeg") returned 6
	[0048.995] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.mpg") returned 0
	[0048.995] lstrlenA (lpString="*.mpg") returned 5
	[0048.995] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.flv") returned 0
	[0048.995] lstrlenA (lpString="*.flv") returned 5
	[0048.995] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.avi") returned 0
	[0048.995] lstrlenA (lpString="*.avi") returned 5
	[0048.995] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.mp4") returned 0
	[0048.995] lstrlenA (lpString="*.mp4") returned 5
	[0048.995] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.wmv") returned 0
	[0048.995] lstrlenA (lpString="*.wmv") returned 5
	[0048.995] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.mkv") returned 0
	[0048.995] lstrlenA (lpString="*.mkv") returned 5
	[0048.995] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.mp3") returned 0
	[0048.995] lstrlenA (lpString="*.mp3") returned 5
	[0048.995] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.wav") returned 0
	[0048.995] lstrlenA (lpString="*.wav") returned 5
	[0048.995] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.flac") returned 0
	[0048.995] lstrlenA (lpString="*.flac") returned 6
	[0048.995] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.wma") returned 0
	[0048.995] lstrlenA (lpString="*.wma") returned 5
	[0048.995] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.au3") returned 0
	[0048.995] lstrlenA (lpString="*.au3") returned 5
	[0048.995] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.ahk") returned 0
	[0048.995] lstrlenA (lpString="*.ahk") returned 5
	[0048.995] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.c") returned 0
	[0048.995] lstrlenA (lpString="*.c") returned 3
	[0048.995] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.cc") returned 0
	[0048.995] lstrlenA (lpString="*.cc") returned 4
	[0048.995] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.cpp") returned 0
	[0048.995] lstrlenA (lpString="*.cpp") returned 5
	[0048.995] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.cxx") returned 0
	[0048.995] lstrlenA (lpString="*.cxx") returned 5
	[0048.995] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.c++") returned 0
	[0048.995] lstrlenA (lpString="*.c++") returned 5
	[0048.995] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.cs") returned 0
	[0048.995] lstrlenA (lpString="*.cs") returned 4
	[0048.996] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.vb") returned 0
	[0048.996] lstrlenA (lpString="*.vb") returned 4
	[0048.996] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.bas") returned 0
	[0048.996] lstrlenA (lpString="*.bas") returned 5
	[0048.996] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.csproj") returned 0
	[0048.996] lstrlenA (lpString="*.csproj") returned 8
	[0048.996] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.vbproj") returned 0
	[0048.996] lstrlenA (lpString="*.vbproj") returned 8
	[0048.996] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.vcxproj") returned 0
	[0048.996] lstrlenA (lpString="*.vcxproj") returned 9
	[0048.996] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.manifest") returned 0
	[0048.996] lstrlenA (lpString="*.manifest") returned 10
	[0048.996] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.php") returned 0
	[0048.996] lstrlenA (lpString="*.php") returned 5
	[0048.996] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.vbe") returned 0
	[0048.996] lstrlenA (lpString="*.vbe") returned 5
	[0048.996] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.vba") returned 0
	[0048.996] lstrlenA (lpString="*.vba") returned 5
	[0048.996] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.vbs") returned 0
	[0048.996] lstrlenA (lpString="*.vbs") returned 5
	[0048.996] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.bat") returned 0
	[0048.996] lstrlenA (lpString="*.bat") returned 5
	[0048.996] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.cmd") returned 0
	[0048.996] lstrlenA (lpString="*.cmd") returned 5
	[0048.996] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.js") returned 0
	[0048.996] lstrlenA (lpString="*.js") returned 4
	[0048.996] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.jscript") returned 0
	[0048.996] lstrlenA (lpString="*.jscript") returned 9
	[0048.996] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.hta") returned 0
	[0048.996] lstrlenA (lpString="*.hta") returned 5
	[0048.996] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.php7") returned 0
	[0048.996] lstrlenA (lpString="*.php7") returned 6
	[0048.996] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.db") returned 0
	[0048.996] lstrlenA (lpString="*.db") returned 4
	[0048.996] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.swf") returned 0
	[0048.996] lstrlenA (lpString="*.swf") returned 5
	[0048.996] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.eml") returned 0
	[0048.996] lstrlenA (lpString="*.eml") returned 5
	[0048.997] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.part") returned 0
	[0048.997] lstrlenA (lpString="*.part") returned 6
	[0048.997] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.nfo") returned 0
	[0048.997] lstrlenA (lpString="*.nfo") returned 5
	[0048.997] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.rsa") returned 0
	[0048.997] lstrlenA (lpString="*.rsa") returned 5
	[0048.997] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.key") returned 0
	[0048.997] lstrlenA (lpString="*.key") returned 5
	[0048.997] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.aes") returned 0
	[0048.997] lstrlenA (lpString="*.aes") returned 5
	[0048.997] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.blob") returned 0
	[0048.997] lstrlenA (lpString="*.blob") returned 6
	[0048.997] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.btc") returned 0
	[0048.997] lstrlenA (lpString="*.btc") returned 5
	[0048.997] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.wallet") returned 0
	[0048.997] lstrlenA (lpString="*.wallet") returned 8
	[0048.997] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0048.997] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0048.997] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SetupResources.dll") returned -1
	[0048.997] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SetupResources.dll") returned -1
	[0048.997] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1
	[0048.997] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned="LocalizedData.xml"
	[0048.997] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1046\\" | out: lpString1="C:\\588bce7c90097ed212\\1046\\") returned="C:\\588bce7c90097ed212\\1046\\"
	[0048.997] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1046\\" | out: pszPath="C:\\588bce7c90097ed212\\1046\\") returned=""
	[0048.997] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1046\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1046\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1046\\HOW-TO-DECRYPT-FILES.HTM"
	[0048.997] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1046\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1046\\how-to-decrypt-files.htm")) returned 0x20
	[0048.997] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1046\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1046\\SetupResources.dll"
	[0048.997] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.zip") returned 0
	[0048.997] lstrlenA (lpString="*.zip") returned 5
	[0048.997] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.rar") returned 0
	[0048.997] lstrlenA (lpString="*.rar") returned 5
	[0048.997] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.7z") returned 0
	[0048.997] lstrlenA (lpString="*.7z") returned 4
	[0048.997] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.tar") returned 0
	[0048.998] lstrlenA (lpString="*.tar") returned 5
	[0048.998] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.gzip") returned 0
	[0048.998] lstrlenA (lpString="*.gzip") returned 6
	[0048.998] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.jpg") returned 0
	[0048.998] lstrlenA (lpString="*.jpg") returned 5
	[0048.998] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.jpeg") returned 0
	[0048.998] lstrlenA (lpString="*.jpeg") returned 6
	[0048.998] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.bmp") returned 0
	[0048.998] lstrlenA (lpString="*.bmp") returned 5
	[0048.998] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.gif") returned 0
	[0048.998] lstrlenA (lpString="*.gif") returned 5
	[0048.998] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.png") returned 0
	[0048.998] lstrlenA (lpString="*.png") returned 5
	[0048.998] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.doc") returned 0
	[0048.998] lstrlenA (lpString="*.doc") returned 5
	[0048.998] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.docx") returned 0
	[0048.998] lstrlenA (lpString="*.docx") returned 6
	[0048.998] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.xls") returned 0
	[0048.998] lstrlenA (lpString="*.xls") returned 5
	[0048.998] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.xlsx") returned 0
	[0048.998] lstrlenA (lpString="*.xlsx") returned 6
	[0048.998] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.ppt") returned 0
	[0048.998] lstrlenA (lpString="*.ppt") returned 5
	[0048.998] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.pptx") returned 0
	[0048.998] lstrlenA (lpString="*.pptx") returned 6
	[0048.998] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.txt") returned 0
	[0048.998] lstrlenA (lpString="*.txt") returned 5
	[0048.998] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.pdf") returned 0
	[0048.998] lstrlenA (lpString="*.pdf") returned 5
	[0048.998] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.htm") returned 0
	[0048.998] lstrlenA (lpString="*.htm") returned 5
	[0048.998] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.html") returned 0
	[0048.998] lstrlenA (lpString="*.html") returned 6
	[0048.998] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.mdb") returned 0
	[0048.998] lstrlenA (lpString="*.mdb") returned 5
	[0048.998] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.pfx") returned 0
	[0048.998] lstrlenA (lpString="*.pfx") returned 5
	[0048.998] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.md") returned 0
	[0048.999] lstrlenA (lpString="*.md") returned 4
	[0048.999] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.lnk") returned 0
	[0048.999] lstrlenA (lpString="*.lnk") returned 5
	[0048.999] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.torrent") returned 0
	[0048.999] lstrlenA (lpString="*.torrent") returned 9
	[0048.999] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.mov") returned 0
	[0048.999] lstrlenA (lpString="*.mov") returned 5
	[0048.999] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.3gp") returned 0
	[0048.999] lstrlenA (lpString="*.3gp") returned 5
	[0048.999] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.mpeg") returned 0
	[0048.999] lstrlenA (lpString="*.mpeg") returned 6
	[0048.999] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.mpg") returned 0
	[0048.999] lstrlenA (lpString="*.mpg") returned 5
	[0048.999] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.flv") returned 0
	[0048.999] lstrlenA (lpString="*.flv") returned 5
	[0048.999] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.avi") returned 0
	[0048.999] lstrlenA (lpString="*.avi") returned 5
	[0048.999] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.mp4") returned 0
	[0048.999] lstrlenA (lpString="*.mp4") returned 5
	[0048.999] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.wmv") returned 0
	[0048.999] lstrlenA (lpString="*.wmv") returned 5
	[0048.999] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.mkv") returned 0
	[0048.999] lstrlenA (lpString="*.mkv") returned 5
	[0048.999] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.mp3") returned 0
	[0048.999] lstrlenA (lpString="*.mp3") returned 5
	[0048.999] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.wav") returned 0
	[0048.999] lstrlenA (lpString="*.wav") returned 5
	[0048.999] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.flac") returned 0
	[0048.999] lstrlenA (lpString="*.flac") returned 6
	[0048.999] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.wma") returned 0
	[0048.999] lstrlenA (lpString="*.wma") returned 5
	[0048.999] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.au3") returned 0
	[0048.999] lstrlenA (lpString="*.au3") returned 5
	[0048.999] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.ahk") returned 0
	[0048.999] lstrlenA (lpString="*.ahk") returned 5
	[0048.999] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.c") returned 0
	[0048.999] lstrlenA (lpString="*.c") returned 3
	[0048.999] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.cc") returned 0
	[0049.000] lstrlenA (lpString="*.cc") returned 4
	[0049.000] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.cpp") returned 0
	[0049.000] lstrlenA (lpString="*.cpp") returned 5
	[0049.000] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.cxx") returned 0
	[0049.000] lstrlenA (lpString="*.cxx") returned 5
	[0049.000] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.c++") returned 0
	[0049.000] lstrlenA (lpString="*.c++") returned 5
	[0049.000] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.cs") returned 0
	[0049.000] lstrlenA (lpString="*.cs") returned 4
	[0049.000] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.vb") returned 0
	[0049.000] lstrlenA (lpString="*.vb") returned 4
	[0049.000] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.bas") returned 0
	[0049.000] lstrlenA (lpString="*.bas") returned 5
	[0049.000] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.csproj") returned 0
	[0049.000] lstrlenA (lpString="*.csproj") returned 8
	[0049.000] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.vbproj") returned 0
	[0049.000] lstrlenA (lpString="*.vbproj") returned 8
	[0049.000] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.vcxproj") returned 0
	[0049.000] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.000] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.manifest") returned 0
	[0049.000] lstrlenA (lpString="*.manifest") returned 10
	[0049.000] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.php") returned 0
	[0049.000] lstrlenA (lpString="*.php") returned 5
	[0049.000] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.vbe") returned 0
	[0049.000] lstrlenA (lpString="*.vbe") returned 5
	[0049.000] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.vba") returned 0
	[0049.000] lstrlenA (lpString="*.vba") returned 5
	[0049.000] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.vbs") returned 0
	[0049.000] lstrlenA (lpString="*.vbs") returned 5
	[0049.000] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.bat") returned 0
	[0049.000] lstrlenA (lpString="*.bat") returned 5
	[0049.000] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.cmd") returned 0
	[0049.000] lstrlenA (lpString="*.cmd") returned 5
	[0049.000] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.js") returned 0
	[0049.000] lstrlenA (lpString="*.js") returned 4
	[0049.000] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.jscript") returned 0
	[0049.000] lstrlenA (lpString="*.jscript") returned 9
	[0049.001] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.hta") returned 0
	[0049.001] lstrlenA (lpString="*.hta") returned 5
	[0049.001] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.php7") returned 0
	[0049.001] lstrlenA (lpString="*.php7") returned 6
	[0049.001] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.db") returned 0
	[0049.001] lstrlenA (lpString="*.db") returned 4
	[0049.001] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.swf") returned 0
	[0049.001] lstrlenA (lpString="*.swf") returned 5
	[0049.001] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.eml") returned 0
	[0049.001] lstrlenA (lpString="*.eml") returned 5
	[0049.001] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.part") returned 0
	[0049.001] lstrlenA (lpString="*.part") returned 6
	[0049.001] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.nfo") returned 0
	[0049.001] lstrlenA (lpString="*.nfo") returned 5
	[0049.001] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.rsa") returned 0
	[0049.001] lstrlenA (lpString="*.rsa") returned 5
	[0049.001] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.key") returned 0
	[0049.001] lstrlenA (lpString="*.key") returned 5
	[0049.001] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.aes") returned 0
	[0049.001] lstrlenA (lpString="*.aes") returned 5
	[0049.001] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.blob") returned 0
	[0049.001] lstrlenA (lpString="*.blob") returned 6
	[0049.001] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.btc") returned 0
	[0049.001] lstrlenA (lpString="*.btc") returned 5
	[0049.001] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.wallet") returned 0
	[0049.001] lstrlenA (lpString="*.wallet") returned 8
	[0049.001] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0049.001] FindClose (in: hFindFile=0x7cb590 | out: hFindFile=0x7cb590) returned 1
	[0049.001] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d1d40, dwReserved1=0x7b00c0, cFileName="1049", cAlternateFileName="")) returned 1
	[0049.001] lstrcmpA (lpString1=".", lpString2="1049") returned -1
	[0049.001] lstrcmpA (lpString1="..", lpString2="1049") returned -1
	[0049.001] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*"
	[0049.001] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1049" | out: lpString1="C:\\588bce7c90097ed212\\1049") returned="C:\\588bce7c90097ed212\\1049"
	[0049.002] lstrlenA (lpString="C:\\588bce7c90097ed212\\1049") returned 26
	[0049.002] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb6d0
	[0049.002] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0049.002] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0049.002] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0049.002] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0049.002] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0049.002] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.002] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="eula.rtf") returned -1
	[0049.002] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="eula.rtf") returned 1
	[0049.002] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1
	[0049.002] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1049\\*.*") returned="*.*"
	[0049.002] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1049\\" | out: lpString1="C:\\588bce7c90097ed212\\1049\\") returned="C:\\588bce7c90097ed212\\1049\\"
	[0049.002] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1049\\" | out: pszPath="C:\\588bce7c90097ed212\\1049\\") returned=""
	[0049.002] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1049\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1049\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1049\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.002] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1049\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1049\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0049.002] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1049\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1049\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0049.036] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0049.036] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0049.037] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0049.037] CloseHandle (hObject=0x208) returned 1
	[0049.038] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1049\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned="C:\\588bce7c90097ed212\\1049\\eula.rtf"
	[0049.038] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.zip") returned 0
	[0049.038] lstrlenA (lpString="*.zip") returned 5
	[0049.038] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.rar") returned 0
	[0049.038] lstrlenA (lpString="*.rar") returned 5
	[0049.038] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.7z") returned 0
	[0049.038] lstrlenA (lpString="*.7z") returned 4
	[0049.038] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.tar") returned 0
	[0049.038] lstrlenA (lpString="*.tar") returned 5
	[0049.038] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.gzip") returned 0
	[0049.038] lstrlenA (lpString="*.gzip") returned 6
	[0049.038] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.jpg") returned 0
	[0049.038] lstrlenA (lpString="*.jpg") returned 5
	[0049.038] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.jpeg") returned 0
	[0049.038] lstrlenA (lpString="*.jpeg") returned 6
	[0049.038] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.bmp") returned 0
	[0049.038] lstrlenA (lpString="*.bmp") returned 5
	[0049.038] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.gif") returned 0
	[0049.038] lstrlenA (lpString="*.gif") returned 5
	[0049.038] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.png") returned 0
	[0049.038] lstrlenA (lpString="*.png") returned 5
	[0049.038] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.doc") returned 0
	[0049.038] lstrlenA (lpString="*.doc") returned 5
	[0049.038] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.docx") returned 0
	[0049.038] lstrlenA (lpString="*.docx") returned 6
	[0049.038] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.xls") returned 0
	[0049.038] lstrlenA (lpString="*.xls") returned 5
	[0049.038] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.xlsx") returned 0
	[0049.038] lstrlenA (lpString="*.xlsx") returned 6
	[0049.038] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.ppt") returned 0
	[0049.038] lstrlenA (lpString="*.ppt") returned 5
	[0049.038] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.pptx") returned 0
	[0049.039] lstrlenA (lpString="*.pptx") returned 6
	[0049.039] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.txt") returned 0
	[0049.039] lstrlenA (lpString="*.txt") returned 5
	[0049.039] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.pdf") returned 0
	[0049.039] lstrlenA (lpString="*.pdf") returned 5
	[0049.039] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.htm") returned 0
	[0049.039] lstrlenA (lpString="*.htm") returned 5
	[0049.039] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.html") returned 0
	[0049.039] lstrlenA (lpString="*.html") returned 6
	[0049.039] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.mdb") returned 0
	[0049.039] lstrlenA (lpString="*.mdb") returned 5
	[0049.039] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.pfx") returned 0
	[0049.039] lstrlenA (lpString="*.pfx") returned 5
	[0049.039] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.md") returned 0
	[0049.039] lstrlenA (lpString="*.md") returned 4
	[0049.039] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.lnk") returned 0
	[0049.039] lstrlenA (lpString="*.lnk") returned 5
	[0049.039] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.torrent") returned 0
	[0049.039] lstrlenA (lpString="*.torrent") returned 9
	[0049.039] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.mov") returned 0
	[0049.039] lstrlenA (lpString="*.mov") returned 5
	[0049.039] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.3gp") returned 0
	[0049.039] lstrlenA (lpString="*.3gp") returned 5
	[0049.039] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.mpeg") returned 0
	[0049.039] lstrlenA (lpString="*.mpeg") returned 6
	[0049.039] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.mpg") returned 0
	[0049.039] lstrlenA (lpString="*.mpg") returned 5
	[0049.039] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.flv") returned 0
	[0049.039] lstrlenA (lpString="*.flv") returned 5
	[0049.039] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.avi") returned 0
	[0049.039] lstrlenA (lpString="*.avi") returned 5
	[0049.039] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.mp4") returned 0
	[0049.039] lstrlenA (lpString="*.mp4") returned 5
	[0049.039] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.wmv") returned 0
	[0049.039] lstrlenA (lpString="*.wmv") returned 5
	[0049.039] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.mkv") returned 0
	[0049.039] lstrlenA (lpString="*.mkv") returned 5
	[0049.039] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.mp3") returned 0
	[0049.040] lstrlenA (lpString="*.mp3") returned 5
	[0049.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.wav") returned 0
	[0049.040] lstrlenA (lpString="*.wav") returned 5
	[0049.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.flac") returned 0
	[0049.040] lstrlenA (lpString="*.flac") returned 6
	[0049.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.wma") returned 0
	[0049.040] lstrlenA (lpString="*.wma") returned 5
	[0049.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.au3") returned 0
	[0049.040] lstrlenA (lpString="*.au3") returned 5
	[0049.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.ahk") returned 0
	[0049.040] lstrlenA (lpString="*.ahk") returned 5
	[0049.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.c") returned 0
	[0049.040] lstrlenA (lpString="*.c") returned 3
	[0049.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.cc") returned 0
	[0049.040] lstrlenA (lpString="*.cc") returned 4
	[0049.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.cpp") returned 0
	[0049.040] lstrlenA (lpString="*.cpp") returned 5
	[0049.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.cxx") returned 0
	[0049.040] lstrlenA (lpString="*.cxx") returned 5
	[0049.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.c++") returned 0
	[0049.040] lstrlenA (lpString="*.c++") returned 5
	[0049.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.cs") returned 0
	[0049.040] lstrlenA (lpString="*.cs") returned 4
	[0049.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.vb") returned 0
	[0049.040] lstrlenA (lpString="*.vb") returned 4
	[0049.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.bas") returned 0
	[0049.040] lstrlenA (lpString="*.bas") returned 5
	[0049.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.csproj") returned 0
	[0049.040] lstrlenA (lpString="*.csproj") returned 8
	[0049.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.vbproj") returned 0
	[0049.040] lstrlenA (lpString="*.vbproj") returned 8
	[0049.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.vcxproj") returned 0
	[0049.040] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.manifest") returned 0
	[0049.040] lstrlenA (lpString="*.manifest") returned 10
	[0049.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.php") returned 0
	[0049.040] lstrlenA (lpString="*.php") returned 5
	[0049.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.vbe") returned 0
	[0049.041] lstrlenA (lpString="*.vbe") returned 5
	[0049.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.vba") returned 0
	[0049.041] lstrlenA (lpString="*.vba") returned 5
	[0049.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.vbs") returned 0
	[0049.041] lstrlenA (lpString="*.vbs") returned 5
	[0049.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.bat") returned 0
	[0049.041] lstrlenA (lpString="*.bat") returned 5
	[0049.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.cmd") returned 0
	[0049.041] lstrlenA (lpString="*.cmd") returned 5
	[0049.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.js") returned 0
	[0049.041] lstrlenA (lpString="*.js") returned 4
	[0049.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.jscript") returned 0
	[0049.041] lstrlenA (lpString="*.jscript") returned 9
	[0049.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.hta") returned 0
	[0049.041] lstrlenA (lpString="*.hta") returned 5
	[0049.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.php7") returned 0
	[0049.041] lstrlenA (lpString="*.php7") returned 6
	[0049.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.db") returned 0
	[0049.041] lstrlenA (lpString="*.db") returned 4
	[0049.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.swf") returned 0
	[0049.041] lstrlenA (lpString="*.swf") returned 5
	[0049.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.eml") returned 0
	[0049.041] lstrlenA (lpString="*.eml") returned 5
	[0049.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.part") returned 0
	[0049.041] lstrlenA (lpString="*.part") returned 6
	[0049.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.nfo") returned 0
	[0049.041] lstrlenA (lpString="*.nfo") returned 5
	[0049.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.rsa") returned 0
	[0049.041] lstrlenA (lpString="*.rsa") returned 5
	[0049.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.key") returned 0
	[0049.041] lstrlenA (lpString="*.key") returned 5
	[0049.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.aes") returned 0
	[0049.041] lstrlenA (lpString="*.aes") returned 5
	[0049.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.blob") returned 0
	[0049.041] lstrlenA (lpString="*.blob") returned 6
	[0049.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.btc") returned 0
	[0049.041] lstrlenA (lpString="*.btc") returned 5
	[0049.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.wallet") returned 0
	[0049.042] lstrlenA (lpString="*.wallet") returned 8
	[0049.042] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0049.042] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.042] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="LocalizedData.xml") returned -1
	[0049.042] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="LocalizedData.xml") returned -1
	[0049.042] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1
	[0049.042] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned="eula.rtf"
	[0049.042] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1049\\" | out: lpString1="C:\\588bce7c90097ed212\\1049\\") returned="C:\\588bce7c90097ed212\\1049\\"
	[0049.042] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1049\\" | out: pszPath="C:\\588bce7c90097ed212\\1049\\") returned=""
	[0049.042] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1049\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1049\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1049\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.042] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1049\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1049\\how-to-decrypt-files.htm")) returned 0x20
	[0049.042] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1049\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml"
	[0049.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.zip") returned 0
	[0049.042] lstrlenA (lpString="*.zip") returned 5
	[0049.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.rar") returned 0
	[0049.042] lstrlenA (lpString="*.rar") returned 5
	[0049.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.7z") returned 0
	[0049.042] lstrlenA (lpString="*.7z") returned 4
	[0049.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.tar") returned 0
	[0049.042] lstrlenA (lpString="*.tar") returned 5
	[0049.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.gzip") returned 0
	[0049.042] lstrlenA (lpString="*.gzip") returned 6
	[0049.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.jpg") returned 0
	[0049.042] lstrlenA (lpString="*.jpg") returned 5
	[0049.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.jpeg") returned 0
	[0049.042] lstrlenA (lpString="*.jpeg") returned 6
	[0049.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.bmp") returned 0
	[0049.042] lstrlenA (lpString="*.bmp") returned 5
	[0049.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.gif") returned 0
	[0049.042] lstrlenA (lpString="*.gif") returned 5
	[0049.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.png") returned 0
	[0049.042] lstrlenA (lpString="*.png") returned 5
	[0049.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.doc") returned 0
	[0049.043] lstrlenA (lpString="*.doc") returned 5
	[0049.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.docx") returned 0
	[0049.043] lstrlenA (lpString="*.docx") returned 6
	[0049.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.xls") returned 0
	[0049.043] lstrlenA (lpString="*.xls") returned 5
	[0049.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.xlsx") returned 0
	[0049.043] lstrlenA (lpString="*.xlsx") returned 6
	[0049.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.ppt") returned 0
	[0049.043] lstrlenA (lpString="*.ppt") returned 5
	[0049.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.pptx") returned 0
	[0049.043] lstrlenA (lpString="*.pptx") returned 6
	[0049.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.txt") returned 0
	[0049.043] lstrlenA (lpString="*.txt") returned 5
	[0049.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.pdf") returned 0
	[0049.043] lstrlenA (lpString="*.pdf") returned 5
	[0049.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.htm") returned 0
	[0049.043] lstrlenA (lpString="*.htm") returned 5
	[0049.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.html") returned 0
	[0049.043] lstrlenA (lpString="*.html") returned 6
	[0049.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.mdb") returned 0
	[0049.043] lstrlenA (lpString="*.mdb") returned 5
	[0049.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.pfx") returned 0
	[0049.043] lstrlenA (lpString="*.pfx") returned 5
	[0049.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.md") returned 0
	[0049.043] lstrlenA (lpString="*.md") returned 4
	[0049.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.lnk") returned 0
	[0049.043] lstrlenA (lpString="*.lnk") returned 5
	[0049.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.torrent") returned 0
	[0049.043] lstrlenA (lpString="*.torrent") returned 9
	[0049.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.mov") returned 0
	[0049.043] lstrlenA (lpString="*.mov") returned 5
	[0049.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.3gp") returned 0
	[0049.043] lstrlenA (lpString="*.3gp") returned 5
	[0049.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.mpeg") returned 0
	[0049.043] lstrlenA (lpString="*.mpeg") returned 6
	[0049.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.mpg") returned 0
	[0049.044] lstrlenA (lpString="*.mpg") returned 5
	[0049.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.flv") returned 0
	[0049.044] lstrlenA (lpString="*.flv") returned 5
	[0049.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.avi") returned 0
	[0049.044] lstrlenA (lpString="*.avi") returned 5
	[0049.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.mp4") returned 0
	[0049.044] lstrlenA (lpString="*.mp4") returned 5
	[0049.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.wmv") returned 0
	[0049.044] lstrlenA (lpString="*.wmv") returned 5
	[0049.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.mkv") returned 0
	[0049.044] lstrlenA (lpString="*.mkv") returned 5
	[0049.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.mp3") returned 0
	[0049.044] lstrlenA (lpString="*.mp3") returned 5
	[0049.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.wav") returned 0
	[0049.044] lstrlenA (lpString="*.wav") returned 5
	[0049.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.flac") returned 0
	[0049.044] lstrlenA (lpString="*.flac") returned 6
	[0049.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.wma") returned 0
	[0049.044] lstrlenA (lpString="*.wma") returned 5
	[0049.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.au3") returned 0
	[0049.044] lstrlenA (lpString="*.au3") returned 5
	[0049.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.ahk") returned 0
	[0049.044] lstrlenA (lpString="*.ahk") returned 5
	[0049.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.c") returned 0
	[0049.044] lstrlenA (lpString="*.c") returned 3
	[0049.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.cc") returned 0
	[0049.044] lstrlenA (lpString="*.cc") returned 4
	[0049.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.cpp") returned 0
	[0049.044] lstrlenA (lpString="*.cpp") returned 5
	[0049.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.cxx") returned 0
	[0049.044] lstrlenA (lpString="*.cxx") returned 5
	[0049.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.c++") returned 0
	[0049.044] lstrlenA (lpString="*.c++") returned 5
	[0049.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.cs") returned 0
	[0049.044] lstrlenA (lpString="*.cs") returned 4
	[0049.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.vb") returned 0
	[0049.044] lstrlenA (lpString="*.vb") returned 4
	[0049.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.bas") returned 0
	[0049.045] lstrlenA (lpString="*.bas") returned 5
	[0049.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.csproj") returned 0
	[0049.045] lstrlenA (lpString="*.csproj") returned 8
	[0049.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.vbproj") returned 0
	[0049.045] lstrlenA (lpString="*.vbproj") returned 8
	[0049.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.vcxproj") returned 0
	[0049.045] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.manifest") returned 0
	[0049.045] lstrlenA (lpString="*.manifest") returned 10
	[0049.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.php") returned 0
	[0049.045] lstrlenA (lpString="*.php") returned 5
	[0049.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.vbe") returned 0
	[0049.045] lstrlenA (lpString="*.vbe") returned 5
	[0049.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.vba") returned 0
	[0049.045] lstrlenA (lpString="*.vba") returned 5
	[0049.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.vbs") returned 0
	[0049.045] lstrlenA (lpString="*.vbs") returned 5
	[0049.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.bat") returned 0
	[0049.045] lstrlenA (lpString="*.bat") returned 5
	[0049.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.cmd") returned 0
	[0049.045] lstrlenA (lpString="*.cmd") returned 5
	[0049.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.js") returned 0
	[0049.045] lstrlenA (lpString="*.js") returned 4
	[0049.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.jscript") returned 0
	[0049.045] lstrlenA (lpString="*.jscript") returned 9
	[0049.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.hta") returned 0
	[0049.045] lstrlenA (lpString="*.hta") returned 5
	[0049.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.php7") returned 0
	[0049.045] lstrlenA (lpString="*.php7") returned 6
	[0049.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.db") returned 0
	[0049.045] lstrlenA (lpString="*.db") returned 4
	[0049.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.swf") returned 0
	[0049.045] lstrlenA (lpString="*.swf") returned 5
	[0049.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.eml") returned 0
	[0049.046] lstrlenA (lpString="*.eml") returned 5
	[0049.046] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.part") returned 0
	[0049.046] lstrlenA (lpString="*.part") returned 6
	[0049.046] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.nfo") returned 0
	[0049.046] lstrlenA (lpString="*.nfo") returned 5
	[0049.046] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.rsa") returned 0
	[0049.046] lstrlenA (lpString="*.rsa") returned 5
	[0049.046] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.key") returned 0
	[0049.046] lstrlenA (lpString="*.key") returned 5
	[0049.046] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.aes") returned 0
	[0049.046] lstrlenA (lpString="*.aes") returned 5
	[0049.046] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.blob") returned 0
	[0049.046] lstrlenA (lpString="*.blob") returned 6
	[0049.046] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.btc") returned 0
	[0049.046] lstrlenA (lpString="*.btc") returned 5
	[0049.046] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.wallet") returned 0
	[0049.046] lstrlenA (lpString="*.wallet") returned 8
	[0049.046] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0049.046] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.046] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SetupResources.dll") returned -1
	[0049.046] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SetupResources.dll") returned -1
	[0049.046] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1
	[0049.046] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned="LocalizedData.xml"
	[0049.046] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1049\\" | out: lpString1="C:\\588bce7c90097ed212\\1049\\") returned="C:\\588bce7c90097ed212\\1049\\"
	[0049.046] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1049\\" | out: pszPath="C:\\588bce7c90097ed212\\1049\\") returned=""
	[0049.046] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1049\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1049\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1049\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.046] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1049\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1049\\how-to-decrypt-files.htm")) returned 0x20
	[0049.046] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1049\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1049\\SetupResources.dll"
	[0049.046] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.zip") returned 0
	[0049.046] lstrlenA (lpString="*.zip") returned 5
	[0049.046] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.rar") returned 0
	[0049.046] lstrlenA (lpString="*.rar") returned 5
	[0049.046] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.7z") returned 0
	[0049.046] lstrlenA (lpString="*.7z") returned 4
	[0049.047] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.tar") returned 0
	[0049.047] lstrlenA (lpString="*.tar") returned 5
	[0049.047] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.gzip") returned 0
	[0049.047] lstrlenA (lpString="*.gzip") returned 6
	[0049.047] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.jpg") returned 0
	[0049.047] lstrlenA (lpString="*.jpg") returned 5
	[0049.047] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.jpeg") returned 0
	[0049.047] lstrlenA (lpString="*.jpeg") returned 6
	[0049.047] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.bmp") returned 0
	[0049.047] lstrlenA (lpString="*.bmp") returned 5
	[0049.047] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.gif") returned 0
	[0049.047] lstrlenA (lpString="*.gif") returned 5
	[0049.047] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.png") returned 0
	[0049.047] lstrlenA (lpString="*.png") returned 5
	[0049.047] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.doc") returned 0
	[0049.047] lstrlenA (lpString="*.doc") returned 5
	[0049.047] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.docx") returned 0
	[0049.047] lstrlenA (lpString="*.docx") returned 6
	[0049.047] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.xls") returned 0
	[0049.047] lstrlenA (lpString="*.xls") returned 5
	[0049.047] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.xlsx") returned 0
	[0049.047] lstrlenA (lpString="*.xlsx") returned 6
	[0049.047] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.ppt") returned 0
	[0049.047] lstrlenA (lpString="*.ppt") returned 5
	[0049.047] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.pptx") returned 0
	[0049.047] lstrlenA (lpString="*.pptx") returned 6
	[0049.047] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.txt") returned 0
	[0049.047] lstrlenA (lpString="*.txt") returned 5
	[0049.047] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.pdf") returned 0
	[0049.047] lstrlenA (lpString="*.pdf") returned 5
	[0049.047] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.htm") returned 0
	[0049.047] lstrlenA (lpString="*.htm") returned 5
	[0049.047] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.html") returned 0
	[0049.047] lstrlenA (lpString="*.html") returned 6
	[0049.047] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.mdb") returned 0
	[0049.047] lstrlenA (lpString="*.mdb") returned 5
	[0049.047] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.pfx") returned 0
	[0049.048] lstrlenA (lpString="*.pfx") returned 5
	[0049.048] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.md") returned 0
	[0049.048] lstrlenA (lpString="*.md") returned 4
	[0049.048] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.lnk") returned 0
	[0049.048] lstrlenA (lpString="*.lnk") returned 5
	[0049.048] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.torrent") returned 0
	[0049.048] lstrlenA (lpString="*.torrent") returned 9
	[0049.048] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.mov") returned 0
	[0049.048] lstrlenA (lpString="*.mov") returned 5
	[0049.048] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.3gp") returned 0
	[0049.048] lstrlenA (lpString="*.3gp") returned 5
	[0049.048] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.mpeg") returned 0
	[0049.048] lstrlenA (lpString="*.mpeg") returned 6
	[0049.048] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.mpg") returned 0
	[0049.048] lstrlenA (lpString="*.mpg") returned 5
	[0049.048] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.flv") returned 0
	[0049.048] lstrlenA (lpString="*.flv") returned 5
	[0049.048] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.avi") returned 0
	[0049.048] lstrlenA (lpString="*.avi") returned 5
	[0049.048] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.mp4") returned 0
	[0049.048] lstrlenA (lpString="*.mp4") returned 5
	[0049.048] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.wmv") returned 0
	[0049.048] lstrlenA (lpString="*.wmv") returned 5
	[0049.048] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.mkv") returned 0
	[0049.048] lstrlenA (lpString="*.mkv") returned 5
	[0049.048] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.mp3") returned 0
	[0049.048] lstrlenA (lpString="*.mp3") returned 5
	[0049.048] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.wav") returned 0
	[0049.048] lstrlenA (lpString="*.wav") returned 5
	[0049.048] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.flac") returned 0
	[0049.048] lstrlenA (lpString="*.flac") returned 6
	[0049.048] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.wma") returned 0
	[0049.048] lstrlenA (lpString="*.wma") returned 5
	[0049.048] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.au3") returned 0
	[0049.048] lstrlenA (lpString="*.au3") returned 5
	[0049.048] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.ahk") returned 0
	[0049.048] lstrlenA (lpString="*.ahk") returned 5
	[0049.049] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.c") returned 0
	[0049.049] lstrlenA (lpString="*.c") returned 3
	[0049.049] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.cc") returned 0
	[0049.049] lstrlenA (lpString="*.cc") returned 4
	[0049.049] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.cpp") returned 0
	[0049.049] lstrlenA (lpString="*.cpp") returned 5
	[0049.049] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.cxx") returned 0
	[0049.049] lstrlenA (lpString="*.cxx") returned 5
	[0049.049] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.c++") returned 0
	[0049.049] lstrlenA (lpString="*.c++") returned 5
	[0049.049] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.cs") returned 0
	[0049.049] lstrlenA (lpString="*.cs") returned 4
	[0049.049] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.vb") returned 0
	[0049.049] lstrlenA (lpString="*.vb") returned 4
	[0049.049] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.bas") returned 0
	[0049.049] lstrlenA (lpString="*.bas") returned 5
	[0049.049] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.csproj") returned 0
	[0049.049] lstrlenA (lpString="*.csproj") returned 8
	[0049.049] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.vbproj") returned 0
	[0049.049] lstrlenA (lpString="*.vbproj") returned 8
	[0049.049] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.vcxproj") returned 0
	[0049.049] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.049] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.manifest") returned 0
	[0049.049] lstrlenA (lpString="*.manifest") returned 10
	[0049.049] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.php") returned 0
	[0049.049] lstrlenA (lpString="*.php") returned 5
	[0049.049] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.vbe") returned 0
	[0049.049] lstrlenA (lpString="*.vbe") returned 5
	[0049.049] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.vba") returned 0
	[0049.049] lstrlenA (lpString="*.vba") returned 5
	[0049.049] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.vbs") returned 0
	[0049.049] lstrlenA (lpString="*.vbs") returned 5
	[0049.049] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.bat") returned 0
	[0049.049] lstrlenA (lpString="*.bat") returned 5
	[0049.049] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.cmd") returned 0
	[0049.049] lstrlenA (lpString="*.cmd") returned 5
	[0049.049] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.js") returned 0
	[0049.049] lstrlenA (lpString="*.js") returned 4
	[0049.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.jscript") returned 0
	[0049.050] lstrlenA (lpString="*.jscript") returned 9
	[0049.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.hta") returned 0
	[0049.050] lstrlenA (lpString="*.hta") returned 5
	[0049.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.php7") returned 0
	[0049.050] lstrlenA (lpString="*.php7") returned 6
	[0049.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.db") returned 0
	[0049.050] lstrlenA (lpString="*.db") returned 4
	[0049.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.swf") returned 0
	[0049.050] lstrlenA (lpString="*.swf") returned 5
	[0049.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.eml") returned 0
	[0049.050] lstrlenA (lpString="*.eml") returned 5
	[0049.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.part") returned 0
	[0049.050] lstrlenA (lpString="*.part") returned 6
	[0049.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.nfo") returned 0
	[0049.050] lstrlenA (lpString="*.nfo") returned 5
	[0049.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.rsa") returned 0
	[0049.050] lstrlenA (lpString="*.rsa") returned 5
	[0049.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.key") returned 0
	[0049.050] lstrlenA (lpString="*.key") returned 5
	[0049.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.aes") returned 0
	[0049.050] lstrlenA (lpString="*.aes") returned 5
	[0049.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.blob") returned 0
	[0049.050] lstrlenA (lpString="*.blob") returned 6
	[0049.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.btc") returned 0
	[0049.050] lstrlenA (lpString="*.btc") returned 5
	[0049.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.wallet") returned 0
	[0049.050] lstrlenA (lpString="*.wallet") returned 8
	[0049.050] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0049.050] FindClose (in: hFindFile=0x7cb6d0 | out: hFindFile=0x7cb6d0) returned 1
	[0049.050] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d1d40, dwReserved1=0x7b00c0, cFileName="1053", cAlternateFileName="")) returned 1
	[0049.050] lstrcmpA (lpString1=".", lpString2="1053") returned -1
	[0049.050] lstrcmpA (lpString1="..", lpString2="1053") returned -1
	[0049.050] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*"
	[0049.051] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1053" | out: lpString1="C:\\588bce7c90097ed212\\1053") returned="C:\\588bce7c90097ed212\\1053"
	[0049.051] lstrlenA (lpString="C:\\588bce7c90097ed212\\1053") returned 26
	[0049.051] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb810
	[0049.051] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0049.052] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0049.052] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0049.052] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0049.052] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0049.052] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.052] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="eula.rtf") returned -1
	[0049.052] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="eula.rtf") returned 1
	[0049.052] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1
	[0049.052] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1053\\*.*") returned="*.*"
	[0049.052] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1053\\" | out: lpString1="C:\\588bce7c90097ed212\\1053\\") returned="C:\\588bce7c90097ed212\\1053\\"
	[0049.052] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1053\\" | out: pszPath="C:\\588bce7c90097ed212\\1053\\") returned=""
	[0049.052] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1053\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1053\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1053\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.052] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1053\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1053\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0049.052] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1053\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1053\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0049.054] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0049.054] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0049.055] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0049.055] CloseHandle (hObject=0x208) returned 1
	[0049.055] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1053\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned="C:\\588bce7c90097ed212\\1053\\eula.rtf"
	[0049.055] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.zip") returned 0
	[0049.055] lstrlenA (lpString="*.zip") returned 5
	[0049.055] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.rar") returned 0
	[0049.055] lstrlenA (lpString="*.rar") returned 5
	[0049.055] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.7z") returned 0
	[0049.055] lstrlenA (lpString="*.7z") returned 4
	[0049.055] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.tar") returned 0
	[0049.055] lstrlenA (lpString="*.tar") returned 5
	[0049.055] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.gzip") returned 0
	[0049.055] lstrlenA (lpString="*.gzip") returned 6
	[0049.055] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.jpg") returned 0
	[0049.055] lstrlenA (lpString="*.jpg") returned 5
	[0049.055] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.jpeg") returned 0
	[0049.055] lstrlenA (lpString="*.jpeg") returned 6
	[0049.055] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.bmp") returned 0
	[0049.055] lstrlenA (lpString="*.bmp") returned 5
	[0049.055] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.gif") returned 0
	[0049.056] lstrlenA (lpString="*.gif") returned 5
	[0049.056] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.png") returned 0
	[0049.056] lstrlenA (lpString="*.png") returned 5
	[0049.056] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.doc") returned 0
	[0049.056] lstrlenA (lpString="*.doc") returned 5
	[0049.056] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.docx") returned 0
	[0049.056] lstrlenA (lpString="*.docx") returned 6
	[0049.056] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.xls") returned 0
	[0049.056] lstrlenA (lpString="*.xls") returned 5
	[0049.056] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.xlsx") returned 0
	[0049.056] lstrlenA (lpString="*.xlsx") returned 6
	[0049.056] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.ppt") returned 0
	[0049.056] lstrlenA (lpString="*.ppt") returned 5
	[0049.056] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.pptx") returned 0
	[0049.056] lstrlenA (lpString="*.pptx") returned 6
	[0049.056] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.txt") returned 0
	[0049.056] lstrlenA (lpString="*.txt") returned 5
	[0049.056] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.pdf") returned 0
	[0049.056] lstrlenA (lpString="*.pdf") returned 5
	[0049.056] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.htm") returned 0
	[0049.056] lstrlenA (lpString="*.htm") returned 5
	[0049.056] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.html") returned 0
	[0049.056] lstrlenA (lpString="*.html") returned 6
	[0049.056] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.mdb") returned 0
	[0049.056] lstrlenA (lpString="*.mdb") returned 5
	[0049.056] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.pfx") returned 0
	[0049.056] lstrlenA (lpString="*.pfx") returned 5
	[0049.056] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.md") returned 0
	[0049.056] lstrlenA (lpString="*.md") returned 4
	[0049.056] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.lnk") returned 0
	[0049.056] lstrlenA (lpString="*.lnk") returned 5
	[0049.056] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.torrent") returned 0
	[0049.056] lstrlenA (lpString="*.torrent") returned 9
	[0049.056] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.mov") returned 0
	[0049.056] lstrlenA (lpString="*.mov") returned 5
	[0049.056] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.3gp") returned 0
	[0049.056] lstrlenA (lpString="*.3gp") returned 5
	[0049.056] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.mpeg") returned 0
	[0049.057] lstrlenA (lpString="*.mpeg") returned 6
	[0049.057] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.mpg") returned 0
	[0049.057] lstrlenA (lpString="*.mpg") returned 5
	[0049.057] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.flv") returned 0
	[0049.057] lstrlenA (lpString="*.flv") returned 5
	[0049.057] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.avi") returned 0
	[0049.057] lstrlenA (lpString="*.avi") returned 5
	[0049.057] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.mp4") returned 0
	[0049.057] lstrlenA (lpString="*.mp4") returned 5
	[0049.057] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.wmv") returned 0
	[0049.057] lstrlenA (lpString="*.wmv") returned 5
	[0049.057] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.mkv") returned 0
	[0049.057] lstrlenA (lpString="*.mkv") returned 5
	[0049.057] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.mp3") returned 0
	[0049.057] lstrlenA (lpString="*.mp3") returned 5
	[0049.057] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.wav") returned 0
	[0049.057] lstrlenA (lpString="*.wav") returned 5
	[0049.057] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.flac") returned 0
	[0049.057] lstrlenA (lpString="*.flac") returned 6
	[0049.057] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.wma") returned 0
	[0049.057] lstrlenA (lpString="*.wma") returned 5
	[0049.057] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.au3") returned 0
	[0049.057] lstrlenA (lpString="*.au3") returned 5
	[0049.057] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.ahk") returned 0
	[0049.057] lstrlenA (lpString="*.ahk") returned 5
	[0049.057] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.c") returned 0
	[0049.057] lstrlenA (lpString="*.c") returned 3
	[0049.057] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.cc") returned 0
	[0049.057] lstrlenA (lpString="*.cc") returned 4
	[0049.057] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.cpp") returned 0
	[0049.057] lstrlenA (lpString="*.cpp") returned 5
	[0049.057] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.cxx") returned 0
	[0049.057] lstrlenA (lpString="*.cxx") returned 5
	[0049.057] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.c++") returned 0
	[0049.057] lstrlenA (lpString="*.c++") returned 5
	[0049.057] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.cs") returned 0
	[0049.057] lstrlenA (lpString="*.cs") returned 4
	[0049.058] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.vb") returned 0
	[0049.058] lstrlenA (lpString="*.vb") returned 4
	[0049.058] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.bas") returned 0
	[0049.058] lstrlenA (lpString="*.bas") returned 5
	[0049.058] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.csproj") returned 0
	[0049.058] lstrlenA (lpString="*.csproj") returned 8
	[0049.058] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.vbproj") returned 0
	[0049.058] lstrlenA (lpString="*.vbproj") returned 8
	[0049.058] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.vcxproj") returned 0
	[0049.058] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.058] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.manifest") returned 0
	[0049.058] lstrlenA (lpString="*.manifest") returned 10
	[0049.058] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.php") returned 0
	[0049.058] lstrlenA (lpString="*.php") returned 5
	[0049.058] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.vbe") returned 0
	[0049.058] lstrlenA (lpString="*.vbe") returned 5
	[0049.058] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.vba") returned 0
	[0049.058] lstrlenA (lpString="*.vba") returned 5
	[0049.058] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.vbs") returned 0
	[0049.058] lstrlenA (lpString="*.vbs") returned 5
	[0049.058] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.bat") returned 0
	[0049.058] lstrlenA (lpString="*.bat") returned 5
	[0049.058] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.cmd") returned 0
	[0049.058] lstrlenA (lpString="*.cmd") returned 5
	[0049.058] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.js") returned 0
	[0049.058] lstrlenA (lpString="*.js") returned 4
	[0049.058] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.jscript") returned 0
	[0049.058] lstrlenA (lpString="*.jscript") returned 9
	[0049.058] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.hta") returned 0
	[0049.058] lstrlenA (lpString="*.hta") returned 5
	[0049.058] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.php7") returned 0
	[0049.058] lstrlenA (lpString="*.php7") returned 6
	[0049.058] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.db") returned 0
	[0049.058] lstrlenA (lpString="*.db") returned 4
	[0049.058] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.swf") returned 0
	[0049.058] lstrlenA (lpString="*.swf") returned 5
	[0049.058] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.eml") returned 0
	[0049.058] lstrlenA (lpString="*.eml") returned 5
	[0049.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.part") returned 0
	[0049.059] lstrlenA (lpString="*.part") returned 6
	[0049.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.nfo") returned 0
	[0049.059] lstrlenA (lpString="*.nfo") returned 5
	[0049.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.rsa") returned 0
	[0049.059] lstrlenA (lpString="*.rsa") returned 5
	[0049.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.key") returned 0
	[0049.059] lstrlenA (lpString="*.key") returned 5
	[0049.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.aes") returned 0
	[0049.059] lstrlenA (lpString="*.aes") returned 5
	[0049.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.blob") returned 0
	[0049.059] lstrlenA (lpString="*.blob") returned 6
	[0049.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.btc") returned 0
	[0049.059] lstrlenA (lpString="*.btc") returned 5
	[0049.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.wallet") returned 0
	[0049.059] lstrlenA (lpString="*.wallet") returned 8
	[0049.059] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0049.059] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.059] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="LocalizedData.xml") returned -1
	[0049.059] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="LocalizedData.xml") returned -1
	[0049.059] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1
	[0049.059] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned="eula.rtf"
	[0049.059] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1053\\" | out: lpString1="C:\\588bce7c90097ed212\\1053\\") returned="C:\\588bce7c90097ed212\\1053\\"
	[0049.059] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1053\\" | out: pszPath="C:\\588bce7c90097ed212\\1053\\") returned=""
	[0049.059] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1053\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1053\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1053\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.059] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1053\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1053\\how-to-decrypt-files.htm")) returned 0x20
	[0049.059] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1053\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml"
	[0049.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.zip") returned 0
	[0049.059] lstrlenA (lpString="*.zip") returned 5
	[0049.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.rar") returned 0
	[0049.059] lstrlenA (lpString="*.rar") returned 5
	[0049.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.7z") returned 0
	[0049.059] lstrlenA (lpString="*.7z") returned 4
	[0049.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.tar") returned 0
	[0049.060] lstrlenA (lpString="*.tar") returned 5
	[0049.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.gzip") returned 0
	[0049.060] lstrlenA (lpString="*.gzip") returned 6
	[0049.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.jpg") returned 0
	[0049.060] lstrlenA (lpString="*.jpg") returned 5
	[0049.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.jpeg") returned 0
	[0049.060] lstrlenA (lpString="*.jpeg") returned 6
	[0049.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.bmp") returned 0
	[0049.060] lstrlenA (lpString="*.bmp") returned 5
	[0049.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.gif") returned 0
	[0049.060] lstrlenA (lpString="*.gif") returned 5
	[0049.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.png") returned 0
	[0049.060] lstrlenA (lpString="*.png") returned 5
	[0049.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.doc") returned 0
	[0049.060] lstrlenA (lpString="*.doc") returned 5
	[0049.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.docx") returned 0
	[0049.060] lstrlenA (lpString="*.docx") returned 6
	[0049.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.xls") returned 0
	[0049.060] lstrlenA (lpString="*.xls") returned 5
	[0049.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.xlsx") returned 0
	[0049.060] lstrlenA (lpString="*.xlsx") returned 6
	[0049.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.ppt") returned 0
	[0049.060] lstrlenA (lpString="*.ppt") returned 5
	[0049.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.pptx") returned 0
	[0049.060] lstrlenA (lpString="*.pptx") returned 6
	[0049.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.txt") returned 0
	[0049.060] lstrlenA (lpString="*.txt") returned 5
	[0049.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.pdf") returned 0
	[0049.060] lstrlenA (lpString="*.pdf") returned 5
	[0049.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.htm") returned 0
	[0049.060] lstrlenA (lpString="*.htm") returned 5
	[0049.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.html") returned 0
	[0049.060] lstrlenA (lpString="*.html") returned 6
	[0049.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.mdb") returned 0
	[0049.060] lstrlenA (lpString="*.mdb") returned 5
	[0049.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.pfx") returned 0
	[0049.061] lstrlenA (lpString="*.pfx") returned 5
	[0049.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.md") returned 0
	[0049.061] lstrlenA (lpString="*.md") returned 4
	[0049.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.lnk") returned 0
	[0049.061] lstrlenA (lpString="*.lnk") returned 5
	[0049.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.torrent") returned 0
	[0049.061] lstrlenA (lpString="*.torrent") returned 9
	[0049.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.mov") returned 0
	[0049.061] lstrlenA (lpString="*.mov") returned 5
	[0049.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.3gp") returned 0
	[0049.061] lstrlenA (lpString="*.3gp") returned 5
	[0049.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.mpeg") returned 0
	[0049.061] lstrlenA (lpString="*.mpeg") returned 6
	[0049.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.mpg") returned 0
	[0049.061] lstrlenA (lpString="*.mpg") returned 5
	[0049.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.flv") returned 0
	[0049.061] lstrlenA (lpString="*.flv") returned 5
	[0049.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.avi") returned 0
	[0049.061] lstrlenA (lpString="*.avi") returned 5
	[0049.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.mp4") returned 0
	[0049.061] lstrlenA (lpString="*.mp4") returned 5
	[0049.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.wmv") returned 0
	[0049.062] lstrlenA (lpString="*.wmv") returned 5
	[0049.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.mkv") returned 0
	[0049.062] lstrlenA (lpString="*.mkv") returned 5
	[0049.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.mp3") returned 0
	[0049.062] lstrlenA (lpString="*.mp3") returned 5
	[0049.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.wav") returned 0
	[0049.062] lstrlenA (lpString="*.wav") returned 5
	[0049.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.flac") returned 0
	[0049.062] lstrlenA (lpString="*.flac") returned 6
	[0049.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.wma") returned 0
	[0049.062] lstrlenA (lpString="*.wma") returned 5
	[0049.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.au3") returned 0
	[0049.062] lstrlenA (lpString="*.au3") returned 5
	[0049.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.ahk") returned 0
	[0049.062] lstrlenA (lpString="*.ahk") returned 5
	[0049.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.c") returned 0
	[0049.062] lstrlenA (lpString="*.c") returned 3
	[0049.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.cc") returned 0
	[0049.062] lstrlenA (lpString="*.cc") returned 4
	[0049.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.cpp") returned 0
	[0049.062] lstrlenA (lpString="*.cpp") returned 5
	[0049.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.cxx") returned 0
	[0049.062] lstrlenA (lpString="*.cxx") returned 5
	[0049.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.c++") returned 0
	[0049.062] lstrlenA (lpString="*.c++") returned 5
	[0049.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.cs") returned 0
	[0049.062] lstrlenA (lpString="*.cs") returned 4
	[0049.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.vb") returned 0
	[0049.062] lstrlenA (lpString="*.vb") returned 4
	[0049.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.bas") returned 0
	[0049.062] lstrlenA (lpString="*.bas") returned 5
	[0049.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.csproj") returned 0
	[0049.063] lstrlenA (lpString="*.csproj") returned 8
	[0049.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.vbproj") returned 0
	[0049.063] lstrlenA (lpString="*.vbproj") returned 8
	[0049.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.vcxproj") returned 0
	[0049.063] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.manifest") returned 0
	[0049.063] lstrlenA (lpString="*.manifest") returned 10
	[0049.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.php") returned 0
	[0049.063] lstrlenA (lpString="*.php") returned 5
	[0049.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.vbe") returned 0
	[0049.063] lstrlenA (lpString="*.vbe") returned 5
	[0049.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.vba") returned 0
	[0049.063] lstrlenA (lpString="*.vba") returned 5
	[0049.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.vbs") returned 0
	[0049.063] lstrlenA (lpString="*.vbs") returned 5
	[0049.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.bat") returned 0
	[0049.063] lstrlenA (lpString="*.bat") returned 5
	[0049.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.cmd") returned 0
	[0049.063] lstrlenA (lpString="*.cmd") returned 5
	[0049.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.js") returned 0
	[0049.063] lstrlenA (lpString="*.js") returned 4
	[0049.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.jscript") returned 0
	[0049.063] lstrlenA (lpString="*.jscript") returned 9
	[0049.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.hta") returned 0
	[0049.063] lstrlenA (lpString="*.hta") returned 5
	[0049.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.php7") returned 0
	[0049.063] lstrlenA (lpString="*.php7") returned 6
	[0049.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.db") returned 0
	[0049.063] lstrlenA (lpString="*.db") returned 4
	[0049.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.swf") returned 0
	[0049.063] lstrlenA (lpString="*.swf") returned 5
	[0049.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.eml") returned 0
	[0049.063] lstrlenA (lpString="*.eml") returned 5
	[0049.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.part") returned 0
	[0049.063] lstrlenA (lpString="*.part") returned 6
	[0049.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.nfo") returned 0
	[0049.063] lstrlenA (lpString="*.nfo") returned 5
	[0049.064] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.rsa") returned 0
	[0049.064] lstrlenA (lpString="*.rsa") returned 5
	[0049.064] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.key") returned 0
	[0049.064] lstrlenA (lpString="*.key") returned 5
	[0049.064] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.aes") returned 0
	[0049.064] lstrlenA (lpString="*.aes") returned 5
	[0049.064] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.blob") returned 0
	[0049.064] lstrlenA (lpString="*.blob") returned 6
	[0049.064] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.btc") returned 0
	[0049.064] lstrlenA (lpString="*.btc") returned 5
	[0049.064] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.wallet") returned 0
	[0049.064] lstrlenA (lpString="*.wallet") returned 8
	[0049.064] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0049.064] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.064] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SetupResources.dll") returned -1
	[0049.064] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SetupResources.dll") returned -1
	[0049.064] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1
	[0049.064] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned="LocalizedData.xml"
	[0049.064] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1053\\" | out: lpString1="C:\\588bce7c90097ed212\\1053\\") returned="C:\\588bce7c90097ed212\\1053\\"
	[0049.064] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1053\\" | out: pszPath="C:\\588bce7c90097ed212\\1053\\") returned=""
	[0049.064] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1053\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1053\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1053\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.064] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1053\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1053\\how-to-decrypt-files.htm")) returned 0x20
	[0049.064] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1053\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1053\\SetupResources.dll"
	[0049.064] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.zip") returned 0
	[0049.064] lstrlenA (lpString="*.zip") returned 5
	[0049.064] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.rar") returned 0
	[0049.064] lstrlenA (lpString="*.rar") returned 5
	[0049.064] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.7z") returned 0
	[0049.064] lstrlenA (lpString="*.7z") returned 4
	[0049.064] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.tar") returned 0
	[0049.064] lstrlenA (lpString="*.tar") returned 5
	[0049.064] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.gzip") returned 0
	[0049.064] lstrlenA (lpString="*.gzip") returned 6
	[0049.064] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.jpg") returned 0
	[0049.065] lstrlenA (lpString="*.jpg") returned 5
	[0049.065] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.jpeg") returned 0
	[0049.065] lstrlenA (lpString="*.jpeg") returned 6
	[0049.065] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.bmp") returned 0
	[0049.065] lstrlenA (lpString="*.bmp") returned 5
	[0049.065] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.gif") returned 0
	[0049.065] lstrlenA (lpString="*.gif") returned 5
	[0049.065] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.png") returned 0
	[0049.065] lstrlenA (lpString="*.png") returned 5
	[0049.065] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.doc") returned 0
	[0049.065] lstrlenA (lpString="*.doc") returned 5
	[0049.065] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.docx") returned 0
	[0049.065] lstrlenA (lpString="*.docx") returned 6
	[0049.065] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.xls") returned 0
	[0049.065] lstrlenA (lpString="*.xls") returned 5
	[0049.065] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.xlsx") returned 0
	[0049.065] lstrlenA (lpString="*.xlsx") returned 6
	[0049.065] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.ppt") returned 0
	[0049.065] lstrlenA (lpString="*.ppt") returned 5
	[0049.065] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.pptx") returned 0
	[0049.065] lstrlenA (lpString="*.pptx") returned 6
	[0049.065] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.txt") returned 0
	[0049.065] lstrlenA (lpString="*.txt") returned 5
	[0049.065] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.pdf") returned 0
	[0049.065] lstrlenA (lpString="*.pdf") returned 5
	[0049.065] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.htm") returned 0
	[0049.065] lstrlenA (lpString="*.htm") returned 5
	[0049.065] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.html") returned 0
	[0049.065] lstrlenA (lpString="*.html") returned 6
	[0049.065] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.mdb") returned 0
	[0049.065] lstrlenA (lpString="*.mdb") returned 5
	[0049.065] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.pfx") returned 0
	[0049.065] lstrlenA (lpString="*.pfx") returned 5
	[0049.065] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.md") returned 0
	[0049.065] lstrlenA (lpString="*.md") returned 4
	[0049.065] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.lnk") returned 0
	[0049.065] lstrlenA (lpString="*.lnk") returned 5
	[0049.066] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.torrent") returned 0
	[0049.066] lstrlenA (lpString="*.torrent") returned 9
	[0049.066] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.mov") returned 0
	[0049.066] lstrlenA (lpString="*.mov") returned 5
	[0049.066] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.3gp") returned 0
	[0049.066] lstrlenA (lpString="*.3gp") returned 5
	[0049.066] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.mpeg") returned 0
	[0049.066] lstrlenA (lpString="*.mpeg") returned 6
	[0049.066] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.mpg") returned 0
	[0049.066] lstrlenA (lpString="*.mpg") returned 5
	[0049.066] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.flv") returned 0
	[0049.066] lstrlenA (lpString="*.flv") returned 5
	[0049.066] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.avi") returned 0
	[0049.066] lstrlenA (lpString="*.avi") returned 5
	[0049.066] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.mp4") returned 0
	[0049.066] lstrlenA (lpString="*.mp4") returned 5
	[0049.066] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.wmv") returned 0
	[0049.066] lstrlenA (lpString="*.wmv") returned 5
	[0049.066] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.mkv") returned 0
	[0049.066] lstrlenA (lpString="*.mkv") returned 5
	[0049.066] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.mp3") returned 0
	[0049.066] lstrlenA (lpString="*.mp3") returned 5
	[0049.066] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.wav") returned 0
	[0049.066] lstrlenA (lpString="*.wav") returned 5
	[0049.066] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.flac") returned 0
	[0049.066] lstrlenA (lpString="*.flac") returned 6
	[0049.066] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.wma") returned 0
	[0049.066] lstrlenA (lpString="*.wma") returned 5
	[0049.066] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.au3") returned 0
	[0049.066] lstrlenA (lpString="*.au3") returned 5
	[0049.066] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.ahk") returned 0
	[0049.066] lstrlenA (lpString="*.ahk") returned 5
	[0049.066] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.c") returned 0
	[0049.066] lstrlenA (lpString="*.c") returned 3
	[0049.066] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.cc") returned 0
	[0049.066] lstrlenA (lpString="*.cc") returned 4
	[0049.066] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.cpp") returned 0
	[0049.067] lstrlenA (lpString="*.cpp") returned 5
	[0049.067] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.cxx") returned 0
	[0049.067] lstrlenA (lpString="*.cxx") returned 5
	[0049.067] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.c++") returned 0
	[0049.067] lstrlenA (lpString="*.c++") returned 5
	[0049.067] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.cs") returned 0
	[0049.067] lstrlenA (lpString="*.cs") returned 4
	[0049.067] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.vb") returned 0
	[0049.067] lstrlenA (lpString="*.vb") returned 4
	[0049.067] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.bas") returned 0
	[0049.067] lstrlenA (lpString="*.bas") returned 5
	[0049.067] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.csproj") returned 0
	[0049.067] lstrlenA (lpString="*.csproj") returned 8
	[0049.067] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.vbproj") returned 0
	[0049.067] lstrlenA (lpString="*.vbproj") returned 8
	[0049.067] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.vcxproj") returned 0
	[0049.067] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.067] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.manifest") returned 0
	[0049.067] lstrlenA (lpString="*.manifest") returned 10
	[0049.067] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.php") returned 0
	[0049.067] lstrlenA (lpString="*.php") returned 5
	[0049.067] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.vbe") returned 0
	[0049.067] lstrlenA (lpString="*.vbe") returned 5
	[0049.067] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.vba") returned 0
	[0049.067] lstrlenA (lpString="*.vba") returned 5
	[0049.067] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.vbs") returned 0
	[0049.067] lstrlenA (lpString="*.vbs") returned 5
	[0049.067] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.bat") returned 0
	[0049.067] lstrlenA (lpString="*.bat") returned 5
	[0049.067] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.cmd") returned 0
	[0049.067] lstrlenA (lpString="*.cmd") returned 5
	[0049.067] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.js") returned 0
	[0049.067] lstrlenA (lpString="*.js") returned 4
	[0049.067] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.jscript") returned 0
	[0049.067] lstrlenA (lpString="*.jscript") returned 9
	[0049.067] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.hta") returned 0
	[0049.067] lstrlenA (lpString="*.hta") returned 5
	[0049.067] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.php7") returned 0
	[0049.068] lstrlenA (lpString="*.php7") returned 6
	[0049.068] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.db") returned 0
	[0049.068] lstrlenA (lpString="*.db") returned 4
	[0049.069] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.swf") returned 0
	[0049.069] lstrlenA (lpString="*.swf") returned 5
	[0049.069] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.eml") returned 0
	[0049.069] lstrlenA (lpString="*.eml") returned 5
	[0049.069] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.part") returned 0
	[0049.069] lstrlenA (lpString="*.part") returned 6
	[0049.069] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.nfo") returned 0
	[0049.069] lstrlenA (lpString="*.nfo") returned 5
	[0049.069] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.rsa") returned 0
	[0049.069] lstrlenA (lpString="*.rsa") returned 5
	[0049.069] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.key") returned 0
	[0049.069] lstrlenA (lpString="*.key") returned 5
	[0049.069] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.aes") returned 0
	[0049.069] lstrlenA (lpString="*.aes") returned 5
	[0049.069] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.blob") returned 0
	[0049.069] lstrlenA (lpString="*.blob") returned 6
	[0049.069] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.btc") returned 0
	[0049.069] lstrlenA (lpString="*.btc") returned 5
	[0049.069] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.wallet") returned 0
	[0049.069] lstrlenA (lpString="*.wallet") returned 8
	[0049.069] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0049.069] FindClose (in: hFindFile=0x7cb810 | out: hFindFile=0x7cb810) returned 1
	[0049.069] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d1d40, dwReserved1=0x7b00c0, cFileName="1055", cAlternateFileName="")) returned 1
	[0049.069] lstrcmpA (lpString1=".", lpString2="1055") returned -1
	[0049.069] lstrcmpA (lpString1="..", lpString2="1055") returned -1
	[0049.069] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*"
	[0049.069] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1055" | out: lpString1="C:\\588bce7c90097ed212\\1055") returned="C:\\588bce7c90097ed212\\1055"
	[0049.069] lstrlenA (lpString="C:\\588bce7c90097ed212\\1055") returned 26
	[0049.069] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb690
	[0049.097] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0049.097] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0049.097] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0049.097] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0049.097] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0049.097] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.098] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="eula.rtf") returned -1
	[0049.098] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="eula.rtf") returned 1
	[0049.098] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1
	[0049.098] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1055\\*.*") returned="*.*"
	[0049.098] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1055\\" | out: lpString1="C:\\588bce7c90097ed212\\1055\\") returned="C:\\588bce7c90097ed212\\1055\\"
	[0049.098] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1055\\" | out: pszPath="C:\\588bce7c90097ed212\\1055\\") returned=""
	[0049.098] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1055\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1055\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1055\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.098] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1055\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1055\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0049.098] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1055\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1055\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0049.100] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0049.100] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0049.101] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0049.101] CloseHandle (hObject=0x208) returned 1
	[0049.101] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1055\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned="C:\\588bce7c90097ed212\\1055\\eula.rtf"
	[0049.101] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.zip") returned 0
	[0049.101] lstrlenA (lpString="*.zip") returned 5
	[0049.101] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.rar") returned 0
	[0049.101] lstrlenA (lpString="*.rar") returned 5
	[0049.101] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.7z") returned 0
	[0049.101] lstrlenA (lpString="*.7z") returned 4
	[0049.101] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.tar") returned 0
	[0049.101] lstrlenA (lpString="*.tar") returned 5
	[0049.101] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.gzip") returned 0
	[0049.101] lstrlenA (lpString="*.gzip") returned 6
	[0049.101] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.jpg") returned 0
	[0049.101] lstrlenA (lpString="*.jpg") returned 5
	[0049.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.jpeg") returned 0
	[0049.102] lstrlenA (lpString="*.jpeg") returned 6
	[0049.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.bmp") returned 0
	[0049.102] lstrlenA (lpString="*.bmp") returned 5
	[0049.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.gif") returned 0
	[0049.102] lstrlenA (lpString="*.gif") returned 5
	[0049.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.png") returned 0
	[0049.102] lstrlenA (lpString="*.png") returned 5
	[0049.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.doc") returned 0
	[0049.102] lstrlenA (lpString="*.doc") returned 5
	[0049.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.docx") returned 0
	[0049.102] lstrlenA (lpString="*.docx") returned 6
	[0049.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.xls") returned 0
	[0049.102] lstrlenA (lpString="*.xls") returned 5
	[0049.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.xlsx") returned 0
	[0049.102] lstrlenA (lpString="*.xlsx") returned 6
	[0049.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.ppt") returned 0
	[0049.102] lstrlenA (lpString="*.ppt") returned 5
	[0049.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.pptx") returned 0
	[0049.102] lstrlenA (lpString="*.pptx") returned 6
	[0049.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.txt") returned 0
	[0049.102] lstrlenA (lpString="*.txt") returned 5
	[0049.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.pdf") returned 0
	[0049.102] lstrlenA (lpString="*.pdf") returned 5
	[0049.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.htm") returned 0
	[0049.102] lstrlenA (lpString="*.htm") returned 5
	[0049.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.html") returned 0
	[0049.102] lstrlenA (lpString="*.html") returned 6
	[0049.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.mdb") returned 0
	[0049.102] lstrlenA (lpString="*.mdb") returned 5
	[0049.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.pfx") returned 0
	[0049.102] lstrlenA (lpString="*.pfx") returned 5
	[0049.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.md") returned 0
	[0049.102] lstrlenA (lpString="*.md") returned 4
	[0049.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.lnk") returned 0
	[0049.103] lstrlenA (lpString="*.lnk") returned 5
	[0049.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.torrent") returned 0
	[0049.103] lstrlenA (lpString="*.torrent") returned 9
	[0049.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.mov") returned 0
	[0049.103] lstrlenA (lpString="*.mov") returned 5
	[0049.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.3gp") returned 0
	[0049.103] lstrlenA (lpString="*.3gp") returned 5
	[0049.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.mpeg") returned 0
	[0049.103] lstrlenA (lpString="*.mpeg") returned 6
	[0049.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.mpg") returned 0
	[0049.103] lstrlenA (lpString="*.mpg") returned 5
	[0049.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.flv") returned 0
	[0049.103] lstrlenA (lpString="*.flv") returned 5
	[0049.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.avi") returned 0
	[0049.103] lstrlenA (lpString="*.avi") returned 5
	[0049.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.mp4") returned 0
	[0049.103] lstrlenA (lpString="*.mp4") returned 5
	[0049.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.wmv") returned 0
	[0049.103] lstrlenA (lpString="*.wmv") returned 5
	[0049.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.mkv") returned 0
	[0049.103] lstrlenA (lpString="*.mkv") returned 5
	[0049.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.mp3") returned 0
	[0049.103] lstrlenA (lpString="*.mp3") returned 5
	[0049.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.wav") returned 0
	[0049.103] lstrlenA (lpString="*.wav") returned 5
	[0049.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.flac") returned 0
	[0049.103] lstrlenA (lpString="*.flac") returned 6
	[0049.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.wma") returned 0
	[0049.103] lstrlenA (lpString="*.wma") returned 5
	[0049.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.au3") returned 0
	[0049.103] lstrlenA (lpString="*.au3") returned 5
	[0049.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.ahk") returned 0
	[0049.103] lstrlenA (lpString="*.ahk") returned 5
	[0049.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.c") returned 0
	[0049.104] lstrlenA (lpString="*.c") returned 3
	[0049.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.cc") returned 0
	[0049.104] lstrlenA (lpString="*.cc") returned 4
	[0049.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.cpp") returned 0
	[0049.104] lstrlenA (lpString="*.cpp") returned 5
	[0049.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.cxx") returned 0
	[0049.104] lstrlenA (lpString="*.cxx") returned 5
	[0049.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.c++") returned 0
	[0049.104] lstrlenA (lpString="*.c++") returned 5
	[0049.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.cs") returned 0
	[0049.104] lstrlenA (lpString="*.cs") returned 4
	[0049.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.vb") returned 0
	[0049.104] lstrlenA (lpString="*.vb") returned 4
	[0049.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.bas") returned 0
	[0049.104] lstrlenA (lpString="*.bas") returned 5
	[0049.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.csproj") returned 0
	[0049.104] lstrlenA (lpString="*.csproj") returned 8
	[0049.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.vbproj") returned 0
	[0049.104] lstrlenA (lpString="*.vbproj") returned 8
	[0049.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.vcxproj") returned 0
	[0049.104] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.manifest") returned 0
	[0049.104] lstrlenA (lpString="*.manifest") returned 10
	[0049.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.php") returned 0
	[0049.104] lstrlenA (lpString="*.php") returned 5
	[0049.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.vbe") returned 0
	[0049.104] lstrlenA (lpString="*.vbe") returned 5
	[0049.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.vba") returned 0
	[0049.104] lstrlenA (lpString="*.vba") returned 5
	[0049.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.vbs") returned 0
	[0049.104] lstrlenA (lpString="*.vbs") returned 5
	[0049.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.bat") returned 0
	[0049.104] lstrlenA (lpString="*.bat") returned 5
	[0049.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.cmd") returned 0
	[0049.104] lstrlenA (lpString="*.cmd") returned 5
	[0049.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.js") returned 0
	[0049.105] lstrlenA (lpString="*.js") returned 4
	[0049.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.jscript") returned 0
	[0049.105] lstrlenA (lpString="*.jscript") returned 9
	[0049.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.hta") returned 0
	[0049.105] lstrlenA (lpString="*.hta") returned 5
	[0049.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.php7") returned 0
	[0049.105] lstrlenA (lpString="*.php7") returned 6
	[0049.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.db") returned 0
	[0049.105] lstrlenA (lpString="*.db") returned 4
	[0049.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.swf") returned 0
	[0049.105] lstrlenA (lpString="*.swf") returned 5
	[0049.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.eml") returned 0
	[0049.105] lstrlenA (lpString="*.eml") returned 5
	[0049.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.part") returned 0
	[0049.105] lstrlenA (lpString="*.part") returned 6
	[0049.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.nfo") returned 0
	[0049.105] lstrlenA (lpString="*.nfo") returned 5
	[0049.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.rsa") returned 0
	[0049.105] lstrlenA (lpString="*.rsa") returned 5
	[0049.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.key") returned 0
	[0049.105] lstrlenA (lpString="*.key") returned 5
	[0049.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.aes") returned 0
	[0049.105] lstrlenA (lpString="*.aes") returned 5
	[0049.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.blob") returned 0
	[0049.105] lstrlenA (lpString="*.blob") returned 6
	[0049.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.btc") returned 0
	[0049.105] lstrlenA (lpString="*.btc") returned 5
	[0049.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.wallet") returned 0
	[0049.105] lstrlenA (lpString="*.wallet") returned 8
	[0049.105] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0049.105] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.105] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="LocalizedData.xml") returned -1
	[0049.105] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="LocalizedData.xml") returned -1
	[0049.105] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1
	[0049.105] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned="eula.rtf"
	[0049.105] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1055\\" | out: lpString1="C:\\588bce7c90097ed212\\1055\\") returned="C:\\588bce7c90097ed212\\1055\\"
	[0049.106] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1055\\" | out: pszPath="C:\\588bce7c90097ed212\\1055\\") returned=""
	[0049.106] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1055\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1055\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1055\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.106] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1055\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1055\\how-to-decrypt-files.htm")) returned 0x20
	[0049.106] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1055\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml"
	[0049.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.zip") returned 0
	[0049.106] lstrlenA (lpString="*.zip") returned 5
	[0049.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.rar") returned 0
	[0049.106] lstrlenA (lpString="*.rar") returned 5
	[0049.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.7z") returned 0
	[0049.106] lstrlenA (lpString="*.7z") returned 4
	[0049.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.tar") returned 0
	[0049.106] lstrlenA (lpString="*.tar") returned 5
	[0049.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.gzip") returned 0
	[0049.106] lstrlenA (lpString="*.gzip") returned 6
	[0049.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.jpg") returned 0
	[0049.106] lstrlenA (lpString="*.jpg") returned 5
	[0049.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.jpeg") returned 0
	[0049.106] lstrlenA (lpString="*.jpeg") returned 6
	[0049.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.bmp") returned 0
	[0049.106] lstrlenA (lpString="*.bmp") returned 5
	[0049.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.gif") returned 0
	[0049.106] lstrlenA (lpString="*.gif") returned 5
	[0049.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.png") returned 0
	[0049.106] lstrlenA (lpString="*.png") returned 5
	[0049.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.doc") returned 0
	[0049.106] lstrlenA (lpString="*.doc") returned 5
	[0049.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.docx") returned 0
	[0049.106] lstrlenA (lpString="*.docx") returned 6
	[0049.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.xls") returned 0
	[0049.106] lstrlenA (lpString="*.xls") returned 5
	[0049.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.xlsx") returned 0
	[0049.106] lstrlenA (lpString="*.xlsx") returned 6
	[0049.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.ppt") returned 0
	[0049.107] lstrlenA (lpString="*.ppt") returned 5
	[0049.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.pptx") returned 0
	[0049.107] lstrlenA (lpString="*.pptx") returned 6
	[0049.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.txt") returned 0
	[0049.107] lstrlenA (lpString="*.txt") returned 5
	[0049.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.pdf") returned 0
	[0049.107] lstrlenA (lpString="*.pdf") returned 5
	[0049.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.htm") returned 0
	[0049.107] lstrlenA (lpString="*.htm") returned 5
	[0049.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.html") returned 0
	[0049.107] lstrlenA (lpString="*.html") returned 6
	[0049.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.mdb") returned 0
	[0049.107] lstrlenA (lpString="*.mdb") returned 5
	[0049.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.pfx") returned 0
	[0049.107] lstrlenA (lpString="*.pfx") returned 5
	[0049.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.md") returned 0
	[0049.107] lstrlenA (lpString="*.md") returned 4
	[0049.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.lnk") returned 0
	[0049.107] lstrlenA (lpString="*.lnk") returned 5
	[0049.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.torrent") returned 0
	[0049.107] lstrlenA (lpString="*.torrent") returned 9
	[0049.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.mov") returned 0
	[0049.107] lstrlenA (lpString="*.mov") returned 5
	[0049.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.3gp") returned 0
	[0049.107] lstrlenA (lpString="*.3gp") returned 5
	[0049.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.mpeg") returned 0
	[0049.107] lstrlenA (lpString="*.mpeg") returned 6
	[0049.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.mpg") returned 0
	[0049.107] lstrlenA (lpString="*.mpg") returned 5
	[0049.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.flv") returned 0
	[0049.107] lstrlenA (lpString="*.flv") returned 5
	[0049.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.avi") returned 0
	[0049.107] lstrlenA (lpString="*.avi") returned 5
	[0049.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.mp4") returned 0
	[0049.107] lstrlenA (lpString="*.mp4") returned 5
	[0049.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.wmv") returned 0
	[0049.108] lstrlenA (lpString="*.wmv") returned 5
	[0049.108] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.mkv") returned 0
	[0049.108] lstrlenA (lpString="*.mkv") returned 5
	[0049.108] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.mp3") returned 0
	[0049.108] lstrlenA (lpString="*.mp3") returned 5
	[0049.108] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.wav") returned 0
	[0049.108] lstrlenA (lpString="*.wav") returned 5
	[0049.108] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.flac") returned 0
	[0049.108] lstrlenA (lpString="*.flac") returned 6
	[0049.108] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.wma") returned 0
	[0049.108] lstrlenA (lpString="*.wma") returned 5
	[0049.108] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.au3") returned 0
	[0049.108] lstrlenA (lpString="*.au3") returned 5
	[0049.108] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.ahk") returned 0
	[0049.108] lstrlenA (lpString="*.ahk") returned 5
	[0049.108] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.c") returned 0
	[0049.108] lstrlenA (lpString="*.c") returned 3
	[0049.108] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.cc") returned 0
	[0049.108] lstrlenA (lpString="*.cc") returned 4
	[0049.108] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.cpp") returned 0
	[0049.108] lstrlenA (lpString="*.cpp") returned 5
	[0049.108] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.cxx") returned 0
	[0049.108] lstrlenA (lpString="*.cxx") returned 5
	[0049.108] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.c++") returned 0
	[0049.108] lstrlenA (lpString="*.c++") returned 5
	[0049.108] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.cs") returned 0
	[0049.108] lstrlenA (lpString="*.cs") returned 4
	[0049.108] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.vb") returned 0
	[0049.108] lstrlenA (lpString="*.vb") returned 4
	[0049.108] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.bas") returned 0
	[0049.108] lstrlenA (lpString="*.bas") returned 5
	[0049.108] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.csproj") returned 0
	[0049.108] lstrlenA (lpString="*.csproj") returned 8
	[0049.108] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.vbproj") returned 0
	[0049.108] lstrlenA (lpString="*.vbproj") returned 8
	[0049.108] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.vcxproj") returned 0
	[0049.108] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.manifest") returned 0
	[0049.109] lstrlenA (lpString="*.manifest") returned 10
	[0049.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.php") returned 0
	[0049.109] lstrlenA (lpString="*.php") returned 5
	[0049.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.vbe") returned 0
	[0049.109] lstrlenA (lpString="*.vbe") returned 5
	[0049.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.vba") returned 0
	[0049.109] lstrlenA (lpString="*.vba") returned 5
	[0049.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.vbs") returned 0
	[0049.109] lstrlenA (lpString="*.vbs") returned 5
	[0049.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.bat") returned 0
	[0049.109] lstrlenA (lpString="*.bat") returned 5
	[0049.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.cmd") returned 0
	[0049.109] lstrlenA (lpString="*.cmd") returned 5
	[0049.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.js") returned 0
	[0049.109] lstrlenA (lpString="*.js") returned 4
	[0049.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.jscript") returned 0
	[0049.109] lstrlenA (lpString="*.jscript") returned 9
	[0049.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.hta") returned 0
	[0049.109] lstrlenA (lpString="*.hta") returned 5
	[0049.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.php7") returned 0
	[0049.109] lstrlenA (lpString="*.php7") returned 6
	[0049.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.db") returned 0
	[0049.109] lstrlenA (lpString="*.db") returned 4
	[0049.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.swf") returned 0
	[0049.109] lstrlenA (lpString="*.swf") returned 5
	[0049.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.eml") returned 0
	[0049.109] lstrlenA (lpString="*.eml") returned 5
	[0049.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.part") returned 0
	[0049.109] lstrlenA (lpString="*.part") returned 6
	[0049.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.nfo") returned 0
	[0049.109] lstrlenA (lpString="*.nfo") returned 5
	[0049.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.rsa") returned 0
	[0049.109] lstrlenA (lpString="*.rsa") returned 5
	[0049.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.key") returned 0
	[0049.109] lstrlenA (lpString="*.key") returned 5
	[0049.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.aes") returned 0
	[0049.110] lstrlenA (lpString="*.aes") returned 5
	[0049.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.blob") returned 0
	[0049.110] lstrlenA (lpString="*.blob") returned 6
	[0049.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.btc") returned 0
	[0049.110] lstrlenA (lpString="*.btc") returned 5
	[0049.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.wallet") returned 0
	[0049.110] lstrlenA (lpString="*.wallet") returned 8
	[0049.110] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0049.110] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.110] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SetupResources.dll") returned -1
	[0049.110] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SetupResources.dll") returned -1
	[0049.110] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1
	[0049.110] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned="LocalizedData.xml"
	[0049.110] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1055\\" | out: lpString1="C:\\588bce7c90097ed212\\1055\\") returned="C:\\588bce7c90097ed212\\1055\\"
	[0049.110] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1055\\" | out: pszPath="C:\\588bce7c90097ed212\\1055\\") returned=""
	[0049.110] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1055\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\1055\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\1055\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.110] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1055\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\1055\\how-to-decrypt-files.htm")) returned 0x20
	[0049.110] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1055\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1055\\SetupResources.dll"
	[0049.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.zip") returned 0
	[0049.110] lstrlenA (lpString="*.zip") returned 5
	[0049.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.rar") returned 0
	[0049.110] lstrlenA (lpString="*.rar") returned 5
	[0049.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.7z") returned 0
	[0049.110] lstrlenA (lpString="*.7z") returned 4
	[0049.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.tar") returned 0
	[0049.110] lstrlenA (lpString="*.tar") returned 5
	[0049.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.gzip") returned 0
	[0049.110] lstrlenA (lpString="*.gzip") returned 6
	[0049.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.jpg") returned 0
	[0049.110] lstrlenA (lpString="*.jpg") returned 5
	[0049.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.jpeg") returned 0
	[0049.110] lstrlenA (lpString="*.jpeg") returned 6
	[0049.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.bmp") returned 0
	[0049.110] lstrlenA (lpString="*.bmp") returned 5
	[0049.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.gif") returned 0
	[0049.111] lstrlenA (lpString="*.gif") returned 5
	[0049.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.png") returned 0
	[0049.111] lstrlenA (lpString="*.png") returned 5
	[0049.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.doc") returned 0
	[0049.111] lstrlenA (lpString="*.doc") returned 5
	[0049.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.docx") returned 0
	[0049.111] lstrlenA (lpString="*.docx") returned 6
	[0049.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.xls") returned 0
	[0049.111] lstrlenA (lpString="*.xls") returned 5
	[0049.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.xlsx") returned 0
	[0049.111] lstrlenA (lpString="*.xlsx") returned 6
	[0049.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.ppt") returned 0
	[0049.111] lstrlenA (lpString="*.ppt") returned 5
	[0049.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.pptx") returned 0
	[0049.111] lstrlenA (lpString="*.pptx") returned 6
	[0049.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.txt") returned 0
	[0049.111] lstrlenA (lpString="*.txt") returned 5
	[0049.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.pdf") returned 0
	[0049.111] lstrlenA (lpString="*.pdf") returned 5
	[0049.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.htm") returned 0
	[0049.111] lstrlenA (lpString="*.htm") returned 5
	[0049.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.html") returned 0
	[0049.111] lstrlenA (lpString="*.html") returned 6
	[0049.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.mdb") returned 0
	[0049.111] lstrlenA (lpString="*.mdb") returned 5
	[0049.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.pfx") returned 0
	[0049.111] lstrlenA (lpString="*.pfx") returned 5
	[0049.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.md") returned 0
	[0049.111] lstrlenA (lpString="*.md") returned 4
	[0049.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.lnk") returned 0
	[0049.111] lstrlenA (lpString="*.lnk") returned 5
	[0049.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.torrent") returned 0
	[0049.111] lstrlenA (lpString="*.torrent") returned 9
	[0049.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.mov") returned 0
	[0049.111] lstrlenA (lpString="*.mov") returned 5
	[0049.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.3gp") returned 0
	[0049.112] lstrlenA (lpString="*.3gp") returned 5
	[0049.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.mpeg") returned 0
	[0049.112] lstrlenA (lpString="*.mpeg") returned 6
	[0049.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.mpg") returned 0
	[0049.112] lstrlenA (lpString="*.mpg") returned 5
	[0049.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.flv") returned 0
	[0049.112] lstrlenA (lpString="*.flv") returned 5
	[0049.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.avi") returned 0
	[0049.112] lstrlenA (lpString="*.avi") returned 5
	[0049.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.mp4") returned 0
	[0049.112] lstrlenA (lpString="*.mp4") returned 5
	[0049.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.wmv") returned 0
	[0049.112] lstrlenA (lpString="*.wmv") returned 5
	[0049.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.mkv") returned 0
	[0049.112] lstrlenA (lpString="*.mkv") returned 5
	[0049.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.mp3") returned 0
	[0049.112] lstrlenA (lpString="*.mp3") returned 5
	[0049.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.wav") returned 0
	[0049.112] lstrlenA (lpString="*.wav") returned 5
	[0049.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.flac") returned 0
	[0049.112] lstrlenA (lpString="*.flac") returned 6
	[0049.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.wma") returned 0
	[0049.112] lstrlenA (lpString="*.wma") returned 5
	[0049.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.au3") returned 0
	[0049.112] lstrlenA (lpString="*.au3") returned 5
	[0049.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.ahk") returned 0
	[0049.112] lstrlenA (lpString="*.ahk") returned 5
	[0049.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.c") returned 0
	[0049.112] lstrlenA (lpString="*.c") returned 3
	[0049.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.cc") returned 0
	[0049.112] lstrlenA (lpString="*.cc") returned 4
	[0049.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.cpp") returned 0
	[0049.112] lstrlenA (lpString="*.cpp") returned 5
	[0049.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.cxx") returned 0
	[0049.112] lstrlenA (lpString="*.cxx") returned 5
	[0049.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.c++") returned 0
	[0049.113] lstrlenA (lpString="*.c++") returned 5
	[0049.113] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.cs") returned 0
	[0049.113] lstrlenA (lpString="*.cs") returned 4
	[0049.113] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.vb") returned 0
	[0049.113] lstrlenA (lpString="*.vb") returned 4
	[0049.113] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.bas") returned 0
	[0049.113] lstrlenA (lpString="*.bas") returned 5
	[0049.113] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.csproj") returned 0
	[0049.113] lstrlenA (lpString="*.csproj") returned 8
	[0049.113] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.vbproj") returned 0
	[0049.113] lstrlenA (lpString="*.vbproj") returned 8
	[0049.113] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.vcxproj") returned 0
	[0049.113] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.113] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.manifest") returned 0
	[0049.113] lstrlenA (lpString="*.manifest") returned 10
	[0049.113] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.php") returned 0
	[0049.113] lstrlenA (lpString="*.php") returned 5
	[0049.113] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.vbe") returned 0
	[0049.113] lstrlenA (lpString="*.vbe") returned 5
	[0049.113] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.vba") returned 0
	[0049.113] lstrlenA (lpString="*.vba") returned 5
	[0049.113] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.vbs") returned 0
	[0049.113] lstrlenA (lpString="*.vbs") returned 5
	[0049.113] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.bat") returned 0
	[0049.113] lstrlenA (lpString="*.bat") returned 5
	[0049.113] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.cmd") returned 0
	[0049.113] lstrlenA (lpString="*.cmd") returned 5
	[0049.113] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.js") returned 0
	[0049.113] lstrlenA (lpString="*.js") returned 4
	[0049.113] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.jscript") returned 0
	[0049.113] lstrlenA (lpString="*.jscript") returned 9
	[0049.113] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.hta") returned 0
	[0049.113] lstrlenA (lpString="*.hta") returned 5
	[0049.113] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.php7") returned 0
	[0049.113] lstrlenA (lpString="*.php7") returned 6
	[0049.113] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.db") returned 0
	[0049.114] lstrlenA (lpString="*.db") returned 4
	[0049.114] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.swf") returned 0
	[0049.114] lstrlenA (lpString="*.swf") returned 5
	[0049.114] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.eml") returned 0
	[0049.114] lstrlenA (lpString="*.eml") returned 5
	[0049.114] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.part") returned 0
	[0049.114] lstrlenA (lpString="*.part") returned 6
	[0049.114] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.nfo") returned 0
	[0049.114] lstrlenA (lpString="*.nfo") returned 5
	[0049.114] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.rsa") returned 0
	[0049.114] lstrlenA (lpString="*.rsa") returned 5
	[0049.114] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.key") returned 0
	[0049.114] lstrlenA (lpString="*.key") returned 5
	[0049.114] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.aes") returned 0
	[0049.114] lstrlenA (lpString="*.aes") returned 5
	[0049.114] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.blob") returned 0
	[0049.114] lstrlenA (lpString="*.blob") returned 6
	[0049.114] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.btc") returned 0
	[0049.114] lstrlenA (lpString="*.btc") returned 5
	[0049.114] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.wallet") returned 0
	[0049.114] lstrlenA (lpString="*.wallet") returned 8
	[0049.114] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0049.114] FindClose (in: hFindFile=0x7cb690 | out: hFindFile=0x7cb690) returned 1
	[0049.114] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d1d40, dwReserved1=0x7b00c0, cFileName="2052", cAlternateFileName="")) returned 1
	[0049.114] lstrcmpA (lpString1=".", lpString2="2052") returned -1
	[0049.114] lstrcmpA (lpString1="..", lpString2="2052") returned -1
	[0049.114] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*"
	[0049.114] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="2052" | out: lpString1="C:\\588bce7c90097ed212\\2052") returned="C:\\588bce7c90097ed212\\2052"
	[0049.114] lstrlenA (lpString="C:\\588bce7c90097ed212\\2052") returned 26
	[0049.114] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbb90
	[0049.115] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0049.115] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0049.115] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0049.115] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0049.115] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0049.115] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.115] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="eula.rtf") returned -1
	[0049.115] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="eula.rtf") returned 1
	[0049.115] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1
	[0049.115] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\2052\\*.*") returned="*.*"
	[0049.115] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\2052\\" | out: lpString1="C:\\588bce7c90097ed212\\2052\\") returned="C:\\588bce7c90097ed212\\2052\\"
	[0049.115] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\2052\\" | out: pszPath="C:\\588bce7c90097ed212\\2052\\") returned=""
	[0049.115] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\2052\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\2052\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\2052\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.115] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\2052\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\2052\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0049.115] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\2052\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\2052\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0049.117] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0049.117] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0049.118] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0049.118] CloseHandle (hObject=0x208) returned 1
	[0049.118] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\2052\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned="C:\\588bce7c90097ed212\\2052\\eula.rtf"
	[0049.118] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.zip") returned 0
	[0049.118] lstrlenA (lpString="*.zip") returned 5
	[0049.118] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.rar") returned 0
	[0049.118] lstrlenA (lpString="*.rar") returned 5
	[0049.118] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.7z") returned 0
	[0049.118] lstrlenA (lpString="*.7z") returned 4
	[0049.118] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.tar") returned 0
	[0049.118] lstrlenA (lpString="*.tar") returned 5
	[0049.118] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.gzip") returned 0
	[0049.118] lstrlenA (lpString="*.gzip") returned 6
	[0049.118] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.jpg") returned 0
	[0049.118] lstrlenA (lpString="*.jpg") returned 5
	[0049.118] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.jpeg") returned 0
	[0049.118] lstrlenA (lpString="*.jpeg") returned 6
	[0049.118] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.bmp") returned 0
	[0049.118] lstrlenA (lpString="*.bmp") returned 5
	[0049.118] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.gif") returned 0
	[0049.118] lstrlenA (lpString="*.gif") returned 5
	[0049.118] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.png") returned 0
	[0049.118] lstrlenA (lpString="*.png") returned 5
	[0049.118] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.doc") returned 0
	[0049.118] lstrlenA (lpString="*.doc") returned 5
	[0049.119] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.docx") returned 0
	[0049.119] lstrlenA (lpString="*.docx") returned 6
	[0049.119] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.xls") returned 0
	[0049.119] lstrlenA (lpString="*.xls") returned 5
	[0049.119] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.xlsx") returned 0
	[0049.119] lstrlenA (lpString="*.xlsx") returned 6
	[0049.119] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.ppt") returned 0
	[0049.119] lstrlenA (lpString="*.ppt") returned 5
	[0049.119] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.pptx") returned 0
	[0049.119] lstrlenA (lpString="*.pptx") returned 6
	[0049.119] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.txt") returned 0
	[0049.119] lstrlenA (lpString="*.txt") returned 5
	[0049.119] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.pdf") returned 0
	[0049.119] lstrlenA (lpString="*.pdf") returned 5
	[0049.119] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.htm") returned 0
	[0049.119] lstrlenA (lpString="*.htm") returned 5
	[0049.119] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.html") returned 0
	[0049.119] lstrlenA (lpString="*.html") returned 6
	[0049.119] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.mdb") returned 0
	[0049.119] lstrlenA (lpString="*.mdb") returned 5
	[0049.119] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.pfx") returned 0
	[0049.119] lstrlenA (lpString="*.pfx") returned 5
	[0049.119] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.md") returned 0
	[0049.119] lstrlenA (lpString="*.md") returned 4
	[0049.119] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.lnk") returned 0
	[0049.119] lstrlenA (lpString="*.lnk") returned 5
	[0049.119] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.torrent") returned 0
	[0049.119] lstrlenA (lpString="*.torrent") returned 9
	[0049.119] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.mov") returned 0
	[0049.119] lstrlenA (lpString="*.mov") returned 5
	[0049.119] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.3gp") returned 0
	[0049.119] lstrlenA (lpString="*.3gp") returned 5
	[0049.119] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.mpeg") returned 0
	[0049.119] lstrlenA (lpString="*.mpeg") returned 6
	[0049.119] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.mpg") returned 0
	[0049.119] lstrlenA (lpString="*.mpg") returned 5
	[0049.119] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.flv") returned 0
	[0049.120] lstrlenA (lpString="*.flv") returned 5
	[0049.120] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.avi") returned 0
	[0049.120] lstrlenA (lpString="*.avi") returned 5
	[0049.120] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.mp4") returned 0
	[0049.120] lstrlenA (lpString="*.mp4") returned 5
	[0049.120] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.wmv") returned 0
	[0049.120] lstrlenA (lpString="*.wmv") returned 5
	[0049.120] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.mkv") returned 0
	[0049.120] lstrlenA (lpString="*.mkv") returned 5
	[0049.120] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.mp3") returned 0
	[0049.120] lstrlenA (lpString="*.mp3") returned 5
	[0049.120] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.wav") returned 0
	[0049.120] lstrlenA (lpString="*.wav") returned 5
	[0049.120] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.flac") returned 0
	[0049.120] lstrlenA (lpString="*.flac") returned 6
	[0049.120] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.wma") returned 0
	[0049.120] lstrlenA (lpString="*.wma") returned 5
	[0049.120] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.au3") returned 0
	[0049.120] lstrlenA (lpString="*.au3") returned 5
	[0049.120] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.ahk") returned 0
	[0049.120] lstrlenA (lpString="*.ahk") returned 5
	[0049.120] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.c") returned 0
	[0049.120] lstrlenA (lpString="*.c") returned 3
	[0049.120] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.cc") returned 0
	[0049.120] lstrlenA (lpString="*.cc") returned 4
	[0049.120] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.cpp") returned 0
	[0049.120] lstrlenA (lpString="*.cpp") returned 5
	[0049.120] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.cxx") returned 0
	[0049.120] lstrlenA (lpString="*.cxx") returned 5
	[0049.120] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.c++") returned 0
	[0049.120] lstrlenA (lpString="*.c++") returned 5
	[0049.120] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.cs") returned 0
	[0049.120] lstrlenA (lpString="*.cs") returned 4
	[0049.120] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.vb") returned 0
	[0049.120] lstrlenA (lpString="*.vb") returned 4
	[0049.120] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.bas") returned 0
	[0049.121] lstrlenA (lpString="*.bas") returned 5
	[0049.121] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.csproj") returned 0
	[0049.121] lstrlenA (lpString="*.csproj") returned 8
	[0049.121] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.vbproj") returned 0
	[0049.121] lstrlenA (lpString="*.vbproj") returned 8
	[0049.121] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.vcxproj") returned 0
	[0049.121] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.121] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.manifest") returned 0
	[0049.121] lstrlenA (lpString="*.manifest") returned 10
	[0049.121] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.php") returned 0
	[0049.121] lstrlenA (lpString="*.php") returned 5
	[0049.121] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.vbe") returned 0
	[0049.121] lstrlenA (lpString="*.vbe") returned 5
	[0049.121] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.vba") returned 0
	[0049.121] lstrlenA (lpString="*.vba") returned 5
	[0049.121] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.vbs") returned 0
	[0049.121] lstrlenA (lpString="*.vbs") returned 5
	[0049.121] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.bat") returned 0
	[0049.121] lstrlenA (lpString="*.bat") returned 5
	[0049.121] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.cmd") returned 0
	[0049.121] lstrlenA (lpString="*.cmd") returned 5
	[0049.121] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.js") returned 0
	[0049.121] lstrlenA (lpString="*.js") returned 4
	[0049.121] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.jscript") returned 0
	[0049.121] lstrlenA (lpString="*.jscript") returned 9
	[0049.121] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.hta") returned 0
	[0049.121] lstrlenA (lpString="*.hta") returned 5
	[0049.121] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.php7") returned 0
	[0049.121] lstrlenA (lpString="*.php7") returned 6
	[0049.121] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.db") returned 0
	[0049.121] lstrlenA (lpString="*.db") returned 4
	[0049.121] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.swf") returned 0
	[0049.121] lstrlenA (lpString="*.swf") returned 5
	[0049.121] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.eml") returned 0
	[0049.121] lstrlenA (lpString="*.eml") returned 5
	[0049.121] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.part") returned 0
	[0049.122] lstrlenA (lpString="*.part") returned 6
	[0049.122] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.nfo") returned 0
	[0049.122] lstrlenA (lpString="*.nfo") returned 5
	[0049.122] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.rsa") returned 0
	[0049.122] lstrlenA (lpString="*.rsa") returned 5
	[0049.122] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.key") returned 0
	[0049.122] lstrlenA (lpString="*.key") returned 5
	[0049.122] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.aes") returned 0
	[0049.122] lstrlenA (lpString="*.aes") returned 5
	[0049.122] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.blob") returned 0
	[0049.122] lstrlenA (lpString="*.blob") returned 6
	[0049.122] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.btc") returned 0
	[0049.122] lstrlenA (lpString="*.btc") returned 5
	[0049.122] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.wallet") returned 0
	[0049.122] lstrlenA (lpString="*.wallet") returned 8
	[0049.122] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0049.122] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.122] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="LocalizedData.xml") returned -1
	[0049.122] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="LocalizedData.xml") returned -1
	[0049.122] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1
	[0049.122] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned="eula.rtf"
	[0049.122] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\2052\\" | out: lpString1="C:\\588bce7c90097ed212\\2052\\") returned="C:\\588bce7c90097ed212\\2052\\"
	[0049.122] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\2052\\" | out: pszPath="C:\\588bce7c90097ed212\\2052\\") returned=""
	[0049.122] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\2052\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\2052\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\2052\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.122] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\2052\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\2052\\how-to-decrypt-files.htm")) returned 0x20
	[0049.122] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\2052\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml"
	[0049.122] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.zip") returned 0
	[0049.122] lstrlenA (lpString="*.zip") returned 5
	[0049.122] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.rar") returned 0
	[0049.122] lstrlenA (lpString="*.rar") returned 5
	[0049.122] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.7z") returned 0
	[0049.122] lstrlenA (lpString="*.7z") returned 4
	[0049.123] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.tar") returned 0
	[0049.123] lstrlenA (lpString="*.tar") returned 5
	[0049.123] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.gzip") returned 0
	[0049.123] lstrlenA (lpString="*.gzip") returned 6
	[0049.123] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.jpg") returned 0
	[0049.123] lstrlenA (lpString="*.jpg") returned 5
	[0049.123] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.jpeg") returned 0
	[0049.123] lstrlenA (lpString="*.jpeg") returned 6
	[0049.123] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.bmp") returned 0
	[0049.123] lstrlenA (lpString="*.bmp") returned 5
	[0049.123] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.gif") returned 0
	[0049.123] lstrlenA (lpString="*.gif") returned 5
	[0049.123] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.png") returned 0
	[0049.123] lstrlenA (lpString="*.png") returned 5
	[0049.123] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.doc") returned 0
	[0049.123] lstrlenA (lpString="*.doc") returned 5
	[0049.123] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.docx") returned 0
	[0049.123] lstrlenA (lpString="*.docx") returned 6
	[0049.123] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.xls") returned 0
	[0049.123] lstrlenA (lpString="*.xls") returned 5
	[0049.123] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.xlsx") returned 0
	[0049.123] lstrlenA (lpString="*.xlsx") returned 6
	[0049.123] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.ppt") returned 0
	[0049.123] lstrlenA (lpString="*.ppt") returned 5
	[0049.123] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.pptx") returned 0
	[0049.123] lstrlenA (lpString="*.pptx") returned 6
	[0049.123] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.txt") returned 0
	[0049.123] lstrlenA (lpString="*.txt") returned 5
	[0049.123] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.pdf") returned 0
	[0049.123] lstrlenA (lpString="*.pdf") returned 5
	[0049.123] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.htm") returned 0
	[0049.123] lstrlenA (lpString="*.htm") returned 5
	[0049.123] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.html") returned 0
	[0049.123] lstrlenA (lpString="*.html") returned 6
	[0049.123] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.mdb") returned 0
	[0049.123] lstrlenA (lpString="*.mdb") returned 5
	[0049.124] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.pfx") returned 0
	[0049.124] lstrlenA (lpString="*.pfx") returned 5
	[0049.124] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.md") returned 0
	[0049.124] lstrlenA (lpString="*.md") returned 4
	[0049.124] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.lnk") returned 0
	[0049.124] lstrlenA (lpString="*.lnk") returned 5
	[0049.124] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.torrent") returned 0
	[0049.124] lstrlenA (lpString="*.torrent") returned 9
	[0049.124] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.mov") returned 0
	[0049.124] lstrlenA (lpString="*.mov") returned 5
	[0049.124] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.3gp") returned 0
	[0049.124] lstrlenA (lpString="*.3gp") returned 5
	[0049.124] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.mpeg") returned 0
	[0049.124] lstrlenA (lpString="*.mpeg") returned 6
	[0049.124] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.mpg") returned 0
	[0049.124] lstrlenA (lpString="*.mpg") returned 5
	[0049.124] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.flv") returned 0
	[0049.124] lstrlenA (lpString="*.flv") returned 5
	[0049.124] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.avi") returned 0
	[0049.124] lstrlenA (lpString="*.avi") returned 5
	[0049.124] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.mp4") returned 0
	[0049.124] lstrlenA (lpString="*.mp4") returned 5
	[0049.124] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.wmv") returned 0
	[0049.124] lstrlenA (lpString="*.wmv") returned 5
	[0049.124] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.mkv") returned 0
	[0049.124] lstrlenA (lpString="*.mkv") returned 5
	[0049.124] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.mp3") returned 0
	[0049.124] lstrlenA (lpString="*.mp3") returned 5
	[0049.124] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.wav") returned 0
	[0049.124] lstrlenA (lpString="*.wav") returned 5
	[0049.124] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.flac") returned 0
	[0049.124] lstrlenA (lpString="*.flac") returned 6
	[0049.124] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.wma") returned 0
	[0049.124] lstrlenA (lpString="*.wma") returned 5
	[0049.124] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.au3") returned 0
	[0049.124] lstrlenA (lpString="*.au3") returned 5
	[0049.125] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.ahk") returned 0
	[0049.125] lstrlenA (lpString="*.ahk") returned 5
	[0049.125] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.c") returned 0
	[0049.125] lstrlenA (lpString="*.c") returned 3
	[0049.125] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.cc") returned 0
	[0049.125] lstrlenA (lpString="*.cc") returned 4
	[0049.125] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.cpp") returned 0
	[0049.125] lstrlenA (lpString="*.cpp") returned 5
	[0049.125] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.cxx") returned 0
	[0049.125] lstrlenA (lpString="*.cxx") returned 5
	[0049.125] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.c++") returned 0
	[0049.125] lstrlenA (lpString="*.c++") returned 5
	[0049.125] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.cs") returned 0
	[0049.125] lstrlenA (lpString="*.cs") returned 4
	[0049.125] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.vb") returned 0
	[0049.125] lstrlenA (lpString="*.vb") returned 4
	[0049.125] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.bas") returned 0
	[0049.125] lstrlenA (lpString="*.bas") returned 5
	[0049.125] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.csproj") returned 0
	[0049.125] lstrlenA (lpString="*.csproj") returned 8
	[0049.125] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.vbproj") returned 0
	[0049.125] lstrlenA (lpString="*.vbproj") returned 8
	[0049.125] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.vcxproj") returned 0
	[0049.125] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.125] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.manifest") returned 0
	[0049.125] lstrlenA (lpString="*.manifest") returned 10
	[0049.125] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.php") returned 0
	[0049.125] lstrlenA (lpString="*.php") returned 5
	[0049.125] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.vbe") returned 0
	[0049.125] lstrlenA (lpString="*.vbe") returned 5
	[0049.125] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.vba") returned 0
	[0049.125] lstrlenA (lpString="*.vba") returned 5
	[0049.125] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.vbs") returned 0
	[0049.125] lstrlenA (lpString="*.vbs") returned 5
	[0049.125] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.bat") returned 0
	[0049.125] lstrlenA (lpString="*.bat") returned 5
	[0049.126] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.cmd") returned 0
	[0049.126] lstrlenA (lpString="*.cmd") returned 5
	[0049.126] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.js") returned 0
	[0049.126] lstrlenA (lpString="*.js") returned 4
	[0049.126] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.jscript") returned 0
	[0049.126] lstrlenA (lpString="*.jscript") returned 9
	[0049.126] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.hta") returned 0
	[0049.126] lstrlenA (lpString="*.hta") returned 5
	[0049.126] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.php7") returned 0
	[0049.126] lstrlenA (lpString="*.php7") returned 6
	[0049.126] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.db") returned 0
	[0049.126] lstrlenA (lpString="*.db") returned 4
	[0049.126] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.swf") returned 0
	[0049.126] lstrlenA (lpString="*.swf") returned 5
	[0049.126] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.eml") returned 0
	[0049.126] lstrlenA (lpString="*.eml") returned 5
	[0049.126] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.part") returned 0
	[0049.126] lstrlenA (lpString="*.part") returned 6
	[0049.126] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.nfo") returned 0
	[0049.126] lstrlenA (lpString="*.nfo") returned 5
	[0049.126] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.rsa") returned 0
	[0049.126] lstrlenA (lpString="*.rsa") returned 5
	[0049.126] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.key") returned 0
	[0049.126] lstrlenA (lpString="*.key") returned 5
	[0049.126] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.aes") returned 0
	[0049.126] lstrlenA (lpString="*.aes") returned 5
	[0049.126] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.blob") returned 0
	[0049.126] lstrlenA (lpString="*.blob") returned 6
	[0049.126] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.btc") returned 0
	[0049.126] lstrlenA (lpString="*.btc") returned 5
	[0049.126] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.wallet") returned 0
	[0049.126] lstrlenA (lpString="*.wallet") returned 8
	[0049.126] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0049.126] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.126] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SetupResources.dll") returned -1
	[0049.127] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SetupResources.dll") returned -1
	[0049.127] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1
	[0049.127] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned="LocalizedData.xml"
	[0049.127] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\2052\\" | out: lpString1="C:\\588bce7c90097ed212\\2052\\") returned="C:\\588bce7c90097ed212\\2052\\"
	[0049.127] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\2052\\" | out: pszPath="C:\\588bce7c90097ed212\\2052\\") returned=""
	[0049.127] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\2052\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\2052\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\2052\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.127] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\2052\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\2052\\how-to-decrypt-files.htm")) returned 0x20
	[0049.127] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\2052\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\2052\\SetupResources.dll"
	[0049.127] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.zip") returned 0
	[0049.127] lstrlenA (lpString="*.zip") returned 5
	[0049.127] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.rar") returned 0
	[0049.127] lstrlenA (lpString="*.rar") returned 5
	[0049.127] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.7z") returned 0
	[0049.127] lstrlenA (lpString="*.7z") returned 4
	[0049.127] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.tar") returned 0
	[0049.127] lstrlenA (lpString="*.tar") returned 5
	[0049.127] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.gzip") returned 0
	[0049.127] lstrlenA (lpString="*.gzip") returned 6
	[0049.127] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.jpg") returned 0
	[0049.127] lstrlenA (lpString="*.jpg") returned 5
	[0049.127] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.jpeg") returned 0
	[0049.127] lstrlenA (lpString="*.jpeg") returned 6
	[0049.127] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.bmp") returned 0
	[0049.127] lstrlenA (lpString="*.bmp") returned 5
	[0049.127] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.gif") returned 0
	[0049.127] lstrlenA (lpString="*.gif") returned 5
	[0049.127] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.png") returned 0
	[0049.127] lstrlenA (lpString="*.png") returned 5
	[0049.127] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.doc") returned 0
	[0049.127] lstrlenA (lpString="*.doc") returned 5
	[0049.127] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.docx") returned 0
	[0049.127] lstrlenA (lpString="*.docx") returned 6
	[0049.127] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.xls") returned 0
	[0049.127] lstrlenA (lpString="*.xls") returned 5
	[0049.128] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.xlsx") returned 0
	[0049.128] lstrlenA (lpString="*.xlsx") returned 6
	[0049.128] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.ppt") returned 0
	[0049.128] lstrlenA (lpString="*.ppt") returned 5
	[0049.128] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.pptx") returned 0
	[0049.128] lstrlenA (lpString="*.pptx") returned 6
	[0049.128] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.txt") returned 0
	[0049.128] lstrlenA (lpString="*.txt") returned 5
	[0049.128] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.pdf") returned 0
	[0049.128] lstrlenA (lpString="*.pdf") returned 5
	[0049.128] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.htm") returned 0
	[0049.128] lstrlenA (lpString="*.htm") returned 5
	[0049.128] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.html") returned 0
	[0049.128] lstrlenA (lpString="*.html") returned 6
	[0049.128] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.mdb") returned 0
	[0049.128] lstrlenA (lpString="*.mdb") returned 5
	[0049.128] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.pfx") returned 0
	[0049.128] lstrlenA (lpString="*.pfx") returned 5
	[0049.128] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.md") returned 0
	[0049.128] lstrlenA (lpString="*.md") returned 4
	[0049.128] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.lnk") returned 0
	[0049.128] lstrlenA (lpString="*.lnk") returned 5
	[0049.128] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.torrent") returned 0
	[0049.128] lstrlenA (lpString="*.torrent") returned 9
	[0049.128] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.mov") returned 0
	[0049.128] lstrlenA (lpString="*.mov") returned 5
	[0049.128] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.3gp") returned 0
	[0049.128] lstrlenA (lpString="*.3gp") returned 5
	[0049.128] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.mpeg") returned 0
	[0049.128] lstrlenA (lpString="*.mpeg") returned 6
	[0049.128] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.mpg") returned 0
	[0049.128] lstrlenA (lpString="*.mpg") returned 5
	[0049.128] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.flv") returned 0
	[0049.128] lstrlenA (lpString="*.flv") returned 5
	[0049.128] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.avi") returned 0
	[0049.128] lstrlenA (lpString="*.avi") returned 5
	[0049.129] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.mp4") returned 0
	[0049.129] lstrlenA (lpString="*.mp4") returned 5
	[0049.129] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.wmv") returned 0
	[0049.129] lstrlenA (lpString="*.wmv") returned 5
	[0049.129] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.mkv") returned 0
	[0049.129] lstrlenA (lpString="*.mkv") returned 5
	[0049.129] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.mp3") returned 0
	[0049.129] lstrlenA (lpString="*.mp3") returned 5
	[0049.129] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.wav") returned 0
	[0049.129] lstrlenA (lpString="*.wav") returned 5
	[0049.129] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.flac") returned 0
	[0049.129] lstrlenA (lpString="*.flac") returned 6
	[0049.129] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.wma") returned 0
	[0049.129] lstrlenA (lpString="*.wma") returned 5
	[0049.129] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.au3") returned 0
	[0049.129] lstrlenA (lpString="*.au3") returned 5
	[0049.129] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.ahk") returned 0
	[0049.129] lstrlenA (lpString="*.ahk") returned 5
	[0049.129] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.c") returned 0
	[0049.129] lstrlenA (lpString="*.c") returned 3
	[0049.129] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.cc") returned 0
	[0049.129] lstrlenA (lpString="*.cc") returned 4
	[0049.129] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.cpp") returned 0
	[0049.129] lstrlenA (lpString="*.cpp") returned 5
	[0049.129] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.cxx") returned 0
	[0049.129] lstrlenA (lpString="*.cxx") returned 5
	[0049.129] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.c++") returned 0
	[0049.129] lstrlenA (lpString="*.c++") returned 5
	[0049.129] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.cs") returned 0
	[0049.129] lstrlenA (lpString="*.cs") returned 4
	[0049.129] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.vb") returned 0
	[0049.129] lstrlenA (lpString="*.vb") returned 4
	[0049.129] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.bas") returned 0
	[0049.129] lstrlenA (lpString="*.bas") returned 5
	[0049.129] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.csproj") returned 0
	[0049.129] lstrlenA (lpString="*.csproj") returned 8
	[0049.129] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.vbproj") returned 0
	[0049.129] lstrlenA (lpString="*.vbproj") returned 8
	[0049.130] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.vcxproj") returned 0
	[0049.130] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.130] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.manifest") returned 0
	[0049.130] lstrlenA (lpString="*.manifest") returned 10
	[0049.130] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.php") returned 0
	[0049.130] lstrlenA (lpString="*.php") returned 5
	[0049.130] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.vbe") returned 0
	[0049.130] lstrlenA (lpString="*.vbe") returned 5
	[0049.130] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.vba") returned 0
	[0049.130] lstrlenA (lpString="*.vba") returned 5
	[0049.130] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.vbs") returned 0
	[0049.130] lstrlenA (lpString="*.vbs") returned 5
	[0049.130] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.bat") returned 0
	[0049.130] lstrlenA (lpString="*.bat") returned 5
	[0049.130] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.cmd") returned 0
	[0049.130] lstrlenA (lpString="*.cmd") returned 5
	[0049.130] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.js") returned 0
	[0049.130] lstrlenA (lpString="*.js") returned 4
	[0049.130] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.jscript") returned 0
	[0049.130] lstrlenA (lpString="*.jscript") returned 9
	[0049.130] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.hta") returned 0
	[0049.130] lstrlenA (lpString="*.hta") returned 5
	[0049.130] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.php7") returned 0
	[0049.176] lstrlenA (lpString="*.php7") returned 6
	[0049.176] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.db") returned 0
	[0049.176] lstrlenA (lpString="*.db") returned 4
	[0049.176] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.swf") returned 0
	[0049.176] lstrlenA (lpString="*.swf") returned 5
	[0049.177] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.eml") returned 0
	[0049.177] lstrlenA (lpString="*.eml") returned 5
	[0049.177] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.part") returned 0
	[0049.177] lstrlenA (lpString="*.part") returned 6
	[0049.177] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.nfo") returned 0
	[0049.177] lstrlenA (lpString="*.nfo") returned 5
	[0049.177] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.rsa") returned 0
	[0049.177] lstrlenA (lpString="*.rsa") returned 5
	[0049.177] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.key") returned 0
	[0049.177] lstrlenA (lpString="*.key") returned 5
	[0049.177] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.aes") returned 0
	[0049.177] lstrlenA (lpString="*.aes") returned 5
	[0049.177] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.blob") returned 0
	[0049.177] lstrlenA (lpString="*.blob") returned 6
	[0049.177] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.btc") returned 0
	[0049.177] lstrlenA (lpString="*.btc") returned 5
	[0049.177] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.wallet") returned 0
	[0049.177] lstrlenA (lpString="*.wallet") returned 8
	[0049.177] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0049.178] FindClose (in: hFindFile=0x7cbb90 | out: hFindFile=0x7cbb90) returned 1
	[0049.178] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d1d40, dwReserved1=0x7b00c0, cFileName="2070", cAlternateFileName="")) returned 1
	[0049.178] lstrcmpA (lpString1=".", lpString2="2070") returned -1
	[0049.178] lstrcmpA (lpString1="..", lpString2="2070") returned -1
	[0049.178] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*"
	[0049.178] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="2070" | out: lpString1="C:\\588bce7c90097ed212\\2070") returned="C:\\588bce7c90097ed212\\2070"
	[0049.178] lstrlenA (lpString="C:\\588bce7c90097ed212\\2070") returned 26
	[0049.178] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb990
	[0049.178] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0049.178] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0049.178] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0049.178] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0049.178] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0049.178] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.178] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="eula.rtf") returned -1
	[0049.178] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="eula.rtf") returned 1
	[0049.178] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1
	[0049.178] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\2070\\*.*") returned="*.*"
	[0049.178] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\2070\\" | out: lpString1="C:\\588bce7c90097ed212\\2070\\") returned="C:\\588bce7c90097ed212\\2070\\"
	[0049.178] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\2070\\" | out: pszPath="C:\\588bce7c90097ed212\\2070\\") returned=""
	[0049.179] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\2070\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\2070\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\2070\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.179] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\2070\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\2070\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0049.179] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\2070\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\2070\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0049.181] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0049.181] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0049.182] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0049.182] CloseHandle (hObject=0x208) returned 1
	[0049.182] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\2070\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned="C:\\588bce7c90097ed212\\2070\\eula.rtf"
	[0049.182] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.zip") returned 0
	[0049.182] lstrlenA (lpString="*.zip") returned 5
	[0049.182] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.rar") returned 0
	[0049.182] lstrlenA (lpString="*.rar") returned 5
	[0049.182] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.7z") returned 0
	[0049.182] lstrlenA (lpString="*.7z") returned 4
	[0049.182] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.tar") returned 0
	[0049.182] lstrlenA (lpString="*.tar") returned 5
	[0049.182] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.gzip") returned 0
	[0049.182] lstrlenA (lpString="*.gzip") returned 6
	[0049.182] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.jpg") returned 0
	[0049.182] lstrlenA (lpString="*.jpg") returned 5
	[0049.182] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.jpeg") returned 0
	[0049.182] lstrlenA (lpString="*.jpeg") returned 6
	[0049.182] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.bmp") returned 0
	[0049.182] lstrlenA (lpString="*.bmp") returned 5
	[0049.182] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.gif") returned 0
	[0049.182] lstrlenA (lpString="*.gif") returned 5
	[0049.182] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.png") returned 0
	[0049.182] lstrlenA (lpString="*.png") returned 5
	[0049.182] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.doc") returned 0
	[0049.183] lstrlenA (lpString="*.doc") returned 5
	[0049.183] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.docx") returned 0
	[0049.183] lstrlenA (lpString="*.docx") returned 6
	[0049.183] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.xls") returned 0
	[0049.183] lstrlenA (lpString="*.xls") returned 5
	[0049.183] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.xlsx") returned 0
	[0049.183] lstrlenA (lpString="*.xlsx") returned 6
	[0049.183] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.ppt") returned 0
	[0049.183] lstrlenA (lpString="*.ppt") returned 5
	[0049.183] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.pptx") returned 0
	[0049.183] lstrlenA (lpString="*.pptx") returned 6
	[0049.183] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.txt") returned 0
	[0049.183] lstrlenA (lpString="*.txt") returned 5
	[0049.183] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.pdf") returned 0
	[0049.183] lstrlenA (lpString="*.pdf") returned 5
	[0049.183] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.htm") returned 0
	[0049.183] lstrlenA (lpString="*.htm") returned 5
	[0049.183] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.html") returned 0
	[0049.183] lstrlenA (lpString="*.html") returned 6
	[0049.183] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.mdb") returned 0
	[0049.183] lstrlenA (lpString="*.mdb") returned 5
	[0049.183] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.pfx") returned 0
	[0049.183] lstrlenA (lpString="*.pfx") returned 5
	[0049.183] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.md") returned 0
	[0049.183] lstrlenA (lpString="*.md") returned 4
	[0049.183] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.lnk") returned 0
	[0049.183] lstrlenA (lpString="*.lnk") returned 5
	[0049.183] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.torrent") returned 0
	[0049.183] lstrlenA (lpString="*.torrent") returned 9
	[0049.183] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.mov") returned 0
	[0049.183] lstrlenA (lpString="*.mov") returned 5
	[0049.183] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.3gp") returned 0
	[0049.183] lstrlenA (lpString="*.3gp") returned 5
	[0049.183] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.mpeg") returned 0
	[0049.183] lstrlenA (lpString="*.mpeg") returned 6
	[0049.183] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.mpg") returned 0
	[0049.183] lstrlenA (lpString="*.mpg") returned 5
	[0049.183] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.flv") returned 0
	[0049.184] lstrlenA (lpString="*.flv") returned 5
	[0049.184] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.avi") returned 0
	[0049.184] lstrlenA (lpString="*.avi") returned 5
	[0049.184] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.mp4") returned 0
	[0049.184] lstrlenA (lpString="*.mp4") returned 5
	[0049.184] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.wmv") returned 0
	[0049.184] lstrlenA (lpString="*.wmv") returned 5
	[0049.184] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.mkv") returned 0
	[0049.184] lstrlenA (lpString="*.mkv") returned 5
	[0049.184] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.mp3") returned 0
	[0049.184] lstrlenA (lpString="*.mp3") returned 5
	[0049.184] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.wav") returned 0
	[0049.184] lstrlenA (lpString="*.wav") returned 5
	[0049.184] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.flac") returned 0
	[0049.184] lstrlenA (lpString="*.flac") returned 6
	[0049.184] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.wma") returned 0
	[0049.184] lstrlenA (lpString="*.wma") returned 5
	[0049.184] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.au3") returned 0
	[0049.184] lstrlenA (lpString="*.au3") returned 5
	[0049.184] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.ahk") returned 0
	[0049.184] lstrlenA (lpString="*.ahk") returned 5
	[0049.184] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.c") returned 0
	[0049.184] lstrlenA (lpString="*.c") returned 3
	[0049.184] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.cc") returned 0
	[0049.184] lstrlenA (lpString="*.cc") returned 4
	[0049.184] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.cpp") returned 0
	[0049.184] lstrlenA (lpString="*.cpp") returned 5
	[0049.184] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.cxx") returned 0
	[0049.184] lstrlenA (lpString="*.cxx") returned 5
	[0049.184] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.c++") returned 0
	[0049.184] lstrlenA (lpString="*.c++") returned 5
	[0049.184] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.cs") returned 0
	[0049.184] lstrlenA (lpString="*.cs") returned 4
	[0049.184] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.vb") returned 0
	[0049.184] lstrlenA (lpString="*.vb") returned 4
	[0049.184] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.bas") returned 0
	[0049.185] lstrlenA (lpString="*.bas") returned 5
	[0049.185] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.csproj") returned 0
	[0049.185] lstrlenA (lpString="*.csproj") returned 8
	[0049.185] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.vbproj") returned 0
	[0049.185] lstrlenA (lpString="*.vbproj") returned 8
	[0049.185] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.vcxproj") returned 0
	[0049.185] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.185] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.manifest") returned 0
	[0049.185] lstrlenA (lpString="*.manifest") returned 10
	[0049.185] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.php") returned 0
	[0049.185] lstrlenA (lpString="*.php") returned 5
	[0049.185] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.vbe") returned 0
	[0049.185] lstrlenA (lpString="*.vbe") returned 5
	[0049.185] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.vba") returned 0
	[0049.185] lstrlenA (lpString="*.vba") returned 5
	[0049.185] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.vbs") returned 0
	[0049.185] lstrlenA (lpString="*.vbs") returned 5
	[0049.185] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.bat") returned 0
	[0049.185] lstrlenA (lpString="*.bat") returned 5
	[0049.185] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.cmd") returned 0
	[0049.185] lstrlenA (lpString="*.cmd") returned 5
	[0049.185] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.js") returned 0
	[0049.185] lstrlenA (lpString="*.js") returned 4
	[0049.185] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.jscript") returned 0
	[0049.185] lstrlenA (lpString="*.jscript") returned 9
	[0049.185] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.hta") returned 0
	[0049.185] lstrlenA (lpString="*.hta") returned 5
	[0049.185] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.php7") returned 0
	[0049.185] lstrlenA (lpString="*.php7") returned 6
	[0049.185] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.db") returned 0
	[0049.185] lstrlenA (lpString="*.db") returned 4
	[0049.185] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.swf") returned 0
	[0049.185] lstrlenA (lpString="*.swf") returned 5
	[0049.185] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.eml") returned 0
	[0049.185] lstrlenA (lpString="*.eml") returned 5
	[0049.185] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.part") returned 0
	[0049.185] lstrlenA (lpString="*.part") returned 6
	[0049.186] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.nfo") returned 0
	[0049.186] lstrlenA (lpString="*.nfo") returned 5
	[0049.186] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.rsa") returned 0
	[0049.186] lstrlenA (lpString="*.rsa") returned 5
	[0049.186] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.key") returned 0
	[0049.186] lstrlenA (lpString="*.key") returned 5
	[0049.186] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.aes") returned 0
	[0049.186] lstrlenA (lpString="*.aes") returned 5
	[0049.186] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.blob") returned 0
	[0049.186] lstrlenA (lpString="*.blob") returned 6
	[0049.186] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.btc") returned 0
	[0049.186] lstrlenA (lpString="*.btc") returned 5
	[0049.186] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.wallet") returned 0
	[0049.186] lstrlenA (lpString="*.wallet") returned 8
	[0049.186] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0049.186] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.186] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="LocalizedData.xml") returned -1
	[0049.186] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="LocalizedData.xml") returned -1
	[0049.186] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1
	[0049.186] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned="eula.rtf"
	[0049.186] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\2070\\" | out: lpString1="C:\\588bce7c90097ed212\\2070\\") returned="C:\\588bce7c90097ed212\\2070\\"
	[0049.186] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\2070\\" | out: pszPath="C:\\588bce7c90097ed212\\2070\\") returned=""
	[0049.186] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\2070\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\2070\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\2070\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.186] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\2070\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\2070\\how-to-decrypt-files.htm")) returned 0x20
	[0049.186] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\2070\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml"
	[0049.186] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.zip") returned 0
	[0049.186] lstrlenA (lpString="*.zip") returned 5
	[0049.186] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.rar") returned 0
	[0049.186] lstrlenA (lpString="*.rar") returned 5
	[0049.186] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.7z") returned 0
	[0049.186] lstrlenA (lpString="*.7z") returned 4
	[0049.186] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.tar") returned 0
	[0049.186] lstrlenA (lpString="*.tar") returned 5
	[0049.186] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.gzip") returned 0
	[0049.187] lstrlenA (lpString="*.gzip") returned 6
	[0049.187] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.jpg") returned 0
	[0049.187] lstrlenA (lpString="*.jpg") returned 5
	[0049.187] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.jpeg") returned 0
	[0049.187] lstrlenA (lpString="*.jpeg") returned 6
	[0049.187] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.bmp") returned 0
	[0049.187] lstrlenA (lpString="*.bmp") returned 5
	[0049.187] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.gif") returned 0
	[0049.187] lstrlenA (lpString="*.gif") returned 5
	[0049.187] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.png") returned 0
	[0049.187] lstrlenA (lpString="*.png") returned 5
	[0049.187] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.doc") returned 0
	[0049.187] lstrlenA (lpString="*.doc") returned 5
	[0049.187] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.docx") returned 0
	[0049.187] lstrlenA (lpString="*.docx") returned 6
	[0049.187] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.xls") returned 0
	[0049.187] lstrlenA (lpString="*.xls") returned 5
	[0049.187] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.xlsx") returned 0
	[0049.187] lstrlenA (lpString="*.xlsx") returned 6
	[0049.187] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.ppt") returned 0
	[0049.187] lstrlenA (lpString="*.ppt") returned 5
	[0049.187] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.pptx") returned 0
	[0049.187] lstrlenA (lpString="*.pptx") returned 6
	[0049.187] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.txt") returned 0
	[0049.187] lstrlenA (lpString="*.txt") returned 5
	[0049.187] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.pdf") returned 0
	[0049.187] lstrlenA (lpString="*.pdf") returned 5
	[0049.187] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.htm") returned 0
	[0049.187] lstrlenA (lpString="*.htm") returned 5
	[0049.187] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.html") returned 0
	[0049.187] lstrlenA (lpString="*.html") returned 6
	[0049.187] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.mdb") returned 0
	[0049.187] lstrlenA (lpString="*.mdb") returned 5
	[0049.187] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.pfx") returned 0
	[0049.187] lstrlenA (lpString="*.pfx") returned 5
	[0049.187] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.md") returned 0
	[0049.188] lstrlenA (lpString="*.md") returned 4
	[0049.188] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.lnk") returned 0
	[0049.188] lstrlenA (lpString="*.lnk") returned 5
	[0049.188] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.torrent") returned 0
	[0049.188] lstrlenA (lpString="*.torrent") returned 9
	[0049.188] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.mov") returned 0
	[0049.188] lstrlenA (lpString="*.mov") returned 5
	[0049.188] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.3gp") returned 0
	[0049.188] lstrlenA (lpString="*.3gp") returned 5
	[0049.188] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.mpeg") returned 0
	[0049.188] lstrlenA (lpString="*.mpeg") returned 6
	[0049.188] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.mpg") returned 0
	[0049.188] lstrlenA (lpString="*.mpg") returned 5
	[0049.188] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.flv") returned 0
	[0049.188] lstrlenA (lpString="*.flv") returned 5
	[0049.188] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.avi") returned 0
	[0049.188] lstrlenA (lpString="*.avi") returned 5
	[0049.188] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.mp4") returned 0
	[0049.188] lstrlenA (lpString="*.mp4") returned 5
	[0049.188] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.wmv") returned 0
	[0049.188] lstrlenA (lpString="*.wmv") returned 5
	[0049.188] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.mkv") returned 0
	[0049.188] lstrlenA (lpString="*.mkv") returned 5
	[0049.188] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.mp3") returned 0
	[0049.188] lstrlenA (lpString="*.mp3") returned 5
	[0049.188] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.wav") returned 0
	[0049.188] lstrlenA (lpString="*.wav") returned 5
	[0049.188] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.flac") returned 0
	[0049.188] lstrlenA (lpString="*.flac") returned 6
	[0049.188] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.wma") returned 0
	[0049.188] lstrlenA (lpString="*.wma") returned 5
	[0049.188] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.au3") returned 0
	[0049.188] lstrlenA (lpString="*.au3") returned 5
	[0049.188] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.ahk") returned 0
	[0049.188] lstrlenA (lpString="*.ahk") returned 5
	[0049.188] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.c") returned 0
	[0049.189] lstrlenA (lpString="*.c") returned 3
	[0049.189] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.cc") returned 0
	[0049.189] lstrlenA (lpString="*.cc") returned 4
	[0049.189] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.cpp") returned 0
	[0049.189] lstrlenA (lpString="*.cpp") returned 5
	[0049.189] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.cxx") returned 0
	[0049.189] lstrlenA (lpString="*.cxx") returned 5
	[0049.189] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.c++") returned 0
	[0049.189] lstrlenA (lpString="*.c++") returned 5
	[0049.189] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.cs") returned 0
	[0049.189] lstrlenA (lpString="*.cs") returned 4
	[0049.189] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.vb") returned 0
	[0049.189] lstrlenA (lpString="*.vb") returned 4
	[0049.189] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.bas") returned 0
	[0049.189] lstrlenA (lpString="*.bas") returned 5
	[0049.189] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.csproj") returned 0
	[0049.189] lstrlenA (lpString="*.csproj") returned 8
	[0049.189] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.vbproj") returned 0
	[0049.189] lstrlenA (lpString="*.vbproj") returned 8
	[0049.189] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.vcxproj") returned 0
	[0049.189] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.189] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.manifest") returned 0
	[0049.189] lstrlenA (lpString="*.manifest") returned 10
	[0049.189] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.php") returned 0
	[0049.189] lstrlenA (lpString="*.php") returned 5
	[0049.189] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.vbe") returned 0
	[0049.189] lstrlenA (lpString="*.vbe") returned 5
	[0049.189] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.vba") returned 0
	[0049.189] lstrlenA (lpString="*.vba") returned 5
	[0049.189] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.vbs") returned 0
	[0049.189] lstrlenA (lpString="*.vbs") returned 5
	[0049.189] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.bat") returned 0
	[0049.189] lstrlenA (lpString="*.bat") returned 5
	[0049.189] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.cmd") returned 0
	[0049.189] lstrlenA (lpString="*.cmd") returned 5
	[0049.189] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.js") returned 0
	[0049.189] lstrlenA (lpString="*.js") returned 4
	[0049.190] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.jscript") returned 0
	[0049.190] lstrlenA (lpString="*.jscript") returned 9
	[0049.190] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.hta") returned 0
	[0049.190] lstrlenA (lpString="*.hta") returned 5
	[0049.190] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.php7") returned 0
	[0049.190] lstrlenA (lpString="*.php7") returned 6
	[0049.190] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.db") returned 0
	[0049.190] lstrlenA (lpString="*.db") returned 4
	[0049.190] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.swf") returned 0
	[0049.190] lstrlenA (lpString="*.swf") returned 5
	[0049.190] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.eml") returned 0
	[0049.190] lstrlenA (lpString="*.eml") returned 5
	[0049.190] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.part") returned 0
	[0049.190] lstrlenA (lpString="*.part") returned 6
	[0049.190] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.nfo") returned 0
	[0049.190] lstrlenA (lpString="*.nfo") returned 5
	[0049.190] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.rsa") returned 0
	[0049.190] lstrlenA (lpString="*.rsa") returned 5
	[0049.190] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.key") returned 0
	[0049.190] lstrlenA (lpString="*.key") returned 5
	[0049.190] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.aes") returned 0
	[0049.190] lstrlenA (lpString="*.aes") returned 5
	[0049.190] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.blob") returned 0
	[0049.190] lstrlenA (lpString="*.blob") returned 6
	[0049.190] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.btc") returned 0
	[0049.190] lstrlenA (lpString="*.btc") returned 5
	[0049.190] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.wallet") returned 0
	[0049.190] lstrlenA (lpString="*.wallet") returned 8
	[0049.190] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0049.190] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.190] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SetupResources.dll") returned -1
	[0049.190] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SetupResources.dll") returned -1
	[0049.190] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1
	[0049.190] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned="LocalizedData.xml"
	[0049.190] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\2070\\" | out: lpString1="C:\\588bce7c90097ed212\\2070\\") returned="C:\\588bce7c90097ed212\\2070\\"
	[0049.191] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\2070\\" | out: pszPath="C:\\588bce7c90097ed212\\2070\\") returned=""
	[0049.191] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\2070\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\2070\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\2070\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.191] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\2070\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\2070\\how-to-decrypt-files.htm")) returned 0x20
	[0049.191] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\2070\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\2070\\SetupResources.dll"
	[0049.191] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.zip") returned 0
	[0049.191] lstrlenA (lpString="*.zip") returned 5
	[0049.191] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.rar") returned 0
	[0049.191] lstrlenA (lpString="*.rar") returned 5
	[0049.191] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.7z") returned 0
	[0049.191] lstrlenA (lpString="*.7z") returned 4
	[0049.191] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.tar") returned 0
	[0049.191] lstrlenA (lpString="*.tar") returned 5
	[0049.191] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.gzip") returned 0
	[0049.191] lstrlenA (lpString="*.gzip") returned 6
	[0049.191] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.jpg") returned 0
	[0049.191] lstrlenA (lpString="*.jpg") returned 5
	[0049.191] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.jpeg") returned 0
	[0049.191] lstrlenA (lpString="*.jpeg") returned 6
	[0049.191] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.bmp") returned 0
	[0049.191] lstrlenA (lpString="*.bmp") returned 5
	[0049.191] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.gif") returned 0
	[0049.191] lstrlenA (lpString="*.gif") returned 5
	[0049.191] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.png") returned 0
	[0049.191] lstrlenA (lpString="*.png") returned 5
	[0049.191] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.doc") returned 0
	[0049.191] lstrlenA (lpString="*.doc") returned 5
	[0049.191] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.docx") returned 0
	[0049.191] lstrlenA (lpString="*.docx") returned 6
	[0049.191] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.xls") returned 0
	[0049.191] lstrlenA (lpString="*.xls") returned 5
	[0049.191] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.xlsx") returned 0
	[0049.191] lstrlenA (lpString="*.xlsx") returned 6
	[0049.191] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.ppt") returned 0
	[0049.191] lstrlenA (lpString="*.ppt") returned 5
	[0049.191] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.pptx") returned 0
	[0049.192] lstrlenA (lpString="*.pptx") returned 6
	[0049.192] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.txt") returned 0
	[0049.192] lstrlenA (lpString="*.txt") returned 5
	[0049.192] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.pdf") returned 0
	[0049.192] lstrlenA (lpString="*.pdf") returned 5
	[0049.192] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.htm") returned 0
	[0049.192] lstrlenA (lpString="*.htm") returned 5
	[0049.192] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.html") returned 0
	[0049.192] lstrlenA (lpString="*.html") returned 6
	[0049.192] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.mdb") returned 0
	[0049.192] lstrlenA (lpString="*.mdb") returned 5
	[0049.192] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.pfx") returned 0
	[0049.192] lstrlenA (lpString="*.pfx") returned 5
	[0049.192] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.md") returned 0
	[0049.192] lstrlenA (lpString="*.md") returned 4
	[0049.192] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.lnk") returned 0
	[0049.192] lstrlenA (lpString="*.lnk") returned 5
	[0049.192] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.torrent") returned 0
	[0049.192] lstrlenA (lpString="*.torrent") returned 9
	[0049.192] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.mov") returned 0
	[0049.192] lstrlenA (lpString="*.mov") returned 5
	[0049.192] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.3gp") returned 0
	[0049.192] lstrlenA (lpString="*.3gp") returned 5
	[0049.192] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.mpeg") returned 0
	[0049.192] lstrlenA (lpString="*.mpeg") returned 6
	[0049.192] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.mpg") returned 0
	[0049.192] lstrlenA (lpString="*.mpg") returned 5
	[0049.192] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.flv") returned 0
	[0049.192] lstrlenA (lpString="*.flv") returned 5
	[0049.192] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.avi") returned 0
	[0049.192] lstrlenA (lpString="*.avi") returned 5
	[0049.192] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.mp4") returned 0
	[0049.192] lstrlenA (lpString="*.mp4") returned 5
	[0049.192] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.wmv") returned 0
	[0049.192] lstrlenA (lpString="*.wmv") returned 5
	[0049.192] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.mkv") returned 0
	[0049.192] lstrlenA (lpString="*.mkv") returned 5
	[0049.192] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.mp3") returned 0
	[0049.193] lstrlenA (lpString="*.mp3") returned 5
	[0049.193] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.wav") returned 0
	[0049.193] lstrlenA (lpString="*.wav") returned 5
	[0049.193] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.flac") returned 0
	[0049.193] lstrlenA (lpString="*.flac") returned 6
	[0049.193] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.wma") returned 0
	[0049.193] lstrlenA (lpString="*.wma") returned 5
	[0049.193] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.au3") returned 0
	[0049.193] lstrlenA (lpString="*.au3") returned 5
	[0049.193] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.ahk") returned 0
	[0049.193] lstrlenA (lpString="*.ahk") returned 5
	[0049.193] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.c") returned 0
	[0049.193] lstrlenA (lpString="*.c") returned 3
	[0049.193] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.cc") returned 0
	[0049.193] lstrlenA (lpString="*.cc") returned 4
	[0049.193] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.cpp") returned 0
	[0049.193] lstrlenA (lpString="*.cpp") returned 5
	[0049.193] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.cxx") returned 0
	[0049.193] lstrlenA (lpString="*.cxx") returned 5
	[0049.193] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.c++") returned 0
	[0049.193] lstrlenA (lpString="*.c++") returned 5
	[0049.193] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.cs") returned 0
	[0049.193] lstrlenA (lpString="*.cs") returned 4
	[0049.193] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.vb") returned 0
	[0049.193] lstrlenA (lpString="*.vb") returned 4
	[0049.193] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.bas") returned 0
	[0049.194] lstrlenA (lpString="*.bas") returned 5
	[0049.194] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.csproj") returned 0
	[0049.194] lstrlenA (lpString="*.csproj") returned 8
	[0049.194] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.vbproj") returned 0
	[0049.194] lstrlenA (lpString="*.vbproj") returned 8
	[0049.194] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.vcxproj") returned 0
	[0049.194] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.194] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.manifest") returned 0
	[0049.194] lstrlenA (lpString="*.manifest") returned 10
	[0049.194] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.php") returned 0
	[0049.194] lstrlenA (lpString="*.php") returned 5
	[0049.194] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.vbe") returned 0
	[0049.194] lstrlenA (lpString="*.vbe") returned 5
	[0049.194] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.vba") returned 0
	[0049.194] lstrlenA (lpString="*.vba") returned 5
	[0049.194] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.vbs") returned 0
	[0049.194] lstrlenA (lpString="*.vbs") returned 5
	[0049.194] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.bat") returned 0
	[0049.194] lstrlenA (lpString="*.bat") returned 5
	[0049.194] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.cmd") returned 0
	[0049.194] lstrlenA (lpString="*.cmd") returned 5
	[0049.194] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.js") returned 0
	[0049.194] lstrlenA (lpString="*.js") returned 4
	[0049.194] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.jscript") returned 0
	[0049.194] lstrlenA (lpString="*.jscript") returned 9
	[0049.194] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.hta") returned 0
	[0049.194] lstrlenA (lpString="*.hta") returned 5
	[0049.194] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.php7") returned 0
	[0049.194] lstrlenA (lpString="*.php7") returned 6
	[0049.194] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.db") returned 0
	[0049.194] lstrlenA (lpString="*.db") returned 4
	[0049.194] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.swf") returned 0
	[0049.194] lstrlenA (lpString="*.swf") returned 5
	[0049.194] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.eml") returned 0
	[0049.194] lstrlenA (lpString="*.eml") returned 5
	[0049.194] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.part") returned 0
	[0049.195] lstrlenA (lpString="*.part") returned 6
	[0049.195] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.nfo") returned 0
	[0049.195] lstrlenA (lpString="*.nfo") returned 5
	[0049.195] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.rsa") returned 0
	[0049.195] lstrlenA (lpString="*.rsa") returned 5
	[0049.195] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.key") returned 0
	[0049.195] lstrlenA (lpString="*.key") returned 5
	[0049.195] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.aes") returned 0
	[0049.195] lstrlenA (lpString="*.aes") returned 5
	[0049.195] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.blob") returned 0
	[0049.195] lstrlenA (lpString="*.blob") returned 6
	[0049.195] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.btc") returned 0
	[0049.195] lstrlenA (lpString="*.btc") returned 5
	[0049.195] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.wallet") returned 0
	[0049.195] lstrlenA (lpString="*.wallet") returned 8
	[0049.195] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0049.195] FindClose (in: hFindFile=0x7cb990 | out: hFindFile=0x7cb990) returned 1
	[0049.195] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d1d40, dwReserved1=0x7b00c0, cFileName="3076", cAlternateFileName="")) returned 1
	[0049.195] lstrcmpA (lpString1=".", lpString2="3076") returned -1
	[0049.195] lstrcmpA (lpString1="..", lpString2="3076") returned -1
	[0049.195] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*"
	[0049.195] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="3076" | out: lpString1="C:\\588bce7c90097ed212\\3076") returned="C:\\588bce7c90097ed212\\3076"
	[0049.195] lstrlenA (lpString="C:\\588bce7c90097ed212\\3076") returned 26
	[0049.195] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbc50
	[0049.195] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0049.195] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0049.196] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0049.196] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0049.196] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0049.196] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.196] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="eula.rtf") returned -1
	[0049.196] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="eula.rtf") returned 1
	[0049.196] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1
	[0049.196] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\3076\\*.*") returned="*.*"
	[0049.196] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\3076\\" | out: lpString1="C:\\588bce7c90097ed212\\3076\\") returned="C:\\588bce7c90097ed212\\3076\\"
	[0049.196] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\3076\\" | out: pszPath="C:\\588bce7c90097ed212\\3076\\") returned=""
	[0049.196] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\3076\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\3076\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\3076\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.196] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\3076\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\3076\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0049.196] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\3076\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\3076\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0049.198] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0049.198] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0049.199] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0049.199] CloseHandle (hObject=0x208) returned 1
	[0049.199] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\3076\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned="C:\\588bce7c90097ed212\\3076\\eula.rtf"
	[0049.200] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.zip") returned 0
	[0049.200] lstrlenA (lpString="*.zip") returned 5
	[0049.200] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.rar") returned 0
	[0049.200] lstrlenA (lpString="*.rar") returned 5
	[0049.200] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.7z") returned 0
	[0049.200] lstrlenA (lpString="*.7z") returned 4
	[0049.200] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.tar") returned 0
	[0049.200] lstrlenA (lpString="*.tar") returned 5
	[0049.200] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.gzip") returned 0
	[0049.200] lstrlenA (lpString="*.gzip") returned 6
	[0049.200] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.jpg") returned 0
	[0049.200] lstrlenA (lpString="*.jpg") returned 5
	[0049.200] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.jpeg") returned 0
	[0049.200] lstrlenA (lpString="*.jpeg") returned 6
	[0049.200] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.bmp") returned 0
	[0049.200] lstrlenA (lpString="*.bmp") returned 5
	[0049.200] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.gif") returned 0
	[0049.200] lstrlenA (lpString="*.gif") returned 5
	[0049.200] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.png") returned 0
	[0049.200] lstrlenA (lpString="*.png") returned 5
	[0049.200] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.doc") returned 0
	[0049.200] lstrlenA (lpString="*.doc") returned 5
	[0049.200] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.docx") returned 0
	[0049.200] lstrlenA (lpString="*.docx") returned 6
	[0049.200] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.xls") returned 0
	[0049.200] lstrlenA (lpString="*.xls") returned 5
	[0049.200] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.xlsx") returned 0
	[0049.200] lstrlenA (lpString="*.xlsx") returned 6
	[0049.200] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.ppt") returned 0
	[0049.200] lstrlenA (lpString="*.ppt") returned 5
	[0049.200] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.pptx") returned 0
	[0049.200] lstrlenA (lpString="*.pptx") returned 6
	[0049.200] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.txt") returned 0
	[0049.200] lstrlenA (lpString="*.txt") returned 5
	[0049.200] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.pdf") returned 0
	[0049.200] lstrlenA (lpString="*.pdf") returned 5
	[0049.200] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.htm") returned 0
	[0049.201] lstrlenA (lpString="*.htm") returned 5
	[0049.201] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.html") returned 0
	[0049.201] lstrlenA (lpString="*.html") returned 6
	[0049.201] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.mdb") returned 0
	[0049.201] lstrlenA (lpString="*.mdb") returned 5
	[0049.201] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.pfx") returned 0
	[0049.201] lstrlenA (lpString="*.pfx") returned 5
	[0049.201] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.md") returned 0
	[0049.201] lstrlenA (lpString="*.md") returned 4
	[0049.201] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.lnk") returned 0
	[0049.201] lstrlenA (lpString="*.lnk") returned 5
	[0049.201] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.torrent") returned 0
	[0049.201] lstrlenA (lpString="*.torrent") returned 9
	[0049.201] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.mov") returned 0
	[0049.201] lstrlenA (lpString="*.mov") returned 5
	[0049.201] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.3gp") returned 0
	[0049.201] lstrlenA (lpString="*.3gp") returned 5
	[0049.201] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.mpeg") returned 0
	[0049.201] lstrlenA (lpString="*.mpeg") returned 6
	[0049.201] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.mpg") returned 0
	[0049.201] lstrlenA (lpString="*.mpg") returned 5
	[0049.201] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.flv") returned 0
	[0049.201] lstrlenA (lpString="*.flv") returned 5
	[0049.201] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.avi") returned 0
	[0049.201] lstrlenA (lpString="*.avi") returned 5
	[0049.201] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.mp4") returned 0
	[0049.201] lstrlenA (lpString="*.mp4") returned 5
	[0049.201] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.wmv") returned 0
	[0049.201] lstrlenA (lpString="*.wmv") returned 5
	[0049.201] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.mkv") returned 0
	[0049.201] lstrlenA (lpString="*.mkv") returned 5
	[0049.201] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.mp3") returned 0
	[0049.201] lstrlenA (lpString="*.mp3") returned 5
	[0049.201] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.wav") returned 0
	[0049.201] lstrlenA (lpString="*.wav") returned 5
	[0049.201] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.flac") returned 0
	[0049.201] lstrlenA (lpString="*.flac") returned 6
	[0049.202] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.wma") returned 0
	[0049.202] lstrlenA (lpString="*.wma") returned 5
	[0049.202] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.au3") returned 0
	[0049.202] lstrlenA (lpString="*.au3") returned 5
	[0049.202] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.ahk") returned 0
	[0049.202] lstrlenA (lpString="*.ahk") returned 5
	[0049.202] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.c") returned 0
	[0049.202] lstrlenA (lpString="*.c") returned 3
	[0049.202] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.cc") returned 0
	[0049.202] lstrlenA (lpString="*.cc") returned 4
	[0049.202] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.cpp") returned 0
	[0049.202] lstrlenA (lpString="*.cpp") returned 5
	[0049.202] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.cxx") returned 0
	[0049.202] lstrlenA (lpString="*.cxx") returned 5
	[0049.202] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.c++") returned 0
	[0049.202] lstrlenA (lpString="*.c++") returned 5
	[0049.202] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.cs") returned 0
	[0049.202] lstrlenA (lpString="*.cs") returned 4
	[0049.202] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.vb") returned 0
	[0049.202] lstrlenA (lpString="*.vb") returned 4
	[0049.202] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.bas") returned 0
	[0049.202] lstrlenA (lpString="*.bas") returned 5
	[0049.202] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.csproj") returned 0
	[0049.202] lstrlenA (lpString="*.csproj") returned 8
	[0049.202] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.vbproj") returned 0
	[0049.202] lstrlenA (lpString="*.vbproj") returned 8
	[0049.202] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.vcxproj") returned 0
	[0049.202] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.202] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.manifest") returned 0
	[0049.202] lstrlenA (lpString="*.manifest") returned 10
	[0049.202] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.php") returned 0
	[0049.202] lstrlenA (lpString="*.php") returned 5
	[0049.202] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.vbe") returned 0
	[0049.202] lstrlenA (lpString="*.vbe") returned 5
	[0049.202] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.vba") returned 0
	[0049.202] lstrlenA (lpString="*.vba") returned 5
	[0049.203] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.vbs") returned 0
	[0049.203] lstrlenA (lpString="*.vbs") returned 5
	[0049.203] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.bat") returned 0
	[0049.203] lstrlenA (lpString="*.bat") returned 5
	[0049.203] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.cmd") returned 0
	[0049.203] lstrlenA (lpString="*.cmd") returned 5
	[0049.203] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.js") returned 0
	[0049.203] lstrlenA (lpString="*.js") returned 4
	[0049.203] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.jscript") returned 0
	[0049.203] lstrlenA (lpString="*.jscript") returned 9
	[0049.203] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.hta") returned 0
	[0049.203] lstrlenA (lpString="*.hta") returned 5
	[0049.203] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.php7") returned 0
	[0049.203] lstrlenA (lpString="*.php7") returned 6
	[0049.203] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.db") returned 0
	[0049.203] lstrlenA (lpString="*.db") returned 4
	[0049.203] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.swf") returned 0
	[0049.203] lstrlenA (lpString="*.swf") returned 5
	[0049.203] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.eml") returned 0
	[0049.203] lstrlenA (lpString="*.eml") returned 5
	[0049.203] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.part") returned 0
	[0049.203] lstrlenA (lpString="*.part") returned 6
	[0049.203] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.nfo") returned 0
	[0049.203] lstrlenA (lpString="*.nfo") returned 5
	[0049.203] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.rsa") returned 0
	[0049.203] lstrlenA (lpString="*.rsa") returned 5
	[0049.203] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.key") returned 0
	[0049.203] lstrlenA (lpString="*.key") returned 5
	[0049.203] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.aes") returned 0
	[0049.203] lstrlenA (lpString="*.aes") returned 5
	[0049.203] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.blob") returned 0
	[0049.203] lstrlenA (lpString="*.blob") returned 6
	[0049.203] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.btc") returned 0
	[0049.203] lstrlenA (lpString="*.btc") returned 5
	[0049.203] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.wallet") returned 0
	[0049.203] lstrlenA (lpString="*.wallet") returned 8
	[0049.204] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0049.204] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.204] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="LocalizedData.xml") returned -1
	[0049.204] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="LocalizedData.xml") returned -1
	[0049.204] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1
	[0049.204] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned="eula.rtf"
	[0049.204] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\3076\\" | out: lpString1="C:\\588bce7c90097ed212\\3076\\") returned="C:\\588bce7c90097ed212\\3076\\"
	[0049.204] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\3076\\" | out: pszPath="C:\\588bce7c90097ed212\\3076\\") returned=""
	[0049.204] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\3076\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\3076\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\3076\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.204] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\3076\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\3076\\how-to-decrypt-files.htm")) returned 0x20
	[0049.204] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\3076\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml"
	[0049.204] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.zip") returned 0
	[0049.204] lstrlenA (lpString="*.zip") returned 5
	[0049.204] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.rar") returned 0
	[0049.204] lstrlenA (lpString="*.rar") returned 5
	[0049.204] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.7z") returned 0
	[0049.204] lstrlenA (lpString="*.7z") returned 4
	[0049.204] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.tar") returned 0
	[0049.204] lstrlenA (lpString="*.tar") returned 5
	[0049.204] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.gzip") returned 0
	[0049.204] lstrlenA (lpString="*.gzip") returned 6
	[0049.204] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.jpg") returned 0
	[0049.204] lstrlenA (lpString="*.jpg") returned 5
	[0049.204] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.jpeg") returned 0
	[0049.204] lstrlenA (lpString="*.jpeg") returned 6
	[0049.204] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.bmp") returned 0
	[0049.204] lstrlenA (lpString="*.bmp") returned 5
	[0049.204] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.gif") returned 0
	[0049.204] lstrlenA (lpString="*.gif") returned 5
	[0049.204] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.png") returned 0
	[0049.204] lstrlenA (lpString="*.png") returned 5
	[0049.204] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.doc") returned 0
	[0049.204] lstrlenA (lpString="*.doc") returned 5
	[0049.205] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.docx") returned 0
	[0049.205] lstrlenA (lpString="*.docx") returned 6
	[0049.205] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.xls") returned 0
	[0049.205] lstrlenA (lpString="*.xls") returned 5
	[0049.205] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.xlsx") returned 0
	[0049.205] lstrlenA (lpString="*.xlsx") returned 6
	[0049.205] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.ppt") returned 0
	[0049.205] lstrlenA (lpString="*.ppt") returned 5
	[0049.205] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.pptx") returned 0
	[0049.205] lstrlenA (lpString="*.pptx") returned 6
	[0049.205] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.txt") returned 0
	[0049.205] lstrlenA (lpString="*.txt") returned 5
	[0049.205] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.pdf") returned 0
	[0049.205] lstrlenA (lpString="*.pdf") returned 5
	[0049.205] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.htm") returned 0
	[0049.205] lstrlenA (lpString="*.htm") returned 5
	[0049.205] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.html") returned 0
	[0049.205] lstrlenA (lpString="*.html") returned 6
	[0049.205] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.mdb") returned 0
	[0049.205] lstrlenA (lpString="*.mdb") returned 5
	[0049.205] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.pfx") returned 0
	[0049.205] lstrlenA (lpString="*.pfx") returned 5
	[0049.205] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.md") returned 0
	[0049.205] lstrlenA (lpString="*.md") returned 4
	[0049.205] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.lnk") returned 0
	[0049.205] lstrlenA (lpString="*.lnk") returned 5
	[0049.205] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.torrent") returned 0
	[0049.205] lstrlenA (lpString="*.torrent") returned 9
	[0049.205] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.mov") returned 0
	[0049.205] lstrlenA (lpString="*.mov") returned 5
	[0049.205] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.3gp") returned 0
	[0049.205] lstrlenA (lpString="*.3gp") returned 5
	[0049.205] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.mpeg") returned 0
	[0049.205] lstrlenA (lpString="*.mpeg") returned 6
	[0049.205] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.mpg") returned 0
	[0049.205] lstrlenA (lpString="*.mpg") returned 5
	[0049.205] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.flv") returned 0
	[0049.206] lstrlenA (lpString="*.flv") returned 5
	[0049.206] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.avi") returned 0
	[0049.206] lstrlenA (lpString="*.avi") returned 5
	[0049.206] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.mp4") returned 0
	[0049.206] lstrlenA (lpString="*.mp4") returned 5
	[0049.206] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.wmv") returned 0
	[0049.206] lstrlenA (lpString="*.wmv") returned 5
	[0049.206] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.mkv") returned 0
	[0049.206] lstrlenA (lpString="*.mkv") returned 5
	[0049.206] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.mp3") returned 0
	[0049.206] lstrlenA (lpString="*.mp3") returned 5
	[0049.206] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.wav") returned 0
	[0049.206] lstrlenA (lpString="*.wav") returned 5
	[0049.206] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.flac") returned 0
	[0049.206] lstrlenA (lpString="*.flac") returned 6
	[0049.206] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.wma") returned 0
	[0049.206] lstrlenA (lpString="*.wma") returned 5
	[0049.206] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.au3") returned 0
	[0049.206] lstrlenA (lpString="*.au3") returned 5
	[0049.206] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.ahk") returned 0
	[0049.206] lstrlenA (lpString="*.ahk") returned 5
	[0049.206] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.c") returned 0
	[0049.206] lstrlenA (lpString="*.c") returned 3
	[0049.206] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.cc") returned 0
	[0049.206] lstrlenA (lpString="*.cc") returned 4
	[0049.206] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.cpp") returned 0
	[0049.206] lstrlenA (lpString="*.cpp") returned 5
	[0049.206] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.cxx") returned 0
	[0049.206] lstrlenA (lpString="*.cxx") returned 5
	[0049.206] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.c++") returned 0
	[0049.206] lstrlenA (lpString="*.c++") returned 5
	[0049.206] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.cs") returned 0
	[0049.206] lstrlenA (lpString="*.cs") returned 4
	[0049.206] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.vb") returned 0
	[0049.206] lstrlenA (lpString="*.vb") returned 4
	[0049.206] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.bas") returned 0
	[0049.206] lstrlenA (lpString="*.bas") returned 5
	[0049.207] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.csproj") returned 0
	[0049.207] lstrlenA (lpString="*.csproj") returned 8
	[0049.207] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.vbproj") returned 0
	[0049.207] lstrlenA (lpString="*.vbproj") returned 8
	[0049.207] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.vcxproj") returned 0
	[0049.207] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.207] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.manifest") returned 0
	[0049.207] lstrlenA (lpString="*.manifest") returned 10
	[0049.207] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.php") returned 0
	[0049.207] lstrlenA (lpString="*.php") returned 5
	[0049.207] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.vbe") returned 0
	[0049.207] lstrlenA (lpString="*.vbe") returned 5
	[0049.207] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.vba") returned 0
	[0049.207] lstrlenA (lpString="*.vba") returned 5
	[0049.207] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.vbs") returned 0
	[0049.207] lstrlenA (lpString="*.vbs") returned 5
	[0049.207] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.bat") returned 0
	[0049.207] lstrlenA (lpString="*.bat") returned 5
	[0049.207] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.cmd") returned 0
	[0049.207] lstrlenA (lpString="*.cmd") returned 5
	[0049.207] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.js") returned 0
	[0049.207] lstrlenA (lpString="*.js") returned 4
	[0049.207] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.jscript") returned 0
	[0049.207] lstrlenA (lpString="*.jscript") returned 9
	[0049.207] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.hta") returned 0
	[0049.207] lstrlenA (lpString="*.hta") returned 5
	[0049.207] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.php7") returned 0
	[0049.207] lstrlenA (lpString="*.php7") returned 6
	[0049.207] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.db") returned 0
	[0049.207] lstrlenA (lpString="*.db") returned 4
	[0049.207] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.swf") returned 0
	[0049.207] lstrlenA (lpString="*.swf") returned 5
	[0049.207] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.eml") returned 0
	[0049.207] lstrlenA (lpString="*.eml") returned 5
	[0049.207] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.part") returned 0
	[0049.207] lstrlenA (lpString="*.part") returned 6
	[0049.208] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.nfo") returned 0
	[0049.208] lstrlenA (lpString="*.nfo") returned 5
	[0049.208] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.rsa") returned 0
	[0049.208] lstrlenA (lpString="*.rsa") returned 5
	[0049.208] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.key") returned 0
	[0049.208] lstrlenA (lpString="*.key") returned 5
	[0049.208] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.aes") returned 0
	[0049.208] lstrlenA (lpString="*.aes") returned 5
	[0049.208] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.blob") returned 0
	[0049.208] lstrlenA (lpString="*.blob") returned 6
	[0049.208] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.btc") returned 0
	[0049.208] lstrlenA (lpString="*.btc") returned 5
	[0049.208] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.wallet") returned 0
	[0049.208] lstrlenA (lpString="*.wallet") returned 8
	[0049.208] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0049.208] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.208] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SetupResources.dll") returned -1
	[0049.208] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SetupResources.dll") returned -1
	[0049.208] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1
	[0049.208] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned="LocalizedData.xml"
	[0049.208] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\3076\\" | out: lpString1="C:\\588bce7c90097ed212\\3076\\") returned="C:\\588bce7c90097ed212\\3076\\"
	[0049.208] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\3076\\" | out: pszPath="C:\\588bce7c90097ed212\\3076\\") returned=""
	[0049.208] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\3076\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\3076\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\3076\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.208] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\3076\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\3076\\how-to-decrypt-files.htm")) returned 0x20
	[0049.208] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\3076\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\3076\\SetupResources.dll"
	[0049.208] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.zip") returned 0
	[0049.208] lstrlenA (lpString="*.zip") returned 5
	[0049.208] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.rar") returned 0
	[0049.208] lstrlenA (lpString="*.rar") returned 5
	[0049.208] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.7z") returned 0
	[0049.208] lstrlenA (lpString="*.7z") returned 4
	[0049.209] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.tar") returned 0
	[0049.209] lstrlenA (lpString="*.tar") returned 5
	[0049.209] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.gzip") returned 0
	[0049.209] lstrlenA (lpString="*.gzip") returned 6
	[0049.209] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.jpg") returned 0
	[0049.209] lstrlenA (lpString="*.jpg") returned 5
	[0049.209] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.jpeg") returned 0
	[0049.209] lstrlenA (lpString="*.jpeg") returned 6
	[0049.209] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.bmp") returned 0
	[0049.209] lstrlenA (lpString="*.bmp") returned 5
	[0049.209] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.gif") returned 0
	[0049.209] lstrlenA (lpString="*.gif") returned 5
	[0049.209] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.png") returned 0
	[0049.209] lstrlenA (lpString="*.png") returned 5
	[0049.209] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.doc") returned 0
	[0049.209] lstrlenA (lpString="*.doc") returned 5
	[0049.209] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.docx") returned 0
	[0049.209] lstrlenA (lpString="*.docx") returned 6
	[0049.209] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.xls") returned 0
	[0049.209] lstrlenA (lpString="*.xls") returned 5
	[0049.209] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.xlsx") returned 0
	[0049.209] lstrlenA (lpString="*.xlsx") returned 6
	[0049.209] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.ppt") returned 0
	[0049.209] lstrlenA (lpString="*.ppt") returned 5
	[0049.209] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.pptx") returned 0
	[0049.209] lstrlenA (lpString="*.pptx") returned 6
	[0049.209] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.txt") returned 0
	[0049.209] lstrlenA (lpString="*.txt") returned 5
	[0049.209] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.pdf") returned 0
	[0049.209] lstrlenA (lpString="*.pdf") returned 5
	[0049.209] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.htm") returned 0
	[0049.209] lstrlenA (lpString="*.htm") returned 5
	[0049.209] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.html") returned 0
	[0049.209] lstrlenA (lpString="*.html") returned 6
	[0049.209] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.mdb") returned 0
	[0049.209] lstrlenA (lpString="*.mdb") returned 5
	[0049.210] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.pfx") returned 0
	[0049.210] lstrlenA (lpString="*.pfx") returned 5
	[0049.210] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.md") returned 0
	[0049.210] lstrlenA (lpString="*.md") returned 4
	[0049.210] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.lnk") returned 0
	[0049.210] lstrlenA (lpString="*.lnk") returned 5
	[0049.210] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.torrent") returned 0
	[0049.210] lstrlenA (lpString="*.torrent") returned 9
	[0049.210] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.mov") returned 0
	[0049.210] lstrlenA (lpString="*.mov") returned 5
	[0049.210] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.3gp") returned 0
	[0049.210] lstrlenA (lpString="*.3gp") returned 5
	[0049.210] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.mpeg") returned 0
	[0049.210] lstrlenA (lpString="*.mpeg") returned 6
	[0049.210] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.mpg") returned 0
	[0049.210] lstrlenA (lpString="*.mpg") returned 5
	[0049.210] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.flv") returned 0
	[0049.210] lstrlenA (lpString="*.flv") returned 5
	[0049.210] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.avi") returned 0
	[0049.210] lstrlenA (lpString="*.avi") returned 5
	[0049.210] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.mp4") returned 0
	[0049.210] lstrlenA (lpString="*.mp4") returned 5
	[0049.210] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.wmv") returned 0
	[0049.210] lstrlenA (lpString="*.wmv") returned 5
	[0049.210] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.mkv") returned 0
	[0049.210] lstrlenA (lpString="*.mkv") returned 5
	[0049.210] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.mp3") returned 0
	[0049.210] lstrlenA (lpString="*.mp3") returned 5
	[0049.210] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.wav") returned 0
	[0049.210] lstrlenA (lpString="*.wav") returned 5
	[0049.210] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.flac") returned 0
	[0049.210] lstrlenA (lpString="*.flac") returned 6
	[0049.210] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.wma") returned 0
	[0049.210] lstrlenA (lpString="*.wma") returned 5
	[0049.210] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.au3") returned 0
	[0049.210] lstrlenA (lpString="*.au3") returned 5
	[0049.211] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.ahk") returned 0
	[0049.211] lstrlenA (lpString="*.ahk") returned 5
	[0049.211] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.c") returned 0
	[0049.211] lstrlenA (lpString="*.c") returned 3
	[0049.211] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.cc") returned 0
	[0049.211] lstrlenA (lpString="*.cc") returned 4
	[0049.211] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.cpp") returned 0
	[0049.211] lstrlenA (lpString="*.cpp") returned 5
	[0049.211] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.cxx") returned 0
	[0049.211] lstrlenA (lpString="*.cxx") returned 5
	[0049.211] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.c++") returned 0
	[0049.211] lstrlenA (lpString="*.c++") returned 5
	[0049.211] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.cs") returned 0
	[0049.211] lstrlenA (lpString="*.cs") returned 4
	[0049.211] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.vb") returned 0
	[0049.211] lstrlenA (lpString="*.vb") returned 4
	[0049.211] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.bas") returned 0
	[0049.211] lstrlenA (lpString="*.bas") returned 5
	[0049.211] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.csproj") returned 0
	[0049.211] lstrlenA (lpString="*.csproj") returned 8
	[0049.211] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.vbproj") returned 0
	[0049.211] lstrlenA (lpString="*.vbproj") returned 8
	[0049.211] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.vcxproj") returned 0
	[0049.211] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.211] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.manifest") returned 0
	[0049.211] lstrlenA (lpString="*.manifest") returned 10
	[0049.211] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.php") returned 0
	[0049.211] lstrlenA (lpString="*.php") returned 5
	[0049.211] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.vbe") returned 0
	[0049.211] lstrlenA (lpString="*.vbe") returned 5
	[0049.211] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.vba") returned 0
	[0049.211] lstrlenA (lpString="*.vba") returned 5
	[0049.211] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.vbs") returned 0
	[0049.211] lstrlenA (lpString="*.vbs") returned 5
	[0049.211] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.bat") returned 0
	[0049.211] lstrlenA (lpString="*.bat") returned 5
	[0049.212] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.cmd") returned 0
	[0049.212] lstrlenA (lpString="*.cmd") returned 5
	[0049.212] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.js") returned 0
	[0049.212] lstrlenA (lpString="*.js") returned 4
	[0049.212] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.jscript") returned 0
	[0049.212] lstrlenA (lpString="*.jscript") returned 9
	[0049.212] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.hta") returned 0
	[0049.212] lstrlenA (lpString="*.hta") returned 5
	[0049.212] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.php7") returned 0
	[0049.212] lstrlenA (lpString="*.php7") returned 6
	[0049.212] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.db") returned 0
	[0049.212] lstrlenA (lpString="*.db") returned 4
	[0049.212] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.swf") returned 0
	[0049.212] lstrlenA (lpString="*.swf") returned 5
	[0049.212] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.eml") returned 0
	[0049.212] lstrlenA (lpString="*.eml") returned 5
	[0049.212] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.part") returned 0
	[0049.212] lstrlenA (lpString="*.part") returned 6
	[0049.212] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.nfo") returned 0
	[0049.212] lstrlenA (lpString="*.nfo") returned 5
	[0049.212] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.rsa") returned 0
	[0049.212] lstrlenA (lpString="*.rsa") returned 5
	[0049.212] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.key") returned 0
	[0049.212] lstrlenA (lpString="*.key") returned 5
	[0049.212] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.aes") returned 0
	[0049.212] lstrlenA (lpString="*.aes") returned 5
	[0049.212] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.blob") returned 0
	[0049.212] lstrlenA (lpString="*.blob") returned 6
	[0049.212] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.btc") returned 0
	[0049.212] lstrlenA (lpString="*.btc") returned 5
	[0049.212] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.wallet") returned 0
	[0049.212] lstrlenA (lpString="*.wallet") returned 8
	[0049.212] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0049.212] FindClose (in: hFindFile=0x7cbc50 | out: hFindFile=0x7cbc50) returned 1
	[0049.213] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d1d40, dwReserved1=0x7b00c0, cFileName="3082", cAlternateFileName="")) returned 1
	[0049.213] lstrcmpA (lpString1=".", lpString2="3082") returned -1
	[0049.213] lstrcmpA (lpString1="..", lpString2="3082") returned -1
	[0049.213] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*"
	[0049.213] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="3082" | out: lpString1="C:\\588bce7c90097ed212\\3082") returned="C:\\588bce7c90097ed212\\3082"
	[0049.213] lstrlenA (lpString="C:\\588bce7c90097ed212\\3082") returned 26
	[0049.213] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb790
	[0049.236] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0049.236] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0049.236] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0049.236] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0049.236] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0049.237] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.237] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="eula.rtf") returned -1
	[0049.237] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="eula.rtf") returned 1
	[0049.237] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1
	[0049.237] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\3082\\*.*") returned="*.*"
	[0049.237] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\3082\\" | out: lpString1="C:\\588bce7c90097ed212\\3082\\") returned="C:\\588bce7c90097ed212\\3082\\"
	[0049.237] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\3082\\" | out: pszPath="C:\\588bce7c90097ed212\\3082\\") returned=""
	[0049.237] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\3082\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\3082\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\3082\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.237] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\3082\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\3082\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0049.237] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\3082\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\3082\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0049.239] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0049.239] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0049.240] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0049.240] CloseHandle (hObject=0x208) returned 1
	[0049.240] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\3082\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned="C:\\588bce7c90097ed212\\3082\\eula.rtf"
	[0049.240] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.zip") returned 0
	[0049.241] lstrlenA (lpString="*.zip") returned 5
	[0049.241] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.rar") returned 0
	[0049.241] lstrlenA (lpString="*.rar") returned 5
	[0049.241] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.7z") returned 0
	[0049.241] lstrlenA (lpString="*.7z") returned 4
	[0049.241] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.tar") returned 0
	[0049.241] lstrlenA (lpString="*.tar") returned 5
	[0049.241] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.gzip") returned 0
	[0049.241] lstrlenA (lpString="*.gzip") returned 6
	[0049.241] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.jpg") returned 0
	[0049.241] lstrlenA (lpString="*.jpg") returned 5
	[0049.241] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.jpeg") returned 0
	[0049.241] lstrlenA (lpString="*.jpeg") returned 6
	[0049.241] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.bmp") returned 0
	[0049.241] lstrlenA (lpString="*.bmp") returned 5
	[0049.241] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.gif") returned 0
	[0049.241] lstrlenA (lpString="*.gif") returned 5
	[0049.241] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.png") returned 0
	[0049.241] lstrlenA (lpString="*.png") returned 5
	[0049.241] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.doc") returned 0
	[0049.241] lstrlenA (lpString="*.doc") returned 5
	[0049.241] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.docx") returned 0
	[0049.241] lstrlenA (lpString="*.docx") returned 6
	[0049.241] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.xls") returned 0
	[0049.241] lstrlenA (lpString="*.xls") returned 5
	[0049.241] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.xlsx") returned 0
	[0049.241] lstrlenA (lpString="*.xlsx") returned 6
	[0049.241] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.ppt") returned 0
	[0049.241] lstrlenA (lpString="*.ppt") returned 5
	[0049.241] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.pptx") returned 0
	[0049.241] lstrlenA (lpString="*.pptx") returned 6
	[0049.241] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.txt") returned 0
	[0049.241] lstrlenA (lpString="*.txt") returned 5
	[0049.241] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.pdf") returned 0
	[0049.241] lstrlenA (lpString="*.pdf") returned 5
	[0049.242] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.htm") returned 0
	[0049.242] lstrlenA (lpString="*.htm") returned 5
	[0049.242] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.html") returned 0
	[0049.242] lstrlenA (lpString="*.html") returned 6
	[0049.242] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.mdb") returned 0
	[0049.242] lstrlenA (lpString="*.mdb") returned 5
	[0049.242] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.pfx") returned 0
	[0049.242] lstrlenA (lpString="*.pfx") returned 5
	[0049.242] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.md") returned 0
	[0049.242] lstrlenA (lpString="*.md") returned 4
	[0049.242] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.lnk") returned 0
	[0049.242] lstrlenA (lpString="*.lnk") returned 5
	[0049.242] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.torrent") returned 0
	[0049.242] lstrlenA (lpString="*.torrent") returned 9
	[0049.242] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.mov") returned 0
	[0049.242] lstrlenA (lpString="*.mov") returned 5
	[0049.242] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.3gp") returned 0
	[0049.242] lstrlenA (lpString="*.3gp") returned 5
	[0049.242] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.mpeg") returned 0
	[0049.242] lstrlenA (lpString="*.mpeg") returned 6
	[0049.242] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.mpg") returned 0
	[0049.242] lstrlenA (lpString="*.mpg") returned 5
	[0049.242] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.flv") returned 0
	[0049.242] lstrlenA (lpString="*.flv") returned 5
	[0049.242] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.avi") returned 0
	[0049.242] lstrlenA (lpString="*.avi") returned 5
	[0049.242] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.mp4") returned 0
	[0049.242] lstrlenA (lpString="*.mp4") returned 5
	[0049.242] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.wmv") returned 0
	[0049.242] lstrlenA (lpString="*.wmv") returned 5
	[0049.242] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.mkv") returned 0
	[0049.242] lstrlenA (lpString="*.mkv") returned 5
	[0049.242] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.mp3") returned 0
	[0049.242] lstrlenA (lpString="*.mp3") returned 5
	[0049.242] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.wav") returned 0
	[0049.243] lstrlenA (lpString="*.wav") returned 5
	[0049.243] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.flac") returned 0
	[0049.243] lstrlenA (lpString="*.flac") returned 6
	[0049.243] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.wma") returned 0
	[0049.243] lstrlenA (lpString="*.wma") returned 5
	[0049.243] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.au3") returned 0
	[0049.243] lstrlenA (lpString="*.au3") returned 5
	[0049.243] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.ahk") returned 0
	[0049.243] lstrlenA (lpString="*.ahk") returned 5
	[0049.243] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.c") returned 0
	[0049.243] lstrlenA (lpString="*.c") returned 3
	[0049.243] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.cc") returned 0
	[0049.243] lstrlenA (lpString="*.cc") returned 4
	[0049.243] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.cpp") returned 0
	[0049.243] lstrlenA (lpString="*.cpp") returned 5
	[0049.243] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.cxx") returned 0
	[0049.243] lstrlenA (lpString="*.cxx") returned 5
	[0049.243] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.c++") returned 0
	[0049.243] lstrlenA (lpString="*.c++") returned 5
	[0049.243] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.cs") returned 0
	[0049.243] lstrlenA (lpString="*.cs") returned 4
	[0049.243] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.vb") returned 0
	[0049.243] lstrlenA (lpString="*.vb") returned 4
	[0049.243] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.bas") returned 0
	[0049.243] lstrlenA (lpString="*.bas") returned 5
	[0049.243] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.csproj") returned 0
	[0049.243] lstrlenA (lpString="*.csproj") returned 8
	[0049.243] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.vbproj") returned 0
	[0049.243] lstrlenA (lpString="*.vbproj") returned 8
	[0049.243] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.vcxproj") returned 0
	[0049.243] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.243] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.manifest") returned 0
	[0049.243] lstrlenA (lpString="*.manifest") returned 10
	[0049.243] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.php") returned 0
	[0049.243] lstrlenA (lpString="*.php") returned 5
	[0049.244] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.vbe") returned 0
	[0049.244] lstrlenA (lpString="*.vbe") returned 5
	[0049.244] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.vba") returned 0
	[0049.244] lstrlenA (lpString="*.vba") returned 5
	[0049.244] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.vbs") returned 0
	[0049.244] lstrlenA (lpString="*.vbs") returned 5
	[0049.244] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.bat") returned 0
	[0049.244] lstrlenA (lpString="*.bat") returned 5
	[0049.244] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.cmd") returned 0
	[0049.244] lstrlenA (lpString="*.cmd") returned 5
	[0049.244] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.js") returned 0
	[0049.244] lstrlenA (lpString="*.js") returned 4
	[0049.244] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.jscript") returned 0
	[0049.244] lstrlenA (lpString="*.jscript") returned 9
	[0049.244] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.hta") returned 0
	[0049.244] lstrlenA (lpString="*.hta") returned 5
	[0049.244] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.php7") returned 0
	[0049.244] lstrlenA (lpString="*.php7") returned 6
	[0049.244] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.db") returned 0
	[0049.244] lstrlenA (lpString="*.db") returned 4
	[0049.244] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.swf") returned 0
	[0049.244] lstrlenA (lpString="*.swf") returned 5
	[0049.244] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.eml") returned 0
	[0049.244] lstrlenA (lpString="*.eml") returned 5
	[0049.244] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.part") returned 0
	[0049.244] lstrlenA (lpString="*.part") returned 6
	[0049.244] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.nfo") returned 0
	[0049.244] lstrlenA (lpString="*.nfo") returned 5
	[0049.244] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.rsa") returned 0
	[0049.244] lstrlenA (lpString="*.rsa") returned 5
	[0049.244] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.key") returned 0
	[0049.244] lstrlenA (lpString="*.key") returned 5
	[0049.244] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.aes") returned 0
	[0049.244] lstrlenA (lpString="*.aes") returned 5
	[0049.244] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.blob") returned 0
	[0049.245] lstrlenA (lpString="*.blob") returned 6
	[0049.245] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.btc") returned 0
	[0049.245] lstrlenA (lpString="*.btc") returned 5
	[0049.245] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.wallet") returned 0
	[0049.245] lstrlenA (lpString="*.wallet") returned 8
	[0049.245] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0049.245] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.245] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="LocalizedData.xml") returned -1
	[0049.245] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="LocalizedData.xml") returned -1
	[0049.245] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1
	[0049.245] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned="eula.rtf"
	[0049.245] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\3082\\" | out: lpString1="C:\\588bce7c90097ed212\\3082\\") returned="C:\\588bce7c90097ed212\\3082\\"
	[0049.245] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\3082\\" | out: pszPath="C:\\588bce7c90097ed212\\3082\\") returned=""
	[0049.245] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\3082\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\3082\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\3082\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.245] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\3082\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\3082\\how-to-decrypt-files.htm")) returned 0x20
	[0049.245] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\3082\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml"
	[0049.245] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.zip") returned 0
	[0049.245] lstrlenA (lpString="*.zip") returned 5
	[0049.245] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.rar") returned 0
	[0049.245] lstrlenA (lpString="*.rar") returned 5
	[0049.245] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.7z") returned 0
	[0049.245] lstrlenA (lpString="*.7z") returned 4
	[0049.245] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.tar") returned 0
	[0049.245] lstrlenA (lpString="*.tar") returned 5
	[0049.245] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.gzip") returned 0
	[0049.245] lstrlenA (lpString="*.gzip") returned 6
	[0049.245] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.jpg") returned 0
	[0049.245] lstrlenA (lpString="*.jpg") returned 5
	[0049.245] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.jpeg") returned 0
	[0049.246] lstrlenA (lpString="*.jpeg") returned 6
	[0049.246] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.bmp") returned 0
	[0049.246] lstrlenA (lpString="*.bmp") returned 5
	[0049.246] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.gif") returned 0
	[0049.246] lstrlenA (lpString="*.gif") returned 5
	[0049.246] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.png") returned 0
	[0049.246] lstrlenA (lpString="*.png") returned 5
	[0049.246] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.doc") returned 0
	[0049.246] lstrlenA (lpString="*.doc") returned 5
	[0049.246] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.docx") returned 0
	[0049.246] lstrlenA (lpString="*.docx") returned 6
	[0049.246] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.xls") returned 0
	[0049.246] lstrlenA (lpString="*.xls") returned 5
	[0049.246] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.xlsx") returned 0
	[0049.246] lstrlenA (lpString="*.xlsx") returned 6
	[0049.246] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.ppt") returned 0
	[0049.246] lstrlenA (lpString="*.ppt") returned 5
	[0049.246] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.pptx") returned 0
	[0049.246] lstrlenA (lpString="*.pptx") returned 6
	[0049.246] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.txt") returned 0
	[0049.246] lstrlenA (lpString="*.txt") returned 5
	[0049.246] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.pdf") returned 0
	[0049.246] lstrlenA (lpString="*.pdf") returned 5
	[0049.246] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.htm") returned 0
	[0049.246] lstrlenA (lpString="*.htm") returned 5
	[0049.246] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.html") returned 0
	[0049.246] lstrlenA (lpString="*.html") returned 6
	[0049.246] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.mdb") returned 0
	[0049.246] lstrlenA (lpString="*.mdb") returned 5
	[0049.247] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.pfx") returned 0
	[0049.247] lstrlenA (lpString="*.pfx") returned 5
	[0049.247] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.md") returned 0
	[0049.247] lstrlenA (lpString="*.md") returned 4
	[0049.247] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.lnk") returned 0
	[0049.247] lstrlenA (lpString="*.lnk") returned 5
	[0049.247] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.torrent") returned 0
	[0049.247] lstrlenA (lpString="*.torrent") returned 9
	[0049.247] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.mov") returned 0
	[0049.247] lstrlenA (lpString="*.mov") returned 5
	[0049.247] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.3gp") returned 0
	[0049.247] lstrlenA (lpString="*.3gp") returned 5
	[0049.247] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.mpeg") returned 0
	[0049.247] lstrlenA (lpString="*.mpeg") returned 6
	[0049.247] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.mpg") returned 0
	[0049.247] lstrlenA (lpString="*.mpg") returned 5
	[0049.247] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.flv") returned 0
	[0049.247] lstrlenA (lpString="*.flv") returned 5
	[0049.247] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.avi") returned 0
	[0049.247] lstrlenA (lpString="*.avi") returned 5
	[0049.247] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.mp4") returned 0
	[0049.247] lstrlenA (lpString="*.mp4") returned 5
	[0049.247] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.wmv") returned 0
	[0049.247] lstrlenA (lpString="*.wmv") returned 5
	[0049.247] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.mkv") returned 0
	[0049.247] lstrlenA (lpString="*.mkv") returned 5
	[0049.247] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.mp3") returned 0
	[0049.248] lstrlenA (lpString="*.mp3") returned 5
	[0049.248] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.wav") returned 0
	[0049.248] lstrlenA (lpString="*.wav") returned 5
	[0049.248] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.flac") returned 0
	[0049.248] lstrlenA (lpString="*.flac") returned 6
	[0049.248] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.wma") returned 0
	[0049.248] lstrlenA (lpString="*.wma") returned 5
	[0049.248] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.au3") returned 0
	[0049.248] lstrlenA (lpString="*.au3") returned 5
	[0049.248] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.ahk") returned 0
	[0049.248] lstrlenA (lpString="*.ahk") returned 5
	[0049.248] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.c") returned 0
	[0049.248] lstrlenA (lpString="*.c") returned 3
	[0049.248] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.cc") returned 0
	[0049.248] lstrlenA (lpString="*.cc") returned 4
	[0049.248] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.cpp") returned 0
	[0049.248] lstrlenA (lpString="*.cpp") returned 5
	[0049.248] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.cxx") returned 0
	[0049.248] lstrlenA (lpString="*.cxx") returned 5
	[0049.248] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.c++") returned 0
	[0049.248] lstrlenA (lpString="*.c++") returned 5
	[0049.248] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.cs") returned 0
	[0049.248] lstrlenA (lpString="*.cs") returned 4
	[0049.248] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.vb") returned 0
	[0049.248] lstrlenA (lpString="*.vb") returned 4
	[0049.248] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.bas") returned 0
	[0049.248] lstrlenA (lpString="*.bas") returned 5
	[0049.248] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.csproj") returned 0
	[0049.248] lstrlenA (lpString="*.csproj") returned 8
	[0049.248] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.vbproj") returned 0
	[0049.248] lstrlenA (lpString="*.vbproj") returned 8
	[0049.248] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.vcxproj") returned 0
	[0049.248] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.248] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.manifest") returned 0
	[0049.248] lstrlenA (lpString="*.manifest") returned 10
	[0049.249] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.php") returned 0
	[0049.249] lstrlenA (lpString="*.php") returned 5
	[0049.249] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.vbe") returned 0
	[0049.249] lstrlenA (lpString="*.vbe") returned 5
	[0049.249] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.vba") returned 0
	[0049.249] lstrlenA (lpString="*.vba") returned 5
	[0049.249] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.vbs") returned 0
	[0049.249] lstrlenA (lpString="*.vbs") returned 5
	[0049.249] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.bat") returned 0
	[0049.249] lstrlenA (lpString="*.bat") returned 5
	[0049.249] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.cmd") returned 0
	[0049.249] lstrlenA (lpString="*.cmd") returned 5
	[0049.249] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.js") returned 0
	[0049.249] lstrlenA (lpString="*.js") returned 4
	[0049.249] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.jscript") returned 0
	[0049.249] lstrlenA (lpString="*.jscript") returned 9
	[0049.249] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.hta") returned 0
	[0049.249] lstrlenA (lpString="*.hta") returned 5
	[0049.249] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.php7") returned 0
	[0049.249] lstrlenA (lpString="*.php7") returned 6
	[0049.249] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.db") returned 0
	[0049.249] lstrlenA (lpString="*.db") returned 4
	[0049.249] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.swf") returned 0
	[0049.249] lstrlenA (lpString="*.swf") returned 5
	[0049.249] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.eml") returned 0
	[0049.249] lstrlenA (lpString="*.eml") returned 5
	[0049.249] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.part") returned 0
	[0049.249] lstrlenA (lpString="*.part") returned 6
	[0049.249] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.nfo") returned 0
	[0049.249] lstrlenA (lpString="*.nfo") returned 5
	[0049.249] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.rsa") returned 0
	[0049.249] lstrlenA (lpString="*.rsa") returned 5
	[0049.249] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.key") returned 0
	[0049.249] lstrlenA (lpString="*.key") returned 5
	[0049.249] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.aes") returned 0
	[0049.250] lstrlenA (lpString="*.aes") returned 5
	[0049.250] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.blob") returned 0
	[0049.250] lstrlenA (lpString="*.blob") returned 6
	[0049.250] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.btc") returned 0
	[0049.250] lstrlenA (lpString="*.btc") returned 5
	[0049.250] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.wallet") returned 0
	[0049.250] lstrlenA (lpString="*.wallet") returned 8
	[0049.250] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0049.250] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.250] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SetupResources.dll") returned -1
	[0049.250] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SetupResources.dll") returned -1
	[0049.250] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1
	[0049.250] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned="LocalizedData.xml"
	[0049.250] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\3082\\" | out: lpString1="C:\\588bce7c90097ed212\\3082\\") returned="C:\\588bce7c90097ed212\\3082\\"
	[0049.250] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\3082\\" | out: pszPath="C:\\588bce7c90097ed212\\3082\\") returned=""
	[0049.250] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\3082\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\3082\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\3082\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.250] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\3082\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\3082\\how-to-decrypt-files.htm")) returned 0x20
	[0049.250] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\3082\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\3082\\SetupResources.dll"
	[0049.250] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.zip") returned 0
	[0049.250] lstrlenA (lpString="*.zip") returned 5
	[0049.250] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.rar") returned 0
	[0049.250] lstrlenA (lpString="*.rar") returned 5
	[0049.250] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.7z") returned 0
	[0049.250] lstrlenA (lpString="*.7z") returned 4
	[0049.250] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.tar") returned 0
	[0049.250] lstrlenA (lpString="*.tar") returned 5
	[0049.250] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.gzip") returned 0
	[0049.250] lstrlenA (lpString="*.gzip") returned 6
	[0049.251] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.jpg") returned 0
	[0049.251] lstrlenA (lpString="*.jpg") returned 5
	[0049.251] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.jpeg") returned 0
	[0049.251] lstrlenA (lpString="*.jpeg") returned 6
	[0049.251] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.bmp") returned 0
	[0049.251] lstrlenA (lpString="*.bmp") returned 5
	[0049.251] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.gif") returned 0
	[0049.251] lstrlenA (lpString="*.gif") returned 5
	[0049.251] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.png") returned 0
	[0049.251] lstrlenA (lpString="*.png") returned 5
	[0049.251] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.doc") returned 0
	[0049.251] lstrlenA (lpString="*.doc") returned 5
	[0049.251] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.docx") returned 0
	[0049.251] lstrlenA (lpString="*.docx") returned 6
	[0049.251] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.xls") returned 0
	[0049.251] lstrlenA (lpString="*.xls") returned 5
	[0049.251] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.xlsx") returned 0
	[0049.251] lstrlenA (lpString="*.xlsx") returned 6
	[0049.251] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.ppt") returned 0
	[0049.251] lstrlenA (lpString="*.ppt") returned 5
	[0049.251] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.pptx") returned 0
	[0049.251] lstrlenA (lpString="*.pptx") returned 6
	[0049.251] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.txt") returned 0
	[0049.251] lstrlenA (lpString="*.txt") returned 5
	[0049.251] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.pdf") returned 0
	[0049.251] lstrlenA (lpString="*.pdf") returned 5
	[0049.251] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.htm") returned 0
	[0049.251] lstrlenA (lpString="*.htm") returned 5
	[0049.252] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.html") returned 0
	[0049.252] lstrlenA (lpString="*.html") returned 6
	[0049.252] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.mdb") returned 0
	[0049.252] lstrlenA (lpString="*.mdb") returned 5
	[0049.252] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.pfx") returned 0
	[0049.252] lstrlenA (lpString="*.pfx") returned 5
	[0049.252] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.md") returned 0
	[0049.252] lstrlenA (lpString="*.md") returned 4
	[0049.252] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.lnk") returned 0
	[0049.252] lstrlenA (lpString="*.lnk") returned 5
	[0049.252] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.torrent") returned 0
	[0049.252] lstrlenA (lpString="*.torrent") returned 9
	[0049.252] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.mov") returned 0
	[0049.252] lstrlenA (lpString="*.mov") returned 5
	[0049.252] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.3gp") returned 0
	[0049.252] lstrlenA (lpString="*.3gp") returned 5
	[0049.252] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.mpeg") returned 0
	[0049.252] lstrlenA (lpString="*.mpeg") returned 6
	[0049.252] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.mpg") returned 0
	[0049.252] lstrlenA (lpString="*.mpg") returned 5
	[0049.252] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.flv") returned 0
	[0049.252] lstrlenA (lpString="*.flv") returned 5
	[0049.252] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.avi") returned 0
	[0049.252] lstrlenA (lpString="*.avi") returned 5
	[0049.252] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.mp4") returned 0
	[0049.252] lstrlenA (lpString="*.mp4") returned 5
	[0049.252] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.wmv") returned 0
	[0049.252] lstrlenA (lpString="*.wmv") returned 5
	[0049.252] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.mkv") returned 0
	[0049.252] lstrlenA (lpString="*.mkv") returned 5
	[0049.252] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.mp3") returned 0
	[0049.252] lstrlenA (lpString="*.mp3") returned 5
	[0049.252] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.wav") returned 0
	[0049.252] lstrlenA (lpString="*.wav") returned 5
	[0049.253] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.flac") returned 0
	[0049.253] lstrlenA (lpString="*.flac") returned 6
	[0049.253] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.wma") returned 0
	[0049.253] lstrlenA (lpString="*.wma") returned 5
	[0049.253] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.au3") returned 0
	[0049.253] lstrlenA (lpString="*.au3") returned 5
	[0049.253] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.ahk") returned 0
	[0049.253] lstrlenA (lpString="*.ahk") returned 5
	[0049.253] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.c") returned 0
	[0049.253] lstrlenA (lpString="*.c") returned 3
	[0049.253] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.cc") returned 0
	[0049.253] lstrlenA (lpString="*.cc") returned 4
	[0049.253] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.cpp") returned 0
	[0049.253] lstrlenA (lpString="*.cpp") returned 5
	[0049.253] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.cxx") returned 0
	[0049.253] lstrlenA (lpString="*.cxx") returned 5
	[0049.253] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.c++") returned 0
	[0049.253] lstrlenA (lpString="*.c++") returned 5
	[0049.253] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.cs") returned 0
	[0049.253] lstrlenA (lpString="*.cs") returned 4
	[0049.253] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.vb") returned 0
	[0049.253] lstrlenA (lpString="*.vb") returned 4
	[0049.253] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.bas") returned 0
	[0049.253] lstrlenA (lpString="*.bas") returned 5
	[0049.253] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.csproj") returned 0
	[0049.253] lstrlenA (lpString="*.csproj") returned 8
	[0049.253] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.vbproj") returned 0
	[0049.253] lstrlenA (lpString="*.vbproj") returned 8
	[0049.253] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.vcxproj") returned 0
	[0049.253] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.253] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.manifest") returned 0
	[0049.253] lstrlenA (lpString="*.manifest") returned 10
	[0049.253] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.php") returned 0
	[0049.253] lstrlenA (lpString="*.php") returned 5
	[0049.253] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.vbe") returned 0
	[0049.253] lstrlenA (lpString="*.vbe") returned 5
	[0049.254] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.vba") returned 0
	[0049.254] lstrlenA (lpString="*.vba") returned 5
	[0049.254] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.vbs") returned 0
	[0049.254] lstrlenA (lpString="*.vbs") returned 5
	[0049.254] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.bat") returned 0
	[0049.254] lstrlenA (lpString="*.bat") returned 5
	[0049.254] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.cmd") returned 0
	[0049.254] lstrlenA (lpString="*.cmd") returned 5
	[0049.254] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.js") returned 0
	[0049.254] lstrlenA (lpString="*.js") returned 4
	[0049.254] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.jscript") returned 0
	[0049.254] lstrlenA (lpString="*.jscript") returned 9
	[0049.254] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.hta") returned 0
	[0049.254] lstrlenA (lpString="*.hta") returned 5
	[0049.254] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.php7") returned 0
	[0049.254] lstrlenA (lpString="*.php7") returned 6
	[0049.254] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.db") returned 0
	[0049.254] lstrlenA (lpString="*.db") returned 4
	[0049.254] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.swf") returned 0
	[0049.254] lstrlenA (lpString="*.swf") returned 5
	[0049.254] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.eml") returned 0
	[0049.254] lstrlenA (lpString="*.eml") returned 5
	[0049.254] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.part") returned 0
	[0049.254] lstrlenA (lpString="*.part") returned 6
	[0049.254] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.nfo") returned 0
	[0049.254] lstrlenA (lpString="*.nfo") returned 5
	[0049.254] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.rsa") returned 0
	[0049.254] lstrlenA (lpString="*.rsa") returned 5
	[0049.254] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.key") returned 0
	[0049.254] lstrlenA (lpString="*.key") returned 5
	[0049.254] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.aes") returned 0
	[0049.254] lstrlenA (lpString="*.aes") returned 5
	[0049.254] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.blob") returned 0
	[0049.254] lstrlenA (lpString="*.blob") returned 6
	[0049.254] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.btc") returned 0
	[0049.255] lstrlenA (lpString="*.btc") returned 5
	[0049.255] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.wallet") returned 0
	[0049.255] lstrlenA (lpString="*.wallet") returned 8
	[0049.255] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0049.255] FindClose (in: hFindFile=0x7cb790 | out: hFindFile=0x7cb790) returned 1
	[0049.255] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d1d40, dwReserved1=0x7b00c0, cFileName="Client", cAlternateFileName="")) returned 1
	[0049.255] lstrcmpA (lpString1=".", lpString2="Client") returned -1
	[0049.255] lstrcmpA (lpString1="..", lpString2="Client") returned -1
	[0049.255] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*"
	[0049.255] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="Client" | out: lpString1="C:\\588bce7c90097ed212\\Client") returned="C:\\588bce7c90097ed212\\Client"
	[0049.255] lstrlenA (lpString="C:\\588bce7c90097ed212\\Client") returned 28
	[0049.255] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbad0
	[0049.256] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0049.256] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0049.256] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0049.256] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0049.256] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1
	[0049.256] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.256] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Parameterinfo.xml") returned -1
	[0049.256] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Parameterinfo.xml") returned -1
	[0049.256] lstrcmpiA (lpString1="", lpString2="Parameterinfo.xml") returned -1
	[0049.257] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Client\\*.*") returned="*.*"
	[0049.257] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\Client\\" | out: lpString1="C:\\588bce7c90097ed212\\Client\\") returned="C:\\588bce7c90097ed212\\Client\\"
	[0049.257] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\Client\\" | out: pszPath="C:\\588bce7c90097ed212\\Client\\") returned=""
	[0049.257] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Client\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\Client\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\Client\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.257] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\Client\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\client\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0049.257] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\Client\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\client\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0049.257] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0049.257] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0049.258] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0049.258] CloseHandle (hObject=0x208) returned 1
	[0049.258] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Client\\", lpString2="Parameterinfo.xml" | out: lpString1="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml"
	[0049.258] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.zip") returned 0
	[0049.258] lstrlenA (lpString="*.zip") returned 5
	[0049.258] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.rar") returned 0
	[0049.258] lstrlenA (lpString="*.rar") returned 5
	[0049.258] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.7z") returned 0
	[0049.258] lstrlenA (lpString="*.7z") returned 4
	[0049.259] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.tar") returned 0
	[0049.259] lstrlenA (lpString="*.tar") returned 5
	[0049.259] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.gzip") returned 0
	[0049.259] lstrlenA (lpString="*.gzip") returned 6
	[0049.259] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.jpg") returned 0
	[0049.259] lstrlenA (lpString="*.jpg") returned 5
	[0049.259] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.jpeg") returned 0
	[0049.259] lstrlenA (lpString="*.jpeg") returned 6
	[0049.259] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.bmp") returned 0
	[0049.259] lstrlenA (lpString="*.bmp") returned 5
	[0049.259] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.gif") returned 0
	[0049.259] lstrlenA (lpString="*.gif") returned 5
	[0049.259] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.png") returned 0
	[0049.259] lstrlenA (lpString="*.png") returned 5
	[0049.259] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.doc") returned 0
	[0049.259] lstrlenA (lpString="*.doc") returned 5
	[0049.259] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.docx") returned 0
	[0049.259] lstrlenA (lpString="*.docx") returned 6
	[0049.259] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.xls") returned 0
	[0049.259] lstrlenA (lpString="*.xls") returned 5
	[0049.259] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.xlsx") returned 0
	[0049.259] lstrlenA (lpString="*.xlsx") returned 6
	[0049.259] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.ppt") returned 0
	[0049.259] lstrlenA (lpString="*.ppt") returned 5
	[0049.259] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.pptx") returned 0
	[0049.259] lstrlenA (lpString="*.pptx") returned 6
	[0049.259] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.txt") returned 0
	[0049.259] lstrlenA (lpString="*.txt") returned 5
	[0049.259] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.pdf") returned 0
	[0049.259] lstrlenA (lpString="*.pdf") returned 5
	[0049.259] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.htm") returned 0
	[0049.259] lstrlenA (lpString="*.htm") returned 5
	[0049.259] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.html") returned 0
	[0049.259] lstrlenA (lpString="*.html") returned 6
	[0049.260] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.mdb") returned 0
	[0049.260] lstrlenA (lpString="*.mdb") returned 5
	[0049.260] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.pfx") returned 0
	[0049.260] lstrlenA (lpString="*.pfx") returned 5
	[0049.260] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.md") returned 0
	[0049.260] lstrlenA (lpString="*.md") returned 4
	[0049.260] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.lnk") returned 0
	[0049.260] lstrlenA (lpString="*.lnk") returned 5
	[0049.260] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.torrent") returned 0
	[0049.260] lstrlenA (lpString="*.torrent") returned 9
	[0049.260] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.mov") returned 0
	[0049.260] lstrlenA (lpString="*.mov") returned 5
	[0049.260] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.3gp") returned 0
	[0049.260] lstrlenA (lpString="*.3gp") returned 5
	[0049.260] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.mpeg") returned 0
	[0049.260] lstrlenA (lpString="*.mpeg") returned 6
	[0049.260] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.mpg") returned 0
	[0049.260] lstrlenA (lpString="*.mpg") returned 5
	[0049.260] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.flv") returned 0
	[0049.260] lstrlenA (lpString="*.flv") returned 5
	[0049.260] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.avi") returned 0
	[0049.260] lstrlenA (lpString="*.avi") returned 5
	[0049.260] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.mp4") returned 0
	[0049.260] lstrlenA (lpString="*.mp4") returned 5
	[0049.260] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.wmv") returned 0
	[0049.260] lstrlenA (lpString="*.wmv") returned 5
	[0049.260] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.mkv") returned 0
	[0049.260] lstrlenA (lpString="*.mkv") returned 5
	[0049.260] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.mp3") returned 0
	[0049.260] lstrlenA (lpString="*.mp3") returned 5
	[0049.260] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.wav") returned 0
	[0049.260] lstrlenA (lpString="*.wav") returned 5
	[0049.260] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.flac") returned 0
	[0049.260] lstrlenA (lpString="*.flac") returned 6
	[0049.260] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.wma") returned 0
	[0049.260] lstrlenA (lpString="*.wma") returned 5
	[0049.261] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.au3") returned 0
	[0049.261] lstrlenA (lpString="*.au3") returned 5
	[0049.261] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.ahk") returned 0
	[0049.261] lstrlenA (lpString="*.ahk") returned 5
	[0049.261] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.c") returned 0
	[0049.261] lstrlenA (lpString="*.c") returned 3
	[0049.261] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.cc") returned 0
	[0049.261] lstrlenA (lpString="*.cc") returned 4
	[0049.261] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.cpp") returned 0
	[0049.261] lstrlenA (lpString="*.cpp") returned 5
	[0049.261] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.cxx") returned 0
	[0049.261] lstrlenA (lpString="*.cxx") returned 5
	[0049.261] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.c++") returned 0
	[0049.261] lstrlenA (lpString="*.c++") returned 5
	[0049.261] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.cs") returned 0
	[0049.261] lstrlenA (lpString="*.cs") returned 4
	[0049.261] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.vb") returned 0
	[0049.261] lstrlenA (lpString="*.vb") returned 4
	[0049.261] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.bas") returned 0
	[0049.261] lstrlenA (lpString="*.bas") returned 5
	[0049.261] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.csproj") returned 0
	[0049.261] lstrlenA (lpString="*.csproj") returned 8
	[0049.261] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.vbproj") returned 0
	[0049.261] lstrlenA (lpString="*.vbproj") returned 8
	[0049.261] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.vcxproj") returned 0
	[0049.261] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.261] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.manifest") returned 0
	[0049.261] lstrlenA (lpString="*.manifest") returned 10
	[0049.261] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.php") returned 0
	[0049.261] lstrlenA (lpString="*.php") returned 5
	[0049.261] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.vbe") returned 0
	[0049.261] lstrlenA (lpString="*.vbe") returned 5
	[0049.261] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.vba") returned 0
	[0049.261] lstrlenA (lpString="*.vba") returned 5
	[0049.261] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.vbs") returned 0
	[0049.262] lstrlenA (lpString="*.vbs") returned 5
	[0049.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.bat") returned 0
	[0049.262] lstrlenA (lpString="*.bat") returned 5
	[0049.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.cmd") returned 0
	[0049.262] lstrlenA (lpString="*.cmd") returned 5
	[0049.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.js") returned 0
	[0049.262] lstrlenA (lpString="*.js") returned 4
	[0049.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.jscript") returned 0
	[0049.262] lstrlenA (lpString="*.jscript") returned 9
	[0049.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.hta") returned 0
	[0049.262] lstrlenA (lpString="*.hta") returned 5
	[0049.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.php7") returned 0
	[0049.262] lstrlenA (lpString="*.php7") returned 6
	[0049.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.db") returned 0
	[0049.262] lstrlenA (lpString="*.db") returned 4
	[0049.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.swf") returned 0
	[0049.262] lstrlenA (lpString="*.swf") returned 5
	[0049.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.eml") returned 0
	[0049.262] lstrlenA (lpString="*.eml") returned 5
	[0049.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.part") returned 0
	[0049.262] lstrlenA (lpString="*.part") returned 6
	[0049.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.nfo") returned 0
	[0049.262] lstrlenA (lpString="*.nfo") returned 5
	[0049.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.rsa") returned 0
	[0049.262] lstrlenA (lpString="*.rsa") returned 5
	[0049.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.key") returned 0
	[0049.262] lstrlenA (lpString="*.key") returned 5
	[0049.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.aes") returned 0
	[0049.262] lstrlenA (lpString="*.aes") returned 5
	[0049.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.blob") returned 0
	[0049.262] lstrlenA (lpString="*.blob") returned 6
	[0049.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.btc") returned 0
	[0049.262] lstrlenA (lpString="*.btc") returned 5
	[0049.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.wallet") returned 0
	[0049.263] lstrlenA (lpString="*.wallet") returned 8
	[0049.263] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x1, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1
	[0049.263] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.263] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="UiInfo.xml") returned -1
	[0049.263] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="UiInfo.xml") returned -1
	[0049.263] lstrcmpiA (lpString1="", lpString2="UiInfo.xml") returned -1
	[0049.263] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned="Parameterinfo.xml"
	[0049.263] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\Client\\" | out: lpString1="C:\\588bce7c90097ed212\\Client\\") returned="C:\\588bce7c90097ed212\\Client\\"
	[0049.263] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\Client\\" | out: pszPath="C:\\588bce7c90097ed212\\Client\\") returned=""
	[0049.263] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Client\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\Client\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\Client\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.263] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\Client\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\client\\how-to-decrypt-files.htm")) returned 0x20
	[0049.263] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Client\\", lpString2="UiInfo.xml" | out: lpString1="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned="C:\\588bce7c90097ed212\\Client\\UiInfo.xml"
	[0049.263] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.zip") returned 0
	[0049.263] lstrlenA (lpString="*.zip") returned 5
	[0049.263] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.rar") returned 0
	[0049.263] lstrlenA (lpString="*.rar") returned 5
	[0049.263] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.7z") returned 0
	[0049.263] lstrlenA (lpString="*.7z") returned 4
	[0049.263] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.tar") returned 0
	[0049.263] lstrlenA (lpString="*.tar") returned 5
	[0049.263] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.gzip") returned 0
	[0049.263] lstrlenA (lpString="*.gzip") returned 6
	[0049.263] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.jpg") returned 0
	[0049.263] lstrlenA (lpString="*.jpg") returned 5
	[0049.263] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.jpeg") returned 0
	[0049.263] lstrlenA (lpString="*.jpeg") returned 6
	[0049.263] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.bmp") returned 0
	[0049.263] lstrlenA (lpString="*.bmp") returned 5
	[0049.263] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.gif") returned 0
	[0049.263] lstrlenA (lpString="*.gif") returned 5
	[0049.264] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.png") returned 0
	[0049.264] lstrlenA (lpString="*.png") returned 5
	[0049.264] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.doc") returned 0
	[0049.264] lstrlenA (lpString="*.doc") returned 5
	[0049.264] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.docx") returned 0
	[0049.264] lstrlenA (lpString="*.docx") returned 6
	[0049.264] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.xls") returned 0
	[0049.264] lstrlenA (lpString="*.xls") returned 5
	[0049.264] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.xlsx") returned 0
	[0049.264] lstrlenA (lpString="*.xlsx") returned 6
	[0049.264] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.ppt") returned 0
	[0049.264] lstrlenA (lpString="*.ppt") returned 5
	[0049.264] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.pptx") returned 0
	[0049.264] lstrlenA (lpString="*.pptx") returned 6
	[0049.264] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.txt") returned 0
	[0049.264] lstrlenA (lpString="*.txt") returned 5
	[0049.264] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.pdf") returned 0
	[0049.264] lstrlenA (lpString="*.pdf") returned 5
	[0049.264] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.htm") returned 0
	[0049.264] lstrlenA (lpString="*.htm") returned 5
	[0049.264] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.html") returned 0
	[0049.264] lstrlenA (lpString="*.html") returned 6
	[0049.264] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.mdb") returned 0
	[0049.264] lstrlenA (lpString="*.mdb") returned 5
	[0049.264] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.pfx") returned 0
	[0049.264] lstrlenA (lpString="*.pfx") returned 5
	[0049.264] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.md") returned 0
	[0049.264] lstrlenA (lpString="*.md") returned 4
	[0049.264] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.lnk") returned 0
	[0049.264] lstrlenA (lpString="*.lnk") returned 5
	[0049.264] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.torrent") returned 0
	[0049.264] lstrlenA (lpString="*.torrent") returned 9
	[0049.264] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.mov") returned 0
	[0049.264] lstrlenA (lpString="*.mov") returned 5
	[0049.265] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.3gp") returned 0
	[0049.265] lstrlenA (lpString="*.3gp") returned 5
	[0049.265] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.mpeg") returned 0
	[0049.265] lstrlenA (lpString="*.mpeg") returned 6
	[0049.265] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.mpg") returned 0
	[0049.265] lstrlenA (lpString="*.mpg") returned 5
	[0049.265] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.flv") returned 0
	[0049.265] lstrlenA (lpString="*.flv") returned 5
	[0049.265] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.avi") returned 0
	[0049.265] lstrlenA (lpString="*.avi") returned 5
	[0049.265] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.mp4") returned 0
	[0049.265] lstrlenA (lpString="*.mp4") returned 5
	[0049.265] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.wmv") returned 0
	[0049.265] lstrlenA (lpString="*.wmv") returned 5
	[0049.265] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.mkv") returned 0
	[0049.265] lstrlenA (lpString="*.mkv") returned 5
	[0049.265] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.mp3") returned 0
	[0049.265] lstrlenA (lpString="*.mp3") returned 5
	[0049.265] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.wav") returned 0
	[0049.265] lstrlenA (lpString="*.wav") returned 5
	[0049.265] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.flac") returned 0
	[0049.265] lstrlenA (lpString="*.flac") returned 6
	[0049.265] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.wma") returned 0
	[0049.265] lstrlenA (lpString="*.wma") returned 5
	[0049.265] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.au3") returned 0
	[0049.265] lstrlenA (lpString="*.au3") returned 5
	[0049.265] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.ahk") returned 0
	[0049.265] lstrlenA (lpString="*.ahk") returned 5
	[0049.265] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.c") returned 0
	[0049.265] lstrlenA (lpString="*.c") returned 3
	[0049.265] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.cc") returned 0
	[0049.265] lstrlenA (lpString="*.cc") returned 4
	[0049.265] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.cpp") returned 0
	[0049.265] lstrlenA (lpString="*.cpp") returned 5
	[0049.265] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.cxx") returned 0
	[0049.266] lstrlenA (lpString="*.cxx") returned 5
	[0049.266] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.c++") returned 0
	[0049.266] lstrlenA (lpString="*.c++") returned 5
	[0049.266] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.cs") returned 0
	[0049.266] lstrlenA (lpString="*.cs") returned 4
	[0049.266] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.vb") returned 0
	[0049.266] lstrlenA (lpString="*.vb") returned 4
	[0049.266] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.bas") returned 0
	[0049.266] lstrlenA (lpString="*.bas") returned 5
	[0049.266] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.csproj") returned 0
	[0049.266] lstrlenA (lpString="*.csproj") returned 8
	[0049.266] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.vbproj") returned 0
	[0049.266] lstrlenA (lpString="*.vbproj") returned 8
	[0049.266] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.vcxproj") returned 0
	[0049.266] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.266] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.manifest") returned 0
	[0049.266] lstrlenA (lpString="*.manifest") returned 10
	[0049.266] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.php") returned 0
	[0049.266] lstrlenA (lpString="*.php") returned 5
	[0049.266] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.vbe") returned 0
	[0049.266] lstrlenA (lpString="*.vbe") returned 5
	[0049.266] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.vba") returned 0
	[0049.266] lstrlenA (lpString="*.vba") returned 5
	[0049.266] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.vbs") returned 0
	[0049.266] lstrlenA (lpString="*.vbs") returned 5
	[0049.266] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.bat") returned 0
	[0049.266] lstrlenA (lpString="*.bat") returned 5
	[0049.266] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.cmd") returned 0
	[0049.266] lstrlenA (lpString="*.cmd") returned 5
	[0049.266] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.js") returned 0
	[0049.266] lstrlenA (lpString="*.js") returned 4
	[0049.266] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.jscript") returned 0
	[0049.266] lstrlenA (lpString="*.jscript") returned 9
	[0049.266] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.hta") returned 0
	[0049.267] lstrlenA (lpString="*.hta") returned 5
	[0049.267] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.php7") returned 0
	[0049.267] lstrlenA (lpString="*.php7") returned 6
	[0049.267] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.db") returned 0
	[0049.267] lstrlenA (lpString="*.db") returned 4
	[0049.267] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.swf") returned 0
	[0049.267] lstrlenA (lpString="*.swf") returned 5
	[0049.267] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.eml") returned 0
	[0049.267] lstrlenA (lpString="*.eml") returned 5
	[0049.267] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.part") returned 0
	[0049.267] lstrlenA (lpString="*.part") returned 6
	[0049.267] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.nfo") returned 0
	[0049.267] lstrlenA (lpString="*.nfo") returned 5
	[0049.267] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.rsa") returned 0
	[0049.267] lstrlenA (lpString="*.rsa") returned 5
	[0049.267] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.key") returned 0
	[0049.267] lstrlenA (lpString="*.key") returned 5
	[0049.267] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.aes") returned 0
	[0049.267] lstrlenA (lpString="*.aes") returned 5
	[0049.267] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.blob") returned 0
	[0049.267] lstrlenA (lpString="*.blob") returned 6
	[0049.267] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.btc") returned 0
	[0049.267] lstrlenA (lpString="*.btc") returned 5
	[0049.267] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.wallet") returned 0
	[0049.267] lstrlenA (lpString="*.wallet") returned 8
	[0049.267] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x1, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0
	[0049.267] FindClose (in: hFindFile=0x7cbad0 | out: hFindFile=0x7cbad0) returned 1
	[0049.267] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x7d1d40, dwReserved1=0x7b00c0, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1
	[0049.267] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0049.267] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="DHtmlHeader.html") returned 1
	[0049.267] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="DHtmlHeader.html") returned 1
	[0049.268] lstrcmpiA (lpString1="", lpString2="DHtmlHeader.html") returned -1
	[0049.268] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*"
	[0049.268] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0049.268] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned=""
	[0049.268] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.268] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0049.268] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0049.268] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0049.268] WriteFile (in: hFile=0x204, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0049.269] SetFileTime (hFile=0x204, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0049.269] CloseHandle (hObject=0x204) returned 1
	[0049.269] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="DHtmlHeader.html" | out: lpString1="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned="C:\\588bce7c90097ed212\\DHtmlHeader.html"
	[0049.269] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.zip") returned 0
	[0049.269] lstrlenA (lpString="*.zip") returned 5
	[0049.269] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.rar") returned 0
	[0049.269] lstrlenA (lpString="*.rar") returned 5
	[0049.269] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.7z") returned 0
	[0049.269] lstrlenA (lpString="*.7z") returned 4
	[0049.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.tar") returned 0
	[0049.270] lstrlenA (lpString="*.tar") returned 5
	[0049.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.gzip") returned 0
	[0049.270] lstrlenA (lpString="*.gzip") returned 6
	[0049.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.jpg") returned 0
	[0049.270] lstrlenA (lpString="*.jpg") returned 5
	[0049.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.jpeg") returned 0
	[0049.270] lstrlenA (lpString="*.jpeg") returned 6
	[0049.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.bmp") returned 0
	[0049.270] lstrlenA (lpString="*.bmp") returned 5
	[0049.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.gif") returned 0
	[0049.270] lstrlenA (lpString="*.gif") returned 5
	[0049.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.png") returned 0
	[0049.270] lstrlenA (lpString="*.png") returned 5
	[0049.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.doc") returned 0
	[0049.270] lstrlenA (lpString="*.doc") returned 5
	[0049.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.docx") returned 0
	[0049.270] lstrlenA (lpString="*.docx") returned 6
	[0049.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.xls") returned 0
	[0049.270] lstrlenA (lpString="*.xls") returned 5
	[0049.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.xlsx") returned 0
	[0049.270] lstrlenA (lpString="*.xlsx") returned 6
	[0049.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.ppt") returned 0
	[0049.270] lstrlenA (lpString="*.ppt") returned 5
	[0049.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.pptx") returned 0
	[0049.270] lstrlenA (lpString="*.pptx") returned 6
	[0049.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.txt") returned 0
	[0049.270] lstrlenA (lpString="*.txt") returned 5
	[0049.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.pdf") returned 0
	[0049.270] lstrlenA (lpString="*.pdf") returned 5
	[0049.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.htm") returned 0
	[0049.270] lstrlenA (lpString="*.htm") returned 5
	[0049.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.html") returned 1
	[0049.270] lstrlenA (lpString="*.html") returned 6
	[0049.271] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\588bce7c90097ed212\\DHtmlHeader.html" | out: lpString1="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned="C:\\588bce7c90097ed212\\DHtmlHeader.html"
	[0049.271] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\588bce7c90097ed212\\DHtmlHeader.html" | out: lpString1="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned="C:\\588bce7c90097ed212\\DHtmlHeader.html"
	[0049.271] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\DHtmlHeader.html", lpString2="." | out: lpString1="C:\\588bce7c90097ed212\\DHtmlHeader.html.") returned="C:\\588bce7c90097ed212\\DHtmlHeader.html."
	[0049.271] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\DHtmlHeader.html.", lpString2="exe" | out: lpString1="C:\\588bce7c90097ed212\\DHtmlHeader.html.exe") returned="C:\\588bce7c90097ed212\\DHtmlHeader.html.exe"
	[0049.271] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0049.296] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ef6
	[0049.296] GetFileTime (in: hFile=0x204, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xbc518d00, dwHighDateTime=0x1ca2a28), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc518d00, dwHighDateTime=0x1ca2a28), lpLastWriteTime=0x40753e*(dwLowDateTime=0xbc518d00, dwHighDateTime=0x1ca2a28)) returned 1
	[0049.296] SetFilePointer (in: hFile=0x204, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0049.296] ReadFile (in: hFile=0x204, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x3eb4, lpOverlapped=0x0) returned 1
	[0049.298] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned="DHtmlHeader.html"
	[0049.298] SetFilePointer (in: hFile=0x204, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0049.298] WriteFile (in: hFile=0x204, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x3eb4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x3eb4, lpOverlapped=0x0) returned 1
	[0049.298] SetFileTime (hFile=0x204, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.299] CloseHandle (hObject=0x204) returned 1
	[0049.300] MoveFileA (lpExistingFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), lpNewFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.exe" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.exe")) returned 1
	[0049.300] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x15, dwReserved1=0x1, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1
	[0049.300] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0049.300] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="DisplayIcon.ico") returned 1
	[0049.300] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="DisplayIcon.ico") returned 1
	[0049.300] lstrcmpiA (lpString1="", lpString2="DisplayIcon.ico") returned -1
	[0049.300] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned="DHtmlHeader.html"
	[0049.300] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0049.300] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned=""
	[0049.301] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.301] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\how-to-decrypt-files.htm")) returned 0x20
	[0049.301] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="DisplayIcon.ico" | out: lpString1="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned="C:\\588bce7c90097ed212\\DisplayIcon.ico"
	[0049.301] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.zip") returned 0
	[0049.301] lstrlenA (lpString="*.zip") returned 5
	[0049.301] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.rar") returned 0
	[0049.301] lstrlenA (lpString="*.rar") returned 5
	[0049.301] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.7z") returned 0
	[0049.301] lstrlenA (lpString="*.7z") returned 4
	[0049.301] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.tar") returned 0
	[0049.301] lstrlenA (lpString="*.tar") returned 5
	[0049.301] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.gzip") returned 0
	[0049.301] lstrlenA (lpString="*.gzip") returned 6
	[0049.301] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.jpg") returned 0
	[0049.301] lstrlenA (lpString="*.jpg") returned 5
	[0049.301] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.jpeg") returned 0
	[0049.301] lstrlenA (lpString="*.jpeg") returned 6
	[0049.301] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.bmp") returned 0
	[0049.301] lstrlenA (lpString="*.bmp") returned 5
	[0049.301] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.gif") returned 0
	[0049.301] lstrlenA (lpString="*.gif") returned 5
	[0049.301] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.png") returned 0
	[0049.301] lstrlenA (lpString="*.png") returned 5
	[0049.301] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.doc") returned 0
	[0049.301] lstrlenA (lpString="*.doc") returned 5
	[0049.301] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.docx") returned 0
	[0049.301] lstrlenA (lpString="*.docx") returned 6
	[0049.301] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.xls") returned 0
	[0049.301] lstrlenA (lpString="*.xls") returned 5
	[0049.301] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.xlsx") returned 0
	[0049.301] lstrlenA (lpString="*.xlsx") returned 6
	[0049.301] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.ppt") returned 0
	[0049.302] lstrlenA (lpString="*.ppt") returned 5
	[0049.302] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.pptx") returned 0
	[0049.302] lstrlenA (lpString="*.pptx") returned 6
	[0049.302] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.txt") returned 0
	[0049.302] lstrlenA (lpString="*.txt") returned 5
	[0049.302] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.pdf") returned 0
	[0049.302] lstrlenA (lpString="*.pdf") returned 5
	[0049.302] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.htm") returned 0
	[0049.302] lstrlenA (lpString="*.htm") returned 5
	[0049.302] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.html") returned 0
	[0049.302] lstrlenA (lpString="*.html") returned 6
	[0049.302] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.mdb") returned 0
	[0049.302] lstrlenA (lpString="*.mdb") returned 5
	[0049.302] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.pfx") returned 0
	[0049.302] lstrlenA (lpString="*.pfx") returned 5
	[0049.302] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.md") returned 0
	[0049.302] lstrlenA (lpString="*.md") returned 4
	[0049.302] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.lnk") returned 0
	[0049.302] lstrlenA (lpString="*.lnk") returned 5
	[0049.302] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.torrent") returned 0
	[0049.302] lstrlenA (lpString="*.torrent") returned 9
	[0049.302] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.mov") returned 0
	[0049.302] lstrlenA (lpString="*.mov") returned 5
	[0049.302] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.3gp") returned 0
	[0049.302] lstrlenA (lpString="*.3gp") returned 5
	[0049.302] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.mpeg") returned 0
	[0049.302] lstrlenA (lpString="*.mpeg") returned 6
	[0049.302] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.mpg") returned 0
	[0049.302] lstrlenA (lpString="*.mpg") returned 5
	[0049.302] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.flv") returned 0
	[0049.302] lstrlenA (lpString="*.flv") returned 5
	[0049.302] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.avi") returned 0
	[0049.303] lstrlenA (lpString="*.avi") returned 5
	[0049.303] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.mp4") returned 0
	[0049.303] lstrlenA (lpString="*.mp4") returned 5
	[0049.303] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.wmv") returned 0
	[0049.303] lstrlenA (lpString="*.wmv") returned 5
	[0049.303] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.mkv") returned 0
	[0049.303] lstrlenA (lpString="*.mkv") returned 5
	[0049.303] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.mp3") returned 0
	[0049.303] lstrlenA (lpString="*.mp3") returned 5
	[0049.303] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.wav") returned 0
	[0049.303] lstrlenA (lpString="*.wav") returned 5
	[0049.303] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.flac") returned 0
	[0049.303] lstrlenA (lpString="*.flac") returned 6
	[0049.303] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.wma") returned 0
	[0049.303] lstrlenA (lpString="*.wma") returned 5
	[0049.303] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.au3") returned 0
	[0049.303] lstrlenA (lpString="*.au3") returned 5
	[0049.303] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.ahk") returned 0
	[0049.303] lstrlenA (lpString="*.ahk") returned 5
	[0049.303] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.c") returned 0
	[0049.303] lstrlenA (lpString="*.c") returned 3
	[0049.303] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.cc") returned 0
	[0049.303] lstrlenA (lpString="*.cc") returned 4
	[0049.303] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.cpp") returned 0
	[0049.303] lstrlenA (lpString="*.cpp") returned 5
	[0049.303] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.cxx") returned 0
	[0049.303] lstrlenA (lpString="*.cxx") returned 5
	[0049.303] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.c++") returned 0
	[0049.303] lstrlenA (lpString="*.c++") returned 5
	[0049.303] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.cs") returned 0
	[0049.303] lstrlenA (lpString="*.cs") returned 4
	[0049.303] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.vb") returned 0
	[0049.303] lstrlenA (lpString="*.vb") returned 4
	[0049.303] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.bas") returned 0
	[0049.303] lstrlenA (lpString="*.bas") returned 5
	[0049.304] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.csproj") returned 0
	[0049.304] lstrlenA (lpString="*.csproj") returned 8
	[0049.304] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.vbproj") returned 0
	[0049.304] lstrlenA (lpString="*.vbproj") returned 8
	[0049.304] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.vcxproj") returned 0
	[0049.304] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.304] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.manifest") returned 0
	[0049.304] lstrlenA (lpString="*.manifest") returned 10
	[0049.304] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.php") returned 0
	[0049.304] lstrlenA (lpString="*.php") returned 5
	[0049.304] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.vbe") returned 0
	[0049.304] lstrlenA (lpString="*.vbe") returned 5
	[0049.304] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.vba") returned 0
	[0049.304] lstrlenA (lpString="*.vba") returned 5
	[0049.304] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.vbs") returned 0
	[0049.304] lstrlenA (lpString="*.vbs") returned 5
	[0049.304] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.bat") returned 0
	[0049.304] lstrlenA (lpString="*.bat") returned 5
	[0049.304] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.cmd") returned 0
	[0049.304] lstrlenA (lpString="*.cmd") returned 5
	[0049.304] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.js") returned 0
	[0049.304] lstrlenA (lpString="*.js") returned 4
	[0049.304] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.jscript") returned 0
	[0049.304] lstrlenA (lpString="*.jscript") returned 9
	[0049.304] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.hta") returned 0
	[0049.304] lstrlenA (lpString="*.hta") returned 5
	[0049.304] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.php7") returned 0
	[0049.304] lstrlenA (lpString="*.php7") returned 6
	[0049.304] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.db") returned 0
	[0049.304] lstrlenA (lpString="*.db") returned 4
	[0049.304] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.swf") returned 0
	[0049.304] lstrlenA (lpString="*.swf") returned 5
	[0049.304] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.eml") returned 0
	[0049.304] lstrlenA (lpString="*.eml") returned 5
	[0049.304] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.part") returned 0
	[0049.304] lstrlenA (lpString="*.part") returned 6
	[0049.305] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.nfo") returned 0
	[0049.305] lstrlenA (lpString="*.nfo") returned 5
	[0049.305] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.rsa") returned 0
	[0049.305] lstrlenA (lpString="*.rsa") returned 5
	[0049.305] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.key") returned 0
	[0049.305] lstrlenA (lpString="*.key") returned 5
	[0049.305] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.aes") returned 0
	[0049.305] lstrlenA (lpString="*.aes") returned 5
	[0049.305] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.blob") returned 0
	[0049.305] lstrlenA (lpString="*.blob") returned 6
	[0049.305] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.btc") returned 0
	[0049.305] lstrlenA (lpString="*.btc") returned 5
	[0049.305] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.wallet") returned 0
	[0049.305] lstrlenA (lpString="*.wallet") returned 8
	[0049.305] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Extended", cAlternateFileName="")) returned 1
	[0049.305] lstrcmpA (lpString1=".", lpString2="Extended") returned -1
	[0049.305] lstrcmpA (lpString1="..", lpString2="Extended") returned -1
	[0049.305] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned="DisplayIcon.ico"
	[0049.305] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="Extended" | out: lpString1="C:\\588bce7c90097ed212\\Extended") returned="C:\\588bce7c90097ed212\\Extended"
	[0049.305] lstrlenA (lpString="C:\\588bce7c90097ed212\\Extended") returned 30
	[0049.305] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x70, cFileName=".", cAlternateFileName="")) returned 0x7cbad0
	[0049.305] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0049.305] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x70, cFileName="..", cAlternateFileName="")) returned 1
	[0049.305] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0049.306] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0049.306] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x7b0000, dwReserved1=0x70, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1
	[0049.306] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.306] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Parameterinfo.xml") returned -1
	[0049.306] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Parameterinfo.xml") returned -1
	[0049.306] lstrcmpiA (lpString1="", lpString2="Parameterinfo.xml") returned -1
	[0049.306] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Extended\\*.*") returned="*.*"
	[0049.306] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\Extended\\" | out: lpString1="C:\\588bce7c90097ed212\\Extended\\") returned="C:\\588bce7c90097ed212\\Extended\\"
	[0049.306] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\Extended\\" | out: pszPath="C:\\588bce7c90097ed212\\Extended\\") returned=""
	[0049.306] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Extended\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\Extended\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\Extended\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.306] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\Extended\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\extended\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0049.306] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\Extended\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\extended\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0049.307] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0049.307] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0049.308] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0049.308] CloseHandle (hObject=0x208) returned 1
	[0049.308] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Extended\\", lpString2="Parameterinfo.xml" | out: lpString1="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml"
	[0049.308] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.zip") returned 0
	[0049.308] lstrlenA (lpString="*.zip") returned 5
	[0049.308] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.rar") returned 0
	[0049.308] lstrlenA (lpString="*.rar") returned 5
	[0049.308] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.7z") returned 0
	[0049.308] lstrlenA (lpString="*.7z") returned 4
	[0049.308] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.tar") returned 0
	[0049.308] lstrlenA (lpString="*.tar") returned 5
	[0049.308] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.gzip") returned 0
	[0049.308] lstrlenA (lpString="*.gzip") returned 6
	[0049.308] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.jpg") returned 0
	[0049.308] lstrlenA (lpString="*.jpg") returned 5
	[0049.308] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.jpeg") returned 0
	[0049.308] lstrlenA (lpString="*.jpeg") returned 6
	[0049.308] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.bmp") returned 0
	[0049.308] lstrlenA (lpString="*.bmp") returned 5
	[0049.308] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.gif") returned 0
	[0049.308] lstrlenA (lpString="*.gif") returned 5
	[0049.308] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.png") returned 0
	[0049.308] lstrlenA (lpString="*.png") returned 5
	[0049.308] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.doc") returned 0
	[0049.309] lstrlenA (lpString="*.doc") returned 5
	[0049.309] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.docx") returned 0
	[0049.309] lstrlenA (lpString="*.docx") returned 6
	[0049.309] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.xls") returned 0
	[0049.309] lstrlenA (lpString="*.xls") returned 5
	[0049.309] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.xlsx") returned 0
	[0049.309] lstrlenA (lpString="*.xlsx") returned 6
	[0049.309] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.ppt") returned 0
	[0049.309] lstrlenA (lpString="*.ppt") returned 5
	[0049.309] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.pptx") returned 0
	[0049.309] lstrlenA (lpString="*.pptx") returned 6
	[0049.309] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.txt") returned 0
	[0049.309] lstrlenA (lpString="*.txt") returned 5
	[0049.309] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.pdf") returned 0
	[0049.309] lstrlenA (lpString="*.pdf") returned 5
	[0049.309] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.htm") returned 0
	[0049.309] lstrlenA (lpString="*.htm") returned 5
	[0049.309] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.html") returned 0
	[0049.309] lstrlenA (lpString="*.html") returned 6
	[0049.309] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.mdb") returned 0
	[0049.309] lstrlenA (lpString="*.mdb") returned 5
	[0049.309] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.pfx") returned 0
	[0049.309] lstrlenA (lpString="*.pfx") returned 5
	[0049.309] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.md") returned 0
	[0049.309] lstrlenA (lpString="*.md") returned 4
	[0049.309] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.lnk") returned 0
	[0049.309] lstrlenA (lpString="*.lnk") returned 5
	[0049.309] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.torrent") returned 0
	[0049.309] lstrlenA (lpString="*.torrent") returned 9
	[0049.309] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.mov") returned 0
	[0049.309] lstrlenA (lpString="*.mov") returned 5
	[0049.309] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.3gp") returned 0
	[0049.309] lstrlenA (lpString="*.3gp") returned 5
	[0049.309] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.mpeg") returned 0
	[0049.309] lstrlenA (lpString="*.mpeg") returned 6
	[0049.310] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.mpg") returned 0
	[0049.310] lstrlenA (lpString="*.mpg") returned 5
	[0049.310] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.flv") returned 0
	[0049.310] lstrlenA (lpString="*.flv") returned 5
	[0049.310] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.avi") returned 0
	[0049.310] lstrlenA (lpString="*.avi") returned 5
	[0049.310] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.mp4") returned 0
	[0049.310] lstrlenA (lpString="*.mp4") returned 5
	[0049.310] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.wmv") returned 0
	[0049.310] lstrlenA (lpString="*.wmv") returned 5
	[0049.310] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.mkv") returned 0
	[0049.310] lstrlenA (lpString="*.mkv") returned 5
	[0049.310] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.mp3") returned 0
	[0049.310] lstrlenA (lpString="*.mp3") returned 5
	[0049.310] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.wav") returned 0
	[0049.310] lstrlenA (lpString="*.wav") returned 5
	[0049.310] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.flac") returned 0
	[0049.310] lstrlenA (lpString="*.flac") returned 6
	[0049.310] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.wma") returned 0
	[0049.310] lstrlenA (lpString="*.wma") returned 5
	[0049.310] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.au3") returned 0
	[0049.310] lstrlenA (lpString="*.au3") returned 5
	[0049.310] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.ahk") returned 0
	[0049.310] lstrlenA (lpString="*.ahk") returned 5
	[0049.310] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.c") returned 0
	[0049.310] lstrlenA (lpString="*.c") returned 3
	[0049.310] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.cc") returned 0
	[0049.310] lstrlenA (lpString="*.cc") returned 4
	[0049.310] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.cpp") returned 0
	[0049.310] lstrlenA (lpString="*.cpp") returned 5
	[0049.310] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.cxx") returned 0
	[0049.310] lstrlenA (lpString="*.cxx") returned 5
	[0049.310] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.c++") returned 0
	[0049.310] lstrlenA (lpString="*.c++") returned 5
	[0049.310] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.cs") returned 0
	[0049.311] lstrlenA (lpString="*.cs") returned 4
	[0049.311] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.vb") returned 0
	[0049.311] lstrlenA (lpString="*.vb") returned 4
	[0049.311] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.bas") returned 0
	[0049.311] lstrlenA (lpString="*.bas") returned 5
	[0049.311] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.csproj") returned 0
	[0049.311] lstrlenA (lpString="*.csproj") returned 8
	[0049.311] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.vbproj") returned 0
	[0049.311] lstrlenA (lpString="*.vbproj") returned 8
	[0049.311] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.vcxproj") returned 0
	[0049.311] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.311] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.manifest") returned 0
	[0049.311] lstrlenA (lpString="*.manifest") returned 10
	[0049.311] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.php") returned 0
	[0049.311] lstrlenA (lpString="*.php") returned 5
	[0049.311] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.vbe") returned 0
	[0049.311] lstrlenA (lpString="*.vbe") returned 5
	[0049.311] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.vba") returned 0
	[0049.311] lstrlenA (lpString="*.vba") returned 5
	[0049.311] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.vbs") returned 0
	[0049.311] lstrlenA (lpString="*.vbs") returned 5
	[0049.311] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.bat") returned 0
	[0049.311] lstrlenA (lpString="*.bat") returned 5
	[0049.311] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.cmd") returned 0
	[0049.311] lstrlenA (lpString="*.cmd") returned 5
	[0049.311] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.js") returned 0
	[0049.311] lstrlenA (lpString="*.js") returned 4
	[0049.311] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.jscript") returned 0
	[0049.311] lstrlenA (lpString="*.jscript") returned 9
	[0049.311] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.hta") returned 0
	[0049.311] lstrlenA (lpString="*.hta") returned 5
	[0049.311] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.php7") returned 0
	[0049.311] lstrlenA (lpString="*.php7") returned 6
	[0049.311] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.db") returned 0
	[0049.312] lstrlenA (lpString="*.db") returned 4
	[0049.312] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.swf") returned 0
	[0049.312] lstrlenA (lpString="*.swf") returned 5
	[0049.312] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.eml") returned 0
	[0049.312] lstrlenA (lpString="*.eml") returned 5
	[0049.312] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.part") returned 0
	[0049.312] lstrlenA (lpString="*.part") returned 6
	[0049.312] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.nfo") returned 0
	[0049.312] lstrlenA (lpString="*.nfo") returned 5
	[0049.312] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.rsa") returned 0
	[0049.312] lstrlenA (lpString="*.rsa") returned 5
	[0049.312] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.key") returned 0
	[0049.312] lstrlenA (lpString="*.key") returned 5
	[0049.312] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.aes") returned 0
	[0049.312] lstrlenA (lpString="*.aes") returned 5
	[0049.312] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.blob") returned 0
	[0049.312] lstrlenA (lpString="*.blob") returned 6
	[0049.312] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.btc") returned 0
	[0049.312] lstrlenA (lpString="*.btc") returned 5
	[0049.312] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.wallet") returned 0
	[0049.312] lstrlenA (lpString="*.wallet") returned 8
	[0049.312] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x1, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1
	[0049.312] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.312] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="UiInfo.xml") returned -1
	[0049.312] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="UiInfo.xml") returned -1
	[0049.312] lstrcmpiA (lpString1="", lpString2="UiInfo.xml") returned -1
	[0049.312] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned="Parameterinfo.xml"
	[0049.312] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\Extended\\" | out: lpString1="C:\\588bce7c90097ed212\\Extended\\") returned="C:\\588bce7c90097ed212\\Extended\\"
	[0049.312] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\Extended\\" | out: pszPath="C:\\588bce7c90097ed212\\Extended\\") returned=""
	[0049.312] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Extended\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\Extended\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\Extended\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.312] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\Extended\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\extended\\how-to-decrypt-files.htm")) returned 0x20
	[0049.312] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Extended\\", lpString2="UiInfo.xml" | out: lpString1="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml"
	[0049.313] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.zip") returned 0
	[0049.313] lstrlenA (lpString="*.zip") returned 5
	[0049.313] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.rar") returned 0
	[0049.313] lstrlenA (lpString="*.rar") returned 5
	[0049.313] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.7z") returned 0
	[0049.313] lstrlenA (lpString="*.7z") returned 4
	[0049.313] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.tar") returned 0
	[0049.313] lstrlenA (lpString="*.tar") returned 5
	[0049.313] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.gzip") returned 0
	[0049.313] lstrlenA (lpString="*.gzip") returned 6
	[0049.313] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.jpg") returned 0
	[0049.313] lstrlenA (lpString="*.jpg") returned 5
	[0049.313] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.jpeg") returned 0
	[0049.313] lstrlenA (lpString="*.jpeg") returned 6
	[0049.313] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.bmp") returned 0
	[0049.313] lstrlenA (lpString="*.bmp") returned 5
	[0049.313] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.gif") returned 0
	[0049.313] lstrlenA (lpString="*.gif") returned 5
	[0049.313] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.png") returned 0
	[0049.313] lstrlenA (lpString="*.png") returned 5
	[0049.313] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.doc") returned 0
	[0049.313] lstrlenA (lpString="*.doc") returned 5
	[0049.313] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.docx") returned 0
	[0049.313] lstrlenA (lpString="*.docx") returned 6
	[0049.313] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.xls") returned 0
	[0049.313] lstrlenA (lpString="*.xls") returned 5
	[0049.313] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.xlsx") returned 0
	[0049.313] lstrlenA (lpString="*.xlsx") returned 6
	[0049.313] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.ppt") returned 0
	[0049.313] lstrlenA (lpString="*.ppt") returned 5
	[0049.313] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.pptx") returned 0
	[0049.313] lstrlenA (lpString="*.pptx") returned 6
	[0049.313] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.txt") returned 0
	[0049.313] lstrlenA (lpString="*.txt") returned 5
	[0049.313] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.pdf") returned 0
	[0049.314] lstrlenA (lpString="*.pdf") returned 5
	[0049.314] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.htm") returned 0
	[0049.314] lstrlenA (lpString="*.htm") returned 5
	[0049.314] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.html") returned 0
	[0049.314] lstrlenA (lpString="*.html") returned 6
	[0049.314] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.mdb") returned 0
	[0049.314] lstrlenA (lpString="*.mdb") returned 5
	[0049.314] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.pfx") returned 0
	[0049.314] lstrlenA (lpString="*.pfx") returned 5
	[0049.314] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.md") returned 0
	[0049.314] lstrlenA (lpString="*.md") returned 4
	[0049.314] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.lnk") returned 0
	[0049.314] lstrlenA (lpString="*.lnk") returned 5
	[0049.314] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.torrent") returned 0
	[0049.314] lstrlenA (lpString="*.torrent") returned 9
	[0049.314] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.mov") returned 0
	[0049.314] lstrlenA (lpString="*.mov") returned 5
	[0049.314] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.3gp") returned 0
	[0049.314] lstrlenA (lpString="*.3gp") returned 5
	[0049.314] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.mpeg") returned 0
	[0049.314] lstrlenA (lpString="*.mpeg") returned 6
	[0049.314] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.mpg") returned 0
	[0049.314] lstrlenA (lpString="*.mpg") returned 5
	[0049.314] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.flv") returned 0
	[0049.314] lstrlenA (lpString="*.flv") returned 5
	[0049.314] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.avi") returned 0
	[0049.314] lstrlenA (lpString="*.avi") returned 5
	[0049.314] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.mp4") returned 0
	[0049.314] lstrlenA (lpString="*.mp4") returned 5
	[0049.314] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.wmv") returned 0
	[0049.314] lstrlenA (lpString="*.wmv") returned 5
	[0049.314] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.mkv") returned 0
	[0049.314] lstrlenA (lpString="*.mkv") returned 5
	[0049.314] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.mp3") returned 0
	[0049.315] lstrlenA (lpString="*.mp3") returned 5
	[0049.315] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.wav") returned 0
	[0049.315] lstrlenA (lpString="*.wav") returned 5
	[0049.315] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.flac") returned 0
	[0049.315] lstrlenA (lpString="*.flac") returned 6
	[0049.315] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.wma") returned 0
	[0049.315] lstrlenA (lpString="*.wma") returned 5
	[0049.315] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.au3") returned 0
	[0049.315] lstrlenA (lpString="*.au3") returned 5
	[0049.315] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.ahk") returned 0
	[0049.315] lstrlenA (lpString="*.ahk") returned 5
	[0049.315] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.c") returned 0
	[0049.315] lstrlenA (lpString="*.c") returned 3
	[0049.315] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.cc") returned 0
	[0049.315] lstrlenA (lpString="*.cc") returned 4
	[0049.315] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.cpp") returned 0
	[0049.315] lstrlenA (lpString="*.cpp") returned 5
	[0049.315] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.cxx") returned 0
	[0049.315] lstrlenA (lpString="*.cxx") returned 5
	[0049.315] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.c++") returned 0
	[0049.315] lstrlenA (lpString="*.c++") returned 5
	[0049.315] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.cs") returned 0
	[0049.315] lstrlenA (lpString="*.cs") returned 4
	[0049.315] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.vb") returned 0
	[0049.315] lstrlenA (lpString="*.vb") returned 4
	[0049.315] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.bas") returned 0
	[0049.315] lstrlenA (lpString="*.bas") returned 5
	[0049.315] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.csproj") returned 0
	[0049.315] lstrlenA (lpString="*.csproj") returned 8
	[0049.315] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.vbproj") returned 0
	[0049.315] lstrlenA (lpString="*.vbproj") returned 8
	[0049.315] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.vcxproj") returned 0
	[0049.315] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.315] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.manifest") returned 0
	[0049.315] lstrlenA (lpString="*.manifest") returned 10
	[0049.316] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.php") returned 0
	[0049.316] lstrlenA (lpString="*.php") returned 5
	[0049.316] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.vbe") returned 0
	[0049.316] lstrlenA (lpString="*.vbe") returned 5
	[0049.316] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.vba") returned 0
	[0049.316] lstrlenA (lpString="*.vba") returned 5
	[0049.316] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.vbs") returned 0
	[0049.316] lstrlenA (lpString="*.vbs") returned 5
	[0049.316] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.bat") returned 0
	[0049.316] lstrlenA (lpString="*.bat") returned 5
	[0049.316] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.cmd") returned 0
	[0049.316] lstrlenA (lpString="*.cmd") returned 5
	[0049.316] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.js") returned 0
	[0049.316] lstrlenA (lpString="*.js") returned 4
	[0049.316] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.jscript") returned 0
	[0049.316] lstrlenA (lpString="*.jscript") returned 9
	[0049.316] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.hta") returned 0
	[0049.316] lstrlenA (lpString="*.hta") returned 5
	[0049.316] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.php7") returned 0
	[0049.316] lstrlenA (lpString="*.php7") returned 6
	[0049.316] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.db") returned 0
	[0049.316] lstrlenA (lpString="*.db") returned 4
	[0049.316] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.swf") returned 0
	[0049.316] lstrlenA (lpString="*.swf") returned 5
	[0049.316] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.eml") returned 0
	[0049.316] lstrlenA (lpString="*.eml") returned 5
	[0049.316] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.part") returned 0
	[0049.316] lstrlenA (lpString="*.part") returned 6
	[0049.316] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.nfo") returned 0
	[0049.316] lstrlenA (lpString="*.nfo") returned 5
	[0049.316] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.rsa") returned 0
	[0049.316] lstrlenA (lpString="*.rsa") returned 5
	[0049.316] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.key") returned 0
	[0049.316] lstrlenA (lpString="*.key") returned 5
	[0049.316] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.aes") returned 0
	[0049.317] lstrlenA (lpString="*.aes") returned 5
	[0049.317] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.blob") returned 0
	[0049.317] lstrlenA (lpString="*.blob") returned 6
	[0049.317] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.btc") returned 0
	[0049.317] lstrlenA (lpString="*.btc") returned 5
	[0049.317] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.wallet") returned 0
	[0049.317] lstrlenA (lpString="*.wallet") returned 8
	[0049.317] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x1, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0
	[0049.317] FindClose (in: hFindFile=0x7cbad0 | out: hFindFile=0x7cbad0) returned 1
	[0049.317] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d2548, dwReserved1=0x7b00c0, cFileName="Graphics", cAlternateFileName="")) returned 1
	[0049.317] lstrcmpA (lpString1=".", lpString2="Graphics") returned -1
	[0049.317] lstrcmpA (lpString1="..", lpString2="Graphics") returned -1
	[0049.317] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*"
	[0049.317] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="Graphics" | out: lpString1="C:\\588bce7c90097ed212\\Graphics") returned="C:\\588bce7c90097ed212\\Graphics"
	[0049.317] lstrlenA (lpString="C:\\588bce7c90097ed212\\Graphics") returned 30
	[0049.317] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb910
	[0049.320] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0049.320] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0049.320] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0049.320] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0049.320] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico", cAlternateFileName="")) returned 1
	[0049.320] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.320] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Print.ico") returned -1
	[0049.320] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Print.ico") returned -1
	[0049.320] lstrcmpiA (lpString1="", lpString2="Print.ico") returned -1
	[0049.320] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Graphics\\*.*") returned="*.*"
	[0049.320] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\"
	[0049.320] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\Graphics\\" | out: pszPath="C:\\588bce7c90097ed212\\Graphics\\") returned=""
	[0049.320] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.320] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\graphics\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0049.320] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\graphics\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0049.320] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0049.321] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0049.322] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0049.322] CloseHandle (hObject=0x208) returned 1
	[0049.322] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Print.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Print.ico"
	[0049.322] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.zip") returned 0
	[0049.322] lstrlenA (lpString="*.zip") returned 5
	[0049.322] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.rar") returned 0
	[0049.322] lstrlenA (lpString="*.rar") returned 5
	[0049.322] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.7z") returned 0
	[0049.322] lstrlenA (lpString="*.7z") returned 4
	[0049.322] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.tar") returned 0
	[0049.322] lstrlenA (lpString="*.tar") returned 5
	[0049.322] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.gzip") returned 0
	[0049.322] lstrlenA (lpString="*.gzip") returned 6
	[0049.322] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.jpg") returned 0
	[0049.322] lstrlenA (lpString="*.jpg") returned 5
	[0049.322] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.jpeg") returned 0
	[0049.322] lstrlenA (lpString="*.jpeg") returned 6
	[0049.322] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.bmp") returned 0
	[0049.322] lstrlenA (lpString="*.bmp") returned 5
	[0049.322] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.gif") returned 0
	[0049.323] lstrlenA (lpString="*.gif") returned 5
	[0049.323] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.png") returned 0
	[0049.323] lstrlenA (lpString="*.png") returned 5
	[0049.323] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.doc") returned 0
	[0049.323] lstrlenA (lpString="*.doc") returned 5
	[0049.323] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.docx") returned 0
	[0049.323] lstrlenA (lpString="*.docx") returned 6
	[0049.323] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.xls") returned 0
	[0049.323] lstrlenA (lpString="*.xls") returned 5
	[0049.323] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.xlsx") returned 0
	[0049.323] lstrlenA (lpString="*.xlsx") returned 6
	[0049.323] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.ppt") returned 0
	[0049.323] lstrlenA (lpString="*.ppt") returned 5
	[0049.323] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.pptx") returned 0
	[0049.323] lstrlenA (lpString="*.pptx") returned 6
	[0049.323] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.txt") returned 0
	[0049.323] lstrlenA (lpString="*.txt") returned 5
	[0049.323] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.pdf") returned 0
	[0049.323] lstrlenA (lpString="*.pdf") returned 5
	[0049.323] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.htm") returned 0
	[0049.323] lstrlenA (lpString="*.htm") returned 5
	[0049.323] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.html") returned 0
	[0049.323] lstrlenA (lpString="*.html") returned 6
	[0049.323] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.mdb") returned 0
	[0049.323] lstrlenA (lpString="*.mdb") returned 5
	[0049.323] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.pfx") returned 0
	[0049.323] lstrlenA (lpString="*.pfx") returned 5
	[0049.323] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.md") returned 0
	[0049.323] lstrlenA (lpString="*.md") returned 4
	[0049.323] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.lnk") returned 0
	[0049.323] lstrlenA (lpString="*.lnk") returned 5
	[0049.323] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.torrent") returned 0
	[0049.323] lstrlenA (lpString="*.torrent") returned 9
	[0049.323] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.mov") returned 0
	[0049.323] lstrlenA (lpString="*.mov") returned 5
	[0049.324] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.3gp") returned 0
	[0049.324] lstrlenA (lpString="*.3gp") returned 5
	[0049.324] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.mpeg") returned 0
	[0049.324] lstrlenA (lpString="*.mpeg") returned 6
	[0049.324] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.mpg") returned 0
	[0049.324] lstrlenA (lpString="*.mpg") returned 5
	[0049.324] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.flv") returned 0
	[0049.324] lstrlenA (lpString="*.flv") returned 5
	[0049.324] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.avi") returned 0
	[0049.324] lstrlenA (lpString="*.avi") returned 5
	[0049.324] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.mp4") returned 0
	[0049.324] lstrlenA (lpString="*.mp4") returned 5
	[0049.324] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.wmv") returned 0
	[0049.324] lstrlenA (lpString="*.wmv") returned 5
	[0049.324] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.mkv") returned 0
	[0049.324] lstrlenA (lpString="*.mkv") returned 5
	[0049.324] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.mp3") returned 0
	[0049.324] lstrlenA (lpString="*.mp3") returned 5
	[0049.324] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.wav") returned 0
	[0049.324] lstrlenA (lpString="*.wav") returned 5
	[0049.324] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.flac") returned 0
	[0049.324] lstrlenA (lpString="*.flac") returned 6
	[0049.324] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.wma") returned 0
	[0049.324] lstrlenA (lpString="*.wma") returned 5
	[0049.324] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.au3") returned 0
	[0049.324] lstrlenA (lpString="*.au3") returned 5
	[0049.324] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.ahk") returned 0
	[0049.324] lstrlenA (lpString="*.ahk") returned 5
	[0049.324] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.c") returned 0
	[0049.324] lstrlenA (lpString="*.c") returned 3
	[0049.324] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.cc") returned 0
	[0049.324] lstrlenA (lpString="*.cc") returned 4
	[0049.324] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.cpp") returned 0
	[0049.324] lstrlenA (lpString="*.cpp") returned 5
	[0049.324] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.cxx") returned 0
	[0049.324] lstrlenA (lpString="*.cxx") returned 5
	[0049.325] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.c++") returned 0
	[0049.325] lstrlenA (lpString="*.c++") returned 5
	[0049.325] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.cs") returned 0
	[0049.325] lstrlenA (lpString="*.cs") returned 4
	[0049.325] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.vb") returned 0
	[0049.325] lstrlenA (lpString="*.vb") returned 4
	[0049.325] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.bas") returned 0
	[0049.325] lstrlenA (lpString="*.bas") returned 5
	[0049.325] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.csproj") returned 0
	[0049.325] lstrlenA (lpString="*.csproj") returned 8
	[0049.325] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.vbproj") returned 0
	[0049.325] lstrlenA (lpString="*.vbproj") returned 8
	[0049.325] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.vcxproj") returned 0
	[0049.325] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.325] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.manifest") returned 0
	[0049.325] lstrlenA (lpString="*.manifest") returned 10
	[0049.325] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.php") returned 0
	[0049.325] lstrlenA (lpString="*.php") returned 5
	[0049.325] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.vbe") returned 0
	[0049.325] lstrlenA (lpString="*.vbe") returned 5
	[0049.325] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.vba") returned 0
	[0049.325] lstrlenA (lpString="*.vba") returned 5
	[0049.325] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.vbs") returned 0
	[0049.325] lstrlenA (lpString="*.vbs") returned 5
	[0049.325] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.bat") returned 0
	[0049.325] lstrlenA (lpString="*.bat") returned 5
	[0049.325] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.cmd") returned 0
	[0049.325] lstrlenA (lpString="*.cmd") returned 5
	[0049.325] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.js") returned 0
	[0049.325] lstrlenA (lpString="*.js") returned 4
	[0049.325] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.jscript") returned 0
	[0049.325] lstrlenA (lpString="*.jscript") returned 9
	[0049.325] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.hta") returned 0
	[0049.325] lstrlenA (lpString="*.hta") returned 5
	[0049.326] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.php7") returned 0
	[0049.326] lstrlenA (lpString="*.php7") returned 6
	[0049.326] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.db") returned 0
	[0049.326] lstrlenA (lpString="*.db") returned 4
	[0049.326] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.swf") returned 0
	[0049.326] lstrlenA (lpString="*.swf") returned 5
	[0049.326] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.eml") returned 0
	[0049.326] lstrlenA (lpString="*.eml") returned 5
	[0049.326] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.part") returned 0
	[0049.326] lstrlenA (lpString="*.part") returned 6
	[0049.326] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.nfo") returned 0
	[0049.326] lstrlenA (lpString="*.nfo") returned 5
	[0049.326] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.rsa") returned 0
	[0049.326] lstrlenA (lpString="*.rsa") returned 5
	[0049.326] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.key") returned 0
	[0049.326] lstrlenA (lpString="*.key") returned 5
	[0049.326] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.aes") returned 0
	[0049.326] lstrlenA (lpString="*.aes") returned 5
	[0049.326] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.blob") returned 0
	[0049.326] lstrlenA (lpString="*.blob") returned 6
	[0049.326] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.btc") returned 0
	[0049.326] lstrlenA (lpString="*.btc") returned 5
	[0049.326] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.wallet") returned 0
	[0049.326] lstrlenA (lpString="*.wallet") returned 8
	[0049.326] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x1, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1
	[0049.326] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.326] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Rotate1.ico") returned -1
	[0049.326] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Rotate1.ico") returned -1
	[0049.326] lstrcmpiA (lpString1="", lpString2="Rotate1.ico") returned -1
	[0049.327] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned="Print.ico"
	[0049.327] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\"
	[0049.327] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\Graphics\\" | out: pszPath="C:\\588bce7c90097ed212\\Graphics\\") returned=""
	[0049.327] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.327] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\graphics\\how-to-decrypt-files.htm")) returned 0x20
	[0049.327] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Rotate1.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico"
	[0049.327] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.zip") returned 0
	[0049.327] lstrlenA (lpString="*.zip") returned 5
	[0049.327] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.rar") returned 0
	[0049.327] lstrlenA (lpString="*.rar") returned 5
	[0049.327] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.7z") returned 0
	[0049.327] lstrlenA (lpString="*.7z") returned 4
	[0049.327] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.tar") returned 0
	[0049.327] lstrlenA (lpString="*.tar") returned 5
	[0049.327] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.gzip") returned 0
	[0049.327] lstrlenA (lpString="*.gzip") returned 6
	[0049.327] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.jpg") returned 0
	[0049.327] lstrlenA (lpString="*.jpg") returned 5
	[0049.327] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.jpeg") returned 0
	[0049.327] lstrlenA (lpString="*.jpeg") returned 6
	[0049.327] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.bmp") returned 0
	[0049.327] lstrlenA (lpString="*.bmp") returned 5
	[0049.327] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.gif") returned 0
	[0049.327] lstrlenA (lpString="*.gif") returned 5
	[0049.327] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.png") returned 0
	[0049.327] lstrlenA (lpString="*.png") returned 5
	[0049.327] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.doc") returned 0
	[0049.327] lstrlenA (lpString="*.doc") returned 5
	[0049.327] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.docx") returned 0
	[0049.327] lstrlenA (lpString="*.docx") returned 6
	[0049.327] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.xls") returned 0
	[0049.328] lstrlenA (lpString="*.xls") returned 5
	[0049.328] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.xlsx") returned 0
	[0049.328] lstrlenA (lpString="*.xlsx") returned 6
	[0049.328] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.ppt") returned 0
	[0049.328] lstrlenA (lpString="*.ppt") returned 5
	[0049.328] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.pptx") returned 0
	[0049.328] lstrlenA (lpString="*.pptx") returned 6
	[0049.328] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.txt") returned 0
	[0049.328] lstrlenA (lpString="*.txt") returned 5
	[0049.328] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.pdf") returned 0
	[0049.328] lstrlenA (lpString="*.pdf") returned 5
	[0049.328] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.htm") returned 0
	[0049.328] lstrlenA (lpString="*.htm") returned 5
	[0049.328] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.html") returned 0
	[0049.328] lstrlenA (lpString="*.html") returned 6
	[0049.328] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.mdb") returned 0
	[0049.328] lstrlenA (lpString="*.mdb") returned 5
	[0049.328] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.pfx") returned 0
	[0049.328] lstrlenA (lpString="*.pfx") returned 5
	[0049.328] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.md") returned 0
	[0049.328] lstrlenA (lpString="*.md") returned 4
	[0049.328] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.lnk") returned 0
	[0049.328] lstrlenA (lpString="*.lnk") returned 5
	[0049.328] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.torrent") returned 0
	[0049.328] lstrlenA (lpString="*.torrent") returned 9
	[0049.328] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.mov") returned 0
	[0049.328] lstrlenA (lpString="*.mov") returned 5
	[0049.328] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.3gp") returned 0
	[0049.328] lstrlenA (lpString="*.3gp") returned 5
	[0049.328] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.mpeg") returned 0
	[0049.328] lstrlenA (lpString="*.mpeg") returned 6
	[0049.328] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.mpg") returned 0
	[0049.328] lstrlenA (lpString="*.mpg") returned 5
	[0049.328] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.flv") returned 0
	[0049.328] lstrlenA (lpString="*.flv") returned 5
	[0049.328] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.avi") returned 0
	[0049.328] lstrlenA (lpString="*.avi") returned 5
	[0049.329] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.mp4") returned 0
	[0049.329] lstrlenA (lpString="*.mp4") returned 5
	[0049.329] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.wmv") returned 0
	[0049.329] lstrlenA (lpString="*.wmv") returned 5
	[0049.329] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.mkv") returned 0
	[0049.329] lstrlenA (lpString="*.mkv") returned 5
	[0049.329] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.mp3") returned 0
	[0049.329] lstrlenA (lpString="*.mp3") returned 5
	[0049.329] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.wav") returned 0
	[0049.329] lstrlenA (lpString="*.wav") returned 5
	[0049.329] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.flac") returned 0
	[0049.329] lstrlenA (lpString="*.flac") returned 6
	[0049.329] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.wma") returned 0
	[0049.329] lstrlenA (lpString="*.wma") returned 5
	[0049.329] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.au3") returned 0
	[0049.329] lstrlenA (lpString="*.au3") returned 5
	[0049.329] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.ahk") returned 0
	[0049.329] lstrlenA (lpString="*.ahk") returned 5
	[0049.329] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.c") returned 0
	[0049.329] lstrlenA (lpString="*.c") returned 3
	[0049.329] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.cc") returned 0
	[0049.329] lstrlenA (lpString="*.cc") returned 4
	[0049.329] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.cpp") returned 0
	[0049.329] lstrlenA (lpString="*.cpp") returned 5
	[0049.329] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.cxx") returned 0
	[0049.329] lstrlenA (lpString="*.cxx") returned 5
	[0049.329] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.c++") returned 0
	[0049.329] lstrlenA (lpString="*.c++") returned 5
	[0049.329] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.cs") returned 0
	[0049.329] lstrlenA (lpString="*.cs") returned 4
	[0049.329] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.vb") returned 0
	[0049.329] lstrlenA (lpString="*.vb") returned 4
	[0049.329] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.bas") returned 0
	[0049.329] lstrlenA (lpString="*.bas") returned 5
	[0049.329] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.csproj") returned 0
	[0049.330] lstrlenA (lpString="*.csproj") returned 8
	[0049.330] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.vbproj") returned 0
	[0049.330] lstrlenA (lpString="*.vbproj") returned 8
	[0049.330] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.vcxproj") returned 0
	[0049.330] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.330] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.manifest") returned 0
	[0049.330] lstrlenA (lpString="*.manifest") returned 10
	[0049.330] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.php") returned 0
	[0049.330] lstrlenA (lpString="*.php") returned 5
	[0049.330] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.vbe") returned 0
	[0049.330] lstrlenA (lpString="*.vbe") returned 5
	[0049.330] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.vba") returned 0
	[0049.330] lstrlenA (lpString="*.vba") returned 5
	[0049.330] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.vbs") returned 0
	[0049.330] lstrlenA (lpString="*.vbs") returned 5
	[0049.330] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.bat") returned 0
	[0049.330] lstrlenA (lpString="*.bat") returned 5
	[0049.330] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.cmd") returned 0
	[0049.330] lstrlenA (lpString="*.cmd") returned 5
	[0049.330] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.js") returned 0
	[0049.330] lstrlenA (lpString="*.js") returned 4
	[0049.330] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.jscript") returned 0
	[0049.330] lstrlenA (lpString="*.jscript") returned 9
	[0049.330] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.hta") returned 0
	[0049.330] lstrlenA (lpString="*.hta") returned 5
	[0049.330] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.php7") returned 0
	[0049.330] lstrlenA (lpString="*.php7") returned 6
	[0049.330] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.db") returned 0
	[0049.330] lstrlenA (lpString="*.db") returned 4
	[0049.330] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.swf") returned 0
	[0049.330] lstrlenA (lpString="*.swf") returned 5
	[0049.330] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.eml") returned 0
	[0049.330] lstrlenA (lpString="*.eml") returned 5
	[0049.330] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.part") returned 0
	[0049.331] lstrlenA (lpString="*.part") returned 6
	[0049.331] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.nfo") returned 0
	[0049.331] lstrlenA (lpString="*.nfo") returned 5
	[0049.331] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.rsa") returned 0
	[0049.331] lstrlenA (lpString="*.rsa") returned 5
	[0049.331] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.key") returned 0
	[0049.331] lstrlenA (lpString="*.key") returned 5
	[0049.331] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.aes") returned 0
	[0049.331] lstrlenA (lpString="*.aes") returned 5
	[0049.331] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.blob") returned 0
	[0049.331] lstrlenA (lpString="*.blob") returned 6
	[0049.331] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.btc") returned 0
	[0049.331] lstrlenA (lpString="*.btc") returned 5
	[0049.331] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.wallet") returned 0
	[0049.331] lstrlenA (lpString="*.wallet") returned 8
	[0049.331] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1
	[0049.331] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.331] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Rotate2.ico") returned -1
	[0049.331] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Rotate2.ico") returned -1
	[0049.331] lstrcmpiA (lpString1="", lpString2="Rotate2.ico") returned -1
	[0049.331] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned="Rotate1.ico"
	[0049.331] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\"
	[0049.331] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\Graphics\\" | out: pszPath="C:\\588bce7c90097ed212\\Graphics\\") returned=""
	[0049.331] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.331] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\graphics\\how-to-decrypt-files.htm")) returned 0x20
	[0049.331] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Rotate2.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico"
	[0049.331] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.zip") returned 0
	[0049.331] lstrlenA (lpString="*.zip") returned 5
	[0049.331] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.rar") returned 0
	[0049.331] lstrlenA (lpString="*.rar") returned 5
	[0049.331] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.7z") returned 0
	[0049.331] lstrlenA (lpString="*.7z") returned 4
	[0049.332] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.tar") returned 0
	[0049.332] lstrlenA (lpString="*.tar") returned 5
	[0049.332] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.gzip") returned 0
	[0049.332] lstrlenA (lpString="*.gzip") returned 6
	[0049.332] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.jpg") returned 0
	[0049.332] lstrlenA (lpString="*.jpg") returned 5
	[0049.332] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.jpeg") returned 0
	[0049.332] lstrlenA (lpString="*.jpeg") returned 6
	[0049.332] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.bmp") returned 0
	[0049.332] lstrlenA (lpString="*.bmp") returned 5
	[0049.332] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.gif") returned 0
	[0049.332] lstrlenA (lpString="*.gif") returned 5
	[0049.332] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.png") returned 0
	[0049.332] lstrlenA (lpString="*.png") returned 5
	[0049.332] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.doc") returned 0
	[0049.332] lstrlenA (lpString="*.doc") returned 5
	[0049.332] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.docx") returned 0
	[0049.332] lstrlenA (lpString="*.docx") returned 6
	[0049.332] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.xls") returned 0
	[0049.332] lstrlenA (lpString="*.xls") returned 5
	[0049.332] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.xlsx") returned 0
	[0049.332] lstrlenA (lpString="*.xlsx") returned 6
	[0049.332] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.ppt") returned 0
	[0049.332] lstrlenA (lpString="*.ppt") returned 5
	[0049.332] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.pptx") returned 0
	[0049.332] lstrlenA (lpString="*.pptx") returned 6
	[0049.332] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.txt") returned 0
	[0049.332] lstrlenA (lpString="*.txt") returned 5
	[0049.332] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.pdf") returned 0
	[0049.332] lstrlenA (lpString="*.pdf") returned 5
	[0049.332] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.htm") returned 0
	[0049.332] lstrlenA (lpString="*.htm") returned 5
	[0049.332] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.html") returned 0
	[0049.332] lstrlenA (lpString="*.html") returned 6
	[0049.332] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.mdb") returned 0
	[0049.333] lstrlenA (lpString="*.mdb") returned 5
	[0049.333] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.pfx") returned 0
	[0049.333] lstrlenA (lpString="*.pfx") returned 5
	[0049.333] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.md") returned 0
	[0049.333] lstrlenA (lpString="*.md") returned 4
	[0049.333] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.lnk") returned 0
	[0049.333] lstrlenA (lpString="*.lnk") returned 5
	[0049.333] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.torrent") returned 0
	[0049.333] lstrlenA (lpString="*.torrent") returned 9
	[0049.333] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.mov") returned 0
	[0049.333] lstrlenA (lpString="*.mov") returned 5
	[0049.333] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.3gp") returned 0
	[0049.333] lstrlenA (lpString="*.3gp") returned 5
	[0049.333] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.mpeg") returned 0
	[0049.333] lstrlenA (lpString="*.mpeg") returned 6
	[0049.333] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.mpg") returned 0
	[0049.333] lstrlenA (lpString="*.mpg") returned 5
	[0049.333] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.flv") returned 0
	[0049.333] lstrlenA (lpString="*.flv") returned 5
	[0049.333] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.avi") returned 0
	[0049.333] lstrlenA (lpString="*.avi") returned 5
	[0049.333] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.mp4") returned 0
	[0049.333] lstrlenA (lpString="*.mp4") returned 5
	[0049.333] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.wmv") returned 0
	[0049.333] lstrlenA (lpString="*.wmv") returned 5
	[0049.333] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.mkv") returned 0
	[0049.333] lstrlenA (lpString="*.mkv") returned 5
	[0049.333] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.mp3") returned 0
	[0049.427] lstrlenA (lpString="*.mp3") returned 5
	[0049.427] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.wav") returned 0
	[0049.427] lstrlenA (lpString="*.wav") returned 5
	[0049.427] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.flac") returned 0
	[0049.427] lstrlenA (lpString="*.flac") returned 6
	[0049.427] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.wma") returned 0
	[0049.427] lstrlenA (lpString="*.wma") returned 5
	[0049.427] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.au3") returned 0
	[0049.427] lstrlenA (lpString="*.au3") returned 5
	[0049.427] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.ahk") returned 0
	[0049.427] lstrlenA (lpString="*.ahk") returned 5
	[0049.427] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.c") returned 0
	[0049.427] lstrlenA (lpString="*.c") returned 3
	[0049.427] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.cc") returned 0
	[0049.427] lstrlenA (lpString="*.cc") returned 4
	[0049.427] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.cpp") returned 0
	[0049.427] lstrlenA (lpString="*.cpp") returned 5
	[0049.427] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.cxx") returned 0
	[0049.427] lstrlenA (lpString="*.cxx") returned 5
	[0049.428] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.c++") returned 0
	[0049.428] lstrlenA (lpString="*.c++") returned 5
	[0049.428] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.cs") returned 0
	[0049.428] lstrlenA (lpString="*.cs") returned 4
	[0049.428] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.vb") returned 0
	[0049.428] lstrlenA (lpString="*.vb") returned 4
	[0049.428] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.bas") returned 0
	[0049.428] lstrlenA (lpString="*.bas") returned 5
	[0049.428] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.csproj") returned 0
	[0049.428] lstrlenA (lpString="*.csproj") returned 8
	[0049.428] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.vbproj") returned 0
	[0049.428] lstrlenA (lpString="*.vbproj") returned 8
	[0049.428] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.vcxproj") returned 0
	[0049.428] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.428] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.manifest") returned 0
	[0049.428] lstrlenA (lpString="*.manifest") returned 10
	[0049.428] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.php") returned 0
	[0049.428] lstrlenA (lpString="*.php") returned 5
	[0049.428] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.vbe") returned 0
	[0049.428] lstrlenA (lpString="*.vbe") returned 5
	[0049.428] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.vba") returned 0
	[0049.428] lstrlenA (lpString="*.vba") returned 5
	[0049.428] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.vbs") returned 0
	[0049.428] lstrlenA (lpString="*.vbs") returned 5
	[0049.428] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.bat") returned 0
	[0049.428] lstrlenA (lpString="*.bat") returned 5
	[0049.428] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.cmd") returned 0
	[0049.428] lstrlenA (lpString="*.cmd") returned 5
	[0049.428] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.js") returned 0
	[0049.428] lstrlenA (lpString="*.js") returned 4
	[0049.428] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.jscript") returned 0
	[0049.428] lstrlenA (lpString="*.jscript") returned 9
	[0049.428] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.hta") returned 0
	[0049.429] lstrlenA (lpString="*.hta") returned 5
	[0049.429] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.php7") returned 0
	[0049.429] lstrlenA (lpString="*.php7") returned 6
	[0049.429] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.db") returned 0
	[0049.429] lstrlenA (lpString="*.db") returned 4
	[0049.429] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.swf") returned 0
	[0049.429] lstrlenA (lpString="*.swf") returned 5
	[0049.429] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.eml") returned 0
	[0049.429] lstrlenA (lpString="*.eml") returned 5
	[0049.429] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.part") returned 0
	[0049.429] lstrlenA (lpString="*.part") returned 6
	[0049.429] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.nfo") returned 0
	[0049.429] lstrlenA (lpString="*.nfo") returned 5
	[0049.429] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.rsa") returned 0
	[0049.429] lstrlenA (lpString="*.rsa") returned 5
	[0049.429] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.key") returned 0
	[0049.429] lstrlenA (lpString="*.key") returned 5
	[0049.429] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.aes") returned 0
	[0049.429] lstrlenA (lpString="*.aes") returned 5
	[0049.429] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.blob") returned 0
	[0049.429] lstrlenA (lpString="*.blob") returned 6
	[0049.429] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.btc") returned 0
	[0049.429] lstrlenA (lpString="*.btc") returned 5
	[0049.429] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.wallet") returned 0
	[0049.429] lstrlenA (lpString="*.wallet") returned 8
	[0049.429] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1
	[0049.429] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.429] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Rotate3.ico") returned -1
	[0049.429] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Rotate3.ico") returned -1
	[0049.429] lstrcmpiA (lpString1="", lpString2="Rotate3.ico") returned -1
	[0049.429] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned="Rotate2.ico"
	[0049.430] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\"
	[0049.430] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\Graphics\\" | out: pszPath="C:\\588bce7c90097ed212\\Graphics\\") returned=""
	[0049.430] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.430] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\graphics\\how-to-decrypt-files.htm")) returned 0x20
	[0049.430] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Rotate3.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico"
	[0049.430] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.zip") returned 0
	[0049.430] lstrlenA (lpString="*.zip") returned 5
	[0049.430] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.rar") returned 0
	[0049.430] lstrlenA (lpString="*.rar") returned 5
	[0049.430] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.7z") returned 0
	[0049.430] lstrlenA (lpString="*.7z") returned 4
	[0049.430] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.tar") returned 0
	[0049.430] lstrlenA (lpString="*.tar") returned 5
	[0049.430] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.gzip") returned 0
	[0049.430] lstrlenA (lpString="*.gzip") returned 6
	[0049.430] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.jpg") returned 0
	[0049.430] lstrlenA (lpString="*.jpg") returned 5
	[0049.430] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.jpeg") returned 0
	[0049.430] lstrlenA (lpString="*.jpeg") returned 6
	[0049.430] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.bmp") returned 0
	[0049.430] lstrlenA (lpString="*.bmp") returned 5
	[0049.430] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.gif") returned 0
	[0049.430] lstrlenA (lpString="*.gif") returned 5
	[0049.430] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.png") returned 0
	[0049.430] lstrlenA (lpString="*.png") returned 5
	[0049.430] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.doc") returned 0
	[0049.430] lstrlenA (lpString="*.doc") returned 5
	[0049.430] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.docx") returned 0
	[0049.431] lstrlenA (lpString="*.docx") returned 6
	[0049.431] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.xls") returned 0
	[0049.431] lstrlenA (lpString="*.xls") returned 5
	[0049.431] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.xlsx") returned 0
	[0049.431] lstrlenA (lpString="*.xlsx") returned 6
	[0049.431] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.ppt") returned 0
	[0049.431] lstrlenA (lpString="*.ppt") returned 5
	[0049.431] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.pptx") returned 0
	[0049.431] lstrlenA (lpString="*.pptx") returned 6
	[0049.431] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.txt") returned 0
	[0049.431] lstrlenA (lpString="*.txt") returned 5
	[0049.431] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.pdf") returned 0
	[0049.431] lstrlenA (lpString="*.pdf") returned 5
	[0049.431] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.htm") returned 0
	[0049.431] lstrlenA (lpString="*.htm") returned 5
	[0049.431] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.html") returned 0
	[0049.431] lstrlenA (lpString="*.html") returned 6
	[0049.431] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.mdb") returned 0
	[0049.431] lstrlenA (lpString="*.mdb") returned 5
	[0049.431] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.pfx") returned 0
	[0049.431] lstrlenA (lpString="*.pfx") returned 5
	[0049.431] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.md") returned 0
	[0049.431] lstrlenA (lpString="*.md") returned 4
	[0049.431] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.lnk") returned 0
	[0049.431] lstrlenA (lpString="*.lnk") returned 5
	[0049.431] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.torrent") returned 0
	[0049.431] lstrlenA (lpString="*.torrent") returned 9
	[0049.431] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.mov") returned 0
	[0049.431] lstrlenA (lpString="*.mov") returned 5
	[0049.431] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.3gp") returned 0
	[0049.431] lstrlenA (lpString="*.3gp") returned 5
	[0049.431] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.mpeg") returned 0
	[0049.431] lstrlenA (lpString="*.mpeg") returned 6
	[0049.431] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.mpg") returned 0
	[0049.431] lstrlenA (lpString="*.mpg") returned 5
	[0049.432] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.flv") returned 0
	[0049.432] lstrlenA (lpString="*.flv") returned 5
	[0049.432] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.avi") returned 0
	[0049.432] lstrlenA (lpString="*.avi") returned 5
	[0049.432] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.mp4") returned 0
	[0049.432] lstrlenA (lpString="*.mp4") returned 5
	[0049.432] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.wmv") returned 0
	[0049.432] lstrlenA (lpString="*.wmv") returned 5
	[0049.432] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.mkv") returned 0
	[0049.432] lstrlenA (lpString="*.mkv") returned 5
	[0049.432] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.mp3") returned 0
	[0049.432] lstrlenA (lpString="*.mp3") returned 5
	[0049.432] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.wav") returned 0
	[0049.432] lstrlenA (lpString="*.wav") returned 5
	[0049.432] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.flac") returned 0
	[0049.432] lstrlenA (lpString="*.flac") returned 6
	[0049.432] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.wma") returned 0
	[0049.432] lstrlenA (lpString="*.wma") returned 5
	[0049.432] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.au3") returned 0
	[0049.432] lstrlenA (lpString="*.au3") returned 5
	[0049.432] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.ahk") returned 0
	[0049.432] lstrlenA (lpString="*.ahk") returned 5
	[0049.432] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.c") returned 0
	[0049.432] lstrlenA (lpString="*.c") returned 3
	[0049.432] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.cc") returned 0
	[0049.432] lstrlenA (lpString="*.cc") returned 4
	[0049.432] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.cpp") returned 0
	[0049.432] lstrlenA (lpString="*.cpp") returned 5
	[0049.432] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.cxx") returned 0
	[0049.432] lstrlenA (lpString="*.cxx") returned 5
	[0049.432] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.c++") returned 0
	[0049.432] lstrlenA (lpString="*.c++") returned 5
	[0049.432] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.cs") returned 0
	[0049.432] lstrlenA (lpString="*.cs") returned 4
	[0049.433] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.vb") returned 0
	[0049.433] lstrlenA (lpString="*.vb") returned 4
	[0049.433] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.bas") returned 0
	[0049.433] lstrlenA (lpString="*.bas") returned 5
	[0049.433] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.csproj") returned 0
	[0049.433] lstrlenA (lpString="*.csproj") returned 8
	[0049.433] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.vbproj") returned 0
	[0049.433] lstrlenA (lpString="*.vbproj") returned 8
	[0049.433] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.vcxproj") returned 0
	[0049.433] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.433] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.manifest") returned 0
	[0049.433] lstrlenA (lpString="*.manifest") returned 10
	[0049.433] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.php") returned 0
	[0049.433] lstrlenA (lpString="*.php") returned 5
	[0049.433] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.vbe") returned 0
	[0049.433] lstrlenA (lpString="*.vbe") returned 5
	[0049.433] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.vba") returned 0
	[0049.433] lstrlenA (lpString="*.vba") returned 5
	[0049.433] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.vbs") returned 0
	[0049.433] lstrlenA (lpString="*.vbs") returned 5
	[0049.433] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.bat") returned 0
	[0049.433] lstrlenA (lpString="*.bat") returned 5
	[0049.433] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.cmd") returned 0
	[0049.433] lstrlenA (lpString="*.cmd") returned 5
	[0049.433] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.js") returned 0
	[0049.433] lstrlenA (lpString="*.js") returned 4
	[0049.433] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.jscript") returned 0
	[0049.433] lstrlenA (lpString="*.jscript") returned 9
	[0049.433] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.hta") returned 0
	[0049.433] lstrlenA (lpString="*.hta") returned 5
	[0049.433] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.php7") returned 0
	[0049.433] lstrlenA (lpString="*.php7") returned 6
	[0049.433] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.db") returned 0
	[0049.433] lstrlenA (lpString="*.db") returned 4
	[0049.434] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.swf") returned 0
	[0049.434] lstrlenA (lpString="*.swf") returned 5
	[0049.434] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.eml") returned 0
	[0049.434] lstrlenA (lpString="*.eml") returned 5
	[0049.434] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.part") returned 0
	[0049.434] lstrlenA (lpString="*.part") returned 6
	[0049.434] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.nfo") returned 0
	[0049.434] lstrlenA (lpString="*.nfo") returned 5
	[0049.434] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.rsa") returned 0
	[0049.434] lstrlenA (lpString="*.rsa") returned 5
	[0049.434] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.key") returned 0
	[0049.434] lstrlenA (lpString="*.key") returned 5
	[0049.434] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.aes") returned 0
	[0049.434] lstrlenA (lpString="*.aes") returned 5
	[0049.434] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.blob") returned 0
	[0049.434] lstrlenA (lpString="*.blob") returned 6
	[0049.434] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.btc") returned 0
	[0049.434] lstrlenA (lpString="*.btc") returned 5
	[0049.434] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.wallet") returned 0
	[0049.434] lstrlenA (lpString="*.wallet") returned 8
	[0049.434] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1
	[0049.434] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.434] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Rotate4.ico") returned -1
	[0049.434] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Rotate4.ico") returned -1
	[0049.434] lstrcmpiA (lpString1="", lpString2="Rotate4.ico") returned -1
	[0049.434] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned="Rotate3.ico"
	[0049.434] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\"
	[0049.434] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\Graphics\\" | out: pszPath="C:\\588bce7c90097ed212\\Graphics\\") returned=""
	[0049.434] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.434] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\graphics\\how-to-decrypt-files.htm")) returned 0x20
	[0049.435] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Rotate4.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico"
	[0049.435] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.zip") returned 0
	[0049.435] lstrlenA (lpString="*.zip") returned 5
	[0049.435] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.rar") returned 0
	[0049.435] lstrlenA (lpString="*.rar") returned 5
	[0049.435] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.7z") returned 0
	[0049.435] lstrlenA (lpString="*.7z") returned 4
	[0049.435] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.tar") returned 0
	[0049.435] lstrlenA (lpString="*.tar") returned 5
	[0049.435] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.gzip") returned 0
	[0049.435] lstrlenA (lpString="*.gzip") returned 6
	[0049.435] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.jpg") returned 0
	[0049.435] lstrlenA (lpString="*.jpg") returned 5
	[0049.435] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.jpeg") returned 0
	[0049.435] lstrlenA (lpString="*.jpeg") returned 6
	[0049.435] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.bmp") returned 0
	[0049.435] lstrlenA (lpString="*.bmp") returned 5
	[0049.435] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.gif") returned 0
	[0049.435] lstrlenA (lpString="*.gif") returned 5
	[0049.435] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.png") returned 0
	[0049.435] lstrlenA (lpString="*.png") returned 5
	[0049.435] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.doc") returned 0
	[0049.435] lstrlenA (lpString="*.doc") returned 5
	[0049.435] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.docx") returned 0
	[0049.435] lstrlenA (lpString="*.docx") returned 6
	[0049.435] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.xls") returned 0
	[0049.435] lstrlenA (lpString="*.xls") returned 5
	[0049.435] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.xlsx") returned 0
	[0049.435] lstrlenA (lpString="*.xlsx") returned 6
	[0049.435] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.ppt") returned 0
	[0049.435] lstrlenA (lpString="*.ppt") returned 5
	[0049.435] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.pptx") returned 0
	[0049.436] lstrlenA (lpString="*.pptx") returned 6
	[0049.436] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.txt") returned 0
	[0049.436] lstrlenA (lpString="*.txt") returned 5
	[0049.436] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.pdf") returned 0
	[0049.436] lstrlenA (lpString="*.pdf") returned 5
	[0049.436] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.htm") returned 0
	[0049.436] lstrlenA (lpString="*.htm") returned 5
	[0049.436] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.html") returned 0
	[0049.436] lstrlenA (lpString="*.html") returned 6
	[0049.436] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.mdb") returned 0
	[0049.436] lstrlenA (lpString="*.mdb") returned 5
	[0049.436] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.pfx") returned 0
	[0049.436] lstrlenA (lpString="*.pfx") returned 5
	[0049.436] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.md") returned 0
	[0049.436] lstrlenA (lpString="*.md") returned 4
	[0049.436] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.lnk") returned 0
	[0049.436] lstrlenA (lpString="*.lnk") returned 5
	[0049.436] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.torrent") returned 0
	[0049.436] lstrlenA (lpString="*.torrent") returned 9
	[0049.436] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.mov") returned 0
	[0049.436] lstrlenA (lpString="*.mov") returned 5
	[0049.436] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.3gp") returned 0
	[0049.436] lstrlenA (lpString="*.3gp") returned 5
	[0049.436] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.mpeg") returned 0
	[0049.436] lstrlenA (lpString="*.mpeg") returned 6
	[0049.436] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.mpg") returned 0
	[0049.436] lstrlenA (lpString="*.mpg") returned 5
	[0049.436] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.flv") returned 0
	[0049.436] lstrlenA (lpString="*.flv") returned 5
	[0049.436] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.avi") returned 0
	[0049.436] lstrlenA (lpString="*.avi") returned 5
	[0049.436] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.mp4") returned 0
	[0049.436] lstrlenA (lpString="*.mp4") returned 5
	[0049.436] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.wmv") returned 0
	[0049.436] lstrlenA (lpString="*.wmv") returned 5
	[0049.437] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.mkv") returned 0
	[0049.437] lstrlenA (lpString="*.mkv") returned 5
	[0049.437] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.mp3") returned 0
	[0049.437] lstrlenA (lpString="*.mp3") returned 5
	[0049.437] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.wav") returned 0
	[0049.437] lstrlenA (lpString="*.wav") returned 5
	[0049.437] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.flac") returned 0
	[0049.437] lstrlenA (lpString="*.flac") returned 6
	[0049.437] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.wma") returned 0
	[0049.437] lstrlenA (lpString="*.wma") returned 5
	[0049.437] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.au3") returned 0
	[0049.437] lstrlenA (lpString="*.au3") returned 5
	[0049.437] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.ahk") returned 0
	[0049.437] lstrlenA (lpString="*.ahk") returned 5
	[0049.437] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.c") returned 0
	[0049.437] lstrlenA (lpString="*.c") returned 3
	[0049.437] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.cc") returned 0
	[0049.437] lstrlenA (lpString="*.cc") returned 4
	[0049.437] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.cpp") returned 0
	[0049.437] lstrlenA (lpString="*.cpp") returned 5
	[0049.437] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.cxx") returned 0
	[0049.437] lstrlenA (lpString="*.cxx") returned 5
	[0049.437] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.c++") returned 0
	[0049.437] lstrlenA (lpString="*.c++") returned 5
	[0049.437] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.cs") returned 0
	[0049.437] lstrlenA (lpString="*.cs") returned 4
	[0049.437] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.vb") returned 0
	[0049.437] lstrlenA (lpString="*.vb") returned 4
	[0049.437] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.bas") returned 0
	[0049.437] lstrlenA (lpString="*.bas") returned 5
	[0049.437] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.csproj") returned 0
	[0049.437] lstrlenA (lpString="*.csproj") returned 8
	[0049.437] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.vbproj") returned 0
	[0049.437] lstrlenA (lpString="*.vbproj") returned 8
	[0049.437] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.vcxproj") returned 0
	[0049.438] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.438] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.manifest") returned 0
	[0049.438] lstrlenA (lpString="*.manifest") returned 10
	[0049.438] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.php") returned 0
	[0049.438] lstrlenA (lpString="*.php") returned 5
	[0049.438] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.vbe") returned 0
	[0049.438] lstrlenA (lpString="*.vbe") returned 5
	[0049.438] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.vba") returned 0
	[0049.438] lstrlenA (lpString="*.vba") returned 5
	[0049.438] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.vbs") returned 0
	[0049.438] lstrlenA (lpString="*.vbs") returned 5
	[0049.438] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.bat") returned 0
	[0049.438] lstrlenA (lpString="*.bat") returned 5
	[0049.438] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.cmd") returned 0
	[0049.438] lstrlenA (lpString="*.cmd") returned 5
	[0049.438] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.js") returned 0
	[0049.438] lstrlenA (lpString="*.js") returned 4
	[0049.438] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.jscript") returned 0
	[0049.438] lstrlenA (lpString="*.jscript") returned 9
	[0049.438] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.hta") returned 0
	[0049.438] lstrlenA (lpString="*.hta") returned 5
	[0049.438] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.php7") returned 0
	[0049.438] lstrlenA (lpString="*.php7") returned 6
	[0049.438] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.db") returned 0
	[0049.438] lstrlenA (lpString="*.db") returned 4
	[0049.438] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.swf") returned 0
	[0049.438] lstrlenA (lpString="*.swf") returned 5
	[0049.438] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.eml") returned 0
	[0049.438] lstrlenA (lpString="*.eml") returned 5
	[0049.438] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.part") returned 0
	[0049.438] lstrlenA (lpString="*.part") returned 6
	[0049.438] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.nfo") returned 0
	[0049.438] lstrlenA (lpString="*.nfo") returned 5
	[0049.438] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.rsa") returned 0
	[0049.439] lstrlenA (lpString="*.rsa") returned 5
	[0049.439] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.key") returned 0
	[0049.439] lstrlenA (lpString="*.key") returned 5
	[0049.439] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.aes") returned 0
	[0049.439] lstrlenA (lpString="*.aes") returned 5
	[0049.439] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.blob") returned 0
	[0049.439] lstrlenA (lpString="*.blob") returned 6
	[0049.439] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.btc") returned 0
	[0049.439] lstrlenA (lpString="*.btc") returned 5
	[0049.439] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.wallet") returned 0
	[0049.439] lstrlenA (lpString="*.wallet") returned 8
	[0049.439] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1
	[0049.439] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.439] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Rotate5.ico") returned -1
	[0049.439] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Rotate5.ico") returned -1
	[0049.439] lstrcmpiA (lpString1="", lpString2="Rotate5.ico") returned -1
	[0049.439] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned="Rotate4.ico"
	[0049.439] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\"
	[0049.439] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\Graphics\\" | out: pszPath="C:\\588bce7c90097ed212\\Graphics\\") returned=""
	[0049.439] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.439] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\graphics\\how-to-decrypt-files.htm")) returned 0x20
	[0049.439] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Rotate5.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico"
	[0049.439] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.zip") returned 0
	[0049.439] lstrlenA (lpString="*.zip") returned 5
	[0049.439] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.rar") returned 0
	[0049.439] lstrlenA (lpString="*.rar") returned 5
	[0049.439] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.7z") returned 0
	[0049.439] lstrlenA (lpString="*.7z") returned 4
	[0049.439] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.tar") returned 0
	[0049.440] lstrlenA (lpString="*.tar") returned 5
	[0049.440] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.gzip") returned 0
	[0049.440] lstrlenA (lpString="*.gzip") returned 6
	[0049.440] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.jpg") returned 0
	[0049.440] lstrlenA (lpString="*.jpg") returned 5
	[0049.440] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.jpeg") returned 0
	[0049.440] lstrlenA (lpString="*.jpeg") returned 6
	[0049.440] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.bmp") returned 0
	[0049.440] lstrlenA (lpString="*.bmp") returned 5
	[0049.440] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.gif") returned 0
	[0049.440] lstrlenA (lpString="*.gif") returned 5
	[0049.440] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.png") returned 0
	[0049.440] lstrlenA (lpString="*.png") returned 5
	[0049.440] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.doc") returned 0
	[0049.440] lstrlenA (lpString="*.doc") returned 5
	[0049.440] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.docx") returned 0
	[0049.440] lstrlenA (lpString="*.docx") returned 6
	[0049.440] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.xls") returned 0
	[0049.440] lstrlenA (lpString="*.xls") returned 5
	[0049.440] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.xlsx") returned 0
	[0049.440] lstrlenA (lpString="*.xlsx") returned 6
	[0049.440] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.ppt") returned 0
	[0049.440] lstrlenA (lpString="*.ppt") returned 5
	[0049.440] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.pptx") returned 0
	[0049.440] lstrlenA (lpString="*.pptx") returned 6
	[0049.440] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.txt") returned 0
	[0049.440] lstrlenA (lpString="*.txt") returned 5
	[0049.440] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.pdf") returned 0
	[0049.440] lstrlenA (lpString="*.pdf") returned 5
	[0049.440] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.htm") returned 0
	[0049.440] lstrlenA (lpString="*.htm") returned 5
	[0049.440] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.html") returned 0
	[0049.440] lstrlenA (lpString="*.html") returned 6
	[0049.440] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.mdb") returned 0
	[0049.440] lstrlenA (lpString="*.mdb") returned 5
	[0049.441] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.pfx") returned 0
	[0049.441] lstrlenA (lpString="*.pfx") returned 5
	[0049.441] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.md") returned 0
	[0049.441] lstrlenA (lpString="*.md") returned 4
	[0049.441] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.lnk") returned 0
	[0049.441] lstrlenA (lpString="*.lnk") returned 5
	[0049.441] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.torrent") returned 0
	[0049.441] lstrlenA (lpString="*.torrent") returned 9
	[0049.441] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.mov") returned 0
	[0049.441] lstrlenA (lpString="*.mov") returned 5
	[0049.441] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.3gp") returned 0
	[0049.441] lstrlenA (lpString="*.3gp") returned 5
	[0049.441] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.mpeg") returned 0
	[0049.441] lstrlenA (lpString="*.mpeg") returned 6
	[0049.441] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.mpg") returned 0
	[0049.441] lstrlenA (lpString="*.mpg") returned 5
	[0049.441] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.flv") returned 0
	[0049.441] lstrlenA (lpString="*.flv") returned 5
	[0049.441] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.avi") returned 0
	[0049.441] lstrlenA (lpString="*.avi") returned 5
	[0049.441] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.mp4") returned 0
	[0049.441] lstrlenA (lpString="*.mp4") returned 5
	[0049.441] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.wmv") returned 0
	[0049.441] lstrlenA (lpString="*.wmv") returned 5
	[0049.441] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.mkv") returned 0
	[0049.441] lstrlenA (lpString="*.mkv") returned 5
	[0049.441] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.mp3") returned 0
	[0049.441] lstrlenA (lpString="*.mp3") returned 5
	[0049.441] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.wav") returned 0
	[0049.441] lstrlenA (lpString="*.wav") returned 5
	[0049.441] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.flac") returned 0
	[0049.441] lstrlenA (lpString="*.flac") returned 6
	[0049.441] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.wma") returned 0
	[0049.441] lstrlenA (lpString="*.wma") returned 5
	[0049.442] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.au3") returned 0
	[0049.442] lstrlenA (lpString="*.au3") returned 5
	[0049.442] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.ahk") returned 0
	[0049.442] lstrlenA (lpString="*.ahk") returned 5
	[0049.442] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.c") returned 0
	[0049.442] lstrlenA (lpString="*.c") returned 3
	[0049.442] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.cc") returned 0
	[0049.442] lstrlenA (lpString="*.cc") returned 4
	[0049.442] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.cpp") returned 0
	[0049.442] lstrlenA (lpString="*.cpp") returned 5
	[0049.442] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.cxx") returned 0
	[0049.442] lstrlenA (lpString="*.cxx") returned 5
	[0049.442] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.c++") returned 0
	[0049.442] lstrlenA (lpString="*.c++") returned 5
	[0049.442] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.cs") returned 0
	[0049.442] lstrlenA (lpString="*.cs") returned 4
	[0049.442] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.vb") returned 0
	[0049.442] lstrlenA (lpString="*.vb") returned 4
	[0049.442] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.bas") returned 0
	[0049.442] lstrlenA (lpString="*.bas") returned 5
	[0049.442] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.csproj") returned 0
	[0049.442] lstrlenA (lpString="*.csproj") returned 8
	[0049.442] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.vbproj") returned 0
	[0049.442] lstrlenA (lpString="*.vbproj") returned 8
	[0049.442] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.vcxproj") returned 0
	[0049.442] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.442] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.manifest") returned 0
	[0049.442] lstrlenA (lpString="*.manifest") returned 10
	[0049.442] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.php") returned 0
	[0049.442] lstrlenA (lpString="*.php") returned 5
	[0049.442] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.vbe") returned 0
	[0049.442] lstrlenA (lpString="*.vbe") returned 5
	[0049.442] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.vba") returned 0
	[0049.442] lstrlenA (lpString="*.vba") returned 5
	[0049.442] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.vbs") returned 0
	[0049.443] lstrlenA (lpString="*.vbs") returned 5
	[0049.443] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.bat") returned 0
	[0049.443] lstrlenA (lpString="*.bat") returned 5
	[0049.443] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.cmd") returned 0
	[0049.443] lstrlenA (lpString="*.cmd") returned 5
	[0049.467] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.js") returned 0
	[0049.467] lstrlenA (lpString="*.js") returned 4
	[0049.467] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.jscript") returned 0
	[0049.467] lstrlenA (lpString="*.jscript") returned 9
	[0049.467] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.hta") returned 0
	[0049.467] lstrlenA (lpString="*.hta") returned 5
	[0049.467] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.php7") returned 0
	[0049.467] lstrlenA (lpString="*.php7") returned 6
	[0049.467] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.db") returned 0
	[0049.467] lstrlenA (lpString="*.db") returned 4
	[0049.467] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.swf") returned 0
	[0049.467] lstrlenA (lpString="*.swf") returned 5
	[0049.467] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.eml") returned 0
	[0049.467] lstrlenA (lpString="*.eml") returned 5
	[0049.467] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.part") returned 0
	[0049.467] lstrlenA (lpString="*.part") returned 6
	[0049.467] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.nfo") returned 0
	[0049.467] lstrlenA (lpString="*.nfo") returned 5
	[0049.467] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.rsa") returned 0
	[0049.467] lstrlenA (lpString="*.rsa") returned 5
	[0049.467] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.key") returned 0
	[0049.467] lstrlenA (lpString="*.key") returned 5
	[0049.467] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.aes") returned 0
	[0049.467] lstrlenA (lpString="*.aes") returned 5
	[0049.467] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.blob") returned 0
	[0049.467] lstrlenA (lpString="*.blob") returned 6
	[0049.467] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.btc") returned 0
	[0049.467] lstrlenA (lpString="*.btc") returned 5
	[0049.467] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.wallet") returned 0
	[0049.467] lstrlenA (lpString="*.wallet") returned 8
	[0049.467] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1
	[0049.468] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.468] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Rotate6.ico") returned -1
	[0049.468] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Rotate6.ico") returned -1
	[0049.468] lstrcmpiA (lpString1="", lpString2="Rotate6.ico") returned -1
	[0049.468] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned="Rotate5.ico"
	[0049.468] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\"
	[0049.468] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\Graphics\\" | out: pszPath="C:\\588bce7c90097ed212\\Graphics\\") returned=""
	[0049.468] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.468] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\graphics\\how-to-decrypt-files.htm")) returned 0x20
	[0049.468] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Rotate6.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico"
	[0049.468] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.zip") returned 0
	[0049.468] lstrlenA (lpString="*.zip") returned 5
	[0049.468] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.rar") returned 0
	[0049.468] lstrlenA (lpString="*.rar") returned 5
	[0049.468] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.7z") returned 0
	[0049.468] lstrlenA (lpString="*.7z") returned 4
	[0049.468] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.tar") returned 0
	[0049.468] lstrlenA (lpString="*.tar") returned 5
	[0049.468] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.gzip") returned 0
	[0049.468] lstrlenA (lpString="*.gzip") returned 6
	[0049.468] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.jpg") returned 0
	[0049.468] lstrlenA (lpString="*.jpg") returned 5
	[0049.468] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.jpeg") returned 0
	[0049.468] lstrlenA (lpString="*.jpeg") returned 6
	[0049.468] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.bmp") returned 0
	[0049.468] lstrlenA (lpString="*.bmp") returned 5
	[0049.468] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.gif") returned 0
	[0049.468] lstrlenA (lpString="*.gif") returned 5
	[0049.469] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.png") returned 0
	[0049.469] lstrlenA (lpString="*.png") returned 5
	[0049.469] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.doc") returned 0
	[0049.469] lstrlenA (lpString="*.doc") returned 5
	[0049.469] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.docx") returned 0
	[0049.469] lstrlenA (lpString="*.docx") returned 6
	[0049.469] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.xls") returned 0
	[0049.469] lstrlenA (lpString="*.xls") returned 5
	[0049.469] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.xlsx") returned 0
	[0049.469] lstrlenA (lpString="*.xlsx") returned 6
	[0049.469] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.ppt") returned 0
	[0049.469] lstrlenA (lpString="*.ppt") returned 5
	[0049.469] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.pptx") returned 0
	[0049.469] lstrlenA (lpString="*.pptx") returned 6
	[0049.469] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.txt") returned 0
	[0049.469] lstrlenA (lpString="*.txt") returned 5
	[0049.469] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.pdf") returned 0
	[0049.469] lstrlenA (lpString="*.pdf") returned 5
	[0049.469] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.htm") returned 0
	[0049.469] lstrlenA (lpString="*.htm") returned 5
	[0049.469] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.html") returned 0
	[0049.469] lstrlenA (lpString="*.html") returned 6
	[0049.469] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.mdb") returned 0
	[0049.469] lstrlenA (lpString="*.mdb") returned 5
	[0049.469] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.pfx") returned 0
	[0049.469] lstrlenA (lpString="*.pfx") returned 5
	[0049.469] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.md") returned 0
	[0049.469] lstrlenA (lpString="*.md") returned 4
	[0049.469] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.lnk") returned 0
	[0049.469] lstrlenA (lpString="*.lnk") returned 5
	[0049.469] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.torrent") returned 0
	[0049.469] lstrlenA (lpString="*.torrent") returned 9
	[0049.469] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.mov") returned 0
	[0049.470] lstrlenA (lpString="*.mov") returned 5
	[0049.470] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.3gp") returned 0
	[0049.470] lstrlenA (lpString="*.3gp") returned 5
	[0049.470] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.mpeg") returned 0
	[0049.470] lstrlenA (lpString="*.mpeg") returned 6
	[0049.470] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.mpg") returned 0
	[0049.470] lstrlenA (lpString="*.mpg") returned 5
	[0049.470] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.flv") returned 0
	[0049.470] lstrlenA (lpString="*.flv") returned 5
	[0049.470] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.avi") returned 0
	[0049.470] lstrlenA (lpString="*.avi") returned 5
	[0049.470] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.mp4") returned 0
	[0049.470] lstrlenA (lpString="*.mp4") returned 5
	[0049.470] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.wmv") returned 0
	[0049.470] lstrlenA (lpString="*.wmv") returned 5
	[0049.470] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.mkv") returned 0
	[0049.470] lstrlenA (lpString="*.mkv") returned 5
	[0049.470] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.mp3") returned 0
	[0049.470] lstrlenA (lpString="*.mp3") returned 5
	[0049.470] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.wav") returned 0
	[0049.470] lstrlenA (lpString="*.wav") returned 5
	[0049.470] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.flac") returned 0
	[0049.470] lstrlenA (lpString="*.flac") returned 6
	[0049.470] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.wma") returned 0
	[0049.470] lstrlenA (lpString="*.wma") returned 5
	[0049.470] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.au3") returned 0
	[0049.470] lstrlenA (lpString="*.au3") returned 5
	[0049.470] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.ahk") returned 0
	[0049.470] lstrlenA (lpString="*.ahk") returned 5
	[0049.470] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.c") returned 0
	[0049.470] lstrlenA (lpString="*.c") returned 3
	[0049.470] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.cc") returned 0
	[0049.470] lstrlenA (lpString="*.cc") returned 4
	[0049.470] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.cpp") returned 0
	[0049.471] lstrlenA (lpString="*.cpp") returned 5
	[0049.471] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.cxx") returned 0
	[0049.471] lstrlenA (lpString="*.cxx") returned 5
	[0049.471] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.c++") returned 0
	[0049.471] lstrlenA (lpString="*.c++") returned 5
	[0049.471] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.cs") returned 0
	[0049.471] lstrlenA (lpString="*.cs") returned 4
	[0049.471] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.vb") returned 0
	[0049.471] lstrlenA (lpString="*.vb") returned 4
	[0049.471] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.bas") returned 0
	[0049.471] lstrlenA (lpString="*.bas") returned 5
	[0049.471] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.csproj") returned 0
	[0049.471] lstrlenA (lpString="*.csproj") returned 8
	[0049.471] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.vbproj") returned 0
	[0049.471] lstrlenA (lpString="*.vbproj") returned 8
	[0049.471] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.vcxproj") returned 0
	[0049.471] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.471] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.manifest") returned 0
	[0049.471] lstrlenA (lpString="*.manifest") returned 10
	[0049.471] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.php") returned 0
	[0049.471] lstrlenA (lpString="*.php") returned 5
	[0049.471] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.vbe") returned 0
	[0049.471] lstrlenA (lpString="*.vbe") returned 5
	[0049.471] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.vba") returned 0
	[0049.471] lstrlenA (lpString="*.vba") returned 5
	[0049.471] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.vbs") returned 0
	[0049.471] lstrlenA (lpString="*.vbs") returned 5
	[0049.471] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.bat") returned 0
	[0049.471] lstrlenA (lpString="*.bat") returned 5
	[0049.471] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.cmd") returned 0
	[0049.471] lstrlenA (lpString="*.cmd") returned 5
	[0049.471] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.js") returned 0
	[0049.471] lstrlenA (lpString="*.js") returned 4
	[0049.471] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.jscript") returned 0
	[0049.471] lstrlenA (lpString="*.jscript") returned 9
	[0049.472] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.hta") returned 0
	[0049.472] lstrlenA (lpString="*.hta") returned 5
	[0049.472] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.php7") returned 0
	[0049.472] lstrlenA (lpString="*.php7") returned 6
	[0049.472] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.db") returned 0
	[0049.472] lstrlenA (lpString="*.db") returned 4
	[0049.472] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.swf") returned 0
	[0049.472] lstrlenA (lpString="*.swf") returned 5
	[0049.472] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.eml") returned 0
	[0049.472] lstrlenA (lpString="*.eml") returned 5
	[0049.472] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.part") returned 0
	[0049.472] lstrlenA (lpString="*.part") returned 6
	[0049.472] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.nfo") returned 0
	[0049.472] lstrlenA (lpString="*.nfo") returned 5
	[0049.472] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.rsa") returned 0
	[0049.472] lstrlenA (lpString="*.rsa") returned 5
	[0049.472] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.key") returned 0
	[0049.472] lstrlenA (lpString="*.key") returned 5
	[0049.472] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.aes") returned 0
	[0049.472] lstrlenA (lpString="*.aes") returned 5
	[0049.472] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.blob") returned 0
	[0049.472] lstrlenA (lpString="*.blob") returned 6
	[0049.472] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.btc") returned 0
	[0049.472] lstrlenA (lpString="*.btc") returned 5
	[0049.472] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.wallet") returned 0
	[0049.472] lstrlenA (lpString="*.wallet") returned 8
	[0049.472] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1
	[0049.472] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.472] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Rotate7.ico") returned -1
	[0049.472] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Rotate7.ico") returned -1
	[0049.472] lstrcmpiA (lpString1="", lpString2="Rotate7.ico") returned -1
	[0049.472] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned="Rotate6.ico"
	[0049.472] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\"
	[0049.472] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\Graphics\\" | out: pszPath="C:\\588bce7c90097ed212\\Graphics\\") returned=""
	[0049.473] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.473] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\graphics\\how-to-decrypt-files.htm")) returned 0x20
	[0049.473] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Rotate7.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico"
	[0049.473] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.zip") returned 0
	[0049.473] lstrlenA (lpString="*.zip") returned 5
	[0049.473] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.rar") returned 0
	[0049.473] lstrlenA (lpString="*.rar") returned 5
	[0049.473] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.7z") returned 0
	[0049.473] lstrlenA (lpString="*.7z") returned 4
	[0049.473] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.tar") returned 0
	[0049.473] lstrlenA (lpString="*.tar") returned 5
	[0049.473] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.gzip") returned 0
	[0049.473] lstrlenA (lpString="*.gzip") returned 6
	[0049.473] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.jpg") returned 0
	[0049.473] lstrlenA (lpString="*.jpg") returned 5
	[0049.473] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.jpeg") returned 0
	[0049.473] lstrlenA (lpString="*.jpeg") returned 6
	[0049.473] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.bmp") returned 0
	[0049.473] lstrlenA (lpString="*.bmp") returned 5
	[0049.473] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.gif") returned 0
	[0049.473] lstrlenA (lpString="*.gif") returned 5
	[0049.473] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.png") returned 0
	[0049.473] lstrlenA (lpString="*.png") returned 5
	[0049.473] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.doc") returned 0
	[0049.473] lstrlenA (lpString="*.doc") returned 5
	[0049.473] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.docx") returned 0
	[0049.473] lstrlenA (lpString="*.docx") returned 6
	[0049.473] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.xls") returned 0
	[0049.473] lstrlenA (lpString="*.xls") returned 5
	[0049.473] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.xlsx") returned 0
	[0049.473] lstrlenA (lpString="*.xlsx") returned 6
	[0049.473] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.ppt") returned 0
	[0049.474] lstrlenA (lpString="*.ppt") returned 5
	[0049.474] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.pptx") returned 0
	[0049.474] lstrlenA (lpString="*.pptx") returned 6
	[0049.474] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.txt") returned 0
	[0049.474] lstrlenA (lpString="*.txt") returned 5
	[0049.474] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.pdf") returned 0
	[0049.474] lstrlenA (lpString="*.pdf") returned 5
	[0049.474] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.htm") returned 0
	[0049.474] lstrlenA (lpString="*.htm") returned 5
	[0049.474] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.html") returned 0
	[0049.474] lstrlenA (lpString="*.html") returned 6
	[0049.474] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.mdb") returned 0
	[0049.487] lstrlenA (lpString="*.mdb") returned 5
	[0049.487] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.pfx") returned 0
	[0049.487] lstrlenA (lpString="*.pfx") returned 5
	[0049.487] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.md") returned 0
	[0049.487] lstrlenA (lpString="*.md") returned 4
	[0049.487] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.lnk") returned 0
	[0049.487] lstrlenA (lpString="*.lnk") returned 5
	[0049.487] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.torrent") returned 0
	[0049.487] lstrlenA (lpString="*.torrent") returned 9
	[0049.487] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.mov") returned 0
	[0049.487] lstrlenA (lpString="*.mov") returned 5
	[0049.487] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.3gp") returned 0
	[0049.487] lstrlenA (lpString="*.3gp") returned 5
	[0049.487] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.mpeg") returned 0
	[0049.487] lstrlenA (lpString="*.mpeg") returned 6
	[0049.487] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.mpg") returned 0
	[0049.487] lstrlenA (lpString="*.mpg") returned 5
	[0049.487] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.flv") returned 0
	[0049.487] lstrlenA (lpString="*.flv") returned 5
	[0049.487] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.avi") returned 0
	[0049.487] lstrlenA (lpString="*.avi") returned 5
	[0049.487] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.mp4") returned 0
	[0049.487] lstrlenA (lpString="*.mp4") returned 5
	[0049.487] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.wmv") returned 0
	[0049.487] lstrlenA (lpString="*.wmv") returned 5
	[0049.487] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.mkv") returned 0
	[0049.487] lstrlenA (lpString="*.mkv") returned 5
	[0049.487] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.mp3") returned 0
	[0049.487] lstrlenA (lpString="*.mp3") returned 5
	[0049.487] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.wav") returned 0
	[0049.487] lstrlenA (lpString="*.wav") returned 5
	[0049.487] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.flac") returned 0
	[0049.488] lstrlenA (lpString="*.flac") returned 6
	[0049.488] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.wma") returned 0
	[0049.488] lstrlenA (lpString="*.wma") returned 5
	[0049.488] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.au3") returned 0
	[0049.488] lstrlenA (lpString="*.au3") returned 5
	[0049.488] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.ahk") returned 0
	[0049.488] lstrlenA (lpString="*.ahk") returned 5
	[0049.488] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.c") returned 0
	[0049.488] lstrlenA (lpString="*.c") returned 3
	[0049.488] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.cc") returned 0
	[0049.488] lstrlenA (lpString="*.cc") returned 4
	[0049.488] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.cpp") returned 0
	[0049.488] lstrlenA (lpString="*.cpp") returned 5
	[0049.488] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.cxx") returned 0
	[0049.488] lstrlenA (lpString="*.cxx") returned 5
	[0049.488] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.c++") returned 0
	[0049.488] lstrlenA (lpString="*.c++") returned 5
	[0049.488] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.cs") returned 0
	[0049.488] lstrlenA (lpString="*.cs") returned 4
	[0049.488] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.vb") returned 0
	[0049.488] lstrlenA (lpString="*.vb") returned 4
	[0049.488] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.bas") returned 0
	[0049.488] lstrlenA (lpString="*.bas") returned 5
	[0049.488] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.csproj") returned 0
	[0049.488] lstrlenA (lpString="*.csproj") returned 8
	[0049.488] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.vbproj") returned 0
	[0049.488] lstrlenA (lpString="*.vbproj") returned 8
	[0049.488] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.vcxproj") returned 0
	[0049.488] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.488] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.manifest") returned 0
	[0049.488] lstrlenA (lpString="*.manifest") returned 10
	[0049.488] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.php") returned 0
	[0049.488] lstrlenA (lpString="*.php") returned 5
	[0049.488] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.vbe") returned 0
	[0049.489] lstrlenA (lpString="*.vbe") returned 5
	[0049.489] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.vba") returned 0
	[0049.489] lstrlenA (lpString="*.vba") returned 5
	[0049.489] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.vbs") returned 0
	[0049.489] lstrlenA (lpString="*.vbs") returned 5
	[0049.489] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.bat") returned 0
	[0049.489] lstrlenA (lpString="*.bat") returned 5
	[0049.489] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.cmd") returned 0
	[0049.489] lstrlenA (lpString="*.cmd") returned 5
	[0049.489] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.js") returned 0
	[0049.489] lstrlenA (lpString="*.js") returned 4
	[0049.489] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.jscript") returned 0
	[0049.489] lstrlenA (lpString="*.jscript") returned 9
	[0049.489] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.hta") returned 0
	[0049.489] lstrlenA (lpString="*.hta") returned 5
	[0049.489] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.php7") returned 0
	[0049.489] lstrlenA (lpString="*.php7") returned 6
	[0049.489] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.db") returned 0
	[0049.489] lstrlenA (lpString="*.db") returned 4
	[0049.489] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.swf") returned 0
	[0049.489] lstrlenA (lpString="*.swf") returned 5
	[0049.489] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.eml") returned 0
	[0049.489] lstrlenA (lpString="*.eml") returned 5
	[0049.489] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.part") returned 0
	[0049.489] lstrlenA (lpString="*.part") returned 6
	[0049.489] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.nfo") returned 0
	[0049.489] lstrlenA (lpString="*.nfo") returned 5
	[0049.489] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.rsa") returned 0
	[0049.489] lstrlenA (lpString="*.rsa") returned 5
	[0049.489] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.key") returned 0
	[0049.489] lstrlenA (lpString="*.key") returned 5
	[0049.489] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.aes") returned 0
	[0049.489] lstrlenA (lpString="*.aes") returned 5
	[0049.489] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.blob") returned 0
	[0049.490] lstrlenA (lpString="*.blob") returned 6
	[0049.490] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.btc") returned 0
	[0049.490] lstrlenA (lpString="*.btc") returned 5
	[0049.490] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.wallet") returned 0
	[0049.490] lstrlenA (lpString="*.wallet") returned 8
	[0049.490] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1
	[0049.490] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.490] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Rotate8.ico") returned -1
	[0049.490] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Rotate8.ico") returned -1
	[0049.490] lstrcmpiA (lpString1="", lpString2="Rotate8.ico") returned -1
	[0049.490] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned="Rotate7.ico"
	[0049.490] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\"
	[0049.490] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\Graphics\\" | out: pszPath="C:\\588bce7c90097ed212\\Graphics\\") returned=""
	[0049.490] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.490] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\graphics\\how-to-decrypt-files.htm")) returned 0x20
	[0049.490] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Rotate8.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico"
	[0049.490] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.zip") returned 0
	[0049.490] lstrlenA (lpString="*.zip") returned 5
	[0049.490] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.rar") returned 0
	[0049.490] lstrlenA (lpString="*.rar") returned 5
	[0049.490] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.7z") returned 0
	[0049.490] lstrlenA (lpString="*.7z") returned 4
	[0049.490] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.tar") returned 0
	[0049.490] lstrlenA (lpString="*.tar") returned 5
	[0049.490] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.gzip") returned 0
	[0049.490] lstrlenA (lpString="*.gzip") returned 6
	[0049.490] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.jpg") returned 0
	[0049.491] lstrlenA (lpString="*.jpg") returned 5
	[0049.491] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.jpeg") returned 0
	[0049.491] lstrlenA (lpString="*.jpeg") returned 6
	[0049.491] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.bmp") returned 0
	[0049.491] lstrlenA (lpString="*.bmp") returned 5
	[0049.491] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.gif") returned 0
	[0049.491] lstrlenA (lpString="*.gif") returned 5
	[0049.491] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.png") returned 0
	[0049.491] lstrlenA (lpString="*.png") returned 5
	[0049.491] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.doc") returned 0
	[0049.491] lstrlenA (lpString="*.doc") returned 5
	[0049.491] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.docx") returned 0
	[0049.491] lstrlenA (lpString="*.docx") returned 6
	[0049.491] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.xls") returned 0
	[0049.491] lstrlenA (lpString="*.xls") returned 5
	[0049.491] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.xlsx") returned 0
	[0049.491] lstrlenA (lpString="*.xlsx") returned 6
	[0049.491] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.ppt") returned 0
	[0049.491] lstrlenA (lpString="*.ppt") returned 5
	[0049.491] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.pptx") returned 0
	[0049.491] lstrlenA (lpString="*.pptx") returned 6
	[0049.491] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.txt") returned 0
	[0049.491] lstrlenA (lpString="*.txt") returned 5
	[0049.491] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.pdf") returned 0
	[0049.491] lstrlenA (lpString="*.pdf") returned 5
	[0049.491] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.htm") returned 0
	[0049.491] lstrlenA (lpString="*.htm") returned 5
	[0049.491] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.html") returned 0
	[0049.491] lstrlenA (lpString="*.html") returned 6
	[0049.491] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.mdb") returned 0
	[0049.491] lstrlenA (lpString="*.mdb") returned 5
	[0049.491] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.pfx") returned 0
	[0049.491] lstrlenA (lpString="*.pfx") returned 5
	[0049.491] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.md") returned 0
	[0049.491] lstrlenA (lpString="*.md") returned 4
	[0049.492] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.lnk") returned 0
	[0049.492] lstrlenA (lpString="*.lnk") returned 5
	[0049.492] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.torrent") returned 0
	[0049.492] lstrlenA (lpString="*.torrent") returned 9
	[0049.492] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.mov") returned 0
	[0049.492] lstrlenA (lpString="*.mov") returned 5
	[0049.492] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.3gp") returned 0
	[0049.492] lstrlenA (lpString="*.3gp") returned 5
	[0049.492] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.mpeg") returned 0
	[0049.492] lstrlenA (lpString="*.mpeg") returned 6
	[0049.492] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.mpg") returned 0
	[0049.492] lstrlenA (lpString="*.mpg") returned 5
	[0049.492] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.flv") returned 0
	[0049.492] lstrlenA (lpString="*.flv") returned 5
	[0049.492] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.avi") returned 0
	[0049.492] lstrlenA (lpString="*.avi") returned 5
	[0049.492] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.mp4") returned 0
	[0049.492] lstrlenA (lpString="*.mp4") returned 5
	[0049.492] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.wmv") returned 0
	[0049.492] lstrlenA (lpString="*.wmv") returned 5
	[0049.492] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.mkv") returned 0
	[0049.492] lstrlenA (lpString="*.mkv") returned 5
	[0049.492] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.mp3") returned 0
	[0049.492] lstrlenA (lpString="*.mp3") returned 5
	[0049.492] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.wav") returned 0
	[0049.492] lstrlenA (lpString="*.wav") returned 5
	[0049.492] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.flac") returned 0
	[0049.492] lstrlenA (lpString="*.flac") returned 6
	[0049.492] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.wma") returned 0
	[0049.492] lstrlenA (lpString="*.wma") returned 5
	[0049.492] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.au3") returned 0
	[0049.492] lstrlenA (lpString="*.au3") returned 5
	[0049.492] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.ahk") returned 0
	[0049.492] lstrlenA (lpString="*.ahk") returned 5
	[0049.492] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.c") returned 0
	[0049.493] lstrlenA (lpString="*.c") returned 3
	[0049.493] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.cc") returned 0
	[0049.493] lstrlenA (lpString="*.cc") returned 4
	[0049.493] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.cpp") returned 0
	[0049.493] lstrlenA (lpString="*.cpp") returned 5
	[0049.493] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.cxx") returned 0
	[0049.493] lstrlenA (lpString="*.cxx") returned 5
	[0049.493] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.c++") returned 0
	[0049.493] lstrlenA (lpString="*.c++") returned 5
	[0049.493] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.cs") returned 0
	[0049.493] lstrlenA (lpString="*.cs") returned 4
	[0049.493] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.vb") returned 0
	[0049.493] lstrlenA (lpString="*.vb") returned 4
	[0049.493] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.bas") returned 0
	[0049.493] lstrlenA (lpString="*.bas") returned 5
	[0049.493] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.csproj") returned 0
	[0049.493] lstrlenA (lpString="*.csproj") returned 8
	[0049.493] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.vbproj") returned 0
	[0049.493] lstrlenA (lpString="*.vbproj") returned 8
	[0049.493] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.vcxproj") returned 0
	[0049.493] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.493] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.manifest") returned 0
	[0049.493] lstrlenA (lpString="*.manifest") returned 10
	[0049.493] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.php") returned 0
	[0049.493] lstrlenA (lpString="*.php") returned 5
	[0049.493] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.vbe") returned 0
	[0049.493] lstrlenA (lpString="*.vbe") returned 5
	[0049.493] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.vba") returned 0
	[0049.493] lstrlenA (lpString="*.vba") returned 5
	[0049.493] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.vbs") returned 0
	[0049.493] lstrlenA (lpString="*.vbs") returned 5
	[0049.493] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.bat") returned 0
	[0049.493] lstrlenA (lpString="*.bat") returned 5
	[0049.493] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.cmd") returned 0
	[0049.493] lstrlenA (lpString="*.cmd") returned 5
	[0049.494] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.js") returned 0
	[0049.494] lstrlenA (lpString="*.js") returned 4
	[0049.494] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.jscript") returned 0
	[0049.494] lstrlenA (lpString="*.jscript") returned 9
	[0049.494] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.hta") returned 0
	[0049.494] lstrlenA (lpString="*.hta") returned 5
	[0049.494] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.php7") returned 0
	[0049.494] lstrlenA (lpString="*.php7") returned 6
	[0049.494] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.db") returned 0
	[0049.494] lstrlenA (lpString="*.db") returned 4
	[0049.494] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.swf") returned 0
	[0049.494] lstrlenA (lpString="*.swf") returned 5
	[0049.494] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.eml") returned 0
	[0049.494] lstrlenA (lpString="*.eml") returned 5
	[0049.494] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.part") returned 0
	[0049.494] lstrlenA (lpString="*.part") returned 6
	[0049.494] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.nfo") returned 0
	[0049.494] lstrlenA (lpString="*.nfo") returned 5
	[0049.494] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.rsa") returned 0
	[0049.494] lstrlenA (lpString="*.rsa") returned 5
	[0049.494] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.key") returned 0
	[0049.494] lstrlenA (lpString="*.key") returned 5
	[0049.494] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.aes") returned 0
	[0049.494] lstrlenA (lpString="*.aes") returned 5
	[0049.494] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.blob") returned 0
	[0049.494] lstrlenA (lpString="*.blob") returned 6
	[0049.494] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.btc") returned 0
	[0049.494] lstrlenA (lpString="*.btc") returned 5
	[0049.494] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.wallet") returned 0
	[0049.494] lstrlenA (lpString="*.wallet") returned 8
	[0049.494] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico", cAlternateFileName="")) returned 1
	[0049.494] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.494] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Save.ico") returned -1
	[0049.494] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Save.ico") returned -1
	[0049.495] lstrcmpiA (lpString1="", lpString2="Save.ico") returned -1
	[0049.495] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned="Rotate8.ico"
	[0049.495] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\"
	[0049.495] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\Graphics\\" | out: pszPath="C:\\588bce7c90097ed212\\Graphics\\") returned=""
	[0049.495] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.495] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\graphics\\how-to-decrypt-files.htm")) returned 0x20
	[0049.495] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Save.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Save.ico"
	[0049.495] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.zip") returned 0
	[0049.495] lstrlenA (lpString="*.zip") returned 5
	[0049.495] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.rar") returned 0
	[0049.495] lstrlenA (lpString="*.rar") returned 5
	[0049.495] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.7z") returned 0
	[0049.495] lstrlenA (lpString="*.7z") returned 4
	[0049.495] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.tar") returned 0
	[0049.495] lstrlenA (lpString="*.tar") returned 5
	[0049.495] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.gzip") returned 0
	[0049.495] lstrlenA (lpString="*.gzip") returned 6
	[0049.495] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.jpg") returned 0
	[0049.495] lstrlenA (lpString="*.jpg") returned 5
	[0049.495] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.jpeg") returned 0
	[0049.495] lstrlenA (lpString="*.jpeg") returned 6
	[0049.495] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.bmp") returned 0
	[0049.495] lstrlenA (lpString="*.bmp") returned 5
	[0049.495] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.gif") returned 0
	[0049.495] lstrlenA (lpString="*.gif") returned 5
	[0049.495] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.png") returned 0
	[0049.495] lstrlenA (lpString="*.png") returned 5
	[0049.495] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.doc") returned 0
	[0049.495] lstrlenA (lpString="*.doc") returned 5
	[0049.495] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.docx") returned 0
	[0049.495] lstrlenA (lpString="*.docx") returned 6
	[0049.495] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.xls") returned 0
	[0049.496] lstrlenA (lpString="*.xls") returned 5
	[0049.496] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.xlsx") returned 0
	[0049.496] lstrlenA (lpString="*.xlsx") returned 6
	[0049.496] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.ppt") returned 0
	[0049.496] lstrlenA (lpString="*.ppt") returned 5
	[0049.496] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.pptx") returned 0
	[0049.496] lstrlenA (lpString="*.pptx") returned 6
	[0049.496] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.txt") returned 0
	[0049.496] lstrlenA (lpString="*.txt") returned 5
	[0049.496] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.pdf") returned 0
	[0049.496] lstrlenA (lpString="*.pdf") returned 5
	[0049.496] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.htm") returned 0
	[0049.496] lstrlenA (lpString="*.htm") returned 5
	[0049.496] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.html") returned 0
	[0049.496] lstrlenA (lpString="*.html") returned 6
	[0049.496] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.mdb") returned 0
	[0049.496] lstrlenA (lpString="*.mdb") returned 5
	[0049.496] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.pfx") returned 0
	[0049.496] lstrlenA (lpString="*.pfx") returned 5
	[0049.496] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.md") returned 0
	[0049.496] lstrlenA (lpString="*.md") returned 4
	[0049.496] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.lnk") returned 0
	[0049.496] lstrlenA (lpString="*.lnk") returned 5
	[0049.496] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.torrent") returned 0
	[0049.496] lstrlenA (lpString="*.torrent") returned 9
	[0049.496] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.mov") returned 0
	[0049.496] lstrlenA (lpString="*.mov") returned 5
	[0049.496] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.3gp") returned 0
	[0049.496] lstrlenA (lpString="*.3gp") returned 5
	[0049.496] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.mpeg") returned 0
	[0049.496] lstrlenA (lpString="*.mpeg") returned 6
	[0049.496] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.mpg") returned 0
	[0049.496] lstrlenA (lpString="*.mpg") returned 5
	[0049.496] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.flv") returned 0
	[0049.496] lstrlenA (lpString="*.flv") returned 5
	[0049.497] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.avi") returned 0
	[0049.497] lstrlenA (lpString="*.avi") returned 5
	[0049.497] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.mp4") returned 0
	[0049.497] lstrlenA (lpString="*.mp4") returned 5
	[0049.497] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.wmv") returned 0
	[0049.497] lstrlenA (lpString="*.wmv") returned 5
	[0049.497] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.mkv") returned 0
	[0049.497] lstrlenA (lpString="*.mkv") returned 5
	[0049.497] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.mp3") returned 0
	[0049.497] lstrlenA (lpString="*.mp3") returned 5
	[0049.497] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.wav") returned 0
	[0049.497] lstrlenA (lpString="*.wav") returned 5
	[0049.497] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.flac") returned 0
	[0049.497] lstrlenA (lpString="*.flac") returned 6
	[0049.497] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.wma") returned 0
	[0049.497] lstrlenA (lpString="*.wma") returned 5
	[0049.497] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.au3") returned 0
	[0049.497] lstrlenA (lpString="*.au3") returned 5
	[0049.497] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.ahk") returned 0
	[0049.497] lstrlenA (lpString="*.ahk") returned 5
	[0049.497] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.c") returned 0
	[0049.497] lstrlenA (lpString="*.c") returned 3
	[0049.497] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.cc") returned 0
	[0049.497] lstrlenA (lpString="*.cc") returned 4
	[0049.497] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.cpp") returned 0
	[0049.497] lstrlenA (lpString="*.cpp") returned 5
	[0049.497] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.cxx") returned 0
	[0049.497] lstrlenA (lpString="*.cxx") returned 5
	[0049.497] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.c++") returned 0
	[0049.497] lstrlenA (lpString="*.c++") returned 5
	[0049.497] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.cs") returned 0
	[0049.497] lstrlenA (lpString="*.cs") returned 4
	[0049.497] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.vb") returned 0
	[0049.497] lstrlenA (lpString="*.vb") returned 4
	[0049.497] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.bas") returned 0
	[0049.498] lstrlenA (lpString="*.bas") returned 5
	[0049.498] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.csproj") returned 0
	[0049.498] lstrlenA (lpString="*.csproj") returned 8
	[0049.498] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.vbproj") returned 0
	[0049.498] lstrlenA (lpString="*.vbproj") returned 8
	[0049.498] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.vcxproj") returned 0
	[0049.498] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.498] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.manifest") returned 0
	[0049.498] lstrlenA (lpString="*.manifest") returned 10
	[0049.498] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.php") returned 0
	[0049.498] lstrlenA (lpString="*.php") returned 5
	[0049.498] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.vbe") returned 0
	[0049.498] lstrlenA (lpString="*.vbe") returned 5
	[0049.498] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.vba") returned 0
	[0049.498] lstrlenA (lpString="*.vba") returned 5
	[0049.498] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.vbs") returned 0
	[0049.498] lstrlenA (lpString="*.vbs") returned 5
	[0049.498] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.bat") returned 0
	[0049.498] lstrlenA (lpString="*.bat") returned 5
	[0049.498] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.cmd") returned 0
	[0049.498] lstrlenA (lpString="*.cmd") returned 5
	[0049.498] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.js") returned 0
	[0049.498] lstrlenA (lpString="*.js") returned 4
	[0049.498] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.jscript") returned 0
	[0049.498] lstrlenA (lpString="*.jscript") returned 9
	[0049.498] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.hta") returned 0
	[0049.498] lstrlenA (lpString="*.hta") returned 5
	[0049.498] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.php7") returned 0
	[0049.498] lstrlenA (lpString="*.php7") returned 6
	[0049.498] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.db") returned 0
	[0049.498] lstrlenA (lpString="*.db") returned 4
	[0049.498] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.swf") returned 0
	[0049.498] lstrlenA (lpString="*.swf") returned 5
	[0049.498] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.eml") returned 0
	[0049.499] lstrlenA (lpString="*.eml") returned 5
	[0049.499] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.part") returned 0
	[0049.499] lstrlenA (lpString="*.part") returned 6
	[0049.499] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.nfo") returned 0
	[0049.499] lstrlenA (lpString="*.nfo") returned 5
	[0049.499] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.rsa") returned 0
	[0049.499] lstrlenA (lpString="*.rsa") returned 5
	[0049.499] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.key") returned 0
	[0049.499] lstrlenA (lpString="*.key") returned 5
	[0049.499] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.aes") returned 0
	[0049.499] lstrlenA (lpString="*.aes") returned 5
	[0049.499] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.blob") returned 0
	[0049.499] lstrlenA (lpString="*.blob") returned 6
	[0049.499] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.btc") returned 0
	[0049.499] lstrlenA (lpString="*.btc") returned 5
	[0049.499] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.wallet") returned 0
	[0049.499] lstrlenA (lpString="*.wallet") returned 8
	[0049.499] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico", cAlternateFileName="")) returned 1
	[0049.499] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.499] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Setup.ico") returned -1
	[0049.499] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Setup.ico") returned -1
	[0049.499] lstrcmpiA (lpString1="", lpString2="Setup.ico") returned -1
	[0049.499] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned="Save.ico"
	[0049.499] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\"
	[0049.499] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\Graphics\\" | out: pszPath="C:\\588bce7c90097ed212\\Graphics\\") returned=""
	[0049.499] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.499] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\graphics\\how-to-decrypt-files.htm")) returned 0x20
	[0049.499] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Setup.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Setup.ico"
	[0049.499] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.zip") returned 0
	[0049.499] lstrlenA (lpString="*.zip") returned 5
	[0049.499] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.rar") returned 0
	[0049.500] lstrlenA (lpString="*.rar") returned 5
	[0049.500] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.7z") returned 0
	[0049.500] lstrlenA (lpString="*.7z") returned 4
	[0049.500] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.tar") returned 0
	[0049.500] lstrlenA (lpString="*.tar") returned 5
	[0049.500] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.gzip") returned 0
	[0049.500] lstrlenA (lpString="*.gzip") returned 6
	[0049.500] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.jpg") returned 0
	[0049.500] lstrlenA (lpString="*.jpg") returned 5
	[0049.500] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.jpeg") returned 0
	[0049.500] lstrlenA (lpString="*.jpeg") returned 6
	[0049.500] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.bmp") returned 0
	[0049.500] lstrlenA (lpString="*.bmp") returned 5
	[0049.500] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.gif") returned 0
	[0049.500] lstrlenA (lpString="*.gif") returned 5
	[0049.500] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.png") returned 0
	[0049.500] lstrlenA (lpString="*.png") returned 5
	[0049.500] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.doc") returned 0
	[0049.500] lstrlenA (lpString="*.doc") returned 5
	[0049.500] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.docx") returned 0
	[0049.500] lstrlenA (lpString="*.docx") returned 6
	[0049.500] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.xls") returned 0
	[0049.500] lstrlenA (lpString="*.xls") returned 5
	[0049.500] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.xlsx") returned 0
	[0049.500] lstrlenA (lpString="*.xlsx") returned 6
	[0049.500] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.ppt") returned 0
	[0049.500] lstrlenA (lpString="*.ppt") returned 5
	[0049.500] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.pptx") returned 0
	[0049.500] lstrlenA (lpString="*.pptx") returned 6
	[0049.500] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.txt") returned 0
	[0049.500] lstrlenA (lpString="*.txt") returned 5
	[0049.500] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.pdf") returned 0
	[0049.500] lstrlenA (lpString="*.pdf") returned 5
	[0049.500] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.htm") returned 0
	[0049.500] lstrlenA (lpString="*.htm") returned 5
	[0049.500] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.html") returned 0
	[0049.501] lstrlenA (lpString="*.html") returned 6
	[0049.501] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.mdb") returned 0
	[0049.501] lstrlenA (lpString="*.mdb") returned 5
	[0049.501] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.pfx") returned 0
	[0049.501] lstrlenA (lpString="*.pfx") returned 5
	[0049.501] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.md") returned 0
	[0049.501] lstrlenA (lpString="*.md") returned 4
	[0049.501] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.lnk") returned 0
	[0049.501] lstrlenA (lpString="*.lnk") returned 5
	[0049.501] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.torrent") returned 0
	[0049.501] lstrlenA (lpString="*.torrent") returned 9
	[0049.501] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.mov") returned 0
	[0049.501] lstrlenA (lpString="*.mov") returned 5
	[0049.501] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.3gp") returned 0
	[0049.501] lstrlenA (lpString="*.3gp") returned 5
	[0049.501] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.mpeg") returned 0
	[0049.501] lstrlenA (lpString="*.mpeg") returned 6
	[0049.501] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.mpg") returned 0
	[0049.501] lstrlenA (lpString="*.mpg") returned 5
	[0049.501] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.flv") returned 0
	[0049.501] lstrlenA (lpString="*.flv") returned 5
	[0049.501] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.avi") returned 0
	[0049.501] lstrlenA (lpString="*.avi") returned 5
	[0049.501] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.mp4") returned 0
	[0049.501] lstrlenA (lpString="*.mp4") returned 5
	[0049.501] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.wmv") returned 0
	[0049.501] lstrlenA (lpString="*.wmv") returned 5
	[0049.501] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.mkv") returned 0
	[0049.501] lstrlenA (lpString="*.mkv") returned 5
	[0049.501] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.mp3") returned 0
	[0049.501] lstrlenA (lpString="*.mp3") returned 5
	[0049.501] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.wav") returned 0
	[0049.501] lstrlenA (lpString="*.wav") returned 5
	[0049.501] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.flac") returned 0
	[0049.501] lstrlenA (lpString="*.flac") returned 6
	[0049.501] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.wma") returned 0
	[0049.502] lstrlenA (lpString="*.wma") returned 5
	[0049.502] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.au3") returned 0
	[0049.502] lstrlenA (lpString="*.au3") returned 5
	[0049.502] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.ahk") returned 0
	[0049.502] lstrlenA (lpString="*.ahk") returned 5
	[0049.502] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.c") returned 0
	[0049.502] lstrlenA (lpString="*.c") returned 3
	[0049.502] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.cc") returned 0
	[0049.502] lstrlenA (lpString="*.cc") returned 4
	[0049.502] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.cpp") returned 0
	[0049.502] lstrlenA (lpString="*.cpp") returned 5
	[0049.502] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.cxx") returned 0
	[0049.502] lstrlenA (lpString="*.cxx") returned 5
	[0049.502] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.c++") returned 0
	[0049.502] lstrlenA (lpString="*.c++") returned 5
	[0049.502] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.cs") returned 0
	[0049.502] lstrlenA (lpString="*.cs") returned 4
	[0049.502] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.vb") returned 0
	[0049.502] lstrlenA (lpString="*.vb") returned 4
	[0049.502] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.bas") returned 0
	[0049.502] lstrlenA (lpString="*.bas") returned 5
	[0049.502] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.csproj") returned 0
	[0049.502] lstrlenA (lpString="*.csproj") returned 8
	[0049.502] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.vbproj") returned 0
	[0049.502] lstrlenA (lpString="*.vbproj") returned 8
	[0049.502] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.vcxproj") returned 0
	[0049.502] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.502] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.manifest") returned 0
	[0049.502] lstrlenA (lpString="*.manifest") returned 10
	[0049.502] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.php") returned 0
	[0049.502] lstrlenA (lpString="*.php") returned 5
	[0049.502] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.vbe") returned 0
	[0049.502] lstrlenA (lpString="*.vbe") returned 5
	[0049.502] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.vba") returned 0
	[0049.502] lstrlenA (lpString="*.vba") returned 5
	[0049.503] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.vbs") returned 0
	[0049.503] lstrlenA (lpString="*.vbs") returned 5
	[0049.503] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.bat") returned 0
	[0049.503] lstrlenA (lpString="*.bat") returned 5
	[0049.503] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.cmd") returned 0
	[0049.503] lstrlenA (lpString="*.cmd") returned 5
	[0049.503] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.js") returned 0
	[0049.503] lstrlenA (lpString="*.js") returned 4
	[0049.503] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.jscript") returned 0
	[0049.503] lstrlenA (lpString="*.jscript") returned 9
	[0049.503] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.hta") returned 0
	[0049.503] lstrlenA (lpString="*.hta") returned 5
	[0049.503] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.php7") returned 0
	[0049.503] lstrlenA (lpString="*.php7") returned 6
	[0049.503] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.db") returned 0
	[0049.503] lstrlenA (lpString="*.db") returned 4
	[0049.503] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.swf") returned 0
	[0049.503] lstrlenA (lpString="*.swf") returned 5
	[0049.503] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.eml") returned 0
	[0049.503] lstrlenA (lpString="*.eml") returned 5
	[0049.503] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.part") returned 0
	[0049.503] lstrlenA (lpString="*.part") returned 6
	[0049.503] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.nfo") returned 0
	[0049.503] lstrlenA (lpString="*.nfo") returned 5
	[0049.503] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.rsa") returned 0
	[0049.503] lstrlenA (lpString="*.rsa") returned 5
	[0049.503] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.key") returned 0
	[0049.503] lstrlenA (lpString="*.key") returned 5
	[0049.503] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.aes") returned 0
	[0049.503] lstrlenA (lpString="*.aes") returned 5
	[0049.503] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.blob") returned 0
	[0049.503] lstrlenA (lpString="*.blob") returned 6
	[0049.503] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.btc") returned 0
	[0049.503] lstrlenA (lpString="*.btc") returned 5
	[0049.503] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.wallet") returned 0
	[0049.503] lstrlenA (lpString="*.wallet") returned 8
	[0049.504] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico", cAlternateFileName="")) returned 1
	[0049.504] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.504] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="stop.ico") returned -1
	[0049.504] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="stop.ico") returned -1
	[0049.504] lstrcmpiA (lpString1="", lpString2="stop.ico") returned -1
	[0049.504] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned="Setup.ico"
	[0049.504] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\"
	[0049.504] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\Graphics\\" | out: pszPath="C:\\588bce7c90097ed212\\Graphics\\") returned=""
	[0049.504] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.504] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\graphics\\how-to-decrypt-files.htm")) returned 0x20
	[0049.504] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="stop.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned="C:\\588bce7c90097ed212\\Graphics\\stop.ico"
	[0049.504] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.zip") returned 0
	[0049.504] lstrlenA (lpString="*.zip") returned 5
	[0049.504] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.rar") returned 0
	[0049.504] lstrlenA (lpString="*.rar") returned 5
	[0049.504] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.7z") returned 0
	[0049.504] lstrlenA (lpString="*.7z") returned 4
	[0049.504] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.tar") returned 0
	[0049.504] lstrlenA (lpString="*.tar") returned 5
	[0049.504] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.gzip") returned 0
	[0049.504] lstrlenA (lpString="*.gzip") returned 6
	[0049.504] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.jpg") returned 0
	[0049.504] lstrlenA (lpString="*.jpg") returned 5
	[0049.504] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.jpeg") returned 0
	[0049.504] lstrlenA (lpString="*.jpeg") returned 6
	[0049.504] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.bmp") returned 0
	[0049.504] lstrlenA (lpString="*.bmp") returned 5
	[0049.504] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.gif") returned 0
	[0049.504] lstrlenA (lpString="*.gif") returned 5
	[0049.504] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.png") returned 0
	[0049.504] lstrlenA (lpString="*.png") returned 5
	[0049.504] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.doc") returned 0
	[0049.504] lstrlenA (lpString="*.doc") returned 5
	[0049.505] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.docx") returned 0
	[0049.505] lstrlenA (lpString="*.docx") returned 6
	[0049.505] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.xls") returned 0
	[0049.505] lstrlenA (lpString="*.xls") returned 5
	[0049.505] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.xlsx") returned 0
	[0049.505] lstrlenA (lpString="*.xlsx") returned 6
	[0049.505] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.ppt") returned 0
	[0049.505] lstrlenA (lpString="*.ppt") returned 5
	[0049.505] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.pptx") returned 0
	[0049.505] lstrlenA (lpString="*.pptx") returned 6
	[0049.505] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.txt") returned 0
	[0049.505] lstrlenA (lpString="*.txt") returned 5
	[0049.505] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.pdf") returned 0
	[0049.505] lstrlenA (lpString="*.pdf") returned 5
	[0049.505] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.htm") returned 0
	[0049.505] lstrlenA (lpString="*.htm") returned 5
	[0049.505] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.html") returned 0
	[0049.505] lstrlenA (lpString="*.html") returned 6
	[0049.505] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.mdb") returned 0
	[0049.505] lstrlenA (lpString="*.mdb") returned 5
	[0049.505] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.pfx") returned 0
	[0049.505] lstrlenA (lpString="*.pfx") returned 5
	[0049.505] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.md") returned 0
	[0049.513] lstrlenA (lpString="*.md") returned 4
	[0049.513] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.lnk") returned 0
	[0049.513] lstrlenA (lpString="*.lnk") returned 5
	[0049.513] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.torrent") returned 0
	[0049.513] lstrlenA (lpString="*.torrent") returned 9
	[0049.513] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.mov") returned 0
	[0049.513] lstrlenA (lpString="*.mov") returned 5
	[0049.513] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.3gp") returned 0
	[0049.513] lstrlenA (lpString="*.3gp") returned 5
	[0049.513] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.mpeg") returned 0
	[0049.513] lstrlenA (lpString="*.mpeg") returned 6
	[0049.513] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.mpg") returned 0
	[0049.513] lstrlenA (lpString="*.mpg") returned 5
	[0049.513] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.flv") returned 0
	[0049.513] lstrlenA (lpString="*.flv") returned 5
	[0049.513] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.avi") returned 0
	[0049.513] lstrlenA (lpString="*.avi") returned 5
	[0049.513] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.mp4") returned 0
	[0049.513] lstrlenA (lpString="*.mp4") returned 5
	[0049.513] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.wmv") returned 0
	[0049.513] lstrlenA (lpString="*.wmv") returned 5
	[0049.513] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.mkv") returned 0
	[0049.513] lstrlenA (lpString="*.mkv") returned 5
	[0049.513] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.mp3") returned 0
	[0049.513] lstrlenA (lpString="*.mp3") returned 5
	[0049.513] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.wav") returned 0
	[0049.513] lstrlenA (lpString="*.wav") returned 5
	[0049.513] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.flac") returned 0
	[0049.514] lstrlenA (lpString="*.flac") returned 6
	[0049.514] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.wma") returned 0
	[0049.514] lstrlenA (lpString="*.wma") returned 5
	[0049.514] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.au3") returned 0
	[0049.514] lstrlenA (lpString="*.au3") returned 5
	[0049.514] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.ahk") returned 0
	[0049.514] lstrlenA (lpString="*.ahk") returned 5
	[0049.514] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.c") returned 0
	[0049.514] lstrlenA (lpString="*.c") returned 3
	[0049.514] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.cc") returned 0
	[0049.514] lstrlenA (lpString="*.cc") returned 4
	[0049.514] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.cpp") returned 0
	[0049.514] lstrlenA (lpString="*.cpp") returned 5
	[0049.514] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.cxx") returned 0
	[0049.514] lstrlenA (lpString="*.cxx") returned 5
	[0049.514] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.c++") returned 0
	[0049.514] lstrlenA (lpString="*.c++") returned 5
	[0049.514] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.cs") returned 0
	[0049.514] lstrlenA (lpString="*.cs") returned 4
	[0049.514] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.vb") returned 0
	[0049.514] lstrlenA (lpString="*.vb") returned 4
	[0049.514] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.bas") returned 0
	[0049.514] lstrlenA (lpString="*.bas") returned 5
	[0049.514] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.csproj") returned 0
	[0049.514] lstrlenA (lpString="*.csproj") returned 8
	[0049.514] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.vbproj") returned 0
	[0049.514] lstrlenA (lpString="*.vbproj") returned 8
	[0049.514] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.vcxproj") returned 0
	[0049.514] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.514] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.manifest") returned 0
	[0049.514] lstrlenA (lpString="*.manifest") returned 10
	[0049.514] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.php") returned 0
	[0049.514] lstrlenA (lpString="*.php") returned 5
	[0049.514] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.vbe") returned 0
	[0049.514] lstrlenA (lpString="*.vbe") returned 5
	[0049.515] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.vba") returned 0
	[0049.515] lstrlenA (lpString="*.vba") returned 5
	[0049.515] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.vbs") returned 0
	[0049.515] lstrlenA (lpString="*.vbs") returned 5
	[0049.515] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.bat") returned 0
	[0049.515] lstrlenA (lpString="*.bat") returned 5
	[0049.515] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.cmd") returned 0
	[0049.515] lstrlenA (lpString="*.cmd") returned 5
	[0049.515] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.js") returned 0
	[0049.515] lstrlenA (lpString="*.js") returned 4
	[0049.515] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.jscript") returned 0
	[0049.515] lstrlenA (lpString="*.jscript") returned 9
	[0049.515] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.hta") returned 0
	[0049.515] lstrlenA (lpString="*.hta") returned 5
	[0049.515] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.php7") returned 0
	[0049.515] lstrlenA (lpString="*.php7") returned 6
	[0049.515] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.db") returned 0
	[0049.515] lstrlenA (lpString="*.db") returned 4
	[0049.515] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.swf") returned 0
	[0049.515] lstrlenA (lpString="*.swf") returned 5
	[0049.515] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.eml") returned 0
	[0049.515] lstrlenA (lpString="*.eml") returned 5
	[0049.515] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.part") returned 0
	[0049.515] lstrlenA (lpString="*.part") returned 6
	[0049.515] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.nfo") returned 0
	[0049.515] lstrlenA (lpString="*.nfo") returned 5
	[0049.515] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.rsa") returned 0
	[0049.515] lstrlenA (lpString="*.rsa") returned 5
	[0049.515] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.key") returned 0
	[0049.515] lstrlenA (lpString="*.key") returned 5
	[0049.515] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.aes") returned 0
	[0049.515] lstrlenA (lpString="*.aes") returned 5
	[0049.515] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.blob") returned 0
	[0049.515] lstrlenA (lpString="*.blob") returned 6
	[0049.516] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.btc") returned 0
	[0049.516] lstrlenA (lpString="*.btc") returned 5
	[0049.516] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.wallet") returned 0
	[0049.516] lstrlenA (lpString="*.wallet") returned 8
	[0049.516] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1
	[0049.516] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.516] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SysReqMet.ico") returned -1
	[0049.516] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SysReqMet.ico") returned -1
	[0049.516] lstrcmpiA (lpString1="", lpString2="SysReqMet.ico") returned -1
	[0049.516] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned="stop.ico"
	[0049.516] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\"
	[0049.516] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\Graphics\\" | out: pszPath="C:\\588bce7c90097ed212\\Graphics\\") returned=""
	[0049.516] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.516] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\graphics\\how-to-decrypt-files.htm")) returned 0x20
	[0049.516] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="SysReqMet.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico"
	[0049.516] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.zip") returned 0
	[0049.516] lstrlenA (lpString="*.zip") returned 5
	[0049.516] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.rar") returned 0
	[0049.516] lstrlenA (lpString="*.rar") returned 5
	[0049.516] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.7z") returned 0
	[0049.516] lstrlenA (lpString="*.7z") returned 4
	[0049.516] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.tar") returned 0
	[0049.516] lstrlenA (lpString="*.tar") returned 5
	[0049.516] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.gzip") returned 0
	[0049.516] lstrlenA (lpString="*.gzip") returned 6
	[0049.516] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.jpg") returned 0
	[0049.516] lstrlenA (lpString="*.jpg") returned 5
	[0049.516] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.jpeg") returned 0
	[0049.516] lstrlenA (lpString="*.jpeg") returned 6
	[0049.516] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.bmp") returned 0
	[0049.517] lstrlenA (lpString="*.bmp") returned 5
	[0049.517] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.gif") returned 0
	[0049.517] lstrlenA (lpString="*.gif") returned 5
	[0049.517] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.png") returned 0
	[0049.517] lstrlenA (lpString="*.png") returned 5
	[0049.517] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.doc") returned 0
	[0049.517] lstrlenA (lpString="*.doc") returned 5
	[0049.517] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.docx") returned 0
	[0049.517] lstrlenA (lpString="*.docx") returned 6
	[0049.517] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.xls") returned 0
	[0049.517] lstrlenA (lpString="*.xls") returned 5
	[0049.517] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.xlsx") returned 0
	[0049.517] lstrlenA (lpString="*.xlsx") returned 6
	[0049.517] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.ppt") returned 0
	[0049.517] lstrlenA (lpString="*.ppt") returned 5
	[0049.517] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.pptx") returned 0
	[0049.517] lstrlenA (lpString="*.pptx") returned 6
	[0049.517] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.txt") returned 0
	[0049.517] lstrlenA (lpString="*.txt") returned 5
	[0049.517] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.pdf") returned 0
	[0049.517] lstrlenA (lpString="*.pdf") returned 5
	[0049.517] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.htm") returned 0
	[0049.517] lstrlenA (lpString="*.htm") returned 5
	[0049.517] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.html") returned 0
	[0049.517] lstrlenA (lpString="*.html") returned 6
	[0049.517] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.mdb") returned 0
	[0049.517] lstrlenA (lpString="*.mdb") returned 5
	[0049.517] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.pfx") returned 0
	[0049.517] lstrlenA (lpString="*.pfx") returned 5
	[0049.517] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.md") returned 0
	[0049.517] lstrlenA (lpString="*.md") returned 4
	[0049.517] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.lnk") returned 0
	[0049.517] lstrlenA (lpString="*.lnk") returned 5
	[0049.517] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.torrent") returned 0
	[0049.517] lstrlenA (lpString="*.torrent") returned 9
	[0049.518] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.mov") returned 0
	[0049.518] lstrlenA (lpString="*.mov") returned 5
	[0049.518] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.3gp") returned 0
	[0049.518] lstrlenA (lpString="*.3gp") returned 5
	[0049.518] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.mpeg") returned 0
	[0049.518] lstrlenA (lpString="*.mpeg") returned 6
	[0049.518] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.mpg") returned 0
	[0049.518] lstrlenA (lpString="*.mpg") returned 5
	[0049.518] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.flv") returned 0
	[0049.518] lstrlenA (lpString="*.flv") returned 5
	[0049.518] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.avi") returned 0
	[0049.518] lstrlenA (lpString="*.avi") returned 5
	[0049.518] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.mp4") returned 0
	[0049.518] lstrlenA (lpString="*.mp4") returned 5
	[0049.518] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.wmv") returned 0
	[0049.518] lstrlenA (lpString="*.wmv") returned 5
	[0049.518] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.mkv") returned 0
	[0049.518] lstrlenA (lpString="*.mkv") returned 5
	[0049.518] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.mp3") returned 0
	[0049.518] lstrlenA (lpString="*.mp3") returned 5
	[0049.518] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.wav") returned 0
	[0049.518] lstrlenA (lpString="*.wav") returned 5
	[0049.518] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.flac") returned 0
	[0049.518] lstrlenA (lpString="*.flac") returned 6
	[0049.518] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.wma") returned 0
	[0049.518] lstrlenA (lpString="*.wma") returned 5
	[0049.518] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.au3") returned 0
	[0049.518] lstrlenA (lpString="*.au3") returned 5
	[0049.518] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.ahk") returned 0
	[0049.518] lstrlenA (lpString="*.ahk") returned 5
	[0049.518] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.c") returned 0
	[0049.518] lstrlenA (lpString="*.c") returned 3
	[0049.518] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.cc") returned 0
	[0049.518] lstrlenA (lpString="*.cc") returned 4
	[0049.519] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.cpp") returned 0
	[0049.519] lstrlenA (lpString="*.cpp") returned 5
	[0049.519] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.cxx") returned 0
	[0049.519] lstrlenA (lpString="*.cxx") returned 5
	[0049.519] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.c++") returned 0
	[0049.519] lstrlenA (lpString="*.c++") returned 5
	[0049.519] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.cs") returned 0
	[0049.519] lstrlenA (lpString="*.cs") returned 4
	[0049.519] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.vb") returned 0
	[0049.519] lstrlenA (lpString="*.vb") returned 4
	[0049.519] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.bas") returned 0
	[0049.519] lstrlenA (lpString="*.bas") returned 5
	[0049.519] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.csproj") returned 0
	[0049.519] lstrlenA (lpString="*.csproj") returned 8
	[0049.519] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.vbproj") returned 0
	[0049.519] lstrlenA (lpString="*.vbproj") returned 8
	[0049.519] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.vcxproj") returned 0
	[0049.519] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.519] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.manifest") returned 0
	[0049.519] lstrlenA (lpString="*.manifest") returned 10
	[0049.519] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.php") returned 0
	[0049.519] lstrlenA (lpString="*.php") returned 5
	[0049.519] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.vbe") returned 0
	[0049.519] lstrlenA (lpString="*.vbe") returned 5
	[0049.519] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.vba") returned 0
	[0049.519] lstrlenA (lpString="*.vba") returned 5
	[0049.519] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.vbs") returned 0
	[0049.519] lstrlenA (lpString="*.vbs") returned 5
	[0049.519] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.bat") returned 0
	[0049.519] lstrlenA (lpString="*.bat") returned 5
	[0049.519] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.cmd") returned 0
	[0049.519] lstrlenA (lpString="*.cmd") returned 5
	[0049.519] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.js") returned 0
	[0049.519] lstrlenA (lpString="*.js") returned 4
	[0049.520] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.jscript") returned 0
	[0049.520] lstrlenA (lpString="*.jscript") returned 9
	[0049.520] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.hta") returned 0
	[0049.520] lstrlenA (lpString="*.hta") returned 5
	[0049.520] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.php7") returned 0
	[0049.520] lstrlenA (lpString="*.php7") returned 6
	[0049.520] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.db") returned 0
	[0049.520] lstrlenA (lpString="*.db") returned 4
	[0049.520] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.swf") returned 0
	[0049.520] lstrlenA (lpString="*.swf") returned 5
	[0049.520] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.eml") returned 0
	[0049.520] lstrlenA (lpString="*.eml") returned 5
	[0049.520] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.part") returned 0
	[0049.520] lstrlenA (lpString="*.part") returned 6
	[0049.520] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.nfo") returned 0
	[0049.520] lstrlenA (lpString="*.nfo") returned 5
	[0049.520] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.rsa") returned 0
	[0049.520] lstrlenA (lpString="*.rsa") returned 5
	[0049.520] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.key") returned 0
	[0049.520] lstrlenA (lpString="*.key") returned 5
	[0049.520] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.aes") returned 0
	[0049.520] lstrlenA (lpString="*.aes") returned 5
	[0049.520] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.blob") returned 0
	[0049.520] lstrlenA (lpString="*.blob") returned 6
	[0049.520] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.btc") returned 0
	[0049.520] lstrlenA (lpString="*.btc") returned 5
	[0049.520] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.wallet") returned 0
	[0049.520] lstrlenA (lpString="*.wallet") returned 8
	[0049.520] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1
	[0049.520] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.520] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SysReqNotMet.ico") returned -1
	[0049.520] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SysReqNotMet.ico") returned -1
	[0049.520] lstrcmpiA (lpString1="", lpString2="SysReqNotMet.ico") returned -1
	[0049.520] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned="SysReqMet.ico"
	[0049.520] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\"
	[0049.521] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\Graphics\\" | out: pszPath="C:\\588bce7c90097ed212\\Graphics\\") returned=""
	[0049.521] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.521] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\graphics\\how-to-decrypt-files.htm")) returned 0x20
	[0049.521] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="SysReqNotMet.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico"
	[0049.521] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.zip") returned 0
	[0049.521] lstrlenA (lpString="*.zip") returned 5
	[0049.521] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.rar") returned 0
	[0049.521] lstrlenA (lpString="*.rar") returned 5
	[0049.521] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.7z") returned 0
	[0049.521] lstrlenA (lpString="*.7z") returned 4
	[0049.521] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.tar") returned 0
	[0049.521] lstrlenA (lpString="*.tar") returned 5
	[0049.521] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.gzip") returned 0
	[0049.521] lstrlenA (lpString="*.gzip") returned 6
	[0049.521] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.jpg") returned 0
	[0049.521] lstrlenA (lpString="*.jpg") returned 5
	[0049.521] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.jpeg") returned 0
	[0049.521] lstrlenA (lpString="*.jpeg") returned 6
	[0049.521] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.bmp") returned 0
	[0049.521] lstrlenA (lpString="*.bmp") returned 5
	[0049.521] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.gif") returned 0
	[0049.521] lstrlenA (lpString="*.gif") returned 5
	[0049.521] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.png") returned 0
	[0049.521] lstrlenA (lpString="*.png") returned 5
	[0049.522] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.doc") returned 0
	[0049.522] lstrlenA (lpString="*.doc") returned 5
	[0049.522] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.docx") returned 0
	[0049.522] lstrlenA (lpString="*.docx") returned 6
	[0049.522] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.xls") returned 0
	[0049.522] lstrlenA (lpString="*.xls") returned 5
	[0049.522] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.xlsx") returned 0
	[0049.522] lstrlenA (lpString="*.xlsx") returned 6
	[0049.522] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.ppt") returned 0
	[0049.522] lstrlenA (lpString="*.ppt") returned 5
	[0049.522] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.pptx") returned 0
	[0049.522] lstrlenA (lpString="*.pptx") returned 6
	[0049.522] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.txt") returned 0
	[0049.522] lstrlenA (lpString="*.txt") returned 5
	[0049.522] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.pdf") returned 0
	[0049.522] lstrlenA (lpString="*.pdf") returned 5
	[0049.522] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.htm") returned 0
	[0049.522] lstrlenA (lpString="*.htm") returned 5
	[0049.522] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.html") returned 0
	[0049.522] lstrlenA (lpString="*.html") returned 6
	[0049.522] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.mdb") returned 0
	[0049.522] lstrlenA (lpString="*.mdb") returned 5
	[0049.522] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.pfx") returned 0
	[0049.522] lstrlenA (lpString="*.pfx") returned 5
	[0049.522] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.md") returned 0
	[0049.522] lstrlenA (lpString="*.md") returned 4
	[0049.522] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.lnk") returned 0
	[0049.522] lstrlenA (lpString="*.lnk") returned 5
	[0049.522] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.torrent") returned 0
	[0049.522] lstrlenA (lpString="*.torrent") returned 9
	[0049.522] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.mov") returned 0
	[0049.522] lstrlenA (lpString="*.mov") returned 5
	[0049.522] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.3gp") returned 0
	[0049.522] lstrlenA (lpString="*.3gp") returned 5
	[0049.522] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.mpeg") returned 0
	[0049.523] lstrlenA (lpString="*.mpeg") returned 6
	[0049.523] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.mpg") returned 0
	[0049.523] lstrlenA (lpString="*.mpg") returned 5
	[0049.523] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.flv") returned 0
	[0049.523] lstrlenA (lpString="*.flv") returned 5
	[0049.523] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.avi") returned 0
	[0049.523] lstrlenA (lpString="*.avi") returned 5
	[0049.523] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.mp4") returned 0
	[0049.523] lstrlenA (lpString="*.mp4") returned 5
	[0049.523] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.wmv") returned 0
	[0049.523] lstrlenA (lpString="*.wmv") returned 5
	[0049.523] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.mkv") returned 0
	[0049.523] lstrlenA (lpString="*.mkv") returned 5
	[0049.523] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.mp3") returned 0
	[0049.523] lstrlenA (lpString="*.mp3") returned 5
	[0049.523] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.wav") returned 0
	[0049.523] lstrlenA (lpString="*.wav") returned 5
	[0049.523] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.flac") returned 0
	[0049.523] lstrlenA (lpString="*.flac") returned 6
	[0049.523] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.wma") returned 0
	[0049.523] lstrlenA (lpString="*.wma") returned 5
	[0049.523] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.au3") returned 0
	[0049.523] lstrlenA (lpString="*.au3") returned 5
	[0049.523] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.ahk") returned 0
	[0049.523] lstrlenA (lpString="*.ahk") returned 5
	[0049.523] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.c") returned 0
	[0049.523] lstrlenA (lpString="*.c") returned 3
	[0049.523] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.cc") returned 0
	[0049.523] lstrlenA (lpString="*.cc") returned 4
	[0049.523] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.cpp") returned 0
	[0049.523] lstrlenA (lpString="*.cpp") returned 5
	[0049.523] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.cxx") returned 0
	[0049.523] lstrlenA (lpString="*.cxx") returned 5
	[0049.523] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.c++") returned 0
	[0049.524] lstrlenA (lpString="*.c++") returned 5
	[0049.524] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.cs") returned 0
	[0049.524] lstrlenA (lpString="*.cs") returned 4
	[0049.524] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.vb") returned 0
	[0049.524] lstrlenA (lpString="*.vb") returned 4
	[0049.524] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.bas") returned 0
	[0049.524] lstrlenA (lpString="*.bas") returned 5
	[0049.524] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.csproj") returned 0
	[0049.524] lstrlenA (lpString="*.csproj") returned 8
	[0049.524] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.vbproj") returned 0
	[0049.524] lstrlenA (lpString="*.vbproj") returned 8
	[0049.524] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.vcxproj") returned 0
	[0049.524] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.524] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.manifest") returned 0
	[0049.524] lstrlenA (lpString="*.manifest") returned 10
	[0049.524] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.php") returned 0
	[0049.524] lstrlenA (lpString="*.php") returned 5
	[0049.524] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.vbe") returned 0
	[0049.524] lstrlenA (lpString="*.vbe") returned 5
	[0049.524] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.vba") returned 0
	[0049.524] lstrlenA (lpString="*.vba") returned 5
	[0049.524] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.vbs") returned 0
	[0049.524] lstrlenA (lpString="*.vbs") returned 5
	[0049.524] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.bat") returned 0
	[0049.524] lstrlenA (lpString="*.bat") returned 5
	[0049.524] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.cmd") returned 0
	[0049.524] lstrlenA (lpString="*.cmd") returned 5
	[0049.524] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.js") returned 0
	[0049.524] lstrlenA (lpString="*.js") returned 4
	[0049.524] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.jscript") returned 0
	[0049.524] lstrlenA (lpString="*.jscript") returned 9
	[0049.524] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.hta") returned 0
	[0049.524] lstrlenA (lpString="*.hta") returned 5
	[0049.524] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.php7") returned 0
	[0049.524] lstrlenA (lpString="*.php7") returned 6
	[0049.524] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.db") returned 0
	[0049.525] lstrlenA (lpString="*.db") returned 4
	[0049.525] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.swf") returned 0
	[0049.525] lstrlenA (lpString="*.swf") returned 5
	[0049.525] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.eml") returned 0
	[0049.525] lstrlenA (lpString="*.eml") returned 5
	[0049.525] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.part") returned 0
	[0049.525] lstrlenA (lpString="*.part") returned 6
	[0049.525] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.nfo") returned 0
	[0049.525] lstrlenA (lpString="*.nfo") returned 5
	[0049.525] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.rsa") returned 0
	[0049.525] lstrlenA (lpString="*.rsa") returned 5
	[0049.525] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.key") returned 0
	[0049.525] lstrlenA (lpString="*.key") returned 5
	[0049.525] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.aes") returned 0
	[0049.525] lstrlenA (lpString="*.aes") returned 5
	[0049.525] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.blob") returned 0
	[0049.525] lstrlenA (lpString="*.blob") returned 6
	[0049.525] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.btc") returned 0
	[0049.525] lstrlenA (lpString="*.btc") returned 5
	[0049.525] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.wallet") returned 0
	[0049.525] lstrlenA (lpString="*.wallet") returned 8
	[0049.525] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 1
	[0049.525] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.525] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="warn.ico") returned -1
	[0049.525] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="warn.ico") returned -1
	[0049.525] lstrcmpiA (lpString1="", lpString2="warn.ico") returned -1
	[0049.525] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned="SysReqNotMet.ico"
	[0049.525] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\"
	[0049.525] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\Graphics\\" | out: pszPath="C:\\588bce7c90097ed212\\Graphics\\") returned=""
	[0049.525] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.525] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\graphics\\how-to-decrypt-files.htm")) returned 0x20
	[0049.525] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="warn.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned="C:\\588bce7c90097ed212\\Graphics\\warn.ico"
	[0049.526] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.zip") returned 0
	[0049.526] lstrlenA (lpString="*.zip") returned 5
	[0049.526] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.rar") returned 0
	[0049.526] lstrlenA (lpString="*.rar") returned 5
	[0049.526] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.7z") returned 0
	[0049.526] lstrlenA (lpString="*.7z") returned 4
	[0049.526] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.tar") returned 0
	[0049.526] lstrlenA (lpString="*.tar") returned 5
	[0049.526] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.gzip") returned 0
	[0049.526] lstrlenA (lpString="*.gzip") returned 6
	[0049.526] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.jpg") returned 0
	[0049.526] lstrlenA (lpString="*.jpg") returned 5
	[0049.526] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.jpeg") returned 0
	[0049.526] lstrlenA (lpString="*.jpeg") returned 6
	[0049.526] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.bmp") returned 0
	[0049.526] lstrlenA (lpString="*.bmp") returned 5
	[0049.526] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.gif") returned 0
	[0049.526] lstrlenA (lpString="*.gif") returned 5
	[0049.526] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.png") returned 0
	[0049.526] lstrlenA (lpString="*.png") returned 5
	[0049.526] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.doc") returned 0
	[0049.526] lstrlenA (lpString="*.doc") returned 5
	[0049.526] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.docx") returned 0
	[0049.526] lstrlenA (lpString="*.docx") returned 6
	[0049.526] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.xls") returned 0
	[0049.526] lstrlenA (lpString="*.xls") returned 5
	[0049.526] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.xlsx") returned 0
	[0049.526] lstrlenA (lpString="*.xlsx") returned 6
	[0049.526] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.ppt") returned 0
	[0049.526] lstrlenA (lpString="*.ppt") returned 5
	[0049.526] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.pptx") returned 0
	[0049.526] lstrlenA (lpString="*.pptx") returned 6
	[0049.526] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.txt") returned 0
	[0049.526] lstrlenA (lpString="*.txt") returned 5
	[0049.527] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.pdf") returned 0
	[0049.527] lstrlenA (lpString="*.pdf") returned 5
	[0049.527] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.htm") returned 0
	[0049.527] lstrlenA (lpString="*.htm") returned 5
	[0049.527] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.html") returned 0
	[0049.527] lstrlenA (lpString="*.html") returned 6
	[0049.527] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.mdb") returned 0
	[0049.527] lstrlenA (lpString="*.mdb") returned 5
	[0049.527] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.pfx") returned 0
	[0049.527] lstrlenA (lpString="*.pfx") returned 5
	[0049.527] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.md") returned 0
	[0049.527] lstrlenA (lpString="*.md") returned 4
	[0049.527] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.lnk") returned 0
	[0049.527] lstrlenA (lpString="*.lnk") returned 5
	[0049.527] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.torrent") returned 0
	[0049.527] lstrlenA (lpString="*.torrent") returned 9
	[0049.527] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.mov") returned 0
	[0049.527] lstrlenA (lpString="*.mov") returned 5
	[0049.527] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.3gp") returned 0
	[0049.527] lstrlenA (lpString="*.3gp") returned 5
	[0049.527] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.mpeg") returned 0
	[0049.527] lstrlenA (lpString="*.mpeg") returned 6
	[0049.527] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.mpg") returned 0
	[0049.527] lstrlenA (lpString="*.mpg") returned 5
	[0049.527] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.flv") returned 0
	[0049.527] lstrlenA (lpString="*.flv") returned 5
	[0049.527] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.avi") returned 0
	[0049.527] lstrlenA (lpString="*.avi") returned 5
	[0049.527] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.mp4") returned 0
	[0049.527] lstrlenA (lpString="*.mp4") returned 5
	[0049.527] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.wmv") returned 0
	[0049.527] lstrlenA (lpString="*.wmv") returned 5
	[0049.527] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.mkv") returned 0
	[0049.527] lstrlenA (lpString="*.mkv") returned 5
	[0049.527] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.mp3") returned 0
	[0049.528] lstrlenA (lpString="*.mp3") returned 5
	[0049.528] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.wav") returned 0
	[0049.528] lstrlenA (lpString="*.wav") returned 5
	[0049.528] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.flac") returned 0
	[0049.528] lstrlenA (lpString="*.flac") returned 6
	[0049.528] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.wma") returned 0
	[0049.528] lstrlenA (lpString="*.wma") returned 5
	[0049.528] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.au3") returned 0
	[0049.528] lstrlenA (lpString="*.au3") returned 5
	[0049.528] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.ahk") returned 0
	[0049.528] lstrlenA (lpString="*.ahk") returned 5
	[0049.528] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.c") returned 0
	[0049.528] lstrlenA (lpString="*.c") returned 3
	[0049.528] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.cc") returned 0
	[0049.528] lstrlenA (lpString="*.cc") returned 4
	[0049.528] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.cpp") returned 0
	[0049.528] lstrlenA (lpString="*.cpp") returned 5
	[0049.528] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.cxx") returned 0
	[0049.528] lstrlenA (lpString="*.cxx") returned 5
	[0049.528] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.c++") returned 0
	[0049.528] lstrlenA (lpString="*.c++") returned 5
	[0049.528] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.cs") returned 0
	[0049.528] lstrlenA (lpString="*.cs") returned 4
	[0049.528] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.vb") returned 0
	[0049.528] lstrlenA (lpString="*.vb") returned 4
	[0049.528] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.bas") returned 0
	[0049.528] lstrlenA (lpString="*.bas") returned 5
	[0049.528] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.csproj") returned 0
	[0049.528] lstrlenA (lpString="*.csproj") returned 8
	[0049.528] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.vbproj") returned 0
	[0049.528] lstrlenA (lpString="*.vbproj") returned 8
	[0049.528] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.vcxproj") returned 0
	[0049.528] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.528] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.manifest") returned 0
	[0049.528] lstrlenA (lpString="*.manifest") returned 10
	[0049.529] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.php") returned 0
	[0049.529] lstrlenA (lpString="*.php") returned 5
	[0049.529] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.vbe") returned 0
	[0049.529] lstrlenA (lpString="*.vbe") returned 5
	[0049.529] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.vba") returned 0
	[0049.529] lstrlenA (lpString="*.vba") returned 5
	[0049.529] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.vbs") returned 0
	[0049.529] lstrlenA (lpString="*.vbs") returned 5
	[0049.529] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.bat") returned 0
	[0049.529] lstrlenA (lpString="*.bat") returned 5
	[0049.529] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.cmd") returned 0
	[0049.529] lstrlenA (lpString="*.cmd") returned 5
	[0049.529] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.js") returned 0
	[0049.529] lstrlenA (lpString="*.js") returned 4
	[0049.529] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.jscript") returned 0
	[0049.529] lstrlenA (lpString="*.jscript") returned 9
	[0049.529] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.hta") returned 0
	[0049.529] lstrlenA (lpString="*.hta") returned 5
	[0049.529] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.php7") returned 0
	[0049.529] lstrlenA (lpString="*.php7") returned 6
	[0049.529] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.db") returned 0
	[0049.529] lstrlenA (lpString="*.db") returned 4
	[0049.529] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.swf") returned 0
	[0049.529] lstrlenA (lpString="*.swf") returned 5
	[0049.529] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.eml") returned 0
	[0049.529] lstrlenA (lpString="*.eml") returned 5
	[0049.529] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.part") returned 0
	[0049.529] lstrlenA (lpString="*.part") returned 6
	[0049.529] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.nfo") returned 0
	[0049.529] lstrlenA (lpString="*.nfo") returned 5
	[0049.529] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.rsa") returned 0
	[0049.529] lstrlenA (lpString="*.rsa") returned 5
	[0049.529] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.key") returned 0
	[0049.529] lstrlenA (lpString="*.key") returned 5
	[0049.529] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.aes") returned 0
	[0049.530] lstrlenA (lpString="*.aes") returned 5
	[0049.530] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.blob") returned 0
	[0049.530] lstrlenA (lpString="*.blob") returned 6
	[0049.530] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.btc") returned 0
	[0049.530] lstrlenA (lpString="*.btc") returned 5
	[0049.530] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.wallet") returned 0
	[0049.530] lstrlenA (lpString="*.wallet") returned 8
	[0049.530] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 0
	[0049.530] FindClose (in: hFindFile=0x7cb910 | out: hFindFile=0x7cb910) returned 1
	[0049.530] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x7d2548, dwReserved1=0x7b00c0, cFileName="header.bmp", cAlternateFileName="")) returned 1
	[0049.530] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0049.530] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="header.bmp") returned -1
	[0049.530] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="header.bmp") returned 1
	[0049.530] lstrcmpiA (lpString1="", lpString2="header.bmp") returned -1
	[0049.530] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*"
	[0049.530] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0049.530] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned=""
	[0049.530] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.530] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\how-to-decrypt-files.htm")) returned 0x20
	[0049.530] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="header.bmp" | out: lpString1="C:\\588bce7c90097ed212\\header.bmp") returned="C:\\588bce7c90097ed212\\header.bmp"
	[0049.530] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\header.bmp", pszSpec="*.zip") returned 0
	[0049.530] lstrlenA (lpString="*.zip") returned 5
	[0049.530] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\header.bmp", pszSpec="*.rar") returned 0
	[0049.530] lstrlenA (lpString="*.rar") returned 5
	[0049.530] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\header.bmp", pszSpec="*.7z") returned 0
	[0049.530] lstrlenA (lpString="*.7z") returned 4
	[0049.531] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\header.bmp", pszSpec="*.tar") returned 0
	[0049.531] lstrlenA (lpString="*.tar") returned 5
	[0049.531] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\header.bmp", pszSpec="*.gzip") returned 0
	[0049.531] lstrlenA (lpString="*.gzip") returned 6
	[0049.531] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\header.bmp", pszSpec="*.jpg") returned 0
	[0049.531] lstrlenA (lpString="*.jpg") returned 5
	[0049.531] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\header.bmp", pszSpec="*.jpeg") returned 0
	[0049.531] lstrlenA (lpString="*.jpeg") returned 6
	[0049.531] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\header.bmp", pszSpec="*.bmp") returned 1
	[0049.531] lstrlenA (lpString="*.bmp") returned 5
	[0049.531] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\588bce7c90097ed212\\header.bmp" | out: lpString1="C:\\588bce7c90097ed212\\header.bmp") returned="C:\\588bce7c90097ed212\\header.bmp"
	[0049.531] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\588bce7c90097ed212\\header.bmp" | out: lpString1="C:\\588bce7c90097ed212\\header.bmp") returned="C:\\588bce7c90097ed212\\header.bmp"
	[0049.531] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\header.bmp", lpString2="." | out: lpString1="C:\\588bce7c90097ed212\\header.bmp.") returned="C:\\588bce7c90097ed212\\header.bmp."
	[0049.531] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\header.bmp.", lpString2="exe" | out: lpString1="C:\\588bce7c90097ed212\\header.bmp.exe") returned="C:\\588bce7c90097ed212\\header.bmp.exe"
	[0049.531] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0049.532] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe2c
	[0049.532] GetFileTime (in: hFile=0x204, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x87910600, dwHighDateTime=0x1ca2a27), lpLastAccessTime=0x407536*(dwLowDateTime=0x87910600, dwHighDateTime=0x1ca2a27), lpLastWriteTime=0x40753e*(dwLowDateTime=0x87910600, dwHighDateTime=0x1ca2a27)) returned 1
	[0049.532] SetFilePointer (in: hFile=0x204, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0049.532] ReadFile (in: hFile=0x204, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xdea, lpOverlapped=0x0) returned 1
	[0049.534] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\header.bmp") returned="header.bmp"
	[0049.534] SetFilePointer (in: hFile=0x204, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0049.534] WriteFile (in: hFile=0x204, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xdea, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xdea, lpOverlapped=0x0) returned 1
	[0049.534] SetFileTime (hFile=0x204, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.534] CloseHandle (hObject=0x204) returned 1
	[0049.535] MoveFileA (lpExistingFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), lpNewFileName="C:\\588bce7c90097ed212\\header.bmp.exe" (normalized: "c:\\588bce7c90097ed212\\header.bmp.exe")) returned 1
	[0049.535] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x15, dwReserved1=0x1, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1
	[0049.535] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0049.535] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="netfx_Core.mzz") returned -1
	[0049.535] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="netfx_Core.mzz") returned -1
	[0049.535] lstrcmpiA (lpString1="", lpString2="netfx_Core.mzz") returned -1
	[0049.535] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\header.bmp") returned="header.bmp"
	[0049.535] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0049.535] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned=""
	[0049.535] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.536] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\how-to-decrypt-files.htm")) returned 0x20
	[0049.536] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="netfx_Core.mzz" | out: lpString1="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned="C:\\588bce7c90097ed212\\netfx_Core.mzz"
	[0049.536] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.zip") returned 0
	[0049.536] lstrlenA (lpString="*.zip") returned 5
	[0049.536] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.rar") returned 0
	[0049.536] lstrlenA (lpString="*.rar") returned 5
	[0049.536] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.7z") returned 0
	[0049.536] lstrlenA (lpString="*.7z") returned 4
	[0049.536] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.tar") returned 0
	[0049.536] lstrlenA (lpString="*.tar") returned 5
	[0049.536] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.gzip") returned 0
	[0049.536] lstrlenA (lpString="*.gzip") returned 6
	[0049.536] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.jpg") returned 0
	[0049.536] lstrlenA (lpString="*.jpg") returned 5
	[0049.536] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.jpeg") returned 0
	[0049.536] lstrlenA (lpString="*.jpeg") returned 6
	[0049.536] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.bmp") returned 0
	[0049.536] lstrlenA (lpString="*.bmp") returned 5
	[0049.536] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.gif") returned 0
	[0049.536] lstrlenA (lpString="*.gif") returned 5
	[0049.536] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.png") returned 0
	[0049.536] lstrlenA (lpString="*.png") returned 5
	[0049.536] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.doc") returned 0
	[0049.536] lstrlenA (lpString="*.doc") returned 5
	[0049.536] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.docx") returned 0
	[0049.536] lstrlenA (lpString="*.docx") returned 6
	[0049.536] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.xls") returned 0
	[0049.536] lstrlenA (lpString="*.xls") returned 5
	[0049.537] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.xlsx") returned 0
	[0049.537] lstrlenA (lpString="*.xlsx") returned 6
	[0049.537] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.ppt") returned 0
	[0049.537] lstrlenA (lpString="*.ppt") returned 5
	[0049.537] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.pptx") returned 0
	[0049.537] lstrlenA (lpString="*.pptx") returned 6
	[0049.537] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.txt") returned 0
	[0049.537] lstrlenA (lpString="*.txt") returned 5
	[0049.537] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.pdf") returned 0
	[0049.537] lstrlenA (lpString="*.pdf") returned 5
	[0049.537] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.htm") returned 0
	[0049.537] lstrlenA (lpString="*.htm") returned 5
	[0049.537] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.html") returned 0
	[0049.537] lstrlenA (lpString="*.html") returned 6
	[0049.537] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.mdb") returned 0
	[0049.537] lstrlenA (lpString="*.mdb") returned 5
	[0049.537] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.pfx") returned 0
	[0049.537] lstrlenA (lpString="*.pfx") returned 5
	[0049.537] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.md") returned 0
	[0049.537] lstrlenA (lpString="*.md") returned 4
	[0049.537] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.lnk") returned 0
	[0049.537] lstrlenA (lpString="*.lnk") returned 5
	[0049.537] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.torrent") returned 0
	[0049.537] lstrlenA (lpString="*.torrent") returned 9
	[0049.537] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.mov") returned 0
	[0049.537] lstrlenA (lpString="*.mov") returned 5
	[0049.537] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.3gp") returned 0
	[0049.537] lstrlenA (lpString="*.3gp") returned 5
	[0049.537] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.mpeg") returned 0
	[0049.537] lstrlenA (lpString="*.mpeg") returned 6
	[0049.537] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.mpg") returned 0
	[0049.537] lstrlenA (lpString="*.mpg") returned 5
	[0049.538] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.flv") returned 0
	[0049.538] lstrlenA (lpString="*.flv") returned 5
	[0049.538] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.avi") returned 0
	[0049.538] lstrlenA (lpString="*.avi") returned 5
	[0049.538] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.mp4") returned 0
	[0049.538] lstrlenA (lpString="*.mp4") returned 5
	[0049.538] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.wmv") returned 0
	[0049.538] lstrlenA (lpString="*.wmv") returned 5
	[0049.538] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.mkv") returned 0
	[0049.538] lstrlenA (lpString="*.mkv") returned 5
	[0049.538] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.mp3") returned 0
	[0049.538] lstrlenA (lpString="*.mp3") returned 5
	[0049.538] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.wav") returned 0
	[0049.538] lstrlenA (lpString="*.wav") returned 5
	[0049.538] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.flac") returned 0
	[0049.538] lstrlenA (lpString="*.flac") returned 6
	[0049.538] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.wma") returned 0
	[0049.538] lstrlenA (lpString="*.wma") returned 5
	[0049.538] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.au3") returned 0
	[0049.538] lstrlenA (lpString="*.au3") returned 5
	[0049.538] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.ahk") returned 0
	[0049.538] lstrlenA (lpString="*.ahk") returned 5
	[0049.538] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.c") returned 0
	[0049.538] lstrlenA (lpString="*.c") returned 3
	[0049.538] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.cc") returned 0
	[0049.539] lstrlenA (lpString="*.cc") returned 4
	[0049.539] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.cpp") returned 0
	[0049.539] lstrlenA (lpString="*.cpp") returned 5
	[0049.539] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.cxx") returned 0
	[0049.539] lstrlenA (lpString="*.cxx") returned 5
	[0049.539] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.c++") returned 0
	[0049.539] lstrlenA (lpString="*.c++") returned 5
	[0049.539] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.cs") returned 0
	[0049.539] lstrlenA (lpString="*.cs") returned 4
	[0049.539] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.vb") returned 0
	[0049.539] lstrlenA (lpString="*.vb") returned 4
	[0049.539] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.bas") returned 0
	[0049.539] lstrlenA (lpString="*.bas") returned 5
	[0049.539] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.csproj") returned 0
	[0049.539] lstrlenA (lpString="*.csproj") returned 8
	[0049.539] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.vbproj") returned 0
	[0049.539] lstrlenA (lpString="*.vbproj") returned 8
	[0049.539] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.vcxproj") returned 0
	[0049.539] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.539] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.manifest") returned 0
	[0049.539] lstrlenA (lpString="*.manifest") returned 10
	[0049.539] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.php") returned 0
	[0049.539] lstrlenA (lpString="*.php") returned 5
	[0049.539] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.vbe") returned 0
	[0049.539] lstrlenA (lpString="*.vbe") returned 5
	[0049.539] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.vba") returned 0
	[0049.539] lstrlenA (lpString="*.vba") returned 5
	[0049.539] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.vbs") returned 0
	[0049.539] lstrlenA (lpString="*.vbs") returned 5
	[0049.539] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.bat") returned 0
	[0049.539] lstrlenA (lpString="*.bat") returned 5
	[0049.539] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.cmd") returned 0
	[0049.539] lstrlenA (lpString="*.cmd") returned 5
	[0049.539] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.js") returned 0
	[0049.539] lstrlenA (lpString="*.js") returned 4
	[0049.540] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.jscript") returned 0
	[0049.540] lstrlenA (lpString="*.jscript") returned 9
	[0049.540] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.hta") returned 0
	[0049.540] lstrlenA (lpString="*.hta") returned 5
	[0049.540] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.php7") returned 0
	[0049.540] lstrlenA (lpString="*.php7") returned 6
	[0049.540] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.db") returned 0
	[0049.540] lstrlenA (lpString="*.db") returned 4
	[0049.540] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.swf") returned 0
	[0049.540] lstrlenA (lpString="*.swf") returned 5
	[0049.540] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.eml") returned 0
	[0049.540] lstrlenA (lpString="*.eml") returned 5
	[0049.540] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.part") returned 0
	[0049.540] lstrlenA (lpString="*.part") returned 6
	[0049.540] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.nfo") returned 0
	[0049.540] lstrlenA (lpString="*.nfo") returned 5
	[0049.540] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.rsa") returned 0
	[0049.540] lstrlenA (lpString="*.rsa") returned 5
	[0049.540] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.key") returned 0
	[0049.540] lstrlenA (lpString="*.key") returned 5
	[0049.540] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.aes") returned 0
	[0049.540] lstrlenA (lpString="*.aes") returned 5
	[0049.540] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.blob") returned 0
	[0049.540] lstrlenA (lpString="*.blob") returned 6
	[0049.540] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.btc") returned 0
	[0049.540] lstrlenA (lpString="*.btc") returned 5
	[0049.540] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.wallet") returned 0
	[0049.540] lstrlenA (lpString="*.wallet") returned 8
	[0049.540] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1
	[0049.540] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0049.540] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="netfx_Core_x64.msi") returned -1
	[0049.540] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="netfx_Core_x64.msi") returned -1
	[0049.540] lstrcmpiA (lpString1="", lpString2="netfx_Core_x64.msi") returned -1
	[0049.540] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned="netfx_Core.mzz"
	[0049.540] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0049.541] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned=""
	[0049.541] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.541] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\how-to-decrypt-files.htm")) returned 0x20
	[0049.541] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="netfx_Core_x64.msi" | out: lpString1="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned="C:\\588bce7c90097ed212\\netfx_Core_x64.msi"
	[0049.541] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.zip") returned 0
	[0049.541] lstrlenA (lpString="*.zip") returned 5
	[0049.541] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.rar") returned 0
	[0049.541] lstrlenA (lpString="*.rar") returned 5
	[0049.541] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.7z") returned 0
	[0049.541] lstrlenA (lpString="*.7z") returned 4
	[0049.541] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.tar") returned 0
	[0049.541] lstrlenA (lpString="*.tar") returned 5
	[0049.541] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.gzip") returned 0
	[0049.541] lstrlenA (lpString="*.gzip") returned 6
	[0049.541] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.jpg") returned 0
	[0049.541] lstrlenA (lpString="*.jpg") returned 5
	[0049.541] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.jpeg") returned 0
	[0049.541] lstrlenA (lpString="*.jpeg") returned 6
	[0049.541] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.bmp") returned 0
	[0049.541] lstrlenA (lpString="*.bmp") returned 5
	[0049.541] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.gif") returned 0
	[0049.541] lstrlenA (lpString="*.gif") returned 5
	[0049.541] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.png") returned 0
	[0049.541] lstrlenA (lpString="*.png") returned 5
	[0049.541] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.doc") returned 0
	[0049.541] lstrlenA (lpString="*.doc") returned 5
	[0049.541] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.docx") returned 0
	[0049.541] lstrlenA (lpString="*.docx") returned 6
	[0049.541] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.xls") returned 0
	[0049.541] lstrlenA (lpString="*.xls") returned 5
	[0049.541] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.xlsx") returned 0
	[0049.541] lstrlenA (lpString="*.xlsx") returned 6
	[0049.542] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.ppt") returned 0
	[0049.542] lstrlenA (lpString="*.ppt") returned 5
	[0049.542] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.pptx") returned 0
	[0049.542] lstrlenA (lpString="*.pptx") returned 6
	[0049.542] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.txt") returned 0
	[0049.542] lstrlenA (lpString="*.txt") returned 5
	[0049.542] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.pdf") returned 0
	[0049.542] lstrlenA (lpString="*.pdf") returned 5
	[0049.542] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.htm") returned 0
	[0049.542] lstrlenA (lpString="*.htm") returned 5
	[0049.542] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.html") returned 0
	[0049.542] lstrlenA (lpString="*.html") returned 6
	[0049.542] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.mdb") returned 0
	[0049.542] lstrlenA (lpString="*.mdb") returned 5
	[0049.542] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.pfx") returned 0
	[0049.542] lstrlenA (lpString="*.pfx") returned 5
	[0049.542] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.md") returned 0
	[0049.542] lstrlenA (lpString="*.md") returned 4
	[0049.542] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.lnk") returned 0
	[0049.542] lstrlenA (lpString="*.lnk") returned 5
	[0049.542] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.torrent") returned 0
	[0049.542] lstrlenA (lpString="*.torrent") returned 9
	[0049.542] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.mov") returned 0
	[0049.542] lstrlenA (lpString="*.mov") returned 5
	[0049.542] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.3gp") returned 0
	[0049.542] lstrlenA (lpString="*.3gp") returned 5
	[0049.542] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.mpeg") returned 0
	[0049.542] lstrlenA (lpString="*.mpeg") returned 6
	[0049.542] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.mpg") returned 0
	[0049.542] lstrlenA (lpString="*.mpg") returned 5
	[0049.542] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.flv") returned 0
	[0049.542] lstrlenA (lpString="*.flv") returned 5
	[0049.542] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.avi") returned 0
	[0049.542] lstrlenA (lpString="*.avi") returned 5
	[0049.543] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.mp4") returned 0
	[0049.543] lstrlenA (lpString="*.mp4") returned 5
	[0049.543] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.wmv") returned 0
	[0049.543] lstrlenA (lpString="*.wmv") returned 5
	[0049.543] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.mkv") returned 0
	[0049.543] lstrlenA (lpString="*.mkv") returned 5
	[0049.543] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.mp3") returned 0
	[0049.543] lstrlenA (lpString="*.mp3") returned 5
	[0049.543] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.wav") returned 0
	[0049.543] lstrlenA (lpString="*.wav") returned 5
	[0049.543] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.flac") returned 0
	[0049.543] lstrlenA (lpString="*.flac") returned 6
	[0049.543] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.wma") returned 0
	[0049.543] lstrlenA (lpString="*.wma") returned 5
	[0049.543] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.au3") returned 0
	[0049.543] lstrlenA (lpString="*.au3") returned 5
	[0049.543] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.ahk") returned 0
	[0049.543] lstrlenA (lpString="*.ahk") returned 5
	[0049.543] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.c") returned 0
	[0049.543] lstrlenA (lpString="*.c") returned 3
	[0049.543] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.cc") returned 0
	[0049.543] lstrlenA (lpString="*.cc") returned 4
	[0049.543] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.cpp") returned 0
	[0049.543] lstrlenA (lpString="*.cpp") returned 5
	[0049.543] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.cxx") returned 0
	[0049.543] lstrlenA (lpString="*.cxx") returned 5
	[0049.543] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.c++") returned 0
	[0049.543] lstrlenA (lpString="*.c++") returned 5
	[0049.543] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.cs") returned 0
	[0049.543] lstrlenA (lpString="*.cs") returned 4
	[0049.543] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.vb") returned 0
	[0049.543] lstrlenA (lpString="*.vb") returned 4
	[0049.543] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.bas") returned 0
	[0049.543] lstrlenA (lpString="*.bas") returned 5
	[0049.543] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.csproj") returned 0
	[0049.544] lstrlenA (lpString="*.csproj") returned 8
	[0049.544] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.vbproj") returned 0
	[0049.544] lstrlenA (lpString="*.vbproj") returned 8
	[0049.544] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.vcxproj") returned 0
	[0049.544] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.544] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.manifest") returned 0
	[0049.544] lstrlenA (lpString="*.manifest") returned 10
	[0049.544] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.php") returned 0
	[0049.544] lstrlenA (lpString="*.php") returned 5
	[0049.544] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.vbe") returned 0
	[0049.544] lstrlenA (lpString="*.vbe") returned 5
	[0049.544] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.vba") returned 0
	[0049.544] lstrlenA (lpString="*.vba") returned 5
	[0049.544] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.vbs") returned 0
	[0049.544] lstrlenA (lpString="*.vbs") returned 5
	[0049.544] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.bat") returned 0
	[0049.544] lstrlenA (lpString="*.bat") returned 5
	[0049.544] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.cmd") returned 0
	[0049.544] lstrlenA (lpString="*.cmd") returned 5
	[0049.544] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.js") returned 0
	[0049.544] lstrlenA (lpString="*.js") returned 4
	[0049.544] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.jscript") returned 0
	[0049.544] lstrlenA (lpString="*.jscript") returned 9
	[0049.544] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.hta") returned 0
	[0049.544] lstrlenA (lpString="*.hta") returned 5
	[0049.544] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.php7") returned 0
	[0049.544] lstrlenA (lpString="*.php7") returned 6
	[0049.544] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.db") returned 0
	[0049.544] lstrlenA (lpString="*.db") returned 4
	[0049.544] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.swf") returned 0
	[0049.544] lstrlenA (lpString="*.swf") returned 5
	[0049.544] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.eml") returned 0
	[0049.544] lstrlenA (lpString="*.eml") returned 5
	[0049.544] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.part") returned 0
	[0049.545] lstrlenA (lpString="*.part") returned 6
	[0049.545] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.nfo") returned 0
	[0049.545] lstrlenA (lpString="*.nfo") returned 5
	[0049.545] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.rsa") returned 0
	[0049.545] lstrlenA (lpString="*.rsa") returned 5
	[0049.545] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.key") returned 0
	[0049.545] lstrlenA (lpString="*.key") returned 5
	[0049.545] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.aes") returned 0
	[0049.545] lstrlenA (lpString="*.aes") returned 5
	[0049.545] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.blob") returned 0
	[0049.545] lstrlenA (lpString="*.blob") returned 6
	[0049.545] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.btc") returned 0
	[0049.545] lstrlenA (lpString="*.btc") returned 5
	[0049.545] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.wallet") returned 0
	[0049.545] lstrlenA (lpString="*.wallet") returned 8
	[0049.545] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1
	[0049.545] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0049.545] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="netfx_Core_x86.msi") returned -1
	[0049.545] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="netfx_Core_x86.msi") returned -1
	[0049.545] lstrcmpiA (lpString1="", lpString2="netfx_Core_x86.msi") returned -1
	[0049.545] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned="netfx_Core_x64.msi"
	[0049.545] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0049.545] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned=""
	[0049.545] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.545] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\how-to-decrypt-files.htm")) returned 0x20
	[0049.545] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="netfx_Core_x86.msi" | out: lpString1="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned="C:\\588bce7c90097ed212\\netfx_Core_x86.msi"
	[0049.545] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.zip") returned 0
	[0049.545] lstrlenA (lpString="*.zip") returned 5
	[0049.546] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.rar") returned 0
	[0049.546] lstrlenA (lpString="*.rar") returned 5
	[0049.546] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.7z") returned 0
	[0049.546] lstrlenA (lpString="*.7z") returned 4
	[0049.546] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.tar") returned 0
	[0049.546] lstrlenA (lpString="*.tar") returned 5
	[0049.546] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.gzip") returned 0
	[0049.546] lstrlenA (lpString="*.gzip") returned 6
	[0049.546] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.jpg") returned 0
	[0049.546] lstrlenA (lpString="*.jpg") returned 5
	[0049.546] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.jpeg") returned 0
	[0049.546] lstrlenA (lpString="*.jpeg") returned 6
	[0049.546] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.bmp") returned 0
	[0049.546] lstrlenA (lpString="*.bmp") returned 5
	[0049.546] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.gif") returned 0
	[0049.546] lstrlenA (lpString="*.gif") returned 5
	[0049.546] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.png") returned 0
	[0049.546] lstrlenA (lpString="*.png") returned 5
	[0049.546] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.doc") returned 0
	[0049.546] lstrlenA (lpString="*.doc") returned 5
	[0049.546] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.docx") returned 0
	[0049.546] lstrlenA (lpString="*.docx") returned 6
	[0049.546] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.xls") returned 0
	[0049.546] lstrlenA (lpString="*.xls") returned 5
	[0049.546] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.xlsx") returned 0
	[0049.546] lstrlenA (lpString="*.xlsx") returned 6
	[0049.546] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.ppt") returned 0
	[0049.546] lstrlenA (lpString="*.ppt") returned 5
	[0049.546] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.pptx") returned 0
	[0049.546] lstrlenA (lpString="*.pptx") returned 6
	[0049.546] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.txt") returned 0
	[0049.546] lstrlenA (lpString="*.txt") returned 5
	[0049.546] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.pdf") returned 0
	[0049.546] lstrlenA (lpString="*.pdf") returned 5
	[0049.546] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.htm") returned 0
	[0049.547] lstrlenA (lpString="*.htm") returned 5
	[0049.547] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.html") returned 0
	[0049.547] lstrlenA (lpString="*.html") returned 6
	[0049.547] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.mdb") returned 0
	[0049.547] lstrlenA (lpString="*.mdb") returned 5
	[0049.547] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.pfx") returned 0
	[0049.547] lstrlenA (lpString="*.pfx") returned 5
	[0049.547] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.md") returned 0
	[0049.547] lstrlenA (lpString="*.md") returned 4
	[0049.547] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.lnk") returned 0
	[0049.547] lstrlenA (lpString="*.lnk") returned 5
	[0049.547] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.torrent") returned 0
	[0049.547] lstrlenA (lpString="*.torrent") returned 9
	[0049.547] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.mov") returned 0
	[0049.547] lstrlenA (lpString="*.mov") returned 5
	[0049.547] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.3gp") returned 0
	[0049.547] lstrlenA (lpString="*.3gp") returned 5
	[0049.547] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.mpeg") returned 0
	[0049.547] lstrlenA (lpString="*.mpeg") returned 6
	[0049.547] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.mpg") returned 0
	[0049.547] lstrlenA (lpString="*.mpg") returned 5
	[0049.547] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.flv") returned 0
	[0049.547] lstrlenA (lpString="*.flv") returned 5
	[0049.547] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.avi") returned 0
	[0049.547] lstrlenA (lpString="*.avi") returned 5
	[0049.547] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.mp4") returned 0
	[0049.547] lstrlenA (lpString="*.mp4") returned 5
	[0049.547] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.wmv") returned 0
	[0049.547] lstrlenA (lpString="*.wmv") returned 5
	[0049.547] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.mkv") returned 0
	[0049.547] lstrlenA (lpString="*.mkv") returned 5
	[0049.547] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.mp3") returned 0
	[0049.547] lstrlenA (lpString="*.mp3") returned 5
	[0049.547] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.wav") returned 0
	[0049.548] lstrlenA (lpString="*.wav") returned 5
	[0049.548] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.flac") returned 0
	[0049.548] lstrlenA (lpString="*.flac") returned 6
	[0049.548] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.wma") returned 0
	[0049.548] lstrlenA (lpString="*.wma") returned 5
	[0049.548] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.au3") returned 0
	[0049.548] lstrlenA (lpString="*.au3") returned 5
	[0049.548] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.ahk") returned 0
	[0049.548] lstrlenA (lpString="*.ahk") returned 5
	[0049.548] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.c") returned 0
	[0049.548] lstrlenA (lpString="*.c") returned 3
	[0049.548] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.cc") returned 0
	[0049.548] lstrlenA (lpString="*.cc") returned 4
	[0049.548] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.cpp") returned 0
	[0049.548] lstrlenA (lpString="*.cpp") returned 5
	[0049.548] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.cxx") returned 0
	[0049.548] lstrlenA (lpString="*.cxx") returned 5
	[0049.548] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.c++") returned 0
	[0049.548] lstrlenA (lpString="*.c++") returned 5
	[0049.548] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.cs") returned 0
	[0049.548] lstrlenA (lpString="*.cs") returned 4
	[0049.548] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.vb") returned 0
	[0049.548] lstrlenA (lpString="*.vb") returned 4
	[0049.548] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.bas") returned 0
	[0049.548] lstrlenA (lpString="*.bas") returned 5
	[0049.548] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.csproj") returned 0
	[0049.548] lstrlenA (lpString="*.csproj") returned 8
	[0049.548] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.vbproj") returned 0
	[0049.548] lstrlenA (lpString="*.vbproj") returned 8
	[0049.548] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.vcxproj") returned 0
	[0049.548] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.548] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.manifest") returned 0
	[0049.548] lstrlenA (lpString="*.manifest") returned 10
	[0049.548] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.php") returned 0
	[0049.548] lstrlenA (lpString="*.php") returned 5
	[0049.548] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.vbe") returned 0
	[0049.549] lstrlenA (lpString="*.vbe") returned 5
	[0049.549] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.vba") returned 0
	[0049.549] lstrlenA (lpString="*.vba") returned 5
	[0049.549] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.vbs") returned 0
	[0049.549] lstrlenA (lpString="*.vbs") returned 5
	[0049.549] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.bat") returned 0
	[0049.549] lstrlenA (lpString="*.bat") returned 5
	[0049.549] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.cmd") returned 0
	[0049.549] lstrlenA (lpString="*.cmd") returned 5
	[0049.549] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.js") returned 0
	[0049.549] lstrlenA (lpString="*.js") returned 4
	[0049.549] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.jscript") returned 0
	[0049.549] lstrlenA (lpString="*.jscript") returned 9
	[0049.549] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.hta") returned 0
	[0049.549] lstrlenA (lpString="*.hta") returned 5
	[0049.549] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.php7") returned 0
	[0049.549] lstrlenA (lpString="*.php7") returned 6
	[0049.549] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.db") returned 0
	[0049.549] lstrlenA (lpString="*.db") returned 4
	[0049.549] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.swf") returned 0
	[0049.549] lstrlenA (lpString="*.swf") returned 5
	[0049.549] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.eml") returned 0
	[0049.549] lstrlenA (lpString="*.eml") returned 5
	[0049.549] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.part") returned 0
	[0049.549] lstrlenA (lpString="*.part") returned 6
	[0049.549] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.nfo") returned 0
	[0049.549] lstrlenA (lpString="*.nfo") returned 5
	[0049.549] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.rsa") returned 0
	[0049.549] lstrlenA (lpString="*.rsa") returned 5
	[0049.549] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.key") returned 0
	[0049.549] lstrlenA (lpString="*.key") returned 5
	[0049.549] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.aes") returned 0
	[0049.549] lstrlenA (lpString="*.aes") returned 5
	[0049.549] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.blob") returned 0
	[0049.549] lstrlenA (lpString="*.blob") returned 6
	[0049.549] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.btc") returned 0
	[0049.550] lstrlenA (lpString="*.btc") returned 5
	[0049.550] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.wallet") returned 0
	[0049.550] lstrlenA (lpString="*.wallet") returned 8
	[0049.550] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1
	[0049.550] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0049.550] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="netfx_Extended.mzz") returned -1
	[0049.550] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="netfx_Extended.mzz") returned -1
	[0049.550] lstrcmpiA (lpString1="", lpString2="netfx_Extended.mzz") returned -1
	[0049.550] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned="netfx_Core_x86.msi"
	[0049.550] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0049.550] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned=""
	[0049.550] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.550] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\how-to-decrypt-files.htm")) returned 0x20
	[0049.550] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="netfx_Extended.mzz" | out: lpString1="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned="C:\\588bce7c90097ed212\\netfx_Extended.mzz"
	[0049.550] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.zip") returned 0
	[0049.550] lstrlenA (lpString="*.zip") returned 5
	[0049.550] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.rar") returned 0
	[0049.550] lstrlenA (lpString="*.rar") returned 5
	[0049.550] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.7z") returned 0
	[0049.550] lstrlenA (lpString="*.7z") returned 4
	[0049.550] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.tar") returned 0
	[0049.550] lstrlenA (lpString="*.tar") returned 5
	[0049.550] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.gzip") returned 0
	[0049.550] lstrlenA (lpString="*.gzip") returned 6
	[0049.550] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.jpg") returned 0
	[0049.550] lstrlenA (lpString="*.jpg") returned 5
	[0049.550] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.jpeg") returned 0
	[0049.550] lstrlenA (lpString="*.jpeg") returned 6
	[0049.550] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.bmp") returned 0
	[0049.550] lstrlenA (lpString="*.bmp") returned 5
	[0049.550] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.gif") returned 0
	[0049.550] lstrlenA (lpString="*.gif") returned 5
	[0049.551] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.png") returned 0
	[0049.551] lstrlenA (lpString="*.png") returned 5
	[0049.551] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.doc") returned 0
	[0049.551] lstrlenA (lpString="*.doc") returned 5
	[0049.551] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.docx") returned 0
	[0049.551] lstrlenA (lpString="*.docx") returned 6
	[0049.551] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.xls") returned 0
	[0049.551] lstrlenA (lpString="*.xls") returned 5
	[0049.551] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.xlsx") returned 0
	[0049.551] lstrlenA (lpString="*.xlsx") returned 6
	[0049.551] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.ppt") returned 0
	[0049.551] lstrlenA (lpString="*.ppt") returned 5
	[0049.551] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.pptx") returned 0
	[0049.551] lstrlenA (lpString="*.pptx") returned 6
	[0049.551] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.txt") returned 0
	[0049.551] lstrlenA (lpString="*.txt") returned 5
	[0049.551] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.pdf") returned 0
	[0049.551] lstrlenA (lpString="*.pdf") returned 5
	[0049.551] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.htm") returned 0
	[0049.551] lstrlenA (lpString="*.htm") returned 5
	[0049.551] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.html") returned 0
	[0049.551] lstrlenA (lpString="*.html") returned 6
	[0049.551] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.mdb") returned 0
	[0049.551] lstrlenA (lpString="*.mdb") returned 5
	[0049.551] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.pfx") returned 0
	[0049.551] lstrlenA (lpString="*.pfx") returned 5
	[0049.551] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.md") returned 0
	[0049.551] lstrlenA (lpString="*.md") returned 4
	[0049.551] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.lnk") returned 0
	[0049.551] lstrlenA (lpString="*.lnk") returned 5
	[0049.551] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.torrent") returned 0
	[0049.551] lstrlenA (lpString="*.torrent") returned 9
	[0049.551] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.mov") returned 0
	[0049.551] lstrlenA (lpString="*.mov") returned 5
	[0049.551] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.3gp") returned 0
	[0049.551] lstrlenA (lpString="*.3gp") returned 5
	[0049.552] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.mpeg") returned 0
	[0049.552] lstrlenA (lpString="*.mpeg") returned 6
	[0049.552] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.mpg") returned 0
	[0049.552] lstrlenA (lpString="*.mpg") returned 5
	[0049.552] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.flv") returned 0
	[0049.552] lstrlenA (lpString="*.flv") returned 5
	[0049.552] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.avi") returned 0
	[0049.552] lstrlenA (lpString="*.avi") returned 5
	[0049.552] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.mp4") returned 0
	[0049.552] lstrlenA (lpString="*.mp4") returned 5
	[0049.552] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.wmv") returned 0
	[0049.552] lstrlenA (lpString="*.wmv") returned 5
	[0049.552] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.mkv") returned 0
	[0049.552] lstrlenA (lpString="*.mkv") returned 5
	[0049.552] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.mp3") returned 0
	[0049.552] lstrlenA (lpString="*.mp3") returned 5
	[0049.559] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.wav") returned 0
	[0049.559] lstrlenA (lpString="*.wav") returned 5
	[0049.559] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.flac") returned 0
	[0049.559] lstrlenA (lpString="*.flac") returned 6
	[0049.559] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.wma") returned 0
	[0049.559] lstrlenA (lpString="*.wma") returned 5
	[0049.559] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.au3") returned 0
	[0049.560] lstrlenA (lpString="*.au3") returned 5
	[0049.560] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.ahk") returned 0
	[0049.560] lstrlenA (lpString="*.ahk") returned 5
	[0049.560] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.c") returned 0
	[0049.560] lstrlenA (lpString="*.c") returned 3
	[0049.560] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.cc") returned 0
	[0049.560] lstrlenA (lpString="*.cc") returned 4
	[0049.560] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.cpp") returned 0
	[0049.560] lstrlenA (lpString="*.cpp") returned 5
	[0049.560] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.cxx") returned 0
	[0049.560] lstrlenA (lpString="*.cxx") returned 5
	[0049.560] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.c++") returned 0
	[0049.560] lstrlenA (lpString="*.c++") returned 5
	[0049.560] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.cs") returned 0
	[0049.560] lstrlenA (lpString="*.cs") returned 4
	[0049.560] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.vb") returned 0
	[0049.560] lstrlenA (lpString="*.vb") returned 4
	[0049.560] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.bas") returned 0
	[0049.560] lstrlenA (lpString="*.bas") returned 5
	[0049.560] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.csproj") returned 0
	[0049.560] lstrlenA (lpString="*.csproj") returned 8
	[0049.560] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.vbproj") returned 0
	[0049.560] lstrlenA (lpString="*.vbproj") returned 8
	[0049.560] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.vcxproj") returned 0
	[0049.560] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.560] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.manifest") returned 0
	[0049.560] lstrlenA (lpString="*.manifest") returned 10
	[0049.560] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.php") returned 0
	[0049.560] lstrlenA (lpString="*.php") returned 5
	[0049.560] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.vbe") returned 0
	[0049.560] lstrlenA (lpString="*.vbe") returned 5
	[0049.560] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.vba") returned 0
	[0049.560] lstrlenA (lpString="*.vba") returned 5
	[0049.560] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.vbs") returned 0
	[0049.560] lstrlenA (lpString="*.vbs") returned 5
	[0049.560] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.bat") returned 0
	[0049.561] lstrlenA (lpString="*.bat") returned 5
	[0049.561] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.cmd") returned 0
	[0049.561] lstrlenA (lpString="*.cmd") returned 5
	[0049.561] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.js") returned 0
	[0049.561] lstrlenA (lpString="*.js") returned 4
	[0049.561] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.jscript") returned 0
	[0049.561] lstrlenA (lpString="*.jscript") returned 9
	[0049.561] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.hta") returned 0
	[0049.561] lstrlenA (lpString="*.hta") returned 5
	[0049.561] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.php7") returned 0
	[0049.561] lstrlenA (lpString="*.php7") returned 6
	[0049.561] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.db") returned 0
	[0049.561] lstrlenA (lpString="*.db") returned 4
	[0049.561] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.swf") returned 0
	[0049.561] lstrlenA (lpString="*.swf") returned 5
	[0049.561] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.eml") returned 0
	[0049.561] lstrlenA (lpString="*.eml") returned 5
	[0049.561] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.part") returned 0
	[0049.561] lstrlenA (lpString="*.part") returned 6
	[0049.561] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.nfo") returned 0
	[0049.561] lstrlenA (lpString="*.nfo") returned 5
	[0049.561] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.rsa") returned 0
	[0049.561] lstrlenA (lpString="*.rsa") returned 5
	[0049.561] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.key") returned 0
	[0049.561] lstrlenA (lpString="*.key") returned 5
	[0049.561] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.aes") returned 0
	[0049.561] lstrlenA (lpString="*.aes") returned 5
	[0049.561] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.blob") returned 0
	[0049.561] lstrlenA (lpString="*.blob") returned 6
	[0049.561] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.btc") returned 0
	[0049.561] lstrlenA (lpString="*.btc") returned 5
	[0049.561] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.wallet") returned 0
	[0049.561] lstrlenA (lpString="*.wallet") returned 8
	[0049.561] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1
	[0049.561] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0049.562] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="netfx_Extended_x64.msi") returned -1
	[0049.562] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="netfx_Extended_x64.msi") returned -1
	[0049.562] lstrcmpiA (lpString1="", lpString2="netfx_Extended_x64.msi") returned -1
	[0049.562] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned="netfx_Extended.mzz"
	[0049.562] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0049.562] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned=""
	[0049.562] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.562] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\how-to-decrypt-files.htm")) returned 0x20
	[0049.562] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="netfx_Extended_x64.msi" | out: lpString1="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi"
	[0049.562] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.zip") returned 0
	[0049.562] lstrlenA (lpString="*.zip") returned 5
	[0049.562] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.rar") returned 0
	[0049.562] lstrlenA (lpString="*.rar") returned 5
	[0049.562] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.7z") returned 0
	[0049.562] lstrlenA (lpString="*.7z") returned 4
	[0049.562] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.tar") returned 0
	[0049.562] lstrlenA (lpString="*.tar") returned 5
	[0049.562] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.gzip") returned 0
	[0049.562] lstrlenA (lpString="*.gzip") returned 6
	[0049.562] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.jpg") returned 0
	[0049.562] lstrlenA (lpString="*.jpg") returned 5
	[0049.562] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.jpeg") returned 0
	[0049.562] lstrlenA (lpString="*.jpeg") returned 6
	[0049.562] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.bmp") returned 0
	[0049.562] lstrlenA (lpString="*.bmp") returned 5
	[0049.562] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.gif") returned 0
	[0049.562] lstrlenA (lpString="*.gif") returned 5
	[0049.562] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.png") returned 0
	[0049.562] lstrlenA (lpString="*.png") returned 5
	[0049.562] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.doc") returned 0
	[0049.562] lstrlenA (lpString="*.doc") returned 5
	[0049.563] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.docx") returned 0
	[0049.563] lstrlenA (lpString="*.docx") returned 6
	[0049.563] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.xls") returned 0
	[0049.563] lstrlenA (lpString="*.xls") returned 5
	[0049.563] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.xlsx") returned 0
	[0049.563] lstrlenA (lpString="*.xlsx") returned 6
	[0049.563] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.ppt") returned 0
	[0049.563] lstrlenA (lpString="*.ppt") returned 5
	[0049.563] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.pptx") returned 0
	[0049.563] lstrlenA (lpString="*.pptx") returned 6
	[0049.563] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.txt") returned 0
	[0049.563] lstrlenA (lpString="*.txt") returned 5
	[0049.563] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.pdf") returned 0
	[0049.563] lstrlenA (lpString="*.pdf") returned 5
	[0049.563] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.htm") returned 0
	[0049.563] lstrlenA (lpString="*.htm") returned 5
	[0049.563] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.html") returned 0
	[0049.563] lstrlenA (lpString="*.html") returned 6
	[0049.563] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.mdb") returned 0
	[0049.563] lstrlenA (lpString="*.mdb") returned 5
	[0049.563] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.pfx") returned 0
	[0049.563] lstrlenA (lpString="*.pfx") returned 5
	[0049.563] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.md") returned 0
	[0049.563] lstrlenA (lpString="*.md") returned 4
	[0049.563] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.lnk") returned 0
	[0049.563] lstrlenA (lpString="*.lnk") returned 5
	[0049.563] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.torrent") returned 0
	[0049.563] lstrlenA (lpString="*.torrent") returned 9
	[0049.563] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.mov") returned 0
	[0049.563] lstrlenA (lpString="*.mov") returned 5
	[0049.563] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.3gp") returned 0
	[0049.563] lstrlenA (lpString="*.3gp") returned 5
	[0049.563] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.mpeg") returned 0
	[0049.563] lstrlenA (lpString="*.mpeg") returned 6
	[0049.564] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.mpg") returned 0
	[0049.564] lstrlenA (lpString="*.mpg") returned 5
	[0049.564] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.flv") returned 0
	[0049.564] lstrlenA (lpString="*.flv") returned 5
	[0049.564] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.avi") returned 0
	[0049.564] lstrlenA (lpString="*.avi") returned 5
	[0049.564] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.mp4") returned 0
	[0049.564] lstrlenA (lpString="*.mp4") returned 5
	[0049.564] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.wmv") returned 0
	[0049.564] lstrlenA (lpString="*.wmv") returned 5
	[0049.564] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.mkv") returned 0
	[0049.564] lstrlenA (lpString="*.mkv") returned 5
	[0049.564] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.mp3") returned 0
	[0049.564] lstrlenA (lpString="*.mp3") returned 5
	[0049.564] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.wav") returned 0
	[0049.564] lstrlenA (lpString="*.wav") returned 5
	[0049.564] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.flac") returned 0
	[0049.564] lstrlenA (lpString="*.flac") returned 6
	[0049.564] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.wma") returned 0
	[0049.564] lstrlenA (lpString="*.wma") returned 5
	[0049.564] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.au3") returned 0
	[0049.564] lstrlenA (lpString="*.au3") returned 5
	[0049.564] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.ahk") returned 0
	[0049.564] lstrlenA (lpString="*.ahk") returned 5
	[0049.564] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.c") returned 0
	[0049.564] lstrlenA (lpString="*.c") returned 3
	[0049.564] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.cc") returned 0
	[0049.564] lstrlenA (lpString="*.cc") returned 4
	[0049.564] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.cpp") returned 0
	[0049.564] lstrlenA (lpString="*.cpp") returned 5
	[0049.564] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.cxx") returned 0
	[0049.564] lstrlenA (lpString="*.cxx") returned 5
	[0049.564] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.c++") returned 0
	[0049.564] lstrlenA (lpString="*.c++") returned 5
	[0049.564] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.cs") returned 0
	[0049.565] lstrlenA (lpString="*.cs") returned 4
	[0049.565] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.vb") returned 0
	[0049.565] lstrlenA (lpString="*.vb") returned 4
	[0049.565] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.bas") returned 0
	[0049.565] lstrlenA (lpString="*.bas") returned 5
	[0049.565] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.csproj") returned 0
	[0049.565] lstrlenA (lpString="*.csproj") returned 8
	[0049.565] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.vbproj") returned 0
	[0049.565] lstrlenA (lpString="*.vbproj") returned 8
	[0049.565] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.vcxproj") returned 0
	[0049.565] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.565] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.manifest") returned 0
	[0049.565] lstrlenA (lpString="*.manifest") returned 10
	[0049.565] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.php") returned 0
	[0049.565] lstrlenA (lpString="*.php") returned 5
	[0049.565] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.vbe") returned 0
	[0049.565] lstrlenA (lpString="*.vbe") returned 5
	[0049.565] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.vba") returned 0
	[0049.565] lstrlenA (lpString="*.vba") returned 5
	[0049.565] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.vbs") returned 0
	[0049.565] lstrlenA (lpString="*.vbs") returned 5
	[0049.565] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.bat") returned 0
	[0049.565] lstrlenA (lpString="*.bat") returned 5
	[0049.565] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.cmd") returned 0
	[0049.565] lstrlenA (lpString="*.cmd") returned 5
	[0049.565] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.js") returned 0
	[0049.565] lstrlenA (lpString="*.js") returned 4
	[0049.565] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.jscript") returned 0
	[0049.565] lstrlenA (lpString="*.jscript") returned 9
	[0049.565] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.hta") returned 0
	[0049.565] lstrlenA (lpString="*.hta") returned 5
	[0049.565] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.php7") returned 0
	[0049.565] lstrlenA (lpString="*.php7") returned 6
	[0049.565] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.db") returned 0
	[0049.565] lstrlenA (lpString="*.db") returned 4
	[0049.566] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.swf") returned 0
	[0049.566] lstrlenA (lpString="*.swf") returned 5
	[0049.566] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.eml") returned 0
	[0049.566] lstrlenA (lpString="*.eml") returned 5
	[0049.566] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.part") returned 0
	[0049.566] lstrlenA (lpString="*.part") returned 6
	[0049.566] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.nfo") returned 0
	[0049.566] lstrlenA (lpString="*.nfo") returned 5
	[0049.566] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.rsa") returned 0
	[0049.566] lstrlenA (lpString="*.rsa") returned 5
	[0049.566] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.key") returned 0
	[0049.566] lstrlenA (lpString="*.key") returned 5
	[0049.566] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.aes") returned 0
	[0049.566] lstrlenA (lpString="*.aes") returned 5
	[0049.566] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.blob") returned 0
	[0049.566] lstrlenA (lpString="*.blob") returned 6
	[0049.566] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.btc") returned 0
	[0049.566] lstrlenA (lpString="*.btc") returned 5
	[0049.566] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.wallet") returned 0
	[0049.566] lstrlenA (lpString="*.wallet") returned 8
	[0049.566] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1
	[0049.567] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0049.567] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="netfx_Extended_x86.msi") returned -1
	[0049.567] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="netfx_Extended_x86.msi") returned -1
	[0049.567] lstrcmpiA (lpString1="", lpString2="netfx_Extended_x86.msi") returned -1
	[0049.567] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned="netfx_Extended_x64.msi"
	[0049.567] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0049.567] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned=""
	[0049.567] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.567] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\how-to-decrypt-files.htm")) returned 0x20
	[0049.567] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="netfx_Extended_x86.msi" | out: lpString1="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi"
	[0049.567] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.zip") returned 0
	[0049.567] lstrlenA (lpString="*.zip") returned 5
	[0049.567] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.rar") returned 0
	[0049.567] lstrlenA (lpString="*.rar") returned 5
	[0049.567] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.7z") returned 0
	[0049.567] lstrlenA (lpString="*.7z") returned 4
	[0049.567] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.tar") returned 0
	[0049.567] lstrlenA (lpString="*.tar") returned 5
	[0049.567] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.gzip") returned 0
	[0049.567] lstrlenA (lpString="*.gzip") returned 6
	[0049.567] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.jpg") returned 0
	[0049.567] lstrlenA (lpString="*.jpg") returned 5
	[0049.567] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.jpeg") returned 0
	[0049.568] lstrlenA (lpString="*.jpeg") returned 6
	[0049.568] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.bmp") returned 0
	[0049.568] lstrlenA (lpString="*.bmp") returned 5
	[0049.568] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.gif") returned 0
	[0049.568] lstrlenA (lpString="*.gif") returned 5
	[0049.568] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.png") returned 0
	[0049.568] lstrlenA (lpString="*.png") returned 5
	[0049.568] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.doc") returned 0
	[0049.568] lstrlenA (lpString="*.doc") returned 5
	[0049.568] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.docx") returned 0
	[0049.568] lstrlenA (lpString="*.docx") returned 6
	[0049.568] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.xls") returned 0
	[0049.568] lstrlenA (lpString="*.xls") returned 5
	[0049.568] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.xlsx") returned 0
	[0049.568] lstrlenA (lpString="*.xlsx") returned 6
	[0049.568] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.ppt") returned 0
	[0049.568] lstrlenA (lpString="*.ppt") returned 5
	[0049.568] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.pptx") returned 0
	[0049.568] lstrlenA (lpString="*.pptx") returned 6
	[0049.568] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.txt") returned 0
	[0049.568] lstrlenA (lpString="*.txt") returned 5
	[0049.568] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.pdf") returned 0
	[0049.568] lstrlenA (lpString="*.pdf") returned 5
	[0049.569] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.htm") returned 0
	[0049.569] lstrlenA (lpString="*.htm") returned 5
	[0049.569] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.html") returned 0
	[0049.569] lstrlenA (lpString="*.html") returned 6
	[0049.569] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.mdb") returned 0
	[0049.569] lstrlenA (lpString="*.mdb") returned 5
	[0049.569] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.pfx") returned 0
	[0049.569] lstrlenA (lpString="*.pfx") returned 5
	[0049.569] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.md") returned 0
	[0049.569] lstrlenA (lpString="*.md") returned 4
	[0049.569] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.lnk") returned 0
	[0049.569] lstrlenA (lpString="*.lnk") returned 5
	[0049.569] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.torrent") returned 0
	[0049.569] lstrlenA (lpString="*.torrent") returned 9
	[0049.569] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.mov") returned 0
	[0049.569] lstrlenA (lpString="*.mov") returned 5
	[0049.569] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.3gp") returned 0
	[0049.569] lstrlenA (lpString="*.3gp") returned 5
	[0049.569] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.mpeg") returned 0
	[0049.569] lstrlenA (lpString="*.mpeg") returned 6
	[0049.569] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.mpg") returned 0
	[0049.569] lstrlenA (lpString="*.mpg") returned 5
	[0049.569] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.flv") returned 0
	[0049.569] lstrlenA (lpString="*.flv") returned 5
	[0049.569] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.avi") returned 0
	[0049.569] lstrlenA (lpString="*.avi") returned 5
	[0049.569] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.mp4") returned 0
	[0049.569] lstrlenA (lpString="*.mp4") returned 5
	[0049.569] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.wmv") returned 0
	[0049.569] lstrlenA (lpString="*.wmv") returned 5
	[0049.569] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.mkv") returned 0
	[0049.569] lstrlenA (lpString="*.mkv") returned 5
	[0049.569] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.mp3") returned 0
	[0049.569] lstrlenA (lpString="*.mp3") returned 5
	[0049.569] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.wav") returned 0
	[0049.570] lstrlenA (lpString="*.wav") returned 5
	[0049.570] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.flac") returned 0
	[0049.570] lstrlenA (lpString="*.flac") returned 6
	[0049.570] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.wma") returned 0
	[0049.570] lstrlenA (lpString="*.wma") returned 5
	[0049.570] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.au3") returned 0
	[0049.570] lstrlenA (lpString="*.au3") returned 5
	[0049.570] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.ahk") returned 0
	[0049.570] lstrlenA (lpString="*.ahk") returned 5
	[0049.570] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.c") returned 0
	[0049.570] lstrlenA (lpString="*.c") returned 3
	[0049.570] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.cc") returned 0
	[0049.570] lstrlenA (lpString="*.cc") returned 4
	[0049.570] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.cpp") returned 0
	[0049.570] lstrlenA (lpString="*.cpp") returned 5
	[0049.570] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.cxx") returned 0
	[0049.570] lstrlenA (lpString="*.cxx") returned 5
	[0049.570] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.c++") returned 0
	[0049.570] lstrlenA (lpString="*.c++") returned 5
	[0049.570] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.cs") returned 0
	[0049.570] lstrlenA (lpString="*.cs") returned 4
	[0049.570] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.vb") returned 0
	[0049.570] lstrlenA (lpString="*.vb") returned 4
	[0049.570] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.bas") returned 0
	[0049.570] lstrlenA (lpString="*.bas") returned 5
	[0049.570] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.csproj") returned 0
	[0049.570] lstrlenA (lpString="*.csproj") returned 8
	[0049.570] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.vbproj") returned 0
	[0049.570] lstrlenA (lpString="*.vbproj") returned 8
	[0049.570] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.vcxproj") returned 0
	[0049.570] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.570] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.manifest") returned 0
	[0049.570] lstrlenA (lpString="*.manifest") returned 10
	[0049.570] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.php") returned 0
	[0049.570] lstrlenA (lpString="*.php") returned 5
	[0049.571] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.vbe") returned 0
	[0049.571] lstrlenA (lpString="*.vbe") returned 5
	[0049.571] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.vba") returned 0
	[0049.571] lstrlenA (lpString="*.vba") returned 5
	[0049.571] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.vbs") returned 0
	[0049.571] lstrlenA (lpString="*.vbs") returned 5
	[0049.571] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.bat") returned 0
	[0049.571] lstrlenA (lpString="*.bat") returned 5
	[0049.571] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.cmd") returned 0
	[0049.571] lstrlenA (lpString="*.cmd") returned 5
	[0049.571] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.js") returned 0
	[0049.571] lstrlenA (lpString="*.js") returned 4
	[0049.571] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.jscript") returned 0
	[0049.571] lstrlenA (lpString="*.jscript") returned 9
	[0049.571] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.hta") returned 0
	[0049.571] lstrlenA (lpString="*.hta") returned 5
	[0049.571] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.php7") returned 0
	[0049.571] lstrlenA (lpString="*.php7") returned 6
	[0049.571] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.db") returned 0
	[0049.571] lstrlenA (lpString="*.db") returned 4
	[0049.571] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.swf") returned 0
	[0049.571] lstrlenA (lpString="*.swf") returned 5
	[0049.571] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.eml") returned 0
	[0049.571] lstrlenA (lpString="*.eml") returned 5
	[0049.571] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.part") returned 0
	[0049.571] lstrlenA (lpString="*.part") returned 6
	[0049.571] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.nfo") returned 0
	[0049.571] lstrlenA (lpString="*.nfo") returned 5
	[0049.571] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.rsa") returned 0
	[0049.571] lstrlenA (lpString="*.rsa") returned 5
	[0049.571] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.key") returned 0
	[0049.571] lstrlenA (lpString="*.key") returned 5
	[0049.571] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.aes") returned 0
	[0049.571] lstrlenA (lpString="*.aes") returned 5
	[0049.571] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.blob") returned 0
	[0049.572] lstrlenA (lpString="*.blob") returned 6
	[0049.572] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.btc") returned 0
	[0049.572] lstrlenA (lpString="*.btc") returned 5
	[0049.572] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.wallet") returned 0
	[0049.572] lstrlenA (lpString="*.wallet") returned 8
	[0049.572] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="ParameterInfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1
	[0049.572] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0049.572] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="ParameterInfo.xml") returned -1
	[0049.572] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="ParameterInfo.xml") returned -1
	[0049.572] lstrcmpiA (lpString1="", lpString2="ParameterInfo.xml") returned -1
	[0049.572] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned="netfx_Extended_x86.msi"
	[0049.572] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0049.572] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned=""
	[0049.572] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.572] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\how-to-decrypt-files.htm")) returned 0x20
	[0049.572] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="ParameterInfo.xml" | out: lpString1="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned="C:\\588bce7c90097ed212\\ParameterInfo.xml"
	[0049.572] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.zip") returned 0
	[0049.572] lstrlenA (lpString="*.zip") returned 5
	[0049.572] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.rar") returned 0
	[0049.572] lstrlenA (lpString="*.rar") returned 5
	[0049.572] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.7z") returned 0
	[0049.572] lstrlenA (lpString="*.7z") returned 4
	[0049.572] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.tar") returned 0
	[0049.572] lstrlenA (lpString="*.tar") returned 5
	[0049.572] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.gzip") returned 0
	[0049.572] lstrlenA (lpString="*.gzip") returned 6
	[0049.572] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.jpg") returned 0
	[0049.572] lstrlenA (lpString="*.jpg") returned 5
	[0049.572] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.jpeg") returned 0
	[0049.572] lstrlenA (lpString="*.jpeg") returned 6
	[0049.572] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.bmp") returned 0
	[0049.573] lstrlenA (lpString="*.bmp") returned 5
	[0049.573] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.gif") returned 0
	[0049.573] lstrlenA (lpString="*.gif") returned 5
	[0049.573] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.png") returned 0
	[0049.573] lstrlenA (lpString="*.png") returned 5
	[0049.573] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.doc") returned 0
	[0049.573] lstrlenA (lpString="*.doc") returned 5
	[0049.573] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.docx") returned 0
	[0049.573] lstrlenA (lpString="*.docx") returned 6
	[0049.573] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.xls") returned 0
	[0049.573] lstrlenA (lpString="*.xls") returned 5
	[0049.573] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.xlsx") returned 0
	[0049.573] lstrlenA (lpString="*.xlsx") returned 6
	[0049.573] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.ppt") returned 0
	[0049.573] lstrlenA (lpString="*.ppt") returned 5
	[0049.573] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.pptx") returned 0
	[0049.573] lstrlenA (lpString="*.pptx") returned 6
	[0049.573] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.txt") returned 0
	[0049.573] lstrlenA (lpString="*.txt") returned 5
	[0049.573] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.pdf") returned 0
	[0049.573] lstrlenA (lpString="*.pdf") returned 5
	[0049.573] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.htm") returned 0
	[0049.573] lstrlenA (lpString="*.htm") returned 5
	[0049.573] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.html") returned 0
	[0049.573] lstrlenA (lpString="*.html") returned 6
	[0049.573] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.mdb") returned 0
	[0049.573] lstrlenA (lpString="*.mdb") returned 5
	[0049.573] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.pfx") returned 0
	[0049.573] lstrlenA (lpString="*.pfx") returned 5
	[0049.573] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.md") returned 0
	[0049.573] lstrlenA (lpString="*.md") returned 4
	[0049.573] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.lnk") returned 0
	[0049.573] lstrlenA (lpString="*.lnk") returned 5
	[0049.573] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.torrent") returned 0
	[0049.573] lstrlenA (lpString="*.torrent") returned 9
	[0049.574] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.mov") returned 0
	[0049.574] lstrlenA (lpString="*.mov") returned 5
	[0049.574] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.3gp") returned 0
	[0049.574] lstrlenA (lpString="*.3gp") returned 5
	[0049.574] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.mpeg") returned 0
	[0049.574] lstrlenA (lpString="*.mpeg") returned 6
	[0049.574] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.mpg") returned 0
	[0049.574] lstrlenA (lpString="*.mpg") returned 5
	[0049.574] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.flv") returned 0
	[0049.574] lstrlenA (lpString="*.flv") returned 5
	[0049.574] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.avi") returned 0
	[0049.574] lstrlenA (lpString="*.avi") returned 5
	[0049.574] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.mp4") returned 0
	[0049.574] lstrlenA (lpString="*.mp4") returned 5
	[0049.574] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.wmv") returned 0
	[0049.574] lstrlenA (lpString="*.wmv") returned 5
	[0049.574] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.mkv") returned 0
	[0049.574] lstrlenA (lpString="*.mkv") returned 5
	[0049.574] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.mp3") returned 0
	[0049.574] lstrlenA (lpString="*.mp3") returned 5
	[0049.574] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.wav") returned 0
	[0049.574] lstrlenA (lpString="*.wav") returned 5
	[0049.574] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.flac") returned 0
	[0049.574] lstrlenA (lpString="*.flac") returned 6
	[0049.574] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.wma") returned 0
	[0049.574] lstrlenA (lpString="*.wma") returned 5
	[0049.574] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.au3") returned 0
	[0049.574] lstrlenA (lpString="*.au3") returned 5
	[0049.574] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.ahk") returned 0
	[0049.574] lstrlenA (lpString="*.ahk") returned 5
	[0049.574] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.c") returned 0
	[0049.574] lstrlenA (lpString="*.c") returned 3
	[0049.574] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.cc") returned 0
	[0049.574] lstrlenA (lpString="*.cc") returned 4
	[0049.574] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.cpp") returned 0
	[0049.575] lstrlenA (lpString="*.cpp") returned 5
	[0049.575] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.cxx") returned 0
	[0049.575] lstrlenA (lpString="*.cxx") returned 5
	[0049.575] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.c++") returned 0
	[0049.575] lstrlenA (lpString="*.c++") returned 5
	[0049.575] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.cs") returned 0
	[0049.575] lstrlenA (lpString="*.cs") returned 4
	[0049.575] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.vb") returned 0
	[0049.575] lstrlenA (lpString="*.vb") returned 4
	[0049.575] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.bas") returned 0
	[0049.575] lstrlenA (lpString="*.bas") returned 5
	[0049.575] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.csproj") returned 0
	[0049.575] lstrlenA (lpString="*.csproj") returned 8
	[0049.575] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.vbproj") returned 0
	[0049.575] lstrlenA (lpString="*.vbproj") returned 8
	[0049.575] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.vcxproj") returned 0
	[0049.575] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.575] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.manifest") returned 0
	[0049.575] lstrlenA (lpString="*.manifest") returned 10
	[0049.575] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.php") returned 0
	[0049.575] lstrlenA (lpString="*.php") returned 5
	[0049.575] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.vbe") returned 0
	[0049.575] lstrlenA (lpString="*.vbe") returned 5
	[0049.575] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.vba") returned 0
	[0049.575] lstrlenA (lpString="*.vba") returned 5
	[0049.575] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.vbs") returned 0
	[0049.575] lstrlenA (lpString="*.vbs") returned 5
	[0049.575] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.bat") returned 0
	[0049.575] lstrlenA (lpString="*.bat") returned 5
	[0049.575] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.cmd") returned 0
	[0049.575] lstrlenA (lpString="*.cmd") returned 5
	[0049.575] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.js") returned 0
	[0049.575] lstrlenA (lpString="*.js") returned 4
	[0049.575] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.jscript") returned 0
	[0049.575] lstrlenA (lpString="*.jscript") returned 9
	[0049.576] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.hta") returned 0
	[0049.576] lstrlenA (lpString="*.hta") returned 5
	[0049.576] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.php7") returned 0
	[0049.576] lstrlenA (lpString="*.php7") returned 6
	[0049.576] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.db") returned 0
	[0049.576] lstrlenA (lpString="*.db") returned 4
	[0049.576] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.swf") returned 0
	[0049.576] lstrlenA (lpString="*.swf") returned 5
	[0049.576] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.eml") returned 0
	[0049.576] lstrlenA (lpString="*.eml") returned 5
	[0049.576] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.part") returned 0
	[0049.576] lstrlenA (lpString="*.part") returned 6
	[0049.576] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.nfo") returned 0
	[0049.576] lstrlenA (lpString="*.nfo") returned 5
	[0049.576] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.rsa") returned 0
	[0049.576] lstrlenA (lpString="*.rsa") returned 5
	[0049.576] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.key") returned 0
	[0049.576] lstrlenA (lpString="*.key") returned 5
	[0049.576] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.aes") returned 0
	[0049.576] lstrlenA (lpString="*.aes") returned 5
	[0049.576] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.blob") returned 0
	[0049.576] lstrlenA (lpString="*.blob") returned 6
	[0049.576] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.btc") returned 0
	[0049.576] lstrlenA (lpString="*.btc") returned 5
	[0049.576] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.wallet") returned 0
	[0049.576] lstrlenA (lpString="*.wallet") returned 8
	[0049.576] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1
	[0049.576] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0049.576] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="RGB9RAST_x64.msi") returned -1
	[0049.576] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="RGB9RAST_x64.msi") returned -1
	[0049.576] lstrcmpiA (lpString1="", lpString2="RGB9RAST_x64.msi") returned -1
	[0049.576] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned="ParameterInfo.xml"
	[0049.576] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0049.576] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned=""
	[0049.576] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.577] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\how-to-decrypt-files.htm")) returned 0x20
	[0049.577] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="RGB9RAST_x64.msi" | out: lpString1="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi"
	[0049.577] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.zip") returned 0
	[0049.577] lstrlenA (lpString="*.zip") returned 5
	[0049.577] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.rar") returned 0
	[0049.577] lstrlenA (lpString="*.rar") returned 5
	[0049.577] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.7z") returned 0
	[0049.577] lstrlenA (lpString="*.7z") returned 4
	[0049.577] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.tar") returned 0
	[0049.577] lstrlenA (lpString="*.tar") returned 5
	[0049.577] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.gzip") returned 0
	[0049.577] lstrlenA (lpString="*.gzip") returned 6
	[0049.577] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.jpg") returned 0
	[0049.577] lstrlenA (lpString="*.jpg") returned 5
	[0049.577] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.jpeg") returned 0
	[0049.577] lstrlenA (lpString="*.jpeg") returned 6
	[0049.577] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.bmp") returned 0
	[0049.577] lstrlenA (lpString="*.bmp") returned 5
	[0049.577] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.gif") returned 0
	[0049.577] lstrlenA (lpString="*.gif") returned 5
	[0049.577] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.png") returned 0
	[0049.577] lstrlenA (lpString="*.png") returned 5
	[0049.577] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.doc") returned 0
	[0049.577] lstrlenA (lpString="*.doc") returned 5
	[0049.577] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.docx") returned 0
	[0049.577] lstrlenA (lpString="*.docx") returned 6
	[0049.577] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.xls") returned 0
	[0049.577] lstrlenA (lpString="*.xls") returned 5
	[0049.577] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.xlsx") returned 0
	[0049.577] lstrlenA (lpString="*.xlsx") returned 6
	[0049.577] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.ppt") returned 0
	[0049.577] lstrlenA (lpString="*.ppt") returned 5
	[0049.578] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.pptx") returned 0
	[0049.578] lstrlenA (lpString="*.pptx") returned 6
	[0049.578] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.txt") returned 0
	[0049.578] lstrlenA (lpString="*.txt") returned 5
	[0049.578] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.pdf") returned 0
	[0049.578] lstrlenA (lpString="*.pdf") returned 5
	[0049.578] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.htm") returned 0
	[0049.578] lstrlenA (lpString="*.htm") returned 5
	[0049.578] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.html") returned 0
	[0049.578] lstrlenA (lpString="*.html") returned 6
	[0049.578] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.mdb") returned 0
	[0049.578] lstrlenA (lpString="*.mdb") returned 5
	[0049.578] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.pfx") returned 0
	[0049.578] lstrlenA (lpString="*.pfx") returned 5
	[0049.578] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.md") returned 0
	[0049.578] lstrlenA (lpString="*.md") returned 4
	[0049.578] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.lnk") returned 0
	[0049.578] lstrlenA (lpString="*.lnk") returned 5
	[0049.578] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.torrent") returned 0
	[0049.578] lstrlenA (lpString="*.torrent") returned 9
	[0049.578] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.mov") returned 0
	[0049.578] lstrlenA (lpString="*.mov") returned 5
	[0049.578] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.3gp") returned 0
	[0049.578] lstrlenA (lpString="*.3gp") returned 5
	[0049.578] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.mpeg") returned 0
	[0049.578] lstrlenA (lpString="*.mpeg") returned 6
	[0049.578] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.mpg") returned 0
	[0049.578] lstrlenA (lpString="*.mpg") returned 5
	[0049.578] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.flv") returned 0
	[0049.578] lstrlenA (lpString="*.flv") returned 5
	[0049.578] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.avi") returned 0
	[0049.578] lstrlenA (lpString="*.avi") returned 5
	[0049.578] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.mp4") returned 0
	[0049.579] lstrlenA (lpString="*.mp4") returned 5
	[0049.579] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.wmv") returned 0
	[0049.579] lstrlenA (lpString="*.wmv") returned 5
	[0049.579] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.mkv") returned 0
	[0049.579] lstrlenA (lpString="*.mkv") returned 5
	[0049.579] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.mp3") returned 0
	[0049.579] lstrlenA (lpString="*.mp3") returned 5
	[0049.579] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.wav") returned 0
	[0049.579] lstrlenA (lpString="*.wav") returned 5
	[0049.579] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.flac") returned 0
	[0049.579] lstrlenA (lpString="*.flac") returned 6
	[0049.579] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.wma") returned 0
	[0049.579] lstrlenA (lpString="*.wma") returned 5
	[0049.579] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.au3") returned 0
	[0049.579] lstrlenA (lpString="*.au3") returned 5
	[0049.579] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.ahk") returned 0
	[0049.579] lstrlenA (lpString="*.ahk") returned 5
	[0049.579] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.c") returned 0
	[0049.579] lstrlenA (lpString="*.c") returned 3
	[0049.579] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.cc") returned 0
	[0049.579] lstrlenA (lpString="*.cc") returned 4
	[0049.579] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.cpp") returned 0
	[0049.579] lstrlenA (lpString="*.cpp") returned 5
	[0049.579] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.cxx") returned 0
	[0049.579] lstrlenA (lpString="*.cxx") returned 5
	[0049.579] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.c++") returned 0
	[0049.579] lstrlenA (lpString="*.c++") returned 5
	[0049.579] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.cs") returned 0
	[0049.579] lstrlenA (lpString="*.cs") returned 4
	[0049.579] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.vb") returned 0
	[0049.579] lstrlenA (lpString="*.vb") returned 4
	[0049.579] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.bas") returned 0
	[0049.579] lstrlenA (lpString="*.bas") returned 5
	[0049.579] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.csproj") returned 0
	[0049.579] lstrlenA (lpString="*.csproj") returned 8
	[0049.580] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.vbproj") returned 0
	[0049.580] lstrlenA (lpString="*.vbproj") returned 8
	[0049.580] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.vcxproj") returned 0
	[0049.580] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.580] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.manifest") returned 0
	[0049.580] lstrlenA (lpString="*.manifest") returned 10
	[0049.580] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.php") returned 0
	[0049.580] lstrlenA (lpString="*.php") returned 5
	[0049.580] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.vbe") returned 0
	[0049.580] lstrlenA (lpString="*.vbe") returned 5
	[0049.580] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.vba") returned 0
	[0049.580] lstrlenA (lpString="*.vba") returned 5
	[0049.580] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.vbs") returned 0
	[0049.580] lstrlenA (lpString="*.vbs") returned 5
	[0049.580] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.bat") returned 0
	[0049.580] lstrlenA (lpString="*.bat") returned 5
	[0049.580] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.cmd") returned 0
	[0049.580] lstrlenA (lpString="*.cmd") returned 5
	[0049.580] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.js") returned 0
	[0049.580] lstrlenA (lpString="*.js") returned 4
	[0049.580] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.jscript") returned 0
	[0049.580] lstrlenA (lpString="*.jscript") returned 9
	[0049.580] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.hta") returned 0
	[0049.580] lstrlenA (lpString="*.hta") returned 5
	[0049.580] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.php7") returned 0
	[0049.580] lstrlenA (lpString="*.php7") returned 6
	[0049.580] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.db") returned 0
	[0049.580] lstrlenA (lpString="*.db") returned 4
	[0049.580] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.swf") returned 0
	[0049.580] lstrlenA (lpString="*.swf") returned 5
	[0049.580] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.eml") returned 0
	[0049.580] lstrlenA (lpString="*.eml") returned 5
	[0049.580] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.part") returned 0
	[0049.580] lstrlenA (lpString="*.part") returned 6
	[0049.581] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.nfo") returned 0
	[0049.581] lstrlenA (lpString="*.nfo") returned 5
	[0049.581] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.rsa") returned 0
	[0049.581] lstrlenA (lpString="*.rsa") returned 5
	[0049.581] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.key") returned 0
	[0049.581] lstrlenA (lpString="*.key") returned 5
	[0049.581] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.aes") returned 0
	[0049.581] lstrlenA (lpString="*.aes") returned 5
	[0049.581] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.blob") returned 0
	[0049.581] lstrlenA (lpString="*.blob") returned 6
	[0049.581] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.btc") returned 0
	[0049.581] lstrlenA (lpString="*.btc") returned 5
	[0049.581] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.wallet") returned 0
	[0049.581] lstrlenA (lpString="*.wallet") returned 8
	[0049.581] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1
	[0049.581] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0049.581] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="RGB9Rast_x86.msi") returned -1
	[0049.581] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="RGB9Rast_x86.msi") returned -1
	[0049.581] lstrcmpiA (lpString1="", lpString2="RGB9Rast_x86.msi") returned -1
	[0049.581] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned="RGB9RAST_x64.msi"
	[0049.581] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0049.581] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned=""
	[0049.581] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.581] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\how-to-decrypt-files.htm")) returned 0x20
	[0049.581] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="RGB9Rast_x86.msi" | out: lpString1="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi"
	[0049.581] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.zip") returned 0
	[0049.581] lstrlenA (lpString="*.zip") returned 5
	[0049.581] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.rar") returned 0
	[0049.581] lstrlenA (lpString="*.rar") returned 5
	[0049.581] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.7z") returned 0
	[0049.581] lstrlenA (lpString="*.7z") returned 4
	[0049.581] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.tar") returned 0
	[0049.581] lstrlenA (lpString="*.tar") returned 5
	[0049.582] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.gzip") returned 0
	[0049.582] lstrlenA (lpString="*.gzip") returned 6
	[0049.582] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.jpg") returned 0
	[0049.582] lstrlenA (lpString="*.jpg") returned 5
	[0049.582] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.jpeg") returned 0
	[0049.582] lstrlenA (lpString="*.jpeg") returned 6
	[0049.582] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.bmp") returned 0
	[0049.582] lstrlenA (lpString="*.bmp") returned 5
	[0049.582] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.gif") returned 0
	[0049.582] lstrlenA (lpString="*.gif") returned 5
	[0049.582] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.png") returned 0
	[0049.582] lstrlenA (lpString="*.png") returned 5
	[0049.582] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.doc") returned 0
	[0049.582] lstrlenA (lpString="*.doc") returned 5
	[0049.582] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.docx") returned 0
	[0049.582] lstrlenA (lpString="*.docx") returned 6
	[0049.582] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.xls") returned 0
	[0049.582] lstrlenA (lpString="*.xls") returned 5
	[0049.582] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.xlsx") returned 0
	[0049.582] lstrlenA (lpString="*.xlsx") returned 6
	[0049.582] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.ppt") returned 0
	[0049.582] lstrlenA (lpString="*.ppt") returned 5
	[0049.582] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.pptx") returned 0
	[0049.582] lstrlenA (lpString="*.pptx") returned 6
	[0049.582] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.txt") returned 0
	[0049.582] lstrlenA (lpString="*.txt") returned 5
	[0049.582] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.pdf") returned 0
	[0049.582] lstrlenA (lpString="*.pdf") returned 5
	[0049.582] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.htm") returned 0
	[0049.582] lstrlenA (lpString="*.htm") returned 5
	[0049.582] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.html") returned 0
	[0049.582] lstrlenA (lpString="*.html") returned 6
	[0049.582] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.mdb") returned 0
	[0049.582] lstrlenA (lpString="*.mdb") returned 5
	[0049.582] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.pfx") returned 0
	[0049.583] lstrlenA (lpString="*.pfx") returned 5
	[0049.583] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.md") returned 0
	[0049.583] lstrlenA (lpString="*.md") returned 4
	[0049.583] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.lnk") returned 0
	[0049.583] lstrlenA (lpString="*.lnk") returned 5
	[0049.583] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.torrent") returned 0
	[0049.583] lstrlenA (lpString="*.torrent") returned 9
	[0049.583] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.mov") returned 0
	[0049.583] lstrlenA (lpString="*.mov") returned 5
	[0049.583] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.3gp") returned 0
	[0049.583] lstrlenA (lpString="*.3gp") returned 5
	[0049.583] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.mpeg") returned 0
	[0049.583] lstrlenA (lpString="*.mpeg") returned 6
	[0049.583] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.mpg") returned 0
	[0049.583] lstrlenA (lpString="*.mpg") returned 5
	[0049.583] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.flv") returned 0
	[0049.583] lstrlenA (lpString="*.flv") returned 5
	[0049.583] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.avi") returned 0
	[0049.583] lstrlenA (lpString="*.avi") returned 5
	[0049.583] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.mp4") returned 0
	[0049.583] lstrlenA (lpString="*.mp4") returned 5
	[0049.583] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.wmv") returned 0
	[0049.583] lstrlenA (lpString="*.wmv") returned 5
	[0049.583] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.mkv") returned 0
	[0049.583] lstrlenA (lpString="*.mkv") returned 5
	[0049.584] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.mp3") returned 0
	[0049.584] lstrlenA (lpString="*.mp3") returned 5
	[0049.584] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.wav") returned 0
	[0049.584] lstrlenA (lpString="*.wav") returned 5
	[0049.584] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.flac") returned 0
	[0049.584] lstrlenA (lpString="*.flac") returned 6
	[0049.584] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.wma") returned 0
	[0049.584] lstrlenA (lpString="*.wma") returned 5
	[0049.584] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.au3") returned 0
	[0049.584] lstrlenA (lpString="*.au3") returned 5
	[0049.584] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.ahk") returned 0
	[0049.585] lstrlenA (lpString="*.ahk") returned 5
	[0049.585] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.c") returned 0
	[0049.585] lstrlenA (lpString="*.c") returned 3
	[0049.585] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.cc") returned 0
	[0049.585] lstrlenA (lpString="*.cc") returned 4
	[0049.585] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.cpp") returned 0
	[0049.585] lstrlenA (lpString="*.cpp") returned 5
	[0049.585] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.cxx") returned 0
	[0049.585] lstrlenA (lpString="*.cxx") returned 5
	[0049.585] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.c++") returned 0
	[0049.585] lstrlenA (lpString="*.c++") returned 5
	[0049.585] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.cs") returned 0
	[0049.585] lstrlenA (lpString="*.cs") returned 4
	[0049.585] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.vb") returned 0
	[0049.585] lstrlenA (lpString="*.vb") returned 4
	[0049.585] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.bas") returned 0
	[0049.585] lstrlenA (lpString="*.bas") returned 5
	[0049.585] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.csproj") returned 0
	[0049.586] lstrlenA (lpString="*.csproj") returned 8
	[0049.586] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.vbproj") returned 0
	[0049.586] lstrlenA (lpString="*.vbproj") returned 8
	[0049.586] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.vcxproj") returned 0
	[0049.586] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.586] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.manifest") returned 0
	[0049.586] lstrlenA (lpString="*.manifest") returned 10
	[0049.586] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.php") returned 0
	[0049.586] lstrlenA (lpString="*.php") returned 5
	[0049.586] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.vbe") returned 0
	[0049.586] lstrlenA (lpString="*.vbe") returned 5
	[0049.586] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.vba") returned 0
	[0049.586] lstrlenA (lpString="*.vba") returned 5
	[0049.586] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.vbs") returned 0
	[0049.586] lstrlenA (lpString="*.vbs") returned 5
	[0049.586] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.bat") returned 0
	[0049.586] lstrlenA (lpString="*.bat") returned 5
	[0049.586] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.cmd") returned 0
	[0049.586] lstrlenA (lpString="*.cmd") returned 5
	[0049.586] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.js") returned 0
	[0049.586] lstrlenA (lpString="*.js") returned 4
	[0049.586] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.jscript") returned 0
	[0049.586] lstrlenA (lpString="*.jscript") returned 9
	[0049.586] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.hta") returned 0
	[0049.586] lstrlenA (lpString="*.hta") returned 5
	[0049.586] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.php7") returned 0
	[0049.586] lstrlenA (lpString="*.php7") returned 6
	[0049.586] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.db") returned 0
	[0049.586] lstrlenA (lpString="*.db") returned 4
	[0049.586] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.swf") returned 0
	[0049.586] lstrlenA (lpString="*.swf") returned 5
	[0049.586] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.eml") returned 0
	[0049.586] lstrlenA (lpString="*.eml") returned 5
	[0049.586] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.part") returned 0
	[0049.586] lstrlenA (lpString="*.part") returned 6
	[0049.587] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.nfo") returned 0
	[0049.587] lstrlenA (lpString="*.nfo") returned 5
	[0049.587] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.rsa") returned 0
	[0049.587] lstrlenA (lpString="*.rsa") returned 5
	[0049.587] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.key") returned 0
	[0049.587] lstrlenA (lpString="*.key") returned 5
	[0049.587] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.aes") returned 0
	[0049.587] lstrlenA (lpString="*.aes") returned 5
	[0049.587] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.blob") returned 0
	[0049.587] lstrlenA (lpString="*.blob") returned 6
	[0049.587] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.btc") returned 0
	[0049.587] lstrlenA (lpString="*.btc") returned 5
	[0049.587] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.wallet") returned 0
	[0049.587] lstrlenA (lpString="*.wallet") returned 8
	[0049.587] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.exe", cAlternateFileName="")) returned 1
	[0049.587] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0049.587] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Setup.exe") returned -1
	[0049.587] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Setup.exe") returned -1
	[0049.587] lstrcmpiA (lpString1="", lpString2="Setup.exe") returned -1
	[0049.587] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned="RGB9Rast_x86.msi"
	[0049.587] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0049.587] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned=""
	[0049.587] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.587] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\how-to-decrypt-files.htm")) returned 0x20
	[0049.587] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="Setup.exe" | out: lpString1="C:\\588bce7c90097ed212\\Setup.exe") returned="C:\\588bce7c90097ed212\\Setup.exe"
	[0049.587] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.zip") returned 0
	[0049.587] lstrlenA (lpString="*.zip") returned 5
	[0049.587] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.rar") returned 0
	[0049.587] lstrlenA (lpString="*.rar") returned 5
	[0049.588] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.7z") returned 0
	[0049.588] lstrlenA (lpString="*.7z") returned 4
	[0049.588] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.tar") returned 0
	[0049.588] lstrlenA (lpString="*.tar") returned 5
	[0049.588] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.gzip") returned 0
	[0049.588] lstrlenA (lpString="*.gzip") returned 6
	[0049.588] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.jpg") returned 0
	[0049.588] lstrlenA (lpString="*.jpg") returned 5
	[0049.588] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.jpeg") returned 0
	[0049.588] lstrlenA (lpString="*.jpeg") returned 6
	[0049.588] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.bmp") returned 0
	[0049.588] lstrlenA (lpString="*.bmp") returned 5
	[0049.588] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.gif") returned 0
	[0049.588] lstrlenA (lpString="*.gif") returned 5
	[0049.588] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.png") returned 0
	[0049.588] lstrlenA (lpString="*.png") returned 5
	[0049.588] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.doc") returned 0
	[0049.588] lstrlenA (lpString="*.doc") returned 5
	[0049.588] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.docx") returned 0
	[0049.588] lstrlenA (lpString="*.docx") returned 6
	[0049.588] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.xls") returned 0
	[0049.588] lstrlenA (lpString="*.xls") returned 5
	[0049.588] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.xlsx") returned 0
	[0049.588] lstrlenA (lpString="*.xlsx") returned 6
	[0049.588] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.ppt") returned 0
	[0049.588] lstrlenA (lpString="*.ppt") returned 5
	[0049.588] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.pptx") returned 0
	[0049.588] lstrlenA (lpString="*.pptx") returned 6
	[0049.588] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.txt") returned 0
	[0049.588] lstrlenA (lpString="*.txt") returned 5
	[0049.588] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.pdf") returned 0
	[0049.588] lstrlenA (lpString="*.pdf") returned 5
	[0049.588] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.htm") returned 0
	[0049.588] lstrlenA (lpString="*.htm") returned 5
	[0049.588] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.html") returned 0
	[0049.589] lstrlenA (lpString="*.html") returned 6
	[0049.589] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.mdb") returned 0
	[0049.589] lstrlenA (lpString="*.mdb") returned 5
	[0049.589] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.pfx") returned 0
	[0049.589] lstrlenA (lpString="*.pfx") returned 5
	[0049.589] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.md") returned 0
	[0049.589] lstrlenA (lpString="*.md") returned 4
	[0049.589] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.lnk") returned 0
	[0049.589] lstrlenA (lpString="*.lnk") returned 5
	[0049.589] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.torrent") returned 0
	[0049.589] lstrlenA (lpString="*.torrent") returned 9
	[0049.589] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.mov") returned 0
	[0049.589] lstrlenA (lpString="*.mov") returned 5
	[0049.589] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.3gp") returned 0
	[0049.589] lstrlenA (lpString="*.3gp") returned 5
	[0049.589] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.mpeg") returned 0
	[0049.589] lstrlenA (lpString="*.mpeg") returned 6
	[0049.589] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.mpg") returned 0
	[0049.589] lstrlenA (lpString="*.mpg") returned 5
	[0049.589] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.flv") returned 0
	[0049.589] lstrlenA (lpString="*.flv") returned 5
	[0049.589] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.avi") returned 0
	[0049.589] lstrlenA (lpString="*.avi") returned 5
	[0049.589] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.mp4") returned 0
	[0049.589] lstrlenA (lpString="*.mp4") returned 5
	[0049.589] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.wmv") returned 0
	[0049.589] lstrlenA (lpString="*.wmv") returned 5
	[0049.589] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.mkv") returned 0
	[0049.589] lstrlenA (lpString="*.mkv") returned 5
	[0049.589] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.mp3") returned 0
	[0049.589] lstrlenA (lpString="*.mp3") returned 5
	[0049.589] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.wav") returned 0
	[0049.589] lstrlenA (lpString="*.wav") returned 5
	[0049.589] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.flac") returned 0
	[0049.590] lstrlenA (lpString="*.flac") returned 6
	[0049.590] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.wma") returned 0
	[0049.590] lstrlenA (lpString="*.wma") returned 5
	[0049.590] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.au3") returned 0
	[0049.590] lstrlenA (lpString="*.au3") returned 5
	[0049.590] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.ahk") returned 0
	[0049.590] lstrlenA (lpString="*.ahk") returned 5
	[0049.590] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.c") returned 0
	[0049.590] lstrlenA (lpString="*.c") returned 3
	[0049.590] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.cc") returned 0
	[0049.590] lstrlenA (lpString="*.cc") returned 4
	[0049.590] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.cpp") returned 0
	[0049.590] lstrlenA (lpString="*.cpp") returned 5
	[0049.590] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.cxx") returned 0
	[0049.590] lstrlenA (lpString="*.cxx") returned 5
	[0049.590] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.c++") returned 0
	[0049.590] lstrlenA (lpString="*.c++") returned 5
	[0049.590] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.cs") returned 0
	[0049.590] lstrlenA (lpString="*.cs") returned 4
	[0049.590] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.vb") returned 0
	[0049.590] lstrlenA (lpString="*.vb") returned 4
	[0049.590] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.bas") returned 0
	[0049.590] lstrlenA (lpString="*.bas") returned 5
	[0049.590] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.csproj") returned 0
	[0049.590] lstrlenA (lpString="*.csproj") returned 8
	[0049.590] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.vbproj") returned 0
	[0049.590] lstrlenA (lpString="*.vbproj") returned 8
	[0049.590] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.vcxproj") returned 0
	[0049.590] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.590] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.manifest") returned 0
	[0049.590] lstrlenA (lpString="*.manifest") returned 10
	[0049.590] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.php") returned 0
	[0049.590] lstrlenA (lpString="*.php") returned 5
	[0049.590] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.vbe") returned 0
	[0049.590] lstrlenA (lpString="*.vbe") returned 5
	[0049.591] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.vba") returned 0
	[0049.591] lstrlenA (lpString="*.vba") returned 5
	[0049.591] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.vbs") returned 0
	[0049.591] lstrlenA (lpString="*.vbs") returned 5
	[0049.591] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.bat") returned 0
	[0049.591] lstrlenA (lpString="*.bat") returned 5
	[0049.591] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.cmd") returned 0
	[0049.591] lstrlenA (lpString="*.cmd") returned 5
	[0049.591] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.js") returned 0
	[0049.591] lstrlenA (lpString="*.js") returned 4
	[0049.591] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.jscript") returned 0
	[0049.591] lstrlenA (lpString="*.jscript") returned 9
	[0049.591] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.hta") returned 0
	[0049.591] lstrlenA (lpString="*.hta") returned 5
	[0049.591] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.php7") returned 0
	[0049.591] lstrlenA (lpString="*.php7") returned 6
	[0049.591] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.db") returned 0
	[0049.591] lstrlenA (lpString="*.db") returned 4
	[0049.591] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.swf") returned 0
	[0049.591] lstrlenA (lpString="*.swf") returned 5
	[0049.591] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.eml") returned 0
	[0049.591] lstrlenA (lpString="*.eml") returned 5
	[0049.591] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.part") returned 0
	[0049.591] lstrlenA (lpString="*.part") returned 6
	[0049.591] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.nfo") returned 0
	[0049.591] lstrlenA (lpString="*.nfo") returned 5
	[0049.591] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.rsa") returned 0
	[0049.591] lstrlenA (lpString="*.rsa") returned 5
	[0049.591] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.key") returned 0
	[0049.591] lstrlenA (lpString="*.key") returned 5
	[0049.591] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.aes") returned 0
	[0049.591] lstrlenA (lpString="*.aes") returned 5
	[0049.591] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.blob") returned 0
	[0049.591] lstrlenA (lpString="*.blob") returned 6
	[0049.592] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.btc") returned 0
	[0049.592] lstrlenA (lpString="*.btc") returned 5
	[0049.592] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.wallet") returned 0
	[0049.592] lstrlenA (lpString="*.wallet") returned 8
	[0049.592] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1
	[0049.592] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0049.592] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SetupEngine.dll") returned -1
	[0049.592] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SetupEngine.dll") returned -1
	[0049.592] lstrcmpiA (lpString1="", lpString2="SetupEngine.dll") returned -1
	[0049.592] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Setup.exe") returned="Setup.exe"
	[0049.592] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0049.592] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned=""
	[0049.592] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.592] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\how-to-decrypt-files.htm")) returned 0x20
	[0049.592] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="SetupEngine.dll" | out: lpString1="C:\\588bce7c90097ed212\\SetupEngine.dll") returned="C:\\588bce7c90097ed212\\SetupEngine.dll"
	[0049.592] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.zip") returned 0
	[0049.592] lstrlenA (lpString="*.zip") returned 5
	[0049.592] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.rar") returned 0
	[0049.592] lstrlenA (lpString="*.rar") returned 5
	[0049.592] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.7z") returned 0
	[0049.592] lstrlenA (lpString="*.7z") returned 4
	[0049.592] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.tar") returned 0
	[0049.592] lstrlenA (lpString="*.tar") returned 5
	[0049.592] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.gzip") returned 0
	[0049.592] lstrlenA (lpString="*.gzip") returned 6
	[0049.592] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.jpg") returned 0
	[0049.592] lstrlenA (lpString="*.jpg") returned 5
	[0049.592] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.jpeg") returned 0
	[0049.592] lstrlenA (lpString="*.jpeg") returned 6
	[0049.592] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.bmp") returned 0
	[0049.592] lstrlenA (lpString="*.bmp") returned 5
	[0049.592] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.gif") returned 0
	[0049.593] lstrlenA (lpString="*.gif") returned 5
	[0049.593] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.png") returned 0
	[0049.593] lstrlenA (lpString="*.png") returned 5
	[0049.593] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.doc") returned 0
	[0049.593] lstrlenA (lpString="*.doc") returned 5
	[0049.593] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.docx") returned 0
	[0049.593] lstrlenA (lpString="*.docx") returned 6
	[0049.593] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.xls") returned 0
	[0049.593] lstrlenA (lpString="*.xls") returned 5
	[0049.593] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.xlsx") returned 0
	[0049.593] lstrlenA (lpString="*.xlsx") returned 6
	[0049.593] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.ppt") returned 0
	[0049.593] lstrlenA (lpString="*.ppt") returned 5
	[0049.593] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.pptx") returned 0
	[0049.593] lstrlenA (lpString="*.pptx") returned 6
	[0049.593] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.txt") returned 0
	[0049.593] lstrlenA (lpString="*.txt") returned 5
	[0049.593] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.pdf") returned 0
	[0049.593] lstrlenA (lpString="*.pdf") returned 5
	[0049.593] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.htm") returned 0
	[0049.593] lstrlenA (lpString="*.htm") returned 5
	[0049.593] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.html") returned 0
	[0049.593] lstrlenA (lpString="*.html") returned 6
	[0049.593] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.mdb") returned 0
	[0049.593] lstrlenA (lpString="*.mdb") returned 5
	[0049.593] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.pfx") returned 0
	[0049.593] lstrlenA (lpString="*.pfx") returned 5
	[0049.593] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.md") returned 0
	[0049.593] lstrlenA (lpString="*.md") returned 4
	[0049.593] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.lnk") returned 0
	[0049.593] lstrlenA (lpString="*.lnk") returned 5
	[0049.593] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.torrent") returned 0
	[0049.593] lstrlenA (lpString="*.torrent") returned 9
	[0049.593] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.mov") returned 0
	[0049.593] lstrlenA (lpString="*.mov") returned 5
	[0049.593] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.3gp") returned 0
	[0049.594] lstrlenA (lpString="*.3gp") returned 5
	[0049.594] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.mpeg") returned 0
	[0049.594] lstrlenA (lpString="*.mpeg") returned 6
	[0049.594] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.mpg") returned 0
	[0049.594] lstrlenA (lpString="*.mpg") returned 5
	[0049.594] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.flv") returned 0
	[0049.594] lstrlenA (lpString="*.flv") returned 5
	[0049.594] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.avi") returned 0
	[0049.594] lstrlenA (lpString="*.avi") returned 5
	[0049.594] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.mp4") returned 0
	[0049.594] lstrlenA (lpString="*.mp4") returned 5
	[0049.594] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.wmv") returned 0
	[0049.594] lstrlenA (lpString="*.wmv") returned 5
	[0049.594] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.mkv") returned 0
	[0049.594] lstrlenA (lpString="*.mkv") returned 5
	[0049.594] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.mp3") returned 0
	[0049.594] lstrlenA (lpString="*.mp3") returned 5
	[0049.594] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.wav") returned 0
	[0049.594] lstrlenA (lpString="*.wav") returned 5
	[0049.594] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.flac") returned 0
	[0049.594] lstrlenA (lpString="*.flac") returned 6
	[0049.594] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.wma") returned 0
	[0049.594] lstrlenA (lpString="*.wma") returned 5
	[0049.594] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.au3") returned 0
	[0049.594] lstrlenA (lpString="*.au3") returned 5
	[0049.594] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.ahk") returned 0
	[0049.594] lstrlenA (lpString="*.ahk") returned 5
	[0049.594] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.c") returned 0
	[0049.594] lstrlenA (lpString="*.c") returned 3
	[0049.594] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.cc") returned 0
	[0049.594] lstrlenA (lpString="*.cc") returned 4
	[0049.594] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.cpp") returned 0
	[0049.594] lstrlenA (lpString="*.cpp") returned 5
	[0049.594] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.cxx") returned 0
	[0049.594] lstrlenA (lpString="*.cxx") returned 5
	[0049.595] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.c++") returned 0
	[0049.595] lstrlenA (lpString="*.c++") returned 5
	[0049.595] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.cs") returned 0
	[0049.595] lstrlenA (lpString="*.cs") returned 4
	[0049.595] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.vb") returned 0
	[0049.595] lstrlenA (lpString="*.vb") returned 4
	[0049.595] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.bas") returned 0
	[0049.595] lstrlenA (lpString="*.bas") returned 5
	[0049.595] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.csproj") returned 0
	[0049.595] lstrlenA (lpString="*.csproj") returned 8
	[0049.595] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.vbproj") returned 0
	[0049.595] lstrlenA (lpString="*.vbproj") returned 8
	[0049.595] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.vcxproj") returned 0
	[0049.595] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.595] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.manifest") returned 0
	[0049.595] lstrlenA (lpString="*.manifest") returned 10
	[0049.595] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.php") returned 0
	[0049.595] lstrlenA (lpString="*.php") returned 5
	[0049.595] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.vbe") returned 0
	[0049.595] lstrlenA (lpString="*.vbe") returned 5
	[0049.595] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.vba") returned 0
	[0049.595] lstrlenA (lpString="*.vba") returned 5
	[0049.595] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.vbs") returned 0
	[0049.595] lstrlenA (lpString="*.vbs") returned 5
	[0049.595] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.bat") returned 0
	[0049.595] lstrlenA (lpString="*.bat") returned 5
	[0049.595] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.cmd") returned 0
	[0049.595] lstrlenA (lpString="*.cmd") returned 5
	[0049.595] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.js") returned 0
	[0049.595] lstrlenA (lpString="*.js") returned 4
	[0049.595] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.jscript") returned 0
	[0049.595] lstrlenA (lpString="*.jscript") returned 9
	[0049.595] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.hta") returned 0
	[0049.595] lstrlenA (lpString="*.hta") returned 5
	[0049.595] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.php7") returned 0
	[0049.596] lstrlenA (lpString="*.php7") returned 6
	[0049.596] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.db") returned 0
	[0049.596] lstrlenA (lpString="*.db") returned 4
	[0049.596] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.swf") returned 0
	[0049.596] lstrlenA (lpString="*.swf") returned 5
	[0049.596] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.eml") returned 0
	[0049.596] lstrlenA (lpString="*.eml") returned 5
	[0049.596] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.part") returned 0
	[0049.596] lstrlenA (lpString="*.part") returned 6
	[0049.596] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.nfo") returned 0
	[0049.596] lstrlenA (lpString="*.nfo") returned 5
	[0049.596] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.rsa") returned 0
	[0049.596] lstrlenA (lpString="*.rsa") returned 5
	[0049.596] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.key") returned 0
	[0049.596] lstrlenA (lpString="*.key") returned 5
	[0049.596] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.aes") returned 0
	[0049.596] lstrlenA (lpString="*.aes") returned 5
	[0049.596] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.blob") returned 0
	[0049.596] lstrlenA (lpString="*.blob") returned 6
	[0049.596] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.btc") returned 0
	[0049.596] lstrlenA (lpString="*.btc") returned 5
	[0049.596] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.wallet") returned 0
	[0049.596] lstrlenA (lpString="*.wallet") returned 8
	[0049.596] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1
	[0049.596] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0049.596] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SetupUi.dll") returned -1
	[0049.596] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SetupUi.dll") returned -1
	[0049.596] lstrcmpiA (lpString1="", lpString2="SetupUi.dll") returned -1
	[0049.596] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\SetupEngine.dll") returned="SetupEngine.dll"
	[0049.596] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0049.596] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned=""
	[0049.596] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.596] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\how-to-decrypt-files.htm")) returned 0x20
	[0049.597] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="SetupUi.dll" | out: lpString1="C:\\588bce7c90097ed212\\SetupUi.dll") returned="C:\\588bce7c90097ed212\\SetupUi.dll"
	[0049.597] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.zip") returned 0
	[0049.597] lstrlenA (lpString="*.zip") returned 5
	[0049.597] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.rar") returned 0
	[0049.597] lstrlenA (lpString="*.rar") returned 5
	[0049.597] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.7z") returned 0
	[0049.597] lstrlenA (lpString="*.7z") returned 4
	[0049.597] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.tar") returned 0
	[0049.597] lstrlenA (lpString="*.tar") returned 5
	[0049.597] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.gzip") returned 0
	[0049.597] lstrlenA (lpString="*.gzip") returned 6
	[0049.597] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.jpg") returned 0
	[0049.597] lstrlenA (lpString="*.jpg") returned 5
	[0049.597] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.jpeg") returned 0
	[0049.597] lstrlenA (lpString="*.jpeg") returned 6
	[0049.597] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.bmp") returned 0
	[0049.597] lstrlenA (lpString="*.bmp") returned 5
	[0049.597] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.gif") returned 0
	[0049.597] lstrlenA (lpString="*.gif") returned 5
	[0049.597] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.png") returned 0
	[0049.597] lstrlenA (lpString="*.png") returned 5
	[0049.597] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.doc") returned 0
	[0049.597] lstrlenA (lpString="*.doc") returned 5
	[0049.597] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.docx") returned 0
	[0049.597] lstrlenA (lpString="*.docx") returned 6
	[0049.597] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.xls") returned 0
	[0049.597] lstrlenA (lpString="*.xls") returned 5
	[0049.597] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.xlsx") returned 0
	[0049.597] lstrlenA (lpString="*.xlsx") returned 6
	[0049.597] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.ppt") returned 0
	[0049.597] lstrlenA (lpString="*.ppt") returned 5
	[0049.597] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.pptx") returned 0
	[0049.597] lstrlenA (lpString="*.pptx") returned 6
	[0049.597] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.txt") returned 0
	[0049.598] lstrlenA (lpString="*.txt") returned 5
	[0049.598] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.pdf") returned 0
	[0049.598] lstrlenA (lpString="*.pdf") returned 5
	[0049.598] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.htm") returned 0
	[0049.598] lstrlenA (lpString="*.htm") returned 5
	[0049.598] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.html") returned 0
	[0049.598] lstrlenA (lpString="*.html") returned 6
	[0049.598] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.mdb") returned 0
	[0049.598] lstrlenA (lpString="*.mdb") returned 5
	[0049.598] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.pfx") returned 0
	[0049.598] lstrlenA (lpString="*.pfx") returned 5
	[0049.598] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.md") returned 0
	[0049.598] lstrlenA (lpString="*.md") returned 4
	[0049.598] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.lnk") returned 0
	[0049.598] lstrlenA (lpString="*.lnk") returned 5
	[0049.598] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.torrent") returned 0
	[0049.598] lstrlenA (lpString="*.torrent") returned 9
	[0049.598] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.mov") returned 0
	[0049.598] lstrlenA (lpString="*.mov") returned 5
	[0049.598] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.3gp") returned 0
	[0049.598] lstrlenA (lpString="*.3gp") returned 5
	[0049.598] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.mpeg") returned 0
	[0049.598] lstrlenA (lpString="*.mpeg") returned 6
	[0049.598] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.mpg") returned 0
	[0049.598] lstrlenA (lpString="*.mpg") returned 5
	[0049.598] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.flv") returned 0
	[0049.598] lstrlenA (lpString="*.flv") returned 5
	[0049.598] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.avi") returned 0
	[0049.598] lstrlenA (lpString="*.avi") returned 5
	[0049.598] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.mp4") returned 0
	[0049.598] lstrlenA (lpString="*.mp4") returned 5
	[0049.598] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.wmv") returned 0
	[0049.598] lstrlenA (lpString="*.wmv") returned 5
	[0049.598] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.mkv") returned 0
	[0049.599] lstrlenA (lpString="*.mkv") returned 5
	[0049.599] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.mp3") returned 0
	[0049.599] lstrlenA (lpString="*.mp3") returned 5
	[0049.599] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.wav") returned 0
	[0049.599] lstrlenA (lpString="*.wav") returned 5
	[0049.599] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.flac") returned 0
	[0049.599] lstrlenA (lpString="*.flac") returned 6
	[0049.599] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.wma") returned 0
	[0049.599] lstrlenA (lpString="*.wma") returned 5
	[0049.599] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.au3") returned 0
	[0049.599] lstrlenA (lpString="*.au3") returned 5
	[0049.599] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.ahk") returned 0
	[0049.642] lstrlenA (lpString="*.ahk") returned 5
	[0049.642] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.c") returned 0
	[0049.642] lstrlenA (lpString="*.c") returned 3
	[0049.642] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.cc") returned 0
	[0049.642] lstrlenA (lpString="*.cc") returned 4
	[0049.642] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.cpp") returned 0
	[0049.642] lstrlenA (lpString="*.cpp") returned 5
	[0049.642] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.cxx") returned 0
	[0049.642] lstrlenA (lpString="*.cxx") returned 5
	[0049.642] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.c++") returned 0
	[0049.642] lstrlenA (lpString="*.c++") returned 5
	[0049.642] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.cs") returned 0
	[0049.642] lstrlenA (lpString="*.cs") returned 4
	[0049.642] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.vb") returned 0
	[0049.642] lstrlenA (lpString="*.vb") returned 4
	[0049.642] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.bas") returned 0
	[0049.642] lstrlenA (lpString="*.bas") returned 5
	[0049.642] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.csproj") returned 0
	[0049.642] lstrlenA (lpString="*.csproj") returned 8
	[0049.642] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.vbproj") returned 0
	[0049.642] lstrlenA (lpString="*.vbproj") returned 8
	[0049.642] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.vcxproj") returned 0
	[0049.642] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.642] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.manifest") returned 0
	[0049.642] lstrlenA (lpString="*.manifest") returned 10
	[0049.642] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.php") returned 0
	[0049.642] lstrlenA (lpString="*.php") returned 5
	[0049.642] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.vbe") returned 0
	[0049.642] lstrlenA (lpString="*.vbe") returned 5
	[0049.642] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.vba") returned 0
	[0049.642] lstrlenA (lpString="*.vba") returned 5
	[0049.642] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.vbs") returned 0
	[0049.642] lstrlenA (lpString="*.vbs") returned 5
	[0049.642] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.bat") returned 0
	[0049.643] lstrlenA (lpString="*.bat") returned 5
	[0049.643] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.cmd") returned 0
	[0049.643] lstrlenA (lpString="*.cmd") returned 5
	[0049.643] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.js") returned 0
	[0049.643] lstrlenA (lpString="*.js") returned 4
	[0049.643] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.jscript") returned 0
	[0049.643] lstrlenA (lpString="*.jscript") returned 9
	[0049.643] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.hta") returned 0
	[0049.643] lstrlenA (lpString="*.hta") returned 5
	[0049.643] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.php7") returned 0
	[0049.643] lstrlenA (lpString="*.php7") returned 6
	[0049.643] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.db") returned 0
	[0049.643] lstrlenA (lpString="*.db") returned 4
	[0049.643] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.swf") returned 0
	[0049.643] lstrlenA (lpString="*.swf") returned 5
	[0049.643] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.eml") returned 0
	[0049.643] lstrlenA (lpString="*.eml") returned 5
	[0049.643] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.part") returned 0
	[0049.643] lstrlenA (lpString="*.part") returned 6
	[0049.643] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.nfo") returned 0
	[0049.643] lstrlenA (lpString="*.nfo") returned 5
	[0049.643] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.rsa") returned 0
	[0049.643] lstrlenA (lpString="*.rsa") returned 5
	[0049.643] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.key") returned 0
	[0049.643] lstrlenA (lpString="*.key") returned 5
	[0049.643] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.aes") returned 0
	[0049.643] lstrlenA (lpString="*.aes") returned 5
	[0049.643] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.blob") returned 0
	[0049.643] lstrlenA (lpString="*.blob") returned 6
	[0049.643] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.btc") returned 0
	[0049.643] lstrlenA (lpString="*.btc") returned 5
	[0049.643] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.wallet") returned 0
	[0049.643] lstrlenA (lpString="*.wallet") returned 8
	[0049.643] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1
	[0049.643] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0049.644] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SetupUi.xsd") returned -1
	[0049.644] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SetupUi.xsd") returned -1
	[0049.644] lstrcmpiA (lpString1="", lpString2="SetupUi.xsd") returned -1
	[0049.644] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\SetupUi.dll") returned="SetupUi.dll"
	[0049.644] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0049.644] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned=""
	[0049.644] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.644] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\how-to-decrypt-files.htm")) returned 0x20
	[0049.644] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="SetupUi.xsd" | out: lpString1="C:\\588bce7c90097ed212\\SetupUi.xsd") returned="C:\\588bce7c90097ed212\\SetupUi.xsd"
	[0049.644] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.zip") returned 0
	[0049.644] lstrlenA (lpString="*.zip") returned 5
	[0049.644] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.rar") returned 0
	[0049.644] lstrlenA (lpString="*.rar") returned 5
	[0049.644] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.7z") returned 0
	[0049.644] lstrlenA (lpString="*.7z") returned 4
	[0049.644] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.tar") returned 0
	[0049.644] lstrlenA (lpString="*.tar") returned 5
	[0049.644] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.gzip") returned 0
	[0049.644] lstrlenA (lpString="*.gzip") returned 6
	[0049.644] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.jpg") returned 0
	[0049.644] lstrlenA (lpString="*.jpg") returned 5
	[0049.644] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.jpeg") returned 0
	[0049.644] lstrlenA (lpString="*.jpeg") returned 6
	[0049.644] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.bmp") returned 0
	[0049.644] lstrlenA (lpString="*.bmp") returned 5
	[0049.644] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.gif") returned 0
	[0049.644] lstrlenA (lpString="*.gif") returned 5
	[0049.644] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.png") returned 0
	[0049.644] lstrlenA (lpString="*.png") returned 5
	[0049.644] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.doc") returned 0
	[0049.645] lstrlenA (lpString="*.doc") returned 5
	[0049.645] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.docx") returned 0
	[0049.645] lstrlenA (lpString="*.docx") returned 6
	[0049.645] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.xls") returned 0
	[0049.645] lstrlenA (lpString="*.xls") returned 5
	[0049.645] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.xlsx") returned 0
	[0049.645] lstrlenA (lpString="*.xlsx") returned 6
	[0049.645] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.ppt") returned 0
	[0049.645] lstrlenA (lpString="*.ppt") returned 5
	[0049.645] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.pptx") returned 0
	[0049.645] lstrlenA (lpString="*.pptx") returned 6
	[0049.645] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.txt") returned 0
	[0049.645] lstrlenA (lpString="*.txt") returned 5
	[0049.645] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.pdf") returned 0
	[0049.645] lstrlenA (lpString="*.pdf") returned 5
	[0049.645] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.htm") returned 0
	[0049.645] lstrlenA (lpString="*.htm") returned 5
	[0049.645] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.html") returned 0
	[0049.645] lstrlenA (lpString="*.html") returned 6
	[0049.645] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.mdb") returned 0
	[0049.645] lstrlenA (lpString="*.mdb") returned 5
	[0049.645] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.pfx") returned 0
	[0049.645] lstrlenA (lpString="*.pfx") returned 5
	[0049.645] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.md") returned 0
	[0049.645] lstrlenA (lpString="*.md") returned 4
	[0049.645] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.lnk") returned 0
	[0049.645] lstrlenA (lpString="*.lnk") returned 5
	[0049.645] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.torrent") returned 0
	[0049.645] lstrlenA (lpString="*.torrent") returned 9
	[0049.645] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.mov") returned 0
	[0049.645] lstrlenA (lpString="*.mov") returned 5
	[0049.645] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.3gp") returned 0
	[0049.645] lstrlenA (lpString="*.3gp") returned 5
	[0049.645] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.mpeg") returned 0
	[0049.645] lstrlenA (lpString="*.mpeg") returned 6
	[0049.645] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.mpg") returned 0
	[0049.646] lstrlenA (lpString="*.mpg") returned 5
	[0049.646] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.flv") returned 0
	[0049.646] lstrlenA (lpString="*.flv") returned 5
	[0049.646] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.avi") returned 0
	[0049.646] lstrlenA (lpString="*.avi") returned 5
	[0049.646] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.mp4") returned 0
	[0049.646] lstrlenA (lpString="*.mp4") returned 5
	[0049.646] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.wmv") returned 0
	[0049.646] lstrlenA (lpString="*.wmv") returned 5
	[0049.646] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.mkv") returned 0
	[0049.646] lstrlenA (lpString="*.mkv") returned 5
	[0049.646] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.mp3") returned 0
	[0049.647] lstrlenA (lpString="*.mp3") returned 5
	[0049.647] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.wav") returned 0
	[0049.647] lstrlenA (lpString="*.wav") returned 5
	[0049.647] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.flac") returned 0
	[0049.647] lstrlenA (lpString="*.flac") returned 6
	[0049.647] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.wma") returned 0
	[0049.647] lstrlenA (lpString="*.wma") returned 5
	[0049.647] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.au3") returned 0
	[0049.647] lstrlenA (lpString="*.au3") returned 5
	[0049.647] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.ahk") returned 0
	[0049.647] lstrlenA (lpString="*.ahk") returned 5
	[0049.647] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.c") returned 0
	[0049.647] lstrlenA (lpString="*.c") returned 3
	[0049.647] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.cc") returned 0
	[0049.647] lstrlenA (lpString="*.cc") returned 4
	[0049.647] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.cpp") returned 0
	[0049.647] lstrlenA (lpString="*.cpp") returned 5
	[0049.647] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.cxx") returned 0
	[0049.647] lstrlenA (lpString="*.cxx") returned 5
	[0049.647] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.c++") returned 0
	[0049.647] lstrlenA (lpString="*.c++") returned 5
	[0049.647] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.cs") returned 0
	[0049.647] lstrlenA (lpString="*.cs") returned 4
	[0049.647] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.vb") returned 0
	[0049.647] lstrlenA (lpString="*.vb") returned 4
	[0049.647] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.bas") returned 0
	[0049.647] lstrlenA (lpString="*.bas") returned 5
	[0049.647] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.csproj") returned 0
	[0049.647] lstrlenA (lpString="*.csproj") returned 8
	[0049.647] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.vbproj") returned 0
	[0049.647] lstrlenA (lpString="*.vbproj") returned 8
	[0049.647] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.vcxproj") returned 0
	[0049.647] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.647] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.manifest") returned 0
	[0049.647] lstrlenA (lpString="*.manifest") returned 10
	[0049.648] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.php") returned 0
	[0049.648] lstrlenA (lpString="*.php") returned 5
	[0049.648] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.vbe") returned 0
	[0049.648] lstrlenA (lpString="*.vbe") returned 5
	[0049.648] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.vba") returned 0
	[0049.648] lstrlenA (lpString="*.vba") returned 5
	[0049.648] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.vbs") returned 0
	[0049.648] lstrlenA (lpString="*.vbs") returned 5
	[0049.648] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.bat") returned 0
	[0049.648] lstrlenA (lpString="*.bat") returned 5
	[0049.648] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.cmd") returned 0
	[0049.648] lstrlenA (lpString="*.cmd") returned 5
	[0049.648] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.js") returned 0
	[0049.648] lstrlenA (lpString="*.js") returned 4
	[0049.648] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.jscript") returned 0
	[0049.648] lstrlenA (lpString="*.jscript") returned 9
	[0049.648] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.hta") returned 0
	[0049.648] lstrlenA (lpString="*.hta") returned 5
	[0049.648] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.php7") returned 0
	[0049.648] lstrlenA (lpString="*.php7") returned 6
	[0049.648] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.db") returned 0
	[0049.648] lstrlenA (lpString="*.db") returned 4
	[0049.648] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.swf") returned 0
	[0049.648] lstrlenA (lpString="*.swf") returned 5
	[0049.648] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.eml") returned 0
	[0049.648] lstrlenA (lpString="*.eml") returned 5
	[0049.648] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.part") returned 0
	[0049.648] lstrlenA (lpString="*.part") returned 6
	[0049.648] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.nfo") returned 0
	[0049.648] lstrlenA (lpString="*.nfo") returned 5
	[0049.648] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.rsa") returned 0
	[0049.648] lstrlenA (lpString="*.rsa") returned 5
	[0049.648] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.key") returned 0
	[0049.648] lstrlenA (lpString="*.key") returned 5
	[0049.648] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.aes") returned 0
	[0049.648] lstrlenA (lpString="*.aes") returned 5
	[0049.649] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.blob") returned 0
	[0049.649] lstrlenA (lpString="*.blob") returned 6
	[0049.649] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.btc") returned 0
	[0049.649] lstrlenA (lpString="*.btc") returned 5
	[0049.649] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.wallet") returned 0
	[0049.649] lstrlenA (lpString="*.wallet") returned 8
	[0049.649] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1
	[0049.649] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0049.649] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SetupUtility.exe") returned -1
	[0049.649] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SetupUtility.exe") returned -1
	[0049.649] lstrcmpiA (lpString1="", lpString2="SetupUtility.exe") returned -1
	[0049.649] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\SetupUi.xsd") returned="SetupUi.xsd"
	[0049.649] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0049.649] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned=""
	[0049.649] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.649] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\how-to-decrypt-files.htm")) returned 0x20
	[0049.649] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="SetupUtility.exe" | out: lpString1="C:\\588bce7c90097ed212\\SetupUtility.exe") returned="C:\\588bce7c90097ed212\\SetupUtility.exe"
	[0049.649] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.zip") returned 0
	[0049.649] lstrlenA (lpString="*.zip") returned 5
	[0049.649] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.rar") returned 0
	[0049.649] lstrlenA (lpString="*.rar") returned 5
	[0049.649] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.7z") returned 0
	[0049.649] lstrlenA (lpString="*.7z") returned 4
	[0049.649] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.tar") returned 0
	[0049.649] lstrlenA (lpString="*.tar") returned 5
	[0049.649] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.gzip") returned 0
	[0049.649] lstrlenA (lpString="*.gzip") returned 6
	[0049.649] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.jpg") returned 0
	[0049.649] lstrlenA (lpString="*.jpg") returned 5
	[0049.649] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.jpeg") returned 0
	[0049.650] lstrlenA (lpString="*.jpeg") returned 6
	[0049.650] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.bmp") returned 0
	[0049.650] lstrlenA (lpString="*.bmp") returned 5
	[0049.650] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.gif") returned 0
	[0049.650] lstrlenA (lpString="*.gif") returned 5
	[0049.650] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.png") returned 0
	[0049.650] lstrlenA (lpString="*.png") returned 5
	[0049.650] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.doc") returned 0
	[0049.650] lstrlenA (lpString="*.doc") returned 5
	[0049.650] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.docx") returned 0
	[0049.650] lstrlenA (lpString="*.docx") returned 6
	[0049.650] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.xls") returned 0
	[0049.650] lstrlenA (lpString="*.xls") returned 5
	[0049.650] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.xlsx") returned 0
	[0049.650] lstrlenA (lpString="*.xlsx") returned 6
	[0049.650] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.ppt") returned 0
	[0049.650] lstrlenA (lpString="*.ppt") returned 5
	[0049.650] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.pptx") returned 0
	[0049.650] lstrlenA (lpString="*.pptx") returned 6
	[0049.650] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.txt") returned 0
	[0049.650] lstrlenA (lpString="*.txt") returned 5
	[0049.650] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.pdf") returned 0
	[0049.650] lstrlenA (lpString="*.pdf") returned 5
	[0049.650] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.htm") returned 0
	[0049.650] lstrlenA (lpString="*.htm") returned 5
	[0049.650] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.html") returned 0
	[0049.650] lstrlenA (lpString="*.html") returned 6
	[0049.650] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.mdb") returned 0
	[0049.650] lstrlenA (lpString="*.mdb") returned 5
	[0049.650] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.pfx") returned 0
	[0049.650] lstrlenA (lpString="*.pfx") returned 5
	[0049.650] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.md") returned 0
	[0049.650] lstrlenA (lpString="*.md") returned 4
	[0049.650] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.lnk") returned 0
	[0049.650] lstrlenA (lpString="*.lnk") returned 5
	[0049.650] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.torrent") returned 0
	[0049.651] lstrlenA (lpString="*.torrent") returned 9
	[0049.651] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.mov") returned 0
	[0049.651] lstrlenA (lpString="*.mov") returned 5
	[0049.651] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.3gp") returned 0
	[0049.651] lstrlenA (lpString="*.3gp") returned 5
	[0049.651] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.mpeg") returned 0
	[0049.651] lstrlenA (lpString="*.mpeg") returned 6
	[0049.651] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.mpg") returned 0
	[0049.651] lstrlenA (lpString="*.mpg") returned 5
	[0049.651] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.flv") returned 0
	[0049.651] lstrlenA (lpString="*.flv") returned 5
	[0049.651] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.avi") returned 0
	[0049.651] lstrlenA (lpString="*.avi") returned 5
	[0049.651] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.mp4") returned 0
	[0049.651] lstrlenA (lpString="*.mp4") returned 5
	[0049.651] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.wmv") returned 0
	[0049.651] lstrlenA (lpString="*.wmv") returned 5
	[0049.651] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.mkv") returned 0
	[0049.651] lstrlenA (lpString="*.mkv") returned 5
	[0049.651] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.mp3") returned 0
	[0049.651] lstrlenA (lpString="*.mp3") returned 5
	[0049.651] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.wav") returned 0
	[0049.651] lstrlenA (lpString="*.wav") returned 5
	[0049.651] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.flac") returned 0
	[0049.651] lstrlenA (lpString="*.flac") returned 6
	[0049.651] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.wma") returned 0
	[0049.651] lstrlenA (lpString="*.wma") returned 5
	[0049.651] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.au3") returned 0
	[0049.651] lstrlenA (lpString="*.au3") returned 5
	[0049.651] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.ahk") returned 0
	[0049.651] lstrlenA (lpString="*.ahk") returned 5
	[0049.651] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.c") returned 0
	[0049.651] lstrlenA (lpString="*.c") returned 3
	[0049.651] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.cc") returned 0
	[0049.651] lstrlenA (lpString="*.cc") returned 4
	[0049.651] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.cpp") returned 0
	[0049.652] lstrlenA (lpString="*.cpp") returned 5
	[0049.652] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.cxx") returned 0
	[0049.652] lstrlenA (lpString="*.cxx") returned 5
	[0049.652] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.c++") returned 0
	[0049.652] lstrlenA (lpString="*.c++") returned 5
	[0049.652] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.cs") returned 0
	[0049.652] lstrlenA (lpString="*.cs") returned 4
	[0049.652] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.vb") returned 0
	[0049.652] lstrlenA (lpString="*.vb") returned 4
	[0049.652] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.bas") returned 0
	[0049.652] lstrlenA (lpString="*.bas") returned 5
	[0049.652] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.csproj") returned 0
	[0049.652] lstrlenA (lpString="*.csproj") returned 8
	[0049.652] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.vbproj") returned 0
	[0049.652] lstrlenA (lpString="*.vbproj") returned 8
	[0049.652] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.vcxproj") returned 0
	[0049.652] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.652] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.manifest") returned 0
	[0049.652] lstrlenA (lpString="*.manifest") returned 10
	[0049.652] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.php") returned 0
	[0049.652] lstrlenA (lpString="*.php") returned 5
	[0049.652] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.vbe") returned 0
	[0049.652] lstrlenA (lpString="*.vbe") returned 5
	[0049.652] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.vba") returned 0
	[0049.652] lstrlenA (lpString="*.vba") returned 5
	[0049.652] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.vbs") returned 0
	[0049.652] lstrlenA (lpString="*.vbs") returned 5
	[0049.652] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.bat") returned 0
	[0049.652] lstrlenA (lpString="*.bat") returned 5
	[0049.652] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.cmd") returned 0
	[0049.652] lstrlenA (lpString="*.cmd") returned 5
	[0049.652] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.js") returned 0
	[0049.652] lstrlenA (lpString="*.js") returned 4
	[0049.652] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.jscript") returned 0
	[0049.652] lstrlenA (lpString="*.jscript") returned 9
	[0049.652] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.hta") returned 0
	[0049.653] lstrlenA (lpString="*.hta") returned 5
	[0049.653] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.php7") returned 0
	[0049.653] lstrlenA (lpString="*.php7") returned 6
	[0049.653] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.db") returned 0
	[0049.653] lstrlenA (lpString="*.db") returned 4
	[0049.653] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.swf") returned 0
	[0049.653] lstrlenA (lpString="*.swf") returned 5
	[0049.653] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.eml") returned 0
	[0049.653] lstrlenA (lpString="*.eml") returned 5
	[0049.653] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.part") returned 0
	[0049.653] lstrlenA (lpString="*.part") returned 6
	[0049.653] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.nfo") returned 0
	[0049.653] lstrlenA (lpString="*.nfo") returned 5
	[0049.653] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.rsa") returned 0
	[0049.653] lstrlenA (lpString="*.rsa") returned 5
	[0049.653] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.key") returned 0
	[0049.653] lstrlenA (lpString="*.key") returned 5
	[0049.653] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.aes") returned 0
	[0049.653] lstrlenA (lpString="*.aes") returned 5
	[0049.653] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.blob") returned 0
	[0049.653] lstrlenA (lpString="*.blob") returned 6
	[0049.653] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.btc") returned 0
	[0049.653] lstrlenA (lpString="*.btc") returned 5
	[0049.653] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.wallet") returned 0
	[0049.653] lstrlenA (lpString="*.wallet") returned 8
	[0049.653] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x0, dwReserved1=0x0, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1
	[0049.653] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0049.653] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SplashScreen.bmp") returned -1
	[0049.653] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SplashScreen.bmp") returned -1
	[0049.653] lstrcmpiA (lpString1="", lpString2="SplashScreen.bmp") returned -1
	[0049.653] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\SetupUtility.exe") returned="SetupUtility.exe"
	[0049.653] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0049.653] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned=""
	[0049.653] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.654] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\how-to-decrypt-files.htm")) returned 0x20
	[0049.654] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="SplashScreen.bmp" | out: lpString1="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned="C:\\588bce7c90097ed212\\SplashScreen.bmp"
	[0049.654] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SplashScreen.bmp", pszSpec="*.zip") returned 0
	[0049.654] lstrlenA (lpString="*.zip") returned 5
	[0049.654] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SplashScreen.bmp", pszSpec="*.rar") returned 0
	[0049.654] lstrlenA (lpString="*.rar") returned 5
	[0049.654] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SplashScreen.bmp", pszSpec="*.7z") returned 0
	[0049.654] lstrlenA (lpString="*.7z") returned 4
	[0049.654] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SplashScreen.bmp", pszSpec="*.tar") returned 0
	[0049.654] lstrlenA (lpString="*.tar") returned 5
	[0049.654] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SplashScreen.bmp", pszSpec="*.gzip") returned 0
	[0049.654] lstrlenA (lpString="*.gzip") returned 6
	[0049.654] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SplashScreen.bmp", pszSpec="*.jpg") returned 0
	[0049.654] lstrlenA (lpString="*.jpg") returned 5
	[0049.654] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SplashScreen.bmp", pszSpec="*.jpeg") returned 0
	[0049.654] lstrlenA (lpString="*.jpeg") returned 6
	[0049.654] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SplashScreen.bmp", pszSpec="*.bmp") returned 1
	[0049.654] lstrlenA (lpString="*.bmp") returned 5
	[0049.654] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\588bce7c90097ed212\\SplashScreen.bmp" | out: lpString1="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned="C:\\588bce7c90097ed212\\SplashScreen.bmp"
	[0049.654] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\588bce7c90097ed212\\SplashScreen.bmp" | out: lpString1="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned="C:\\588bce7c90097ed212\\SplashScreen.bmp"
	[0049.654] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\SplashScreen.bmp", lpString2="." | out: lpString1="C:\\588bce7c90097ed212\\SplashScreen.bmp.") returned="C:\\588bce7c90097ed212\\SplashScreen.bmp."
	[0049.654] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\SplashScreen.bmp.", lpString2="exe" | out: lpString1="C:\\588bce7c90097ed212\\SplashScreen.bmp.exe") returned="C:\\588bce7c90097ed212\\SplashScreen.bmp.exe"
	[0049.654] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0049.654] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa078
	[0049.655] GetFileTime (in: hFile=0x204, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xce333000, dwHighDateTime=0x1ca2a28), lpLastAccessTime=0x407536*(dwLowDateTime=0xce333000, dwHighDateTime=0x1ca2a28), lpLastWriteTime=0x40753e*(dwLowDateTime=0xce333000, dwHighDateTime=0x1ca2a28)) returned 1
	[0049.655] SetFilePointer (in: hFile=0x204, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0049.655] ReadFile (in: hFile=0x204, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xa036, lpOverlapped=0x0) returned 1
	[0049.657] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned="SplashScreen.bmp"
	[0049.657] SetFilePointer (in: hFile=0x204, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0049.657] WriteFile (in: hFile=0x204, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xa036, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xa036, lpOverlapped=0x0) returned 1
	[0049.657] SetFileTime (hFile=0x204, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.657] CloseHandle (hObject=0x204) returned 1
	[0049.659] MoveFileA (lpExistingFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), lpNewFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.exe" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.exe")) returned 1
	[0049.659] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x15, dwReserved1=0x1, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1
	[0049.659] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0049.659] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="sqmapi.dll") returned -1
	[0049.659] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="sqmapi.dll") returned -1
	[0049.659] lstrcmpiA (lpString1="", lpString2="sqmapi.dll") returned -1
	[0049.660] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned="SplashScreen.bmp"
	[0049.660] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0049.660] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned=""
	[0049.660] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.660] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\how-to-decrypt-files.htm")) returned 0x20
	[0049.660] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="sqmapi.dll" | out: lpString1="C:\\588bce7c90097ed212\\sqmapi.dll") returned="C:\\588bce7c90097ed212\\sqmapi.dll"
	[0049.660] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.zip") returned 0
	[0049.660] lstrlenA (lpString="*.zip") returned 5
	[0049.660] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.rar") returned 0
	[0049.660] lstrlenA (lpString="*.rar") returned 5
	[0049.660] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.7z") returned 0
	[0049.660] lstrlenA (lpString="*.7z") returned 4
	[0049.660] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.tar") returned 0
	[0049.660] lstrlenA (lpString="*.tar") returned 5
	[0049.660] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.gzip") returned 0
	[0049.660] lstrlenA (lpString="*.gzip") returned 6
	[0049.660] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.jpg") returned 0
	[0049.660] lstrlenA (lpString="*.jpg") returned 5
	[0049.660] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.jpeg") returned 0
	[0049.660] lstrlenA (lpString="*.jpeg") returned 6
	[0049.660] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.bmp") returned 0
	[0049.660] lstrlenA (lpString="*.bmp") returned 5
	[0049.660] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.gif") returned 0
	[0049.660] lstrlenA (lpString="*.gif") returned 5
	[0049.660] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.png") returned 0
	[0049.660] lstrlenA (lpString="*.png") returned 5
	[0049.660] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.doc") returned 0
	[0049.660] lstrlenA (lpString="*.doc") returned 5
	[0049.660] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.docx") returned 0
	[0049.660] lstrlenA (lpString="*.docx") returned 6
	[0049.660] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.xls") returned 0
	[0049.660] lstrlenA (lpString="*.xls") returned 5
	[0049.660] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.xlsx") returned 0
	[0049.661] lstrlenA (lpString="*.xlsx") returned 6
	[0049.661] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.ppt") returned 0
	[0049.661] lstrlenA (lpString="*.ppt") returned 5
	[0049.661] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.pptx") returned 0
	[0049.661] lstrlenA (lpString="*.pptx") returned 6
	[0049.661] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.txt") returned 0
	[0049.661] lstrlenA (lpString="*.txt") returned 5
	[0049.661] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.pdf") returned 0
	[0049.661] lstrlenA (lpString="*.pdf") returned 5
	[0049.661] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.htm") returned 0
	[0049.661] lstrlenA (lpString="*.htm") returned 5
	[0049.661] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.html") returned 0
	[0049.661] lstrlenA (lpString="*.html") returned 6
	[0049.661] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.mdb") returned 0
	[0049.661] lstrlenA (lpString="*.mdb") returned 5
	[0049.661] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.pfx") returned 0
	[0049.661] lstrlenA (lpString="*.pfx") returned 5
	[0049.661] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.md") returned 0
	[0049.661] lstrlenA (lpString="*.md") returned 4
	[0049.661] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.lnk") returned 0
	[0049.661] lstrlenA (lpString="*.lnk") returned 5
	[0049.661] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.torrent") returned 0
	[0049.661] lstrlenA (lpString="*.torrent") returned 9
	[0049.661] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.mov") returned 0
	[0049.661] lstrlenA (lpString="*.mov") returned 5
	[0049.661] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.3gp") returned 0
	[0049.661] lstrlenA (lpString="*.3gp") returned 5
	[0049.661] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.mpeg") returned 0
	[0049.661] lstrlenA (lpString="*.mpeg") returned 6
	[0049.661] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.mpg") returned 0
	[0049.661] lstrlenA (lpString="*.mpg") returned 5
	[0049.662] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.flv") returned 0
	[0049.662] lstrlenA (lpString="*.flv") returned 5
	[0049.662] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.avi") returned 0
	[0049.662] lstrlenA (lpString="*.avi") returned 5
	[0049.662] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.mp4") returned 0
	[0049.662] lstrlenA (lpString="*.mp4") returned 5
	[0049.662] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.wmv") returned 0
	[0049.662] lstrlenA (lpString="*.wmv") returned 5
	[0049.662] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.mkv") returned 0
	[0049.662] lstrlenA (lpString="*.mkv") returned 5
	[0049.662] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.mp3") returned 0
	[0049.662] lstrlenA (lpString="*.mp3") returned 5
	[0049.662] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.wav") returned 0
	[0049.662] lstrlenA (lpString="*.wav") returned 5
	[0049.662] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.flac") returned 0
	[0049.662] lstrlenA (lpString="*.flac") returned 6
	[0049.662] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.wma") returned 0
	[0049.662] lstrlenA (lpString="*.wma") returned 5
	[0049.662] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.au3") returned 0
	[0049.662] lstrlenA (lpString="*.au3") returned 5
	[0049.662] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.ahk") returned 0
	[0049.662] lstrlenA (lpString="*.ahk") returned 5
	[0049.662] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.c") returned 0
	[0049.662] lstrlenA (lpString="*.c") returned 3
	[0049.662] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.cc") returned 0
	[0049.662] lstrlenA (lpString="*.cc") returned 4
	[0049.662] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.cpp") returned 0
	[0049.662] lstrlenA (lpString="*.cpp") returned 5
	[0049.662] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.cxx") returned 0
	[0049.662] lstrlenA (lpString="*.cxx") returned 5
	[0049.663] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.c++") returned 0
	[0049.663] lstrlenA (lpString="*.c++") returned 5
	[0049.663] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.cs") returned 0
	[0049.663] lstrlenA (lpString="*.cs") returned 4
	[0049.663] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.vb") returned 0
	[0049.663] lstrlenA (lpString="*.vb") returned 4
	[0049.663] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.bas") returned 0
	[0049.663] lstrlenA (lpString="*.bas") returned 5
	[0049.663] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.csproj") returned 0
	[0049.663] lstrlenA (lpString="*.csproj") returned 8
	[0049.663] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.vbproj") returned 0
	[0049.663] lstrlenA (lpString="*.vbproj") returned 8
	[0049.663] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.vcxproj") returned 0
	[0049.663] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.663] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.manifest") returned 0
	[0049.663] lstrlenA (lpString="*.manifest") returned 10
	[0049.663] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.php") returned 0
	[0049.663] lstrlenA (lpString="*.php") returned 5
	[0049.663] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.vbe") returned 0
	[0049.663] lstrlenA (lpString="*.vbe") returned 5
	[0049.663] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.vba") returned 0
	[0049.663] lstrlenA (lpString="*.vba") returned 5
	[0049.663] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.vbs") returned 0
	[0049.663] lstrlenA (lpString="*.vbs") returned 5
	[0049.663] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.bat") returned 0
	[0049.663] lstrlenA (lpString="*.bat") returned 5
	[0049.663] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.cmd") returned 0
	[0049.663] lstrlenA (lpString="*.cmd") returned 5
	[0049.663] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.js") returned 0
	[0049.663] lstrlenA (lpString="*.js") returned 4
	[0049.663] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.jscript") returned 0
	[0049.663] lstrlenA (lpString="*.jscript") returned 9
	[0049.663] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.hta") returned 0
	[0049.663] lstrlenA (lpString="*.hta") returned 5
	[0049.663] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.php7") returned 0
	[0049.664] lstrlenA (lpString="*.php7") returned 6
	[0049.664] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.db") returned 0
	[0049.664] lstrlenA (lpString="*.db") returned 4
	[0049.664] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.swf") returned 0
	[0049.664] lstrlenA (lpString="*.swf") returned 5
	[0049.664] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.eml") returned 0
	[0049.664] lstrlenA (lpString="*.eml") returned 5
	[0049.664] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.part") returned 0
	[0049.664] lstrlenA (lpString="*.part") returned 6
	[0049.664] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.nfo") returned 0
	[0049.664] lstrlenA (lpString="*.nfo") returned 5
	[0049.664] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.rsa") returned 0
	[0049.664] lstrlenA (lpString="*.rsa") returned 5
	[0049.664] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.key") returned 0
	[0049.664] lstrlenA (lpString="*.key") returned 5
	[0049.664] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.aes") returned 0
	[0049.664] lstrlenA (lpString="*.aes") returned 5
	[0049.664] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.blob") returned 0
	[0049.664] lstrlenA (lpString="*.blob") returned 6
	[0049.664] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.btc") returned 0
	[0049.664] lstrlenA (lpString="*.btc") returned 5
	[0049.664] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.wallet") returned 0
	[0049.664] lstrlenA (lpString="*.wallet") returned 8
	[0049.664] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0x0, dwReserved1=0x0, cFileName="Strings.xml", cAlternateFileName="")) returned 1
	[0049.664] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0049.664] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Strings.xml") returned -1
	[0049.664] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Strings.xml") returned -1
	[0049.664] lstrcmpiA (lpString1="", lpString2="Strings.xml") returned -1
	[0049.664] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\sqmapi.dll") returned="sqmapi.dll"
	[0049.664] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0049.664] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned=""
	[0049.664] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.664] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\how-to-decrypt-files.htm")) returned 0x20
	[0049.665] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="Strings.xml" | out: lpString1="C:\\588bce7c90097ed212\\Strings.xml") returned="C:\\588bce7c90097ed212\\Strings.xml"
	[0049.665] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.zip") returned 0
	[0049.665] lstrlenA (lpString="*.zip") returned 5
	[0049.665] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.rar") returned 0
	[0049.665] lstrlenA (lpString="*.rar") returned 5
	[0049.665] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.7z") returned 0
	[0049.665] lstrlenA (lpString="*.7z") returned 4
	[0049.665] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.tar") returned 0
	[0049.665] lstrlenA (lpString="*.tar") returned 5
	[0049.665] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.gzip") returned 0
	[0049.665] lstrlenA (lpString="*.gzip") returned 6
	[0049.665] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.jpg") returned 0
	[0049.665] lstrlenA (lpString="*.jpg") returned 5
	[0049.665] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.jpeg") returned 0
	[0049.665] lstrlenA (lpString="*.jpeg") returned 6
	[0049.665] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.bmp") returned 0
	[0049.665] lstrlenA (lpString="*.bmp") returned 5
	[0049.665] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.gif") returned 0
	[0049.665] lstrlenA (lpString="*.gif") returned 5
	[0049.665] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.png") returned 0
	[0049.665] lstrlenA (lpString="*.png") returned 5
	[0049.665] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.doc") returned 0
	[0049.665] lstrlenA (lpString="*.doc") returned 5
	[0049.665] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.docx") returned 0
	[0049.665] lstrlenA (lpString="*.docx") returned 6
	[0049.665] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.xls") returned 0
	[0049.665] lstrlenA (lpString="*.xls") returned 5
	[0049.665] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.xlsx") returned 0
	[0049.665] lstrlenA (lpString="*.xlsx") returned 6
	[0049.665] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.ppt") returned 0
	[0049.665] lstrlenA (lpString="*.ppt") returned 5
	[0049.665] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.pptx") returned 0
	[0049.665] lstrlenA (lpString="*.pptx") returned 6
	[0049.665] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.txt") returned 0
	[0049.665] lstrlenA (lpString="*.txt") returned 5
	[0049.666] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.pdf") returned 0
	[0049.666] lstrlenA (lpString="*.pdf") returned 5
	[0049.666] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.htm") returned 0
	[0049.666] lstrlenA (lpString="*.htm") returned 5
	[0049.666] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.html") returned 0
	[0049.666] lstrlenA (lpString="*.html") returned 6
	[0049.666] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.mdb") returned 0
	[0049.666] lstrlenA (lpString="*.mdb") returned 5
	[0049.666] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.pfx") returned 0
	[0049.666] lstrlenA (lpString="*.pfx") returned 5
	[0049.666] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.md") returned 0
	[0049.666] lstrlenA (lpString="*.md") returned 4
	[0049.666] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.lnk") returned 0
	[0049.666] lstrlenA (lpString="*.lnk") returned 5
	[0049.666] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.torrent") returned 0
	[0049.666] lstrlenA (lpString="*.torrent") returned 9
	[0049.666] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.mov") returned 0
	[0049.666] lstrlenA (lpString="*.mov") returned 5
	[0049.666] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.3gp") returned 0
	[0049.666] lstrlenA (lpString="*.3gp") returned 5
	[0049.666] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.mpeg") returned 0
	[0049.666] lstrlenA (lpString="*.mpeg") returned 6
	[0049.666] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.mpg") returned 0
	[0049.666] lstrlenA (lpString="*.mpg") returned 5
	[0049.666] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.flv") returned 0
	[0049.666] lstrlenA (lpString="*.flv") returned 5
	[0049.666] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.avi") returned 0
	[0049.666] lstrlenA (lpString="*.avi") returned 5
	[0049.666] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.mp4") returned 0
	[0049.666] lstrlenA (lpString="*.mp4") returned 5
	[0049.666] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.wmv") returned 0
	[0049.666] lstrlenA (lpString="*.wmv") returned 5
	[0049.666] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.mkv") returned 0
	[0049.666] lstrlenA (lpString="*.mkv") returned 5
	[0049.666] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.mp3") returned 0
	[0049.667] lstrlenA (lpString="*.mp3") returned 5
	[0049.667] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.wav") returned 0
	[0049.667] lstrlenA (lpString="*.wav") returned 5
	[0049.667] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.flac") returned 0
	[0049.667] lstrlenA (lpString="*.flac") returned 6
	[0049.667] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.wma") returned 0
	[0049.667] lstrlenA (lpString="*.wma") returned 5
	[0049.667] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.au3") returned 0
	[0049.667] lstrlenA (lpString="*.au3") returned 5
	[0049.667] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.ahk") returned 0
	[0049.667] lstrlenA (lpString="*.ahk") returned 5
	[0049.667] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.c") returned 0
	[0049.667] lstrlenA (lpString="*.c") returned 3
	[0049.667] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.cc") returned 0
	[0049.667] lstrlenA (lpString="*.cc") returned 4
	[0049.667] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.cpp") returned 0
	[0049.667] lstrlenA (lpString="*.cpp") returned 5
	[0049.667] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.cxx") returned 0
	[0049.667] lstrlenA (lpString="*.cxx") returned 5
	[0049.667] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.c++") returned 0
	[0049.667] lstrlenA (lpString="*.c++") returned 5
	[0049.667] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.cs") returned 0
	[0049.667] lstrlenA (lpString="*.cs") returned 4
	[0049.667] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.vb") returned 0
	[0049.667] lstrlenA (lpString="*.vb") returned 4
	[0049.667] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.bas") returned 0
	[0049.667] lstrlenA (lpString="*.bas") returned 5
	[0049.667] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.csproj") returned 0
	[0049.667] lstrlenA (lpString="*.csproj") returned 8
	[0049.667] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.vbproj") returned 0
	[0049.667] lstrlenA (lpString="*.vbproj") returned 8
	[0049.667] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.vcxproj") returned 0
	[0049.667] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.667] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.manifest") returned 0
	[0049.667] lstrlenA (lpString="*.manifest") returned 10
	[0049.668] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.php") returned 0
	[0049.668] lstrlenA (lpString="*.php") returned 5
	[0049.668] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.vbe") returned 0
	[0049.668] lstrlenA (lpString="*.vbe") returned 5
	[0049.668] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.vba") returned 0
	[0049.668] lstrlenA (lpString="*.vba") returned 5
	[0049.668] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.vbs") returned 0
	[0049.668] lstrlenA (lpString="*.vbs") returned 5
	[0049.668] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.bat") returned 0
	[0049.668] lstrlenA (lpString="*.bat") returned 5
	[0049.668] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.cmd") returned 0
	[0049.668] lstrlenA (lpString="*.cmd") returned 5
	[0049.668] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.js") returned 0
	[0049.668] lstrlenA (lpString="*.js") returned 4
	[0049.668] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.jscript") returned 0
	[0049.668] lstrlenA (lpString="*.jscript") returned 9
	[0049.668] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.hta") returned 0
	[0049.668] lstrlenA (lpString="*.hta") returned 5
	[0049.668] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.php7") returned 0
	[0049.668] lstrlenA (lpString="*.php7") returned 6
	[0049.668] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.db") returned 0
	[0049.668] lstrlenA (lpString="*.db") returned 4
	[0049.668] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.swf") returned 0
	[0049.668] lstrlenA (lpString="*.swf") returned 5
	[0049.668] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.eml") returned 0
	[0049.668] lstrlenA (lpString="*.eml") returned 5
	[0049.668] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.part") returned 0
	[0049.668] lstrlenA (lpString="*.part") returned 6
	[0049.668] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.nfo") returned 0
	[0049.668] lstrlenA (lpString="*.nfo") returned 5
	[0049.668] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.rsa") returned 0
	[0049.668] lstrlenA (lpString="*.rsa") returned 5
	[0049.668] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.key") returned 0
	[0049.668] lstrlenA (lpString="*.key") returned 5
	[0049.668] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.aes") returned 0
	[0049.668] lstrlenA (lpString="*.aes") returned 5
	[0049.669] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.blob") returned 0
	[0049.669] lstrlenA (lpString="*.blob") returned 6
	[0049.669] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.btc") returned 0
	[0049.669] lstrlenA (lpString="*.btc") returned 5
	[0049.669] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.wallet") returned 0
	[0049.669] lstrlenA (lpString="*.wallet") returned 8
	[0049.669] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1
	[0049.669] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0049.669] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="UiInfo.xml") returned -1
	[0049.669] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="UiInfo.xml") returned -1
	[0049.669] lstrcmpiA (lpString1="", lpString2="UiInfo.xml") returned -1
	[0049.669] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Strings.xml") returned="Strings.xml"
	[0049.669] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0049.669] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned=""
	[0049.669] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.669] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\how-to-decrypt-files.htm")) returned 0x20
	[0049.669] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="UiInfo.xml" | out: lpString1="C:\\588bce7c90097ed212\\UiInfo.xml") returned="C:\\588bce7c90097ed212\\UiInfo.xml"
	[0049.669] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.zip") returned 0
	[0049.669] lstrlenA (lpString="*.zip") returned 5
	[0049.669] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.rar") returned 0
	[0049.669] lstrlenA (lpString="*.rar") returned 5
	[0049.669] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.7z") returned 0
	[0049.669] lstrlenA (lpString="*.7z") returned 4
	[0049.669] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.tar") returned 0
	[0049.669] lstrlenA (lpString="*.tar") returned 5
	[0049.669] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.gzip") returned 0
	[0049.669] lstrlenA (lpString="*.gzip") returned 6
	[0049.669] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.jpg") returned 0
	[0049.669] lstrlenA (lpString="*.jpg") returned 5
	[0049.669] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.jpeg") returned 0
	[0049.669] lstrlenA (lpString="*.jpeg") returned 6
	[0049.669] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.bmp") returned 0
	[0049.669] lstrlenA (lpString="*.bmp") returned 5
	[0049.670] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.gif") returned 0
	[0049.670] lstrlenA (lpString="*.gif") returned 5
	[0049.670] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.png") returned 0
	[0049.670] lstrlenA (lpString="*.png") returned 5
	[0049.670] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.doc") returned 0
	[0049.670] lstrlenA (lpString="*.doc") returned 5
	[0049.670] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.docx") returned 0
	[0049.670] lstrlenA (lpString="*.docx") returned 6
	[0049.670] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.xls") returned 0
	[0049.670] lstrlenA (lpString="*.xls") returned 5
	[0049.670] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.xlsx") returned 0
	[0049.670] lstrlenA (lpString="*.xlsx") returned 6
	[0049.670] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.ppt") returned 0
	[0049.670] lstrlenA (lpString="*.ppt") returned 5
	[0049.670] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.pptx") returned 0
	[0049.670] lstrlenA (lpString="*.pptx") returned 6
	[0049.670] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.txt") returned 0
	[0049.670] lstrlenA (lpString="*.txt") returned 5
	[0049.670] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.pdf") returned 0
	[0049.670] lstrlenA (lpString="*.pdf") returned 5
	[0049.670] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.htm") returned 0
	[0049.670] lstrlenA (lpString="*.htm") returned 5
	[0049.670] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.html") returned 0
	[0049.670] lstrlenA (lpString="*.html") returned 6
	[0049.670] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.mdb") returned 0
	[0049.670] lstrlenA (lpString="*.mdb") returned 5
	[0049.670] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.pfx") returned 0
	[0049.670] lstrlenA (lpString="*.pfx") returned 5
	[0049.670] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.md") returned 0
	[0049.670] lstrlenA (lpString="*.md") returned 4
	[0049.670] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.lnk") returned 0
	[0049.670] lstrlenA (lpString="*.lnk") returned 5
	[0049.670] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.torrent") returned 0
	[0049.670] lstrlenA (lpString="*.torrent") returned 9
	[0049.670] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.mov") returned 0
	[0049.671] lstrlenA (lpString="*.mov") returned 5
	[0049.671] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.3gp") returned 0
	[0049.671] lstrlenA (lpString="*.3gp") returned 5
	[0049.671] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.mpeg") returned 0
	[0049.671] lstrlenA (lpString="*.mpeg") returned 6
	[0049.671] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.mpg") returned 0
	[0049.671] lstrlenA (lpString="*.mpg") returned 5
	[0049.671] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.flv") returned 0
	[0049.671] lstrlenA (lpString="*.flv") returned 5
	[0049.671] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.avi") returned 0
	[0049.671] lstrlenA (lpString="*.avi") returned 5
	[0049.671] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.mp4") returned 0
	[0049.671] lstrlenA (lpString="*.mp4") returned 5
	[0049.671] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.wmv") returned 0
	[0049.671] lstrlenA (lpString="*.wmv") returned 5
	[0049.671] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.mkv") returned 0
	[0049.671] lstrlenA (lpString="*.mkv") returned 5
	[0049.671] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.mp3") returned 0
	[0049.671] lstrlenA (lpString="*.mp3") returned 5
	[0049.671] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.wav") returned 0
	[0049.671] lstrlenA (lpString="*.wav") returned 5
	[0049.671] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.flac") returned 0
	[0049.671] lstrlenA (lpString="*.flac") returned 6
	[0049.671] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.wma") returned 0
	[0049.671] lstrlenA (lpString="*.wma") returned 5
	[0049.671] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.au3") returned 0
	[0049.671] lstrlenA (lpString="*.au3") returned 5
	[0049.671] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.ahk") returned 0
	[0049.671] lstrlenA (lpString="*.ahk") returned 5
	[0049.671] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.c") returned 0
	[0049.671] lstrlenA (lpString="*.c") returned 3
	[0049.671] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.cc") returned 0
	[0049.671] lstrlenA (lpString="*.cc") returned 4
	[0049.671] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.cpp") returned 0
	[0049.671] lstrlenA (lpString="*.cpp") returned 5
	[0049.671] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.cxx") returned 0
	[0049.672] lstrlenA (lpString="*.cxx") returned 5
	[0049.672] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.c++") returned 0
	[0049.672] lstrlenA (lpString="*.c++") returned 5
	[0049.672] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.cs") returned 0
	[0049.672] lstrlenA (lpString="*.cs") returned 4
	[0049.672] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.vb") returned 0
	[0049.672] lstrlenA (lpString="*.vb") returned 4
	[0049.672] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.bas") returned 0
	[0049.672] lstrlenA (lpString="*.bas") returned 5
	[0049.672] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.csproj") returned 0
	[0049.672] lstrlenA (lpString="*.csproj") returned 8
	[0049.672] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.vbproj") returned 0
	[0049.672] lstrlenA (lpString="*.vbproj") returned 8
	[0049.672] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.vcxproj") returned 0
	[0049.672] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.672] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.manifest") returned 0
	[0049.672] lstrlenA (lpString="*.manifest") returned 10
	[0049.672] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.php") returned 0
	[0049.672] lstrlenA (lpString="*.php") returned 5
	[0049.672] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.vbe") returned 0
	[0049.672] lstrlenA (lpString="*.vbe") returned 5
	[0049.672] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.vba") returned 0
	[0049.672] lstrlenA (lpString="*.vba") returned 5
	[0049.672] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.vbs") returned 0
	[0049.672] lstrlenA (lpString="*.vbs") returned 5
	[0049.672] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.bat") returned 0
	[0049.672] lstrlenA (lpString="*.bat") returned 5
	[0049.672] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.cmd") returned 0
	[0049.672] lstrlenA (lpString="*.cmd") returned 5
	[0049.672] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.js") returned 0
	[0049.672] lstrlenA (lpString="*.js") returned 4
	[0049.672] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.jscript") returned 0
	[0049.672] lstrlenA (lpString="*.jscript") returned 9
	[0049.672] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.hta") returned 0
	[0049.672] lstrlenA (lpString="*.hta") returned 5
	[0049.672] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.php7") returned 0
	[0049.673] lstrlenA (lpString="*.php7") returned 6
	[0049.673] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.db") returned 0
	[0049.673] lstrlenA (lpString="*.db") returned 4
	[0049.673] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.swf") returned 0
	[0049.673] lstrlenA (lpString="*.swf") returned 5
	[0049.673] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.eml") returned 0
	[0049.673] lstrlenA (lpString="*.eml") returned 5
	[0049.673] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.part") returned 0
	[0049.673] lstrlenA (lpString="*.part") returned 6
	[0049.673] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.nfo") returned 0
	[0049.673] lstrlenA (lpString="*.nfo") returned 5
	[0049.673] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.rsa") returned 0
	[0049.673] lstrlenA (lpString="*.rsa") returned 5
	[0049.673] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.key") returned 0
	[0049.673] lstrlenA (lpString="*.key") returned 5
	[0049.673] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.aes") returned 0
	[0049.673] lstrlenA (lpString="*.aes") returned 5
	[0049.673] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.blob") returned 0
	[0049.673] lstrlenA (lpString="*.blob") returned 6
	[0049.673] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.btc") returned 0
	[0049.673] lstrlenA (lpString="*.btc") returned 5
	[0049.673] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.wallet") returned 0
	[0049.673] lstrlenA (lpString="*.wallet") returned 8
	[0049.673] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1
	[0049.673] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0049.673] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="watermark.bmp") returned -1
	[0049.673] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="watermark.bmp") returned -1
	[0049.673] lstrcmpiA (lpString1="", lpString2="watermark.bmp") returned -1
	[0049.673] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\UiInfo.xml") returned="UiInfo.xml"
	[0049.673] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0049.673] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned=""
	[0049.673] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.673] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\how-to-decrypt-files.htm")) returned 0x20
	[0049.674] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="watermark.bmp" | out: lpString1="C:\\588bce7c90097ed212\\watermark.bmp") returned="C:\\588bce7c90097ed212\\watermark.bmp"
	[0049.674] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\watermark.bmp", pszSpec="*.zip") returned 0
	[0049.674] lstrlenA (lpString="*.zip") returned 5
	[0049.674] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\watermark.bmp", pszSpec="*.rar") returned 0
	[0049.674] lstrlenA (lpString="*.rar") returned 5
	[0049.674] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\watermark.bmp", pszSpec="*.7z") returned 0
	[0049.674] lstrlenA (lpString="*.7z") returned 4
	[0049.674] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\watermark.bmp", pszSpec="*.tar") returned 0
	[0049.674] lstrlenA (lpString="*.tar") returned 5
	[0049.674] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\watermark.bmp", pszSpec="*.gzip") returned 0
	[0049.674] lstrlenA (lpString="*.gzip") returned 6
	[0049.674] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\watermark.bmp", pszSpec="*.jpg") returned 0
	[0049.674] lstrlenA (lpString="*.jpg") returned 5
	[0049.674] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\watermark.bmp", pszSpec="*.jpeg") returned 0
	[0049.674] lstrlenA (lpString="*.jpeg") returned 6
	[0049.674] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\watermark.bmp", pszSpec="*.bmp") returned 1
	[0049.674] lstrlenA (lpString="*.bmp") returned 5
	[0049.674] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\588bce7c90097ed212\\watermark.bmp" | out: lpString1="C:\\588bce7c90097ed212\\watermark.bmp") returned="C:\\588bce7c90097ed212\\watermark.bmp"
	[0049.674] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\588bce7c90097ed212\\watermark.bmp" | out: lpString1="C:\\588bce7c90097ed212\\watermark.bmp") returned="C:\\588bce7c90097ed212\\watermark.bmp"
	[0049.674] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\watermark.bmp", lpString2="." | out: lpString1="C:\\588bce7c90097ed212\\watermark.bmp.") returned="C:\\588bce7c90097ed212\\watermark.bmp."
	[0049.674] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\watermark.bmp.", lpString2="exe" | out: lpString1="C:\\588bce7c90097ed212\\watermark.bmp.exe") returned="C:\\588bce7c90097ed212\\watermark.bmp.exe"
	[0049.674] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0049.674] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19688
	[0049.674] GetFileTime (in: hFile=0x204, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x87910600, dwHighDateTime=0x1ca2a27), lpLastAccessTime=0x407536*(dwLowDateTime=0x87910600, dwHighDateTime=0x1ca2a27), lpLastWriteTime=0x40753e*(dwLowDateTime=0x87910600, dwHighDateTime=0x1ca2a27)) returned 1
	[0049.674] SetFilePointer (in: hFile=0x204, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0049.675] ReadFile (in: hFile=0x204, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x19646, lpOverlapped=0x0) returned 1
	[0049.690] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\watermark.bmp") returned="watermark.bmp"
	[0049.690] SetFilePointer (in: hFile=0x204, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0049.691] WriteFile (in: hFile=0x204, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x19646, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x19646, lpOverlapped=0x0) returned 1
	[0049.691] SetFileTime (hFile=0x204, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.691] CloseHandle (hObject=0x204) returned 1
	[0049.694] MoveFileA (lpExistingFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), lpNewFileName="C:\\588bce7c90097ed212\\watermark.bmp.exe" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.exe")) returned 1
	[0049.694] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x15, dwReserved1=0x1, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1
	[0049.694] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0049.694] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Windows6.0-KB956250-v6001-x64.msu") returned -1
	[0049.694] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Windows6.0-KB956250-v6001-x64.msu") returned -1
	[0049.694] lstrcmpiA (lpString1="", lpString2="Windows6.0-KB956250-v6001-x64.msu") returned -1
	[0049.694] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\watermark.bmp") returned="watermark.bmp"
	[0049.694] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0049.694] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned=""
	[0049.695] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.695] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\how-to-decrypt-files.htm")) returned 0x20
	[0049.695] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="Windows6.0-KB956250-v6001-x64.msu" | out: lpString1="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu"
	[0049.695] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.zip") returned 0
	[0049.695] lstrlenA (lpString="*.zip") returned 5
	[0049.695] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.rar") returned 0
	[0049.695] lstrlenA (lpString="*.rar") returned 5
	[0049.695] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.7z") returned 0
	[0049.695] lstrlenA (lpString="*.7z") returned 4
	[0049.695] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.tar") returned 0
	[0049.695] lstrlenA (lpString="*.tar") returned 5
	[0049.695] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.gzip") returned 0
	[0049.695] lstrlenA (lpString="*.gzip") returned 6
	[0049.695] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.jpg") returned 0
	[0049.695] lstrlenA (lpString="*.jpg") returned 5
	[0049.695] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.jpeg") returned 0
	[0049.695] lstrlenA (lpString="*.jpeg") returned 6
	[0049.695] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.bmp") returned 0
	[0049.695] lstrlenA (lpString="*.bmp") returned 5
	[0049.695] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.gif") returned 0
	[0049.695] lstrlenA (lpString="*.gif") returned 5
	[0049.695] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.png") returned 0
	[0049.695] lstrlenA (lpString="*.png") returned 5
	[0049.695] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.doc") returned 0
	[0049.695] lstrlenA (lpString="*.doc") returned 5
	[0049.695] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.docx") returned 0
	[0049.695] lstrlenA (lpString="*.docx") returned 6
	[0049.695] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.xls") returned 0
	[0049.695] lstrlenA (lpString="*.xls") returned 5
	[0049.695] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.xlsx") returned 0
	[0049.695] lstrlenA (lpString="*.xlsx") returned 6
	[0049.696] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.ppt") returned 0
	[0049.696] lstrlenA (lpString="*.ppt") returned 5
	[0049.696] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.pptx") returned 0
	[0049.696] lstrlenA (lpString="*.pptx") returned 6
	[0049.696] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.txt") returned 0
	[0049.696] lstrlenA (lpString="*.txt") returned 5
	[0049.696] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.pdf") returned 0
	[0049.696] lstrlenA (lpString="*.pdf") returned 5
	[0049.696] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.htm") returned 0
	[0049.696] lstrlenA (lpString="*.htm") returned 5
	[0049.696] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.html") returned 0
	[0049.696] lstrlenA (lpString="*.html") returned 6
	[0049.696] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.mdb") returned 0
	[0049.696] lstrlenA (lpString="*.mdb") returned 5
	[0049.696] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.pfx") returned 0
	[0049.696] lstrlenA (lpString="*.pfx") returned 5
	[0049.696] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.md") returned 0
	[0049.696] lstrlenA (lpString="*.md") returned 4
	[0049.696] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.lnk") returned 0
	[0049.696] lstrlenA (lpString="*.lnk") returned 5
	[0049.696] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.torrent") returned 0
	[0049.696] lstrlenA (lpString="*.torrent") returned 9
	[0049.696] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.mov") returned 0
	[0049.696] lstrlenA (lpString="*.mov") returned 5
	[0049.696] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.3gp") returned 0
	[0049.696] lstrlenA (lpString="*.3gp") returned 5
	[0049.696] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.mpeg") returned 0
	[0049.696] lstrlenA (lpString="*.mpeg") returned 6
	[0049.696] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.mpg") returned 0
	[0049.696] lstrlenA (lpString="*.mpg") returned 5
	[0049.696] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.flv") returned 0
	[0049.696] lstrlenA (lpString="*.flv") returned 5
	[0049.696] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.avi") returned 0
	[0049.696] lstrlenA (lpString="*.avi") returned 5
	[0049.696] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.mp4") returned 0
	[0049.696] lstrlenA (lpString="*.mp4") returned 5
	[0049.697] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.wmv") returned 0
	[0049.697] lstrlenA (lpString="*.wmv") returned 5
	[0049.697] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.mkv") returned 0
	[0049.697] lstrlenA (lpString="*.mkv") returned 5
	[0049.697] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.mp3") returned 0
	[0049.697] lstrlenA (lpString="*.mp3") returned 5
	[0049.697] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.wav") returned 0
	[0049.697] lstrlenA (lpString="*.wav") returned 5
	[0049.697] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.flac") returned 0
	[0049.697] lstrlenA (lpString="*.flac") returned 6
	[0049.697] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.wma") returned 0
	[0049.697] lstrlenA (lpString="*.wma") returned 5
	[0049.697] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.au3") returned 0
	[0049.697] lstrlenA (lpString="*.au3") returned 5
	[0049.697] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.ahk") returned 0
	[0049.697] lstrlenA (lpString="*.ahk") returned 5
	[0049.697] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.c") returned 0
	[0049.697] lstrlenA (lpString="*.c") returned 3
	[0049.697] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.cc") returned 0
	[0049.697] lstrlenA (lpString="*.cc") returned 4
	[0049.697] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.cpp") returned 0
	[0049.697] lstrlenA (lpString="*.cpp") returned 5
	[0049.697] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.cxx") returned 0
	[0049.697] lstrlenA (lpString="*.cxx") returned 5
	[0049.697] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.c++") returned 0
	[0049.697] lstrlenA (lpString="*.c++") returned 5
	[0049.697] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.cs") returned 0
	[0049.697] lstrlenA (lpString="*.cs") returned 4
	[0049.697] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.vb") returned 0
	[0049.697] lstrlenA (lpString="*.vb") returned 4
	[0049.697] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.bas") returned 0
	[0049.697] lstrlenA (lpString="*.bas") returned 5
	[0049.697] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.csproj") returned 0
	[0049.697] lstrlenA (lpString="*.csproj") returned 8
	[0049.697] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.vbproj") returned 0
	[0049.698] lstrlenA (lpString="*.vbproj") returned 8
	[0049.698] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.vcxproj") returned 0
	[0049.698] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.698] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.manifest") returned 0
	[0049.698] lstrlenA (lpString="*.manifest") returned 10
	[0049.698] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.php") returned 0
	[0049.698] lstrlenA (lpString="*.php") returned 5
	[0049.698] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.vbe") returned 0
	[0049.698] lstrlenA (lpString="*.vbe") returned 5
	[0049.698] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.vba") returned 0
	[0049.698] lstrlenA (lpString="*.vba") returned 5
	[0049.698] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.vbs") returned 0
	[0049.698] lstrlenA (lpString="*.vbs") returned 5
	[0049.698] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.bat") returned 0
	[0049.698] lstrlenA (lpString="*.bat") returned 5
	[0049.698] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.cmd") returned 0
	[0049.698] lstrlenA (lpString="*.cmd") returned 5
	[0049.698] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.js") returned 0
	[0049.698] lstrlenA (lpString="*.js") returned 4
	[0049.698] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.jscript") returned 0
	[0049.698] lstrlenA (lpString="*.jscript") returned 9
	[0049.698] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.hta") returned 0
	[0049.698] lstrlenA (lpString="*.hta") returned 5
	[0049.698] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.php7") returned 0
	[0049.698] lstrlenA (lpString="*.php7") returned 6
	[0049.698] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.db") returned 0
	[0049.698] lstrlenA (lpString="*.db") returned 4
	[0049.698] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.swf") returned 0
	[0049.698] lstrlenA (lpString="*.swf") returned 5
	[0049.698] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.eml") returned 0
	[0049.698] lstrlenA (lpString="*.eml") returned 5
	[0049.698] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.part") returned 0
	[0049.698] lstrlenA (lpString="*.part") returned 6
	[0049.698] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.nfo") returned 0
	[0049.699] lstrlenA (lpString="*.nfo") returned 5
	[0049.699] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.rsa") returned 0
	[0049.699] lstrlenA (lpString="*.rsa") returned 5
	[0049.699] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.key") returned 0
	[0049.699] lstrlenA (lpString="*.key") returned 5
	[0049.699] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.aes") returned 0
	[0049.699] lstrlenA (lpString="*.aes") returned 5
	[0049.699] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.blob") returned 0
	[0049.699] lstrlenA (lpString="*.blob") returned 6
	[0049.699] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.btc") returned 0
	[0049.699] lstrlenA (lpString="*.btc") returned 5
	[0049.699] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.wallet") returned 0
	[0049.699] lstrlenA (lpString="*.wallet") returned 8
	[0049.699] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1
	[0049.699] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0049.699] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Windows6.0-KB956250-v6001-x86.msu") returned -1
	[0049.699] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Windows6.0-KB956250-v6001-x86.msu") returned -1
	[0049.699] lstrcmpiA (lpString1="", lpString2="Windows6.0-KB956250-v6001-x86.msu") returned -1
	[0049.699] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned="Windows6.0-KB956250-v6001-x64.msu"
	[0049.699] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0049.699] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned=""
	[0049.699] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.699] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\how-to-decrypt-files.htm")) returned 0x20
	[0049.699] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="Windows6.0-KB956250-v6001-x86.msu" | out: lpString1="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu"
	[0049.699] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.zip") returned 0
	[0049.699] lstrlenA (lpString="*.zip") returned 5
	[0049.699] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.rar") returned 0
	[0049.699] lstrlenA (lpString="*.rar") returned 5
	[0049.699] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.7z") returned 0
	[0049.699] lstrlenA (lpString="*.7z") returned 4
	[0049.699] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.tar") returned 0
	[0049.700] lstrlenA (lpString="*.tar") returned 5
	[0049.700] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.gzip") returned 0
	[0049.700] lstrlenA (lpString="*.gzip") returned 6
	[0049.700] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.jpg") returned 0
	[0049.700] lstrlenA (lpString="*.jpg") returned 5
	[0049.700] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.jpeg") returned 0
	[0049.700] lstrlenA (lpString="*.jpeg") returned 6
	[0049.700] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.bmp") returned 0
	[0049.700] lstrlenA (lpString="*.bmp") returned 5
	[0049.700] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.gif") returned 0
	[0049.700] lstrlenA (lpString="*.gif") returned 5
	[0049.700] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.png") returned 0
	[0049.700] lstrlenA (lpString="*.png") returned 5
	[0049.700] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.doc") returned 0
	[0049.700] lstrlenA (lpString="*.doc") returned 5
	[0049.700] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.docx") returned 0
	[0049.700] lstrlenA (lpString="*.docx") returned 6
	[0049.700] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.xls") returned 0
	[0049.700] lstrlenA (lpString="*.xls") returned 5
	[0049.700] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.xlsx") returned 0
	[0049.700] lstrlenA (lpString="*.xlsx") returned 6
	[0049.700] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.ppt") returned 0
	[0049.700] lstrlenA (lpString="*.ppt") returned 5
	[0049.700] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.pptx") returned 0
	[0049.700] lstrlenA (lpString="*.pptx") returned 6
	[0049.700] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.txt") returned 0
	[0049.700] lstrlenA (lpString="*.txt") returned 5
	[0049.700] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.pdf") returned 0
	[0049.700] lstrlenA (lpString="*.pdf") returned 5
	[0049.700] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.htm") returned 0
	[0049.700] lstrlenA (lpString="*.htm") returned 5
	[0049.700] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.html") returned 0
	[0049.700] lstrlenA (lpString="*.html") returned 6
	[0049.700] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.mdb") returned 0
	[0049.700] lstrlenA (lpString="*.mdb") returned 5
	[0049.700] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.pfx") returned 0
	[0049.701] lstrlenA (lpString="*.pfx") returned 5
	[0049.701] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.md") returned 0
	[0049.701] lstrlenA (lpString="*.md") returned 4
	[0049.701] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.lnk") returned 0
	[0049.701] lstrlenA (lpString="*.lnk") returned 5
	[0049.701] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.torrent") returned 0
	[0049.701] lstrlenA (lpString="*.torrent") returned 9
	[0049.701] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.mov") returned 0
	[0049.701] lstrlenA (lpString="*.mov") returned 5
	[0049.701] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.3gp") returned 0
	[0049.701] lstrlenA (lpString="*.3gp") returned 5
	[0049.701] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.mpeg") returned 0
	[0049.701] lstrlenA (lpString="*.mpeg") returned 6
	[0049.701] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.mpg") returned 0
	[0049.701] lstrlenA (lpString="*.mpg") returned 5
	[0049.701] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.flv") returned 0
	[0049.701] lstrlenA (lpString="*.flv") returned 5
	[0049.701] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.avi") returned 0
	[0049.701] lstrlenA (lpString="*.avi") returned 5
	[0049.701] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.mp4") returned 0
	[0049.701] lstrlenA (lpString="*.mp4") returned 5
	[0049.701] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.wmv") returned 0
	[0049.701] lstrlenA (lpString="*.wmv") returned 5
	[0049.701] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.mkv") returned 0
	[0049.701] lstrlenA (lpString="*.mkv") returned 5
	[0049.701] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.mp3") returned 0
	[0049.701] lstrlenA (lpString="*.mp3") returned 5
	[0049.701] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.wav") returned 0
	[0049.701] lstrlenA (lpString="*.wav") returned 5
	[0049.701] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.flac") returned 0
	[0049.701] lstrlenA (lpString="*.flac") returned 6
	[0049.701] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.wma") returned 0
	[0049.701] lstrlenA (lpString="*.wma") returned 5
	[0049.701] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.au3") returned 0
	[0049.701] lstrlenA (lpString="*.au3") returned 5
	[0049.701] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.ahk") returned 0
	[0049.702] lstrlenA (lpString="*.ahk") returned 5
	[0049.702] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.c") returned 0
	[0049.702] lstrlenA (lpString="*.c") returned 3
	[0049.702] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.cc") returned 0
	[0049.702] lstrlenA (lpString="*.cc") returned 4
	[0049.702] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.cpp") returned 0
	[0049.702] lstrlenA (lpString="*.cpp") returned 5
	[0049.702] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.cxx") returned 0
	[0049.702] lstrlenA (lpString="*.cxx") returned 5
	[0049.702] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.c++") returned 0
	[0049.702] lstrlenA (lpString="*.c++") returned 5
	[0049.702] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.cs") returned 0
	[0049.702] lstrlenA (lpString="*.cs") returned 4
	[0049.702] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.vb") returned 0
	[0049.702] lstrlenA (lpString="*.vb") returned 4
	[0049.702] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.bas") returned 0
	[0049.702] lstrlenA (lpString="*.bas") returned 5
	[0049.702] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.csproj") returned 0
	[0049.702] lstrlenA (lpString="*.csproj") returned 8
	[0049.702] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.vbproj") returned 0
	[0049.702] lstrlenA (lpString="*.vbproj") returned 8
	[0049.702] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.vcxproj") returned 0
	[0049.702] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.702] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.manifest") returned 0
	[0049.702] lstrlenA (lpString="*.manifest") returned 10
	[0049.702] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.php") returned 0
	[0049.702] lstrlenA (lpString="*.php") returned 5
	[0049.702] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.vbe") returned 0
	[0049.702] lstrlenA (lpString="*.vbe") returned 5
	[0049.702] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.vba") returned 0
	[0049.702] lstrlenA (lpString="*.vba") returned 5
	[0049.702] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.vbs") returned 0
	[0049.702] lstrlenA (lpString="*.vbs") returned 5
	[0049.702] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.bat") returned 0
	[0049.703] lstrlenA (lpString="*.bat") returned 5
	[0049.703] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.cmd") returned 0
	[0049.703] lstrlenA (lpString="*.cmd") returned 5
	[0049.703] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.js") returned 0
	[0049.703] lstrlenA (lpString="*.js") returned 4
	[0049.703] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.jscript") returned 0
	[0049.703] lstrlenA (lpString="*.jscript") returned 9
	[0049.703] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.hta") returned 0
	[0049.703] lstrlenA (lpString="*.hta") returned 5
	[0049.703] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.php7") returned 0
	[0049.703] lstrlenA (lpString="*.php7") returned 6
	[0049.703] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.db") returned 0
	[0049.703] lstrlenA (lpString="*.db") returned 4
	[0049.703] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.swf") returned 0
	[0049.703] lstrlenA (lpString="*.swf") returned 5
	[0049.703] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.eml") returned 0
	[0049.703] lstrlenA (lpString="*.eml") returned 5
	[0049.703] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.part") returned 0
	[0049.703] lstrlenA (lpString="*.part") returned 6
	[0049.703] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.nfo") returned 0
	[0049.703] lstrlenA (lpString="*.nfo") returned 5
	[0049.703] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.rsa") returned 0
	[0049.703] lstrlenA (lpString="*.rsa") returned 5
	[0049.703] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.key") returned 0
	[0049.703] lstrlenA (lpString="*.key") returned 5
	[0049.703] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.aes") returned 0
	[0049.703] lstrlenA (lpString="*.aes") returned 5
	[0049.703] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.blob") returned 0
	[0049.703] lstrlenA (lpString="*.blob") returned 6
	[0049.703] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.btc") returned 0
	[0049.703] lstrlenA (lpString="*.btc") returned 5
	[0049.703] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.wallet") returned 0
	[0049.703] lstrlenA (lpString="*.wallet") returned 8
	[0049.703] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1
	[0049.704] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0049.704] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Windows6.1-KB958488-v6001-x64.msu") returned -1
	[0049.704] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Windows6.1-KB958488-v6001-x64.msu") returned -1
	[0049.704] lstrcmpiA (lpString1="", lpString2="Windows6.1-KB958488-v6001-x64.msu") returned -1
	[0049.704] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned="Windows6.0-KB956250-v6001-x86.msu"
	[0049.704] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0049.704] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned=""
	[0049.704] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.704] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\how-to-decrypt-files.htm")) returned 0x20
	[0049.704] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="Windows6.1-KB958488-v6001-x64.msu" | out: lpString1="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu"
	[0049.704] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.zip") returned 0
	[0049.704] lstrlenA (lpString="*.zip") returned 5
	[0049.704] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.rar") returned 0
	[0049.704] lstrlenA (lpString="*.rar") returned 5
	[0049.704] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.7z") returned 0
	[0049.704] lstrlenA (lpString="*.7z") returned 4
	[0049.704] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.tar") returned 0
	[0049.704] lstrlenA (lpString="*.tar") returned 5
	[0049.704] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.gzip") returned 0
	[0049.704] lstrlenA (lpString="*.gzip") returned 6
	[0049.704] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.jpg") returned 0
	[0049.704] lstrlenA (lpString="*.jpg") returned 5
	[0049.704] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.jpeg") returned 0
	[0049.704] lstrlenA (lpString="*.jpeg") returned 6
	[0049.704] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.bmp") returned 0
	[0049.704] lstrlenA (lpString="*.bmp") returned 5
	[0049.704] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.gif") returned 0
	[0049.704] lstrlenA (lpString="*.gif") returned 5
	[0049.704] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.png") returned 0
	[0049.704] lstrlenA (lpString="*.png") returned 5
	[0049.704] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.doc") returned 0
	[0049.704] lstrlenA (lpString="*.doc") returned 5
	[0049.704] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.docx") returned 0
	[0049.705] lstrlenA (lpString="*.docx") returned 6
	[0049.705] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.xls") returned 0
	[0049.705] lstrlenA (lpString="*.xls") returned 5
	[0049.705] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.xlsx") returned 0
	[0049.705] lstrlenA (lpString="*.xlsx") returned 6
	[0049.705] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.ppt") returned 0
	[0049.705] lstrlenA (lpString="*.ppt") returned 5
	[0049.705] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.pptx") returned 0
	[0049.705] lstrlenA (lpString="*.pptx") returned 6
	[0049.705] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.txt") returned 0
	[0049.705] lstrlenA (lpString="*.txt") returned 5
	[0049.705] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.pdf") returned 0
	[0049.705] lstrlenA (lpString="*.pdf") returned 5
	[0049.705] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.htm") returned 0
	[0049.705] lstrlenA (lpString="*.htm") returned 5
	[0049.705] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.html") returned 0
	[0049.705] lstrlenA (lpString="*.html") returned 6
	[0049.705] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.mdb") returned 0
	[0049.705] lstrlenA (lpString="*.mdb") returned 5
	[0049.705] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.pfx") returned 0
	[0049.705] lstrlenA (lpString="*.pfx") returned 5
	[0049.705] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.md") returned 0
	[0049.705] lstrlenA (lpString="*.md") returned 4
	[0049.705] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.lnk") returned 0
	[0049.705] lstrlenA (lpString="*.lnk") returned 5
	[0049.705] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.torrent") returned 0
	[0049.705] lstrlenA (lpString="*.torrent") returned 9
	[0049.705] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.mov") returned 0
	[0049.705] lstrlenA (lpString="*.mov") returned 5
	[0049.705] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.3gp") returned 0
	[0049.705] lstrlenA (lpString="*.3gp") returned 5
	[0049.705] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.mpeg") returned 0
	[0049.705] lstrlenA (lpString="*.mpeg") returned 6
	[0049.705] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.mpg") returned 0
	[0049.705] lstrlenA (lpString="*.mpg") returned 5
	[0049.705] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.flv") returned 0
	[0049.706] lstrlenA (lpString="*.flv") returned 5
	[0049.706] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.avi") returned 0
	[0049.706] lstrlenA (lpString="*.avi") returned 5
	[0049.706] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.mp4") returned 0
	[0049.706] lstrlenA (lpString="*.mp4") returned 5
	[0049.706] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.wmv") returned 0
	[0049.706] lstrlenA (lpString="*.wmv") returned 5
	[0049.706] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.mkv") returned 0
	[0049.706] lstrlenA (lpString="*.mkv") returned 5
	[0049.706] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.mp3") returned 0
	[0049.706] lstrlenA (lpString="*.mp3") returned 5
	[0049.706] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.wav") returned 0
	[0049.706] lstrlenA (lpString="*.wav") returned 5
	[0049.706] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.flac") returned 0
	[0049.706] lstrlenA (lpString="*.flac") returned 6
	[0049.706] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.wma") returned 0
	[0049.706] lstrlenA (lpString="*.wma") returned 5
	[0049.706] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.au3") returned 0
	[0049.706] lstrlenA (lpString="*.au3") returned 5
	[0049.706] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.ahk") returned 0
	[0049.706] lstrlenA (lpString="*.ahk") returned 5
	[0049.706] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.c") returned 0
	[0049.706] lstrlenA (lpString="*.c") returned 3
	[0049.706] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.cc") returned 0
	[0049.706] lstrlenA (lpString="*.cc") returned 4
	[0049.706] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.cpp") returned 0
	[0049.706] lstrlenA (lpString="*.cpp") returned 5
	[0049.706] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.cxx") returned 0
	[0049.706] lstrlenA (lpString="*.cxx") returned 5
	[0049.706] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.c++") returned 0
	[0049.706] lstrlenA (lpString="*.c++") returned 5
	[0049.706] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.cs") returned 0
	[0049.706] lstrlenA (lpString="*.cs") returned 4
	[0049.706] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.vb") returned 0
	[0049.707] lstrlenA (lpString="*.vb") returned 4
	[0049.707] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.bas") returned 0
	[0049.707] lstrlenA (lpString="*.bas") returned 5
	[0049.707] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.csproj") returned 0
	[0049.707] lstrlenA (lpString="*.csproj") returned 8
	[0049.707] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.vbproj") returned 0
	[0049.707] lstrlenA (lpString="*.vbproj") returned 8
	[0049.707] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.vcxproj") returned 0
	[0049.707] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.707] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.manifest") returned 0
	[0049.707] lstrlenA (lpString="*.manifest") returned 10
	[0049.707] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.php") returned 0
	[0049.707] lstrlenA (lpString="*.php") returned 5
	[0049.707] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.vbe") returned 0
	[0049.707] lstrlenA (lpString="*.vbe") returned 5
	[0049.707] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.vba") returned 0
	[0049.707] lstrlenA (lpString="*.vba") returned 5
	[0049.707] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.vbs") returned 0
	[0049.707] lstrlenA (lpString="*.vbs") returned 5
	[0049.707] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.bat") returned 0
	[0049.707] lstrlenA (lpString="*.bat") returned 5
	[0049.707] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.cmd") returned 0
	[0049.707] lstrlenA (lpString="*.cmd") returned 5
	[0049.707] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.js") returned 0
	[0049.707] lstrlenA (lpString="*.js") returned 4
	[0049.707] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.jscript") returned 0
	[0049.707] lstrlenA (lpString="*.jscript") returned 9
	[0049.707] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.hta") returned 0
	[0049.707] lstrlenA (lpString="*.hta") returned 5
	[0049.707] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.php7") returned 0
	[0049.707] lstrlenA (lpString="*.php7") returned 6
	[0049.707] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.db") returned 0
	[0049.707] lstrlenA (lpString="*.db") returned 4
	[0049.707] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.swf") returned 0
	[0049.707] lstrlenA (lpString="*.swf") returned 5
	[0049.708] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.eml") returned 0
	[0049.708] lstrlenA (lpString="*.eml") returned 5
	[0049.708] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.part") returned 0
	[0049.708] lstrlenA (lpString="*.part") returned 6
	[0049.708] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.nfo") returned 0
	[0049.708] lstrlenA (lpString="*.nfo") returned 5
	[0049.708] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.rsa") returned 0
	[0049.708] lstrlenA (lpString="*.rsa") returned 5
	[0049.708] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.key") returned 0
	[0049.708] lstrlenA (lpString="*.key") returned 5
	[0049.708] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.aes") returned 0
	[0049.708] lstrlenA (lpString="*.aes") returned 5
	[0049.708] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.blob") returned 0
	[0049.708] lstrlenA (lpString="*.blob") returned 6
	[0049.708] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.btc") returned 0
	[0049.708] lstrlenA (lpString="*.btc") returned 5
	[0049.708] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.wallet") returned 0
	[0049.708] lstrlenA (lpString="*.wallet") returned 8
	[0049.708] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1
	[0049.708] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0049.708] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Windows6.1-KB958488-v6001-x86.msu") returned -1
	[0049.708] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Windows6.1-KB958488-v6001-x86.msu") returned -1
	[0049.708] lstrcmpiA (lpString1="", lpString2="Windows6.1-KB958488-v6001-x86.msu") returned -1
	[0049.708] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned="Windows6.1-KB958488-v6001-x64.msu"
	[0049.708] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0049.708] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned=""
	[0049.708] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.708] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\588bce7c90097ed212\\how-to-decrypt-files.htm")) returned 0x20
	[0049.708] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="Windows6.1-KB958488-v6001-x86.msu" | out: lpString1="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu"
	[0049.708] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.zip") returned 0
	[0049.709] lstrlenA (lpString="*.zip") returned 5
	[0049.709] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.rar") returned 0
	[0049.709] lstrlenA (lpString="*.rar") returned 5
	[0049.709] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.7z") returned 0
	[0049.709] lstrlenA (lpString="*.7z") returned 4
	[0049.709] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.tar") returned 0
	[0049.709] lstrlenA (lpString="*.tar") returned 5
	[0049.709] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.gzip") returned 0
	[0049.709] lstrlenA (lpString="*.gzip") returned 6
	[0049.709] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.jpg") returned 0
	[0049.709] lstrlenA (lpString="*.jpg") returned 5
	[0049.709] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.jpeg") returned 0
	[0049.709] lstrlenA (lpString="*.jpeg") returned 6
	[0049.709] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.bmp") returned 0
	[0049.709] lstrlenA (lpString="*.bmp") returned 5
	[0049.709] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.gif") returned 0
	[0049.709] lstrlenA (lpString="*.gif") returned 5
	[0049.709] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.png") returned 0
	[0049.709] lstrlenA (lpString="*.png") returned 5
	[0049.709] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.doc") returned 0
	[0049.709] lstrlenA (lpString="*.doc") returned 5
	[0049.709] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.docx") returned 0
	[0049.709] lstrlenA (lpString="*.docx") returned 6
	[0049.709] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.xls") returned 0
	[0049.709] lstrlenA (lpString="*.xls") returned 5
	[0049.710] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.xlsx") returned 0
	[0049.710] lstrlenA (lpString="*.xlsx") returned 6
	[0049.710] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.ppt") returned 0
	[0049.710] lstrlenA (lpString="*.ppt") returned 5
	[0049.710] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.pptx") returned 0
	[0049.710] lstrlenA (lpString="*.pptx") returned 6
	[0049.710] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.txt") returned 0
	[0049.710] lstrlenA (lpString="*.txt") returned 5
	[0049.710] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.pdf") returned 0
	[0049.710] lstrlenA (lpString="*.pdf") returned 5
	[0049.710] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.htm") returned 0
	[0049.710] lstrlenA (lpString="*.htm") returned 5
	[0049.710] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.html") returned 0
	[0049.710] lstrlenA (lpString="*.html") returned 6
	[0049.710] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.mdb") returned 0
	[0049.710] lstrlenA (lpString="*.mdb") returned 5
	[0049.710] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.pfx") returned 0
	[0049.710] lstrlenA (lpString="*.pfx") returned 5
	[0049.710] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.md") returned 0
	[0049.710] lstrlenA (lpString="*.md") returned 4
	[0049.710] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.lnk") returned 0
	[0049.710] lstrlenA (lpString="*.lnk") returned 5
	[0049.710] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.torrent") returned 0
	[0049.710] lstrlenA (lpString="*.torrent") returned 9
	[0049.710] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.mov") returned 0
	[0049.710] lstrlenA (lpString="*.mov") returned 5
	[0049.710] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.3gp") returned 0
	[0049.710] lstrlenA (lpString="*.3gp") returned 5
	[0049.710] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.mpeg") returned 0
	[0049.710] lstrlenA (lpString="*.mpeg") returned 6
	[0049.710] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.mpg") returned 0
	[0049.710] lstrlenA (lpString="*.mpg") returned 5
	[0049.710] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.flv") returned 0
	[0049.710] lstrlenA (lpString="*.flv") returned 5
	[0049.710] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.avi") returned 0
	[0049.711] lstrlenA (lpString="*.avi") returned 5
	[0049.711] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.mp4") returned 0
	[0049.711] lstrlenA (lpString="*.mp4") returned 5
	[0049.711] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.wmv") returned 0
	[0049.711] lstrlenA (lpString="*.wmv") returned 5
	[0049.711] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.mkv") returned 0
	[0049.711] lstrlenA (lpString="*.mkv") returned 5
	[0049.711] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.mp3") returned 0
	[0049.711] lstrlenA (lpString="*.mp3") returned 5
	[0049.711] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.wav") returned 0
	[0049.711] lstrlenA (lpString="*.wav") returned 5
	[0049.711] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.flac") returned 0
	[0049.711] lstrlenA (lpString="*.flac") returned 6
	[0049.711] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.wma") returned 0
	[0049.711] lstrlenA (lpString="*.wma") returned 5
	[0049.711] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.au3") returned 0
	[0049.711] lstrlenA (lpString="*.au3") returned 5
	[0049.711] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.ahk") returned 0
	[0049.711] lstrlenA (lpString="*.ahk") returned 5
	[0049.711] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.c") returned 0
	[0049.711] lstrlenA (lpString="*.c") returned 3
	[0049.711] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.cc") returned 0
	[0049.711] lstrlenA (lpString="*.cc") returned 4
	[0049.711] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.cpp") returned 0
	[0049.711] lstrlenA (lpString="*.cpp") returned 5
	[0049.711] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.cxx") returned 0
	[0049.711] lstrlenA (lpString="*.cxx") returned 5
	[0049.711] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.c++") returned 0
	[0049.711] lstrlenA (lpString="*.c++") returned 5
	[0049.711] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.cs") returned 0
	[0049.711] lstrlenA (lpString="*.cs") returned 4
	[0049.711] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.vb") returned 0
	[0049.711] lstrlenA (lpString="*.vb") returned 4
	[0049.711] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.bas") returned 0
	[0049.712] lstrlenA (lpString="*.bas") returned 5
	[0049.712] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.csproj") returned 0
	[0049.712] lstrlenA (lpString="*.csproj") returned 8
	[0049.712] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.vbproj") returned 0
	[0049.712] lstrlenA (lpString="*.vbproj") returned 8
	[0049.712] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.vcxproj") returned 0
	[0049.712] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.712] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.manifest") returned 0
	[0049.712] lstrlenA (lpString="*.manifest") returned 10
	[0049.712] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.php") returned 0
	[0049.712] lstrlenA (lpString="*.php") returned 5
	[0049.712] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.vbe") returned 0
	[0049.712] lstrlenA (lpString="*.vbe") returned 5
	[0049.712] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.vba") returned 0
	[0049.712] lstrlenA (lpString="*.vba") returned 5
	[0049.712] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.vbs") returned 0
	[0049.712] lstrlenA (lpString="*.vbs") returned 5
	[0049.712] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.bat") returned 0
	[0049.712] lstrlenA (lpString="*.bat") returned 5
	[0049.712] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.cmd") returned 0
	[0049.712] lstrlenA (lpString="*.cmd") returned 5
	[0049.712] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.js") returned 0
	[0049.712] lstrlenA (lpString="*.js") returned 4
	[0049.712] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.jscript") returned 0
	[0049.712] lstrlenA (lpString="*.jscript") returned 9
	[0049.712] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.hta") returned 0
	[0049.712] lstrlenA (lpString="*.hta") returned 5
	[0049.712] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.php7") returned 0
	[0049.712] lstrlenA (lpString="*.php7") returned 6
	[0049.712] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.db") returned 0
	[0049.712] lstrlenA (lpString="*.db") returned 4
	[0049.712] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.swf") returned 0
	[0049.712] lstrlenA (lpString="*.swf") returned 5
	[0049.712] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.eml") returned 0
	[0049.712] lstrlenA (lpString="*.eml") returned 5
	[0049.713] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.part") returned 0
	[0049.713] lstrlenA (lpString="*.part") returned 6
	[0049.713] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.nfo") returned 0
	[0049.713] lstrlenA (lpString="*.nfo") returned 5
	[0049.713] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.rsa") returned 0
	[0049.713] lstrlenA (lpString="*.rsa") returned 5
	[0049.713] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.key") returned 0
	[0049.713] lstrlenA (lpString="*.key") returned 5
	[0049.713] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.aes") returned 0
	[0049.713] lstrlenA (lpString="*.aes") returned 5
	[0049.713] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.blob") returned 0
	[0049.713] lstrlenA (lpString="*.blob") returned 6
	[0049.713] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.btc") returned 0
	[0049.713] lstrlenA (lpString="*.btc") returned 5
	[0049.713] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.wallet") returned 0
	[0049.713] lstrlenA (lpString="*.wallet") returned 8
	[0049.713] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0
	[0049.713] FindClose (in: hFindFile=0x7cb950 | out: hFindFile=0x7cb950) returned 1
	[0049.713] FindNextFileA (in: hFindFile=0x7cba90, lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1
	[0049.713] lstrcmpA (lpString1=".", lpString2="Boot") returned -1
	[0049.713] lstrcmpA (lpString1="..", lpString2="Boot") returned -1
	[0049.713] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*"
	[0049.713] lstrcatA (in: lpString1="C:\\", lpString2="Boot" | out: lpString1="C:\\Boot") returned="C:\\Boot"
	[0049.713] lstrlenA (lpString="C:\\Boot") returned 7
	[0049.713] FindFirstFileA (in: lpFileName="C:\\Boot\\*.*", lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbbd0
	[0049.714] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0049.714] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0049.715] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0049.715] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0049.715] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1
	[0049.715] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0049.715] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="BCD") returned 1
	[0049.715] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="BCD") returned 1
	[0049.715] lstrcmpiA (lpString1="", lpString2="BCD") returned -1
	[0049.715] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0049.715] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\"
	[0049.716] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned=""
	[0049.716] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.716] GetFileAttributesA (lpFileName="C:\\Boot\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0049.716] CreateFileA (lpFileName="C:\\Boot\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0049.716] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0049.716] WriteFile (in: hFile=0x204, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0049.717] SetFileTime (hFile=0x204, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0049.717] CloseHandle (hObject=0x204) returned 1
	[0049.717] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="BCD" | out: lpString1="C:\\Boot\\BCD") returned="C:\\Boot\\BCD"
	[0049.717] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.zip") returned 0
	[0049.717] lstrlenA (lpString="*.zip") returned 5
	[0049.717] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.rar") returned 0
	[0049.717] lstrlenA (lpString="*.rar") returned 5
	[0049.717] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.7z") returned 0
	[0049.717] lstrlenA (lpString="*.7z") returned 4
	[0049.717] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.tar") returned 0
	[0049.717] lstrlenA (lpString="*.tar") returned 5
	[0049.717] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.gzip") returned 0
	[0049.717] lstrlenA (lpString="*.gzip") returned 6
	[0049.717] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.jpg") returned 0
	[0049.717] lstrlenA (lpString="*.jpg") returned 5
	[0049.718] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.jpeg") returned 0
	[0049.718] lstrlenA (lpString="*.jpeg") returned 6
	[0049.718] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.bmp") returned 0
	[0049.718] lstrlenA (lpString="*.bmp") returned 5
	[0049.718] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.gif") returned 0
	[0049.718] lstrlenA (lpString="*.gif") returned 5
	[0049.718] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.png") returned 0
	[0049.718] lstrlenA (lpString="*.png") returned 5
	[0049.718] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.doc") returned 0
	[0049.718] lstrlenA (lpString="*.doc") returned 5
	[0049.718] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.docx") returned 0
	[0049.718] lstrlenA (lpString="*.docx") returned 6
	[0049.718] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.xls") returned 0
	[0049.718] lstrlenA (lpString="*.xls") returned 5
	[0049.718] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.xlsx") returned 0
	[0049.718] lstrlenA (lpString="*.xlsx") returned 6
	[0049.718] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.ppt") returned 0
	[0049.718] lstrlenA (lpString="*.ppt") returned 5
	[0049.718] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.pptx") returned 0
	[0049.718] lstrlenA (lpString="*.pptx") returned 6
	[0049.718] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.txt") returned 0
	[0049.718] lstrlenA (lpString="*.txt") returned 5
	[0049.718] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.pdf") returned 0
	[0049.718] lstrlenA (lpString="*.pdf") returned 5
	[0049.718] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.htm") returned 0
	[0049.718] lstrlenA (lpString="*.htm") returned 5
	[0049.718] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.html") returned 0
	[0049.718] lstrlenA (lpString="*.html") returned 6
	[0049.718] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mdb") returned 0
	[0049.718] lstrlenA (lpString="*.mdb") returned 5
	[0049.718] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.pfx") returned 0
	[0049.718] lstrlenA (lpString="*.pfx") returned 5
	[0049.718] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.md") returned 0
	[0049.718] lstrlenA (lpString="*.md") returned 4
	[0049.718] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.lnk") returned 0
	[0049.719] lstrlenA (lpString="*.lnk") returned 5
	[0049.719] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.torrent") returned 0
	[0049.719] lstrlenA (lpString="*.torrent") returned 9
	[0049.719] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mov") returned 0
	[0049.719] lstrlenA (lpString="*.mov") returned 5
	[0049.719] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.3gp") returned 0
	[0049.719] lstrlenA (lpString="*.3gp") returned 5
	[0049.719] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mpeg") returned 0
	[0049.719] lstrlenA (lpString="*.mpeg") returned 6
	[0049.719] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mpg") returned 0
	[0049.719] lstrlenA (lpString="*.mpg") returned 5
	[0049.719] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.flv") returned 0
	[0049.719] lstrlenA (lpString="*.flv") returned 5
	[0049.719] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.avi") returned 0
	[0049.719] lstrlenA (lpString="*.avi") returned 5
	[0049.719] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mp4") returned 0
	[0049.719] lstrlenA (lpString="*.mp4") returned 5
	[0049.719] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.wmv") returned 0
	[0049.719] lstrlenA (lpString="*.wmv") returned 5
	[0049.719] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mkv") returned 0
	[0049.719] lstrlenA (lpString="*.mkv") returned 5
	[0049.719] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mp3") returned 0
	[0049.719] lstrlenA (lpString="*.mp3") returned 5
	[0049.719] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.wav") returned 0
	[0049.719] lstrlenA (lpString="*.wav") returned 5
	[0049.719] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.flac") returned 0
	[0049.719] lstrlenA (lpString="*.flac") returned 6
	[0049.719] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.wma") returned 0
	[0049.719] lstrlenA (lpString="*.wma") returned 5
	[0049.719] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.au3") returned 0
	[0049.719] lstrlenA (lpString="*.au3") returned 5
	[0049.719] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.ahk") returned 0
	[0049.719] lstrlenA (lpString="*.ahk") returned 5
	[0049.719] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.c") returned 0
	[0049.719] lstrlenA (lpString="*.c") returned 3
	[0049.720] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.cc") returned 0
	[0049.720] lstrlenA (lpString="*.cc") returned 4
	[0049.720] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.cpp") returned 0
	[0049.720] lstrlenA (lpString="*.cpp") returned 5
	[0049.720] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.cxx") returned 0
	[0049.720] lstrlenA (lpString="*.cxx") returned 5
	[0049.720] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.c++") returned 0
	[0049.720] lstrlenA (lpString="*.c++") returned 5
	[0049.720] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.cs") returned 0
	[0049.720] lstrlenA (lpString="*.cs") returned 4
	[0049.720] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.vb") returned 0
	[0049.720] lstrlenA (lpString="*.vb") returned 4
	[0049.720] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.bas") returned 0
	[0049.720] lstrlenA (lpString="*.bas") returned 5
	[0049.720] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.csproj") returned 0
	[0049.720] lstrlenA (lpString="*.csproj") returned 8
	[0049.720] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.vbproj") returned 0
	[0049.720] lstrlenA (lpString="*.vbproj") returned 8
	[0049.720] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.vcxproj") returned 0
	[0049.720] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.720] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.manifest") returned 0
	[0049.720] lstrlenA (lpString="*.manifest") returned 10
	[0049.720] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.php") returned 0
	[0049.720] lstrlenA (lpString="*.php") returned 5
	[0049.720] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.vbe") returned 0
	[0049.720] lstrlenA (lpString="*.vbe") returned 5
	[0049.720] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.vba") returned 0
	[0049.720] lstrlenA (lpString="*.vba") returned 5
	[0049.720] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.vbs") returned 0
	[0049.720] lstrlenA (lpString="*.vbs") returned 5
	[0049.720] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.bat") returned 0
	[0049.720] lstrlenA (lpString="*.bat") returned 5
	[0049.720] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.cmd") returned 0
	[0049.720] lstrlenA (lpString="*.cmd") returned 5
	[0049.720] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.js") returned 0
	[0049.721] lstrlenA (lpString="*.js") returned 4
	[0049.721] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.jscript") returned 0
	[0049.721] lstrlenA (lpString="*.jscript") returned 9
	[0049.721] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.hta") returned 0
	[0049.721] lstrlenA (lpString="*.hta") returned 5
	[0049.721] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.php7") returned 0
	[0049.721] lstrlenA (lpString="*.php7") returned 6
	[0049.721] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.db") returned 0
	[0049.721] lstrlenA (lpString="*.db") returned 4
	[0049.721] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.swf") returned 0
	[0049.721] lstrlenA (lpString="*.swf") returned 5
	[0049.721] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.eml") returned 0
	[0049.721] lstrlenA (lpString="*.eml") returned 5
	[0049.721] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.part") returned 0
	[0049.721] lstrlenA (lpString="*.part") returned 6
	[0049.721] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.nfo") returned 0
	[0049.721] lstrlenA (lpString="*.nfo") returned 5
	[0049.721] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.rsa") returned 0
	[0049.721] lstrlenA (lpString="*.rsa") returned 5
	[0049.721] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.key") returned 0
	[0049.721] lstrlenA (lpString="*.key") returned 5
	[0049.721] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.aes") returned 0
	[0049.721] lstrlenA (lpString="*.aes") returned 5
	[0049.721] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.blob") returned 0
	[0049.721] lstrlenA (lpString="*.blob") returned 6
	[0049.721] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.btc") returned 0
	[0049.721] lstrlenA (lpString="*.btc") returned 5
	[0049.721] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.wallet") returned 0
	[0049.721] lstrlenA (lpString="*.wallet") returned 8
	[0049.721] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x1, cFileName="BCD.LOG", cAlternateFileName="")) returned 1
	[0049.721] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0049.721] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="BCD.LOG") returned 1
	[0049.721] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="BCD.LOG") returned 1
	[0049.721] lstrcmpiA (lpString1="", lpString2="BCD.LOG") returned -1
	[0049.722] PathFindFileNameA (pszPath="C:\\Boot\\BCD") returned="BCD"
	[0049.722] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\"
	[0049.722] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned=""
	[0049.722] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.722] GetFileAttributesA (lpFileName="C:\\Boot\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\how-to-decrypt-files.htm")) returned 0x20
	[0049.722] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG" | out: lpString1="C:\\Boot\\BCD.LOG") returned="C:\\Boot\\BCD.LOG"
	[0049.722] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.zip") returned 0
	[0049.722] lstrlenA (lpString="*.zip") returned 5
	[0049.722] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.rar") returned 0
	[0049.722] lstrlenA (lpString="*.rar") returned 5
	[0049.722] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.7z") returned 0
	[0049.722] lstrlenA (lpString="*.7z") returned 4
	[0049.722] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.tar") returned 0
	[0049.722] lstrlenA (lpString="*.tar") returned 5
	[0049.722] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.gzip") returned 0
	[0049.722] lstrlenA (lpString="*.gzip") returned 6
	[0049.722] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.jpg") returned 0
	[0049.722] lstrlenA (lpString="*.jpg") returned 5
	[0049.722] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.jpeg") returned 0
	[0049.722] lstrlenA (lpString="*.jpeg") returned 6
	[0049.722] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.bmp") returned 0
	[0049.722] lstrlenA (lpString="*.bmp") returned 5
	[0049.722] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.gif") returned 0
	[0049.722] lstrlenA (lpString="*.gif") returned 5
	[0049.722] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.png") returned 0
	[0049.722] lstrlenA (lpString="*.png") returned 5
	[0049.722] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.doc") returned 0
	[0049.722] lstrlenA (lpString="*.doc") returned 5
	[0049.722] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.docx") returned 0
	[0049.722] lstrlenA (lpString="*.docx") returned 6
	[0049.723] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.xls") returned 0
	[0049.723] lstrlenA (lpString="*.xls") returned 5
	[0049.723] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.xlsx") returned 0
	[0049.723] lstrlenA (lpString="*.xlsx") returned 6
	[0049.723] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.ppt") returned 0
	[0049.723] lstrlenA (lpString="*.ppt") returned 5
	[0049.723] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.pptx") returned 0
	[0049.723] lstrlenA (lpString="*.pptx") returned 6
	[0049.723] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.txt") returned 0
	[0049.723] lstrlenA (lpString="*.txt") returned 5
	[0049.723] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.pdf") returned 0
	[0049.723] lstrlenA (lpString="*.pdf") returned 5
	[0049.723] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.htm") returned 0
	[0049.723] lstrlenA (lpString="*.htm") returned 5
	[0049.723] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.html") returned 0
	[0049.723] lstrlenA (lpString="*.html") returned 6
	[0049.723] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mdb") returned 0
	[0049.723] lstrlenA (lpString="*.mdb") returned 5
	[0049.723] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.pfx") returned 0
	[0049.723] lstrlenA (lpString="*.pfx") returned 5
	[0049.723] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.md") returned 0
	[0049.723] lstrlenA (lpString="*.md") returned 4
	[0049.723] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.lnk") returned 0
	[0049.723] lstrlenA (lpString="*.lnk") returned 5
	[0049.723] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.torrent") returned 0
	[0049.723] lstrlenA (lpString="*.torrent") returned 9
	[0049.723] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mov") returned 0
	[0049.723] lstrlenA (lpString="*.mov") returned 5
	[0049.723] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.3gp") returned 0
	[0049.723] lstrlenA (lpString="*.3gp") returned 5
	[0049.723] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mpeg") returned 0
	[0049.723] lstrlenA (lpString="*.mpeg") returned 6
	[0049.723] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mpg") returned 0
	[0049.723] lstrlenA (lpString="*.mpg") returned 5
	[0049.723] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.flv") returned 0
	[0049.724] lstrlenA (lpString="*.flv") returned 5
	[0049.724] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.avi") returned 0
	[0049.724] lstrlenA (lpString="*.avi") returned 5
	[0049.724] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mp4") returned 0
	[0049.724] lstrlenA (lpString="*.mp4") returned 5
	[0049.724] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.wmv") returned 0
	[0049.724] lstrlenA (lpString="*.wmv") returned 5
	[0049.724] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mkv") returned 0
	[0049.724] lstrlenA (lpString="*.mkv") returned 5
	[0049.724] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mp3") returned 0
	[0049.724] lstrlenA (lpString="*.mp3") returned 5
	[0049.724] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.wav") returned 0
	[0049.726] lstrlenA (lpString="*.wav") returned 5
	[0049.726] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.flac") returned 0
	[0049.726] lstrlenA (lpString="*.flac") returned 6
	[0049.726] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.wma") returned 0
	[0049.726] lstrlenA (lpString="*.wma") returned 5
	[0049.726] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.au3") returned 0
	[0049.727] lstrlenA (lpString="*.au3") returned 5
	[0049.727] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.ahk") returned 0
	[0049.727] lstrlenA (lpString="*.ahk") returned 5
	[0049.727] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.c") returned 0
	[0049.727] lstrlenA (lpString="*.c") returned 3
	[0049.727] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.cc") returned 0
	[0049.727] lstrlenA (lpString="*.cc") returned 4
	[0049.727] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.cpp") returned 0
	[0049.727] lstrlenA (lpString="*.cpp") returned 5
	[0049.727] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.cxx") returned 0
	[0049.727] lstrlenA (lpString="*.cxx") returned 5
	[0049.727] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.c++") returned 0
	[0049.727] lstrlenA (lpString="*.c++") returned 5
	[0049.727] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.cs") returned 0
	[0049.727] lstrlenA (lpString="*.cs") returned 4
	[0049.727] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.vb") returned 0
	[0049.727] lstrlenA (lpString="*.vb") returned 4
	[0049.727] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.bas") returned 0
	[0049.727] lstrlenA (lpString="*.bas") returned 5
	[0049.727] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.csproj") returned 0
	[0049.728] lstrlenA (lpString="*.csproj") returned 8
	[0049.728] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.vbproj") returned 0
	[0049.728] lstrlenA (lpString="*.vbproj") returned 8
	[0049.728] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.vcxproj") returned 0
	[0049.728] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.728] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.manifest") returned 0
	[0049.728] lstrlenA (lpString="*.manifest") returned 10
	[0049.728] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.php") returned 0
	[0049.728] lstrlenA (lpString="*.php") returned 5
	[0049.728] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.vbe") returned 0
	[0049.728] lstrlenA (lpString="*.vbe") returned 5
	[0049.728] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.vba") returned 0
	[0049.728] lstrlenA (lpString="*.vba") returned 5
	[0049.728] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.vbs") returned 0
	[0049.728] lstrlenA (lpString="*.vbs") returned 5
	[0049.728] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.bat") returned 0
	[0049.728] lstrlenA (lpString="*.bat") returned 5
	[0049.728] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.cmd") returned 0
	[0049.728] lstrlenA (lpString="*.cmd") returned 5
	[0049.728] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.js") returned 0
	[0049.728] lstrlenA (lpString="*.js") returned 4
	[0049.728] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.jscript") returned 0
	[0049.728] lstrlenA (lpString="*.jscript") returned 9
	[0049.728] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.hta") returned 0
	[0049.728] lstrlenA (lpString="*.hta") returned 5
	[0049.728] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.php7") returned 0
	[0049.728] lstrlenA (lpString="*.php7") returned 6
	[0049.728] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.db") returned 0
	[0049.728] lstrlenA (lpString="*.db") returned 4
	[0049.728] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.swf") returned 0
	[0049.728] lstrlenA (lpString="*.swf") returned 5
	[0049.728] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.eml") returned 0
	[0049.728] lstrlenA (lpString="*.eml") returned 5
	[0049.728] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.part") returned 0
	[0049.728] lstrlenA (lpString="*.part") returned 6
	[0049.729] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.nfo") returned 0
	[0049.729] lstrlenA (lpString="*.nfo") returned 5
	[0049.729] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.rsa") returned 0
	[0049.729] lstrlenA (lpString="*.rsa") returned 5
	[0049.729] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.key") returned 0
	[0049.729] lstrlenA (lpString="*.key") returned 5
	[0049.729] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.aes") returned 0
	[0049.729] lstrlenA (lpString="*.aes") returned 5
	[0049.729] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.blob") returned 0
	[0049.729] lstrlenA (lpString="*.blob") returned 6
	[0049.729] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.btc") returned 0
	[0049.729] lstrlenA (lpString="*.btc") returned 5
	[0049.729] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.wallet") returned 0
	[0049.729] lstrlenA (lpString="*.wallet") returned 8
	[0049.729] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1
	[0049.729] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0049.729] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="BCD.LOG1") returned 1
	[0049.729] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="BCD.LOG1") returned 1
	[0049.729] lstrcmpiA (lpString1="", lpString2="BCD.LOG1") returned -1
	[0049.729] PathFindFileNameA (pszPath="C:\\Boot\\BCD.LOG") returned="BCD.LOG"
	[0049.729] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\"
	[0049.729] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned=""
	[0049.729] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.729] GetFileAttributesA (lpFileName="C:\\Boot\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\how-to-decrypt-files.htm")) returned 0x20
	[0049.729] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG1" | out: lpString1="C:\\Boot\\BCD.LOG1") returned="C:\\Boot\\BCD.LOG1"
	[0049.729] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.zip") returned 0
	[0049.729] lstrlenA (lpString="*.zip") returned 5
	[0049.729] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.rar") returned 0
	[0049.729] lstrlenA (lpString="*.rar") returned 5
	[0049.729] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.7z") returned 0
	[0049.729] lstrlenA (lpString="*.7z") returned 4
	[0049.729] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.tar") returned 0
	[0049.730] lstrlenA (lpString="*.tar") returned 5
	[0049.730] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.gzip") returned 0
	[0049.730] lstrlenA (lpString="*.gzip") returned 6
	[0049.730] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.jpg") returned 0
	[0049.730] lstrlenA (lpString="*.jpg") returned 5
	[0049.730] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.jpeg") returned 0
	[0049.730] lstrlenA (lpString="*.jpeg") returned 6
	[0049.730] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.bmp") returned 0
	[0049.730] lstrlenA (lpString="*.bmp") returned 5
	[0049.730] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.gif") returned 0
	[0049.730] lstrlenA (lpString="*.gif") returned 5
	[0049.730] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.png") returned 0
	[0049.730] lstrlenA (lpString="*.png") returned 5
	[0049.730] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.doc") returned 0
	[0049.730] lstrlenA (lpString="*.doc") returned 5
	[0049.730] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.docx") returned 0
	[0049.730] lstrlenA (lpString="*.docx") returned 6
	[0049.730] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.xls") returned 0
	[0049.730] lstrlenA (lpString="*.xls") returned 5
	[0049.730] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.xlsx") returned 0
	[0049.730] lstrlenA (lpString="*.xlsx") returned 6
	[0049.730] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.ppt") returned 0
	[0049.730] lstrlenA (lpString="*.ppt") returned 5
	[0049.730] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.pptx") returned 0
	[0049.730] lstrlenA (lpString="*.pptx") returned 6
	[0049.730] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.txt") returned 0
	[0049.730] lstrlenA (lpString="*.txt") returned 5
	[0049.730] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.pdf") returned 0
	[0049.730] lstrlenA (lpString="*.pdf") returned 5
	[0049.730] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.htm") returned 0
	[0049.730] lstrlenA (lpString="*.htm") returned 5
	[0049.730] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.html") returned 0
	[0049.730] lstrlenA (lpString="*.html") returned 6
	[0049.730] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mdb") returned 0
	[0049.730] lstrlenA (lpString="*.mdb") returned 5
	[0049.731] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.pfx") returned 0
	[0049.731] lstrlenA (lpString="*.pfx") returned 5
	[0049.731] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.md") returned 0
	[0049.731] lstrlenA (lpString="*.md") returned 4
	[0049.731] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.lnk") returned 0
	[0049.731] lstrlenA (lpString="*.lnk") returned 5
	[0049.731] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.torrent") returned 0
	[0049.731] lstrlenA (lpString="*.torrent") returned 9
	[0049.731] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mov") returned 0
	[0049.731] lstrlenA (lpString="*.mov") returned 5
	[0049.731] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.3gp") returned 0
	[0049.731] lstrlenA (lpString="*.3gp") returned 5
	[0049.731] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mpeg") returned 0
	[0049.731] lstrlenA (lpString="*.mpeg") returned 6
	[0049.731] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mpg") returned 0
	[0049.731] lstrlenA (lpString="*.mpg") returned 5
	[0049.731] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.flv") returned 0
	[0049.731] lstrlenA (lpString="*.flv") returned 5
	[0049.731] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.avi") returned 0
	[0049.731] lstrlenA (lpString="*.avi") returned 5
	[0049.731] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mp4") returned 0
	[0049.731] lstrlenA (lpString="*.mp4") returned 5
	[0049.731] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.wmv") returned 0
	[0049.731] lstrlenA (lpString="*.wmv") returned 5
	[0049.731] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mkv") returned 0
	[0049.731] lstrlenA (lpString="*.mkv") returned 5
	[0049.731] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mp3") returned 0
	[0049.731] lstrlenA (lpString="*.mp3") returned 5
	[0049.731] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.wav") returned 0
	[0049.731] lstrlenA (lpString="*.wav") returned 5
	[0049.731] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.flac") returned 0
	[0049.731] lstrlenA (lpString="*.flac") returned 6
	[0049.731] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.wma") returned 0
	[0049.731] lstrlenA (lpString="*.wma") returned 5
	[0049.731] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.au3") returned 0
	[0049.732] lstrlenA (lpString="*.au3") returned 5
	[0049.732] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.ahk") returned 0
	[0049.732] lstrlenA (lpString="*.ahk") returned 5
	[0049.732] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.c") returned 0
	[0049.732] lstrlenA (lpString="*.c") returned 3
	[0049.732] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.cc") returned 0
	[0049.732] lstrlenA (lpString="*.cc") returned 4
	[0049.732] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.cpp") returned 0
	[0049.732] lstrlenA (lpString="*.cpp") returned 5
	[0049.732] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.cxx") returned 0
	[0049.732] lstrlenA (lpString="*.cxx") returned 5
	[0049.732] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.c++") returned 0
	[0049.732] lstrlenA (lpString="*.c++") returned 5
	[0049.732] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.cs") returned 0
	[0049.732] lstrlenA (lpString="*.cs") returned 4
	[0049.732] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.vb") returned 0
	[0049.732] lstrlenA (lpString="*.vb") returned 4
	[0049.732] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.bas") returned 0
	[0049.732] lstrlenA (lpString="*.bas") returned 5
	[0049.732] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.csproj") returned 0
	[0049.732] lstrlenA (lpString="*.csproj") returned 8
	[0049.732] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.vbproj") returned 0
	[0049.732] lstrlenA (lpString="*.vbproj") returned 8
	[0049.732] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.vcxproj") returned 0
	[0049.732] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.732] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.manifest") returned 0
	[0049.732] lstrlenA (lpString="*.manifest") returned 10
	[0049.732] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.php") returned 0
	[0049.732] lstrlenA (lpString="*.php") returned 5
	[0049.732] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.vbe") returned 0
	[0049.732] lstrlenA (lpString="*.vbe") returned 5
	[0049.732] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.vba") returned 0
	[0049.732] lstrlenA (lpString="*.vba") returned 5
	[0049.732] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.vbs") returned 0
	[0049.732] lstrlenA (lpString="*.vbs") returned 5
	[0049.733] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.bat") returned 0
	[0049.733] lstrlenA (lpString="*.bat") returned 5
	[0049.733] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.cmd") returned 0
	[0049.733] lstrlenA (lpString="*.cmd") returned 5
	[0049.733] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.js") returned 0
	[0049.733] lstrlenA (lpString="*.js") returned 4
	[0049.733] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.jscript") returned 0
	[0049.733] lstrlenA (lpString="*.jscript") returned 9
	[0049.733] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.hta") returned 0
	[0049.733] lstrlenA (lpString="*.hta") returned 5
	[0049.733] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.php7") returned 0
	[0049.733] lstrlenA (lpString="*.php7") returned 6
	[0049.733] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.db") returned 0
	[0049.733] lstrlenA (lpString="*.db") returned 4
	[0049.733] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.swf") returned 0
	[0049.733] lstrlenA (lpString="*.swf") returned 5
	[0049.733] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.eml") returned 0
	[0049.733] lstrlenA (lpString="*.eml") returned 5
	[0049.733] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.part") returned 0
	[0049.733] lstrlenA (lpString="*.part") returned 6
	[0049.733] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.nfo") returned 0
	[0049.733] lstrlenA (lpString="*.nfo") returned 5
	[0049.733] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.rsa") returned 0
	[0049.733] lstrlenA (lpString="*.rsa") returned 5
	[0049.733] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.key") returned 0
	[0049.733] lstrlenA (lpString="*.key") returned 5
	[0049.733] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.aes") returned 0
	[0049.733] lstrlenA (lpString="*.aes") returned 5
	[0049.733] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.blob") returned 0
	[0049.733] lstrlenA (lpString="*.blob") returned 6
	[0049.733] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.btc") returned 0
	[0049.733] lstrlenA (lpString="*.btc") returned 5
	[0049.733] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.wallet") returned 0
	[0049.733] lstrlenA (lpString="*.wallet") returned 8
	[0049.733] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1
	[0049.733] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0049.734] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="BCD.LOG2") returned 1
	[0049.734] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="BCD.LOG2") returned 1
	[0049.734] lstrcmpiA (lpString1="", lpString2="BCD.LOG2") returned -1
	[0049.734] PathFindFileNameA (pszPath="C:\\Boot\\BCD.LOG1") returned="BCD.LOG1"
	[0049.734] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\"
	[0049.734] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned=""
	[0049.734] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.734] GetFileAttributesA (lpFileName="C:\\Boot\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\how-to-decrypt-files.htm")) returned 0x20
	[0049.734] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG2" | out: lpString1="C:\\Boot\\BCD.LOG2") returned="C:\\Boot\\BCD.LOG2"
	[0049.734] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.zip") returned 0
	[0049.734] lstrlenA (lpString="*.zip") returned 5
	[0049.734] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.rar") returned 0
	[0049.734] lstrlenA (lpString="*.rar") returned 5
	[0049.734] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.7z") returned 0
	[0049.734] lstrlenA (lpString="*.7z") returned 4
	[0049.734] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.tar") returned 0
	[0049.734] lstrlenA (lpString="*.tar") returned 5
	[0049.734] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.gzip") returned 0
	[0049.734] lstrlenA (lpString="*.gzip") returned 6
	[0049.734] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.jpg") returned 0
	[0049.734] lstrlenA (lpString="*.jpg") returned 5
	[0049.734] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.jpeg") returned 0
	[0049.734] lstrlenA (lpString="*.jpeg") returned 6
	[0049.734] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.bmp") returned 0
	[0049.734] lstrlenA (lpString="*.bmp") returned 5
	[0049.734] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.gif") returned 0
	[0049.734] lstrlenA (lpString="*.gif") returned 5
	[0049.734] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.png") returned 0
	[0049.734] lstrlenA (lpString="*.png") returned 5
	[0049.734] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.doc") returned 0
	[0049.734] lstrlenA (lpString="*.doc") returned 5
	[0049.734] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.docx") returned 0
	[0049.735] lstrlenA (lpString="*.docx") returned 6
	[0049.735] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.xls") returned 0
	[0049.735] lstrlenA (lpString="*.xls") returned 5
	[0049.735] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.xlsx") returned 0
	[0049.735] lstrlenA (lpString="*.xlsx") returned 6
	[0049.735] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.ppt") returned 0
	[0049.735] lstrlenA (lpString="*.ppt") returned 5
	[0049.735] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.pptx") returned 0
	[0049.735] lstrlenA (lpString="*.pptx") returned 6
	[0049.735] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.txt") returned 0
	[0049.735] lstrlenA (lpString="*.txt") returned 5
	[0049.735] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.pdf") returned 0
	[0049.735] lstrlenA (lpString="*.pdf") returned 5
	[0049.735] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.htm") returned 0
	[0049.735] lstrlenA (lpString="*.htm") returned 5
	[0049.735] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.html") returned 0
	[0049.735] lstrlenA (lpString="*.html") returned 6
	[0049.735] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mdb") returned 0
	[0049.735] lstrlenA (lpString="*.mdb") returned 5
	[0049.735] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.pfx") returned 0
	[0049.735] lstrlenA (lpString="*.pfx") returned 5
	[0049.735] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.md") returned 0
	[0049.735] lstrlenA (lpString="*.md") returned 4
	[0049.735] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.lnk") returned 0
	[0049.735] lstrlenA (lpString="*.lnk") returned 5
	[0049.735] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.torrent") returned 0
	[0049.735] lstrlenA (lpString="*.torrent") returned 9
	[0049.735] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mov") returned 0
	[0049.735] lstrlenA (lpString="*.mov") returned 5
	[0049.735] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.3gp") returned 0
	[0049.735] lstrlenA (lpString="*.3gp") returned 5
	[0049.735] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mpeg") returned 0
	[0049.735] lstrlenA (lpString="*.mpeg") returned 6
	[0049.735] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mpg") returned 0
	[0049.735] lstrlenA (lpString="*.mpg") returned 5
	[0049.736] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.flv") returned 0
	[0049.736] lstrlenA (lpString="*.flv") returned 5
	[0049.736] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.avi") returned 0
	[0049.736] lstrlenA (lpString="*.avi") returned 5
	[0049.736] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mp4") returned 0
	[0049.736] lstrlenA (lpString="*.mp4") returned 5
	[0049.736] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.wmv") returned 0
	[0049.736] lstrlenA (lpString="*.wmv") returned 5
	[0049.736] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mkv") returned 0
	[0049.736] lstrlenA (lpString="*.mkv") returned 5
	[0049.736] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mp3") returned 0
	[0049.736] lstrlenA (lpString="*.mp3") returned 5
	[0049.736] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.wav") returned 0
	[0049.736] lstrlenA (lpString="*.wav") returned 5
	[0049.736] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.flac") returned 0
	[0049.736] lstrlenA (lpString="*.flac") returned 6
	[0049.736] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.wma") returned 0
	[0049.736] lstrlenA (lpString="*.wma") returned 5
	[0049.736] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.au3") returned 0
	[0049.736] lstrlenA (lpString="*.au3") returned 5
	[0049.736] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.ahk") returned 0
	[0049.736] lstrlenA (lpString="*.ahk") returned 5
	[0049.736] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.c") returned 0
	[0049.736] lstrlenA (lpString="*.c") returned 3
	[0049.736] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.cc") returned 0
	[0049.736] lstrlenA (lpString="*.cc") returned 4
	[0049.736] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.cpp") returned 0
	[0049.736] lstrlenA (lpString="*.cpp") returned 5
	[0049.736] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.cxx") returned 0
	[0049.736] lstrlenA (lpString="*.cxx") returned 5
	[0049.736] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.c++") returned 0
	[0049.736] lstrlenA (lpString="*.c++") returned 5
	[0049.736] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.cs") returned 0
	[0049.736] lstrlenA (lpString="*.cs") returned 4
	[0049.736] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.vb") returned 0
	[0049.736] lstrlenA (lpString="*.vb") returned 4
	[0049.737] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.bas") returned 0
	[0049.737] lstrlenA (lpString="*.bas") returned 5
	[0049.737] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.csproj") returned 0
	[0049.737] lstrlenA (lpString="*.csproj") returned 8
	[0049.737] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.vbproj") returned 0
	[0049.737] lstrlenA (lpString="*.vbproj") returned 8
	[0049.737] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.vcxproj") returned 0
	[0049.737] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.737] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.manifest") returned 0
	[0049.737] lstrlenA (lpString="*.manifest") returned 10
	[0049.737] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.php") returned 0
	[0049.737] lstrlenA (lpString="*.php") returned 5
	[0049.737] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.vbe") returned 0
	[0049.737] lstrlenA (lpString="*.vbe") returned 5
	[0049.737] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.vba") returned 0
	[0049.737] lstrlenA (lpString="*.vba") returned 5
	[0049.737] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.vbs") returned 0
	[0049.737] lstrlenA (lpString="*.vbs") returned 5
	[0049.737] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.bat") returned 0
	[0049.737] lstrlenA (lpString="*.bat") returned 5
	[0049.737] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.cmd") returned 0
	[0049.737] lstrlenA (lpString="*.cmd") returned 5
	[0049.737] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.js") returned 0
	[0049.737] lstrlenA (lpString="*.js") returned 4
	[0049.737] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.jscript") returned 0
	[0049.737] lstrlenA (lpString="*.jscript") returned 9
	[0049.737] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.hta") returned 0
	[0049.737] lstrlenA (lpString="*.hta") returned 5
	[0049.737] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.php7") returned 0
	[0049.737] lstrlenA (lpString="*.php7") returned 6
	[0049.737] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.db") returned 0
	[0049.737] lstrlenA (lpString="*.db") returned 4
	[0049.737] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.swf") returned 0
	[0049.737] lstrlenA (lpString="*.swf") returned 5
	[0049.737] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.eml") returned 0
	[0049.737] lstrlenA (lpString="*.eml") returned 5
	[0049.737] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.part") returned 0
	[0049.738] lstrlenA (lpString="*.part") returned 6
	[0049.738] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.nfo") returned 0
	[0049.738] lstrlenA (lpString="*.nfo") returned 5
	[0049.738] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.rsa") returned 0
	[0049.738] lstrlenA (lpString="*.rsa") returned 5
	[0049.738] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.key") returned 0
	[0049.738] lstrlenA (lpString="*.key") returned 5
	[0049.738] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.aes") returned 0
	[0049.738] lstrlenA (lpString="*.aes") returned 5
	[0049.738] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.blob") returned 0
	[0049.738] lstrlenA (lpString="*.blob") returned 6
	[0049.738] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.btc") returned 0
	[0049.738] lstrlenA (lpString="*.btc") returned 5
	[0049.738] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.wallet") returned 0
	[0049.738] lstrlenA (lpString="*.wallet") returned 8
	[0049.738] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1
	[0049.738] lstrcmpA (lpString1=".", lpString2="bg-BG") returned -1
	[0049.738] lstrcmpA (lpString1="..", lpString2="bg-BG") returned -1
	[0049.738] PathFindFileNameA (pszPath="C:\\Boot\\BCD.LOG2") returned="BCD.LOG2"
	[0049.738] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="bg-BG" | out: lpString1="C:\\Boot\\bg-BG") returned="C:\\Boot\\bg-BG"
	[0049.738] lstrlenA (lpString="C:\\Boot\\bg-BG") returned 13
	[0049.738] FindFirstFileA (in: lpFileName="C:\\Boot\\bg-BG\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x58, cFileName=".", cAlternateFileName="")) returned 0x7cbad0
	[0049.738] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0049.738] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x58, cFileName="..", cAlternateFileName="")) returned 1
	[0049.739] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0049.739] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0049.739] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x7b0000, dwReserved1=0x58, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0049.739] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.739] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr.exe.mui") returned 1
	[0049.739] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr.exe.mui") returned 1
	[0049.739] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0049.739] PathFindFileNameA (pszPath="C:\\Boot\\bg-BG\\*.*") returned="*.*"
	[0049.739] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\bg-BG\\" | out: lpString1="C:\\Boot\\bg-BG\\") returned="C:\\Boot\\bg-BG\\"
	[0049.739] PathAddBackslashA (in: pszPath="C:\\Boot\\bg-BG\\" | out: pszPath="C:\\Boot\\bg-BG\\") returned=""
	[0049.739] lstrcatA (in: lpString1="C:\\Boot\\bg-BG\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\bg-BG\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\bg-BG\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.739] GetFileAttributesA (lpFileName="C:\\Boot\\bg-BG\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\bg-bg\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0049.739] CreateFileA (lpFileName="C:\\Boot\\bg-BG\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\bg-bg\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0049.739] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0049.739] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0049.741] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0049.741] CloseHandle (hObject=0x208) returned 1
	[0049.741] lstrcatA (in: lpString1="C:\\Boot\\bg-BG\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned="C:\\Boot\\bg-BG\\bootmgr.exe.mui"
	[0049.741] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0049.741] lstrlenA (lpString="*.zip") returned 5
	[0049.741] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0049.741] lstrlenA (lpString="*.rar") returned 5
	[0049.741] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0049.741] lstrlenA (lpString="*.7z") returned 4
	[0049.741] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0049.741] lstrlenA (lpString="*.tar") returned 5
	[0049.741] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0049.741] lstrlenA (lpString="*.gzip") returned 6
	[0049.741] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0049.741] lstrlenA (lpString="*.jpg") returned 5
	[0049.741] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0049.741] lstrlenA (lpString="*.jpeg") returned 6
	[0049.741] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0049.741] lstrlenA (lpString="*.bmp") returned 5
	[0049.741] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0049.741] lstrlenA (lpString="*.gif") returned 5
	[0049.741] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0049.742] lstrlenA (lpString="*.png") returned 5
	[0049.742] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0049.742] lstrlenA (lpString="*.doc") returned 5
	[0049.742] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0049.742] lstrlenA (lpString="*.docx") returned 6
	[0049.742] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0049.742] lstrlenA (lpString="*.xls") returned 5
	[0049.742] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0049.742] lstrlenA (lpString="*.xlsx") returned 6
	[0049.742] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0049.742] lstrlenA (lpString="*.ppt") returned 5
	[0049.742] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0049.742] lstrlenA (lpString="*.pptx") returned 6
	[0049.742] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0049.742] lstrlenA (lpString="*.txt") returned 5
	[0049.742] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0049.742] lstrlenA (lpString="*.pdf") returned 5
	[0049.742] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0049.742] lstrlenA (lpString="*.htm") returned 5
	[0049.742] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0049.742] lstrlenA (lpString="*.html") returned 6
	[0049.742] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0049.742] lstrlenA (lpString="*.mdb") returned 5
	[0049.742] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0049.742] lstrlenA (lpString="*.pfx") returned 5
	[0049.742] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0049.742] lstrlenA (lpString="*.md") returned 4
	[0049.742] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0049.742] lstrlenA (lpString="*.lnk") returned 5
	[0049.742] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0049.742] lstrlenA (lpString="*.torrent") returned 9
	[0049.742] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0049.742] lstrlenA (lpString="*.mov") returned 5
	[0049.742] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0049.742] lstrlenA (lpString="*.3gp") returned 5
	[0049.743] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0049.743] lstrlenA (lpString="*.mpeg") returned 6
	[0049.743] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0049.743] lstrlenA (lpString="*.mpg") returned 5
	[0049.743] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0049.743] lstrlenA (lpString="*.flv") returned 5
	[0049.743] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0049.743] lstrlenA (lpString="*.avi") returned 5
	[0049.743] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0049.743] lstrlenA (lpString="*.mp4") returned 5
	[0049.743] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0049.743] lstrlenA (lpString="*.wmv") returned 5
	[0049.743] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0049.743] lstrlenA (lpString="*.mkv") returned 5
	[0049.743] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0049.743] lstrlenA (lpString="*.mp3") returned 5
	[0049.743] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0049.743] lstrlenA (lpString="*.wav") returned 5
	[0049.743] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0049.743] lstrlenA (lpString="*.flac") returned 6
	[0049.743] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0049.743] lstrlenA (lpString="*.wma") returned 5
	[0049.743] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.au3") returned 0
	[0049.743] lstrlenA (lpString="*.au3") returned 5
	[0049.743] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.ahk") returned 0
	[0049.743] lstrlenA (lpString="*.ahk") returned 5
	[0049.743] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.c") returned 0
	[0049.743] lstrlenA (lpString="*.c") returned 3
	[0049.743] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.cc") returned 0
	[0049.743] lstrlenA (lpString="*.cc") returned 4
	[0049.743] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0
	[0049.743] lstrlenA (lpString="*.cpp") returned 5
	[0049.743] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.cxx") returned 0
	[0049.744] lstrlenA (lpString="*.cxx") returned 5
	[0049.744] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.c++") returned 0
	[0049.744] lstrlenA (lpString="*.c++") returned 5
	[0049.744] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.cs") returned 0
	[0049.744] lstrlenA (lpString="*.cs") returned 4
	[0049.744] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.vb") returned 0
	[0049.744] lstrlenA (lpString="*.vb") returned 4
	[0049.744] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.bas") returned 0
	[0049.744] lstrlenA (lpString="*.bas") returned 5
	[0049.744] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.csproj") returned 0
	[0049.744] lstrlenA (lpString="*.csproj") returned 8
	[0049.744] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.vbproj") returned 0
	[0049.744] lstrlenA (lpString="*.vbproj") returned 8
	[0049.744] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.vcxproj") returned 0
	[0049.744] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.744] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.manifest") returned 0
	[0049.744] lstrlenA (lpString="*.manifest") returned 10
	[0049.744] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.php") returned 0
	[0049.744] lstrlenA (lpString="*.php") returned 5
	[0049.744] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.vbe") returned 0
	[0049.744] lstrlenA (lpString="*.vbe") returned 5
	[0049.744] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.vba") returned 0
	[0049.744] lstrlenA (lpString="*.vba") returned 5
	[0049.744] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.vbs") returned 0
	[0049.744] lstrlenA (lpString="*.vbs") returned 5
	[0049.744] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.bat") returned 0
	[0049.744] lstrlenA (lpString="*.bat") returned 5
	[0049.744] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.cmd") returned 0
	[0049.744] lstrlenA (lpString="*.cmd") returned 5
	[0049.744] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.js") returned 0
	[0049.744] lstrlenA (lpString="*.js") returned 4
	[0049.744] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.jscript") returned 0
	[0049.744] lstrlenA (lpString="*.jscript") returned 9
	[0049.744] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.hta") returned 0
	[0049.744] lstrlenA (lpString="*.hta") returned 5
	[0049.744] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.php7") returned 0
	[0049.745] lstrlenA (lpString="*.php7") returned 6
	[0049.745] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.db") returned 0
	[0049.745] lstrlenA (lpString="*.db") returned 4
	[0049.745] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.swf") returned 0
	[0049.745] lstrlenA (lpString="*.swf") returned 5
	[0049.745] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.eml") returned 0
	[0049.745] lstrlenA (lpString="*.eml") returned 5
	[0049.745] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.part") returned 0
	[0049.745] lstrlenA (lpString="*.part") returned 6
	[0049.745] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.nfo") returned 0
	[0049.745] lstrlenA (lpString="*.nfo") returned 5
	[0049.745] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.rsa") returned 0
	[0049.745] lstrlenA (lpString="*.rsa") returned 5
	[0049.745] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.key") returned 0
	[0049.745] lstrlenA (lpString="*.key") returned 5
	[0049.745] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.aes") returned 0
	[0049.745] lstrlenA (lpString="*.aes") returned 5
	[0049.745] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.blob") returned 0
	[0049.745] lstrlenA (lpString="*.blob") returned 6
	[0049.745] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.btc") returned 0
	[0049.745] lstrlenA (lpString="*.btc") returned 5
	[0049.745] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.wallet") returned 0
	[0049.745] lstrlenA (lpString="*.wallet") returned 8
	[0049.745] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x7b0000, dwReserved1=0x58, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0049.745] FindClose (in: hFindFile=0x7cbad0 | out: hFindFile=0x7cbad0) returned 1
	[0049.745] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x7d2548, dwReserved1=0x7b00c0, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1
	[0049.745] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0049.745] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootspaces.dll") returned 1
	[0049.745] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootspaces.dll") returned 1
	[0049.745] lstrcmpiA (lpString1="", lpString2="bootspaces.dll") returned -1
	[0049.745] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0049.745] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\"
	[0049.746] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned=""
	[0049.746] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.746] GetFileAttributesA (lpFileName="C:\\Boot\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\how-to-decrypt-files.htm")) returned 0x20
	[0049.746] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="bootspaces.dll" | out: lpString1="C:\\Boot\\bootspaces.dll") returned="C:\\Boot\\bootspaces.dll"
	[0049.746] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.zip") returned 0
	[0049.746] lstrlenA (lpString="*.zip") returned 5
	[0049.746] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.rar") returned 0
	[0049.746] lstrlenA (lpString="*.rar") returned 5
	[0049.746] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.7z") returned 0
	[0049.746] lstrlenA (lpString="*.7z") returned 4
	[0049.746] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.tar") returned 0
	[0049.746] lstrlenA (lpString="*.tar") returned 5
	[0049.746] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.gzip") returned 0
	[0049.746] lstrlenA (lpString="*.gzip") returned 6
	[0049.746] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.jpg") returned 0
	[0049.746] lstrlenA (lpString="*.jpg") returned 5
	[0049.746] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.jpeg") returned 0
	[0049.746] lstrlenA (lpString="*.jpeg") returned 6
	[0049.746] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.bmp") returned 0
	[0049.746] lstrlenA (lpString="*.bmp") returned 5
	[0049.746] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.gif") returned 0
	[0049.746] lstrlenA (lpString="*.gif") returned 5
	[0049.746] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.png") returned 0
	[0049.746] lstrlenA (lpString="*.png") returned 5
	[0049.746] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.doc") returned 0
	[0049.746] lstrlenA (lpString="*.doc") returned 5
	[0049.746] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.docx") returned 0
	[0049.746] lstrlenA (lpString="*.docx") returned 6
	[0049.746] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.xls") returned 0
	[0049.746] lstrlenA (lpString="*.xls") returned 5
	[0049.746] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.xlsx") returned 0
	[0049.747] lstrlenA (lpString="*.xlsx") returned 6
	[0049.747] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.ppt") returned 0
	[0049.747] lstrlenA (lpString="*.ppt") returned 5
	[0049.747] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.pptx") returned 0
	[0049.747] lstrlenA (lpString="*.pptx") returned 6
	[0049.747] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.txt") returned 0
	[0049.747] lstrlenA (lpString="*.txt") returned 5
	[0049.747] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.pdf") returned 0
	[0049.747] lstrlenA (lpString="*.pdf") returned 5
	[0049.747] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.htm") returned 0
	[0049.747] lstrlenA (lpString="*.htm") returned 5
	[0049.747] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.html") returned 0
	[0049.747] lstrlenA (lpString="*.html") returned 6
	[0049.747] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.mdb") returned 0
	[0049.747] lstrlenA (lpString="*.mdb") returned 5
	[0049.747] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.pfx") returned 0
	[0049.747] lstrlenA (lpString="*.pfx") returned 5
	[0049.747] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.md") returned 0
	[0049.747] lstrlenA (lpString="*.md") returned 4
	[0049.747] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.lnk") returned 0
	[0049.747] lstrlenA (lpString="*.lnk") returned 5
	[0049.747] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.torrent") returned 0
	[0049.747] lstrlenA (lpString="*.torrent") returned 9
	[0049.747] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.mov") returned 0
	[0049.747] lstrlenA (lpString="*.mov") returned 5
	[0049.747] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.3gp") returned 0
	[0049.747] lstrlenA (lpString="*.3gp") returned 5
	[0049.747] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.mpeg") returned 0
	[0049.747] lstrlenA (lpString="*.mpeg") returned 6
	[0049.747] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.mpg") returned 0
	[0049.747] lstrlenA (lpString="*.mpg") returned 5
	[0049.747] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.flv") returned 0
	[0049.747] lstrlenA (lpString="*.flv") returned 5
	[0049.747] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.avi") returned 0
	[0049.747] lstrlenA (lpString="*.avi") returned 5
	[0049.747] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.mp4") returned 0
	[0049.748] lstrlenA (lpString="*.mp4") returned 5
	[0049.748] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.wmv") returned 0
	[0049.748] lstrlenA (lpString="*.wmv") returned 5
	[0049.748] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.mkv") returned 0
	[0049.748] lstrlenA (lpString="*.mkv") returned 5
	[0049.748] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.mp3") returned 0
	[0049.748] lstrlenA (lpString="*.mp3") returned 5
	[0049.748] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.wav") returned 0
	[0049.748] lstrlenA (lpString="*.wav") returned 5
	[0049.748] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.flac") returned 0
	[0049.748] lstrlenA (lpString="*.flac") returned 6
	[0049.748] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.wma") returned 0
	[0049.748] lstrlenA (lpString="*.wma") returned 5
	[0049.748] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.au3") returned 0
	[0049.748] lstrlenA (lpString="*.au3") returned 5
	[0049.748] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.ahk") returned 0
	[0049.748] lstrlenA (lpString="*.ahk") returned 5
	[0049.748] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.c") returned 0
	[0049.748] lstrlenA (lpString="*.c") returned 3
	[0049.748] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.cc") returned 0
	[0049.748] lstrlenA (lpString="*.cc") returned 4
	[0049.748] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.cpp") returned 0
	[0049.748] lstrlenA (lpString="*.cpp") returned 5
	[0049.748] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.cxx") returned 0
	[0049.748] lstrlenA (lpString="*.cxx") returned 5
	[0049.748] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.c++") returned 0
	[0049.748] lstrlenA (lpString="*.c++") returned 5
	[0049.748] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.cs") returned 0
	[0049.748] lstrlenA (lpString="*.cs") returned 4
	[0049.748] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.vb") returned 0
	[0049.748] lstrlenA (lpString="*.vb") returned 4
	[0049.748] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.bas") returned 0
	[0049.748] lstrlenA (lpString="*.bas") returned 5
	[0049.748] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.csproj") returned 0
	[0049.748] lstrlenA (lpString="*.csproj") returned 8
	[0049.749] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.vbproj") returned 0
	[0049.749] lstrlenA (lpString="*.vbproj") returned 8
	[0049.749] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.vcxproj") returned 0
	[0049.749] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.749] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.manifest") returned 0
	[0049.749] lstrlenA (lpString="*.manifest") returned 10
	[0049.749] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.php") returned 0
	[0049.749] lstrlenA (lpString="*.php") returned 5
	[0049.749] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.vbe") returned 0
	[0049.749] lstrlenA (lpString="*.vbe") returned 5
	[0049.749] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.vba") returned 0
	[0049.749] lstrlenA (lpString="*.vba") returned 5
	[0049.749] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.vbs") returned 0
	[0049.749] lstrlenA (lpString="*.vbs") returned 5
	[0049.749] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.bat") returned 0
	[0049.749] lstrlenA (lpString="*.bat") returned 5
	[0049.749] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.cmd") returned 0
	[0049.749] lstrlenA (lpString="*.cmd") returned 5
	[0049.749] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.js") returned 0
	[0049.749] lstrlenA (lpString="*.js") returned 4
	[0049.749] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.jscript") returned 0
	[0049.749] lstrlenA (lpString="*.jscript") returned 9
	[0049.749] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.hta") returned 0
	[0049.749] lstrlenA (lpString="*.hta") returned 5
	[0049.749] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.php7") returned 0
	[0049.749] lstrlenA (lpString="*.php7") returned 6
	[0049.749] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.db") returned 0
	[0049.749] lstrlenA (lpString="*.db") returned 4
	[0049.749] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.swf") returned 0
	[0049.749] lstrlenA (lpString="*.swf") returned 5
	[0049.749] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.eml") returned 0
	[0049.749] lstrlenA (lpString="*.eml") returned 5
	[0049.749] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.part") returned 0
	[0049.749] lstrlenA (lpString="*.part") returned 6
	[0049.749] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.nfo") returned 0
	[0049.749] lstrlenA (lpString="*.nfo") returned 5
	[0049.750] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.rsa") returned 0
	[0049.750] lstrlenA (lpString="*.rsa") returned 5
	[0049.750] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.key") returned 0
	[0049.750] lstrlenA (lpString="*.key") returned 5
	[0049.750] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.aes") returned 0
	[0049.750] lstrlenA (lpString="*.aes") returned 5
	[0049.750] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.blob") returned 0
	[0049.750] lstrlenA (lpString="*.blob") returned 6
	[0049.750] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.btc") returned 0
	[0049.750] lstrlenA (lpString="*.btc") returned 5
	[0049.750] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.wallet") returned 0
	[0049.750] lstrlenA (lpString="*.wallet") returned 8
	[0049.750] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xef703e94, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1
	[0049.750] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0049.750] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="BOOTSTAT.DAT") returned 1
	[0049.750] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="BOOTSTAT.DAT") returned 1
	[0049.750] lstrcmpiA (lpString1="", lpString2="BOOTSTAT.DAT") returned -1
	[0049.750] PathFindFileNameA (pszPath="C:\\Boot\\bootspaces.dll") returned="bootspaces.dll"
	[0049.750] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\"
	[0049.750] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned=""
	[0049.750] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.750] GetFileAttributesA (lpFileName="C:\\Boot\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\how-to-decrypt-files.htm")) returned 0x20
	[0049.750] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="BOOTSTAT.DAT" | out: lpString1="C:\\Boot\\BOOTSTAT.DAT") returned="C:\\Boot\\BOOTSTAT.DAT"
	[0049.750] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.zip") returned 0
	[0049.750] lstrlenA (lpString="*.zip") returned 5
	[0049.750] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.rar") returned 0
	[0049.750] lstrlenA (lpString="*.rar") returned 5
	[0049.750] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.7z") returned 0
	[0049.750] lstrlenA (lpString="*.7z") returned 4
	[0049.750] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.tar") returned 0
	[0049.750] lstrlenA (lpString="*.tar") returned 5
	[0049.750] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.gzip") returned 0
	[0049.751] lstrlenA (lpString="*.gzip") returned 6
	[0049.751] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.jpg") returned 0
	[0049.751] lstrlenA (lpString="*.jpg") returned 5
	[0049.751] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.jpeg") returned 0
	[0049.751] lstrlenA (lpString="*.jpeg") returned 6
	[0049.751] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.bmp") returned 0
	[0049.751] lstrlenA (lpString="*.bmp") returned 5
	[0049.751] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.gif") returned 0
	[0049.751] lstrlenA (lpString="*.gif") returned 5
	[0049.751] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.png") returned 0
	[0049.751] lstrlenA (lpString="*.png") returned 5
	[0049.751] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.doc") returned 0
	[0049.751] lstrlenA (lpString="*.doc") returned 5
	[0049.751] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.docx") returned 0
	[0049.751] lstrlenA (lpString="*.docx") returned 6
	[0049.751] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.xls") returned 0
	[0049.751] lstrlenA (lpString="*.xls") returned 5
	[0049.751] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.xlsx") returned 0
	[0049.751] lstrlenA (lpString="*.xlsx") returned 6
	[0049.751] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.ppt") returned 0
	[0049.751] lstrlenA (lpString="*.ppt") returned 5
	[0049.751] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.pptx") returned 0
	[0049.751] lstrlenA (lpString="*.pptx") returned 6
	[0049.751] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.txt") returned 0
	[0049.751] lstrlenA (lpString="*.txt") returned 5
	[0049.751] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.pdf") returned 0
	[0049.751] lstrlenA (lpString="*.pdf") returned 5
	[0049.751] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.htm") returned 0
	[0049.751] lstrlenA (lpString="*.htm") returned 5
	[0049.751] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.html") returned 0
	[0049.751] lstrlenA (lpString="*.html") returned 6
	[0049.751] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mdb") returned 0
	[0049.751] lstrlenA (lpString="*.mdb") returned 5
	[0049.751] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.pfx") returned 0
	[0049.751] lstrlenA (lpString="*.pfx") returned 5
	[0049.752] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.md") returned 0
	[0049.752] lstrlenA (lpString="*.md") returned 4
	[0049.752] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.lnk") returned 0
	[0049.752] lstrlenA (lpString="*.lnk") returned 5
	[0049.752] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.torrent") returned 0
	[0049.752] lstrlenA (lpString="*.torrent") returned 9
	[0049.752] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mov") returned 0
	[0049.752] lstrlenA (lpString="*.mov") returned 5
	[0049.752] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.3gp") returned 0
	[0049.752] lstrlenA (lpString="*.3gp") returned 5
	[0049.752] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mpeg") returned 0
	[0049.752] lstrlenA (lpString="*.mpeg") returned 6
	[0049.752] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mpg") returned 0
	[0049.752] lstrlenA (lpString="*.mpg") returned 5
	[0049.752] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.flv") returned 0
	[0049.752] lstrlenA (lpString="*.flv") returned 5
	[0049.752] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.avi") returned 0
	[0049.752] lstrlenA (lpString="*.avi") returned 5
	[0049.752] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mp4") returned 0
	[0049.752] lstrlenA (lpString="*.mp4") returned 5
	[0049.752] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.wmv") returned 0
	[0049.752] lstrlenA (lpString="*.wmv") returned 5
	[0049.752] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mkv") returned 0
	[0049.752] lstrlenA (lpString="*.mkv") returned 5
	[0049.752] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mp3") returned 0
	[0049.752] lstrlenA (lpString="*.mp3") returned 5
	[0049.752] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.wav") returned 0
	[0049.752] lstrlenA (lpString="*.wav") returned 5
	[0049.752] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.flac") returned 0
	[0049.752] lstrlenA (lpString="*.flac") returned 6
	[0049.752] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.wma") returned 0
	[0049.752] lstrlenA (lpString="*.wma") returned 5
	[0049.752] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.au3") returned 0
	[0049.752] lstrlenA (lpString="*.au3") returned 5
	[0049.752] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.ahk") returned 0
	[0049.752] lstrlenA (lpString="*.ahk") returned 5
	[0049.752] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.c") returned 0
	[0049.753] lstrlenA (lpString="*.c") returned 3
	[0049.753] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.cc") returned 0
	[0049.753] lstrlenA (lpString="*.cc") returned 4
	[0049.753] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.cpp") returned 0
	[0049.753] lstrlenA (lpString="*.cpp") returned 5
	[0049.753] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.cxx") returned 0
	[0049.753] lstrlenA (lpString="*.cxx") returned 5
	[0049.753] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.c++") returned 0
	[0049.753] lstrlenA (lpString="*.c++") returned 5
	[0049.753] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.cs") returned 0
	[0049.753] lstrlenA (lpString="*.cs") returned 4
	[0049.753] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.vb") returned 0
	[0049.753] lstrlenA (lpString="*.vb") returned 4
	[0049.753] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.bas") returned 0
	[0049.753] lstrlenA (lpString="*.bas") returned 5
	[0049.753] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.csproj") returned 0
	[0049.753] lstrlenA (lpString="*.csproj") returned 8
	[0049.753] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.vbproj") returned 0
	[0049.753] lstrlenA (lpString="*.vbproj") returned 8
	[0049.753] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.vcxproj") returned 0
	[0049.753] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.753] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.manifest") returned 0
	[0049.753] lstrlenA (lpString="*.manifest") returned 10
	[0049.753] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.php") returned 0
	[0049.753] lstrlenA (lpString="*.php") returned 5
	[0049.753] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.vbe") returned 0
	[0049.753] lstrlenA (lpString="*.vbe") returned 5
	[0049.753] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.vba") returned 0
	[0049.753] lstrlenA (lpString="*.vba") returned 5
	[0049.753] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.vbs") returned 0
	[0049.753] lstrlenA (lpString="*.vbs") returned 5
	[0049.753] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.bat") returned 0
	[0049.753] lstrlenA (lpString="*.bat") returned 5
	[0049.753] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.cmd") returned 0
	[0049.753] lstrlenA (lpString="*.cmd") returned 5
	[0049.753] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.js") returned 0
	[0049.754] lstrlenA (lpString="*.js") returned 4
	[0049.754] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.jscript") returned 0
	[0049.754] lstrlenA (lpString="*.jscript") returned 9
	[0049.754] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.hta") returned 0
	[0049.754] lstrlenA (lpString="*.hta") returned 5
	[0049.754] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.php7") returned 0
	[0049.754] lstrlenA (lpString="*.php7") returned 6
	[0049.754] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.db") returned 0
	[0049.754] lstrlenA (lpString="*.db") returned 4
	[0049.754] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.swf") returned 0
	[0049.754] lstrlenA (lpString="*.swf") returned 5
	[0049.754] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.eml") returned 0
	[0049.754] lstrlenA (lpString="*.eml") returned 5
	[0049.754] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.part") returned 0
	[0049.754] lstrlenA (lpString="*.part") returned 6
	[0049.754] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.nfo") returned 0
	[0049.754] lstrlenA (lpString="*.nfo") returned 5
	[0049.754] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.rsa") returned 0
	[0049.754] lstrlenA (lpString="*.rsa") returned 5
	[0049.754] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.key") returned 0
	[0049.754] lstrlenA (lpString="*.key") returned 5
	[0049.754] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.aes") returned 0
	[0049.754] lstrlenA (lpString="*.aes") returned 5
	[0049.754] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.blob") returned 0
	[0049.754] lstrlenA (lpString="*.blob") returned 6
	[0049.754] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.btc") returned 0
	[0049.754] lstrlenA (lpString="*.btc") returned 5
	[0049.754] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.wallet") returned 0
	[0049.754] lstrlenA (lpString="*.wallet") returned 8
	[0049.754] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1
	[0049.754] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0049.754] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootvhd.dll") returned 1
	[0049.754] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootvhd.dll") returned 1
	[0049.754] lstrcmpiA (lpString1="", lpString2="bootvhd.dll") returned -1
	[0049.754] PathFindFileNameA (pszPath="C:\\Boot\\BOOTSTAT.DAT") returned="BOOTSTAT.DAT"
	[0049.755] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\"
	[0049.755] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned=""
	[0049.755] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.755] GetFileAttributesA (lpFileName="C:\\Boot\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\how-to-decrypt-files.htm")) returned 0x20
	[0049.755] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="bootvhd.dll" | out: lpString1="C:\\Boot\\bootvhd.dll") returned="C:\\Boot\\bootvhd.dll"
	[0049.755] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.zip") returned 0
	[0049.755] lstrlenA (lpString="*.zip") returned 5
	[0049.755] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.rar") returned 0
	[0049.755] lstrlenA (lpString="*.rar") returned 5
	[0049.755] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.7z") returned 0
	[0049.755] lstrlenA (lpString="*.7z") returned 4
	[0049.755] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.tar") returned 0
	[0049.755] lstrlenA (lpString="*.tar") returned 5
	[0049.755] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.gzip") returned 0
	[0049.755] lstrlenA (lpString="*.gzip") returned 6
	[0049.755] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.jpg") returned 0
	[0049.755] lstrlenA (lpString="*.jpg") returned 5
	[0049.755] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.jpeg") returned 0
	[0049.755] lstrlenA (lpString="*.jpeg") returned 6
	[0049.755] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.bmp") returned 0
	[0049.801] lstrlenA (lpString="*.bmp") returned 5
	[0049.801] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.gif") returned 0
	[0049.801] lstrlenA (lpString="*.gif") returned 5
	[0049.801] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.png") returned 0
	[0049.801] lstrlenA (lpString="*.png") returned 5
	[0049.801] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.doc") returned 0
	[0049.801] lstrlenA (lpString="*.doc") returned 5
	[0049.801] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.docx") returned 0
	[0049.801] lstrlenA (lpString="*.docx") returned 6
	[0049.801] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.xls") returned 0
	[0049.801] lstrlenA (lpString="*.xls") returned 5
	[0049.801] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.xlsx") returned 0
	[0049.801] lstrlenA (lpString="*.xlsx") returned 6
	[0049.801] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.ppt") returned 0
	[0049.801] lstrlenA (lpString="*.ppt") returned 5
	[0049.802] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.pptx") returned 0
	[0049.802] lstrlenA (lpString="*.pptx") returned 6
	[0049.802] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.txt") returned 0
	[0049.802] lstrlenA (lpString="*.txt") returned 5
	[0049.802] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.pdf") returned 0
	[0049.802] lstrlenA (lpString="*.pdf") returned 5
	[0049.802] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.htm") returned 0
	[0049.802] lstrlenA (lpString="*.htm") returned 5
	[0049.802] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.html") returned 0
	[0049.802] lstrlenA (lpString="*.html") returned 6
	[0049.802] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.mdb") returned 0
	[0049.802] lstrlenA (lpString="*.mdb") returned 5
	[0049.802] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.pfx") returned 0
	[0049.802] lstrlenA (lpString="*.pfx") returned 5
	[0049.802] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.md") returned 0
	[0049.802] lstrlenA (lpString="*.md") returned 4
	[0049.802] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.lnk") returned 0
	[0049.802] lstrlenA (lpString="*.lnk") returned 5
	[0049.802] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.torrent") returned 0
	[0049.802] lstrlenA (lpString="*.torrent") returned 9
	[0049.802] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.mov") returned 0
	[0049.802] lstrlenA (lpString="*.mov") returned 5
	[0049.802] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.3gp") returned 0
	[0049.802] lstrlenA (lpString="*.3gp") returned 5
	[0049.802] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.mpeg") returned 0
	[0049.802] lstrlenA (lpString="*.mpeg") returned 6
	[0049.802] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.mpg") returned 0
	[0049.802] lstrlenA (lpString="*.mpg") returned 5
	[0049.802] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.flv") returned 0
	[0049.802] lstrlenA (lpString="*.flv") returned 5
	[0049.802] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.avi") returned 0
	[0049.802] lstrlenA (lpString="*.avi") returned 5
	[0049.802] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.mp4") returned 0
	[0049.802] lstrlenA (lpString="*.mp4") returned 5
	[0049.803] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.wmv") returned 0
	[0049.803] lstrlenA (lpString="*.wmv") returned 5
	[0049.803] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.mkv") returned 0
	[0049.803] lstrlenA (lpString="*.mkv") returned 5
	[0049.803] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.mp3") returned 0
	[0049.803] lstrlenA (lpString="*.mp3") returned 5
	[0049.803] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.wav") returned 0
	[0049.803] lstrlenA (lpString="*.wav") returned 5
	[0049.803] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.flac") returned 0
	[0049.803] lstrlenA (lpString="*.flac") returned 6
	[0049.803] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.wma") returned 0
	[0049.803] lstrlenA (lpString="*.wma") returned 5
	[0049.803] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.au3") returned 0
	[0049.803] lstrlenA (lpString="*.au3") returned 5
	[0049.803] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.ahk") returned 0
	[0049.803] lstrlenA (lpString="*.ahk") returned 5
	[0049.803] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.c") returned 0
	[0049.803] lstrlenA (lpString="*.c") returned 3
	[0049.803] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.cc") returned 0
	[0049.803] lstrlenA (lpString="*.cc") returned 4
	[0049.803] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.cpp") returned 0
	[0049.803] lstrlenA (lpString="*.cpp") returned 5
	[0049.803] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.cxx") returned 0
	[0049.803] lstrlenA (lpString="*.cxx") returned 5
	[0049.803] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.c++") returned 0
	[0049.803] lstrlenA (lpString="*.c++") returned 5
	[0049.803] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.cs") returned 0
	[0049.803] lstrlenA (lpString="*.cs") returned 4
	[0049.803] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.vb") returned 0
	[0049.803] lstrlenA (lpString="*.vb") returned 4
	[0049.803] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.bas") returned 0
	[0049.803] lstrlenA (lpString="*.bas") returned 5
	[0049.803] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.csproj") returned 0
	[0049.803] lstrlenA (lpString="*.csproj") returned 8
	[0049.804] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.vbproj") returned 0
	[0049.804] lstrlenA (lpString="*.vbproj") returned 8
	[0049.804] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.vcxproj") returned 0
	[0049.804] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.804] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.manifest") returned 0
	[0049.804] lstrlenA (lpString="*.manifest") returned 10
	[0049.804] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.php") returned 0
	[0049.804] lstrlenA (lpString="*.php") returned 5
	[0049.804] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.vbe") returned 0
	[0049.804] lstrlenA (lpString="*.vbe") returned 5
	[0049.804] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.vba") returned 0
	[0049.804] lstrlenA (lpString="*.vba") returned 5
	[0049.804] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.vbs") returned 0
	[0049.804] lstrlenA (lpString="*.vbs") returned 5
	[0049.804] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.bat") returned 0
	[0049.804] lstrlenA (lpString="*.bat") returned 5
	[0049.804] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.cmd") returned 0
	[0049.804] lstrlenA (lpString="*.cmd") returned 5
	[0049.804] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.js") returned 0
	[0049.804] lstrlenA (lpString="*.js") returned 4
	[0049.804] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.jscript") returned 0
	[0049.804] lstrlenA (lpString="*.jscript") returned 9
	[0049.804] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.hta") returned 0
	[0049.804] lstrlenA (lpString="*.hta") returned 5
	[0049.804] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.php7") returned 0
	[0049.804] lstrlenA (lpString="*.php7") returned 6
	[0049.804] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.db") returned 0
	[0049.804] lstrlenA (lpString="*.db") returned 4
	[0049.804] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.swf") returned 0
	[0049.804] lstrlenA (lpString="*.swf") returned 5
	[0049.804] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.eml") returned 0
	[0049.804] lstrlenA (lpString="*.eml") returned 5
	[0049.804] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.part") returned 0
	[0049.804] lstrlenA (lpString="*.part") returned 6
	[0049.804] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.nfo") returned 0
	[0049.805] lstrlenA (lpString="*.nfo") returned 5
	[0049.805] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.rsa") returned 0
	[0049.805] lstrlenA (lpString="*.rsa") returned 5
	[0049.805] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.key") returned 0
	[0049.805] lstrlenA (lpString="*.key") returned 5
	[0049.805] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.aes") returned 0
	[0049.805] lstrlenA (lpString="*.aes") returned 5
	[0049.805] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.blob") returned 0
	[0049.805] lstrlenA (lpString="*.blob") returned 6
	[0049.805] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.btc") returned 0
	[0049.805] lstrlenA (lpString="*.btc") returned 5
	[0049.805] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.wallet") returned 0
	[0049.805] lstrlenA (lpString="*.wallet") returned 8
	[0049.805] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1
	[0049.805] lstrcmpA (lpString1=".", lpString2="cs-CZ") returned -1
	[0049.805] lstrcmpA (lpString1="..", lpString2="cs-CZ") returned -1
	[0049.805] PathFindFileNameA (pszPath="C:\\Boot\\bootvhd.dll") returned="bootvhd.dll"
	[0049.805] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="cs-CZ" | out: lpString1="C:\\Boot\\cs-CZ") returned="C:\\Boot\\cs-CZ"
	[0049.805] lstrlenA (lpString="C:\\Boot\\cs-CZ") returned 13
	[0049.805] FindFirstFileA (in: lpFileName="C:\\Boot\\cs-CZ\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x58, cFileName=".", cAlternateFileName="")) returned 0x7cbb90
	[0049.815] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0049.815] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x58, cFileName="..", cAlternateFileName="")) returned 1
	[0049.815] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0049.815] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0049.815] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x7b0000, dwReserved1=0x58, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0049.815] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.815] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr.exe.mui") returned 1
	[0049.815] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr.exe.mui") returned 1
	[0049.815] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0049.815] PathFindFileNameA (pszPath="C:\\Boot\\cs-CZ\\*.*") returned="*.*"
	[0049.815] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\cs-CZ\\" | out: lpString1="C:\\Boot\\cs-CZ\\") returned="C:\\Boot\\cs-CZ\\"
	[0049.815] PathAddBackslashA (in: pszPath="C:\\Boot\\cs-CZ\\" | out: pszPath="C:\\Boot\\cs-CZ\\") returned=""
	[0049.815] lstrcatA (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\cs-CZ\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\cs-CZ\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.815] GetFileAttributesA (lpFileName="C:\\Boot\\cs-CZ\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\cs-cz\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0049.815] CreateFileA (lpFileName="C:\\Boot\\cs-CZ\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\cs-cz\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0049.818] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0049.818] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0049.819] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0049.819] CloseHandle (hObject=0x208) returned 1
	[0049.819] lstrcatA (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned="C:\\Boot\\cs-CZ\\bootmgr.exe.mui"
	[0049.819] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0049.819] lstrlenA (lpString="*.zip") returned 5
	[0049.819] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0049.819] lstrlenA (lpString="*.rar") returned 5
	[0049.820] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0049.820] lstrlenA (lpString="*.7z") returned 4
	[0049.820] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0049.820] lstrlenA (lpString="*.tar") returned 5
	[0049.820] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0049.820] lstrlenA (lpString="*.gzip") returned 6
	[0049.820] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0049.820] lstrlenA (lpString="*.jpg") returned 5
	[0049.820] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0049.820] lstrlenA (lpString="*.jpeg") returned 6
	[0049.820] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0049.820] lstrlenA (lpString="*.bmp") returned 5
	[0049.820] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0049.820] lstrlenA (lpString="*.gif") returned 5
	[0049.820] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0049.820] lstrlenA (lpString="*.png") returned 5
	[0049.820] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0049.820] lstrlenA (lpString="*.doc") returned 5
	[0049.820] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0049.820] lstrlenA (lpString="*.docx") returned 6
	[0049.820] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0049.820] lstrlenA (lpString="*.xls") returned 5
	[0049.820] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0049.820] lstrlenA (lpString="*.xlsx") returned 6
	[0049.820] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0049.820] lstrlenA (lpString="*.ppt") returned 5
	[0049.820] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0049.820] lstrlenA (lpString="*.pptx") returned 6
	[0049.820] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0049.820] lstrlenA (lpString="*.txt") returned 5
	[0049.820] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0049.820] lstrlenA (lpString="*.pdf") returned 5
	[0049.820] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0049.820] lstrlenA (lpString="*.htm") returned 5
	[0049.820] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0049.820] lstrlenA (lpString="*.html") returned 6
	[0049.821] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0049.821] lstrlenA (lpString="*.mdb") returned 5
	[0049.821] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0049.821] lstrlenA (lpString="*.pfx") returned 5
	[0049.821] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0049.821] lstrlenA (lpString="*.md") returned 4
	[0049.821] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0049.821] lstrlenA (lpString="*.lnk") returned 5
	[0049.821] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0049.821] lstrlenA (lpString="*.torrent") returned 9
	[0049.821] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0049.821] lstrlenA (lpString="*.mov") returned 5
	[0049.821] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0049.821] lstrlenA (lpString="*.3gp") returned 5
	[0049.821] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0049.821] lstrlenA (lpString="*.mpeg") returned 6
	[0049.821] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0049.821] lstrlenA (lpString="*.mpg") returned 5
	[0049.821] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0049.821] lstrlenA (lpString="*.flv") returned 5
	[0049.821] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0049.821] lstrlenA (lpString="*.avi") returned 5
	[0049.821] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0049.821] lstrlenA (lpString="*.mp4") returned 5
	[0049.821] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0049.821] lstrlenA (lpString="*.wmv") returned 5
	[0049.821] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0049.821] lstrlenA (lpString="*.mkv") returned 5
	[0049.821] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0049.821] lstrlenA (lpString="*.mp3") returned 5
	[0049.821] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0049.821] lstrlenA (lpString="*.wav") returned 5
	[0049.821] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0049.821] lstrlenA (lpString="*.flac") returned 6
	[0049.821] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0049.822] lstrlenA (lpString="*.wma") returned 5
	[0049.822] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.au3") returned 0
	[0049.822] lstrlenA (lpString="*.au3") returned 5
	[0049.822] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.ahk") returned 0
	[0049.822] lstrlenA (lpString="*.ahk") returned 5
	[0049.822] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.c") returned 0
	[0049.822] lstrlenA (lpString="*.c") returned 3
	[0049.822] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.cc") returned 0
	[0049.822] lstrlenA (lpString="*.cc") returned 4
	[0049.822] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0
	[0049.822] lstrlenA (lpString="*.cpp") returned 5
	[0049.822] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.cxx") returned 0
	[0049.822] lstrlenA (lpString="*.cxx") returned 5
	[0049.822] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.c++") returned 0
	[0049.822] lstrlenA (lpString="*.c++") returned 5
	[0049.822] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.cs") returned 0
	[0049.822] lstrlenA (lpString="*.cs") returned 4
	[0049.822] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.vb") returned 0
	[0049.822] lstrlenA (lpString="*.vb") returned 4
	[0049.822] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.bas") returned 0
	[0049.822] lstrlenA (lpString="*.bas") returned 5
	[0049.822] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.csproj") returned 0
	[0049.822] lstrlenA (lpString="*.csproj") returned 8
	[0049.822] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.vbproj") returned 0
	[0049.822] lstrlenA (lpString="*.vbproj") returned 8
	[0049.822] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.vcxproj") returned 0
	[0049.822] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.822] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.manifest") returned 0
	[0049.822] lstrlenA (lpString="*.manifest") returned 10
	[0049.822] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.php") returned 0
	[0049.822] lstrlenA (lpString="*.php") returned 5
	[0049.822] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.vbe") returned 0
	[0049.822] lstrlenA (lpString="*.vbe") returned 5
	[0049.822] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.vba") returned 0
	[0049.822] lstrlenA (lpString="*.vba") returned 5
	[0049.823] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.vbs") returned 0
	[0049.823] lstrlenA (lpString="*.vbs") returned 5
	[0049.823] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.bat") returned 0
	[0049.823] lstrlenA (lpString="*.bat") returned 5
	[0049.823] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.cmd") returned 0
	[0049.823] lstrlenA (lpString="*.cmd") returned 5
	[0049.823] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.js") returned 0
	[0049.823] lstrlenA (lpString="*.js") returned 4
	[0049.823] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.jscript") returned 0
	[0049.823] lstrlenA (lpString="*.jscript") returned 9
	[0049.823] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.hta") returned 0
	[0049.823] lstrlenA (lpString="*.hta") returned 5
	[0049.823] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.php7") returned 0
	[0049.823] lstrlenA (lpString="*.php7") returned 6
	[0049.823] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.db") returned 0
	[0049.823] lstrlenA (lpString="*.db") returned 4
	[0049.823] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.swf") returned 0
	[0049.823] lstrlenA (lpString="*.swf") returned 5
	[0049.823] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.eml") returned 0
	[0049.823] lstrlenA (lpString="*.eml") returned 5
	[0049.823] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.part") returned 0
	[0049.823] lstrlenA (lpString="*.part") returned 6
	[0049.823] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.nfo") returned 0
	[0049.823] lstrlenA (lpString="*.nfo") returned 5
	[0049.823] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.rsa") returned 0
	[0049.823] lstrlenA (lpString="*.rsa") returned 5
	[0049.823] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.key") returned 0
	[0049.823] lstrlenA (lpString="*.key") returned 5
	[0049.823] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.aes") returned 0
	[0049.823] lstrlenA (lpString="*.aes") returned 5
	[0049.823] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.blob") returned 0
	[0049.823] lstrlenA (lpString="*.blob") returned 6
	[0049.823] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.btc") returned 0
	[0049.823] lstrlenA (lpString="*.btc") returned 5
	[0049.824] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.wallet") returned 0
	[0049.824] lstrlenA (lpString="*.wallet") returned 8
	[0049.824] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0049.824] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.824] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="memtest.exe.mui") returned -1
	[0049.824] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="memtest.exe.mui") returned -1
	[0049.824] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1
	[0049.824] PathFindFileNameA (pszPath="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned="bootmgr.exe.mui"
	[0049.824] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\cs-CZ\\" | out: lpString1="C:\\Boot\\cs-CZ\\") returned="C:\\Boot\\cs-CZ\\"
	[0049.824] PathAddBackslashA (in: pszPath="C:\\Boot\\cs-CZ\\" | out: pszPath="C:\\Boot\\cs-CZ\\") returned=""
	[0049.824] lstrcatA (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\cs-CZ\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\cs-CZ\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.824] GetFileAttributesA (lpFileName="C:\\Boot\\cs-CZ\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\cs-cz\\how-to-decrypt-files.htm")) returned 0x20
	[0049.824] lstrcatA (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned="C:\\Boot\\cs-CZ\\memtest.exe.mui"
	[0049.824] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.zip") returned 0
	[0049.824] lstrlenA (lpString="*.zip") returned 5
	[0049.824] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.rar") returned 0
	[0049.824] lstrlenA (lpString="*.rar") returned 5
	[0049.824] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.7z") returned 0
	[0049.824] lstrlenA (lpString="*.7z") returned 4
	[0049.824] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.tar") returned 0
	[0049.824] lstrlenA (lpString="*.tar") returned 5
	[0049.824] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.gzip") returned 0
	[0049.824] lstrlenA (lpString="*.gzip") returned 6
	[0049.824] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.jpg") returned 0
	[0049.824] lstrlenA (lpString="*.jpg") returned 5
	[0049.824] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.jpeg") returned 0
	[0049.824] lstrlenA (lpString="*.jpeg") returned 6
	[0049.824] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.bmp") returned 0
	[0049.824] lstrlenA (lpString="*.bmp") returned 5
	[0049.824] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.gif") returned 0
	[0049.825] lstrlenA (lpString="*.gif") returned 5
	[0049.825] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.png") returned 0
	[0049.825] lstrlenA (lpString="*.png") returned 5
	[0049.825] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.doc") returned 0
	[0049.825] lstrlenA (lpString="*.doc") returned 5
	[0049.825] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.docx") returned 0
	[0049.825] lstrlenA (lpString="*.docx") returned 6
	[0049.825] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.xls") returned 0
	[0049.825] lstrlenA (lpString="*.xls") returned 5
	[0049.825] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.xlsx") returned 0
	[0049.825] lstrlenA (lpString="*.xlsx") returned 6
	[0049.825] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.ppt") returned 0
	[0049.825] lstrlenA (lpString="*.ppt") returned 5
	[0049.825] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.pptx") returned 0
	[0049.825] lstrlenA (lpString="*.pptx") returned 6
	[0049.825] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.txt") returned 0
	[0049.825] lstrlenA (lpString="*.txt") returned 5
	[0049.825] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.pdf") returned 0
	[0049.825] lstrlenA (lpString="*.pdf") returned 5
	[0049.825] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.htm") returned 0
	[0049.825] lstrlenA (lpString="*.htm") returned 5
	[0049.825] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.html") returned 0
	[0049.825] lstrlenA (lpString="*.html") returned 6
	[0049.825] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.mdb") returned 0
	[0049.825] lstrlenA (lpString="*.mdb") returned 5
	[0049.825] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.pfx") returned 0
	[0049.825] lstrlenA (lpString="*.pfx") returned 5
	[0049.825] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.md") returned 0
	[0049.825] lstrlenA (lpString="*.md") returned 4
	[0049.825] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.lnk") returned 0
	[0049.825] lstrlenA (lpString="*.lnk") returned 5
	[0049.825] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.torrent") returned 0
	[0049.825] lstrlenA (lpString="*.torrent") returned 9
	[0049.825] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.mov") returned 0
	[0049.826] lstrlenA (lpString="*.mov") returned 5
	[0049.826] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.3gp") returned 0
	[0049.826] lstrlenA (lpString="*.3gp") returned 5
	[0049.826] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.mpeg") returned 0
	[0049.826] lstrlenA (lpString="*.mpeg") returned 6
	[0049.826] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.mpg") returned 0
	[0049.826] lstrlenA (lpString="*.mpg") returned 5
	[0049.826] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.flv") returned 0
	[0049.826] lstrlenA (lpString="*.flv") returned 5
	[0049.826] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.avi") returned 0
	[0049.826] lstrlenA (lpString="*.avi") returned 5
	[0049.826] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.mp4") returned 0
	[0049.826] lstrlenA (lpString="*.mp4") returned 5
	[0049.826] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.wmv") returned 0
	[0049.826] lstrlenA (lpString="*.wmv") returned 5
	[0049.826] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.mkv") returned 0
	[0049.826] lstrlenA (lpString="*.mkv") returned 5
	[0049.826] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.mp3") returned 0
	[0049.826] lstrlenA (lpString="*.mp3") returned 5
	[0049.826] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.wav") returned 0
	[0049.826] lstrlenA (lpString="*.wav") returned 5
	[0049.826] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.flac") returned 0
	[0049.826] lstrlenA (lpString="*.flac") returned 6
	[0049.826] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.wma") returned 0
	[0049.826] lstrlenA (lpString="*.wma") returned 5
	[0049.826] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.au3") returned 0
	[0049.826] lstrlenA (lpString="*.au3") returned 5
	[0049.826] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.ahk") returned 0
	[0049.826] lstrlenA (lpString="*.ahk") returned 5
	[0049.826] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.c") returned 0
	[0049.826] lstrlenA (lpString="*.c") returned 3
	[0049.826] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.cc") returned 0
	[0049.826] lstrlenA (lpString="*.cc") returned 4
	[0049.826] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.cpp") returned 0
	[0049.827] lstrlenA (lpString="*.cpp") returned 5
	[0049.827] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.cxx") returned 0
	[0049.827] lstrlenA (lpString="*.cxx") returned 5
	[0049.827] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.c++") returned 0
	[0049.827] lstrlenA (lpString="*.c++") returned 5
	[0049.827] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.cs") returned 0
	[0049.827] lstrlenA (lpString="*.cs") returned 4
	[0049.827] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.vb") returned 0
	[0049.827] lstrlenA (lpString="*.vb") returned 4
	[0049.827] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.bas") returned 0
	[0049.827] lstrlenA (lpString="*.bas") returned 5
	[0049.827] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.csproj") returned 0
	[0049.827] lstrlenA (lpString="*.csproj") returned 8
	[0049.827] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.vbproj") returned 0
	[0049.827] lstrlenA (lpString="*.vbproj") returned 8
	[0049.827] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.vcxproj") returned 0
	[0049.827] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.827] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.manifest") returned 0
	[0049.827] lstrlenA (lpString="*.manifest") returned 10
	[0049.827] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.php") returned 0
	[0049.827] lstrlenA (lpString="*.php") returned 5
	[0049.827] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.vbe") returned 0
	[0049.827] lstrlenA (lpString="*.vbe") returned 5
	[0049.827] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.vba") returned 0
	[0049.827] lstrlenA (lpString="*.vba") returned 5
	[0049.827] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.vbs") returned 0
	[0049.827] lstrlenA (lpString="*.vbs") returned 5
	[0049.827] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.bat") returned 0
	[0049.827] lstrlenA (lpString="*.bat") returned 5
	[0049.827] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.cmd") returned 0
	[0049.827] lstrlenA (lpString="*.cmd") returned 5
	[0049.827] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.js") returned 0
	[0049.827] lstrlenA (lpString="*.js") returned 4
	[0049.827] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.jscript") returned 0
	[0049.827] lstrlenA (lpString="*.jscript") returned 9
	[0049.828] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.hta") returned 0
	[0049.828] lstrlenA (lpString="*.hta") returned 5
	[0049.828] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.php7") returned 0
	[0049.828] lstrlenA (lpString="*.php7") returned 6
	[0049.828] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.db") returned 0
	[0049.828] lstrlenA (lpString="*.db") returned 4
	[0049.828] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.swf") returned 0
	[0049.828] lstrlenA (lpString="*.swf") returned 5
	[0049.828] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.eml") returned 0
	[0049.828] lstrlenA (lpString="*.eml") returned 5
	[0049.828] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.part") returned 0
	[0049.828] lstrlenA (lpString="*.part") returned 6
	[0049.828] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.nfo") returned 0
	[0049.828] lstrlenA (lpString="*.nfo") returned 5
	[0049.828] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.rsa") returned 0
	[0049.828] lstrlenA (lpString="*.rsa") returned 5
	[0049.828] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.key") returned 0
	[0049.828] lstrlenA (lpString="*.key") returned 5
	[0049.828] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.aes") returned 0
	[0049.828] lstrlenA (lpString="*.aes") returned 5
	[0049.828] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.blob") returned 0
	[0049.828] lstrlenA (lpString="*.blob") returned 6
	[0049.828] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.btc") returned 0
	[0049.828] lstrlenA (lpString="*.btc") returned 5
	[0049.828] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.wallet") returned 0
	[0049.828] lstrlenA (lpString="*.wallet") returned 8
	[0049.828] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0049.828] FindClose (in: hFindFile=0x7cbb90 | out: hFindFile=0x7cbb90) returned 1
	[0049.828] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d2548, dwReserved1=0x7b00c0, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0049.828] lstrcmpA (lpString1=".", lpString2="da-DK") returned -1
	[0049.829] lstrcmpA (lpString1="..", lpString2="da-DK") returned -1
	[0049.829] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0049.829] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="da-DK" | out: lpString1="C:\\Boot\\da-DK") returned="C:\\Boot\\da-DK"
	[0049.829] lstrlenA (lpString="C:\\Boot\\da-DK") returned 13
	[0049.829] FindFirstFileA (in: lpFileName="C:\\Boot\\da-DK\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbc50
	[0049.830] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0049.830] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0049.830] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0049.830] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0049.830] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0049.830] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.830] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr.exe.mui") returned 1
	[0049.830] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr.exe.mui") returned 1
	[0049.830] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0049.830] PathFindFileNameA (pszPath="C:\\Boot\\da-DK\\*.*") returned="*.*"
	[0049.830] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\da-DK\\" | out: lpString1="C:\\Boot\\da-DK\\") returned="C:\\Boot\\da-DK\\"
	[0049.830] PathAddBackslashA (in: pszPath="C:\\Boot\\da-DK\\" | out: pszPath="C:\\Boot\\da-DK\\") returned=""
	[0049.830] lstrcatA (in: lpString1="C:\\Boot\\da-DK\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\da-DK\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\da-DK\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.830] GetFileAttributesA (lpFileName="C:\\Boot\\da-DK\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\da-dk\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0049.830] CreateFileA (lpFileName="C:\\Boot\\da-DK\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\da-dk\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0049.832] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0049.832] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0049.834] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0049.834] CloseHandle (hObject=0x208) returned 1
	[0049.834] lstrcatA (in: lpString1="C:\\Boot\\da-DK\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned="C:\\Boot\\da-DK\\bootmgr.exe.mui"
	[0049.834] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0049.834] lstrlenA (lpString="*.zip") returned 5
	[0049.834] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0049.834] lstrlenA (lpString="*.rar") returned 5
	[0049.834] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0049.834] lstrlenA (lpString="*.7z") returned 4
	[0049.834] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0049.834] lstrlenA (lpString="*.tar") returned 5
	[0049.834] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0049.834] lstrlenA (lpString="*.gzip") returned 6
	[0049.834] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0049.834] lstrlenA (lpString="*.jpg") returned 5
	[0049.834] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0049.834] lstrlenA (lpString="*.jpeg") returned 6
	[0049.834] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0049.835] lstrlenA (lpString="*.bmp") returned 5
	[0049.835] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0049.835] lstrlenA (lpString="*.gif") returned 5
	[0049.835] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0049.835] lstrlenA (lpString="*.png") returned 5
	[0049.835] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0049.835] lstrlenA (lpString="*.doc") returned 5
	[0049.835] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0049.835] lstrlenA (lpString="*.docx") returned 6
	[0049.835] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0049.835] lstrlenA (lpString="*.xls") returned 5
	[0049.835] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0049.835] lstrlenA (lpString="*.xlsx") returned 6
	[0049.835] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0049.835] lstrlenA (lpString="*.ppt") returned 5
	[0049.835] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0049.835] lstrlenA (lpString="*.pptx") returned 6
	[0049.835] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0049.835] lstrlenA (lpString="*.txt") returned 5
	[0049.835] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0049.835] lstrlenA (lpString="*.pdf") returned 5
	[0049.835] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0049.835] lstrlenA (lpString="*.htm") returned 5
	[0049.835] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0049.835] lstrlenA (lpString="*.html") returned 6
	[0049.835] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0049.835] lstrlenA (lpString="*.mdb") returned 5
	[0049.835] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0049.835] lstrlenA (lpString="*.pfx") returned 5
	[0049.835] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0049.835] lstrlenA (lpString="*.md") returned 4
	[0049.835] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0049.835] lstrlenA (lpString="*.lnk") returned 5
	[0049.836] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0049.836] lstrlenA (lpString="*.torrent") returned 9
	[0049.836] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0049.836] lstrlenA (lpString="*.mov") returned 5
	[0049.836] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0049.836] lstrlenA (lpString="*.3gp") returned 5
	[0049.836] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0049.836] lstrlenA (lpString="*.mpeg") returned 6
	[0049.836] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0049.836] lstrlenA (lpString="*.mpg") returned 5
	[0049.836] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0049.836] lstrlenA (lpString="*.flv") returned 5
	[0049.836] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0049.836] lstrlenA (lpString="*.avi") returned 5
	[0049.836] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0049.836] lstrlenA (lpString="*.mp4") returned 5
	[0049.836] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0049.836] lstrlenA (lpString="*.wmv") returned 5
	[0049.836] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0049.836] lstrlenA (lpString="*.mkv") returned 5
	[0049.836] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0049.836] lstrlenA (lpString="*.mp3") returned 5
	[0049.836] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0049.836] lstrlenA (lpString="*.wav") returned 5
	[0049.836] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0049.836] lstrlenA (lpString="*.flac") returned 6
	[0049.836] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0049.836] lstrlenA (lpString="*.wma") returned 5
	[0049.836] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.au3") returned 0
	[0049.836] lstrlenA (lpString="*.au3") returned 5
	[0049.836] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.ahk") returned 0
	[0049.836] lstrlenA (lpString="*.ahk") returned 5
	[0049.836] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.c") returned 0
	[0049.836] lstrlenA (lpString="*.c") returned 3
	[0049.837] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.cc") returned 0
	[0049.837] lstrlenA (lpString="*.cc") returned 4
	[0049.837] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0
	[0049.837] lstrlenA (lpString="*.cpp") returned 5
	[0049.837] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.cxx") returned 0
	[0049.837] lstrlenA (lpString="*.cxx") returned 5
	[0049.837] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.c++") returned 0
	[0049.837] lstrlenA (lpString="*.c++") returned 5
	[0049.837] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.cs") returned 0
	[0049.837] lstrlenA (lpString="*.cs") returned 4
	[0049.837] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.vb") returned 0
	[0049.837] lstrlenA (lpString="*.vb") returned 4
	[0049.837] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.bas") returned 0
	[0049.837] lstrlenA (lpString="*.bas") returned 5
	[0049.837] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.csproj") returned 0
	[0049.837] lstrlenA (lpString="*.csproj") returned 8
	[0049.837] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.vbproj") returned 0
	[0049.837] lstrlenA (lpString="*.vbproj") returned 8
	[0049.837] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.vcxproj") returned 0
	[0049.837] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.837] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.manifest") returned 0
	[0049.837] lstrlenA (lpString="*.manifest") returned 10
	[0049.837] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.php") returned 0
	[0049.837] lstrlenA (lpString="*.php") returned 5
	[0049.837] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.vbe") returned 0
	[0049.837] lstrlenA (lpString="*.vbe") returned 5
	[0049.838] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.vba") returned 0
	[0049.838] lstrlenA (lpString="*.vba") returned 5
	[0049.838] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.vbs") returned 0
	[0049.838] lstrlenA (lpString="*.vbs") returned 5
	[0049.838] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.bat") returned 0
	[0049.838] lstrlenA (lpString="*.bat") returned 5
	[0049.838] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.cmd") returned 0
	[0049.838] lstrlenA (lpString="*.cmd") returned 5
	[0049.838] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.js") returned 0
	[0049.838] lstrlenA (lpString="*.js") returned 4
	[0049.838] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.jscript") returned 0
	[0049.838] lstrlenA (lpString="*.jscript") returned 9
	[0049.838] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.hta") returned 0
	[0049.838] lstrlenA (lpString="*.hta") returned 5
	[0049.838] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.php7") returned 0
	[0049.838] lstrlenA (lpString="*.php7") returned 6
	[0049.838] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.db") returned 0
	[0049.838] lstrlenA (lpString="*.db") returned 4
	[0049.838] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.swf") returned 0
	[0049.838] lstrlenA (lpString="*.swf") returned 5
	[0049.838] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.eml") returned 0
	[0049.838] lstrlenA (lpString="*.eml") returned 5
	[0049.838] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.part") returned 0
	[0049.838] lstrlenA (lpString="*.part") returned 6
	[0049.838] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.nfo") returned 0
	[0049.838] lstrlenA (lpString="*.nfo") returned 5
	[0049.838] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.rsa") returned 0
	[0049.838] lstrlenA (lpString="*.rsa") returned 5
	[0049.838] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.key") returned 0
	[0049.838] lstrlenA (lpString="*.key") returned 5
	[0049.838] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.aes") returned 0
	[0049.838] lstrlenA (lpString="*.aes") returned 5
	[0049.838] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.blob") returned 0
	[0049.838] lstrlenA (lpString="*.blob") returned 6
	[0049.838] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.btc") returned 0
	[0049.838] lstrlenA (lpString="*.btc") returned 5
	[0049.839] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.wallet") returned 0
	[0049.839] lstrlenA (lpString="*.wallet") returned 8
	[0049.839] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0049.839] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.839] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="memtest.exe.mui") returned -1
	[0049.839] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="memtest.exe.mui") returned -1
	[0049.839] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1
	[0049.839] PathFindFileNameA (pszPath="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned="bootmgr.exe.mui"
	[0049.839] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\da-DK\\" | out: lpString1="C:\\Boot\\da-DK\\") returned="C:\\Boot\\da-DK\\"
	[0049.839] PathAddBackslashA (in: pszPath="C:\\Boot\\da-DK\\" | out: pszPath="C:\\Boot\\da-DK\\") returned=""
	[0049.839] lstrcatA (in: lpString1="C:\\Boot\\da-DK\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\da-DK\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\da-DK\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.839] GetFileAttributesA (lpFileName="C:\\Boot\\da-DK\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\da-dk\\how-to-decrypt-files.htm")) returned 0x20
	[0049.839] lstrcatA (in: lpString1="C:\\Boot\\da-DK\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\da-DK\\memtest.exe.mui") returned="C:\\Boot\\da-DK\\memtest.exe.mui"
	[0049.839] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.zip") returned 0
	[0049.839] lstrlenA (lpString="*.zip") returned 5
	[0049.839] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.rar") returned 0
	[0049.839] lstrlenA (lpString="*.rar") returned 5
	[0049.839] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.7z") returned 0
	[0049.839] lstrlenA (lpString="*.7z") returned 4
	[0049.839] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.tar") returned 0
	[0049.839] lstrlenA (lpString="*.tar") returned 5
	[0049.839] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.gzip") returned 0
	[0049.839] lstrlenA (lpString="*.gzip") returned 6
	[0049.839] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.jpg") returned 0
	[0049.839] lstrlenA (lpString="*.jpg") returned 5
	[0049.839] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.jpeg") returned 0
	[0049.839] lstrlenA (lpString="*.jpeg") returned 6
	[0049.839] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.bmp") returned 0
	[0049.839] lstrlenA (lpString="*.bmp") returned 5
	[0049.839] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.gif") returned 0
	[0049.840] lstrlenA (lpString="*.gif") returned 5
	[0049.840] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.png") returned 0
	[0049.840] lstrlenA (lpString="*.png") returned 5
	[0049.840] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.doc") returned 0
	[0049.840] lstrlenA (lpString="*.doc") returned 5
	[0049.840] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.docx") returned 0
	[0049.840] lstrlenA (lpString="*.docx") returned 6
	[0049.840] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.xls") returned 0
	[0049.840] lstrlenA (lpString="*.xls") returned 5
	[0049.840] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.xlsx") returned 0
	[0049.840] lstrlenA (lpString="*.xlsx") returned 6
	[0049.840] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.ppt") returned 0
	[0049.840] lstrlenA (lpString="*.ppt") returned 5
	[0049.840] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.pptx") returned 0
	[0049.840] lstrlenA (lpString="*.pptx") returned 6
	[0049.840] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.txt") returned 0
	[0049.840] lstrlenA (lpString="*.txt") returned 5
	[0049.840] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.pdf") returned 0
	[0049.840] lstrlenA (lpString="*.pdf") returned 5
	[0049.840] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.htm") returned 0
	[0049.840] lstrlenA (lpString="*.htm") returned 5
	[0049.840] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.html") returned 0
	[0049.840] lstrlenA (lpString="*.html") returned 6
	[0049.840] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.mdb") returned 0
	[0049.840] lstrlenA (lpString="*.mdb") returned 5
	[0049.840] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.pfx") returned 0
	[0049.840] lstrlenA (lpString="*.pfx") returned 5
	[0049.840] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.md") returned 0
	[0049.840] lstrlenA (lpString="*.md") returned 4
	[0049.840] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.lnk") returned 0
	[0049.840] lstrlenA (lpString="*.lnk") returned 5
	[0049.840] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.torrent") returned 0
	[0049.840] lstrlenA (lpString="*.torrent") returned 9
	[0049.840] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.mov") returned 0
	[0049.840] lstrlenA (lpString="*.mov") returned 5
	[0049.841] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.3gp") returned 0
	[0049.841] lstrlenA (lpString="*.3gp") returned 5
	[0049.841] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.mpeg") returned 0
	[0049.841] lstrlenA (lpString="*.mpeg") returned 6
	[0049.841] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.mpg") returned 0
	[0049.841] lstrlenA (lpString="*.mpg") returned 5
	[0049.841] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.flv") returned 0
	[0049.841] lstrlenA (lpString="*.flv") returned 5
	[0049.841] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.avi") returned 0
	[0049.841] lstrlenA (lpString="*.avi") returned 5
	[0049.841] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.mp4") returned 0
	[0049.841] lstrlenA (lpString="*.mp4") returned 5
	[0049.841] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.wmv") returned 0
	[0049.841] lstrlenA (lpString="*.wmv") returned 5
	[0049.841] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.mkv") returned 0
	[0049.841] lstrlenA (lpString="*.mkv") returned 5
	[0049.841] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.mp3") returned 0
	[0049.841] lstrlenA (lpString="*.mp3") returned 5
	[0049.841] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.wav") returned 0
	[0049.841] lstrlenA (lpString="*.wav") returned 5
	[0049.841] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.flac") returned 0
	[0049.841] lstrlenA (lpString="*.flac") returned 6
	[0049.841] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.wma") returned 0
	[0049.841] lstrlenA (lpString="*.wma") returned 5
	[0049.841] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.au3") returned 0
	[0049.841] lstrlenA (lpString="*.au3") returned 5
	[0049.841] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.ahk") returned 0
	[0049.841] lstrlenA (lpString="*.ahk") returned 5
	[0049.841] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.c") returned 0
	[0049.841] lstrlenA (lpString="*.c") returned 3
	[0049.841] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.cc") returned 0
	[0049.841] lstrlenA (lpString="*.cc") returned 4
	[0049.841] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.cpp") returned 0
	[0049.841] lstrlenA (lpString="*.cpp") returned 5
	[0049.841] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.cxx") returned 0
	[0049.841] lstrlenA (lpString="*.cxx") returned 5
	[0049.842] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.c++") returned 0
	[0049.842] lstrlenA (lpString="*.c++") returned 5
	[0049.842] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.cs") returned 0
	[0049.842] lstrlenA (lpString="*.cs") returned 4
	[0049.842] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.vb") returned 0
	[0049.842] lstrlenA (lpString="*.vb") returned 4
	[0049.842] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.bas") returned 0
	[0049.842] lstrlenA (lpString="*.bas") returned 5
	[0049.842] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.csproj") returned 0
	[0049.842] lstrlenA (lpString="*.csproj") returned 8
	[0049.842] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.vbproj") returned 0
	[0049.842] lstrlenA (lpString="*.vbproj") returned 8
	[0049.842] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.vcxproj") returned 0
	[0049.842] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.842] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.manifest") returned 0
	[0049.842] lstrlenA (lpString="*.manifest") returned 10
	[0049.842] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.php") returned 0
	[0049.842] lstrlenA (lpString="*.php") returned 5
	[0049.842] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.vbe") returned 0
	[0049.842] lstrlenA (lpString="*.vbe") returned 5
	[0049.842] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.vba") returned 0
	[0049.842] lstrlenA (lpString="*.vba") returned 5
	[0049.842] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.vbs") returned 0
	[0049.842] lstrlenA (lpString="*.vbs") returned 5
	[0049.842] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.bat") returned 0
	[0049.842] lstrlenA (lpString="*.bat") returned 5
	[0049.842] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.cmd") returned 0
	[0049.842] lstrlenA (lpString="*.cmd") returned 5
	[0049.842] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.js") returned 0
	[0049.842] lstrlenA (lpString="*.js") returned 4
	[0049.842] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.jscript") returned 0
	[0049.842] lstrlenA (lpString="*.jscript") returned 9
	[0049.842] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.hta") returned 0
	[0049.842] lstrlenA (lpString="*.hta") returned 5
	[0049.843] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.php7") returned 0
	[0049.843] lstrlenA (lpString="*.php7") returned 6
	[0049.843] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.db") returned 0
	[0049.843] lstrlenA (lpString="*.db") returned 4
	[0049.843] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.swf") returned 0
	[0049.843] lstrlenA (lpString="*.swf") returned 5
	[0049.843] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.eml") returned 0
	[0049.843] lstrlenA (lpString="*.eml") returned 5
	[0049.843] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.part") returned 0
	[0049.843] lstrlenA (lpString="*.part") returned 6
	[0049.843] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.nfo") returned 0
	[0049.843] lstrlenA (lpString="*.nfo") returned 5
	[0049.843] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.rsa") returned 0
	[0049.843] lstrlenA (lpString="*.rsa") returned 5
	[0049.843] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.key") returned 0
	[0049.843] lstrlenA (lpString="*.key") returned 5
	[0049.843] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.aes") returned 0
	[0049.843] lstrlenA (lpString="*.aes") returned 5
	[0049.843] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.blob") returned 0
	[0049.843] lstrlenA (lpString="*.blob") returned 6
	[0049.843] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.btc") returned 0
	[0049.843] lstrlenA (lpString="*.btc") returned 5
	[0049.843] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.wallet") returned 0
	[0049.843] lstrlenA (lpString="*.wallet") returned 8
	[0049.843] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0049.843] FindClose (in: hFindFile=0x7cbc50 | out: hFindFile=0x7cbc50) returned 1
	[0049.843] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d2548, dwReserved1=0x7b00c0, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0049.843] lstrcmpA (lpString1=".", lpString2="de-DE") returned -1
	[0049.843] lstrcmpA (lpString1="..", lpString2="de-DE") returned -1
	[0049.843] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0049.843] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="de-DE" | out: lpString1="C:\\Boot\\de-DE") returned="C:\\Boot\\de-DE"
	[0049.844] lstrlenA (lpString="C:\\Boot\\de-DE") returned 13
	[0049.844] FindFirstFileA (in: lpFileName="C:\\Boot\\de-DE\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb950
	[0049.844] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0049.844] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0049.844] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0049.844] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0049.844] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0049.844] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.844] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr.exe.mui") returned 1
	[0049.844] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr.exe.mui") returned 1
	[0049.844] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0049.844] PathFindFileNameA (pszPath="C:\\Boot\\de-DE\\*.*") returned="*.*"
	[0049.844] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\de-DE\\" | out: lpString1="C:\\Boot\\de-DE\\") returned="C:\\Boot\\de-DE\\"
	[0049.844] PathAddBackslashA (in: pszPath="C:\\Boot\\de-DE\\" | out: pszPath="C:\\Boot\\de-DE\\") returned=""
	[0049.844] lstrcatA (in: lpString1="C:\\Boot\\de-DE\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\de-DE\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\de-DE\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.844] GetFileAttributesA (lpFileName="C:\\Boot\\de-DE\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\de-de\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0049.844] CreateFileA (lpFileName="C:\\Boot\\de-DE\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\de-de\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0049.846] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0049.846] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0049.847] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0049.847] CloseHandle (hObject=0x208) returned 1
	[0049.932] lstrcatA (in: lpString1="C:\\Boot\\de-DE\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned="C:\\Boot\\de-DE\\bootmgr.exe.mui"
	[0049.932] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0049.932] lstrlenA (lpString="*.zip") returned 5
	[0049.932] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0049.932] lstrlenA (lpString="*.rar") returned 5
	[0049.932] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0049.932] lstrlenA (lpString="*.7z") returned 4
	[0049.932] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0049.932] lstrlenA (lpString="*.tar") returned 5
	[0049.932] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0049.932] lstrlenA (lpString="*.gzip") returned 6
	[0049.932] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0049.932] lstrlenA (lpString="*.jpg") returned 5
	[0049.932] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0049.932] lstrlenA (lpString="*.jpeg") returned 6
	[0049.932] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0049.932] lstrlenA (lpString="*.bmp") returned 5
	[0049.932] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0049.932] lstrlenA (lpString="*.gif") returned 5
	[0049.933] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0049.933] lstrlenA (lpString="*.png") returned 5
	[0049.933] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0049.933] lstrlenA (lpString="*.doc") returned 5
	[0049.933] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0049.933] lstrlenA (lpString="*.docx") returned 6
	[0049.933] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0049.933] lstrlenA (lpString="*.xls") returned 5
	[0049.933] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0049.933] lstrlenA (lpString="*.xlsx") returned 6
	[0049.933] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0049.933] lstrlenA (lpString="*.ppt") returned 5
	[0049.933] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0049.933] lstrlenA (lpString="*.pptx") returned 6
	[0049.933] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0049.933] lstrlenA (lpString="*.txt") returned 5
	[0049.933] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0049.933] lstrlenA (lpString="*.pdf") returned 5
	[0049.933] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0049.933] lstrlenA (lpString="*.htm") returned 5
	[0049.933] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0049.933] lstrlenA (lpString="*.html") returned 6
	[0049.933] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0049.933] lstrlenA (lpString="*.mdb") returned 5
	[0049.933] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0049.933] lstrlenA (lpString="*.pfx") returned 5
	[0049.933] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0049.933] lstrlenA (lpString="*.md") returned 4
	[0049.933] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0049.933] lstrlenA (lpString="*.lnk") returned 5
	[0049.933] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0049.933] lstrlenA (lpString="*.torrent") returned 9
	[0049.933] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0049.933] lstrlenA (lpString="*.mov") returned 5
	[0049.933] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0049.933] lstrlenA (lpString="*.3gp") returned 5
	[0049.934] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0049.934] lstrlenA (lpString="*.mpeg") returned 6
	[0049.934] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0049.934] lstrlenA (lpString="*.mpg") returned 5
	[0049.934] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0049.934] lstrlenA (lpString="*.flv") returned 5
	[0049.934] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0049.934] lstrlenA (lpString="*.avi") returned 5
	[0049.934] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0049.934] lstrlenA (lpString="*.mp4") returned 5
	[0049.934] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0049.934] lstrlenA (lpString="*.wmv") returned 5
	[0049.934] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0049.934] lstrlenA (lpString="*.mkv") returned 5
	[0049.934] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0049.934] lstrlenA (lpString="*.mp3") returned 5
	[0049.934] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0049.934] lstrlenA (lpString="*.wav") returned 5
	[0049.934] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0049.934] lstrlenA (lpString="*.flac") returned 6
	[0049.934] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0049.934] lstrlenA (lpString="*.wma") returned 5
	[0049.934] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.au3") returned 0
	[0049.934] lstrlenA (lpString="*.au3") returned 5
	[0049.934] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.ahk") returned 0
	[0049.934] lstrlenA (lpString="*.ahk") returned 5
	[0049.934] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.c") returned 0
	[0049.934] lstrlenA (lpString="*.c") returned 3
	[0049.934] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.cc") returned 0
	[0049.934] lstrlenA (lpString="*.cc") returned 4
	[0049.934] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0
	[0049.934] lstrlenA (lpString="*.cpp") returned 5
	[0049.934] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.cxx") returned 0
	[0049.934] lstrlenA (lpString="*.cxx") returned 5
	[0049.934] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.c++") returned 0
	[0049.935] lstrlenA (lpString="*.c++") returned 5
	[0049.935] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.cs") returned 0
	[0049.935] lstrlenA (lpString="*.cs") returned 4
	[0049.935] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.vb") returned 0
	[0049.935] lstrlenA (lpString="*.vb") returned 4
	[0049.935] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.bas") returned 0
	[0049.935] lstrlenA (lpString="*.bas") returned 5
	[0049.935] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.csproj") returned 0
	[0049.935] lstrlenA (lpString="*.csproj") returned 8
	[0049.935] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.vbproj") returned 0
	[0049.935] lstrlenA (lpString="*.vbproj") returned 8
	[0049.935] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.vcxproj") returned 0
	[0049.935] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.935] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.manifest") returned 0
	[0049.935] lstrlenA (lpString="*.manifest") returned 10
	[0049.935] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.php") returned 0
	[0049.935] lstrlenA (lpString="*.php") returned 5
	[0049.935] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.vbe") returned 0
	[0049.935] lstrlenA (lpString="*.vbe") returned 5
	[0049.935] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.vba") returned 0
	[0049.935] lstrlenA (lpString="*.vba") returned 5
	[0049.935] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.vbs") returned 0
	[0049.935] lstrlenA (lpString="*.vbs") returned 5
	[0049.935] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.bat") returned 0
	[0049.935] lstrlenA (lpString="*.bat") returned 5
	[0049.935] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.cmd") returned 0
	[0049.935] lstrlenA (lpString="*.cmd") returned 5
	[0049.935] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.js") returned 0
	[0049.935] lstrlenA (lpString="*.js") returned 4
	[0049.935] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.jscript") returned 0
	[0049.935] lstrlenA (lpString="*.jscript") returned 9
	[0049.935] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.hta") returned 0
	[0049.935] lstrlenA (lpString="*.hta") returned 5
	[0049.935] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.php7") returned 0
	[0049.935] lstrlenA (lpString="*.php7") returned 6
	[0049.935] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.db") returned 0
	[0049.936] lstrlenA (lpString="*.db") returned 4
	[0049.936] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.swf") returned 0
	[0049.936] lstrlenA (lpString="*.swf") returned 5
	[0049.936] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.eml") returned 0
	[0049.936] lstrlenA (lpString="*.eml") returned 5
	[0049.936] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.part") returned 0
	[0049.936] lstrlenA (lpString="*.part") returned 6
	[0049.936] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.nfo") returned 0
	[0049.936] lstrlenA (lpString="*.nfo") returned 5
	[0049.936] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.rsa") returned 0
	[0049.936] lstrlenA (lpString="*.rsa") returned 5
	[0049.936] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.key") returned 0
	[0049.936] lstrlenA (lpString="*.key") returned 5
	[0049.936] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.aes") returned 0
	[0049.936] lstrlenA (lpString="*.aes") returned 5
	[0049.936] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.blob") returned 0
	[0049.936] lstrlenA (lpString="*.blob") returned 6
	[0049.936] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.btc") returned 0
	[0049.936] lstrlenA (lpString="*.btc") returned 5
	[0049.936] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.wallet") returned 0
	[0049.936] lstrlenA (lpString="*.wallet") returned 8
	[0049.936] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0049.936] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.936] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="memtest.exe.mui") returned -1
	[0049.936] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="memtest.exe.mui") returned -1
	[0049.936] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1
	[0049.936] PathFindFileNameA (pszPath="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned="bootmgr.exe.mui"
	[0049.936] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\de-DE\\" | out: lpString1="C:\\Boot\\de-DE\\") returned="C:\\Boot\\de-DE\\"
	[0049.936] PathAddBackslashA (in: pszPath="C:\\Boot\\de-DE\\" | out: pszPath="C:\\Boot\\de-DE\\") returned=""
	[0049.936] lstrcatA (in: lpString1="C:\\Boot\\de-DE\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\de-DE\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\de-DE\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.936] GetFileAttributesA (lpFileName="C:\\Boot\\de-DE\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\de-de\\how-to-decrypt-files.htm")) returned 0x20
	[0049.937] lstrcatA (in: lpString1="C:\\Boot\\de-DE\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\de-DE\\memtest.exe.mui") returned="C:\\Boot\\de-DE\\memtest.exe.mui"
	[0049.937] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.zip") returned 0
	[0049.937] lstrlenA (lpString="*.zip") returned 5
	[0049.937] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.rar") returned 0
	[0049.937] lstrlenA (lpString="*.rar") returned 5
	[0049.937] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.7z") returned 0
	[0049.937] lstrlenA (lpString="*.7z") returned 4
	[0049.937] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.tar") returned 0
	[0049.937] lstrlenA (lpString="*.tar") returned 5
	[0049.937] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.gzip") returned 0
	[0049.937] lstrlenA (lpString="*.gzip") returned 6
	[0049.937] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.jpg") returned 0
	[0049.937] lstrlenA (lpString="*.jpg") returned 5
	[0049.937] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.jpeg") returned 0
	[0049.937] lstrlenA (lpString="*.jpeg") returned 6
	[0049.937] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.bmp") returned 0
	[0049.937] lstrlenA (lpString="*.bmp") returned 5
	[0049.937] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.gif") returned 0
	[0049.937] lstrlenA (lpString="*.gif") returned 5
	[0049.937] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.png") returned 0
	[0049.937] lstrlenA (lpString="*.png") returned 5
	[0049.937] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.doc") returned 0
	[0049.937] lstrlenA (lpString="*.doc") returned 5
	[0049.937] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.docx") returned 0
	[0049.937] lstrlenA (lpString="*.docx") returned 6
	[0049.937] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.xls") returned 0
	[0049.937] lstrlenA (lpString="*.xls") returned 5
	[0049.937] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.xlsx") returned 0
	[0049.937] lstrlenA (lpString="*.xlsx") returned 6
	[0049.937] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.ppt") returned 0
	[0049.937] lstrlenA (lpString="*.ppt") returned 5
	[0049.937] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.pptx") returned 0
	[0049.937] lstrlenA (lpString="*.pptx") returned 6
	[0049.937] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.txt") returned 0
	[0049.937] lstrlenA (lpString="*.txt") returned 5
	[0049.938] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.pdf") returned 0
	[0049.938] lstrlenA (lpString="*.pdf") returned 5
	[0049.938] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.htm") returned 0
	[0049.938] lstrlenA (lpString="*.htm") returned 5
	[0049.938] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.html") returned 0
	[0049.938] lstrlenA (lpString="*.html") returned 6
	[0049.938] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.mdb") returned 0
	[0049.938] lstrlenA (lpString="*.mdb") returned 5
	[0049.938] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.pfx") returned 0
	[0049.938] lstrlenA (lpString="*.pfx") returned 5
	[0049.938] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.md") returned 0
	[0049.938] lstrlenA (lpString="*.md") returned 4
	[0049.938] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.lnk") returned 0
	[0049.938] lstrlenA (lpString="*.lnk") returned 5
	[0049.938] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.torrent") returned 0
	[0049.938] lstrlenA (lpString="*.torrent") returned 9
	[0049.938] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.mov") returned 0
	[0049.938] lstrlenA (lpString="*.mov") returned 5
	[0049.938] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.3gp") returned 0
	[0049.938] lstrlenA (lpString="*.3gp") returned 5
	[0049.938] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.mpeg") returned 0
	[0049.938] lstrlenA (lpString="*.mpeg") returned 6
	[0049.938] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.mpg") returned 0
	[0049.938] lstrlenA (lpString="*.mpg") returned 5
	[0049.938] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.flv") returned 0
	[0049.938] lstrlenA (lpString="*.flv") returned 5
	[0049.938] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.avi") returned 0
	[0049.938] lstrlenA (lpString="*.avi") returned 5
	[0049.938] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.mp4") returned 0
	[0049.938] lstrlenA (lpString="*.mp4") returned 5
	[0049.938] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.wmv") returned 0
	[0049.938] lstrlenA (lpString="*.wmv") returned 5
	[0049.938] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.mkv") returned 0
	[0049.938] lstrlenA (lpString="*.mkv") returned 5
	[0049.938] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.mp3") returned 0
	[0049.938] lstrlenA (lpString="*.mp3") returned 5
	[0049.939] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.wav") returned 0
	[0049.939] lstrlenA (lpString="*.wav") returned 5
	[0049.939] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.flac") returned 0
	[0049.939] lstrlenA (lpString="*.flac") returned 6
	[0049.939] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.wma") returned 0
	[0049.939] lstrlenA (lpString="*.wma") returned 5
	[0049.939] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.au3") returned 0
	[0049.939] lstrlenA (lpString="*.au3") returned 5
	[0049.939] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.ahk") returned 0
	[0049.939] lstrlenA (lpString="*.ahk") returned 5
	[0049.939] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.c") returned 0
	[0049.939] lstrlenA (lpString="*.c") returned 3
	[0049.939] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.cc") returned 0
	[0049.939] lstrlenA (lpString="*.cc") returned 4
	[0049.939] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.cpp") returned 0
	[0049.939] lstrlenA (lpString="*.cpp") returned 5
	[0049.939] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.cxx") returned 0
	[0049.939] lstrlenA (lpString="*.cxx") returned 5
	[0049.939] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.c++") returned 0
	[0049.939] lstrlenA (lpString="*.c++") returned 5
	[0049.939] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.cs") returned 0
	[0049.939] lstrlenA (lpString="*.cs") returned 4
	[0049.939] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.vb") returned 0
	[0049.939] lstrlenA (lpString="*.vb") returned 4
	[0049.939] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.bas") returned 0
	[0049.939] lstrlenA (lpString="*.bas") returned 5
	[0049.939] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.csproj") returned 0
	[0049.939] lstrlenA (lpString="*.csproj") returned 8
	[0049.939] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.vbproj") returned 0
	[0049.939] lstrlenA (lpString="*.vbproj") returned 8
	[0049.939] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.vcxproj") returned 0
	[0049.939] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.939] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.manifest") returned 0
	[0049.939] lstrlenA (lpString="*.manifest") returned 10
	[0049.939] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.php") returned 0
	[0049.940] lstrlenA (lpString="*.php") returned 5
	[0049.940] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.vbe") returned 0
	[0049.940] lstrlenA (lpString="*.vbe") returned 5
	[0049.940] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.vba") returned 0
	[0049.940] lstrlenA (lpString="*.vba") returned 5
	[0049.940] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.vbs") returned 0
	[0049.940] lstrlenA (lpString="*.vbs") returned 5
	[0049.940] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.bat") returned 0
	[0049.940] lstrlenA (lpString="*.bat") returned 5
	[0049.940] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.cmd") returned 0
	[0049.940] lstrlenA (lpString="*.cmd") returned 5
	[0049.940] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.js") returned 0
	[0049.940] lstrlenA (lpString="*.js") returned 4
	[0049.940] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.jscript") returned 0
	[0049.940] lstrlenA (lpString="*.jscript") returned 9
	[0049.940] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.hta") returned 0
	[0049.940] lstrlenA (lpString="*.hta") returned 5
	[0049.940] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.php7") returned 0
	[0049.940] lstrlenA (lpString="*.php7") returned 6
	[0049.940] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.db") returned 0
	[0049.940] lstrlenA (lpString="*.db") returned 4
	[0049.940] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.swf") returned 0
	[0049.940] lstrlenA (lpString="*.swf") returned 5
	[0049.940] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.eml") returned 0
	[0049.940] lstrlenA (lpString="*.eml") returned 5
	[0049.940] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.part") returned 0
	[0049.940] lstrlenA (lpString="*.part") returned 6
	[0049.940] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.nfo") returned 0
	[0049.940] lstrlenA (lpString="*.nfo") returned 5
	[0049.940] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.rsa") returned 0
	[0049.940] lstrlenA (lpString="*.rsa") returned 5
	[0049.940] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.key") returned 0
	[0049.940] lstrlenA (lpString="*.key") returned 5
	[0049.940] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.aes") returned 0
	[0049.940] lstrlenA (lpString="*.aes") returned 5
	[0049.940] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.blob") returned 0
	[0049.941] lstrlenA (lpString="*.blob") returned 6
	[0049.941] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.btc") returned 0
	[0049.941] lstrlenA (lpString="*.btc") returned 5
	[0049.941] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.wallet") returned 0
	[0049.941] lstrlenA (lpString="*.wallet") returned 8
	[0049.941] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0049.941] FindClose (in: hFindFile=0x7cb950 | out: hFindFile=0x7cb950) returned 1
	[0049.941] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0049.941] lstrcmpA (lpString1=".", lpString2="el-GR") returned -1
	[0049.941] lstrcmpA (lpString1="..", lpString2="el-GR") returned -1
	[0049.941] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0049.941] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="el-GR" | out: lpString1="C:\\Boot\\el-GR") returned="C:\\Boot\\el-GR"
	[0049.941] lstrlenA (lpString="C:\\Boot\\el-GR") returned 13
	[0049.941] FindFirstFileA (in: lpFileName="C:\\Boot\\el-GR\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb750
	[0049.942] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0049.942] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0049.942] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0049.942] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0049.942] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0049.942] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.942] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr.exe.mui") returned 1
	[0049.942] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr.exe.mui") returned 1
	[0049.942] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0049.942] PathFindFileNameA (pszPath="C:\\Boot\\el-GR\\*.*") returned="*.*"
	[0049.942] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\el-GR\\" | out: lpString1="C:\\Boot\\el-GR\\") returned="C:\\Boot\\el-GR\\"
	[0049.942] PathAddBackslashA (in: pszPath="C:\\Boot\\el-GR\\" | out: pszPath="C:\\Boot\\el-GR\\") returned=""
	[0049.942] lstrcatA (in: lpString1="C:\\Boot\\el-GR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\el-GR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\el-GR\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.942] GetFileAttributesA (lpFileName="C:\\Boot\\el-GR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\el-gr\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0049.942] CreateFileA (lpFileName="C:\\Boot\\el-GR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\el-gr\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0049.944] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0049.944] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0049.945] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0049.945] CloseHandle (hObject=0x208) returned 1
	[0049.946] lstrcatA (in: lpString1="C:\\Boot\\el-GR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned="C:\\Boot\\el-GR\\bootmgr.exe.mui"
	[0049.946] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0049.946] lstrlenA (lpString="*.zip") returned 5
	[0049.946] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0049.946] lstrlenA (lpString="*.rar") returned 5
	[0049.946] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0049.946] lstrlenA (lpString="*.7z") returned 4
	[0049.946] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0049.946] lstrlenA (lpString="*.tar") returned 5
	[0049.946] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0049.946] lstrlenA (lpString="*.gzip") returned 6
	[0049.946] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0049.946] lstrlenA (lpString="*.jpg") returned 5
	[0049.946] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0049.946] lstrlenA (lpString="*.jpeg") returned 6
	[0049.946] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0049.946] lstrlenA (lpString="*.bmp") returned 5
	[0049.946] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0049.946] lstrlenA (lpString="*.gif") returned 5
	[0049.946] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0049.946] lstrlenA (lpString="*.png") returned 5
	[0049.946] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0049.946] lstrlenA (lpString="*.doc") returned 5
	[0049.946] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0049.946] lstrlenA (lpString="*.docx") returned 6
	[0049.946] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0049.946] lstrlenA (lpString="*.xls") returned 5
	[0049.946] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0049.946] lstrlenA (lpString="*.xlsx") returned 6
	[0049.946] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0049.947] lstrlenA (lpString="*.ppt") returned 5
	[0049.947] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0049.947] lstrlenA (lpString="*.pptx") returned 6
	[0049.947] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0049.947] lstrlenA (lpString="*.txt") returned 5
	[0049.947] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0049.947] lstrlenA (lpString="*.pdf") returned 5
	[0049.947] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0049.947] lstrlenA (lpString="*.htm") returned 5
	[0049.947] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0049.947] lstrlenA (lpString="*.html") returned 6
	[0049.947] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0049.947] lstrlenA (lpString="*.mdb") returned 5
	[0049.947] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0049.947] lstrlenA (lpString="*.pfx") returned 5
	[0049.947] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0049.947] lstrlenA (lpString="*.md") returned 4
	[0049.947] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0049.947] lstrlenA (lpString="*.lnk") returned 5
	[0049.947] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0049.947] lstrlenA (lpString="*.torrent") returned 9
	[0049.947] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0049.947] lstrlenA (lpString="*.mov") returned 5
	[0049.947] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0049.947] lstrlenA (lpString="*.3gp") returned 5
	[0049.947] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0049.947] lstrlenA (lpString="*.mpeg") returned 6
	[0049.947] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0049.947] lstrlenA (lpString="*.mpg") returned 5
	[0049.947] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0049.947] lstrlenA (lpString="*.flv") returned 5
	[0049.947] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0049.947] lstrlenA (lpString="*.avi") returned 5
	[0049.947] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0049.947] lstrlenA (lpString="*.mp4") returned 5
	[0049.947] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0049.948] lstrlenA (lpString="*.wmv") returned 5
	[0049.948] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0049.948] lstrlenA (lpString="*.mkv") returned 5
	[0049.948] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0049.948] lstrlenA (lpString="*.mp3") returned 5
	[0049.948] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0049.948] lstrlenA (lpString="*.wav") returned 5
	[0049.948] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0049.948] lstrlenA (lpString="*.flac") returned 6
	[0049.948] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0049.948] lstrlenA (lpString="*.wma") returned 5
	[0049.948] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.au3") returned 0
	[0049.948] lstrlenA (lpString="*.au3") returned 5
	[0049.948] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.ahk") returned 0
	[0049.948] lstrlenA (lpString="*.ahk") returned 5
	[0049.948] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.c") returned 0
	[0049.948] lstrlenA (lpString="*.c") returned 3
	[0049.948] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.cc") returned 0
	[0049.948] lstrlenA (lpString="*.cc") returned 4
	[0049.948] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0
	[0049.948] lstrlenA (lpString="*.cpp") returned 5
	[0049.948] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.cxx") returned 0
	[0049.948] lstrlenA (lpString="*.cxx") returned 5
	[0049.948] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.c++") returned 0
	[0049.948] lstrlenA (lpString="*.c++") returned 5
	[0049.948] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.cs") returned 0
	[0049.948] lstrlenA (lpString="*.cs") returned 4
	[0049.948] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.vb") returned 0
	[0049.948] lstrlenA (lpString="*.vb") returned 4
	[0049.948] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.bas") returned 0
	[0049.948] lstrlenA (lpString="*.bas") returned 5
	[0049.948] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.csproj") returned 0
	[0049.948] lstrlenA (lpString="*.csproj") returned 8
	[0049.948] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.vbproj") returned 0
	[0049.948] lstrlenA (lpString="*.vbproj") returned 8
	[0049.949] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.vcxproj") returned 0
	[0049.949] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.949] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.manifest") returned 0
	[0049.949] lstrlenA (lpString="*.manifest") returned 10
	[0049.949] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.php") returned 0
	[0049.949] lstrlenA (lpString="*.php") returned 5
	[0049.949] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.vbe") returned 0
	[0049.949] lstrlenA (lpString="*.vbe") returned 5
	[0049.949] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.vba") returned 0
	[0049.949] lstrlenA (lpString="*.vba") returned 5
	[0049.949] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.vbs") returned 0
	[0049.949] lstrlenA (lpString="*.vbs") returned 5
	[0049.949] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.bat") returned 0
	[0049.949] lstrlenA (lpString="*.bat") returned 5
	[0049.949] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.cmd") returned 0
	[0049.949] lstrlenA (lpString="*.cmd") returned 5
	[0049.949] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.js") returned 0
	[0049.949] lstrlenA (lpString="*.js") returned 4
	[0049.949] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.jscript") returned 0
	[0049.949] lstrlenA (lpString="*.jscript") returned 9
	[0049.949] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.hta") returned 0
	[0049.949] lstrlenA (lpString="*.hta") returned 5
	[0049.949] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.php7") returned 0
	[0049.949] lstrlenA (lpString="*.php7") returned 6
	[0049.949] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.db") returned 0
	[0049.949] lstrlenA (lpString="*.db") returned 4
	[0049.949] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.swf") returned 0
	[0049.949] lstrlenA (lpString="*.swf") returned 5
	[0049.949] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.eml") returned 0
	[0049.949] lstrlenA (lpString="*.eml") returned 5
	[0049.949] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.part") returned 0
	[0049.949] lstrlenA (lpString="*.part") returned 6
	[0049.949] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.nfo") returned 0
	[0049.949] lstrlenA (lpString="*.nfo") returned 5
	[0049.949] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.rsa") returned 0
	[0049.950] lstrlenA (lpString="*.rsa") returned 5
	[0049.950] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.key") returned 0
	[0049.950] lstrlenA (lpString="*.key") returned 5
	[0049.950] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.aes") returned 0
	[0049.950] lstrlenA (lpString="*.aes") returned 5
	[0049.950] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.blob") returned 0
	[0049.950] lstrlenA (lpString="*.blob") returned 6
	[0049.950] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.btc") returned 0
	[0049.950] lstrlenA (lpString="*.btc") returned 5
	[0049.950] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.wallet") returned 0
	[0049.950] lstrlenA (lpString="*.wallet") returned 8
	[0049.950] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0049.950] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.950] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="memtest.exe.mui") returned -1
	[0049.950] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="memtest.exe.mui") returned -1
	[0049.950] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1
	[0049.950] PathFindFileNameA (pszPath="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned="bootmgr.exe.mui"
	[0049.950] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\el-GR\\" | out: lpString1="C:\\Boot\\el-GR\\") returned="C:\\Boot\\el-GR\\"
	[0049.950] PathAddBackslashA (in: pszPath="C:\\Boot\\el-GR\\" | out: pszPath="C:\\Boot\\el-GR\\") returned=""
	[0049.950] lstrcatA (in: lpString1="C:\\Boot\\el-GR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\el-GR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\el-GR\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.950] GetFileAttributesA (lpFileName="C:\\Boot\\el-GR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\el-gr\\how-to-decrypt-files.htm")) returned 0x20
	[0049.950] lstrcatA (in: lpString1="C:\\Boot\\el-GR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\el-GR\\memtest.exe.mui") returned="C:\\Boot\\el-GR\\memtest.exe.mui"
	[0049.950] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.zip") returned 0
	[0049.950] lstrlenA (lpString="*.zip") returned 5
	[0049.950] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.rar") returned 0
	[0049.950] lstrlenA (lpString="*.rar") returned 5
	[0049.950] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.7z") returned 0
	[0049.950] lstrlenA (lpString="*.7z") returned 4
	[0049.950] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.tar") returned 0
	[0049.950] lstrlenA (lpString="*.tar") returned 5
	[0049.950] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.gzip") returned 0
	[0049.951] lstrlenA (lpString="*.gzip") returned 6
	[0049.951] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.jpg") returned 0
	[0049.951] lstrlenA (lpString="*.jpg") returned 5
	[0049.951] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.jpeg") returned 0
	[0049.951] lstrlenA (lpString="*.jpeg") returned 6
	[0049.951] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.bmp") returned 0
	[0049.951] lstrlenA (lpString="*.bmp") returned 5
	[0049.951] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.gif") returned 0
	[0049.951] lstrlenA (lpString="*.gif") returned 5
	[0049.951] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.png") returned 0
	[0049.951] lstrlenA (lpString="*.png") returned 5
	[0049.951] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.doc") returned 0
	[0049.951] lstrlenA (lpString="*.doc") returned 5
	[0049.951] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.docx") returned 0
	[0049.951] lstrlenA (lpString="*.docx") returned 6
	[0049.951] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.xls") returned 0
	[0049.951] lstrlenA (lpString="*.xls") returned 5
	[0049.951] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.xlsx") returned 0
	[0049.951] lstrlenA (lpString="*.xlsx") returned 6
	[0049.951] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.ppt") returned 0
	[0049.951] lstrlenA (lpString="*.ppt") returned 5
	[0049.951] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.pptx") returned 0
	[0049.951] lstrlenA (lpString="*.pptx") returned 6
	[0049.951] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.txt") returned 0
	[0049.951] lstrlenA (lpString="*.txt") returned 5
	[0049.951] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.pdf") returned 0
	[0049.951] lstrlenA (lpString="*.pdf") returned 5
	[0049.951] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.htm") returned 0
	[0049.951] lstrlenA (lpString="*.htm") returned 5
	[0049.951] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.html") returned 0
	[0049.951] lstrlenA (lpString="*.html") returned 6
	[0049.951] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.mdb") returned 0
	[0049.951] lstrlenA (lpString="*.mdb") returned 5
	[0049.951] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.pfx") returned 0
	[0049.951] lstrlenA (lpString="*.pfx") returned 5
	[0049.951] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.md") returned 0
	[0049.952] lstrlenA (lpString="*.md") returned 4
	[0049.952] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.lnk") returned 0
	[0049.952] lstrlenA (lpString="*.lnk") returned 5
	[0049.952] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.torrent") returned 0
	[0049.952] lstrlenA (lpString="*.torrent") returned 9
	[0049.952] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.mov") returned 0
	[0049.952] lstrlenA (lpString="*.mov") returned 5
	[0049.952] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.3gp") returned 0
	[0049.952] lstrlenA (lpString="*.3gp") returned 5
	[0049.952] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.mpeg") returned 0
	[0049.952] lstrlenA (lpString="*.mpeg") returned 6
	[0049.952] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.mpg") returned 0
	[0049.952] lstrlenA (lpString="*.mpg") returned 5
	[0049.952] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.flv") returned 0
	[0049.952] lstrlenA (lpString="*.flv") returned 5
	[0049.952] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.avi") returned 0
	[0049.952] lstrlenA (lpString="*.avi") returned 5
	[0049.952] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.mp4") returned 0
	[0049.952] lstrlenA (lpString="*.mp4") returned 5
	[0049.952] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.wmv") returned 0
	[0049.952] lstrlenA (lpString="*.wmv") returned 5
	[0049.952] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.mkv") returned 0
	[0049.952] lstrlenA (lpString="*.mkv") returned 5
	[0049.952] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.mp3") returned 0
	[0049.952] lstrlenA (lpString="*.mp3") returned 5
	[0049.952] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.wav") returned 0
	[0049.952] lstrlenA (lpString="*.wav") returned 5
	[0049.952] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.flac") returned 0
	[0049.952] lstrlenA (lpString="*.flac") returned 6
	[0049.952] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.wma") returned 0
	[0049.952] lstrlenA (lpString="*.wma") returned 5
	[0049.952] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.au3") returned 0
	[0049.952] lstrlenA (lpString="*.au3") returned 5
	[0049.953] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.ahk") returned 0
	[0049.953] lstrlenA (lpString="*.ahk") returned 5
	[0049.953] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.c") returned 0
	[0049.953] lstrlenA (lpString="*.c") returned 3
	[0049.953] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.cc") returned 0
	[0049.953] lstrlenA (lpString="*.cc") returned 4
	[0049.953] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.cpp") returned 0
	[0049.953] lstrlenA (lpString="*.cpp") returned 5
	[0049.953] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.cxx") returned 0
	[0049.953] lstrlenA (lpString="*.cxx") returned 5
	[0049.953] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.c++") returned 0
	[0049.953] lstrlenA (lpString="*.c++") returned 5
	[0049.953] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.cs") returned 0
	[0049.953] lstrlenA (lpString="*.cs") returned 4
	[0049.953] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.vb") returned 0
	[0049.953] lstrlenA (lpString="*.vb") returned 4
	[0049.953] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.bas") returned 0
	[0049.953] lstrlenA (lpString="*.bas") returned 5
	[0049.953] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.csproj") returned 0
	[0049.953] lstrlenA (lpString="*.csproj") returned 8
	[0049.953] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.vbproj") returned 0
	[0049.953] lstrlenA (lpString="*.vbproj") returned 8
	[0049.953] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.vcxproj") returned 0
	[0049.953] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.953] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.manifest") returned 0
	[0049.953] lstrlenA (lpString="*.manifest") returned 10
	[0049.953] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.php") returned 0
	[0049.953] lstrlenA (lpString="*.php") returned 5
	[0049.953] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.vbe") returned 0
	[0049.953] lstrlenA (lpString="*.vbe") returned 5
	[0049.953] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.vba") returned 0
	[0049.953] lstrlenA (lpString="*.vba") returned 5
	[0049.953] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.vbs") returned 0
	[0049.953] lstrlenA (lpString="*.vbs") returned 5
	[0049.954] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.bat") returned 0
	[0049.954] lstrlenA (lpString="*.bat") returned 5
	[0049.954] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.cmd") returned 0
	[0049.954] lstrlenA (lpString="*.cmd") returned 5
	[0049.954] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.js") returned 0
	[0049.954] lstrlenA (lpString="*.js") returned 4
	[0049.954] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.jscript") returned 0
	[0049.954] lstrlenA (lpString="*.jscript") returned 9
	[0049.954] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.hta") returned 0
	[0049.954] lstrlenA (lpString="*.hta") returned 5
	[0049.954] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.php7") returned 0
	[0049.954] lstrlenA (lpString="*.php7") returned 6
	[0049.954] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.db") returned 0
	[0049.954] lstrlenA (lpString="*.db") returned 4
	[0049.954] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.swf") returned 0
	[0049.954] lstrlenA (lpString="*.swf") returned 5
	[0049.954] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.eml") returned 0
	[0049.954] lstrlenA (lpString="*.eml") returned 5
	[0049.954] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.part") returned 0
	[0049.954] lstrlenA (lpString="*.part") returned 6
	[0049.954] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.nfo") returned 0
	[0049.954] lstrlenA (lpString="*.nfo") returned 5
	[0049.954] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.rsa") returned 0
	[0049.954] lstrlenA (lpString="*.rsa") returned 5
	[0049.954] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.key") returned 0
	[0049.954] lstrlenA (lpString="*.key") returned 5
	[0049.954] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.aes") returned 0
	[0049.954] lstrlenA (lpString="*.aes") returned 5
	[0049.954] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.blob") returned 0
	[0049.954] lstrlenA (lpString="*.blob") returned 6
	[0049.954] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.btc") returned 0
	[0049.954] lstrlenA (lpString="*.btc") returned 5
	[0049.954] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.wallet") returned 0
	[0049.954] lstrlenA (lpString="*.wallet") returned 8
	[0049.955] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0049.955] FindClose (in: hFindFile=0x7cb750 | out: hFindFile=0x7cb750) returned 1
	[0049.955] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1
	[0049.955] lstrcmpA (lpString1=".", lpString2="en-GB") returned -1
	[0049.955] lstrcmpA (lpString1="..", lpString2="en-GB") returned -1
	[0049.955] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0049.955] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="en-GB" | out: lpString1="C:\\Boot\\en-GB") returned="C:\\Boot\\en-GB"
	[0049.955] lstrlenA (lpString="C:\\Boot\\en-GB") returned 13
	[0049.955] FindFirstFileA (in: lpFileName="C:\\Boot\\en-GB\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb590
	[0049.962] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0049.962] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0049.962] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0049.962] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0049.962] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0049.962] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.962] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr.exe.mui") returned 1
	[0049.962] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr.exe.mui") returned 1
	[0049.962] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0049.962] PathFindFileNameA (pszPath="C:\\Boot\\en-GB\\*.*") returned="*.*"
	[0049.962] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\en-GB\\" | out: lpString1="C:\\Boot\\en-GB\\") returned="C:\\Boot\\en-GB\\"
	[0049.962] PathAddBackslashA (in: pszPath="C:\\Boot\\en-GB\\" | out: pszPath="C:\\Boot\\en-GB\\") returned=""
	[0049.962] lstrcatA (in: lpString1="C:\\Boot\\en-GB\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\en-GB\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\en-GB\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.962] GetFileAttributesA (lpFileName="C:\\Boot\\en-GB\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\en-gb\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0049.963] CreateFileA (lpFileName="C:\\Boot\\en-GB\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\en-gb\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0049.963] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0049.963] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0049.964] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0049.964] CloseHandle (hObject=0x208) returned 1
	[0049.965] lstrcatA (in: lpString1="C:\\Boot\\en-GB\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned="C:\\Boot\\en-GB\\bootmgr.exe.mui"
	[0049.965] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0049.965] lstrlenA (lpString="*.zip") returned 5
	[0049.965] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0049.965] lstrlenA (lpString="*.rar") returned 5
	[0049.965] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0049.965] lstrlenA (lpString="*.7z") returned 4
	[0049.965] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0049.965] lstrlenA (lpString="*.tar") returned 5
	[0049.965] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0049.965] lstrlenA (lpString="*.gzip") returned 6
	[0049.965] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0049.965] lstrlenA (lpString="*.jpg") returned 5
	[0049.965] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0049.965] lstrlenA (lpString="*.jpeg") returned 6
	[0049.965] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0049.965] lstrlenA (lpString="*.bmp") returned 5
	[0049.965] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0049.965] lstrlenA (lpString="*.gif") returned 5
	[0049.965] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0049.965] lstrlenA (lpString="*.png") returned 5
	[0049.965] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0049.965] lstrlenA (lpString="*.doc") returned 5
	[0049.965] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0049.965] lstrlenA (lpString="*.docx") returned 6
	[0049.965] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0049.965] lstrlenA (lpString="*.xls") returned 5
	[0049.965] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0049.965] lstrlenA (lpString="*.xlsx") returned 6
	[0049.965] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0049.965] lstrlenA (lpString="*.ppt") returned 5
	[0049.965] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0049.966] lstrlenA (lpString="*.pptx") returned 6
	[0049.966] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0049.966] lstrlenA (lpString="*.txt") returned 5
	[0049.966] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0049.966] lstrlenA (lpString="*.pdf") returned 5
	[0049.966] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0049.966] lstrlenA (lpString="*.htm") returned 5
	[0049.966] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0049.966] lstrlenA (lpString="*.html") returned 6
	[0049.966] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0049.966] lstrlenA (lpString="*.mdb") returned 5
	[0049.966] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0049.966] lstrlenA (lpString="*.pfx") returned 5
	[0049.966] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0049.966] lstrlenA (lpString="*.md") returned 4
	[0049.966] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0049.966] lstrlenA (lpString="*.lnk") returned 5
	[0049.966] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0049.966] lstrlenA (lpString="*.torrent") returned 9
	[0049.966] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0049.966] lstrlenA (lpString="*.mov") returned 5
	[0049.966] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0049.966] lstrlenA (lpString="*.3gp") returned 5
	[0049.966] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0049.966] lstrlenA (lpString="*.mpeg") returned 6
	[0049.966] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0049.966] lstrlenA (lpString="*.mpg") returned 5
	[0049.966] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0049.966] lstrlenA (lpString="*.flv") returned 5
	[0049.966] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0049.966] lstrlenA (lpString="*.avi") returned 5
	[0049.966] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0049.966] lstrlenA (lpString="*.mp4") returned 5
	[0049.966] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0049.967] lstrlenA (lpString="*.wmv") returned 5
	[0049.967] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0049.967] lstrlenA (lpString="*.mkv") returned 5
	[0049.967] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0049.967] lstrlenA (lpString="*.mp3") returned 5
	[0049.967] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0049.967] lstrlenA (lpString="*.wav") returned 5
	[0049.967] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0049.967] lstrlenA (lpString="*.flac") returned 6
	[0049.967] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0049.967] lstrlenA (lpString="*.wma") returned 5
	[0049.967] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.au3") returned 0
	[0049.967] lstrlenA (lpString="*.au3") returned 5
	[0049.967] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.ahk") returned 0
	[0049.967] lstrlenA (lpString="*.ahk") returned 5
	[0049.967] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.c") returned 0
	[0049.967] lstrlenA (lpString="*.c") returned 3
	[0049.967] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.cc") returned 0
	[0049.967] lstrlenA (lpString="*.cc") returned 4
	[0049.967] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0
	[0049.967] lstrlenA (lpString="*.cpp") returned 5
	[0049.967] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.cxx") returned 0
	[0049.967] lstrlenA (lpString="*.cxx") returned 5
	[0049.967] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.c++") returned 0
	[0049.967] lstrlenA (lpString="*.c++") returned 5
	[0049.967] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.cs") returned 0
	[0049.967] lstrlenA (lpString="*.cs") returned 4
	[0049.967] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.vb") returned 0
	[0049.967] lstrlenA (lpString="*.vb") returned 4
	[0049.967] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.bas") returned 0
	[0049.967] lstrlenA (lpString="*.bas") returned 5
	[0049.967] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.csproj") returned 0
	[0049.967] lstrlenA (lpString="*.csproj") returned 8
	[0049.967] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.vbproj") returned 0
	[0049.968] lstrlenA (lpString="*.vbproj") returned 8
	[0049.968] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.vcxproj") returned 0
	[0049.968] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.968] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.manifest") returned 0
	[0049.968] lstrlenA (lpString="*.manifest") returned 10
	[0049.968] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.php") returned 0
	[0049.968] lstrlenA (lpString="*.php") returned 5
	[0049.968] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.vbe") returned 0
	[0049.968] lstrlenA (lpString="*.vbe") returned 5
	[0049.968] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.vba") returned 0
	[0049.968] lstrlenA (lpString="*.vba") returned 5
	[0049.968] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.vbs") returned 0
	[0049.968] lstrlenA (lpString="*.vbs") returned 5
	[0049.968] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.bat") returned 0
	[0049.968] lstrlenA (lpString="*.bat") returned 5
	[0049.968] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.cmd") returned 0
	[0049.968] lstrlenA (lpString="*.cmd") returned 5
	[0049.968] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.js") returned 0
	[0049.968] lstrlenA (lpString="*.js") returned 4
	[0049.968] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.jscript") returned 0
	[0049.968] lstrlenA (lpString="*.jscript") returned 9
	[0049.968] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.hta") returned 0
	[0049.968] lstrlenA (lpString="*.hta") returned 5
	[0049.968] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.php7") returned 0
	[0049.968] lstrlenA (lpString="*.php7") returned 6
	[0049.968] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.db") returned 0
	[0049.968] lstrlenA (lpString="*.db") returned 4
	[0049.968] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.swf") returned 0
	[0049.968] lstrlenA (lpString="*.swf") returned 5
	[0049.968] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.eml") returned 0
	[0049.968] lstrlenA (lpString="*.eml") returned 5
	[0049.968] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.part") returned 0
	[0049.968] lstrlenA (lpString="*.part") returned 6
	[0049.968] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.nfo") returned 0
	[0049.968] lstrlenA (lpString="*.nfo") returned 5
	[0049.969] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.rsa") returned 0
	[0049.969] lstrlenA (lpString="*.rsa") returned 5
	[0049.969] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.key") returned 0
	[0049.969] lstrlenA (lpString="*.key") returned 5
	[0049.969] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.aes") returned 0
	[0049.969] lstrlenA (lpString="*.aes") returned 5
	[0049.969] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.blob") returned 0
	[0049.969] lstrlenA (lpString="*.blob") returned 6
	[0049.969] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.btc") returned 0
	[0049.969] lstrlenA (lpString="*.btc") returned 5
	[0049.969] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.wallet") returned 0
	[0049.969] lstrlenA (lpString="*.wallet") returned 8
	[0049.969] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0049.969] FindClose (in: hFindFile=0x7cb590 | out: hFindFile=0x7cb590) returned 1
	[0049.969] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0049.969] lstrcmpA (lpString1=".", lpString2="en-US") returned -1
	[0049.969] lstrcmpA (lpString1="..", lpString2="en-US") returned -1
	[0049.969] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0049.969] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="en-US" | out: lpString1="C:\\Boot\\en-US") returned="C:\\Boot\\en-US"
	[0049.969] lstrlenA (lpString="C:\\Boot\\en-US") returned 13
	[0049.969] FindFirstFileA (in: lpFileName="C:\\Boot\\en-US\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb810
	[0049.969] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0049.969] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0049.969] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0049.970] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0049.970] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef569843, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x327294d0, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0049.970] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.970] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr.exe.mui") returned 1
	[0049.970] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr.exe.mui") returned 1
	[0049.970] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0049.970] PathFindFileNameA (pszPath="C:\\Boot\\en-US\\*.*") returned="*.*"
	[0049.970] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\en-US\\" | out: lpString1="C:\\Boot\\en-US\\") returned="C:\\Boot\\en-US\\"
	[0049.970] PathAddBackslashA (in: pszPath="C:\\Boot\\en-US\\" | out: pszPath="C:\\Boot\\en-US\\") returned=""
	[0049.970] lstrcatA (in: lpString1="C:\\Boot\\en-US\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\en-US\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\en-US\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.970] GetFileAttributesA (lpFileName="C:\\Boot\\en-US\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\en-us\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0049.970] CreateFileA (lpFileName="C:\\Boot\\en-US\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\en-us\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0049.972] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0049.972] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0049.972] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0049.973] CloseHandle (hObject=0x208) returned 1
	[0049.973] lstrcatA (in: lpString1="C:\\Boot\\en-US\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\en-US\\bootmgr.exe.mui") returned="C:\\Boot\\en-US\\bootmgr.exe.mui"
	[0049.973] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0049.973] lstrlenA (lpString="*.zip") returned 5
	[0049.973] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0049.973] lstrlenA (lpString="*.rar") returned 5
	[0049.973] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0049.973] lstrlenA (lpString="*.7z") returned 4
	[0049.973] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0049.973] lstrlenA (lpString="*.tar") returned 5
	[0049.973] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0049.973] lstrlenA (lpString="*.gzip") returned 6
	[0049.973] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0049.973] lstrlenA (lpString="*.jpg") returned 5
	[0049.973] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0049.973] lstrlenA (lpString="*.jpeg") returned 6
	[0049.973] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0049.973] lstrlenA (lpString="*.bmp") returned 5
	[0049.973] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0049.973] lstrlenA (lpString="*.gif") returned 5
	[0049.973] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0049.973] lstrlenA (lpString="*.png") returned 5
	[0049.973] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0049.973] lstrlenA (lpString="*.doc") returned 5
	[0049.973] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0049.973] lstrlenA (lpString="*.docx") returned 6
	[0049.973] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0049.973] lstrlenA (lpString="*.xls") returned 5
	[0049.973] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0049.973] lstrlenA (lpString="*.xlsx") returned 6
	[0049.974] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0049.974] lstrlenA (lpString="*.ppt") returned 5
	[0049.974] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0049.974] lstrlenA (lpString="*.pptx") returned 6
	[0049.974] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0049.974] lstrlenA (lpString="*.txt") returned 5
	[0049.974] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0049.974] lstrlenA (lpString="*.pdf") returned 5
	[0049.974] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0049.974] lstrlenA (lpString="*.htm") returned 5
	[0049.974] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0049.974] lstrlenA (lpString="*.html") returned 6
	[0049.974] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0049.974] lstrlenA (lpString="*.mdb") returned 5
	[0049.974] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0049.974] lstrlenA (lpString="*.pfx") returned 5
	[0049.974] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0049.974] lstrlenA (lpString="*.md") returned 4
	[0049.974] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0049.974] lstrlenA (lpString="*.lnk") returned 5
	[0049.974] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0049.974] lstrlenA (lpString="*.torrent") returned 9
	[0049.974] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0049.974] lstrlenA (lpString="*.mov") returned 5
	[0049.974] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0049.974] lstrlenA (lpString="*.3gp") returned 5
	[0049.974] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0049.974] lstrlenA (lpString="*.mpeg") returned 6
	[0049.974] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0049.975] lstrlenA (lpString="*.mpg") returned 5
	[0049.975] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0049.975] lstrlenA (lpString="*.flv") returned 5
	[0049.975] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0049.975] lstrlenA (lpString="*.avi") returned 5
	[0049.975] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0049.975] lstrlenA (lpString="*.mp4") returned 5
	[0049.975] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0049.975] lstrlenA (lpString="*.wmv") returned 5
	[0049.975] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0049.975] lstrlenA (lpString="*.mkv") returned 5
	[0049.975] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0049.975] lstrlenA (lpString="*.mp3") returned 5
	[0049.975] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0049.975] lstrlenA (lpString="*.wav") returned 5
	[0049.975] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0049.975] lstrlenA (lpString="*.flac") returned 6
	[0049.975] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0049.975] lstrlenA (lpString="*.wma") returned 5
	[0049.975] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.au3") returned 0
	[0049.975] lstrlenA (lpString="*.au3") returned 5
	[0049.975] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.ahk") returned 0
	[0049.975] lstrlenA (lpString="*.ahk") returned 5
	[0049.975] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.c") returned 0
	[0049.975] lstrlenA (lpString="*.c") returned 3
	[0049.975] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.cc") returned 0
	[0049.975] lstrlenA (lpString="*.cc") returned 4
	[0049.975] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0
	[0049.975] lstrlenA (lpString="*.cpp") returned 5
	[0049.975] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.cxx") returned 0
	[0049.975] lstrlenA (lpString="*.cxx") returned 5
	[0049.975] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.c++") returned 0
	[0049.975] lstrlenA (lpString="*.c++") returned 5
	[0049.975] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.cs") returned 0
	[0049.976] lstrlenA (lpString="*.cs") returned 4
	[0049.976] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.vb") returned 0
	[0049.976] lstrlenA (lpString="*.vb") returned 4
	[0049.976] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.bas") returned 0
	[0049.976] lstrlenA (lpString="*.bas") returned 5
	[0049.976] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.csproj") returned 0
	[0049.976] lstrlenA (lpString="*.csproj") returned 8
	[0049.976] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.vbproj") returned 0
	[0049.976] lstrlenA (lpString="*.vbproj") returned 8
	[0049.976] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.vcxproj") returned 0
	[0049.976] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.976] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.manifest") returned 0
	[0049.976] lstrlenA (lpString="*.manifest") returned 10
	[0049.976] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.php") returned 0
	[0049.976] lstrlenA (lpString="*.php") returned 5
	[0049.976] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.vbe") returned 0
	[0049.976] lstrlenA (lpString="*.vbe") returned 5
	[0049.976] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.vba") returned 0
	[0049.976] lstrlenA (lpString="*.vba") returned 5
	[0049.976] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.vbs") returned 0
	[0049.976] lstrlenA (lpString="*.vbs") returned 5
	[0049.976] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.bat") returned 0
	[0049.976] lstrlenA (lpString="*.bat") returned 5
	[0049.976] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.cmd") returned 0
	[0049.976] lstrlenA (lpString="*.cmd") returned 5
	[0049.976] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.js") returned 0
	[0049.976] lstrlenA (lpString="*.js") returned 4
	[0049.976] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.jscript") returned 0
	[0049.976] lstrlenA (lpString="*.jscript") returned 9
	[0049.976] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.hta") returned 0
	[0049.976] lstrlenA (lpString="*.hta") returned 5
	[0049.976] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.php7") returned 0
	[0049.976] lstrlenA (lpString="*.php7") returned 6
	[0049.976] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.db") returned 0
	[0049.976] lstrlenA (lpString="*.db") returned 4
	[0049.977] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.swf") returned 0
	[0049.977] lstrlenA (lpString="*.swf") returned 5
	[0049.977] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.eml") returned 0
	[0049.977] lstrlenA (lpString="*.eml") returned 5
	[0049.977] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.part") returned 0
	[0049.977] lstrlenA (lpString="*.part") returned 6
	[0049.977] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.nfo") returned 0
	[0049.977] lstrlenA (lpString="*.nfo") returned 5
	[0049.977] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.rsa") returned 0
	[0049.977] lstrlenA (lpString="*.rsa") returned 5
	[0049.977] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.key") returned 0
	[0049.977] lstrlenA (lpString="*.key") returned 5
	[0049.977] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.aes") returned 0
	[0049.977] lstrlenA (lpString="*.aes") returned 5
	[0049.977] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.blob") returned 0
	[0049.977] lstrlenA (lpString="*.blob") returned 6
	[0049.977] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.btc") returned 0
	[0049.977] lstrlenA (lpString="*.btc") returned 5
	[0049.977] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.wallet") returned 0
	[0049.977] lstrlenA (lpString="*.wallet") returned 8
	[0049.977] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0049.977] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.977] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="memtest.exe.mui") returned -1
	[0049.977] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="memtest.exe.mui") returned -1
	[0049.977] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1
	[0049.977] PathFindFileNameA (pszPath="C:\\Boot\\en-US\\bootmgr.exe.mui") returned="bootmgr.exe.mui"
	[0049.977] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\en-US\\" | out: lpString1="C:\\Boot\\en-US\\") returned="C:\\Boot\\en-US\\"
	[0049.977] PathAddBackslashA (in: pszPath="C:\\Boot\\en-US\\" | out: pszPath="C:\\Boot\\en-US\\") returned=""
	[0049.977] lstrcatA (in: lpString1="C:\\Boot\\en-US\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\en-US\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\en-US\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.977] GetFileAttributesA (lpFileName="C:\\Boot\\en-US\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\en-us\\how-to-decrypt-files.htm")) returned 0x20
	[0049.977] lstrcatA (in: lpString1="C:\\Boot\\en-US\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\en-US\\memtest.exe.mui") returned="C:\\Boot\\en-US\\memtest.exe.mui"
	[0049.977] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.zip") returned 0
	[0049.978] lstrlenA (lpString="*.zip") returned 5
	[0049.978] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.rar") returned 0
	[0049.978] lstrlenA (lpString="*.rar") returned 5
	[0049.978] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.7z") returned 0
	[0049.978] lstrlenA (lpString="*.7z") returned 4
	[0049.978] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.tar") returned 0
	[0049.978] lstrlenA (lpString="*.tar") returned 5
	[0049.978] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.gzip") returned 0
	[0049.978] lstrlenA (lpString="*.gzip") returned 6
	[0049.978] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.jpg") returned 0
	[0049.978] lstrlenA (lpString="*.jpg") returned 5
	[0049.978] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.jpeg") returned 0
	[0049.978] lstrlenA (lpString="*.jpeg") returned 6
	[0049.978] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.bmp") returned 0
	[0049.978] lstrlenA (lpString="*.bmp") returned 5
	[0049.978] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.gif") returned 0
	[0049.978] lstrlenA (lpString="*.gif") returned 5
	[0049.978] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.png") returned 0
	[0049.978] lstrlenA (lpString="*.png") returned 5
	[0049.978] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.doc") returned 0
	[0049.978] lstrlenA (lpString="*.doc") returned 5
	[0049.978] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.docx") returned 0
	[0049.978] lstrlenA (lpString="*.docx") returned 6
	[0049.978] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.xls") returned 0
	[0049.978] lstrlenA (lpString="*.xls") returned 5
	[0049.978] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.xlsx") returned 0
	[0049.978] lstrlenA (lpString="*.xlsx") returned 6
	[0049.978] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.ppt") returned 0
	[0049.978] lstrlenA (lpString="*.ppt") returned 5
	[0049.978] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.pptx") returned 0
	[0049.978] lstrlenA (lpString="*.pptx") returned 6
	[0049.978] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.txt") returned 0
	[0049.978] lstrlenA (lpString="*.txt") returned 5
	[0049.978] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.pdf") returned 0
	[0049.978] lstrlenA (lpString="*.pdf") returned 5
	[0049.978] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.htm") returned 0
	[0049.979] lstrlenA (lpString="*.htm") returned 5
	[0049.979] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.html") returned 0
	[0049.979] lstrlenA (lpString="*.html") returned 6
	[0049.979] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mdb") returned 0
	[0049.979] lstrlenA (lpString="*.mdb") returned 5
	[0049.979] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.pfx") returned 0
	[0049.979] lstrlenA (lpString="*.pfx") returned 5
	[0049.979] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.md") returned 0
	[0049.979] lstrlenA (lpString="*.md") returned 4
	[0049.979] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.lnk") returned 0
	[0049.979] lstrlenA (lpString="*.lnk") returned 5
	[0049.979] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.torrent") returned 0
	[0049.979] lstrlenA (lpString="*.torrent") returned 9
	[0049.979] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mov") returned 0
	[0049.979] lstrlenA (lpString="*.mov") returned 5
	[0049.979] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.3gp") returned 0
	[0049.979] lstrlenA (lpString="*.3gp") returned 5
	[0049.979] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mpeg") returned 0
	[0049.979] lstrlenA (lpString="*.mpeg") returned 6
	[0049.979] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mpg") returned 0
	[0049.979] lstrlenA (lpString="*.mpg") returned 5
	[0049.979] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.flv") returned 0
	[0049.979] lstrlenA (lpString="*.flv") returned 5
	[0049.979] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.avi") returned 0
	[0049.979] lstrlenA (lpString="*.avi") returned 5
	[0049.979] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mp4") returned 0
	[0049.979] lstrlenA (lpString="*.mp4") returned 5
	[0049.979] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.wmv") returned 0
	[0049.979] lstrlenA (lpString="*.wmv") returned 5
	[0049.979] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mkv") returned 0
	[0049.979] lstrlenA (lpString="*.mkv") returned 5
	[0049.979] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mp3") returned 0
	[0049.979] lstrlenA (lpString="*.mp3") returned 5
	[0049.979] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.wav") returned 0
	[0049.979] lstrlenA (lpString="*.wav") returned 5
	[0049.979] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.flac") returned 0
	[0049.980] lstrlenA (lpString="*.flac") returned 6
	[0049.980] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.wma") returned 0
	[0049.980] lstrlenA (lpString="*.wma") returned 5
	[0049.980] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.au3") returned 0
	[0049.980] lstrlenA (lpString="*.au3") returned 5
	[0049.980] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.ahk") returned 0
	[0049.980] lstrlenA (lpString="*.ahk") returned 5
	[0049.980] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.c") returned 0
	[0049.980] lstrlenA (lpString="*.c") returned 3
	[0049.980] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.cc") returned 0
	[0049.980] lstrlenA (lpString="*.cc") returned 4
	[0049.980] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.cpp") returned 0
	[0049.980] lstrlenA (lpString="*.cpp") returned 5
	[0049.980] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.cxx") returned 0
	[0049.980] lstrlenA (lpString="*.cxx") returned 5
	[0049.980] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.c++") returned 0
	[0049.980] lstrlenA (lpString="*.c++") returned 5
	[0049.980] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.cs") returned 0
	[0049.980] lstrlenA (lpString="*.cs") returned 4
	[0049.980] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.vb") returned 0
	[0049.980] lstrlenA (lpString="*.vb") returned 4
	[0049.980] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.bas") returned 0
	[0049.980] lstrlenA (lpString="*.bas") returned 5
	[0049.980] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.csproj") returned 0
	[0049.980] lstrlenA (lpString="*.csproj") returned 8
	[0049.980] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.vbproj") returned 0
	[0049.980] lstrlenA (lpString="*.vbproj") returned 8
	[0049.980] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.vcxproj") returned 0
	[0049.980] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.980] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.manifest") returned 0
	[0049.980] lstrlenA (lpString="*.manifest") returned 10
	[0049.980] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.php") returned 0
	[0049.980] lstrlenA (lpString="*.php") returned 5
	[0049.980] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.vbe") returned 0
	[0049.980] lstrlenA (lpString="*.vbe") returned 5
	[0049.980] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.vba") returned 0
	[0049.980] lstrlenA (lpString="*.vba") returned 5
	[0049.981] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.vbs") returned 0
	[0049.981] lstrlenA (lpString="*.vbs") returned 5
	[0049.981] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.bat") returned 0
	[0049.981] lstrlenA (lpString="*.bat") returned 5
	[0049.981] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.cmd") returned 0
	[0049.981] lstrlenA (lpString="*.cmd") returned 5
	[0049.981] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.js") returned 0
	[0049.981] lstrlenA (lpString="*.js") returned 4
	[0049.981] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.jscript") returned 0
	[0049.981] lstrlenA (lpString="*.jscript") returned 9
	[0049.981] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.hta") returned 0
	[0049.981] lstrlenA (lpString="*.hta") returned 5
	[0049.981] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.php7") returned 0
	[0049.981] lstrlenA (lpString="*.php7") returned 6
	[0049.981] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.db") returned 0
	[0049.981] lstrlenA (lpString="*.db") returned 4
	[0049.981] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.swf") returned 0
	[0049.981] lstrlenA (lpString="*.swf") returned 5
	[0049.981] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.eml") returned 0
	[0049.981] lstrlenA (lpString="*.eml") returned 5
	[0049.981] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.part") returned 0
	[0049.981] lstrlenA (lpString="*.part") returned 6
	[0049.981] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.nfo") returned 0
	[0049.981] lstrlenA (lpString="*.nfo") returned 5
	[0049.981] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.rsa") returned 0
	[0049.981] lstrlenA (lpString="*.rsa") returned 5
	[0049.981] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.key") returned 0
	[0049.981] lstrlenA (lpString="*.key") returned 5
	[0049.981] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.aes") returned 0
	[0049.981] lstrlenA (lpString="*.aes") returned 5
	[0049.981] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.blob") returned 0
	[0049.981] lstrlenA (lpString="*.blob") returned 6
	[0049.981] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.btc") returned 0
	[0049.981] lstrlenA (lpString="*.btc") returned 5
	[0049.981] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.wallet") returned 0
	[0049.981] lstrlenA (lpString="*.wallet") returned 8
	[0049.982] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0049.982] FindClose (in: hFindFile=0x7cb810 | out: hFindFile=0x7cb810) returned 1
	[0049.982] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0049.982] lstrcmpA (lpString1=".", lpString2="es-ES") returned -1
	[0049.982] lstrcmpA (lpString1="..", lpString2="es-ES") returned -1
	[0049.982] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0049.982] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="es-ES" | out: lpString1="C:\\Boot\\es-ES") returned="C:\\Boot\\es-ES"
	[0049.982] lstrlenA (lpString="C:\\Boot\\es-ES") returned 13
	[0049.982] FindFirstFileA (in: lpFileName="C:\\Boot\\es-ES\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbb90
	[0049.983] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0049.983] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0049.983] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0049.983] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0049.983] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0049.983] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.983] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr.exe.mui") returned 1
	[0049.983] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr.exe.mui") returned 1
	[0049.983] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0049.983] PathFindFileNameA (pszPath="C:\\Boot\\es-ES\\*.*") returned="*.*"
	[0049.983] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\es-ES\\" | out: lpString1="C:\\Boot\\es-ES\\") returned="C:\\Boot\\es-ES\\"
	[0049.983] PathAddBackslashA (in: pszPath="C:\\Boot\\es-ES\\" | out: pszPath="C:\\Boot\\es-ES\\") returned=""
	[0049.983] lstrcatA (in: lpString1="C:\\Boot\\es-ES\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\es-ES\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\es-ES\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.983] GetFileAttributesA (lpFileName="C:\\Boot\\es-ES\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\es-es\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0049.983] CreateFileA (lpFileName="C:\\Boot\\es-ES\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\es-es\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0049.985] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0049.985] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0049.986] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0049.986] CloseHandle (hObject=0x208) returned 1
	[0049.986] lstrcatA (in: lpString1="C:\\Boot\\es-ES\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned="C:\\Boot\\es-ES\\bootmgr.exe.mui"
	[0049.986] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0049.986] lstrlenA (lpString="*.zip") returned 5
	[0049.986] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0049.986] lstrlenA (lpString="*.rar") returned 5
	[0049.986] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0049.986] lstrlenA (lpString="*.7z") returned 4
	[0049.986] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0049.986] lstrlenA (lpString="*.tar") returned 5
	[0049.986] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0049.987] lstrlenA (lpString="*.gzip") returned 6
	[0049.987] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0049.987] lstrlenA (lpString="*.jpg") returned 5
	[0049.987] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0049.987] lstrlenA (lpString="*.jpeg") returned 6
	[0049.987] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0049.987] lstrlenA (lpString="*.bmp") returned 5
	[0049.987] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0049.987] lstrlenA (lpString="*.gif") returned 5
	[0049.987] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0049.987] lstrlenA (lpString="*.png") returned 5
	[0049.987] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0049.987] lstrlenA (lpString="*.doc") returned 5
	[0049.987] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0049.987] lstrlenA (lpString="*.docx") returned 6
	[0049.987] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0049.987] lstrlenA (lpString="*.xls") returned 5
	[0049.987] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0049.987] lstrlenA (lpString="*.xlsx") returned 6
	[0049.987] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0049.987] lstrlenA (lpString="*.ppt") returned 5
	[0049.987] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0049.987] lstrlenA (lpString="*.pptx") returned 6
	[0049.987] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0049.987] lstrlenA (lpString="*.txt") returned 5
	[0049.987] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0049.987] lstrlenA (lpString="*.pdf") returned 5
	[0049.987] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0049.987] lstrlenA (lpString="*.htm") returned 5
	[0049.987] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0049.987] lstrlenA (lpString="*.html") returned 6
	[0049.987] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0049.987] lstrlenA (lpString="*.mdb") returned 5
	[0049.987] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0049.987] lstrlenA (lpString="*.pfx") returned 5
	[0049.987] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0049.988] lstrlenA (lpString="*.md") returned 4
	[0049.988] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0049.988] lstrlenA (lpString="*.lnk") returned 5
	[0049.988] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0049.988] lstrlenA (lpString="*.torrent") returned 9
	[0049.988] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0049.988] lstrlenA (lpString="*.mov") returned 5
	[0049.988] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0049.988] lstrlenA (lpString="*.3gp") returned 5
	[0049.988] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0049.988] lstrlenA (lpString="*.mpeg") returned 6
	[0049.988] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0049.988] lstrlenA (lpString="*.mpg") returned 5
	[0049.988] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0049.988] lstrlenA (lpString="*.flv") returned 5
	[0049.988] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0049.988] lstrlenA (lpString="*.avi") returned 5
	[0049.988] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0049.988] lstrlenA (lpString="*.mp4") returned 5
	[0049.988] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0049.988] lstrlenA (lpString="*.wmv") returned 5
	[0049.988] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0049.988] lstrlenA (lpString="*.mkv") returned 5
	[0049.988] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0049.988] lstrlenA (lpString="*.mp3") returned 5
	[0049.988] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0049.988] lstrlenA (lpString="*.wav") returned 5
	[0049.988] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0049.988] lstrlenA (lpString="*.flac") returned 6
	[0049.988] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0049.988] lstrlenA (lpString="*.wma") returned 5
	[0049.988] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.au3") returned 0
	[0049.988] lstrlenA (lpString="*.au3") returned 5
	[0049.988] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.ahk") returned 0
	[0049.988] lstrlenA (lpString="*.ahk") returned 5
	[0049.988] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.c") returned 0
	[0049.988] lstrlenA (lpString="*.c") returned 3
	[0049.989] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.cc") returned 0
	[0049.989] lstrlenA (lpString="*.cc") returned 4
	[0049.989] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0
	[0049.989] lstrlenA (lpString="*.cpp") returned 5
	[0049.989] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.cxx") returned 0
	[0049.989] lstrlenA (lpString="*.cxx") returned 5
	[0049.989] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.c++") returned 0
	[0049.989] lstrlenA (lpString="*.c++") returned 5
	[0049.989] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.cs") returned 0
	[0049.989] lstrlenA (lpString="*.cs") returned 4
	[0049.989] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.vb") returned 0
	[0049.989] lstrlenA (lpString="*.vb") returned 4
	[0049.989] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.bas") returned 0
	[0049.989] lstrlenA (lpString="*.bas") returned 5
	[0049.989] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.csproj") returned 0
	[0049.989] lstrlenA (lpString="*.csproj") returned 8
	[0049.989] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.vbproj") returned 0
	[0049.989] lstrlenA (lpString="*.vbproj") returned 8
	[0049.989] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.vcxproj") returned 0
	[0049.989] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.989] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.manifest") returned 0
	[0049.989] lstrlenA (lpString="*.manifest") returned 10
	[0049.989] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.php") returned 0
	[0049.989] lstrlenA (lpString="*.php") returned 5
	[0049.989] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.vbe") returned 0
	[0049.989] lstrlenA (lpString="*.vbe") returned 5
	[0049.989] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.vba") returned 0
	[0049.989] lstrlenA (lpString="*.vba") returned 5
	[0049.989] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.vbs") returned 0
	[0049.989] lstrlenA (lpString="*.vbs") returned 5
	[0049.989] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.bat") returned 0
	[0049.989] lstrlenA (lpString="*.bat") returned 5
	[0049.989] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.cmd") returned 0
	[0049.989] lstrlenA (lpString="*.cmd") returned 5
	[0049.990] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.js") returned 0
	[0049.990] lstrlenA (lpString="*.js") returned 4
	[0049.990] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.jscript") returned 0
	[0049.990] lstrlenA (lpString="*.jscript") returned 9
	[0049.990] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.hta") returned 0
	[0049.990] lstrlenA (lpString="*.hta") returned 5
	[0049.990] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.php7") returned 0
	[0049.990] lstrlenA (lpString="*.php7") returned 6
	[0049.990] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.db") returned 0
	[0049.990] lstrlenA (lpString="*.db") returned 4
	[0049.990] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.swf") returned 0
	[0049.990] lstrlenA (lpString="*.swf") returned 5
	[0049.990] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.eml") returned 0
	[0049.990] lstrlenA (lpString="*.eml") returned 5
	[0049.990] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.part") returned 0
	[0049.990] lstrlenA (lpString="*.part") returned 6
	[0049.990] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.nfo") returned 0
	[0049.990] lstrlenA (lpString="*.nfo") returned 5
	[0049.990] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.rsa") returned 0
	[0049.990] lstrlenA (lpString="*.rsa") returned 5
	[0049.990] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.key") returned 0
	[0049.990] lstrlenA (lpString="*.key") returned 5
	[0049.990] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.aes") returned 0
	[0049.990] lstrlenA (lpString="*.aes") returned 5
	[0049.990] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.blob") returned 0
	[0049.990] lstrlenA (lpString="*.blob") returned 6
	[0049.990] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.btc") returned 0
	[0049.990] lstrlenA (lpString="*.btc") returned 5
	[0049.990] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.wallet") returned 0
	[0049.990] lstrlenA (lpString="*.wallet") returned 8
	[0049.991] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0049.991] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0049.991] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="memtest.exe.mui") returned -1
	[0049.991] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="memtest.exe.mui") returned -1
	[0049.991] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1
	[0049.991] PathFindFileNameA (pszPath="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned="bootmgr.exe.mui"
	[0049.991] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\es-ES\\" | out: lpString1="C:\\Boot\\es-ES\\") returned="C:\\Boot\\es-ES\\"
	[0049.991] PathAddBackslashA (in: pszPath="C:\\Boot\\es-ES\\" | out: pszPath="C:\\Boot\\es-ES\\") returned=""
	[0049.991] lstrcatA (in: lpString1="C:\\Boot\\es-ES\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\es-ES\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\es-ES\\HOW-TO-DECRYPT-FILES.HTM"
	[0049.991] GetFileAttributesA (lpFileName="C:\\Boot\\es-ES\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\es-es\\how-to-decrypt-files.htm")) returned 0x20
	[0049.991] lstrcatA (in: lpString1="C:\\Boot\\es-ES\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\es-ES\\memtest.exe.mui") returned="C:\\Boot\\es-ES\\memtest.exe.mui"
	[0049.991] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.zip") returned 0
	[0049.991] lstrlenA (lpString="*.zip") returned 5
	[0049.991] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.rar") returned 0
	[0049.991] lstrlenA (lpString="*.rar") returned 5
	[0049.991] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.7z") returned 0
	[0049.991] lstrlenA (lpString="*.7z") returned 4
	[0049.991] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.tar") returned 0
	[0049.991] lstrlenA (lpString="*.tar") returned 5
	[0049.991] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.gzip") returned 0
	[0049.991] lstrlenA (lpString="*.gzip") returned 6
	[0049.991] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.jpg") returned 0
	[0049.991] lstrlenA (lpString="*.jpg") returned 5
	[0049.991] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.jpeg") returned 0
	[0049.991] lstrlenA (lpString="*.jpeg") returned 6
	[0049.991] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.bmp") returned 0
	[0049.991] lstrlenA (lpString="*.bmp") returned 5
	[0049.991] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.gif") returned 0
	[0049.991] lstrlenA (lpString="*.gif") returned 5
	[0049.991] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.png") returned 0
	[0049.991] lstrlenA (lpString="*.png") returned 5
	[0049.992] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.doc") returned 0
	[0049.992] lstrlenA (lpString="*.doc") returned 5
	[0049.992] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.docx") returned 0
	[0049.992] lstrlenA (lpString="*.docx") returned 6
	[0049.992] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.xls") returned 0
	[0049.992] lstrlenA (lpString="*.xls") returned 5
	[0049.992] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.xlsx") returned 0
	[0049.992] lstrlenA (lpString="*.xlsx") returned 6
	[0049.992] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.ppt") returned 0
	[0049.992] lstrlenA (lpString="*.ppt") returned 5
	[0049.992] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.pptx") returned 0
	[0049.992] lstrlenA (lpString="*.pptx") returned 6
	[0049.992] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.txt") returned 0
	[0049.992] lstrlenA (lpString="*.txt") returned 5
	[0049.992] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.pdf") returned 0
	[0049.992] lstrlenA (lpString="*.pdf") returned 5
	[0049.992] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.htm") returned 0
	[0049.992] lstrlenA (lpString="*.htm") returned 5
	[0049.992] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.html") returned 0
	[0049.992] lstrlenA (lpString="*.html") returned 6
	[0049.992] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.mdb") returned 0
	[0049.992] lstrlenA (lpString="*.mdb") returned 5
	[0049.992] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.pfx") returned 0
	[0049.992] lstrlenA (lpString="*.pfx") returned 5
	[0049.992] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.md") returned 0
	[0049.992] lstrlenA (lpString="*.md") returned 4
	[0049.992] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.lnk") returned 0
	[0049.992] lstrlenA (lpString="*.lnk") returned 5
	[0049.992] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.torrent") returned 0
	[0049.992] lstrlenA (lpString="*.torrent") returned 9
	[0049.992] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.mov") returned 0
	[0049.992] lstrlenA (lpString="*.mov") returned 5
	[0049.992] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.3gp") returned 0
	[0049.992] lstrlenA (lpString="*.3gp") returned 5
	[0049.992] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.mpeg") returned 0
	[0049.992] lstrlenA (lpString="*.mpeg") returned 6
	[0049.992] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.mpg") returned 0
	[0049.993] lstrlenA (lpString="*.mpg") returned 5
	[0049.993] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.flv") returned 0
	[0049.993] lstrlenA (lpString="*.flv") returned 5
	[0049.993] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.avi") returned 0
	[0049.993] lstrlenA (lpString="*.avi") returned 5
	[0049.993] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.mp4") returned 0
	[0049.993] lstrlenA (lpString="*.mp4") returned 5
	[0049.993] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.wmv") returned 0
	[0049.993] lstrlenA (lpString="*.wmv") returned 5
	[0049.993] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.mkv") returned 0
	[0049.993] lstrlenA (lpString="*.mkv") returned 5
	[0049.993] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.mp3") returned 0
	[0049.993] lstrlenA (lpString="*.mp3") returned 5
	[0049.993] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.wav") returned 0
	[0049.993] lstrlenA (lpString="*.wav") returned 5
	[0049.993] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.flac") returned 0
	[0049.993] lstrlenA (lpString="*.flac") returned 6
	[0049.993] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.wma") returned 0
	[0049.993] lstrlenA (lpString="*.wma") returned 5
	[0049.993] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.au3") returned 0
	[0049.993] lstrlenA (lpString="*.au3") returned 5
	[0049.993] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.ahk") returned 0
	[0049.993] lstrlenA (lpString="*.ahk") returned 5
	[0049.993] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.c") returned 0
	[0049.993] lstrlenA (lpString="*.c") returned 3
	[0049.993] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.cc") returned 0
	[0049.993] lstrlenA (lpString="*.cc") returned 4
	[0049.993] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.cpp") returned 0
	[0049.993] lstrlenA (lpString="*.cpp") returned 5
	[0049.993] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.cxx") returned 0
	[0049.993] lstrlenA (lpString="*.cxx") returned 5
	[0049.993] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.c++") returned 0
	[0049.993] lstrlenA (lpString="*.c++") returned 5
	[0049.993] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.cs") returned 0
	[0049.993] lstrlenA (lpString="*.cs") returned 4
	[0049.993] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.vb") returned 0
	[0049.993] lstrlenA (lpString="*.vb") returned 4
	[0049.994] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.bas") returned 0
	[0049.994] lstrlenA (lpString="*.bas") returned 5
	[0049.994] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.csproj") returned 0
	[0049.994] lstrlenA (lpString="*.csproj") returned 8
	[0049.994] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.vbproj") returned 0
	[0049.994] lstrlenA (lpString="*.vbproj") returned 8
	[0049.994] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.vcxproj") returned 0
	[0049.994] lstrlenA (lpString="*.vcxproj") returned 9
	[0049.994] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.manifest") returned 0
	[0049.994] lstrlenA (lpString="*.manifest") returned 10
	[0049.994] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.php") returned 0
	[0049.994] lstrlenA (lpString="*.php") returned 5
	[0049.994] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.vbe") returned 0
	[0049.994] lstrlenA (lpString="*.vbe") returned 5
	[0049.994] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.vba") returned 0
	[0049.994] lstrlenA (lpString="*.vba") returned 5
	[0049.994] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.vbs") returned 0
	[0049.994] lstrlenA (lpString="*.vbs") returned 5
	[0049.994] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.bat") returned 0
	[0049.994] lstrlenA (lpString="*.bat") returned 5
	[0049.994] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.cmd") returned 0
	[0049.994] lstrlenA (lpString="*.cmd") returned 5
	[0049.994] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.js") returned 0
	[0049.994] lstrlenA (lpString="*.js") returned 4
	[0049.994] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.jscript") returned 0
	[0049.994] lstrlenA (lpString="*.jscript") returned 9
	[0049.994] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.hta") returned 0
	[0049.994] lstrlenA (lpString="*.hta") returned 5
	[0049.994] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.php7") returned 0
	[0049.994] lstrlenA (lpString="*.php7") returned 6
	[0049.994] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.db") returned 0
	[0049.994] lstrlenA (lpString="*.db") returned 4
	[0049.994] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.swf") returned 0
	[0049.994] lstrlenA (lpString="*.swf") returned 5
	[0049.994] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.eml") returned 0
	[0049.994] lstrlenA (lpString="*.eml") returned 5
	[0049.995] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.part") returned 0
	[0049.995] lstrlenA (lpString="*.part") returned 6
	[0049.995] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.nfo") returned 0
	[0049.995] lstrlenA (lpString="*.nfo") returned 5
	[0049.995] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.rsa") returned 0
	[0049.995] lstrlenA (lpString="*.rsa") returned 5
	[0049.995] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.key") returned 0
	[0049.995] lstrlenA (lpString="*.key") returned 5
	[0049.995] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.aes") returned 0
	[0049.995] lstrlenA (lpString="*.aes") returned 5
	[0049.995] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.blob") returned 0
	[0049.995] lstrlenA (lpString="*.blob") returned 6
	[0049.995] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.btc") returned 0
	[0049.995] lstrlenA (lpString="*.btc") returned 5
	[0049.995] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.wallet") returned 0
	[0049.995] lstrlenA (lpString="*.wallet") returned 8
	[0049.995] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0049.995] FindClose (in: hFindFile=0x7cbb90 | out: hFindFile=0x7cbb90) returned 1
	[0049.995] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1
	[0049.995] lstrcmpA (lpString1=".", lpString2="es-MX") returned -1
	[0049.995] lstrcmpA (lpString1="..", lpString2="es-MX") returned -1
	[0049.995] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0049.995] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="es-MX" | out: lpString1="C:\\Boot\\es-MX") returned="C:\\Boot\\es-MX"
	[0049.995] lstrlenA (lpString="C:\\Boot\\es-MX") returned 13
	[0049.995] FindFirstFileA (in: lpFileName="C:\\Boot\\es-MX\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbb90
	[0050.013] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.013] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0050.013] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.013] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.013] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0050.013] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.013] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr.exe.mui") returned 1
	[0050.013] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr.exe.mui") returned 1
	[0050.013] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0050.013] PathFindFileNameA (pszPath="C:\\Boot\\es-MX\\*.*") returned="*.*"
	[0050.013] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\es-MX\\" | out: lpString1="C:\\Boot\\es-MX\\") returned="C:\\Boot\\es-MX\\"
	[0050.013] PathAddBackslashA (in: pszPath="C:\\Boot\\es-MX\\" | out: pszPath="C:\\Boot\\es-MX\\") returned=""
	[0050.013] lstrcatA (in: lpString1="C:\\Boot\\es-MX\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\es-MX\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\es-MX\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.013] GetFileAttributesA (lpFileName="C:\\Boot\\es-MX\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\es-mx\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0050.014] CreateFileA (lpFileName="C:\\Boot\\es-MX\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\es-mx\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0050.014] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0050.014] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0050.015] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.015] CloseHandle (hObject=0x208) returned 1
	[0050.015] lstrcatA (in: lpString1="C:\\Boot\\es-MX\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned="C:\\Boot\\es-MX\\bootmgr.exe.mui"
	[0050.015] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0050.015] lstrlenA (lpString="*.zip") returned 5
	[0050.015] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0050.015] lstrlenA (lpString="*.rar") returned 5
	[0050.015] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0050.015] lstrlenA (lpString="*.7z") returned 4
	[0050.015] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0050.015] lstrlenA (lpString="*.tar") returned 5
	[0050.015] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0050.015] lstrlenA (lpString="*.gzip") returned 6
	[0050.015] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0050.015] lstrlenA (lpString="*.jpg") returned 5
	[0050.015] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.015] lstrlenA (lpString="*.jpeg") returned 6
	[0050.015] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0050.015] lstrlenA (lpString="*.bmp") returned 5
	[0050.016] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0050.016] lstrlenA (lpString="*.gif") returned 5
	[0050.016] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0050.016] lstrlenA (lpString="*.png") returned 5
	[0050.016] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0050.016] lstrlenA (lpString="*.doc") returned 5
	[0050.016] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0050.016] lstrlenA (lpString="*.docx") returned 6
	[0050.016] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0050.016] lstrlenA (lpString="*.xls") returned 5
	[0050.016] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.016] lstrlenA (lpString="*.xlsx") returned 6
	[0050.016] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0050.016] lstrlenA (lpString="*.ppt") returned 5
	[0050.016] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0050.016] lstrlenA (lpString="*.pptx") returned 6
	[0050.016] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0050.016] lstrlenA (lpString="*.txt") returned 5
	[0050.016] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0050.016] lstrlenA (lpString="*.pdf") returned 5
	[0050.016] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0050.016] lstrlenA (lpString="*.htm") returned 5
	[0050.016] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0050.016] lstrlenA (lpString="*.html") returned 6
	[0050.016] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0050.016] lstrlenA (lpString="*.mdb") returned 5
	[0050.016] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0050.016] lstrlenA (lpString="*.pfx") returned 5
	[0050.016] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0050.016] lstrlenA (lpString="*.md") returned 4
	[0050.016] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0050.016] lstrlenA (lpString="*.lnk") returned 5
	[0050.016] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0050.016] lstrlenA (lpString="*.torrent") returned 9
	[0050.016] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0050.016] lstrlenA (lpString="*.mov") returned 5
	[0050.017] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0050.017] lstrlenA (lpString="*.3gp") returned 5
	[0050.017] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.017] lstrlenA (lpString="*.mpeg") returned 6
	[0050.017] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0050.017] lstrlenA (lpString="*.mpg") returned 5
	[0050.017] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0050.017] lstrlenA (lpString="*.flv") returned 5
	[0050.017] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0050.017] lstrlenA (lpString="*.avi") returned 5
	[0050.017] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0050.017] lstrlenA (lpString="*.mp4") returned 5
	[0050.017] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0050.017] lstrlenA (lpString="*.wmv") returned 5
	[0050.017] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0050.017] lstrlenA (lpString="*.mkv") returned 5
	[0050.017] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0050.017] lstrlenA (lpString="*.mp3") returned 5
	[0050.017] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0050.017] lstrlenA (lpString="*.wav") returned 5
	[0050.017] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0050.017] lstrlenA (lpString="*.flac") returned 6
	[0050.017] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0050.017] lstrlenA (lpString="*.wma") returned 5
	[0050.017] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.au3") returned 0
	[0050.017] lstrlenA (lpString="*.au3") returned 5
	[0050.017] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.ahk") returned 0
	[0050.017] lstrlenA (lpString="*.ahk") returned 5
	[0050.017] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.c") returned 0
	[0050.017] lstrlenA (lpString="*.c") returned 3
	[0050.017] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.cc") returned 0
	[0050.017] lstrlenA (lpString="*.cc") returned 4
	[0050.017] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0
	[0050.017] lstrlenA (lpString="*.cpp") returned 5
	[0050.017] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.cxx") returned 0
	[0050.017] lstrlenA (lpString="*.cxx") returned 5
	[0050.017] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.c++") returned 0
	[0050.018] lstrlenA (lpString="*.c++") returned 5
	[0050.018] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.cs") returned 0
	[0050.018] lstrlenA (lpString="*.cs") returned 4
	[0050.018] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.vb") returned 0
	[0050.018] lstrlenA (lpString="*.vb") returned 4
	[0050.018] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.bas") returned 0
	[0050.018] lstrlenA (lpString="*.bas") returned 5
	[0050.018] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.csproj") returned 0
	[0050.018] lstrlenA (lpString="*.csproj") returned 8
	[0050.018] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.018] lstrlenA (lpString="*.vbproj") returned 8
	[0050.018] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.018] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.018] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.manifest") returned 0
	[0050.018] lstrlenA (lpString="*.manifest") returned 10
	[0050.018] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.php") returned 0
	[0050.018] lstrlenA (lpString="*.php") returned 5
	[0050.018] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.vbe") returned 0
	[0050.018] lstrlenA (lpString="*.vbe") returned 5
	[0050.018] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.vba") returned 0
	[0050.018] lstrlenA (lpString="*.vba") returned 5
	[0050.018] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.vbs") returned 0
	[0050.018] lstrlenA (lpString="*.vbs") returned 5
	[0050.018] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.bat") returned 0
	[0050.018] lstrlenA (lpString="*.bat") returned 5
	[0050.018] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.cmd") returned 0
	[0050.018] lstrlenA (lpString="*.cmd") returned 5
	[0050.018] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.js") returned 0
	[0050.018] lstrlenA (lpString="*.js") returned 4
	[0050.018] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.jscript") returned 0
	[0050.018] lstrlenA (lpString="*.jscript") returned 9
	[0050.018] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.hta") returned 0
	[0050.018] lstrlenA (lpString="*.hta") returned 5
	[0050.018] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.php7") returned 0
	[0050.018] lstrlenA (lpString="*.php7") returned 6
	[0050.018] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.db") returned 0
	[0050.018] lstrlenA (lpString="*.db") returned 4
	[0050.019] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.swf") returned 0
	[0050.019] lstrlenA (lpString="*.swf") returned 5
	[0050.019] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.eml") returned 0
	[0050.019] lstrlenA (lpString="*.eml") returned 5
	[0050.019] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.part") returned 0
	[0050.019] lstrlenA (lpString="*.part") returned 6
	[0050.019] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.nfo") returned 0
	[0050.019] lstrlenA (lpString="*.nfo") returned 5
	[0050.019] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.rsa") returned 0
	[0050.019] lstrlenA (lpString="*.rsa") returned 5
	[0050.019] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.key") returned 0
	[0050.019] lstrlenA (lpString="*.key") returned 5
	[0050.019] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.aes") returned 0
	[0050.019] lstrlenA (lpString="*.aes") returned 5
	[0050.019] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.blob") returned 0
	[0050.019] lstrlenA (lpString="*.blob") returned 6
	[0050.019] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.btc") returned 0
	[0050.019] lstrlenA (lpString="*.btc") returned 5
	[0050.019] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.wallet") returned 0
	[0050.019] lstrlenA (lpString="*.wallet") returned 8
	[0050.019] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0050.019] FindClose (in: hFindFile=0x7cbb90 | out: hFindFile=0x7cbb90) returned 1
	[0050.019] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1
	[0050.019] lstrcmpA (lpString1=".", lpString2="et-EE") returned -1
	[0050.019] lstrcmpA (lpString1="..", lpString2="et-EE") returned -1
	[0050.019] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0050.019] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="et-EE" | out: lpString1="C:\\Boot\\et-EE") returned="C:\\Boot\\et-EE"
	[0050.019] lstrlenA (lpString="C:\\Boot\\et-EE") returned 13
	[0050.019] FindFirstFileA (in: lpFileName="C:\\Boot\\et-EE\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb750
	[0050.020] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.020] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0050.020] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.020] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.020] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0050.020] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.020] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr.exe.mui") returned 1
	[0050.020] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr.exe.mui") returned 1
	[0050.020] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0050.020] PathFindFileNameA (pszPath="C:\\Boot\\et-EE\\*.*") returned="*.*"
	[0050.020] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\et-EE\\" | out: lpString1="C:\\Boot\\et-EE\\") returned="C:\\Boot\\et-EE\\"
	[0050.020] PathAddBackslashA (in: pszPath="C:\\Boot\\et-EE\\" | out: pszPath="C:\\Boot\\et-EE\\") returned=""
	[0050.020] lstrcatA (in: lpString1="C:\\Boot\\et-EE\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\et-EE\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\et-EE\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.020] GetFileAttributesA (lpFileName="C:\\Boot\\et-EE\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\et-ee\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0050.020] CreateFileA (lpFileName="C:\\Boot\\et-EE\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\et-ee\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0050.021] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0050.021] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0050.022] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.022] CloseHandle (hObject=0x208) returned 1
	[0050.022] lstrcatA (in: lpString1="C:\\Boot\\et-EE\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned="C:\\Boot\\et-EE\\bootmgr.exe.mui"
	[0050.022] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0050.022] lstrlenA (lpString="*.zip") returned 5
	[0050.022] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0050.023] lstrlenA (lpString="*.rar") returned 5
	[0050.023] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0050.023] lstrlenA (lpString="*.7z") returned 4
	[0050.023] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0050.023] lstrlenA (lpString="*.tar") returned 5
	[0050.023] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0050.023] lstrlenA (lpString="*.gzip") returned 6
	[0050.023] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0050.023] lstrlenA (lpString="*.jpg") returned 5
	[0050.023] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.023] lstrlenA (lpString="*.jpeg") returned 6
	[0050.023] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0050.023] lstrlenA (lpString="*.bmp") returned 5
	[0050.023] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0050.023] lstrlenA (lpString="*.gif") returned 5
	[0050.023] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0050.023] lstrlenA (lpString="*.png") returned 5
	[0050.023] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0050.023] lstrlenA (lpString="*.doc") returned 5
	[0050.023] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0050.023] lstrlenA (lpString="*.docx") returned 6
	[0050.023] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0050.023] lstrlenA (lpString="*.xls") returned 5
	[0050.023] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.023] lstrlenA (lpString="*.xlsx") returned 6
	[0050.023] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0050.023] lstrlenA (lpString="*.ppt") returned 5
	[0050.023] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0050.023] lstrlenA (lpString="*.pptx") returned 6
	[0050.023] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0050.023] lstrlenA (lpString="*.txt") returned 5
	[0050.023] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0050.023] lstrlenA (lpString="*.pdf") returned 5
	[0050.023] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0050.023] lstrlenA (lpString="*.htm") returned 5
	[0050.023] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0050.024] lstrlenA (lpString="*.html") returned 6
	[0050.024] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0050.024] lstrlenA (lpString="*.mdb") returned 5
	[0050.024] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0050.024] lstrlenA (lpString="*.pfx") returned 5
	[0050.024] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0050.024] lstrlenA (lpString="*.md") returned 4
	[0050.024] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0050.024] lstrlenA (lpString="*.lnk") returned 5
	[0050.024] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0050.024] lstrlenA (lpString="*.torrent") returned 9
	[0050.024] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0050.024] lstrlenA (lpString="*.mov") returned 5
	[0050.024] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0050.024] lstrlenA (lpString="*.3gp") returned 5
	[0050.024] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.024] lstrlenA (lpString="*.mpeg") returned 6
	[0050.024] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0050.024] lstrlenA (lpString="*.mpg") returned 5
	[0050.024] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0050.024] lstrlenA (lpString="*.flv") returned 5
	[0050.024] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0050.024] lstrlenA (lpString="*.avi") returned 5
	[0050.024] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0050.024] lstrlenA (lpString="*.mp4") returned 5
	[0050.024] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0050.024] lstrlenA (lpString="*.wmv") returned 5
	[0050.024] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0050.024] lstrlenA (lpString="*.mkv") returned 5
	[0050.024] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0050.024] lstrlenA (lpString="*.mp3") returned 5
	[0050.024] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0050.024] lstrlenA (lpString="*.wav") returned 5
	[0050.024] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0050.024] lstrlenA (lpString="*.flac") returned 6
	[0050.024] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0050.024] lstrlenA (lpString="*.wma") returned 5
	[0050.025] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.au3") returned 0
	[0050.025] lstrlenA (lpString="*.au3") returned 5
	[0050.025] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.ahk") returned 0
	[0050.025] lstrlenA (lpString="*.ahk") returned 5
	[0050.025] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.c") returned 0
	[0050.025] lstrlenA (lpString="*.c") returned 3
	[0050.025] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.cc") returned 0
	[0050.025] lstrlenA (lpString="*.cc") returned 4
	[0050.025] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0
	[0050.025] lstrlenA (lpString="*.cpp") returned 5
	[0050.025] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.cxx") returned 0
	[0050.025] lstrlenA (lpString="*.cxx") returned 5
	[0050.025] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.c++") returned 0
	[0050.025] lstrlenA (lpString="*.c++") returned 5
	[0050.025] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.cs") returned 0
	[0050.025] lstrlenA (lpString="*.cs") returned 4
	[0050.025] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.vb") returned 0
	[0050.025] lstrlenA (lpString="*.vb") returned 4
	[0050.025] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.bas") returned 0
	[0050.025] lstrlenA (lpString="*.bas") returned 5
	[0050.025] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.csproj") returned 0
	[0050.025] lstrlenA (lpString="*.csproj") returned 8
	[0050.025] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.025] lstrlenA (lpString="*.vbproj") returned 8
	[0050.025] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.025] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.025] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.manifest") returned 0
	[0050.025] lstrlenA (lpString="*.manifest") returned 10
	[0050.025] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.php") returned 0
	[0050.025] lstrlenA (lpString="*.php") returned 5
	[0050.025] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.vbe") returned 0
	[0050.025] lstrlenA (lpString="*.vbe") returned 5
	[0050.025] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.vba") returned 0
	[0050.025] lstrlenA (lpString="*.vba") returned 5
	[0050.025] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.vbs") returned 0
	[0050.025] lstrlenA (lpString="*.vbs") returned 5
	[0050.025] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.bat") returned 0
	[0050.026] lstrlenA (lpString="*.bat") returned 5
	[0050.026] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.cmd") returned 0
	[0050.026] lstrlenA (lpString="*.cmd") returned 5
	[0050.026] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.js") returned 0
	[0050.026] lstrlenA (lpString="*.js") returned 4
	[0050.026] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.jscript") returned 0
	[0050.026] lstrlenA (lpString="*.jscript") returned 9
	[0050.026] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.hta") returned 0
	[0050.026] lstrlenA (lpString="*.hta") returned 5
	[0050.026] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.php7") returned 0
	[0050.026] lstrlenA (lpString="*.php7") returned 6
	[0050.026] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.db") returned 0
	[0050.026] lstrlenA (lpString="*.db") returned 4
	[0050.026] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.swf") returned 0
	[0050.026] lstrlenA (lpString="*.swf") returned 5
	[0050.026] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.eml") returned 0
	[0050.026] lstrlenA (lpString="*.eml") returned 5
	[0050.026] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.part") returned 0
	[0050.026] lstrlenA (lpString="*.part") returned 6
	[0050.026] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.nfo") returned 0
	[0050.026] lstrlenA (lpString="*.nfo") returned 5
	[0050.026] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.rsa") returned 0
	[0050.026] lstrlenA (lpString="*.rsa") returned 5
	[0050.026] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.key") returned 0
	[0050.026] lstrlenA (lpString="*.key") returned 5
	[0050.026] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.aes") returned 0
	[0050.026] lstrlenA (lpString="*.aes") returned 5
	[0050.026] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.blob") returned 0
	[0050.026] lstrlenA (lpString="*.blob") returned 6
	[0050.026] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.btc") returned 0
	[0050.026] lstrlenA (lpString="*.btc") returned 5
	[0050.026] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.wallet") returned 0
	[0050.026] lstrlenA (lpString="*.wallet") returned 8
	[0050.026] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0050.026] FindClose (in: hFindFile=0x7cb750 | out: hFindFile=0x7cb750) returned 1
	[0050.027] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0050.027] lstrcmpA (lpString1=".", lpString2="fi-FI") returned -1
	[0050.027] lstrcmpA (lpString1="..", lpString2="fi-FI") returned -1
	[0050.027] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0050.027] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="fi-FI" | out: lpString1="C:\\Boot\\fi-FI") returned="C:\\Boot\\fi-FI"
	[0050.027] lstrlenA (lpString="C:\\Boot\\fi-FI") returned 13
	[0050.027] FindFirstFileA (in: lpFileName="C:\\Boot\\fi-FI\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb810
	[0050.027] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.027] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0050.028] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.028] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.028] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0050.028] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.028] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr.exe.mui") returned 1
	[0050.028] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr.exe.mui") returned 1
	[0050.028] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0050.028] PathFindFileNameA (pszPath="C:\\Boot\\fi-FI\\*.*") returned="*.*"
	[0050.028] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\fi-FI\\" | out: lpString1="C:\\Boot\\fi-FI\\") returned="C:\\Boot\\fi-FI\\"
	[0050.028] PathAddBackslashA (in: pszPath="C:\\Boot\\fi-FI\\" | out: pszPath="C:\\Boot\\fi-FI\\") returned=""
	[0050.028] lstrcatA (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\fi-FI\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\fi-FI\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.028] GetFileAttributesA (lpFileName="C:\\Boot\\fi-FI\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\fi-fi\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0050.028] CreateFileA (lpFileName="C:\\Boot\\fi-FI\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\fi-fi\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0050.029] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0050.029] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0050.030] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.030] CloseHandle (hObject=0x208) returned 1
	[0050.031] lstrcatA (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned="C:\\Boot\\fi-FI\\bootmgr.exe.mui"
	[0050.031] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0050.031] lstrlenA (lpString="*.zip") returned 5
	[0050.031] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0050.031] lstrlenA (lpString="*.rar") returned 5
	[0050.031] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0050.031] lstrlenA (lpString="*.7z") returned 4
	[0050.031] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0050.031] lstrlenA (lpString="*.tar") returned 5
	[0050.031] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0050.031] lstrlenA (lpString="*.gzip") returned 6
	[0050.031] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0050.031] lstrlenA (lpString="*.jpg") returned 5
	[0050.031] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.031] lstrlenA (lpString="*.jpeg") returned 6
	[0050.031] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0050.031] lstrlenA (lpString="*.bmp") returned 5
	[0050.031] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0050.031] lstrlenA (lpString="*.gif") returned 5
	[0050.031] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0050.031] lstrlenA (lpString="*.png") returned 5
	[0050.031] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0050.031] lstrlenA (lpString="*.doc") returned 5
	[0050.031] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0050.031] lstrlenA (lpString="*.docx") returned 6
	[0050.031] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0050.031] lstrlenA (lpString="*.xls") returned 5
	[0050.031] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.031] lstrlenA (lpString="*.xlsx") returned 6
	[0050.031] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0050.031] lstrlenA (lpString="*.ppt") returned 5
	[0050.031] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0050.032] lstrlenA (lpString="*.pptx") returned 6
	[0050.032] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0050.032] lstrlenA (lpString="*.txt") returned 5
	[0050.032] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0050.032] lstrlenA (lpString="*.pdf") returned 5
	[0050.032] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0050.032] lstrlenA (lpString="*.htm") returned 5
	[0050.032] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0050.032] lstrlenA (lpString="*.html") returned 6
	[0050.032] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0050.032] lstrlenA (lpString="*.mdb") returned 5
	[0050.032] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0050.032] lstrlenA (lpString="*.pfx") returned 5
	[0050.032] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0050.032] lstrlenA (lpString="*.md") returned 4
	[0050.032] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0050.032] lstrlenA (lpString="*.lnk") returned 5
	[0050.032] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0050.032] lstrlenA (lpString="*.torrent") returned 9
	[0050.032] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0050.032] lstrlenA (lpString="*.mov") returned 5
	[0050.032] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0050.032] lstrlenA (lpString="*.3gp") returned 5
	[0050.032] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.032] lstrlenA (lpString="*.mpeg") returned 6
	[0050.032] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0050.032] lstrlenA (lpString="*.mpg") returned 5
	[0050.032] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0050.032] lstrlenA (lpString="*.flv") returned 5
	[0050.032] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0050.032] lstrlenA (lpString="*.avi") returned 5
	[0050.032] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0050.032] lstrlenA (lpString="*.mp4") returned 5
	[0050.032] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0050.032] lstrlenA (lpString="*.wmv") returned 5
	[0050.032] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0050.032] lstrlenA (lpString="*.mkv") returned 5
	[0050.032] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0050.033] lstrlenA (lpString="*.mp3") returned 5
	[0050.033] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0050.033] lstrlenA (lpString="*.wav") returned 5
	[0050.033] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0050.033] lstrlenA (lpString="*.flac") returned 6
	[0050.033] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0050.033] lstrlenA (lpString="*.wma") returned 5
	[0050.033] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.au3") returned 0
	[0050.033] lstrlenA (lpString="*.au3") returned 5
	[0050.033] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.ahk") returned 0
	[0050.033] lstrlenA (lpString="*.ahk") returned 5
	[0050.033] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.c") returned 0
	[0050.033] lstrlenA (lpString="*.c") returned 3
	[0050.033] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.cc") returned 0
	[0050.033] lstrlenA (lpString="*.cc") returned 4
	[0050.033] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0
	[0050.033] lstrlenA (lpString="*.cpp") returned 5
	[0050.033] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.cxx") returned 0
	[0050.033] lstrlenA (lpString="*.cxx") returned 5
	[0050.033] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.c++") returned 0
	[0050.033] lstrlenA (lpString="*.c++") returned 5
	[0050.033] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.cs") returned 0
	[0050.033] lstrlenA (lpString="*.cs") returned 4
	[0050.033] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.vb") returned 0
	[0050.033] lstrlenA (lpString="*.vb") returned 4
	[0050.033] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.bas") returned 0
	[0050.033] lstrlenA (lpString="*.bas") returned 5
	[0050.033] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.csproj") returned 0
	[0050.033] lstrlenA (lpString="*.csproj") returned 8
	[0050.033] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.033] lstrlenA (lpString="*.vbproj") returned 8
	[0050.033] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.033] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.033] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.manifest") returned 0
	[0050.033] lstrlenA (lpString="*.manifest") returned 10
	[0050.033] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.php") returned 0
	[0050.033] lstrlenA (lpString="*.php") returned 5
	[0050.034] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.vbe") returned 0
	[0050.034] lstrlenA (lpString="*.vbe") returned 5
	[0050.034] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.vba") returned 0
	[0050.034] lstrlenA (lpString="*.vba") returned 5
	[0050.034] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.vbs") returned 0
	[0050.034] lstrlenA (lpString="*.vbs") returned 5
	[0050.034] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.bat") returned 0
	[0050.034] lstrlenA (lpString="*.bat") returned 5
	[0050.034] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.cmd") returned 0
	[0050.034] lstrlenA (lpString="*.cmd") returned 5
	[0050.034] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.js") returned 0
	[0050.034] lstrlenA (lpString="*.js") returned 4
	[0050.034] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.jscript") returned 0
	[0050.034] lstrlenA (lpString="*.jscript") returned 9
	[0050.034] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.hta") returned 0
	[0050.034] lstrlenA (lpString="*.hta") returned 5
	[0050.034] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.php7") returned 0
	[0050.034] lstrlenA (lpString="*.php7") returned 6
	[0050.034] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.db") returned 0
	[0050.034] lstrlenA (lpString="*.db") returned 4
	[0050.034] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.swf") returned 0
	[0050.034] lstrlenA (lpString="*.swf") returned 5
	[0050.034] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.eml") returned 0
	[0050.034] lstrlenA (lpString="*.eml") returned 5
	[0050.034] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.part") returned 0
	[0050.034] lstrlenA (lpString="*.part") returned 6
	[0050.034] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.nfo") returned 0
	[0050.034] lstrlenA (lpString="*.nfo") returned 5
	[0050.034] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.rsa") returned 0
	[0050.034] lstrlenA (lpString="*.rsa") returned 5
	[0050.034] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.key") returned 0
	[0050.034] lstrlenA (lpString="*.key") returned 5
	[0050.034] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.aes") returned 0
	[0050.034] lstrlenA (lpString="*.aes") returned 5
	[0050.034] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.blob") returned 0
	[0050.034] lstrlenA (lpString="*.blob") returned 6
	[0050.035] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.btc") returned 0
	[0050.035] lstrlenA (lpString="*.btc") returned 5
	[0050.035] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.wallet") returned 0
	[0050.035] lstrlenA (lpString="*.wallet") returned 8
	[0050.035] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0050.035] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.035] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="memtest.exe.mui") returned -1
	[0050.035] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="memtest.exe.mui") returned -1
	[0050.035] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1
	[0050.035] PathFindFileNameA (pszPath="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned="bootmgr.exe.mui"
	[0050.035] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\fi-FI\\" | out: lpString1="C:\\Boot\\fi-FI\\") returned="C:\\Boot\\fi-FI\\"
	[0050.035] PathAddBackslashA (in: pszPath="C:\\Boot\\fi-FI\\" | out: pszPath="C:\\Boot\\fi-FI\\") returned=""
	[0050.035] lstrcatA (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\fi-FI\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\fi-FI\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.035] GetFileAttributesA (lpFileName="C:\\Boot\\fi-FI\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\fi-fi\\how-to-decrypt-files.htm")) returned 0x20
	[0050.035] lstrcatA (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\fi-FI\\memtest.exe.mui") returned="C:\\Boot\\fi-FI\\memtest.exe.mui"
	[0050.035] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.zip") returned 0
	[0050.035] lstrlenA (lpString="*.zip") returned 5
	[0050.035] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.rar") returned 0
	[0050.035] lstrlenA (lpString="*.rar") returned 5
	[0050.035] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.7z") returned 0
	[0050.035] lstrlenA (lpString="*.7z") returned 4
	[0050.035] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.tar") returned 0
	[0050.035] lstrlenA (lpString="*.tar") returned 5
	[0050.035] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.gzip") returned 0
	[0050.035] lstrlenA (lpString="*.gzip") returned 6
	[0050.035] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.jpg") returned 0
	[0050.035] lstrlenA (lpString="*.jpg") returned 5
	[0050.035] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.035] lstrlenA (lpString="*.jpeg") returned 6
	[0050.035] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.bmp") returned 0
	[0050.035] lstrlenA (lpString="*.bmp") returned 5
	[0050.035] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.gif") returned 0
	[0050.035] lstrlenA (lpString="*.gif") returned 5
	[0050.036] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.png") returned 0
	[0050.036] lstrlenA (lpString="*.png") returned 5
	[0050.036] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.doc") returned 0
	[0050.036] lstrlenA (lpString="*.doc") returned 5
	[0050.036] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.docx") returned 0
	[0050.036] lstrlenA (lpString="*.docx") returned 6
	[0050.036] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.xls") returned 0
	[0050.036] lstrlenA (lpString="*.xls") returned 5
	[0050.036] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.036] lstrlenA (lpString="*.xlsx") returned 6
	[0050.036] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.ppt") returned 0
	[0050.036] lstrlenA (lpString="*.ppt") returned 5
	[0050.036] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.pptx") returned 0
	[0050.036] lstrlenA (lpString="*.pptx") returned 6
	[0050.036] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.txt") returned 0
	[0050.036] lstrlenA (lpString="*.txt") returned 5
	[0050.036] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.pdf") returned 0
	[0050.036] lstrlenA (lpString="*.pdf") returned 5
	[0050.036] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.htm") returned 0
	[0050.036] lstrlenA (lpString="*.htm") returned 5
	[0050.036] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.html") returned 0
	[0050.036] lstrlenA (lpString="*.html") returned 6
	[0050.036] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.mdb") returned 0
	[0050.036] lstrlenA (lpString="*.mdb") returned 5
	[0050.036] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.pfx") returned 0
	[0050.036] lstrlenA (lpString="*.pfx") returned 5
	[0050.036] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.md") returned 0
	[0050.036] lstrlenA (lpString="*.md") returned 4
	[0050.036] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.lnk") returned 0
	[0050.036] lstrlenA (lpString="*.lnk") returned 5
	[0050.036] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.torrent") returned 0
	[0050.036] lstrlenA (lpString="*.torrent") returned 9
	[0050.036] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.mov") returned 0
	[0050.037] lstrlenA (lpString="*.mov") returned 5
	[0050.037] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.3gp") returned 0
	[0050.037] lstrlenA (lpString="*.3gp") returned 5
	[0050.037] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.037] lstrlenA (lpString="*.mpeg") returned 6
	[0050.037] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.mpg") returned 0
	[0050.037] lstrlenA (lpString="*.mpg") returned 5
	[0050.037] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.flv") returned 0
	[0050.037] lstrlenA (lpString="*.flv") returned 5
	[0050.037] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.avi") returned 0
	[0050.037] lstrlenA (lpString="*.avi") returned 5
	[0050.037] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.mp4") returned 0
	[0050.037] lstrlenA (lpString="*.mp4") returned 5
	[0050.037] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.wmv") returned 0
	[0050.037] lstrlenA (lpString="*.wmv") returned 5
	[0050.037] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.mkv") returned 0
	[0050.037] lstrlenA (lpString="*.mkv") returned 5
	[0050.037] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.mp3") returned 0
	[0050.037] lstrlenA (lpString="*.mp3") returned 5
	[0050.037] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.wav") returned 0
	[0050.037] lstrlenA (lpString="*.wav") returned 5
	[0050.037] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.flac") returned 0
	[0050.038] lstrlenA (lpString="*.flac") returned 6
	[0050.038] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.wma") returned 0
	[0050.038] lstrlenA (lpString="*.wma") returned 5
	[0050.038] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.au3") returned 0
	[0050.038] lstrlenA (lpString="*.au3") returned 5
	[0050.038] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.ahk") returned 0
	[0050.038] lstrlenA (lpString="*.ahk") returned 5
	[0050.038] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.c") returned 0
	[0050.038] lstrlenA (lpString="*.c") returned 3
	[0050.038] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.cc") returned 0
	[0050.038] lstrlenA (lpString="*.cc") returned 4
	[0050.038] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.cpp") returned 0
	[0050.038] lstrlenA (lpString="*.cpp") returned 5
	[0050.038] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.cxx") returned 0
	[0050.038] lstrlenA (lpString="*.cxx") returned 5
	[0050.038] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.c++") returned 0
	[0050.038] lstrlenA (lpString="*.c++") returned 5
	[0050.038] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.cs") returned 0
	[0050.038] lstrlenA (lpString="*.cs") returned 4
	[0050.038] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.vb") returned 0
	[0050.038] lstrlenA (lpString="*.vb") returned 4
	[0050.038] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.bas") returned 0
	[0050.038] lstrlenA (lpString="*.bas") returned 5
	[0050.038] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.csproj") returned 0
	[0050.038] lstrlenA (lpString="*.csproj") returned 8
	[0050.038] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.038] lstrlenA (lpString="*.vbproj") returned 8
	[0050.038] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.038] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.038] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.manifest") returned 0
	[0050.038] lstrlenA (lpString="*.manifest") returned 10
	[0050.038] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.php") returned 0
	[0050.038] lstrlenA (lpString="*.php") returned 5
	[0050.038] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.vbe") returned 0
	[0050.038] lstrlenA (lpString="*.vbe") returned 5
	[0050.038] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.vba") returned 0
	[0050.039] lstrlenA (lpString="*.vba") returned 5
	[0050.039] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.vbs") returned 0
	[0050.039] lstrlenA (lpString="*.vbs") returned 5
	[0050.039] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.bat") returned 0
	[0050.039] lstrlenA (lpString="*.bat") returned 5
	[0050.039] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.cmd") returned 0
	[0050.039] lstrlenA (lpString="*.cmd") returned 5
	[0050.039] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.js") returned 0
	[0050.039] lstrlenA (lpString="*.js") returned 4
	[0050.039] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.jscript") returned 0
	[0050.039] lstrlenA (lpString="*.jscript") returned 9
	[0050.039] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.hta") returned 0
	[0050.039] lstrlenA (lpString="*.hta") returned 5
	[0050.039] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.php7") returned 0
	[0050.039] lstrlenA (lpString="*.php7") returned 6
	[0050.039] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.db") returned 0
	[0050.039] lstrlenA (lpString="*.db") returned 4
	[0050.039] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.swf") returned 0
	[0050.039] lstrlenA (lpString="*.swf") returned 5
	[0050.039] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.eml") returned 0
	[0050.039] lstrlenA (lpString="*.eml") returned 5
	[0050.039] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.part") returned 0
	[0050.039] lstrlenA (lpString="*.part") returned 6
	[0050.039] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.nfo") returned 0
	[0050.039] lstrlenA (lpString="*.nfo") returned 5
	[0050.039] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.rsa") returned 0
	[0050.039] lstrlenA (lpString="*.rsa") returned 5
	[0050.039] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.key") returned 0
	[0050.039] lstrlenA (lpString="*.key") returned 5
	[0050.039] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.aes") returned 0
	[0050.039] lstrlenA (lpString="*.aes") returned 5
	[0050.039] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.blob") returned 0
	[0050.039] lstrlenA (lpString="*.blob") returned 6
	[0050.039] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.btc") returned 0
	[0050.039] lstrlenA (lpString="*.btc") returned 5
	[0050.039] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.wallet") returned 0
	[0050.039] lstrlenA (lpString="*.wallet") returned 8
	[0050.040] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0050.040] FindClose (in: hFindFile=0x7cb810 | out: hFindFile=0x7cb810) returned 1
	[0050.040] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1
	[0050.040] lstrcmpA (lpString1=".", lpString2="Fonts") returned -1
	[0050.040] lstrcmpA (lpString1="..", lpString2="Fonts") returned -1
	[0050.040] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0050.040] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="Fonts" | out: lpString1="C:\\Boot\\Fonts") returned="C:\\Boot\\Fonts"
	[0050.040] lstrlenA (lpString="C:\\Boot\\Fonts") returned 13
	[0050.040] FindFirstFileA (in: lpFileName="C:\\Boot\\Fonts\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb750
	[0050.042] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.042] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0050.042] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.042] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.042] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef782dd9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x386467, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1
	[0050.042] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.042] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="chs_boot.ttf") returned 1
	[0050.042] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="chs_boot.ttf") returned 1
	[0050.042] lstrcmpiA (lpString1="", lpString2="chs_boot.ttf") returned -1
	[0050.042] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\*.*") returned="*.*"
	[0050.042] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\"
	[0050.042] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned=""
	[0050.042] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.042] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\fonts\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0050.042] CreateFileA (lpFileName="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\fonts\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0050.043] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0050.043] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0050.044] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.044] CloseHandle (hObject=0x208) returned 1
	[0050.044] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="chs_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\chs_boot.ttf") returned="C:\\Boot\\Fonts\\chs_boot.ttf"
	[0050.044] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.zip") returned 0
	[0050.044] lstrlenA (lpString="*.zip") returned 5
	[0050.044] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.rar") returned 0
	[0050.044] lstrlenA (lpString="*.rar") returned 5
	[0050.044] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.7z") returned 0
	[0050.044] lstrlenA (lpString="*.7z") returned 4
	[0050.044] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.tar") returned 0
	[0050.044] lstrlenA (lpString="*.tar") returned 5
	[0050.044] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.gzip") returned 0
	[0050.044] lstrlenA (lpString="*.gzip") returned 6
	[0050.044] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.jpg") returned 0
	[0050.044] lstrlenA (lpString="*.jpg") returned 5
	[0050.044] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.jpeg") returned 0
	[0050.044] lstrlenA (lpString="*.jpeg") returned 6
	[0050.044] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.bmp") returned 0
	[0050.044] lstrlenA (lpString="*.bmp") returned 5
	[0050.044] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.gif") returned 0
	[0050.044] lstrlenA (lpString="*.gif") returned 5
	[0050.044] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.png") returned 0
	[0050.044] lstrlenA (lpString="*.png") returned 5
	[0050.044] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.doc") returned 0
	[0050.044] lstrlenA (lpString="*.doc") returned 5
	[0050.044] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.docx") returned 0
	[0050.044] lstrlenA (lpString="*.docx") returned 6
	[0050.044] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.xls") returned 0
	[0050.044] lstrlenA (lpString="*.xls") returned 5
	[0050.045] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.xlsx") returned 0
	[0050.045] lstrlenA (lpString="*.xlsx") returned 6
	[0050.045] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.ppt") returned 0
	[0050.045] lstrlenA (lpString="*.ppt") returned 5
	[0050.045] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.pptx") returned 0
	[0050.045] lstrlenA (lpString="*.pptx") returned 6
	[0050.045] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.txt") returned 0
	[0050.045] lstrlenA (lpString="*.txt") returned 5
	[0050.045] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.pdf") returned 0
	[0050.045] lstrlenA (lpString="*.pdf") returned 5
	[0050.045] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.htm") returned 0
	[0050.045] lstrlenA (lpString="*.htm") returned 5
	[0050.045] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.html") returned 0
	[0050.045] lstrlenA (lpString="*.html") returned 6
	[0050.045] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mdb") returned 0
	[0050.045] lstrlenA (lpString="*.mdb") returned 5
	[0050.045] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.pfx") returned 0
	[0050.045] lstrlenA (lpString="*.pfx") returned 5
	[0050.045] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.md") returned 0
	[0050.045] lstrlenA (lpString="*.md") returned 4
	[0050.045] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.lnk") returned 0
	[0050.045] lstrlenA (lpString="*.lnk") returned 5
	[0050.045] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.torrent") returned 0
	[0050.045] lstrlenA (lpString="*.torrent") returned 9
	[0050.045] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mov") returned 0
	[0050.045] lstrlenA (lpString="*.mov") returned 5
	[0050.045] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.3gp") returned 0
	[0050.045] lstrlenA (lpString="*.3gp") returned 5
	[0050.045] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mpeg") returned 0
	[0050.045] lstrlenA (lpString="*.mpeg") returned 6
	[0050.045] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mpg") returned 0
	[0050.045] lstrlenA (lpString="*.mpg") returned 5
	[0050.045] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.flv") returned 0
	[0050.045] lstrlenA (lpString="*.flv") returned 5
	[0050.045] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.avi") returned 0
	[0050.045] lstrlenA (lpString="*.avi") returned 5
	[0050.046] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mp4") returned 0
	[0050.046] lstrlenA (lpString="*.mp4") returned 5
	[0050.046] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.wmv") returned 0
	[0050.046] lstrlenA (lpString="*.wmv") returned 5
	[0050.046] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mkv") returned 0
	[0050.046] lstrlenA (lpString="*.mkv") returned 5
	[0050.046] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mp3") returned 0
	[0050.046] lstrlenA (lpString="*.mp3") returned 5
	[0050.046] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.wav") returned 0
	[0050.046] lstrlenA (lpString="*.wav") returned 5
	[0050.046] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.flac") returned 0
	[0050.046] lstrlenA (lpString="*.flac") returned 6
	[0050.046] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.wma") returned 0
	[0050.046] lstrlenA (lpString="*.wma") returned 5
	[0050.046] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.au3") returned 0
	[0050.046] lstrlenA (lpString="*.au3") returned 5
	[0050.046] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.ahk") returned 0
	[0050.046] lstrlenA (lpString="*.ahk") returned 5
	[0050.046] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.c") returned 0
	[0050.046] lstrlenA (lpString="*.c") returned 3
	[0050.046] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.cc") returned 0
	[0050.046] lstrlenA (lpString="*.cc") returned 4
	[0050.046] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.cpp") returned 0
	[0050.046] lstrlenA (lpString="*.cpp") returned 5
	[0050.046] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.cxx") returned 0
	[0050.046] lstrlenA (lpString="*.cxx") returned 5
	[0050.046] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.c++") returned 0
	[0050.046] lstrlenA (lpString="*.c++") returned 5
	[0050.046] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.cs") returned 0
	[0050.046] lstrlenA (lpString="*.cs") returned 4
	[0050.046] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.vb") returned 0
	[0050.046] lstrlenA (lpString="*.vb") returned 4
	[0050.046] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.bas") returned 0
	[0050.046] lstrlenA (lpString="*.bas") returned 5
	[0050.046] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.csproj") returned 0
	[0050.046] lstrlenA (lpString="*.csproj") returned 8
	[0050.046] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.vbproj") returned 0
	[0050.047] lstrlenA (lpString="*.vbproj") returned 8
	[0050.047] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.vcxproj") returned 0
	[0050.047] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.047] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.manifest") returned 0
	[0050.047] lstrlenA (lpString="*.manifest") returned 10
	[0050.047] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.php") returned 0
	[0050.047] lstrlenA (lpString="*.php") returned 5
	[0050.047] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.vbe") returned 0
	[0050.047] lstrlenA (lpString="*.vbe") returned 5
	[0050.047] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.vba") returned 0
	[0050.047] lstrlenA (lpString="*.vba") returned 5
	[0050.047] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.vbs") returned 0
	[0050.047] lstrlenA (lpString="*.vbs") returned 5
	[0050.047] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.bat") returned 0
	[0050.047] lstrlenA (lpString="*.bat") returned 5
	[0050.047] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.cmd") returned 0
	[0050.047] lstrlenA (lpString="*.cmd") returned 5
	[0050.047] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.js") returned 0
	[0050.047] lstrlenA (lpString="*.js") returned 4
	[0050.047] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.jscript") returned 0
	[0050.047] lstrlenA (lpString="*.jscript") returned 9
	[0050.047] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.hta") returned 0
	[0050.047] lstrlenA (lpString="*.hta") returned 5
	[0050.047] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.php7") returned 0
	[0050.047] lstrlenA (lpString="*.php7") returned 6
	[0050.047] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.db") returned 0
	[0050.047] lstrlenA (lpString="*.db") returned 4
	[0050.047] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.swf") returned 0
	[0050.047] lstrlenA (lpString="*.swf") returned 5
	[0050.047] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.eml") returned 0
	[0050.047] lstrlenA (lpString="*.eml") returned 5
	[0050.047] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.part") returned 0
	[0050.047] lstrlenA (lpString="*.part") returned 6
	[0050.047] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.nfo") returned 0
	[0050.047] lstrlenA (lpString="*.nfo") returned 5
	[0050.047] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.rsa") returned 0
	[0050.048] lstrlenA (lpString="*.rsa") returned 5
	[0050.048] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.key") returned 0
	[0050.048] lstrlenA (lpString="*.key") returned 5
	[0050.048] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.aes") returned 0
	[0050.048] lstrlenA (lpString="*.aes") returned 5
	[0050.048] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.blob") returned 0
	[0050.048] lstrlenA (lpString="*.blob") returned 6
	[0050.048] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.btc") returned 0
	[0050.048] lstrlenA (lpString="*.btc") returned 5
	[0050.048] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.wallet") returned 0
	[0050.048] lstrlenA (lpString="*.wallet") returned 8
	[0050.048] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a1dbea, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef81cc08, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1
	[0050.048] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.048] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="cht_boot.ttf") returned 1
	[0050.048] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="cht_boot.ttf") returned 1
	[0050.048] lstrcmpiA (lpString1="", lpString2="cht_boot.ttf") returned -1
	[0050.048] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\chs_boot.ttf") returned="chs_boot.ttf"
	[0050.048] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\"
	[0050.048] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned=""
	[0050.048] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.048] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\fonts\\how-to-decrypt-files.htm")) returned 0x20
	[0050.048] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="cht_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\cht_boot.ttf") returned="C:\\Boot\\Fonts\\cht_boot.ttf"
	[0050.048] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.zip") returned 0
	[0050.048] lstrlenA (lpString="*.zip") returned 5
	[0050.048] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.rar") returned 0
	[0050.048] lstrlenA (lpString="*.rar") returned 5
	[0050.048] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.7z") returned 0
	[0050.048] lstrlenA (lpString="*.7z") returned 4
	[0050.048] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.tar") returned 0
	[0050.048] lstrlenA (lpString="*.tar") returned 5
	[0050.048] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.gzip") returned 0
	[0050.048] lstrlenA (lpString="*.gzip") returned 6
	[0050.048] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.jpg") returned 0
	[0050.048] lstrlenA (lpString="*.jpg") returned 5
	[0050.049] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.jpeg") returned 0
	[0050.049] lstrlenA (lpString="*.jpeg") returned 6
	[0050.049] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.bmp") returned 0
	[0050.049] lstrlenA (lpString="*.bmp") returned 5
	[0050.049] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.gif") returned 0
	[0050.049] lstrlenA (lpString="*.gif") returned 5
	[0050.049] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.png") returned 0
	[0050.049] lstrlenA (lpString="*.png") returned 5
	[0050.049] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.doc") returned 0
	[0050.049] lstrlenA (lpString="*.doc") returned 5
	[0050.049] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.docx") returned 0
	[0050.049] lstrlenA (lpString="*.docx") returned 6
	[0050.049] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.xls") returned 0
	[0050.049] lstrlenA (lpString="*.xls") returned 5
	[0050.049] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.xlsx") returned 0
	[0050.049] lstrlenA (lpString="*.xlsx") returned 6
	[0050.049] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.ppt") returned 0
	[0050.049] lstrlenA (lpString="*.ppt") returned 5
	[0050.049] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.pptx") returned 0
	[0050.049] lstrlenA (lpString="*.pptx") returned 6
	[0050.049] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.txt") returned 0
	[0050.049] lstrlenA (lpString="*.txt") returned 5
	[0050.049] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.pdf") returned 0
	[0050.049] lstrlenA (lpString="*.pdf") returned 5
	[0050.049] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.htm") returned 0
	[0050.049] lstrlenA (lpString="*.htm") returned 5
	[0050.049] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.html") returned 0
	[0050.049] lstrlenA (lpString="*.html") returned 6
	[0050.049] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mdb") returned 0
	[0050.049] lstrlenA (lpString="*.mdb") returned 5
	[0050.049] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.pfx") returned 0
	[0050.049] lstrlenA (lpString="*.pfx") returned 5
	[0050.049] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.md") returned 0
	[0050.049] lstrlenA (lpString="*.md") returned 4
	[0050.049] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.lnk") returned 0
	[0050.049] lstrlenA (lpString="*.lnk") returned 5
	[0050.049] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.torrent") returned 0
	[0050.050] lstrlenA (lpString="*.torrent") returned 9
	[0050.050] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mov") returned 0
	[0050.050] lstrlenA (lpString="*.mov") returned 5
	[0050.050] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.3gp") returned 0
	[0050.050] lstrlenA (lpString="*.3gp") returned 5
	[0050.050] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mpeg") returned 0
	[0050.050] lstrlenA (lpString="*.mpeg") returned 6
	[0050.050] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mpg") returned 0
	[0050.050] lstrlenA (lpString="*.mpg") returned 5
	[0050.050] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.flv") returned 0
	[0050.050] lstrlenA (lpString="*.flv") returned 5
	[0050.050] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.avi") returned 0
	[0050.050] lstrlenA (lpString="*.avi") returned 5
	[0050.050] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mp4") returned 0
	[0050.050] lstrlenA (lpString="*.mp4") returned 5
	[0050.050] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.wmv") returned 0
	[0050.050] lstrlenA (lpString="*.wmv") returned 5
	[0050.050] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mkv") returned 0
	[0050.050] lstrlenA (lpString="*.mkv") returned 5
	[0050.050] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mp3") returned 0
	[0050.050] lstrlenA (lpString="*.mp3") returned 5
	[0050.050] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.wav") returned 0
	[0050.050] lstrlenA (lpString="*.wav") returned 5
	[0050.050] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.flac") returned 0
	[0050.050] lstrlenA (lpString="*.flac") returned 6
	[0050.050] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.wma") returned 0
	[0050.050] lstrlenA (lpString="*.wma") returned 5
	[0050.050] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.au3") returned 0
	[0050.050] lstrlenA (lpString="*.au3") returned 5
	[0050.050] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.ahk") returned 0
	[0050.050] lstrlenA (lpString="*.ahk") returned 5
	[0050.050] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.c") returned 0
	[0050.050] lstrlenA (lpString="*.c") returned 3
	[0050.050] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.cc") returned 0
	[0050.050] lstrlenA (lpString="*.cc") returned 4
	[0050.050] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.cpp") returned 0
	[0050.050] lstrlenA (lpString="*.cpp") returned 5
	[0050.051] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.cxx") returned 0
	[0050.051] lstrlenA (lpString="*.cxx") returned 5
	[0050.051] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.c++") returned 0
	[0050.051] lstrlenA (lpString="*.c++") returned 5
	[0050.051] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.cs") returned 0
	[0050.051] lstrlenA (lpString="*.cs") returned 4
	[0050.051] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.vb") returned 0
	[0050.051] lstrlenA (lpString="*.vb") returned 4
	[0050.051] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.bas") returned 0
	[0050.051] lstrlenA (lpString="*.bas") returned 5
	[0050.051] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.csproj") returned 0
	[0050.051] lstrlenA (lpString="*.csproj") returned 8
	[0050.051] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.vbproj") returned 0
	[0050.051] lstrlenA (lpString="*.vbproj") returned 8
	[0050.051] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.vcxproj") returned 0
	[0050.051] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.051] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.manifest") returned 0
	[0050.051] lstrlenA (lpString="*.manifest") returned 10
	[0050.051] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.php") returned 0
	[0050.051] lstrlenA (lpString="*.php") returned 5
	[0050.051] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.vbe") returned 0
	[0050.051] lstrlenA (lpString="*.vbe") returned 5
	[0050.051] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.vba") returned 0
	[0050.051] lstrlenA (lpString="*.vba") returned 5
	[0050.051] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.vbs") returned 0
	[0050.051] lstrlenA (lpString="*.vbs") returned 5
	[0050.051] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.bat") returned 0
	[0050.051] lstrlenA (lpString="*.bat") returned 5
	[0050.051] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.cmd") returned 0
	[0050.051] lstrlenA (lpString="*.cmd") returned 5
	[0050.051] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.js") returned 0
	[0050.051] lstrlenA (lpString="*.js") returned 4
	[0050.051] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.jscript") returned 0
	[0050.051] lstrlenA (lpString="*.jscript") returned 9
	[0050.051] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.hta") returned 0
	[0050.051] lstrlenA (lpString="*.hta") returned 5
	[0050.052] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.php7") returned 0
	[0050.052] lstrlenA (lpString="*.php7") returned 6
	[0050.052] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.db") returned 0
	[0050.052] lstrlenA (lpString="*.db") returned 4
	[0050.052] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.swf") returned 0
	[0050.052] lstrlenA (lpString="*.swf") returned 5
	[0050.052] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.eml") returned 0
	[0050.052] lstrlenA (lpString="*.eml") returned 5
	[0050.052] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.part") returned 0
	[0050.052] lstrlenA (lpString="*.part") returned 6
	[0050.052] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.nfo") returned 0
	[0050.052] lstrlenA (lpString="*.nfo") returned 5
	[0050.052] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.rsa") returned 0
	[0050.052] lstrlenA (lpString="*.rsa") returned 5
	[0050.052] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.key") returned 0
	[0050.052] lstrlenA (lpString="*.key") returned 5
	[0050.052] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.aes") returned 0
	[0050.052] lstrlenA (lpString="*.aes") returned 5
	[0050.052] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.blob") returned 0
	[0050.052] lstrlenA (lpString="*.blob") returned 6
	[0050.055] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.btc") returned 0
	[0050.055] lstrlenA (lpString="*.btc") returned 5
	[0050.055] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.wallet") returned 0
	[0050.055] lstrlenA (lpString="*.wallet") returned 8
	[0050.055] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a902c2, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8771a7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1
	[0050.055] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.055] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="jpn_boot.ttf") returned -1
	[0050.055] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="jpn_boot.ttf") returned -1
	[0050.055] lstrcmpiA (lpString1="", lpString2="jpn_boot.ttf") returned -1
	[0050.055] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\cht_boot.ttf") returned="cht_boot.ttf"
	[0050.055] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\"
	[0050.055] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned=""
	[0050.055] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.056] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\fonts\\how-to-decrypt-files.htm")) returned 0x20
	[0050.056] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="jpn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\jpn_boot.ttf") returned="C:\\Boot\\Fonts\\jpn_boot.ttf"
	[0050.056] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.zip") returned 0
	[0050.056] lstrlenA (lpString="*.zip") returned 5
	[0050.056] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.rar") returned 0
	[0050.056] lstrlenA (lpString="*.rar") returned 5
	[0050.056] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.7z") returned 0
	[0050.056] lstrlenA (lpString="*.7z") returned 4
	[0050.056] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.tar") returned 0
	[0050.056] lstrlenA (lpString="*.tar") returned 5
	[0050.056] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.gzip") returned 0
	[0050.056] lstrlenA (lpString="*.gzip") returned 6
	[0050.056] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.jpg") returned 0
	[0050.056] lstrlenA (lpString="*.jpg") returned 5
	[0050.056] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.jpeg") returned 0
	[0050.056] lstrlenA (lpString="*.jpeg") returned 6
	[0050.056] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.bmp") returned 0
	[0050.056] lstrlenA (lpString="*.bmp") returned 5
	[0050.056] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.gif") returned 0
	[0050.056] lstrlenA (lpString="*.gif") returned 5
	[0050.056] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.png") returned 0
	[0050.056] lstrlenA (lpString="*.png") returned 5
	[0050.056] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.doc") returned 0
	[0050.056] lstrlenA (lpString="*.doc") returned 5
	[0050.056] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.docx") returned 0
	[0050.056] lstrlenA (lpString="*.docx") returned 6
	[0050.056] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.xls") returned 0
	[0050.056] lstrlenA (lpString="*.xls") returned 5
	[0050.056] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.xlsx") returned 0
	[0050.056] lstrlenA (lpString="*.xlsx") returned 6
	[0050.056] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.ppt") returned 0
	[0050.056] lstrlenA (lpString="*.ppt") returned 5
	[0050.056] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.pptx") returned 0
	[0050.056] lstrlenA (lpString="*.pptx") returned 6
	[0050.057] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.txt") returned 0
	[0050.057] lstrlenA (lpString="*.txt") returned 5
	[0050.057] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.pdf") returned 0
	[0050.057] lstrlenA (lpString="*.pdf") returned 5
	[0050.057] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.htm") returned 0
	[0050.057] lstrlenA (lpString="*.htm") returned 5
	[0050.057] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.html") returned 0
	[0050.057] lstrlenA (lpString="*.html") returned 6
	[0050.057] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mdb") returned 0
	[0050.057] lstrlenA (lpString="*.mdb") returned 5
	[0050.057] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.pfx") returned 0
	[0050.057] lstrlenA (lpString="*.pfx") returned 5
	[0050.057] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.md") returned 0
	[0050.057] lstrlenA (lpString="*.md") returned 4
	[0050.057] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.lnk") returned 0
	[0050.057] lstrlenA (lpString="*.lnk") returned 5
	[0050.057] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.torrent") returned 0
	[0050.057] lstrlenA (lpString="*.torrent") returned 9
	[0050.057] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mov") returned 0
	[0050.057] lstrlenA (lpString="*.mov") returned 5
	[0050.057] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.3gp") returned 0
	[0050.057] lstrlenA (lpString="*.3gp") returned 5
	[0050.057] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mpeg") returned 0
	[0050.057] lstrlenA (lpString="*.mpeg") returned 6
	[0050.057] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mpg") returned 0
	[0050.057] lstrlenA (lpString="*.mpg") returned 5
	[0050.057] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.flv") returned 0
	[0050.057] lstrlenA (lpString="*.flv") returned 5
	[0050.057] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.avi") returned 0
	[0050.057] lstrlenA (lpString="*.avi") returned 5
	[0050.057] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mp4") returned 0
	[0050.057] lstrlenA (lpString="*.mp4") returned 5
	[0050.057] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.wmv") returned 0
	[0050.057] lstrlenA (lpString="*.wmv") returned 5
	[0050.057] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mkv") returned 0
	[0050.057] lstrlenA (lpString="*.mkv") returned 5
	[0050.057] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mp3") returned 0
	[0050.057] lstrlenA (lpString="*.mp3") returned 5
	[0050.058] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.wav") returned 0
	[0050.058] lstrlenA (lpString="*.wav") returned 5
	[0050.058] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.flac") returned 0
	[0050.058] lstrlenA (lpString="*.flac") returned 6
	[0050.058] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.wma") returned 0
	[0050.058] lstrlenA (lpString="*.wma") returned 5
	[0050.058] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.au3") returned 0
	[0050.058] lstrlenA (lpString="*.au3") returned 5
	[0050.058] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.ahk") returned 0
	[0050.058] lstrlenA (lpString="*.ahk") returned 5
	[0050.058] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.c") returned 0
	[0050.058] lstrlenA (lpString="*.c") returned 3
	[0050.058] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.cc") returned 0
	[0050.058] lstrlenA (lpString="*.cc") returned 4
	[0050.058] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.cpp") returned 0
	[0050.058] lstrlenA (lpString="*.cpp") returned 5
	[0050.058] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.cxx") returned 0
	[0050.058] lstrlenA (lpString="*.cxx") returned 5
	[0050.058] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.c++") returned 0
	[0050.058] lstrlenA (lpString="*.c++") returned 5
	[0050.058] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.cs") returned 0
	[0050.058] lstrlenA (lpString="*.cs") returned 4
	[0050.058] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.vb") returned 0
	[0050.058] lstrlenA (lpString="*.vb") returned 4
	[0050.058] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.bas") returned 0
	[0050.058] lstrlenA (lpString="*.bas") returned 5
	[0050.058] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.csproj") returned 0
	[0050.058] lstrlenA (lpString="*.csproj") returned 8
	[0050.058] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.vbproj") returned 0
	[0050.058] lstrlenA (lpString="*.vbproj") returned 8
	[0050.058] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.vcxproj") returned 0
	[0050.058] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.058] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.manifest") returned 0
	[0050.058] lstrlenA (lpString="*.manifest") returned 10
	[0050.058] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.php") returned 0
	[0050.058] lstrlenA (lpString="*.php") returned 5
	[0050.059] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.vbe") returned 0
	[0050.059] lstrlenA (lpString="*.vbe") returned 5
	[0050.059] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.vba") returned 0
	[0050.059] lstrlenA (lpString="*.vba") returned 5
	[0050.059] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.vbs") returned 0
	[0050.059] lstrlenA (lpString="*.vbs") returned 5
	[0050.059] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.bat") returned 0
	[0050.059] lstrlenA (lpString="*.bat") returned 5
	[0050.059] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.cmd") returned 0
	[0050.059] lstrlenA (lpString="*.cmd") returned 5
	[0050.059] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.js") returned 0
	[0050.059] lstrlenA (lpString="*.js") returned 4
	[0050.059] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.jscript") returned 0
	[0050.059] lstrlenA (lpString="*.jscript") returned 9
	[0050.059] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.hta") returned 0
	[0050.059] lstrlenA (lpString="*.hta") returned 5
	[0050.059] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.php7") returned 0
	[0050.059] lstrlenA (lpString="*.php7") returned 6
	[0050.059] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.db") returned 0
	[0050.059] lstrlenA (lpString="*.db") returned 4
	[0050.059] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.swf") returned 0
	[0050.059] lstrlenA (lpString="*.swf") returned 5
	[0050.059] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.eml") returned 0
	[0050.059] lstrlenA (lpString="*.eml") returned 5
	[0050.059] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.part") returned 0
	[0050.059] lstrlenA (lpString="*.part") returned 6
	[0050.059] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.nfo") returned 0
	[0050.059] lstrlenA (lpString="*.nfo") returned 5
	[0050.059] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.rsa") returned 0
	[0050.059] lstrlenA (lpString="*.rsa") returned 5
	[0050.059] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.key") returned 0
	[0050.059] lstrlenA (lpString="*.key") returned 5
	[0050.059] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.aes") returned 0
	[0050.059] lstrlenA (lpString="*.aes") returned 5
	[0050.059] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.blob") returned 0
	[0050.059] lstrlenA (lpString="*.blob") returned 6
	[0050.059] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.btc") returned 0
	[0050.060] lstrlenA (lpString="*.btc") returned 5
	[0050.060] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.wallet") returned 0
	[0050.060] lstrlenA (lpString="*.wallet") returned 8
	[0050.060] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b4eed5, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8c4060, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x243588, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1
	[0050.060] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.060] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="kor_boot.ttf") returned -1
	[0050.060] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="kor_boot.ttf") returned -1
	[0050.060] lstrcmpiA (lpString1="", lpString2="kor_boot.ttf") returned -1
	[0050.060] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\jpn_boot.ttf") returned="jpn_boot.ttf"
	[0050.060] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\"
	[0050.060] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned=""
	[0050.060] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.060] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\fonts\\how-to-decrypt-files.htm")) returned 0x20
	[0050.060] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="kor_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\kor_boot.ttf") returned="C:\\Boot\\Fonts\\kor_boot.ttf"
	[0050.060] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.zip") returned 0
	[0050.060] lstrlenA (lpString="*.zip") returned 5
	[0050.060] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.rar") returned 0
	[0050.060] lstrlenA (lpString="*.rar") returned 5
	[0050.060] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.7z") returned 0
	[0050.060] lstrlenA (lpString="*.7z") returned 4
	[0050.060] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.tar") returned 0
	[0050.060] lstrlenA (lpString="*.tar") returned 5
	[0050.060] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.gzip") returned 0
	[0050.060] lstrlenA (lpString="*.gzip") returned 6
	[0050.060] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.jpg") returned 0
	[0050.060] lstrlenA (lpString="*.jpg") returned 5
	[0050.060] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.jpeg") returned 0
	[0050.060] lstrlenA (lpString="*.jpeg") returned 6
	[0050.060] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.bmp") returned 0
	[0050.060] lstrlenA (lpString="*.bmp") returned 5
	[0050.060] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.gif") returned 0
	[0050.060] lstrlenA (lpString="*.gif") returned 5
	[0050.060] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.png") returned 0
	[0050.060] lstrlenA (lpString="*.png") returned 5
	[0050.060] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.doc") returned 0
	[0050.061] lstrlenA (lpString="*.doc") returned 5
	[0050.061] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.docx") returned 0
	[0050.061] lstrlenA (lpString="*.docx") returned 6
	[0050.061] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.xls") returned 0
	[0050.061] lstrlenA (lpString="*.xls") returned 5
	[0050.061] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.xlsx") returned 0
	[0050.061] lstrlenA (lpString="*.xlsx") returned 6
	[0050.061] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.ppt") returned 0
	[0050.061] lstrlenA (lpString="*.ppt") returned 5
	[0050.061] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.pptx") returned 0
	[0050.061] lstrlenA (lpString="*.pptx") returned 6
	[0050.061] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.txt") returned 0
	[0050.061] lstrlenA (lpString="*.txt") returned 5
	[0050.061] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.pdf") returned 0
	[0050.061] lstrlenA (lpString="*.pdf") returned 5
	[0050.061] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.htm") returned 0
	[0050.061] lstrlenA (lpString="*.htm") returned 5
	[0050.061] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.html") returned 0
	[0050.061] lstrlenA (lpString="*.html") returned 6
	[0050.061] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mdb") returned 0
	[0050.061] lstrlenA (lpString="*.mdb") returned 5
	[0050.061] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.pfx") returned 0
	[0050.061] lstrlenA (lpString="*.pfx") returned 5
	[0050.061] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.md") returned 0
	[0050.061] lstrlenA (lpString="*.md") returned 4
	[0050.061] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.lnk") returned 0
	[0050.061] lstrlenA (lpString="*.lnk") returned 5
	[0050.061] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.torrent") returned 0
	[0050.061] lstrlenA (lpString="*.torrent") returned 9
	[0050.061] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mov") returned 0
	[0050.061] lstrlenA (lpString="*.mov") returned 5
	[0050.061] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.3gp") returned 0
	[0050.061] lstrlenA (lpString="*.3gp") returned 5
	[0050.061] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mpeg") returned 0
	[0050.061] lstrlenA (lpString="*.mpeg") returned 6
	[0050.061] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mpg") returned 0
	[0050.061] lstrlenA (lpString="*.mpg") returned 5
	[0050.061] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.flv") returned 0
	[0050.061] lstrlenA (lpString="*.flv") returned 5
	[0050.062] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.avi") returned 0
	[0050.062] lstrlenA (lpString="*.avi") returned 5
	[0050.062] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mp4") returned 0
	[0050.062] lstrlenA (lpString="*.mp4") returned 5
	[0050.062] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.wmv") returned 0
	[0050.062] lstrlenA (lpString="*.wmv") returned 5
	[0050.062] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mkv") returned 0
	[0050.062] lstrlenA (lpString="*.mkv") returned 5
	[0050.062] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mp3") returned 0
	[0050.062] lstrlenA (lpString="*.mp3") returned 5
	[0050.062] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.wav") returned 0
	[0050.062] lstrlenA (lpString="*.wav") returned 5
	[0050.062] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.flac") returned 0
	[0050.062] lstrlenA (lpString="*.flac") returned 6
	[0050.062] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.wma") returned 0
	[0050.062] lstrlenA (lpString="*.wma") returned 5
	[0050.062] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.au3") returned 0
	[0050.062] lstrlenA (lpString="*.au3") returned 5
	[0050.062] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.ahk") returned 0
	[0050.062] lstrlenA (lpString="*.ahk") returned 5
	[0050.062] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.c") returned 0
	[0050.062] lstrlenA (lpString="*.c") returned 3
	[0050.062] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.cc") returned 0
	[0050.062] lstrlenA (lpString="*.cc") returned 4
	[0050.062] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.cpp") returned 0
	[0050.062] lstrlenA (lpString="*.cpp") returned 5
	[0050.062] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.cxx") returned 0
	[0050.062] lstrlenA (lpString="*.cxx") returned 5
	[0050.062] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.c++") returned 0
	[0050.062] lstrlenA (lpString="*.c++") returned 5
	[0050.062] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.cs") returned 0
	[0050.062] lstrlenA (lpString="*.cs") returned 4
	[0050.062] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.vb") returned 0
	[0050.062] lstrlenA (lpString="*.vb") returned 4
	[0050.062] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.bas") returned 0
	[0050.062] lstrlenA (lpString="*.bas") returned 5
	[0050.062] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.csproj") returned 0
	[0050.063] lstrlenA (lpString="*.csproj") returned 8
	[0050.063] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.vbproj") returned 0
	[0050.063] lstrlenA (lpString="*.vbproj") returned 8
	[0050.063] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.vcxproj") returned 0
	[0050.063] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.063] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.manifest") returned 0
	[0050.063] lstrlenA (lpString="*.manifest") returned 10
	[0050.063] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.php") returned 0
	[0050.063] lstrlenA (lpString="*.php") returned 5
	[0050.063] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.vbe") returned 0
	[0050.063] lstrlenA (lpString="*.vbe") returned 5
	[0050.063] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.vba") returned 0
	[0050.063] lstrlenA (lpString="*.vba") returned 5
	[0050.063] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.vbs") returned 0
	[0050.063] lstrlenA (lpString="*.vbs") returned 5
	[0050.063] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.bat") returned 0
	[0050.063] lstrlenA (lpString="*.bat") returned 5
	[0050.063] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.cmd") returned 0
	[0050.063] lstrlenA (lpString="*.cmd") returned 5
	[0050.063] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.js") returned 0
	[0050.063] lstrlenA (lpString="*.js") returned 4
	[0050.063] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.jscript") returned 0
	[0050.063] lstrlenA (lpString="*.jscript") returned 9
	[0050.063] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.hta") returned 0
	[0050.063] lstrlenA (lpString="*.hta") returned 5
	[0050.063] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.php7") returned 0
	[0050.063] lstrlenA (lpString="*.php7") returned 6
	[0050.063] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.db") returned 0
	[0050.063] lstrlenA (lpString="*.db") returned 4
	[0050.063] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.swf") returned 0
	[0050.063] lstrlenA (lpString="*.swf") returned 5
	[0050.063] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.eml") returned 0
	[0050.063] lstrlenA (lpString="*.eml") returned 5
	[0050.063] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.part") returned 0
	[0050.063] lstrlenA (lpString="*.part") returned 6
	[0050.063] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.nfo") returned 0
	[0050.064] lstrlenA (lpString="*.nfo") returned 5
	[0050.064] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.rsa") returned 0
	[0050.064] lstrlenA (lpString="*.rsa") returned 5
	[0050.064] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.key") returned 0
	[0050.064] lstrlenA (lpString="*.key") returned 5
	[0050.064] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.aes") returned 0
	[0050.064] lstrlenA (lpString="*.aes") returned 5
	[0050.064] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.blob") returned 0
	[0050.064] lstrlenA (lpString="*.blob") returned 6
	[0050.064] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.btc") returned 0
	[0050.064] lstrlenA (lpString="*.btc") returned 5
	[0050.064] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.wallet") returned 0
	[0050.064] lstrlenA (lpString="*.wallet") returned 8
	[0050.064] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8e28b4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2ab6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgunn_boot.ttf", cAlternateFileName="MALGUN~1.TTF")) returned 1
	[0050.064] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.064] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="malgunn_boot.ttf") returned -1
	[0050.064] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="malgunn_boot.ttf") returned -1
	[0050.064] lstrcmpiA (lpString1="", lpString2="malgunn_boot.ttf") returned -1
	[0050.064] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\kor_boot.ttf") returned="kor_boot.ttf"
	[0050.064] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\"
	[0050.064] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned=""
	[0050.064] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.064] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\fonts\\how-to-decrypt-files.htm")) returned 0x20
	[0050.064] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="malgunn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned="C:\\Boot\\Fonts\\malgunn_boot.ttf"
	[0050.064] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.zip") returned 0
	[0050.064] lstrlenA (lpString="*.zip") returned 5
	[0050.064] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.rar") returned 0
	[0050.064] lstrlenA (lpString="*.rar") returned 5
	[0050.064] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.7z") returned 0
	[0050.064] lstrlenA (lpString="*.7z") returned 4
	[0050.064] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.tar") returned 0
	[0050.064] lstrlenA (lpString="*.tar") returned 5
	[0050.064] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.gzip") returned 0
	[0050.064] lstrlenA (lpString="*.gzip") returned 6
	[0050.065] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.jpg") returned 0
	[0050.065] lstrlenA (lpString="*.jpg") returned 5
	[0050.065] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.jpeg") returned 0
	[0050.065] lstrlenA (lpString="*.jpeg") returned 6
	[0050.065] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.bmp") returned 0
	[0050.065] lstrlenA (lpString="*.bmp") returned 5
	[0050.065] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.gif") returned 0
	[0050.065] lstrlenA (lpString="*.gif") returned 5
	[0050.065] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.png") returned 0
	[0050.065] lstrlenA (lpString="*.png") returned 5
	[0050.065] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.doc") returned 0
	[0050.065] lstrlenA (lpString="*.doc") returned 5
	[0050.065] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.docx") returned 0
	[0050.065] lstrlenA (lpString="*.docx") returned 6
	[0050.065] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.xls") returned 0
	[0050.065] lstrlenA (lpString="*.xls") returned 5
	[0050.065] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.xlsx") returned 0
	[0050.065] lstrlenA (lpString="*.xlsx") returned 6
	[0050.065] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.ppt") returned 0
	[0050.065] lstrlenA (lpString="*.ppt") returned 5
	[0050.065] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.pptx") returned 0
	[0050.065] lstrlenA (lpString="*.pptx") returned 6
	[0050.065] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.txt") returned 0
	[0050.065] lstrlenA (lpString="*.txt") returned 5
	[0050.065] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.pdf") returned 0
	[0050.065] lstrlenA (lpString="*.pdf") returned 5
	[0050.065] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.htm") returned 0
	[0050.065] lstrlenA (lpString="*.htm") returned 5
	[0050.065] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.html") returned 0
	[0050.065] lstrlenA (lpString="*.html") returned 6
	[0050.065] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.mdb") returned 0
	[0050.065] lstrlenA (lpString="*.mdb") returned 5
	[0050.065] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.pfx") returned 0
	[0050.065] lstrlenA (lpString="*.pfx") returned 5
	[0050.065] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.md") returned 0
	[0050.065] lstrlenA (lpString="*.md") returned 4
	[0050.065] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.lnk") returned 0
	[0050.065] lstrlenA (lpString="*.lnk") returned 5
	[0050.066] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.torrent") returned 0
	[0050.066] lstrlenA (lpString="*.torrent") returned 9
	[0050.066] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.mov") returned 0
	[0050.066] lstrlenA (lpString="*.mov") returned 5
	[0050.066] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.3gp") returned 0
	[0050.066] lstrlenA (lpString="*.3gp") returned 5
	[0050.066] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.mpeg") returned 0
	[0050.066] lstrlenA (lpString="*.mpeg") returned 6
	[0050.066] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.mpg") returned 0
	[0050.066] lstrlenA (lpString="*.mpg") returned 5
	[0050.066] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.flv") returned 0
	[0050.066] lstrlenA (lpString="*.flv") returned 5
	[0050.066] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.avi") returned 0
	[0050.066] lstrlenA (lpString="*.avi") returned 5
	[0050.066] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.mp4") returned 0
	[0050.066] lstrlenA (lpString="*.mp4") returned 5
	[0050.066] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.wmv") returned 0
	[0050.066] lstrlenA (lpString="*.wmv") returned 5
	[0050.066] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.mkv") returned 0
	[0050.066] lstrlenA (lpString="*.mkv") returned 5
	[0050.066] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.mp3") returned 0
	[0050.066] lstrlenA (lpString="*.mp3") returned 5
	[0050.066] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.wav") returned 0
	[0050.066] lstrlenA (lpString="*.wav") returned 5
	[0050.066] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.flac") returned 0
	[0050.066] lstrlenA (lpString="*.flac") returned 6
	[0050.066] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.wma") returned 0
	[0050.066] lstrlenA (lpString="*.wma") returned 5
	[0050.066] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.au3") returned 0
	[0050.066] lstrlenA (lpString="*.au3") returned 5
	[0050.066] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.ahk") returned 0
	[0050.066] lstrlenA (lpString="*.ahk") returned 5
	[0050.066] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.c") returned 0
	[0050.066] lstrlenA (lpString="*.c") returned 3
	[0050.066] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.cc") returned 0
	[0050.067] lstrlenA (lpString="*.cc") returned 4
	[0050.067] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.cpp") returned 0
	[0050.067] lstrlenA (lpString="*.cpp") returned 5
	[0050.067] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.cxx") returned 0
	[0050.067] lstrlenA (lpString="*.cxx") returned 5
	[0050.067] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.c++") returned 0
	[0050.067] lstrlenA (lpString="*.c++") returned 5
	[0050.067] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.cs") returned 0
	[0050.067] lstrlenA (lpString="*.cs") returned 4
	[0050.067] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.vb") returned 0
	[0050.067] lstrlenA (lpString="*.vb") returned 4
	[0050.067] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.bas") returned 0
	[0050.067] lstrlenA (lpString="*.bas") returned 5
	[0050.067] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.csproj") returned 0
	[0050.067] lstrlenA (lpString="*.csproj") returned 8
	[0050.067] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.vbproj") returned 0
	[0050.067] lstrlenA (lpString="*.vbproj") returned 8
	[0050.067] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.vcxproj") returned 0
	[0050.067] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.067] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.manifest") returned 0
	[0050.067] lstrlenA (lpString="*.manifest") returned 10
	[0050.067] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.php") returned 0
	[0050.067] lstrlenA (lpString="*.php") returned 5
	[0050.067] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.vbe") returned 0
	[0050.067] lstrlenA (lpString="*.vbe") returned 5
	[0050.067] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.vba") returned 0
	[0050.067] lstrlenA (lpString="*.vba") returned 5
	[0050.067] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.vbs") returned 0
	[0050.067] lstrlenA (lpString="*.vbs") returned 5
	[0050.067] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.bat") returned 0
	[0050.067] lstrlenA (lpString="*.bat") returned 5
	[0050.067] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.cmd") returned 0
	[0050.067] lstrlenA (lpString="*.cmd") returned 5
	[0050.067] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.js") returned 0
	[0050.067] lstrlenA (lpString="*.js") returned 4
	[0050.067] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.jscript") returned 0
	[0050.067] lstrlenA (lpString="*.jscript") returned 9
	[0050.068] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.hta") returned 0
	[0050.068] lstrlenA (lpString="*.hta") returned 5
	[0050.068] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.php7") returned 0
	[0050.068] lstrlenA (lpString="*.php7") returned 6
	[0050.068] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.db") returned 0
	[0050.068] lstrlenA (lpString="*.db") returned 4
	[0050.068] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.swf") returned 0
	[0050.068] lstrlenA (lpString="*.swf") returned 5
	[0050.068] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.eml") returned 0
	[0050.068] lstrlenA (lpString="*.eml") returned 5
	[0050.068] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.part") returned 0
	[0050.068] lstrlenA (lpString="*.part") returned 6
	[0050.068] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.nfo") returned 0
	[0050.068] lstrlenA (lpString="*.nfo") returned 5
	[0050.068] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.rsa") returned 0
	[0050.068] lstrlenA (lpString="*.rsa") returned 5
	[0050.068] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.key") returned 0
	[0050.068] lstrlenA (lpString="*.key") returned 5
	[0050.068] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.aes") returned 0
	[0050.068] lstrlenA (lpString="*.aes") returned 5
	[0050.068] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.blob") returned 0
	[0050.068] lstrlenA (lpString="*.blob") returned 6
	[0050.068] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.btc") returned 0
	[0050.068] lstrlenA (lpString="*.btc") returned 5
	[0050.068] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.wallet") returned 0
	[0050.068] lstrlenA (lpString="*.wallet") returned 8
	[0050.068] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8f4db4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2b506, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgun_boot.ttf", cAlternateFileName="MALGUN~2.TTF")) returned 1
	[0050.069] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.069] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="malgun_boot.ttf") returned -1
	[0050.069] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="malgun_boot.ttf") returned -1
	[0050.069] lstrcmpiA (lpString1="", lpString2="malgun_boot.ttf") returned -1
	[0050.069] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned="malgunn_boot.ttf"
	[0050.069] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\"
	[0050.069] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned=""
	[0050.069] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.069] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\fonts\\how-to-decrypt-files.htm")) returned 0x20
	[0050.069] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="malgun_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\malgun_boot.ttf") returned="C:\\Boot\\Fonts\\malgun_boot.ttf"
	[0050.069] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.zip") returned 0
	[0050.069] lstrlenA (lpString="*.zip") returned 5
	[0050.069] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.rar") returned 0
	[0050.069] lstrlenA (lpString="*.rar") returned 5
	[0050.069] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.7z") returned 0
	[0050.069] lstrlenA (lpString="*.7z") returned 4
	[0050.069] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.tar") returned 0
	[0050.069] lstrlenA (lpString="*.tar") returned 5
	[0050.069] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.gzip") returned 0
	[0050.069] lstrlenA (lpString="*.gzip") returned 6
	[0050.069] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.jpg") returned 0
	[0050.069] lstrlenA (lpString="*.jpg") returned 5
	[0050.069] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.jpeg") returned 0
	[0050.069] lstrlenA (lpString="*.jpeg") returned 6
	[0050.069] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.bmp") returned 0
	[0050.069] lstrlenA (lpString="*.bmp") returned 5
	[0050.069] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.gif") returned 0
	[0050.069] lstrlenA (lpString="*.gif") returned 5
	[0050.069] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.png") returned 0
	[0050.069] lstrlenA (lpString="*.png") returned 5
	[0050.069] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.doc") returned 0
	[0050.069] lstrlenA (lpString="*.doc") returned 5
	[0050.069] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.docx") returned 0
	[0050.069] lstrlenA (lpString="*.docx") returned 6
	[0050.070] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.xls") returned 0
	[0050.070] lstrlenA (lpString="*.xls") returned 5
	[0050.070] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.xlsx") returned 0
	[0050.070] lstrlenA (lpString="*.xlsx") returned 6
	[0050.070] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.ppt") returned 0
	[0050.070] lstrlenA (lpString="*.ppt") returned 5
	[0050.070] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.pptx") returned 0
	[0050.070] lstrlenA (lpString="*.pptx") returned 6
	[0050.070] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.txt") returned 0
	[0050.070] lstrlenA (lpString="*.txt") returned 5
	[0050.070] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.pdf") returned 0
	[0050.070] lstrlenA (lpString="*.pdf") returned 5
	[0050.070] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.htm") returned 0
	[0050.070] lstrlenA (lpString="*.htm") returned 5
	[0050.070] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.html") returned 0
	[0050.070] lstrlenA (lpString="*.html") returned 6
	[0050.070] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.mdb") returned 0
	[0050.070] lstrlenA (lpString="*.mdb") returned 5
	[0050.070] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.pfx") returned 0
	[0050.070] lstrlenA (lpString="*.pfx") returned 5
	[0050.070] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.md") returned 0
	[0050.070] lstrlenA (lpString="*.md") returned 4
	[0050.070] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.lnk") returned 0
	[0050.070] lstrlenA (lpString="*.lnk") returned 5
	[0050.070] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.torrent") returned 0
	[0050.070] lstrlenA (lpString="*.torrent") returned 9
	[0050.070] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.mov") returned 0
	[0050.070] lstrlenA (lpString="*.mov") returned 5
	[0050.070] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.3gp") returned 0
	[0050.070] lstrlenA (lpString="*.3gp") returned 5
	[0050.070] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.mpeg") returned 0
	[0050.070] lstrlenA (lpString="*.mpeg") returned 6
	[0050.070] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.mpg") returned 0
	[0050.070] lstrlenA (lpString="*.mpg") returned 5
	[0050.070] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.flv") returned 0
	[0050.070] lstrlenA (lpString="*.flv") returned 5
	[0050.070] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.avi") returned 0
	[0050.071] lstrlenA (lpString="*.avi") returned 5
	[0050.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.mp4") returned 0
	[0050.071] lstrlenA (lpString="*.mp4") returned 5
	[0050.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.wmv") returned 0
	[0050.071] lstrlenA (lpString="*.wmv") returned 5
	[0050.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.mkv") returned 0
	[0050.071] lstrlenA (lpString="*.mkv") returned 5
	[0050.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.mp3") returned 0
	[0050.071] lstrlenA (lpString="*.mp3") returned 5
	[0050.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.wav") returned 0
	[0050.071] lstrlenA (lpString="*.wav") returned 5
	[0050.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.flac") returned 0
	[0050.071] lstrlenA (lpString="*.flac") returned 6
	[0050.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.wma") returned 0
	[0050.071] lstrlenA (lpString="*.wma") returned 5
	[0050.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.au3") returned 0
	[0050.071] lstrlenA (lpString="*.au3") returned 5
	[0050.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.ahk") returned 0
	[0050.071] lstrlenA (lpString="*.ahk") returned 5
	[0050.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.c") returned 0
	[0050.071] lstrlenA (lpString="*.c") returned 3
	[0050.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.cc") returned 0
	[0050.071] lstrlenA (lpString="*.cc") returned 4
	[0050.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.cpp") returned 0
	[0050.071] lstrlenA (lpString="*.cpp") returned 5
	[0050.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.cxx") returned 0
	[0050.071] lstrlenA (lpString="*.cxx") returned 5
	[0050.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.c++") returned 0
	[0050.071] lstrlenA (lpString="*.c++") returned 5
	[0050.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.cs") returned 0
	[0050.071] lstrlenA (lpString="*.cs") returned 4
	[0050.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.vb") returned 0
	[0050.071] lstrlenA (lpString="*.vb") returned 4
	[0050.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.bas") returned 0
	[0050.071] lstrlenA (lpString="*.bas") returned 5
	[0050.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.csproj") returned 0
	[0050.071] lstrlenA (lpString="*.csproj") returned 8
	[0050.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.vbproj") returned 0
	[0050.071] lstrlenA (lpString="*.vbproj") returned 8
	[0050.072] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.vcxproj") returned 0
	[0050.072] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.072] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.manifest") returned 0
	[0050.072] lstrlenA (lpString="*.manifest") returned 10
	[0050.072] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.php") returned 0
	[0050.072] lstrlenA (lpString="*.php") returned 5
	[0050.072] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.vbe") returned 0
	[0050.072] lstrlenA (lpString="*.vbe") returned 5
	[0050.072] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.vba") returned 0
	[0050.072] lstrlenA (lpString="*.vba") returned 5
	[0050.072] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.vbs") returned 0
	[0050.072] lstrlenA (lpString="*.vbs") returned 5
	[0050.072] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.bat") returned 0
	[0050.072] lstrlenA (lpString="*.bat") returned 5
	[0050.072] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.cmd") returned 0
	[0050.072] lstrlenA (lpString="*.cmd") returned 5
	[0050.072] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.js") returned 0
	[0050.072] lstrlenA (lpString="*.js") returned 4
	[0050.072] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.jscript") returned 0
	[0050.072] lstrlenA (lpString="*.jscript") returned 9
	[0050.072] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.hta") returned 0
	[0050.072] lstrlenA (lpString="*.hta") returned 5
	[0050.072] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.php7") returned 0
	[0050.072] lstrlenA (lpString="*.php7") returned 6
	[0050.072] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.db") returned 0
	[0050.072] lstrlenA (lpString="*.db") returned 4
	[0050.072] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.swf") returned 0
	[0050.072] lstrlenA (lpString="*.swf") returned 5
	[0050.072] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.eml") returned 0
	[0050.072] lstrlenA (lpString="*.eml") returned 5
	[0050.072] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.part") returned 0
	[0050.072] lstrlenA (lpString="*.part") returned 6
	[0050.072] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.nfo") returned 0
	[0050.072] lstrlenA (lpString="*.nfo") returned 5
	[0050.072] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.rsa") returned 0
	[0050.072] lstrlenA (lpString="*.rsa") returned 5
	[0050.072] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.key") returned 0
	[0050.072] lstrlenA (lpString="*.key") returned 5
	[0050.073] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.aes") returned 0
	[0050.073] lstrlenA (lpString="*.aes") returned 5
	[0050.073] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.blob") returned 0
	[0050.073] lstrlenA (lpString="*.blob") returned 6
	[0050.073] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.btc") returned 0
	[0050.073] lstrlenA (lpString="*.btc") returned 5
	[0050.073] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.wallet") returned 0
	[0050.073] lstrlenA (lpString="*.wallet") returned 8
	[0050.073] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9072c7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2318a, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryon_boot.ttf", cAlternateFileName="MEIRYO~1.TTF")) returned 1
	[0050.073] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.073] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="meiryon_boot.ttf") returned -1
	[0050.073] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="meiryon_boot.ttf") returned -1
	[0050.073] lstrcmpiA (lpString1="", lpString2="meiryon_boot.ttf") returned -1
	[0050.073] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\malgun_boot.ttf") returned="malgun_boot.ttf"
	[0050.073] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\"
	[0050.073] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned=""
	[0050.073] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.073] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\fonts\\how-to-decrypt-files.htm")) returned 0x20
	[0050.073] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="meiryon_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned="C:\\Boot\\Fonts\\meiryon_boot.ttf"
	[0050.073] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.zip") returned 0
	[0050.073] lstrlenA (lpString="*.zip") returned 5
	[0050.073] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.rar") returned 0
	[0050.073] lstrlenA (lpString="*.rar") returned 5
	[0050.073] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.7z") returned 0
	[0050.073] lstrlenA (lpString="*.7z") returned 4
	[0050.073] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.tar") returned 0
	[0050.073] lstrlenA (lpString="*.tar") returned 5
	[0050.073] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.gzip") returned 0
	[0050.073] lstrlenA (lpString="*.gzip") returned 6
	[0050.073] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.jpg") returned 0
	[0050.073] lstrlenA (lpString="*.jpg") returned 5
	[0050.073] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.jpeg") returned 0
	[0050.073] lstrlenA (lpString="*.jpeg") returned 6
	[0050.073] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.bmp") returned 0
	[0050.073] lstrlenA (lpString="*.bmp") returned 5
	[0050.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.gif") returned 0
	[0050.074] lstrlenA (lpString="*.gif") returned 5
	[0050.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.png") returned 0
	[0050.074] lstrlenA (lpString="*.png") returned 5
	[0050.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.doc") returned 0
	[0050.074] lstrlenA (lpString="*.doc") returned 5
	[0050.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.docx") returned 0
	[0050.074] lstrlenA (lpString="*.docx") returned 6
	[0050.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.xls") returned 0
	[0050.074] lstrlenA (lpString="*.xls") returned 5
	[0050.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.xlsx") returned 0
	[0050.074] lstrlenA (lpString="*.xlsx") returned 6
	[0050.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.ppt") returned 0
	[0050.074] lstrlenA (lpString="*.ppt") returned 5
	[0050.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.pptx") returned 0
	[0050.074] lstrlenA (lpString="*.pptx") returned 6
	[0050.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.txt") returned 0
	[0050.074] lstrlenA (lpString="*.txt") returned 5
	[0050.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.pdf") returned 0
	[0050.074] lstrlenA (lpString="*.pdf") returned 5
	[0050.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.htm") returned 0
	[0050.074] lstrlenA (lpString="*.htm") returned 5
	[0050.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.html") returned 0
	[0050.074] lstrlenA (lpString="*.html") returned 6
	[0050.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.mdb") returned 0
	[0050.074] lstrlenA (lpString="*.mdb") returned 5
	[0050.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.pfx") returned 0
	[0050.074] lstrlenA (lpString="*.pfx") returned 5
	[0050.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.md") returned 0
	[0050.074] lstrlenA (lpString="*.md") returned 4
	[0050.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.lnk") returned 0
	[0050.074] lstrlenA (lpString="*.lnk") returned 5
	[0050.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.torrent") returned 0
	[0050.074] lstrlenA (lpString="*.torrent") returned 9
	[0050.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.mov") returned 0
	[0050.074] lstrlenA (lpString="*.mov") returned 5
	[0050.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.3gp") returned 0
	[0050.075] lstrlenA (lpString="*.3gp") returned 5
	[0050.075] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.mpeg") returned 0
	[0050.075] lstrlenA (lpString="*.mpeg") returned 6
	[0050.075] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.mpg") returned 0
	[0050.075] lstrlenA (lpString="*.mpg") returned 5
	[0050.075] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.flv") returned 0
	[0050.075] lstrlenA (lpString="*.flv") returned 5
	[0050.075] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.avi") returned 0
	[0050.075] lstrlenA (lpString="*.avi") returned 5
	[0050.075] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.mp4") returned 0
	[0050.075] lstrlenA (lpString="*.mp4") returned 5
	[0050.075] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.wmv") returned 0
	[0050.075] lstrlenA (lpString="*.wmv") returned 5
	[0050.075] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.mkv") returned 0
	[0050.075] lstrlenA (lpString="*.mkv") returned 5
	[0050.075] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.mp3") returned 0
	[0050.075] lstrlenA (lpString="*.mp3") returned 5
	[0050.075] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.wav") returned 0
	[0050.075] lstrlenA (lpString="*.wav") returned 5
	[0050.075] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.flac") returned 0
	[0050.075] lstrlenA (lpString="*.flac") returned 6
	[0050.075] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.wma") returned 0
	[0050.075] lstrlenA (lpString="*.wma") returned 5
	[0050.075] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.au3") returned 0
	[0050.075] lstrlenA (lpString="*.au3") returned 5
	[0050.075] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.ahk") returned 0
	[0050.075] lstrlenA (lpString="*.ahk") returned 5
	[0050.075] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.c") returned 0
	[0050.075] lstrlenA (lpString="*.c") returned 3
	[0050.075] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.cc") returned 0
	[0050.075] lstrlenA (lpString="*.cc") returned 4
	[0050.075] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.cpp") returned 0
	[0050.075] lstrlenA (lpString="*.cpp") returned 5
	[0050.075] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.cxx") returned 0
	[0050.075] lstrlenA (lpString="*.cxx") returned 5
	[0050.075] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.c++") returned 0
	[0050.075] lstrlenA (lpString="*.c++") returned 5
	[0050.075] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.cs") returned 0
	[0050.076] lstrlenA (lpString="*.cs") returned 4
	[0050.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.vb") returned 0
	[0050.076] lstrlenA (lpString="*.vb") returned 4
	[0050.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.bas") returned 0
	[0050.076] lstrlenA (lpString="*.bas") returned 5
	[0050.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.csproj") returned 0
	[0050.076] lstrlenA (lpString="*.csproj") returned 8
	[0050.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.vbproj") returned 0
	[0050.076] lstrlenA (lpString="*.vbproj") returned 8
	[0050.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.vcxproj") returned 0
	[0050.076] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.manifest") returned 0
	[0050.076] lstrlenA (lpString="*.manifest") returned 10
	[0050.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.php") returned 0
	[0050.076] lstrlenA (lpString="*.php") returned 5
	[0050.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.vbe") returned 0
	[0050.076] lstrlenA (lpString="*.vbe") returned 5
	[0050.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.vba") returned 0
	[0050.076] lstrlenA (lpString="*.vba") returned 5
	[0050.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.vbs") returned 0
	[0050.076] lstrlenA (lpString="*.vbs") returned 5
	[0050.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.bat") returned 0
	[0050.076] lstrlenA (lpString="*.bat") returned 5
	[0050.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.cmd") returned 0
	[0050.076] lstrlenA (lpString="*.cmd") returned 5
	[0050.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.js") returned 0
	[0050.076] lstrlenA (lpString="*.js") returned 4
	[0050.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.jscript") returned 0
	[0050.076] lstrlenA (lpString="*.jscript") returned 9
	[0050.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.hta") returned 0
	[0050.076] lstrlenA (lpString="*.hta") returned 5
	[0050.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.php7") returned 0
	[0050.076] lstrlenA (lpString="*.php7") returned 6
	[0050.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.db") returned 0
	[0050.076] lstrlenA (lpString="*.db") returned 4
	[0050.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.swf") returned 0
	[0050.076] lstrlenA (lpString="*.swf") returned 5
	[0050.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.eml") returned 0
	[0050.077] lstrlenA (lpString="*.eml") returned 5
	[0050.077] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.part") returned 0
	[0050.077] lstrlenA (lpString="*.part") returned 6
	[0050.077] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.nfo") returned 0
	[0050.077] lstrlenA (lpString="*.nfo") returned 5
	[0050.077] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.rsa") returned 0
	[0050.077] lstrlenA (lpString="*.rsa") returned 5
	[0050.077] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.key") returned 0
	[0050.077] lstrlenA (lpString="*.key") returned 5
	[0050.077] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.aes") returned 0
	[0050.077] lstrlenA (lpString="*.aes") returned 5
	[0050.077] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.blob") returned 0
	[0050.077] lstrlenA (lpString="*.blob") returned 6
	[0050.077] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.btc") returned 0
	[0050.077] lstrlenA (lpString="*.btc") returned 5
	[0050.077] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.wallet") returned 0
	[0050.077] lstrlenA (lpString="*.wallet") returned 8
	[0050.077] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef918492, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2380b, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryo_boot.ttf", cAlternateFileName="MEIRYO~2.TTF")) returned 1
	[0050.077] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.077] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="meiryo_boot.ttf") returned -1
	[0050.077] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="meiryo_boot.ttf") returned -1
	[0050.077] lstrcmpiA (lpString1="", lpString2="meiryo_boot.ttf") returned -1
	[0050.077] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned="meiryon_boot.ttf"
	[0050.077] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\"
	[0050.077] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned=""
	[0050.077] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.077] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\fonts\\how-to-decrypt-files.htm")) returned 0x20
	[0050.077] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="meiryo_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned="C:\\Boot\\Fonts\\meiryo_boot.ttf"
	[0050.077] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.zip") returned 0
	[0050.077] lstrlenA (lpString="*.zip") returned 5
	[0050.077] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.rar") returned 0
	[0050.077] lstrlenA (lpString="*.rar") returned 5
	[0050.077] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.7z") returned 0
	[0050.077] lstrlenA (lpString="*.7z") returned 4
	[0050.077] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.tar") returned 0
	[0050.078] lstrlenA (lpString="*.tar") returned 5
	[0050.078] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.gzip") returned 0
	[0050.078] lstrlenA (lpString="*.gzip") returned 6
	[0050.078] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.jpg") returned 0
	[0050.078] lstrlenA (lpString="*.jpg") returned 5
	[0050.078] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.jpeg") returned 0
	[0050.078] lstrlenA (lpString="*.jpeg") returned 6
	[0050.078] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.bmp") returned 0
	[0050.078] lstrlenA (lpString="*.bmp") returned 5
	[0050.078] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.gif") returned 0
	[0050.078] lstrlenA (lpString="*.gif") returned 5
	[0050.078] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.png") returned 0
	[0050.078] lstrlenA (lpString="*.png") returned 5
	[0050.078] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.doc") returned 0
	[0050.078] lstrlenA (lpString="*.doc") returned 5
	[0050.078] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.docx") returned 0
	[0050.078] lstrlenA (lpString="*.docx") returned 6
	[0050.078] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.xls") returned 0
	[0050.078] lstrlenA (lpString="*.xls") returned 5
	[0050.078] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.xlsx") returned 0
	[0050.078] lstrlenA (lpString="*.xlsx") returned 6
	[0050.078] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.ppt") returned 0
	[0050.078] lstrlenA (lpString="*.ppt") returned 5
	[0050.078] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.pptx") returned 0
	[0050.078] lstrlenA (lpString="*.pptx") returned 6
	[0050.078] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.txt") returned 0
	[0050.078] lstrlenA (lpString="*.txt") returned 5
	[0050.078] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.pdf") returned 0
	[0050.078] lstrlenA (lpString="*.pdf") returned 5
	[0050.078] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.htm") returned 0
	[0050.078] lstrlenA (lpString="*.htm") returned 5
	[0050.078] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.html") returned 0
	[0050.078] lstrlenA (lpString="*.html") returned 6
	[0050.078] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.mdb") returned 0
	[0050.078] lstrlenA (lpString="*.mdb") returned 5
	[0050.078] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.pfx") returned 0
	[0050.079] lstrlenA (lpString="*.pfx") returned 5
	[0050.079] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.md") returned 0
	[0050.079] lstrlenA (lpString="*.md") returned 4
	[0050.079] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.lnk") returned 0
	[0050.079] lstrlenA (lpString="*.lnk") returned 5
	[0050.079] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.torrent") returned 0
	[0050.079] lstrlenA (lpString="*.torrent") returned 9
	[0050.079] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.mov") returned 0
	[0050.079] lstrlenA (lpString="*.mov") returned 5
	[0050.079] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.3gp") returned 0
	[0050.079] lstrlenA (lpString="*.3gp") returned 5
	[0050.079] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.mpeg") returned 0
	[0050.079] lstrlenA (lpString="*.mpeg") returned 6
	[0050.079] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.mpg") returned 0
	[0050.079] lstrlenA (lpString="*.mpg") returned 5
	[0050.079] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.flv") returned 0
	[0050.079] lstrlenA (lpString="*.flv") returned 5
	[0050.079] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.avi") returned 0
	[0050.079] lstrlenA (lpString="*.avi") returned 5
	[0050.079] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.mp4") returned 0
	[0050.079] lstrlenA (lpString="*.mp4") returned 5
	[0050.079] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.wmv") returned 0
	[0050.079] lstrlenA (lpString="*.wmv") returned 5
	[0050.079] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.mkv") returned 0
	[0050.079] lstrlenA (lpString="*.mkv") returned 5
	[0050.079] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.mp3") returned 0
	[0050.079] lstrlenA (lpString="*.mp3") returned 5
	[0050.079] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.wav") returned 0
	[0050.079] lstrlenA (lpString="*.wav") returned 5
	[0050.079] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.flac") returned 0
	[0050.079] lstrlenA (lpString="*.flac") returned 6
	[0050.079] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.wma") returned 0
	[0050.079] lstrlenA (lpString="*.wma") returned 5
	[0050.079] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.au3") returned 0
	[0050.079] lstrlenA (lpString="*.au3") returned 5
	[0050.079] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.ahk") returned 0
	[0050.079] lstrlenA (lpString="*.ahk") returned 5
	[0050.080] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.c") returned 0
	[0050.080] lstrlenA (lpString="*.c") returned 3
	[0050.080] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.cc") returned 0
	[0050.080] lstrlenA (lpString="*.cc") returned 4
	[0050.080] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.cpp") returned 0
	[0050.080] lstrlenA (lpString="*.cpp") returned 5
	[0050.080] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.cxx") returned 0
	[0050.080] lstrlenA (lpString="*.cxx") returned 5
	[0050.080] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.c++") returned 0
	[0050.080] lstrlenA (lpString="*.c++") returned 5
	[0050.080] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.cs") returned 0
	[0050.080] lstrlenA (lpString="*.cs") returned 4
	[0050.080] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.vb") returned 0
	[0050.080] lstrlenA (lpString="*.vb") returned 4
	[0050.080] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.bas") returned 0
	[0050.080] lstrlenA (lpString="*.bas") returned 5
	[0050.080] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.csproj") returned 0
	[0050.080] lstrlenA (lpString="*.csproj") returned 8
	[0050.080] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.vbproj") returned 0
	[0050.080] lstrlenA (lpString="*.vbproj") returned 8
	[0050.080] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.vcxproj") returned 0
	[0050.080] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.080] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.manifest") returned 0
	[0050.080] lstrlenA (lpString="*.manifest") returned 10
	[0050.080] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.php") returned 0
	[0050.080] lstrlenA (lpString="*.php") returned 5
	[0050.080] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.vbe") returned 0
	[0050.080] lstrlenA (lpString="*.vbe") returned 5
	[0050.080] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.vba") returned 0
	[0050.080] lstrlenA (lpString="*.vba") returned 5
	[0050.080] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.vbs") returned 0
	[0050.080] lstrlenA (lpString="*.vbs") returned 5
	[0050.080] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.bat") returned 0
	[0050.080] lstrlenA (lpString="*.bat") returned 5
	[0050.080] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.cmd") returned 0
	[0050.080] lstrlenA (lpString="*.cmd") returned 5
	[0050.080] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.js") returned 0
	[0050.081] lstrlenA (lpString="*.js") returned 4
	[0050.081] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.jscript") returned 0
	[0050.081] lstrlenA (lpString="*.jscript") returned 9
	[0050.081] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.hta") returned 0
	[0050.081] lstrlenA (lpString="*.hta") returned 5
	[0050.081] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.php7") returned 0
	[0050.081] lstrlenA (lpString="*.php7") returned 6
	[0050.081] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.db") returned 0
	[0050.081] lstrlenA (lpString="*.db") returned 4
	[0050.081] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.swf") returned 0
	[0050.081] lstrlenA (lpString="*.swf") returned 5
	[0050.081] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.eml") returned 0
	[0050.081] lstrlenA (lpString="*.eml") returned 5
	[0050.081] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.part") returned 0
	[0050.081] lstrlenA (lpString="*.part") returned 6
	[0050.081] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.nfo") returned 0
	[0050.081] lstrlenA (lpString="*.nfo") returned 5
	[0050.081] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.rsa") returned 0
	[0050.081] lstrlenA (lpString="*.rsa") returned 5
	[0050.081] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.key") returned 0
	[0050.081] lstrlenA (lpString="*.key") returned 5
	[0050.081] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.aes") returned 0
	[0050.081] lstrlenA (lpString="*.aes") returned 5
	[0050.081] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.blob") returned 0
	[0050.081] lstrlenA (lpString="*.blob") returned 6
	[0050.081] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.btc") returned 0
	[0050.081] lstrlenA (lpString="*.btc") returned 5
	[0050.081] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.wallet") returned 0
	[0050.081] lstrlenA (lpString="*.wallet") returned 8
	[0050.081] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef92a947, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x27a1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjhn_boot.ttf", cAlternateFileName="MSJHN_~1.TTF")) returned 1
	[0050.081] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.081] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="msjhn_boot.ttf") returned -1
	[0050.081] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="msjhn_boot.ttf") returned -1
	[0050.081] lstrcmpiA (lpString1="", lpString2="msjhn_boot.ttf") returned -1
	[0050.081] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned="meiryo_boot.ttf"
	[0050.081] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\"
	[0050.081] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned=""
	[0050.082] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.082] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\fonts\\how-to-decrypt-files.htm")) returned 0x20
	[0050.082] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="msjhn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned="C:\\Boot\\Fonts\\msjhn_boot.ttf"
	[0050.082] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.zip") returned 0
	[0050.082] lstrlenA (lpString="*.zip") returned 5
	[0050.082] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.rar") returned 0
	[0050.082] lstrlenA (lpString="*.rar") returned 5
	[0050.082] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.7z") returned 0
	[0050.082] lstrlenA (lpString="*.7z") returned 4
	[0050.082] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.tar") returned 0
	[0050.082] lstrlenA (lpString="*.tar") returned 5
	[0050.082] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.gzip") returned 0
	[0050.082] lstrlenA (lpString="*.gzip") returned 6
	[0050.082] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.jpg") returned 0
	[0050.082] lstrlenA (lpString="*.jpg") returned 5
	[0050.082] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.jpeg") returned 0
	[0050.082] lstrlenA (lpString="*.jpeg") returned 6
	[0050.082] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.bmp") returned 0
	[0050.082] lstrlenA (lpString="*.bmp") returned 5
	[0050.082] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.gif") returned 0
	[0050.082] lstrlenA (lpString="*.gif") returned 5
	[0050.082] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.png") returned 0
	[0050.082] lstrlenA (lpString="*.png") returned 5
	[0050.082] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.doc") returned 0
	[0050.082] lstrlenA (lpString="*.doc") returned 5
	[0050.082] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.docx") returned 0
	[0050.082] lstrlenA (lpString="*.docx") returned 6
	[0050.082] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.xls") returned 0
	[0050.082] lstrlenA (lpString="*.xls") returned 5
	[0050.082] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.xlsx") returned 0
	[0050.082] lstrlenA (lpString="*.xlsx") returned 6
	[0050.082] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.ppt") returned 0
	[0050.082] lstrlenA (lpString="*.ppt") returned 5
	[0050.082] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.pptx") returned 0
	[0050.082] lstrlenA (lpString="*.pptx") returned 6
	[0050.082] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.txt") returned 0
	[0050.083] lstrlenA (lpString="*.txt") returned 5
	[0050.083] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.pdf") returned 0
	[0050.083] lstrlenA (lpString="*.pdf") returned 5
	[0050.083] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.htm") returned 0
	[0050.083] lstrlenA (lpString="*.htm") returned 5
	[0050.083] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.html") returned 0
	[0050.083] lstrlenA (lpString="*.html") returned 6
	[0050.083] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.mdb") returned 0
	[0050.083] lstrlenA (lpString="*.mdb") returned 5
	[0050.083] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.pfx") returned 0
	[0050.083] lstrlenA (lpString="*.pfx") returned 5
	[0050.083] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.md") returned 0
	[0050.083] lstrlenA (lpString="*.md") returned 4
	[0050.083] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.lnk") returned 0
	[0050.083] lstrlenA (lpString="*.lnk") returned 5
	[0050.083] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.torrent") returned 0
	[0050.083] lstrlenA (lpString="*.torrent") returned 9
	[0050.083] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.mov") returned 0
	[0050.083] lstrlenA (lpString="*.mov") returned 5
	[0050.083] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.3gp") returned 0
	[0050.083] lstrlenA (lpString="*.3gp") returned 5
	[0050.083] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.mpeg") returned 0
	[0050.083] lstrlenA (lpString="*.mpeg") returned 6
	[0050.083] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.mpg") returned 0
	[0050.083] lstrlenA (lpString="*.mpg") returned 5
	[0050.083] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.flv") returned 0
	[0050.083] lstrlenA (lpString="*.flv") returned 5
	[0050.083] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.avi") returned 0
	[0050.084] lstrlenA (lpString="*.avi") returned 5
	[0050.084] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.mp4") returned 0
	[0050.084] lstrlenA (lpString="*.mp4") returned 5
	[0050.084] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.wmv") returned 0
	[0050.084] lstrlenA (lpString="*.wmv") returned 5
	[0050.084] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.mkv") returned 0
	[0050.084] lstrlenA (lpString="*.mkv") returned 5
	[0050.084] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.mp3") returned 0
	[0050.084] lstrlenA (lpString="*.mp3") returned 5
	[0050.084] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.wav") returned 0
	[0050.085] lstrlenA (lpString="*.wav") returned 5
	[0050.085] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.flac") returned 0
	[0050.085] lstrlenA (lpString="*.flac") returned 6
	[0050.085] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.wma") returned 0
	[0050.085] lstrlenA (lpString="*.wma") returned 5
	[0050.085] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.au3") returned 0
	[0050.085] lstrlenA (lpString="*.au3") returned 5
	[0050.085] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.ahk") returned 0
	[0050.085] lstrlenA (lpString="*.ahk") returned 5
	[0050.085] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.c") returned 0
	[0050.085] lstrlenA (lpString="*.c") returned 3
	[0050.085] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.cc") returned 0
	[0050.085] lstrlenA (lpString="*.cc") returned 4
	[0050.085] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.cpp") returned 0
	[0050.085] lstrlenA (lpString="*.cpp") returned 5
	[0050.085] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.cxx") returned 0
	[0050.085] lstrlenA (lpString="*.cxx") returned 5
	[0050.085] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.c++") returned 0
	[0050.085] lstrlenA (lpString="*.c++") returned 5
	[0050.085] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.cs") returned 0
	[0050.085] lstrlenA (lpString="*.cs") returned 4
	[0050.085] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.vb") returned 0
	[0050.085] lstrlenA (lpString="*.vb") returned 4
	[0050.085] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.bas") returned 0
	[0050.085] lstrlenA (lpString="*.bas") returned 5
	[0050.085] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.csproj") returned 0
	[0050.085] lstrlenA (lpString="*.csproj") returned 8
	[0050.085] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.vbproj") returned 0
	[0050.085] lstrlenA (lpString="*.vbproj") returned 8
	[0050.085] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.vcxproj") returned 0
	[0050.085] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.085] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.manifest") returned 0
	[0050.085] lstrlenA (lpString="*.manifest") returned 10
	[0050.085] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.php") returned 0
	[0050.085] lstrlenA (lpString="*.php") returned 5
	[0050.085] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.vbe") returned 0
	[0050.085] lstrlenA (lpString="*.vbe") returned 5
	[0050.086] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.vba") returned 0
	[0050.086] lstrlenA (lpString="*.vba") returned 5
	[0050.086] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.vbs") returned 0
	[0050.086] lstrlenA (lpString="*.vbs") returned 5
	[0050.086] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.bat") returned 0
	[0050.086] lstrlenA (lpString="*.bat") returned 5
	[0050.086] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.cmd") returned 0
	[0050.086] lstrlenA (lpString="*.cmd") returned 5
	[0050.086] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.js") returned 0
	[0050.086] lstrlenA (lpString="*.js") returned 4
	[0050.086] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.jscript") returned 0
	[0050.086] lstrlenA (lpString="*.jscript") returned 9
	[0050.086] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.hta") returned 0
	[0050.086] lstrlenA (lpString="*.hta") returned 5
	[0050.086] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.php7") returned 0
	[0050.086] lstrlenA (lpString="*.php7") returned 6
	[0050.086] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.db") returned 0
	[0050.086] lstrlenA (lpString="*.db") returned 4
	[0050.086] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.swf") returned 0
	[0050.086] lstrlenA (lpString="*.swf") returned 5
	[0050.086] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.eml") returned 0
	[0050.086] lstrlenA (lpString="*.eml") returned 5
	[0050.086] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.part") returned 0
	[0050.086] lstrlenA (lpString="*.part") returned 6
	[0050.086] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.nfo") returned 0
	[0050.086] lstrlenA (lpString="*.nfo") returned 5
	[0050.086] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.rsa") returned 0
	[0050.086] lstrlenA (lpString="*.rsa") returned 5
	[0050.086] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.key") returned 0
	[0050.086] lstrlenA (lpString="*.key") returned 5
	[0050.086] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.aes") returned 0
	[0050.086] lstrlenA (lpString="*.aes") returned 5
	[0050.086] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.blob") returned 0
	[0050.086] lstrlenA (lpString="*.blob") returned 6
	[0050.086] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.btc") returned 0
	[0050.086] lstrlenA (lpString="*.btc") returned 5
	[0050.086] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.wallet") returned 0
	[0050.087] lstrlenA (lpString="*.wallet") returned 8
	[0050.087] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef93ce3b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x281fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjh_boot.ttf", cAlternateFileName="MSJH_B~1.TTF")) returned 1
	[0050.087] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.087] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="msjh_boot.ttf") returned -1
	[0050.087] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="msjh_boot.ttf") returned -1
	[0050.087] lstrcmpiA (lpString1="", lpString2="msjh_boot.ttf") returned -1
	[0050.087] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned="msjhn_boot.ttf"
	[0050.087] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\"
	[0050.087] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned=""
	[0050.087] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.087] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\fonts\\how-to-decrypt-files.htm")) returned 0x20
	[0050.087] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="msjh_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\msjh_boot.ttf") returned="C:\\Boot\\Fonts\\msjh_boot.ttf"
	[0050.087] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.zip") returned 0
	[0050.087] lstrlenA (lpString="*.zip") returned 5
	[0050.087] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.rar") returned 0
	[0050.087] lstrlenA (lpString="*.rar") returned 5
	[0050.087] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.7z") returned 0
	[0050.087] lstrlenA (lpString="*.7z") returned 4
	[0050.087] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.tar") returned 0
	[0050.087] lstrlenA (lpString="*.tar") returned 5
	[0050.087] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.gzip") returned 0
	[0050.087] lstrlenA (lpString="*.gzip") returned 6
	[0050.087] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.jpg") returned 0
	[0050.087] lstrlenA (lpString="*.jpg") returned 5
	[0050.087] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.jpeg") returned 0
	[0050.087] lstrlenA (lpString="*.jpeg") returned 6
	[0050.087] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.bmp") returned 0
	[0050.087] lstrlenA (lpString="*.bmp") returned 5
	[0050.087] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.gif") returned 0
	[0050.087] lstrlenA (lpString="*.gif") returned 5
	[0050.087] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.png") returned 0
	[0050.087] lstrlenA (lpString="*.png") returned 5
	[0050.087] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.doc") returned 0
	[0050.088] lstrlenA (lpString="*.doc") returned 5
	[0050.088] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.docx") returned 0
	[0050.088] lstrlenA (lpString="*.docx") returned 6
	[0050.088] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.xls") returned 0
	[0050.088] lstrlenA (lpString="*.xls") returned 5
	[0050.088] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.xlsx") returned 0
	[0050.088] lstrlenA (lpString="*.xlsx") returned 6
	[0050.088] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.ppt") returned 0
	[0050.088] lstrlenA (lpString="*.ppt") returned 5
	[0050.088] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.pptx") returned 0
	[0050.088] lstrlenA (lpString="*.pptx") returned 6
	[0050.088] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.txt") returned 0
	[0050.088] lstrlenA (lpString="*.txt") returned 5
	[0050.088] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.pdf") returned 0
	[0050.088] lstrlenA (lpString="*.pdf") returned 5
	[0050.088] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.htm") returned 0
	[0050.088] lstrlenA (lpString="*.htm") returned 5
	[0050.088] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.html") returned 0
	[0050.088] lstrlenA (lpString="*.html") returned 6
	[0050.088] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.mdb") returned 0
	[0050.088] lstrlenA (lpString="*.mdb") returned 5
	[0050.088] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.pfx") returned 0
	[0050.088] lstrlenA (lpString="*.pfx") returned 5
	[0050.088] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.md") returned 0
	[0050.088] lstrlenA (lpString="*.md") returned 4
	[0050.088] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.lnk") returned 0
	[0050.088] lstrlenA (lpString="*.lnk") returned 5
	[0050.088] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.torrent") returned 0
	[0050.088] lstrlenA (lpString="*.torrent") returned 9
	[0050.088] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.mov") returned 0
	[0050.088] lstrlenA (lpString="*.mov") returned 5
	[0050.088] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.3gp") returned 0
	[0050.088] lstrlenA (lpString="*.3gp") returned 5
	[0050.088] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.mpeg") returned 0
	[0050.088] lstrlenA (lpString="*.mpeg") returned 6
	[0050.088] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.mpg") returned 0
	[0050.088] lstrlenA (lpString="*.mpg") returned 5
	[0050.089] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.flv") returned 0
	[0050.089] lstrlenA (lpString="*.flv") returned 5
	[0050.089] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.avi") returned 0
	[0050.089] lstrlenA (lpString="*.avi") returned 5
	[0050.089] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.mp4") returned 0
	[0050.089] lstrlenA (lpString="*.mp4") returned 5
	[0050.089] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.wmv") returned 0
	[0050.089] lstrlenA (lpString="*.wmv") returned 5
	[0050.089] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.mkv") returned 0
	[0050.089] lstrlenA (lpString="*.mkv") returned 5
	[0050.089] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.mp3") returned 0
	[0050.089] lstrlenA (lpString="*.mp3") returned 5
	[0050.089] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.wav") returned 0
	[0050.089] lstrlenA (lpString="*.wav") returned 5
	[0050.089] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.flac") returned 0
	[0050.089] lstrlenA (lpString="*.flac") returned 6
	[0050.089] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.wma") returned 0
	[0050.089] lstrlenA (lpString="*.wma") returned 5
	[0050.089] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.au3") returned 0
	[0050.089] lstrlenA (lpString="*.au3") returned 5
	[0050.089] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.ahk") returned 0
	[0050.089] lstrlenA (lpString="*.ahk") returned 5
	[0050.089] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.c") returned 0
	[0050.089] lstrlenA (lpString="*.c") returned 3
	[0050.089] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.cc") returned 0
	[0050.089] lstrlenA (lpString="*.cc") returned 4
	[0050.089] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.cpp") returned 0
	[0050.089] lstrlenA (lpString="*.cpp") returned 5
	[0050.089] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.cxx") returned 0
	[0050.089] lstrlenA (lpString="*.cxx") returned 5
	[0050.089] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.c++") returned 0
	[0050.089] lstrlenA (lpString="*.c++") returned 5
	[0050.089] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.cs") returned 0
	[0050.089] lstrlenA (lpString="*.cs") returned 4
	[0050.089] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.vb") returned 0
	[0050.089] lstrlenA (lpString="*.vb") returned 4
	[0050.089] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.bas") returned 0
	[0050.090] lstrlenA (lpString="*.bas") returned 5
	[0050.090] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.csproj") returned 0
	[0050.090] lstrlenA (lpString="*.csproj") returned 8
	[0050.090] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.vbproj") returned 0
	[0050.090] lstrlenA (lpString="*.vbproj") returned 8
	[0050.090] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.vcxproj") returned 0
	[0050.090] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.090] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.manifest") returned 0
	[0050.090] lstrlenA (lpString="*.manifest") returned 10
	[0050.090] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.php") returned 0
	[0050.090] lstrlenA (lpString="*.php") returned 5
	[0050.090] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.vbe") returned 0
	[0050.090] lstrlenA (lpString="*.vbe") returned 5
	[0050.090] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.vba") returned 0
	[0050.090] lstrlenA (lpString="*.vba") returned 5
	[0050.090] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.vbs") returned 0
	[0050.090] lstrlenA (lpString="*.vbs") returned 5
	[0050.090] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.bat") returned 0
	[0050.090] lstrlenA (lpString="*.bat") returned 5
	[0050.090] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.cmd") returned 0
	[0050.090] lstrlenA (lpString="*.cmd") returned 5
	[0050.090] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.js") returned 0
	[0050.090] lstrlenA (lpString="*.js") returned 4
	[0050.090] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.jscript") returned 0
	[0050.090] lstrlenA (lpString="*.jscript") returned 9
	[0050.090] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.hta") returned 0
	[0050.090] lstrlenA (lpString="*.hta") returned 5
	[0050.090] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.php7") returned 0
	[0050.090] lstrlenA (lpString="*.php7") returned 6
	[0050.090] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.db") returned 0
	[0050.090] lstrlenA (lpString="*.db") returned 4
	[0050.090] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.swf") returned 0
	[0050.090] lstrlenA (lpString="*.swf") returned 5
	[0050.090] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.eml") returned 0
	[0050.090] lstrlenA (lpString="*.eml") returned 5
	[0050.090] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.part") returned 0
	[0050.091] lstrlenA (lpString="*.part") returned 6
	[0050.091] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.nfo") returned 0
	[0050.091] lstrlenA (lpString="*.nfo") returned 5
	[0050.091] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.rsa") returned 0
	[0050.091] lstrlenA (lpString="*.rsa") returned 5
	[0050.091] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.key") returned 0
	[0050.091] lstrlenA (lpString="*.key") returned 5
	[0050.091] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.aes") returned 0
	[0050.091] lstrlenA (lpString="*.aes") returned 5
	[0050.091] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.blob") returned 0
	[0050.091] lstrlenA (lpString="*.blob") returned 6
	[0050.091] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.btc") returned 0
	[0050.091] lstrlenA (lpString="*.btc") returned 5
	[0050.091] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.wallet") returned 0
	[0050.091] lstrlenA (lpString="*.wallet") returned 8
	[0050.091] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef94dfcd, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x25b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyhn_boot.ttf", cAlternateFileName="MSYHN_~1.TTF")) returned 1
	[0050.091] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.091] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="msyhn_boot.ttf") returned -1
	[0050.091] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="msyhn_boot.ttf") returned -1
	[0050.091] lstrcmpiA (lpString1="", lpString2="msyhn_boot.ttf") returned -1
	[0050.091] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\msjh_boot.ttf") returned="msjh_boot.ttf"
	[0050.091] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\"
	[0050.091] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned=""
	[0050.091] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.091] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\fonts\\how-to-decrypt-files.htm")) returned 0x20
	[0050.091] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="msyhn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned="C:\\Boot\\Fonts\\msyhn_boot.ttf"
	[0050.091] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.zip") returned 0
	[0050.091] lstrlenA (lpString="*.zip") returned 5
	[0050.091] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.rar") returned 0
	[0050.091] lstrlenA (lpString="*.rar") returned 5
	[0050.091] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.7z") returned 0
	[0050.091] lstrlenA (lpString="*.7z") returned 4
	[0050.091] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.tar") returned 0
	[0050.091] lstrlenA (lpString="*.tar") returned 5
	[0050.091] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.gzip") returned 0
	[0050.092] lstrlenA (lpString="*.gzip") returned 6
	[0050.092] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.jpg") returned 0
	[0050.092] lstrlenA (lpString="*.jpg") returned 5
	[0050.092] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.jpeg") returned 0
	[0050.092] lstrlenA (lpString="*.jpeg") returned 6
	[0050.092] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.bmp") returned 0
	[0050.092] lstrlenA (lpString="*.bmp") returned 5
	[0050.092] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.gif") returned 0
	[0050.092] lstrlenA (lpString="*.gif") returned 5
	[0050.092] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.png") returned 0
	[0050.092] lstrlenA (lpString="*.png") returned 5
	[0050.092] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.doc") returned 0
	[0050.092] lstrlenA (lpString="*.doc") returned 5
	[0050.092] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.docx") returned 0
	[0050.092] lstrlenA (lpString="*.docx") returned 6
	[0050.092] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.xls") returned 0
	[0050.092] lstrlenA (lpString="*.xls") returned 5
	[0050.092] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.xlsx") returned 0
	[0050.092] lstrlenA (lpString="*.xlsx") returned 6
	[0050.092] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.ppt") returned 0
	[0050.092] lstrlenA (lpString="*.ppt") returned 5
	[0050.092] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.pptx") returned 0
	[0050.092] lstrlenA (lpString="*.pptx") returned 6
	[0050.092] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.txt") returned 0
	[0050.092] lstrlenA (lpString="*.txt") returned 5
	[0050.092] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.pdf") returned 0
	[0050.092] lstrlenA (lpString="*.pdf") returned 5
	[0050.092] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.htm") returned 0
	[0050.092] lstrlenA (lpString="*.htm") returned 5
	[0050.092] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.html") returned 0
	[0050.092] lstrlenA (lpString="*.html") returned 6
	[0050.092] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.mdb") returned 0
	[0050.092] lstrlenA (lpString="*.mdb") returned 5
	[0050.092] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.pfx") returned 0
	[0050.092] lstrlenA (lpString="*.pfx") returned 5
	[0050.092] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.md") returned 0
	[0050.093] lstrlenA (lpString="*.md") returned 4
	[0050.093] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.lnk") returned 0
	[0050.093] lstrlenA (lpString="*.lnk") returned 5
	[0050.093] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.torrent") returned 0
	[0050.093] lstrlenA (lpString="*.torrent") returned 9
	[0050.093] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.mov") returned 0
	[0050.093] lstrlenA (lpString="*.mov") returned 5
	[0050.093] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.3gp") returned 0
	[0050.093] lstrlenA (lpString="*.3gp") returned 5
	[0050.093] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.mpeg") returned 0
	[0050.093] lstrlenA (lpString="*.mpeg") returned 6
	[0050.093] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.mpg") returned 0
	[0050.093] lstrlenA (lpString="*.mpg") returned 5
	[0050.093] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.flv") returned 0
	[0050.093] lstrlenA (lpString="*.flv") returned 5
	[0050.093] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.avi") returned 0
	[0050.093] lstrlenA (lpString="*.avi") returned 5
	[0050.093] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.mp4") returned 0
	[0050.093] lstrlenA (lpString="*.mp4") returned 5
	[0050.093] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.wmv") returned 0
	[0050.093] lstrlenA (lpString="*.wmv") returned 5
	[0050.093] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.mkv") returned 0
	[0050.093] lstrlenA (lpString="*.mkv") returned 5
	[0050.093] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.mp3") returned 0
	[0050.093] lstrlenA (lpString="*.mp3") returned 5
	[0050.093] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.wav") returned 0
	[0050.093] lstrlenA (lpString="*.wav") returned 5
	[0050.093] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.flac") returned 0
	[0050.093] lstrlenA (lpString="*.flac") returned 6
	[0050.093] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.wma") returned 0
	[0050.093] lstrlenA (lpString="*.wma") returned 5
	[0050.093] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.au3") returned 0
	[0050.093] lstrlenA (lpString="*.au3") returned 5
	[0050.093] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.ahk") returned 0
	[0050.093] lstrlenA (lpString="*.ahk") returned 5
	[0050.093] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.c") returned 0
	[0050.093] lstrlenA (lpString="*.c") returned 3
	[0050.094] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.cc") returned 0
	[0050.094] lstrlenA (lpString="*.cc") returned 4
	[0050.094] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.cpp") returned 0
	[0050.094] lstrlenA (lpString="*.cpp") returned 5
	[0050.094] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.cxx") returned 0
	[0050.094] lstrlenA (lpString="*.cxx") returned 5
	[0050.094] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.c++") returned 0
	[0050.094] lstrlenA (lpString="*.c++") returned 5
	[0050.094] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.cs") returned 0
	[0050.094] lstrlenA (lpString="*.cs") returned 4
	[0050.094] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.vb") returned 0
	[0050.094] lstrlenA (lpString="*.vb") returned 4
	[0050.094] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.bas") returned 0
	[0050.094] lstrlenA (lpString="*.bas") returned 5
	[0050.094] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.csproj") returned 0
	[0050.094] lstrlenA (lpString="*.csproj") returned 8
	[0050.094] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.vbproj") returned 0
	[0050.094] lstrlenA (lpString="*.vbproj") returned 8
	[0050.094] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.vcxproj") returned 0
	[0050.094] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.094] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.manifest") returned 0
	[0050.094] lstrlenA (lpString="*.manifest") returned 10
	[0050.094] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.php") returned 0
	[0050.094] lstrlenA (lpString="*.php") returned 5
	[0050.094] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.vbe") returned 0
	[0050.094] lstrlenA (lpString="*.vbe") returned 5
	[0050.094] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.vba") returned 0
	[0050.094] lstrlenA (lpString="*.vba") returned 5
	[0050.094] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.vbs") returned 0
	[0050.094] lstrlenA (lpString="*.vbs") returned 5
	[0050.094] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.bat") returned 0
	[0050.094] lstrlenA (lpString="*.bat") returned 5
	[0050.094] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.cmd") returned 0
	[0050.094] lstrlenA (lpString="*.cmd") returned 5
	[0050.094] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.js") returned 0
	[0050.094] lstrlenA (lpString="*.js") returned 4
	[0050.094] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.jscript") returned 0
	[0050.094] lstrlenA (lpString="*.jscript") returned 9
	[0050.095] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.hta") returned 0
	[0050.095] lstrlenA (lpString="*.hta") returned 5
	[0050.095] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.php7") returned 0
	[0050.095] lstrlenA (lpString="*.php7") returned 6
	[0050.095] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.db") returned 0
	[0050.095] lstrlenA (lpString="*.db") returned 4
	[0050.095] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.swf") returned 0
	[0050.095] lstrlenA (lpString="*.swf") returned 5
	[0050.095] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.eml") returned 0
	[0050.095] lstrlenA (lpString="*.eml") returned 5
	[0050.095] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.part") returned 0
	[0050.095] lstrlenA (lpString="*.part") returned 6
	[0050.095] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.nfo") returned 0
	[0050.095] lstrlenA (lpString="*.nfo") returned 5
	[0050.095] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.rsa") returned 0
	[0050.095] lstrlenA (lpString="*.rsa") returned 5
	[0050.095] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.key") returned 0
	[0050.095] lstrlenA (lpString="*.key") returned 5
	[0050.095] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.aes") returned 0
	[0050.095] lstrlenA (lpString="*.aes") returned 5
	[0050.095] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.blob") returned 0
	[0050.095] lstrlenA (lpString="*.blob") returned 6
	[0050.095] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.btc") returned 0
	[0050.095] lstrlenA (lpString="*.btc") returned 5
	[0050.095] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.wallet") returned 0
	[0050.095] lstrlenA (lpString="*.wallet") returned 8
	[0050.095] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef95f141, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x26255, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyh_boot.ttf", cAlternateFileName="MSYH_B~1.TTF")) returned 1
	[0050.095] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.095] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="msyh_boot.ttf") returned -1
	[0050.095] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="msyh_boot.ttf") returned -1
	[0050.095] lstrcmpiA (lpString1="", lpString2="msyh_boot.ttf") returned -1
	[0050.095] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned="msyhn_boot.ttf"
	[0050.095] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\"
	[0050.095] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned=""
	[0050.095] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.096] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\fonts\\how-to-decrypt-files.htm")) returned 0x20
	[0050.096] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="msyh_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\msyh_boot.ttf") returned="C:\\Boot\\Fonts\\msyh_boot.ttf"
	[0050.096] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.zip") returned 0
	[0050.096] lstrlenA (lpString="*.zip") returned 5
	[0050.096] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.rar") returned 0
	[0050.096] lstrlenA (lpString="*.rar") returned 5
	[0050.096] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.7z") returned 0
	[0050.096] lstrlenA (lpString="*.7z") returned 4
	[0050.096] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.tar") returned 0
	[0050.096] lstrlenA (lpString="*.tar") returned 5
	[0050.096] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.gzip") returned 0
	[0050.096] lstrlenA (lpString="*.gzip") returned 6
	[0050.096] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.jpg") returned 0
	[0050.096] lstrlenA (lpString="*.jpg") returned 5
	[0050.096] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.jpeg") returned 0
	[0050.096] lstrlenA (lpString="*.jpeg") returned 6
	[0050.096] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.bmp") returned 0
	[0050.096] lstrlenA (lpString="*.bmp") returned 5
	[0050.096] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.gif") returned 0
	[0050.096] lstrlenA (lpString="*.gif") returned 5
	[0050.096] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.png") returned 0
	[0050.096] lstrlenA (lpString="*.png") returned 5
	[0050.096] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.doc") returned 0
	[0050.096] lstrlenA (lpString="*.doc") returned 5
	[0050.096] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.docx") returned 0
	[0050.096] lstrlenA (lpString="*.docx") returned 6
	[0050.096] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.xls") returned 0
	[0050.096] lstrlenA (lpString="*.xls") returned 5
	[0050.096] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.xlsx") returned 0
	[0050.096] lstrlenA (lpString="*.xlsx") returned 6
	[0050.096] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.ppt") returned 0
	[0050.096] lstrlenA (lpString="*.ppt") returned 5
	[0050.096] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.pptx") returned 0
	[0050.096] lstrlenA (lpString="*.pptx") returned 6
	[0050.096] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.txt") returned 0
	[0050.097] lstrlenA (lpString="*.txt") returned 5
	[0050.097] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.pdf") returned 0
	[0050.097] lstrlenA (lpString="*.pdf") returned 5
	[0050.097] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.htm") returned 0
	[0050.097] lstrlenA (lpString="*.htm") returned 5
	[0050.097] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.html") returned 0
	[0050.097] lstrlenA (lpString="*.html") returned 6
	[0050.097] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.mdb") returned 0
	[0050.097] lstrlenA (lpString="*.mdb") returned 5
	[0050.097] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.pfx") returned 0
	[0050.097] lstrlenA (lpString="*.pfx") returned 5
	[0050.097] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.md") returned 0
	[0050.097] lstrlenA (lpString="*.md") returned 4
	[0050.097] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.lnk") returned 0
	[0050.097] lstrlenA (lpString="*.lnk") returned 5
	[0050.097] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.torrent") returned 0
	[0050.097] lstrlenA (lpString="*.torrent") returned 9
	[0050.097] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.mov") returned 0
	[0050.097] lstrlenA (lpString="*.mov") returned 5
	[0050.097] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.3gp") returned 0
	[0050.097] lstrlenA (lpString="*.3gp") returned 5
	[0050.097] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.mpeg") returned 0
	[0050.097] lstrlenA (lpString="*.mpeg") returned 6
	[0050.097] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.mpg") returned 0
	[0050.097] lstrlenA (lpString="*.mpg") returned 5
	[0050.097] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.flv") returned 0
	[0050.097] lstrlenA (lpString="*.flv") returned 5
	[0050.098] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef96ef3e, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="segmono_boot.ttf", cAlternateFileName="SEGMON~1.TTF")) returned 1
	[0050.098] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.098] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="segmono_boot.ttf") returned -1
	[0050.098] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="segmono_boot.ttf") returned -1
	[0050.098] lstrcmpiA (lpString1="", lpString2="segmono_boot.ttf") returned -1
	[0050.098] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\msyh_boot.ttf") returned="msyh_boot.ttf"
	[0050.098] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\"
	[0050.098] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned=""
	[0050.098] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.098] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\fonts\\how-to-decrypt-files.htm")) returned 0x20
	[0050.098] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="segmono_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\segmono_boot.ttf") returned="C:\\Boot\\Fonts\\segmono_boot.ttf"
	[0050.098] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c0da69, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef97d9ab, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x14f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoen_slboot.ttf", cAlternateFileName="SEGOEN~1.TTF")) returned 1
	[0050.098] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.098] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="segoen_slboot.ttf") returned -1
	[0050.098] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="segoen_slboot.ttf") returned -1
	[0050.098] lstrcmpiA (lpString1="", lpString2="segoen_slboot.ttf") returned -1
	[0050.098] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\segmono_boot.ttf") returned="segmono_boot.ttf"
	[0050.098] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\"
	[0050.098] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned=""
	[0050.098] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.098] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\fonts\\how-to-decrypt-files.htm")) returned 0x20
	[0050.098] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="segoen_slboot.ttf" | out: lpString1="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned="C:\\Boot\\Fonts\\segoen_slboot.ttf"
	[0050.098] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef98c419, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x150a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoe_slboot.ttf", cAlternateFileName="SEGOE_~1.TTF")) returned 1
	[0050.098] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.098] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="segoe_slboot.ttf") returned -1
	[0050.098] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="segoe_slboot.ttf") returned -1
	[0050.099] lstrcmpiA (lpString1="", lpString2="segoe_slboot.ttf") returned -1
	[0050.099] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned="segoen_slboot.ttf"
	[0050.099] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\"
	[0050.099] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned=""
	[0050.099] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.099] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\fonts\\how-to-decrypt-files.htm")) returned 0x20
	[0050.099] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="segoe_slboot.ttf" | out: lpString1="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned="C:\\Boot\\Fonts\\segoe_slboot.ttf"
	[0050.099] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1
	[0050.099] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.109] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="wgl4_boot.ttf") returned -1
	[0050.109] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="wgl4_boot.ttf") returned -1
	[0050.109] lstrcmpiA (lpString1="", lpString2="wgl4_boot.ttf") returned -1
	[0050.109] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned="segoe_slboot.ttf"
	[0050.109] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\"
	[0050.109] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned=""
	[0050.109] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.110] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\fonts\\how-to-decrypt-files.htm")) returned 0x20
	[0050.110] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="wgl4_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned="C:\\Boot\\Fonts\\wgl4_boot.ttf"
	[0050.110] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0
	[0050.110] FindClose (in: hFindFile=0x7cb750 | out: hFindFile=0x7cb750) returned 1
	[0050.110] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="fr-CA", cAlternateFileName="")) returned 1
	[0050.110] lstrcmpA (lpString1=".", lpString2="fr-CA") returned -1
	[0050.110] lstrcmpA (lpString1="..", lpString2="fr-CA") returned -1
	[0050.110] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0050.110] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="fr-CA" | out: lpString1="C:\\Boot\\fr-CA") returned="C:\\Boot\\fr-CA"
	[0050.110] FindFirstFileA (in: lpFileName="C:\\Boot\\fr-CA\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb590
	[0050.111] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.111] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0050.111] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.111] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.111] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0050.111] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.111] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr.exe.mui") returned 1
	[0050.111] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr.exe.mui") returned 1
	[0050.111] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0050.111] PathFindFileNameA (pszPath="C:\\Boot\\fr-CA\\*.*") returned="*.*"
	[0050.111] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\fr-CA\\" | out: lpString1="C:\\Boot\\fr-CA\\") returned="C:\\Boot\\fr-CA\\"
	[0050.111] PathAddBackslashA (in: pszPath="C:\\Boot\\fr-CA\\" | out: pszPath="C:\\Boot\\fr-CA\\") returned=""
	[0050.111] lstrcatA (in: lpString1="C:\\Boot\\fr-CA\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\fr-CA\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\fr-CA\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.111] GetFileAttributesA (lpFileName="C:\\Boot\\fr-CA\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\fr-ca\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0050.111] CreateFileA (lpFileName="C:\\Boot\\fr-CA\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\fr-ca\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0050.111] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0050.112] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.112] CloseHandle (hObject=0x208) returned 1
	[0050.113] lstrcatA (in: lpString1="C:\\Boot\\fr-CA\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned="C:\\Boot\\fr-CA\\bootmgr.exe.mui"
	[0050.113] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0050.113] lstrlenA (lpString="*.zip") returned 5
	[0050.113] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0050.113] lstrlenA (lpString="*.rar") returned 5
	[0050.113] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0050.113] lstrlenA (lpString="*.7z") returned 4
	[0050.113] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0050.113] lstrlenA (lpString="*.tar") returned 5
	[0050.113] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0050.113] lstrlenA (lpString="*.gzip") returned 6
	[0050.113] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0050.113] lstrlenA (lpString="*.jpg") returned 5
	[0050.113] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.113] lstrlenA (lpString="*.jpeg") returned 6
	[0050.113] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0050.113] lstrlenA (lpString="*.bmp") returned 5
	[0050.113] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0050.113] lstrlenA (lpString="*.gif") returned 5
	[0050.113] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0050.113] lstrlenA (lpString="*.png") returned 5
	[0050.113] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0050.113] lstrlenA (lpString="*.doc") returned 5
	[0050.113] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0050.113] lstrlenA (lpString="*.docx") returned 6
	[0050.113] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0050.114] lstrlenA (lpString="*.xls") returned 5
	[0050.114] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.114] lstrlenA (lpString="*.xlsx") returned 6
	[0050.114] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0050.114] lstrlenA (lpString="*.ppt") returned 5
	[0050.114] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0050.114] lstrlenA (lpString="*.pptx") returned 6
	[0050.114] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0050.114] lstrlenA (lpString="*.txt") returned 5
	[0050.114] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0050.114] lstrlenA (lpString="*.pdf") returned 5
	[0050.114] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0050.114] lstrlenA (lpString="*.htm") returned 5
	[0050.114] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0050.114] lstrlenA (lpString="*.html") returned 6
	[0050.114] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0050.114] lstrlenA (lpString="*.mdb") returned 5
	[0050.114] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0050.114] lstrlenA (lpString="*.pfx") returned 5
	[0050.114] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0050.114] lstrlenA (lpString="*.md") returned 4
	[0050.114] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0050.114] lstrlenA (lpString="*.lnk") returned 5
	[0050.114] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0050.114] lstrlenA (lpString="*.torrent") returned 9
	[0050.114] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0050.114] lstrlenA (lpString="*.mov") returned 5
	[0050.114] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0050.114] lstrlenA (lpString="*.3gp") returned 5
	[0050.114] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.114] lstrlenA (lpString="*.mpeg") returned 6
	[0050.114] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0050.114] lstrlenA (lpString="*.mpg") returned 5
	[0050.114] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0050.114] lstrlenA (lpString="*.flv") returned 5
	[0050.115] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0050.115] lstrlenA (lpString="*.avi") returned 5
	[0050.115] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0050.115] lstrlenA (lpString="*.mp4") returned 5
	[0050.115] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0050.115] lstrlenA (lpString="*.wmv") returned 5
	[0050.115] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0050.115] lstrlenA (lpString="*.mkv") returned 5
	[0050.115] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0050.115] lstrlenA (lpString="*.mp3") returned 5
	[0050.115] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0050.115] lstrlenA (lpString="*.wav") returned 5
	[0050.115] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0050.115] lstrlenA (lpString="*.flac") returned 6
	[0050.115] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0050.115] lstrlenA (lpString="*.wma") returned 5
	[0050.115] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.au3") returned 0
	[0050.115] lstrlenA (lpString="*.au3") returned 5
	[0050.115] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.ahk") returned 0
	[0050.115] lstrlenA (lpString="*.ahk") returned 5
	[0050.115] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.c") returned 0
	[0050.115] lstrlenA (lpString="*.c") returned 3
	[0050.115] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.cc") returned 0
	[0050.115] lstrlenA (lpString="*.cc") returned 4
	[0050.115] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0
	[0050.115] lstrlenA (lpString="*.cpp") returned 5
	[0050.115] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.cxx") returned 0
	[0050.115] lstrlenA (lpString="*.cxx") returned 5
	[0050.115] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.c++") returned 0
	[0050.115] lstrlenA (lpString="*.c++") returned 5
	[0050.116] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.cs") returned 0
	[0050.116] lstrlenA (lpString="*.cs") returned 4
	[0050.116] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.vb") returned 0
	[0050.116] lstrlenA (lpString="*.vb") returned 4
	[0050.116] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.bas") returned 0
	[0050.116] lstrlenA (lpString="*.bas") returned 5
	[0050.116] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.csproj") returned 0
	[0050.116] lstrlenA (lpString="*.csproj") returned 8
	[0050.116] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.116] lstrlenA (lpString="*.vbproj") returned 8
	[0050.116] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.116] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.116] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.manifest") returned 0
	[0050.116] lstrlenA (lpString="*.manifest") returned 10
	[0050.116] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.php") returned 0
	[0050.116] lstrlenA (lpString="*.php") returned 5
	[0050.116] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.vbe") returned 0
	[0050.116] lstrlenA (lpString="*.vbe") returned 5
	[0050.116] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.vba") returned 0
	[0050.116] lstrlenA (lpString="*.vba") returned 5
	[0050.116] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.vbs") returned 0
	[0050.116] lstrlenA (lpString="*.vbs") returned 5
	[0050.116] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.bat") returned 0
	[0050.116] lstrlenA (lpString="*.bat") returned 5
	[0050.116] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.cmd") returned 0
	[0050.116] lstrlenA (lpString="*.cmd") returned 5
	[0050.116] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.js") returned 0
	[0050.116] lstrlenA (lpString="*.js") returned 4
	[0050.116] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.jscript") returned 0
	[0050.116] lstrlenA (lpString="*.jscript") returned 9
	[0050.116] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.hta") returned 0
	[0050.116] lstrlenA (lpString="*.hta") returned 5
	[0050.116] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.php7") returned 0
	[0050.116] lstrlenA (lpString="*.php7") returned 6
	[0050.116] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.db") returned 0
	[0050.116] lstrlenA (lpString="*.db") returned 4
	[0050.116] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.swf") returned 0
	[0050.117] lstrlenA (lpString="*.swf") returned 5
	[0050.117] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.eml") returned 0
	[0050.117] lstrlenA (lpString="*.eml") returned 5
	[0050.117] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.part") returned 0
	[0050.117] lstrlenA (lpString="*.part") returned 6
	[0050.117] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.nfo") returned 0
	[0050.117] lstrlenA (lpString="*.nfo") returned 5
	[0050.117] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.rsa") returned 0
	[0050.117] lstrlenA (lpString="*.rsa") returned 5
	[0050.117] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.key") returned 0
	[0050.117] lstrlenA (lpString="*.key") returned 5
	[0050.117] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.aes") returned 0
	[0050.117] lstrlenA (lpString="*.aes") returned 5
	[0050.117] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.blob") returned 0
	[0050.117] lstrlenA (lpString="*.blob") returned 6
	[0050.117] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.btc") returned 0
	[0050.117] lstrlenA (lpString="*.btc") returned 5
	[0050.117] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.wallet") returned 0
	[0050.117] lstrlenA (lpString="*.wallet") returned 8
	[0050.117] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0050.117] FindClose (in: hFindFile=0x7cb590 | out: hFindFile=0x7cb590) returned 1
	[0050.117] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0050.117] lstrcmpA (lpString1=".", lpString2="fr-FR") returned -1
	[0050.117] lstrcmpA (lpString1="..", lpString2="fr-FR") returned -1
	[0050.117] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0050.117] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="fr-FR" | out: lpString1="C:\\Boot\\fr-FR") returned="C:\\Boot\\fr-FR"
	[0050.117] lstrlenA (lpString="C:\\Boot\\fr-FR") returned 13
	[0050.117] FindFirstFileA (in: lpFileName="C:\\Boot\\fr-FR\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbad0
	[0050.118] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.118] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0050.118] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.118] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.118] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0050.118] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.118] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr.exe.mui") returned 1
	[0050.118] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr.exe.mui") returned 1
	[0050.118] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0050.118] PathFindFileNameA (pszPath="C:\\Boot\\fr-FR\\*.*") returned="*.*"
	[0050.118] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\fr-FR\\" | out: lpString1="C:\\Boot\\fr-FR\\") returned="C:\\Boot\\fr-FR\\"
	[0050.118] PathAddBackslashA (in: pszPath="C:\\Boot\\fr-FR\\" | out: pszPath="C:\\Boot\\fr-FR\\") returned=""
	[0050.118] lstrcatA (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\fr-FR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\fr-FR\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.118] GetFileAttributesA (lpFileName="C:\\Boot\\fr-FR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\fr-fr\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0050.118] CreateFileA (lpFileName="C:\\Boot\\fr-FR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\fr-fr\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0050.120] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0050.120] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0050.121] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.121] CloseHandle (hObject=0x208) returned 1
	[0050.122] lstrcatA (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned="C:\\Boot\\fr-FR\\bootmgr.exe.mui"
	[0050.122] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0050.122] lstrlenA (lpString="*.zip") returned 5
	[0050.122] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0050.122] lstrlenA (lpString="*.rar") returned 5
	[0050.122] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0050.122] lstrlenA (lpString="*.7z") returned 4
	[0050.122] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0050.122] lstrlenA (lpString="*.tar") returned 5
	[0050.122] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0050.122] lstrlenA (lpString="*.gzip") returned 6
	[0050.122] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0050.122] lstrlenA (lpString="*.jpg") returned 5
	[0050.122] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.122] lstrlenA (lpString="*.jpeg") returned 6
	[0050.122] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0050.122] lstrlenA (lpString="*.bmp") returned 5
	[0050.122] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0050.122] lstrlenA (lpString="*.gif") returned 5
	[0050.122] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0050.122] lstrlenA (lpString="*.png") returned 5
	[0050.122] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0050.122] lstrlenA (lpString="*.doc") returned 5
	[0050.122] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0050.122] lstrlenA (lpString="*.docx") returned 6
	[0050.122] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0050.122] lstrlenA (lpString="*.xls") returned 5
	[0050.122] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.122] lstrlenA (lpString="*.xlsx") returned 6
	[0050.122] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0050.122] lstrlenA (lpString="*.ppt") returned 5
	[0050.122] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0050.122] lstrlenA (lpString="*.pptx") returned 6
	[0050.122] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0050.123] lstrlenA (lpString="*.txt") returned 5
	[0050.123] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0050.123] lstrlenA (lpString="*.pdf") returned 5
	[0050.123] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0050.123] lstrlenA (lpString="*.htm") returned 5
	[0050.123] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0050.123] lstrlenA (lpString="*.html") returned 6
	[0050.123] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0050.123] lstrlenA (lpString="*.mdb") returned 5
	[0050.123] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0050.123] lstrlenA (lpString="*.pfx") returned 5
	[0050.123] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0050.123] lstrlenA (lpString="*.md") returned 4
	[0050.123] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0050.123] lstrlenA (lpString="*.lnk") returned 5
	[0050.123] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0050.123] lstrlenA (lpString="*.torrent") returned 9
	[0050.123] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0050.123] lstrlenA (lpString="*.mov") returned 5
	[0050.123] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0050.123] lstrlenA (lpString="*.3gp") returned 5
	[0050.123] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.123] lstrlenA (lpString="*.mpeg") returned 6
	[0050.123] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0050.123] lstrlenA (lpString="*.mpg") returned 5
	[0050.123] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0050.123] lstrlenA (lpString="*.flv") returned 5
	[0050.123] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0050.123] lstrlenA (lpString="*.avi") returned 5
	[0050.123] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0050.123] lstrlenA (lpString="*.mp4") returned 5
	[0050.123] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0050.123] lstrlenA (lpString="*.wmv") returned 5
	[0050.123] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0050.123] lstrlenA (lpString="*.mkv") returned 5
	[0050.123] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0050.123] lstrlenA (lpString="*.mp3") returned 5
	[0050.123] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0050.124] lstrlenA (lpString="*.wav") returned 5
	[0050.124] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0050.124] lstrlenA (lpString="*.flac") returned 6
	[0050.124] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0050.124] lstrlenA (lpString="*.wma") returned 5
	[0050.124] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.au3") returned 0
	[0050.124] lstrlenA (lpString="*.au3") returned 5
	[0050.124] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.ahk") returned 0
	[0050.124] lstrlenA (lpString="*.ahk") returned 5
	[0050.124] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.c") returned 0
	[0050.124] lstrlenA (lpString="*.c") returned 3
	[0050.124] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.cc") returned 0
	[0050.124] lstrlenA (lpString="*.cc") returned 4
	[0050.124] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0
	[0050.124] lstrlenA (lpString="*.cpp") returned 5
	[0050.124] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.cxx") returned 0
	[0050.124] lstrlenA (lpString="*.cxx") returned 5
	[0050.124] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.c++") returned 0
	[0050.124] lstrlenA (lpString="*.c++") returned 5
	[0050.124] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.cs") returned 0
	[0050.124] lstrlenA (lpString="*.cs") returned 4
	[0050.124] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.vb") returned 0
	[0050.124] lstrlenA (lpString="*.vb") returned 4
	[0050.124] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.bas") returned 0
	[0050.124] lstrlenA (lpString="*.bas") returned 5
	[0050.124] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.csproj") returned 0
	[0050.124] lstrlenA (lpString="*.csproj") returned 8
	[0050.124] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.124] lstrlenA (lpString="*.vbproj") returned 8
	[0050.124] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.124] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.124] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.manifest") returned 0
	[0050.124] lstrlenA (lpString="*.manifest") returned 10
	[0050.124] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.php") returned 0
	[0050.124] lstrlenA (lpString="*.php") returned 5
	[0050.124] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.vbe") returned 0
	[0050.125] lstrlenA (lpString="*.vbe") returned 5
	[0050.125] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.vba") returned 0
	[0050.125] lstrlenA (lpString="*.vba") returned 5
	[0050.125] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.vbs") returned 0
	[0050.125] lstrlenA (lpString="*.vbs") returned 5
	[0050.125] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.bat") returned 0
	[0050.125] lstrlenA (lpString="*.bat") returned 5
	[0050.125] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.cmd") returned 0
	[0050.125] lstrlenA (lpString="*.cmd") returned 5
	[0050.125] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.js") returned 0
	[0050.125] lstrlenA (lpString="*.js") returned 4
	[0050.125] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.jscript") returned 0
	[0050.125] lstrlenA (lpString="*.jscript") returned 9
	[0050.125] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.hta") returned 0
	[0050.125] lstrlenA (lpString="*.hta") returned 5
	[0050.125] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.php7") returned 0
	[0050.125] lstrlenA (lpString="*.php7") returned 6
	[0050.125] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.db") returned 0
	[0050.125] lstrlenA (lpString="*.db") returned 4
	[0050.125] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.swf") returned 0
	[0050.125] lstrlenA (lpString="*.swf") returned 5
	[0050.125] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.eml") returned 0
	[0050.125] lstrlenA (lpString="*.eml") returned 5
	[0050.125] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.part") returned 0
	[0050.125] lstrlenA (lpString="*.part") returned 6
	[0050.125] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.nfo") returned 0
	[0050.125] lstrlenA (lpString="*.nfo") returned 5
	[0050.125] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.rsa") returned 0
	[0050.125] lstrlenA (lpString="*.rsa") returned 5
	[0050.125] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.key") returned 0
	[0050.125] lstrlenA (lpString="*.key") returned 5
	[0050.125] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.aes") returned 0
	[0050.125] lstrlenA (lpString="*.aes") returned 5
	[0050.125] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.blob") returned 0
	[0050.125] lstrlenA (lpString="*.blob") returned 6
	[0050.125] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.btc") returned 0
	[0050.125] lstrlenA (lpString="*.btc") returned 5
	[0050.125] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.wallet") returned 0
	[0050.126] lstrlenA (lpString="*.wallet") returned 8
	[0050.126] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0050.126] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.126] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="memtest.exe.mui") returned -1
	[0050.126] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="memtest.exe.mui") returned -1
	[0050.126] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1
	[0050.126] PathFindFileNameA (pszPath="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned="bootmgr.exe.mui"
	[0050.126] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\fr-FR\\" | out: lpString1="C:\\Boot\\fr-FR\\") returned="C:\\Boot\\fr-FR\\"
	[0050.126] PathAddBackslashA (in: pszPath="C:\\Boot\\fr-FR\\" | out: pszPath="C:\\Boot\\fr-FR\\") returned=""
	[0050.126] lstrcatA (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\fr-FR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\fr-FR\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.126] GetFileAttributesA (lpFileName="C:\\Boot\\fr-FR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\fr-fr\\how-to-decrypt-files.htm")) returned 0x20
	[0050.126] lstrcatA (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\fr-FR\\memtest.exe.mui") returned="C:\\Boot\\fr-FR\\memtest.exe.mui"
	[0050.126] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.zip") returned 0
	[0050.126] lstrlenA (lpString="*.zip") returned 5
	[0050.126] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.rar") returned 0
	[0050.126] lstrlenA (lpString="*.rar") returned 5
	[0050.126] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.7z") returned 0
	[0050.126] lstrlenA (lpString="*.7z") returned 4
	[0050.126] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.tar") returned 0
	[0050.126] lstrlenA (lpString="*.tar") returned 5
	[0050.126] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.gzip") returned 0
	[0050.126] lstrlenA (lpString="*.gzip") returned 6
	[0050.126] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.jpg") returned 0
	[0050.126] lstrlenA (lpString="*.jpg") returned 5
	[0050.126] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.126] lstrlenA (lpString="*.jpeg") returned 6
	[0050.126] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.bmp") returned 0
	[0050.126] lstrlenA (lpString="*.bmp") returned 5
	[0050.126] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.gif") returned 0
	[0050.126] lstrlenA (lpString="*.gif") returned 5
	[0050.126] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.png") returned 0
	[0050.126] lstrlenA (lpString="*.png") returned 5
	[0050.126] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.doc") returned 0
	[0050.126] lstrlenA (lpString="*.doc") returned 5
	[0050.127] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.docx") returned 0
	[0050.127] lstrlenA (lpString="*.docx") returned 6
	[0050.127] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.xls") returned 0
	[0050.127] lstrlenA (lpString="*.xls") returned 5
	[0050.127] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.127] lstrlenA (lpString="*.xlsx") returned 6
	[0050.127] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.ppt") returned 0
	[0050.127] lstrlenA (lpString="*.ppt") returned 5
	[0050.127] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.pptx") returned 0
	[0050.127] lstrlenA (lpString="*.pptx") returned 6
	[0050.127] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.txt") returned 0
	[0050.127] lstrlenA (lpString="*.txt") returned 5
	[0050.127] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.pdf") returned 0
	[0050.127] lstrlenA (lpString="*.pdf") returned 5
	[0050.127] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.htm") returned 0
	[0050.127] lstrlenA (lpString="*.htm") returned 5
	[0050.127] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.html") returned 0
	[0050.127] lstrlenA (lpString="*.html") returned 6
	[0050.127] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.mdb") returned 0
	[0050.127] lstrlenA (lpString="*.mdb") returned 5
	[0050.127] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.pfx") returned 0
	[0050.127] lstrlenA (lpString="*.pfx") returned 5
	[0050.127] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.md") returned 0
	[0050.127] lstrlenA (lpString="*.md") returned 4
	[0050.127] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.lnk") returned 0
	[0050.127] lstrlenA (lpString="*.lnk") returned 5
	[0050.127] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.torrent") returned 0
	[0050.127] lstrlenA (lpString="*.torrent") returned 9
	[0050.127] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.mov") returned 0
	[0050.127] lstrlenA (lpString="*.mov") returned 5
	[0050.127] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.3gp") returned 0
	[0050.127] lstrlenA (lpString="*.3gp") returned 5
	[0050.127] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.127] lstrlenA (lpString="*.mpeg") returned 6
	[0050.127] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.mpg") returned 0
	[0050.127] lstrlenA (lpString="*.mpg") returned 5
	[0050.127] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.flv") returned 0
	[0050.128] lstrlenA (lpString="*.flv") returned 5
	[0050.128] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.avi") returned 0
	[0050.128] lstrlenA (lpString="*.avi") returned 5
	[0050.128] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.mp4") returned 0
	[0050.128] lstrlenA (lpString="*.mp4") returned 5
	[0050.128] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.wmv") returned 0
	[0050.128] lstrlenA (lpString="*.wmv") returned 5
	[0050.128] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.mkv") returned 0
	[0050.128] lstrlenA (lpString="*.mkv") returned 5
	[0050.128] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.mp3") returned 0
	[0050.128] lstrlenA (lpString="*.mp3") returned 5
	[0050.128] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.wav") returned 0
	[0050.128] lstrlenA (lpString="*.wav") returned 5
	[0050.128] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.flac") returned 0
	[0050.128] lstrlenA (lpString="*.flac") returned 6
	[0050.128] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.wma") returned 0
	[0050.128] lstrlenA (lpString="*.wma") returned 5
	[0050.128] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.au3") returned 0
	[0050.128] lstrlenA (lpString="*.au3") returned 5
	[0050.128] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.ahk") returned 0
	[0050.128] lstrlenA (lpString="*.ahk") returned 5
	[0050.128] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.c") returned 0
	[0050.128] lstrlenA (lpString="*.c") returned 3
	[0050.128] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.cc") returned 0
	[0050.128] lstrlenA (lpString="*.cc") returned 4
	[0050.128] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.cpp") returned 0
	[0050.128] lstrlenA (lpString="*.cpp") returned 5
	[0050.128] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.cxx") returned 0
	[0050.128] lstrlenA (lpString="*.cxx") returned 5
	[0050.128] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.c++") returned 0
	[0050.128] lstrlenA (lpString="*.c++") returned 5
	[0050.128] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.cs") returned 0
	[0050.128] lstrlenA (lpString="*.cs") returned 4
	[0050.128] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.vb") returned 0
	[0050.128] lstrlenA (lpString="*.vb") returned 4
	[0050.128] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.bas") returned 0
	[0050.128] lstrlenA (lpString="*.bas") returned 5
	[0050.128] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.csproj") returned 0
	[0050.129] lstrlenA (lpString="*.csproj") returned 8
	[0050.129] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.129] lstrlenA (lpString="*.vbproj") returned 8
	[0050.129] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.129] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.129] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.manifest") returned 0
	[0050.129] lstrlenA (lpString="*.manifest") returned 10
	[0050.129] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.php") returned 0
	[0050.129] lstrlenA (lpString="*.php") returned 5
	[0050.129] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.vbe") returned 0
	[0050.129] lstrlenA (lpString="*.vbe") returned 5
	[0050.129] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.vba") returned 0
	[0050.129] lstrlenA (lpString="*.vba") returned 5
	[0050.129] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.vbs") returned 0
	[0050.129] lstrlenA (lpString="*.vbs") returned 5
	[0050.129] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.bat") returned 0
	[0050.129] lstrlenA (lpString="*.bat") returned 5
	[0050.129] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.cmd") returned 0
	[0050.129] lstrlenA (lpString="*.cmd") returned 5
	[0050.129] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.js") returned 0
	[0050.129] lstrlenA (lpString="*.js") returned 4
	[0050.129] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.jscript") returned 0
	[0050.129] lstrlenA (lpString="*.jscript") returned 9
	[0050.129] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.hta") returned 0
	[0050.129] lstrlenA (lpString="*.hta") returned 5
	[0050.129] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.php7") returned 0
	[0050.129] lstrlenA (lpString="*.php7") returned 6
	[0050.129] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.db") returned 0
	[0050.129] lstrlenA (lpString="*.db") returned 4
	[0050.129] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.swf") returned 0
	[0050.129] lstrlenA (lpString="*.swf") returned 5
	[0050.129] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.eml") returned 0
	[0050.129] lstrlenA (lpString="*.eml") returned 5
	[0050.129] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.part") returned 0
	[0050.129] lstrlenA (lpString="*.part") returned 6
	[0050.129] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.nfo") returned 0
	[0050.129] lstrlenA (lpString="*.nfo") returned 5
	[0050.130] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.rsa") returned 0
	[0050.130] lstrlenA (lpString="*.rsa") returned 5
	[0050.130] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.key") returned 0
	[0050.130] lstrlenA (lpString="*.key") returned 5
	[0050.130] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.aes") returned 0
	[0050.130] lstrlenA (lpString="*.aes") returned 5
	[0050.130] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.blob") returned 0
	[0050.130] lstrlenA (lpString="*.blob") returned 6
	[0050.130] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.btc") returned 0
	[0050.130] lstrlenA (lpString="*.btc") returned 5
	[0050.130] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.wallet") returned 0
	[0050.130] lstrlenA (lpString="*.wallet") returned 8
	[0050.130] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0050.130] FindClose (in: hFindFile=0x7cbad0 | out: hFindFile=0x7cbad0) returned 1
	[0050.130] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1
	[0050.130] lstrcmpA (lpString1=".", lpString2="hr-HR") returned -1
	[0050.130] lstrcmpA (lpString1="..", lpString2="hr-HR") returned -1
	[0050.130] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0050.130] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="hr-HR" | out: lpString1="C:\\Boot\\hr-HR") returned="C:\\Boot\\hr-HR"
	[0050.130] lstrlenA (lpString="C:\\Boot\\hr-HR") returned 13
	[0050.130] FindFirstFileA (in: lpFileName="C:\\Boot\\hr-HR\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb850
	[0050.131] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.131] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0050.131] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.131] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.131] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0050.131] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.131] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr.exe.mui") returned 1
	[0050.131] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr.exe.mui") returned 1
	[0050.131] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0050.131] PathFindFileNameA (pszPath="C:\\Boot\\hr-HR\\*.*") returned="*.*"
	[0050.131] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\hr-HR\\" | out: lpString1="C:\\Boot\\hr-HR\\") returned="C:\\Boot\\hr-HR\\"
	[0050.131] PathAddBackslashA (in: pszPath="C:\\Boot\\hr-HR\\" | out: pszPath="C:\\Boot\\hr-HR\\") returned=""
	[0050.131] lstrcatA (in: lpString1="C:\\Boot\\hr-HR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\hr-HR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\hr-HR\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.131] GetFileAttributesA (lpFileName="C:\\Boot\\hr-HR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\hr-hr\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0050.132] CreateFileA (lpFileName="C:\\Boot\\hr-HR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\hr-hr\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0050.132] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0050.132] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0050.133] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.133] CloseHandle (hObject=0x208) returned 1
	[0050.133] lstrcatA (in: lpString1="C:\\Boot\\hr-HR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\hr-HR\\bootmgr.exe.mui") returned="C:\\Boot\\hr-HR\\bootmgr.exe.mui"
	[0050.133] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0050.133] lstrlenA (lpString="*.zip") returned 5
	[0050.133] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0050.133] lstrlenA (lpString="*.rar") returned 5
	[0050.133] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0050.133] lstrlenA (lpString="*.7z") returned 4
	[0050.133] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0050.133] lstrlenA (lpString="*.tar") returned 5
	[0050.133] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0050.133] lstrlenA (lpString="*.gzip") returned 6
	[0050.133] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0050.133] lstrlenA (lpString="*.jpg") returned 5
	[0050.133] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.133] lstrlenA (lpString="*.jpeg") returned 6
	[0050.133] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0050.133] lstrlenA (lpString="*.bmp") returned 5
	[0050.133] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0050.133] lstrlenA (lpString="*.gif") returned 5
	[0050.133] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0050.133] lstrlenA (lpString="*.png") returned 5
	[0050.134] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0050.134] lstrlenA (lpString="*.doc") returned 5
	[0050.134] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0050.134] lstrlenA (lpString="*.docx") returned 6
	[0050.134] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0050.134] lstrlenA (lpString="*.xls") returned 5
	[0050.134] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.134] lstrlenA (lpString="*.xlsx") returned 6
	[0050.134] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0050.134] lstrlenA (lpString="*.ppt") returned 5
	[0050.134] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0050.134] lstrlenA (lpString="*.pptx") returned 6
	[0050.134] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0050.134] lstrlenA (lpString="*.txt") returned 5
	[0050.134] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0050.134] lstrlenA (lpString="*.pdf") returned 5
	[0050.134] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0050.134] lstrlenA (lpString="*.htm") returned 5
	[0050.134] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0050.134] lstrlenA (lpString="*.html") returned 6
	[0050.134] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0050.134] lstrlenA (lpString="*.mdb") returned 5
	[0050.134] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0050.134] lstrlenA (lpString="*.pfx") returned 5
	[0050.134] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0050.134] lstrlenA (lpString="*.md") returned 4
	[0050.134] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0050.134] lstrlenA (lpString="*.lnk") returned 5
	[0050.134] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0050.134] lstrlenA (lpString="*.torrent") returned 9
	[0050.134] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0050.134] lstrlenA (lpString="*.mov") returned 5
	[0050.134] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0050.134] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.134] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0050.135] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0050.135] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0050.135] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0050.135] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0050.135] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0050.135] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0050.135] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0050.135] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0050.135] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0050.135] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.au3") returned 0
	[0050.135] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.ahk") returned 0
	[0050.135] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.c") returned 0
	[0050.135] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.cc") returned 0
	[0050.135] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0
	[0050.135] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.cxx") returned 0
	[0050.135] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.c++") returned 0
	[0050.135] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.cs") returned 0
	[0050.135] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.vb") returned 0
	[0050.135] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.bas") returned 0
	[0050.135] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.csproj") returned 0
	[0050.135] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.135] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.135] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.manifest") returned 0
	[0050.135] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.php") returned 0
	[0050.135] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.vbe") returned 0
	[0050.135] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.vba") returned 0
	[0050.136] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.vbs") returned 0
	[0050.136] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.bat") returned 0
	[0050.136] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.cmd") returned 0
	[0050.136] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.js") returned 0
	[0050.136] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.jscript") returned 0
	[0050.136] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.hta") returned 0
	[0050.136] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.php7") returned 0
	[0050.136] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.db") returned 0
	[0050.136] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.swf") returned 0
	[0050.136] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.eml") returned 0
	[0050.136] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.part") returned 0
	[0050.136] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.nfo") returned 0
	[0050.136] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.rsa") returned 0
	[0050.136] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.key") returned 0
	[0050.136] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.aes") returned 0
	[0050.136] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.blob") returned 0
	[0050.136] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.btc") returned 0
	[0050.136] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.wallet") returned 0
	[0050.136] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0050.136] FindClose (in: hFindFile=0x7cb850 | out: hFindFile=0x7cb850) returned 1
	[0050.136] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0050.136] lstrcmpA (lpString1=".", lpString2="hu-HU") returned -1
	[0050.136] lstrcmpA (lpString1="..", lpString2="hu-HU") returned -1
	[0050.136] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0050.136] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="hu-HU" | out: lpString1="C:\\Boot\\hu-HU") returned="C:\\Boot\\hu-HU"
	[0050.137] FindFirstFileA (in: lpFileName="C:\\Boot\\hu-HU\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb590
	[0050.137] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.137] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0050.137] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.137] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.137] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13360, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0050.137] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.137] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr.exe.mui") returned 1
	[0050.137] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr.exe.mui") returned 1
	[0050.137] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0050.137] PathFindFileNameA (pszPath="C:\\Boot\\hu-HU\\*.*") returned="*.*"
	[0050.137] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\hu-HU\\" | out: lpString1="C:\\Boot\\hu-HU\\") returned="C:\\Boot\\hu-HU\\"
	[0050.137] PathAddBackslashA (in: pszPath="C:\\Boot\\hu-HU\\" | out: pszPath="C:\\Boot\\hu-HU\\") returned=""
	[0050.137] lstrcatA (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\hu-HU\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\hu-HU\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.137] GetFileAttributesA (lpFileName="C:\\Boot\\hu-HU\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\hu-hu\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0050.137] CreateFileA (lpFileName="C:\\Boot\\hu-HU\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\hu-hu\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0050.139] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0050.140] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.140] CloseHandle (hObject=0x208) returned 1
	[0050.140] lstrcatA (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned="C:\\Boot\\hu-HU\\bootmgr.exe.mui"
	[0050.140] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0050.140] lstrlenA (lpString="*.zip") returned 5
	[0050.140] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0050.140] lstrlenA (lpString="*.rar") returned 5
	[0050.140] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0050.140] lstrlenA (lpString="*.7z") returned 4
	[0050.140] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0050.140] lstrlenA (lpString="*.tar") returned 5
	[0050.140] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0050.140] lstrlenA (lpString="*.gzip") returned 6
	[0050.140] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0050.140] lstrlenA (lpString="*.jpg") returned 5
	[0050.140] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.141] lstrlenA (lpString="*.jpeg") returned 6
	[0050.141] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0050.141] lstrlenA (lpString="*.bmp") returned 5
	[0050.141] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0050.141] lstrlenA (lpString="*.gif") returned 5
	[0050.141] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0050.141] lstrlenA (lpString="*.png") returned 5
	[0050.141] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0050.141] lstrlenA (lpString="*.doc") returned 5
	[0050.141] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0050.141] lstrlenA (lpString="*.docx") returned 6
	[0050.141] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0050.141] lstrlenA (lpString="*.xls") returned 5
	[0050.141] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.141] lstrlenA (lpString="*.xlsx") returned 6
	[0050.141] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0050.141] lstrlenA (lpString="*.ppt") returned 5
	[0050.141] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0050.141] lstrlenA (lpString="*.pptx") returned 6
	[0050.141] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0050.141] lstrlenA (lpString="*.txt") returned 5
	[0050.141] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0050.141] lstrlenA (lpString="*.pdf") returned 5
	[0050.141] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0050.141] lstrlenA (lpString="*.htm") returned 5
	[0050.141] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0050.141] lstrlenA (lpString="*.html") returned 6
	[0050.141] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0050.141] lstrlenA (lpString="*.mdb") returned 5
	[0050.141] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0050.141] lstrlenA (lpString="*.pfx") returned 5
	[0050.141] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0050.141] lstrlenA (lpString="*.md") returned 4
	[0050.141] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0050.141] lstrlenA (lpString="*.lnk") returned 5
	[0050.141] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0050.141] lstrlenA (lpString="*.torrent") returned 9
	[0050.141] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0050.142] lstrlenA (lpString="*.mov") returned 5
	[0050.142] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0050.142] lstrlenA (lpString="*.3gp") returned 5
	[0050.142] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.142] lstrlenA (lpString="*.mpeg") returned 6
	[0050.142] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0050.142] lstrlenA (lpString="*.mpg") returned 5
	[0050.142] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0050.142] lstrlenA (lpString="*.flv") returned 5
	[0050.142] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0050.142] lstrlenA (lpString="*.avi") returned 5
	[0050.142] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0050.142] lstrlenA (lpString="*.mp4") returned 5
	[0050.142] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0050.142] lstrlenA (lpString="*.wmv") returned 5
	[0050.142] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0050.142] lstrlenA (lpString="*.mkv") returned 5
	[0050.142] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0050.142] lstrlenA (lpString="*.mp3") returned 5
	[0050.142] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0050.142] lstrlenA (lpString="*.wav") returned 5
	[0050.142] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0050.142] lstrlenA (lpString="*.flac") returned 6
	[0050.142] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0050.142] lstrlenA (lpString="*.wma") returned 5
	[0050.142] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.au3") returned 0
	[0050.142] lstrlenA (lpString="*.au3") returned 5
	[0050.142] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.ahk") returned 0
	[0050.142] lstrlenA (lpString="*.ahk") returned 5
	[0050.142] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.c") returned 0
	[0050.142] lstrlenA (lpString="*.c") returned 3
	[0050.142] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.cc") returned 0
	[0050.142] lstrlenA (lpString="*.cc") returned 4
	[0050.142] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0
	[0050.142] lstrlenA (lpString="*.cpp") returned 5
	[0050.142] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.cxx") returned 0
	[0050.142] lstrlenA (lpString="*.cxx") returned 5
	[0050.143] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.c++") returned 0
	[0050.143] lstrlenA (lpString="*.c++") returned 5
	[0050.143] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.cs") returned 0
	[0050.143] lstrlenA (lpString="*.cs") returned 4
	[0050.143] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.vb") returned 0
	[0050.143] lstrlenA (lpString="*.vb") returned 4
	[0050.143] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.bas") returned 0
	[0050.143] lstrlenA (lpString="*.bas") returned 5
	[0050.143] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.csproj") returned 0
	[0050.143] lstrlenA (lpString="*.csproj") returned 8
	[0050.143] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.143] lstrlenA (lpString="*.vbproj") returned 8
	[0050.143] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.143] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.143] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.manifest") returned 0
	[0050.143] lstrlenA (lpString="*.manifest") returned 10
	[0050.143] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.php") returned 0
	[0050.143] lstrlenA (lpString="*.php") returned 5
	[0050.143] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.vbe") returned 0
	[0050.143] lstrlenA (lpString="*.vbe") returned 5
	[0050.143] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.vba") returned 0
	[0050.143] lstrlenA (lpString="*.vba") returned 5
	[0050.143] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.vbs") returned 0
	[0050.143] lstrlenA (lpString="*.vbs") returned 5
	[0050.143] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.bat") returned 0
	[0050.143] lstrlenA (lpString="*.bat") returned 5
	[0050.143] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.cmd") returned 0
	[0050.143] lstrlenA (lpString="*.cmd") returned 5
	[0050.143] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.js") returned 0
	[0050.143] lstrlenA (lpString="*.js") returned 4
	[0050.143] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.jscript") returned 0
	[0050.143] lstrlenA (lpString="*.jscript") returned 9
	[0050.143] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.hta") returned 0
	[0050.143] lstrlenA (lpString="*.hta") returned 5
	[0050.143] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.php7") returned 0
	[0050.143] lstrlenA (lpString="*.php7") returned 6
	[0050.143] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.db") returned 0
	[0050.143] lstrlenA (lpString="*.db") returned 4
	[0050.144] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.swf") returned 0
	[0050.144] lstrlenA (lpString="*.swf") returned 5
	[0050.144] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.eml") returned 0
	[0050.144] lstrlenA (lpString="*.eml") returned 5
	[0050.144] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.part") returned 0
	[0050.144] lstrlenA (lpString="*.part") returned 6
	[0050.144] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.nfo") returned 0
	[0050.144] lstrlenA (lpString="*.nfo") returned 5
	[0050.144] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.rsa") returned 0
	[0050.144] lstrlenA (lpString="*.rsa") returned 5
	[0050.144] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.key") returned 0
	[0050.144] lstrlenA (lpString="*.key") returned 5
	[0050.144] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.aes") returned 0
	[0050.144] lstrlenA (lpString="*.aes") returned 5
	[0050.144] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.blob") returned 0
	[0050.144] lstrlenA (lpString="*.blob") returned 6
	[0050.144] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.btc") returned 0
	[0050.144] lstrlenA (lpString="*.btc") returned 5
	[0050.144] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.wallet") returned 0
	[0050.144] lstrlenA (lpString="*.wallet") returned 8
	[0050.144] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0050.144] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.144] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="memtest.exe.mui") returned -1
	[0050.144] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="memtest.exe.mui") returned -1
	[0050.144] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1
	[0050.144] PathFindFileNameA (pszPath="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned="bootmgr.exe.mui"
	[0050.144] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\hu-HU\\" | out: lpString1="C:\\Boot\\hu-HU\\") returned="C:\\Boot\\hu-HU\\"
	[0050.144] PathAddBackslashA (in: pszPath="C:\\Boot\\hu-HU\\" | out: pszPath="C:\\Boot\\hu-HU\\") returned=""
	[0050.144] lstrcatA (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\hu-HU\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\hu-HU\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.144] GetFileAttributesA (lpFileName="C:\\Boot\\hu-HU\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\hu-hu\\how-to-decrypt-files.htm")) returned 0x20
	[0050.144] lstrcatA (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\hu-HU\\memtest.exe.mui") returned="C:\\Boot\\hu-HU\\memtest.exe.mui"
	[0050.144] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.zip") returned 0
	[0050.144] lstrlenA (lpString="*.zip") returned 5
	[0050.144] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.rar") returned 0
	[0050.144] lstrlenA (lpString="*.rar") returned 5
	[0050.145] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.7z") returned 0
	[0050.145] lstrlenA (lpString="*.7z") returned 4
	[0050.145] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.tar") returned 0
	[0050.145] lstrlenA (lpString="*.tar") returned 5
	[0050.145] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.gzip") returned 0
	[0050.145] lstrlenA (lpString="*.gzip") returned 6
	[0050.145] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.jpg") returned 0
	[0050.145] lstrlenA (lpString="*.jpg") returned 5
	[0050.145] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.145] lstrlenA (lpString="*.jpeg") returned 6
	[0050.145] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.bmp") returned 0
	[0050.145] lstrlenA (lpString="*.bmp") returned 5
	[0050.145] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.gif") returned 0
	[0050.145] lstrlenA (lpString="*.gif") returned 5
	[0050.145] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.png") returned 0
	[0050.145] lstrlenA (lpString="*.png") returned 5
	[0050.145] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.doc") returned 0
	[0050.145] lstrlenA (lpString="*.doc") returned 5
	[0050.145] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.docx") returned 0
	[0050.145] lstrlenA (lpString="*.docx") returned 6
	[0050.145] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.xls") returned 0
	[0050.145] lstrlenA (lpString="*.xls") returned 5
	[0050.145] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.145] lstrlenA (lpString="*.xlsx") returned 6
	[0050.145] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.ppt") returned 0
	[0050.145] lstrlenA (lpString="*.ppt") returned 5
	[0050.145] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.pptx") returned 0
	[0050.145] lstrlenA (lpString="*.pptx") returned 6
	[0050.145] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.txt") returned 0
	[0050.145] lstrlenA (lpString="*.txt") returned 5
	[0050.145] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.pdf") returned 0
	[0050.145] lstrlenA (lpString="*.pdf") returned 5
	[0050.145] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.htm") returned 0
	[0050.145] lstrlenA (lpString="*.htm") returned 5
	[0050.145] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.html") returned 0
	[0050.145] lstrlenA (lpString="*.html") returned 6
	[0050.145] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.mdb") returned 0
	[0050.145] lstrlenA (lpString="*.mdb") returned 5
	[0050.145] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.pfx") returned 0
	[0050.146] lstrlenA (lpString="*.pfx") returned 5
	[0050.146] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.md") returned 0
	[0050.146] lstrlenA (lpString="*.md") returned 4
	[0050.146] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.lnk") returned 0
	[0050.146] lstrlenA (lpString="*.lnk") returned 5
	[0050.146] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.torrent") returned 0
	[0050.146] lstrlenA (lpString="*.torrent") returned 9
	[0050.154] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.mov") returned 0
	[0050.154] lstrlenA (lpString="*.mov") returned 5
	[0050.154] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.3gp") returned 0
	[0050.154] lstrlenA (lpString="*.3gp") returned 5
	[0050.154] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.154] lstrlenA (lpString="*.mpeg") returned 6
	[0050.154] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.mpg") returned 0
	[0050.154] lstrlenA (lpString="*.mpg") returned 5
	[0050.154] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.flv") returned 0
	[0050.154] lstrlenA (lpString="*.flv") returned 5
	[0050.154] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.avi") returned 0
	[0050.154] lstrlenA (lpString="*.avi") returned 5
	[0050.154] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.mp4") returned 0
	[0050.154] lstrlenA (lpString="*.mp4") returned 5
	[0050.154] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.wmv") returned 0
	[0050.154] lstrlenA (lpString="*.wmv") returned 5
	[0050.154] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.mkv") returned 0
	[0050.154] lstrlenA (lpString="*.mkv") returned 5
	[0050.154] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.mp3") returned 0
	[0050.154] lstrlenA (lpString="*.mp3") returned 5
	[0050.154] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.wav") returned 0
	[0050.154] lstrlenA (lpString="*.wav") returned 5
	[0050.154] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.flac") returned 0
	[0050.154] lstrlenA (lpString="*.flac") returned 6
	[0050.155] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.wma") returned 0
	[0050.155] lstrlenA (lpString="*.wma") returned 5
	[0050.155] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.au3") returned 0
	[0050.155] lstrlenA (lpString="*.au3") returned 5
	[0050.155] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.ahk") returned 0
	[0050.155] lstrlenA (lpString="*.ahk") returned 5
	[0050.155] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.c") returned 0
	[0050.155] lstrlenA (lpString="*.c") returned 3
	[0050.155] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.cc") returned 0
	[0050.155] lstrlenA (lpString="*.cc") returned 4
	[0050.155] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.cpp") returned 0
	[0050.155] lstrlenA (lpString="*.cpp") returned 5
	[0050.155] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.cxx") returned 0
	[0050.155] lstrlenA (lpString="*.cxx") returned 5
	[0050.155] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.c++") returned 0
	[0050.155] lstrlenA (lpString="*.c++") returned 5
	[0050.155] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.cs") returned 0
	[0050.155] lstrlenA (lpString="*.cs") returned 4
	[0050.155] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.vb") returned 0
	[0050.155] lstrlenA (lpString="*.vb") returned 4
	[0050.155] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.bas") returned 0
	[0050.155] lstrlenA (lpString="*.bas") returned 5
	[0050.155] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.csproj") returned 0
	[0050.155] lstrlenA (lpString="*.csproj") returned 8
	[0050.155] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.155] lstrlenA (lpString="*.vbproj") returned 8
	[0050.155] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.155] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.155] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.manifest") returned 0
	[0050.155] lstrlenA (lpString="*.manifest") returned 10
	[0050.155] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.php") returned 0
	[0050.155] lstrlenA (lpString="*.php") returned 5
	[0050.155] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.vbe") returned 0
	[0050.155] lstrlenA (lpString="*.vbe") returned 5
	[0050.156] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.vba") returned 0
	[0050.156] lstrlenA (lpString="*.vba") returned 5
	[0050.156] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.vbs") returned 0
	[0050.156] lstrlenA (lpString="*.vbs") returned 5
	[0050.156] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.bat") returned 0
	[0050.156] lstrlenA (lpString="*.bat") returned 5
	[0050.156] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.cmd") returned 0
	[0050.156] lstrlenA (lpString="*.cmd") returned 5
	[0050.156] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.js") returned 0
	[0050.156] lstrlenA (lpString="*.js") returned 4
	[0050.156] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.jscript") returned 0
	[0050.156] lstrlenA (lpString="*.jscript") returned 9
	[0050.156] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.hta") returned 0
	[0050.156] lstrlenA (lpString="*.hta") returned 5
	[0050.156] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.php7") returned 0
	[0050.156] lstrlenA (lpString="*.php7") returned 6
	[0050.156] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.db") returned 0
	[0050.156] lstrlenA (lpString="*.db") returned 4
	[0050.156] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.swf") returned 0
	[0050.156] lstrlenA (lpString="*.swf") returned 5
	[0050.156] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.eml") returned 0
	[0050.156] lstrlenA (lpString="*.eml") returned 5
	[0050.156] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.part") returned 0
	[0050.156] lstrlenA (lpString="*.part") returned 6
	[0050.156] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.nfo") returned 0
	[0050.156] lstrlenA (lpString="*.nfo") returned 5
	[0050.156] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.rsa") returned 0
	[0050.156] lstrlenA (lpString="*.rsa") returned 5
	[0050.156] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.key") returned 0
	[0050.156] lstrlenA (lpString="*.key") returned 5
	[0050.157] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.aes") returned 0
	[0050.157] lstrlenA (lpString="*.aes") returned 5
	[0050.157] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.blob") returned 0
	[0050.157] lstrlenA (lpString="*.blob") returned 6
	[0050.157] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.btc") returned 0
	[0050.157] lstrlenA (lpString="*.btc") returned 5
	[0050.157] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.wallet") returned 0
	[0050.157] lstrlenA (lpString="*.wallet") returned 8
	[0050.157] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0050.157] FindClose (in: hFindFile=0x7cb590 | out: hFindFile=0x7cb590) returned 1
	[0050.157] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1
	[0050.157] lstrcmpA (lpString1=".", lpString2="it-IT") returned -1
	[0050.157] lstrcmpA (lpString1="..", lpString2="it-IT") returned -1
	[0050.157] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0050.157] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="it-IT" | out: lpString1="C:\\Boot\\it-IT") returned="C:\\Boot\\it-IT"
	[0050.157] lstrlenA (lpString="C:\\Boot\\it-IT") returned 13
	[0050.157] FindFirstFileA (in: lpFileName="C:\\Boot\\it-IT\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb910
	[0050.158] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.158] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0050.158] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.158] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.158] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0050.158] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.158] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr.exe.mui") returned 1
	[0050.158] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr.exe.mui") returned 1
	[0050.158] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0050.158] PathFindFileNameA (pszPath="C:\\Boot\\it-IT\\*.*") returned="*.*"
	[0050.158] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\it-IT\\" | out: lpString1="C:\\Boot\\it-IT\\") returned="C:\\Boot\\it-IT\\"
	[0050.158] PathAddBackslashA (in: pszPath="C:\\Boot\\it-IT\\" | out: pszPath="C:\\Boot\\it-IT\\") returned=""
	[0050.158] lstrcatA (in: lpString1="C:\\Boot\\it-IT\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\it-IT\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\it-IT\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.158] GetFileAttributesA (lpFileName="C:\\Boot\\it-IT\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\it-it\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0050.158] CreateFileA (lpFileName="C:\\Boot\\it-IT\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\it-it\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0050.160] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0050.160] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0050.161] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.161] CloseHandle (hObject=0x208) returned 1
	[0050.161] lstrcatA (in: lpString1="C:\\Boot\\it-IT\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned="C:\\Boot\\it-IT\\bootmgr.exe.mui"
	[0050.161] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0050.161] lstrlenA (lpString="*.zip") returned 5
	[0050.161] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0050.161] lstrlenA (lpString="*.rar") returned 5
	[0050.161] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0050.161] lstrlenA (lpString="*.7z") returned 4
	[0050.161] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0050.161] lstrlenA (lpString="*.tar") returned 5
	[0050.161] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0050.161] lstrlenA (lpString="*.gzip") returned 6
	[0050.161] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0050.161] lstrlenA (lpString="*.jpg") returned 5
	[0050.161] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.161] lstrlenA (lpString="*.jpeg") returned 6
	[0050.161] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0050.161] lstrlenA (lpString="*.bmp") returned 5
	[0050.161] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0050.162] lstrlenA (lpString="*.gif") returned 5
	[0050.162] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0050.162] lstrlenA (lpString="*.png") returned 5
	[0050.162] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0050.162] lstrlenA (lpString="*.doc") returned 5
	[0050.162] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0050.162] lstrlenA (lpString="*.docx") returned 6
	[0050.162] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0050.162] lstrlenA (lpString="*.xls") returned 5
	[0050.162] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.162] lstrlenA (lpString="*.xlsx") returned 6
	[0050.162] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0050.162] lstrlenA (lpString="*.ppt") returned 5
	[0050.162] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0050.162] lstrlenA (lpString="*.pptx") returned 6
	[0050.162] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0050.162] lstrlenA (lpString="*.txt") returned 5
	[0050.162] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0050.162] lstrlenA (lpString="*.pdf") returned 5
	[0050.162] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0050.162] lstrlenA (lpString="*.htm") returned 5
	[0050.162] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0050.162] lstrlenA (lpString="*.html") returned 6
	[0050.162] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0050.162] lstrlenA (lpString="*.mdb") returned 5
	[0050.162] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0050.162] lstrlenA (lpString="*.pfx") returned 5
	[0050.162] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0050.162] lstrlenA (lpString="*.md") returned 4
	[0050.162] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0050.162] lstrlenA (lpString="*.lnk") returned 5
	[0050.162] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0050.163] lstrlenA (lpString="*.torrent") returned 9
	[0050.163] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0050.163] lstrlenA (lpString="*.mov") returned 5
	[0050.163] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0050.163] lstrlenA (lpString="*.3gp") returned 5
	[0050.163] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.163] lstrlenA (lpString="*.mpeg") returned 6
	[0050.163] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0050.163] lstrlenA (lpString="*.mpg") returned 5
	[0050.163] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0050.163] lstrlenA (lpString="*.flv") returned 5
	[0050.163] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0050.163] lstrlenA (lpString="*.avi") returned 5
	[0050.163] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0050.163] lstrlenA (lpString="*.mp4") returned 5
	[0050.163] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0050.163] lstrlenA (lpString="*.wmv") returned 5
	[0050.163] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0050.163] lstrlenA (lpString="*.mkv") returned 5
	[0050.163] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0050.163] lstrlenA (lpString="*.mp3") returned 5
	[0050.163] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0050.163] lstrlenA (lpString="*.wav") returned 5
	[0050.163] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0050.163] lstrlenA (lpString="*.flac") returned 6
	[0050.163] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0050.163] lstrlenA (lpString="*.wma") returned 5
	[0050.163] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.au3") returned 0
	[0050.163] lstrlenA (lpString="*.au3") returned 5
	[0050.163] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.ahk") returned 0
	[0050.163] lstrlenA (lpString="*.ahk") returned 5
	[0050.163] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.c") returned 0
	[0050.163] lstrlenA (lpString="*.c") returned 3
	[0050.163] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.cc") returned 0
	[0050.163] lstrlenA (lpString="*.cc") returned 4
	[0050.163] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0
	[0050.163] lstrlenA (lpString="*.cpp") returned 5
	[0050.163] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.cxx") returned 0
	[0050.164] lstrlenA (lpString="*.cxx") returned 5
	[0050.164] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.c++") returned 0
	[0050.164] lstrlenA (lpString="*.c++") returned 5
	[0050.164] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.cs") returned 0
	[0050.164] lstrlenA (lpString="*.cs") returned 4
	[0050.164] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.vb") returned 0
	[0050.164] lstrlenA (lpString="*.vb") returned 4
	[0050.164] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.bas") returned 0
	[0050.164] lstrlenA (lpString="*.bas") returned 5
	[0050.164] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.csproj") returned 0
	[0050.164] lstrlenA (lpString="*.csproj") returned 8
	[0050.164] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.164] lstrlenA (lpString="*.vbproj") returned 8
	[0050.164] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.164] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.164] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.manifest") returned 0
	[0050.164] lstrlenA (lpString="*.manifest") returned 10
	[0050.164] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.php") returned 0
	[0050.164] lstrlenA (lpString="*.php") returned 5
	[0050.164] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.vbe") returned 0
	[0050.164] lstrlenA (lpString="*.vbe") returned 5
	[0050.164] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.vba") returned 0
	[0050.164] lstrlenA (lpString="*.vba") returned 5
	[0050.164] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.vbs") returned 0
	[0050.164] lstrlenA (lpString="*.vbs") returned 5
	[0050.164] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.bat") returned 0
	[0050.164] lstrlenA (lpString="*.bat") returned 5
	[0050.164] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.cmd") returned 0
	[0050.164] lstrlenA (lpString="*.cmd") returned 5
	[0050.164] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.js") returned 0
	[0050.164] lstrlenA (lpString="*.js") returned 4
	[0050.164] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.jscript") returned 0
	[0050.164] lstrlenA (lpString="*.jscript") returned 9
	[0050.164] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.hta") returned 0
	[0050.164] lstrlenA (lpString="*.hta") returned 5
	[0050.164] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.php7") returned 0
	[0050.164] lstrlenA (lpString="*.php7") returned 6
	[0050.165] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.db") returned 0
	[0050.165] lstrlenA (lpString="*.db") returned 4
	[0050.165] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.swf") returned 0
	[0050.165] lstrlenA (lpString="*.swf") returned 5
	[0050.165] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.eml") returned 0
	[0050.165] lstrlenA (lpString="*.eml") returned 5
	[0050.165] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.part") returned 0
	[0050.165] lstrlenA (lpString="*.part") returned 6
	[0050.165] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.nfo") returned 0
	[0050.165] lstrlenA (lpString="*.nfo") returned 5
	[0050.165] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.rsa") returned 0
	[0050.165] lstrlenA (lpString="*.rsa") returned 5
	[0050.165] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.key") returned 0
	[0050.165] lstrlenA (lpString="*.key") returned 5
	[0050.165] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.aes") returned 0
	[0050.165] lstrlenA (lpString="*.aes") returned 5
	[0050.165] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.blob") returned 0
	[0050.165] lstrlenA (lpString="*.blob") returned 6
	[0050.165] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.btc") returned 0
	[0050.165] lstrlenA (lpString="*.btc") returned 5
	[0050.165] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.wallet") returned 0
	[0050.165] lstrlenA (lpString="*.wallet") returned 8
	[0050.165] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0050.165] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.165] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="memtest.exe.mui") returned -1
	[0050.165] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="memtest.exe.mui") returned -1
	[0050.165] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1
	[0050.165] PathFindFileNameA (pszPath="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned="bootmgr.exe.mui"
	[0050.165] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\it-IT\\" | out: lpString1="C:\\Boot\\it-IT\\") returned="C:\\Boot\\it-IT\\"
	[0050.165] PathAddBackslashA (in: pszPath="C:\\Boot\\it-IT\\" | out: pszPath="C:\\Boot\\it-IT\\") returned=""
	[0050.165] lstrcatA (in: lpString1="C:\\Boot\\it-IT\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\it-IT\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\it-IT\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.165] GetFileAttributesA (lpFileName="C:\\Boot\\it-IT\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\it-it\\how-to-decrypt-files.htm")) returned 0x20
	[0050.165] lstrcatA (in: lpString1="C:\\Boot\\it-IT\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\it-IT\\memtest.exe.mui") returned="C:\\Boot\\it-IT\\memtest.exe.mui"
	[0050.165] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.zip") returned 0
	[0050.166] lstrlenA (lpString="*.zip") returned 5
	[0050.166] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.rar") returned 0
	[0050.166] lstrlenA (lpString="*.rar") returned 5
	[0050.166] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.7z") returned 0
	[0050.166] lstrlenA (lpString="*.7z") returned 4
	[0050.166] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.tar") returned 0
	[0050.166] lstrlenA (lpString="*.tar") returned 5
	[0050.166] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.gzip") returned 0
	[0050.166] lstrlenA (lpString="*.gzip") returned 6
	[0050.166] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.jpg") returned 0
	[0050.166] lstrlenA (lpString="*.jpg") returned 5
	[0050.166] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.166] lstrlenA (lpString="*.jpeg") returned 6
	[0050.166] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.bmp") returned 0
	[0050.166] lstrlenA (lpString="*.bmp") returned 5
	[0050.166] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.gif") returned 0
	[0050.166] lstrlenA (lpString="*.gif") returned 5
	[0050.166] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.png") returned 0
	[0050.166] lstrlenA (lpString="*.png") returned 5
	[0050.166] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.doc") returned 0
	[0050.166] lstrlenA (lpString="*.doc") returned 5
	[0050.166] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.docx") returned 0
	[0050.166] lstrlenA (lpString="*.docx") returned 6
	[0050.166] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.xls") returned 0
	[0050.166] lstrlenA (lpString="*.xls") returned 5
	[0050.166] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.166] lstrlenA (lpString="*.xlsx") returned 6
	[0050.166] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.ppt") returned 0
	[0050.166] lstrlenA (lpString="*.ppt") returned 5
	[0050.166] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.pptx") returned 0
	[0050.166] lstrlenA (lpString="*.pptx") returned 6
	[0050.166] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.txt") returned 0
	[0050.166] lstrlenA (lpString="*.txt") returned 5
	[0050.166] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.pdf") returned 0
	[0050.166] lstrlenA (lpString="*.pdf") returned 5
	[0050.166] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.htm") returned 0
	[0050.166] lstrlenA (lpString="*.htm") returned 5
	[0050.166] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.html") returned 0
	[0050.167] lstrlenA (lpString="*.html") returned 6
	[0050.167] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.mdb") returned 0
	[0050.167] lstrlenA (lpString="*.mdb") returned 5
	[0050.167] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.pfx") returned 0
	[0050.167] lstrlenA (lpString="*.pfx") returned 5
	[0050.167] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.md") returned 0
	[0050.167] lstrlenA (lpString="*.md") returned 4
	[0050.167] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.lnk") returned 0
	[0050.167] lstrlenA (lpString="*.lnk") returned 5
	[0050.167] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.torrent") returned 0
	[0050.167] lstrlenA (lpString="*.torrent") returned 9
	[0050.167] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.mov") returned 0
	[0050.167] lstrlenA (lpString="*.mov") returned 5
	[0050.167] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.3gp") returned 0
	[0050.167] lstrlenA (lpString="*.3gp") returned 5
	[0050.167] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.167] lstrlenA (lpString="*.mpeg") returned 6
	[0050.167] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.mpg") returned 0
	[0050.167] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.flv") returned 0
	[0050.167] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.avi") returned 0
	[0050.167] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.mp4") returned 0
	[0050.167] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.wmv") returned 0
	[0050.167] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.mkv") returned 0
	[0050.167] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.mp3") returned 0
	[0050.167] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.wav") returned 0
	[0050.167] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.flac") returned 0
	[0050.167] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.wma") returned 0
	[0050.167] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.au3") returned 0
	[0050.167] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.ahk") returned 0
	[0050.167] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.c") returned 0
	[0050.167] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.cc") returned 0
	[0050.168] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.cpp") returned 0
	[0050.168] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.cxx") returned 0
	[0050.168] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.c++") returned 0
	[0050.168] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.cs") returned 0
	[0050.168] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.vb") returned 0
	[0050.168] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.bas") returned 0
	[0050.168] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.csproj") returned 0
	[0050.168] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.168] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.168] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.manifest") returned 0
	[0050.168] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.php") returned 0
	[0050.168] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.vbe") returned 0
	[0050.168] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.vba") returned 0
	[0050.168] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.vbs") returned 0
	[0050.168] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.bat") returned 0
	[0050.168] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.cmd") returned 0
	[0050.168] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.js") returned 0
	[0050.168] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.jscript") returned 0
	[0050.168] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.hta") returned 0
	[0050.168] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.php7") returned 0
	[0050.168] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.db") returned 0
	[0050.168] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.swf") returned 0
	[0050.168] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.eml") returned 0
	[0050.168] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.part") returned 0
	[0050.168] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.nfo") returned 0
	[0050.168] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.rsa") returned 0
	[0050.169] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.key") returned 0
	[0050.169] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.aes") returned 0
	[0050.169] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.blob") returned 0
	[0050.169] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.btc") returned 0
	[0050.169] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.wallet") returned 0
	[0050.169] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0050.169] FindClose (in: hFindFile=0x7cb910 | out: hFindFile=0x7cb910) returned 1
	[0050.169] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0050.169] lstrcmpA (lpString1=".", lpString2="ja-JP") returned -1
	[0050.169] lstrcmpA (lpString1="..", lpString2="ja-JP") returned -1
	[0050.169] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0050.169] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="ja-JP" | out: lpString1="C:\\Boot\\ja-JP") returned="C:\\Boot\\ja-JP"
	[0050.169] FindFirstFileA (in: lpFileName="C:\\Boot\\ja-JP\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb590
	[0050.170] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.170] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0050.170] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.170] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.170] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48c6596, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0050.170] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.170] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr.exe.mui") returned 1
	[0050.170] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr.exe.mui") returned 1
	[0050.170] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0050.170] PathFindFileNameA (pszPath="C:\\Boot\\ja-JP\\*.*") returned="*.*"
	[0050.170] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\ja-JP\\" | out: lpString1="C:\\Boot\\ja-JP\\") returned="C:\\Boot\\ja-JP\\"
	[0050.170] PathAddBackslashA (in: pszPath="C:\\Boot\\ja-JP\\" | out: pszPath="C:\\Boot\\ja-JP\\") returned=""
	[0050.170] lstrcatA (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\ja-JP\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\ja-JP\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.170] GetFileAttributesA (lpFileName="C:\\Boot\\ja-JP\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\ja-jp\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0050.170] CreateFileA (lpFileName="C:\\Boot\\ja-JP\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\ja-jp\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0050.172] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0050.174] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.174] CloseHandle (hObject=0x208) returned 1
	[0050.174] lstrcatA (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned="C:\\Boot\\ja-JP\\bootmgr.exe.mui"
	[0050.174] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0050.174] lstrlenA (lpString="*.zip") returned 5
	[0050.174] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0050.174] lstrlenA (lpString="*.rar") returned 5
	[0050.174] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0050.174] lstrlenA (lpString="*.7z") returned 4
	[0050.174] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0050.174] lstrlenA (lpString="*.tar") returned 5
	[0050.174] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0050.174] lstrlenA (lpString="*.gzip") returned 6
	[0050.174] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0050.174] lstrlenA (lpString="*.jpg") returned 5
	[0050.174] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.174] lstrlenA (lpString="*.jpeg") returned 6
	[0050.174] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0050.174] lstrlenA (lpString="*.bmp") returned 5
	[0050.174] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0050.174] lstrlenA (lpString="*.gif") returned 5
	[0050.174] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0050.174] lstrlenA (lpString="*.png") returned 5
	[0050.174] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0050.174] lstrlenA (lpString="*.doc") returned 5
	[0050.174] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0050.174] lstrlenA (lpString="*.docx") returned 6
	[0050.174] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0050.175] lstrlenA (lpString="*.xls") returned 5
	[0050.175] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.175] lstrlenA (lpString="*.xlsx") returned 6
	[0050.175] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0050.175] lstrlenA (lpString="*.ppt") returned 5
	[0050.175] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0050.175] lstrlenA (lpString="*.pptx") returned 6
	[0050.175] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0050.175] lstrlenA (lpString="*.txt") returned 5
	[0050.175] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0050.175] lstrlenA (lpString="*.pdf") returned 5
	[0050.175] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0050.175] lstrlenA (lpString="*.htm") returned 5
	[0050.175] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0050.175] lstrlenA (lpString="*.html") returned 6
	[0050.175] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0050.175] lstrlenA (lpString="*.mdb") returned 5
	[0050.175] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0050.175] lstrlenA (lpString="*.pfx") returned 5
	[0050.175] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0050.175] lstrlenA (lpString="*.md") returned 4
	[0050.175] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0050.175] lstrlenA (lpString="*.lnk") returned 5
	[0050.175] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0050.175] lstrlenA (lpString="*.torrent") returned 9
	[0050.175] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0050.175] lstrlenA (lpString="*.mov") returned 5
	[0050.175] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0050.175] lstrlenA (lpString="*.3gp") returned 5
	[0050.175] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.175] lstrlenA (lpString="*.mpeg") returned 6
	[0050.175] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0050.175] lstrlenA (lpString="*.mpg") returned 5
	[0050.175] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0050.175] lstrlenA (lpString="*.flv") returned 5
	[0050.175] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0050.176] lstrlenA (lpString="*.avi") returned 5
	[0050.176] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0050.176] lstrlenA (lpString="*.mp4") returned 5
	[0050.176] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0050.176] lstrlenA (lpString="*.wmv") returned 5
	[0050.176] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0050.176] lstrlenA (lpString="*.mkv") returned 5
	[0050.176] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0050.176] lstrlenA (lpString="*.mp3") returned 5
	[0050.176] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0050.176] lstrlenA (lpString="*.wav") returned 5
	[0050.176] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0050.176] lstrlenA (lpString="*.flac") returned 6
	[0050.176] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0050.176] lstrlenA (lpString="*.wma") returned 5
	[0050.176] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.au3") returned 0
	[0050.176] lstrlenA (lpString="*.au3") returned 5
	[0050.176] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.ahk") returned 0
	[0050.176] lstrlenA (lpString="*.ahk") returned 5
	[0050.176] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.c") returned 0
	[0050.176] lstrlenA (lpString="*.c") returned 3
	[0050.176] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.cc") returned 0
	[0050.176] lstrlenA (lpString="*.cc") returned 4
	[0050.176] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0
	[0050.176] lstrlenA (lpString="*.cpp") returned 5
	[0050.176] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.cxx") returned 0
	[0050.176] lstrlenA (lpString="*.cxx") returned 5
	[0050.176] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.c++") returned 0
	[0050.176] lstrlenA (lpString="*.c++") returned 5
	[0050.176] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.cs") returned 0
	[0050.176] lstrlenA (lpString="*.cs") returned 4
	[0050.176] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.vb") returned 0
	[0050.176] lstrlenA (lpString="*.vb") returned 4
	[0050.176] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.bas") returned 0
	[0050.176] lstrlenA (lpString="*.bas") returned 5
	[0050.177] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.csproj") returned 0
	[0050.177] lstrlenA (lpString="*.csproj") returned 8
	[0050.177] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.177] lstrlenA (lpString="*.vbproj") returned 8
	[0050.177] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.177] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.177] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.manifest") returned 0
	[0050.177] lstrlenA (lpString="*.manifest") returned 10
	[0050.177] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.php") returned 0
	[0050.177] lstrlenA (lpString="*.php") returned 5
	[0050.177] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.vbe") returned 0
	[0050.177] lstrlenA (lpString="*.vbe") returned 5
	[0050.177] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.vba") returned 0
	[0050.177] lstrlenA (lpString="*.vba") returned 5
	[0050.177] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.vbs") returned 0
	[0050.177] lstrlenA (lpString="*.vbs") returned 5
	[0050.177] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.bat") returned 0
	[0050.177] lstrlenA (lpString="*.bat") returned 5
	[0050.177] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.cmd") returned 0
	[0050.177] lstrlenA (lpString="*.cmd") returned 5
	[0050.177] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.js") returned 0
	[0050.177] lstrlenA (lpString="*.js") returned 4
	[0050.177] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.jscript") returned 0
	[0050.177] lstrlenA (lpString="*.jscript") returned 9
	[0050.177] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.hta") returned 0
	[0050.177] lstrlenA (lpString="*.hta") returned 5
	[0050.177] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.php7") returned 0
	[0050.178] lstrlenA (lpString="*.php7") returned 6
	[0050.178] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.db") returned 0
	[0050.178] lstrlenA (lpString="*.db") returned 4
	[0050.178] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.swf") returned 0
	[0050.178] lstrlenA (lpString="*.swf") returned 5
	[0050.178] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.eml") returned 0
	[0050.178] lstrlenA (lpString="*.eml") returned 5
	[0050.178] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.part") returned 0
	[0050.178] lstrlenA (lpString="*.part") returned 6
	[0050.178] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.nfo") returned 0
	[0050.178] lstrlenA (lpString="*.nfo") returned 5
	[0050.178] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.rsa") returned 0
	[0050.178] lstrlenA (lpString="*.rsa") returned 5
	[0050.178] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.key") returned 0
	[0050.178] lstrlenA (lpString="*.key") returned 5
	[0050.178] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.aes") returned 0
	[0050.178] lstrlenA (lpString="*.aes") returned 5
	[0050.178] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.blob") returned 0
	[0050.178] lstrlenA (lpString="*.blob") returned 6
	[0050.178] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.btc") returned 0
	[0050.178] lstrlenA (lpString="*.btc") returned 5
	[0050.178] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.wallet") returned 0
	[0050.178] lstrlenA (lpString="*.wallet") returned 8
	[0050.178] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0050.178] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.178] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="memtest.exe.mui") returned -1
	[0050.178] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="memtest.exe.mui") returned -1
	[0050.178] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1
	[0050.178] PathFindFileNameA (pszPath="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned="bootmgr.exe.mui"
	[0050.178] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\ja-JP\\" | out: lpString1="C:\\Boot\\ja-JP\\") returned="C:\\Boot\\ja-JP\\"
	[0050.178] PathAddBackslashA (in: pszPath="C:\\Boot\\ja-JP\\" | out: pszPath="C:\\Boot\\ja-JP\\") returned=""
	[0050.178] lstrcatA (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\ja-JP\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\ja-JP\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.178] GetFileAttributesA (lpFileName="C:\\Boot\\ja-JP\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\ja-jp\\how-to-decrypt-files.htm")) returned 0x20
	[0050.179] lstrcatA (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\ja-JP\\memtest.exe.mui") returned="C:\\Boot\\ja-JP\\memtest.exe.mui"
	[0050.179] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.zip") returned 0
	[0050.179] lstrlenA (lpString="*.zip") returned 5
	[0050.179] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.rar") returned 0
	[0050.179] lstrlenA (lpString="*.rar") returned 5
	[0050.179] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.7z") returned 0
	[0050.179] lstrlenA (lpString="*.7z") returned 4
	[0050.179] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.tar") returned 0
	[0050.179] lstrlenA (lpString="*.tar") returned 5
	[0050.179] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.gzip") returned 0
	[0050.179] lstrlenA (lpString="*.gzip") returned 6
	[0050.179] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.jpg") returned 0
	[0050.179] lstrlenA (lpString="*.jpg") returned 5
	[0050.179] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.179] lstrlenA (lpString="*.jpeg") returned 6
	[0050.179] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.bmp") returned 0
	[0050.179] lstrlenA (lpString="*.bmp") returned 5
	[0050.179] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.gif") returned 0
	[0050.179] lstrlenA (lpString="*.gif") returned 5
	[0050.179] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.png") returned 0
	[0050.179] lstrlenA (lpString="*.png") returned 5
	[0050.179] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.doc") returned 0
	[0050.179] lstrlenA (lpString="*.doc") returned 5
	[0050.179] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.docx") returned 0
	[0050.179] lstrlenA (lpString="*.docx") returned 6
	[0050.179] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.xls") returned 0
	[0050.179] lstrlenA (lpString="*.xls") returned 5
	[0050.179] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.179] lstrlenA (lpString="*.xlsx") returned 6
	[0050.179] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.ppt") returned 0
	[0050.179] lstrlenA (lpString="*.ppt") returned 5
	[0050.179] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.pptx") returned 0
	[0050.179] lstrlenA (lpString="*.pptx") returned 6
	[0050.179] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.txt") returned 0
	[0050.179] lstrlenA (lpString="*.txt") returned 5
	[0050.179] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.pdf") returned 0
	[0050.180] lstrlenA (lpString="*.pdf") returned 5
	[0050.180] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.htm") returned 0
	[0050.180] lstrlenA (lpString="*.htm") returned 5
	[0050.180] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.html") returned 0
	[0050.180] lstrlenA (lpString="*.html") returned 6
	[0050.180] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.mdb") returned 0
	[0050.180] lstrlenA (lpString="*.mdb") returned 5
	[0050.180] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.pfx") returned 0
	[0050.180] lstrlenA (lpString="*.pfx") returned 5
	[0050.180] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.md") returned 0
	[0050.180] lstrlenA (lpString="*.md") returned 4
	[0050.180] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.lnk") returned 0
	[0050.180] lstrlenA (lpString="*.lnk") returned 5
	[0050.180] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.torrent") returned 0
	[0050.180] lstrlenA (lpString="*.torrent") returned 9
	[0050.180] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.mov") returned 0
	[0050.180] lstrlenA (lpString="*.mov") returned 5
	[0050.180] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.3gp") returned 0
	[0050.180] lstrlenA (lpString="*.3gp") returned 5
	[0050.180] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.180] lstrlenA (lpString="*.mpeg") returned 6
	[0050.180] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.mpg") returned 0
	[0050.180] lstrlenA (lpString="*.mpg") returned 5
	[0050.180] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.flv") returned 0
	[0050.180] lstrlenA (lpString="*.flv") returned 5
	[0050.180] lstrlenA (lpString="*.avi") returned 5
	[0050.181] lstrlenA (lpString="*.mp4") returned 5
	[0050.181] lstrlenA (lpString="*.wmv") returned 5
	[0050.181] lstrlenA (lpString="*.mkv") returned 5
	[0050.181] lstrlenA (lpString="*.mp3") returned 5
	[0050.181] lstrlenA (lpString="*.wav") returned 5
	[0050.181] lstrlenA (lpString="*.flac") returned 6
	[0050.181] lstrlenA (lpString="*.wma") returned 5
	[0050.181] lstrlenA (lpString="*.au3") returned 5
	[0050.181] lstrlenA (lpString="*.ahk") returned 5
	[0050.181] lstrlenA (lpString="*.c") returned 3
	[0050.181] lstrlenA (lpString="*.cc") returned 4
	[0050.181] lstrlenA (lpString="*.cpp") returned 5
	[0050.181] lstrlenA (lpString="*.cxx") returned 5
	[0050.181] lstrlenA (lpString="*.c++") returned 5
	[0050.181] lstrlenA (lpString="*.cs") returned 4
	[0050.181] lstrlenA (lpString="*.vb") returned 4
	[0050.181] lstrlenA (lpString="*.bas") returned 5
	[0050.181] lstrlenA (lpString="*.csproj") returned 8
	[0050.181] lstrlenA (lpString="*.vbproj") returned 8
	[0050.181] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.181] lstrlenA (lpString="*.manifest") returned 10
	[0050.181] lstrlenA (lpString="*.php") returned 5
	[0050.181] lstrlenA (lpString="*.vbe") returned 5
	[0050.181] lstrlenA (lpString="*.vba") returned 5
	[0050.181] lstrlenA (lpString="*.vbs") returned 5
	[0050.181] lstrlenA (lpString="*.bat") returned 5
	[0050.182] lstrlenA (lpString="*.cmd") returned 5
	[0050.182] lstrlenA (lpString="*.js") returned 4
	[0050.182] lstrlenA (lpString="*.jscript") returned 9
	[0050.182] lstrlenA (lpString="*.hta") returned 5
	[0050.182] lstrlenA (lpString="*.php7") returned 6
	[0050.182] lstrlenA (lpString="*.db") returned 4
	[0050.182] lstrlenA (lpString="*.swf") returned 5
	[0050.182] lstrlenA (lpString="*.eml") returned 5
	[0050.182] lstrlenA (lpString="*.part") returned 6
	[0050.182] lstrlenA (lpString="*.nfo") returned 5
	[0050.182] lstrlenA (lpString="*.rsa") returned 5
	[0050.182] lstrlenA (lpString="*.key") returned 5
	[0050.182] lstrlenA (lpString="*.aes") returned 5
	[0050.182] lstrlenA (lpString="*.blob") returned 6
	[0050.182] lstrlenA (lpString="*.btc") returned 5
	[0050.182] lstrlenA (lpString="*.wallet") returned 8
	[0050.182] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0050.182] FindClose (in: hFindFile=0x7cb590 | out: hFindFile=0x7cb590) returned 1
	[0050.182] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0050.182] lstrcmpA (lpString1=".", lpString2="ko-KR") returned -1
	[0050.182] lstrcmpA (lpString1="..", lpString2="ko-KR") returned -1
	[0050.182] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0050.182] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="ko-KR" | out: lpString1="C:\\Boot\\ko-KR") returned="C:\\Boot\\ko-KR"
	[0050.182] lstrlenA (lpString="C:\\Boot\\ko-KR") returned 13
	[0050.182] FindFirstFileA (in: lpFileName="C:\\Boot\\ko-KR\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb790
	[0050.183] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.183] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0050.183] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.183] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.183] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211c6af1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0050.183] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.183] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr.exe.mui") returned 1
	[0050.183] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr.exe.mui") returned 1
	[0050.183] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0050.183] PathFindFileNameA (pszPath="C:\\Boot\\ko-KR\\*.*") returned="*.*"
	[0050.183] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\ko-KR\\" | out: lpString1="C:\\Boot\\ko-KR\\") returned="C:\\Boot\\ko-KR\\"
	[0050.183] PathAddBackslashA (in: pszPath="C:\\Boot\\ko-KR\\" | out: pszPath="C:\\Boot\\ko-KR\\") returned=""
	[0050.184] lstrcatA (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\ko-KR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\ko-KR\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.184] GetFileAttributesA (lpFileName="C:\\Boot\\ko-KR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\ko-kr\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0050.184] CreateFileA (lpFileName="C:\\Boot\\ko-KR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\ko-kr\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0050.185] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0050.185] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0050.186] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.186] CloseHandle (hObject=0x208) returned 1
	[0050.186] lstrcatA (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned="C:\\Boot\\ko-KR\\bootmgr.exe.mui"
	[0050.186] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0050.186] lstrlenA (lpString="*.zip") returned 5
	[0050.186] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0050.186] lstrlenA (lpString="*.rar") returned 5
	[0050.186] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0050.186] lstrlenA (lpString="*.7z") returned 4
	[0050.186] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0050.187] lstrlenA (lpString="*.tar") returned 5
	[0050.187] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0050.187] lstrlenA (lpString="*.gzip") returned 6
	[0050.187] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0050.187] lstrlenA (lpString="*.jpg") returned 5
	[0050.187] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.187] lstrlenA (lpString="*.jpeg") returned 6
	[0050.187] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0050.187] lstrlenA (lpString="*.bmp") returned 5
	[0050.187] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0050.187] lstrlenA (lpString="*.gif") returned 5
	[0050.187] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0050.187] lstrlenA (lpString="*.png") returned 5
	[0050.187] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0050.187] lstrlenA (lpString="*.doc") returned 5
	[0050.187] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0050.187] lstrlenA (lpString="*.docx") returned 6
	[0050.187] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0050.187] lstrlenA (lpString="*.xls") returned 5
	[0050.187] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.187] lstrlenA (lpString="*.xlsx") returned 6
	[0050.187] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0050.187] lstrlenA (lpString="*.ppt") returned 5
	[0050.187] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0050.187] lstrlenA (lpString="*.pptx") returned 6
	[0050.187] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0050.187] lstrlenA (lpString="*.txt") returned 5
	[0050.187] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0050.187] lstrlenA (lpString="*.pdf") returned 5
	[0050.187] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0050.187] lstrlenA (lpString="*.htm") returned 5
	[0050.187] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0050.187] lstrlenA (lpString="*.html") returned 6
	[0050.187] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0050.187] lstrlenA (lpString="*.mdb") returned 5
	[0050.187] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0050.188] lstrlenA (lpString="*.pfx") returned 5
	[0050.188] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0050.188] lstrlenA (lpString="*.md") returned 4
	[0050.188] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0050.188] lstrlenA (lpString="*.lnk") returned 5
	[0050.188] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0050.188] lstrlenA (lpString="*.torrent") returned 9
	[0050.188] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0050.188] lstrlenA (lpString="*.mov") returned 5
	[0050.188] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0050.188] lstrlenA (lpString="*.3gp") returned 5
	[0050.188] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.188] lstrlenA (lpString="*.mpeg") returned 6
	[0050.188] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0050.188] lstrlenA (lpString="*.mpg") returned 5
	[0050.188] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0050.188] lstrlenA (lpString="*.flv") returned 5
	[0050.188] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0050.188] lstrlenA (lpString="*.avi") returned 5
	[0050.188] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0050.188] lstrlenA (lpString="*.mp4") returned 5
	[0050.188] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0050.188] lstrlenA (lpString="*.wmv") returned 5
	[0050.188] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0050.188] lstrlenA (lpString="*.mkv") returned 5
	[0050.188] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0050.188] lstrlenA (lpString="*.mp3") returned 5
	[0050.188] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0050.188] lstrlenA (lpString="*.wav") returned 5
	[0050.188] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0050.188] lstrlenA (lpString="*.flac") returned 6
	[0050.188] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0050.188] lstrlenA (lpString="*.wma") returned 5
	[0050.188] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.au3") returned 0
	[0050.188] lstrlenA (lpString="*.au3") returned 5
	[0050.188] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.ahk") returned 0
	[0050.188] lstrlenA (lpString="*.ahk") returned 5
	[0050.189] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.c") returned 0
	[0050.189] lstrlenA (lpString="*.c") returned 3
	[0050.189] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.cc") returned 0
	[0050.189] lstrlenA (lpString="*.cc") returned 4
	[0050.189] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0
	[0050.189] lstrlenA (lpString="*.cpp") returned 5
	[0050.189] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.cxx") returned 0
	[0050.189] lstrlenA (lpString="*.cxx") returned 5
	[0050.189] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.c++") returned 0
	[0050.189] lstrlenA (lpString="*.c++") returned 5
	[0050.189] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.cs") returned 0
	[0050.189] lstrlenA (lpString="*.cs") returned 4
	[0050.189] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.vb") returned 0
	[0050.189] lstrlenA (lpString="*.vb") returned 4
	[0050.189] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.bas") returned 0
	[0050.189] lstrlenA (lpString="*.bas") returned 5
	[0050.189] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.csproj") returned 0
	[0050.189] lstrlenA (lpString="*.csproj") returned 8
	[0050.189] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.189] lstrlenA (lpString="*.vbproj") returned 8
	[0050.189] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.189] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.189] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.manifest") returned 0
	[0050.189] lstrlenA (lpString="*.manifest") returned 10
	[0050.189] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.php") returned 0
	[0050.189] lstrlenA (lpString="*.php") returned 5
	[0050.189] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.vbe") returned 0
	[0050.189] lstrlenA (lpString="*.vbe") returned 5
	[0050.189] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.vba") returned 0
	[0050.189] lstrlenA (lpString="*.vba") returned 5
	[0050.189] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.vbs") returned 0
	[0050.189] lstrlenA (lpString="*.vbs") returned 5
	[0050.189] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.bat") returned 0
	[0050.189] lstrlenA (lpString="*.bat") returned 5
	[0050.189] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.cmd") returned 0
	[0050.189] lstrlenA (lpString="*.cmd") returned 5
	[0050.189] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.js") returned 0
	[0050.190] lstrlenA (lpString="*.js") returned 4
	[0050.190] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.jscript") returned 0
	[0050.190] lstrlenA (lpString="*.jscript") returned 9
	[0050.190] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.hta") returned 0
	[0050.190] lstrlenA (lpString="*.hta") returned 5
	[0050.190] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.php7") returned 0
	[0050.190] lstrlenA (lpString="*.php7") returned 6
	[0050.190] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.db") returned 0
	[0050.190] lstrlenA (lpString="*.db") returned 4
	[0050.190] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.swf") returned 0
	[0050.190] lstrlenA (lpString="*.swf") returned 5
	[0050.190] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.eml") returned 0
	[0050.190] lstrlenA (lpString="*.eml") returned 5
	[0050.190] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.part") returned 0
	[0050.190] lstrlenA (lpString="*.part") returned 6
	[0050.190] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.nfo") returned 0
	[0050.190] lstrlenA (lpString="*.nfo") returned 5
	[0050.190] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.rsa") returned 0
	[0050.190] lstrlenA (lpString="*.rsa") returned 5
	[0050.190] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.key") returned 0
	[0050.190] lstrlenA (lpString="*.key") returned 5
	[0050.190] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.aes") returned 0
	[0050.190] lstrlenA (lpString="*.aes") returned 5
	[0050.190] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.blob") returned 0
	[0050.190] lstrlenA (lpString="*.blob") returned 6
	[0050.190] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.btc") returned 0
	[0050.190] lstrlenA (lpString="*.btc") returned 5
	[0050.190] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.wallet") returned 0
	[0050.190] lstrlenA (lpString="*.wallet") returned 8
	[0050.190] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0050.190] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.190] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="memtest.exe.mui") returned -1
	[0050.190] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="memtest.exe.mui") returned -1
	[0050.190] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1
	[0050.190] PathFindFileNameA (pszPath="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned="bootmgr.exe.mui"
	[0050.190] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\ko-KR\\" | out: lpString1="C:\\Boot\\ko-KR\\") returned="C:\\Boot\\ko-KR\\"
	[0050.191] PathAddBackslashA (in: pszPath="C:\\Boot\\ko-KR\\" | out: pszPath="C:\\Boot\\ko-KR\\") returned=""
	[0050.191] lstrcatA (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\ko-KR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\ko-KR\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.191] GetFileAttributesA (lpFileName="C:\\Boot\\ko-KR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\ko-kr\\how-to-decrypt-files.htm")) returned 0x20
	[0050.191] lstrcatA (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\ko-KR\\memtest.exe.mui") returned="C:\\Boot\\ko-KR\\memtest.exe.mui"
	[0050.191] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.zip") returned 0
	[0050.191] lstrlenA (lpString="*.zip") returned 5
	[0050.191] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.rar") returned 0
	[0050.191] lstrlenA (lpString="*.rar") returned 5
	[0050.191] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.7z") returned 0
	[0050.191] lstrlenA (lpString="*.7z") returned 4
	[0050.191] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.tar") returned 0
	[0050.191] lstrlenA (lpString="*.tar") returned 5
	[0050.191] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.gzip") returned 0
	[0050.191] lstrlenA (lpString="*.gzip") returned 6
	[0050.191] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.jpg") returned 0
	[0050.191] lstrlenA (lpString="*.jpg") returned 5
	[0050.191] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.191] lstrlenA (lpString="*.jpeg") returned 6
	[0050.191] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.bmp") returned 0
	[0050.191] lstrlenA (lpString="*.bmp") returned 5
	[0050.191] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.gif") returned 0
	[0050.191] lstrlenA (lpString="*.gif") returned 5
	[0050.191] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.png") returned 0
	[0050.191] lstrlenA (lpString="*.png") returned 5
	[0050.191] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.doc") returned 0
	[0050.191] lstrlenA (lpString="*.doc") returned 5
	[0050.191] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.docx") returned 0
	[0050.191] lstrlenA (lpString="*.docx") returned 6
	[0050.191] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.xls") returned 0
	[0050.191] lstrlenA (lpString="*.xls") returned 5
	[0050.191] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.191] lstrlenA (lpString="*.xlsx") returned 6
	[0050.191] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.ppt") returned 0
	[0050.191] lstrlenA (lpString="*.ppt") returned 5
	[0050.191] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.pptx") returned 0
	[0050.192] lstrlenA (lpString="*.pptx") returned 6
	[0050.192] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.txt") returned 0
	[0050.192] lstrlenA (lpString="*.txt") returned 5
	[0050.192] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.pdf") returned 0
	[0050.192] lstrlenA (lpString="*.pdf") returned 5
	[0050.192] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.htm") returned 0
	[0050.192] lstrlenA (lpString="*.htm") returned 5
	[0050.192] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.html") returned 0
	[0050.192] lstrlenA (lpString="*.html") returned 6
	[0050.192] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.mdb") returned 0
	[0050.192] lstrlenA (lpString="*.mdb") returned 5
	[0050.192] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.pfx") returned 0
	[0050.192] lstrlenA (lpString="*.pfx") returned 5
	[0050.192] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.md") returned 0
	[0050.192] lstrlenA (lpString="*.md") returned 4
	[0050.192] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.lnk") returned 0
	[0050.192] lstrlenA (lpString="*.lnk") returned 5
	[0050.192] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.torrent") returned 0
	[0050.192] lstrlenA (lpString="*.torrent") returned 9
	[0050.192] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.mov") returned 0
	[0050.192] lstrlenA (lpString="*.mov") returned 5
	[0050.192] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.3gp") returned 0
	[0050.192] lstrlenA (lpString="*.3gp") returned 5
	[0050.192] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.192] lstrlenA (lpString="*.mpeg") returned 6
	[0050.192] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.mpg") returned 0
	[0050.192] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.flv") returned 0
	[0050.192] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.avi") returned 0
	[0050.192] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.mp4") returned 0
	[0050.192] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.wmv") returned 0
	[0050.192] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.mkv") returned 0
	[0050.192] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.mp3") returned 0
	[0050.192] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.wav") returned 0
	[0050.192] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.flac") returned 0
	[0050.193] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.wma") returned 0
	[0050.193] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.au3") returned 0
	[0050.193] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.ahk") returned 0
	[0050.322] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.c") returned 0
	[0050.322] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.cc") returned 0
	[0050.323] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.cpp") returned 0
	[0050.323] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.cxx") returned 0
	[0050.323] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.c++") returned 0
	[0050.323] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.cs") returned 0
	[0050.323] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.vb") returned 0
	[0050.323] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.bas") returned 0
	[0050.323] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.csproj") returned 0
	[0050.323] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.323] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.323] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.manifest") returned 0
	[0050.323] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.php") returned 0
	[0050.323] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.vbe") returned 0
	[0050.323] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.vba") returned 0
	[0050.323] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.vbs") returned 0
	[0050.323] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.bat") returned 0
	[0050.323] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.cmd") returned 0
	[0050.323] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.js") returned 0
	[0050.323] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.jscript") returned 0
	[0050.323] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.hta") returned 0
	[0050.323] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.php7") returned 0
	[0050.323] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.db") returned 0
	[0050.323] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.swf") returned 0
	[0050.323] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.eml") returned 0
	[0050.323] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.part") returned 0
	[0050.323] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.nfo") returned 0
	[0050.323] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.rsa") returned 0
	[0050.323] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.key") returned 0
	[0050.324] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.aes") returned 0
	[0050.324] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.blob") returned 0
	[0050.324] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.btc") returned 0
	[0050.324] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.wallet") returned 0
	[0050.324] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0050.324] FindClose (in: hFindFile=0x7cb790 | out: hFindFile=0x7cb790) returned 1
	[0050.324] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1
	[0050.324] lstrcmpA (lpString1=".", lpString2="lt-LT") returned -1
	[0050.324] lstrcmpA (lpString1="..", lpString2="lt-LT") returned -1
	[0050.324] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0050.324] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="lt-LT" | out: lpString1="C:\\Boot\\lt-LT") returned="C:\\Boot\\lt-LT"
	[0050.324] FindFirstFileA (in: lpFileName="C:\\Boot\\lt-LT\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb5d0
	[0050.324] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.324] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0050.324] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.324] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.324] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0050.324] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.324] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr.exe.mui") returned 1
	[0050.324] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr.exe.mui") returned 1
	[0050.325] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0050.325] PathFindFileNameA (pszPath="C:\\Boot\\lt-LT\\*.*") returned="*.*"
	[0050.325] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\lt-LT\\" | out: lpString1="C:\\Boot\\lt-LT\\") returned="C:\\Boot\\lt-LT\\"
	[0050.325] PathAddBackslashA (in: pszPath="C:\\Boot\\lt-LT\\" | out: pszPath="C:\\Boot\\lt-LT\\") returned=""
	[0050.325] lstrcatA (in: lpString1="C:\\Boot\\lt-LT\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\lt-LT\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\lt-LT\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.325] GetFileAttributesA (lpFileName="C:\\Boot\\lt-LT\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\lt-lt\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0050.325] CreateFileA (lpFileName="C:\\Boot\\lt-LT\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\lt-lt\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0050.325] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0050.326] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.326] CloseHandle (hObject=0x208) returned 1
	[0050.326] lstrcatA (in: lpString1="C:\\Boot\\lt-LT\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\lt-LT\\bootmgr.exe.mui") returned="C:\\Boot\\lt-LT\\bootmgr.exe.mui"
	[0050.326] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0050.326] lstrlenA (lpString="*.zip") returned 5
	[0050.326] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0050.326] lstrlenA (lpString="*.rar") returned 5
	[0050.326] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0050.326] lstrlenA (lpString="*.7z") returned 4
	[0050.326] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0050.326] lstrlenA (lpString="*.tar") returned 5
	[0050.326] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0050.326] lstrlenA (lpString="*.gzip") returned 6
	[0050.326] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0050.326] lstrlenA (lpString="*.jpg") returned 5
	[0050.326] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.327] lstrlenA (lpString="*.jpeg") returned 6
	[0050.327] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0050.327] lstrlenA (lpString="*.bmp") returned 5
	[0050.327] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0050.327] lstrlenA (lpString="*.gif") returned 5
	[0050.327] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0050.327] lstrlenA (lpString="*.png") returned 5
	[0050.327] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0050.327] lstrlenA (lpString="*.doc") returned 5
	[0050.327] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0050.327] lstrlenA (lpString="*.docx") returned 6
	[0050.327] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0050.327] lstrlenA (lpString="*.xls") returned 5
	[0050.327] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.327] lstrlenA (lpString="*.xlsx") returned 6
	[0050.327] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0050.327] lstrlenA (lpString="*.ppt") returned 5
	[0050.327] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0050.327] lstrlenA (lpString="*.pptx") returned 6
	[0050.327] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0050.327] lstrlenA (lpString="*.txt") returned 5
	[0050.327] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0050.327] lstrlenA (lpString="*.pdf") returned 5
	[0050.327] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0050.327] lstrlenA (lpString="*.htm") returned 5
	[0050.327] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0050.327] lstrlenA (lpString="*.html") returned 6
	[0050.327] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0050.327] lstrlenA (lpString="*.mdb") returned 5
	[0050.327] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0050.327] lstrlenA (lpString="*.pfx") returned 5
	[0050.327] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0050.327] lstrlenA (lpString="*.md") returned 4
	[0050.327] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0050.327] lstrlenA (lpString="*.lnk") returned 5
	[0050.327] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0050.327] lstrlenA (lpString="*.torrent") returned 9
	[0050.328] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0050.328] lstrlenA (lpString="*.mov") returned 5
	[0050.328] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0050.328] lstrlenA (lpString="*.3gp") returned 5
	[0050.328] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.328] lstrlenA (lpString="*.mpeg") returned 6
	[0050.328] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0050.328] lstrlenA (lpString="*.mpg") returned 5
	[0050.328] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0050.328] lstrlenA (lpString="*.flv") returned 5
	[0050.328] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0050.328] lstrlenA (lpString="*.avi") returned 5
	[0050.328] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0050.328] lstrlenA (lpString="*.mp4") returned 5
	[0050.328] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0050.328] lstrlenA (lpString="*.wmv") returned 5
	[0050.328] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0050.328] lstrlenA (lpString="*.mkv") returned 5
	[0050.328] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0050.328] lstrlenA (lpString="*.mp3") returned 5
	[0050.328] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0050.328] lstrlenA (lpString="*.wav") returned 5
	[0050.328] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0050.328] lstrlenA (lpString="*.flac") returned 6
	[0050.328] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0050.328] lstrlenA (lpString="*.wma") returned 5
	[0050.328] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.au3") returned 0
	[0050.328] lstrlenA (lpString="*.au3") returned 5
	[0050.328] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.ahk") returned 0
	[0050.328] lstrlenA (lpString="*.ahk") returned 5
	[0050.328] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.c") returned 0
	[0050.328] lstrlenA (lpString="*.c") returned 3
	[0050.328] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.cc") returned 0
	[0050.328] lstrlenA (lpString="*.cc") returned 4
	[0050.328] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0
	[0050.328] lstrlenA (lpString="*.cpp") returned 5
	[0050.328] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.cxx") returned 0
	[0050.328] lstrlenA (lpString="*.cxx") returned 5
	[0050.328] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.c++") returned 0
	[0050.329] lstrlenA (lpString="*.c++") returned 5
	[0050.329] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.cs") returned 0
	[0050.329] lstrlenA (lpString="*.cs") returned 4
	[0050.329] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.vb") returned 0
	[0050.329] lstrlenA (lpString="*.vb") returned 4
	[0050.329] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.bas") returned 0
	[0050.329] lstrlenA (lpString="*.bas") returned 5
	[0050.329] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.csproj") returned 0
	[0050.329] lstrlenA (lpString="*.csproj") returned 8
	[0050.329] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.329] lstrlenA (lpString="*.vbproj") returned 8
	[0050.329] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.329] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.329] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.manifest") returned 0
	[0050.329] lstrlenA (lpString="*.manifest") returned 10
	[0050.329] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.php") returned 0
	[0050.329] lstrlenA (lpString="*.php") returned 5
	[0050.329] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.vbe") returned 0
	[0050.329] lstrlenA (lpString="*.vbe") returned 5
	[0050.329] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.vba") returned 0
	[0050.329] lstrlenA (lpString="*.vba") returned 5
	[0050.329] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.vbs") returned 0
	[0050.329] lstrlenA (lpString="*.vbs") returned 5
	[0050.329] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.bat") returned 0
	[0050.329] lstrlenA (lpString="*.bat") returned 5
	[0050.329] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.cmd") returned 0
	[0050.329] lstrlenA (lpString="*.cmd") returned 5
	[0050.329] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.js") returned 0
	[0050.329] lstrlenA (lpString="*.js") returned 4
	[0050.329] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.jscript") returned 0
	[0050.329] lstrlenA (lpString="*.jscript") returned 9
	[0050.329] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.hta") returned 0
	[0050.329] lstrlenA (lpString="*.hta") returned 5
	[0050.329] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.php7") returned 0
	[0050.329] lstrlenA (lpString="*.php7") returned 6
	[0050.329] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.db") returned 0
	[0050.329] lstrlenA (lpString="*.db") returned 4
	[0050.330] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.swf") returned 0
	[0050.330] lstrlenA (lpString="*.swf") returned 5
	[0050.330] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.eml") returned 0
	[0050.330] lstrlenA (lpString="*.eml") returned 5
	[0050.330] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.part") returned 0
	[0050.330] lstrlenA (lpString="*.part") returned 6
	[0050.330] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.nfo") returned 0
	[0050.330] lstrlenA (lpString="*.nfo") returned 5
	[0050.330] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.rsa") returned 0
	[0050.330] lstrlenA (lpString="*.rsa") returned 5
	[0050.330] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.key") returned 0
	[0050.330] lstrlenA (lpString="*.key") returned 5
	[0050.330] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.aes") returned 0
	[0050.330] lstrlenA (lpString="*.aes") returned 5
	[0050.330] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.blob") returned 0
	[0050.330] lstrlenA (lpString="*.blob") returned 6
	[0050.330] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.btc") returned 0
	[0050.330] lstrlenA (lpString="*.btc") returned 5
	[0050.330] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.wallet") returned 0
	[0050.330] lstrlenA (lpString="*.wallet") returned 8
	[0050.330] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0050.330] FindClose (in: hFindFile=0x7cb5d0 | out: hFindFile=0x7cb5d0) returned 1
	[0050.330] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1
	[0050.330] lstrcmpA (lpString1=".", lpString2="lv-LV") returned -1
	[0050.330] lstrcmpA (lpString1="..", lpString2="lv-LV") returned -1
	[0050.330] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0050.330] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="lv-LV" | out: lpString1="C:\\Boot\\lv-LV") returned="C:\\Boot\\lv-LV"
	[0050.330] lstrlenA (lpString="C:\\Boot\\lv-LV") returned 13
	[0050.330] FindFirstFileA (in: lpFileName="C:\\Boot\\lv-LV\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbc50
	[0050.331] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.331] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0050.331] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.331] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.331] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0050.331] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.331] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr.exe.mui") returned 1
	[0050.331] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr.exe.mui") returned 1
	[0050.331] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0050.332] PathFindFileNameA (pszPath="C:\\Boot\\lv-LV\\*.*") returned="*.*"
	[0050.332] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\lv-LV\\" | out: lpString1="C:\\Boot\\lv-LV\\") returned="C:\\Boot\\lv-LV\\"
	[0050.332] PathAddBackslashA (in: pszPath="C:\\Boot\\lv-LV\\" | out: pszPath="C:\\Boot\\lv-LV\\") returned=""
	[0050.332] lstrcatA (in: lpString1="C:\\Boot\\lv-LV\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\lv-LV\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\lv-LV\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.332] GetFileAttributesA (lpFileName="C:\\Boot\\lv-LV\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\lv-lv\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0050.332] CreateFileA (lpFileName="C:\\Boot\\lv-LV\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\lv-lv\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0050.332] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0050.332] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0050.334] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.334] CloseHandle (hObject=0x208) returned 1
	[0050.334] lstrcatA (in: lpString1="C:\\Boot\\lv-LV\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\lv-LV\\bootmgr.exe.mui") returned="C:\\Boot\\lv-LV\\bootmgr.exe.mui"
	[0050.334] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0050.334] lstrlenA (lpString="*.zip") returned 5
	[0050.334] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0050.334] lstrlenA (lpString="*.rar") returned 5
	[0050.334] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0050.334] lstrlenA (lpString="*.7z") returned 4
	[0050.334] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0050.334] lstrlenA (lpString="*.tar") returned 5
	[0050.334] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0050.334] lstrlenA (lpString="*.gzip") returned 6
	[0050.334] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0050.334] lstrlenA (lpString="*.jpg") returned 5
	[0050.334] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.334] lstrlenA (lpString="*.jpeg") returned 6
	[0050.334] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0050.334] lstrlenA (lpString="*.bmp") returned 5
	[0050.334] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0050.334] lstrlenA (lpString="*.gif") returned 5
	[0050.334] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0050.334] lstrlenA (lpString="*.png") returned 5
	[0050.334] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0050.334] lstrlenA (lpString="*.doc") returned 5
	[0050.334] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0050.334] lstrlenA (lpString="*.docx") returned 6
	[0050.334] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0050.335] lstrlenA (lpString="*.xls") returned 5
	[0050.335] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.335] lstrlenA (lpString="*.xlsx") returned 6
	[0050.335] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0050.335] lstrlenA (lpString="*.ppt") returned 5
	[0050.335] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0050.335] lstrlenA (lpString="*.pptx") returned 6
	[0050.335] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0050.335] lstrlenA (lpString="*.txt") returned 5
	[0050.335] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0050.335] lstrlenA (lpString="*.pdf") returned 5
	[0050.335] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0050.335] lstrlenA (lpString="*.htm") returned 5
	[0050.335] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0050.335] lstrlenA (lpString="*.html") returned 6
	[0050.335] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0050.335] lstrlenA (lpString="*.mdb") returned 5
	[0050.335] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0050.335] lstrlenA (lpString="*.pfx") returned 5
	[0050.335] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0050.335] lstrlenA (lpString="*.md") returned 4
	[0050.335] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0050.335] lstrlenA (lpString="*.lnk") returned 5
	[0050.335] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0050.335] lstrlenA (lpString="*.torrent") returned 9
	[0050.335] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0050.335] lstrlenA (lpString="*.mov") returned 5
	[0050.335] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0050.335] lstrlenA (lpString="*.3gp") returned 5
	[0050.335] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.335] lstrlenA (lpString="*.mpeg") returned 6
	[0050.335] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0050.335] lstrlenA (lpString="*.mpg") returned 5
	[0050.335] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0050.335] lstrlenA (lpString="*.flv") returned 5
	[0050.335] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0050.335] lstrlenA (lpString="*.avi") returned 5
	[0050.335] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0050.336] lstrlenA (lpString="*.mp4") returned 5
	[0050.336] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0050.336] lstrlenA (lpString="*.wmv") returned 5
	[0050.336] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0050.336] lstrlenA (lpString="*.mkv") returned 5
	[0050.336] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0050.336] lstrlenA (lpString="*.mp3") returned 5
	[0050.336] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0050.336] lstrlenA (lpString="*.wav") returned 5
	[0050.336] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0050.336] lstrlenA (lpString="*.flac") returned 6
	[0050.336] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0050.336] lstrlenA (lpString="*.wma") returned 5
	[0050.336] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.au3") returned 0
	[0050.336] lstrlenA (lpString="*.au3") returned 5
	[0050.336] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.ahk") returned 0
	[0050.336] lstrlenA (lpString="*.ahk") returned 5
	[0050.336] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.c") returned 0
	[0050.336] lstrlenA (lpString="*.c") returned 3
	[0050.336] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.cc") returned 0
	[0050.336] lstrlenA (lpString="*.cc") returned 4
	[0050.336] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0
	[0050.336] lstrlenA (lpString="*.cpp") returned 5
	[0050.336] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.cxx") returned 0
	[0050.336] lstrlenA (lpString="*.cxx") returned 5
	[0050.336] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.c++") returned 0
	[0050.336] lstrlenA (lpString="*.c++") returned 5
	[0050.336] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.cs") returned 0
	[0050.336] lstrlenA (lpString="*.cs") returned 4
	[0050.336] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.vb") returned 0
	[0050.336] lstrlenA (lpString="*.vb") returned 4
	[0050.336] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.bas") returned 0
	[0050.336] lstrlenA (lpString="*.bas") returned 5
	[0050.336] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.csproj") returned 0
	[0050.336] lstrlenA (lpString="*.csproj") returned 8
	[0050.336] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.336] lstrlenA (lpString="*.vbproj") returned 8
	[0050.336] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.337] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.337] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.manifest") returned 0
	[0050.337] lstrlenA (lpString="*.manifest") returned 10
	[0050.337] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.php") returned 0
	[0050.337] lstrlenA (lpString="*.php") returned 5
	[0050.337] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.vbe") returned 0
	[0050.337] lstrlenA (lpString="*.vbe") returned 5
	[0050.337] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.vba") returned 0
	[0050.337] lstrlenA (lpString="*.vba") returned 5
	[0050.337] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.vbs") returned 0
	[0050.337] lstrlenA (lpString="*.vbs") returned 5
	[0050.337] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.bat") returned 0
	[0050.337] lstrlenA (lpString="*.bat") returned 5
	[0050.337] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.cmd") returned 0
	[0050.337] lstrlenA (lpString="*.cmd") returned 5
	[0050.337] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.js") returned 0
	[0050.337] lstrlenA (lpString="*.js") returned 4
	[0050.337] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.jscript") returned 0
	[0050.337] lstrlenA (lpString="*.jscript") returned 9
	[0050.337] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.hta") returned 0
	[0050.337] lstrlenA (lpString="*.hta") returned 5
	[0050.337] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.php7") returned 0
	[0050.337] lstrlenA (lpString="*.php7") returned 6
	[0050.337] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.db") returned 0
	[0050.337] lstrlenA (lpString="*.db") returned 4
	[0050.337] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.swf") returned 0
	[0050.337] lstrlenA (lpString="*.swf") returned 5
	[0050.337] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.eml") returned 0
	[0050.337] lstrlenA (lpString="*.eml") returned 5
	[0050.337] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.part") returned 0
	[0050.337] lstrlenA (lpString="*.part") returned 6
	[0050.337] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.nfo") returned 0
	[0050.337] lstrlenA (lpString="*.nfo") returned 5
	[0050.337] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.rsa") returned 0
	[0050.337] lstrlenA (lpString="*.rsa") returned 5
	[0050.337] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.key") returned 0
	[0050.337] lstrlenA (lpString="*.key") returned 5
	[0050.337] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.aes") returned 0
	[0050.338] lstrlenA (lpString="*.aes") returned 5
	[0050.338] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.blob") returned 0
	[0050.338] lstrlenA (lpString="*.blob") returned 6
	[0050.338] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.btc") returned 0
	[0050.338] lstrlenA (lpString="*.btc") returned 5
	[0050.338] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.wallet") returned 0
	[0050.338] lstrlenA (lpString="*.wallet") returned 8
	[0050.338] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0050.338] FindClose (in: hFindFile=0x7cbc50 | out: hFindFile=0x7cbc50) returned 1
	[0050.338] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1
	[0050.338] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.338] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="memtest.exe") returned -1
	[0050.338] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="memtest.exe") returned -1
	[0050.338] lstrcmpiA (lpString1="", lpString2="memtest.exe") returned -1
	[0050.338] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0050.338] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\"
	[0050.338] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned=""
	[0050.338] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.338] GetFileAttributesA (lpFileName="C:\\Boot\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\how-to-decrypt-files.htm")) returned 0x20
	[0050.338] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="memtest.exe" | out: lpString1="C:\\Boot\\memtest.exe") returned="C:\\Boot\\memtest.exe"
	[0050.338] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.zip") returned 0
	[0050.338] lstrlenA (lpString="*.zip") returned 5
	[0050.338] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.rar") returned 0
	[0050.338] lstrlenA (lpString="*.rar") returned 5
	[0050.338] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.7z") returned 0
	[0050.338] lstrlenA (lpString="*.7z") returned 4
	[0050.338] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.tar") returned 0
	[0050.338] lstrlenA (lpString="*.tar") returned 5
	[0050.338] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.gzip") returned 0
	[0050.338] lstrlenA (lpString="*.gzip") returned 6
	[0050.338] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.jpg") returned 0
	[0050.339] lstrlenA (lpString="*.jpg") returned 5
	[0050.339] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.jpeg") returned 0
	[0050.339] lstrlenA (lpString="*.jpeg") returned 6
	[0050.339] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.bmp") returned 0
	[0050.339] lstrlenA (lpString="*.bmp") returned 5
	[0050.339] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.gif") returned 0
	[0050.339] lstrlenA (lpString="*.gif") returned 5
	[0050.339] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.png") returned 0
	[0050.339] lstrlenA (lpString="*.png") returned 5
	[0050.339] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.doc") returned 0
	[0050.339] lstrlenA (lpString="*.doc") returned 5
	[0050.339] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.docx") returned 0
	[0050.339] lstrlenA (lpString="*.docx") returned 6
	[0050.339] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.xls") returned 0
	[0050.339] lstrlenA (lpString="*.xls") returned 5
	[0050.339] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.xlsx") returned 0
	[0050.339] lstrlenA (lpString="*.xlsx") returned 6
	[0050.339] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.ppt") returned 0
	[0050.339] lstrlenA (lpString="*.ppt") returned 5
	[0050.339] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.pptx") returned 0
	[0050.339] lstrlenA (lpString="*.pptx") returned 6
	[0050.339] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.txt") returned 0
	[0050.339] lstrlenA (lpString="*.txt") returned 5
	[0050.339] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.pdf") returned 0
	[0050.339] lstrlenA (lpString="*.pdf") returned 5
	[0050.339] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.htm") returned 0
	[0050.339] lstrlenA (lpString="*.htm") returned 5
	[0050.339] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.html") returned 0
	[0050.339] lstrlenA (lpString="*.html") returned 6
	[0050.339] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mdb") returned 0
	[0050.339] lstrlenA (lpString="*.mdb") returned 5
	[0050.339] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.pfx") returned 0
	[0050.339] lstrlenA (lpString="*.pfx") returned 5
	[0050.339] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.md") returned 0
	[0050.339] lstrlenA (lpString="*.md") returned 4
	[0050.339] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.lnk") returned 0
	[0050.339] lstrlenA (lpString="*.lnk") returned 5
	[0050.339] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.torrent") returned 0
	[0050.340] lstrlenA (lpString="*.torrent") returned 9
	[0050.340] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mov") returned 0
	[0050.340] lstrlenA (lpString="*.mov") returned 5
	[0050.340] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.3gp") returned 0
	[0050.340] lstrlenA (lpString="*.3gp") returned 5
	[0050.340] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mpeg") returned 0
	[0050.340] lstrlenA (lpString="*.mpeg") returned 6
	[0050.340] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mpg") returned 0
	[0050.340] lstrlenA (lpString="*.mpg") returned 5
	[0050.340] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.flv") returned 0
	[0050.340] lstrlenA (lpString="*.flv") returned 5
	[0050.340] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.avi") returned 0
	[0050.340] lstrlenA (lpString="*.avi") returned 5
	[0050.340] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mp4") returned 0
	[0050.340] lstrlenA (lpString="*.mp4") returned 5
	[0050.340] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.wmv") returned 0
	[0050.340] lstrlenA (lpString="*.wmv") returned 5
	[0050.340] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mkv") returned 0
	[0050.340] lstrlenA (lpString="*.mkv") returned 5
	[0050.340] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mp3") returned 0
	[0050.340] lstrlenA (lpString="*.mp3") returned 5
	[0050.340] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.wav") returned 0
	[0050.340] lstrlenA (lpString="*.wav") returned 5
	[0050.340] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.flac") returned 0
	[0050.340] lstrlenA (lpString="*.flac") returned 6
	[0050.340] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.wma") returned 0
	[0050.340] lstrlenA (lpString="*.wma") returned 5
	[0050.340] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.au3") returned 0
	[0050.340] lstrlenA (lpString="*.au3") returned 5
	[0050.340] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.ahk") returned 0
	[0050.340] lstrlenA (lpString="*.ahk") returned 5
	[0050.340] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.c") returned 0
	[0050.340] lstrlenA (lpString="*.c") returned 3
	[0050.340] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.cc") returned 0
	[0050.340] lstrlenA (lpString="*.cc") returned 4
	[0050.340] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.cpp") returned 0
	[0050.340] lstrlenA (lpString="*.cpp") returned 5
	[0050.340] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.cxx") returned 0
	[0050.341] lstrlenA (lpString="*.cxx") returned 5
	[0050.341] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.c++") returned 0
	[0050.341] lstrlenA (lpString="*.c++") returned 5
	[0050.341] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.cs") returned 0
	[0050.341] lstrlenA (lpString="*.cs") returned 4
	[0050.341] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.vb") returned 0
	[0050.341] lstrlenA (lpString="*.vb") returned 4
	[0050.341] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.bas") returned 0
	[0050.341] lstrlenA (lpString="*.bas") returned 5
	[0050.341] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.csproj") returned 0
	[0050.341] lstrlenA (lpString="*.csproj") returned 8
	[0050.341] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.vbproj") returned 0
	[0050.341] lstrlenA (lpString="*.vbproj") returned 8
	[0050.341] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.vcxproj") returned 0
	[0050.341] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.341] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.manifest") returned 0
	[0050.341] lstrlenA (lpString="*.manifest") returned 10
	[0050.341] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.php") returned 0
	[0050.341] lstrlenA (lpString="*.php") returned 5
	[0050.341] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.vbe") returned 0
	[0050.341] lstrlenA (lpString="*.vbe") returned 5
	[0050.341] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.vba") returned 0
	[0050.341] lstrlenA (lpString="*.vba") returned 5
	[0050.341] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.vbs") returned 0
	[0050.341] lstrlenA (lpString="*.vbs") returned 5
	[0050.341] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.bat") returned 0
	[0050.341] lstrlenA (lpString="*.bat") returned 5
	[0050.341] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.cmd") returned 0
	[0050.341] lstrlenA (lpString="*.cmd") returned 5
	[0050.341] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.js") returned 0
	[0050.341] lstrlenA (lpString="*.js") returned 4
	[0050.341] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.jscript") returned 0
	[0050.341] lstrlenA (lpString="*.jscript") returned 9
	[0050.341] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.hta") returned 0
	[0050.341] lstrlenA (lpString="*.hta") returned 5
	[0050.341] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.php7") returned 0
	[0050.341] lstrlenA (lpString="*.php7") returned 6
	[0050.341] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.db") returned 0
	[0050.341] lstrlenA (lpString="*.db") returned 4
	[0050.342] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.swf") returned 0
	[0050.342] lstrlenA (lpString="*.swf") returned 5
	[0050.342] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.eml") returned 0
	[0050.342] lstrlenA (lpString="*.eml") returned 5
	[0050.342] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.part") returned 0
	[0050.342] lstrlenA (lpString="*.part") returned 6
	[0050.342] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.nfo") returned 0
	[0050.342] lstrlenA (lpString="*.nfo") returned 5
	[0050.342] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.rsa") returned 0
	[0050.342] lstrlenA (lpString="*.rsa") returned 5
	[0050.342] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.key") returned 0
	[0050.342] lstrlenA (lpString="*.key") returned 5
	[0050.342] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.aes") returned 0
	[0050.342] lstrlenA (lpString="*.aes") returned 5
	[0050.342] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.blob") returned 0
	[0050.342] lstrlenA (lpString="*.blob") returned 6
	[0050.342] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.btc") returned 0
	[0050.342] lstrlenA (lpString="*.btc") returned 5
	[0050.342] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.wallet") returned 0
	[0050.342] lstrlenA (lpString="*.wallet") returned 8
	[0050.342] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1
	[0050.342] lstrcmpA (lpString1=".", lpString2="nb-NO") returned -1
	[0050.342] lstrcmpA (lpString1="..", lpString2="nb-NO") returned -1
	[0050.342] PathFindFileNameA (pszPath="C:\\Boot\\memtest.exe") returned="memtest.exe"
	[0050.342] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="nb-NO" | out: lpString1="C:\\Boot\\nb-NO") returned="C:\\Boot\\nb-NO"
	[0050.342] lstrlenA (lpString="C:\\Boot\\nb-NO") returned 13
	[0050.342] FindFirstFileA (in: lpFileName="C:\\Boot\\nb-NO\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x58, cFileName=".", cAlternateFileName="")) returned 0x7cb9d0
	[0050.343] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.343] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x58, cFileName="..", cAlternateFileName="")) returned 1
	[0050.343] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.343] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.343] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x7b0000, dwReserved1=0x58, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0050.343] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.343] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr.exe.mui") returned 1
	[0050.343] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr.exe.mui") returned 1
	[0050.343] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0050.343] PathFindFileNameA (pszPath="C:\\Boot\\nb-NO\\*.*") returned="*.*"
	[0050.343] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\nb-NO\\" | out: lpString1="C:\\Boot\\nb-NO\\") returned="C:\\Boot\\nb-NO\\"
	[0050.343] PathAddBackslashA (in: pszPath="C:\\Boot\\nb-NO\\" | out: pszPath="C:\\Boot\\nb-NO\\") returned=""
	[0050.343] lstrcatA (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\nb-NO\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\nb-NO\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.343] GetFileAttributesA (lpFileName="C:\\Boot\\nb-NO\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\nb-no\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0050.344] CreateFileA (lpFileName="C:\\Boot\\nb-NO\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\nb-no\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0050.345] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0050.345] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0050.346] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.346] CloseHandle (hObject=0x208) returned 1
	[0050.346] lstrcatA (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned="C:\\Boot\\nb-NO\\bootmgr.exe.mui"
	[0050.346] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0050.346] lstrlenA (lpString="*.zip") returned 5
	[0050.346] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0050.346] lstrlenA (lpString="*.rar") returned 5
	[0050.346] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0050.346] lstrlenA (lpString="*.7z") returned 4
	[0050.346] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0050.347] lstrlenA (lpString="*.tar") returned 5
	[0050.347] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0050.347] lstrlenA (lpString="*.gzip") returned 6
	[0050.347] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0050.347] lstrlenA (lpString="*.jpg") returned 5
	[0050.347] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.347] lstrlenA (lpString="*.jpeg") returned 6
	[0050.347] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0050.347] lstrlenA (lpString="*.bmp") returned 5
	[0050.347] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0050.347] lstrlenA (lpString="*.gif") returned 5
	[0050.347] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0050.347] lstrlenA (lpString="*.png") returned 5
	[0050.347] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0050.347] lstrlenA (lpString="*.doc") returned 5
	[0050.347] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0050.347] lstrlenA (lpString="*.docx") returned 6
	[0050.347] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0050.347] lstrlenA (lpString="*.xls") returned 5
	[0050.347] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.347] lstrlenA (lpString="*.xlsx") returned 6
	[0050.347] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0050.347] lstrlenA (lpString="*.ppt") returned 5
	[0050.347] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0050.347] lstrlenA (lpString="*.pptx") returned 6
	[0050.347] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0050.347] lstrlenA (lpString="*.txt") returned 5
	[0050.347] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0050.347] lstrlenA (lpString="*.pdf") returned 5
	[0050.347] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0050.347] lstrlenA (lpString="*.htm") returned 5
	[0050.347] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0050.347] lstrlenA (lpString="*.html") returned 6
	[0050.347] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0050.347] lstrlenA (lpString="*.mdb") returned 5
	[0050.347] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0050.347] lstrlenA (lpString="*.pfx") returned 5
	[0050.347] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0050.348] lstrlenA (lpString="*.md") returned 4
	[0050.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0050.348] lstrlenA (lpString="*.lnk") returned 5
	[0050.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0050.348] lstrlenA (lpString="*.torrent") returned 9
	[0050.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0050.348] lstrlenA (lpString="*.mov") returned 5
	[0050.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0050.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0050.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0050.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0050.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0050.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0050.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0050.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0050.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0050.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0050.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0050.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.au3") returned 0
	[0050.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.ahk") returned 0
	[0050.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.c") returned 0
	[0050.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.cc") returned 0
	[0050.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0
	[0050.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.cxx") returned 0
	[0050.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.c++") returned 0
	[0050.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.cs") returned 0
	[0050.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.vb") returned 0
	[0050.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.bas") returned 0
	[0050.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.csproj") returned 0
	[0050.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.manifest") returned 0
	[0050.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.php") returned 0
	[0050.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.vbe") returned 0
	[0050.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.vba") returned 0
	[0050.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.vbs") returned 0
	[0050.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.bat") returned 0
	[0050.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.cmd") returned 0
	[0050.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.js") returned 0
	[0050.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.jscript") returned 0
	[0050.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.hta") returned 0
	[0050.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.php7") returned 0
	[0050.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.db") returned 0
	[0050.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.swf") returned 0
	[0050.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.eml") returned 0
	[0050.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.part") returned 0
	[0050.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.nfo") returned 0
	[0050.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.rsa") returned 0
	[0050.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.key") returned 0
	[0050.350] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.aes") returned 0
	[0050.350] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.blob") returned 0
	[0050.350] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.btc") returned 0
	[0050.350] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.wallet") returned 0
	[0050.350] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0050.350] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.350] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="memtest.exe.mui") returned -1
	[0050.350] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="memtest.exe.mui") returned -1
	[0050.350] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1
	[0050.350] PathFindFileNameA (pszPath="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned="bootmgr.exe.mui"
	[0050.350] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\nb-NO\\" | out: lpString1="C:\\Boot\\nb-NO\\") returned="C:\\Boot\\nb-NO\\"
	[0050.350] PathAddBackslashA (in: pszPath="C:\\Boot\\nb-NO\\" | out: pszPath="C:\\Boot\\nb-NO\\") returned=""
	[0050.350] lstrcatA (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\nb-NO\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\nb-NO\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.350] GetFileAttributesA (lpFileName="C:\\Boot\\nb-NO\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\nb-no\\how-to-decrypt-files.htm")) returned 0x20
	[0050.350] lstrcatA (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\nb-NO\\memtest.exe.mui") returned="C:\\Boot\\nb-NO\\memtest.exe.mui"
	[0050.350] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.zip") returned 0
	[0050.350] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.rar") returned 0
	[0050.350] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.7z") returned 0
	[0050.350] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.tar") returned 0
	[0050.350] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.gzip") returned 0
	[0050.350] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.jpg") returned 0
	[0050.350] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.350] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.bmp") returned 0
	[0050.350] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.gif") returned 0
	[0050.350] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.png") returned 0
	[0050.350] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.doc") returned 0
	[0050.350] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.docx") returned 0
	[0050.351] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.xls") returned 0
	[0050.351] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.351] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.ppt") returned 0
	[0050.351] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.pptx") returned 0
	[0050.351] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.txt") returned 0
	[0050.351] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.pdf") returned 0
	[0050.351] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.htm") returned 0
	[0050.351] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.html") returned 0
	[0050.351] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.mdb") returned 0
	[0050.351] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.pfx") returned 0
	[0050.351] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.md") returned 0
	[0050.351] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.lnk") returned 0
	[0050.351] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.torrent") returned 0
	[0050.351] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.mov") returned 0
	[0050.351] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.3gp") returned 0
	[0050.351] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.351] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.mpg") returned 0
	[0050.351] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.flv") returned 0
	[0050.352] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0050.352] FindClose (in: hFindFile=0x7cb9d0 | out: hFindFile=0x7cb9d0) returned 1
	[0050.352] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0050.352] lstrcmpA (lpString1=".", lpString2="nl-NL") returned -1
	[0050.352] lstrcmpA (lpString1="..", lpString2="nl-NL") returned -1
	[0050.352] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0050.352] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="nl-NL" | out: lpString1="C:\\Boot\\nl-NL") returned="C:\\Boot\\nl-NL"
	[0050.352] FindFirstFileA (in: lpFileName="C:\\Boot\\nl-NL\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb750
	[0050.352] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.352] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0050.352] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.352] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.352] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0050.352] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.352] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr.exe.mui") returned 1
	[0050.352] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr.exe.mui") returned 1
	[0050.352] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0050.352] PathFindFileNameA (pszPath="C:\\Boot\\nl-NL\\*.*") returned="*.*"
	[0050.352] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\nl-NL\\" | out: lpString1="C:\\Boot\\nl-NL\\") returned="C:\\Boot\\nl-NL\\"
	[0050.352] PathAddBackslashA (in: pszPath="C:\\Boot\\nl-NL\\" | out: pszPath="C:\\Boot\\nl-NL\\") returned=""
	[0050.352] lstrcatA (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\nl-NL\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\nl-NL\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.352] GetFileAttributesA (lpFileName="C:\\Boot\\nl-NL\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\nl-nl\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0050.352] CreateFileA (lpFileName="C:\\Boot\\nl-NL\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\nl-nl\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0050.355] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0050.355] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.356] CloseHandle (hObject=0x208) returned 1
	[0050.356] lstrcatA (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned="C:\\Boot\\nl-NL\\bootmgr.exe.mui"
	[0050.356] lstrlenA (lpString="*.zip") returned 5
	[0050.356] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0050.356] lstrlenA (lpString="*.rar") returned 5
	[0050.356] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0050.356] lstrlenA (lpString="*.7z") returned 4
	[0050.356] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0050.356] lstrlenA (lpString="*.tar") returned 5
	[0050.356] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0050.356] lstrlenA (lpString="*.gzip") returned 6
	[0050.356] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0050.356] lstrlenA (lpString="*.jpg") returned 5
	[0050.356] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.356] lstrlenA (lpString="*.jpeg") returned 6
	[0050.356] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0050.356] lstrlenA (lpString="*.bmp") returned 5
	[0050.356] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0050.356] lstrlenA (lpString="*.gif") returned 5
	[0050.356] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0050.356] lstrlenA (lpString="*.png") returned 5
	[0050.356] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0050.356] lstrlenA (lpString="*.doc") returned 5
	[0050.356] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0050.356] lstrlenA (lpString="*.docx") returned 6
	[0050.356] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0050.356] lstrlenA (lpString="*.xls") returned 5
	[0050.356] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.357] lstrlenA (lpString="*.xlsx") returned 6
	[0050.357] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0050.357] lstrlenA (lpString="*.ppt") returned 5
	[0050.357] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0050.357] lstrlenA (lpString="*.pptx") returned 6
	[0050.357] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0050.357] lstrlenA (lpString="*.txt") returned 5
	[0050.357] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0050.357] lstrlenA (lpString="*.pdf") returned 5
	[0050.357] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0050.357] lstrlenA (lpString="*.htm") returned 5
	[0050.357] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0050.357] lstrlenA (lpString="*.html") returned 6
	[0050.357] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0050.357] lstrlenA (lpString="*.mdb") returned 5
	[0050.357] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0050.357] lstrlenA (lpString="*.pfx") returned 5
	[0050.357] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0050.357] lstrlenA (lpString="*.md") returned 4
	[0050.357] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0050.357] lstrlenA (lpString="*.lnk") returned 5
	[0050.357] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0050.357] lstrlenA (lpString="*.torrent") returned 9
	[0050.357] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0050.357] lstrlenA (lpString="*.mov") returned 5
	[0050.357] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0050.357] lstrlenA (lpString="*.3gp") returned 5
	[0050.357] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.357] lstrlenA (lpString="*.mpeg") returned 6
	[0050.357] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0050.357] lstrlenA (lpString="*.mpg") returned 5
	[0050.357] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0050.357] lstrlenA (lpString="*.flv") returned 5
	[0050.357] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0050.357] lstrlenA (lpString="*.avi") returned 5
	[0050.357] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0050.357] lstrlenA (lpString="*.mp4") returned 5
	[0050.357] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0050.357] lstrlenA (lpString="*.wmv") returned 5
	[0050.358] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0050.358] lstrlenA (lpString="*.mkv") returned 5
	[0050.358] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0050.358] lstrlenA (lpString="*.mp3") returned 5
	[0050.358] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0050.358] lstrlenA (lpString="*.wav") returned 5
	[0050.358] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0050.358] lstrlenA (lpString="*.flac") returned 6
	[0050.358] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0050.358] lstrlenA (lpString="*.wma") returned 5
	[0050.358] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.au3") returned 0
	[0050.358] lstrlenA (lpString="*.au3") returned 5
	[0050.358] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.ahk") returned 0
	[0050.358] lstrlenA (lpString="*.ahk") returned 5
	[0050.358] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.c") returned 0
	[0050.358] lstrlenA (lpString="*.c") returned 3
	[0050.358] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.cc") returned 0
	[0050.358] lstrlenA (lpString="*.cc") returned 4
	[0050.358] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0
	[0050.358] lstrlenA (lpString="*.cpp") returned 5
	[0050.358] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.cxx") returned 0
	[0050.358] lstrlenA (lpString="*.cxx") returned 5
	[0050.358] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.c++") returned 0
	[0050.358] lstrlenA (lpString="*.c++") returned 5
	[0050.358] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.cs") returned 0
	[0050.358] lstrlenA (lpString="*.cs") returned 4
	[0050.358] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.vb") returned 0
	[0050.358] lstrlenA (lpString="*.vb") returned 4
	[0050.358] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.bas") returned 0
	[0050.358] lstrlenA (lpString="*.bas") returned 5
	[0050.358] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.csproj") returned 0
	[0050.358] lstrlenA (lpString="*.csproj") returned 8
	[0050.358] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.358] lstrlenA (lpString="*.vbproj") returned 8
	[0050.358] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.358] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.358] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.manifest") returned 0
	[0050.359] lstrlenA (lpString="*.manifest") returned 10
	[0050.359] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.php") returned 0
	[0050.359] lstrlenA (lpString="*.php") returned 5
	[0050.359] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.vbe") returned 0
	[0050.359] lstrlenA (lpString="*.vbe") returned 5
	[0050.359] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.vba") returned 0
	[0050.359] lstrlenA (lpString="*.vba") returned 5
	[0050.359] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.vbs") returned 0
	[0050.359] lstrlenA (lpString="*.vbs") returned 5
	[0050.359] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.bat") returned 0
	[0050.359] lstrlenA (lpString="*.bat") returned 5
	[0050.359] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.cmd") returned 0
	[0050.359] lstrlenA (lpString="*.cmd") returned 5
	[0050.359] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.js") returned 0
	[0050.359] lstrlenA (lpString="*.js") returned 4
	[0050.359] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.jscript") returned 0
	[0050.359] lstrlenA (lpString="*.jscript") returned 9
	[0050.359] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.hta") returned 0
	[0050.359] lstrlenA (lpString="*.hta") returned 5
	[0050.359] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.php7") returned 0
	[0050.359] lstrlenA (lpString="*.php7") returned 6
	[0050.359] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.db") returned 0
	[0050.359] lstrlenA (lpString="*.db") returned 4
	[0050.359] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.swf") returned 0
	[0050.359] lstrlenA (lpString="*.swf") returned 5
	[0050.359] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.eml") returned 0
	[0050.359] lstrlenA (lpString="*.eml") returned 5
	[0050.359] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.part") returned 0
	[0050.359] lstrlenA (lpString="*.part") returned 6
	[0050.359] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.nfo") returned 0
	[0050.359] lstrlenA (lpString="*.nfo") returned 5
	[0050.359] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.rsa") returned 0
	[0050.359] lstrlenA (lpString="*.rsa") returned 5
	[0050.359] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.key") returned 0
	[0050.359] lstrlenA (lpString="*.key") returned 5
	[0050.359] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.aes") returned 0
	[0050.359] lstrlenA (lpString="*.aes") returned 5
	[0050.360] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.blob") returned 0
	[0050.360] lstrlenA (lpString="*.blob") returned 6
	[0050.360] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.btc") returned 0
	[0050.360] lstrlenA (lpString="*.btc") returned 5
	[0050.360] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.wallet") returned 0
	[0050.360] lstrlenA (lpString="*.wallet") returned 8
	[0050.360] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0050.360] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.360] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="memtest.exe.mui") returned -1
	[0050.360] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="memtest.exe.mui") returned -1
	[0050.360] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1
	[0050.360] PathFindFileNameA (pszPath="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned="bootmgr.exe.mui"
	[0050.360] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\nl-NL\\" | out: lpString1="C:\\Boot\\nl-NL\\") returned="C:\\Boot\\nl-NL\\"
	[0050.360] PathAddBackslashA (in: pszPath="C:\\Boot\\nl-NL\\" | out: pszPath="C:\\Boot\\nl-NL\\") returned=""
	[0050.360] lstrcatA (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\nl-NL\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\nl-NL\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.360] GetFileAttributesA (lpFileName="C:\\Boot\\nl-NL\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\nl-nl\\how-to-decrypt-files.htm")) returned 0x20
	[0050.360] lstrcatA (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\nl-NL\\memtest.exe.mui") returned="C:\\Boot\\nl-NL\\memtest.exe.mui"
	[0050.360] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.zip") returned 0
	[0050.360] lstrlenA (lpString="*.zip") returned 5
	[0050.360] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.rar") returned 0
	[0050.360] lstrlenA (lpString="*.rar") returned 5
	[0050.360] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.7z") returned 0
	[0050.360] lstrlenA (lpString="*.7z") returned 4
	[0050.360] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.tar") returned 0
	[0050.360] lstrlenA (lpString="*.tar") returned 5
	[0050.360] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.gzip") returned 0
	[0050.360] lstrlenA (lpString="*.gzip") returned 6
	[0050.360] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.jpg") returned 0
	[0050.360] lstrlenA (lpString="*.jpg") returned 5
	[0050.360] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.360] lstrlenA (lpString="*.jpeg") returned 6
	[0050.360] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.bmp") returned 0
	[0050.360] lstrlenA (lpString="*.bmp") returned 5
	[0050.360] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.gif") returned 0
	[0050.361] lstrlenA (lpString="*.gif") returned 5
	[0050.361] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.png") returned 0
	[0050.361] lstrlenA (lpString="*.png") returned 5
	[0050.361] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.doc") returned 0
	[0050.361] lstrlenA (lpString="*.doc") returned 5
	[0050.361] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.docx") returned 0
	[0050.361] lstrlenA (lpString="*.docx") returned 6
	[0050.361] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.xls") returned 0
	[0050.361] lstrlenA (lpString="*.xls") returned 5
	[0050.361] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.361] lstrlenA (lpString="*.xlsx") returned 6
	[0050.361] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.ppt") returned 0
	[0050.361] lstrlenA (lpString="*.ppt") returned 5
	[0050.361] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.pptx") returned 0
	[0050.361] lstrlenA (lpString="*.pptx") returned 6
	[0050.361] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.txt") returned 0
	[0050.361] lstrlenA (lpString="*.txt") returned 5
	[0050.361] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.pdf") returned 0
	[0050.361] lstrlenA (lpString="*.pdf") returned 5
	[0050.361] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.htm") returned 0
	[0050.361] lstrlenA (lpString="*.htm") returned 5
	[0050.361] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.html") returned 0
	[0050.361] lstrlenA (lpString="*.html") returned 6
	[0050.361] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.mdb") returned 0
	[0050.361] lstrlenA (lpString="*.mdb") returned 5
	[0050.361] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.pfx") returned 0
	[0050.361] lstrlenA (lpString="*.pfx") returned 5
	[0050.361] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.md") returned 0
	[0050.361] lstrlenA (lpString="*.md") returned 4
	[0050.361] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.lnk") returned 0
	[0050.361] lstrlenA (lpString="*.lnk") returned 5
	[0050.361] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.torrent") returned 0
	[0050.361] lstrlenA (lpString="*.torrent") returned 9
	[0050.361] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.mov") returned 0
	[0050.361] lstrlenA (lpString="*.mov") returned 5
	[0050.361] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.3gp") returned 0
	[0050.361] lstrlenA (lpString="*.3gp") returned 5
	[0050.361] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.362] lstrlenA (lpString="*.mpeg") returned 6
	[0050.362] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.mpg") returned 0
	[0050.362] lstrlenA (lpString="*.mpg") returned 5
	[0050.362] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.flv") returned 0
	[0050.362] lstrlenA (lpString="*.flv") returned 5
	[0050.362] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.avi") returned 0
	[0050.362] lstrlenA (lpString="*.avi") returned 5
	[0050.362] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.mp4") returned 0
	[0050.362] lstrlenA (lpString="*.mp4") returned 5
	[0050.362] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.wmv") returned 0
	[0050.362] lstrlenA (lpString="*.wmv") returned 5
	[0050.362] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.mkv") returned 0
	[0050.362] lstrlenA (lpString="*.mkv") returned 5
	[0050.362] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.mp3") returned 0
	[0050.362] lstrlenA (lpString="*.mp3") returned 5
	[0050.362] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.wav") returned 0
	[0050.362] lstrlenA (lpString="*.wav") returned 5
	[0050.362] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.flac") returned 0
	[0050.362] lstrlenA (lpString="*.flac") returned 6
	[0050.362] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.wma") returned 0
	[0050.362] lstrlenA (lpString="*.wma") returned 5
	[0050.362] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.au3") returned 0
	[0050.362] lstrlenA (lpString="*.au3") returned 5
	[0050.362] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.ahk") returned 0
	[0050.362] lstrlenA (lpString="*.ahk") returned 5
	[0050.362] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.c") returned 0
	[0050.362] lstrlenA (lpString="*.c") returned 3
	[0050.362] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.cc") returned 0
	[0050.362] lstrlenA (lpString="*.cc") returned 4
	[0050.362] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.cpp") returned 0
	[0050.362] lstrlenA (lpString="*.cpp") returned 5
	[0050.362] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.cxx") returned 0
	[0050.362] lstrlenA (lpString="*.cxx") returned 5
	[0050.362] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.c++") returned 0
	[0050.362] lstrlenA (lpString="*.c++") returned 5
	[0050.362] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.cs") returned 0
	[0050.362] lstrlenA (lpString="*.cs") returned 4
	[0050.362] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.vb") returned 0
	[0050.363] lstrlenA (lpString="*.vb") returned 4
	[0050.363] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.bas") returned 0
	[0050.363] lstrlenA (lpString="*.bas") returned 5
	[0050.363] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.csproj") returned 0
	[0050.363] lstrlenA (lpString="*.csproj") returned 8
	[0050.363] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.363] lstrlenA (lpString="*.vbproj") returned 8
	[0050.363] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.363] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.363] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.manifest") returned 0
	[0050.363] lstrlenA (lpString="*.manifest") returned 10
	[0050.363] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.php") returned 0
	[0050.363] lstrlenA (lpString="*.php") returned 5
	[0050.363] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.vbe") returned 0
	[0050.363] lstrlenA (lpString="*.vbe") returned 5
	[0050.363] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.vba") returned 0
	[0050.363] lstrlenA (lpString="*.vba") returned 5
	[0050.363] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.vbs") returned 0
	[0050.363] lstrlenA (lpString="*.vbs") returned 5
	[0050.363] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.bat") returned 0
	[0050.363] lstrlenA (lpString="*.bat") returned 5
	[0050.363] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.cmd") returned 0
	[0050.363] lstrlenA (lpString="*.cmd") returned 5
	[0050.363] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.js") returned 0
	[0050.363] lstrlenA (lpString="*.js") returned 4
	[0050.363] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.jscript") returned 0
	[0050.363] lstrlenA (lpString="*.jscript") returned 9
	[0050.363] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.hta") returned 0
	[0050.363] lstrlenA (lpString="*.hta") returned 5
	[0050.363] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.php7") returned 0
	[0050.363] lstrlenA (lpString="*.php7") returned 6
	[0050.363] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.db") returned 0
	[0050.363] lstrlenA (lpString="*.db") returned 4
	[0050.363] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.swf") returned 0
	[0050.363] lstrlenA (lpString="*.swf") returned 5
	[0050.363] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.eml") returned 0
	[0050.363] lstrlenA (lpString="*.eml") returned 5
	[0050.363] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.part") returned 0
	[0050.364] lstrlenA (lpString="*.part") returned 6
	[0050.364] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.nfo") returned 0
	[0050.364] lstrlenA (lpString="*.nfo") returned 5
	[0050.364] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.rsa") returned 0
	[0050.364] lstrlenA (lpString="*.rsa") returned 5
	[0050.364] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.key") returned 0
	[0050.364] lstrlenA (lpString="*.key") returned 5
	[0050.364] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.aes") returned 0
	[0050.364] lstrlenA (lpString="*.aes") returned 5
	[0050.364] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.blob") returned 0
	[0050.364] lstrlenA (lpString="*.blob") returned 6
	[0050.364] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.btc") returned 0
	[0050.364] lstrlenA (lpString="*.btc") returned 5
	[0050.364] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.wallet") returned 0
	[0050.364] lstrlenA (lpString="*.wallet") returned 8
	[0050.364] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0050.364] FindClose (in: hFindFile=0x7cb750 | out: hFindFile=0x7cb750) returned 1
	[0050.364] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0050.364] lstrcmpA (lpString1=".", lpString2="pl-PL") returned -1
	[0050.364] lstrcmpA (lpString1="..", lpString2="pl-PL") returned -1
	[0050.364] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0050.364] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="pl-PL" | out: lpString1="C:\\Boot\\pl-PL") returned="C:\\Boot\\pl-PL"
	[0050.364] lstrlenA (lpString="C:\\Boot\\pl-PL") returned 13
	[0050.364] FindFirstFileA (in: lpFileName="C:\\Boot\\pl-PL\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb590
	[0050.413] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.413] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0050.413] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.413] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.413] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0050.413] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.413] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr.exe.mui") returned 1
	[0050.413] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr.exe.mui") returned 1
	[0050.413] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0050.413] PathFindFileNameA (pszPath="C:\\Boot\\pl-PL\\*.*") returned="*.*"
	[0050.413] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\pl-PL\\" | out: lpString1="C:\\Boot\\pl-PL\\") returned="C:\\Boot\\pl-PL\\"
	[0050.413] PathAddBackslashA (in: pszPath="C:\\Boot\\pl-PL\\" | out: pszPath="C:\\Boot\\pl-PL\\") returned=""
	[0050.413] lstrcatA (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\pl-PL\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\pl-PL\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.413] GetFileAttributesA (lpFileName="C:\\Boot\\pl-PL\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\pl-pl\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0050.413] CreateFileA (lpFileName="C:\\Boot\\pl-PL\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\pl-pl\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0050.415] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0050.415] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0050.416] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.416] CloseHandle (hObject=0x208) returned 1
	[0050.416] lstrcatA (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned="C:\\Boot\\pl-PL\\bootmgr.exe.mui"
	[0050.417] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0050.417] lstrlenA (lpString="*.zip") returned 5
	[0050.417] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0050.417] lstrlenA (lpString="*.rar") returned 5
	[0050.417] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0050.417] lstrlenA (lpString="*.7z") returned 4
	[0050.417] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0050.417] lstrlenA (lpString="*.tar") returned 5
	[0050.417] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0050.417] lstrlenA (lpString="*.gzip") returned 6
	[0050.417] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0050.417] lstrlenA (lpString="*.jpg") returned 5
	[0050.417] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.417] lstrlenA (lpString="*.jpeg") returned 6
	[0050.417] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0050.417] lstrlenA (lpString="*.bmp") returned 5
	[0050.417] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0050.417] lstrlenA (lpString="*.gif") returned 5
	[0050.417] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0050.417] lstrlenA (lpString="*.png") returned 5
	[0050.417] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0050.417] lstrlenA (lpString="*.doc") returned 5
	[0050.417] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0050.417] lstrlenA (lpString="*.docx") returned 6
	[0050.417] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0050.417] lstrlenA (lpString="*.xls") returned 5
	[0050.417] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.417] lstrlenA (lpString="*.xlsx") returned 6
	[0050.417] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0050.417] lstrlenA (lpString="*.ppt") returned 5
	[0050.417] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0050.417] lstrlenA (lpString="*.pptx") returned 6
	[0050.417] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0050.417] lstrlenA (lpString="*.txt") returned 5
	[0050.417] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0050.417] lstrlenA (lpString="*.pdf") returned 5
	[0050.418] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0050.418] lstrlenA (lpString="*.htm") returned 5
	[0050.418] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0050.418] lstrlenA (lpString="*.html") returned 6
	[0050.418] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0050.418] lstrlenA (lpString="*.mdb") returned 5
	[0050.418] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0050.418] lstrlenA (lpString="*.pfx") returned 5
	[0050.418] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0050.418] lstrlenA (lpString="*.md") returned 4
	[0050.418] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0050.418] lstrlenA (lpString="*.lnk") returned 5
	[0050.418] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0050.418] lstrlenA (lpString="*.torrent") returned 9
	[0050.418] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0050.418] lstrlenA (lpString="*.mov") returned 5
	[0050.418] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0050.418] lstrlenA (lpString="*.3gp") returned 5
	[0050.418] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.418] lstrlenA (lpString="*.mpeg") returned 6
	[0050.418] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0050.418] lstrlenA (lpString="*.mpg") returned 5
	[0050.418] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0050.418] lstrlenA (lpString="*.flv") returned 5
	[0050.418] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0050.418] lstrlenA (lpString="*.avi") returned 5
	[0050.418] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0050.418] lstrlenA (lpString="*.mp4") returned 5
	[0050.418] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0050.418] lstrlenA (lpString="*.wmv") returned 5
	[0050.418] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0050.418] lstrlenA (lpString="*.mkv") returned 5
	[0050.418] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0050.418] lstrlenA (lpString="*.mp3") returned 5
	[0050.418] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0050.418] lstrlenA (lpString="*.wav") returned 5
	[0050.418] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0050.419] lstrlenA (lpString="*.flac") returned 6
	[0050.419] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0050.419] lstrlenA (lpString="*.wma") returned 5
	[0050.419] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.au3") returned 0
	[0050.419] lstrlenA (lpString="*.au3") returned 5
	[0050.419] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.ahk") returned 0
	[0050.419] lstrlenA (lpString="*.ahk") returned 5
	[0050.419] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.c") returned 0
	[0050.419] lstrlenA (lpString="*.c") returned 3
	[0050.419] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.cc") returned 0
	[0050.419] lstrlenA (lpString="*.cc") returned 4
	[0050.419] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0
	[0050.419] lstrlenA (lpString="*.cpp") returned 5
	[0050.419] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.cxx") returned 0
	[0050.419] lstrlenA (lpString="*.cxx") returned 5
	[0050.419] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.c++") returned 0
	[0050.419] lstrlenA (lpString="*.c++") returned 5
	[0050.419] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.cs") returned 0
	[0050.419] lstrlenA (lpString="*.cs") returned 4
	[0050.419] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.vb") returned 0
	[0050.419] lstrlenA (lpString="*.vb") returned 4
	[0050.419] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.bas") returned 0
	[0050.419] lstrlenA (lpString="*.bas") returned 5
	[0050.419] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.csproj") returned 0
	[0050.419] lstrlenA (lpString="*.csproj") returned 8
	[0050.419] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.419] lstrlenA (lpString="*.vbproj") returned 8
	[0050.419] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.419] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.419] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.manifest") returned 0
	[0050.419] lstrlenA (lpString="*.manifest") returned 10
	[0050.419] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.php") returned 0
	[0050.419] lstrlenA (lpString="*.php") returned 5
	[0050.419] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.vbe") returned 0
	[0050.419] lstrlenA (lpString="*.vbe") returned 5
	[0050.419] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.vba") returned 0
	[0050.419] lstrlenA (lpString="*.vba") returned 5
	[0050.420] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.vbs") returned 0
	[0050.420] lstrlenA (lpString="*.vbs") returned 5
	[0050.420] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.bat") returned 0
	[0050.420] lstrlenA (lpString="*.bat") returned 5
	[0050.420] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.cmd") returned 0
	[0050.420] lstrlenA (lpString="*.cmd") returned 5
	[0050.420] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.js") returned 0
	[0050.420] lstrlenA (lpString="*.js") returned 4
	[0050.420] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.jscript") returned 0
	[0050.420] lstrlenA (lpString="*.jscript") returned 9
	[0050.420] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.hta") returned 0
	[0050.420] lstrlenA (lpString="*.hta") returned 5
	[0050.420] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.php7") returned 0
	[0050.420] lstrlenA (lpString="*.php7") returned 6
	[0050.420] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.db") returned 0
	[0050.420] lstrlenA (lpString="*.db") returned 4
	[0050.420] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.swf") returned 0
	[0050.420] lstrlenA (lpString="*.swf") returned 5
	[0050.420] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.eml") returned 0
	[0050.420] lstrlenA (lpString="*.eml") returned 5
	[0050.420] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.part") returned 0
	[0050.420] lstrlenA (lpString="*.part") returned 6
	[0050.420] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.nfo") returned 0
	[0050.420] lstrlenA (lpString="*.nfo") returned 5
	[0050.420] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.rsa") returned 0
	[0050.420] lstrlenA (lpString="*.rsa") returned 5
	[0050.420] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.key") returned 0
	[0050.420] lstrlenA (lpString="*.key") returned 5
	[0050.420] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.aes") returned 0
	[0050.420] lstrlenA (lpString="*.aes") returned 5
	[0050.420] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.blob") returned 0
	[0050.420] lstrlenA (lpString="*.blob") returned 6
	[0050.420] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.btc") returned 0
	[0050.420] lstrlenA (lpString="*.btc") returned 5
	[0050.420] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.wallet") returned 0
	[0050.420] lstrlenA (lpString="*.wallet") returned 8
	[0050.420] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0050.420] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.421] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="memtest.exe.mui") returned -1
	[0050.421] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="memtest.exe.mui") returned -1
	[0050.421] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1
	[0050.421] PathFindFileNameA (pszPath="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned="bootmgr.exe.mui"
	[0050.421] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\pl-PL\\" | out: lpString1="C:\\Boot\\pl-PL\\") returned="C:\\Boot\\pl-PL\\"
	[0050.421] PathAddBackslashA (in: pszPath="C:\\Boot\\pl-PL\\" | out: pszPath="C:\\Boot\\pl-PL\\") returned=""
	[0050.421] lstrcatA (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\pl-PL\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\pl-PL\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.421] GetFileAttributesA (lpFileName="C:\\Boot\\pl-PL\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\pl-pl\\how-to-decrypt-files.htm")) returned 0x20
	[0050.421] lstrcatA (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\pl-PL\\memtest.exe.mui") returned="C:\\Boot\\pl-PL\\memtest.exe.mui"
	[0050.421] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.zip") returned 0
	[0050.421] lstrlenA (lpString="*.zip") returned 5
	[0050.421] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.rar") returned 0
	[0050.421] lstrlenA (lpString="*.rar") returned 5
	[0050.421] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.7z") returned 0
	[0050.421] lstrlenA (lpString="*.7z") returned 4
	[0050.421] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.tar") returned 0
	[0050.421] lstrlenA (lpString="*.tar") returned 5
	[0050.421] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.gzip") returned 0
	[0050.421] lstrlenA (lpString="*.gzip") returned 6
	[0050.421] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.jpg") returned 0
	[0050.421] lstrlenA (lpString="*.jpg") returned 5
	[0050.421] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.421] lstrlenA (lpString="*.jpeg") returned 6
	[0050.421] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.bmp") returned 0
	[0050.421] lstrlenA (lpString="*.bmp") returned 5
	[0050.421] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.gif") returned 0
	[0050.421] lstrlenA (lpString="*.gif") returned 5
	[0050.421] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.png") returned 0
	[0050.421] lstrlenA (lpString="*.png") returned 5
	[0050.421] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.doc") returned 0
	[0050.421] lstrlenA (lpString="*.doc") returned 5
	[0050.421] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.docx") returned 0
	[0050.421] lstrlenA (lpString="*.docx") returned 6
	[0050.422] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.xls") returned 0
	[0050.422] lstrlenA (lpString="*.xls") returned 5
	[0050.422] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.422] lstrlenA (lpString="*.xlsx") returned 6
	[0050.422] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.ppt") returned 0
	[0050.422] lstrlenA (lpString="*.ppt") returned 5
	[0050.422] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.pptx") returned 0
	[0050.422] lstrlenA (lpString="*.pptx") returned 6
	[0050.422] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.txt") returned 0
	[0050.422] lstrlenA (lpString="*.txt") returned 5
	[0050.422] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.pdf") returned 0
	[0050.422] lstrlenA (lpString="*.pdf") returned 5
	[0050.422] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.htm") returned 0
	[0050.422] lstrlenA (lpString="*.htm") returned 5
	[0050.422] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.html") returned 0
	[0050.422] lstrlenA (lpString="*.html") returned 6
	[0050.422] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.mdb") returned 0
	[0050.422] lstrlenA (lpString="*.mdb") returned 5
	[0050.422] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.pfx") returned 0
	[0050.422] lstrlenA (lpString="*.pfx") returned 5
	[0050.422] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.md") returned 0
	[0050.422] lstrlenA (lpString="*.md") returned 4
	[0050.422] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.lnk") returned 0
	[0050.422] lstrlenA (lpString="*.lnk") returned 5
	[0050.422] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.torrent") returned 0
	[0050.422] lstrlenA (lpString="*.torrent") returned 9
	[0050.422] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.mov") returned 0
	[0050.422] lstrlenA (lpString="*.mov") returned 5
	[0050.422] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.3gp") returned 0
	[0050.422] lstrlenA (lpString="*.3gp") returned 5
	[0050.422] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.422] lstrlenA (lpString="*.mpeg") returned 6
	[0050.422] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.mpg") returned 0
	[0050.422] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.flv") returned 0
	[0050.422] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.avi") returned 0
	[0050.423] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.mp4") returned 0
	[0050.423] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.wmv") returned 0
	[0050.423] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.mkv") returned 0
	[0050.423] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.mp3") returned 0
	[0050.423] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.wav") returned 0
	[0050.423] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.flac") returned 0
	[0050.423] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.wma") returned 0
	[0050.423] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.au3") returned 0
	[0050.423] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.ahk") returned 0
	[0050.423] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.c") returned 0
	[0050.423] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.cc") returned 0
	[0050.423] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.cpp") returned 0
	[0050.423] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.cxx") returned 0
	[0050.423] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.c++") returned 0
	[0050.423] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.cs") returned 0
	[0050.423] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.vb") returned 0
	[0050.423] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.bas") returned 0
	[0050.423] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.csproj") returned 0
	[0050.423] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.423] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.423] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.manifest") returned 0
	[0050.423] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.php") returned 0
	[0050.423] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.vbe") returned 0
	[0050.423] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.vba") returned 0
	[0050.423] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.vbs") returned 0
	[0050.423] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.bat") returned 0
	[0050.424] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.cmd") returned 0
	[0050.424] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.js") returned 0
	[0050.424] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.jscript") returned 0
	[0050.424] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.hta") returned 0
	[0050.424] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.php7") returned 0
	[0050.424] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.db") returned 0
	[0050.424] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.swf") returned 0
	[0050.424] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.eml") returned 0
	[0050.424] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.part") returned 0
	[0050.424] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.nfo") returned 0
	[0050.424] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.rsa") returned 0
	[0050.424] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.key") returned 0
	[0050.424] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.aes") returned 0
	[0050.424] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.blob") returned 0
	[0050.424] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.btc") returned 0
	[0050.424] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.wallet") returned 0
	[0050.424] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0050.424] FindClose (in: hFindFile=0x7cb590 | out: hFindFile=0x7cb590) returned 1
	[0050.424] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0050.424] lstrcmpA (lpString1=".", lpString2="pt-BR") returned -1
	[0050.424] lstrcmpA (lpString1="..", lpString2="pt-BR") returned -1
	[0050.424] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0050.424] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="pt-BR" | out: lpString1="C:\\Boot\\pt-BR") returned="C:\\Boot\\pt-BR"
	[0050.424] FindFirstFileA (in: lpFileName="C:\\Boot\\pt-BR\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbc50
	[0050.429] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.429] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0050.429] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.429] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.429] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0050.429] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.429] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr.exe.mui") returned 1
	[0050.429] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr.exe.mui") returned 1
	[0050.429] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0050.429] PathFindFileNameA (pszPath="C:\\Boot\\pt-BR\\*.*") returned="*.*"
	[0050.429] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\pt-BR\\" | out: lpString1="C:\\Boot\\pt-BR\\") returned="C:\\Boot\\pt-BR\\"
	[0050.429] PathAddBackslashA (in: pszPath="C:\\Boot\\pt-BR\\" | out: pszPath="C:\\Boot\\pt-BR\\") returned=""
	[0050.430] lstrcatA (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\pt-BR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\pt-BR\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.430] GetFileAttributesA (lpFileName="C:\\Boot\\pt-BR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\pt-br\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0050.430] CreateFileA (lpFileName="C:\\Boot\\pt-BR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\pt-br\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0050.432] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0050.432] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.433] CloseHandle (hObject=0x208) returned 1
	[0050.433] lstrcatA (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned="C:\\Boot\\pt-BR\\bootmgr.exe.mui"
	[0050.433] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0050.433] lstrlenA (lpString="*.zip") returned 5
	[0050.433] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0050.433] lstrlenA (lpString="*.rar") returned 5
	[0050.433] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0050.433] lstrlenA (lpString="*.7z") returned 4
	[0050.433] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0050.433] lstrlenA (lpString="*.tar") returned 5
	[0050.433] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0050.433] lstrlenA (lpString="*.gzip") returned 6
	[0050.433] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0050.433] lstrlenA (lpString="*.jpg") returned 5
	[0050.433] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.433] lstrlenA (lpString="*.jpeg") returned 6
	[0050.433] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0050.433] lstrlenA (lpString="*.bmp") returned 5
	[0050.433] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0050.433] lstrlenA (lpString="*.gif") returned 5
	[0050.433] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0050.433] lstrlenA (lpString="*.png") returned 5
	[0050.433] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0050.433] lstrlenA (lpString="*.doc") returned 5
	[0050.433] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0050.433] lstrlenA (lpString="*.docx") returned 6
	[0050.433] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0050.433] lstrlenA (lpString="*.xls") returned 5
	[0050.433] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.433] lstrlenA (lpString="*.xlsx") returned 6
	[0050.434] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0050.434] lstrlenA (lpString="*.ppt") returned 5
	[0050.434] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0050.434] lstrlenA (lpString="*.pptx") returned 6
	[0050.434] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0050.434] lstrlenA (lpString="*.txt") returned 5
	[0050.434] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0050.434] lstrlenA (lpString="*.pdf") returned 5
	[0050.434] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0050.434] lstrlenA (lpString="*.htm") returned 5
	[0050.434] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0050.434] lstrlenA (lpString="*.html") returned 6
	[0050.434] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0050.434] lstrlenA (lpString="*.mdb") returned 5
	[0050.434] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0050.434] lstrlenA (lpString="*.pfx") returned 5
	[0050.434] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0050.434] lstrlenA (lpString="*.md") returned 4
	[0050.434] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0050.434] lstrlenA (lpString="*.lnk") returned 5
	[0050.434] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0050.434] lstrlenA (lpString="*.torrent") returned 9
	[0050.434] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0050.434] lstrlenA (lpString="*.mov") returned 5
	[0050.434] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0050.434] lstrlenA (lpString="*.3gp") returned 5
	[0050.434] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.434] lstrlenA (lpString="*.mpeg") returned 6
	[0050.434] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0050.434] lstrlenA (lpString="*.mpg") returned 5
	[0050.434] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0050.434] lstrlenA (lpString="*.flv") returned 5
	[0050.434] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0050.434] lstrlenA (lpString="*.avi") returned 5
	[0050.434] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0050.434] lstrlenA (lpString="*.mp4") returned 5
	[0050.434] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0050.435] lstrlenA (lpString="*.wmv") returned 5
	[0050.435] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0050.435] lstrlenA (lpString="*.mkv") returned 5
	[0050.435] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0050.435] lstrlenA (lpString="*.mp3") returned 5
	[0050.435] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0050.435] lstrlenA (lpString="*.wav") returned 5
	[0050.435] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0050.435] lstrlenA (lpString="*.flac") returned 6
	[0050.435] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0050.435] lstrlenA (lpString="*.wma") returned 5
	[0050.435] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.au3") returned 0
	[0050.435] lstrlenA (lpString="*.au3") returned 5
	[0050.435] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.ahk") returned 0
	[0050.435] lstrlenA (lpString="*.ahk") returned 5
	[0050.435] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.c") returned 0
	[0050.435] lstrlenA (lpString="*.c") returned 3
	[0050.435] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.cc") returned 0
	[0050.435] lstrlenA (lpString="*.cc") returned 4
	[0050.435] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0
	[0050.435] lstrlenA (lpString="*.cpp") returned 5
	[0050.435] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.cxx") returned 0
	[0050.435] lstrlenA (lpString="*.cxx") returned 5
	[0050.435] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.c++") returned 0
	[0050.435] lstrlenA (lpString="*.c++") returned 5
	[0050.435] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.cs") returned 0
	[0050.435] lstrlenA (lpString="*.cs") returned 4
	[0050.435] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.vb") returned 0
	[0050.435] lstrlenA (lpString="*.vb") returned 4
	[0050.435] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.bas") returned 0
	[0050.435] lstrlenA (lpString="*.bas") returned 5
	[0050.435] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.csproj") returned 0
	[0050.435] lstrlenA (lpString="*.csproj") returned 8
	[0050.435] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.435] lstrlenA (lpString="*.vbproj") returned 8
	[0050.435] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.435] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.436] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.manifest") returned 0
	[0050.436] lstrlenA (lpString="*.manifest") returned 10
	[0050.436] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.php") returned 0
	[0050.436] lstrlenA (lpString="*.php") returned 5
	[0050.436] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.vbe") returned 0
	[0050.436] lstrlenA (lpString="*.vbe") returned 5
	[0050.436] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.vba") returned 0
	[0050.436] lstrlenA (lpString="*.vba") returned 5
	[0050.436] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.vbs") returned 0
	[0050.436] lstrlenA (lpString="*.vbs") returned 5
	[0050.436] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.bat") returned 0
	[0050.436] lstrlenA (lpString="*.bat") returned 5
	[0050.436] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.cmd") returned 0
	[0050.436] lstrlenA (lpString="*.cmd") returned 5
	[0050.436] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.js") returned 0
	[0050.436] lstrlenA (lpString="*.js") returned 4
	[0050.436] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.jscript") returned 0
	[0050.436] lstrlenA (lpString="*.jscript") returned 9
	[0050.436] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.hta") returned 0
	[0050.436] lstrlenA (lpString="*.hta") returned 5
	[0050.436] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.php7") returned 0
	[0050.436] lstrlenA (lpString="*.php7") returned 6
	[0050.436] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.db") returned 0
	[0050.436] lstrlenA (lpString="*.db") returned 4
	[0050.436] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.swf") returned 0
	[0050.436] lstrlenA (lpString="*.swf") returned 5
	[0050.436] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.eml") returned 0
	[0050.436] lstrlenA (lpString="*.eml") returned 5
	[0050.436] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.part") returned 0
	[0050.436] lstrlenA (lpString="*.part") returned 6
	[0050.436] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.nfo") returned 0
	[0050.436] lstrlenA (lpString="*.nfo") returned 5
	[0050.436] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.rsa") returned 0
	[0050.436] lstrlenA (lpString="*.rsa") returned 5
	[0050.436] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.key") returned 0
	[0050.436] lstrlenA (lpString="*.key") returned 5
	[0050.436] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.aes") returned 0
	[0050.436] lstrlenA (lpString="*.aes") returned 5
	[0050.437] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.blob") returned 0
	[0050.437] lstrlenA (lpString="*.blob") returned 6
	[0050.437] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.btc") returned 0
	[0050.437] lstrlenA (lpString="*.btc") returned 5
	[0050.437] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.wallet") returned 0
	[0050.437] lstrlenA (lpString="*.wallet") returned 8
	[0050.437] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0050.437] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.437] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="memtest.exe.mui") returned -1
	[0050.437] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="memtest.exe.mui") returned -1
	[0050.437] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1
	[0050.437] PathFindFileNameA (pszPath="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned="bootmgr.exe.mui"
	[0050.437] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\pt-BR\\" | out: lpString1="C:\\Boot\\pt-BR\\") returned="C:\\Boot\\pt-BR\\"
	[0050.437] PathAddBackslashA (in: pszPath="C:\\Boot\\pt-BR\\" | out: pszPath="C:\\Boot\\pt-BR\\") returned=""
	[0050.437] lstrcatA (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\pt-BR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\pt-BR\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.437] GetFileAttributesA (lpFileName="C:\\Boot\\pt-BR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\pt-br\\how-to-decrypt-files.htm")) returned 0x20
	[0050.437] lstrcatA (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\pt-BR\\memtest.exe.mui") returned="C:\\Boot\\pt-BR\\memtest.exe.mui"
	[0050.437] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.zip") returned 0
	[0050.437] lstrlenA (lpString="*.zip") returned 5
	[0050.437] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.rar") returned 0
	[0050.437] lstrlenA (lpString="*.rar") returned 5
	[0050.437] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.7z") returned 0
	[0050.437] lstrlenA (lpString="*.7z") returned 4
	[0050.437] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.tar") returned 0
	[0050.437] lstrlenA (lpString="*.tar") returned 5
	[0050.437] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.gzip") returned 0
	[0050.437] lstrlenA (lpString="*.gzip") returned 6
	[0050.437] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.jpg") returned 0
	[0050.437] lstrlenA (lpString="*.jpg") returned 5
	[0050.437] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.437] lstrlenA (lpString="*.jpeg") returned 6
	[0050.437] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.bmp") returned 0
	[0050.437] lstrlenA (lpString="*.bmp") returned 5
	[0050.437] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.gif") returned 0
	[0050.438] lstrlenA (lpString="*.gif") returned 5
	[0050.438] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.png") returned 0
	[0050.438] lstrlenA (lpString="*.png") returned 5
	[0050.438] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.doc") returned 0
	[0050.438] lstrlenA (lpString="*.doc") returned 5
	[0050.438] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.docx") returned 0
	[0050.438] lstrlenA (lpString="*.docx") returned 6
	[0050.438] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.xls") returned 0
	[0050.438] lstrlenA (lpString="*.xls") returned 5
	[0050.438] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.438] lstrlenA (lpString="*.xlsx") returned 6
	[0050.438] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.ppt") returned 0
	[0050.438] lstrlenA (lpString="*.ppt") returned 5
	[0050.438] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.pptx") returned 0
	[0050.438] lstrlenA (lpString="*.pptx") returned 6
	[0050.438] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.txt") returned 0
	[0050.438] lstrlenA (lpString="*.txt") returned 5
	[0050.438] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.pdf") returned 0
	[0050.438] lstrlenA (lpString="*.pdf") returned 5
	[0050.438] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.htm") returned 0
	[0050.438] lstrlenA (lpString="*.htm") returned 5
	[0050.438] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.html") returned 0
	[0050.438] lstrlenA (lpString="*.html") returned 6
	[0050.438] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.mdb") returned 0
	[0050.438] lstrlenA (lpString="*.mdb") returned 5
	[0050.438] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.pfx") returned 0
	[0050.438] lstrlenA (lpString="*.pfx") returned 5
	[0050.438] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.md") returned 0
	[0050.438] lstrlenA (lpString="*.md") returned 4
	[0050.438] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.lnk") returned 0
	[0050.438] lstrlenA (lpString="*.lnk") returned 5
	[0050.438] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.torrent") returned 0
	[0050.438] lstrlenA (lpString="*.torrent") returned 9
	[0050.438] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.mov") returned 0
	[0050.438] lstrlenA (lpString="*.mov") returned 5
	[0050.438] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.3gp") returned 0
	[0050.438] lstrlenA (lpString="*.3gp") returned 5
	[0050.439] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.439] lstrlenA (lpString="*.mpeg") returned 6
	[0050.439] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.mpg") returned 0
	[0050.439] lstrlenA (lpString="*.mpg") returned 5
	[0050.439] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.flv") returned 0
	[0050.439] lstrlenA (lpString="*.flv") returned 5
	[0050.439] lstrlenA (lpString="*.avi") returned 5
	[0050.439] lstrlenA (lpString="*.mp4") returned 5
	[0050.439] lstrlenA (lpString="*.wmv") returned 5
	[0050.439] lstrlenA (lpString="*.mkv") returned 5
	[0050.439] lstrlenA (lpString="*.mp3") returned 5
	[0050.439] lstrlenA (lpString="*.wav") returned 5
	[0050.439] lstrlenA (lpString="*.flac") returned 6
	[0050.439] lstrlenA (lpString="*.wma") returned 5
	[0050.439] lstrlenA (lpString="*.au3") returned 5
	[0050.439] lstrlenA (lpString="*.ahk") returned 5
	[0050.439] lstrlenA (lpString="*.c") returned 3
	[0050.439] lstrlenA (lpString="*.cc") returned 4
	[0050.439] lstrlenA (lpString="*.cpp") returned 5
	[0050.439] lstrlenA (lpString="*.cxx") returned 5
	[0050.439] lstrlenA (lpString="*.c++") returned 5
	[0050.440] lstrlenA (lpString="*.cs") returned 4
	[0050.440] lstrlenA (lpString="*.vb") returned 4
	[0050.440] lstrlenA (lpString="*.bas") returned 5
	[0050.440] lstrlenA (lpString="*.csproj") returned 8
	[0050.440] lstrlenA (lpString="*.vbproj") returned 8
	[0050.440] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.440] lstrlenA (lpString="*.manifest") returned 10
	[0050.440] lstrlenA (lpString="*.php") returned 5
	[0050.440] lstrlenA (lpString="*.vbe") returned 5
	[0050.440] lstrlenA (lpString="*.vba") returned 5
	[0050.440] lstrlenA (lpString="*.vbs") returned 5
	[0050.440] lstrlenA (lpString="*.bat") returned 5
	[0050.440] lstrlenA (lpString="*.cmd") returned 5
	[0050.440] lstrlenA (lpString="*.js") returned 4
	[0050.440] lstrlenA (lpString="*.jscript") returned 9
	[0050.440] lstrlenA (lpString="*.hta") returned 5
	[0050.440] lstrlenA (lpString="*.php7") returned 6
	[0050.440] lstrlenA (lpString="*.db") returned 4
	[0050.440] lstrlenA (lpString="*.swf") returned 5
	[0050.440] lstrlenA (lpString="*.eml") returned 5
	[0050.440] lstrlenA (lpString="*.part") returned 6
	[0050.440] lstrlenA (lpString="*.nfo") returned 5
	[0050.440] lstrlenA (lpString="*.rsa") returned 5
	[0050.440] lstrlenA (lpString="*.key") returned 5
	[0050.440] lstrlenA (lpString="*.aes") returned 5
	[0050.440] lstrlenA (lpString="*.blob") returned 6
	[0050.440] lstrlenA (lpString="*.btc") returned 5
	[0050.440] lstrlenA (lpString="*.wallet") returned 8
	[0050.441] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0050.441] FindClose (in: hFindFile=0x7cbc50 | out: hFindFile=0x7cbc50) returned 1
	[0050.441] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0050.441] lstrcmpA (lpString1=".", lpString2="pt-PT") returned -1
	[0050.441] lstrcmpA (lpString1="..", lpString2="pt-PT") returned -1
	[0050.441] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0050.441] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="pt-PT" | out: lpString1="C:\\Boot\\pt-PT") returned="C:\\Boot\\pt-PT"
	[0050.441] lstrlenA (lpString="C:\\Boot\\pt-PT") returned 13
	[0050.441] FindFirstFileA (in: lpFileName="C:\\Boot\\pt-PT\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbb90
	[0050.441] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.441] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0050.442] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.442] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.442] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0050.442] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.442] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr.exe.mui") returned 1
	[0050.442] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr.exe.mui") returned 1
	[0050.442] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0050.442] PathFindFileNameA (pszPath="C:\\Boot\\pt-PT\\*.*") returned="*.*"
	[0050.442] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\pt-PT\\" | out: lpString1="C:\\Boot\\pt-PT\\") returned="C:\\Boot\\pt-PT\\"
	[0050.442] PathAddBackslashA (in: pszPath="C:\\Boot\\pt-PT\\" | out: pszPath="C:\\Boot\\pt-PT\\") returned=""
	[0050.442] lstrcatA (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\pt-PT\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\pt-PT\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.442] GetFileAttributesA (lpFileName="C:\\Boot\\pt-PT\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\pt-pt\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0050.442] CreateFileA (lpFileName="C:\\Boot\\pt-PT\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\pt-pt\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0050.457] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0050.457] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0050.458] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.458] CloseHandle (hObject=0x208) returned 1
	[0050.458] lstrcatA (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned="C:\\Boot\\pt-PT\\bootmgr.exe.mui"
	[0050.458] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0050.470] lstrlenA (lpString="*.zip") returned 5
	[0050.470] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0050.470] lstrlenA (lpString="*.rar") returned 5
	[0050.470] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0050.470] lstrlenA (lpString="*.7z") returned 4
	[0050.470] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0050.470] lstrlenA (lpString="*.tar") returned 5
	[0050.470] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0050.471] lstrlenA (lpString="*.gzip") returned 6
	[0050.471] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0050.471] lstrlenA (lpString="*.jpg") returned 5
	[0050.471] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.471] lstrlenA (lpString="*.jpeg") returned 6
	[0050.471] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0050.471] lstrlenA (lpString="*.bmp") returned 5
	[0050.471] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0050.471] lstrlenA (lpString="*.gif") returned 5
	[0050.471] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0050.471] lstrlenA (lpString="*.png") returned 5
	[0050.471] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0050.471] lstrlenA (lpString="*.doc") returned 5
	[0050.471] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0050.471] lstrlenA (lpString="*.docx") returned 6
	[0050.471] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0050.471] lstrlenA (lpString="*.xls") returned 5
	[0050.471] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.471] lstrlenA (lpString="*.xlsx") returned 6
	[0050.471] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0050.471] lstrlenA (lpString="*.ppt") returned 5
	[0050.471] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0050.471] lstrlenA (lpString="*.pptx") returned 6
	[0050.471] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0050.471] lstrlenA (lpString="*.txt") returned 5
	[0050.471] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0050.471] lstrlenA (lpString="*.pdf") returned 5
	[0050.471] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0050.471] lstrlenA (lpString="*.htm") returned 5
	[0050.471] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0050.471] lstrlenA (lpString="*.html") returned 6
	[0050.471] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0050.471] lstrlenA (lpString="*.mdb") returned 5
	[0050.471] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0050.471] lstrlenA (lpString="*.pfx") returned 5
	[0050.471] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0050.471] lstrlenA (lpString="*.md") returned 4
	[0050.471] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0050.472] lstrlenA (lpString="*.lnk") returned 5
	[0050.472] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0050.472] lstrlenA (lpString="*.torrent") returned 9
	[0050.472] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0050.472] lstrlenA (lpString="*.mov") returned 5
	[0050.472] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0050.472] lstrlenA (lpString="*.3gp") returned 5
	[0050.472] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.472] lstrlenA (lpString="*.mpeg") returned 6
	[0050.472] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0050.472] lstrlenA (lpString="*.mpg") returned 5
	[0050.472] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0050.472] lstrlenA (lpString="*.flv") returned 5
	[0050.472] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0050.472] lstrlenA (lpString="*.avi") returned 5
	[0050.472] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0050.472] lstrlenA (lpString="*.mp4") returned 5
	[0050.472] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0050.472] lstrlenA (lpString="*.wmv") returned 5
	[0050.472] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0050.472] lstrlenA (lpString="*.mkv") returned 5
	[0050.472] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0050.472] lstrlenA (lpString="*.mp3") returned 5
	[0050.472] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0050.472] lstrlenA (lpString="*.wav") returned 5
	[0050.472] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0050.472] lstrlenA (lpString="*.flac") returned 6
	[0050.472] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0050.472] lstrlenA (lpString="*.wma") returned 5
	[0050.472] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.au3") returned 0
	[0050.472] lstrlenA (lpString="*.au3") returned 5
	[0050.472] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.ahk") returned 0
	[0050.472] lstrlenA (lpString="*.ahk") returned 5
	[0050.472] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.c") returned 0
	[0050.472] lstrlenA (lpString="*.c") returned 3
	[0050.472] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.cc") returned 0
	[0050.472] lstrlenA (lpString="*.cc") returned 4
	[0050.473] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0
	[0050.473] lstrlenA (lpString="*.cpp") returned 5
	[0050.473] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.cxx") returned 0
	[0050.473] lstrlenA (lpString="*.cxx") returned 5
	[0050.473] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.c++") returned 0
	[0050.473] lstrlenA (lpString="*.c++") returned 5
	[0050.473] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.cs") returned 0
	[0050.473] lstrlenA (lpString="*.cs") returned 4
	[0050.473] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.vb") returned 0
	[0050.473] lstrlenA (lpString="*.vb") returned 4
	[0050.473] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.bas") returned 0
	[0050.473] lstrlenA (lpString="*.bas") returned 5
	[0050.473] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.csproj") returned 0
	[0050.473] lstrlenA (lpString="*.csproj") returned 8
	[0050.473] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.473] lstrlenA (lpString="*.vbproj") returned 8
	[0050.473] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.473] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.473] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.manifest") returned 0
	[0050.473] lstrlenA (lpString="*.manifest") returned 10
	[0050.473] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.php") returned 0
	[0050.473] lstrlenA (lpString="*.php") returned 5
	[0050.473] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.vbe") returned 0
	[0050.473] lstrlenA (lpString="*.vbe") returned 5
	[0050.473] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.vba") returned 0
	[0050.473] lstrlenA (lpString="*.vba") returned 5
	[0050.473] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.vbs") returned 0
	[0050.473] lstrlenA (lpString="*.vbs") returned 5
	[0050.473] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.bat") returned 0
	[0050.473] lstrlenA (lpString="*.bat") returned 5
	[0050.473] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.cmd") returned 0
	[0050.473] lstrlenA (lpString="*.cmd") returned 5
	[0050.473] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.js") returned 0
	[0050.473] lstrlenA (lpString="*.js") returned 4
	[0050.473] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.jscript") returned 0
	[0050.473] lstrlenA (lpString="*.jscript") returned 9
	[0050.473] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.hta") returned 0
	[0050.473] lstrlenA (lpString="*.hta") returned 5
	[0050.474] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.php7") returned 0
	[0050.474] lstrlenA (lpString="*.php7") returned 6
	[0050.474] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.db") returned 0
	[0050.474] lstrlenA (lpString="*.db") returned 4
	[0050.474] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.swf") returned 0
	[0050.474] lstrlenA (lpString="*.swf") returned 5
	[0050.474] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.eml") returned 0
	[0050.474] lstrlenA (lpString="*.eml") returned 5
	[0050.474] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.part") returned 0
	[0050.474] lstrlenA (lpString="*.part") returned 6
	[0050.474] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.nfo") returned 0
	[0050.474] lstrlenA (lpString="*.nfo") returned 5
	[0050.474] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.rsa") returned 0
	[0050.474] lstrlenA (lpString="*.rsa") returned 5
	[0050.474] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.key") returned 0
	[0050.474] lstrlenA (lpString="*.key") returned 5
	[0050.474] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.aes") returned 0
	[0050.474] lstrlenA (lpString="*.aes") returned 5
	[0050.474] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.blob") returned 0
	[0050.474] lstrlenA (lpString="*.blob") returned 6
	[0050.474] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.btc") returned 0
	[0050.474] lstrlenA (lpString="*.btc") returned 5
	[0050.474] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.wallet") returned 0
	[0050.474] lstrlenA (lpString="*.wallet") returned 8
	[0050.474] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0050.474] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.475] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="memtest.exe.mui") returned -1
	[0050.475] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="memtest.exe.mui") returned -1
	[0050.475] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1
	[0050.475] PathFindFileNameA (pszPath="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned="bootmgr.exe.mui"
	[0050.475] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\pt-PT\\" | out: lpString1="C:\\Boot\\pt-PT\\") returned="C:\\Boot\\pt-PT\\"
	[0050.475] PathAddBackslashA (in: pszPath="C:\\Boot\\pt-PT\\" | out: pszPath="C:\\Boot\\pt-PT\\") returned=""
	[0050.475] lstrcatA (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\pt-PT\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\pt-PT\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.475] GetFileAttributesA (lpFileName="C:\\Boot\\pt-PT\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\pt-pt\\how-to-decrypt-files.htm")) returned 0x20
	[0050.475] lstrcatA (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\pt-PT\\memtest.exe.mui") returned="C:\\Boot\\pt-PT\\memtest.exe.mui"
	[0050.475] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.zip") returned 0
	[0050.475] lstrlenA (lpString="*.zip") returned 5
	[0050.475] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.rar") returned 0
	[0050.475] lstrlenA (lpString="*.rar") returned 5
	[0050.475] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.7z") returned 0
	[0050.475] lstrlenA (lpString="*.7z") returned 4
	[0050.475] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.tar") returned 0
	[0050.475] lstrlenA (lpString="*.tar") returned 5
	[0050.475] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.gzip") returned 0
	[0050.475] lstrlenA (lpString="*.gzip") returned 6
	[0050.475] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.jpg") returned 0
	[0050.475] lstrlenA (lpString="*.jpg") returned 5
	[0050.475] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.475] lstrlenA (lpString="*.jpeg") returned 6
	[0050.475] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.bmp") returned 0
	[0050.475] lstrlenA (lpString="*.bmp") returned 5
	[0050.475] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.gif") returned 0
	[0050.475] lstrlenA (lpString="*.gif") returned 5
	[0050.475] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.png") returned 0
	[0050.475] lstrlenA (lpString="*.png") returned 5
	[0050.475] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.doc") returned 0
	[0050.476] lstrlenA (lpString="*.doc") returned 5
	[0050.476] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.docx") returned 0
	[0050.476] lstrlenA (lpString="*.docx") returned 6
	[0050.476] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.xls") returned 0
	[0050.476] lstrlenA (lpString="*.xls") returned 5
	[0050.476] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.476] lstrlenA (lpString="*.xlsx") returned 6
	[0050.476] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.ppt") returned 0
	[0050.476] lstrlenA (lpString="*.ppt") returned 5
	[0050.476] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.pptx") returned 0
	[0050.476] lstrlenA (lpString="*.pptx") returned 6
	[0050.476] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.txt") returned 0
	[0050.476] lstrlenA (lpString="*.txt") returned 5
	[0050.476] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.pdf") returned 0
	[0050.476] lstrlenA (lpString="*.pdf") returned 5
	[0050.476] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.htm") returned 0
	[0050.476] lstrlenA (lpString="*.htm") returned 5
	[0050.476] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.html") returned 0
	[0050.476] lstrlenA (lpString="*.html") returned 6
	[0050.476] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.mdb") returned 0
	[0050.476] lstrlenA (lpString="*.mdb") returned 5
	[0050.476] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.pfx") returned 0
	[0050.476] lstrlenA (lpString="*.pfx") returned 5
	[0050.476] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.md") returned 0
	[0050.476] lstrlenA (lpString="*.md") returned 4
	[0050.476] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.lnk") returned 0
	[0050.476] lstrlenA (lpString="*.lnk") returned 5
	[0050.476] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.torrent") returned 0
	[0050.476] lstrlenA (lpString="*.torrent") returned 9
	[0050.476] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.mov") returned 0
	[0050.476] lstrlenA (lpString="*.mov") returned 5
	[0050.476] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.3gp") returned 0
	[0050.476] lstrlenA (lpString="*.3gp") returned 5
	[0050.476] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.476] lstrlenA (lpString="*.mpeg") returned 6
	[0050.476] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.mpg") returned 0
	[0050.477] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.flv") returned 0
	[0050.477] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.avi") returned 0
	[0050.477] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.mp4") returned 0
	[0050.477] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.wmv") returned 0
	[0050.477] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.mkv") returned 0
	[0050.477] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.mp3") returned 0
	[0050.477] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.wav") returned 0
	[0050.477] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.flac") returned 0
	[0050.477] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.wma") returned 0
	[0050.477] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.au3") returned 0
	[0050.477] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.ahk") returned 0
	[0050.477] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.c") returned 0
	[0050.477] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.cc") returned 0
	[0050.477] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.cpp") returned 0
	[0050.477] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.cxx") returned 0
	[0050.477] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.c++") returned 0
	[0050.477] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.cs") returned 0
	[0050.477] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.vb") returned 0
	[0050.477] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.bas") returned 0
	[0050.477] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.csproj") returned 0
	[0050.477] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.477] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.477] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.manifest") returned 0
	[0050.477] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.php") returned 0
	[0050.477] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.vbe") returned 0
	[0050.477] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.vba") returned 0
	[0050.478] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.vbs") returned 0
	[0050.478] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.bat") returned 0
	[0050.478] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.cmd") returned 0
	[0050.478] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.js") returned 0
	[0050.478] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.jscript") returned 0
	[0050.478] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.hta") returned 0
	[0050.478] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.php7") returned 0
	[0050.478] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.db") returned 0
	[0050.478] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.swf") returned 0
	[0050.478] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.eml") returned 0
	[0050.478] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.part") returned 0
	[0050.478] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.nfo") returned 0
	[0050.478] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.rsa") returned 0
	[0050.478] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.key") returned 0
	[0050.478] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.aes") returned 0
	[0050.478] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.blob") returned 0
	[0050.478] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.btc") returned 0
	[0050.478] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.wallet") returned 0
	[0050.478] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0050.478] FindClose (in: hFindFile=0x7cbb90 | out: hFindFile=0x7cbb90) returned 1
	[0050.478] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="qps-ploc", cAlternateFileName="")) returned 1
	[0050.478] lstrcmpA (lpString1=".", lpString2="qps-ploc") returned -1
	[0050.478] lstrcmpA (lpString1="..", lpString2="qps-ploc") returned -1
	[0050.478] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0050.479] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="qps-ploc" | out: lpString1="C:\\Boot\\qps-ploc") returned="C:\\Boot\\qps-ploc"
	[0050.479] FindFirstFileA (in: lpFileName="C:\\Boot\\qps-ploc\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb690
	[0050.479] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.479] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0050.479] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.479] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.479] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0050.479] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.479] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr.exe.mui") returned 1
	[0050.479] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr.exe.mui") returned 1
	[0050.479] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0050.479] PathFindFileNameA (pszPath="C:\\Boot\\qps-ploc\\*.*") returned="*.*"
	[0050.479] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\qps-ploc\\" | out: lpString1="C:\\Boot\\qps-ploc\\") returned="C:\\Boot\\qps-ploc\\"
	[0050.479] PathAddBackslashA (in: pszPath="C:\\Boot\\qps-ploc\\" | out: pszPath="C:\\Boot\\qps-ploc\\") returned=""
	[0050.479] lstrcatA (in: lpString1="C:\\Boot\\qps-ploc\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\qps-ploc\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\qps-ploc\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.479] GetFileAttributesA (lpFileName="C:\\Boot\\qps-ploc\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\qps-ploc\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0050.479] CreateFileA (lpFileName="C:\\Boot\\qps-ploc\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\qps-ploc\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0050.539] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0050.540] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.540] CloseHandle (hObject=0x208) returned 1
	[0050.540] lstrcatA (in: lpString1="C:\\Boot\\qps-ploc\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\qps-ploc\\bootmgr.exe.mui") returned="C:\\Boot\\qps-ploc\\bootmgr.exe.mui"
	[0050.540] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0050.540] lstrlenA (lpString="*.zip") returned 5
	[0050.540] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0050.540] lstrlenA (lpString="*.rar") returned 5
	[0050.540] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0050.540] lstrlenA (lpString="*.7z") returned 4
	[0050.540] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0050.540] lstrlenA (lpString="*.tar") returned 5
	[0050.540] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0050.541] lstrlenA (lpString="*.gzip") returned 6
	[0050.541] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0050.541] lstrlenA (lpString="*.jpg") returned 5
	[0050.541] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.541] lstrlenA (lpString="*.jpeg") returned 6
	[0050.541] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0050.541] lstrlenA (lpString="*.bmp") returned 5
	[0050.541] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0050.541] lstrlenA (lpString="*.gif") returned 5
	[0050.541] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0050.541] lstrlenA (lpString="*.png") returned 5
	[0050.541] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0050.541] lstrlenA (lpString="*.doc") returned 5
	[0050.541] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0050.541] lstrlenA (lpString="*.docx") returned 6
	[0050.541] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0050.541] lstrlenA (lpString="*.xls") returned 5
	[0050.541] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.541] lstrlenA (lpString="*.xlsx") returned 6
	[0050.541] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0050.541] lstrlenA (lpString="*.ppt") returned 5
	[0050.541] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0050.541] lstrlenA (lpString="*.pptx") returned 6
	[0050.541] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0050.541] lstrlenA (lpString="*.txt") returned 5
	[0050.541] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0050.541] lstrlenA (lpString="*.pdf") returned 5
	[0050.541] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0050.541] lstrlenA (lpString="*.htm") returned 5
	[0050.541] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0050.541] lstrlenA (lpString="*.html") returned 6
	[0050.541] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0050.541] lstrlenA (lpString="*.mdb") returned 5
	[0050.541] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0050.542] lstrlenA (lpString="*.pfx") returned 5
	[0050.542] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0050.542] lstrlenA (lpString="*.md") returned 4
	[0050.542] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0050.542] lstrlenA (lpString="*.lnk") returned 5
	[0050.542] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0050.542] lstrlenA (lpString="*.torrent") returned 9
	[0050.542] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0050.542] lstrlenA (lpString="*.mov") returned 5
	[0050.542] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0050.542] lstrlenA (lpString="*.3gp") returned 5
	[0050.542] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.542] lstrlenA (lpString="*.mpeg") returned 6
	[0050.542] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0050.542] lstrlenA (lpString="*.mpg") returned 5
	[0050.542] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0050.542] lstrlenA (lpString="*.flv") returned 5
	[0050.542] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0050.542] lstrlenA (lpString="*.avi") returned 5
	[0050.542] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0050.542] lstrlenA (lpString="*.mp4") returned 5
	[0050.542] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0050.542] lstrlenA (lpString="*.wmv") returned 5
	[0050.542] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0050.542] lstrlenA (lpString="*.mkv") returned 5
	[0050.542] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0050.542] lstrlenA (lpString="*.mp3") returned 5
	[0050.542] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0050.542] lstrlenA (lpString="*.wav") returned 5
	[0050.542] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0050.542] lstrlenA (lpString="*.flac") returned 6
	[0050.542] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0050.542] lstrlenA (lpString="*.wma") returned 5
	[0050.542] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.au3") returned 0
	[0050.542] lstrlenA (lpString="*.au3") returned 5
	[0050.542] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.ahk") returned 0
	[0050.542] lstrlenA (lpString="*.ahk") returned 5
	[0050.543] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.c") returned 0
	[0050.543] lstrlenA (lpString="*.c") returned 3
	[0050.543] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.cc") returned 0
	[0050.543] lstrlenA (lpString="*.cc") returned 4
	[0050.543] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0
	[0050.543] lstrlenA (lpString="*.cpp") returned 5
	[0050.543] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.cxx") returned 0
	[0050.543] lstrlenA (lpString="*.cxx") returned 5
	[0050.543] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.c++") returned 0
	[0050.543] lstrlenA (lpString="*.c++") returned 5
	[0050.543] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.cs") returned 0
	[0050.543] lstrlenA (lpString="*.cs") returned 4
	[0050.543] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.vb") returned 0
	[0050.543] lstrlenA (lpString="*.vb") returned 4
	[0050.543] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.bas") returned 0
	[0050.543] lstrlenA (lpString="*.bas") returned 5
	[0050.543] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.csproj") returned 0
	[0050.543] lstrlenA (lpString="*.csproj") returned 8
	[0050.543] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.543] lstrlenA (lpString="*.vbproj") returned 8
	[0050.543] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.543] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.543] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.manifest") returned 0
	[0050.543] lstrlenA (lpString="*.manifest") returned 10
	[0050.543] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.php") returned 0
	[0050.543] lstrlenA (lpString="*.php") returned 5
	[0050.543] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.vbe") returned 0
	[0050.543] lstrlenA (lpString="*.vbe") returned 5
	[0050.543] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.vba") returned 0
	[0050.543] lstrlenA (lpString="*.vba") returned 5
	[0050.543] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.vbs") returned 0
	[0050.543] lstrlenA (lpString="*.vbs") returned 5
	[0050.543] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.bat") returned 0
	[0050.543] lstrlenA (lpString="*.bat") returned 5
	[0050.543] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.cmd") returned 0
	[0050.543] lstrlenA (lpString="*.cmd") returned 5
	[0050.543] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.js") returned 0
	[0050.544] lstrlenA (lpString="*.js") returned 4
	[0050.544] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.jscript") returned 0
	[0050.544] lstrlenA (lpString="*.jscript") returned 9
	[0050.544] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.hta") returned 0
	[0050.544] lstrlenA (lpString="*.hta") returned 5
	[0050.544] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.php7") returned 0
	[0050.544] lstrlenA (lpString="*.php7") returned 6
	[0050.544] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.db") returned 0
	[0050.544] lstrlenA (lpString="*.db") returned 4
	[0050.544] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.swf") returned 0
	[0050.544] lstrlenA (lpString="*.swf") returned 5
	[0050.544] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.eml") returned 0
	[0050.544] lstrlenA (lpString="*.eml") returned 5
	[0050.544] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.part") returned 0
	[0050.544] lstrlenA (lpString="*.part") returned 6
	[0050.544] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.nfo") returned 0
	[0050.544] lstrlenA (lpString="*.nfo") returned 5
	[0050.544] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.rsa") returned 0
	[0050.544] lstrlenA (lpString="*.rsa") returned 5
	[0050.544] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.key") returned 0
	[0050.544] lstrlenA (lpString="*.key") returned 5
	[0050.544] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.aes") returned 0
	[0050.544] lstrlenA (lpString="*.aes") returned 5
	[0050.544] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.blob") returned 0
	[0050.544] lstrlenA (lpString="*.blob") returned 6
	[0050.544] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.btc") returned 0
	[0050.544] lstrlenA (lpString="*.btc") returned 5
	[0050.544] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.wallet") returned 0
	[0050.544] lstrlenA (lpString="*.wallet") returned 8
	[0050.544] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0050.544] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.544] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="memtest.exe.mui") returned -1
	[0050.544] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="memtest.exe.mui") returned -1
	[0050.544] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1
	[0050.544] PathFindFileNameA (pszPath="C:\\Boot\\qps-ploc\\bootmgr.exe.mui") returned="bootmgr.exe.mui"
	[0050.544] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\qps-ploc\\" | out: lpString1="C:\\Boot\\qps-ploc\\") returned="C:\\Boot\\qps-ploc\\"
	[0050.544] PathAddBackslashA (in: pszPath="C:\\Boot\\qps-ploc\\" | out: pszPath="C:\\Boot\\qps-ploc\\") returned=""
	[0050.545] lstrcatA (in: lpString1="C:\\Boot\\qps-ploc\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\qps-ploc\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\qps-ploc\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.545] GetFileAttributesA (lpFileName="C:\\Boot\\qps-ploc\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\qps-ploc\\how-to-decrypt-files.htm")) returned 0x20
	[0050.545] lstrcatA (in: lpString1="C:\\Boot\\qps-ploc\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\qps-ploc\\memtest.exe.mui") returned="C:\\Boot\\qps-ploc\\memtest.exe.mui"
	[0050.545] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.zip") returned 0
	[0050.545] lstrlenA (lpString="*.zip") returned 5
	[0050.545] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.rar") returned 0
	[0050.545] lstrlenA (lpString="*.rar") returned 5
	[0050.545] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.7z") returned 0
	[0050.545] lstrlenA (lpString="*.7z") returned 4
	[0050.545] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.tar") returned 0
	[0050.545] lstrlenA (lpString="*.tar") returned 5
	[0050.545] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.gzip") returned 0
	[0050.545] lstrlenA (lpString="*.gzip") returned 6
	[0050.545] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.jpg") returned 0
	[0050.545] lstrlenA (lpString="*.jpg") returned 5
	[0050.545] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.545] lstrlenA (lpString="*.jpeg") returned 6
	[0050.545] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.bmp") returned 0
	[0050.545] lstrlenA (lpString="*.bmp") returned 5
	[0050.545] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.gif") returned 0
	[0050.545] lstrlenA (lpString="*.gif") returned 5
	[0050.545] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.png") returned 0
	[0050.545] lstrlenA (lpString="*.png") returned 5
	[0050.545] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.doc") returned 0
	[0050.545] lstrlenA (lpString="*.doc") returned 5
	[0050.545] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.docx") returned 0
	[0050.545] lstrlenA (lpString="*.docx") returned 6
	[0050.545] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.xls") returned 0
	[0050.545] lstrlenA (lpString="*.xls") returned 5
	[0050.545] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.545] lstrlenA (lpString="*.xlsx") returned 6
	[0050.545] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.ppt") returned 0
	[0050.545] lstrlenA (lpString="*.ppt") returned 5
	[0050.545] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.pptx") returned 0
	[0050.546] lstrlenA (lpString="*.pptx") returned 6
	[0050.546] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.txt") returned 0
	[0050.546] lstrlenA (lpString="*.txt") returned 5
	[0050.546] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.pdf") returned 0
	[0050.546] lstrlenA (lpString="*.pdf") returned 5
	[0050.546] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.htm") returned 0
	[0050.546] lstrlenA (lpString="*.htm") returned 5
	[0050.546] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.html") returned 0
	[0050.546] lstrlenA (lpString="*.html") returned 6
	[0050.546] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.mdb") returned 0
	[0050.546] lstrlenA (lpString="*.mdb") returned 5
	[0050.546] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.pfx") returned 0
	[0050.546] lstrlenA (lpString="*.pfx") returned 5
	[0050.546] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.md") returned 0
	[0050.546] lstrlenA (lpString="*.md") returned 4
	[0050.546] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.lnk") returned 0
	[0050.546] lstrlenA (lpString="*.lnk") returned 5
	[0050.546] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.torrent") returned 0
	[0050.546] lstrlenA (lpString="*.torrent") returned 9
	[0050.546] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.mov") returned 0
	[0050.546] lstrlenA (lpString="*.mov") returned 5
	[0050.546] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.3gp") returned 0
	[0050.546] lstrlenA (lpString="*.3gp") returned 5
	[0050.546] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.546] lstrlenA (lpString="*.mpeg") returned 6
	[0050.546] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.mpg") returned 0
	[0050.546] lstrlenA (lpString="*.mpg") returned 5
	[0050.546] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.flv") returned 0
	[0050.546] lstrlenA (lpString="*.flv") returned 5
	[0050.547] lstrlenA (lpString="*.avi") returned 5
	[0050.547] lstrlenA (lpString="*.mp4") returned 5
	[0050.547] lstrlenA (lpString="*.wmv") returned 5
	[0050.547] lstrlenA (lpString="*.mkv") returned 5
	[0050.547] lstrlenA (lpString="*.mp3") returned 5
	[0050.547] lstrlenA (lpString="*.wav") returned 5
	[0050.547] lstrlenA (lpString="*.flac") returned 6
	[0050.547] lstrlenA (lpString="*.wma") returned 5
	[0050.547] lstrlenA (lpString="*.au3") returned 5
	[0050.547] lstrlenA (lpString="*.ahk") returned 5
	[0050.547] lstrlenA (lpString="*.c") returned 3
	[0050.547] lstrlenA (lpString="*.cc") returned 4
	[0050.547] lstrlenA (lpString="*.cpp") returned 5
	[0050.547] lstrlenA (lpString="*.cxx") returned 5
	[0050.547] lstrlenA (lpString="*.c++") returned 5
	[0050.547] lstrlenA (lpString="*.cs") returned 4
	[0050.547] lstrlenA (lpString="*.vb") returned 4
	[0050.547] lstrlenA (lpString="*.bas") returned 5
	[0050.547] lstrlenA (lpString="*.csproj") returned 8
	[0050.547] lstrlenA (lpString="*.vbproj") returned 8
	[0050.547] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.547] lstrlenA (lpString="*.manifest") returned 10
	[0050.547] lstrlenA (lpString="*.php") returned 5
	[0050.547] lstrlenA (lpString="*.vbe") returned 5
	[0050.548] lstrlenA (lpString="*.vba") returned 5
	[0050.548] lstrlenA (lpString="*.vbs") returned 5
	[0050.548] lstrlenA (lpString="*.bat") returned 5
	[0050.548] lstrlenA (lpString="*.cmd") returned 5
	[0050.548] lstrlenA (lpString="*.js") returned 4
	[0050.548] lstrlenA (lpString="*.jscript") returned 9
	[0050.548] lstrlenA (lpString="*.hta") returned 5
	[0050.548] lstrlenA (lpString="*.php7") returned 6
	[0050.548] lstrlenA (lpString="*.db") returned 4
	[0050.548] lstrlenA (lpString="*.swf") returned 5
	[0050.548] lstrlenA (lpString="*.eml") returned 5
	[0050.548] lstrlenA (lpString="*.part") returned 6
	[0050.548] lstrlenA (lpString="*.nfo") returned 5
	[0050.548] lstrlenA (lpString="*.rsa") returned 5
	[0050.548] lstrlenA (lpString="*.key") returned 5
	[0050.548] lstrlenA (lpString="*.aes") returned 5
	[0050.548] lstrlenA (lpString="*.blob") returned 6
	[0050.548] lstrlenA (lpString="*.btc") returned 5
	[0050.548] lstrlenA (lpString="*.wallet") returned 8
	[0050.548] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0050.548] FindClose (in: hFindFile=0x7cb690 | out: hFindFile=0x7cb690) returned 1
	[0050.548] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1
	[0050.548] lstrcmpA (lpString1=".", lpString2="Resources") returned -1
	[0050.548] lstrcmpA (lpString1="..", lpString2="Resources") returned -1
	[0050.548] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0050.548] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="Resources" | out: lpString1="C:\\Boot\\Resources") returned="C:\\Boot\\Resources"
	[0050.548] lstrlenA (lpString="C:\\Boot\\Resources") returned 17
	[0050.549] FindFirstFileA (in: lpFileName="C:\\Boot\\Resources\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbc50
	[0050.549] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.549] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0050.549] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.549] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.549] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9abff9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef597530, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x169a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootres.dll", cAlternateFileName="")) returned 1
	[0050.550] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.550] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootres.dll") returned 1
	[0050.550] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootres.dll") returned 1
	[0050.550] lstrcmpiA (lpString1="", lpString2="bootres.dll") returned -1
	[0050.550] PathFindFileNameA (pszPath="C:\\Boot\\Resources\\*.*") returned="*.*"
	[0050.550] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Resources\\" | out: lpString1="C:\\Boot\\Resources\\") returned="C:\\Boot\\Resources\\"
	[0050.550] PathAddBackslashA (in: pszPath="C:\\Boot\\Resources\\" | out: pszPath="C:\\Boot\\Resources\\") returned=""
	[0050.550] lstrcatA (in: lpString1="C:\\Boot\\Resources\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\Resources\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\Resources\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.550] GetFileAttributesA (lpFileName="C:\\Boot\\Resources\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\resources\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0050.550] CreateFileA (lpFileName="C:\\Boot\\Resources\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\resources\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0050.550] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0050.550] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0050.551] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.551] CloseHandle (hObject=0x208) returned 1
	[0050.551] lstrcatA (in: lpString1="C:\\Boot\\Resources\\", lpString2="bootres.dll" | out: lpString1="C:\\Boot\\Resources\\bootres.dll") returned="C:\\Boot\\Resources\\bootres.dll"
	[0050.551] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.zip") returned 0
	[0050.551] lstrlenA (lpString="*.zip") returned 5
	[0050.552] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.rar") returned 0
	[0050.552] lstrlenA (lpString="*.rar") returned 5
	[0050.552] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.7z") returned 0
	[0050.552] lstrlenA (lpString="*.7z") returned 4
	[0050.552] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.tar") returned 0
	[0050.552] lstrlenA (lpString="*.tar") returned 5
	[0050.552] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.gzip") returned 0
	[0050.552] lstrlenA (lpString="*.gzip") returned 6
	[0050.552] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.jpg") returned 0
	[0050.552] lstrlenA (lpString="*.jpg") returned 5
	[0050.552] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.jpeg") returned 0
	[0050.552] lstrlenA (lpString="*.jpeg") returned 6
	[0050.552] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.bmp") returned 0
	[0050.552] lstrlenA (lpString="*.bmp") returned 5
	[0050.552] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.gif") returned 0
	[0050.552] lstrlenA (lpString="*.gif") returned 5
	[0050.552] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.png") returned 0
	[0050.552] lstrlenA (lpString="*.png") returned 5
	[0050.554] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.doc") returned 0
	[0050.554] lstrlenA (lpString="*.doc") returned 5
	[0050.554] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.docx") returned 0
	[0050.554] lstrlenA (lpString="*.docx") returned 6
	[0050.554] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.xls") returned 0
	[0050.554] lstrlenA (lpString="*.xls") returned 5
	[0050.554] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.xlsx") returned 0
	[0050.554] lstrlenA (lpString="*.xlsx") returned 6
	[0050.554] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.ppt") returned 0
	[0050.554] lstrlenA (lpString="*.ppt") returned 5
	[0050.554] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.pptx") returned 0
	[0050.554] lstrlenA (lpString="*.pptx") returned 6
	[0050.554] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.txt") returned 0
	[0050.554] lstrlenA (lpString="*.txt") returned 5
	[0050.554] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.pdf") returned 0
	[0050.554] lstrlenA (lpString="*.pdf") returned 5
	[0050.554] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.htm") returned 0
	[0050.554] lstrlenA (lpString="*.htm") returned 5
	[0050.554] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.html") returned 0
	[0050.554] lstrlenA (lpString="*.html") returned 6
	[0050.554] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.mdb") returned 0
	[0050.554] lstrlenA (lpString="*.mdb") returned 5
	[0050.554] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.pfx") returned 0
	[0050.554] lstrlenA (lpString="*.pfx") returned 5
	[0050.555] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.md") returned 0
	[0050.555] lstrlenA (lpString="*.md") returned 4
	[0050.555] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.lnk") returned 0
	[0050.555] lstrlenA (lpString="*.lnk") returned 5
	[0050.555] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.torrent") returned 0
	[0050.555] lstrlenA (lpString="*.torrent") returned 9
	[0050.555] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.mov") returned 0
	[0050.555] lstrlenA (lpString="*.mov") returned 5
	[0050.555] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.3gp") returned 0
	[0050.555] lstrlenA (lpString="*.3gp") returned 5
	[0050.555] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.mpeg") returned 0
	[0050.555] lstrlenA (lpString="*.mpeg") returned 6
	[0050.555] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.mpg") returned 0
	[0050.555] lstrlenA (lpString="*.mpg") returned 5
	[0050.555] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.flv") returned 0
	[0050.555] lstrlenA (lpString="*.flv") returned 5
	[0050.555] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.avi") returned 0
	[0050.555] lstrlenA (lpString="*.avi") returned 5
	[0050.555] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.mp4") returned 0
	[0050.555] lstrlenA (lpString="*.mp4") returned 5
	[0050.555] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.wmv") returned 0
	[0050.555] lstrlenA (lpString="*.wmv") returned 5
	[0050.555] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.mkv") returned 0
	[0050.555] lstrlenA (lpString="*.mkv") returned 5
	[0050.555] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.mp3") returned 0
	[0050.555] lstrlenA (lpString="*.mp3") returned 5
	[0050.555] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.wav") returned 0
	[0050.555] lstrlenA (lpString="*.wav") returned 5
	[0050.555] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.flac") returned 0
	[0050.555] lstrlenA (lpString="*.flac") returned 6
	[0050.555] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.wma") returned 0
	[0050.555] lstrlenA (lpString="*.wma") returned 5
	[0050.555] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.au3") returned 0
	[0050.555] lstrlenA (lpString="*.au3") returned 5
	[0050.555] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.ahk") returned 0
	[0050.556] lstrlenA (lpString="*.ahk") returned 5
	[0050.556] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.c") returned 0
	[0050.556] lstrlenA (lpString="*.c") returned 3
	[0050.556] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.cc") returned 0
	[0050.556] lstrlenA (lpString="*.cc") returned 4
	[0050.556] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.cpp") returned 0
	[0050.556] lstrlenA (lpString="*.cpp") returned 5
	[0050.556] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.cxx") returned 0
	[0050.556] lstrlenA (lpString="*.cxx") returned 5
	[0050.556] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.c++") returned 0
	[0050.556] lstrlenA (lpString="*.c++") returned 5
	[0050.556] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.cs") returned 0
	[0050.556] lstrlenA (lpString="*.cs") returned 4
	[0050.556] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.vb") returned 0
	[0050.556] lstrlenA (lpString="*.vb") returned 4
	[0050.556] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.bas") returned 0
	[0050.556] lstrlenA (lpString="*.bas") returned 5
	[0050.556] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.csproj") returned 0
	[0050.556] lstrlenA (lpString="*.csproj") returned 8
	[0050.556] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.vbproj") returned 0
	[0050.556] lstrlenA (lpString="*.vbproj") returned 8
	[0050.556] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.vcxproj") returned 0
	[0050.556] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.556] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.manifest") returned 0
	[0050.556] lstrlenA (lpString="*.manifest") returned 10
	[0050.556] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.php") returned 0
	[0050.556] lstrlenA (lpString="*.php") returned 5
	[0050.556] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.vbe") returned 0
	[0050.556] lstrlenA (lpString="*.vbe") returned 5
	[0050.556] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.vba") returned 0
	[0050.556] lstrlenA (lpString="*.vba") returned 5
	[0050.556] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.vbs") returned 0
	[0050.556] lstrlenA (lpString="*.vbs") returned 5
	[0050.556] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.bat") returned 0
	[0050.556] lstrlenA (lpString="*.bat") returned 5
	[0050.556] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.cmd") returned 0
	[0050.556] lstrlenA (lpString="*.cmd") returned 5
	[0050.557] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.js") returned 0
	[0050.557] lstrlenA (lpString="*.js") returned 4
	[0050.557] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.jscript") returned 0
	[0050.557] lstrlenA (lpString="*.jscript") returned 9
	[0050.557] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.hta") returned 0
	[0050.557] lstrlenA (lpString="*.hta") returned 5
	[0050.557] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.php7") returned 0
	[0050.557] lstrlenA (lpString="*.php7") returned 6
	[0050.557] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.db") returned 0
	[0050.557] lstrlenA (lpString="*.db") returned 4
	[0050.557] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.swf") returned 0
	[0050.557] lstrlenA (lpString="*.swf") returned 5
	[0050.557] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.eml") returned 0
	[0050.557] lstrlenA (lpString="*.eml") returned 5
	[0050.557] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.part") returned 0
	[0050.557] lstrlenA (lpString="*.part") returned 6
	[0050.557] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.nfo") returned 0
	[0050.557] lstrlenA (lpString="*.nfo") returned 5
	[0050.557] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.rsa") returned 0
	[0050.557] lstrlenA (lpString="*.rsa") returned 5
	[0050.557] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.key") returned 0
	[0050.557] lstrlenA (lpString="*.key") returned 5
	[0050.557] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.aes") returned 0
	[0050.557] lstrlenA (lpString="*.aes") returned 5
	[0050.557] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.blob") returned 0
	[0050.557] lstrlenA (lpString="*.blob") returned 6
	[0050.557] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.btc") returned 0
	[0050.557] lstrlenA (lpString="*.btc") returned 5
	[0050.557] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.wallet") returned 0
	[0050.557] lstrlenA (lpString="*.wallet") returned 8
	[0050.557] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="en-US", cAlternateFileName="")) returned 1
	[0050.557] lstrcmpA (lpString1=".", lpString2="en-US") returned -1
	[0050.557] lstrcmpA (lpString1="..", lpString2="en-US") returned -1
	[0050.557] PathFindFileNameA (pszPath="C:\\Boot\\Resources\\bootres.dll") returned="bootres.dll"
	[0050.557] lstrcatA (in: lpString1="C:\\Boot\\Resources\\", lpString2="en-US" | out: lpString1="C:\\Boot\\Resources\\en-US") returned="C:\\Boot\\Resources\\en-US"
	[0050.557] lstrlenA (lpString="C:\\Boot\\Resources\\en-US") returned 23
	[0050.557] FindFirstFileA (in: lpFileName="C:\\Boot\\Resources\\en-US\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c7928, dwReserved1=0x68, cFileName=".", cAlternateFileName="")) returned 0x7cb9d0
	[0050.558] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.558] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c7928, dwReserved1=0x68, cFileName="..", cAlternateFileName="")) returned 1
	[0050.558] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.558] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.558] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x7c7928, dwReserved1=0x68, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 1
	[0050.558] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0050.558] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootres.dll.mui") returned 1
	[0050.558] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootres.dll.mui") returned 1
	[0050.558] lstrcmpiA (lpString1="", lpString2="bootres.dll.mui") returned -1
	[0050.558] PathFindFileNameA (pszPath="C:\\Boot\\Resources\\en-US\\*.*") returned="*.*"
	[0050.558] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Resources\\en-US\\" | out: lpString1="C:\\Boot\\Resources\\en-US\\") returned="C:\\Boot\\Resources\\en-US\\"
	[0050.558] PathAddBackslashA (in: pszPath="C:\\Boot\\Resources\\en-US\\" | out: pszPath="C:\\Boot\\Resources\\en-US\\") returned=""
	[0050.558] lstrcatA (in: lpString1="C:\\Boot\\Resources\\en-US\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\Resources\\en-US\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\Resources\\en-US\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.558] GetFileAttributesA (lpFileName="C:\\Boot\\Resources\\en-US\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\resources\\en-us\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0050.558] CreateFileA (lpFileName="C:\\Boot\\Resources\\en-US\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\resources\\en-us\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0050.559] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0050.559] WriteFile (in: hFile=0x20c, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0050.560] SetFileTime (hFile=0x20c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.560] CloseHandle (hObject=0x20c) returned 1
	[0050.560] lstrcatA (in: lpString1="C:\\Boot\\Resources\\en-US\\", lpString2="bootres.dll.mui" | out: lpString1="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned="C:\\Boot\\Resources\\en-US\\bootres.dll.mui"
	[0050.560] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.zip") returned 0
	[0050.560] lstrlenA (lpString="*.zip") returned 5
	[0050.560] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.rar") returned 0
	[0050.560] lstrlenA (lpString="*.rar") returned 5
	[0050.560] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.7z") returned 0
	[0050.560] lstrlenA (lpString="*.7z") returned 4
	[0050.560] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.tar") returned 0
	[0050.560] lstrlenA (lpString="*.tar") returned 5
	[0050.560] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.gzip") returned 0
	[0050.560] lstrlenA (lpString="*.gzip") returned 6
	[0050.560] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.jpg") returned 0
	[0050.560] lstrlenA (lpString="*.jpg") returned 5
	[0050.560] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.jpeg") returned 0
	[0050.560] lstrlenA (lpString="*.jpeg") returned 6
	[0050.561] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.bmp") returned 0
	[0050.561] lstrlenA (lpString="*.bmp") returned 5
	[0050.561] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.gif") returned 0
	[0050.561] lstrlenA (lpString="*.gif") returned 5
	[0050.561] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.png") returned 0
	[0050.561] lstrlenA (lpString="*.png") returned 5
	[0050.561] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.doc") returned 0
	[0050.561] lstrlenA (lpString="*.doc") returned 5
	[0050.561] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.docx") returned 0
	[0050.561] lstrlenA (lpString="*.docx") returned 6
	[0050.561] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.xls") returned 0
	[0050.561] lstrlenA (lpString="*.xls") returned 5
	[0050.561] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.xlsx") returned 0
	[0050.561] lstrlenA (lpString="*.xlsx") returned 6
	[0050.561] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.ppt") returned 0
	[0050.561] lstrlenA (lpString="*.ppt") returned 5
	[0050.561] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.pptx") returned 0
	[0050.561] lstrlenA (lpString="*.pptx") returned 6
	[0050.561] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.txt") returned 0
	[0050.561] lstrlenA (lpString="*.txt") returned 5
	[0050.561] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.pdf") returned 0
	[0050.561] lstrlenA (lpString="*.pdf") returned 5
	[0050.561] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.htm") returned 0
	[0050.561] lstrlenA (lpString="*.htm") returned 5
	[0050.561] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.html") returned 0
	[0050.561] lstrlenA (lpString="*.html") returned 6
	[0050.561] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.mdb") returned 0
	[0050.561] lstrlenA (lpString="*.mdb") returned 5
	[0050.561] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.pfx") returned 0
	[0050.561] lstrlenA (lpString="*.pfx") returned 5
	[0050.561] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.md") returned 0
	[0050.561] lstrlenA (lpString="*.md") returned 4
	[0050.561] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.lnk") returned 0
	[0050.561] lstrlenA (lpString="*.lnk") returned 5
	[0050.561] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.torrent") returned 0
	[0050.561] lstrlenA (lpString="*.torrent") returned 9
	[0050.561] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.mov") returned 0
	[0050.562] lstrlenA (lpString="*.mov") returned 5
	[0050.562] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.3gp") returned 0
	[0050.562] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.mpeg") returned 0
	[0050.562] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.mpg") returned 0
	[0050.562] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.flv") returned 0
	[0050.562] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.avi") returned 0
	[0050.562] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.mp4") returned 0
	[0050.562] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.wmv") returned 0
	[0050.562] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.mkv") returned 0
	[0050.562] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.mp3") returned 0
	[0050.562] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.wav") returned 0
	[0050.562] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.flac") returned 0
	[0050.562] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.wma") returned 0
	[0050.562] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.au3") returned 0
	[0050.562] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.ahk") returned 0
	[0050.562] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.c") returned 0
	[0050.562] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.cc") returned 0
	[0050.562] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.cpp") returned 0
	[0050.562] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.cxx") returned 0
	[0050.562] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.c++") returned 0
	[0050.562] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.cs") returned 0
	[0050.562] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.vb") returned 0
	[0050.562] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.bas") returned 0
	[0050.562] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.csproj") returned 0
	[0050.562] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.vbproj") returned 0
	[0050.563] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.vcxproj") returned 0
	[0050.563] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.manifest") returned 0
	[0050.563] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.php") returned 0
	[0050.563] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.vbe") returned 0
	[0050.563] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.vba") returned 0
	[0050.563] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.vbs") returned 0
	[0050.563] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.bat") returned 0
	[0050.563] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.cmd") returned 0
	[0050.563] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.js") returned 0
	[0050.563] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.jscript") returned 0
	[0050.563] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.hta") returned 0
	[0050.563] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.php7") returned 0
	[0050.563] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.db") returned 0
	[0050.563] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.swf") returned 0
	[0050.563] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.eml") returned 0
	[0050.563] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.part") returned 0
	[0050.563] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.nfo") returned 0
	[0050.563] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.rsa") returned 0
	[0050.563] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.key") returned 0
	[0050.563] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.aes") returned 0
	[0050.563] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.blob") returned 0
	[0050.563] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.btc") returned 0
	[0050.563] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.wallet") returned 0
	[0050.563] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x7c7928, dwReserved1=0x68, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 0
	[0050.563] FindClose (in: hFindFile=0x7cb9d0 | out: hFindFile=0x7cb9d0) returned 1
	[0050.564] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="en-US", cAlternateFileName="")) returned 0
	[0050.564] FindClose (in: hFindFile=0x7cbc50 | out: hFindFile=0x7cbc50) returned 1
	[0050.564] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1
	[0050.564] lstrcmpA (lpString1=".", lpString2="ro-RO") returned -1
	[0050.564] lstrcmpA (lpString1="..", lpString2="ro-RO") returned -1
	[0050.564] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0050.564] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="ro-RO" | out: lpString1="C:\\Boot\\ro-RO") returned="C:\\Boot\\ro-RO"
	[0050.564] FindFirstFileA (in: lpFileName="C:\\Boot\\ro-RO\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d3d58, dwReserved1=0x7b00c0, cFileName=".", cAlternateFileName="")) returned 0x7cbad0
	[0050.565] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.565] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d3d58, dwReserved1=0x7b00c0, cFileName="..", cAlternateFileName="")) returned 1
	[0050.565] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.565] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.565] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x7d3d58, dwReserved1=0x7b00c0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0050.565] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.565] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr.exe.mui") returned 1
	[0050.565] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr.exe.mui") returned 1
	[0050.565] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0050.565] PathFindFileNameA (pszPath="C:\\Boot\\ro-RO\\*.*") returned="*.*"
	[0050.565] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\ro-RO\\" | out: lpString1="C:\\Boot\\ro-RO\\") returned="C:\\Boot\\ro-RO\\"
	[0050.565] PathAddBackslashA (in: pszPath="C:\\Boot\\ro-RO\\" | out: pszPath="C:\\Boot\\ro-RO\\") returned=""
	[0050.565] lstrcatA (in: lpString1="C:\\Boot\\ro-RO\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\ro-RO\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\ro-RO\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.565] GetFileAttributesA (lpFileName="C:\\Boot\\ro-RO\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\ro-ro\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0050.565] CreateFileA (lpFileName="C:\\Boot\\ro-RO\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\ro-ro\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0050.565] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0050.566] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.566] CloseHandle (hObject=0x208) returned 1
	[0050.566] lstrcatA (in: lpString1="C:\\Boot\\ro-RO\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned="C:\\Boot\\ro-RO\\bootmgr.exe.mui"
	[0050.566] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0050.567] lstrlenA (lpString="*.zip") returned 5
	[0050.567] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0050.567] lstrlenA (lpString="*.rar") returned 5
	[0050.567] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0050.567] lstrlenA (lpString="*.7z") returned 4
	[0050.567] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0050.567] lstrlenA (lpString="*.tar") returned 5
	[0050.567] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0050.567] lstrlenA (lpString="*.gzip") returned 6
	[0050.567] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0050.567] lstrlenA (lpString="*.jpg") returned 5
	[0050.567] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.567] lstrlenA (lpString="*.jpeg") returned 6
	[0050.567] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0050.567] lstrlenA (lpString="*.bmp") returned 5
	[0050.567] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0050.567] lstrlenA (lpString="*.gif") returned 5
	[0050.567] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0050.567] lstrlenA (lpString="*.png") returned 5
	[0050.567] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0050.567] lstrlenA (lpString="*.doc") returned 5
	[0050.567] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0050.567] lstrlenA (lpString="*.docx") returned 6
	[0050.567] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0050.567] lstrlenA (lpString="*.xls") returned 5
	[0050.567] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.567] lstrlenA (lpString="*.xlsx") returned 6
	[0050.567] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0050.567] lstrlenA (lpString="*.ppt") returned 5
	[0050.567] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0050.567] lstrlenA (lpString="*.pptx") returned 6
	[0050.567] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0050.567] lstrlenA (lpString="*.txt") returned 5
	[0050.567] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0050.567] lstrlenA (lpString="*.pdf") returned 5
	[0050.567] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0050.567] lstrlenA (lpString="*.htm") returned 5
	[0050.568] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0050.568] lstrlenA (lpString="*.html") returned 6
	[0050.568] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0050.568] lstrlenA (lpString="*.mdb") returned 5
	[0050.568] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0050.568] lstrlenA (lpString="*.pfx") returned 5
	[0050.568] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0050.568] lstrlenA (lpString="*.md") returned 4
	[0050.568] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0050.568] lstrlenA (lpString="*.lnk") returned 5
	[0050.568] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0050.568] lstrlenA (lpString="*.torrent") returned 9
	[0050.568] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0050.568] lstrlenA (lpString="*.mov") returned 5
	[0050.568] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0050.568] lstrlenA (lpString="*.3gp") returned 5
	[0050.568] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.568] lstrlenA (lpString="*.mpeg") returned 6
	[0050.568] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0050.568] lstrlenA (lpString="*.mpg") returned 5
	[0050.568] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0050.568] lstrlenA (lpString="*.flv") returned 5
	[0050.568] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0050.568] lstrlenA (lpString="*.avi") returned 5
	[0050.568] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0050.568] lstrlenA (lpString="*.mp4") returned 5
	[0050.568] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0050.568] lstrlenA (lpString="*.wmv") returned 5
	[0050.568] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0050.569] lstrlenA (lpString="*.mkv") returned 5
	[0050.569] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0050.569] lstrlenA (lpString="*.mp3") returned 5
	[0050.569] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0050.569] lstrlenA (lpString="*.wav") returned 5
	[0050.569] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0050.569] lstrlenA (lpString="*.flac") returned 6
	[0050.569] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0050.569] lstrlenA (lpString="*.wma") returned 5
	[0050.569] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.au3") returned 0
	[0050.569] lstrlenA (lpString="*.au3") returned 5
	[0050.569] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.ahk") returned 0
	[0050.569] lstrlenA (lpString="*.ahk") returned 5
	[0050.569] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.c") returned 0
	[0050.569] lstrlenA (lpString="*.c") returned 3
	[0050.569] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.cc") returned 0
	[0050.569] lstrlenA (lpString="*.cc") returned 4
	[0050.569] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0
	[0050.569] lstrlenA (lpString="*.cpp") returned 5
	[0050.569] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.cxx") returned 0
	[0050.569] lstrlenA (lpString="*.cxx") returned 5
	[0050.569] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.c++") returned 0
	[0050.569] lstrlenA (lpString="*.c++") returned 5
	[0050.569] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.cs") returned 0
	[0050.569] lstrlenA (lpString="*.cs") returned 4
	[0050.569] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.vb") returned 0
	[0050.569] lstrlenA (lpString="*.vb") returned 4
	[0050.569] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.bas") returned 0
	[0050.569] lstrlenA (lpString="*.bas") returned 5
	[0050.569] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.csproj") returned 0
	[0050.569] lstrlenA (lpString="*.csproj") returned 8
	[0050.569] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.569] lstrlenA (lpString="*.vbproj") returned 8
	[0050.569] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.569] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.569] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.manifest") returned 0
	[0050.569] lstrlenA (lpString="*.manifest") returned 10
	[0050.569] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.php") returned 0
	[0050.569] lstrlenA (lpString="*.php") returned 5
	[0050.570] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.vbe") returned 0
	[0050.570] lstrlenA (lpString="*.vbe") returned 5
	[0050.570] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.vba") returned 0
	[0050.570] lstrlenA (lpString="*.vba") returned 5
	[0050.570] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.vbs") returned 0
	[0050.570] lstrlenA (lpString="*.vbs") returned 5
	[0050.570] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.bat") returned 0
	[0050.570] lstrlenA (lpString="*.bat") returned 5
	[0050.570] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.cmd") returned 0
	[0050.570] lstrlenA (lpString="*.cmd") returned 5
	[0050.570] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.js") returned 0
	[0050.570] lstrlenA (lpString="*.js") returned 4
	[0050.570] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.jscript") returned 0
	[0050.570] lstrlenA (lpString="*.jscript") returned 9
	[0050.570] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.hta") returned 0
	[0050.570] lstrlenA (lpString="*.hta") returned 5
	[0050.570] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.php7") returned 0
	[0050.570] lstrlenA (lpString="*.php7") returned 6
	[0050.570] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.db") returned 0
	[0050.570] lstrlenA (lpString="*.db") returned 4
	[0050.570] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.swf") returned 0
	[0050.570] lstrlenA (lpString="*.swf") returned 5
	[0050.570] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.eml") returned 0
	[0050.570] lstrlenA (lpString="*.eml") returned 5
	[0050.570] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.part") returned 0
	[0050.570] lstrlenA (lpString="*.part") returned 6
	[0050.570] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.nfo") returned 0
	[0050.570] lstrlenA (lpString="*.nfo") returned 5
	[0050.570] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.rsa") returned 0
	[0050.570] lstrlenA (lpString="*.rsa") returned 5
	[0050.570] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.key") returned 0
	[0050.570] lstrlenA (lpString="*.key") returned 5
	[0050.570] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.aes") returned 0
	[0050.570] lstrlenA (lpString="*.aes") returned 5
	[0050.570] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.blob") returned 0
	[0050.570] lstrlenA (lpString="*.blob") returned 6
	[0050.570] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.btc") returned 0
	[0050.570] lstrlenA (lpString="*.btc") returned 5
	[0050.571] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.wallet") returned 0
	[0050.571] lstrlenA (lpString="*.wallet") returned 8
	[0050.571] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x7d3d58, dwReserved1=0x7b00c0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0050.571] FindClose (in: hFindFile=0x7cbad0 | out: hFindFile=0x7cbad0) returned 1
	[0050.571] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1
	[0050.571] lstrcmpA (lpString1=".", lpString2="ru-RU") returned -1
	[0050.571] lstrcmpA (lpString1="..", lpString2="ru-RU") returned -1
	[0050.571] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0050.571] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="ru-RU" | out: lpString1="C:\\Boot\\ru-RU") returned="C:\\Boot\\ru-RU"
	[0050.571] lstrlenA (lpString="C:\\Boot\\ru-RU") returned 13
	[0050.571] FindFirstFileA (in: lpFileName="C:\\Boot\\ru-RU\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbad0
	[0050.572] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.572] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0050.572] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.572] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.572] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0050.572] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.572] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr.exe.mui") returned 1
	[0050.572] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr.exe.mui") returned 1
	[0050.572] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0050.572] PathFindFileNameA (pszPath="C:\\Boot\\ru-RU\\*.*") returned="*.*"
	[0050.572] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\ru-RU\\" | out: lpString1="C:\\Boot\\ru-RU\\") returned="C:\\Boot\\ru-RU\\"
	[0050.572] PathAddBackslashA (in: pszPath="C:\\Boot\\ru-RU\\" | out: pszPath="C:\\Boot\\ru-RU\\") returned=""
	[0050.572] lstrcatA (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\ru-RU\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\ru-RU\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.572] GetFileAttributesA (lpFileName="C:\\Boot\\ru-RU\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\ru-ru\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0050.572] CreateFileA (lpFileName="C:\\Boot\\ru-RU\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\ru-ru\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0050.588] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0050.588] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0050.589] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.589] CloseHandle (hObject=0x208) returned 1
	[0050.590] lstrcatA (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned="C:\\Boot\\ru-RU\\bootmgr.exe.mui"
	[0050.590] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0050.590] lstrlenA (lpString="*.zip") returned 5
	[0050.590] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0050.590] lstrlenA (lpString="*.rar") returned 5
	[0050.590] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0050.590] lstrlenA (lpString="*.7z") returned 4
	[0050.590] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0050.590] lstrlenA (lpString="*.tar") returned 5
	[0050.590] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0050.590] lstrlenA (lpString="*.gzip") returned 6
	[0050.590] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0050.590] lstrlenA (lpString="*.jpg") returned 5
	[0050.590] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.590] lstrlenA (lpString="*.jpeg") returned 6
	[0050.590] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0050.590] lstrlenA (lpString="*.bmp") returned 5
	[0050.590] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0050.590] lstrlenA (lpString="*.gif") returned 5
	[0050.590] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0050.590] lstrlenA (lpString="*.png") returned 5
	[0050.590] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0050.590] lstrlenA (lpString="*.doc") returned 5
	[0050.590] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0050.590] lstrlenA (lpString="*.docx") returned 6
	[0050.590] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0050.590] lstrlenA (lpString="*.xls") returned 5
	[0050.590] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.590] lstrlenA (lpString="*.xlsx") returned 6
	[0050.590] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0050.590] lstrlenA (lpString="*.ppt") returned 5
	[0050.590] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0050.590] lstrlenA (lpString="*.pptx") returned 6
	[0050.590] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0050.591] lstrlenA (lpString="*.txt") returned 5
	[0050.591] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0050.591] lstrlenA (lpString="*.pdf") returned 5
	[0050.591] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0050.591] lstrlenA (lpString="*.htm") returned 5
	[0050.591] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0050.591] lstrlenA (lpString="*.html") returned 6
	[0050.591] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0050.591] lstrlenA (lpString="*.mdb") returned 5
	[0050.591] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0050.591] lstrlenA (lpString="*.pfx") returned 5
	[0050.591] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0050.591] lstrlenA (lpString="*.md") returned 4
	[0050.591] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0050.591] lstrlenA (lpString="*.lnk") returned 5
	[0050.591] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0050.591] lstrlenA (lpString="*.torrent") returned 9
	[0050.591] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0050.591] lstrlenA (lpString="*.mov") returned 5
	[0050.591] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0050.591] lstrlenA (lpString="*.3gp") returned 5
	[0050.591] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.591] lstrlenA (lpString="*.mpeg") returned 6
	[0050.591] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0050.591] lstrlenA (lpString="*.mpg") returned 5
	[0050.591] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0050.591] lstrlenA (lpString="*.flv") returned 5
	[0050.591] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0050.591] lstrlenA (lpString="*.avi") returned 5
	[0050.591] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0050.591] lstrlenA (lpString="*.mp4") returned 5
	[0050.591] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0050.591] lstrlenA (lpString="*.wmv") returned 5
	[0050.591] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0050.591] lstrlenA (lpString="*.mkv") returned 5
	[0050.591] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0050.592] lstrlenA (lpString="*.mp3") returned 5
	[0050.592] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0050.592] lstrlenA (lpString="*.wav") returned 5
	[0050.592] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0050.592] lstrlenA (lpString="*.flac") returned 6
	[0050.592] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0050.592] lstrlenA (lpString="*.wma") returned 5
	[0050.592] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.au3") returned 0
	[0050.592] lstrlenA (lpString="*.au3") returned 5
	[0050.592] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.ahk") returned 0
	[0050.592] lstrlenA (lpString="*.ahk") returned 5
	[0050.592] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.c") returned 0
	[0050.592] lstrlenA (lpString="*.c") returned 3
	[0050.592] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.cc") returned 0
	[0050.592] lstrlenA (lpString="*.cc") returned 4
	[0050.592] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0
	[0050.592] lstrlenA (lpString="*.cpp") returned 5
	[0050.592] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.cxx") returned 0
	[0050.592] lstrlenA (lpString="*.cxx") returned 5
	[0050.592] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.c++") returned 0
	[0050.592] lstrlenA (lpString="*.c++") returned 5
	[0050.592] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.cs") returned 0
	[0050.592] lstrlenA (lpString="*.cs") returned 4
	[0050.592] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.vb") returned 0
	[0050.592] lstrlenA (lpString="*.vb") returned 4
	[0050.592] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.bas") returned 0
	[0050.592] lstrlenA (lpString="*.bas") returned 5
	[0050.592] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.csproj") returned 0
	[0050.592] lstrlenA (lpString="*.csproj") returned 8
	[0050.592] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.592] lstrlenA (lpString="*.vbproj") returned 8
	[0050.592] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.592] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.592] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.manifest") returned 0
	[0050.592] lstrlenA (lpString="*.manifest") returned 10
	[0050.592] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.php") returned 0
	[0050.592] lstrlenA (lpString="*.php") returned 5
	[0050.592] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.vbe") returned 0
	[0050.593] lstrlenA (lpString="*.vbe") returned 5
	[0050.593] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.vba") returned 0
	[0050.593] lstrlenA (lpString="*.vba") returned 5
	[0050.593] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.vbs") returned 0
	[0050.593] lstrlenA (lpString="*.vbs") returned 5
	[0050.593] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.bat") returned 0
	[0050.593] lstrlenA (lpString="*.bat") returned 5
	[0050.593] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.cmd") returned 0
	[0050.593] lstrlenA (lpString="*.cmd") returned 5
	[0050.593] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.js") returned 0
	[0050.593] lstrlenA (lpString="*.js") returned 4
	[0050.593] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.jscript") returned 0
	[0050.593] lstrlenA (lpString="*.jscript") returned 9
	[0050.593] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.hta") returned 0
	[0050.593] lstrlenA (lpString="*.hta") returned 5
	[0050.593] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.php7") returned 0
	[0050.593] lstrlenA (lpString="*.php7") returned 6
	[0050.593] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.db") returned 0
	[0050.593] lstrlenA (lpString="*.db") returned 4
	[0050.593] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.swf") returned 0
	[0050.593] lstrlenA (lpString="*.swf") returned 5
	[0050.593] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.eml") returned 0
	[0050.593] lstrlenA (lpString="*.eml") returned 5
	[0050.593] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.part") returned 0
	[0050.593] lstrlenA (lpString="*.part") returned 6
	[0050.593] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.nfo") returned 0
	[0050.593] lstrlenA (lpString="*.nfo") returned 5
	[0050.593] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.rsa") returned 0
	[0050.593] lstrlenA (lpString="*.rsa") returned 5
	[0050.593] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.key") returned 0
	[0050.593] lstrlenA (lpString="*.key") returned 5
	[0050.593] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.aes") returned 0
	[0050.593] lstrlenA (lpString="*.aes") returned 5
	[0050.593] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.blob") returned 0
	[0050.593] lstrlenA (lpString="*.blob") returned 6
	[0050.593] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.btc") returned 0
	[0050.593] lstrlenA (lpString="*.btc") returned 5
	[0050.593] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.wallet") returned 0
	[0050.593] lstrlenA (lpString="*.wallet") returned 8
	[0050.594] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0050.594] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.594] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="memtest.exe.mui") returned -1
	[0050.594] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="memtest.exe.mui") returned -1
	[0050.594] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1
	[0050.594] PathFindFileNameA (pszPath="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned="bootmgr.exe.mui"
	[0050.594] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\ru-RU\\" | out: lpString1="C:\\Boot\\ru-RU\\") returned="C:\\Boot\\ru-RU\\"
	[0050.594] PathAddBackslashA (in: pszPath="C:\\Boot\\ru-RU\\" | out: pszPath="C:\\Boot\\ru-RU\\") returned=""
	[0050.594] lstrcatA (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\ru-RU\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\ru-RU\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.594] GetFileAttributesA (lpFileName="C:\\Boot\\ru-RU\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\ru-ru\\how-to-decrypt-files.htm")) returned 0x20
	[0050.594] lstrcatA (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\ru-RU\\memtest.exe.mui") returned="C:\\Boot\\ru-RU\\memtest.exe.mui"
	[0050.594] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.zip") returned 0
	[0050.594] lstrlenA (lpString="*.zip") returned 5
	[0050.594] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.rar") returned 0
	[0050.594] lstrlenA (lpString="*.rar") returned 5
	[0050.594] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.7z") returned 0
	[0050.594] lstrlenA (lpString="*.7z") returned 4
	[0050.594] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.tar") returned 0
	[0050.594] lstrlenA (lpString="*.tar") returned 5
	[0050.594] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.gzip") returned 0
	[0050.594] lstrlenA (lpString="*.gzip") returned 6
	[0050.594] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.jpg") returned 0
	[0050.594] lstrlenA (lpString="*.jpg") returned 5
	[0050.594] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.594] lstrlenA (lpString="*.jpeg") returned 6
	[0050.594] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.bmp") returned 0
	[0050.594] lstrlenA (lpString="*.bmp") returned 5
	[0050.594] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.gif") returned 0
	[0050.594] lstrlenA (lpString="*.gif") returned 5
	[0050.594] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.png") returned 0
	[0050.594] lstrlenA (lpString="*.png") returned 5
	[0050.595] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.doc") returned 0
	[0050.595] lstrlenA (lpString="*.doc") returned 5
	[0050.595] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.docx") returned 0
	[0050.595] lstrlenA (lpString="*.docx") returned 6
	[0050.595] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.xls") returned 0
	[0050.595] lstrlenA (lpString="*.xls") returned 5
	[0050.595] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.595] lstrlenA (lpString="*.xlsx") returned 6
	[0050.595] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.ppt") returned 0
	[0050.595] lstrlenA (lpString="*.ppt") returned 5
	[0050.595] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.pptx") returned 0
	[0050.595] lstrlenA (lpString="*.pptx") returned 6
	[0050.595] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.txt") returned 0
	[0050.595] lstrlenA (lpString="*.txt") returned 5
	[0050.595] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.pdf") returned 0
	[0050.595] lstrlenA (lpString="*.pdf") returned 5
	[0050.595] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.htm") returned 0
	[0050.595] lstrlenA (lpString="*.htm") returned 5
	[0050.595] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.html") returned 0
	[0050.595] lstrlenA (lpString="*.html") returned 6
	[0050.595] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.mdb") returned 0
	[0050.595] lstrlenA (lpString="*.mdb") returned 5
	[0050.595] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.pfx") returned 0
	[0050.595] lstrlenA (lpString="*.pfx") returned 5
	[0050.595] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.md") returned 0
	[0050.595] lstrlenA (lpString="*.md") returned 4
	[0050.595] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.lnk") returned 0
	[0050.595] lstrlenA (lpString="*.lnk") returned 5
	[0050.595] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.torrent") returned 0
	[0050.595] lstrlenA (lpString="*.torrent") returned 9
	[0050.595] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.mov") returned 0
	[0050.595] lstrlenA (lpString="*.mov") returned 5
	[0050.595] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.3gp") returned 0
	[0050.595] lstrlenA (lpString="*.3gp") returned 5
	[0050.595] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.595] lstrlenA (lpString="*.mpeg") returned 6
	[0050.595] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.mpg") returned 0
	[0050.596] lstrlenA (lpString="*.mpg") returned 5
	[0050.596] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.flv") returned 0
	[0050.596] lstrlenA (lpString="*.flv") returned 5
	[0050.596] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.avi") returned 0
	[0050.596] lstrlenA (lpString="*.avi") returned 5
	[0050.596] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.mp4") returned 0
	[0050.596] lstrlenA (lpString="*.mp4") returned 5
	[0050.596] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.wmv") returned 0
	[0050.596] lstrlenA (lpString="*.wmv") returned 5
	[0050.596] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.mkv") returned 0
	[0050.596] lstrlenA (lpString="*.mkv") returned 5
	[0050.596] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.mp3") returned 0
	[0050.596] lstrlenA (lpString="*.mp3") returned 5
	[0050.596] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.wav") returned 0
	[0050.596] lstrlenA (lpString="*.wav") returned 5
	[0050.596] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.flac") returned 0
	[0050.596] lstrlenA (lpString="*.flac") returned 6
	[0050.596] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.wma") returned 0
	[0050.596] lstrlenA (lpString="*.wma") returned 5
	[0050.596] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.au3") returned 0
	[0050.596] lstrlenA (lpString="*.au3") returned 5
	[0050.596] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.ahk") returned 0
	[0050.596] lstrlenA (lpString="*.ahk") returned 5
	[0050.596] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.c") returned 0
	[0050.596] lstrlenA (lpString="*.c") returned 3
	[0050.596] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.cc") returned 0
	[0050.596] lstrlenA (lpString="*.cc") returned 4
	[0050.596] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.cpp") returned 0
	[0050.596] lstrlenA (lpString="*.cpp") returned 5
	[0050.596] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.cxx") returned 0
	[0050.596] lstrlenA (lpString="*.cxx") returned 5
	[0050.596] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.c++") returned 0
	[0050.596] lstrlenA (lpString="*.c++") returned 5
	[0050.596] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.cs") returned 0
	[0050.596] lstrlenA (lpString="*.cs") returned 4
	[0050.596] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.vb") returned 0
	[0050.596] lstrlenA (lpString="*.vb") returned 4
	[0050.596] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.bas") returned 0
	[0050.597] lstrlenA (lpString="*.bas") returned 5
	[0050.597] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.csproj") returned 0
	[0050.597] lstrlenA (lpString="*.csproj") returned 8
	[0050.597] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.597] lstrlenA (lpString="*.vbproj") returned 8
	[0050.597] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.597] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.597] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.manifest") returned 0
	[0050.597] lstrlenA (lpString="*.manifest") returned 10
	[0050.597] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.php") returned 0
	[0050.597] lstrlenA (lpString="*.php") returned 5
	[0050.597] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.vbe") returned 0
	[0050.597] lstrlenA (lpString="*.vbe") returned 5
	[0050.597] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.vba") returned 0
	[0050.597] lstrlenA (lpString="*.vba") returned 5
	[0050.597] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.vbs") returned 0
	[0050.597] lstrlenA (lpString="*.vbs") returned 5
	[0050.597] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.bat") returned 0
	[0050.597] lstrlenA (lpString="*.bat") returned 5
	[0050.597] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.cmd") returned 0
	[0050.597] lstrlenA (lpString="*.cmd") returned 5
	[0050.597] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.js") returned 0
	[0050.597] lstrlenA (lpString="*.js") returned 4
	[0050.597] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.jscript") returned 0
	[0050.597] lstrlenA (lpString="*.jscript") returned 9
	[0050.597] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.hta") returned 0
	[0050.597] lstrlenA (lpString="*.hta") returned 5
	[0050.597] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.php7") returned 0
	[0050.597] lstrlenA (lpString="*.php7") returned 6
	[0050.597] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.db") returned 0
	[0050.597] lstrlenA (lpString="*.db") returned 4
	[0050.597] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.swf") returned 0
	[0050.597] lstrlenA (lpString="*.swf") returned 5
	[0050.597] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.eml") returned 0
	[0050.597] lstrlenA (lpString="*.eml") returned 5
	[0050.597] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.part") returned 0
	[0050.597] lstrlenA (lpString="*.part") returned 6
	[0050.597] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.nfo") returned 0
	[0050.597] lstrlenA (lpString="*.nfo") returned 5
	[0050.598] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.rsa") returned 0
	[0050.598] lstrlenA (lpString="*.rsa") returned 5
	[0050.598] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.key") returned 0
	[0050.598] lstrlenA (lpString="*.key") returned 5
	[0050.598] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.aes") returned 0
	[0050.598] lstrlenA (lpString="*.aes") returned 5
	[0050.598] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.blob") returned 0
	[0050.598] lstrlenA (lpString="*.blob") returned 6
	[0050.598] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.btc") returned 0
	[0050.598] lstrlenA (lpString="*.btc") returned 5
	[0050.598] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.wallet") returned 0
	[0050.598] lstrlenA (lpString="*.wallet") returned 8
	[0050.598] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0050.598] FindClose (in: hFindFile=0x7cbad0 | out: hFindFile=0x7cbad0) returned 1
	[0050.598] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1
	[0050.598] lstrcmpA (lpString1=".", lpString2="sk-SK") returned -1
	[0050.598] lstrcmpA (lpString1="..", lpString2="sk-SK") returned -1
	[0050.598] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0050.598] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="sk-SK" | out: lpString1="C:\\Boot\\sk-SK") returned="C:\\Boot\\sk-SK"
	[0050.598] lstrlenA (lpString="C:\\Boot\\sk-SK") returned 13
	[0050.598] FindFirstFileA (in: lpFileName="C:\\Boot\\sk-SK\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb9d0
	[0050.598] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.598] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0050.598] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.598] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.598] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0050.598] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.599] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr.exe.mui") returned 1
	[0050.599] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr.exe.mui") returned 1
	[0050.599] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0050.599] PathFindFileNameA (pszPath="C:\\Boot\\sk-SK\\*.*") returned="*.*"
	[0050.599] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\sk-SK\\" | out: lpString1="C:\\Boot\\sk-SK\\") returned="C:\\Boot\\sk-SK\\"
	[0050.599] PathAddBackslashA (in: pszPath="C:\\Boot\\sk-SK\\" | out: pszPath="C:\\Boot\\sk-SK\\") returned=""
	[0050.599] lstrcatA (in: lpString1="C:\\Boot\\sk-SK\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\sk-SK\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\sk-SK\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.599] GetFileAttributesA (lpFileName="C:\\Boot\\sk-SK\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\sk-sk\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0050.599] CreateFileA (lpFileName="C:\\Boot\\sk-SK\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\sk-sk\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0050.600] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0050.600] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0050.601] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.601] CloseHandle (hObject=0x208) returned 1
	[0050.601] lstrcatA (in: lpString1="C:\\Boot\\sk-SK\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned="C:\\Boot\\sk-SK\\bootmgr.exe.mui"
	[0050.601] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0050.601] lstrlenA (lpString="*.zip") returned 5
	[0050.602] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0050.602] lstrlenA (lpString="*.rar") returned 5
	[0050.602] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0050.602] lstrlenA (lpString="*.7z") returned 4
	[0050.602] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0050.602] lstrlenA (lpString="*.tar") returned 5
	[0050.602] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0050.602] lstrlenA (lpString="*.gzip") returned 6
	[0050.602] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0050.602] lstrlenA (lpString="*.jpg") returned 5
	[0050.602] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.602] lstrlenA (lpString="*.jpeg") returned 6
	[0050.602] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0050.602] lstrlenA (lpString="*.bmp") returned 5
	[0050.602] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0050.602] lstrlenA (lpString="*.gif") returned 5
	[0050.602] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0050.602] lstrlenA (lpString="*.png") returned 5
	[0050.602] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0050.602] lstrlenA (lpString="*.doc") returned 5
	[0050.602] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0050.602] lstrlenA (lpString="*.docx") returned 6
	[0050.602] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0050.602] lstrlenA (lpString="*.xls") returned 5
	[0050.602] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.602] lstrlenA (lpString="*.xlsx") returned 6
	[0050.602] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0050.602] lstrlenA (lpString="*.ppt") returned 5
	[0050.602] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0050.602] lstrlenA (lpString="*.pptx") returned 6
	[0050.602] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0050.602] lstrlenA (lpString="*.txt") returned 5
	[0050.602] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0050.602] lstrlenA (lpString="*.pdf") returned 5
	[0050.602] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0050.602] lstrlenA (lpString="*.htm") returned 5
	[0050.603] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0050.603] lstrlenA (lpString="*.html") returned 6
	[0050.603] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0050.603] lstrlenA (lpString="*.mdb") returned 5
	[0050.603] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0050.603] lstrlenA (lpString="*.pfx") returned 5
	[0050.603] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0050.603] lstrlenA (lpString="*.md") returned 4
	[0050.603] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0050.603] lstrlenA (lpString="*.lnk") returned 5
	[0050.603] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0050.603] lstrlenA (lpString="*.torrent") returned 9
	[0050.603] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0050.603] lstrlenA (lpString="*.mov") returned 5
	[0050.603] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0050.603] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.603] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0050.603] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0050.603] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0050.603] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0050.603] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0050.603] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0050.603] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0050.603] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0050.603] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0050.603] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0050.603] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.au3") returned 0
	[0050.603] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.ahk") returned 0
	[0050.603] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.c") returned 0
	[0050.603] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.cc") returned 0
	[0050.604] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0
	[0050.604] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.cxx") returned 0
	[0050.604] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.c++") returned 0
	[0050.604] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.cs") returned 0
	[0050.604] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.vb") returned 0
	[0050.604] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.bas") returned 0
	[0050.604] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.csproj") returned 0
	[0050.604] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.604] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.604] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.manifest") returned 0
	[0050.604] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.php") returned 0
	[0050.604] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.vbe") returned 0
	[0050.604] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.vba") returned 0
	[0050.604] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.vbs") returned 0
	[0050.604] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.bat") returned 0
	[0050.604] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.cmd") returned 0
	[0050.604] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.js") returned 0
	[0050.604] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.jscript") returned 0
	[0050.604] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.hta") returned 0
	[0050.604] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.php7") returned 0
	[0050.604] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.db") returned 0
	[0050.604] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.swf") returned 0
	[0050.604] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.eml") returned 0
	[0050.604] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.part") returned 0
	[0050.604] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.nfo") returned 0
	[0050.604] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.rsa") returned 0
	[0050.605] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.key") returned 0
	[0050.605] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.aes") returned 0
	[0050.605] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.blob") returned 0
	[0050.605] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.btc") returned 0
	[0050.605] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.wallet") returned 0
	[0050.605] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0050.605] FindClose (in: hFindFile=0x7cb9d0 | out: hFindFile=0x7cb9d0) returned 1
	[0050.605] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1
	[0050.605] lstrcmpA (lpString1=".", lpString2="sl-SI") returned -1
	[0050.605] lstrcmpA (lpString1="..", lpString2="sl-SI") returned -1
	[0050.605] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0050.605] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="sl-SI" | out: lpString1="C:\\Boot\\sl-SI") returned="C:\\Boot\\sl-SI"
	[0050.605] FindFirstFileA (in: lpFileName="C:\\Boot\\sl-SI\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb810
	[0050.606] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.606] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0050.606] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.606] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.606] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0050.606] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.606] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr.exe.mui") returned 1
	[0050.606] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr.exe.mui") returned 1
	[0050.606] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0050.606] PathFindFileNameA (pszPath="C:\\Boot\\sl-SI\\*.*") returned="*.*"
	[0050.606] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\sl-SI\\" | out: lpString1="C:\\Boot\\sl-SI\\") returned="C:\\Boot\\sl-SI\\"
	[0050.606] PathAddBackslashA (in: pszPath="C:\\Boot\\sl-SI\\" | out: pszPath="C:\\Boot\\sl-SI\\") returned=""
	[0050.606] lstrcatA (in: lpString1="C:\\Boot\\sl-SI\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\sl-SI\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\sl-SI\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.606] GetFileAttributesA (lpFileName="C:\\Boot\\sl-SI\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\sl-si\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0050.606] CreateFileA (lpFileName="C:\\Boot\\sl-SI\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\sl-si\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0050.607] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0050.608] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.608] CloseHandle (hObject=0x208) returned 1
	[0050.608] lstrcatA (in: lpString1="C:\\Boot\\sl-SI\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned="C:\\Boot\\sl-SI\\bootmgr.exe.mui"
	[0050.608] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0050.609] lstrlenA (lpString="*.zip") returned 5
	[0050.609] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0050.609] lstrlenA (lpString="*.rar") returned 5
	[0050.609] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0050.609] lstrlenA (lpString="*.7z") returned 4
	[0050.609] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0050.609] lstrlenA (lpString="*.tar") returned 5
	[0050.609] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0050.609] lstrlenA (lpString="*.gzip") returned 6
	[0050.609] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0050.609] lstrlenA (lpString="*.jpg") returned 5
	[0050.609] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.609] lstrlenA (lpString="*.jpeg") returned 6
	[0050.609] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0050.609] lstrlenA (lpString="*.bmp") returned 5
	[0050.609] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0050.609] lstrlenA (lpString="*.gif") returned 5
	[0050.609] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0050.609] lstrlenA (lpString="*.png") returned 5
	[0050.609] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0050.609] lstrlenA (lpString="*.doc") returned 5
	[0050.609] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0050.609] lstrlenA (lpString="*.docx") returned 6
	[0050.609] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0050.609] lstrlenA (lpString="*.xls") returned 5
	[0050.609] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.609] lstrlenA (lpString="*.xlsx") returned 6
	[0050.609] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0050.609] lstrlenA (lpString="*.ppt") returned 5
	[0050.609] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0050.609] lstrlenA (lpString="*.pptx") returned 6
	[0050.609] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0050.609] lstrlenA (lpString="*.txt") returned 5
	[0050.609] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0050.609] lstrlenA (lpString="*.pdf") returned 5
	[0050.609] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0050.609] lstrlenA (lpString="*.htm") returned 5
	[0050.609] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0050.610] lstrlenA (lpString="*.html") returned 6
	[0050.610] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0050.610] lstrlenA (lpString="*.mdb") returned 5
	[0050.610] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0050.610] lstrlenA (lpString="*.pfx") returned 5
	[0050.610] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0050.610] lstrlenA (lpString="*.md") returned 4
	[0050.610] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0050.610] lstrlenA (lpString="*.lnk") returned 5
	[0050.610] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0050.610] lstrlenA (lpString="*.torrent") returned 9
	[0050.610] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0050.610] lstrlenA (lpString="*.mov") returned 5
	[0050.610] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0050.610] lstrlenA (lpString="*.3gp") returned 5
	[0050.610] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.610] lstrlenA (lpString="*.mpeg") returned 6
	[0050.610] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0050.610] lstrlenA (lpString="*.mpg") returned 5
	[0050.610] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0050.610] lstrlenA (lpString="*.flv") returned 5
	[0050.610] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0050.610] lstrlenA (lpString="*.avi") returned 5
	[0050.610] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0050.610] lstrlenA (lpString="*.mp4") returned 5
	[0050.610] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0050.610] lstrlenA (lpString="*.wmv") returned 5
	[0050.610] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0050.610] lstrlenA (lpString="*.mkv") returned 5
	[0050.610] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0050.610] lstrlenA (lpString="*.mp3") returned 5
	[0050.610] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0050.610] lstrlenA (lpString="*.wav") returned 5
	[0050.610] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0050.611] lstrlenA (lpString="*.flac") returned 6
	[0050.611] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0050.611] lstrlenA (lpString="*.wma") returned 5
	[0050.611] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.au3") returned 0
	[0050.611] lstrlenA (lpString="*.au3") returned 5
	[0050.611] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.ahk") returned 0
	[0050.611] lstrlenA (lpString="*.ahk") returned 5
	[0050.611] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.c") returned 0
	[0050.611] lstrlenA (lpString="*.c") returned 3
	[0050.611] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.cc") returned 0
	[0050.611] lstrlenA (lpString="*.cc") returned 4
	[0050.611] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0
	[0050.611] lstrlenA (lpString="*.cpp") returned 5
	[0050.611] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.cxx") returned 0
	[0050.611] lstrlenA (lpString="*.cxx") returned 5
	[0050.611] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.c++") returned 0
	[0050.611] lstrlenA (lpString="*.c++") returned 5
	[0050.611] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.cs") returned 0
	[0050.611] lstrlenA (lpString="*.cs") returned 4
	[0050.611] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.vb") returned 0
	[0050.611] lstrlenA (lpString="*.vb") returned 4
	[0050.611] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.bas") returned 0
	[0050.611] lstrlenA (lpString="*.bas") returned 5
	[0050.611] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.csproj") returned 0
	[0050.611] lstrlenA (lpString="*.csproj") returned 8
	[0050.611] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.611] lstrlenA (lpString="*.vbproj") returned 8
	[0050.611] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.611] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.611] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.manifest") returned 0
	[0050.611] lstrlenA (lpString="*.manifest") returned 10
	[0050.611] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.php") returned 0
	[0050.611] lstrlenA (lpString="*.php") returned 5
	[0050.611] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.vbe") returned 0
	[0050.611] lstrlenA (lpString="*.vbe") returned 5
	[0050.611] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.vba") returned 0
	[0050.611] lstrlenA (lpString="*.vba") returned 5
	[0050.612] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.vbs") returned 0
	[0050.612] lstrlenA (lpString="*.vbs") returned 5
	[0050.612] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.bat") returned 0
	[0050.612] lstrlenA (lpString="*.bat") returned 5
	[0050.612] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.cmd") returned 0
	[0050.612] lstrlenA (lpString="*.cmd") returned 5
	[0050.612] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.js") returned 0
	[0050.612] lstrlenA (lpString="*.js") returned 4
	[0050.612] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.jscript") returned 0
	[0050.612] lstrlenA (lpString="*.jscript") returned 9
	[0050.612] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.hta") returned 0
	[0050.612] lstrlenA (lpString="*.hta") returned 5
	[0050.612] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.php7") returned 0
	[0050.612] lstrlenA (lpString="*.php7") returned 6
	[0050.612] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.db") returned 0
	[0050.612] lstrlenA (lpString="*.db") returned 4
	[0050.612] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.swf") returned 0
	[0050.612] lstrlenA (lpString="*.swf") returned 5
	[0050.612] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.eml") returned 0
	[0050.612] lstrlenA (lpString="*.eml") returned 5
	[0050.612] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.part") returned 0
	[0050.612] lstrlenA (lpString="*.part") returned 6
	[0050.612] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.nfo") returned 0
	[0050.612] lstrlenA (lpString="*.nfo") returned 5
	[0050.612] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.rsa") returned 0
	[0050.612] lstrlenA (lpString="*.rsa") returned 5
	[0050.612] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.key") returned 0
	[0050.612] lstrlenA (lpString="*.key") returned 5
	[0050.612] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.aes") returned 0
	[0050.612] lstrlenA (lpString="*.aes") returned 5
	[0050.612] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.blob") returned 0
	[0050.612] lstrlenA (lpString="*.blob") returned 6
	[0050.612] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.btc") returned 0
	[0050.612] lstrlenA (lpString="*.btc") returned 5
	[0050.612] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.wallet") returned 0
	[0050.612] lstrlenA (lpString="*.wallet") returned 8
	[0050.612] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0050.612] FindClose (in: hFindFile=0x7cb810 | out: hFindFile=0x7cb810) returned 1
	[0050.613] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1
	[0050.613] lstrcmpA (lpString1=".", lpString2="sr-Latn-CS") returned -1
	[0050.613] lstrcmpA (lpString1="..", lpString2="sr-Latn-CS") returned -1
	[0050.613] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0050.613] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="sr-Latn-CS" | out: lpString1="C:\\Boot\\sr-Latn-CS") returned="C:\\Boot\\sr-Latn-CS"
	[0050.613] lstrlenA (lpString="C:\\Boot\\sr-Latn-CS") returned 18
	[0050.613] FindFirstFileA (in: lpFileName="C:\\Boot\\sr-Latn-CS\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb590
	[0050.613] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.613] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0050.613] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.613] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.613] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0050.613] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.613] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr.exe.mui") returned 1
	[0050.613] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr.exe.mui") returned 1
	[0050.613] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0050.613] PathFindFileNameA (pszPath="C:\\Boot\\sr-Latn-CS\\*.*") returned="*.*"
	[0050.613] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\sr-Latn-CS\\" | out: lpString1="C:\\Boot\\sr-Latn-CS\\") returned="C:\\Boot\\sr-Latn-CS\\"
	[0050.613] PathAddBackslashA (in: pszPath="C:\\Boot\\sr-Latn-CS\\" | out: pszPath="C:\\Boot\\sr-Latn-CS\\") returned=""
	[0050.613] lstrcatA (in: lpString1="C:\\Boot\\sr-Latn-CS\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\sr-Latn-CS\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\sr-Latn-CS\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.613] GetFileAttributesA (lpFileName="C:\\Boot\\sr-Latn-CS\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\sr-latn-cs\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0050.613] CreateFileA (lpFileName="C:\\Boot\\sr-Latn-CS\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\sr-latn-cs\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0050.616] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0050.616] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0050.617] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.617] CloseHandle (hObject=0x208) returned 1
	[0050.617] lstrcatA (in: lpString1="C:\\Boot\\sr-Latn-CS\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui"
	[0050.617] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0050.617] lstrlenA (lpString="*.zip") returned 5
	[0050.617] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0050.617] lstrlenA (lpString="*.rar") returned 5
	[0050.617] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0050.617] lstrlenA (lpString="*.7z") returned 4
	[0050.617] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0050.617] lstrlenA (lpString="*.tar") returned 5
	[0050.617] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0050.617] lstrlenA (lpString="*.gzip") returned 6
	[0050.617] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0050.617] lstrlenA (lpString="*.jpg") returned 5
	[0050.617] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.617] lstrlenA (lpString="*.jpeg") returned 6
	[0050.617] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0050.617] lstrlenA (lpString="*.bmp") returned 5
	[0050.617] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0050.617] lstrlenA (lpString="*.gif") returned 5
	[0050.617] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0050.617] lstrlenA (lpString="*.png") returned 5
	[0050.618] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0050.618] lstrlenA (lpString="*.doc") returned 5
	[0050.618] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0050.618] lstrlenA (lpString="*.docx") returned 6
	[0050.618] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0050.618] lstrlenA (lpString="*.xls") returned 5
	[0050.618] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.618] lstrlenA (lpString="*.xlsx") returned 6
	[0050.618] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0050.618] lstrlenA (lpString="*.ppt") returned 5
	[0050.618] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0050.618] lstrlenA (lpString="*.pptx") returned 6
	[0050.618] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0050.618] lstrlenA (lpString="*.txt") returned 5
	[0050.618] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0050.618] lstrlenA (lpString="*.pdf") returned 5
	[0050.618] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0050.618] lstrlenA (lpString="*.htm") returned 5
	[0050.618] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0050.618] lstrlenA (lpString="*.html") returned 6
	[0050.618] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0050.618] lstrlenA (lpString="*.mdb") returned 5
	[0050.618] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0050.618] lstrlenA (lpString="*.pfx") returned 5
	[0050.618] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0050.618] lstrlenA (lpString="*.md") returned 4
	[0050.618] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0050.618] lstrlenA (lpString="*.lnk") returned 5
	[0050.618] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0050.618] lstrlenA (lpString="*.torrent") returned 9
	[0050.618] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0050.618] lstrlenA (lpString="*.mov") returned 5
	[0050.618] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0050.618] lstrlenA (lpString="*.3gp") returned 5
	[0050.618] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.618] lstrlenA (lpString="*.mpeg") returned 6
	[0050.618] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0050.618] lstrlenA (lpString="*.mpg") returned 5
	[0050.618] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0050.619] lstrlenA (lpString="*.flv") returned 5
	[0050.619] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0050.619] lstrlenA (lpString="*.avi") returned 5
	[0050.619] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0050.619] lstrlenA (lpString="*.mp4") returned 5
	[0050.619] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0050.619] lstrlenA (lpString="*.wmv") returned 5
	[0050.619] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0050.619] lstrlenA (lpString="*.mkv") returned 5
	[0050.619] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0050.619] lstrlenA (lpString="*.mp3") returned 5
	[0050.619] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0050.619] lstrlenA (lpString="*.wav") returned 5
	[0050.619] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0050.619] lstrlenA (lpString="*.flac") returned 6
	[0050.619] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0050.619] lstrlenA (lpString="*.wma") returned 5
	[0050.619] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.au3") returned 0
	[0050.619] lstrlenA (lpString="*.au3") returned 5
	[0050.619] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.ahk") returned 0
	[0050.619] lstrlenA (lpString="*.ahk") returned 5
	[0050.619] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.c") returned 0
	[0050.619] lstrlenA (lpString="*.c") returned 3
	[0050.619] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.cc") returned 0
	[0050.619] lstrlenA (lpString="*.cc") returned 4
	[0050.619] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0
	[0050.619] lstrlenA (lpString="*.cpp") returned 5
	[0050.619] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.cxx") returned 0
	[0050.619] lstrlenA (lpString="*.cxx") returned 5
	[0050.619] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.c++") returned 0
	[0050.619] lstrlenA (lpString="*.c++") returned 5
	[0050.619] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.cs") returned 0
	[0050.619] lstrlenA (lpString="*.cs") returned 4
	[0050.619] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.vb") returned 0
	[0050.619] lstrlenA (lpString="*.vb") returned 4
	[0050.619] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.bas") returned 0
	[0050.619] lstrlenA (lpString="*.bas") returned 5
	[0050.620] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.csproj") returned 0
	[0050.620] lstrlenA (lpString="*.csproj") returned 8
	[0050.620] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.620] lstrlenA (lpString="*.vbproj") returned 8
	[0050.620] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.620] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.620] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.manifest") returned 0
	[0050.620] lstrlenA (lpString="*.manifest") returned 10
	[0050.620] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.php") returned 0
	[0050.620] lstrlenA (lpString="*.php") returned 5
	[0050.620] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.vbe") returned 0
	[0050.620] lstrlenA (lpString="*.vbe") returned 5
	[0050.620] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.vba") returned 0
	[0050.620] lstrlenA (lpString="*.vba") returned 5
	[0050.620] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.vbs") returned 0
	[0050.620] lstrlenA (lpString="*.vbs") returned 5
	[0050.620] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.bat") returned 0
	[0050.620] lstrlenA (lpString="*.bat") returned 5
	[0050.620] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.cmd") returned 0
	[0050.620] lstrlenA (lpString="*.cmd") returned 5
	[0050.620] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.js") returned 0
	[0050.620] lstrlenA (lpString="*.js") returned 4
	[0050.620] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.jscript") returned 0
	[0050.620] lstrlenA (lpString="*.jscript") returned 9
	[0050.620] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.hta") returned 0
	[0050.620] lstrlenA (lpString="*.hta") returned 5
	[0050.620] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.php7") returned 0
	[0050.620] lstrlenA (lpString="*.php7") returned 6
	[0050.620] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.db") returned 0
	[0050.620] lstrlenA (lpString="*.db") returned 4
	[0050.620] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.swf") returned 0
	[0050.620] lstrlenA (lpString="*.swf") returned 5
	[0050.620] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.eml") returned 0
	[0050.620] lstrlenA (lpString="*.eml") returned 5
	[0050.620] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.part") returned 0
	[0050.620] lstrlenA (lpString="*.part") returned 6
	[0050.620] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.nfo") returned 0
	[0050.620] lstrlenA (lpString="*.nfo") returned 5
	[0050.620] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.rsa") returned 0
	[0050.621] lstrlenA (lpString="*.rsa") returned 5
	[0050.621] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.key") returned 0
	[0050.621] lstrlenA (lpString="*.key") returned 5
	[0050.621] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.aes") returned 0
	[0050.621] lstrlenA (lpString="*.aes") returned 5
	[0050.621] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.blob") returned 0
	[0050.621] lstrlenA (lpString="*.blob") returned 6
	[0050.621] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.btc") returned 0
	[0050.621] lstrlenA (lpString="*.btc") returned 5
	[0050.621] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.wallet") returned 0
	[0050.621] lstrlenA (lpString="*.wallet") returned 8
	[0050.621] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0050.621] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.621] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="memtest.exe.mui") returned -1
	[0050.621] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="memtest.exe.mui") returned -1
	[0050.621] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1
	[0050.621] PathFindFileNameA (pszPath="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned="bootmgr.exe.mui"
	[0050.621] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\sr-Latn-CS\\" | out: lpString1="C:\\Boot\\sr-Latn-CS\\") returned="C:\\Boot\\sr-Latn-CS\\"
	[0050.621] PathAddBackslashA (in: pszPath="C:\\Boot\\sr-Latn-CS\\" | out: pszPath="C:\\Boot\\sr-Latn-CS\\") returned=""
	[0050.621] lstrcatA (in: lpString1="C:\\Boot\\sr-Latn-CS\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\sr-Latn-CS\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\sr-Latn-CS\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.621] GetFileAttributesA (lpFileName="C:\\Boot\\sr-Latn-CS\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\sr-latn-cs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.621] lstrcatA (in: lpString1="C:\\Boot\\sr-Latn-CS\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui") returned="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui"
	[0050.621] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.zip") returned 0
	[0050.621] lstrlenA (lpString="*.zip") returned 5
	[0050.621] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.rar") returned 0
	[0050.621] lstrlenA (lpString="*.rar") returned 5
	[0050.621] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.7z") returned 0
	[0050.621] lstrlenA (lpString="*.7z") returned 4
	[0050.621] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.tar") returned 0
	[0050.621] lstrlenA (lpString="*.tar") returned 5
	[0050.621] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.gzip") returned 0
	[0050.621] lstrlenA (lpString="*.gzip") returned 6
	[0050.621] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.jpg") returned 0
	[0050.621] lstrlenA (lpString="*.jpg") returned 5
	[0050.622] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.622] lstrlenA (lpString="*.jpeg") returned 6
	[0050.622] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.bmp") returned 0
	[0050.622] lstrlenA (lpString="*.bmp") returned 5
	[0050.622] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.gif") returned 0
	[0050.622] lstrlenA (lpString="*.gif") returned 5
	[0050.622] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.png") returned 0
	[0050.622] lstrlenA (lpString="*.png") returned 5
	[0050.622] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.doc") returned 0
	[0050.622] lstrlenA (lpString="*.doc") returned 5
	[0050.622] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.docx") returned 0
	[0050.622] lstrlenA (lpString="*.docx") returned 6
	[0050.622] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.xls") returned 0
	[0050.622] lstrlenA (lpString="*.xls") returned 5
	[0050.622] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.622] lstrlenA (lpString="*.xlsx") returned 6
	[0050.622] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.ppt") returned 0
	[0050.622] lstrlenA (lpString="*.ppt") returned 5
	[0050.622] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.pptx") returned 0
	[0050.622] lstrlenA (lpString="*.pptx") returned 6
	[0050.622] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.txt") returned 0
	[0050.622] lstrlenA (lpString="*.txt") returned 5
	[0050.622] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.pdf") returned 0
	[0050.622] lstrlenA (lpString="*.pdf") returned 5
	[0050.622] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.htm") returned 0
	[0050.622] lstrlenA (lpString="*.htm") returned 5
	[0050.622] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.html") returned 0
	[0050.622] lstrlenA (lpString="*.html") returned 6
	[0050.622] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.mdb") returned 0
	[0050.622] lstrlenA (lpString="*.mdb") returned 5
	[0050.622] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.pfx") returned 0
	[0050.622] lstrlenA (lpString="*.pfx") returned 5
	[0050.622] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.md") returned 0
	[0050.622] lstrlenA (lpString="*.md") returned 4
	[0050.622] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.lnk") returned 0
	[0050.622] lstrlenA (lpString="*.lnk") returned 5
	[0050.622] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.torrent") returned 0
	[0050.622] lstrlenA (lpString="*.torrent") returned 9
	[0050.623] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.mov") returned 0
	[0050.623] lstrlenA (lpString="*.mov") returned 5
	[0050.623] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.3gp") returned 0
	[0050.623] lstrlenA (lpString="*.3gp") returned 5
	[0050.623] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.623] lstrlenA (lpString="*.mpeg") returned 6
	[0050.623] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.mpg") returned 0
	[0050.623] lstrlenA (lpString="*.mpg") returned 5
	[0050.623] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.flv") returned 0
	[0050.623] lstrlenA (lpString="*.flv") returned 5
	[0050.623] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.avi") returned 0
	[0050.623] lstrlenA (lpString="*.avi") returned 5
	[0050.623] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.mp4") returned 0
	[0050.623] lstrlenA (lpString="*.mp4") returned 5
	[0050.623] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.wmv") returned 0
	[0050.623] lstrlenA (lpString="*.wmv") returned 5
	[0050.623] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.mkv") returned 0
	[0050.623] lstrlenA (lpString="*.mkv") returned 5
	[0050.623] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.mp3") returned 0
	[0050.623] lstrlenA (lpString="*.mp3") returned 5
	[0050.623] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.wav") returned 0
	[0050.623] lstrlenA (lpString="*.wav") returned 5
	[0050.623] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.flac") returned 0
	[0050.623] lstrlenA (lpString="*.flac") returned 6
	[0050.623] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.wma") returned 0
	[0050.623] lstrlenA (lpString="*.wma") returned 5
	[0050.623] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.au3") returned 0
	[0050.623] lstrlenA (lpString="*.au3") returned 5
	[0050.623] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.ahk") returned 0
	[0050.623] lstrlenA (lpString="*.ahk") returned 5
	[0050.623] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.c") returned 0
	[0050.623] lstrlenA (lpString="*.c") returned 3
	[0050.623] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.cc") returned 0
	[0050.623] lstrlenA (lpString="*.cc") returned 4
	[0050.623] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.cpp") returned 0
	[0050.623] lstrlenA (lpString="*.cpp") returned 5
	[0050.623] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.cxx") returned 0
	[0050.624] lstrlenA (lpString="*.cxx") returned 5
	[0050.624] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.c++") returned 0
	[0050.624] lstrlenA (lpString="*.c++") returned 5
	[0050.624] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.cs") returned 0
	[0050.624] lstrlenA (lpString="*.cs") returned 4
	[0050.624] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.vb") returned 0
	[0050.624] lstrlenA (lpString="*.vb") returned 4
	[0050.624] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.bas") returned 0
	[0050.624] lstrlenA (lpString="*.bas") returned 5
	[0050.624] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.csproj") returned 0
	[0050.624] lstrlenA (lpString="*.csproj") returned 8
	[0050.624] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.624] lstrlenA (lpString="*.vbproj") returned 8
	[0050.624] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.624] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.624] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.manifest") returned 0
	[0050.624] lstrlenA (lpString="*.manifest") returned 10
	[0050.624] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.php") returned 0
	[0050.624] lstrlenA (lpString="*.php") returned 5
	[0050.624] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.vbe") returned 0
	[0050.624] lstrlenA (lpString="*.vbe") returned 5
	[0050.624] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.vba") returned 0
	[0050.624] lstrlenA (lpString="*.vba") returned 5
	[0050.624] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.vbs") returned 0
	[0050.624] lstrlenA (lpString="*.vbs") returned 5
	[0050.624] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.bat") returned 0
	[0050.624] lstrlenA (lpString="*.bat") returned 5
	[0050.624] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.cmd") returned 0
	[0050.624] lstrlenA (lpString="*.cmd") returned 5
	[0050.624] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.js") returned 0
	[0050.624] lstrlenA (lpString="*.js") returned 4
	[0050.624] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.jscript") returned 0
	[0050.624] lstrlenA (lpString="*.jscript") returned 9
	[0050.624] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.hta") returned 0
	[0050.624] lstrlenA (lpString="*.hta") returned 5
	[0050.624] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.php7") returned 0
	[0050.624] lstrlenA (lpString="*.php7") returned 6
	[0050.624] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.db") returned 0
	[0050.625] lstrlenA (lpString="*.db") returned 4
	[0050.625] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.swf") returned 0
	[0050.625] lstrlenA (lpString="*.swf") returned 5
	[0050.625] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.eml") returned 0
	[0050.625] lstrlenA (lpString="*.eml") returned 5
	[0050.625] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.part") returned 0
	[0050.625] lstrlenA (lpString="*.part") returned 6
	[0050.625] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.nfo") returned 0
	[0050.625] lstrlenA (lpString="*.nfo") returned 5
	[0050.625] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.rsa") returned 0
	[0050.625] lstrlenA (lpString="*.rsa") returned 5
	[0050.625] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.key") returned 0
	[0050.625] lstrlenA (lpString="*.key") returned 5
	[0050.625] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.aes") returned 0
	[0050.625] lstrlenA (lpString="*.aes") returned 5
	[0050.625] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.blob") returned 0
	[0050.625] lstrlenA (lpString="*.blob") returned 6
	[0050.625] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.btc") returned 0
	[0050.625] lstrlenA (lpString="*.btc") returned 5
	[0050.625] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.wallet") returned 0
	[0050.625] lstrlenA (lpString="*.wallet") returned 8
	[0050.625] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0050.625] FindClose (in: hFindFile=0x7cb590 | out: hFindFile=0x7cb590) returned 1
	[0050.625] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1
	[0050.625] lstrcmpA (lpString1=".", lpString2="sr-Latn-RS") returned -1
	[0050.625] lstrcmpA (lpString1="..", lpString2="sr-Latn-RS") returned -1
	[0050.625] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0050.625] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="sr-Latn-RS" | out: lpString1="C:\\Boot\\sr-Latn-RS") returned="C:\\Boot\\sr-Latn-RS"
	[0050.625] lstrlenA (lpString="C:\\Boot\\sr-Latn-RS") returned 18
	[0050.625] FindFirstFileA (in: lpFileName="C:\\Boot\\sr-Latn-RS\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbb90
	[0050.648] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.648] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0050.649] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.649] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.649] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0050.649] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.649] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr.exe.mui") returned 1
	[0050.649] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr.exe.mui") returned 1
	[0050.649] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0050.649] PathFindFileNameA (pszPath="C:\\Boot\\sr-Latn-RS\\*.*") returned="*.*"
	[0050.649] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\sr-Latn-RS\\" | out: lpString1="C:\\Boot\\sr-Latn-RS\\") returned="C:\\Boot\\sr-Latn-RS\\"
	[0050.649] PathAddBackslashA (in: pszPath="C:\\Boot\\sr-Latn-RS\\" | out: pszPath="C:\\Boot\\sr-Latn-RS\\") returned=""
	[0050.649] lstrcatA (in: lpString1="C:\\Boot\\sr-Latn-RS\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\sr-Latn-RS\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\sr-Latn-RS\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.649] GetFileAttributesA (lpFileName="C:\\Boot\\sr-Latn-RS\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\sr-latn-rs\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0050.649] CreateFileA (lpFileName="C:\\Boot\\sr-Latn-RS\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\sr-latn-rs\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0050.649] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0050.649] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0050.650] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.650] CloseHandle (hObject=0x208) returned 1
	[0050.650] lstrcatA (in: lpString1="C:\\Boot\\sr-Latn-RS\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui") returned="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui"
	[0050.651] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0050.651] lstrlenA (lpString="*.zip") returned 5
	[0050.651] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0050.651] lstrlenA (lpString="*.rar") returned 5
	[0050.651] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0050.651] lstrlenA (lpString="*.7z") returned 4
	[0050.651] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0050.651] lstrlenA (lpString="*.tar") returned 5
	[0050.651] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0050.651] lstrlenA (lpString="*.gzip") returned 6
	[0050.651] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0050.651] lstrlenA (lpString="*.jpg") returned 5
	[0050.651] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.651] lstrlenA (lpString="*.jpeg") returned 6
	[0050.651] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0050.651] lstrlenA (lpString="*.bmp") returned 5
	[0050.651] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0050.651] lstrlenA (lpString="*.gif") returned 5
	[0050.651] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0050.651] lstrlenA (lpString="*.png") returned 5
	[0050.651] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0050.651] lstrlenA (lpString="*.doc") returned 5
	[0050.651] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0050.651] lstrlenA (lpString="*.docx") returned 6
	[0050.651] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0050.651] lstrlenA (lpString="*.xls") returned 5
	[0050.651] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.651] lstrlenA (lpString="*.xlsx") returned 6
	[0050.651] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0050.651] lstrlenA (lpString="*.ppt") returned 5
	[0050.651] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0050.651] lstrlenA (lpString="*.pptx") returned 6
	[0050.651] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0050.651] lstrlenA (lpString="*.txt") returned 5
	[0050.651] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0050.651] lstrlenA (lpString="*.pdf") returned 5
	[0050.652] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0050.652] lstrlenA (lpString="*.htm") returned 5
	[0050.652] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0050.652] lstrlenA (lpString="*.html") returned 6
	[0050.652] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0050.652] lstrlenA (lpString="*.mdb") returned 5
	[0050.652] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0050.652] lstrlenA (lpString="*.pfx") returned 5
	[0050.652] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0050.652] lstrlenA (lpString="*.md") returned 4
	[0050.652] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0050.652] lstrlenA (lpString="*.lnk") returned 5
	[0050.652] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0050.652] lstrlenA (lpString="*.torrent") returned 9
	[0050.652] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0050.652] lstrlenA (lpString="*.mov") returned 5
	[0050.652] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0050.652] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.652] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0050.652] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0050.652] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0050.652] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0050.652] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0050.652] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0050.652] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0050.652] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0050.652] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0050.652] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0050.652] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.au3") returned 0
	[0050.653] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.ahk") returned 0
	[0050.653] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.c") returned 0
	[0050.653] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.cc") returned 0
	[0050.653] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0
	[0050.653] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.cxx") returned 0
	[0050.653] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.c++") returned 0
	[0050.653] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.cs") returned 0
	[0050.653] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.vb") returned 0
	[0050.653] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.bas") returned 0
	[0050.653] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.csproj") returned 0
	[0050.653] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.653] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.653] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.manifest") returned 0
	[0050.653] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.php") returned 0
	[0050.653] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.vbe") returned 0
	[0050.653] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.vba") returned 0
	[0050.653] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.vbs") returned 0
	[0050.653] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.bat") returned 0
	[0050.653] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.cmd") returned 0
	[0050.653] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.js") returned 0
	[0050.653] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.jscript") returned 0
	[0050.653] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.hta") returned 0
	[0050.653] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.php7") returned 0
	[0050.653] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.db") returned 0
	[0050.653] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.swf") returned 0
	[0050.653] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.eml") returned 0
	[0050.654] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.part") returned 0
	[0050.654] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.nfo") returned 0
	[0050.654] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.rsa") returned 0
	[0050.654] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.key") returned 0
	[0050.654] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.aes") returned 0
	[0050.654] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.blob") returned 0
	[0050.654] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.btc") returned 0
	[0050.654] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.wallet") returned 0
	[0050.654] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0050.654] FindClose (in: hFindFile=0x7cbb90 | out: hFindFile=0x7cbb90) returned 1
	[0050.654] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0050.654] lstrcmpA (lpString1=".", lpString2="sv-SE") returned -1
	[0050.654] lstrcmpA (lpString1="..", lpString2="sv-SE") returned -1
	[0050.654] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0050.654] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="sv-SE" | out: lpString1="C:\\Boot\\sv-SE") returned="C:\\Boot\\sv-SE"
	[0050.654] FindFirstFileA (in: lpFileName="C:\\Boot\\sv-SE\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x7cb590
	[0050.655] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.655] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1
	[0050.655] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.655] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.655] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0050.655] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.655] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr.exe.mui") returned 1
	[0050.655] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr.exe.mui") returned 1
	[0050.655] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0050.655] PathFindFileNameA (pszPath="C:\\Boot\\sv-SE\\*.*") returned="*.*"
	[0050.655] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\sv-SE\\" | out: lpString1="C:\\Boot\\sv-SE\\") returned="C:\\Boot\\sv-SE\\"
	[0050.655] PathAddBackslashA (in: pszPath="C:\\Boot\\sv-SE\\" | out: pszPath="C:\\Boot\\sv-SE\\") returned=""
	[0050.655] lstrcatA (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\sv-SE\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\sv-SE\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.655] GetFileAttributesA (lpFileName="C:\\Boot\\sv-SE\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\sv-se\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0050.656] CreateFileA (lpFileName="C:\\Boot\\sv-SE\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\sv-se\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0050.661] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0050.662] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.663] CloseHandle (hObject=0x208) returned 1
	[0050.663] lstrcatA (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned="C:\\Boot\\sv-SE\\bootmgr.exe.mui"
	[0050.663] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0050.663] lstrlenA (lpString="*.zip") returned 5
	[0050.663] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0050.663] lstrlenA (lpString="*.rar") returned 5
	[0050.663] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0050.663] lstrlenA (lpString="*.7z") returned 4
	[0050.663] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0050.663] lstrlenA (lpString="*.tar") returned 5
	[0050.663] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0050.663] lstrlenA (lpString="*.gzip") returned 6
	[0050.663] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0050.663] lstrlenA (lpString="*.jpg") returned 5
	[0050.663] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.663] lstrlenA (lpString="*.jpeg") returned 6
	[0050.663] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0050.663] lstrlenA (lpString="*.bmp") returned 5
	[0050.663] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0050.663] lstrlenA (lpString="*.gif") returned 5
	[0050.663] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0050.663] lstrlenA (lpString="*.png") returned 5
	[0050.663] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0050.663] lstrlenA (lpString="*.doc") returned 5
	[0050.663] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0050.663] lstrlenA (lpString="*.docx") returned 6
	[0050.663] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0050.663] lstrlenA (lpString="*.xls") returned 5
	[0050.663] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.663] lstrlenA (lpString="*.xlsx") returned 6
	[0050.664] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0050.664] lstrlenA (lpString="*.ppt") returned 5
	[0050.664] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0050.664] lstrlenA (lpString="*.pptx") returned 6
	[0050.664] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0050.664] lstrlenA (lpString="*.txt") returned 5
	[0050.664] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0050.664] lstrlenA (lpString="*.pdf") returned 5
	[0050.664] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0050.664] lstrlenA (lpString="*.htm") returned 5
	[0050.664] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0050.664] lstrlenA (lpString="*.html") returned 6
	[0050.664] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0050.664] lstrlenA (lpString="*.mdb") returned 5
	[0050.664] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0050.664] lstrlenA (lpString="*.pfx") returned 5
	[0050.664] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0050.664] lstrlenA (lpString="*.md") returned 4
	[0050.664] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0050.664] lstrlenA (lpString="*.lnk") returned 5
	[0050.664] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0050.664] lstrlenA (lpString="*.torrent") returned 9
	[0050.664] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0050.664] lstrlenA (lpString="*.mov") returned 5
	[0050.664] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0050.664] lstrlenA (lpString="*.3gp") returned 5
	[0050.664] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.664] lstrlenA (lpString="*.mpeg") returned 6
	[0050.664] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0050.664] lstrlenA (lpString="*.mpg") returned 5
	[0050.664] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0050.664] lstrlenA (lpString="*.flv") returned 5
	[0050.664] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0050.664] lstrlenA (lpString="*.avi") returned 5
	[0050.664] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0050.664] lstrlenA (lpString="*.mp4") returned 5
	[0050.664] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0050.664] lstrlenA (lpString="*.wmv") returned 5
	[0050.665] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0050.665] lstrlenA (lpString="*.mkv") returned 5
	[0050.665] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0050.665] lstrlenA (lpString="*.mp3") returned 5
	[0050.665] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0050.665] lstrlenA (lpString="*.wav") returned 5
	[0050.665] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0050.665] lstrlenA (lpString="*.flac") returned 6
	[0050.665] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0050.665] lstrlenA (lpString="*.wma") returned 5
	[0050.665] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.au3") returned 0
	[0050.665] lstrlenA (lpString="*.au3") returned 5
	[0050.665] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.ahk") returned 0
	[0050.665] lstrlenA (lpString="*.ahk") returned 5
	[0050.665] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.c") returned 0
	[0050.665] lstrlenA (lpString="*.c") returned 3
	[0050.665] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.cc") returned 0
	[0050.665] lstrlenA (lpString="*.cc") returned 4
	[0050.665] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0
	[0050.665] lstrlenA (lpString="*.cpp") returned 5
	[0050.665] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.cxx") returned 0
	[0050.665] lstrlenA (lpString="*.cxx") returned 5
	[0050.665] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.c++") returned 0
	[0050.665] lstrlenA (lpString="*.c++") returned 5
	[0050.665] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.cs") returned 0
	[0050.665] lstrlenA (lpString="*.cs") returned 4
	[0050.665] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.vb") returned 0
	[0050.665] lstrlenA (lpString="*.vb") returned 4
	[0050.665] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.bas") returned 0
	[0050.665] lstrlenA (lpString="*.bas") returned 5
	[0050.665] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.csproj") returned 0
	[0050.665] lstrlenA (lpString="*.csproj") returned 8
	[0050.665] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.665] lstrlenA (lpString="*.vbproj") returned 8
	[0050.665] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.665] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.665] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.manifest") returned 0
	[0050.665] lstrlenA (lpString="*.manifest") returned 10
	[0050.666] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.php") returned 0
	[0050.666] lstrlenA (lpString="*.php") returned 5
	[0050.666] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.vbe") returned 0
	[0050.666] lstrlenA (lpString="*.vbe") returned 5
	[0050.666] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.vba") returned 0
	[0050.666] lstrlenA (lpString="*.vba") returned 5
	[0050.666] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.vbs") returned 0
	[0050.666] lstrlenA (lpString="*.vbs") returned 5
	[0050.666] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.bat") returned 0
	[0050.666] lstrlenA (lpString="*.bat") returned 5
	[0050.666] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.cmd") returned 0
	[0050.666] lstrlenA (lpString="*.cmd") returned 5
	[0050.666] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.js") returned 0
	[0050.666] lstrlenA (lpString="*.js") returned 4
	[0050.666] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.jscript") returned 0
	[0050.666] lstrlenA (lpString="*.jscript") returned 9
	[0050.666] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.hta") returned 0
	[0050.666] lstrlenA (lpString="*.hta") returned 5
	[0050.666] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.php7") returned 0
	[0050.666] lstrlenA (lpString="*.php7") returned 6
	[0050.666] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.db") returned 0
	[0050.666] lstrlenA (lpString="*.db") returned 4
	[0050.666] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.swf") returned 0
	[0050.666] lstrlenA (lpString="*.swf") returned 5
	[0050.666] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.eml") returned 0
	[0050.666] lstrlenA (lpString="*.eml") returned 5
	[0050.666] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.part") returned 0
	[0050.666] lstrlenA (lpString="*.part") returned 6
	[0050.666] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.nfo") returned 0
	[0050.666] lstrlenA (lpString="*.nfo") returned 5
	[0050.666] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.rsa") returned 0
	[0050.666] lstrlenA (lpString="*.rsa") returned 5
	[0050.666] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.key") returned 0
	[0050.666] lstrlenA (lpString="*.key") returned 5
	[0050.666] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.aes") returned 0
	[0050.666] lstrlenA (lpString="*.aes") returned 5
	[0050.666] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.blob") returned 0
	[0050.667] lstrlenA (lpString="*.blob") returned 6
	[0050.667] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.btc") returned 0
	[0050.667] lstrlenA (lpString="*.btc") returned 5
	[0050.667] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.wallet") returned 0
	[0050.667] lstrlenA (lpString="*.wallet") returned 8
	[0050.667] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0050.667] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.667] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="memtest.exe.mui") returned -1
	[0050.667] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="memtest.exe.mui") returned -1
	[0050.667] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1
	[0050.667] PathFindFileNameA (pszPath="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned="bootmgr.exe.mui"
	[0050.667] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\sv-SE\\" | out: lpString1="C:\\Boot\\sv-SE\\") returned="C:\\Boot\\sv-SE\\"
	[0050.667] PathAddBackslashA (in: pszPath="C:\\Boot\\sv-SE\\" | out: pszPath="C:\\Boot\\sv-SE\\") returned=""
	[0050.667] lstrcatA (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\sv-SE\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\sv-SE\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.667] GetFileAttributesA (lpFileName="C:\\Boot\\sv-SE\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\sv-se\\how-to-decrypt-files.htm")) returned 0x20
	[0050.667] lstrcatA (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\sv-SE\\memtest.exe.mui") returned="C:\\Boot\\sv-SE\\memtest.exe.mui"
	[0050.667] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.zip") returned 0
	[0050.667] lstrlenA (lpString="*.zip") returned 5
	[0050.667] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.rar") returned 0
	[0050.667] lstrlenA (lpString="*.rar") returned 5
	[0050.667] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.7z") returned 0
	[0050.667] lstrlenA (lpString="*.7z") returned 4
	[0050.667] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.tar") returned 0
	[0050.667] lstrlenA (lpString="*.tar") returned 5
	[0050.667] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.gzip") returned 0
	[0050.667] lstrlenA (lpString="*.gzip") returned 6
	[0050.667] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.jpg") returned 0
	[0050.667] lstrlenA (lpString="*.jpg") returned 5
	[0050.667] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.667] lstrlenA (lpString="*.jpeg") returned 6
	[0050.667] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.bmp") returned 0
	[0050.667] lstrlenA (lpString="*.bmp") returned 5
	[0050.667] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.gif") returned 0
	[0050.667] lstrlenA (lpString="*.gif") returned 5
	[0050.668] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.png") returned 0
	[0050.668] lstrlenA (lpString="*.png") returned 5
	[0050.668] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.doc") returned 0
	[0050.668] lstrlenA (lpString="*.doc") returned 5
	[0050.668] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.docx") returned 0
	[0050.668] lstrlenA (lpString="*.docx") returned 6
	[0050.668] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.xls") returned 0
	[0050.668] lstrlenA (lpString="*.xls") returned 5
	[0050.668] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.668] lstrlenA (lpString="*.xlsx") returned 6
	[0050.668] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.ppt") returned 0
	[0050.668] lstrlenA (lpString="*.ppt") returned 5
	[0050.668] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.pptx") returned 0
	[0050.668] lstrlenA (lpString="*.pptx") returned 6
	[0050.668] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.txt") returned 0
	[0050.668] lstrlenA (lpString="*.txt") returned 5
	[0050.668] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.pdf") returned 0
	[0050.668] lstrlenA (lpString="*.pdf") returned 5
	[0050.668] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.htm") returned 0
	[0050.668] lstrlenA (lpString="*.htm") returned 5
	[0050.668] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.html") returned 0
	[0050.668] lstrlenA (lpString="*.html") returned 6
	[0050.668] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.mdb") returned 0
	[0050.668] lstrlenA (lpString="*.mdb") returned 5
	[0050.668] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.pfx") returned 0
	[0050.668] lstrlenA (lpString="*.pfx") returned 5
	[0050.668] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.md") returned 0
	[0050.668] lstrlenA (lpString="*.md") returned 4
	[0050.668] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.lnk") returned 0
	[0050.668] lstrlenA (lpString="*.lnk") returned 5
	[0050.668] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.torrent") returned 0
	[0050.668] lstrlenA (lpString="*.torrent") returned 9
	[0050.668] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.mov") returned 0
	[0050.668] lstrlenA (lpString="*.mov") returned 5
	[0050.668] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.3gp") returned 0
	[0050.668] lstrlenA (lpString="*.3gp") returned 5
	[0050.668] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.668] lstrlenA (lpString="*.mpeg") returned 6
	[0050.669] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.mpg") returned 0
	[0050.669] lstrlenA (lpString="*.mpg") returned 5
	[0050.669] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.flv") returned 0
	[0050.669] lstrlenA (lpString="*.flv") returned 5
	[0050.669] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.avi") returned 0
	[0050.669] lstrlenA (lpString="*.avi") returned 5
	[0050.669] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.mp4") returned 0
	[0050.669] lstrlenA (lpString="*.mp4") returned 5
	[0050.669] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.wmv") returned 0
	[0050.669] lstrlenA (lpString="*.wmv") returned 5
	[0050.669] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.mkv") returned 0
	[0050.669] lstrlenA (lpString="*.mkv") returned 5
	[0050.669] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.mp3") returned 0
	[0050.669] lstrlenA (lpString="*.mp3") returned 5
	[0050.669] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.wav") returned 0
	[0050.669] lstrlenA (lpString="*.wav") returned 5
	[0050.669] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.flac") returned 0
	[0050.669] lstrlenA (lpString="*.flac") returned 6
	[0050.669] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.wma") returned 0
	[0050.669] lstrlenA (lpString="*.wma") returned 5
	[0050.669] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.au3") returned 0
	[0050.669] lstrlenA (lpString="*.au3") returned 5
	[0050.669] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.ahk") returned 0
	[0050.669] lstrlenA (lpString="*.ahk") returned 5
	[0050.669] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.c") returned 0
	[0050.669] lstrlenA (lpString="*.c") returned 3
	[0050.669] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.cc") returned 0
	[0050.669] lstrlenA (lpString="*.cc") returned 4
	[0050.669] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.cpp") returned 0
	[0050.669] lstrlenA (lpString="*.cpp") returned 5
	[0050.669] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.cxx") returned 0
	[0050.669] lstrlenA (lpString="*.cxx") returned 5
	[0050.669] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.c++") returned 0
	[0050.669] lstrlenA (lpString="*.c++") returned 5
	[0050.669] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.cs") returned 0
	[0050.669] lstrlenA (lpString="*.cs") returned 4
	[0050.669] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.vb") returned 0
	[0050.670] lstrlenA (lpString="*.vb") returned 4
	[0050.670] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.bas") returned 0
	[0050.670] lstrlenA (lpString="*.bas") returned 5
	[0050.670] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.csproj") returned 0
	[0050.670] lstrlenA (lpString="*.csproj") returned 8
	[0050.670] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.670] lstrlenA (lpString="*.vbproj") returned 8
	[0050.670] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.670] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.670] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.manifest") returned 0
	[0050.670] lstrlenA (lpString="*.manifest") returned 10
	[0050.670] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.php") returned 0
	[0050.670] lstrlenA (lpString="*.php") returned 5
	[0050.670] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.vbe") returned 0
	[0050.670] lstrlenA (lpString="*.vbe") returned 5
	[0050.670] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.vba") returned 0
	[0050.670] lstrlenA (lpString="*.vba") returned 5
	[0050.670] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.vbs") returned 0
	[0050.670] lstrlenA (lpString="*.vbs") returned 5
	[0050.670] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.bat") returned 0
	[0050.670] lstrlenA (lpString="*.bat") returned 5
	[0050.670] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.cmd") returned 0
	[0050.670] lstrlenA (lpString="*.cmd") returned 5
	[0050.670] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.js") returned 0
	[0050.670] lstrlenA (lpString="*.js") returned 4
	[0050.670] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.jscript") returned 0
	[0050.670] lstrlenA (lpString="*.jscript") returned 9
	[0050.670] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.hta") returned 0
	[0050.670] lstrlenA (lpString="*.hta") returned 5
	[0050.670] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.php7") returned 0
	[0050.670] lstrlenA (lpString="*.php7") returned 6
	[0050.670] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.db") returned 0
	[0050.670] lstrlenA (lpString="*.db") returned 4
	[0050.670] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.swf") returned 0
	[0050.670] lstrlenA (lpString="*.swf") returned 5
	[0050.670] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.eml") returned 0
	[0050.670] lstrlenA (lpString="*.eml") returned 5
	[0050.670] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.part") returned 0
	[0050.671] lstrlenA (lpString="*.part") returned 6
	[0050.671] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.nfo") returned 0
	[0050.671] lstrlenA (lpString="*.nfo") returned 5
	[0050.671] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.rsa") returned 0
	[0050.671] lstrlenA (lpString="*.rsa") returned 5
	[0050.671] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.key") returned 0
	[0050.671] lstrlenA (lpString="*.key") returned 5
	[0050.671] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.aes") returned 0
	[0050.671] lstrlenA (lpString="*.aes") returned 5
	[0050.671] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.blob") returned 0
	[0050.671] lstrlenA (lpString="*.blob") returned 6
	[0050.671] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.btc") returned 0
	[0050.671] lstrlenA (lpString="*.btc") returned 5
	[0050.671] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.wallet") returned 0
	[0050.671] lstrlenA (lpString="*.wallet") returned 8
	[0050.671] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0050.671] FindClose (in: hFindFile=0x7cb590 | out: hFindFile=0x7cb590) returned 1
	[0050.671] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1
	[0050.671] lstrcmpA (lpString1=".", lpString2="tr-TR") returned -1
	[0050.671] lstrcmpA (lpString1="..", lpString2="tr-TR") returned -1
	[0050.671] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0050.671] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="tr-TR" | out: lpString1="C:\\Boot\\tr-TR") returned="C:\\Boot\\tr-TR"
	[0050.671] lstrlenA (lpString="C:\\Boot\\tr-TR") returned 13
	[0050.671] FindFirstFileA (in: lpFileName="C:\\Boot\\tr-TR\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb910
	[0050.671] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.671] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0050.671] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.672] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.672] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0050.672] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.672] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr.exe.mui") returned 1
	[0050.672] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr.exe.mui") returned 1
	[0050.672] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0050.672] PathFindFileNameA (pszPath="C:\\Boot\\tr-TR\\*.*") returned="*.*"
	[0050.672] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\tr-TR\\" | out: lpString1="C:\\Boot\\tr-TR\\") returned="C:\\Boot\\tr-TR\\"
	[0050.672] PathAddBackslashA (in: pszPath="C:\\Boot\\tr-TR\\" | out: pszPath="C:\\Boot\\tr-TR\\") returned=""
	[0050.672] lstrcatA (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\tr-TR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\tr-TR\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.672] GetFileAttributesA (lpFileName="C:\\Boot\\tr-TR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\tr-tr\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0050.672] CreateFileA (lpFileName="C:\\Boot\\tr-TR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\tr-tr\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0050.674] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0050.674] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0050.675] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.675] CloseHandle (hObject=0x208) returned 1
	[0050.675] lstrcatA (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned="C:\\Boot\\tr-TR\\bootmgr.exe.mui"
	[0050.675] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0050.675] lstrlenA (lpString="*.zip") returned 5
	[0050.675] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0050.675] lstrlenA (lpString="*.rar") returned 5
	[0050.675] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0050.675] lstrlenA (lpString="*.7z") returned 4
	[0050.675] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0050.675] lstrlenA (lpString="*.tar") returned 5
	[0050.675] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0050.675] lstrlenA (lpString="*.gzip") returned 6
	[0050.675] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0050.675] lstrlenA (lpString="*.jpg") returned 5
	[0050.675] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.675] lstrlenA (lpString="*.jpeg") returned 6
	[0050.675] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0050.676] lstrlenA (lpString="*.bmp") returned 5
	[0050.676] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0050.676] lstrlenA (lpString="*.gif") returned 5
	[0050.676] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0050.676] lstrlenA (lpString="*.png") returned 5
	[0050.676] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0050.676] lstrlenA (lpString="*.doc") returned 5
	[0050.676] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0050.676] lstrlenA (lpString="*.docx") returned 6
	[0050.676] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0050.676] lstrlenA (lpString="*.xls") returned 5
	[0050.676] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.676] lstrlenA (lpString="*.xlsx") returned 6
	[0050.676] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0050.676] lstrlenA (lpString="*.ppt") returned 5
	[0050.676] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0050.676] lstrlenA (lpString="*.pptx") returned 6
	[0050.676] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0050.676] lstrlenA (lpString="*.txt") returned 5
	[0050.676] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0050.676] lstrlenA (lpString="*.pdf") returned 5
	[0050.676] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0050.676] lstrlenA (lpString="*.htm") returned 5
	[0050.676] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0050.676] lstrlenA (lpString="*.html") returned 6
	[0050.676] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0050.676] lstrlenA (lpString="*.mdb") returned 5
	[0050.676] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0050.676] lstrlenA (lpString="*.pfx") returned 5
	[0050.676] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0050.676] lstrlenA (lpString="*.md") returned 4
	[0050.676] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0050.676] lstrlenA (lpString="*.lnk") returned 5
	[0050.676] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0050.676] lstrlenA (lpString="*.torrent") returned 9
	[0050.676] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0050.676] lstrlenA (lpString="*.mov") returned 5
	[0050.677] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0050.677] lstrlenA (lpString="*.3gp") returned 5
	[0050.677] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.677] lstrlenA (lpString="*.mpeg") returned 6
	[0050.677] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0050.677] lstrlenA (lpString="*.mpg") returned 5
	[0050.677] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0050.677] lstrlenA (lpString="*.flv") returned 5
	[0050.677] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0050.677] lstrlenA (lpString="*.avi") returned 5
	[0050.677] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0050.677] lstrlenA (lpString="*.mp4") returned 5
	[0050.677] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0050.677] lstrlenA (lpString="*.wmv") returned 5
	[0050.677] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0050.677] lstrlenA (lpString="*.mkv") returned 5
	[0050.677] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0050.677] lstrlenA (lpString="*.mp3") returned 5
	[0050.677] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0050.677] lstrlenA (lpString="*.wav") returned 5
	[0050.677] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0050.677] lstrlenA (lpString="*.flac") returned 6
	[0050.677] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0050.677] lstrlenA (lpString="*.wma") returned 5
	[0050.678] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.au3") returned 0
	[0050.678] lstrlenA (lpString="*.au3") returned 5
	[0050.678] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.ahk") returned 0
	[0050.678] lstrlenA (lpString="*.ahk") returned 5
	[0050.678] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.c") returned 0
	[0050.678] lstrlenA (lpString="*.c") returned 3
	[0050.678] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.cc") returned 0
	[0050.678] lstrlenA (lpString="*.cc") returned 4
	[0050.678] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0
	[0050.678] lstrlenA (lpString="*.cpp") returned 5
	[0050.678] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.cxx") returned 0
	[0050.678] lstrlenA (lpString="*.cxx") returned 5
	[0050.678] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.c++") returned 0
	[0050.678] lstrlenA (lpString="*.c++") returned 5
	[0050.678] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.cs") returned 0
	[0050.678] lstrlenA (lpString="*.cs") returned 4
	[0050.678] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.vb") returned 0
	[0050.678] lstrlenA (lpString="*.vb") returned 4
	[0050.678] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.bas") returned 0
	[0050.678] lstrlenA (lpString="*.bas") returned 5
	[0050.678] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.csproj") returned 0
	[0050.678] lstrlenA (lpString="*.csproj") returned 8
	[0050.678] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.678] lstrlenA (lpString="*.vbproj") returned 8
	[0050.678] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.678] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.678] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.manifest") returned 0
	[0050.678] lstrlenA (lpString="*.manifest") returned 10
	[0050.678] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.php") returned 0
	[0050.678] lstrlenA (lpString="*.php") returned 5
	[0050.678] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.vbe") returned 0
	[0050.678] lstrlenA (lpString="*.vbe") returned 5
	[0050.678] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.vba") returned 0
	[0050.678] lstrlenA (lpString="*.vba") returned 5
	[0050.678] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.vbs") returned 0
	[0050.678] lstrlenA (lpString="*.vbs") returned 5
	[0050.678] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.bat") returned 0
	[0050.679] lstrlenA (lpString="*.bat") returned 5
	[0050.679] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.cmd") returned 0
	[0050.679] lstrlenA (lpString="*.cmd") returned 5
	[0050.679] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.js") returned 0
	[0050.679] lstrlenA (lpString="*.js") returned 4
	[0050.679] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.jscript") returned 0
	[0050.679] lstrlenA (lpString="*.jscript") returned 9
	[0050.679] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.hta") returned 0
	[0050.679] lstrlenA (lpString="*.hta") returned 5
	[0050.679] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.php7") returned 0
	[0050.679] lstrlenA (lpString="*.php7") returned 6
	[0050.679] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.db") returned 0
	[0050.679] lstrlenA (lpString="*.db") returned 4
	[0050.679] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.swf") returned 0
	[0050.679] lstrlenA (lpString="*.swf") returned 5
	[0050.679] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.eml") returned 0
	[0050.679] lstrlenA (lpString="*.eml") returned 5
	[0050.679] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.part") returned 0
	[0050.679] lstrlenA (lpString="*.part") returned 6
	[0050.679] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.nfo") returned 0
	[0050.679] lstrlenA (lpString="*.nfo") returned 5
	[0050.679] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.rsa") returned 0
	[0050.679] lstrlenA (lpString="*.rsa") returned 5
	[0050.679] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.key") returned 0
	[0050.679] lstrlenA (lpString="*.key") returned 5
	[0050.679] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.aes") returned 0
	[0050.679] lstrlenA (lpString="*.aes") returned 5
	[0050.679] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.blob") returned 0
	[0050.679] lstrlenA (lpString="*.blob") returned 6
	[0050.679] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.btc") returned 0
	[0050.679] lstrlenA (lpString="*.btc") returned 5
	[0050.679] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.wallet") returned 0
	[0050.679] lstrlenA (lpString="*.wallet") returned 8
	[0050.679] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0050.679] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.679] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="memtest.exe.mui") returned -1
	[0050.679] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="memtest.exe.mui") returned -1
	[0050.680] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1
	[0050.680] PathFindFileNameA (pszPath="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned="bootmgr.exe.mui"
	[0050.680] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\tr-TR\\" | out: lpString1="C:\\Boot\\tr-TR\\") returned="C:\\Boot\\tr-TR\\"
	[0050.680] PathAddBackslashA (in: pszPath="C:\\Boot\\tr-TR\\" | out: pszPath="C:\\Boot\\tr-TR\\") returned=""
	[0050.680] lstrcatA (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\tr-TR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\tr-TR\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.680] GetFileAttributesA (lpFileName="C:\\Boot\\tr-TR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\tr-tr\\how-to-decrypt-files.htm")) returned 0x20
	[0050.680] lstrcatA (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\tr-TR\\memtest.exe.mui") returned="C:\\Boot\\tr-TR\\memtest.exe.mui"
	[0050.680] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.zip") returned 0
	[0050.680] lstrlenA (lpString="*.zip") returned 5
	[0050.680] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.rar") returned 0
	[0050.680] lstrlenA (lpString="*.rar") returned 5
	[0050.680] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.7z") returned 0
	[0050.680] lstrlenA (lpString="*.7z") returned 4
	[0050.680] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.tar") returned 0
	[0050.680] lstrlenA (lpString="*.tar") returned 5
	[0050.680] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.gzip") returned 0
	[0050.680] lstrlenA (lpString="*.gzip") returned 6
	[0050.680] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.jpg") returned 0
	[0050.680] lstrlenA (lpString="*.jpg") returned 5
	[0050.680] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.680] lstrlenA (lpString="*.jpeg") returned 6
	[0050.680] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.bmp") returned 0
	[0050.680] lstrlenA (lpString="*.bmp") returned 5
	[0050.680] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.gif") returned 0
	[0050.680] lstrlenA (lpString="*.gif") returned 5
	[0050.680] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.png") returned 0
	[0050.680] lstrlenA (lpString="*.png") returned 5
	[0050.680] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.doc") returned 0
	[0050.680] lstrlenA (lpString="*.doc") returned 5
	[0050.680] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.docx") returned 0
	[0050.680] lstrlenA (lpString="*.docx") returned 6
	[0050.680] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.xls") returned 0
	[0050.680] lstrlenA (lpString="*.xls") returned 5
	[0050.680] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.681] lstrlenA (lpString="*.xlsx") returned 6
	[0050.681] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.ppt") returned 0
	[0050.681] lstrlenA (lpString="*.ppt") returned 5
	[0050.681] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.pptx") returned 0
	[0050.681] lstrlenA (lpString="*.pptx") returned 6
	[0050.681] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.txt") returned 0
	[0050.681] lstrlenA (lpString="*.txt") returned 5
	[0050.681] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.pdf") returned 0
	[0050.681] lstrlenA (lpString="*.pdf") returned 5
	[0050.681] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.htm") returned 0
	[0050.681] lstrlenA (lpString="*.htm") returned 5
	[0050.681] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.html") returned 0
	[0050.681] lstrlenA (lpString="*.html") returned 6
	[0050.681] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.mdb") returned 0
	[0050.681] lstrlenA (lpString="*.mdb") returned 5
	[0050.681] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.pfx") returned 0
	[0050.681] lstrlenA (lpString="*.pfx") returned 5
	[0050.681] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.md") returned 0
	[0050.681] lstrlenA (lpString="*.md") returned 4
	[0050.681] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.lnk") returned 0
	[0050.681] lstrlenA (lpString="*.lnk") returned 5
	[0050.681] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.torrent") returned 0
	[0050.681] lstrlenA (lpString="*.torrent") returned 9
	[0050.681] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.mov") returned 0
	[0050.681] lstrlenA (lpString="*.mov") returned 5
	[0050.681] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.3gp") returned 0
	[0050.681] lstrlenA (lpString="*.3gp") returned 5
	[0050.681] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.681] lstrlenA (lpString="*.mpeg") returned 6
	[0050.681] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.mpg") returned 0
	[0050.681] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.flv") returned 0
	[0050.681] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.avi") returned 0
	[0050.681] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.mp4") returned 0
	[0050.681] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.wmv") returned 0
	[0050.682] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.mkv") returned 0
	[0050.682] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.mp3") returned 0
	[0050.682] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.wav") returned 0
	[0050.682] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.flac") returned 0
	[0050.682] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.wma") returned 0
	[0050.682] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.au3") returned 0
	[0050.682] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.ahk") returned 0
	[0050.682] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.c") returned 0
	[0050.682] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.cc") returned 0
	[0050.682] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.cpp") returned 0
	[0050.682] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.cxx") returned 0
	[0050.682] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.c++") returned 0
	[0050.682] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.cs") returned 0
	[0050.682] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.vb") returned 0
	[0050.682] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.bas") returned 0
	[0050.682] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.csproj") returned 0
	[0050.682] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.682] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.682] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.manifest") returned 0
	[0050.682] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.php") returned 0
	[0050.682] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.vbe") returned 0
	[0050.682] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.vba") returned 0
	[0050.682] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.vbs") returned 0
	[0050.682] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.bat") returned 0
	[0050.682] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.cmd") returned 0
	[0050.683] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.js") returned 0
	[0050.683] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.jscript") returned 0
	[0050.683] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.hta") returned 0
	[0050.683] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.php7") returned 0
	[0050.683] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.db") returned 0
	[0050.683] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.swf") returned 0
	[0050.683] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.eml") returned 0
	[0050.683] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.part") returned 0
	[0050.683] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.nfo") returned 0
	[0050.683] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.rsa") returned 0
	[0050.683] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.key") returned 0
	[0050.683] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.aes") returned 0
	[0050.683] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.blob") returned 0
	[0050.683] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.btc") returned 0
	[0050.683] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.wallet") returned 0
	[0050.683] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0050.683] FindClose (in: hFindFile=0x7cb910 | out: hFindFile=0x7cb910) returned 1
	[0050.683] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1
	[0050.683] lstrcmpA (lpString1=".", lpString2="uk-UA") returned -1
	[0050.683] lstrcmpA (lpString1="..", lpString2="uk-UA") returned -1
	[0050.683] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0050.683] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="uk-UA" | out: lpString1="C:\\Boot\\uk-UA") returned="C:\\Boot\\uk-UA"
	[0050.683] FindFirstFileA (in: lpFileName="C:\\Boot\\uk-UA\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb590
	[0050.693] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.693] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0050.693] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.693] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.693] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0050.693] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.694] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr.exe.mui") returned 1
	[0050.694] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr.exe.mui") returned 1
	[0050.694] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0050.694] PathFindFileNameA (pszPath="C:\\Boot\\uk-UA\\*.*") returned="*.*"
	[0050.694] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\uk-UA\\" | out: lpString1="C:\\Boot\\uk-UA\\") returned="C:\\Boot\\uk-UA\\"
	[0050.694] PathAddBackslashA (in: pszPath="C:\\Boot\\uk-UA\\" | out: pszPath="C:\\Boot\\uk-UA\\") returned=""
	[0050.694] lstrcatA (in: lpString1="C:\\Boot\\uk-UA\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\uk-UA\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\uk-UA\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.694] GetFileAttributesA (lpFileName="C:\\Boot\\uk-UA\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\uk-ua\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0050.694] CreateFileA (lpFileName="C:\\Boot\\uk-UA\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\uk-ua\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0050.694] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0050.695] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.695] CloseHandle (hObject=0x208) returned 1
	[0050.695] lstrcatA (in: lpString1="C:\\Boot\\uk-UA\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\uk-UA\\bootmgr.exe.mui") returned="C:\\Boot\\uk-UA\\bootmgr.exe.mui"
	[0050.695] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0050.695] lstrlenA (lpString="*.zip") returned 5
	[0050.695] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0050.695] lstrlenA (lpString="*.rar") returned 5
	[0050.695] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0050.695] lstrlenA (lpString="*.7z") returned 4
	[0050.695] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0050.695] lstrlenA (lpString="*.tar") returned 5
	[0050.695] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0050.695] lstrlenA (lpString="*.gzip") returned 6
	[0050.695] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0050.696] lstrlenA (lpString="*.jpg") returned 5
	[0050.696] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.696] lstrlenA (lpString="*.jpeg") returned 6
	[0050.696] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0050.696] lstrlenA (lpString="*.bmp") returned 5
	[0050.696] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0050.696] lstrlenA (lpString="*.gif") returned 5
	[0050.696] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0050.696] lstrlenA (lpString="*.png") returned 5
	[0050.696] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0050.696] lstrlenA (lpString="*.doc") returned 5
	[0050.696] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0050.696] lstrlenA (lpString="*.docx") returned 6
	[0050.696] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0050.696] lstrlenA (lpString="*.xls") returned 5
	[0050.696] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.696] lstrlenA (lpString="*.xlsx") returned 6
	[0050.696] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0050.696] lstrlenA (lpString="*.ppt") returned 5
	[0050.696] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0050.696] lstrlenA (lpString="*.pptx") returned 6
	[0050.696] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0050.696] lstrlenA (lpString="*.txt") returned 5
	[0050.696] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0050.696] lstrlenA (lpString="*.pdf") returned 5
	[0050.696] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0050.696] lstrlenA (lpString="*.htm") returned 5
	[0050.696] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0050.696] lstrlenA (lpString="*.html") returned 6
	[0050.696] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0050.696] lstrlenA (lpString="*.mdb") returned 5
	[0050.696] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0050.696] lstrlenA (lpString="*.pfx") returned 5
	[0050.696] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0050.696] lstrlenA (lpString="*.md") returned 4
	[0050.696] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0050.696] lstrlenA (lpString="*.lnk") returned 5
	[0050.697] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0050.697] lstrlenA (lpString="*.torrent") returned 9
	[0050.697] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0050.697] lstrlenA (lpString="*.mov") returned 5
	[0050.697] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0050.697] lstrlenA (lpString="*.3gp") returned 5
	[0050.697] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.697] lstrlenA (lpString="*.mpeg") returned 6
	[0050.697] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0050.697] lstrlenA (lpString="*.mpg") returned 5
	[0050.697] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0050.697] lstrlenA (lpString="*.flv") returned 5
	[0050.697] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0050.697] lstrlenA (lpString="*.avi") returned 5
	[0050.697] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0050.697] lstrlenA (lpString="*.mp4") returned 5
	[0050.697] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0050.697] lstrlenA (lpString="*.wmv") returned 5
	[0050.697] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0050.697] lstrlenA (lpString="*.mkv") returned 5
	[0050.697] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0050.697] lstrlenA (lpString="*.mp3") returned 5
	[0050.697] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0050.697] lstrlenA (lpString="*.wav") returned 5
	[0050.697] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0050.697] lstrlenA (lpString="*.flac") returned 6
	[0050.697] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0050.697] lstrlenA (lpString="*.wma") returned 5
	[0050.697] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.au3") returned 0
	[0050.697] lstrlenA (lpString="*.au3") returned 5
	[0050.697] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.ahk") returned 0
	[0050.697] lstrlenA (lpString="*.ahk") returned 5
	[0050.697] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.c") returned 0
	[0050.697] lstrlenA (lpString="*.c") returned 3
	[0050.697] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.cc") returned 0
	[0050.697] lstrlenA (lpString="*.cc") returned 4
	[0050.698] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0
	[0050.698] lstrlenA (lpString="*.cpp") returned 5
	[0050.698] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.cxx") returned 0
	[0050.698] lstrlenA (lpString="*.cxx") returned 5
	[0050.698] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.c++") returned 0
	[0050.698] lstrlenA (lpString="*.c++") returned 5
	[0050.698] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.cs") returned 0
	[0050.698] lstrlenA (lpString="*.cs") returned 4
	[0050.698] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.vb") returned 0
	[0050.698] lstrlenA (lpString="*.vb") returned 4
	[0050.698] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.bas") returned 0
	[0050.698] lstrlenA (lpString="*.bas") returned 5
	[0050.698] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.csproj") returned 0
	[0050.698] lstrlenA (lpString="*.csproj") returned 8
	[0050.698] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.698] lstrlenA (lpString="*.vbproj") returned 8
	[0050.698] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.698] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.698] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.manifest") returned 0
	[0050.698] lstrlenA (lpString="*.manifest") returned 10
	[0050.698] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.php") returned 0
	[0050.698] lstrlenA (lpString="*.php") returned 5
	[0050.698] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.vbe") returned 0
	[0050.698] lstrlenA (lpString="*.vbe") returned 5
	[0050.698] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.vba") returned 0
	[0050.698] lstrlenA (lpString="*.vba") returned 5
	[0050.698] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.vbs") returned 0
	[0050.698] lstrlenA (lpString="*.vbs") returned 5
	[0050.698] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.bat") returned 0
	[0050.698] lstrlenA (lpString="*.bat") returned 5
	[0050.698] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.cmd") returned 0
	[0050.699] lstrlenA (lpString="*.cmd") returned 5
	[0050.699] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.js") returned 0
	[0050.699] lstrlenA (lpString="*.js") returned 4
	[0050.699] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.jscript") returned 0
	[0050.699] lstrlenA (lpString="*.jscript") returned 9
	[0050.699] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.hta") returned 0
	[0050.699] lstrlenA (lpString="*.hta") returned 5
	[0050.699] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.php7") returned 0
	[0050.699] lstrlenA (lpString="*.php7") returned 6
	[0050.699] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.db") returned 0
	[0050.699] lstrlenA (lpString="*.db") returned 4
	[0050.699] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.swf") returned 0
	[0050.699] lstrlenA (lpString="*.swf") returned 5
	[0050.699] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.eml") returned 0
	[0050.699] lstrlenA (lpString="*.eml") returned 5
	[0050.699] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.part") returned 0
	[0050.699] lstrlenA (lpString="*.part") returned 6
	[0050.699] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.nfo") returned 0
	[0050.699] lstrlenA (lpString="*.nfo") returned 5
	[0050.699] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.rsa") returned 0
	[0050.699] lstrlenA (lpString="*.rsa") returned 5
	[0050.699] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.key") returned 0
	[0050.699] lstrlenA (lpString="*.key") returned 5
	[0050.699] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.aes") returned 0
	[0050.699] lstrlenA (lpString="*.aes") returned 5
	[0050.699] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.blob") returned 0
	[0050.699] lstrlenA (lpString="*.blob") returned 6
	[0050.699] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.btc") returned 0
	[0050.699] lstrlenA (lpString="*.btc") returned 5
	[0050.699] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.wallet") returned 0
	[0050.699] lstrlenA (lpString="*.wallet") returned 8
	[0050.699] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0050.699] FindClose (in: hFindFile=0x7cb590 | out: hFindFile=0x7cb590) returned 1
	[0050.700] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1
	[0050.700] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.700] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="updaterevokesipolicy.p7b") returned -1
	[0050.700] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="updaterevokesipolicy.p7b") returned -1
	[0050.700] lstrcmpiA (lpString1="", lpString2="updaterevokesipolicy.p7b") returned -1
	[0050.700] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0050.700] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\"
	[0050.700] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned=""
	[0050.700] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.700] GetFileAttributesA (lpFileName="C:\\Boot\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\how-to-decrypt-files.htm")) returned 0x20
	[0050.700] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="updaterevokesipolicy.p7b" | out: lpString1="C:\\Boot\\updaterevokesipolicy.p7b") returned="C:\\Boot\\updaterevokesipolicy.p7b"
	[0050.700] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.zip") returned 0
	[0050.701] lstrlenA (lpString="*.zip") returned 5
	[0050.701] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.rar") returned 0
	[0050.701] lstrlenA (lpString="*.rar") returned 5
	[0050.701] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.7z") returned 0
	[0050.701] lstrlenA (lpString="*.7z") returned 4
	[0050.701] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.tar") returned 0
	[0050.701] lstrlenA (lpString="*.tar") returned 5
	[0050.701] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.gzip") returned 0
	[0050.701] lstrlenA (lpString="*.gzip") returned 6
	[0050.701] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.jpg") returned 0
	[0050.701] lstrlenA (lpString="*.jpg") returned 5
	[0050.701] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.jpeg") returned 0
	[0050.701] lstrlenA (lpString="*.jpeg") returned 6
	[0050.701] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.bmp") returned 0
	[0050.701] lstrlenA (lpString="*.bmp") returned 5
	[0050.701] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.gif") returned 0
	[0050.701] lstrlenA (lpString="*.gif") returned 5
	[0050.701] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.png") returned 0
	[0050.701] lstrlenA (lpString="*.png") returned 5
	[0050.701] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.doc") returned 0
	[0050.701] lstrlenA (lpString="*.doc") returned 5
	[0050.701] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.docx") returned 0
	[0050.701] lstrlenA (lpString="*.docx") returned 6
	[0050.701] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.xls") returned 0
	[0050.701] lstrlenA (lpString="*.xls") returned 5
	[0050.701] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.xlsx") returned 0
	[0050.701] lstrlenA (lpString="*.xlsx") returned 6
	[0050.701] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.ppt") returned 0
	[0050.701] lstrlenA (lpString="*.ppt") returned 5
	[0050.701] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.pptx") returned 0
	[0050.701] lstrlenA (lpString="*.pptx") returned 6
	[0050.701] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.txt") returned 0
	[0050.701] lstrlenA (lpString="*.txt") returned 5
	[0050.701] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.pdf") returned 0
	[0050.701] lstrlenA (lpString="*.pdf") returned 5
	[0050.701] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.htm") returned 0
	[0050.701] lstrlenA (lpString="*.htm") returned 5
	[0050.702] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.html") returned 0
	[0050.702] lstrlenA (lpString="*.html") returned 6
	[0050.702] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.mdb") returned 0
	[0050.702] lstrlenA (lpString="*.mdb") returned 5
	[0050.702] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.pfx") returned 0
	[0050.702] lstrlenA (lpString="*.pfx") returned 5
	[0050.702] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.md") returned 0
	[0050.702] lstrlenA (lpString="*.md") returned 4
	[0050.702] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.lnk") returned 0
	[0050.702] lstrlenA (lpString="*.lnk") returned 5
	[0050.702] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.torrent") returned 0
	[0050.702] lstrlenA (lpString="*.torrent") returned 9
	[0050.702] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.mov") returned 0
	[0050.702] lstrlenA (lpString="*.mov") returned 5
	[0050.702] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.3gp") returned 0
	[0050.702] lstrlenA (lpString="*.3gp") returned 5
	[0050.702] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.mpeg") returned 0
	[0050.702] lstrlenA (lpString="*.mpeg") returned 6
	[0050.702] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.mpg") returned 0
	[0050.702] lstrlenA (lpString="*.mpg") returned 5
	[0050.702] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.flv") returned 0
	[0050.702] lstrlenA (lpString="*.flv") returned 5
	[0050.702] lstrlenA (lpString="*.avi") returned 5
	[0050.702] lstrlenA (lpString="*.mp4") returned 5
	[0050.702] lstrlenA (lpString="*.wmv") returned 5
	[0050.703] lstrlenA (lpString="*.mkv") returned 5
	[0050.703] lstrlenA (lpString="*.mp3") returned 5
	[0050.703] lstrlenA (lpString="*.wav") returned 5
	[0050.703] lstrlenA (lpString="*.flac") returned 6
	[0050.703] lstrlenA (lpString="*.wma") returned 5
	[0050.703] lstrlenA (lpString="*.au3") returned 5
	[0050.703] lstrlenA (lpString="*.ahk") returned 5
	[0050.703] lstrlenA (lpString="*.c") returned 3
	[0050.703] lstrlenA (lpString="*.cc") returned 4
	[0050.703] lstrlenA (lpString="*.cpp") returned 5
	[0050.703] lstrlenA (lpString="*.cxx") returned 5
	[0050.703] lstrlenA (lpString="*.c++") returned 5
	[0050.703] lstrlenA (lpString="*.cs") returned 4
	[0050.703] lstrlenA (lpString="*.vb") returned 4
	[0050.703] lstrlenA (lpString="*.bas") returned 5
	[0050.703] lstrlenA (lpString="*.csproj") returned 8
	[0050.703] lstrlenA (lpString="*.vbproj") returned 8
	[0050.703] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.703] lstrlenA (lpString="*.manifest") returned 10
	[0050.703] lstrlenA (lpString="*.php") returned 5
	[0050.703] lstrlenA (lpString="*.vbe") returned 5
	[0050.703] lstrlenA (lpString="*.vba") returned 5
	[0050.703] lstrlenA (lpString="*.vbs") returned 5
	[0050.703] lstrlenA (lpString="*.bat") returned 5
	[0050.703] lstrlenA (lpString="*.cmd") returned 5
	[0050.703] lstrlenA (lpString="*.js") returned 4
	[0050.703] lstrlenA (lpString="*.jscript") returned 9
	[0050.704] lstrlenA (lpString="*.hta") returned 5
	[0050.704] lstrlenA (lpString="*.php7") returned 6
	[0050.704] lstrlenA (lpString="*.db") returned 4
	[0050.704] lstrlenA (lpString="*.swf") returned 5
	[0050.704] lstrlenA (lpString="*.eml") returned 5
	[0050.704] lstrlenA (lpString="*.part") returned 6
	[0050.704] lstrlenA (lpString="*.nfo") returned 5
	[0050.704] lstrlenA (lpString="*.rsa") returned 5
	[0050.704] lstrlenA (lpString="*.key") returned 5
	[0050.704] lstrlenA (lpString="*.aes") returned 5
	[0050.704] lstrlenA (lpString="*.blob") returned 6
	[0050.704] lstrlenA (lpString="*.btc") returned 5
	[0050.704] lstrlenA (lpString="*.wallet") returned 8
	[0050.704] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1
	[0050.704] lstrcmpA (lpString1=".", lpString2="zh-CN") returned -1
	[0050.704] lstrcmpA (lpString1="..", lpString2="zh-CN") returned -1
	[0050.704] PathFindFileNameA (pszPath="C:\\Boot\\updaterevokesipolicy.p7b") returned="updaterevokesipolicy.p7b"
	[0050.704] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="zh-CN" | out: lpString1="C:\\Boot\\zh-CN") returned="C:\\Boot\\zh-CN"
	[0050.704] lstrlenA (lpString="C:\\Boot\\zh-CN") returned 13
	[0050.704] FindFirstFileA (in: lpFileName="C:\\Boot\\zh-CN\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x58, cFileName=".", cAlternateFileName="")) returned 0x7cbc50
	[0050.705] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.705] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x58, cFileName="..", cAlternateFileName="")) returned 1
	[0050.705] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.705] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.705] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0x7b0000, dwReserved1=0x58, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0050.705] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.705] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr.exe.mui") returned 1
	[0050.705] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr.exe.mui") returned 1
	[0050.705] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0050.705] PathFindFileNameA (pszPath="C:\\Boot\\zh-CN\\*.*") returned="*.*"
	[0050.705] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\zh-CN\\" | out: lpString1="C:\\Boot\\zh-CN\\") returned="C:\\Boot\\zh-CN\\"
	[0050.705] PathAddBackslashA (in: pszPath="C:\\Boot\\zh-CN\\" | out: pszPath="C:\\Boot\\zh-CN\\") returned=""
	[0050.705] lstrcatA (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\zh-CN\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\zh-CN\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.705] GetFileAttributesA (lpFileName="C:\\Boot\\zh-CN\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\zh-cn\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0050.705] CreateFileA (lpFileName="C:\\Boot\\zh-CN\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\zh-cn\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0050.707] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0050.707] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0050.708] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.708] CloseHandle (hObject=0x208) returned 1
	[0050.709] lstrcatA (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned="C:\\Boot\\zh-CN\\bootmgr.exe.mui"
	[0050.709] lstrlenA (lpString="*.zip") returned 5
	[0050.709] lstrlenA (lpString="*.rar") returned 5
	[0050.709] lstrlenA (lpString="*.7z") returned 4
	[0050.709] lstrlenA (lpString="*.tar") returned 5
	[0050.709] lstrlenA (lpString="*.gzip") returned 6
	[0050.709] lstrlenA (lpString="*.jpg") returned 5
	[0050.709] lstrlenA (lpString="*.jpeg") returned 6
	[0050.709] lstrlenA (lpString="*.bmp") returned 5
	[0050.709] lstrlenA (lpString="*.gif") returned 5
	[0050.709] lstrlenA (lpString="*.png") returned 5
	[0050.709] lstrlenA (lpString="*.doc") returned 5
	[0050.709] lstrlenA (lpString="*.docx") returned 6
	[0050.709] lstrlenA (lpString="*.xls") returned 5
	[0050.709] lstrlenA (lpString="*.xlsx") returned 6
	[0050.709] lstrlenA (lpString="*.ppt") returned 5
	[0050.709] lstrlenA (lpString="*.pptx") returned 6
	[0050.709] lstrlenA (lpString="*.txt") returned 5
	[0050.709] lstrlenA (lpString="*.pdf") returned 5
	[0050.709] lstrlenA (lpString="*.htm") returned 5
	[0050.710] lstrlenA (lpString="*.html") returned 6
	[0050.710] lstrlenA (lpString="*.mdb") returned 5
	[0050.710] lstrlenA (lpString="*.pfx") returned 5
	[0050.710] lstrlenA (lpString="*.md") returned 4
	[0050.710] lstrlenA (lpString="*.lnk") returned 5
	[0050.710] lstrlenA (lpString="*.torrent") returned 9
	[0050.710] lstrlenA (lpString="*.mov") returned 5
	[0050.710] lstrlenA (lpString="*.3gp") returned 5
	[0050.710] lstrlenA (lpString="*.mpeg") returned 6
	[0050.710] lstrlenA (lpString="*.mpg") returned 5
	[0050.710] lstrlenA (lpString="*.flv") returned 5
	[0050.710] lstrlenA (lpString="*.avi") returned 5
	[0050.710] lstrlenA (lpString="*.mp4") returned 5
	[0050.710] lstrlenA (lpString="*.wmv") returned 5
	[0050.710] lstrlenA (lpString="*.mkv") returned 5
	[0050.710] lstrlenA (lpString="*.mp3") returned 5
	[0050.710] lstrlenA (lpString="*.wav") returned 5
	[0050.710] lstrlenA (lpString="*.flac") returned 6
	[0050.710] lstrlenA (lpString="*.wma") returned 5
	[0050.710] lstrlenA (lpString="*.au3") returned 5
	[0050.710] lstrlenA (lpString="*.ahk") returned 5
	[0050.710] lstrlenA (lpString="*.c") returned 3
	[0050.710] lstrlenA (lpString="*.cc") returned 4
	[0050.710] lstrlenA (lpString="*.cpp") returned 5
	[0050.710] lstrlenA (lpString="*.cxx") returned 5
	[0050.710] lstrlenA (lpString="*.c++") returned 5
	[0050.710] lstrlenA (lpString="*.cs") returned 4
	[0050.711] lstrlenA (lpString="*.vb") returned 4
	[0050.711] lstrlenA (lpString="*.bas") returned 5
	[0050.711] lstrlenA (lpString="*.csproj") returned 8
	[0050.711] lstrlenA (lpString="*.vbproj") returned 8
	[0050.711] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.711] lstrlenA (lpString="*.manifest") returned 10
	[0050.711] lstrlenA (lpString="*.php") returned 5
	[0050.711] lstrlenA (lpString="*.vbe") returned 5
	[0050.711] lstrlenA (lpString="*.vba") returned 5
	[0050.711] lstrlenA (lpString="*.vbs") returned 5
	[0050.711] lstrlenA (lpString="*.bat") returned 5
	[0050.711] lstrlenA (lpString="*.cmd") returned 5
	[0050.711] lstrlenA (lpString="*.js") returned 4
	[0050.711] lstrlenA (lpString="*.jscript") returned 9
	[0050.711] lstrlenA (lpString="*.hta") returned 5
	[0050.711] lstrlenA (lpString="*.php7") returned 6
	[0050.711] lstrlenA (lpString="*.db") returned 4
	[0050.711] lstrlenA (lpString="*.swf") returned 5
	[0050.711] lstrlenA (lpString="*.eml") returned 5
	[0050.711] lstrlenA (lpString="*.part") returned 6
	[0050.711] lstrlenA (lpString="*.nfo") returned 5
	[0050.711] lstrlenA (lpString="*.rsa") returned 5
	[0050.711] lstrlenA (lpString="*.key") returned 5
	[0050.711] lstrlenA (lpString="*.aes") returned 5
	[0050.711] lstrlenA (lpString="*.blob") returned 6
	[0050.711] lstrlenA (lpString="*.btc") returned 5
	[0050.711] lstrlenA (lpString="*.wallet") returned 8
	[0050.712] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6d7e9a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0050.712] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.712] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="memtest.exe.mui") returned -1
	[0050.712] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="memtest.exe.mui") returned -1
	[0050.712] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1
	[0050.712] PathFindFileNameA (pszPath="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned="bootmgr.exe.mui"
	[0050.712] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\zh-CN\\" | out: lpString1="C:\\Boot\\zh-CN\\") returned="C:\\Boot\\zh-CN\\"
	[0050.712] PathAddBackslashA (in: pszPath="C:\\Boot\\zh-CN\\" | out: pszPath="C:\\Boot\\zh-CN\\") returned=""
	[0050.712] lstrcatA (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\zh-CN\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\zh-CN\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.712] GetFileAttributesA (lpFileName="C:\\Boot\\zh-CN\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\zh-cn\\how-to-decrypt-files.htm")) returned 0x20
	[0050.712] lstrcatA (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\zh-CN\\memtest.exe.mui") returned="C:\\Boot\\zh-CN\\memtest.exe.mui"
	[0050.712] lstrlenA (lpString="*.zip") returned 5
	[0050.712] lstrlenA (lpString="*.rar") returned 5
	[0050.712] lstrlenA (lpString="*.7z") returned 4
	[0050.712] lstrlenA (lpString="*.tar") returned 5
	[0050.712] lstrlenA (lpString="*.gzip") returned 6
	[0050.712] lstrlenA (lpString="*.jpg") returned 5
	[0050.712] lstrlenA (lpString="*.jpeg") returned 6
	[0050.712] lstrlenA (lpString="*.bmp") returned 5
	[0050.712] lstrlenA (lpString="*.gif") returned 5
	[0050.712] lstrlenA (lpString="*.png") returned 5
	[0050.712] lstrlenA (lpString="*.doc") returned 5
	[0050.712] lstrlenA (lpString="*.docx") returned 6
	[0050.712] lstrlenA (lpString="*.xls") returned 5
	[0050.712] lstrlenA (lpString="*.xlsx") returned 6
	[0050.712] lstrlenA (lpString="*.ppt") returned 5
	[0050.712] lstrlenA (lpString="*.pptx") returned 6
	[0050.713] lstrlenA (lpString="*.txt") returned 5
	[0050.713] lstrlenA (lpString="*.pdf") returned 5
	[0050.713] lstrlenA (lpString="*.htm") returned 5
	[0050.713] lstrlenA (lpString="*.html") returned 6
	[0050.713] lstrlenA (lpString="*.mdb") returned 5
	[0050.713] lstrlenA (lpString="*.pfx") returned 5
	[0050.713] lstrlenA (lpString="*.md") returned 4
	[0050.713] lstrlenA (lpString="*.lnk") returned 5
	[0050.713] lstrlenA (lpString="*.torrent") returned 9
	[0050.713] lstrlenA (lpString="*.mov") returned 5
	[0050.713] lstrlenA (lpString="*.3gp") returned 5
	[0050.713] lstrlenA (lpString="*.mpeg") returned 6
	[0050.713] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6d7e9a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0050.713] FindClose (in: hFindFile=0x7cbc50 | out: hFindFile=0x7cbc50) returned 1
	[0050.713] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1
	[0050.713] lstrcmpA (lpString1=".", lpString2="zh-HK") returned -1
	[0050.713] lstrcmpA (lpString1="..", lpString2="zh-HK") returned -1
	[0050.713] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0050.713] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="zh-HK" | out: lpString1="C:\\Boot\\zh-HK") returned="C:\\Boot\\zh-HK"
	[0050.713] FindFirstFileA (in: lpFileName="C:\\Boot\\zh-HK\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbb90
	[0050.713] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.713] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0050.714] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.714] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.714] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf958, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0050.714] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.714] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr.exe.mui") returned 1
	[0050.714] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr.exe.mui") returned 1
	[0050.714] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0050.714] PathFindFileNameA (pszPath="C:\\Boot\\zh-HK\\*.*") returned="*.*"
	[0050.714] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\zh-HK\\" | out: lpString1="C:\\Boot\\zh-HK\\") returned="C:\\Boot\\zh-HK\\"
	[0050.714] PathAddBackslashA (in: pszPath="C:\\Boot\\zh-HK\\" | out: pszPath="C:\\Boot\\zh-HK\\") returned=""
	[0050.714] lstrcatA (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\zh-HK\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\zh-HK\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.714] GetFileAttributesA (lpFileName="C:\\Boot\\zh-HK\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\zh-hk\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0050.714] CreateFileA (lpFileName="C:\\Boot\\zh-HK\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\zh-hk\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0050.716] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0050.717] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.717] CloseHandle (hObject=0x208) returned 1
	[0050.717] lstrcatA (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned="C:\\Boot\\zh-HK\\bootmgr.exe.mui"
	[0050.717] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0050.717] lstrlenA (lpString="*.zip") returned 5
	[0050.717] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0050.717] lstrlenA (lpString="*.rar") returned 5
	[0050.717] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0050.717] lstrlenA (lpString="*.7z") returned 4
	[0050.717] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0050.717] lstrlenA (lpString="*.tar") returned 5
	[0050.717] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0050.717] lstrlenA (lpString="*.gzip") returned 6
	[0050.717] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0050.717] lstrlenA (lpString="*.jpg") returned 5
	[0050.717] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.717] lstrlenA (lpString="*.jpeg") returned 6
	[0050.717] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0050.717] lstrlenA (lpString="*.bmp") returned 5
	[0050.718] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0050.718] lstrlenA (lpString="*.gif") returned 5
	[0050.718] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0050.718] lstrlenA (lpString="*.png") returned 5
	[0050.718] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0050.718] lstrlenA (lpString="*.doc") returned 5
	[0050.718] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0050.718] lstrlenA (lpString="*.docx") returned 6
	[0050.718] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0050.718] lstrlenA (lpString="*.xls") returned 5
	[0050.718] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.718] lstrlenA (lpString="*.xlsx") returned 6
	[0050.718] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0050.718] lstrlenA (lpString="*.ppt") returned 5
	[0050.718] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0050.718] lstrlenA (lpString="*.pptx") returned 6
	[0050.718] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0050.718] lstrlenA (lpString="*.txt") returned 5
	[0050.718] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0050.718] lstrlenA (lpString="*.pdf") returned 5
	[0050.718] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0050.718] lstrlenA (lpString="*.htm") returned 5
	[0050.718] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0050.718] lstrlenA (lpString="*.html") returned 6
	[0050.718] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0050.718] lstrlenA (lpString="*.mdb") returned 5
	[0050.718] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0050.718] lstrlenA (lpString="*.pfx") returned 5
	[0050.718] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0050.718] lstrlenA (lpString="*.md") returned 4
	[0050.718] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0050.718] lstrlenA (lpString="*.lnk") returned 5
	[0050.718] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0050.718] lstrlenA (lpString="*.torrent") returned 9
	[0050.718] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0050.718] lstrlenA (lpString="*.mov") returned 5
	[0050.718] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0050.718] lstrlenA (lpString="*.3gp") returned 5
	[0050.719] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.719] lstrlenA (lpString="*.mpeg") returned 6
	[0050.719] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0050.719] lstrlenA (lpString="*.mpg") returned 5
	[0050.719] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0050.719] lstrlenA (lpString="*.flv") returned 5
	[0050.719] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0050.719] lstrlenA (lpString="*.avi") returned 5
	[0050.719] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0050.719] lstrlenA (lpString="*.mp4") returned 5
	[0050.719] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0050.719] lstrlenA (lpString="*.wmv") returned 5
	[0050.719] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0050.719] lstrlenA (lpString="*.mkv") returned 5
	[0050.719] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0050.719] lstrlenA (lpString="*.mp3") returned 5
	[0050.719] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0050.719] lstrlenA (lpString="*.wav") returned 5
	[0050.719] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0050.719] lstrlenA (lpString="*.flac") returned 6
	[0050.719] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0050.719] lstrlenA (lpString="*.wma") returned 5
	[0050.719] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.au3") returned 0
	[0050.719] lstrlenA (lpString="*.au3") returned 5
	[0050.719] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.ahk") returned 0
	[0050.719] lstrlenA (lpString="*.ahk") returned 5
	[0050.719] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.c") returned 0
	[0050.719] lstrlenA (lpString="*.c") returned 3
	[0050.719] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.cc") returned 0
	[0050.719] lstrlenA (lpString="*.cc") returned 4
	[0050.719] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0
	[0050.719] lstrlenA (lpString="*.cpp") returned 5
	[0050.719] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.cxx") returned 0
	[0050.719] lstrlenA (lpString="*.cxx") returned 5
	[0050.719] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.c++") returned 0
	[0050.719] lstrlenA (lpString="*.c++") returned 5
	[0050.719] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.cs") returned 0
	[0050.719] lstrlenA (lpString="*.cs") returned 4
	[0050.720] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.vb") returned 0
	[0050.720] lstrlenA (lpString="*.vb") returned 4
	[0050.720] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.bas") returned 0
	[0050.720] lstrlenA (lpString="*.bas") returned 5
	[0050.720] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.csproj") returned 0
	[0050.720] lstrlenA (lpString="*.csproj") returned 8
	[0050.720] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.720] lstrlenA (lpString="*.vbproj") returned 8
	[0050.720] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.720] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.720] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.manifest") returned 0
	[0050.720] lstrlenA (lpString="*.manifest") returned 10
	[0050.720] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.php") returned 0
	[0050.720] lstrlenA (lpString="*.php") returned 5
	[0050.720] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.vbe") returned 0
	[0050.720] lstrlenA (lpString="*.vbe") returned 5
	[0050.720] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.vba") returned 0
	[0050.720] lstrlenA (lpString="*.vba") returned 5
	[0050.720] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.vbs") returned 0
	[0050.720] lstrlenA (lpString="*.vbs") returned 5
	[0050.720] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.bat") returned 0
	[0050.720] lstrlenA (lpString="*.bat") returned 5
	[0050.720] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.cmd") returned 0
	[0050.720] lstrlenA (lpString="*.cmd") returned 5
	[0050.720] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.js") returned 0
	[0050.720] lstrlenA (lpString="*.js") returned 4
	[0050.720] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.jscript") returned 0
	[0050.720] lstrlenA (lpString="*.jscript") returned 9
	[0050.720] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.hta") returned 0
	[0050.720] lstrlenA (lpString="*.hta") returned 5
	[0050.720] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.php7") returned 0
	[0050.720] lstrlenA (lpString="*.php7") returned 6
	[0050.720] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.db") returned 0
	[0050.720] lstrlenA (lpString="*.db") returned 4
	[0050.720] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.swf") returned 0
	[0050.720] lstrlenA (lpString="*.swf") returned 5
	[0050.720] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.eml") returned 0
	[0050.720] lstrlenA (lpString="*.eml") returned 5
	[0050.721] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.part") returned 0
	[0050.721] lstrlenA (lpString="*.part") returned 6
	[0050.721] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.nfo") returned 0
	[0050.721] lstrlenA (lpString="*.nfo") returned 5
	[0050.721] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.rsa") returned 0
	[0050.721] lstrlenA (lpString="*.rsa") returned 5
	[0050.721] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.key") returned 0
	[0050.721] lstrlenA (lpString="*.key") returned 5
	[0050.721] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.aes") returned 0
	[0050.721] lstrlenA (lpString="*.aes") returned 5
	[0050.721] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.blob") returned 0
	[0050.721] lstrlenA (lpString="*.blob") returned 6
	[0050.721] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.btc") returned 0
	[0050.721] lstrlenA (lpString="*.btc") returned 5
	[0050.721] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.wallet") returned 0
	[0050.721] lstrlenA (lpString="*.wallet") returned 8
	[0050.721] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x518ea25e, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe31db522, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xa558, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0050.721] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.721] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="memtest.exe.mui") returned -1
	[0050.721] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="memtest.exe.mui") returned -1
	[0050.721] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1
	[0050.721] PathFindFileNameA (pszPath="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned="bootmgr.exe.mui"
	[0050.721] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\zh-HK\\" | out: lpString1="C:\\Boot\\zh-HK\\") returned="C:\\Boot\\zh-HK\\"
	[0050.721] PathAddBackslashA (in: pszPath="C:\\Boot\\zh-HK\\" | out: pszPath="C:\\Boot\\zh-HK\\") returned=""
	[0050.721] lstrcatA (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\zh-HK\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\zh-HK\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.721] GetFileAttributesA (lpFileName="C:\\Boot\\zh-HK\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\zh-hk\\how-to-decrypt-files.htm")) returned 0x20
	[0050.721] lstrcatA (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\zh-HK\\memtest.exe.mui") returned="C:\\Boot\\zh-HK\\memtest.exe.mui"
	[0050.721] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.zip") returned 0
	[0050.721] lstrlenA (lpString="*.zip") returned 5
	[0050.721] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.rar") returned 0
	[0050.721] lstrlenA (lpString="*.rar") returned 5
	[0050.721] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.7z") returned 0
	[0050.721] lstrlenA (lpString="*.7z") returned 4
	[0050.721] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.tar") returned 0
	[0050.722] lstrlenA (lpString="*.tar") returned 5
	[0050.722] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.gzip") returned 0
	[0050.722] lstrlenA (lpString="*.gzip") returned 6
	[0050.722] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.jpg") returned 0
	[0050.722] lstrlenA (lpString="*.jpg") returned 5
	[0050.722] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.722] lstrlenA (lpString="*.jpeg") returned 6
	[0050.722] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.bmp") returned 0
	[0050.722] lstrlenA (lpString="*.bmp") returned 5
	[0050.722] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.gif") returned 0
	[0050.722] lstrlenA (lpString="*.gif") returned 5
	[0050.722] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.png") returned 0
	[0050.722] lstrlenA (lpString="*.png") returned 5
	[0050.722] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.doc") returned 0
	[0050.722] lstrlenA (lpString="*.doc") returned 5
	[0050.722] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.docx") returned 0
	[0050.722] lstrlenA (lpString="*.docx") returned 6
	[0050.722] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.xls") returned 0
	[0050.722] lstrlenA (lpString="*.xls") returned 5
	[0050.722] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.722] lstrlenA (lpString="*.xlsx") returned 6
	[0050.722] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.ppt") returned 0
	[0050.722] lstrlenA (lpString="*.ppt") returned 5
	[0050.722] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.pptx") returned 0
	[0050.722] lstrlenA (lpString="*.pptx") returned 6
	[0050.722] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.txt") returned 0
	[0050.722] lstrlenA (lpString="*.txt") returned 5
	[0050.722] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.pdf") returned 0
	[0050.722] lstrlenA (lpString="*.pdf") returned 5
	[0050.722] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.htm") returned 0
	[0050.722] lstrlenA (lpString="*.htm") returned 5
	[0050.722] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.html") returned 0
	[0050.722] lstrlenA (lpString="*.html") returned 6
	[0050.722] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.mdb") returned 0
	[0050.722] lstrlenA (lpString="*.mdb") returned 5
	[0050.722] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.pfx") returned 0
	[0050.722] lstrlenA (lpString="*.pfx") returned 5
	[0050.723] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.md") returned 0
	[0050.723] lstrlenA (lpString="*.md") returned 4
	[0050.723] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.lnk") returned 0
	[0050.723] lstrlenA (lpString="*.lnk") returned 5
	[0050.723] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.torrent") returned 0
	[0050.723] lstrlenA (lpString="*.torrent") returned 9
	[0050.723] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.mov") returned 0
	[0050.723] lstrlenA (lpString="*.mov") returned 5
	[0050.723] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.3gp") returned 0
	[0050.723] lstrlenA (lpString="*.3gp") returned 5
	[0050.723] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.723] lstrlenA (lpString="*.mpeg") returned 6
	[0050.723] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.mpg") returned 0
	[0050.723] lstrlenA (lpString="*.mpg") returned 5
	[0050.723] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.flv") returned 0
	[0050.723] lstrlenA (lpString="*.flv") returned 5
	[0050.723] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.avi") returned 0
	[0050.723] lstrlenA (lpString="*.avi") returned 5
	[0050.723] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.mp4") returned 0
	[0050.723] lstrlenA (lpString="*.mp4") returned 5
	[0050.723] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.wmv") returned 0
	[0050.723] lstrlenA (lpString="*.wmv") returned 5
	[0050.723] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.mkv") returned 0
	[0050.723] lstrlenA (lpString="*.mkv") returned 5
	[0050.723] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.mp3") returned 0
	[0050.723] lstrlenA (lpString="*.mp3") returned 5
	[0050.723] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.wav") returned 0
	[0050.723] lstrlenA (lpString="*.wav") returned 5
	[0050.723] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.flac") returned 0
	[0050.723] lstrlenA (lpString="*.flac") returned 6
	[0050.723] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.wma") returned 0
	[0050.723] lstrlenA (lpString="*.wma") returned 5
	[0050.723] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.au3") returned 0
	[0050.723] lstrlenA (lpString="*.au3") returned 5
	[0050.723] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.ahk") returned 0
	[0050.723] lstrlenA (lpString="*.ahk") returned 5
	[0050.723] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.c") returned 0
	[0050.723] lstrlenA (lpString="*.c") returned 3
	[0050.724] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.cc") returned 0
	[0050.724] lstrlenA (lpString="*.cc") returned 4
	[0050.724] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.cpp") returned 0
	[0050.724] lstrlenA (lpString="*.cpp") returned 5
	[0050.724] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.cxx") returned 0
	[0050.724] lstrlenA (lpString="*.cxx") returned 5
	[0050.724] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.c++") returned 0
	[0050.724] lstrlenA (lpString="*.c++") returned 5
	[0050.724] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.cs") returned 0
	[0050.724] lstrlenA (lpString="*.cs") returned 4
	[0050.724] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.vb") returned 0
	[0050.724] lstrlenA (lpString="*.vb") returned 4
	[0050.724] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.bas") returned 0
	[0050.724] lstrlenA (lpString="*.bas") returned 5
	[0050.724] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.csproj") returned 0
	[0050.724] lstrlenA (lpString="*.csproj") returned 8
	[0050.724] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.724] lstrlenA (lpString="*.vbproj") returned 8
	[0050.724] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.724] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.725] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.manifest") returned 0
	[0050.725] lstrlenA (lpString="*.manifest") returned 10
	[0050.725] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.php") returned 0
	[0050.725] lstrlenA (lpString="*.php") returned 5
	[0050.725] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.vbe") returned 0
	[0050.725] lstrlenA (lpString="*.vbe") returned 5
	[0050.725] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.vba") returned 0
	[0050.725] lstrlenA (lpString="*.vba") returned 5
	[0050.725] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.vbs") returned 0
	[0050.725] lstrlenA (lpString="*.vbs") returned 5
	[0050.725] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.bat") returned 0
	[0050.725] lstrlenA (lpString="*.bat") returned 5
	[0050.725] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.cmd") returned 0
	[0050.725] lstrlenA (lpString="*.cmd") returned 5
	[0050.725] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.js") returned 0
	[0050.725] lstrlenA (lpString="*.js") returned 4
	[0050.725] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.jscript") returned 0
	[0050.725] lstrlenA (lpString="*.jscript") returned 9
	[0050.725] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.hta") returned 0
	[0050.725] lstrlenA (lpString="*.hta") returned 5
	[0050.725] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.php7") returned 0
	[0050.725] lstrlenA (lpString="*.php7") returned 6
	[0050.725] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.db") returned 0
	[0050.725] lstrlenA (lpString="*.db") returned 4
	[0050.725] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.swf") returned 0
	[0050.725] lstrlenA (lpString="*.swf") returned 5
	[0050.725] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.eml") returned 0
	[0050.725] lstrlenA (lpString="*.eml") returned 5
	[0050.725] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.part") returned 0
	[0050.725] lstrlenA (lpString="*.part") returned 6
	[0050.725] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.nfo") returned 0
	[0050.725] lstrlenA (lpString="*.nfo") returned 5
	[0050.725] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.rsa") returned 0
	[0050.725] lstrlenA (lpString="*.rsa") returned 5
	[0050.725] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.key") returned 0
	[0050.725] lstrlenA (lpString="*.key") returned 5
	[0050.725] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.aes") returned 0
	[0050.725] lstrlenA (lpString="*.aes") returned 5
	[0050.726] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.blob") returned 0
	[0050.726] lstrlenA (lpString="*.blob") returned 6
	[0050.726] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.btc") returned 0
	[0050.726] lstrlenA (lpString="*.btc") returned 5
	[0050.726] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\memtest.exe.mui", pszSpec="*.wallet") returned 0
	[0050.726] lstrlenA (lpString="*.wallet") returned 8
	[0050.726] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x518ea25e, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe31db522, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xa558, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0050.726] FindClose (in: hFindFile=0x7cbb90 | out: hFindFile=0x7cbb90) returned 1
	[0050.726] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0050.726] lstrcmpA (lpString1=".", lpString2="zh-TW") returned -1
	[0050.726] lstrcmpA (lpString1="..", lpString2="zh-TW") returned -1
	[0050.726] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0050.726] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="zh-TW" | out: lpString1="C:\\Boot\\zh-TW") returned="C:\\Boot\\zh-TW"
	[0050.726] lstrlenA (lpString="C:\\Boot\\zh-TW") returned 13
	[0050.726] FindFirstFileA (in: lpFileName="C:\\Boot\\zh-TW\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb590
	[0050.727] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.727] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0050.727] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.727] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.727] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0050.727] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.727] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr.exe.mui") returned 1
	[0050.727] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr.exe.mui") returned 1
	[0050.727] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0050.728] PathFindFileNameA (pszPath="C:\\Boot\\zh-TW\\*.*") returned="*.*"
	[0050.728] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\zh-TW\\" | out: lpString1="C:\\Boot\\zh-TW\\") returned="C:\\Boot\\zh-TW\\"
	[0050.728] PathAddBackslashA (in: pszPath="C:\\Boot\\zh-TW\\" | out: pszPath="C:\\Boot\\zh-TW\\") returned=""
	[0050.728] lstrcatA (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\zh-TW\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\zh-TW\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.728] GetFileAttributesA (lpFileName="C:\\Boot\\zh-TW\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\zh-tw\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0050.728] CreateFileA (lpFileName="C:\\Boot\\zh-TW\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\zh-tw\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0050.737] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0050.737] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0050.738] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.738] CloseHandle (hObject=0x208) returned 1
	[0050.739] lstrcatA (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned="C:\\Boot\\zh-TW\\bootmgr.exe.mui"
	[0050.739] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0050.739] lstrlenA (lpString="*.zip") returned 5
	[0050.739] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0050.739] lstrlenA (lpString="*.rar") returned 5
	[0050.739] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0050.739] lstrlenA (lpString="*.7z") returned 4
	[0050.739] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0050.739] lstrlenA (lpString="*.tar") returned 5
	[0050.739] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0050.739] lstrlenA (lpString="*.gzip") returned 6
	[0050.739] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0050.739] lstrlenA (lpString="*.jpg") returned 5
	[0050.739] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.739] lstrlenA (lpString="*.jpeg") returned 6
	[0050.739] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0050.739] lstrlenA (lpString="*.bmp") returned 5
	[0050.739] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0050.739] lstrlenA (lpString="*.gif") returned 5
	[0050.739] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0050.739] lstrlenA (lpString="*.png") returned 5
	[0050.739] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0050.739] lstrlenA (lpString="*.doc") returned 5
	[0050.739] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0050.739] lstrlenA (lpString="*.docx") returned 6
	[0050.739] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0050.739] lstrlenA (lpString="*.xls") returned 5
	[0050.739] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.739] lstrlenA (lpString="*.xlsx") returned 6
	[0050.739] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0050.739] lstrlenA (lpString="*.ppt") returned 5
	[0050.739] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0050.739] lstrlenA (lpString="*.pptx") returned 6
	[0050.739] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0050.739] lstrlenA (lpString="*.txt") returned 5
	[0050.740] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0050.740] lstrlenA (lpString="*.pdf") returned 5
	[0050.740] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0050.740] lstrlenA (lpString="*.htm") returned 5
	[0050.740] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0050.740] lstrlenA (lpString="*.html") returned 6
	[0050.740] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0050.740] lstrlenA (lpString="*.mdb") returned 5
	[0050.740] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0050.740] lstrlenA (lpString="*.pfx") returned 5
	[0050.740] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0050.740] lstrlenA (lpString="*.md") returned 4
	[0050.740] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0050.740] lstrlenA (lpString="*.lnk") returned 5
	[0050.741] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0050.741] lstrlenA (lpString="*.torrent") returned 9
	[0050.741] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0050.741] lstrlenA (lpString="*.mov") returned 5
	[0050.741] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0050.741] lstrlenA (lpString="*.3gp") returned 5
	[0050.741] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.741] lstrlenA (lpString="*.mpeg") returned 6
	[0050.741] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0050.741] lstrlenA (lpString="*.mpg") returned 5
	[0050.741] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0050.741] lstrlenA (lpString="*.flv") returned 5
	[0050.741] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0050.741] lstrlenA (lpString="*.avi") returned 5
	[0050.741] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0050.741] lstrlenA (lpString="*.mp4") returned 5
	[0050.741] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0050.741] lstrlenA (lpString="*.wmv") returned 5
	[0050.741] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0050.741] lstrlenA (lpString="*.mkv") returned 5
	[0050.741] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0050.741] lstrlenA (lpString="*.mp3") returned 5
	[0050.741] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0050.741] lstrlenA (lpString="*.wav") returned 5
	[0050.741] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0050.741] lstrlenA (lpString="*.flac") returned 6
	[0050.741] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0050.741] lstrlenA (lpString="*.wma") returned 5
	[0050.741] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.au3") returned 0
	[0050.741] lstrlenA (lpString="*.au3") returned 5
	[0050.741] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.ahk") returned 0
	[0050.741] lstrlenA (lpString="*.ahk") returned 5
	[0050.741] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.c") returned 0
	[0050.741] lstrlenA (lpString="*.c") returned 3
	[0050.741] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.cc") returned 0
	[0050.741] lstrlenA (lpString="*.cc") returned 4
	[0050.741] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0
	[0050.741] lstrlenA (lpString="*.cpp") returned 5
	[0050.742] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.cxx") returned 0
	[0050.742] lstrlenA (lpString="*.cxx") returned 5
	[0050.742] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.c++") returned 0
	[0050.742] lstrlenA (lpString="*.c++") returned 5
	[0050.742] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.cs") returned 0
	[0050.742] lstrlenA (lpString="*.cs") returned 4
	[0050.742] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.vb") returned 0
	[0050.742] lstrlenA (lpString="*.vb") returned 4
	[0050.742] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.bas") returned 0
	[0050.742] lstrlenA (lpString="*.bas") returned 5
	[0050.742] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.csproj") returned 0
	[0050.742] lstrlenA (lpString="*.csproj") returned 8
	[0050.742] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.742] lstrlenA (lpString="*.vbproj") returned 8
	[0050.742] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.742] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.742] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.manifest") returned 0
	[0050.742] lstrlenA (lpString="*.manifest") returned 10
	[0050.742] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.php") returned 0
	[0050.742] lstrlenA (lpString="*.php") returned 5
	[0050.742] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.vbe") returned 0
	[0050.742] lstrlenA (lpString="*.vbe") returned 5
	[0050.742] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.vba") returned 0
	[0050.742] lstrlenA (lpString="*.vba") returned 5
	[0050.742] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.vbs") returned 0
	[0050.742] lstrlenA (lpString="*.vbs") returned 5
	[0050.742] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.bat") returned 0
	[0050.742] lstrlenA (lpString="*.bat") returned 5
	[0050.742] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.cmd") returned 0
	[0050.742] lstrlenA (lpString="*.cmd") returned 5
	[0050.742] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.js") returned 0
	[0050.742] lstrlenA (lpString="*.js") returned 4
	[0050.742] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.jscript") returned 0
	[0050.742] lstrlenA (lpString="*.jscript") returned 9
	[0050.742] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.hta") returned 0
	[0050.742] lstrlenA (lpString="*.hta") returned 5
	[0050.742] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.php7") returned 0
	[0050.742] lstrlenA (lpString="*.php7") returned 6
	[0050.743] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.db") returned 0
	[0050.743] lstrlenA (lpString="*.db") returned 4
	[0050.743] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.swf") returned 0
	[0050.743] lstrlenA (lpString="*.swf") returned 5
	[0050.743] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.eml") returned 0
	[0050.743] lstrlenA (lpString="*.eml") returned 5
	[0050.743] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.part") returned 0
	[0050.743] lstrlenA (lpString="*.part") returned 6
	[0050.743] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.nfo") returned 0
	[0050.743] lstrlenA (lpString="*.nfo") returned 5
	[0050.743] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.rsa") returned 0
	[0050.743] lstrlenA (lpString="*.rsa") returned 5
	[0050.743] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.key") returned 0
	[0050.743] lstrlenA (lpString="*.key") returned 5
	[0050.743] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.aes") returned 0
	[0050.743] lstrlenA (lpString="*.aes") returned 5
	[0050.743] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.blob") returned 0
	[0050.743] lstrlenA (lpString="*.blob") returned 6
	[0050.743] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.btc") returned 0
	[0050.743] lstrlenA (lpString="*.btc") returned 5
	[0050.743] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.wallet") returned 0
	[0050.743] lstrlenA (lpString="*.wallet") returned 8
	[0050.743] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0050.743] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0050.743] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="memtest.exe.mui") returned -1
	[0050.743] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="memtest.exe.mui") returned -1
	[0050.743] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1
	[0050.743] PathFindFileNameA (pszPath="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned="bootmgr.exe.mui"
	[0050.743] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\zh-TW\\" | out: lpString1="C:\\Boot\\zh-TW\\") returned="C:\\Boot\\zh-TW\\"
	[0050.743] PathAddBackslashA (in: pszPath="C:\\Boot\\zh-TW\\" | out: pszPath="C:\\Boot\\zh-TW\\") returned=""
	[0050.743] lstrcatA (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Boot\\zh-TW\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Boot\\zh-TW\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.743] GetFileAttributesA (lpFileName="C:\\Boot\\zh-TW\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\boot\\zh-tw\\how-to-decrypt-files.htm")) returned 0x20
	[0050.743] lstrcatA (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\zh-TW\\memtest.exe.mui") returned="C:\\Boot\\zh-TW\\memtest.exe.mui"
	[0050.744] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.zip") returned 0
	[0050.744] lstrlenA (lpString="*.zip") returned 5
	[0050.744] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.rar") returned 0
	[0050.744] lstrlenA (lpString="*.rar") returned 5
	[0050.744] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.7z") returned 0
	[0050.744] lstrlenA (lpString="*.7z") returned 4
	[0050.744] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.tar") returned 0
	[0050.744] lstrlenA (lpString="*.tar") returned 5
	[0050.744] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.gzip") returned 0
	[0050.744] lstrlenA (lpString="*.gzip") returned 6
	[0050.744] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.jpg") returned 0
	[0050.744] lstrlenA (lpString="*.jpg") returned 5
	[0050.744] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.jpeg") returned 0
	[0050.744] lstrlenA (lpString="*.jpeg") returned 6
	[0050.744] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.bmp") returned 0
	[0050.744] lstrlenA (lpString="*.bmp") returned 5
	[0050.744] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.gif") returned 0
	[0050.744] lstrlenA (lpString="*.gif") returned 5
	[0050.744] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.png") returned 0
	[0050.744] lstrlenA (lpString="*.png") returned 5
	[0050.744] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.doc") returned 0
	[0050.744] lstrlenA (lpString="*.doc") returned 5
	[0050.744] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.docx") returned 0
	[0050.744] lstrlenA (lpString="*.docx") returned 6
	[0050.744] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.xls") returned 0
	[0050.744] lstrlenA (lpString="*.xls") returned 5
	[0050.744] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.xlsx") returned 0
	[0050.744] lstrlenA (lpString="*.xlsx") returned 6
	[0050.744] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.ppt") returned 0
	[0050.744] lstrlenA (lpString="*.ppt") returned 5
	[0050.744] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.pptx") returned 0
	[0050.744] lstrlenA (lpString="*.pptx") returned 6
	[0050.744] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.txt") returned 0
	[0050.744] lstrlenA (lpString="*.txt") returned 5
	[0050.744] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.pdf") returned 0
	[0050.744] lstrlenA (lpString="*.pdf") returned 5
	[0050.744] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.htm") returned 0
	[0050.745] lstrlenA (lpString="*.htm") returned 5
	[0050.745] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.html") returned 0
	[0050.745] lstrlenA (lpString="*.html") returned 6
	[0050.745] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.mdb") returned 0
	[0050.745] lstrlenA (lpString="*.mdb") returned 5
	[0050.745] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.pfx") returned 0
	[0050.745] lstrlenA (lpString="*.pfx") returned 5
	[0050.745] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.md") returned 0
	[0050.745] lstrlenA (lpString="*.md") returned 4
	[0050.745] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.lnk") returned 0
	[0050.745] lstrlenA (lpString="*.lnk") returned 5
	[0050.745] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.torrent") returned 0
	[0050.745] lstrlenA (lpString="*.torrent") returned 9
	[0050.745] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.mov") returned 0
	[0050.745] lstrlenA (lpString="*.mov") returned 5
	[0050.745] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.3gp") returned 0
	[0050.745] lstrlenA (lpString="*.3gp") returned 5
	[0050.745] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.mpeg") returned 0
	[0050.745] lstrlenA (lpString="*.mpeg") returned 6
	[0050.745] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.mpg") returned 0
	[0050.745] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.flv") returned 0
	[0050.745] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.avi") returned 0
	[0050.745] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.mp4") returned 0
	[0050.745] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.wmv") returned 0
	[0050.745] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.mkv") returned 0
	[0050.745] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.mp3") returned 0
	[0050.745] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.wav") returned 0
	[0050.745] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.flac") returned 0
	[0050.745] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.wma") returned 0
	[0050.745] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.au3") returned 0
	[0050.745] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.ahk") returned 0
	[0050.746] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.c") returned 0
	[0050.746] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.cc") returned 0
	[0050.746] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.cpp") returned 0
	[0050.746] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.cxx") returned 0
	[0050.746] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.c++") returned 0
	[0050.746] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.cs") returned 0
	[0050.746] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.vb") returned 0
	[0050.746] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.bas") returned 0
	[0050.746] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.csproj") returned 0
	[0050.746] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.vbproj") returned 0
	[0050.746] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.vcxproj") returned 0
	[0050.746] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.manifest") returned 0
	[0050.746] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.php") returned 0
	[0050.746] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.vbe") returned 0
	[0050.746] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.vba") returned 0
	[0050.746] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.vbs") returned 0
	[0050.746] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.bat") returned 0
	[0050.746] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.cmd") returned 0
	[0050.746] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.js") returned 0
	[0050.746] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.jscript") returned 0
	[0050.746] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.hta") returned 0
	[0050.746] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.php7") returned 0
	[0050.746] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.db") returned 0
	[0050.746] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.swf") returned 0
	[0050.746] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.eml") returned 0
	[0050.746] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.part") returned 0
	[0050.747] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.nfo") returned 0
	[0050.747] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.rsa") returned 0
	[0050.747] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.key") returned 0
	[0050.747] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.aes") returned 0
	[0050.747] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.blob") returned 0
	[0050.747] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.btc") returned 0
	[0050.747] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.wallet") returned 0
	[0050.747] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0050.747] FindClose (in: hFindFile=0x7cb590 | out: hFindFile=0x7cb590) returned 1
	[0050.747] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0
	[0050.747] FindClose (in: hFindFile=0x7cbbd0 | out: hFindFile=0x7cbbd0) returned 1
	[0050.747] FindNextFileA (in: hFindFile=0x7cba90, lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x7d1538, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1
	[0050.747] PeekMessageA (in: lpMsg=0x19fe0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fe0c) returned 0
	[0050.747] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bootmgr") returned 1
	[0050.747] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bootmgr") returned 1
	[0050.747] lstrcmpiA (lpString1="", lpString2="bootmgr") returned -1
	[0050.747] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*"
	[0050.747] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\"
	[0050.747] PathAddBackslashA (in: pszPath="C:\\" | out: pszPath="C:\\") returned=""
	[0050.747] lstrcatA (in: lpString1="C:\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.747] GetFileAttributesA (lpFileName="C:\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\how-to-decrypt-files.htm")) returned 0x20
	[0050.747] lstrcatA (in: lpString1="C:\\", lpString2="bootmgr" | out: lpString1="C:\\bootmgr") returned="C:\\bootmgr"
	[0050.747] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.zip") returned 0
	[0050.747] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.rar") returned 0
	[0050.748] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.7z") returned 0
	[0050.748] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.tar") returned 0
	[0050.748] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.gzip") returned 0
	[0050.748] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.jpg") returned 0
	[0050.748] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.jpeg") returned 0
	[0050.748] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.bmp") returned 0
	[0050.748] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.gif") returned 0
	[0050.748] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.png") returned 0
	[0050.748] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.doc") returned 0
	[0050.748] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.docx") returned 0
	[0050.748] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.xls") returned 0
	[0050.748] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.xlsx") returned 0
	[0050.748] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.ppt") returned 0
	[0050.748] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.pptx") returned 0
	[0050.748] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.txt") returned 0
	[0050.748] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.pdf") returned 0
	[0050.748] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.htm") returned 0
	[0050.748] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.html") returned 0
	[0050.748] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mdb") returned 0
	[0050.748] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.pfx") returned 0
	[0050.748] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.md") returned 0
	[0050.748] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.lnk") returned 0
	[0050.748] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.torrent") returned 0
	[0050.748] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mov") returned 0
	[0050.748] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.3gp") returned 0
	[0050.748] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mpeg") returned 0
	[0050.748] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mpg") returned 0
	[0050.749] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.flv") returned 0
	[0050.749] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.avi") returned 0
	[0050.749] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mp4") returned 0
	[0050.749] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.wmv") returned 0
	[0050.749] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mkv") returned 0
	[0050.749] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mp3") returned 0
	[0050.749] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.wav") returned 0
	[0050.749] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.flac") returned 0
	[0050.749] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.wma") returned 0
	[0050.749] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.au3") returned 0
	[0050.749] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.ahk") returned 0
	[0050.749] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.c") returned 0
	[0050.749] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.cc") returned 0
	[0050.749] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.cpp") returned 0
	[0050.749] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.cxx") returned 0
	[0050.749] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.c++") returned 0
	[0050.749] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.cs") returned 0
	[0050.749] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.vb") returned 0
	[0050.749] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.bas") returned 0
	[0050.749] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.csproj") returned 0
	[0050.749] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.vbproj") returned 0
	[0050.749] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.vcxproj") returned 0
	[0050.749] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.manifest") returned 0
	[0050.749] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.php") returned 0
	[0050.749] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.vbe") returned 0
	[0050.749] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.vba") returned 0
	[0050.749] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.vbs") returned 0
	[0050.749] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.bat") returned 0
	[0050.750] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.cmd") returned 0
	[0050.750] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.js") returned 0
	[0050.750] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.jscript") returned 0
	[0050.750] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.hta") returned 0
	[0050.750] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.php7") returned 0
	[0050.750] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.db") returned 0
	[0050.750] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.swf") returned 0
	[0050.750] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.eml") returned 0
	[0050.750] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.part") returned 0
	[0050.750] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.nfo") returned 0
	[0050.750] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.rsa") returned 0
	[0050.750] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.key") returned 0
	[0050.750] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.aes") returned 0
	[0050.750] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.blob") returned 0
	[0050.750] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.btc") returned 0
	[0050.750] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.wallet") returned 0
	[0050.750] FindNextFileA (in: hFindFile=0x7cba90, lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef9d0a0c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTNXT", cAlternateFileName="")) returned 1
	[0050.750] PeekMessageA (in: lpMsg=0x19fe0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fe0c) returned 0
	[0050.750] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="BOOTNXT") returned 1
	[0050.750] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="BOOTNXT") returned 1
	[0050.750] lstrcmpiA (lpString1="", lpString2="BOOTNXT") returned -1
	[0050.750] PathFindFileNameA (pszPath="C:\\bootmgr") returned="bootmgr"
	[0050.750] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\"
	[0050.750] PathAddBackslashA (in: pszPath="C:\\" | out: pszPath="C:\\") returned=""
	[0050.750] lstrcatA (in: lpString1="C:\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.750] GetFileAttributesA (lpFileName="C:\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\how-to-decrypt-files.htm")) returned 0x20
	[0050.750] lstrcatA (in: lpString1="C:\\", lpString2="BOOTNXT" | out: lpString1="C:\\BOOTNXT") returned="C:\\BOOTNXT"
	[0050.750] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.zip") returned 0
	[0050.751] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.rar") returned 0
	[0050.751] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.7z") returned 0
	[0050.751] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.tar") returned 0
	[0050.751] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.gzip") returned 0
	[0050.751] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.jpg") returned 0
	[0050.751] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.jpeg") returned 0
	[0050.751] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.bmp") returned 0
	[0050.751] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.gif") returned 0
	[0050.751] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.png") returned 0
	[0050.751] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.doc") returned 0
	[0050.751] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.docx") returned 0
	[0050.751] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.xls") returned 0
	[0050.751] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.xlsx") returned 0
	[0050.751] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.ppt") returned 0
	[0050.751] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.pptx") returned 0
	[0050.751] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.txt") returned 0
	[0050.751] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.pdf") returned 0
	[0050.751] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.htm") returned 0
	[0050.751] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.html") returned 0
	[0050.751] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.mdb") returned 0
	[0050.751] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.pfx") returned 0
	[0050.751] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.md") returned 0
	[0050.751] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.lnk") returned 0
	[0050.751] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.torrent") returned 0
	[0050.751] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.mov") returned 0
	[0050.751] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.3gp") returned 0
	[0050.751] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.mpeg") returned 0
	[0050.752] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.mpg") returned 0
	[0050.752] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.flv") returned 0
	[0050.752] FindNextFileA (in: hFindFile=0x7cba90, lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xc4ee267e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4ee267e, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1c63cdd, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1
	[0050.752] PeekMessageA (in: lpMsg=0x19fe0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fe0c) returned 0
	[0050.752] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="BOOTSECT.BAK") returned 1
	[0050.752] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="BOOTSECT.BAK") returned 1
	[0050.752] lstrcmpiA (lpString1="", lpString2="BOOTSECT.BAK") returned -1
	[0050.752] PathFindFileNameA (pszPath="C:\\BOOTNXT") returned="BOOTNXT"
	[0050.752] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\"
	[0050.752] PathAddBackslashA (in: pszPath="C:\\" | out: pszPath="C:\\") returned=""
	[0050.752] lstrcatA (in: lpString1="C:\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.752] GetFileAttributesA (lpFileName="C:\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\how-to-decrypt-files.htm")) returned 0x20
	[0050.752] lstrcatA (in: lpString1="C:\\", lpString2="BOOTSECT.BAK" | out: lpString1="C:\\BOOTSECT.BAK") returned="C:\\BOOTSECT.BAK"
	[0050.752] FindNextFileA (in: hFindFile=0x7cba90, lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1
	[0050.752] lstrcmpA (lpString1=".", lpString2="Documents and Settings") returned -1
	[0050.752] lstrcmpA (lpString1="..", lpString2="Documents and Settings") returned -1
	[0050.752] PathFindFileNameA (pszPath="C:\\BOOTSECT.BAK") returned="BOOTSECT.BAK"
	[0050.752] lstrcatA (in: lpString1="C:\\", lpString2="Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings"
	[0050.752] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\*.*", lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x19fd78, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x18, nFileSizeHigh=0x207d0, nFileSizeLow=0x0, dwReserved0=0x7ba9f8, dwReserved1=0x40445c, cFileName="\x01", cAlternateFileName="\xcc\xff\x19")) returned 0xffffffff
	[0050.754] FindNextFileA (in: hFindFile=0x7cba90, lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1
	[0050.754] lstrcmpA (lpString1=".", lpString2="ESD") returned -1
	[0050.754] lstrcmpA (lpString1="..", lpString2="ESD") returned -1
	[0050.754] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*"
	[0050.754] lstrcatA (in: lpString1="C:\\", lpString2="ESD" | out: lpString1="C:\\ESD") returned="C:\\ESD"
	[0050.754] FindFirstFileA (in: lpFileName="C:\\ESD\\*.*", lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x48, cFileName=".", cAlternateFileName="")) returned 0x7cb750
	[0050.799] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.799] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x48, cFileName="..", cAlternateFileName="")) returned 1
	[0050.799] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.799] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.799] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x48, cFileName="..", cAlternateFileName="")) returned 0
	[0050.799] FindClose (in: hFindFile=0x7cb750 | out: hFindFile=0x7cb750) returned 1
	[0050.799] FindNextFileA (in: hFindFile=0x7cba90, lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3d7ebe9, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0x7d1538, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1
	[0050.799] PeekMessageA (in: lpMsg=0x19fe0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fe0c) returned 0
	[0050.799] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="hiberfil.sys") returned -1
	[0050.799] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="hiberfil.sys") returned 1
	[0050.799] lstrcmpiA (lpString1="", lpString2="hiberfil.sys") returned -1
	[0050.799] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*"
	[0050.800] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\"
	[0050.800] PathAddBackslashA (in: pszPath="C:\\" | out: pszPath="C:\\") returned=""
	[0050.800] lstrcatA (in: lpString1="C:\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.800] GetFileAttributesA (lpFileName="C:\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\how-to-decrypt-files.htm")) returned 0x20
	[0050.800] lstrcatA (in: lpString1="C:\\", lpString2="hiberfil.sys" | out: lpString1="C:\\hiberfil.sys") returned="C:\\hiberfil.sys"
	[0050.800] FindNextFileA (in: hFindFile=0x7cba90, lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1
	[0050.800] lstrcmpA (lpString1=".", lpString2="Logs") returned -1
	[0050.800] lstrcmpA (lpString1="..", lpString2="Logs") returned -1
	[0050.800] PathFindFileNameA (pszPath="C:\\hiberfil.sys") returned="hiberfil.sys"
	[0050.800] lstrcatA (in: lpString1="C:\\", lpString2="Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0050.800] FindFirstFileA (in: lpFileName="C:\\Logs\\*.*", lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x48, cFileName=".", cAlternateFileName="")) returned 0x7cb790
	[0050.804] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.804] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x48, cFileName="..", cAlternateFileName="")) returned 1
	[0050.808] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.808] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.808] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5052fa31, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5052fa31, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x7b0000, dwReserved1=0x48, cFileName="Application.evtx", cAlternateFileName="APPLIC~1.EVT")) returned 1
	[0050.808] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.808] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Application.evtx") returned 1
	[0050.809] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Application.evtx") returned 1
	[0050.809] lstrcmpiA (lpString1="", lpString2="Application.evtx") returned -1
	[0050.809] PathFindFileNameA (pszPath="C:\\Logs\\*.*") returned="*.*"
	[0050.809] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.809] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.809] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.809] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0050.809] CreateFileA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0050.809] WriteFile (in: hFile=0x204, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0050.810] SetFileTime (hFile=0x204, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.810] CloseHandle (hObject=0x204) returned 1
	[0050.810] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Application.evtx" | out: lpString1="C:\\Logs\\Application.evtx") returned="C:\\Logs\\Application.evtx"
	[0050.810] lstrlenA (lpString="*.zip") returned 5
	[0050.810] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.rar") returned 0
	[0050.810] lstrlenA (lpString="*.rar") returned 5
	[0050.810] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.7z") returned 0
	[0050.810] lstrlenA (lpString="*.7z") returned 4
	[0050.811] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.tar") returned 0
	[0050.811] lstrlenA (lpString="*.tar") returned 5
	[0050.811] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.gzip") returned 0
	[0050.811] lstrlenA (lpString="*.gzip") returned 6
	[0050.811] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.jpg") returned 0
	[0050.811] lstrlenA (lpString="*.jpg") returned 5
	[0050.811] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.jpeg") returned 0
	[0050.811] lstrlenA (lpString="*.jpeg") returned 6
	[0050.811] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.bmp") returned 0
	[0050.811] lstrlenA (lpString="*.bmp") returned 5
	[0050.811] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.gif") returned 0
	[0050.811] lstrlenA (lpString="*.gif") returned 5
	[0050.811] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.png") returned 0
	[0050.811] lstrlenA (lpString="*.png") returned 5
	[0050.811] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.doc") returned 0
	[0050.811] lstrlenA (lpString="*.doc") returned 5
	[0050.811] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.docx") returned 0
	[0050.811] lstrlenA (lpString="*.docx") returned 6
	[0050.811] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.xls") returned 0
	[0050.811] lstrlenA (lpString="*.xls") returned 5
	[0050.811] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.xlsx") returned 0
	[0050.811] lstrlenA (lpString="*.xlsx") returned 6
	[0050.811] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.ppt") returned 0
	[0050.811] lstrlenA (lpString="*.ppt") returned 5
	[0050.811] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.pptx") returned 0
	[0050.811] lstrlenA (lpString="*.pptx") returned 6
	[0050.811] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.txt") returned 0
	[0050.811] lstrlenA (lpString="*.txt") returned 5
	[0050.811] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.pdf") returned 0
	[0050.811] lstrlenA (lpString="*.pdf") returned 5
	[0050.811] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.htm") returned 0
	[0050.811] lstrlenA (lpString="*.htm") returned 5
	[0050.811] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.html") returned 0
	[0050.811] lstrlenA (lpString="*.html") returned 6
	[0050.811] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.mdb") returned 0
	[0050.811] lstrlenA (lpString="*.mdb") returned 5
	[0050.812] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.pfx") returned 0
	[0050.812] lstrlenA (lpString="*.pfx") returned 5
	[0050.812] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.md") returned 0
	[0050.812] lstrlenA (lpString="*.md") returned 4
	[0050.812] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.lnk") returned 0
	[0050.812] lstrlenA (lpString="*.lnk") returned 5
	[0050.812] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.torrent") returned 0
	[0050.812] lstrlenA (lpString="*.torrent") returned 9
	[0050.812] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.mov") returned 0
	[0050.812] lstrlenA (lpString="*.mov") returned 5
	[0050.812] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.3gp") returned 0
	[0050.812] lstrlenA (lpString="*.3gp") returned 5
	[0050.812] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.mpeg") returned 0
	[0050.812] lstrlenA (lpString="*.mpeg") returned 6
	[0050.812] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.mpg") returned 0
	[0050.812] lstrlenA (lpString="*.mpg") returned 5
	[0050.812] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.flv") returned 0
	[0050.812] lstrlenA (lpString="*.flv") returned 5
	[0050.812] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.avi") returned 0
	[0050.812] lstrlenA (lpString="*.avi") returned 5
	[0050.812] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.mp4") returned 0
	[0050.812] lstrlenA (lpString="*.mp4") returned 5
	[0050.812] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.wmv") returned 0
	[0050.812] lstrlenA (lpString="*.wmv") returned 5
	[0050.812] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.mkv") returned 0
	[0050.812] lstrlenA (lpString="*.mkv") returned 5
	[0050.812] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.mp3") returned 0
	[0050.812] lstrlenA (lpString="*.mp3") returned 5
	[0050.812] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.wav") returned 0
	[0050.812] lstrlenA (lpString="*.wav") returned 5
	[0050.812] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.flac") returned 0
	[0050.812] lstrlenA (lpString="*.flac") returned 6
	[0050.812] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.wma") returned 0
	[0050.812] lstrlenA (lpString="*.wma") returned 5
	[0050.812] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.au3") returned 0
	[0050.812] lstrlenA (lpString="*.au3") returned 5
	[0050.812] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.ahk") returned 0
	[0050.813] lstrlenA (lpString="*.ahk") returned 5
	[0050.813] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.c") returned 0
	[0050.813] lstrlenA (lpString="*.c") returned 3
	[0050.813] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.cc") returned 0
	[0050.813] lstrlenA (lpString="*.cc") returned 4
	[0050.813] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.cpp") returned 0
	[0050.813] lstrlenA (lpString="*.cpp") returned 5
	[0050.813] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.cxx") returned 0
	[0050.813] lstrlenA (lpString="*.cxx") returned 5
	[0050.813] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.c++") returned 0
	[0050.813] lstrlenA (lpString="*.c++") returned 5
	[0050.813] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.cs") returned 0
	[0050.813] lstrlenA (lpString="*.cs") returned 4
	[0050.813] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.vb") returned 0
	[0050.813] lstrlenA (lpString="*.vb") returned 4
	[0050.813] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.bas") returned 0
	[0050.813] lstrlenA (lpString="*.bas") returned 5
	[0050.813] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.csproj") returned 0
	[0050.813] lstrlenA (lpString="*.csproj") returned 8
	[0050.813] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.vbproj") returned 0
	[0050.813] lstrlenA (lpString="*.vbproj") returned 8
	[0050.813] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.vcxproj") returned 0
	[0050.813] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.813] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.manifest") returned 0
	[0050.813] lstrlenA (lpString="*.manifest") returned 10
	[0050.813] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.php") returned 0
	[0050.813] lstrlenA (lpString="*.php") returned 5
	[0050.813] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.vbe") returned 0
	[0050.813] lstrlenA (lpString="*.vbe") returned 5
	[0050.813] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.vba") returned 0
	[0050.813] lstrlenA (lpString="*.vba") returned 5
	[0050.813] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.vbs") returned 0
	[0050.813] lstrlenA (lpString="*.vbs") returned 5
	[0050.813] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.bat") returned 0
	[0050.813] lstrlenA (lpString="*.bat") returned 5
	[0050.813] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.cmd") returned 0
	[0050.813] lstrlenA (lpString="*.cmd") returned 5
	[0050.814] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.js") returned 0
	[0050.814] lstrlenA (lpString="*.js") returned 4
	[0050.814] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.jscript") returned 0
	[0050.814] lstrlenA (lpString="*.jscript") returned 9
	[0050.814] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.hta") returned 0
	[0050.814] lstrlenA (lpString="*.hta") returned 5
	[0050.814] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.php7") returned 0
	[0050.814] lstrlenA (lpString="*.php7") returned 6
	[0050.814] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.db") returned 0
	[0050.814] lstrlenA (lpString="*.db") returned 4
	[0050.814] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.swf") returned 0
	[0050.814] lstrlenA (lpString="*.swf") returned 5
	[0050.814] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.eml") returned 0
	[0050.814] lstrlenA (lpString="*.eml") returned 5
	[0050.814] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.part") returned 0
	[0050.814] lstrlenA (lpString="*.part") returned 6
	[0050.814] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.nfo") returned 0
	[0050.814] lstrlenA (lpString="*.nfo") returned 5
	[0050.814] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.rsa") returned 0
	[0050.814] lstrlenA (lpString="*.rsa") returned 5
	[0050.814] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.key") returned 0
	[0050.814] lstrlenA (lpString="*.key") returned 5
	[0050.814] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.aes") returned 0
	[0050.814] lstrlenA (lpString="*.aes") returned 5
	[0050.814] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.blob") returned 0
	[0050.814] lstrlenA (lpString="*.blob") returned 6
	[0050.814] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.btc") returned 0
	[0050.814] lstrlenA (lpString="*.btc") returned 5
	[0050.814] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.wallet") returned 0
	[0050.814] lstrlenA (lpString="*.wallet") returned 8
	[0050.814] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505ee5f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505ee5f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="HardwareEvents.evtx", cAlternateFileName="HARDWA~1.EVT")) returned 1
	[0050.814] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.814] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="HardwareEvents.evtx") returned -1
	[0050.814] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="HardwareEvents.evtx") returned 1
	[0050.814] lstrcmpiA (lpString1="", lpString2="HardwareEvents.evtx") returned -1
	[0050.814] PathFindFileNameA (pszPath="C:\\Logs\\Application.evtx") returned="Application.evtx"
	[0050.814] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.815] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.815] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.815] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.815] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HardwareEvents.evtx" | out: lpString1="C:\\Logs\\HardwareEvents.evtx") returned="C:\\Logs\\HardwareEvents.evtx"
	[0050.815] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.zip") returned 0
	[0050.815] lstrlenA (lpString="*.zip") returned 5
	[0050.815] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.rar") returned 0
	[0050.815] lstrlenA (lpString="*.rar") returned 5
	[0050.815] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.7z") returned 0
	[0050.815] lstrlenA (lpString="*.7z") returned 4
	[0050.815] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.tar") returned 0
	[0050.815] lstrlenA (lpString="*.tar") returned 5
	[0050.815] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.gzip") returned 0
	[0050.815] lstrlenA (lpString="*.gzip") returned 6
	[0050.815] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.jpg") returned 0
	[0050.815] lstrlenA (lpString="*.jpg") returned 5
	[0050.815] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.jpeg") returned 0
	[0050.815] lstrlenA (lpString="*.jpeg") returned 6
	[0050.815] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.bmp") returned 0
	[0050.815] lstrlenA (lpString="*.bmp") returned 5
	[0050.815] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.gif") returned 0
	[0050.815] lstrlenA (lpString="*.gif") returned 5
	[0050.815] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.png") returned 0
	[0050.815] lstrlenA (lpString="*.png") returned 5
	[0050.815] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.doc") returned 0
	[0050.815] lstrlenA (lpString="*.doc") returned 5
	[0050.815] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.docx") returned 0
	[0050.815] lstrlenA (lpString="*.docx") returned 6
	[0050.815] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.xls") returned 0
	[0050.815] lstrlenA (lpString="*.xls") returned 5
	[0050.815] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.xlsx") returned 0
	[0050.815] lstrlenA (lpString="*.xlsx") returned 6
	[0050.815] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.ppt") returned 0
	[0050.816] lstrlenA (lpString="*.ppt") returned 5
	[0050.816] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.pptx") returned 0
	[0050.816] lstrlenA (lpString="*.pptx") returned 6
	[0050.816] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.txt") returned 0
	[0050.816] lstrlenA (lpString="*.txt") returned 5
	[0050.816] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.pdf") returned 0
	[0050.816] lstrlenA (lpString="*.pdf") returned 5
	[0050.816] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.htm") returned 0
	[0050.816] lstrlenA (lpString="*.htm") returned 5
	[0050.816] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.html") returned 0
	[0050.816] lstrlenA (lpString="*.html") returned 6
	[0050.816] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.mdb") returned 0
	[0050.816] lstrlenA (lpString="*.mdb") returned 5
	[0050.816] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.pfx") returned 0
	[0050.816] lstrlenA (lpString="*.pfx") returned 5
	[0050.816] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.md") returned 0
	[0050.816] lstrlenA (lpString="*.md") returned 4
	[0050.816] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.lnk") returned 0
	[0050.816] lstrlenA (lpString="*.lnk") returned 5
	[0050.816] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.torrent") returned 0
	[0050.816] lstrlenA (lpString="*.torrent") returned 9
	[0050.816] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.mov") returned 0
	[0050.816] lstrlenA (lpString="*.mov") returned 5
	[0050.816] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.3gp") returned 0
	[0050.816] lstrlenA (lpString="*.3gp") returned 5
	[0050.816] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.mpeg") returned 0
	[0050.816] lstrlenA (lpString="*.mpeg") returned 6
	[0050.816] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.mpg") returned 0
	[0050.816] lstrlenA (lpString="*.mpg") returned 5
	[0050.816] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.flv") returned 0
	[0050.816] lstrlenA (lpString="*.flv") returned 5
	[0050.816] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.avi") returned 0
	[0050.816] lstrlenA (lpString="*.avi") returned 5
	[0050.816] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.mp4") returned 0
	[0050.816] lstrlenA (lpString="*.mp4") returned 5
	[0050.816] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.wmv") returned 0
	[0050.816] lstrlenA (lpString="*.wmv") returned 5
	[0050.817] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.mkv") returned 0
	[0050.817] lstrlenA (lpString="*.mkv") returned 5
	[0050.817] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.mp3") returned 0
	[0050.817] lstrlenA (lpString="*.mp3") returned 5
	[0050.817] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.wav") returned 0
	[0050.817] lstrlenA (lpString="*.wav") returned 5
	[0050.817] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.flac") returned 0
	[0050.817] lstrlenA (lpString="*.flac") returned 6
	[0050.817] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.wma") returned 0
	[0050.817] lstrlenA (lpString="*.wma") returned 5
	[0050.817] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.au3") returned 0
	[0050.817] lstrlenA (lpString="*.au3") returned 5
	[0050.817] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.ahk") returned 0
	[0050.817] lstrlenA (lpString="*.ahk") returned 5
	[0050.817] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.c") returned 0
	[0050.817] lstrlenA (lpString="*.c") returned 3
	[0050.817] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.cc") returned 0
	[0050.817] lstrlenA (lpString="*.cc") returned 4
	[0050.817] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.cpp") returned 0
	[0050.817] lstrlenA (lpString="*.cpp") returned 5
	[0050.817] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.cxx") returned 0
	[0050.817] lstrlenA (lpString="*.cxx") returned 5
	[0050.817] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.c++") returned 0
	[0050.817] lstrlenA (lpString="*.c++") returned 5
	[0050.817] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.cs") returned 0
	[0050.817] lstrlenA (lpString="*.cs") returned 4
	[0050.817] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.vb") returned 0
	[0050.817] lstrlenA (lpString="*.vb") returned 4
	[0050.817] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.bas") returned 0
	[0050.817] lstrlenA (lpString="*.bas") returned 5
	[0050.817] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.csproj") returned 0
	[0050.817] lstrlenA (lpString="*.csproj") returned 8
	[0050.817] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.vbproj") returned 0
	[0050.817] lstrlenA (lpString="*.vbproj") returned 8
	[0050.817] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.vcxproj") returned 0
	[0050.817] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.818] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.manifest") returned 0
	[0050.818] lstrlenA (lpString="*.manifest") returned 10
	[0050.818] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.php") returned 0
	[0050.822] lstrlenA (lpString="*.php") returned 5
	[0050.822] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.vbe") returned 0
	[0050.822] lstrlenA (lpString="*.vbe") returned 5
	[0050.822] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.vba") returned 0
	[0050.822] lstrlenA (lpString="*.vba") returned 5
	[0050.822] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.vbs") returned 0
	[0050.822] lstrlenA (lpString="*.vbs") returned 5
	[0050.822] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.bat") returned 0
	[0050.822] lstrlenA (lpString="*.bat") returned 5
	[0050.822] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.cmd") returned 0
	[0050.822] lstrlenA (lpString="*.cmd") returned 5
	[0050.822] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.js") returned 0
	[0050.822] lstrlenA (lpString="*.js") returned 4
	[0050.822] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.jscript") returned 0
	[0050.822] lstrlenA (lpString="*.jscript") returned 9
	[0050.822] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.hta") returned 0
	[0050.822] lstrlenA (lpString="*.hta") returned 5
	[0050.822] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.php7") returned 0
	[0050.822] lstrlenA (lpString="*.php7") returned 6
	[0050.822] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.db") returned 0
	[0050.822] lstrlenA (lpString="*.db") returned 4
	[0050.822] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.swf") returned 0
	[0050.822] lstrlenA (lpString="*.swf") returned 5
	[0050.822] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.eml") returned 0
	[0050.822] lstrlenA (lpString="*.eml") returned 5
	[0050.822] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.part") returned 0
	[0050.823] lstrlenA (lpString="*.part") returned 6
	[0050.823] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.nfo") returned 0
	[0050.823] lstrlenA (lpString="*.nfo") returned 5
	[0050.823] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.rsa") returned 0
	[0050.823] lstrlenA (lpString="*.rsa") returned 5
	[0050.823] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.key") returned 0
	[0050.823] lstrlenA (lpString="*.key") returned 5
	[0050.823] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.aes") returned 0
	[0050.823] lstrlenA (lpString="*.aes") returned 5
	[0050.823] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.blob") returned 0
	[0050.823] lstrlenA (lpString="*.blob") returned 6
	[0050.823] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.btc") returned 0
	[0050.823] lstrlenA (lpString="*.btc") returned 5
	[0050.823] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.wallet") returned 0
	[0050.823] lstrlenA (lpString="*.wallet") returned 8
	[0050.823] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505a2134, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505a2134, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer.evtx", cAlternateFileName="INTERN~1.EVT")) returned 1
	[0050.823] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.823] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Internet Explorer.evtx") returned -1
	[0050.823] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Internet Explorer.evtx") returned -1
	[0050.823] lstrcmpiA (lpString1="", lpString2="Internet Explorer.evtx") returned -1
	[0050.823] PathFindFileNameA (pszPath="C:\\Logs\\HardwareEvents.evtx") returned="HardwareEvents.evtx"
	[0050.823] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.823] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.823] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.823] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.823] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Internet Explorer.evtx" | out: lpString1="C:\\Logs\\Internet Explorer.evtx") returned="C:\\Logs\\Internet Explorer.evtx"
	[0050.823] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.zip") returned 0
	[0050.823] lstrlenA (lpString="*.zip") returned 5
	[0050.823] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.rar") returned 0
	[0050.823] lstrlenA (lpString="*.rar") returned 5
	[0050.823] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.7z") returned 0
	[0050.823] lstrlenA (lpString="*.7z") returned 4
	[0050.823] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.tar") returned 0
	[0050.824] lstrlenA (lpString="*.tar") returned 5
	[0050.824] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.gzip") returned 0
	[0050.824] lstrlenA (lpString="*.gzip") returned 6
	[0050.824] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.jpg") returned 0
	[0050.824] lstrlenA (lpString="*.jpg") returned 5
	[0050.824] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.jpeg") returned 0
	[0050.824] lstrlenA (lpString="*.jpeg") returned 6
	[0050.824] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.bmp") returned 0
	[0050.824] lstrlenA (lpString="*.bmp") returned 5
	[0050.824] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.gif") returned 0
	[0050.824] lstrlenA (lpString="*.gif") returned 5
	[0050.824] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.png") returned 0
	[0050.824] lstrlenA (lpString="*.png") returned 5
	[0050.824] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.doc") returned 0
	[0050.824] lstrlenA (lpString="*.doc") returned 5
	[0050.824] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.docx") returned 0
	[0050.824] lstrlenA (lpString="*.docx") returned 6
	[0050.824] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.xls") returned 0
	[0050.824] lstrlenA (lpString="*.xls") returned 5
	[0050.824] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.xlsx") returned 0
	[0050.824] lstrlenA (lpString="*.xlsx") returned 6
	[0050.824] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.ppt") returned 0
	[0050.824] lstrlenA (lpString="*.ppt") returned 5
	[0050.824] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.pptx") returned 0
	[0050.824] lstrlenA (lpString="*.pptx") returned 6
	[0050.824] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.txt") returned 0
	[0050.824] lstrlenA (lpString="*.txt") returned 5
	[0050.824] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.pdf") returned 0
	[0050.824] lstrlenA (lpString="*.pdf") returned 5
	[0050.824] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.htm") returned 0
	[0050.824] lstrlenA (lpString="*.htm") returned 5
	[0050.824] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.html") returned 0
	[0050.824] lstrlenA (lpString="*.html") returned 6
	[0050.824] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.mdb") returned 0
	[0050.824] lstrlenA (lpString="*.mdb") returned 5
	[0050.824] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.pfx") returned 0
	[0050.825] lstrlenA (lpString="*.pfx") returned 5
	[0050.825] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.md") returned 0
	[0050.825] lstrlenA (lpString="*.md") returned 4
	[0050.825] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.lnk") returned 0
	[0050.825] lstrlenA (lpString="*.lnk") returned 5
	[0050.825] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.torrent") returned 0
	[0050.825] lstrlenA (lpString="*.torrent") returned 9
	[0050.825] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.mov") returned 0
	[0050.825] lstrlenA (lpString="*.mov") returned 5
	[0050.825] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.3gp") returned 0
	[0050.825] lstrlenA (lpString="*.3gp") returned 5
	[0050.825] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.mpeg") returned 0
	[0050.825] lstrlenA (lpString="*.mpeg") returned 6
	[0050.825] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.mpg") returned 0
	[0050.825] lstrlenA (lpString="*.mpg") returned 5
	[0050.825] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.flv") returned 0
	[0050.825] lstrlenA (lpString="*.flv") returned 5
	[0050.825] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.avi") returned 0
	[0050.825] lstrlenA (lpString="*.avi") returned 5
	[0050.825] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.mp4") returned 0
	[0050.825] lstrlenA (lpString="*.mp4") returned 5
	[0050.825] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.wmv") returned 0
	[0050.825] lstrlenA (lpString="*.wmv") returned 5
	[0050.825] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.mkv") returned 0
	[0050.825] lstrlenA (lpString="*.mkv") returned 5
	[0050.825] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.mp3") returned 0
	[0050.825] lstrlenA (lpString="*.mp3") returned 5
	[0050.825] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.wav") returned 0
	[0050.825] lstrlenA (lpString="*.wav") returned 5
	[0050.825] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.flac") returned 0
	[0050.825] lstrlenA (lpString="*.flac") returned 6
	[0050.825] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.wma") returned 0
	[0050.825] lstrlenA (lpString="*.wma") returned 5
	[0050.825] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.au3") returned 0
	[0050.825] lstrlenA (lpString="*.au3") returned 5
	[0050.825] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.ahk") returned 0
	[0050.825] lstrlenA (lpString="*.ahk") returned 5
	[0050.826] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.c") returned 0
	[0050.826] lstrlenA (lpString="*.c") returned 3
	[0050.826] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.cc") returned 0
	[0050.826] lstrlenA (lpString="*.cc") returned 4
	[0050.826] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.cpp") returned 0
	[0050.826] lstrlenA (lpString="*.cpp") returned 5
	[0050.826] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.cxx") returned 0
	[0050.826] lstrlenA (lpString="*.cxx") returned 5
	[0050.826] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.c++") returned 0
	[0050.826] lstrlenA (lpString="*.c++") returned 5
	[0050.826] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.cs") returned 0
	[0050.826] lstrlenA (lpString="*.cs") returned 4
	[0050.826] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.vb") returned 0
	[0050.826] lstrlenA (lpString="*.vb") returned 4
	[0050.826] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.bas") returned 0
	[0050.826] lstrlenA (lpString="*.bas") returned 5
	[0050.826] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.csproj") returned 0
	[0050.826] lstrlenA (lpString="*.csproj") returned 8
	[0050.826] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.vbproj") returned 0
	[0050.826] lstrlenA (lpString="*.vbproj") returned 8
	[0050.826] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.vcxproj") returned 0
	[0050.826] lstrlenA (lpString="*.vcxproj") returned 9
	[0050.826] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.manifest") returned 0
	[0050.826] lstrlenA (lpString="*.manifest") returned 10
	[0050.826] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.php") returned 0
	[0050.826] lstrlenA (lpString="*.php") returned 5
	[0050.826] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.vbe") returned 0
	[0050.826] lstrlenA (lpString="*.vbe") returned 5
	[0050.826] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.vba") returned 0
	[0050.826] lstrlenA (lpString="*.vba") returned 5
	[0050.826] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.vbs") returned 0
	[0050.826] lstrlenA (lpString="*.vbs") returned 5
	[0050.826] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.bat") returned 0
	[0050.826] lstrlenA (lpString="*.bat") returned 5
	[0050.826] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.cmd") returned 0
	[0050.826] lstrlenA (lpString="*.cmd") returned 5
	[0050.827] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.js") returned 0
	[0050.827] lstrlenA (lpString="*.js") returned 4
	[0050.827] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.jscript") returned 0
	[0050.827] lstrlenA (lpString="*.jscript") returned 9
	[0050.827] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.hta") returned 0
	[0050.827] lstrlenA (lpString="*.hta") returned 5
	[0050.827] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.php7") returned 0
	[0050.827] lstrlenA (lpString="*.php7") returned 6
	[0050.827] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.db") returned 0
	[0050.827] lstrlenA (lpString="*.db") returned 4
	[0050.827] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.swf") returned 0
	[0050.827] lstrlenA (lpString="*.swf") returned 5
	[0050.827] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.eml") returned 0
	[0050.827] lstrlenA (lpString="*.eml") returned 5
	[0050.827] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.part") returned 0
	[0050.827] lstrlenA (lpString="*.part") returned 6
	[0050.827] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.nfo") returned 0
	[0050.827] lstrlenA (lpString="*.nfo") returned 5
	[0050.827] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.rsa") returned 0
	[0050.827] lstrlenA (lpString="*.rsa") returned 5
	[0050.827] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.key") returned 0
	[0050.827] lstrlenA (lpString="*.key") returned 5
	[0050.827] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.aes") returned 0
	[0050.827] lstrlenA (lpString="*.aes") returned 5
	[0050.827] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.blob") returned 0
	[0050.827] lstrlenA (lpString="*.blob") returned 6
	[0050.827] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.btc") returned 0
	[0050.827] lstrlenA (lpString="*.btc") returned 5
	[0050.827] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.wallet") returned 0
	[0050.827] lstrlenA (lpString="*.wallet") returned 8
	[0050.827] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5057bed8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5057bed8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Key Management Service.evtx", cAlternateFileName="KEYMAN~1.EVT")) returned 1
	[0050.827] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.827] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Key Management Service.evtx") returned -1
	[0050.827] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Key Management Service.evtx") returned -1
	[0050.827] lstrcmpiA (lpString1="", lpString2="Key Management Service.evtx") returned -1
	[0050.827] PathFindFileNameA (pszPath="C:\\Logs\\Internet Explorer.evtx") returned="Internet Explorer.evtx"
	[0050.827] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.828] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.828] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.828] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.828] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Key Management Service.evtx" | out: lpString1="C:\\Logs\\Key Management Service.evtx") returned="C:\\Logs\\Key Management Service.evtx"
	[0050.828] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.zip") returned 0
	[0050.828] lstrlenA (lpString="*.zip") returned 5
	[0050.828] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.rar") returned 0
	[0050.828] lstrlenA (lpString="*.rar") returned 5
	[0050.828] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.7z") returned 0
	[0050.828] lstrlenA (lpString="*.7z") returned 4
	[0050.828] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.tar") returned 0
	[0050.828] lstrlenA (lpString="*.tar") returned 5
	[0050.828] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.gzip") returned 0
	[0050.828] lstrlenA (lpString="*.gzip") returned 6
	[0050.828] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.jpg") returned 0
	[0050.828] lstrlenA (lpString="*.jpg") returned 5
	[0050.828] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.jpeg") returned 0
	[0050.828] lstrlenA (lpString="*.jpeg") returned 6
	[0050.828] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.bmp") returned 0
	[0050.828] lstrlenA (lpString="*.bmp") returned 5
	[0050.828] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.gif") returned 0
	[0050.828] lstrlenA (lpString="*.gif") returned 5
	[0050.828] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.png") returned 0
	[0050.828] lstrlenA (lpString="*.png") returned 5
	[0050.828] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.doc") returned 0
	[0050.828] lstrlenA (lpString="*.doc") returned 5
	[0050.828] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.docx") returned 0
	[0050.828] lstrlenA (lpString="*.docx") returned 6
	[0050.828] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.xls") returned 0
	[0050.828] lstrlenA (lpString="*.xls") returned 5
	[0050.828] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.xlsx") returned 0
	[0050.828] lstrlenA (lpString="*.xlsx") returned 6
	[0050.828] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.ppt") returned 0
	[0050.829] lstrlenA (lpString="*.ppt") returned 5
	[0050.829] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.pptx") returned 0
	[0050.829] lstrlenA (lpString="*.pptx") returned 6
	[0050.829] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.txt") returned 0
	[0050.829] lstrlenA (lpString="*.txt") returned 5
	[0050.829] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.pdf") returned 0
	[0050.829] lstrlenA (lpString="*.pdf") returned 5
	[0050.829] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.htm") returned 0
	[0050.829] lstrlenA (lpString="*.htm") returned 5
	[0050.829] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.html") returned 0
	[0050.829] lstrlenA (lpString="*.html") returned 6
	[0050.829] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.mdb") returned 0
	[0050.829] lstrlenA (lpString="*.mdb") returned 5
	[0050.829] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.pfx") returned 0
	[0050.829] lstrlenA (lpString="*.pfx") returned 5
	[0050.829] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.md") returned 0
	[0050.829] lstrlenA (lpString="*.md") returned 4
	[0050.829] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.lnk") returned 0
	[0050.829] lstrlenA (lpString="*.lnk") returned 5
	[0050.829] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.torrent") returned 0
	[0050.829] lstrlenA (lpString="*.torrent") returned 9
	[0050.829] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.mov") returned 0
	[0050.829] lstrlenA (lpString="*.mov") returned 5
	[0050.829] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.3gp") returned 0
	[0050.829] lstrlenA (lpString="*.3gp") returned 5
	[0050.829] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.mpeg") returned 0
	[0050.829] lstrlenA (lpString="*.mpeg") returned 6
	[0050.829] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.mpg") returned 0
	[0050.829] lstrlenA (lpString="*.mpg") returned 5
	[0050.829] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.flv") returned 0
	[0050.829] lstrlenA (lpString="*.flv") returned 5
	[0050.829] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.avi") returned 0
	[0050.830] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1dbd7c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1dbd7c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Client-Licensing-Platform%4Admin.evtx", cAlternateFileName="MICROS~1.EVT")) returned 1
	[0050.830] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.830] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Client-Licensing-Platform%4Admin.evtx") returned -1
	[0050.830] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Client-Licensing-Platform%4Admin.evtx") returned -1
	[0050.830] lstrcmpiA (lpString1="", lpString2="Microsoft-Client-Licensing-Platform%4Admin.evtx") returned -1
	[0050.830] PathFindFileNameA (pszPath="C:\\Logs\\Key Management Service.evtx") returned="Key Management Service.evtx"
	[0050.830] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.830] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.830] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.830] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.830] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Client-Licensing-Platform%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx"
	[0050.830] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5d836e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5d836e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", cAlternateFileName="MICROS~2.EVT")) returned 1
	[0050.830] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.830] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned -1
	[0050.830] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned -1
	[0050.830] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned -1
	[0050.830] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned="Microsoft-Client-Licensing-Platform%4Admin.evtx"
	[0050.830] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.830] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.830] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.830] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.830] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx"
	[0050.831] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9206ac5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9206ac5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9c0f529, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", cAlternateFileName="MICROS~3.EVT")) returned 1
	[0050.831] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.831] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned -1
	[0050.831] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned -1
	[0050.831] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned -1
	[0050.831] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx"
	[0050.831] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.831] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.831] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.831] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.831] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx"
	[0050.831] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", cAlternateFileName="MICROS~4.EVT")) returned 1
	[0050.831] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.831] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned -1
	[0050.831] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned -1
	[0050.831] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned -1
	[0050.831] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx"
	[0050.831] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.831] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.831] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.831] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.831] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-AppLocker%4EXE and DLL.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx"
	[0050.831] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4169a7a, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4169a7a, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4MSI and Script.evtx", cAlternateFileName="MI2EEA~1.EVT")) returned 1
	[0050.831] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.831] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned -1
	[0050.831] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned -1
	[0050.831] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned -1
	[0050.832] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned="Microsoft-Windows-AppLocker%4EXE and DLL.evtx"
	[0050.832] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.832] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.832] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.832] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.832] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-AppLocker%4MSI and Script.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx"
	[0050.832] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", cAlternateFileName="MI07E1~1.EVT")) returned 1
	[0050.832] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.832] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned -1
	[0050.832] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned -1
	[0050.832] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned -1
	[0050.832] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned="Microsoft-Windows-AppLocker%4MSI and Script.evtx"
	[0050.832] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.832] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.832] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.832] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.832] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx"
	[0050.832] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", cAlternateFileName="MI8196~1.EVT")) returned 1
	[0050.832] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.832] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned -1
	[0050.832] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned -1
	[0050.832] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned -1
	[0050.832] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx"
	[0050.832] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.832] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.832] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.832] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.833] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx"
	[0050.833] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41b5f2d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd41b5f2d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", cAlternateFileName="MIE36C~1.EVT")) returned 1
	[0050.833] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.833] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned -1
	[0050.833] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned -1
	[0050.833] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned -1
	[0050.833] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx"
	[0050.833] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.833] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.833] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.833] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.833] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-AppModel-Runtime%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx"
	[0050.833] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd389efbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd389efbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppReadiness%4Admin.evtx", cAlternateFileName="MIC5CB~1.EVT")) returned 1
	[0050.833] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.833] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-AppReadiness%4Admin.evtx") returned -1
	[0050.833] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-AppReadiness%4Admin.evtx") returned -1
	[0050.833] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-AppReadiness%4Admin.evtx") returned -1
	[0050.833] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned="Microsoft-Windows-AppModel-Runtime%4Admin.evtx"
	[0050.833] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.833] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.833] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.834] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.834] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-AppReadiness%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx"
	[0050.834] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd38c5212, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd38c5212, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppReadiness%4Operational.evtx", cAlternateFileName="MIF8AA~1.EVT")) returned 1
	[0050.834] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.834] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-AppReadiness%4Operational.evtx") returned -1
	[0050.834] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-AppReadiness%4Operational.evtx") returned -1
	[0050.834] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-AppReadiness%4Operational.evtx") returned -1
	[0050.834] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned="Microsoft-Windows-AppReadiness%4Admin.evtx"
	[0050.834] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.834] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.834] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.834] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.834] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-AppReadiness%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx"
	[0050.834] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppXDeployment%4Operational.evtx", cAlternateFileName="MI34FE~1.EVT")) returned 1
	[0050.834] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.834] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-AppXDeployment%4Operational.evtx") returned -1
	[0050.834] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-AppXDeployment%4Operational.evtx") returned -1
	[0050.834] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-AppXDeployment%4Operational.evtx") returned -1
	[0050.834] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned="Microsoft-Windows-AppReadiness%4Operational.evtx"
	[0050.834] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.834] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.834] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.834] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.834] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-AppXDeployment%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx"
	[0050.835] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x211000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", cAlternateFileName="MIA24C~1.EVT")) returned 1
	[0050.835] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.835] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned -1
	[0050.835] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned -1
	[0050.835] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned -1
	[0050.835] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned="Microsoft-Windows-AppXDeployment%4Operational.evtx"
	[0050.835] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.835] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.835] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.835] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.835] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx"
	[0050.835] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", cAlternateFileName="MIDBEC~1.EVT")) returned 1
	[0050.835] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.835] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned -1
	[0050.835] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned -1
	[0050.835] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned -1
	[0050.835] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx"
	[0050.835] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.835] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.835] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.835] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.835] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx"
	[0050.835] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85798667, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x85798667, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppxPackaging%4Operational.evtx", cAlternateFileName="MI54F1~1.EVT")) returned 1
	[0050.835] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.835] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-AppxPackaging%4Operational.evtx") returned -1
	[0050.835] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-AppxPackaging%4Operational.evtx") returned -1
	[0050.835] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-AppxPackaging%4Operational.evtx") returned -1
	[0050.835] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx"
	[0050.836] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.836] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.836] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.836] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.836] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-AppxPackaging%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx"
	[0050.836] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74d25ab, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74d25ab, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", cAlternateFileName="MI111F~1.EVT")) returned 1
	[0050.836] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.836] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned -1
	[0050.836] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned -1
	[0050.836] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned -1
	[0050.836] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned="Microsoft-Windows-AppxPackaging%4Operational.evtx"
	[0050.836] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.836] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.836] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.836] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.836] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx"
	[0050.836] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f96ca4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe1f96ca4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Bits-Client%4Operational.evtx", cAlternateFileName="MI9465~1.EVT")) returned 1
	[0050.836] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.836] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-Bits-Client%4Operational.evtx") returned -1
	[0050.836] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-Bits-Client%4Operational.evtx") returned -1
	[0050.836] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Bits-Client%4Operational.evtx") returned -1
	[0050.836] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx"
	[0050.836] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.836] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.836] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.836] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.837] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Bits-Client%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx"
	[0050.837] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8783aa15, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8783aa15, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-CodeIntegrity%4Operational.evtx", cAlternateFileName="MI03A7~1.EVT")) returned 1
	[0050.837] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.837] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned -1
	[0050.837] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned -1
	[0050.837] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned -1
	[0050.837] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned="Microsoft-Windows-Bits-Client%4Operational.evtx"
	[0050.837] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.837] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.837] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.837] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.837] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-CodeIntegrity%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx"
	[0050.837] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3c71c5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3c71c5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", cAlternateFileName="MI5CA2~1.EVT")) returned 1
	[0050.837] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.837] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned -1
	[0050.837] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned -1
	[0050.837] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned -1
	[0050.837] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned="Microsoft-Windows-CodeIntegrity%4Operational.evtx"
	[0050.837] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.838] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.838] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.838] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.838] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx"
	[0050.838] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", cAlternateFileName="MI5FD1~1.EVT")) returned 1
	[0050.838] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.838] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned -1
	[0050.838] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned -1
	[0050.838] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned -1
	[0050.838] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx"
	[0050.838] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.838] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.838] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.838] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.838] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx"
	[0050.838] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", cAlternateFileName="MI8BDF~1.EVT")) returned 1
	[0050.838] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.838] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned -1
	[0050.838] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned -1
	[0050.838] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned -1
	[0050.838] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx"
	[0050.838] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.838] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.838] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.838] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.838] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx"
	[0050.839] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3ed420, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3ed420, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", cAlternateFileName="MIAEBD~1.EVT")) returned 1
	[0050.839] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.839] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned -1
	[0050.839] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned -1
	[0050.839] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned -1
	[0050.839] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx"
	[0050.839] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.839] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.839] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.839] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.839] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx"
	[0050.839] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cef47f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cef47f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", cAlternateFileName="MIA726~1.EVT")) returned 1
	[0050.839] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.839] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned -1
	[0050.839] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned -1
	[0050.839] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned -1
	[0050.839] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx"
	[0050.839] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.839] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.839] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.839] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.839] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-DeviceSetupManager%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx"
	[0050.839] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", cAlternateFileName="MI08CB~1.EVT")) returned 1
	[0050.839] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.839] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned -1
	[0050.839] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned -1
	[0050.840] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned -1
	[0050.840] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned="Microsoft-Windows-DeviceSetupManager%4Admin.evtx"
	[0050.840] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.840] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.840] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.840] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.840] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-DeviceSetupManager%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx"
	[0050.840] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc967f17e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc967f17e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Dhcp-Client%4Admin.evtx", cAlternateFileName="MI8270~1.EVT")) returned 1
	[0050.840] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.840] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned -1
	[0050.840] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned -1
	[0050.840] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned -1
	[0050.840] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned="Microsoft-Windows-DeviceSetupManager%4Operational.evtx"
	[0050.840] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.840] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.840] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.840] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.840] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Dhcp-Client%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx"
	[0050.840] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc96cb64b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc96cb64b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", cAlternateFileName="MIEBFF~1.EVT")) returned 1
	[0050.840] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.840] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned -1
	[0050.840] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned -1
	[0050.840] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned -1
	[0050.840] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned="Microsoft-Windows-Dhcp-Client%4Admin.evtx"
	[0050.840] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.840] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.840] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.840] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.841] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx"
	[0050.841] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64aa7b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca64aa7b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", cAlternateFileName="MI9F85~1.EVT")) returned 1
	[0050.841] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.841] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned -1
	[0050.841] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned -1
	[0050.841] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned -1
	[0050.841] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx"
	[0050.841] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.841] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.841] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.841] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.841] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx"
	[0050.841] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd9ec80, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xfd9ec80, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", cAlternateFileName="MIBE3D~1.EVT")) returned 1
	[0050.841] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.841] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned -1
	[0050.841] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned -1
	[0050.841] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned -1
	[0050.841] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx"
	[0050.841] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.841] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.841] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.841] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.841] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx"
	[0050.841] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9658ef3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9658ef3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-GroupPolicy%4Operational.evtx", cAlternateFileName="MIE38D~1.EVT")) returned 1
	[0050.841] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.842] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-GroupPolicy%4Operational.evtx") returned -1
	[0050.842] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-GroupPolicy%4Operational.evtx") returned -1
	[0050.842] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-GroupPolicy%4Operational.evtx") returned -1
	[0050.842] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx"
	[0050.842] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.842] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.842] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.842] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.842] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-GroupPolicy%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx"
	[0050.842] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9dcc480, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9dcc480, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-HotspotAuth%4Operational.evtx", cAlternateFileName="MIE386~1.EVT")) returned 1
	[0050.842] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.842] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-HotspotAuth%4Operational.evtx") returned -1
	[0050.842] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-HotspotAuth%4Operational.evtx") returned -1
	[0050.842] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-HotspotAuth%4Operational.evtx") returned -1
	[0050.842] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned="Microsoft-Windows-GroupPolicy%4Operational.evtx"
	[0050.842] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.842] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.842] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.842] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.842] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-HotspotAuth%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx"
	[0050.842] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b4bacf, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b4bacf, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", cAlternateFileName="MI6B25~1.EVT")) returned 1
	[0050.842] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.842] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned -1
	[0050.842] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned -1
	[0050.842] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned -1
	[0050.842] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned="Microsoft-Windows-HotspotAuth%4Operational.evtx"
	[0050.842] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.842] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.842] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.843] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.843] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx"
	[0050.843] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb66288f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-International%4Operational.evtx", cAlternateFileName="MI854A~1.EVT")) returned 1
	[0050.843] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.843] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-International%4Operational.evtx") returned -1
	[0050.843] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-International%4Operational.evtx") returned -1
	[0050.843] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-International%4Operational.evtx") returned -1
	[0050.843] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx"
	[0050.843] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.843] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.843] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.843] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.843] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-International%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx"
	[0050.843] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x506ad1ac, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x506ad1ac, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-Boot%4Operational.evtx", cAlternateFileName="MI32CE~1.EVT")) returned 1
	[0050.843] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.843] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned -1
	[0050.843] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned -1
	[0050.843] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned -1
	[0050.843] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned="Microsoft-Windows-International%4Operational.evtx"
	[0050.843] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.843] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.843] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.843] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.843] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Kernel-Boot%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx"
	[0050.844] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", cAlternateFileName="MIA934~1.EVT")) returned 1
	[0050.844] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.844] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned -1
	[0050.844] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned -1
	[0050.844] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned -1
	[0050.844] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned="Microsoft-Windows-Kernel-Boot%4Operational.evtx"
	[0050.844] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.844] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.844] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.844] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.844] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx"
	[0050.844] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5071f8b0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5071f8b0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", cAlternateFileName="MIB32D~1.EVT")) returned 1
	[0050.844] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.844] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned -1
	[0050.844] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned -1
	[0050.844] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned -1
	[0050.844] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx"
	[0050.844] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.844] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.844] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.844] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.844] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Kernel-PnP%4Configuration.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx"
	[0050.844] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8ebf6d7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc8ebf6d7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", cAlternateFileName="MICA77~1.EVT")) returned 1
	[0050.844] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.844] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned -1
	[0050.844] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned -1
	[0050.844] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned -1
	[0050.844] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned="Microsoft-Windows-Kernel-PnP%4Configuration.evtx"
	[0050.844] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.844] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.845] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.845] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.845] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx"
	[0050.845] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5090f75d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5090f75d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", cAlternateFileName="MI1E8D~1.EVT")) returned 1
	[0050.845] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.845] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned -1
	[0050.845] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned -1
	[0050.845] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned -1
	[0050.845] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx"
	[0050.845] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.845] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.845] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.845] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.845] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx"
	[0050.845] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd75102f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd75102f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", cAlternateFileName="MID067~1.EVT")) returned 1
	[0050.845] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.845] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned -1
	[0050.846] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned -1
	[0050.846] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned -1
	[0050.846] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx"
	[0050.846] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.846] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.846] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.846] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.846] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx"
	[0050.846] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", cAlternateFileName="MIDE4D~1.EVT")) returned 1
	[0050.846] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.846] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned -1
	[0050.846] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned -1
	[0050.846] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned -1
	[0050.846] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx"
	[0050.846] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.846] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.846] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.846] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.846] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Kernel-WHEA%4Errors.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx"
	[0050.846] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", cAlternateFileName="MI36C5~1.EVT")) returned 1
	[0050.846] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.846] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned -1
	[0050.846] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned -1
	[0050.846] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned -1
	[0050.846] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned="Microsoft-Windows-Kernel-WHEA%4Errors.evtx"
	[0050.846] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.846] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.847] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.847] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.847] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Kernel-WHEA%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx"
	[0050.847] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59547c37, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x59547c37, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Known Folders API Service.evtx", cAlternateFileName="MI86D6~1.EVT")) returned 1
	[0050.847] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.847] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-Known Folders API Service.evtx") returned -1
	[0050.847] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-Known Folders API Service.evtx") returned -1
	[0050.847] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Known Folders API Service.evtx") returned -1
	[0050.847] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned="Microsoft-Windows-Kernel-WHEA%4Operational.evtx"
	[0050.847] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.847] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.847] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.847] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.847] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Known Folders API Service.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx"
	[0050.847] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb7386e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbb7386e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-LiveId%4Operational.evtx", cAlternateFileName="MI4C58~1.EVT")) returned 1
	[0050.847] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.847] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-LiveId%4Operational.evtx") returned -1
	[0050.847] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-LiveId%4Operational.evtx") returned -1
	[0050.847] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-LiveId%4Operational.evtx") returned -1
	[0050.847] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned="Microsoft-Windows-Known Folders API Service.evtx"
	[0050.847] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.847] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.847] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.847] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.847] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-LiveId%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx"
	[0050.848] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93d06f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93d06f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-MUI%4Admin.evtx", cAlternateFileName="MI30D3~1.EVT")) returned 1
	[0050.848] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.848] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-MUI%4Admin.evtx") returned -1
	[0050.848] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-MUI%4Admin.evtx") returned -1
	[0050.848] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-MUI%4Admin.evtx") returned -1
	[0050.848] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned="Microsoft-Windows-LiveId%4Operational.evtx"
	[0050.848] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.848] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.848] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.848] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.848] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-MUI%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx"
	[0050.848] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93aa49b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93aa49b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-MUI%4Operational.evtx", cAlternateFileName="MI6F01~1.EVT")) returned 1
	[0050.848] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.848] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-MUI%4Operational.evtx") returned -1
	[0050.848] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-MUI%4Operational.evtx") returned -1
	[0050.848] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-MUI%4Operational.evtx") returned -1
	[0050.848] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned="Microsoft-Windows-MUI%4Admin.evtx"
	[0050.848] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.848] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.848] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.848] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.848] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-MUI%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx"
	[0050.848] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d33b19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9d33b19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-NCSI%4Operational.evtx", cAlternateFileName="MI483C~1.EVT")) returned 1
	[0050.848] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.848] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-NCSI%4Operational.evtx") returned -1
	[0050.848] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-NCSI%4Operational.evtx") returned -1
	[0050.848] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-NCSI%4Operational.evtx") returned -1
	[0050.849] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned="Microsoft-Windows-MUI%4Operational.evtx"
	[0050.849] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.849] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.849] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM"
	[0050.849] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.849] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbcf0ff2, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbcf0ff2, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-NetworkProfile%4Operational.evtx", cAlternateFileName="MIFC66~1.EVT")) returned 1
	[0050.849] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.849] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-NetworkProfile%4Operational.evtx") returned -1
	[0050.849] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-NetworkProfile%4Operational.evtx") returned -1
	[0050.849] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-NetworkProfile%4Operational.evtx") returned -1
	[0050.849] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned="Microsoft-Windows-NCSI%4Operational.evtx"
	[0050.849] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.849] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.849] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.849] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ab3154, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ab3154, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Ntfs%4Operational.evtx", cAlternateFileName="MI6E98~1.EVT")) returned 1
	[0050.849] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.850] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-Ntfs%4Operational.evtx") returned -1
	[0050.850] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-Ntfs%4Operational.evtx") returned -1
	[0050.850] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Ntfs%4Operational.evtx") returned -1
	[0050.850] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned="Microsoft-Windows-NetworkProfile%4Operational.evtx"
	[0050.850] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.850] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.850] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.850] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ad9393, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ad9393, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Ntfs%4WHC.evtx", cAlternateFileName="MIB2AC~1.EVT")) returned 1
	[0050.850] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.850] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-Ntfs%4WHC.evtx") returned -1
	[0050.850] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-Ntfs%4WHC.evtx") returned -1
	[0050.850] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Ntfs%4WHC.evtx") returned -1
	[0050.850] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned="Microsoft-Windows-Ntfs%4Operational.evtx"
	[0050.850] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.850] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.850] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.850] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5fe5cb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5fe5cb, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", cAlternateFileName="MI6AFE~1.EVT")) returned 1
	[0050.850] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.850] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned -1
	[0050.850] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned -1
	[0050.850] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned -1
	[0050.850] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned="Microsoft-Windows-Ntfs%4WHC.evtx"
	[0050.850] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.850] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.850] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.851] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24cdef0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe24cdef0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-ReadyBoost%4Operational.evtx", cAlternateFileName="MIB9D2~1.EVT")) returned 1
	[0050.851] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.851] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-ReadyBoost%4Operational.evtx") returned -1
	[0050.851] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-ReadyBoost%4Operational.evtx") returned -1
	[0050.851] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-ReadyBoost%4Operational.evtx") returned -1
	[0050.851] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx"
	[0050.851] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.851] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.851] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.851] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd125335f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd125335f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", cAlternateFileName="MI7A67~1.EVT")) returned 1
	[0050.851] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.851] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned -1
	[0050.851] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned -1
	[0050.851] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned -1
	[0050.851] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned="Microsoft-Windows-ReadyBoost%4Operational.evtx"
	[0050.851] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.851] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.851] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.851] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SettingSync%4Debug.evtx", cAlternateFileName="MI3773~1.EVT")) returned 1
	[0050.851] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.851] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-SettingSync%4Debug.evtx") returned -1
	[0050.851] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-SettingSync%4Debug.evtx") returned -1
	[0050.851] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-SettingSync%4Debug.evtx") returned -1
	[0050.851] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx"
	[0050.851] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.851] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.852] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.852] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SettingSync%4Operational.evtx", cAlternateFileName="MI36AA~1.EVT")) returned 1
	[0050.852] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.852] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-SettingSync%4Operational.evtx") returned -1
	[0050.852] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-SettingSync%4Operational.evtx") returned -1
	[0050.852] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-SettingSync%4Operational.evtx") returned -1
	[0050.852] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned="Microsoft-Windows-SettingSync%4Debug.evtx"
	[0050.852] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.852] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.852] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.852] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", cAlternateFileName="MI2E2E~1.EVT")) returned 1
	[0050.852] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.852] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned -1
	[0050.852] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned -1
	[0050.852] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned -1
	[0050.852] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned="Microsoft-Windows-SettingSync%4Operational.evtx"
	[0050.852] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.852] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.852] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.852] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Shell-Core%4Operational.evtx", cAlternateFileName="MI1C6C~1.EVT")) returned 1
	[0050.852] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.852] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-Shell-Core%4Operational.evtx") returned -1
	[0050.852] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-Shell-Core%4Operational.evtx") returned -1
	[0050.852] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Shell-Core%4Operational.evtx") returned -1
	[0050.852] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned="Microsoft-Windows-Shell-Core%4ActionCenter.evtx"
	[0050.852] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.853] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.853] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.853] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SmbClient%4Connectivity.evtx", cAlternateFileName="MI00FB~1.EVT")) returned 1
	[0050.853] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.853] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-SmbClient%4Connectivity.evtx") returned -1
	[0050.853] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-SmbClient%4Connectivity.evtx") returned -1
	[0050.853] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-SmbClient%4Connectivity.evtx") returned -1
	[0050.853] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned="Microsoft-Windows-Shell-Core%4Operational.evtx"
	[0050.853] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.853] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.853] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.853] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97b042f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97b042f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBClient%4Operational.evtx", cAlternateFileName="MID8B0~1.EVT")) returned 1
	[0050.853] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.853] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-SMBClient%4Operational.evtx") returned -1
	[0050.853] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-SMBClient%4Operational.evtx") returned -1
	[0050.853] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-SMBClient%4Operational.evtx") returned -1
	[0050.853] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned="Microsoft-Windows-SmbClient%4Connectivity.evtx"
	[0050.853] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.853] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.853] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.853] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SmbClient%4Security.evtx", cAlternateFileName="MI8CEE~1.EVT")) returned 1
	[0050.853] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.853] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-SmbClient%4Security.evtx") returned -1
	[0050.854] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-SmbClient%4Security.evtx") returned -1
	[0050.854] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-SmbClient%4Security.evtx") returned -1
	[0050.854] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned="Microsoft-Windows-SMBClient%4Operational.evtx"
	[0050.854] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.854] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.854] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.854] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb1ea1c9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb1ea1c9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Audit.evtx", cAlternateFileName="MIE3AD~1.EVT")) returned 1
	[0050.854] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.854] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-SMBServer%4Audit.evtx") returned -1
	[0050.854] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-SMBServer%4Audit.evtx") returned -1
	[0050.854] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-SMBServer%4Audit.evtx") returned -1
	[0050.854] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned="Microsoft-Windows-SmbClient%4Security.evtx"
	[0050.854] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.854] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.854] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.854] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb19dd19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb19dd19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Connectivity.evtx", cAlternateFileName="MI8248~1.EVT")) returned 1
	[0050.855] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.855] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-SMBServer%4Connectivity.evtx") returned -1
	[0050.855] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-SMBServer%4Connectivity.evtx") returned -1
	[0050.855] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-SMBServer%4Connectivity.evtx") returned -1
	[0050.855] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned="Microsoft-Windows-SMBServer%4Audit.evtx"
	[0050.855] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.855] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.855] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.855] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb151873, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb151873, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Operational.evtx", cAlternateFileName="MI4B6B~1.EVT")) returned 1
	[0050.855] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.855] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-SMBServer%4Operational.evtx") returned -1
	[0050.855] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-SMBServer%4Operational.evtx") returned -1
	[0050.855] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-SMBServer%4Operational.evtx") returned -1
	[0050.855] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned="Microsoft-Windows-SMBServer%4Connectivity.evtx"
	[0050.855] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.855] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.855] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.855] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb177aca, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb177aca, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Security.evtx", cAlternateFileName="MI7709~1.EVT")) returned 1
	[0050.855] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.855] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-SMBServer%4Security.evtx") returned -1
	[0050.855] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-SMBServer%4Security.evtx") returned -1
	[0050.855] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-SMBServer%4Security.evtx") returned -1
	[0050.855] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned="Microsoft-Windows-SMBServer%4Operational.evtx"
	[0050.855] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.855] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.855] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.856] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd751ea61, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd751ea61, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Store%4Operational.evtx", cAlternateFileName="MICEDD~1.EVT")) returned 1
	[0050.856] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.856] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-Store%4Operational.evtx") returned -1
	[0050.856] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-Store%4Operational.evtx") returned -1
	[0050.856] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Store%4Operational.evtx") returned -1
	[0050.856] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned="Microsoft-Windows-SMBServer%4Security.evtx"
	[0050.856] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.856] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.856] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.856] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd0763ff, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd0763ff, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", cAlternateFileName="MIE2F0~1.EVT")) returned 1
	[0050.856] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.856] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned -1
	[0050.856] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned -1
	[0050.856] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned -1
	[0050.856] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned="Microsoft-Windows-Store%4Operational.evtx"
	[0050.856] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.856] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.856] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.856] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5089d037, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5089d037, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", cAlternateFileName="MIAB1D~1.EVT")) returned 1
	[0050.856] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.856] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned="Microsoft-Windows-TaskScheduler%4Maintenance.evtx"
	[0050.856] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.856] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.856] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.857] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x508c32a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x508c32a6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", cAlternateFileName="MI62D3~1.EVT")) returned 1
	[0050.857] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.857] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx"
	[0050.857] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.857] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.857] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.857] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc14341c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc14341c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", cAlternateFileName="MIEC03~1.EVT")) returned 1
	[0050.857] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.857] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx"
	[0050.857] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.857] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.857] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.857] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1b5b23, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1b5b23, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", cAlternateFileName="MI1F5D~1.EVT")) returned 1
	[0050.857] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.857] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx"
	[0050.857] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.857] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.857] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.857] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74ac348, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74ac348, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TWinUI%4Operational.evtx", cAlternateFileName="MIA925~1.EVT")) returned 1
	[0050.858] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.871] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx"
	[0050.871] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.871] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.871] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.872] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50aff605, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50aff605, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-User Profile Service%4Operational.evtx", cAlternateFileName="MI4D4C~1.EVT")) returned 1
	[0050.872] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.872] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned="Microsoft-Windows-TWinUI%4Operational.evtx"
	[0050.872] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.872] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.872] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.872] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50981e6e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50981e6e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-UserPnp%4ActionCenter.evtx", cAlternateFileName="MI5FF0~1.EVT")) returned 1
	[0050.872] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.872] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned="Microsoft-Windows-User Profile Service%4Operational.evtx"
	[0050.872] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.872] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.872] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.872] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5095bc04, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5095bc04, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", cAlternateFileName="MIBD88~1.EVT")) returned 1
	[0050.872] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.872] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned="Microsoft-Windows-UserPnp%4ActionCenter.evtx"
	[0050.872] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.872] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.872] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.872] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b97f64, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b97f64, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", cAlternateFileName="MICC17~1.EVT")) returned 1
	[0050.872] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.872] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned="Microsoft-Windows-UserPnp%4DeviceInstall.evtx"
	[0050.872] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.873] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.873] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.873] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc986efe1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc986efe1, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Wcmsvc%4Operational.evtx", cAlternateFileName="MI72BF~1.EVT")) returned 1
	[0050.873] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.873] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx"
	[0050.873] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.873] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.873] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.873] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb426548, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb426548, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Defender%4Operational.evtx", cAlternateFileName="MI7501~1.EVT")) returned 1
	[0050.873] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.873] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned="Microsoft-Windows-Wcmsvc%4Operational.evtx"
	[0050.873] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.873] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.873] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.873] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4729e7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb4729e7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Defender%4WHC.evtx", cAlternateFileName="MIF226~1.EVT")) returned 1
	[0050.873] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.873] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned="Microsoft-Windows-Windows Defender%4Operational.evtx"
	[0050.873] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.873] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.873] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.874] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4b19353, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4b19353, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", cAlternateFileName="MIDCC7~1.EVT")) returned 1
	[0050.874] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.874] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned="Microsoft-Windows-Windows Defender%4WHC.evtx"
	[0050.874] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.874] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.874] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.874] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9c9b1b6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9c9b1b6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", cAlternateFileName="MI7771~1.EVT")) returned 1
	[0050.874] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.874] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx"
	[0050.874] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.874] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.874] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.874] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9df26e9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9df26e9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", cAlternateFileName="MI4667~1.EVT")) returned 1
	[0050.874] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.874] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx"
	[0050.874] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.874] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.874] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.875] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd122d184, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd122d184, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Winlogon%4Operational.evtx", cAlternateFileName="MID6AB~1.EVT")) returned 1
	[0050.875] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.875] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx"
	[0050.875] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.875] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.875] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.875] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf164b9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcf164b9b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-WMI-Activity%4Operational.evtx", cAlternateFileName="MIFF83~1.EVT")) returned 1
	[0050.875] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.875] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned="Microsoft-Windows-Winlogon%4Operational.evtx"
	[0050.875] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.875] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.875] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.875] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9a458f4, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security.evtx", cAlternateFileName="SECURI~1.EVT")) returned 1
	[0050.875] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.875] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned="Microsoft-Windows-WMI-Activity%4Operational.evtx"
	[0050.875] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.875] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.875] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.875] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a6db2c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x95a6db2c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.evtx", cAlternateFileName="SETUP~1.EVT")) returned 1
	[0050.875] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.876] PathFindFileNameA (pszPath="C:\\Logs\\Security.evtx") returned="Security.evtx"
	[0050.876] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.876] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.876] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.876] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505097c4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505097c4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.evtx", cAlternateFileName="SYSTEM~1.EVT")) returned 1
	[0050.876] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.876] PathFindFileNameA (pszPath="C:\\Logs\\Setup.evtx") returned="Setup.evtx"
	[0050.876] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.876] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.876] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.876] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 1
	[0050.876] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0
	[0050.876] PathFindFileNameA (pszPath="C:\\Logs\\System.evtx") returned="System.evtx"
	[0050.876] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0050.876] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned=""
	[0050.876] GetFileAttributesA (lpFileName="C:\\Logs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\logs\\how-to-decrypt-files.htm")) returned 0x20
	[0050.876] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 0
	[0050.876] FindClose (in: hFindFile=0x7cb790 | out: hFindFile=0x7cb790) returned 1
	[0050.876] FindNextFileA (in: hFindFile=0x7cba90, lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x47384f2, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0x7d1538, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1
	[0050.876] PeekMessageA (in: lpMsg=0x19fe0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fe0c) returned 0
	[0050.877] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*"
	[0050.877] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\"
	[0050.877] PathAddBackslashA (in: pszPath="C:\\" | out: pszPath="C:\\") returned=""
	[0050.877] GetFileAttributesA (lpFileName="C:\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\how-to-decrypt-files.htm")) returned 0x20
	[0050.877] FindNextFileA (in: hFindFile=0x7cba90, lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1
	[0050.877] lstrcmpA (lpString1=".", lpString2="PerfLogs") returned -1
	[0050.877] lstrcmpA (lpString1="..", lpString2="PerfLogs") returned -1
	[0050.877] PathFindFileNameA (pszPath="C:\\pagefile.sys") returned="pagefile.sys"
	[0050.877] FindFirstFileA (in: lpFileName="C:\\PerfLogs\\*.*", lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x48, cFileName=".", cAlternateFileName="")) returned 0x7cb590
	[0050.878] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.878] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x48, cFileName="..", cAlternateFileName="")) returned 1
	[0050.878] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.878] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.878] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x48, cFileName="..", cAlternateFileName="")) returned 0
	[0050.878] FindClose (in: hFindFile=0x7cb590 | out: hFindFile=0x7cb590) returned 1
	[0050.878] FindNextFileA (in: hFindFile=0x7cba90, lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x160ee9ac, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x160ee9ac, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d1538, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1
	[0050.878] lstrcmpA (lpString1=".", lpString2="Program Files") returned -1
	[0050.878] lstrcmpA (lpString1="..", lpString2="Program Files") returned -1
	[0050.878] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*"
	[0050.878] FindFirstFileA (in: lpFileName="C:\\Program Files\\*.*", lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x160ee9ac, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x160ee9ac, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x48, cFileName=".", cAlternateFileName="")) returned 0x7cb790
	[0050.878] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.879] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*"
	[0050.881] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\*.*") returned="*.*"
	[0050.883] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0050.883] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\DESIGNER\\*.*") returned="*.*"
	[0050.883] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\DESIGNER\\" | out: lpString1="C:\\Program Files\\Common Files\\DESIGNER\\") returned="C:\\Program Files\\Common Files\\DESIGNER\\"
	[0050.883] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\DESIGNER\\" | out: pszPath="C:\\Program Files\\Common Files\\DESIGNER\\") returned=""
	[0050.888] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\*.*") returned="*.*"
	[0050.888] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\*.*") returned="*.*"
	[0050.889] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.889] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\*.*") returned="*.*"
	[0050.889] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.889] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.891] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.891] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned="api-ms-win-core-file-l1-2-0.dll"
	[0050.891] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.891] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.891] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.891] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned="api-ms-win-core-file-l2-1-0.dll"
	[0050.891] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.891] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.891] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.891] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned="api-ms-win-core-localization-l1-2-0.dll"
	[0050.891] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.891] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.891] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.891] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned="api-ms-win-core-processthreads-l1-1-1.dll"
	[0050.892] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.892] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.892] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.892] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned="api-ms-win-core-synch-l1-2-0.dll"
	[0050.892] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.892] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.892] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.892] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned="api-ms-win-core-timezone-l1-1-0.dll"
	[0050.892] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.892] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.892] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.892] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned="api-ms-win-core-xstate-l2-1-0.dll"
	[0050.892] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.892] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.892] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.892] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned="api-ms-win-crt-conio-l1-1-0.dll"
	[0050.892] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.892] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.893] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.893] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned="api-ms-win-crt-convert-l1-1-0.dll"
	[0050.893] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.893] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.893] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.893] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned="api-ms-win-crt-environment-l1-1-0.dll"
	[0050.893] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.893] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.893] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.893] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned="api-ms-win-crt-filesystem-l1-1-0.dll"
	[0050.893] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.893] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.893] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.893] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned="api-ms-win-crt-heap-l1-1-0.dll"
	[0050.893] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.893] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.893] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.893] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned="api-ms-win-crt-locale-l1-1-0.dll"
	[0050.893] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.894] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.894] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.894] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned="api-ms-win-crt-math-l1-1-0.dll"
	[0050.894] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.894] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.894] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.894] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned="api-ms-win-crt-multibyte-l1-1-0.dll"
	[0050.894] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.894] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.894] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.894] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned="api-ms-win-crt-private-l1-1-0.dll"
	[0050.894] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.894] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.894] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.894] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned="api-ms-win-crt-process-l1-1-0.dll"
	[0050.894] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.894] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.895] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.895] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned="api-ms-win-crt-runtime-l1-1-0.dll"
	[0050.895] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.895] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.895] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.895] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned="api-ms-win-crt-stdio-l1-1-0.dll"
	[0050.895] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.895] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.895] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.895] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned="api-ms-win-crt-string-l1-1-0.dll"
	[0050.895] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.895] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.895] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.895] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned="api-ms-win-crt-time-l1-1-0.dll"
	[0050.895] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.895] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.895] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.895] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned="api-ms-win-crt-utility-l1-1-0.dll"
	[0050.896] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.896] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.896] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.896] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned="ApiClient.dll"
	[0050.896] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.896] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.899] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.899] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned="AppVCatalog.dll"
	[0050.899] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.899] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.899] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.899] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned="appvcleaner.exe"
	[0050.899] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.899] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.899] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.899] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned="AppVFileSystemMetadata.dll"
	[0050.899] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.900] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.900] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.900] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned="AppVIntegration.dll"
	[0050.900] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.900] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.900] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.900] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned="AppVIsvApi.dll"
	[0050.900] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.900] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.900] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.900] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned="AppvIsvStream32.dll"
	[0050.900] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.900] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.900] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.900] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned="AppvIsvStream64.dll"
	[0050.900] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.900] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.900] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.901] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned="AppVIsvStreamingManager.dll"
	[0050.901] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.901] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.901] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.901] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned="AppVIsvSubsystemController.dll"
	[0050.901] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.901] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.901] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.901] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned="AppvIsvSubsystems32.dll"
	[0050.901] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.901] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.901] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.901] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned="AppvIsvSubsystems64.dll"
	[0050.901] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.901] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.901] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.901] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned="AppVIsvVirtualization.dll"
	[0050.901] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.901] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.902] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.902] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned="AppVManifest.dll"
	[0050.902] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.902] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.902] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.902] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned="AppVOrchestration.dll"
	[0050.902] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.902] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.902] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.902] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned="AppVPolicy.dll"
	[0050.902] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.902] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.902] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.902] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned="AppVScripting.dll"
	[0050.902] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.902] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.902] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.903] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned="AppVShNotify.exe"
	[0050.903] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.903] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.903] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.903] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned="C2R32.dll"
	[0050.903] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.903] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.903] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.903] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned="C2R64.dll"
	[0050.903] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.903] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.903] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.903] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned="C2RHeartbeatConfig.xml"
	[0050.903] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.903] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.903] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.903] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned="C2RUI.en-us.dll"
	[0050.903] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.903] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.904] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.904] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.904] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned="concrt140.dll"
	[0050.904] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.904] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.904] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.904] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned="i640.hash"
	[0050.904] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.904] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.904] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.904] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned="i641033.hash"
	[0050.904] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.904] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.904] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.904] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned="IntegratedOffice.exe"
	[0050.904] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.904] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.904] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.905] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned="MavInject32.exe"
	[0050.905] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.905] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.905] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.905] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned="mso20win32client.dll"
	[0050.905] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.905] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.905] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.905] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned="mso30win32client.dll"
	[0050.905] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.905] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.905] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.905] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned="mso40uires.dll"
	[0050.905] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.905] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.905] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.905] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned="mso40uiwin32client.dll"
	[0050.905] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.905] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.906] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.906] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned="msointl30.en-us.dll"
	[0050.906] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.906] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.906] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.906] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned="msvcp120.dll"
	[0050.906] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.906] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.906] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.906] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned="msvcp140.dll"
	[0050.906] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.906] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.906] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.906] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned="msvcr120.dll"
	[0050.906] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.906] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.906] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.906] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned="OfficeC2RClient.exe"
	[0050.906] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.907] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.907] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.907] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned="OfficeC2RCom.dll"
	[0050.907] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\"
	[0050.907] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.907] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.907] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.907] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.907] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.907] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.907] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.907] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.907] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.907] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.908] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.908] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.908] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned=""
	[0050.913] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.913] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned=""
	[0050.916] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.916] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\") returned=""
	[0050.918] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.918] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\") returned=""
	[0050.923] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.923] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned=""
	[0050.924] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.924] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\") returned=""
	[0050.925] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.925] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\") returned=""
	[0050.940] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.940] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\") returned=""
	[0050.941] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.941] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\") returned=""
	[0050.944] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.944] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\") returned=""
	[0050.946] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.946] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned=""
	[0050.949] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.949] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned=""
	[0050.949] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.949] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned=""
	[0050.950] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.950] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned=""
	[0050.950] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.950] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned=""
	[0050.950] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.959] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned=""
	[0050.959] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.959] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned=""
	[0050.959] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.959] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned=""
	[0050.960] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.960] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned=""
	[0050.960] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.960] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned=""
	[0050.960] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.960] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned=""
	[0050.960] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.960] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned=""
	[0050.960] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.960] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned=""
	[0050.960] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.961] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned=""
	[0050.961] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.961] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned=""
	[0050.961] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.961] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned=""
	[0050.961] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.961] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned=""
	[0050.961] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.961] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned=""
	[0050.961] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.961] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned=""
	[0050.961] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.962] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned=""
	[0050.962] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.962] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned=""
	[0050.962] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.962] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned=""
	[0050.962] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.962] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned=""
	[0050.963] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.963] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\") returned=""
	[0050.964] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.964] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\") returned=""
	[0050.966] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.966] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\") returned=""
	[0050.969] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.969] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\") returned=""
	[0050.970] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.970] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned=""
	[0050.975] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0050.975] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned=""
	[0050.975] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.976] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\") returned=""
	[0050.977] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.977] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\") returned=""
	[0050.979] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0050.980] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\") returned=""
	[0050.981] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.981] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned=""
	[0050.982] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0050.983] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\") returned=""
	[0050.984] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.984] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned=""
	[0050.984] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0050.984] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned=""
	[0050.985] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0050.986] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned=""
	[0050.986] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0050.986] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned=""
	[0050.986] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.986] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned=""
	[0050.987] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0050.987] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned=""
	[0050.989] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0050.989] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned=""
	[0050.989] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0050.989] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned=""
	[0050.989] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0050.989] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned=""
	[0050.989] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0050.989] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned=""
	[0050.989] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0050.989] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned=""
	[0050.989] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0050.990] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned=""
	[0050.990] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0050.990] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned=""
	[0050.990] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0050.990] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned=""
	[0050.990] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0050.990] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned=""
	[0050.990] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0050.990] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned=""
	[0050.990] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0050.990] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned=""
	[0050.991] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0050.991] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned=""
	[0050.991] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.991] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned=""
	[0050.991] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0050.991] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\") returned=""
	[0050.992] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.992] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned=""
	[0050.993] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0050.993] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\") returned=""
	[0050.994] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.994] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned=""
	[0050.995] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0050.995] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\") returned=""
	[0050.996] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.996] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned=""
	[0050.996] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0050.996] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\") returned=""
	[0050.998] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.998] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned=""
	[0050.998] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0050.998] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\") returned=""
	[0050.999] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0050.999] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned=""
	[0051.028] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0051.028] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned=""
	[0051.029] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0051.029] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned=""
	[0051.029] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0051.029] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned=""
	[0051.030] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0051.030] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned=""
	[0051.030] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\") returned=""
	[0051.577] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt.exe")) returned 1
	[0051.598] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.exe")) returned 1
	[0051.603] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif.exe")) returned 1
	[0051.606] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.exe")) returned 1
	[0051.636] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.exe")) returned 1
	[0051.639] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.exe")) returned 1
	[0051.666] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.exe")) returned 1
	[0051.668] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif.exe")) returned 1
	[0051.670] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif.exe")) returned 1
	[0051.671] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif.exe")) returned 1
	[0051.673] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif.exe")) returned 1
	[0051.675] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif.exe")) returned 1
	[0051.677] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif.exe")) returned 1
	[0051.685] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt.exe")) returned 1
	[0051.693] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt.exe")) returned 1
	[0051.696] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt.exe")) returned 1
	[0051.737] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt.exe")) returned 1
	[0051.739] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html.exe")) returned 1
	[0051.751] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.exe" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm.exe")) returned 1
	[0051.754] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.exe" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs.exe")) returned 1
	[0051.811] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif.exe")) returned 1
	[0051.814] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif.exe")) returned 1
	[0051.817] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif.exe")) returned 1
	[0051.820] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif.exe")) returned 1
	[0051.822] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif.exe")) returned 1
	[0051.824] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif.exe")) returned 1
	[0051.826] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif.exe")) returned 1
	[0051.829] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif.exe")) returned 1
	[0051.832] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif.exe")) returned 1
	[0051.834] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif.exe")) returned 1
	[0051.838] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif.exe")) returned 1
	[0051.840] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif.exe")) returned 1
	[0051.842] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif.exe")) returned 1
	[0051.845] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif.exe")) returned 1
	[0051.847] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif.exe")) returned 1
	[0051.850] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif.exe")) returned 1
	[0051.852] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif.exe")) returned 1
	[0051.855] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif.exe")) returned 1
	[0051.857] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif.exe")) returned 1
	[0051.859] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif.exe")) returned 1
	[0051.861] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif.exe")) returned 1
	[0051.863] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif.exe")) returned 1
	[0051.865] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif.exe")) returned 1
	[0051.867] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif.exe")) returned 1
	[0051.870] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif.exe")) returned 1
	[0051.872] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif.exe")) returned 1
	[0051.874] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif.exe")) returned 1
	[0051.916] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif.exe")) returned 1
	[0051.919] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif.exe")) returned 1
	[0051.921] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif.exe")) returned 1
	[0051.923] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif.exe")) returned 1
	[0051.925] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.exe")) returned 1
	[0051.928] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif.exe")) returned 1
	[0051.931] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif.exe")) returned 1
	[0051.946] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.exe")) returned 1
	[0051.949] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif.exe")) returned 1
	[0051.951] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.exe")) returned 1
	[0051.953] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif.exe")) returned 1
	[0052.125] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif.exe")) returned 1
	[0052.129] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg.exe")) returned 1
	[0052.135] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg.exe")) returned 1
	[0052.138] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg.exe")) returned 1
	[0052.141] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg.exe")) returned 1
	[0052.143] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg.exe")) returned 1
	[0052.146] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg.exe")) returned 1
	[0052.152] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg.exe")) returned 1
	[0052.154] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg.exe")) returned 1
	[0052.156] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg.exe")) returned 1
	[0052.159] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg.exe")) returned 1
	[0052.162] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg.exe")) returned 1
	[0052.165] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg.exe")) returned 1
	[0052.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.zip") returned 0
	[0052.221] lstrlenA (lpString="*.zip") returned 5
	[0052.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.rar") returned 0
	[0052.221] lstrlenA (lpString="*.rar") returned 5
	[0052.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.7z") returned 0
	[0052.221] lstrlenA (lpString="*.7z") returned 4
	[0052.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.tar") returned 0
	[0052.221] lstrlenA (lpString="*.tar") returned 5
	[0052.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.gzip") returned 0
	[0052.221] lstrlenA (lpString="*.gzip") returned 6
	[0052.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.jpg") returned 0
	[0052.221] lstrlenA (lpString="*.jpg") returned 5
	[0052.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.jpeg") returned 0
	[0052.221] lstrlenA (lpString="*.jpeg") returned 6
	[0052.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.bmp") returned 0
	[0052.221] lstrlenA (lpString="*.bmp") returned 5
	[0052.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.gif") returned 0
	[0052.221] lstrlenA (lpString="*.gif") returned 5
	[0052.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.png") returned 0
	[0052.221] lstrlenA (lpString="*.png") returned 5
	[0052.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.doc") returned 0
	[0052.221] lstrlenA (lpString="*.doc") returned 5
	[0052.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.docx") returned 0
	[0052.221] lstrlenA (lpString="*.docx") returned 6
	[0052.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.xls") returned 0
	[0052.221] lstrlenA (lpString="*.xls") returned 5
	[0052.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.xlsx") returned 0
	[0052.221] lstrlenA (lpString="*.xlsx") returned 6
	[0052.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.ppt") returned 0
	[0052.221] lstrlenA (lpString="*.ppt") returned 5
	[0052.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.pptx") returned 0
	[0052.221] lstrlenA (lpString="*.pptx") returned 6
	[0052.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.txt") returned 0
	[0052.221] lstrlenA (lpString="*.txt") returned 5
	[0052.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.pdf") returned 0
	[0052.221] lstrlenA (lpString="*.pdf") returned 5
	[0052.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.htm") returned 0
	[0052.221] lstrlenA (lpString="*.htm") returned 5
	[0052.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.html") returned 0
	[0052.222] lstrlenA (lpString="*.html") returned 6
	[0052.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.mdb") returned 0
	[0052.222] lstrlenA (lpString="*.mdb") returned 5
	[0052.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.pfx") returned 0
	[0052.222] lstrlenA (lpString="*.pfx") returned 5
	[0052.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.md") returned 0
	[0052.222] lstrlenA (lpString="*.md") returned 4
	[0052.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.lnk") returned 0
	[0052.222] lstrlenA (lpString="*.lnk") returned 5
	[0052.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.torrent") returned 0
	[0052.222] lstrlenA (lpString="*.torrent") returned 9
	[0052.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.mov") returned 0
	[0052.222] lstrlenA (lpString="*.mov") returned 5
	[0052.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.3gp") returned 0
	[0052.222] lstrlenA (lpString="*.3gp") returned 5
	[0052.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.mpeg") returned 0
	[0052.222] lstrlenA (lpString="*.mpeg") returned 6
	[0052.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.mpg") returned 0
	[0052.222] lstrlenA (lpString="*.mpg") returned 5
	[0052.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.flv") returned 0
	[0052.222] lstrlenA (lpString="*.flv") returned 5
	[0052.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.avi") returned 0
	[0052.222] lstrlenA (lpString="*.avi") returned 5
	[0052.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.mp4") returned 0
	[0052.222] lstrlenA (lpString="*.mp4") returned 5
	[0052.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.wmv") returned 0
	[0052.222] lstrlenA (lpString="*.wmv") returned 5
	[0052.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.mkv") returned 0
	[0052.222] lstrlenA (lpString="*.mkv") returned 5
	[0052.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.mp3") returned 0
	[0052.222] lstrlenA (lpString="*.mp3") returned 5
	[0052.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.wav") returned 0
	[0052.222] lstrlenA (lpString="*.wav") returned 5
	[0052.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.flac") returned 0
	[0052.222] lstrlenA (lpString="*.flac") returned 6
	[0052.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.wma") returned 0
	[0052.223] lstrlenA (lpString="*.wma") returned 5
	[0052.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.au3") returned 0
	[0052.223] lstrlenA (lpString="*.au3") returned 5
	[0052.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.ahk") returned 0
	[0052.223] lstrlenA (lpString="*.ahk") returned 5
	[0052.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.c") returned 0
	[0052.223] lstrlenA (lpString="*.c") returned 3
	[0052.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.cc") returned 0
	[0052.223] lstrlenA (lpString="*.cc") returned 4
	[0052.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.cpp") returned 0
	[0052.223] lstrlenA (lpString="*.cpp") returned 5
	[0052.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.cxx") returned 0
	[0052.223] lstrlenA (lpString="*.cxx") returned 5
	[0052.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.c++") returned 0
	[0052.223] lstrlenA (lpString="*.c++") returned 5
	[0052.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.cs") returned 0
	[0052.223] lstrlenA (lpString="*.cs") returned 4
	[0052.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.vb") returned 0
	[0052.223] lstrlenA (lpString="*.vb") returned 4
	[0052.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.bas") returned 0
	[0052.223] lstrlenA (lpString="*.bas") returned 5
	[0052.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.csproj") returned 0
	[0052.223] lstrlenA (lpString="*.csproj") returned 8
	[0052.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.vbproj") returned 0
	[0052.223] lstrlenA (lpString="*.vbproj") returned 8
	[0052.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.vcxproj") returned 0
	[0052.223] lstrlenA (lpString="*.vcxproj") returned 9
	[0052.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.manifest") returned 0
	[0052.223] lstrlenA (lpString="*.manifest") returned 10
	[0052.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.php") returned 0
	[0052.223] lstrlenA (lpString="*.php") returned 5
	[0052.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.vbe") returned 0
	[0052.223] lstrlenA (lpString="*.vbe") returned 5
	[0052.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.vba") returned 0
	[0052.223] lstrlenA (lpString="*.vba") returned 5
	[0052.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.vbs") returned 0
	[0052.224] lstrlenA (lpString="*.vbs") returned 5
	[0052.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.bat") returned 0
	[0052.224] lstrlenA (lpString="*.bat") returned 5
	[0052.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.cmd") returned 0
	[0052.224] lstrlenA (lpString="*.cmd") returned 5
	[0052.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.js") returned 0
	[0052.224] lstrlenA (lpString="*.js") returned 4
	[0052.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.jscript") returned 0
	[0052.224] lstrlenA (lpString="*.jscript") returned 9
	[0052.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.hta") returned 0
	[0052.224] lstrlenA (lpString="*.hta") returned 5
	[0052.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.php7") returned 0
	[0052.224] lstrlenA (lpString="*.php7") returned 6
	[0052.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.db") returned 0
	[0052.224] lstrlenA (lpString="*.db") returned 4
	[0052.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.swf") returned 0
	[0052.224] lstrlenA (lpString="*.swf") returned 5
	[0052.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.eml") returned 0
	[0052.224] lstrlenA (lpString="*.eml") returned 5
	[0052.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.part") returned 0
	[0052.224] lstrlenA (lpString="*.part") returned 6
	[0052.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.nfo") returned 0
	[0052.224] lstrlenA (lpString="*.nfo") returned 5
	[0052.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.rsa") returned 0
	[0052.224] lstrlenA (lpString="*.rsa") returned 5
	[0052.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.key") returned 0
	[0052.224] lstrlenA (lpString="*.key") returned 5
	[0052.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.aes") returned 0
	[0052.224] lstrlenA (lpString="*.aes") returned 5
	[0052.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.blob") returned 0
	[0052.224] lstrlenA (lpString="*.blob") returned 6
	[0052.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.btc") returned 0
	[0052.224] lstrlenA (lpString="*.btc") returned 5
	[0052.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF", pszSpec="*.wallet") returned 0
	[0052.224] lstrlenA (lpString="*.wallet") returned 8
	[0052.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.zip") returned 0
	[0052.225] lstrlenA (lpString="*.zip") returned 5
	[0052.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.rar") returned 0
	[0052.225] lstrlenA (lpString="*.rar") returned 5
	[0052.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.7z") returned 0
	[0052.225] lstrlenA (lpString="*.7z") returned 4
	[0052.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.tar") returned 0
	[0052.225] lstrlenA (lpString="*.tar") returned 5
	[0052.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.gzip") returned 0
	[0052.225] lstrlenA (lpString="*.gzip") returned 6
	[0052.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.jpg") returned 0
	[0052.225] lstrlenA (lpString="*.jpg") returned 5
	[0052.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.jpeg") returned 0
	[0052.225] lstrlenA (lpString="*.jpeg") returned 6
	[0052.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.bmp") returned 0
	[0052.225] lstrlenA (lpString="*.bmp") returned 5
	[0052.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.gif") returned 0
	[0052.225] lstrlenA (lpString="*.gif") returned 5
	[0052.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.png") returned 0
	[0052.225] lstrlenA (lpString="*.png") returned 5
	[0052.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.doc") returned 0
	[0052.225] lstrlenA (lpString="*.doc") returned 5
	[0052.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.docx") returned 0
	[0052.225] lstrlenA (lpString="*.docx") returned 6
	[0052.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.xls") returned 0
	[0052.225] lstrlenA (lpString="*.xls") returned 5
	[0052.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.xlsx") returned 0
	[0052.226] lstrlenA (lpString="*.xlsx") returned 6
	[0052.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.ppt") returned 0
	[0052.226] lstrlenA (lpString="*.ppt") returned 5
	[0052.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.pptx") returned 0
	[0052.226] lstrlenA (lpString="*.pptx") returned 6
	[0052.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.txt") returned 0
	[0052.226] lstrlenA (lpString="*.txt") returned 5
	[0052.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.pdf") returned 0
	[0052.226] lstrlenA (lpString="*.pdf") returned 5
	[0052.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.htm") returned 0
	[0052.226] lstrlenA (lpString="*.htm") returned 5
	[0052.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.html") returned 0
	[0052.226] lstrlenA (lpString="*.html") returned 6
	[0052.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.mdb") returned 0
	[0052.226] lstrlenA (lpString="*.mdb") returned 5
	[0052.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.pfx") returned 0
	[0052.226] lstrlenA (lpString="*.pfx") returned 5
	[0052.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.md") returned 0
	[0052.226] lstrlenA (lpString="*.md") returned 4
	[0052.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.lnk") returned 0
	[0052.226] lstrlenA (lpString="*.lnk") returned 5
	[0052.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.torrent") returned 0
	[0052.226] lstrlenA (lpString="*.torrent") returned 9
	[0052.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.mov") returned 0
	[0052.226] lstrlenA (lpString="*.mov") returned 5
	[0052.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.3gp") returned 0
	[0052.226] lstrlenA (lpString="*.3gp") returned 5
	[0052.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.mpeg") returned 0
	[0052.226] lstrlenA (lpString="*.mpeg") returned 6
	[0052.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.mpg") returned 0
	[0052.226] lstrlenA (lpString="*.mpg") returned 5
	[0052.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.flv") returned 0
	[0052.226] lstrlenA (lpString="*.flv") returned 5
	[0052.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.avi") returned 0
	[0052.227] lstrlenA (lpString="*.avi") returned 5
	[0052.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.mp4") returned 0
	[0052.227] lstrlenA (lpString="*.mp4") returned 5
	[0052.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.wmv") returned 0
	[0052.227] lstrlenA (lpString="*.wmv") returned 5
	[0052.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.mkv") returned 0
	[0052.227] lstrlenA (lpString="*.mkv") returned 5
	[0052.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.mp3") returned 0
	[0052.227] lstrlenA (lpString="*.mp3") returned 5
	[0052.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.wav") returned 0
	[0052.227] lstrlenA (lpString="*.wav") returned 5
	[0052.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.flac") returned 0
	[0052.227] lstrlenA (lpString="*.flac") returned 6
	[0052.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.wma") returned 0
	[0052.227] lstrlenA (lpString="*.wma") returned 5
	[0052.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.au3") returned 0
	[0052.227] lstrlenA (lpString="*.au3") returned 5
	[0052.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.ahk") returned 0
	[0052.227] lstrlenA (lpString="*.ahk") returned 5
	[0052.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.c") returned 0
	[0052.227] lstrlenA (lpString="*.c") returned 3
	[0052.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.cc") returned 0
	[0052.227] lstrlenA (lpString="*.cc") returned 4
	[0052.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.cpp") returned 0
	[0052.227] lstrlenA (lpString="*.cpp") returned 5
	[0052.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.cxx") returned 0
	[0052.227] lstrlenA (lpString="*.cxx") returned 5
	[0052.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.c++") returned 0
	[0052.227] lstrlenA (lpString="*.c++") returned 5
	[0052.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.cs") returned 0
	[0052.227] lstrlenA (lpString="*.cs") returned 4
	[0052.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.vb") returned 0
	[0052.227] lstrlenA (lpString="*.vb") returned 4
	[0052.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.bas") returned 0
	[0052.227] lstrlenA (lpString="*.bas") returned 5
	[0052.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.csproj") returned 0
	[0052.227] lstrlenA (lpString="*.csproj") returned 8
	[0052.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.vbproj") returned 0
	[0052.228] lstrlenA (lpString="*.vbproj") returned 8
	[0052.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.vcxproj") returned 0
	[0052.228] lstrlenA (lpString="*.vcxproj") returned 9
	[0052.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.manifest") returned 0
	[0052.228] lstrlenA (lpString="*.manifest") returned 10
	[0052.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.php") returned 0
	[0052.228] lstrlenA (lpString="*.php") returned 5
	[0052.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.vbe") returned 0
	[0052.228] lstrlenA (lpString="*.vbe") returned 5
	[0052.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.vba") returned 0
	[0052.228] lstrlenA (lpString="*.vba") returned 5
	[0052.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.vbs") returned 0
	[0052.228] lstrlenA (lpString="*.vbs") returned 5
	[0052.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.bat") returned 0
	[0052.228] lstrlenA (lpString="*.bat") returned 5
	[0052.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.cmd") returned 0
	[0052.228] lstrlenA (lpString="*.cmd") returned 5
	[0052.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.js") returned 0
	[0052.228] lstrlenA (lpString="*.js") returned 4
	[0052.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.jscript") returned 0
	[0052.228] lstrlenA (lpString="*.jscript") returned 9
	[0052.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.hta") returned 0
	[0052.228] lstrlenA (lpString="*.hta") returned 5
	[0052.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.php7") returned 0
	[0052.228] lstrlenA (lpString="*.php7") returned 6
	[0052.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.db") returned 0
	[0052.228] lstrlenA (lpString="*.db") returned 4
	[0052.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.swf") returned 0
	[0052.228] lstrlenA (lpString="*.swf") returned 5
	[0052.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.eml") returned 0
	[0052.228] lstrlenA (lpString="*.eml") returned 5
	[0052.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.part") returned 0
	[0052.228] lstrlenA (lpString="*.part") returned 6
	[0052.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.nfo") returned 0
	[0052.228] lstrlenA (lpString="*.nfo") returned 5
	[0052.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.rsa") returned 0
	[0052.229] lstrlenA (lpString="*.rsa") returned 5
	[0052.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.key") returned 0
	[0052.229] lstrlenA (lpString="*.key") returned 5
	[0052.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.aes") returned 0
	[0052.229] lstrlenA (lpString="*.aes") returned 5
	[0052.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.blob") returned 0
	[0052.229] lstrlenA (lpString="*.blob") returned 6
	[0052.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.btc") returned 0
	[0052.229] lstrlenA (lpString="*.btc") returned 5
	[0052.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF", pszSpec="*.wallet") returned 0
	[0052.229] lstrlenA (lpString="*.wallet") returned 8
	[0052.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG", pszSpec="*.zip") returned 0
	[0052.229] lstrlenA (lpString="*.zip") returned 5
	[0052.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG", pszSpec="*.rar") returned 0
	[0052.229] lstrlenA (lpString="*.rar") returned 5
	[0052.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG", pszSpec="*.7z") returned 0
	[0052.229] lstrlenA (lpString="*.7z") returned 4
	[0052.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG", pszSpec="*.tar") returned 0
	[0052.229] lstrlenA (lpString="*.tar") returned 5
	[0052.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG", pszSpec="*.gzip") returned 0
	[0052.229] lstrlenA (lpString="*.gzip") returned 6
	[0052.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG", pszSpec="*.jpg") returned 1
	[0052.229] lstrlenA (lpString="*.jpg") returned 5
	[0052.229] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG"
	[0052.229] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG"
	[0052.229] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG."
	[0052.229] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.exe"
	[0052.229] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0052.230] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc53a
	[0052.230] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe081920, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe081920, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe0a7b88, dwHighDateTime=0x1d327e8)) returned 1
	[0052.230] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.230] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xc4f8, lpOverlapped=0x0) returned 1
	[0052.240] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.240] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xc4f8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xc4f8, lpOverlapped=0x0) returned 1
	[0052.241] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.241] CloseHandle (hObject=0x214) returned 1
	[0052.242] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg.exe")) returned 1
	[0052.243] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe081920, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe081920, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe0a7b88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xfcff, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099166.JPG", cAlternateFileName="")) returned 1
	[0052.243] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.243] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099166.JPG") returned -1
	[0052.243] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099166.JPG") returned -1
	[0052.243] lstrcmpiA (lpString1="", lpString2="J0099166.JPG") returned -1
	[0052.243] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned="J0099165.JPG"
	[0052.243] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.243] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.243] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.243] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.243] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099166.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG"
	[0052.243] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG", pszSpec="*.zip") returned 0
	[0052.243] lstrlenA (lpString="*.zip") returned 5
	[0052.243] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG", pszSpec="*.rar") returned 0
	[0052.243] lstrlenA (lpString="*.rar") returned 5
	[0052.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG", pszSpec="*.7z") returned 0
	[0052.244] lstrlenA (lpString="*.7z") returned 4
	[0052.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG", pszSpec="*.tar") returned 0
	[0052.244] lstrlenA (lpString="*.tar") returned 5
	[0052.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG", pszSpec="*.gzip") returned 0
	[0052.244] lstrlenA (lpString="*.gzip") returned 6
	[0052.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG", pszSpec="*.jpg") returned 1
	[0052.244] lstrlenA (lpString="*.jpg") returned 5
	[0052.244] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG"
	[0052.244] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG"
	[0052.244] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG."
	[0052.244] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.exe"
	[0052.244] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0052.244] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfcff
	[0052.244] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe081920, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe081920, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe0a7b88, dwHighDateTime=0x1d327e8)) returned 1
	[0052.244] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.244] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xfcbd, lpOverlapped=0x0) returned 1
	[0052.246] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned="J0099166.JPG"
	[0052.250] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.250] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xfcbd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xfcbd, lpOverlapped=0x0) returned 1
	[0052.251] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.251] CloseHandle (hObject=0x214) returned 1
	[0052.253] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg.exe")) returned 1
	[0052.256] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe081920, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe081920, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe0a7b88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xabad, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099167.JPG", cAlternateFileName="")) returned 1
	[0052.256] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.256] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099167.JPG") returned -1
	[0052.256] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099167.JPG") returned -1
	[0052.256] lstrcmpiA (lpString1="", lpString2="J0099167.JPG") returned -1
	[0052.256] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned="J0099166.JPG"
	[0052.256] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.256] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.256] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.256] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.256] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099167.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG"
	[0052.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG", pszSpec="*.zip") returned 0
	[0052.256] lstrlenA (lpString="*.zip") returned 5
	[0052.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG", pszSpec="*.rar") returned 0
	[0052.256] lstrlenA (lpString="*.rar") returned 5
	[0052.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG", pszSpec="*.7z") returned 0
	[0052.257] lstrlenA (lpString="*.7z") returned 4
	[0052.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG", pszSpec="*.tar") returned 0
	[0052.257] lstrlenA (lpString="*.tar") returned 5
	[0052.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG", pszSpec="*.gzip") returned 0
	[0052.257] lstrlenA (lpString="*.gzip") returned 6
	[0052.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG", pszSpec="*.jpg") returned 1
	[0052.257] lstrlenA (lpString="*.jpg") returned 5
	[0052.257] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG"
	[0052.257] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG"
	[0052.257] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG."
	[0052.257] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.exe"
	[0052.257] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0052.258] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xabad
	[0052.258] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe081920, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe081920, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe0a7b88, dwHighDateTime=0x1d327e8)) returned 1
	[0052.258] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.258] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xab6b, lpOverlapped=0x0) returned 1
	[0052.259] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned="J0099167.JPG"
	[0052.260] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.260] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xab6b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xab6b, lpOverlapped=0x0) returned 1
	[0052.260] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.260] CloseHandle (hObject=0x214) returned 1
	[0052.261] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg.exe")) returned 1
	[0052.324] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe081920, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe081920, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe0a7b88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4ed3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099168.JPG", cAlternateFileName="")) returned 1
	[0052.324] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.324] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099168.JPG") returned -1
	[0052.324] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099168.JPG") returned -1
	[0052.324] lstrcmpiA (lpString1="", lpString2="J0099168.JPG") returned -1
	[0052.324] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned="J0099167.JPG"
	[0052.324] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.324] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.324] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.324] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.324] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099168.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG"
	[0052.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG", pszSpec="*.zip") returned 0
	[0052.324] lstrlenA (lpString="*.zip") returned 5
	[0052.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG", pszSpec="*.rar") returned 0
	[0052.324] lstrlenA (lpString="*.rar") returned 5
	[0052.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG", pszSpec="*.7z") returned 0
	[0052.373] lstrlenA (lpString="*.7z") returned 4
	[0052.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG", pszSpec="*.tar") returned 0
	[0052.373] lstrlenA (lpString="*.tar") returned 5
	[0052.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG", pszSpec="*.gzip") returned 0
	[0052.373] lstrlenA (lpString="*.gzip") returned 6
	[0052.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG", pszSpec="*.jpg") returned 1
	[0052.373] lstrlenA (lpString="*.jpg") returned 5
	[0052.373] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG"
	[0052.373] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG"
	[0052.373] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG."
	[0052.373] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.exe"
	[0052.373] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0052.373] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ed3
	[0052.373] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe081920, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe081920, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe0a7b88, dwHighDateTime=0x1d327e8)) returned 1
	[0052.374] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.374] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x4e91, lpOverlapped=0x0) returned 1
	[0052.375] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned="J0099168.JPG"
	[0052.375] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.375] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x4e91, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x4e91, lpOverlapped=0x0) returned 1
	[0052.375] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.376] CloseHandle (hObject=0x214) returned 1
	[0052.378] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg.exe")) returned 1
	[0052.379] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe081920, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe081920, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe081920, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x27d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099169.WMF", cAlternateFileName="")) returned 1
	[0052.379] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.379] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099169.WMF") returned -1
	[0052.379] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099169.WMF") returned -1
	[0052.379] lstrcmpiA (lpString1="", lpString2="J0099169.WMF") returned -1
	[0052.379] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned="J0099168.JPG"
	[0052.379] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.379] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.380] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.380] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.380] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099169.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF"
	[0052.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.zip") returned 0
	[0052.380] lstrlenA (lpString="*.zip") returned 5
	[0052.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.rar") returned 0
	[0052.380] lstrlenA (lpString="*.rar") returned 5
	[0052.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.7z") returned 0
	[0052.380] lstrlenA (lpString="*.7z") returned 4
	[0052.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.tar") returned 0
	[0052.380] lstrlenA (lpString="*.tar") returned 5
	[0052.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.gzip") returned 0
	[0052.380] lstrlenA (lpString="*.gzip") returned 6
	[0052.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.jpg") returned 0
	[0052.380] lstrlenA (lpString="*.jpg") returned 5
	[0052.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.jpeg") returned 0
	[0052.380] lstrlenA (lpString="*.jpeg") returned 6
	[0052.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.bmp") returned 0
	[0052.380] lstrlenA (lpString="*.bmp") returned 5
	[0052.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.gif") returned 0
	[0052.380] lstrlenA (lpString="*.gif") returned 5
	[0052.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.png") returned 0
	[0052.380] lstrlenA (lpString="*.png") returned 5
	[0052.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.doc") returned 0
	[0052.380] lstrlenA (lpString="*.doc") returned 5
	[0052.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.docx") returned 0
	[0052.380] lstrlenA (lpString="*.docx") returned 6
	[0052.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.xls") returned 0
	[0052.380] lstrlenA (lpString="*.xls") returned 5
	[0052.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.xlsx") returned 0
	[0052.381] lstrlenA (lpString="*.xlsx") returned 6
	[0052.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.ppt") returned 0
	[0052.381] lstrlenA (lpString="*.ppt") returned 5
	[0052.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.pptx") returned 0
	[0052.381] lstrlenA (lpString="*.pptx") returned 6
	[0052.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.txt") returned 0
	[0052.381] lstrlenA (lpString="*.txt") returned 5
	[0052.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.pdf") returned 0
	[0052.381] lstrlenA (lpString="*.pdf") returned 5
	[0052.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.htm") returned 0
	[0052.381] lstrlenA (lpString="*.htm") returned 5
	[0052.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.html") returned 0
	[0052.381] lstrlenA (lpString="*.html") returned 6
	[0052.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.mdb") returned 0
	[0052.381] lstrlenA (lpString="*.mdb") returned 5
	[0052.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.pfx") returned 0
	[0052.381] lstrlenA (lpString="*.pfx") returned 5
	[0052.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.md") returned 0
	[0052.381] lstrlenA (lpString="*.md") returned 4
	[0052.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.lnk") returned 0
	[0052.381] lstrlenA (lpString="*.lnk") returned 5
	[0052.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.torrent") returned 0
	[0052.381] lstrlenA (lpString="*.torrent") returned 9
	[0052.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.mov") returned 0
	[0052.381] lstrlenA (lpString="*.mov") returned 5
	[0052.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.3gp") returned 0
	[0052.381] lstrlenA (lpString="*.3gp") returned 5
	[0052.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.mpeg") returned 0
	[0052.381] lstrlenA (lpString="*.mpeg") returned 6
	[0052.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.mpg") returned 0
	[0052.381] lstrlenA (lpString="*.mpg") returned 5
	[0052.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.flv") returned 0
	[0052.381] lstrlenA (lpString="*.flv") returned 5
	[0052.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.avi") returned 0
	[0052.382] lstrlenA (lpString="*.avi") returned 5
	[0052.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.mp4") returned 0
	[0052.382] lstrlenA (lpString="*.mp4") returned 5
	[0052.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.wmv") returned 0
	[0052.382] lstrlenA (lpString="*.wmv") returned 5
	[0052.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.mkv") returned 0
	[0052.382] lstrlenA (lpString="*.mkv") returned 5
	[0052.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.mp3") returned 0
	[0052.382] lstrlenA (lpString="*.mp3") returned 5
	[0052.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.wav") returned 0
	[0052.382] lstrlenA (lpString="*.wav") returned 5
	[0052.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.flac") returned 0
	[0052.382] lstrlenA (lpString="*.flac") returned 6
	[0052.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.wma") returned 0
	[0052.382] lstrlenA (lpString="*.wma") returned 5
	[0052.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.au3") returned 0
	[0052.382] lstrlenA (lpString="*.au3") returned 5
	[0052.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.ahk") returned 0
	[0052.382] lstrlenA (lpString="*.ahk") returned 5
	[0052.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.c") returned 0
	[0052.382] lstrlenA (lpString="*.c") returned 3
	[0052.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.cc") returned 0
	[0052.382] lstrlenA (lpString="*.cc") returned 4
	[0052.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.cpp") returned 0
	[0052.382] lstrlenA (lpString="*.cpp") returned 5
	[0052.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.cxx") returned 0
	[0052.382] lstrlenA (lpString="*.cxx") returned 5
	[0052.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.c++") returned 0
	[0052.382] lstrlenA (lpString="*.c++") returned 5
	[0052.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.cs") returned 0
	[0052.382] lstrlenA (lpString="*.cs") returned 4
	[0052.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.vb") returned 0
	[0052.383] lstrlenA (lpString="*.vb") returned 4
	[0052.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.bas") returned 0
	[0052.383] lstrlenA (lpString="*.bas") returned 5
	[0052.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.csproj") returned 0
	[0052.383] lstrlenA (lpString="*.csproj") returned 8
	[0052.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.vbproj") returned 0
	[0052.383] lstrlenA (lpString="*.vbproj") returned 8
	[0052.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.vcxproj") returned 0
	[0052.383] lstrlenA (lpString="*.vcxproj") returned 9
	[0052.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.manifest") returned 0
	[0052.383] lstrlenA (lpString="*.manifest") returned 10
	[0052.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.php") returned 0
	[0052.383] lstrlenA (lpString="*.php") returned 5
	[0052.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.vbe") returned 0
	[0052.383] lstrlenA (lpString="*.vbe") returned 5
	[0052.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.vba") returned 0
	[0052.383] lstrlenA (lpString="*.vba") returned 5
	[0052.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.vbs") returned 0
	[0052.383] lstrlenA (lpString="*.vbs") returned 5
	[0052.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.bat") returned 0
	[0052.383] lstrlenA (lpString="*.bat") returned 5
	[0052.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.cmd") returned 0
	[0052.383] lstrlenA (lpString="*.cmd") returned 5
	[0052.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.js") returned 0
	[0052.383] lstrlenA (lpString="*.js") returned 4
	[0052.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.jscript") returned 0
	[0052.383] lstrlenA (lpString="*.jscript") returned 9
	[0052.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.hta") returned 0
	[0052.383] lstrlenA (lpString="*.hta") returned 5
	[0052.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.php7") returned 0
	[0052.383] lstrlenA (lpString="*.php7") returned 6
	[0052.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.db") returned 0
	[0052.383] lstrlenA (lpString="*.db") returned 4
	[0052.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.swf") returned 0
	[0052.384] lstrlenA (lpString="*.swf") returned 5
	[0052.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.eml") returned 0
	[0052.384] lstrlenA (lpString="*.eml") returned 5
	[0052.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.part") returned 0
	[0052.384] lstrlenA (lpString="*.part") returned 6
	[0052.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.nfo") returned 0
	[0052.384] lstrlenA (lpString="*.nfo") returned 5
	[0052.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.rsa") returned 0
	[0052.384] lstrlenA (lpString="*.rsa") returned 5
	[0052.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.key") returned 0
	[0052.384] lstrlenA (lpString="*.key") returned 5
	[0052.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.aes") returned 0
	[0052.384] lstrlenA (lpString="*.aes") returned 5
	[0052.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.blob") returned 0
	[0052.384] lstrlenA (lpString="*.blob") returned 6
	[0052.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.btc") returned 0
	[0052.384] lstrlenA (lpString="*.btc") returned 5
	[0052.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF", pszSpec="*.wallet") returned 0
	[0052.384] lstrlenA (lpString="*.wallet") returned 8
	[0052.384] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe081920, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe081920, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe081920, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5ee4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099170.WMF", cAlternateFileName="")) returned 1
	[0052.384] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.384] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099170.WMF") returned -1
	[0052.384] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099170.WMF") returned -1
	[0052.384] lstrcmpiA (lpString1="", lpString2="J0099170.WMF") returned -1
	[0052.384] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned="J0099169.WMF"
	[0052.384] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.384] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.384] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.384] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.385] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099170.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF"
	[0052.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.zip") returned 0
	[0052.385] lstrlenA (lpString="*.zip") returned 5
	[0052.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.rar") returned 0
	[0052.385] lstrlenA (lpString="*.rar") returned 5
	[0052.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.7z") returned 0
	[0052.385] lstrlenA (lpString="*.7z") returned 4
	[0052.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.tar") returned 0
	[0052.385] lstrlenA (lpString="*.tar") returned 5
	[0052.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.gzip") returned 0
	[0052.385] lstrlenA (lpString="*.gzip") returned 6
	[0052.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.jpg") returned 0
	[0052.385] lstrlenA (lpString="*.jpg") returned 5
	[0052.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.jpeg") returned 0
	[0052.385] lstrlenA (lpString="*.jpeg") returned 6
	[0052.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.bmp") returned 0
	[0052.385] lstrlenA (lpString="*.bmp") returned 5
	[0052.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.gif") returned 0
	[0052.385] lstrlenA (lpString="*.gif") returned 5
	[0052.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.png") returned 0
	[0052.385] lstrlenA (lpString="*.png") returned 5
	[0052.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.doc") returned 0
	[0052.385] lstrlenA (lpString="*.doc") returned 5
	[0052.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.docx") returned 0
	[0052.385] lstrlenA (lpString="*.docx") returned 6
	[0052.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.xls") returned 0
	[0052.385] lstrlenA (lpString="*.xls") returned 5
	[0052.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.xlsx") returned 0
	[0052.385] lstrlenA (lpString="*.xlsx") returned 6
	[0052.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.ppt") returned 0
	[0052.385] lstrlenA (lpString="*.ppt") returned 5
	[0052.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.pptx") returned 0
	[0052.385] lstrlenA (lpString="*.pptx") returned 6
	[0052.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.txt") returned 0
	[0052.386] lstrlenA (lpString="*.txt") returned 5
	[0052.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.pdf") returned 0
	[0052.386] lstrlenA (lpString="*.pdf") returned 5
	[0052.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.htm") returned 0
	[0052.386] lstrlenA (lpString="*.htm") returned 5
	[0052.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.html") returned 0
	[0052.386] lstrlenA (lpString="*.html") returned 6
	[0052.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.mdb") returned 0
	[0052.386] lstrlenA (lpString="*.mdb") returned 5
	[0052.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.pfx") returned 0
	[0052.386] lstrlenA (lpString="*.pfx") returned 5
	[0052.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.md") returned 0
	[0052.386] lstrlenA (lpString="*.md") returned 4
	[0052.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.lnk") returned 0
	[0052.386] lstrlenA (lpString="*.lnk") returned 5
	[0052.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.torrent") returned 0
	[0052.386] lstrlenA (lpString="*.torrent") returned 9
	[0052.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.mov") returned 0
	[0052.386] lstrlenA (lpString="*.mov") returned 5
	[0052.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.3gp") returned 0
	[0052.386] lstrlenA (lpString="*.3gp") returned 5
	[0052.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.mpeg") returned 0
	[0052.386] lstrlenA (lpString="*.mpeg") returned 6
	[0052.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.mpg") returned 0
	[0052.386] lstrlenA (lpString="*.mpg") returned 5
	[0052.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.flv") returned 0
	[0052.386] lstrlenA (lpString="*.flv") returned 5
	[0052.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.avi") returned 0
	[0052.386] lstrlenA (lpString="*.avi") returned 5
	[0052.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.mp4") returned 0
	[0052.386] lstrlenA (lpString="*.mp4") returned 5
	[0052.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.wmv") returned 0
	[0052.386] lstrlenA (lpString="*.wmv") returned 5
	[0052.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.mkv") returned 0
	[0052.386] lstrlenA (lpString="*.mkv") returned 5
	[0052.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.mp3") returned 0
	[0052.387] lstrlenA (lpString="*.mp3") returned 5
	[0052.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.wav") returned 0
	[0052.387] lstrlenA (lpString="*.wav") returned 5
	[0052.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.flac") returned 0
	[0052.387] lstrlenA (lpString="*.flac") returned 6
	[0052.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.wma") returned 0
	[0052.387] lstrlenA (lpString="*.wma") returned 5
	[0052.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.au3") returned 0
	[0052.387] lstrlenA (lpString="*.au3") returned 5
	[0052.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.ahk") returned 0
	[0052.387] lstrlenA (lpString="*.ahk") returned 5
	[0052.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.c") returned 0
	[0052.387] lstrlenA (lpString="*.c") returned 3
	[0052.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.cc") returned 0
	[0052.387] lstrlenA (lpString="*.cc") returned 4
	[0052.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.cpp") returned 0
	[0052.387] lstrlenA (lpString="*.cpp") returned 5
	[0052.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.cxx") returned 0
	[0052.387] lstrlenA (lpString="*.cxx") returned 5
	[0052.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.c++") returned 0
	[0052.387] lstrlenA (lpString="*.c++") returned 5
	[0052.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.cs") returned 0
	[0052.387] lstrlenA (lpString="*.cs") returned 4
	[0052.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.vb") returned 0
	[0052.388] lstrlenA (lpString="*.vb") returned 4
	[0052.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.bas") returned 0
	[0052.388] lstrlenA (lpString="*.bas") returned 5
	[0052.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.csproj") returned 0
	[0052.388] lstrlenA (lpString="*.csproj") returned 8
	[0052.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.vbproj") returned 0
	[0052.388] lstrlenA (lpString="*.vbproj") returned 8
	[0052.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.vcxproj") returned 0
	[0052.388] lstrlenA (lpString="*.vcxproj") returned 9
	[0052.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.manifest") returned 0
	[0052.388] lstrlenA (lpString="*.manifest") returned 10
	[0052.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.php") returned 0
	[0052.388] lstrlenA (lpString="*.php") returned 5
	[0052.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.vbe") returned 0
	[0052.388] lstrlenA (lpString="*.vbe") returned 5
	[0052.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.vba") returned 0
	[0052.388] lstrlenA (lpString="*.vba") returned 5
	[0052.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.vbs") returned 0
	[0052.388] lstrlenA (lpString="*.vbs") returned 5
	[0052.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.bat") returned 0
	[0052.388] lstrlenA (lpString="*.bat") returned 5
	[0052.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.cmd") returned 0
	[0052.388] lstrlenA (lpString="*.cmd") returned 5
	[0052.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.js") returned 0
	[0052.388] lstrlenA (lpString="*.js") returned 4
	[0052.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.jscript") returned 0
	[0052.388] lstrlenA (lpString="*.jscript") returned 9
	[0052.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.hta") returned 0
	[0052.388] lstrlenA (lpString="*.hta") returned 5
	[0052.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.php7") returned 0
	[0052.388] lstrlenA (lpString="*.php7") returned 6
	[0052.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.db") returned 0
	[0052.388] lstrlenA (lpString="*.db") returned 4
	[0052.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.swf") returned 0
	[0052.388] lstrlenA (lpString="*.swf") returned 5
	[0052.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.eml") returned 0
	[0052.389] lstrlenA (lpString="*.eml") returned 5
	[0052.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.part") returned 0
	[0052.389] lstrlenA (lpString="*.part") returned 6
	[0052.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.nfo") returned 0
	[0052.389] lstrlenA (lpString="*.nfo") returned 5
	[0052.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.rsa") returned 0
	[0052.389] lstrlenA (lpString="*.rsa") returned 5
	[0052.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.key") returned 0
	[0052.389] lstrlenA (lpString="*.key") returned 5
	[0052.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.aes") returned 0
	[0052.389] lstrlenA (lpString="*.aes") returned 5
	[0052.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.blob") returned 0
	[0052.389] lstrlenA (lpString="*.blob") returned 6
	[0052.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.btc") returned 0
	[0052.389] lstrlenA (lpString="*.btc") returned 5
	[0052.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF", pszSpec="*.wallet") returned 0
	[0052.389] lstrlenA (lpString="*.wallet") returned 8
	[0052.389] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe081920, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe081920, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe0a7b88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2232, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099171.WMF", cAlternateFileName="")) returned 1
	[0052.389] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.389] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099171.WMF") returned -1
	[0052.389] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099171.WMF") returned -1
	[0052.389] lstrcmpiA (lpString1="", lpString2="J0099171.WMF") returned -1
	[0052.389] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned="J0099170.WMF"
	[0052.389] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.389] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.389] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.389] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.389] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099171.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF"
	[0052.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.zip") returned 0
	[0052.389] lstrlenA (lpString="*.zip") returned 5
	[0052.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.rar") returned 0
	[0052.390] lstrlenA (lpString="*.rar") returned 5
	[0052.390] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.7z") returned 0
	[0052.390] lstrlenA (lpString="*.7z") returned 4
	[0052.390] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.tar") returned 0
	[0052.390] lstrlenA (lpString="*.tar") returned 5
	[0052.390] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.gzip") returned 0
	[0052.390] lstrlenA (lpString="*.gzip") returned 6
	[0052.390] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.jpg") returned 0
	[0052.390] lstrlenA (lpString="*.jpg") returned 5
	[0052.390] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.jpeg") returned 0
	[0052.390] lstrlenA (lpString="*.jpeg") returned 6
	[0052.390] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.bmp") returned 0
	[0052.390] lstrlenA (lpString="*.bmp") returned 5
	[0052.390] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.gif") returned 0
	[0052.390] lstrlenA (lpString="*.gif") returned 5
	[0052.390] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.png") returned 0
	[0052.390] lstrlenA (lpString="*.png") returned 5
	[0052.390] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.doc") returned 0
	[0052.390] lstrlenA (lpString="*.doc") returned 5
	[0052.390] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.docx") returned 0
	[0052.390] lstrlenA (lpString="*.docx") returned 6
	[0052.390] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.xls") returned 0
	[0052.390] lstrlenA (lpString="*.xls") returned 5
	[0052.390] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.xlsx") returned 0
	[0052.390] lstrlenA (lpString="*.xlsx") returned 6
	[0052.390] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.ppt") returned 0
	[0052.390] lstrlenA (lpString="*.ppt") returned 5
	[0052.390] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.pptx") returned 0
	[0052.390] lstrlenA (lpString="*.pptx") returned 6
	[0052.390] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.txt") returned 0
	[0052.390] lstrlenA (lpString="*.txt") returned 5
	[0052.390] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.pdf") returned 0
	[0052.390] lstrlenA (lpString="*.pdf") returned 5
	[0052.390] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.htm") returned 0
	[0052.390] lstrlenA (lpString="*.htm") returned 5
	[0052.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.html") returned 0
	[0052.391] lstrlenA (lpString="*.html") returned 6
	[0052.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.mdb") returned 0
	[0052.391] lstrlenA (lpString="*.mdb") returned 5
	[0052.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.pfx") returned 0
	[0052.391] lstrlenA (lpString="*.pfx") returned 5
	[0052.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.md") returned 0
	[0052.391] lstrlenA (lpString="*.md") returned 4
	[0052.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.lnk") returned 0
	[0052.391] lstrlenA (lpString="*.lnk") returned 5
	[0052.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.torrent") returned 0
	[0052.391] lstrlenA (lpString="*.torrent") returned 9
	[0052.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.mov") returned 0
	[0052.391] lstrlenA (lpString="*.mov") returned 5
	[0052.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.3gp") returned 0
	[0052.391] lstrlenA (lpString="*.3gp") returned 5
	[0052.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.mpeg") returned 0
	[0052.391] lstrlenA (lpString="*.mpeg") returned 6
	[0052.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.mpg") returned 0
	[0052.391] lstrlenA (lpString="*.mpg") returned 5
	[0052.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.flv") returned 0
	[0052.391] lstrlenA (lpString="*.flv") returned 5
	[0052.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.avi") returned 0
	[0052.391] lstrlenA (lpString="*.avi") returned 5
	[0052.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.mp4") returned 0
	[0052.391] lstrlenA (lpString="*.mp4") returned 5
	[0052.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.wmv") returned 0
	[0052.391] lstrlenA (lpString="*.wmv") returned 5
	[0052.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.mkv") returned 0
	[0052.391] lstrlenA (lpString="*.mkv") returned 5
	[0052.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.mp3") returned 0
	[0052.391] lstrlenA (lpString="*.mp3") returned 5
	[0052.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.wav") returned 0
	[0052.391] lstrlenA (lpString="*.wav") returned 5
	[0052.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.flac") returned 0
	[0052.392] lstrlenA (lpString="*.flac") returned 6
	[0052.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.wma") returned 0
	[0052.392] lstrlenA (lpString="*.wma") returned 5
	[0052.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.au3") returned 0
	[0052.392] lstrlenA (lpString="*.au3") returned 5
	[0052.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.ahk") returned 0
	[0052.392] lstrlenA (lpString="*.ahk") returned 5
	[0052.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.c") returned 0
	[0052.392] lstrlenA (lpString="*.c") returned 3
	[0052.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.cc") returned 0
	[0052.392] lstrlenA (lpString="*.cc") returned 4
	[0052.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.cpp") returned 0
	[0052.392] lstrlenA (lpString="*.cpp") returned 5
	[0052.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.cxx") returned 0
	[0052.392] lstrlenA (lpString="*.cxx") returned 5
	[0052.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.c++") returned 0
	[0052.392] lstrlenA (lpString="*.c++") returned 5
	[0052.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.cs") returned 0
	[0052.392] lstrlenA (lpString="*.cs") returned 4
	[0052.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.vb") returned 0
	[0052.392] lstrlenA (lpString="*.vb") returned 4
	[0052.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.bas") returned 0
	[0052.392] lstrlenA (lpString="*.bas") returned 5
	[0052.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.csproj") returned 0
	[0052.392] lstrlenA (lpString="*.csproj") returned 8
	[0052.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.vbproj") returned 0
	[0052.392] lstrlenA (lpString="*.vbproj") returned 8
	[0052.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.vcxproj") returned 0
	[0052.392] lstrlenA (lpString="*.vcxproj") returned 9
	[0052.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.manifest") returned 0
	[0052.392] lstrlenA (lpString="*.manifest") returned 10
	[0052.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.php") returned 0
	[0052.392] lstrlenA (lpString="*.php") returned 5
	[0052.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.vbe") returned 0
	[0052.393] lstrlenA (lpString="*.vbe") returned 5
	[0052.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.vba") returned 0
	[0052.393] lstrlenA (lpString="*.vba") returned 5
	[0052.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.vbs") returned 0
	[0052.393] lstrlenA (lpString="*.vbs") returned 5
	[0052.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.bat") returned 0
	[0052.393] lstrlenA (lpString="*.bat") returned 5
	[0052.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.cmd") returned 0
	[0052.393] lstrlenA (lpString="*.cmd") returned 5
	[0052.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.js") returned 0
	[0052.393] lstrlenA (lpString="*.js") returned 4
	[0052.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.jscript") returned 0
	[0052.393] lstrlenA (lpString="*.jscript") returned 9
	[0052.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.hta") returned 0
	[0052.393] lstrlenA (lpString="*.hta") returned 5
	[0052.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.php7") returned 0
	[0052.393] lstrlenA (lpString="*.php7") returned 6
	[0052.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.db") returned 0
	[0052.393] lstrlenA (lpString="*.db") returned 4
	[0052.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.swf") returned 0
	[0052.393] lstrlenA (lpString="*.swf") returned 5
	[0052.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.eml") returned 0
	[0052.393] lstrlenA (lpString="*.eml") returned 5
	[0052.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.part") returned 0
	[0052.393] lstrlenA (lpString="*.part") returned 6
	[0052.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.nfo") returned 0
	[0052.393] lstrlenA (lpString="*.nfo") returned 5
	[0052.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.rsa") returned 0
	[0052.393] lstrlenA (lpString="*.rsa") returned 5
	[0052.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.key") returned 0
	[0052.393] lstrlenA (lpString="*.key") returned 5
	[0052.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.aes") returned 0
	[0052.393] lstrlenA (lpString="*.aes") returned 5
	[0052.394] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.blob") returned 0
	[0052.394] lstrlenA (lpString="*.blob") returned 6
	[0052.394] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.btc") returned 0
	[0052.394] lstrlenA (lpString="*.btc") returned 5
	[0052.394] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF", pszSpec="*.wallet") returned 0
	[0052.394] lstrlenA (lpString="*.wallet") returned 8
	[0052.394] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe081920, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe081920, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe081920, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe392, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099172.WMF", cAlternateFileName="")) returned 1
	[0052.394] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.394] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099172.WMF") returned -1
	[0052.394] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099172.WMF") returned -1
	[0052.394] lstrcmpiA (lpString1="", lpString2="J0099172.WMF") returned -1
	[0052.394] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned="J0099171.WMF"
	[0052.394] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.394] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.394] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.394] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.394] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099172.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF"
	[0052.394] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF", pszSpec="*.zip") returned 0
	[0052.394] lstrlenA (lpString="*.zip") returned 5
	[0052.394] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF", pszSpec="*.rar") returned 0
	[0052.394] lstrlenA (lpString="*.rar") returned 5
	[0052.394] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF", pszSpec="*.7z") returned 0
	[0052.394] lstrlenA (lpString="*.7z") returned 4
	[0052.394] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF", pszSpec="*.tar") returned 0
	[0052.394] lstrlenA (lpString="*.tar") returned 5
	[0052.394] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF", pszSpec="*.gzip") returned 0
	[0052.394] lstrlenA (lpString="*.gzip") returned 6
	[0052.394] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF", pszSpec="*.jpg") returned 0
	[0052.394] lstrlenA (lpString="*.jpg") returned 5
	[0052.394] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF", pszSpec="*.jpeg") returned 0
	[0052.394] lstrlenA (lpString="*.jpeg") returned 6
	[0052.394] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF", pszSpec="*.bmp") returned 0
	[0052.395] lstrlenA (lpString="*.bmp") returned 5
	[0052.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF", pszSpec="*.gif") returned 0
	[0052.395] lstrlenA (lpString="*.gif") returned 5
	[0052.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF", pszSpec="*.png") returned 0
	[0052.395] lstrlenA (lpString="*.png") returned 5
	[0052.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF", pszSpec="*.doc") returned 0
	[0052.395] lstrlenA (lpString="*.doc") returned 5
	[0052.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF", pszSpec="*.docx") returned 0
	[0052.395] lstrlenA (lpString="*.docx") returned 6
	[0052.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF", pszSpec="*.xls") returned 0
	[0052.395] lstrlenA (lpString="*.xls") returned 5
	[0052.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF", pszSpec="*.xlsx") returned 0
	[0052.395] lstrlenA (lpString="*.xlsx") returned 6
	[0052.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF", pszSpec="*.ppt") returned 0
	[0052.395] lstrlenA (lpString="*.ppt") returned 5
	[0052.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF", pszSpec="*.pptx") returned 0
	[0052.395] lstrlenA (lpString="*.pptx") returned 6
	[0052.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF", pszSpec="*.txt") returned 0
	[0052.395] lstrlenA (lpString="*.txt") returned 5
	[0052.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF", pszSpec="*.pdf") returned 0
	[0052.395] lstrlenA (lpString="*.pdf") returned 5
	[0052.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF", pszSpec="*.htm") returned 0
	[0052.395] lstrlenA (lpString="*.htm") returned 5
	[0052.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF", pszSpec="*.html") returned 0
	[0052.395] lstrlenA (lpString="*.html") returned 6
	[0052.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF", pszSpec="*.mdb") returned 0
	[0052.395] lstrlenA (lpString="*.mdb") returned 5
	[0052.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF", pszSpec="*.pfx") returned 0
	[0052.395] lstrlenA (lpString="*.pfx") returned 5
	[0052.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF", pszSpec="*.md") returned 0
	[0052.395] lstrlenA (lpString="*.md") returned 4
	[0052.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF", pszSpec="*.lnk") returned 0
	[0052.395] lstrlenA (lpString="*.lnk") returned 5
	[0052.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF", pszSpec="*.torrent") returned 0
	[0052.395] lstrlenA (lpString="*.torrent") returned 9
	[0052.396] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF", pszSpec="*.mov") returned 0
	[0052.396] lstrlenA (lpString="*.mov") returned 5
	[0052.396] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF", pszSpec="*.3gp") returned 0
	[0052.396] lstrlenA (lpString="*.3gp") returned 5
	[0052.396] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF", pszSpec="*.mpeg") returned 0
	[0052.396] lstrlenA (lpString="*.mpeg") returned 6
	[0052.396] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF", pszSpec="*.mpg") returned 0
	[0052.396] lstrlenA (lpString="*.mpg") returned 5
	[0052.396] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF", pszSpec="*.flv") returned 0
	[0052.396] lstrlenA (lpString="*.flv") returned 5
	[0052.396] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe081920, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe081920, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe081920, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9114, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099173.WMF", cAlternateFileName="")) returned 1
	[0052.396] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.396] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099173.WMF") returned -1
	[0052.396] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099173.WMF") returned -1
	[0052.396] lstrcmpiA (lpString1="", lpString2="J0099173.WMF") returned -1
	[0052.396] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned="J0099172.WMF"
	[0052.396] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.396] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.396] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.396] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.396] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099173.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF"
	[0052.397] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe081920, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe081920, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe081920, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1846, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099174.WMF", cAlternateFileName="")) returned 1
	[0052.397] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.397] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099174.WMF") returned -1
	[0052.397] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099174.WMF") returned -1
	[0052.397] lstrcmpiA (lpString1="", lpString2="J0099174.WMF") returned -1
	[0052.397] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned="J0099173.WMF"
	[0052.397] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.397] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.397] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.397] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.397] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099174.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF"
	[0052.397] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe0a7b88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe0a7b88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe0a7b88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2610, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099175.WMF", cAlternateFileName="")) returned 1
	[0052.397] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.397] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099175.WMF") returned -1
	[0052.397] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099175.WMF") returned -1
	[0052.397] lstrcmpiA (lpString1="", lpString2="J0099175.WMF") returned -1
	[0052.397] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned="J0099174.WMF"
	[0052.397] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.397] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.397] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.397] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.397] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099175.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF"
	[0052.397] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe0a7b88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe0a7b88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe0a7b88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099176.WMF", cAlternateFileName="")) returned 1
	[0052.397] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.397] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099176.WMF") returned -1
	[0052.397] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099176.WMF") returned -1
	[0052.397] lstrcmpiA (lpString1="", lpString2="J0099176.WMF") returned -1
	[0052.398] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned="J0099175.WMF"
	[0052.398] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.398] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.398] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.398] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.398] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099176.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF"
	[0052.398] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe0a7b88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe0a7b88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe0a7b88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x150a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099177.WMF", cAlternateFileName="")) returned 1
	[0052.398] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.398] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099177.WMF") returned -1
	[0052.398] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099177.WMF") returned -1
	[0052.398] lstrcmpiA (lpString1="", lpString2="J0099177.WMF") returned -1
	[0052.398] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned="J0099176.WMF"
	[0052.398] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.398] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.398] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.398] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.398] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099177.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF"
	[0052.398] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe0a7b88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe0a7b88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe0a7b88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe16, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099178.WMF", cAlternateFileName="")) returned 1
	[0052.398] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.398] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099178.WMF") returned -1
	[0052.398] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099178.WMF") returned -1
	[0052.398] lstrcmpiA (lpString1="", lpString2="J0099178.WMF") returned -1
	[0052.398] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned="J0099177.WMF"
	[0052.398] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.398] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.398] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.399] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.399] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099178.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF"
	[0052.399] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe0a7b88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe0a7b88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe0a7b88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x23c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099179.WMF", cAlternateFileName="")) returned 1
	[0052.399] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.399] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099179.WMF") returned -1
	[0052.399] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099179.WMF") returned -1
	[0052.399] lstrcmpiA (lpString1="", lpString2="J0099179.WMF") returned -1
	[0052.399] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned="J0099178.WMF"
	[0052.399] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.399] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.399] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.399] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.399] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099179.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF"
	[0052.399] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe0a7b88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe0a7b88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe0a7b88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd42, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099180.WMF", cAlternateFileName="")) returned 1
	[0052.399] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.399] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099180.WMF") returned -1
	[0052.399] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099180.WMF") returned -1
	[0052.399] lstrcmpiA (lpString1="", lpString2="J0099180.WMF") returned -1
	[0052.399] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned="J0099179.WMF"
	[0052.399] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.399] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.399] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.399] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.399] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099180.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF"
	[0052.400] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe0a7b88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe0a7b88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe0a7b88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099181.WMF", cAlternateFileName="")) returned 1
	[0052.400] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.400] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099181.WMF") returned -1
	[0052.400] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099181.WMF") returned -1
	[0052.400] lstrcmpiA (lpString1="", lpString2="J0099181.WMF") returned -1
	[0052.400] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned="J0099180.WMF"
	[0052.400] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.400] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.400] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.400] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.400] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099181.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF"
	[0052.400] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe0a7b88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe0a7b88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe0a7b88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf00, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099182.WMF", cAlternateFileName="")) returned 1
	[0052.401] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.401] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099182.WMF") returned -1
	[0052.401] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099182.WMF") returned -1
	[0052.401] lstrcmpiA (lpString1="", lpString2="J0099182.WMF") returned -1
	[0052.401] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned="J0099181.WMF"
	[0052.401] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.401] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.401] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.401] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.401] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099182.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF"
	[0052.401] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe0a7b88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe0a7b88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe0a7b88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1352, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099183.WMF", cAlternateFileName="")) returned 1
	[0052.401] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.401] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099183.WMF") returned -1
	[0052.401] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099183.WMF") returned -1
	[0052.401] lstrcmpiA (lpString1="", lpString2="J0099183.WMF") returned -1
	[0052.401] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned="J0099182.WMF"
	[0052.401] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.401] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.401] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.401] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.401] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099183.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF"
	[0052.402] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe0a7b88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe0a7b88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe0a7b88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1016, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099184.WMF", cAlternateFileName="")) returned 1
	[0052.402] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.402] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099184.WMF") returned -1
	[0052.402] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099184.WMF") returned -1
	[0052.402] lstrcmpiA (lpString1="", lpString2="J0099184.WMF") returned -1
	[0052.402] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned="J0099183.WMF"
	[0052.402] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.402] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.402] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.402] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.402] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099184.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF"
	[0052.402] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe56c811, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe56c811, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe59294b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xcd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099185.JPG", cAlternateFileName="")) returned 1
	[0052.402] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.402] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099185.JPG") returned -1
	[0052.402] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099185.JPG") returned -1
	[0052.402] lstrcmpiA (lpString1="", lpString2="J0099185.JPG") returned -1
	[0052.402] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned="J0099184.WMF"
	[0052.402] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.402] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.402] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.402] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.402] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099185.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG"
	[0052.402] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG"
	[0052.402] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG"
	[0052.402] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG."
	[0052.402] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.exe"
	[0052.402] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0052.403] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcd2
	[0052.403] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe56c811, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe56c811, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe59294b, dwHighDateTime=0x1d327e8)) returned 1
	[0052.404] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.404] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xc90, lpOverlapped=0x0) returned 1
	[0052.405] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned="J0099185.JPG"
	[0052.405] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.405] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xc90, lpOverlapped=0x0) returned 1
	[0052.405] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.405] CloseHandle (hObject=0x214) returned 1
	[0052.406] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg.exe")) returned 1
	[0052.407] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe56c811, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe56c811, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe56c811, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099186.JPG", cAlternateFileName="")) returned 1
	[0052.407] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.407] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099186.JPG") returned -1
	[0052.407] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099186.JPG") returned -1
	[0052.407] lstrcmpiA (lpString1="", lpString2="J0099186.JPG") returned -1
	[0052.407] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned="J0099185.JPG"
	[0052.407] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.407] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.407] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.407] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.407] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099186.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG"
	[0052.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG", pszSpec="*.zip") returned 0
	[0052.407] lstrlenA (lpString="*.zip") returned 5
	[0052.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG", pszSpec="*.rar") returned 0
	[0052.407] lstrlenA (lpString="*.rar") returned 5
	[0052.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG", pszSpec="*.7z") returned 0
	[0052.407] lstrlenA (lpString="*.7z") returned 4
	[0052.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG", pszSpec="*.tar") returned 0
	[0052.407] lstrlenA (lpString="*.tar") returned 5
	[0052.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG", pszSpec="*.gzip") returned 0
	[0052.407] lstrlenA (lpString="*.gzip") returned 6
	[0052.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG", pszSpec="*.jpg") returned 1
	[0052.408] lstrlenA (lpString="*.jpg") returned 5
	[0052.408] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG"
	[0052.408] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG"
	[0052.408] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG."
	[0052.408] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.exe"
	[0052.408] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0052.408] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4162
	[0052.408] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe56c811, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe56c811, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe56c811, dwHighDateTime=0x1d327e8)) returned 1
	[0052.408] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.408] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x4120, lpOverlapped=0x0) returned 1
	[0052.455] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned="J0099186.JPG"
	[0052.455] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.455] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x4120, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x4120, lpOverlapped=0x0) returned 1
	[0052.455] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.456] CloseHandle (hObject=0x214) returned 1
	[0052.458] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg.exe")) returned 1
	[0052.459] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe18c9a5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe18c9a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe56c811, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5fd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099187.JPG", cAlternateFileName="")) returned 1
	[0052.459] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.459] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099187.JPG") returned -1
	[0052.459] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099187.JPG") returned -1
	[0052.459] lstrcmpiA (lpString1="", lpString2="J0099187.JPG") returned -1
	[0052.459] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned="J0099186.JPG"
	[0052.459] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.459] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.459] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.459] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.459] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099187.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG"
	[0052.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG", pszSpec="*.zip") returned 0
	[0052.459] lstrlenA (lpString="*.zip") returned 5
	[0052.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG", pszSpec="*.rar") returned 0
	[0052.460] lstrlenA (lpString="*.rar") returned 5
	[0052.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG", pszSpec="*.7z") returned 0
	[0052.460] lstrlenA (lpString="*.7z") returned 4
	[0052.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG", pszSpec="*.tar") returned 0
	[0052.460] lstrlenA (lpString="*.tar") returned 5
	[0052.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG", pszSpec="*.gzip") returned 0
	[0052.460] lstrlenA (lpString="*.gzip") returned 6
	[0052.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG", pszSpec="*.jpg") returned 1
	[0052.460] lstrlenA (lpString="*.jpg") returned 5
	[0052.460] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG"
	[0052.460] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG"
	[0052.460] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG."
	[0052.460] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.exe"
	[0052.460] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0052.461] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5fd0
	[0052.461] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe18c9a5, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe18c9a5, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe56c811, dwHighDateTime=0x1d327e8)) returned 1
	[0052.461] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.461] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x5f8e, lpOverlapped=0x0) returned 1
	[0052.462] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned="J0099187.JPG"
	[0052.463] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.463] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x5f8e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x5f8e, lpOverlapped=0x0) returned 1
	[0052.463] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.463] CloseHandle (hObject=0x214) returned 1
	[0052.465] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg.exe")) returned 1
	[0052.466] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe18c9a5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe18c9a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe56c811, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2378, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099188.JPG", cAlternateFileName="")) returned 1
	[0052.466] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.466] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099188.JPG") returned -1
	[0052.466] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099188.JPG") returned -1
	[0052.466] lstrcmpiA (lpString1="", lpString2="J0099188.JPG") returned -1
	[0052.466] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned="J0099187.JPG"
	[0052.466] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.466] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.466] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.466] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.466] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099188.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG"
	[0052.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG", pszSpec="*.zip") returned 0
	[0052.466] lstrlenA (lpString="*.zip") returned 5
	[0052.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG", pszSpec="*.rar") returned 0
	[0052.466] lstrlenA (lpString="*.rar") returned 5
	[0052.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG", pszSpec="*.7z") returned 0
	[0052.467] lstrlenA (lpString="*.7z") returned 4
	[0052.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG", pszSpec="*.tar") returned 0
	[0052.467] lstrlenA (lpString="*.tar") returned 5
	[0052.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG", pszSpec="*.gzip") returned 0
	[0052.467] lstrlenA (lpString="*.gzip") returned 6
	[0052.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG", pszSpec="*.jpg") returned 1
	[0052.467] lstrlenA (lpString="*.jpg") returned 5
	[0052.467] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG"
	[0052.467] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG"
	[0052.467] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG."
	[0052.467] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.exe"
	[0052.467] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0052.467] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2378
	[0052.467] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe18c9a5, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe18c9a5, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe56c811, dwHighDateTime=0x1d327e8)) returned 1
	[0052.467] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.467] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x2336, lpOverlapped=0x0) returned 1
	[0052.469] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned="J0099188.JPG"
	[0052.469] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.469] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x2336, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x2336, lpOverlapped=0x0) returned 1
	[0052.469] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.469] CloseHandle (hObject=0x214) returned 1
	[0052.470] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg.exe")) returned 1
	[0052.471] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe0a7b88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe0a7b88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe18c9a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099189.JPG", cAlternateFileName="")) returned 1
	[0052.471] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.471] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099189.JPG") returned -1
	[0052.471] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099189.JPG") returned -1
	[0052.471] lstrcmpiA (lpString1="", lpString2="J0099189.JPG") returned -1
	[0052.471] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned="J0099188.JPG"
	[0052.471] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.471] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.471] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.471] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.471] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099189.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG"
	[0052.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG", pszSpec="*.zip") returned 0
	[0052.471] lstrlenA (lpString="*.zip") returned 5
	[0052.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG", pszSpec="*.rar") returned 0
	[0052.471] lstrlenA (lpString="*.rar") returned 5
	[0052.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG", pszSpec="*.7z") returned 0
	[0052.471] lstrlenA (lpString="*.7z") returned 4
	[0052.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG", pszSpec="*.tar") returned 0
	[0052.471] lstrlenA (lpString="*.tar") returned 5
	[0052.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG", pszSpec="*.gzip") returned 0
	[0052.471] lstrlenA (lpString="*.gzip") returned 6
	[0052.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG", pszSpec="*.jpg") returned 1
	[0052.471] lstrlenA (lpString="*.jpg") returned 5
	[0052.471] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG"
	[0052.471] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG"
	[0052.471] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG."
	[0052.471] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.exe"
	[0052.472] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0052.472] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f8c
	[0052.472] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe0a7b88, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe0a7b88, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe18c9a5, dwHighDateTime=0x1d327e8)) returned 1
	[0052.472] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.472] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1f4a, lpOverlapped=0x0) returned 1
	[0052.473] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned="J0099189.JPG"
	[0052.473] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.473] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1f4a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1f4a, lpOverlapped=0x0) returned 1
	[0052.473] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.474] CloseHandle (hObject=0x214) returned 1
	[0052.475] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg.exe")) returned 1
	[0052.476] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe0a7b88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe0a7b88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe0a7b88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xab74, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099190.JPG", cAlternateFileName="")) returned 1
	[0052.476] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.476] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099190.JPG") returned -1
	[0052.476] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099190.JPG") returned -1
	[0052.476] lstrcmpiA (lpString1="", lpString2="J0099190.JPG") returned -1
	[0052.476] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned="J0099189.JPG"
	[0052.476] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.476] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.476] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.476] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.476] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099190.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG"
	[0052.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG", pszSpec="*.zip") returned 0
	[0052.476] lstrlenA (lpString="*.zip") returned 5
	[0052.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG", pszSpec="*.rar") returned 0
	[0052.476] lstrlenA (lpString="*.rar") returned 5
	[0052.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG", pszSpec="*.7z") returned 0
	[0052.476] lstrlenA (lpString="*.7z") returned 4
	[0052.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG", pszSpec="*.tar") returned 0
	[0052.476] lstrlenA (lpString="*.tar") returned 5
	[0052.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG", pszSpec="*.gzip") returned 0
	[0052.477] lstrlenA (lpString="*.gzip") returned 6
	[0052.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG", pszSpec="*.jpg") returned 1
	[0052.477] lstrlenA (lpString="*.jpg") returned 5
	[0052.477] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG"
	[0052.477] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG"
	[0052.477] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG."
	[0052.477] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.exe"
	[0052.477] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0052.477] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xab74
	[0052.477] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe0a7b88, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe0a7b88, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe0a7b88, dwHighDateTime=0x1d327e8)) returned 1
	[0052.478] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.478] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xab32, lpOverlapped=0x0) returned 1
	[0052.479] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned="J0099190.JPG"
	[0052.479] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.479] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xab32, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xab32, lpOverlapped=0x0) returned 1
	[0052.480] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.480] CloseHandle (hObject=0x214) returned 1
	[0052.481] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg.exe")) returned 1
	[0052.483] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe0a7b88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe0a7b88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe56c811, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf39f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099191.JPG", cAlternateFileName="")) returned 1
	[0052.483] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.483] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099191.JPG") returned -1
	[0052.483] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099191.JPG") returned -1
	[0052.483] lstrcmpiA (lpString1="", lpString2="J0099191.JPG") returned -1
	[0052.483] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned="J0099190.JPG"
	[0052.483] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.483] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.483] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.483] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.483] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099191.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG"
	[0052.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG", pszSpec="*.zip") returned 0
	[0052.483] lstrlenA (lpString="*.zip") returned 5
	[0052.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG", pszSpec="*.rar") returned 0
	[0052.483] lstrlenA (lpString="*.rar") returned 5
	[0052.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG", pszSpec="*.7z") returned 0
	[0052.483] lstrlenA (lpString="*.7z") returned 4
	[0052.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG", pszSpec="*.tar") returned 0
	[0052.483] lstrlenA (lpString="*.tar") returned 5
	[0052.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG", pszSpec="*.gzip") returned 0
	[0052.484] lstrlenA (lpString="*.gzip") returned 6
	[0052.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG", pszSpec="*.jpg") returned 1
	[0052.484] lstrlenA (lpString="*.jpg") returned 5
	[0052.484] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG"
	[0052.484] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG"
	[0052.484] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG."
	[0052.484] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.exe"
	[0052.484] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0052.484] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf39f
	[0052.484] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe0a7b88, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe0a7b88, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe56c811, dwHighDateTime=0x1d327e8)) returned 1
	[0052.484] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.484] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xf35d, lpOverlapped=0x0) returned 1
	[0052.486] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned="J0099191.JPG"
	[0052.487] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.487] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xf35d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xf35d, lpOverlapped=0x0) returned 1
	[0052.487] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.487] CloseHandle (hObject=0x214) returned 1
	[0052.489] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg.exe")) returned 1
	[0052.529] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe0a7b88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe0a7b88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe56c811, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x462c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099192.GIF", cAlternateFileName="")) returned 1
	[0052.529] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.529] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099192.GIF") returned -1
	[0052.529] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099192.GIF") returned -1
	[0052.529] lstrcmpiA (lpString1="", lpString2="J0099192.GIF") returned -1
	[0052.529] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned="J0099191.JPG"
	[0052.530] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.530] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.530] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.530] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.530] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099192.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF"
	[0052.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF", pszSpec="*.zip") returned 0
	[0052.530] lstrlenA (lpString="*.zip") returned 5
	[0052.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF", pszSpec="*.rar") returned 0
	[0052.530] lstrlenA (lpString="*.rar") returned 5
	[0052.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF", pszSpec="*.7z") returned 0
	[0052.530] lstrlenA (lpString="*.7z") returned 4
	[0052.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF", pszSpec="*.tar") returned 0
	[0052.530] lstrlenA (lpString="*.tar") returned 5
	[0052.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF", pszSpec="*.gzip") returned 0
	[0052.530] lstrlenA (lpString="*.gzip") returned 6
	[0052.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF", pszSpec="*.jpg") returned 0
	[0052.530] lstrlenA (lpString="*.jpg") returned 5
	[0052.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF", pszSpec="*.jpeg") returned 0
	[0052.530] lstrlenA (lpString="*.jpeg") returned 6
	[0052.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF", pszSpec="*.bmp") returned 0
	[0052.530] lstrlenA (lpString="*.bmp") returned 5
	[0052.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF", pszSpec="*.gif") returned 1
	[0052.530] lstrlenA (lpString="*.gif") returned 5
	[0052.530] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF"
	[0052.530] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF"
	[0052.530] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF."
	[0052.530] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.exe"
	[0052.530] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0052.531] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x462c
	[0052.531] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe0a7b88, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe0a7b88, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe56c811, dwHighDateTime=0x1d327e8)) returned 1
	[0052.531] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.531] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x45ea, lpOverlapped=0x0) returned 1
	[0052.532] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned="J0099192.GIF"
	[0052.532] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.533] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x45ea, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x45ea, lpOverlapped=0x0) returned 1
	[0052.533] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.533] CloseHandle (hObject=0x214) returned 1
	[0052.534] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif.exe")) returned 1
	[0052.535] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe0a7b88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe0a7b88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe0a7b88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8ada, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099193.GIF", cAlternateFileName="")) returned 1
	[0052.535] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.535] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099193.GIF") returned -1
	[0052.535] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099193.GIF") returned -1
	[0052.535] lstrcmpiA (lpString1="", lpString2="J0099193.GIF") returned -1
	[0052.535] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned="J0099192.GIF"
	[0052.535] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.535] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.535] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.535] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.535] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099193.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF"
	[0052.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF", pszSpec="*.zip") returned 0
	[0052.535] lstrlenA (lpString="*.zip") returned 5
	[0052.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF", pszSpec="*.rar") returned 0
	[0052.535] lstrlenA (lpString="*.rar") returned 5
	[0052.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF", pszSpec="*.7z") returned 0
	[0052.535] lstrlenA (lpString="*.7z") returned 4
	[0052.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF", pszSpec="*.tar") returned 0
	[0052.535] lstrlenA (lpString="*.tar") returned 5
	[0052.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF", pszSpec="*.gzip") returned 0
	[0052.535] lstrlenA (lpString="*.gzip") returned 6
	[0052.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF", pszSpec="*.jpg") returned 0
	[0052.535] lstrlenA (lpString="*.jpg") returned 5
	[0052.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF", pszSpec="*.jpeg") returned 0
	[0052.536] lstrlenA (lpString="*.jpeg") returned 6
	[0052.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF", pszSpec="*.bmp") returned 0
	[0052.536] lstrlenA (lpString="*.bmp") returned 5
	[0052.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF", pszSpec="*.gif") returned 1
	[0052.536] lstrlenA (lpString="*.gif") returned 5
	[0052.536] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF"
	[0052.536] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF"
	[0052.536] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF."
	[0052.536] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.exe"
	[0052.536] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0052.536] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8ada
	[0052.536] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe0a7b88, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe0a7b88, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe0a7b88, dwHighDateTime=0x1d327e8)) returned 1
	[0052.536] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.536] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x8a98, lpOverlapped=0x0) returned 1
	[0052.538] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned="J0099193.GIF"
	[0052.538] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.538] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x8a98, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x8a98, lpOverlapped=0x0) returned 1
	[0052.538] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.538] CloseHandle (hObject=0x214) returned 1
	[0052.540] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif.exe")) returned 1
	[0052.540] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe0a7b88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe0a7b88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe18c9a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x62b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099194.GIF", cAlternateFileName="")) returned 1
	[0052.540] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.540] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099194.GIF") returned -1
	[0052.540] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099194.GIF") returned -1
	[0052.540] lstrcmpiA (lpString1="", lpString2="J0099194.GIF") returned -1
	[0052.540] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned="J0099193.GIF"
	[0052.540] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.540] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.540] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.540] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.541] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099194.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF"
	[0052.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF", pszSpec="*.zip") returned 0
	[0052.541] lstrlenA (lpString="*.zip") returned 5
	[0052.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF", pszSpec="*.rar") returned 0
	[0052.541] lstrlenA (lpString="*.rar") returned 5
	[0052.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF", pszSpec="*.7z") returned 0
	[0052.541] lstrlenA (lpString="*.7z") returned 4
	[0052.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF", pszSpec="*.tar") returned 0
	[0052.541] lstrlenA (lpString="*.tar") returned 5
	[0052.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF", pszSpec="*.gzip") returned 0
	[0052.541] lstrlenA (lpString="*.gzip") returned 6
	[0052.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF", pszSpec="*.jpg") returned 0
	[0052.541] lstrlenA (lpString="*.jpg") returned 5
	[0052.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF", pszSpec="*.jpeg") returned 0
	[0052.541] lstrlenA (lpString="*.jpeg") returned 6
	[0052.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF", pszSpec="*.bmp") returned 0
	[0052.541] lstrlenA (lpString="*.bmp") returned 5
	[0052.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF", pszSpec="*.gif") returned 1
	[0052.541] lstrlenA (lpString="*.gif") returned 5
	[0052.541] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF"
	[0052.541] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF"
	[0052.541] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF."
	[0052.541] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.exe"
	[0052.541] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0052.541] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x62b1
	[0052.542] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe0a7b88, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe0a7b88, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe18c9a5, dwHighDateTime=0x1d327e8)) returned 1
	[0052.542] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.542] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x626f, lpOverlapped=0x0) returned 1
	[0052.543] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned="J0099194.GIF"
	[0052.543] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.543] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x626f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x626f, lpOverlapped=0x0) returned 1
	[0052.544] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.544] CloseHandle (hObject=0x214) returned 1
	[0052.545] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif.exe")) returned 1
	[0052.545] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe59294b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe59294b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe5dee50, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4dd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099195.GIF", cAlternateFileName="")) returned 1
	[0052.545] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.545] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099195.GIF") returned -1
	[0052.546] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099195.GIF") returned -1
	[0052.546] lstrcmpiA (lpString1="", lpString2="J0099195.GIF") returned -1
	[0052.546] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned="J0099194.GIF"
	[0052.546] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.546] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.546] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.546] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.546] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099195.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF"
	[0052.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF", pszSpec="*.zip") returned 0
	[0052.546] lstrlenA (lpString="*.zip") returned 5
	[0052.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF", pszSpec="*.rar") returned 0
	[0052.546] lstrlenA (lpString="*.rar") returned 5
	[0052.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF", pszSpec="*.7z") returned 0
	[0052.546] lstrlenA (lpString="*.7z") returned 4
	[0052.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF", pszSpec="*.tar") returned 0
	[0052.546] lstrlenA (lpString="*.tar") returned 5
	[0052.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF", pszSpec="*.gzip") returned 0
	[0052.546] lstrlenA (lpString="*.gzip") returned 6
	[0052.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF", pszSpec="*.jpg") returned 0
	[0052.546] lstrlenA (lpString="*.jpg") returned 5
	[0052.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF", pszSpec="*.jpeg") returned 0
	[0052.546] lstrlenA (lpString="*.jpeg") returned 6
	[0052.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF", pszSpec="*.bmp") returned 0
	[0052.546] lstrlenA (lpString="*.bmp") returned 5
	[0052.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF", pszSpec="*.gif") returned 1
	[0052.546] lstrlenA (lpString="*.gif") returned 5
	[0052.546] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF"
	[0052.546] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF"
	[0052.546] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF."
	[0052.547] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.exe"
	[0052.547] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0052.547] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4dd3
	[0052.547] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe59294b, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe59294b, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe5dee50, dwHighDateTime=0x1d327e8)) returned 1
	[0052.547] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.547] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x4d91, lpOverlapped=0x0) returned 1
	[0052.549] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned="J0099195.GIF"
	[0052.549] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.549] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x4d91, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x4d91, lpOverlapped=0x0) returned 1
	[0052.549] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.549] CloseHandle (hObject=0x214) returned 1
	[0052.550] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif.exe")) returned 1
	[0052.551] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe59294b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe59294b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe59294b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3801, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099196.GIF", cAlternateFileName="")) returned 1
	[0052.551] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.551] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099196.GIF") returned -1
	[0052.551] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099196.GIF") returned -1
	[0052.551] lstrcmpiA (lpString1="", lpString2="J0099196.GIF") returned -1
	[0052.551] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned="J0099195.GIF"
	[0052.551] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.551] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.551] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.551] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.551] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099196.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF"
	[0052.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF", pszSpec="*.zip") returned 0
	[0052.551] lstrlenA (lpString="*.zip") returned 5
	[0052.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF", pszSpec="*.rar") returned 0
	[0052.552] lstrlenA (lpString="*.rar") returned 5
	[0052.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF", pszSpec="*.7z") returned 0
	[0052.552] lstrlenA (lpString="*.7z") returned 4
	[0052.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF", pszSpec="*.tar") returned 0
	[0052.552] lstrlenA (lpString="*.tar") returned 5
	[0052.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF", pszSpec="*.gzip") returned 0
	[0052.552] lstrlenA (lpString="*.gzip") returned 6
	[0052.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF", pszSpec="*.jpg") returned 0
	[0052.552] lstrlenA (lpString="*.jpg") returned 5
	[0052.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF", pszSpec="*.jpeg") returned 0
	[0052.552] lstrlenA (lpString="*.jpeg") returned 6
	[0052.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF", pszSpec="*.bmp") returned 0
	[0052.552] lstrlenA (lpString="*.bmp") returned 5
	[0052.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF", pszSpec="*.gif") returned 1
	[0052.552] lstrlenA (lpString="*.gif") returned 5
	[0052.552] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF"
	[0052.552] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF"
	[0052.552] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF."
	[0052.552] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.exe"
	[0052.552] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0052.552] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3801
	[0052.552] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe59294b, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe59294b, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe59294b, dwHighDateTime=0x1d327e8)) returned 1
	[0052.553] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.553] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x37bf, lpOverlapped=0x0) returned 1
	[0052.555] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned="J0099196.GIF"
	[0052.555] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.555] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x37bf, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x37bf, lpOverlapped=0x0) returned 1
	[0052.555] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.555] CloseHandle (hObject=0x214) returned 1
	[0052.556] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif.exe")) returned 1
	[0052.557] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe59294b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe59294b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe59294b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2a92, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099197.GIF", cAlternateFileName="")) returned 1
	[0052.557] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.557] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099197.GIF") returned -1
	[0052.557] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099197.GIF") returned -1
	[0052.557] lstrcmpiA (lpString1="", lpString2="J0099197.GIF") returned -1
	[0052.557] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned="J0099196.GIF"
	[0052.557] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.557] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.557] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.558] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.558] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099197.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF"
	[0052.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF", pszSpec="*.zip") returned 0
	[0052.558] lstrlenA (lpString="*.zip") returned 5
	[0052.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF", pszSpec="*.rar") returned 0
	[0052.558] lstrlenA (lpString="*.rar") returned 5
	[0052.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF", pszSpec="*.7z") returned 0
	[0052.558] lstrlenA (lpString="*.7z") returned 4
	[0052.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF", pszSpec="*.tar") returned 0
	[0052.558] lstrlenA (lpString="*.tar") returned 5
	[0052.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF", pszSpec="*.gzip") returned 0
	[0052.558] lstrlenA (lpString="*.gzip") returned 6
	[0052.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF", pszSpec="*.jpg") returned 0
	[0052.558] lstrlenA (lpString="*.jpg") returned 5
	[0052.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF", pszSpec="*.jpeg") returned 0
	[0052.558] lstrlenA (lpString="*.jpeg") returned 6
	[0052.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF", pszSpec="*.bmp") returned 0
	[0052.558] lstrlenA (lpString="*.bmp") returned 5
	[0052.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF", pszSpec="*.gif") returned 1
	[0052.558] lstrlenA (lpString="*.gif") returned 5
	[0052.558] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF"
	[0052.558] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF"
	[0052.558] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF."
	[0052.558] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.exe"
	[0052.558] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0052.559] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2a92
	[0052.559] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe59294b, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe59294b, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe59294b, dwHighDateTime=0x1d327e8)) returned 1
	[0052.559] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.559] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x2a50, lpOverlapped=0x0) returned 1
	[0052.560] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned="J0099197.GIF"
	[0052.560] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.560] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x2a50, lpOverlapped=0x0) returned 1
	[0052.561] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.561] CloseHandle (hObject=0x214) returned 1
	[0052.565] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif.exe")) returned 1
	[0052.566] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe59294b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe59294b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe59294b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x148b, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099198.GIF", cAlternateFileName="")) returned 1
	[0052.566] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.631] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099198.GIF") returned -1
	[0052.631] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099198.GIF") returned -1
	[0052.631] lstrcmpiA (lpString1="", lpString2="J0099198.GIF") returned -1
	[0052.631] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned="J0099197.GIF"
	[0052.631] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.631] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.631] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.631] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.632] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099198.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF"
	[0052.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF", pszSpec="*.zip") returned 0
	[0052.632] lstrlenA (lpString="*.zip") returned 5
	[0052.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF", pszSpec="*.rar") returned 0
	[0052.633] lstrlenA (lpString="*.rar") returned 5
	[0052.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF", pszSpec="*.7z") returned 0
	[0052.633] lstrlenA (lpString="*.7z") returned 4
	[0052.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF", pszSpec="*.tar") returned 0
	[0052.633] lstrlenA (lpString="*.tar") returned 5
	[0052.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF", pszSpec="*.gzip") returned 0
	[0052.633] lstrlenA (lpString="*.gzip") returned 6
	[0052.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF", pszSpec="*.jpg") returned 0
	[0052.633] lstrlenA (lpString="*.jpg") returned 5
	[0052.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF", pszSpec="*.jpeg") returned 0
	[0052.633] lstrlenA (lpString="*.jpeg") returned 6
	[0052.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF", pszSpec="*.bmp") returned 0
	[0052.634] lstrlenA (lpString="*.bmp") returned 5
	[0052.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF", pszSpec="*.gif") returned 1
	[0052.634] lstrlenA (lpString="*.gif") returned 5
	[0052.634] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF"
	[0052.634] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF"
	[0052.634] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF."
	[0052.634] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.exe"
	[0052.634] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0052.635] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x148b
	[0052.635] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe59294b, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe59294b, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe59294b, dwHighDateTime=0x1d327e8)) returned 1
	[0052.635] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.635] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1449, lpOverlapped=0x0) returned 1
	[0052.640] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned="J0099198.GIF"
	[0052.640] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.640] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1449, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1449, lpOverlapped=0x0) returned 1
	[0052.641] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.641] CloseHandle (hObject=0x214) returned 1
	[0052.643] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif.exe")) returned 1
	[0052.644] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe59294b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe59294b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe59294b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x84b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099199.GIF", cAlternateFileName="")) returned 1
	[0052.644] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.644] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099199.GIF") returned -1
	[0052.644] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099199.GIF") returned -1
	[0052.644] lstrcmpiA (lpString1="", lpString2="J0099199.GIF") returned -1
	[0052.644] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned="J0099198.GIF"
	[0052.645] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.645] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.645] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.645] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.645] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099199.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF"
	[0052.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF", pszSpec="*.zip") returned 0
	[0052.645] lstrlenA (lpString="*.zip") returned 5
	[0052.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF", pszSpec="*.rar") returned 0
	[0052.645] lstrlenA (lpString="*.rar") returned 5
	[0052.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF", pszSpec="*.7z") returned 0
	[0052.645] lstrlenA (lpString="*.7z") returned 4
	[0052.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF", pszSpec="*.tar") returned 0
	[0052.645] lstrlenA (lpString="*.tar") returned 5
	[0052.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF", pszSpec="*.gzip") returned 0
	[0052.645] lstrlenA (lpString="*.gzip") returned 6
	[0052.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF", pszSpec="*.jpg") returned 0
	[0052.645] lstrlenA (lpString="*.jpg") returned 5
	[0052.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF", pszSpec="*.jpeg") returned 0
	[0052.645] lstrlenA (lpString="*.jpeg") returned 6
	[0052.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF", pszSpec="*.bmp") returned 0
	[0052.645] lstrlenA (lpString="*.bmp") returned 5
	[0052.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF", pszSpec="*.gif") returned 1
	[0052.645] lstrlenA (lpString="*.gif") returned 5
	[0052.645] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF"
	[0052.645] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF"
	[0052.645] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF."
	[0052.645] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.exe"
	[0052.645] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0052.646] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x84b7
	[0052.646] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe59294b, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe59294b, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe59294b, dwHighDateTime=0x1d327e8)) returned 1
	[0052.646] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.646] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x8475, lpOverlapped=0x0) returned 1
	[0052.648] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned="J0099199.GIF"
	[0052.648] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.648] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x8475, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x8475, lpOverlapped=0x0) returned 1
	[0052.648] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.648] CloseHandle (hObject=0x214) returned 1
	[0052.650] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif.exe")) returned 1
	[0052.650] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe56c811, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe56c811, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe59294b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x409f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099200.GIF", cAlternateFileName="")) returned 1
	[0052.650] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.650] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099200.GIF") returned -1
	[0052.650] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099200.GIF") returned -1
	[0052.650] lstrcmpiA (lpString1="", lpString2="J0099200.GIF") returned -1
	[0052.650] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned="J0099199.GIF"
	[0052.650] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.650] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.650] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.650] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.651] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099200.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF"
	[0052.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF", pszSpec="*.zip") returned 0
	[0052.651] lstrlenA (lpString="*.zip") returned 5
	[0052.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF", pszSpec="*.rar") returned 0
	[0052.651] lstrlenA (lpString="*.rar") returned 5
	[0052.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF", pszSpec="*.7z") returned 0
	[0052.651] lstrlenA (lpString="*.7z") returned 4
	[0052.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF", pszSpec="*.tar") returned 0
	[0052.651] lstrlenA (lpString="*.tar") returned 5
	[0052.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF", pszSpec="*.gzip") returned 0
	[0052.651] lstrlenA (lpString="*.gzip") returned 6
	[0052.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF", pszSpec="*.jpg") returned 0
	[0052.651] lstrlenA (lpString="*.jpg") returned 5
	[0052.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF", pszSpec="*.jpeg") returned 0
	[0052.651] lstrlenA (lpString="*.jpeg") returned 6
	[0052.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF", pszSpec="*.bmp") returned 0
	[0052.651] lstrlenA (lpString="*.bmp") returned 5
	[0052.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF", pszSpec="*.gif") returned 1
	[0052.651] lstrlenA (lpString="*.gif") returned 5
	[0052.651] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF"
	[0052.651] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF"
	[0052.651] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF."
	[0052.651] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.exe"
	[0052.651] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0052.651] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x409f
	[0052.651] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe56c811, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe56c811, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe59294b, dwHighDateTime=0x1d327e8)) returned 1
	[0052.651] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.652] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x405d, lpOverlapped=0x0) returned 1
	[0052.653] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned="J0099200.GIF"
	[0052.654] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.654] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x405d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x405d, lpOverlapped=0x0) returned 1
	[0052.654] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.654] CloseHandle (hObject=0x214) returned 1
	[0052.655] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif.exe")) returned 1
	[0052.655] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe59294b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe59294b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe59294b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc8c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099201.GIF", cAlternateFileName="")) returned 1
	[0052.655] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.656] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099201.GIF") returned -1
	[0052.656] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099201.GIF") returned -1
	[0052.656] lstrcmpiA (lpString1="", lpString2="J0099201.GIF") returned -1
	[0052.656] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned="J0099200.GIF"
	[0052.656] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.656] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.656] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.656] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.656] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099201.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF"
	[0052.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF", pszSpec="*.zip") returned 0
	[0052.656] lstrlenA (lpString="*.zip") returned 5
	[0052.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF", pszSpec="*.rar") returned 0
	[0052.656] lstrlenA (lpString="*.rar") returned 5
	[0052.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF", pszSpec="*.7z") returned 0
	[0052.656] lstrlenA (lpString="*.7z") returned 4
	[0052.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF", pszSpec="*.tar") returned 0
	[0052.656] lstrlenA (lpString="*.tar") returned 5
	[0052.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF", pszSpec="*.gzip") returned 0
	[0052.656] lstrlenA (lpString="*.gzip") returned 6
	[0052.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF", pszSpec="*.jpg") returned 0
	[0052.656] lstrlenA (lpString="*.jpg") returned 5
	[0052.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF", pszSpec="*.jpeg") returned 0
	[0052.656] lstrlenA (lpString="*.jpeg") returned 6
	[0052.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF", pszSpec="*.bmp") returned 0
	[0052.656] lstrlenA (lpString="*.bmp") returned 5
	[0052.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF", pszSpec="*.gif") returned 1
	[0052.656] lstrlenA (lpString="*.gif") returned 5
	[0052.656] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF"
	[0052.656] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF"
	[0052.656] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF."
	[0052.657] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.exe"
	[0052.657] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0052.657] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc8c9
	[0052.657] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe59294b, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe59294b, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe59294b, dwHighDateTime=0x1d327e8)) returned 1
	[0052.657] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.657] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xc887, lpOverlapped=0x0) returned 1
	[0052.659] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned="J0099201.GIF"
	[0052.659] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.659] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xc887, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xc887, lpOverlapped=0x0) returned 1
	[0052.659] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.659] CloseHandle (hObject=0x214) returned 1
	[0052.661] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif.exe")) returned 1
	[0052.662] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe59294b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe59294b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe59294b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1367, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099202.GIF", cAlternateFileName="")) returned 1
	[0052.662] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.662] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099202.GIF") returned -1
	[0052.662] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099202.GIF") returned -1
	[0052.662] lstrcmpiA (lpString1="", lpString2="J0099202.GIF") returned -1
	[0052.662] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned="J0099201.GIF"
	[0052.662] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.662] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.662] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.662] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.662] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099202.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF"
	[0052.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF", pszSpec="*.zip") returned 0
	[0052.662] lstrlenA (lpString="*.zip") returned 5
	[0052.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF", pszSpec="*.rar") returned 0
	[0052.662] lstrlenA (lpString="*.rar") returned 5
	[0052.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF", pszSpec="*.7z") returned 0
	[0052.662] lstrlenA (lpString="*.7z") returned 4
	[0052.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF", pszSpec="*.tar") returned 0
	[0052.662] lstrlenA (lpString="*.tar") returned 5
	[0052.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF", pszSpec="*.gzip") returned 0
	[0052.662] lstrlenA (lpString="*.gzip") returned 6
	[0052.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF", pszSpec="*.jpg") returned 0
	[0052.662] lstrlenA (lpString="*.jpg") returned 5
	[0052.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF", pszSpec="*.jpeg") returned 0
	[0052.663] lstrlenA (lpString="*.jpeg") returned 6
	[0052.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF", pszSpec="*.bmp") returned 0
	[0052.663] lstrlenA (lpString="*.bmp") returned 5
	[0052.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF", pszSpec="*.gif") returned 1
	[0052.663] lstrlenA (lpString="*.gif") returned 5
	[0052.663] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF"
	[0052.663] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF"
	[0052.663] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF."
	[0052.663] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.exe"
	[0052.663] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0052.663] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1367
	[0052.663] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe59294b, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe59294b, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe59294b, dwHighDateTime=0x1d327e8)) returned 1
	[0052.663] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.663] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1325, lpOverlapped=0x0) returned 1
	[0052.664] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned="J0099202.GIF"
	[0052.665] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.665] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1325, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1325, lpOverlapped=0x0) returned 1
	[0052.665] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.665] CloseHandle (hObject=0x214) returned 1
	[0052.666] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif.exe")) returned 1
	[0052.666] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe56c811, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe56c811, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe59294b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf40, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099203.GIF", cAlternateFileName="")) returned 1
	[0052.666] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.666] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099203.GIF") returned -1
	[0052.666] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099203.GIF") returned -1
	[0052.667] lstrcmpiA (lpString1="", lpString2="J0099203.GIF") returned -1
	[0052.667] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned="J0099202.GIF"
	[0052.667] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.667] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.667] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.667] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.667] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099203.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF"
	[0052.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF", pszSpec="*.zip") returned 0
	[0052.667] lstrlenA (lpString="*.zip") returned 5
	[0052.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF", pszSpec="*.rar") returned 0
	[0052.667] lstrlenA (lpString="*.rar") returned 5
	[0052.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF", pszSpec="*.7z") returned 0
	[0052.667] lstrlenA (lpString="*.7z") returned 4
	[0052.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF", pszSpec="*.tar") returned 0
	[0052.667] lstrlenA (lpString="*.tar") returned 5
	[0052.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF", pszSpec="*.gzip") returned 0
	[0052.667] lstrlenA (lpString="*.gzip") returned 6
	[0052.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF", pszSpec="*.jpg") returned 0
	[0052.667] lstrlenA (lpString="*.jpg") returned 5
	[0052.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF", pszSpec="*.jpeg") returned 0
	[0052.667] lstrlenA (lpString="*.jpeg") returned 6
	[0052.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF", pszSpec="*.bmp") returned 0
	[0052.667] lstrlenA (lpString="*.bmp") returned 5
	[0052.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF", pszSpec="*.gif") returned 1
	[0052.667] lstrlenA (lpString="*.gif") returned 5
	[0052.667] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF"
	[0052.667] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF"
	[0052.667] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF."
	[0052.667] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.exe"
	[0052.667] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0052.668] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf40
	[0052.668] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe56c811, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe56c811, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe59294b, dwHighDateTime=0x1d327e8)) returned 1
	[0052.668] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.668] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xefe, lpOverlapped=0x0) returned 1
	[0052.721] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned="J0099203.GIF"
	[0052.721] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.721] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xefe, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xefe, lpOverlapped=0x0) returned 1
	[0052.721] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.721] CloseHandle (hObject=0x214) returned 1
	[0052.722] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif.exe")) returned 1
	[0052.723] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe56c811, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe56c811, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe59294b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x45be, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099204.WMF", cAlternateFileName="")) returned 1
	[0052.723] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.723] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099204.WMF") returned -1
	[0052.723] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099204.WMF") returned -1
	[0052.723] lstrcmpiA (lpString1="", lpString2="J0099204.WMF") returned -1
	[0052.723] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned="J0099203.GIF"
	[0052.723] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.723] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.723] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.723] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.723] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099204.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF"
	[0052.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.zip") returned 0
	[0052.723] lstrlenA (lpString="*.zip") returned 5
	[0052.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.rar") returned 0
	[0052.723] lstrlenA (lpString="*.rar") returned 5
	[0052.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.7z") returned 0
	[0052.723] lstrlenA (lpString="*.7z") returned 4
	[0052.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.tar") returned 0
	[0052.723] lstrlenA (lpString="*.tar") returned 5
	[0052.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.gzip") returned 0
	[0052.723] lstrlenA (lpString="*.gzip") returned 6
	[0052.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.jpg") returned 0
	[0052.723] lstrlenA (lpString="*.jpg") returned 5
	[0052.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.jpeg") returned 0
	[0052.724] lstrlenA (lpString="*.jpeg") returned 6
	[0052.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.bmp") returned 0
	[0052.724] lstrlenA (lpString="*.bmp") returned 5
	[0052.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.gif") returned 0
	[0052.724] lstrlenA (lpString="*.gif") returned 5
	[0052.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.png") returned 0
	[0052.724] lstrlenA (lpString="*.png") returned 5
	[0052.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.doc") returned 0
	[0052.724] lstrlenA (lpString="*.doc") returned 5
	[0052.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.docx") returned 0
	[0052.724] lstrlenA (lpString="*.docx") returned 6
	[0052.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.xls") returned 0
	[0052.724] lstrlenA (lpString="*.xls") returned 5
	[0052.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.xlsx") returned 0
	[0052.724] lstrlenA (lpString="*.xlsx") returned 6
	[0052.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.ppt") returned 0
	[0052.724] lstrlenA (lpString="*.ppt") returned 5
	[0052.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.pptx") returned 0
	[0052.724] lstrlenA (lpString="*.pptx") returned 6
	[0052.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.txt") returned 0
	[0052.724] lstrlenA (lpString="*.txt") returned 5
	[0052.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.pdf") returned 0
	[0052.724] lstrlenA (lpString="*.pdf") returned 5
	[0052.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.htm") returned 0
	[0052.724] lstrlenA (lpString="*.htm") returned 5
	[0052.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.html") returned 0
	[0052.724] lstrlenA (lpString="*.html") returned 6
	[0052.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.mdb") returned 0
	[0052.724] lstrlenA (lpString="*.mdb") returned 5
	[0052.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.pfx") returned 0
	[0052.724] lstrlenA (lpString="*.pfx") returned 5
	[0052.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.md") returned 0
	[0052.724] lstrlenA (lpString="*.md") returned 4
	[0052.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.lnk") returned 0
	[0052.725] lstrlenA (lpString="*.lnk") returned 5
	[0052.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.torrent") returned 0
	[0052.725] lstrlenA (lpString="*.torrent") returned 9
	[0052.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.mov") returned 0
	[0052.725] lstrlenA (lpString="*.mov") returned 5
	[0052.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.3gp") returned 0
	[0052.725] lstrlenA (lpString="*.3gp") returned 5
	[0052.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.mpeg") returned 0
	[0052.725] lstrlenA (lpString="*.mpeg") returned 6
	[0052.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.mpg") returned 0
	[0052.725] lstrlenA (lpString="*.mpg") returned 5
	[0052.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.flv") returned 0
	[0052.725] lstrlenA (lpString="*.flv") returned 5
	[0052.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.avi") returned 0
	[0052.725] lstrlenA (lpString="*.avi") returned 5
	[0052.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.mp4") returned 0
	[0052.725] lstrlenA (lpString="*.mp4") returned 5
	[0052.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.wmv") returned 0
	[0052.725] lstrlenA (lpString="*.wmv") returned 5
	[0052.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.mkv") returned 0
	[0052.725] lstrlenA (lpString="*.mkv") returned 5
	[0052.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.mp3") returned 0
	[0052.725] lstrlenA (lpString="*.mp3") returned 5
	[0052.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.wav") returned 0
	[0052.725] lstrlenA (lpString="*.wav") returned 5
	[0052.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.flac") returned 0
	[0052.725] lstrlenA (lpString="*.flac") returned 6
	[0052.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.wma") returned 0
	[0052.725] lstrlenA (lpString="*.wma") returned 5
	[0052.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.au3") returned 0
	[0052.725] lstrlenA (lpString="*.au3") returned 5
	[0052.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.ahk") returned 0
	[0052.725] lstrlenA (lpString="*.ahk") returned 5
	[0052.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.c") returned 0
	[0052.726] lstrlenA (lpString="*.c") returned 3
	[0052.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.cc") returned 0
	[0052.726] lstrlenA (lpString="*.cc") returned 4
	[0052.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.cpp") returned 0
	[0052.726] lstrlenA (lpString="*.cpp") returned 5
	[0052.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.cxx") returned 0
	[0052.726] lstrlenA (lpString="*.cxx") returned 5
	[0052.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.c++") returned 0
	[0052.726] lstrlenA (lpString="*.c++") returned 5
	[0052.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.cs") returned 0
	[0052.726] lstrlenA (lpString="*.cs") returned 4
	[0052.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.vb") returned 0
	[0052.726] lstrlenA (lpString="*.vb") returned 4
	[0052.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.bas") returned 0
	[0052.726] lstrlenA (lpString="*.bas") returned 5
	[0052.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.csproj") returned 0
	[0052.726] lstrlenA (lpString="*.csproj") returned 8
	[0052.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.vbproj") returned 0
	[0052.726] lstrlenA (lpString="*.vbproj") returned 8
	[0052.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.vcxproj") returned 0
	[0052.726] lstrlenA (lpString="*.vcxproj") returned 9
	[0052.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.manifest") returned 0
	[0052.726] lstrlenA (lpString="*.manifest") returned 10
	[0052.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.php") returned 0
	[0052.726] lstrlenA (lpString="*.php") returned 5
	[0052.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.vbe") returned 0
	[0052.726] lstrlenA (lpString="*.vbe") returned 5
	[0052.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.vba") returned 0
	[0052.726] lstrlenA (lpString="*.vba") returned 5
	[0052.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.vbs") returned 0
	[0052.726] lstrlenA (lpString="*.vbs") returned 5
	[0052.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.bat") returned 0
	[0052.726] lstrlenA (lpString="*.bat") returned 5
	[0052.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.cmd") returned 0
	[0052.727] lstrlenA (lpString="*.cmd") returned 5
	[0052.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.js") returned 0
	[0052.727] lstrlenA (lpString="*.js") returned 4
	[0052.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.jscript") returned 0
	[0052.727] lstrlenA (lpString="*.jscript") returned 9
	[0052.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.hta") returned 0
	[0052.727] lstrlenA (lpString="*.hta") returned 5
	[0052.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.php7") returned 0
	[0052.727] lstrlenA (lpString="*.php7") returned 6
	[0052.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.db") returned 0
	[0052.727] lstrlenA (lpString="*.db") returned 4
	[0052.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.swf") returned 0
	[0052.727] lstrlenA (lpString="*.swf") returned 5
	[0052.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.eml") returned 0
	[0052.727] lstrlenA (lpString="*.eml") returned 5
	[0052.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.part") returned 0
	[0052.727] lstrlenA (lpString="*.part") returned 6
	[0052.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.nfo") returned 0
	[0052.727] lstrlenA (lpString="*.nfo") returned 5
	[0052.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.rsa") returned 0
	[0052.727] lstrlenA (lpString="*.rsa") returned 5
	[0052.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.key") returned 0
	[0052.727] lstrlenA (lpString="*.key") returned 5
	[0052.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.aes") returned 0
	[0052.727] lstrlenA (lpString="*.aes") returned 5
	[0052.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.blob") returned 0
	[0052.727] lstrlenA (lpString="*.blob") returned 6
	[0052.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.btc") returned 0
	[0052.727] lstrlenA (lpString="*.btc") returned 5
	[0052.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF", pszSpec="*.wallet") returned 0
	[0052.727] lstrlenA (lpString="*.wallet") returned 8
	[0052.727] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe5dee50, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe5dee50, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe605048, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x45be, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099205.WMF", cAlternateFileName="")) returned 1
	[0052.727] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.727] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0099205.WMF") returned -1
	[0052.728] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0099205.WMF") returned -1
	[0052.728] lstrcmpiA (lpString1="", lpString2="J0099205.WMF") returned -1
	[0052.728] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned="J0099204.WMF"
	[0052.728] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.728] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.728] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.728] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.728] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0099205.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF"
	[0052.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.zip") returned 0
	[0052.728] lstrlenA (lpString="*.zip") returned 5
	[0052.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.rar") returned 0
	[0052.728] lstrlenA (lpString="*.rar") returned 5
	[0052.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.7z") returned 0
	[0052.728] lstrlenA (lpString="*.7z") returned 4
	[0052.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.tar") returned 0
	[0052.728] lstrlenA (lpString="*.tar") returned 5
	[0052.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.gzip") returned 0
	[0052.728] lstrlenA (lpString="*.gzip") returned 6
	[0052.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.jpg") returned 0
	[0052.728] lstrlenA (lpString="*.jpg") returned 5
	[0052.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.jpeg") returned 0
	[0052.728] lstrlenA (lpString="*.jpeg") returned 6
	[0052.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.bmp") returned 0
	[0052.728] lstrlenA (lpString="*.bmp") returned 5
	[0052.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.gif") returned 0
	[0052.728] lstrlenA (lpString="*.gif") returned 5
	[0052.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.png") returned 0
	[0052.728] lstrlenA (lpString="*.png") returned 5
	[0052.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.doc") returned 0
	[0052.728] lstrlenA (lpString="*.doc") returned 5
	[0052.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.docx") returned 0
	[0052.728] lstrlenA (lpString="*.docx") returned 6
	[0052.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.xls") returned 0
	[0052.729] lstrlenA (lpString="*.xls") returned 5
	[0052.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.xlsx") returned 0
	[0052.729] lstrlenA (lpString="*.xlsx") returned 6
	[0052.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.ppt") returned 0
	[0052.729] lstrlenA (lpString="*.ppt") returned 5
	[0052.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.pptx") returned 0
	[0052.729] lstrlenA (lpString="*.pptx") returned 6
	[0052.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.txt") returned 0
	[0052.729] lstrlenA (lpString="*.txt") returned 5
	[0052.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.pdf") returned 0
	[0052.729] lstrlenA (lpString="*.pdf") returned 5
	[0052.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.htm") returned 0
	[0052.729] lstrlenA (lpString="*.htm") returned 5
	[0052.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.html") returned 0
	[0052.729] lstrlenA (lpString="*.html") returned 6
	[0052.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.mdb") returned 0
	[0052.729] lstrlenA (lpString="*.mdb") returned 5
	[0052.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.pfx") returned 0
	[0052.729] lstrlenA (lpString="*.pfx") returned 5
	[0052.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.md") returned 0
	[0052.729] lstrlenA (lpString="*.md") returned 4
	[0052.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.lnk") returned 0
	[0052.729] lstrlenA (lpString="*.lnk") returned 5
	[0052.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.torrent") returned 0
	[0052.729] lstrlenA (lpString="*.torrent") returned 9
	[0052.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.mov") returned 0
	[0052.729] lstrlenA (lpString="*.mov") returned 5
	[0052.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.3gp") returned 0
	[0052.729] lstrlenA (lpString="*.3gp") returned 5
	[0052.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.mpeg") returned 0
	[0052.729] lstrlenA (lpString="*.mpeg") returned 6
	[0052.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.mpg") returned 0
	[0052.729] lstrlenA (lpString="*.mpg") returned 5
	[0052.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.flv") returned 0
	[0052.730] lstrlenA (lpString="*.flv") returned 5
	[0052.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.avi") returned 0
	[0052.730] lstrlenA (lpString="*.avi") returned 5
	[0052.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.mp4") returned 0
	[0052.730] lstrlenA (lpString="*.mp4") returned 5
	[0052.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.wmv") returned 0
	[0052.730] lstrlenA (lpString="*.wmv") returned 5
	[0052.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.mkv") returned 0
	[0052.730] lstrlenA (lpString="*.mkv") returned 5
	[0052.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.mp3") returned 0
	[0052.730] lstrlenA (lpString="*.mp3") returned 5
	[0052.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.wav") returned 0
	[0052.730] lstrlenA (lpString="*.wav") returned 5
	[0052.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.flac") returned 0
	[0052.730] lstrlenA (lpString="*.flac") returned 6
	[0052.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.wma") returned 0
	[0052.730] lstrlenA (lpString="*.wma") returned 5
	[0052.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.au3") returned 0
	[0052.730] lstrlenA (lpString="*.au3") returned 5
	[0052.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.ahk") returned 0
	[0052.730] lstrlenA (lpString="*.ahk") returned 5
	[0052.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.c") returned 0
	[0052.730] lstrlenA (lpString="*.c") returned 3
	[0052.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.cc") returned 0
	[0052.730] lstrlenA (lpString="*.cc") returned 4
	[0052.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.cpp") returned 0
	[0052.730] lstrlenA (lpString="*.cpp") returned 5
	[0052.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.cxx") returned 0
	[0052.730] lstrlenA (lpString="*.cxx") returned 5
	[0052.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.c++") returned 0
	[0052.730] lstrlenA (lpString="*.c++") returned 5
	[0052.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.cs") returned 0
	[0052.730] lstrlenA (lpString="*.cs") returned 4
	[0052.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.vb") returned 0
	[0052.731] lstrlenA (lpString="*.vb") returned 4
	[0052.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.bas") returned 0
	[0052.731] lstrlenA (lpString="*.bas") returned 5
	[0052.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.csproj") returned 0
	[0052.731] lstrlenA (lpString="*.csproj") returned 8
	[0052.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.vbproj") returned 0
	[0052.731] lstrlenA (lpString="*.vbproj") returned 8
	[0052.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.vcxproj") returned 0
	[0052.731] lstrlenA (lpString="*.vcxproj") returned 9
	[0052.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.manifest") returned 0
	[0052.731] lstrlenA (lpString="*.manifest") returned 10
	[0052.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.php") returned 0
	[0052.731] lstrlenA (lpString="*.php") returned 5
	[0052.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.vbe") returned 0
	[0052.731] lstrlenA (lpString="*.vbe") returned 5
	[0052.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.vba") returned 0
	[0052.731] lstrlenA (lpString="*.vba") returned 5
	[0052.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.vbs") returned 0
	[0052.731] lstrlenA (lpString="*.vbs") returned 5
	[0052.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.bat") returned 0
	[0052.731] lstrlenA (lpString="*.bat") returned 5
	[0052.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.cmd") returned 0
	[0052.731] lstrlenA (lpString="*.cmd") returned 5
	[0052.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.js") returned 0
	[0052.731] lstrlenA (lpString="*.js") returned 4
	[0052.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.jscript") returned 0
	[0052.731] lstrlenA (lpString="*.jscript") returned 9
	[0052.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.hta") returned 0
	[0052.731] lstrlenA (lpString="*.hta") returned 5
	[0052.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.php7") returned 0
	[0052.731] lstrlenA (lpString="*.php7") returned 6
	[0052.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.db") returned 0
	[0052.732] lstrlenA (lpString="*.db") returned 4
	[0052.732] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.swf") returned 0
	[0052.732] lstrlenA (lpString="*.swf") returned 5
	[0052.732] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.eml") returned 0
	[0052.732] lstrlenA (lpString="*.eml") returned 5
	[0052.732] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.part") returned 0
	[0052.732] lstrlenA (lpString="*.part") returned 6
	[0052.732] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.nfo") returned 0
	[0052.732] lstrlenA (lpString="*.nfo") returned 5
	[0052.732] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.rsa") returned 0
	[0052.732] lstrlenA (lpString="*.rsa") returned 5
	[0052.732] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.key") returned 0
	[0052.732] lstrlenA (lpString="*.key") returned 5
	[0052.732] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.aes") returned 0
	[0052.732] lstrlenA (lpString="*.aes") returned 5
	[0052.732] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.blob") returned 0
	[0052.732] lstrlenA (lpString="*.blob") returned 6
	[0052.732] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.btc") returned 0
	[0052.732] lstrlenA (lpString="*.btc") returned 5
	[0052.732] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF", pszSpec="*.wallet") returned 0
	[0052.732] lstrlenA (lpString="*.wallet") returned 8
	[0052.732] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe5dee50, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe5dee50, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe605048, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x133f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101856.BMP", cAlternateFileName="")) returned 1
	[0052.732] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.732] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0101856.BMP") returned -1
	[0052.732] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0101856.BMP") returned -1
	[0052.732] lstrcmpiA (lpString1="", lpString2="J0101856.BMP") returned -1
	[0052.732] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned="J0099205.WMF"
	[0052.732] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.732] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.732] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.732] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.733] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0101856.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP"
	[0052.733] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP", pszSpec="*.zip") returned 0
	[0052.733] lstrlenA (lpString="*.zip") returned 5
	[0052.733] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP", pszSpec="*.rar") returned 0
	[0052.733] lstrlenA (lpString="*.rar") returned 5
	[0052.733] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP", pszSpec="*.7z") returned 0
	[0052.733] lstrlenA (lpString="*.7z") returned 4
	[0052.733] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP", pszSpec="*.tar") returned 0
	[0052.733] lstrlenA (lpString="*.tar") returned 5
	[0052.733] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP", pszSpec="*.gzip") returned 0
	[0052.733] lstrlenA (lpString="*.gzip") returned 6
	[0052.733] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP", pszSpec="*.jpg") returned 0
	[0052.733] lstrlenA (lpString="*.jpg") returned 5
	[0052.733] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP", pszSpec="*.jpeg") returned 0
	[0052.733] lstrlenA (lpString="*.jpeg") returned 6
	[0052.733] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP", pszSpec="*.bmp") returned 1
	[0052.733] lstrlenA (lpString="*.bmp") returned 5
	[0052.733] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP"
	[0052.733] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP"
	[0052.733] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP."
	[0052.733] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.exe"
	[0052.733] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0052.734] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x133f8
	[0052.734] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe5dee50, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe5dee50, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe605048, dwHighDateTime=0x1d327e8)) returned 1
	[0052.734] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.734] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x133b6, lpOverlapped=0x0) returned 1
	[0052.736] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned="J0101856.BMP"
	[0052.736] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.736] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x133b6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x133b6, lpOverlapped=0x0) returned 1
	[0052.737] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.737] CloseHandle (hObject=0x214) returned 1
	[0052.740] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp.exe")) returned 1
	[0052.740] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe5dee50, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe5dee50, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe605048, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101857.BMP", cAlternateFileName="")) returned 1
	[0052.740] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.740] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0101857.BMP") returned -1
	[0052.740] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0101857.BMP") returned -1
	[0052.740] lstrcmpiA (lpString1="", lpString2="J0101857.BMP") returned -1
	[0052.740] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned="J0101856.BMP"
	[0052.740] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.740] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.740] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.740] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.741] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0101857.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP"
	[0052.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP", pszSpec="*.zip") returned 0
	[0052.741] lstrlenA (lpString="*.zip") returned 5
	[0052.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP", pszSpec="*.rar") returned 0
	[0052.741] lstrlenA (lpString="*.rar") returned 5
	[0052.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP", pszSpec="*.7z") returned 0
	[0052.741] lstrlenA (lpString="*.7z") returned 4
	[0052.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP", pszSpec="*.tar") returned 0
	[0052.741] lstrlenA (lpString="*.tar") returned 5
	[0052.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP", pszSpec="*.gzip") returned 0
	[0052.741] lstrlenA (lpString="*.gzip") returned 6
	[0052.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP", pszSpec="*.jpg") returned 0
	[0052.741] lstrlenA (lpString="*.jpg") returned 5
	[0052.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP", pszSpec="*.jpeg") returned 0
	[0052.741] lstrlenA (lpString="*.jpeg") returned 6
	[0052.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP", pszSpec="*.bmp") returned 1
	[0052.741] lstrlenA (lpString="*.bmp") returned 5
	[0052.741] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP"
	[0052.741] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP"
	[0052.741] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP."
	[0052.741] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.exe"
	[0052.741] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0052.742] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7db8
	[0052.742] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe5dee50, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe5dee50, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe605048, dwHighDateTime=0x1d327e8)) returned 1
	[0052.742] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.742] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7d76, lpOverlapped=0x0) returned 1
	[0052.744] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned="J0101857.BMP"
	[0052.744] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.744] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7d76, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7d76, lpOverlapped=0x0) returned 1
	[0052.744] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.744] CloseHandle (hObject=0x214) returned 1
	[0052.746] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp.exe")) returned 1
	[0052.799] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe5dee50, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe5dee50, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe5dee50, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101858.BMP", cAlternateFileName="")) returned 1
	[0052.799] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.799] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0101858.BMP") returned -1
	[0052.799] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0101858.BMP") returned -1
	[0052.799] lstrcmpiA (lpString1="", lpString2="J0101858.BMP") returned -1
	[0052.799] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned="J0101857.BMP"
	[0052.799] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.799] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.799] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.799] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.799] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0101858.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP"
	[0052.799] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP", pszSpec="*.zip") returned 0
	[0052.799] lstrlenA (lpString="*.zip") returned 5
	[0052.799] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP", pszSpec="*.rar") returned 0
	[0052.799] lstrlenA (lpString="*.rar") returned 5
	[0052.799] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP", pszSpec="*.7z") returned 0
	[0052.799] lstrlenA (lpString="*.7z") returned 4
	[0052.799] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP", pszSpec="*.tar") returned 0
	[0052.799] lstrlenA (lpString="*.tar") returned 5
	[0052.799] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP", pszSpec="*.gzip") returned 0
	[0052.799] lstrlenA (lpString="*.gzip") returned 6
	[0052.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP", pszSpec="*.jpg") returned 0
	[0052.800] lstrlenA (lpString="*.jpg") returned 5
	[0052.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP", pszSpec="*.jpeg") returned 0
	[0052.800] lstrlenA (lpString="*.jpeg") returned 6
	[0052.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP", pszSpec="*.bmp") returned 1
	[0052.800] lstrlenA (lpString="*.bmp") returned 5
	[0052.800] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP"
	[0052.800] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP"
	[0052.800] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP."
	[0052.800] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.exe"
	[0052.800] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0052.800] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7db8
	[0052.800] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe5dee50, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe5dee50, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe5dee50, dwHighDateTime=0x1d327e8)) returned 1
	[0052.800] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.800] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7d76, lpOverlapped=0x0) returned 1
	[0052.802] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned="J0101858.BMP"
	[0052.802] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.802] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7d76, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7d76, lpOverlapped=0x0) returned 1
	[0052.802] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.802] CloseHandle (hObject=0x214) returned 1
	[0052.805] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp.exe")) returned 1
	[0052.806] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe5dee50, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe5dee50, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe5dee50, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101859.BMP", cAlternateFileName="")) returned 1
	[0052.806] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.806] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0101859.BMP") returned -1
	[0052.806] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0101859.BMP") returned -1
	[0052.806] lstrcmpiA (lpString1="", lpString2="J0101859.BMP") returned -1
	[0052.806] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned="J0101858.BMP"
	[0052.806] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.806] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.806] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.806] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.806] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0101859.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP"
	[0052.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP", pszSpec="*.zip") returned 0
	[0052.806] lstrlenA (lpString="*.zip") returned 5
	[0052.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP", pszSpec="*.rar") returned 0
	[0052.806] lstrlenA (lpString="*.rar") returned 5
	[0052.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP", pszSpec="*.7z") returned 0
	[0052.806] lstrlenA (lpString="*.7z") returned 4
	[0052.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP", pszSpec="*.tar") returned 0
	[0052.806] lstrlenA (lpString="*.tar") returned 5
	[0052.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP", pszSpec="*.gzip") returned 0
	[0052.806] lstrlenA (lpString="*.gzip") returned 6
	[0052.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP", pszSpec="*.jpg") returned 0
	[0052.807] lstrlenA (lpString="*.jpg") returned 5
	[0052.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP", pszSpec="*.jpeg") returned 0
	[0052.807] lstrlenA (lpString="*.jpeg") returned 6
	[0052.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP", pszSpec="*.bmp") returned 1
	[0052.807] lstrlenA (lpString="*.bmp") returned 5
	[0052.807] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP"
	[0052.807] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP"
	[0052.807] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP."
	[0052.807] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.exe"
	[0052.807] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0052.807] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7ce0
	[0052.807] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe5dee50, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe5dee50, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe5dee50, dwHighDateTime=0x1d327e8)) returned 1
	[0052.807] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.807] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7c9e, lpOverlapped=0x0) returned 1
	[0052.860] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned="J0101859.BMP"
	[0052.860] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.860] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7c9e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7c9e, lpOverlapped=0x0) returned 1
	[0052.860] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.861] CloseHandle (hObject=0x214) returned 1
	[0052.862] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp.exe")) returned 1
	[0052.863] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe59294b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe59294b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe59294b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101860.BMP", cAlternateFileName="")) returned 1
	[0052.863] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.863] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0101860.BMP") returned -1
	[0052.863] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0101860.BMP") returned -1
	[0052.863] lstrcmpiA (lpString1="", lpString2="J0101860.BMP") returned -1
	[0052.863] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned="J0101859.BMP"
	[0052.863] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.863] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.863] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.863] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.863] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0101860.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP"
	[0052.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP", pszSpec="*.zip") returned 0
	[0052.863] lstrlenA (lpString="*.zip") returned 5
	[0052.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP", pszSpec="*.rar") returned 0
	[0052.863] lstrlenA (lpString="*.rar") returned 5
	[0052.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP", pszSpec="*.7z") returned 0
	[0052.863] lstrlenA (lpString="*.7z") returned 4
	[0052.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP", pszSpec="*.tar") returned 0
	[0052.863] lstrlenA (lpString="*.tar") returned 5
	[0052.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP", pszSpec="*.gzip") returned 0
	[0052.863] lstrlenA (lpString="*.gzip") returned 6
	[0052.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP", pszSpec="*.jpg") returned 0
	[0052.863] lstrlenA (lpString="*.jpg") returned 5
	[0052.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP", pszSpec="*.jpeg") returned 0
	[0052.864] lstrlenA (lpString="*.jpeg") returned 6
	[0052.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP", pszSpec="*.bmp") returned 1
	[0052.864] lstrlenA (lpString="*.bmp") returned 5
	[0052.864] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP"
	[0052.864] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP"
	[0052.864] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP."
	[0052.864] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.exe"
	[0052.864] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0052.865] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7db8
	[0052.865] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe59294b, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe59294b, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe59294b, dwHighDateTime=0x1d327e8)) returned 1
	[0052.865] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.865] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7d76, lpOverlapped=0x0) returned 1
	[0052.866] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned="J0101860.BMP"
	[0052.866] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.866] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7d76, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7d76, lpOverlapped=0x0) returned 1
	[0052.867] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.867] CloseHandle (hObject=0x214) returned 1
	[0052.868] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp.exe")) returned 1
	[0052.869] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe5dee50, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe5dee50, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe5dee50, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101861.BMP", cAlternateFileName="")) returned 1
	[0052.869] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.869] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0101861.BMP") returned -1
	[0052.869] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0101861.BMP") returned -1
	[0052.869] lstrcmpiA (lpString1="", lpString2="J0101861.BMP") returned -1
	[0052.869] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned="J0101860.BMP"
	[0052.869] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.869] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.869] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.869] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.869] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0101861.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP"
	[0052.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP", pszSpec="*.zip") returned 0
	[0052.870] lstrlenA (lpString="*.zip") returned 5
	[0052.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP", pszSpec="*.rar") returned 0
	[0052.870] lstrlenA (lpString="*.rar") returned 5
	[0052.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP", pszSpec="*.7z") returned 0
	[0052.870] lstrlenA (lpString="*.7z") returned 4
	[0052.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP", pszSpec="*.tar") returned 0
	[0052.870] lstrlenA (lpString="*.tar") returned 5
	[0052.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP", pszSpec="*.gzip") returned 0
	[0052.870] lstrlenA (lpString="*.gzip") returned 6
	[0052.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP", pszSpec="*.jpg") returned 0
	[0052.870] lstrlenA (lpString="*.jpg") returned 5
	[0052.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP", pszSpec="*.jpeg") returned 0
	[0052.870] lstrlenA (lpString="*.jpeg") returned 6
	[0052.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP", pszSpec="*.bmp") returned 1
	[0052.870] lstrlenA (lpString="*.bmp") returned 5
	[0052.870] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP"
	[0052.870] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP"
	[0052.870] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP."
	[0052.870] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.exe"
	[0052.870] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0052.870] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7db8
	[0052.870] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe5dee50, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe5dee50, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe5dee50, dwHighDateTime=0x1d327e8)) returned 1
	[0052.870] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.870] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7d76, lpOverlapped=0x0) returned 1
	[0052.872] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned="J0101861.BMP"
	[0052.872] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.872] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7d76, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7d76, lpOverlapped=0x0) returned 1
	[0052.873] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.873] CloseHandle (hObject=0x214) returned 1
	[0052.874] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp.exe")) returned 1
	[0052.874] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe59294b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe59294b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe5dee50, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101862.BMP", cAlternateFileName="")) returned 1
	[0052.875] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.875] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0101862.BMP") returned -1
	[0052.875] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0101862.BMP") returned -1
	[0052.875] lstrcmpiA (lpString1="", lpString2="J0101862.BMP") returned -1
	[0052.875] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned="J0101861.BMP"
	[0052.875] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.875] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.875] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.875] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.875] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0101862.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP"
	[0052.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP", pszSpec="*.zip") returned 0
	[0052.875] lstrlenA (lpString="*.zip") returned 5
	[0052.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP", pszSpec="*.rar") returned 0
	[0052.875] lstrlenA (lpString="*.rar") returned 5
	[0052.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP", pszSpec="*.7z") returned 0
	[0052.875] lstrlenA (lpString="*.7z") returned 4
	[0052.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP", pszSpec="*.tar") returned 0
	[0052.875] lstrlenA (lpString="*.tar") returned 5
	[0052.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP", pszSpec="*.gzip") returned 0
	[0052.875] lstrlenA (lpString="*.gzip") returned 6
	[0052.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP", pszSpec="*.jpg") returned 0
	[0052.875] lstrlenA (lpString="*.jpg") returned 5
	[0052.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP", pszSpec="*.jpeg") returned 0
	[0052.875] lstrlenA (lpString="*.jpeg") returned 6
	[0052.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP", pszSpec="*.bmp") returned 1
	[0052.875] lstrlenA (lpString="*.bmp") returned 5
	[0052.875] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP"
	[0052.875] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP"
	[0052.875] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP."
	[0052.875] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.exe"
	[0052.875] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0052.876] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7db8
	[0052.876] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe59294b, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe59294b, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe5dee50, dwHighDateTime=0x1d327e8)) returned 1
	[0052.876] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.876] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7d76, lpOverlapped=0x0) returned 1
	[0052.877] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned="J0101862.BMP"
	[0052.877] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.877] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7d76, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7d76, lpOverlapped=0x0) returned 1
	[0052.878] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.878] CloseHandle (hObject=0x214) returned 1
	[0052.879] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp.exe")) returned 1
	[0052.879] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe59294b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe59294b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe5dee50, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101863.BMP", cAlternateFileName="")) returned 1
	[0052.879] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.879] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0101863.BMP") returned -1
	[0052.880] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0101863.BMP") returned -1
	[0052.880] lstrcmpiA (lpString1="", lpString2="J0101863.BMP") returned -1
	[0052.880] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned="J0101862.BMP"
	[0052.880] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.880] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.880] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.880] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.880] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0101863.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP"
	[0052.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP", pszSpec="*.zip") returned 0
	[0052.880] lstrlenA (lpString="*.zip") returned 5
	[0052.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP", pszSpec="*.rar") returned 0
	[0052.880] lstrlenA (lpString="*.rar") returned 5
	[0052.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP", pszSpec="*.7z") returned 0
	[0052.880] lstrlenA (lpString="*.7z") returned 4
	[0052.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP", pszSpec="*.tar") returned 0
	[0052.880] lstrlenA (lpString="*.tar") returned 5
	[0052.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP", pszSpec="*.gzip") returned 0
	[0052.880] lstrlenA (lpString="*.gzip") returned 6
	[0052.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP", pszSpec="*.jpg") returned 0
	[0052.880] lstrlenA (lpString="*.jpg") returned 5
	[0052.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP", pszSpec="*.jpeg") returned 0
	[0052.880] lstrlenA (lpString="*.jpeg") returned 6
	[0052.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP", pszSpec="*.bmp") returned 1
	[0052.880] lstrlenA (lpString="*.bmp") returned 5
	[0052.880] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP"
	[0052.880] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP"
	[0052.880] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP."
	[0052.880] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.exe"
	[0052.880] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0052.881] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7db8
	[0052.881] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe59294b, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe59294b, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe5dee50, dwHighDateTime=0x1d327e8)) returned 1
	[0052.881] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.881] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7d76, lpOverlapped=0x0) returned 1
	[0052.883] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned="J0101863.BMP"
	[0052.883] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.883] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7d76, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7d76, lpOverlapped=0x0) returned 1
	[0052.883] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.883] CloseHandle (hObject=0x214) returned 1
	[0052.884] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp.exe")) returned 1
	[0052.885] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe59294b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe59294b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe5dee50, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101864.BMP", cAlternateFileName="")) returned 1
	[0052.885] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.885] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0101864.BMP") returned -1
	[0052.885] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0101864.BMP") returned -1
	[0052.885] lstrcmpiA (lpString1="", lpString2="J0101864.BMP") returned -1
	[0052.885] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned="J0101863.BMP"
	[0052.885] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.885] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.885] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.885] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.885] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0101864.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP"
	[0052.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP", pszSpec="*.zip") returned 0
	[0052.885] lstrlenA (lpString="*.zip") returned 5
	[0052.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP", pszSpec="*.rar") returned 0
	[0052.885] lstrlenA (lpString="*.rar") returned 5
	[0052.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP", pszSpec="*.7z") returned 0
	[0052.885] lstrlenA (lpString="*.7z") returned 4
	[0052.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP", pszSpec="*.tar") returned 0
	[0052.885] lstrlenA (lpString="*.tar") returned 5
	[0052.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP", pszSpec="*.gzip") returned 0
	[0052.885] lstrlenA (lpString="*.gzip") returned 6
	[0052.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP", pszSpec="*.jpg") returned 0
	[0052.886] lstrlenA (lpString="*.jpg") returned 5
	[0052.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP", pszSpec="*.jpeg") returned 0
	[0052.886] lstrlenA (lpString="*.jpeg") returned 6
	[0052.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP", pszSpec="*.bmp") returned 1
	[0052.886] lstrlenA (lpString="*.bmp") returned 5
	[0052.886] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP"
	[0052.886] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP"
	[0052.886] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP."
	[0052.886] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.exe"
	[0052.886] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0052.886] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7ce0
	[0052.886] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe59294b, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe59294b, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe5dee50, dwHighDateTime=0x1d327e8)) returned 1
	[0052.886] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.886] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7c9e, lpOverlapped=0x0) returned 1
	[0052.888] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned="J0101864.BMP"
	[0052.889] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.889] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7c9e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7c9e, lpOverlapped=0x0) returned 1
	[0052.889] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.889] CloseHandle (hObject=0x214) returned 1
	[0052.890] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp.exe")) returned 1
	[0052.891] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe605048, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe605048, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe605048, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101865.BMP", cAlternateFileName="")) returned 1
	[0052.891] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.891] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0101865.BMP") returned -1
	[0052.891] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0101865.BMP") returned -1
	[0052.891] lstrcmpiA (lpString1="", lpString2="J0101865.BMP") returned -1
	[0052.891] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned="J0101864.BMP"
	[0052.891] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.891] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.891] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.891] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.891] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0101865.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP"
	[0052.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP", pszSpec="*.zip") returned 0
	[0052.891] lstrlenA (lpString="*.zip") returned 5
	[0052.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP", pszSpec="*.rar") returned 0
	[0052.891] lstrlenA (lpString="*.rar") returned 5
	[0052.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP", pszSpec="*.7z") returned 0
	[0052.891] lstrlenA (lpString="*.7z") returned 4
	[0052.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP", pszSpec="*.tar") returned 0
	[0052.891] lstrlenA (lpString="*.tar") returned 5
	[0052.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP", pszSpec="*.gzip") returned 0
	[0052.892] lstrlenA (lpString="*.gzip") returned 6
	[0052.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP", pszSpec="*.jpg") returned 0
	[0052.892] lstrlenA (lpString="*.jpg") returned 5
	[0052.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP", pszSpec="*.jpeg") returned 0
	[0052.892] lstrlenA (lpString="*.jpeg") returned 6
	[0052.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP", pszSpec="*.bmp") returned 1
	[0052.892] lstrlenA (lpString="*.bmp") returned 5
	[0052.892] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP"
	[0052.892] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP"
	[0052.892] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP."
	[0052.892] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.exe"
	[0052.892] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0052.893] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7db8
	[0052.893] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe605048, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe605048, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe605048, dwHighDateTime=0x1d327e8)) returned 1
	[0052.893] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.893] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7d76, lpOverlapped=0x0) returned 1
	[0052.956] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned="J0101865.BMP"
	[0052.956] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.956] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7d76, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7d76, lpOverlapped=0x0) returned 1
	[0052.956] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.956] CloseHandle (hObject=0x214) returned 1
	[0052.958] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp.exe")) returned 1
	[0052.959] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe605048, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe605048, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe605048, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101866.BMP", cAlternateFileName="")) returned 1
	[0052.960] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.960] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0101866.BMP") returned -1
	[0052.960] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0101866.BMP") returned -1
	[0052.960] lstrcmpiA (lpString1="", lpString2="J0101866.BMP") returned -1
	[0052.960] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned="J0101865.BMP"
	[0052.960] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.960] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.960] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.960] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.960] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0101866.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP"
	[0052.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP", pszSpec="*.zip") returned 0
	[0052.960] lstrlenA (lpString="*.zip") returned 5
	[0052.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP", pszSpec="*.rar") returned 0
	[0052.960] lstrlenA (lpString="*.rar") returned 5
	[0052.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP", pszSpec="*.7z") returned 0
	[0052.960] lstrlenA (lpString="*.7z") returned 4
	[0052.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP", pszSpec="*.tar") returned 0
	[0052.960] lstrlenA (lpString="*.tar") returned 5
	[0052.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP", pszSpec="*.gzip") returned 0
	[0052.961] lstrlenA (lpString="*.gzip") returned 6
	[0052.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP", pszSpec="*.jpg") returned 0
	[0052.961] lstrlenA (lpString="*.jpg") returned 5
	[0052.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP", pszSpec="*.jpeg") returned 0
	[0052.961] lstrlenA (lpString="*.jpeg") returned 6
	[0052.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP", pszSpec="*.bmp") returned 1
	[0052.961] lstrlenA (lpString="*.bmp") returned 5
	[0052.961] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP"
	[0052.961] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP"
	[0052.961] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP."
	[0052.961] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.exe"
	[0052.961] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0052.961] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7db8
	[0052.961] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe605048, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe605048, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe605048, dwHighDateTime=0x1d327e8)) returned 1
	[0052.961] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.961] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7d76, lpOverlapped=0x0) returned 1
	[0052.963] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned="J0101866.BMP"
	[0052.963] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.963] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7d76, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7d76, lpOverlapped=0x0) returned 1
	[0052.963] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.963] CloseHandle (hObject=0x214) returned 1
	[0052.964] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp.exe")) returned 1
	[0052.966] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe605048, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe605048, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe605048, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101867.BMP", cAlternateFileName="")) returned 1
	[0052.966] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.966] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0101867.BMP") returned -1
	[0052.966] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0101867.BMP") returned -1
	[0052.966] lstrcmpiA (lpString1="", lpString2="J0101867.BMP") returned -1
	[0052.966] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned="J0101866.BMP"
	[0052.966] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.966] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.966] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.966] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.966] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0101867.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP"
	[0052.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP", pszSpec="*.zip") returned 0
	[0052.966] lstrlenA (lpString="*.zip") returned 5
	[0052.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP", pszSpec="*.rar") returned 0
	[0052.966] lstrlenA (lpString="*.rar") returned 5
	[0052.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP", pszSpec="*.7z") returned 0
	[0052.966] lstrlenA (lpString="*.7z") returned 4
	[0052.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP", pszSpec="*.tar") returned 0
	[0052.966] lstrlenA (lpString="*.tar") returned 5
	[0052.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP", pszSpec="*.gzip") returned 0
	[0052.966] lstrlenA (lpString="*.gzip") returned 6
	[0052.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP", pszSpec="*.jpg") returned 0
	[0052.966] lstrlenA (lpString="*.jpg") returned 5
	[0052.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP", pszSpec="*.jpeg") returned 0
	[0052.966] lstrlenA (lpString="*.jpeg") returned 6
	[0052.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP", pszSpec="*.bmp") returned 1
	[0052.967] lstrlenA (lpString="*.bmp") returned 5
	[0052.967] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP"
	[0052.967] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP"
	[0052.967] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP."
	[0052.967] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.exe"
	[0052.967] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0052.967] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7f68
	[0052.967] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe605048, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe605048, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe605048, dwHighDateTime=0x1d327e8)) returned 1
	[0052.967] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.967] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7f26, lpOverlapped=0x0) returned 1
	[0052.969] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned="J0101867.BMP"
	[0052.969] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0052.969] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7f26, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7f26, lpOverlapped=0x0) returned 1
	[0052.969] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.969] CloseHandle (hObject=0x214) returned 1
	[0052.970] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp.exe")) returned 1
	[0052.971] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe605048, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe605048, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe605048, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3ee8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101980.WMF", cAlternateFileName="")) returned 1
	[0052.971] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.971] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0101980.WMF") returned -1
	[0052.971] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0101980.WMF") returned -1
	[0052.971] lstrcmpiA (lpString1="", lpString2="J0101980.WMF") returned -1
	[0052.971] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned="J0101867.BMP"
	[0052.971] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.971] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.971] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.971] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.971] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0101980.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF"
	[0052.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.zip") returned 0
	[0052.971] lstrlenA (lpString="*.zip") returned 5
	[0052.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.rar") returned 0
	[0052.971] lstrlenA (lpString="*.rar") returned 5
	[0052.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.7z") returned 0
	[0052.971] lstrlenA (lpString="*.7z") returned 4
	[0052.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.tar") returned 0
	[0052.971] lstrlenA (lpString="*.tar") returned 5
	[0052.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.gzip") returned 0
	[0052.972] lstrlenA (lpString="*.gzip") returned 6
	[0052.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.jpg") returned 0
	[0052.972] lstrlenA (lpString="*.jpg") returned 5
	[0052.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.jpeg") returned 0
	[0052.972] lstrlenA (lpString="*.jpeg") returned 6
	[0052.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.bmp") returned 0
	[0052.972] lstrlenA (lpString="*.bmp") returned 5
	[0052.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.gif") returned 0
	[0052.972] lstrlenA (lpString="*.gif") returned 5
	[0052.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.png") returned 0
	[0052.972] lstrlenA (lpString="*.png") returned 5
	[0052.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.doc") returned 0
	[0052.972] lstrlenA (lpString="*.doc") returned 5
	[0052.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.docx") returned 0
	[0052.972] lstrlenA (lpString="*.docx") returned 6
	[0052.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.xls") returned 0
	[0052.972] lstrlenA (lpString="*.xls") returned 5
	[0052.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.xlsx") returned 0
	[0052.972] lstrlenA (lpString="*.xlsx") returned 6
	[0052.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.ppt") returned 0
	[0052.972] lstrlenA (lpString="*.ppt") returned 5
	[0052.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.pptx") returned 0
	[0052.972] lstrlenA (lpString="*.pptx") returned 6
	[0052.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.txt") returned 0
	[0052.972] lstrlenA (lpString="*.txt") returned 5
	[0052.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.pdf") returned 0
	[0052.972] lstrlenA (lpString="*.pdf") returned 5
	[0052.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.htm") returned 0
	[0052.972] lstrlenA (lpString="*.htm") returned 5
	[0052.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.html") returned 0
	[0052.972] lstrlenA (lpString="*.html") returned 6
	[0052.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.mdb") returned 0
	[0052.972] lstrlenA (lpString="*.mdb") returned 5
	[0052.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.pfx") returned 0
	[0052.973] lstrlenA (lpString="*.pfx") returned 5
	[0052.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.md") returned 0
	[0052.973] lstrlenA (lpString="*.md") returned 4
	[0052.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.lnk") returned 0
	[0052.973] lstrlenA (lpString="*.lnk") returned 5
	[0052.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.torrent") returned 0
	[0052.973] lstrlenA (lpString="*.torrent") returned 9
	[0052.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.mov") returned 0
	[0052.973] lstrlenA (lpString="*.mov") returned 5
	[0052.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.3gp") returned 0
	[0052.973] lstrlenA (lpString="*.3gp") returned 5
	[0052.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.mpeg") returned 0
	[0052.973] lstrlenA (lpString="*.mpeg") returned 6
	[0052.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.mpg") returned 0
	[0052.973] lstrlenA (lpString="*.mpg") returned 5
	[0052.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.flv") returned 0
	[0052.973] lstrlenA (lpString="*.flv") returned 5
	[0052.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.avi") returned 0
	[0052.973] lstrlenA (lpString="*.avi") returned 5
	[0052.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.mp4") returned 0
	[0052.973] lstrlenA (lpString="*.mp4") returned 5
	[0052.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.wmv") returned 0
	[0052.973] lstrlenA (lpString="*.wmv") returned 5
	[0052.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.mkv") returned 0
	[0052.973] lstrlenA (lpString="*.mkv") returned 5
	[0052.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.mp3") returned 0
	[0052.973] lstrlenA (lpString="*.mp3") returned 5
	[0052.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.wav") returned 0
	[0052.973] lstrlenA (lpString="*.wav") returned 5
	[0052.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.flac") returned 0
	[0052.973] lstrlenA (lpString="*.flac") returned 6
	[0052.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.wma") returned 0
	[0052.974] lstrlenA (lpString="*.wma") returned 5
	[0052.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.au3") returned 0
	[0052.974] lstrlenA (lpString="*.au3") returned 5
	[0052.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.ahk") returned 0
	[0052.974] lstrlenA (lpString="*.ahk") returned 5
	[0052.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.c") returned 0
	[0052.974] lstrlenA (lpString="*.c") returned 3
	[0052.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.cc") returned 0
	[0052.974] lstrlenA (lpString="*.cc") returned 4
	[0052.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.cpp") returned 0
	[0052.974] lstrlenA (lpString="*.cpp") returned 5
	[0052.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.cxx") returned 0
	[0052.974] lstrlenA (lpString="*.cxx") returned 5
	[0052.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.c++") returned 0
	[0052.974] lstrlenA (lpString="*.c++") returned 5
	[0052.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.cs") returned 0
	[0052.974] lstrlenA (lpString="*.cs") returned 4
	[0052.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.vb") returned 0
	[0052.974] lstrlenA (lpString="*.vb") returned 4
	[0052.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.bas") returned 0
	[0052.974] lstrlenA (lpString="*.bas") returned 5
	[0052.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.csproj") returned 0
	[0052.974] lstrlenA (lpString="*.csproj") returned 8
	[0052.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.vbproj") returned 0
	[0052.974] lstrlenA (lpString="*.vbproj") returned 8
	[0052.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.vcxproj") returned 0
	[0052.974] lstrlenA (lpString="*.vcxproj") returned 9
	[0052.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.manifest") returned 0
	[0052.974] lstrlenA (lpString="*.manifest") returned 10
	[0052.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.php") returned 0
	[0052.974] lstrlenA (lpString="*.php") returned 5
	[0052.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.vbe") returned 0
	[0052.974] lstrlenA (lpString="*.vbe") returned 5
	[0052.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.vba") returned 0
	[0052.975] lstrlenA (lpString="*.vba") returned 5
	[0052.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.vbs") returned 0
	[0052.975] lstrlenA (lpString="*.vbs") returned 5
	[0052.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.bat") returned 0
	[0052.975] lstrlenA (lpString="*.bat") returned 5
	[0052.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.cmd") returned 0
	[0052.975] lstrlenA (lpString="*.cmd") returned 5
	[0052.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.js") returned 0
	[0052.975] lstrlenA (lpString="*.js") returned 4
	[0052.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.jscript") returned 0
	[0052.975] lstrlenA (lpString="*.jscript") returned 9
	[0052.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.hta") returned 0
	[0052.975] lstrlenA (lpString="*.hta") returned 5
	[0052.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.php7") returned 0
	[0052.975] lstrlenA (lpString="*.php7") returned 6
	[0052.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.db") returned 0
	[0052.975] lstrlenA (lpString="*.db") returned 4
	[0052.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.swf") returned 0
	[0052.975] lstrlenA (lpString="*.swf") returned 5
	[0052.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.eml") returned 0
	[0052.975] lstrlenA (lpString="*.eml") returned 5
	[0052.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.part") returned 0
	[0052.975] lstrlenA (lpString="*.part") returned 6
	[0052.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.nfo") returned 0
	[0052.975] lstrlenA (lpString="*.nfo") returned 5
	[0052.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.rsa") returned 0
	[0052.975] lstrlenA (lpString="*.rsa") returned 5
	[0052.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.key") returned 0
	[0052.975] lstrlenA (lpString="*.key") returned 5
	[0052.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.aes") returned 0
	[0052.975] lstrlenA (lpString="*.aes") returned 5
	[0052.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.blob") returned 0
	[0052.975] lstrlenA (lpString="*.blob") returned 6
	[0052.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.btc") returned 0
	[0052.976] lstrlenA (lpString="*.btc") returned 5
	[0052.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF", pszSpec="*.wallet") returned 0
	[0052.976] lstrlenA (lpString="*.wallet") returned 8
	[0052.976] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe605048, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe605048, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe605048, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3e74, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0102002.WMF", cAlternateFileName="")) returned 1
	[0052.976] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.976] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0102002.WMF") returned -1
	[0052.976] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0102002.WMF") returned -1
	[0052.976] lstrcmpiA (lpString1="", lpString2="J0102002.WMF") returned -1
	[0052.976] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned="J0101980.WMF"
	[0052.976] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.976] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.976] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.976] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.976] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0102002.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF"
	[0052.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.zip") returned 0
	[0052.976] lstrlenA (lpString="*.zip") returned 5
	[0052.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.rar") returned 0
	[0052.976] lstrlenA (lpString="*.rar") returned 5
	[0052.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.7z") returned 0
	[0052.976] lstrlenA (lpString="*.7z") returned 4
	[0052.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.tar") returned 0
	[0052.976] lstrlenA (lpString="*.tar") returned 5
	[0052.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.gzip") returned 0
	[0052.976] lstrlenA (lpString="*.gzip") returned 6
	[0052.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.jpg") returned 0
	[0052.976] lstrlenA (lpString="*.jpg") returned 5
	[0052.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.jpeg") returned 0
	[0052.976] lstrlenA (lpString="*.jpeg") returned 6
	[0052.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.bmp") returned 0
	[0052.976] lstrlenA (lpString="*.bmp") returned 5
	[0052.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.gif") returned 0
	[0052.977] lstrlenA (lpString="*.gif") returned 5
	[0052.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.png") returned 0
	[0052.977] lstrlenA (lpString="*.png") returned 5
	[0052.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.doc") returned 0
	[0052.977] lstrlenA (lpString="*.doc") returned 5
	[0052.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.docx") returned 0
	[0052.977] lstrlenA (lpString="*.docx") returned 6
	[0052.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.xls") returned 0
	[0052.977] lstrlenA (lpString="*.xls") returned 5
	[0052.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.xlsx") returned 0
	[0052.977] lstrlenA (lpString="*.xlsx") returned 6
	[0052.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.ppt") returned 0
	[0052.977] lstrlenA (lpString="*.ppt") returned 5
	[0052.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.pptx") returned 0
	[0052.977] lstrlenA (lpString="*.pptx") returned 6
	[0052.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.txt") returned 0
	[0052.977] lstrlenA (lpString="*.txt") returned 5
	[0052.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.pdf") returned 0
	[0052.977] lstrlenA (lpString="*.pdf") returned 5
	[0052.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.htm") returned 0
	[0052.977] lstrlenA (lpString="*.htm") returned 5
	[0052.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.html") returned 0
	[0052.977] lstrlenA (lpString="*.html") returned 6
	[0052.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.mdb") returned 0
	[0052.977] lstrlenA (lpString="*.mdb") returned 5
	[0052.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.pfx") returned 0
	[0052.977] lstrlenA (lpString="*.pfx") returned 5
	[0052.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.md") returned 0
	[0052.977] lstrlenA (lpString="*.md") returned 4
	[0052.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.lnk") returned 0
	[0052.977] lstrlenA (lpString="*.lnk") returned 5
	[0052.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.torrent") returned 0
	[0052.977] lstrlenA (lpString="*.torrent") returned 9
	[0052.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.mov") returned 0
	[0052.978] lstrlenA (lpString="*.mov") returned 5
	[0052.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.3gp") returned 0
	[0052.978] lstrlenA (lpString="*.3gp") returned 5
	[0052.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.mpeg") returned 0
	[0052.978] lstrlenA (lpString="*.mpeg") returned 6
	[0052.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.mpg") returned 0
	[0052.978] lstrlenA (lpString="*.mpg") returned 5
	[0052.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.flv") returned 0
	[0052.978] lstrlenA (lpString="*.flv") returned 5
	[0052.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.avi") returned 0
	[0052.978] lstrlenA (lpString="*.avi") returned 5
	[0052.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.mp4") returned 0
	[0052.978] lstrlenA (lpString="*.mp4") returned 5
	[0052.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.wmv") returned 0
	[0052.978] lstrlenA (lpString="*.wmv") returned 5
	[0052.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.mkv") returned 0
	[0052.978] lstrlenA (lpString="*.mkv") returned 5
	[0052.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.mp3") returned 0
	[0052.978] lstrlenA (lpString="*.mp3") returned 5
	[0052.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.wav") returned 0
	[0052.978] lstrlenA (lpString="*.wav") returned 5
	[0052.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.flac") returned 0
	[0052.978] lstrlenA (lpString="*.flac") returned 6
	[0052.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.wma") returned 0
	[0052.978] lstrlenA (lpString="*.wma") returned 5
	[0052.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.au3") returned 0
	[0052.978] lstrlenA (lpString="*.au3") returned 5
	[0052.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.ahk") returned 0
	[0052.978] lstrlenA (lpString="*.ahk") returned 5
	[0052.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.c") returned 0
	[0052.978] lstrlenA (lpString="*.c") returned 3
	[0052.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.cc") returned 0
	[0052.978] lstrlenA (lpString="*.cc") returned 4
	[0052.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.cpp") returned 0
	[0052.979] lstrlenA (lpString="*.cpp") returned 5
	[0052.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.cxx") returned 0
	[0052.979] lstrlenA (lpString="*.cxx") returned 5
	[0052.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.c++") returned 0
	[0052.979] lstrlenA (lpString="*.c++") returned 5
	[0052.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.cs") returned 0
	[0052.979] lstrlenA (lpString="*.cs") returned 4
	[0052.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.vb") returned 0
	[0052.979] lstrlenA (lpString="*.vb") returned 4
	[0052.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.bas") returned 0
	[0052.979] lstrlenA (lpString="*.bas") returned 5
	[0052.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.csproj") returned 0
	[0052.979] lstrlenA (lpString="*.csproj") returned 8
	[0052.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.vbproj") returned 0
	[0052.979] lstrlenA (lpString="*.vbproj") returned 8
	[0052.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.vcxproj") returned 0
	[0052.979] lstrlenA (lpString="*.vcxproj") returned 9
	[0052.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.manifest") returned 0
	[0052.979] lstrlenA (lpString="*.manifest") returned 10
	[0052.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.php") returned 0
	[0052.979] lstrlenA (lpString="*.php") returned 5
	[0052.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.vbe") returned 0
	[0052.979] lstrlenA (lpString="*.vbe") returned 5
	[0052.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.vba") returned 0
	[0052.979] lstrlenA (lpString="*.vba") returned 5
	[0052.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.vbs") returned 0
	[0052.979] lstrlenA (lpString="*.vbs") returned 5
	[0052.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.bat") returned 0
	[0052.979] lstrlenA (lpString="*.bat") returned 5
	[0052.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.cmd") returned 0
	[0052.979] lstrlenA (lpString="*.cmd") returned 5
	[0052.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.js") returned 0
	[0052.980] lstrlenA (lpString="*.js") returned 4
	[0052.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.jscript") returned 0
	[0052.980] lstrlenA (lpString="*.jscript") returned 9
	[0052.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.hta") returned 0
	[0052.980] lstrlenA (lpString="*.hta") returned 5
	[0052.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.php7") returned 0
	[0052.980] lstrlenA (lpString="*.php7") returned 6
	[0052.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.db") returned 0
	[0052.980] lstrlenA (lpString="*.db") returned 4
	[0052.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.swf") returned 0
	[0052.980] lstrlenA (lpString="*.swf") returned 5
	[0052.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.eml") returned 0
	[0052.980] lstrlenA (lpString="*.eml") returned 5
	[0052.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.part") returned 0
	[0052.980] lstrlenA (lpString="*.part") returned 6
	[0052.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.nfo") returned 0
	[0052.980] lstrlenA (lpString="*.nfo") returned 5
	[0052.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.rsa") returned 0
	[0052.980] lstrlenA (lpString="*.rsa") returned 5
	[0052.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.key") returned 0
	[0052.980] lstrlenA (lpString="*.key") returned 5
	[0052.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.aes") returned 0
	[0052.980] lstrlenA (lpString="*.aes") returned 5
	[0052.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.blob") returned 0
	[0052.980] lstrlenA (lpString="*.blob") returned 6
	[0052.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.btc") returned 0
	[0052.980] lstrlenA (lpString="*.btc") returned 5
	[0052.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF", pszSpec="*.wallet") returned 0
	[0052.980] lstrlenA (lpString="*.wallet") returned 8
	[0052.980] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe5dee50, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe5dee50, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe605048, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6978, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0102594.WMF", cAlternateFileName="")) returned 1
	[0052.980] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.980] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0102594.WMF") returned -1
	[0052.981] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0102594.WMF") returned -1
	[0052.981] lstrcmpiA (lpString1="", lpString2="J0102594.WMF") returned -1
	[0052.981] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned="J0102002.WMF"
	[0052.981] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.981] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.981] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.981] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.981] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0102594.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF"
	[0052.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.zip") returned 0
	[0052.981] lstrlenA (lpString="*.zip") returned 5
	[0052.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.rar") returned 0
	[0052.981] lstrlenA (lpString="*.rar") returned 5
	[0052.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.7z") returned 0
	[0052.981] lstrlenA (lpString="*.7z") returned 4
	[0052.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.tar") returned 0
	[0052.981] lstrlenA (lpString="*.tar") returned 5
	[0052.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.gzip") returned 0
	[0052.981] lstrlenA (lpString="*.gzip") returned 6
	[0052.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.jpg") returned 0
	[0052.981] lstrlenA (lpString="*.jpg") returned 5
	[0052.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.jpeg") returned 0
	[0052.982] lstrlenA (lpString="*.jpeg") returned 6
	[0052.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.bmp") returned 0
	[0052.982] lstrlenA (lpString="*.bmp") returned 5
	[0052.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.gif") returned 0
	[0052.982] lstrlenA (lpString="*.gif") returned 5
	[0052.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.png") returned 0
	[0052.982] lstrlenA (lpString="*.png") returned 5
	[0052.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.doc") returned 0
	[0052.982] lstrlenA (lpString="*.doc") returned 5
	[0052.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.docx") returned 0
	[0052.982] lstrlenA (lpString="*.docx") returned 6
	[0052.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.xls") returned 0
	[0052.982] lstrlenA (lpString="*.xls") returned 5
	[0052.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.xlsx") returned 0
	[0052.982] lstrlenA (lpString="*.xlsx") returned 6
	[0052.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.ppt") returned 0
	[0052.982] lstrlenA (lpString="*.ppt") returned 5
	[0052.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.pptx") returned 0
	[0052.982] lstrlenA (lpString="*.pptx") returned 6
	[0052.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.txt") returned 0
	[0052.982] lstrlenA (lpString="*.txt") returned 5
	[0052.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.pdf") returned 0
	[0052.982] lstrlenA (lpString="*.pdf") returned 5
	[0052.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.htm") returned 0
	[0052.982] lstrlenA (lpString="*.htm") returned 5
	[0052.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.html") returned 0
	[0052.982] lstrlenA (lpString="*.html") returned 6
	[0052.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.mdb") returned 0
	[0052.982] lstrlenA (lpString="*.mdb") returned 5
	[0052.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.pfx") returned 0
	[0052.982] lstrlenA (lpString="*.pfx") returned 5
	[0052.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.md") returned 0
	[0052.983] lstrlenA (lpString="*.md") returned 4
	[0052.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.lnk") returned 0
	[0052.983] lstrlenA (lpString="*.lnk") returned 5
	[0052.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.torrent") returned 0
	[0052.983] lstrlenA (lpString="*.torrent") returned 9
	[0052.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.mov") returned 0
	[0052.983] lstrlenA (lpString="*.mov") returned 5
	[0052.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.3gp") returned 0
	[0052.983] lstrlenA (lpString="*.3gp") returned 5
	[0052.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.mpeg") returned 0
	[0052.983] lstrlenA (lpString="*.mpeg") returned 6
	[0052.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.mpg") returned 0
	[0052.983] lstrlenA (lpString="*.mpg") returned 5
	[0052.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.flv") returned 0
	[0052.983] lstrlenA (lpString="*.flv") returned 5
	[0052.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.avi") returned 0
	[0052.983] lstrlenA (lpString="*.avi") returned 5
	[0052.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.mp4") returned 0
	[0052.983] lstrlenA (lpString="*.mp4") returned 5
	[0052.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.wmv") returned 0
	[0052.983] lstrlenA (lpString="*.wmv") returned 5
	[0052.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.mkv") returned 0
	[0052.983] lstrlenA (lpString="*.mkv") returned 5
	[0052.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.mp3") returned 0
	[0052.983] lstrlenA (lpString="*.mp3") returned 5
	[0052.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.wav") returned 0
	[0052.983] lstrlenA (lpString="*.wav") returned 5
	[0052.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.flac") returned 0
	[0052.983] lstrlenA (lpString="*.flac") returned 6
	[0052.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.wma") returned 0
	[0052.983] lstrlenA (lpString="*.wma") returned 5
	[0052.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.au3") returned 0
	[0052.983] lstrlenA (lpString="*.au3") returned 5
	[0052.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.ahk") returned 0
	[0052.983] lstrlenA (lpString="*.ahk") returned 5
	[0052.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.c") returned 0
	[0052.984] lstrlenA (lpString="*.c") returned 3
	[0052.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.cc") returned 0
	[0052.984] lstrlenA (lpString="*.cc") returned 4
	[0052.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.cpp") returned 0
	[0052.984] lstrlenA (lpString="*.cpp") returned 5
	[0052.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.cxx") returned 0
	[0052.984] lstrlenA (lpString="*.cxx") returned 5
	[0052.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.c++") returned 0
	[0052.984] lstrlenA (lpString="*.c++") returned 5
	[0052.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.cs") returned 0
	[0052.984] lstrlenA (lpString="*.cs") returned 4
	[0052.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.vb") returned 0
	[0052.984] lstrlenA (lpString="*.vb") returned 4
	[0052.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.bas") returned 0
	[0052.984] lstrlenA (lpString="*.bas") returned 5
	[0052.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.csproj") returned 0
	[0052.984] lstrlenA (lpString="*.csproj") returned 8
	[0052.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.vbproj") returned 0
	[0052.984] lstrlenA (lpString="*.vbproj") returned 8
	[0052.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.vcxproj") returned 0
	[0052.984] lstrlenA (lpString="*.vcxproj") returned 9
	[0052.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.manifest") returned 0
	[0052.984] lstrlenA (lpString="*.manifest") returned 10
	[0052.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.php") returned 0
	[0052.984] lstrlenA (lpString="*.php") returned 5
	[0052.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.vbe") returned 0
	[0052.984] lstrlenA (lpString="*.vbe") returned 5
	[0052.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.vba") returned 0
	[0052.984] lstrlenA (lpString="*.vba") returned 5
	[0052.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.vbs") returned 0
	[0052.984] lstrlenA (lpString="*.vbs") returned 5
	[0052.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.bat") returned 0
	[0052.984] lstrlenA (lpString="*.bat") returned 5
	[0052.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.cmd") returned 0
	[0052.985] lstrlenA (lpString="*.cmd") returned 5
	[0052.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.js") returned 0
	[0052.985] lstrlenA (lpString="*.js") returned 4
	[0052.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.jscript") returned 0
	[0052.985] lstrlenA (lpString="*.jscript") returned 9
	[0052.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.hta") returned 0
	[0052.985] lstrlenA (lpString="*.hta") returned 5
	[0052.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.php7") returned 0
	[0052.985] lstrlenA (lpString="*.php7") returned 6
	[0052.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.db") returned 0
	[0052.985] lstrlenA (lpString="*.db") returned 4
	[0052.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.swf") returned 0
	[0052.985] lstrlenA (lpString="*.swf") returned 5
	[0052.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.eml") returned 0
	[0052.985] lstrlenA (lpString="*.eml") returned 5
	[0052.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.part") returned 0
	[0052.985] lstrlenA (lpString="*.part") returned 6
	[0052.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.nfo") returned 0
	[0052.985] lstrlenA (lpString="*.nfo") returned 5
	[0052.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.rsa") returned 0
	[0052.985] lstrlenA (lpString="*.rsa") returned 5
	[0052.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.key") returned 0
	[0052.985] lstrlenA (lpString="*.key") returned 5
	[0052.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.aes") returned 0
	[0052.985] lstrlenA (lpString="*.aes") returned 5
	[0052.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.blob") returned 0
	[0052.985] lstrlenA (lpString="*.blob") returned 6
	[0052.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.btc") returned 0
	[0052.985] lstrlenA (lpString="*.btc") returned 5
	[0052.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF", pszSpec="*.wallet") returned 0
	[0052.985] lstrlenA (lpString="*.wallet") returned 8
	[0052.985] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe605048, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe605048, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe605048, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2bd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0102762.WMF", cAlternateFileName="")) returned 1
	[0052.985] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.986] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0102762.WMF") returned -1
	[0052.986] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0102762.WMF") returned -1
	[0052.986] lstrcmpiA (lpString1="", lpString2="J0102762.WMF") returned -1
	[0052.986] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned="J0102594.WMF"
	[0052.986] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.986] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.986] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.986] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.986] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0102762.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF"
	[0052.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.zip") returned 0
	[0052.986] lstrlenA (lpString="*.zip") returned 5
	[0052.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.rar") returned 0
	[0052.986] lstrlenA (lpString="*.rar") returned 5
	[0052.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.7z") returned 0
	[0052.986] lstrlenA (lpString="*.7z") returned 4
	[0052.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.tar") returned 0
	[0052.986] lstrlenA (lpString="*.tar") returned 5
	[0052.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.gzip") returned 0
	[0052.986] lstrlenA (lpString="*.gzip") returned 6
	[0052.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.jpg") returned 0
	[0052.986] lstrlenA (lpString="*.jpg") returned 5
	[0052.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.jpeg") returned 0
	[0052.986] lstrlenA (lpString="*.jpeg") returned 6
	[0052.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.bmp") returned 0
	[0052.986] lstrlenA (lpString="*.bmp") returned 5
	[0052.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.gif") returned 0
	[0052.986] lstrlenA (lpString="*.gif") returned 5
	[0052.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.png") returned 0
	[0052.986] lstrlenA (lpString="*.png") returned 5
	[0052.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.doc") returned 0
	[0052.986] lstrlenA (lpString="*.doc") returned 5
	[0052.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.docx") returned 0
	[0052.987] lstrlenA (lpString="*.docx") returned 6
	[0052.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.xls") returned 0
	[0052.987] lstrlenA (lpString="*.xls") returned 5
	[0052.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.xlsx") returned 0
	[0052.987] lstrlenA (lpString="*.xlsx") returned 6
	[0052.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.ppt") returned 0
	[0052.987] lstrlenA (lpString="*.ppt") returned 5
	[0052.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.pptx") returned 0
	[0052.987] lstrlenA (lpString="*.pptx") returned 6
	[0052.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.txt") returned 0
	[0052.987] lstrlenA (lpString="*.txt") returned 5
	[0052.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.pdf") returned 0
	[0052.987] lstrlenA (lpString="*.pdf") returned 5
	[0052.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.htm") returned 0
	[0052.987] lstrlenA (lpString="*.htm") returned 5
	[0052.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.html") returned 0
	[0052.987] lstrlenA (lpString="*.html") returned 6
	[0052.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.mdb") returned 0
	[0052.987] lstrlenA (lpString="*.mdb") returned 5
	[0052.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.pfx") returned 0
	[0052.987] lstrlenA (lpString="*.pfx") returned 5
	[0052.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.md") returned 0
	[0052.987] lstrlenA (lpString="*.md") returned 4
	[0052.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.lnk") returned 0
	[0052.987] lstrlenA (lpString="*.lnk") returned 5
	[0052.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.torrent") returned 0
	[0052.987] lstrlenA (lpString="*.torrent") returned 9
	[0052.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.mov") returned 0
	[0052.987] lstrlenA (lpString="*.mov") returned 5
	[0052.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.3gp") returned 0
	[0052.987] lstrlenA (lpString="*.3gp") returned 5
	[0052.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.mpeg") returned 0
	[0052.987] lstrlenA (lpString="*.mpeg") returned 6
	[0052.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.mpg") returned 0
	[0052.988] lstrlenA (lpString="*.mpg") returned 5
	[0052.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF", pszSpec="*.flv") returned 0
	[0052.988] lstrlenA (lpString="*.flv") returned 5
	[0052.988] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe605048, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe605048, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe605048, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4290, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0102984.WMF", cAlternateFileName="")) returned 1
	[0052.988] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.988] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0102984.WMF") returned -1
	[0052.988] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0102984.WMF") returned -1
	[0052.988] lstrcmpiA (lpString1="", lpString2="J0102984.WMF") returned -1
	[0052.988] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned="J0102762.WMF"
	[0052.988] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.988] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.988] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.988] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.988] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0102984.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF"
	[0052.988] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe605048, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe605048, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe605048, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x43c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0103058.WMF", cAlternateFileName="")) returned 1
	[0052.988] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.988] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0103058.WMF") returned -1
	[0052.989] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0103058.WMF") returned -1
	[0052.989] lstrcmpiA (lpString1="", lpString2="J0103058.WMF") returned -1
	[0052.989] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned="J0102984.WMF"
	[0052.989] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.989] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.989] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.989] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.989] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0103058.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF"
	[0052.989] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe5dee50, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe5dee50, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe605048, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3264, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0103262.WMF", cAlternateFileName="")) returned 1
	[0052.989] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.989] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0103262.WMF") returned -1
	[0052.989] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0103262.WMF") returned -1
	[0052.989] lstrcmpiA (lpString1="", lpString2="J0103262.WMF") returned -1
	[0052.989] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned="J0103058.WMF"
	[0052.989] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.989] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.989] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.989] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.989] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0103262.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF"
	[0052.989] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe62b2d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe62b2d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe62b2d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xaf94, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0103402.WMF", cAlternateFileName="")) returned 1
	[0052.989] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.989] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0103402.WMF") returned -1
	[0052.989] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0103402.WMF") returned -1
	[0052.989] lstrcmpiA (lpString1="", lpString2="J0103402.WMF") returned -1
	[0052.989] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned="J0103262.WMF"
	[0052.989] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.990] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.990] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.990] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.990] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0103402.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF"
	[0052.990] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe605048, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe605048, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe62b2d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1714, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0103812.WMF", cAlternateFileName="")) returned 1
	[0052.990] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.990] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0103812.WMF") returned -1
	[0052.990] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0103812.WMF") returned -1
	[0052.990] lstrcmpiA (lpString1="", lpString2="J0103812.WMF") returned -1
	[0052.990] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned="J0103402.WMF"
	[0052.990] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.990] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.990] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.990] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.990] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0103812.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF"
	[0052.990] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe605048, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe605048, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe62b2d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5c2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0103850.WMF", cAlternateFileName="")) returned 1
	[0052.990] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.990] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0103850.WMF") returned -1
	[0052.990] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0103850.WMF") returned -1
	[0052.990] lstrcmpiA (lpString1="", lpString2="J0103850.WMF") returned -1
	[0052.990] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned="J0103812.WMF"
	[0052.990] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.990] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.990] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.990] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.991] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0103850.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF"
	[0052.991] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe605048, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe605048, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe62b2d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1434, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105230.WMF", cAlternateFileName="")) returned 1
	[0052.991] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.991] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105230.WMF") returned -1
	[0052.991] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105230.WMF") returned -1
	[0052.991] lstrcmpiA (lpString1="", lpString2="J0105230.WMF") returned -1
	[0052.991] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned="J0103850.WMF"
	[0052.991] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.991] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.991] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.991] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.991] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0105230.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF"
	[0052.991] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe605048, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe605048, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe62b2d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105232.WMF", cAlternateFileName="")) returned 1
	[0052.991] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.991] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105232.WMF") returned -1
	[0052.991] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105232.WMF") returned -1
	[0052.991] lstrcmpiA (lpString1="", lpString2="J0105232.WMF") returned -1
	[0052.991] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned="J0105230.WMF"
	[0052.991] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.991] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.991] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.991] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.991] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0105232.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF"
	[0052.992] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe605048, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe605048, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe605048, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd74, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105234.WMF", cAlternateFileName="")) returned 1
	[0052.992] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.992] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105234.WMF") returned -1
	[0052.992] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105234.WMF") returned -1
	[0052.992] lstrcmpiA (lpString1="", lpString2="J0105234.WMF") returned -1
	[0052.992] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned="J0105232.WMF"
	[0052.992] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.992] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.992] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.992] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.992] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0105234.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF"
	[0052.992] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe605048, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe605048, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe62b2d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4314, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105238.WMF", cAlternateFileName="")) returned 1
	[0052.992] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.992] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105238.WMF") returned -1
	[0052.992] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105238.WMF") returned -1
	[0052.992] lstrcmpiA (lpString1="", lpString2="J0105238.WMF") returned -1
	[0052.992] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned="J0105234.WMF"
	[0052.992] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.992] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.992] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.992] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.992] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0105238.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF"
	[0052.992] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe605048, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe605048, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe62b2d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2d0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105240.WMF", cAlternateFileName="")) returned 1
	[0052.992] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.992] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105240.WMF") returned -1
	[0052.993] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105240.WMF") returned -1
	[0052.993] lstrcmpiA (lpString1="", lpString2="J0105240.WMF") returned -1
	[0052.993] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned="J0105238.WMF"
	[0052.993] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.993] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.993] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.993] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.993] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0105240.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF"
	[0052.993] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe605048, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe605048, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe605048, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2bdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105244.WMF", cAlternateFileName="")) returned 1
	[0052.993] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.993] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105244.WMF") returned -1
	[0052.993] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105244.WMF") returned -1
	[0052.993] lstrcmpiA (lpString1="", lpString2="J0105244.WMF") returned -1
	[0052.993] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned="J0105240.WMF"
	[0052.993] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.993] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.993] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.993] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.993] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0105244.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF"
	[0052.993] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe605048, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe605048, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe605048, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105246.WMF", cAlternateFileName="")) returned 1
	[0052.993] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.993] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105246.WMF") returned -1
	[0052.993] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105246.WMF") returned -1
	[0052.993] lstrcmpiA (lpString1="", lpString2="J0105246.WMF") returned -1
	[0052.993] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned="J0105244.WMF"
	[0052.994] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.994] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.994] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.994] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.994] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0105246.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF"
	[0052.994] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe62b2d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe62b2d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe62b2d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1214, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105250.WMF", cAlternateFileName="")) returned 1
	[0052.994] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.994] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105250.WMF") returned -1
	[0052.994] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105250.WMF") returned -1
	[0052.994] lstrcmpiA (lpString1="", lpString2="J0105250.WMF") returned -1
	[0052.994] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned="J0105246.WMF"
	[0052.994] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.994] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.994] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.994] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.994] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0105250.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF"
	[0052.994] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe62b2d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe62b2d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe62b2d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1714, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105266.WMF", cAlternateFileName="")) returned 1
	[0052.994] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.994] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105266.WMF") returned -1
	[0052.994] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105266.WMF") returned -1
	[0052.994] lstrcmpiA (lpString1="", lpString2="J0105266.WMF") returned -1
	[0052.994] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned="J0105250.WMF"
	[0052.994] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.994] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.994] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.995] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.995] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0105266.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF"
	[0052.995] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe62b2d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe62b2d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe62b2d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4540, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105272.WMF", cAlternateFileName="")) returned 1
	[0052.995] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.995] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105272.WMF") returned -1
	[0052.995] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105272.WMF") returned -1
	[0052.995] lstrcmpiA (lpString1="", lpString2="J0105272.WMF") returned -1
	[0052.995] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned="J0105266.WMF"
	[0052.995] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.995] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.995] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.995] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.995] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0105272.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF"
	[0052.995] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe62b2d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe62b2d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe62b2d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4b28, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105276.WMF", cAlternateFileName="")) returned 1
	[0052.995] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.995] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105276.WMF") returned -1
	[0052.995] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105276.WMF") returned -1
	[0052.995] lstrcmpiA (lpString1="", lpString2="J0105276.WMF") returned -1
	[0052.995] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned="J0105272.WMF"
	[0052.995] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.995] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.995] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.995] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.995] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0105276.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF"
	[0052.996] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe62b2d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe62b2d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe62b2d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2d14, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105280.WMF", cAlternateFileName="")) returned 1
	[0052.996] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.996] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105280.WMF") returned -1
	[0052.996] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105280.WMF") returned -1
	[0052.996] lstrcmpiA (lpString1="", lpString2="J0105280.WMF") returned -1
	[0052.996] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned="J0105276.WMF"
	[0052.996] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.996] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.996] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.996] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.996] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0105280.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF"
	[0052.996] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe62b2d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe62b2d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe62b2d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x12bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105282.WMF", cAlternateFileName="")) returned 1
	[0052.996] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0052.996] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105282.WMF") returned -1
	[0052.996] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105282.WMF") returned -1
	[0052.996] lstrcmpiA (lpString1="", lpString2="J0105282.WMF") returned -1
	[0052.996] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned="J0105280.WMF"
	[0052.996] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0052.996] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0052.996] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0052.996] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0052.996] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0105282.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF"
	[0053.051] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe62b2d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe62b2d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe62b2d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x19a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105286.WMF", cAlternateFileName="")) returned 1
	[0053.051] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.051] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105286.WMF") returned -1
	[0053.051] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105286.WMF") returned -1
	[0053.051] lstrcmpiA (lpString1="", lpString2="J0105286.WMF") returned -1
	[0053.051] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned="J0105282.WMF"
	[0053.051] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.051] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.051] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.051] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.052] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0105286.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF"
	[0053.052] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe62b2d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe62b2d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe62b2d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3dd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105288.WMF", cAlternateFileName="")) returned 1
	[0053.052] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.052] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105288.WMF") returned -1
	[0053.052] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105288.WMF") returned -1
	[0053.052] lstrcmpiA (lpString1="", lpString2="J0105288.WMF") returned -1
	[0053.052] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned="J0105286.WMF"
	[0053.052] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.052] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.052] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.052] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.052] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0105288.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF"
	[0053.052] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe62b2d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe62b2d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe62b2d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3a14, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105292.WMF", cAlternateFileName="")) returned 1
	[0053.052] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.052] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105292.WMF") returned -1
	[0053.052] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105292.WMF") returned -1
	[0053.052] lstrcmpiA (lpString1="", lpString2="J0105292.WMF") returned -1
	[0053.052] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned="J0105288.WMF"
	[0053.052] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.052] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.052] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.052] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.052] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0105292.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF"
	[0053.053] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe62b2d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe62b2d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe62b2d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1580, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105294.WMF", cAlternateFileName="")) returned 1
	[0053.053] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.053] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105294.WMF") returned -1
	[0053.053] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105294.WMF") returned -1
	[0053.053] lstrcmpiA (lpString1="", lpString2="J0105294.WMF") returned -1
	[0053.053] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned="J0105292.WMF"
	[0053.053] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.053] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.053] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.053] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.053] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0105294.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF"
	[0053.053] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe651537, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe651537, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe651537, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x18b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105298.WMF", cAlternateFileName="")) returned 1
	[0053.053] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.053] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105298.WMF") returned -1
	[0053.053] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105298.WMF") returned -1
	[0053.053] lstrcmpiA (lpString1="", lpString2="J0105298.WMF") returned -1
	[0053.053] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned="J0105294.WMF"
	[0053.053] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.053] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.053] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.053] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.053] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0105298.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF"
	[0053.053] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe651537, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe651537, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe651537, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105306.WMF", cAlternateFileName="")) returned 1
	[0053.053] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.053] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105306.WMF") returned -1
	[0053.054] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105306.WMF") returned -1
	[0053.054] lstrcmpiA (lpString1="", lpString2="J0105306.WMF") returned -1
	[0053.054] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned="J0105298.WMF"
	[0053.054] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.054] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.054] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.054] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.054] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0105306.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF"
	[0053.054] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe651537, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe651537, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe651537, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105320.WMF", cAlternateFileName="")) returned 1
	[0053.054] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.054] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105320.WMF") returned -1
	[0053.054] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105320.WMF") returned -1
	[0053.054] lstrcmpiA (lpString1="", lpString2="J0105320.WMF") returned -1
	[0053.054] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned="J0105306.WMF"
	[0053.054] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.054] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.054] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.054] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.054] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0105320.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF"
	[0053.054] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe651537, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe651537, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe651537, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f38, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105328.WMF", cAlternateFileName="")) returned 1
	[0053.054] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.054] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105328.WMF") returned -1
	[0053.054] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105328.WMF") returned -1
	[0053.054] lstrcmpiA (lpString1="", lpString2="J0105328.WMF") returned -1
	[0053.054] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned="J0105320.WMF"
	[0053.055] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.055] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.055] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.055] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.055] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0105328.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF"
	[0053.055] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe62b2d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe62b2d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe651537, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x290c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105332.WMF", cAlternateFileName="")) returned 1
	[0053.055] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.055] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105332.WMF") returned -1
	[0053.055] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105332.WMF") returned -1
	[0053.055] lstrcmpiA (lpString1="", lpString2="J0105332.WMF") returned -1
	[0053.055] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned="J0105328.WMF"
	[0053.055] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.055] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.055] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.055] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.055] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0105332.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF"
	[0053.055] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe62b2d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe62b2d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe62b2d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb54, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105336.WMF", cAlternateFileName="")) returned 1
	[0053.056] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.056] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105336.WMF") returned -1
	[0053.056] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105336.WMF") returned -1
	[0053.056] lstrcmpiA (lpString1="", lpString2="J0105336.WMF") returned -1
	[0053.056] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned="J0105332.WMF"
	[0053.057] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.057] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.057] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0105336.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF"
	[0053.057] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe62b2d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe62b2d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe651537, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2d40, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105338.WMF", cAlternateFileName="")) returned 1
	[0053.057] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.057] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105338.WMF") returned -1
	[0053.057] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105338.WMF") returned -1
	[0053.057] lstrcmpiA (lpString1="", lpString2="J0105338.WMF") returned -1
	[0053.057] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned="J0105336.WMF"
	[0053.057] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.057] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.057] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0105338.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF"
	[0053.057] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe62b2d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe62b2d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe651537, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x42a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105348.WMF", cAlternateFileName="")) returned 1
	[0053.057] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.057] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105348.WMF") returned -1
	[0053.057] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105348.WMF") returned -1
	[0053.057] lstrcmpiA (lpString1="", lpString2="J0105348.WMF") returned -1
	[0053.057] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned="J0105338.WMF"
	[0053.057] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.058] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.058] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.058] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.058] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0105348.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF"
	[0053.058] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe62b2d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe62b2d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe651537, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x229c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105360.WMF", cAlternateFileName="")) returned 1
	[0053.058] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.058] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105360.WMF") returned -1
	[0053.058] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105360.WMF") returned -1
	[0053.058] lstrcmpiA (lpString1="", lpString2="J0105360.WMF") returned -1
	[0053.058] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned="J0105348.WMF"
	[0053.058] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.058] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.058] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.058] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.058] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0105360.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF"
	[0053.058] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe62b2d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe62b2d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe651537, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x305c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105368.WMF", cAlternateFileName="")) returned 1
	[0053.058] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.058] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105368.WMF") returned -1
	[0053.058] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105368.WMF") returned -1
	[0053.058] lstrcmpiA (lpString1="", lpString2="J0105368.WMF") returned -1
	[0053.058] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned="J0105360.WMF"
	[0053.058] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.058] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.058] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.059] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.059] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0105368.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF"
	[0053.059] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe651537, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe651537, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe651537, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1364, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105376.WMF", cAlternateFileName="")) returned 1
	[0053.059] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.059] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105376.WMF") returned -1
	[0053.059] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105376.WMF") returned -1
	[0053.059] lstrcmpiA (lpString1="", lpString2="J0105376.WMF") returned -1
	[0053.059] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned="J0105368.WMF"
	[0053.059] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.059] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.059] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.059] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.059] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0105376.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF"
	[0053.059] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe651537, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe651537, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe651537, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1364, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105378.WMF", cAlternateFileName="")) returned 1
	[0053.060] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.060] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105378.WMF") returned -1
	[0053.060] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105378.WMF") returned -1
	[0053.060] lstrcmpiA (lpString1="", lpString2="J0105378.WMF") returned -1
	[0053.060] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned="J0105376.WMF"
	[0053.060] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.060] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.060] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.060] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.060] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0105378.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF"
	[0053.060] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe651537, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe651537, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe651537, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1210, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105380.WMF", cAlternateFileName="")) returned 1
	[0053.060] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.060] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105380.WMF") returned -1
	[0053.060] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105380.WMF") returned -1
	[0053.060] lstrcmpiA (lpString1="", lpString2="J0105380.WMF") returned -1
	[0053.060] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned="J0105378.WMF"
	[0053.060] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.060] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.060] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.060] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.060] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0105380.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF"
	[0053.060] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe651537, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe651537, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe651537, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x16f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105384.WMF", cAlternateFileName="")) returned 1
	[0053.060] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.060] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105384.WMF") returned -1
	[0053.060] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105384.WMF") returned -1
	[0053.061] lstrcmpiA (lpString1="", lpString2="J0105384.WMF") returned -1
	[0053.061] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned="J0105380.WMF"
	[0053.061] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.061] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.061] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.061] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.061] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe651537, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe651537, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe651537, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x175c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105386.WMF", cAlternateFileName="")) returned 1
	[0053.061] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.061] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105386.WMF") returned -1
	[0053.061] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105386.WMF") returned -1
	[0053.061] lstrcmpiA (lpString1="", lpString2="J0105386.WMF") returned -1
	[0053.061] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned="J0105384.WMF"
	[0053.061] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.061] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.061] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.061] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe651537, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe651537, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe651537, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x203c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105388.WMF", cAlternateFileName="")) returned 1
	[0053.061] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.061] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105388.WMF") returned -1
	[0053.061] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105388.WMF") returned -1
	[0053.061] lstrcmpiA (lpString1="", lpString2="J0105388.WMF") returned -1
	[0053.061] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned="J0105386.WMF"
	[0053.061] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.061] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.062] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.062] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe651537, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe651537, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe651537, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1350, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105390.WMF", cAlternateFileName="")) returned 1
	[0053.062] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.062] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105390.WMF") returned -1
	[0053.062] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105390.WMF") returned -1
	[0053.062] lstrcmpiA (lpString1="", lpString2="J0105390.WMF") returned -1
	[0053.062] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned="J0105388.WMF"
	[0053.062] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.062] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.062] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.062] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe651537, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe651537, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe651537, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2b04, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105396.WMF", cAlternateFileName="")) returned 1
	[0053.062] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.062] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105396.WMF") returned -1
	[0053.062] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105396.WMF") returned -1
	[0053.062] lstrcmpiA (lpString1="", lpString2="J0105396.WMF") returned -1
	[0053.062] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned="J0105390.WMF"
	[0053.062] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.062] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.062] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.062] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe651537, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe651537, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe651537, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd00, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105398.WMF", cAlternateFileName="")) returned 1
	[0053.062] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.063] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105398.WMF") returned -1
	[0053.063] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105398.WMF") returned -1
	[0053.063] lstrcmpiA (lpString1="", lpString2="J0105398.WMF") returned -1
	[0053.063] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned="J0105396.WMF"
	[0053.063] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.063] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.063] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.063] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe651537, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe651537, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe651537, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4fdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105410.WMF", cAlternateFileName="")) returned 1
	[0053.063] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.063] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105410.WMF") returned -1
	[0053.063] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105410.WMF") returned -1
	[0053.063] lstrcmpiA (lpString1="", lpString2="J0105410.WMF") returned -1
	[0053.063] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned="J0105398.WMF"
	[0053.063] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.063] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.063] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.063] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe67776a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe67776a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe67776a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x24b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105412.WMF", cAlternateFileName="")) returned 1
	[0053.063] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.063] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105412.WMF") returned -1
	[0053.063] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105412.WMF") returned -1
	[0053.063] lstrcmpiA (lpString1="", lpString2="J0105412.WMF") returned -1
	[0053.063] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned="J0105410.WMF"
	[0053.063] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.063] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.063] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.064] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe67776a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe67776a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe67776a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1864, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105414.WMF", cAlternateFileName="")) returned 1
	[0053.064] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.064] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105414.WMF") returned -1
	[0053.064] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105414.WMF") returned -1
	[0053.064] lstrcmpiA (lpString1="", lpString2="J0105414.WMF") returned -1
	[0053.064] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned="J0105412.WMF"
	[0053.064] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.064] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.064] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.064] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe67776a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe67776a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe67776a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4928, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105490.WMF", cAlternateFileName="")) returned 1
	[0053.064] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.064] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105490.WMF") returned -1
	[0053.064] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105490.WMF") returned -1
	[0053.064] lstrcmpiA (lpString1="", lpString2="J0105490.WMF") returned -1
	[0053.064] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned="J0105414.WMF"
	[0053.064] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.064] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.064] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.064] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe67776a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe67776a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe67776a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1424, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105496.WMF", cAlternateFileName="")) returned 1
	[0053.064] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.064] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105496.WMF") returned -1
	[0053.064] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105496.WMF") returned -1
	[0053.064] lstrcmpiA (lpString1="", lpString2="J0105496.WMF") returned -1
	[0053.065] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned="J0105490.WMF"
	[0053.065] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.065] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.065] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.065] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe651537, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe651537, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe67776a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1560, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105502.WMF", cAlternateFileName="")) returned 1
	[0053.065] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.065] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105502.WMF") returned -1
	[0053.065] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105502.WMF") returned -1
	[0053.065] lstrcmpiA (lpString1="", lpString2="J0105502.WMF") returned -1
	[0053.065] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned="J0105496.WMF"
	[0053.065] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.065] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.065] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.065] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe651537, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe651537, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe651537, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1034, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105504.WMF", cAlternateFileName="")) returned 1
	[0053.065] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.065] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105504.WMF") returned -1
	[0053.065] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105504.WMF") returned -1
	[0053.065] lstrcmpiA (lpString1="", lpString2="J0105504.WMF") returned -1
	[0053.065] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned="J0105502.WMF"
	[0053.065] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.065] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.065] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.066] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe67776a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe67776a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe67776a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105506.WMF", cAlternateFileName="")) returned 1
	[0053.066] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.066] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105506.WMF") returned -1
	[0053.066] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105506.WMF") returned -1
	[0053.066] lstrcmpiA (lpString1="", lpString2="J0105506.WMF") returned -1
	[0053.066] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned="J0105504.WMF"
	[0053.066] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.066] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.066] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.066] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe651537, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe651537, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe67776a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7c44, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105520.WMF", cAlternateFileName="")) returned 1
	[0053.066] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.066] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105520.WMF") returned -1
	[0053.066] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105520.WMF") returned -1
	[0053.066] lstrcmpiA (lpString1="", lpString2="J0105520.WMF") returned -1
	[0053.066] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned="J0105506.WMF"
	[0053.066] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.066] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.066] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.066] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe651537, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe651537, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe67776a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x43b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105526.WMF", cAlternateFileName="")) returned 1
	[0053.066] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.066] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105526.WMF") returned -1
	[0053.066] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105526.WMF") returned -1
	[0053.066] lstrcmpiA (lpString1="", lpString2="J0105526.WMF") returned -1
	[0053.066] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned="J0105520.WMF"
	[0053.067] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.067] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.067] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.067] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe651537, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe651537, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe67776a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1cd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105530.WMF", cAlternateFileName="")) returned 1
	[0053.067] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.067] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105530.WMF") returned -1
	[0053.067] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105530.WMF") returned -1
	[0053.067] lstrcmpiA (lpString1="", lpString2="J0105530.WMF") returned -1
	[0053.067] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned="J0105526.WMF"
	[0053.067] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.067] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.067] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.067] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe67776a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe67776a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe69d9e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x542c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105588.WMF", cAlternateFileName="")) returned 1
	[0053.067] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.067] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105588.WMF") returned -1
	[0053.067] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105588.WMF") returned -1
	[0053.067] lstrcmpiA (lpString1="", lpString2="J0105588.WMF") returned -1
	[0053.067] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned="J0105530.WMF"
	[0053.067] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.067] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.067] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.067] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe67776a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe67776a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe67776a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x21e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105600.WMF", cAlternateFileName="")) returned 1
	[0053.068] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.068] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105600.WMF") returned -1
	[0053.068] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105600.WMF") returned -1
	[0053.068] lstrcmpiA (lpString1="", lpString2="J0105600.WMF") returned -1
	[0053.068] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned="J0105588.WMF"
	[0053.068] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.068] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.068] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.068] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe67776a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe67776a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe67776a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x287c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105638.WMF", cAlternateFileName="")) returned 1
	[0053.068] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.068] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105638.WMF") returned -1
	[0053.068] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105638.WMF") returned -1
	[0053.068] lstrcmpiA (lpString1="", lpString2="J0105638.WMF") returned -1
	[0053.068] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned="J0105600.WMF"
	[0053.068] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.068] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.068] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.068] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe67776a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe67776a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe67776a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x35f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105710.WMF", cAlternateFileName="")) returned 1
	[0053.068] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.068] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105710.WMF") returned -1
	[0053.068] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105710.WMF") returned -1
	[0053.068] lstrcmpiA (lpString1="", lpString2="J0105710.WMF") returned -1
	[0053.068] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned="J0105638.WMF"
	[0053.068] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.068] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.069] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.069] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe67776a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe67776a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe67776a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2030, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105846.WMF", cAlternateFileName="")) returned 1
	[0053.069] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.069] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105846.WMF") returned -1
	[0053.069] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105846.WMF") returned -1
	[0053.069] lstrcmpiA (lpString1="", lpString2="J0105846.WMF") returned -1
	[0053.069] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned="J0105710.WMF"
	[0053.069] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.069] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.069] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.069] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe67776a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe67776a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe67776a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2dc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105912.WMF", cAlternateFileName="")) returned 1
	[0053.069] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.069] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105912.WMF") returned -1
	[0053.069] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105912.WMF") returned -1
	[0053.069] lstrcmpiA (lpString1="", lpString2="J0105912.WMF") returned -1
	[0053.069] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned="J0105846.WMF"
	[0053.069] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.069] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.069] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.069] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe67776a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe67776a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe67776a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1204, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105974.WMF", cAlternateFileName="")) returned 1
	[0053.069] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.069] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0105974.WMF") returned -1
	[0053.070] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0105974.WMF") returned -1
	[0053.070] lstrcmpiA (lpString1="", lpString2="J0105974.WMF") returned -1
	[0053.070] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned="J0105912.WMF"
	[0053.070] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.070] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.070] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.070] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe67776a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe67776a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe67776a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x274c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106020.WMF", cAlternateFileName="")) returned 1
	[0053.070] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.070] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0106020.WMF") returned -1
	[0053.070] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0106020.WMF") returned -1
	[0053.070] lstrcmpiA (lpString1="", lpString2="J0106020.WMF") returned -1
	[0053.070] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned="J0105974.WMF"
	[0053.070] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.070] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.070] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.070] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe67776a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe67776a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe67776a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x16b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106124.WMF", cAlternateFileName="")) returned 1
	[0053.070] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.070] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0106124.WMF") returned -1
	[0053.070] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0106124.WMF") returned -1
	[0053.070] lstrcmpiA (lpString1="", lpString2="J0106124.WMF") returned -1
	[0053.070] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned="J0106020.WMF"
	[0053.070] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.070] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.070] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.071] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe67776a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe67776a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe67776a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5bfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106146.WMF", cAlternateFileName="")) returned 1
	[0053.072] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.072] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0106146.WMF") returned -1
	[0053.072] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0106146.WMF") returned -1
	[0053.072] lstrcmpiA (lpString1="", lpString2="J0106146.WMF") returned -1
	[0053.072] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned="J0106124.WMF"
	[0053.072] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.072] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.072] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.072] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe69d9e5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe69d9e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe69d9e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106208.WMF", cAlternateFileName="")) returned 1
	[0053.072] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.072] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0106208.WMF") returned -1
	[0053.072] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0106208.WMF") returned -1
	[0053.073] lstrcmpiA (lpString1="", lpString2="J0106208.WMF") returned -1
	[0053.073] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned="J0106146.WMF"
	[0053.073] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.073] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.073] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.073] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe69d9e5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe69d9e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe69d9e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4c90, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106222.WMF", cAlternateFileName="")) returned 1
	[0053.073] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.073] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0106222.WMF") returned -1
	[0053.073] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0106222.WMF") returned -1
	[0053.073] lstrcmpiA (lpString1="", lpString2="J0106222.WMF") returned -1
	[0053.073] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned="J0106208.WMF"
	[0053.073] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.073] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.073] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.073] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe69d9e5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe69d9e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe69d9e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x864, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106572.WMF", cAlternateFileName="")) returned 1
	[0053.073] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.073] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0106572.WMF") returned -1
	[0053.073] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0106572.WMF") returned -1
	[0053.073] lstrcmpiA (lpString1="", lpString2="J0106572.WMF") returned -1
	[0053.073] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned="J0106222.WMF"
	[0053.073] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.073] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.073] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.074] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe69d9e5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe69d9e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe69d9e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd04, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106816.WMF", cAlternateFileName="")) returned 1
	[0053.074] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.074] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0106816.WMF") returned -1
	[0053.074] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0106816.WMF") returned -1
	[0053.074] lstrcmpiA (lpString1="", lpString2="J0106816.WMF") returned -1
	[0053.074] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned="J0106572.WMF"
	[0053.074] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.074] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.074] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.074] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe69d9e5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe69d9e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe69d9e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x35d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106958.WMF", cAlternateFileName="")) returned 1
	[0053.074] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.074] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0106958.WMF") returned -1
	[0053.074] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0106958.WMF") returned -1
	[0053.074] lstrcmpiA (lpString1="", lpString2="J0106958.WMF") returned -1
	[0053.074] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned="J0106816.WMF"
	[0053.074] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.074] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.074] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.074] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe67776a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe67776a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe69d9e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107024.WMF", cAlternateFileName="")) returned 1
	[0053.074] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.074] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0107024.WMF") returned -1
	[0053.075] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0107024.WMF") returned -1
	[0053.075] lstrcmpiA (lpString1="", lpString2="J0107024.WMF") returned -1
	[0053.075] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned="J0106958.WMF"
	[0053.075] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.075] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.075] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.075] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe69d9e5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe69d9e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe69d9e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1dd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107026.WMF", cAlternateFileName="")) returned 1
	[0053.075] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.075] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0107026.WMF") returned -1
	[0053.075] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0107026.WMF") returned -1
	[0053.075] lstrcmpiA (lpString1="", lpString2="J0107026.WMF") returned -1
	[0053.075] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned="J0107024.WMF"
	[0053.075] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.075] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.075] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.075] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe69d9e5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe69d9e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe69d9e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2358, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107042.WMF", cAlternateFileName="")) returned 1
	[0053.075] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.075] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0107042.WMF") returned -1
	[0053.075] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0107042.WMF") returned -1
	[0053.076] lstrcmpiA (lpString1="", lpString2="J0107042.WMF") returned -1
	[0053.076] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned="J0107026.WMF"
	[0053.076] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.076] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.076] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.076] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe67776a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe67776a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe69d9e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107090.WMF", cAlternateFileName="")) returned 1
	[0053.076] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.076] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0107090.WMF") returned -1
	[0053.076] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0107090.WMF") returned -1
	[0053.076] lstrcmpiA (lpString1="", lpString2="J0107090.WMF") returned -1
	[0053.076] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned="J0107042.WMF"
	[0053.076] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.076] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.076] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.076] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe67776a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe67776a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe69d9e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x69cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107130.WMF", cAlternateFileName="")) returned 1
	[0053.076] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.076] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0107130.WMF") returned -1
	[0053.076] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0107130.WMF") returned -1
	[0053.076] lstrcmpiA (lpString1="", lpString2="J0107130.WMF") returned -1
	[0053.076] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned="J0107090.WMF"
	[0053.076] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.076] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.076] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.077] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe69d9e5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe69d9e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe6c3c1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbcfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107132.WMF", cAlternateFileName="")) returned 1
	[0053.077] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.077] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0107132.WMF") returned -1
	[0053.077] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0107132.WMF") returned -1
	[0053.077] lstrcmpiA (lpString1="", lpString2="J0107132.WMF") returned -1
	[0053.077] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned="J0107130.WMF"
	[0053.077] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.077] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.077] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.077] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe69d9e5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe69d9e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe6c3c1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbd04, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107134.WMF", cAlternateFileName="")) returned 1
	[0053.077] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.077] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0107134.WMF") returned -1
	[0053.077] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0107134.WMF") returned -1
	[0053.077] lstrcmpiA (lpString1="", lpString2="J0107134.WMF") returned -1
	[0053.077] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned="J0107132.WMF"
	[0053.077] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.077] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.077] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.077] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe69d9e5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe69d9e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe6c3c1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4330, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107138.WMF", cAlternateFileName="")) returned 1
	[0053.077] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.077] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0107138.WMF") returned -1
	[0053.077] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0107138.WMF") returned -1
	[0053.077] lstrcmpiA (lpString1="", lpString2="J0107138.WMF") returned -1
	[0053.078] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned="J0107134.WMF"
	[0053.078] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.078] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.078] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.078] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe69d9e5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe69d9e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe69d9e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3a94, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107146.WMF", cAlternateFileName="")) returned 1
	[0053.078] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.151] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0107146.WMF") returned -1
	[0053.151] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0107146.WMF") returned -1
	[0053.151] lstrcmpiA (lpString1="", lpString2="J0107146.WMF") returned -1
	[0053.151] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned="J0107138.WMF"
	[0053.151] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.151] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.151] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.151] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe69d9e5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe69d9e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe69d9e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4ea8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107148.WMF", cAlternateFileName="")) returned 1
	[0053.151] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.151] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0107148.WMF") returned -1
	[0053.151] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0107148.WMF") returned -1
	[0053.152] lstrcmpiA (lpString1="", lpString2="J0107148.WMF") returned -1
	[0053.152] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned="J0107146.WMF"
	[0053.152] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.152] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.152] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.152] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe69d9e5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe69d9e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe69d9e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3490, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107150.WMF", cAlternateFileName="")) returned 1
	[0053.152] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.152] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0107150.WMF") returned -1
	[0053.152] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0107150.WMF") returned -1
	[0053.152] lstrcmpiA (lpString1="", lpString2="J0107150.WMF") returned -1
	[0053.152] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned="J0107148.WMF"
	[0053.152] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.152] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.152] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.152] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe69d9e5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe69d9e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe69d9e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5804, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107152.WMF", cAlternateFileName="")) returned 1
	[0053.152] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.152] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned="J0107150.WMF"
	[0053.152] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.152] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.152] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.153] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe69d9e5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe69d9e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe69d9e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x571c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107154.WMF", cAlternateFileName="")) returned 1
	[0053.153] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.153] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned="J0107152.WMF"
	[0053.153] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.153] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.153] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.153] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe69d9e5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe69d9e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe69d9e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x614c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107158.WMF", cAlternateFileName="")) returned 1
	[0053.153] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.153] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned="J0107154.WMF"
	[0053.153] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.153] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.153] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.154] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe69d9e5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe69d9e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe69d9e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3ee4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107182.WMF", cAlternateFileName="")) returned 1
	[0053.154] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.154] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned="J0107158.WMF"
	[0053.154] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.154] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.154] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.154] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe6c3c1e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe6c3c1e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe6c3c1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107188.WMF", cAlternateFileName="")) returned 1
	[0053.154] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.154] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned="J0107182.WMF"
	[0053.154] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.154] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.154] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.154] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe6c3c1e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe6c3c1e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe6c3c1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x26f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107192.WMF", cAlternateFileName="")) returned 1
	[0053.154] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.154] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned="J0107188.WMF"
	[0053.154] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.154] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.154] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.154] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe6c3c1e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe6c3c1e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe6c3c1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4ef4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107254.WMF", cAlternateFileName="")) returned 1
	[0053.154] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.155] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned="J0107192.WMF"
	[0053.155] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.155] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.155] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.155] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe6c3c1e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe6c3c1e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe6c3c1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2168, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107258.WMF", cAlternateFileName="")) returned 1
	[0053.155] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.155] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned="J0107254.WMF"
	[0053.155] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.155] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.155] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.155] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe6c3c1e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe6c3c1e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe6c3c1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107262.WMF", cAlternateFileName="")) returned 1
	[0053.155] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.155] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned="J0107258.WMF"
	[0053.155] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.155] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.155] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.155] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe69d9e5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe69d9e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe6c3c1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107264.WMF", cAlternateFileName="")) returned 1
	[0053.155] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.155] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned="J0107262.WMF"
	[0053.155] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.156] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.156] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.156] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe6c3c1e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe6c3c1e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe6c3c1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x16ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107266.WMF", cAlternateFileName="")) returned 1
	[0053.156] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.156] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned="J0107264.WMF"
	[0053.156] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.156] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.156] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.156] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe6c3c1e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe6c3c1e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe6c3c1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2b64, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107280.WMF", cAlternateFileName="")) returned 1
	[0053.156] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.156] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned="J0107266.WMF"
	[0053.156] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.156] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.156] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.156] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe6c3c1e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe6c3c1e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe6c3c1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107282.WMF", cAlternateFileName="")) returned 1
	[0053.156] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.156] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned="J0107280.WMF"
	[0053.156] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.156] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.156] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.157] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe69d9e5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe69d9e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe6c3c1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x347c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107288.WMF", cAlternateFileName="")) returned 1
	[0053.157] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.157] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned="J0107282.WMF"
	[0053.157] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.157] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.157] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.157] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe6c3c1e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe6c3c1e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe6e9e74, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3014, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107290.WMF", cAlternateFileName="")) returned 1
	[0053.157] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.157] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned="J0107288.WMF"
	[0053.157] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.157] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.157] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.157] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe6c3c1e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe6c3c1e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe6e9e74, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x99c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107300.WMF", cAlternateFileName="")) returned 1
	[0053.157] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.157] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned="J0107290.WMF"
	[0053.157] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.157] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.157] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.158] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe6c3c1e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe6c3c1e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe6e9e74, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1028, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107302.WMF", cAlternateFileName="")) returned 1
	[0053.158] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.158] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned="J0107300.WMF"
	[0053.158] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.158] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.158] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.158] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe6c3c1e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe6c3c1e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe6c3c1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107308.WMF", cAlternateFileName="")) returned 1
	[0053.158] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.159] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned="J0107302.WMF"
	[0053.159] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.159] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.159] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.159] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe6c3c1e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe6c3c1e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe6c3c1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2a64, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107314.WMF", cAlternateFileName="")) returned 1
	[0053.159] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.159] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned="J0107308.WMF"
	[0053.159] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.159] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.159] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.159] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe6c3c1e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe6c3c1e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe6c3c1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2c18, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107316.WMF", cAlternateFileName="")) returned 1
	[0053.159] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.159] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned="J0107314.WMF"
	[0053.159] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.159] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.159] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.159] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe6c3c1e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe6c3c1e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe6c3c1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1984, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107328.WMF", cAlternateFileName="")) returned 1
	[0053.159] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.159] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned="J0107316.WMF"
	[0053.159] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.160] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.160] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.160] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe6c3c1e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe6c3c1e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe6c3c1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1094, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107342.WMF", cAlternateFileName="")) returned 1
	[0053.160] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.160] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned="J0107328.WMF"
	[0053.160] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.160] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.160] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.160] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe6c3c1e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe6c3c1e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe6c3c1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107344.WMF", cAlternateFileName="")) returned 1
	[0053.160] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.160] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned="J0107342.WMF"
	[0053.160] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.160] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.160] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.160] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe6c3c1e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe6c3c1e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe6c3c1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5c78, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107350.WMF", cAlternateFileName="")) returned 1
	[0053.160] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.160] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned="J0107344.WMF"
	[0053.160] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.160] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.160] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.161] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe6e9e74, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe6e9e74, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb3c2ce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107358.WMF", cAlternateFileName="")) returned 1
	[0053.161] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.161] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned="J0107350.WMF"
	[0053.161] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.161] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.161] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.161] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe6e9e74, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe6e9e74, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe7100f8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x40cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107364.WMF", cAlternateFileName="")) returned 1
	[0053.161] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.161] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned="J0107358.WMF"
	[0053.161] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.161] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.161] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.161] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe6e9e74, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe6e9e74, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe7100f8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ce4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107426.WMF", cAlternateFileName="")) returned 1
	[0053.161] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.161] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned="J0107364.WMF"
	[0053.161] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.161] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.161] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.162] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe6e9e74, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe6e9e74, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe6e9e74, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7680, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107446.WMF", cAlternateFileName="")) returned 1
	[0053.162] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.162] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned="J0107426.WMF"
	[0053.162] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.162] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.162] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.162] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe6e9e74, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe6e9e74, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe6e9e74, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1338, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107450.WMF", cAlternateFileName="")) returned 1
	[0053.162] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.162] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned="J0107446.WMF"
	[0053.162] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.162] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.162] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.162] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe6c3c1e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe6c3c1e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe6e9e74, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x52e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107452.WMF", cAlternateFileName="")) returned 1
	[0053.162] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.162] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned="J0107450.WMF"
	[0053.162] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.162] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.162] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.162] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe6e9e74, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe6e9e74, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe7100f8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107456.WMF", cAlternateFileName="")) returned 1
	[0053.162] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.163] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned="J0107452.WMF"
	[0053.163] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.163] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.163] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.163] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe6e9e74, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe6e9e74, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe6e9e74, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107458.WMF", cAlternateFileName="")) returned 1
	[0053.163] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.163] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned="J0107456.WMF"
	[0053.163] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.163] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.163] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.163] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe6e9e74, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe6e9e74, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe6e9e74, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x258c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107468.WMF", cAlternateFileName="")) returned 1
	[0053.163] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.163] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned="J0107458.WMF"
	[0053.163] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.163] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.163] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.163] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe6e9e74, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe6e9e74, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe6e9e74, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1788, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107480.WMF", cAlternateFileName="")) returned 1
	[0053.163] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.163] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned="J0107468.WMF"
	[0053.163] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.163] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.164] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.164] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe736331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe736331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe736331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1374, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107482.WMF", cAlternateFileName="")) returned 1
	[0053.164] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.164] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned="J0107480.WMF"
	[0053.164] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.164] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.164] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.164] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe7100f8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe7100f8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe736331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107484.WMF", cAlternateFileName="")) returned 1
	[0053.164] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.164] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned="J0107482.WMF"
	[0053.164] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.164] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.164] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.164] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe7100f8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe7100f8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe736331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f40, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107488.WMF", cAlternateFileName="")) returned 1
	[0053.164] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.164] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned="J0107484.WMF"
	[0053.164] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.164] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.164] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.165] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe7100f8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe7100f8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe736331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4054, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107490.WMF", cAlternateFileName="")) returned 1
	[0053.165] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.165] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned="J0107488.WMF"
	[0053.165] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.165] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.165] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.165] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb3c2ce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb3c2ce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb3c2ce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1acc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107492.WMF", cAlternateFileName="")) returned 1
	[0053.165] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.165] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned="J0107490.WMF"
	[0053.165] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.165] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.165] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.165] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe7100f8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe7100f8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe7100f8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1918, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107494.WMF", cAlternateFileName="")) returned 1
	[0053.165] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.165] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned="J0107492.WMF"
	[0053.165] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.165] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.165] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.166] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe7100f8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe7100f8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe736331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x22a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107496.WMF", cAlternateFileName="")) returned 1
	[0053.166] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.166] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned="J0107494.WMF"
	[0053.166] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.166] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.166] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.166] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe7100f8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe7100f8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe7100f8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107500.WMF", cAlternateFileName="")) returned 1
	[0053.166] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.166] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned="J0107496.WMF"
	[0053.166] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.166] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.166] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.166] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe7100f8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe7100f8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe7100f8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2a54, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107502.WMF", cAlternateFileName="")) returned 1
	[0053.166] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.166] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned="J0107500.WMF"
	[0053.166] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.166] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.166] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.166] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe7100f8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe7100f8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe7100f8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2c8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107512.WMF", cAlternateFileName="")) returned 1
	[0053.167] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.167] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned="J0107502.WMF"
	[0053.167] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.167] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.167] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.167] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe78281d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe78281d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe7a8a31, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2fac, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107514.WMF", cAlternateFileName="")) returned 1
	[0053.167] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.167] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned="J0107512.WMF"
	[0053.167] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.167] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.167] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe78281d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe78281d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe7a8a31, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x36b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107516.WMF", cAlternateFileName="")) returned 1
	[0053.167] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.167] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned="J0107514.WMF"
	[0053.167] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.167] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.167] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe78281d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe78281d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe78281d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107526.WMF", cAlternateFileName="")) returned 1
	[0053.167] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.167] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned="J0107516.WMF"
	[0053.167] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.168] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.168] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe78281d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe78281d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe78281d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1a88, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107528.WMF", cAlternateFileName="")) returned 1
	[0053.168] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.168] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned="J0107526.WMF"
	[0053.168] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.168] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.168] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe736331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe736331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe78281d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6890, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107544.WMF", cAlternateFileName="")) returned 1
	[0053.168] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.168] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned="J0107528.WMF"
	[0053.168] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.168] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.168] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe736331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe736331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe75c571, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107658.WMF", cAlternateFileName="")) returned 1
	[0053.168] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.168] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned="J0107544.WMF"
	[0053.168] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.169] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.169] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe75c571, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe75c571, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe78281d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x12c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107708.WMF", cAlternateFileName="")) returned 1
	[0053.169] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.169] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned="J0107658.WMF"
	[0053.169] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.169] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.169] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe736331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe736331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe75c571, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x121c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107712.WMF", cAlternateFileName="")) returned 1
	[0053.170] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.170] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned="J0107708.WMF"
	[0053.170] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.170] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.170] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe736331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe736331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe78281d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xed8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107718.WMF", cAlternateFileName="")) returned 1
	[0053.170] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.170] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned="J0107712.WMF"
	[0053.170] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.170] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.170] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe736331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe736331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe736331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2044, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107722.WMF", cAlternateFileName="")) returned 1
	[0053.170] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.170] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned="J0107718.WMF"
	[0053.170] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.170] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.171] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe7a8a31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe7a8a31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe7cecf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107724.WMF", cAlternateFileName="")) returned 1
	[0053.171] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.171] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned="J0107722.WMF"
	[0053.171] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.171] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.171] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe7a8a31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe7a8a31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe7cecf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1574, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107728.WMF", cAlternateFileName="")) returned 1
	[0053.171] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.171] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned="J0107724.WMF"
	[0053.171] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.171] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.171] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe7a8a31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe7a8a31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe7a8a31, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107730.WMF", cAlternateFileName="")) returned 1
	[0053.171] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.171] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned="J0107728.WMF"
	[0053.171] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.171] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.171] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe7a8a31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe7a8a31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe7a8a31, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc44, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107734.WMF", cAlternateFileName="")) returned 1
	[0053.171] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.171] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned="J0107730.WMF"
	[0053.172] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.172] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.172] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe7a8a31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe7a8a31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe7a8a31, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107742.WMF", cAlternateFileName="")) returned 1
	[0053.172] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.172] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned="J0107734.WMF"
	[0053.172] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.172] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.172] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe78281d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe78281d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe7a8a31, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107744.WMF", cAlternateFileName="")) returned 1
	[0053.172] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.172] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned="J0107742.WMF"
	[0053.172] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.172] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.172] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe7a8a31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe7a8a31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe7a8a31, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x12b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107746.WMF", cAlternateFileName="")) returned 1
	[0053.172] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.172] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned="J0107744.WMF"
	[0053.172] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.172] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.173] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe7a8a31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe7a8a31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe7a8a31, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2020, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107748.WMF", cAlternateFileName="")) returned 1
	[0053.173] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.173] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned="J0107746.WMF"
	[0053.173] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.173] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.173] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe7a8a31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe7a8a31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe7a8a31, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x126c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107750.WMF", cAlternateFileName="")) returned 1
	[0053.173] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.173] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned="J0107748.WMF"
	[0053.173] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.173] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.173] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe78281d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe78281d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe7a8a31, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4146, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0136865.WMF", cAlternateFileName="")) returned 1
	[0053.173] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.173] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned="J0107750.WMF"
	[0053.173] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.173] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.173] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe7cecf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe7cecf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe7cecf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9d27, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0144773.JPG", cAlternateFileName="")) returned 1
	[0053.173] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.173] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned="J0136865.WMF"
	[0053.173] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.174] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.174] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0053.176] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9d27
	[0053.176] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe7cecf4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe7cecf4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe7cecf4, dwHighDateTime=0x1d327e8)) returned 1
	[0053.176] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.176] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x9ce5, lpOverlapped=0x0) returned 1
	[0053.178] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned="J0144773.JPG"
	[0053.178] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.178] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x9ce5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x9ce5, lpOverlapped=0x0) returned 1
	[0053.178] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.179] CloseHandle (hObject=0x214) returned 1
	[0053.180] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg.exe")) returned 1
	[0053.181] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe7cecf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe7cecf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe7cecf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8379, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145168.JPG", cAlternateFileName="")) returned 1
	[0053.181] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.181] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned="J0144773.JPG"
	[0053.181] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.181] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.181] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.181] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0145168.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG"
	[0053.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG", pszSpec="*.zip") returned 0
	[0053.181] lstrlenA (lpString="*.zip") returned 5
	[0053.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG", pszSpec="*.rar") returned 0
	[0053.181] lstrlenA (lpString="*.rar") returned 5
	[0053.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG", pszSpec="*.7z") returned 0
	[0053.181] lstrlenA (lpString="*.7z") returned 4
	[0053.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG", pszSpec="*.tar") returned 0
	[0053.182] lstrlenA (lpString="*.tar") returned 5
	[0053.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG", pszSpec="*.gzip") returned 0
	[0053.182] lstrlenA (lpString="*.gzip") returned 6
	[0053.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG", pszSpec="*.jpg") returned 1
	[0053.182] lstrlenA (lpString="*.jpg") returned 5
	[0053.182] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG"
	[0053.182] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG"
	[0053.182] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG."
	[0053.182] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG.exe"
	[0053.182] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0053.183] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8379
	[0053.183] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe7cecf4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe7cecf4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe7cecf4, dwHighDateTime=0x1d327e8)) returned 1
	[0053.183] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.183] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x8337, lpOverlapped=0x0) returned 1
	[0053.184] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned="J0145168.JPG"
	[0053.185] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.185] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x8337, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x8337, lpOverlapped=0x0) returned 1
	[0053.185] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.185] CloseHandle (hObject=0x214) returned 1
	[0053.186] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg.exe")) returned 1
	[0053.187] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe7cecf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe7cecf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe7cecf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf0c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145212.JPG", cAlternateFileName="")) returned 1
	[0053.187] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.187] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0145212.JPG") returned -1
	[0053.187] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0145212.JPG") returned -1
	[0053.187] lstrcmpiA (lpString1="", lpString2="J0145212.JPG") returned -1
	[0053.187] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned="J0145168.JPG"
	[0053.187] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.187] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.187] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.187] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.187] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0145212.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG"
	[0053.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG", pszSpec="*.zip") returned 0
	[0053.187] lstrlenA (lpString="*.zip") returned 5
	[0053.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG", pszSpec="*.rar") returned 0
	[0053.187] lstrlenA (lpString="*.rar") returned 5
	[0053.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG", pszSpec="*.7z") returned 0
	[0053.187] lstrlenA (lpString="*.7z") returned 4
	[0053.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG", pszSpec="*.tar") returned 0
	[0053.187] lstrlenA (lpString="*.tar") returned 5
	[0053.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG", pszSpec="*.gzip") returned 0
	[0053.187] lstrlenA (lpString="*.gzip") returned 6
	[0053.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG", pszSpec="*.jpg") returned 1
	[0053.188] lstrlenA (lpString="*.jpg") returned 5
	[0053.188] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG"
	[0053.188] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG"
	[0053.188] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG."
	[0053.188] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG.exe"
	[0053.188] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0053.188] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf0c1
	[0053.188] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe7cecf4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe7cecf4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe7cecf4, dwHighDateTime=0x1d327e8)) returned 1
	[0053.188] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.188] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xf07f, lpOverlapped=0x0) returned 1
	[0053.258] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned="J0145212.JPG"
	[0053.258] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.258] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xf07f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xf07f, lpOverlapped=0x0) returned 1
	[0053.259] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.259] CloseHandle (hObject=0x214) returned 1
	[0053.261] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg.exe")) returned 1
	[0053.261] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe7cecf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe7cecf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe7cecf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc056, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145272.JPG", cAlternateFileName="")) returned 1
	[0053.261] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.261] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0145272.JPG") returned -1
	[0053.261] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0145272.JPG") returned -1
	[0053.262] lstrcmpiA (lpString1="", lpString2="J0145272.JPG") returned -1
	[0053.262] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned="J0145212.JPG"
	[0053.262] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.262] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.262] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.262] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.262] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0145272.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG"
	[0053.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG", pszSpec="*.zip") returned 0
	[0053.262] lstrlenA (lpString="*.zip") returned 5
	[0053.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG", pszSpec="*.rar") returned 0
	[0053.262] lstrlenA (lpString="*.rar") returned 5
	[0053.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG", pszSpec="*.7z") returned 0
	[0053.262] lstrlenA (lpString="*.7z") returned 4
	[0053.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG", pszSpec="*.tar") returned 0
	[0053.262] lstrlenA (lpString="*.tar") returned 5
	[0053.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG", pszSpec="*.gzip") returned 0
	[0053.262] lstrlenA (lpString="*.gzip") returned 6
	[0053.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG", pszSpec="*.jpg") returned 1
	[0053.262] lstrlenA (lpString="*.jpg") returned 5
	[0053.262] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG"
	[0053.262] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG"
	[0053.262] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG."
	[0053.263] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG.exe"
	[0053.263] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0053.263] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc056
	[0053.263] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe7cecf4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe7cecf4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe7cecf4, dwHighDateTime=0x1d327e8)) returned 1
	[0053.263] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.263] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xc014, lpOverlapped=0x0) returned 1
	[0053.266] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned="J0145272.JPG"
	[0053.266] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.266] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xc014, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xc014, lpOverlapped=0x0) returned 1
	[0053.266] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.266] CloseHandle (hObject=0x214) returned 1
	[0053.268] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg.exe")) returned 1
	[0053.268] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe7cecf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe7cecf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe7cecf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5285, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145361.JPG", cAlternateFileName="")) returned 1
	[0053.268] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.268] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0145361.JPG") returned -1
	[0053.268] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0145361.JPG") returned -1
	[0053.268] lstrcmpiA (lpString1="", lpString2="J0145361.JPG") returned -1
	[0053.268] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned="J0145272.JPG"
	[0053.268] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.268] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.269] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.269] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.269] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0145361.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG"
	[0053.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG", pszSpec="*.zip") returned 0
	[0053.269] lstrlenA (lpString="*.zip") returned 5
	[0053.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG", pszSpec="*.rar") returned 0
	[0053.269] lstrlenA (lpString="*.rar") returned 5
	[0053.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG", pszSpec="*.7z") returned 0
	[0053.269] lstrlenA (lpString="*.7z") returned 4
	[0053.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG", pszSpec="*.tar") returned 0
	[0053.269] lstrlenA (lpString="*.tar") returned 5
	[0053.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG", pszSpec="*.gzip") returned 0
	[0053.269] lstrlenA (lpString="*.gzip") returned 6
	[0053.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG", pszSpec="*.jpg") returned 1
	[0053.269] lstrlenA (lpString="*.jpg") returned 5
	[0053.269] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG"
	[0053.269] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG"
	[0053.269] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG."
	[0053.269] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG.exe"
	[0053.269] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0053.269] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5285
	[0053.269] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe7cecf4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe7cecf4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe7cecf4, dwHighDateTime=0x1d327e8)) returned 1
	[0053.269] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.270] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x5243, lpOverlapped=0x0) returned 1
	[0053.271] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned="J0145361.JPG"
	[0053.271] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.271] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x5243, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x5243, lpOverlapped=0x0) returned 1
	[0053.272] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.272] CloseHandle (hObject=0x214) returned 1
	[0053.273] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg.exe")) returned 1
	[0053.273] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe7a8a31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe7a8a31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe7cecf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x45cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145373.JPG", cAlternateFileName="")) returned 1
	[0053.273] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.273] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0145373.JPG") returned -1
	[0053.274] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0145373.JPG") returned -1
	[0053.274] lstrcmpiA (lpString1="", lpString2="J0145373.JPG") returned -1
	[0053.274] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned="J0145361.JPG"
	[0053.274] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.274] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.274] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.274] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.274] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0145373.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG"
	[0053.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG", pszSpec="*.zip") returned 0
	[0053.274] lstrlenA (lpString="*.zip") returned 5
	[0053.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG", pszSpec="*.rar") returned 0
	[0053.274] lstrlenA (lpString="*.rar") returned 5
	[0053.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG", pszSpec="*.7z") returned 0
	[0053.274] lstrlenA (lpString="*.7z") returned 4
	[0053.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG", pszSpec="*.tar") returned 0
	[0053.274] lstrlenA (lpString="*.tar") returned 5
	[0053.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG", pszSpec="*.gzip") returned 0
	[0053.274] lstrlenA (lpString="*.gzip") returned 6
	[0053.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG", pszSpec="*.jpg") returned 1
	[0053.274] lstrlenA (lpString="*.jpg") returned 5
	[0053.274] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG"
	[0053.274] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG"
	[0053.274] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG."
	[0053.274] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG.exe"
	[0053.274] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0053.275] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x45cb
	[0053.275] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe7a8a31, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe7a8a31, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe7cecf4, dwHighDateTime=0x1d327e8)) returned 1
	[0053.275] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.275] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x4589, lpOverlapped=0x0) returned 1
	[0053.277] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned="J0145373.JPG"
	[0053.277] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.277] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x4589, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x4589, lpOverlapped=0x0) returned 1
	[0053.277] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.277] CloseHandle (hObject=0x214) returned 1
	[0053.278] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg.exe")) returned 1
	[0053.279] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe7cecf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe7cecf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe7cecf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7c6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145669.JPG", cAlternateFileName="")) returned 1
	[0053.279] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.279] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0145669.JPG") returned -1
	[0053.279] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0145669.JPG") returned -1
	[0053.279] lstrcmpiA (lpString1="", lpString2="J0145669.JPG") returned -1
	[0053.279] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned="J0145373.JPG"
	[0053.279] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.279] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.279] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.279] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.279] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0145669.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG"
	[0053.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG", pszSpec="*.zip") returned 0
	[0053.279] lstrlenA (lpString="*.zip") returned 5
	[0053.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG", pszSpec="*.rar") returned 0
	[0053.279] lstrlenA (lpString="*.rar") returned 5
	[0053.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG", pszSpec="*.7z") returned 0
	[0053.279] lstrlenA (lpString="*.7z") returned 4
	[0053.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG", pszSpec="*.tar") returned 0
	[0053.279] lstrlenA (lpString="*.tar") returned 5
	[0053.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG", pszSpec="*.gzip") returned 0
	[0053.279] lstrlenA (lpString="*.gzip") returned 6
	[0053.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG", pszSpec="*.jpg") returned 1
	[0053.280] lstrlenA (lpString="*.jpg") returned 5
	[0053.280] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG"
	[0053.280] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG"
	[0053.280] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG."
	[0053.280] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG.exe"
	[0053.280] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0053.280] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7c6a
	[0053.280] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe7cecf4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe7cecf4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe7cecf4, dwHighDateTime=0x1d327e8)) returned 1
	[0053.280] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.280] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7c28, lpOverlapped=0x0) returned 1
	[0053.281] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned="J0145669.JPG"
	[0053.282] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.282] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7c28, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7c28, lpOverlapped=0x0) returned 1
	[0053.282] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.282] CloseHandle (hObject=0x214) returned 1
	[0053.283] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg.exe")) returned 1
	[0053.284] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe7cecf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe7cecf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe7cecf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8fd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145707.JPG", cAlternateFileName="")) returned 1
	[0053.284] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.284] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0145707.JPG") returned -1
	[0053.284] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0145707.JPG") returned -1
	[0053.284] lstrcmpiA (lpString1="", lpString2="J0145707.JPG") returned -1
	[0053.284] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned="J0145669.JPG"
	[0053.284] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.284] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.284] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.284] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.284] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0145707.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG"
	[0053.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG", pszSpec="*.zip") returned 0
	[0053.284] lstrlenA (lpString="*.zip") returned 5
	[0053.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG", pszSpec="*.rar") returned 0
	[0053.284] lstrlenA (lpString="*.rar") returned 5
	[0053.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG", pszSpec="*.7z") returned 0
	[0053.284] lstrlenA (lpString="*.7z") returned 4
	[0053.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG", pszSpec="*.tar") returned 0
	[0053.284] lstrlenA (lpString="*.tar") returned 5
	[0053.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG", pszSpec="*.gzip") returned 0
	[0053.284] lstrlenA (lpString="*.gzip") returned 6
	[0053.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG", pszSpec="*.jpg") returned 1
	[0053.284] lstrlenA (lpString="*.jpg") returned 5
	[0053.284] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG"
	[0053.284] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG"
	[0053.284] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG."
	[0053.284] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG.exe"
	[0053.284] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0053.285] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8fd4
	[0053.285] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe7cecf4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe7cecf4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe7cecf4, dwHighDateTime=0x1d327e8)) returned 1
	[0053.285] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.285] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x8f92, lpOverlapped=0x0) returned 1
	[0053.287] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned="J0145707.JPG"
	[0053.287] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.287] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x8f92, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x8f92, lpOverlapped=0x0) returned 1
	[0053.287] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.287] CloseHandle (hObject=0x214) returned 1
	[0053.288] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg.exe")) returned 1
	[0053.289] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe7cecf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe7cecf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe7cecf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8fb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145810.JPG", cAlternateFileName="")) returned 1
	[0053.289] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.289] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0145810.JPG") returned -1
	[0053.289] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0145810.JPG") returned -1
	[0053.289] lstrcmpiA (lpString1="", lpString2="J0145810.JPG") returned -1
	[0053.289] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned="J0145707.JPG"
	[0053.289] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.289] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.289] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.289] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.289] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0145810.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG"
	[0053.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG", pszSpec="*.zip") returned 0
	[0053.289] lstrlenA (lpString="*.zip") returned 5
	[0053.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG", pszSpec="*.rar") returned 0
	[0053.289] lstrlenA (lpString="*.rar") returned 5
	[0053.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG", pszSpec="*.7z") returned 0
	[0053.289] lstrlenA (lpString="*.7z") returned 4
	[0053.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG", pszSpec="*.tar") returned 0
	[0053.290] lstrlenA (lpString="*.tar") returned 5
	[0053.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG", pszSpec="*.gzip") returned 0
	[0053.290] lstrlenA (lpString="*.gzip") returned 6
	[0053.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG", pszSpec="*.jpg") returned 1
	[0053.290] lstrlenA (lpString="*.jpg") returned 5
	[0053.290] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG"
	[0053.290] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG"
	[0053.290] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG."
	[0053.290] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG.exe"
	[0053.290] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0053.290] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8fb8
	[0053.290] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe7cecf4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe7cecf4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe7cecf4, dwHighDateTime=0x1d327e8)) returned 1
	[0053.291] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.291] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x8f76, lpOverlapped=0x0) returned 1
	[0053.327] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned="J0145810.JPG"
	[0053.327] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.328] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x8f76, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x8f76, lpOverlapped=0x0) returned 1
	[0053.328] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.328] CloseHandle (hObject=0x214) returned 1
	[0053.330] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg.exe")) returned 1
	[0053.330] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe7a8a31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe7a8a31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe7cecf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145879.JPG", cAlternateFileName="")) returned 1
	[0053.330] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.330] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0145879.JPG") returned -1
	[0053.330] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0145879.JPG") returned -1
	[0053.330] lstrcmpiA (lpString1="", lpString2="J0145879.JPG") returned -1
	[0053.330] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned="J0145810.JPG"
	[0053.331] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.331] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.331] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.331] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.331] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0145879.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG"
	[0053.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG", pszSpec="*.zip") returned 0
	[0053.331] lstrlenA (lpString="*.zip") returned 5
	[0053.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG", pszSpec="*.rar") returned 0
	[0053.331] lstrlenA (lpString="*.rar") returned 5
	[0053.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG", pszSpec="*.7z") returned 0
	[0053.331] lstrlenA (lpString="*.7z") returned 4
	[0053.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG", pszSpec="*.tar") returned 0
	[0053.331] lstrlenA (lpString="*.tar") returned 5
	[0053.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG", pszSpec="*.gzip") returned 0
	[0053.331] lstrlenA (lpString="*.gzip") returned 6
	[0053.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG", pszSpec="*.jpg") returned 1
	[0053.331] lstrlenA (lpString="*.jpg") returned 5
	[0053.331] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG"
	[0053.331] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG"
	[0053.331] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG."
	[0053.331] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG.exe"
	[0053.331] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0053.332] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8a5b
	[0053.332] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe7a8a31, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe7a8a31, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe7cecf4, dwHighDateTime=0x1d327e8)) returned 1
	[0053.332] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.332] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x8a19, lpOverlapped=0x0) returned 1
	[0053.334] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned="J0145879.JPG"
	[0053.334] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.334] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x8a19, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x8a19, lpOverlapped=0x0) returned 1
	[0053.334] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.334] CloseHandle (hObject=0x214) returned 1
	[0053.336] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg.exe")) returned 1
	[0053.336] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe84140d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe84140d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe84140d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x84a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145895.JPG", cAlternateFileName="")) returned 1
	[0053.336] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.336] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0145895.JPG") returned -1
	[0053.336] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0145895.JPG") returned -1
	[0053.336] lstrcmpiA (lpString1="", lpString2="J0145895.JPG") returned -1
	[0053.336] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned="J0145879.JPG"
	[0053.337] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.337] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.337] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.337] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.337] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0145895.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG"
	[0053.337] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG", pszSpec="*.zip") returned 0
	[0053.337] lstrlenA (lpString="*.zip") returned 5
	[0053.337] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG", pszSpec="*.rar") returned 0
	[0053.337] lstrlenA (lpString="*.rar") returned 5
	[0053.337] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG", pszSpec="*.7z") returned 0
	[0053.337] lstrlenA (lpString="*.7z") returned 4
	[0053.337] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG", pszSpec="*.tar") returned 0
	[0053.337] lstrlenA (lpString="*.tar") returned 5
	[0053.337] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG", pszSpec="*.gzip") returned 0
	[0053.337] lstrlenA (lpString="*.gzip") returned 6
	[0053.337] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG", pszSpec="*.jpg") returned 1
	[0053.337] lstrlenA (lpString="*.jpg") returned 5
	[0053.337] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG"
	[0053.337] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG"
	[0053.337] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG."
	[0053.337] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG.exe"
	[0053.337] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0053.338] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x84a6
	[0053.338] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe84140d, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe84140d, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe84140d, dwHighDateTime=0x1d327e8)) returned 1
	[0053.338] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.338] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x8464, lpOverlapped=0x0) returned 1
	[0053.340] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned="J0145895.JPG"
	[0053.340] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.340] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x8464, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x8464, lpOverlapped=0x0) returned 1
	[0053.340] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.340] CloseHandle (hObject=0x214) returned 1
	[0053.342] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg.exe")) returned 1
	[0053.342] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe84140d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe84140d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe84140d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9a76, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145904.JPG", cAlternateFileName="")) returned 1
	[0053.342] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.342] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0145904.JPG") returned -1
	[0053.342] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0145904.JPG") returned -1
	[0053.342] lstrcmpiA (lpString1="", lpString2="J0145904.JPG") returned -1
	[0053.342] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned="J0145895.JPG"
	[0053.342] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.343] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.343] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.343] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.343] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0145904.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG"
	[0053.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG", pszSpec="*.zip") returned 0
	[0053.343] lstrlenA (lpString="*.zip") returned 5
	[0053.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG", pszSpec="*.rar") returned 0
	[0053.343] lstrlenA (lpString="*.rar") returned 5
	[0053.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG", pszSpec="*.7z") returned 0
	[0053.343] lstrlenA (lpString="*.7z") returned 4
	[0053.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG", pszSpec="*.tar") returned 0
	[0053.343] lstrlenA (lpString="*.tar") returned 5
	[0053.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG", pszSpec="*.gzip") returned 0
	[0053.343] lstrlenA (lpString="*.gzip") returned 6
	[0053.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG", pszSpec="*.jpg") returned 1
	[0053.343] lstrlenA (lpString="*.jpg") returned 5
	[0053.343] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG"
	[0053.343] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG"
	[0053.343] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG."
	[0053.343] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG.exe"
	[0053.343] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0053.343] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9a76
	[0053.344] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe84140d, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe84140d, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe84140d, dwHighDateTime=0x1d327e8)) returned 1
	[0053.344] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.344] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x9a34, lpOverlapped=0x0) returned 1
	[0053.345] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned="J0145904.JPG"
	[0053.345] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.345] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x9a34, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x9a34, lpOverlapped=0x0) returned 1
	[0053.346] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.346] CloseHandle (hObject=0x214) returned 1
	[0053.347] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg.exe")) returned 1
	[0053.348] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe84140d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe84140d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe84140d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0146142.JPG", cAlternateFileName="")) returned 1
	[0053.348] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.348] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0146142.JPG") returned -1
	[0053.348] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0146142.JPG") returned -1
	[0053.348] lstrcmpiA (lpString1="", lpString2="J0146142.JPG") returned -1
	[0053.348] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned="J0145904.JPG"
	[0053.348] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.348] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.348] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.348] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.348] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0146142.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG"
	[0053.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG", pszSpec="*.zip") returned 0
	[0053.348] lstrlenA (lpString="*.zip") returned 5
	[0053.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG", pszSpec="*.rar") returned 0
	[0053.348] lstrlenA (lpString="*.rar") returned 5
	[0053.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG", pszSpec="*.7z") returned 0
	[0053.348] lstrlenA (lpString="*.7z") returned 4
	[0053.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG", pszSpec="*.tar") returned 0
	[0053.348] lstrlenA (lpString="*.tar") returned 5
	[0053.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG", pszSpec="*.gzip") returned 0
	[0053.348] lstrlenA (lpString="*.gzip") returned 6
	[0053.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG", pszSpec="*.jpg") returned 1
	[0053.348] lstrlenA (lpString="*.jpg") returned 5
	[0053.348] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG"
	[0053.348] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG"
	[0053.349] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG."
	[0053.349] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG.exe"
	[0053.349] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0053.349] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb5ac
	[0053.349] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe84140d, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe84140d, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe84140d, dwHighDateTime=0x1d327e8)) returned 1
	[0053.349] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.349] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xb56a, lpOverlapped=0x0) returned 1
	[0053.351] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned="J0146142.JPG"
	[0053.351] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.351] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xb56a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xb56a, lpOverlapped=0x0) returned 1
	[0053.351] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.351] CloseHandle (hObject=0x214) returned 1
	[0053.353] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg.exe")) returned 1
	[0053.354] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe81b154, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe81b154, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe84140d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xaa9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0148309.JPG", cAlternateFileName="")) returned 1
	[0053.354] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.354] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0148309.JPG") returned -1
	[0053.354] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0148309.JPG") returned -1
	[0053.354] lstrcmpiA (lpString1="", lpString2="J0148309.JPG") returned -1
	[0053.354] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned="J0146142.JPG"
	[0053.354] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.354] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.354] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.354] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.354] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0148309.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG"
	[0053.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG", pszSpec="*.zip") returned 0
	[0053.354] lstrlenA (lpString="*.zip") returned 5
	[0053.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG", pszSpec="*.rar") returned 0
	[0053.354] lstrlenA (lpString="*.rar") returned 5
	[0053.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG", pszSpec="*.7z") returned 0
	[0053.354] lstrlenA (lpString="*.7z") returned 4
	[0053.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG", pszSpec="*.tar") returned 0
	[0053.354] lstrlenA (lpString="*.tar") returned 5
	[0053.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG", pszSpec="*.gzip") returned 0
	[0053.354] lstrlenA (lpString="*.gzip") returned 6
	[0053.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG", pszSpec="*.jpg") returned 1
	[0053.354] lstrlenA (lpString="*.jpg") returned 5
	[0053.354] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG"
	[0053.354] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG"
	[0053.354] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG."
	[0053.355] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG.exe"
	[0053.355] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0053.355] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaa9a
	[0053.355] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe81b154, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe81b154, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe84140d, dwHighDateTime=0x1d327e8)) returned 1
	[0053.356] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.356] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xaa58, lpOverlapped=0x0) returned 1
	[0053.358] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned="J0148309.JPG"
	[0053.359] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.359] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xaa58, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xaa58, lpOverlapped=0x0) returned 1
	[0053.359] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.359] CloseHandle (hObject=0x214) returned 1
	[0053.360] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg.exe")) returned 1
	[0053.361] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe7cecf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe7cecf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe84140d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x107d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0148757.JPG", cAlternateFileName="")) returned 1
	[0053.361] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.361] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0148757.JPG") returned -1
	[0053.361] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0148757.JPG") returned -1
	[0053.361] lstrcmpiA (lpString1="", lpString2="J0148757.JPG") returned -1
	[0053.361] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned="J0148309.JPG"
	[0053.361] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.361] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.361] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.361] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.361] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0148757.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG"
	[0053.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG", pszSpec="*.zip") returned 0
	[0053.361] lstrlenA (lpString="*.zip") returned 5
	[0053.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG", pszSpec="*.rar") returned 0
	[0053.362] lstrlenA (lpString="*.rar") returned 5
	[0053.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG", pszSpec="*.7z") returned 0
	[0053.362] lstrlenA (lpString="*.7z") returned 4
	[0053.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG", pszSpec="*.tar") returned 0
	[0053.362] lstrlenA (lpString="*.tar") returned 5
	[0053.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG", pszSpec="*.gzip") returned 0
	[0053.362] lstrlenA (lpString="*.gzip") returned 6
	[0053.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG", pszSpec="*.jpg") returned 1
	[0053.362] lstrlenA (lpString="*.jpg") returned 5
	[0053.362] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG"
	[0053.362] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG"
	[0053.362] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG."
	[0053.362] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG.exe"
	[0053.362] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0053.413] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x107d4
	[0053.413] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe7cecf4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe7cecf4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe84140d, dwHighDateTime=0x1d327e8)) returned 1
	[0053.413] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.413] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x10792, lpOverlapped=0x0) returned 1
	[0053.415] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned="J0148757.JPG"
	[0053.415] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.416] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x10792, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x10792, lpOverlapped=0x0) returned 1
	[0053.416] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.416] CloseHandle (hObject=0x214) returned 1
	[0053.418] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg.exe")) returned 1
	[0053.419] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe7cecf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe7cecf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe81b154, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x955d, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0148798.JPG", cAlternateFileName="")) returned 1
	[0053.419] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.419] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0148798.JPG") returned -1
	[0053.419] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0148798.JPG") returned -1
	[0053.419] lstrcmpiA (lpString1="", lpString2="J0148798.JPG") returned -1
	[0053.419] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned="J0148757.JPG"
	[0053.419] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.419] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.419] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.419] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.419] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0148798.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG"
	[0053.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG", pszSpec="*.zip") returned 0
	[0053.419] lstrlenA (lpString="*.zip") returned 5
	[0053.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG", pszSpec="*.rar") returned 0
	[0053.419] lstrlenA (lpString="*.rar") returned 5
	[0053.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG", pszSpec="*.7z") returned 0
	[0053.419] lstrlenA (lpString="*.7z") returned 4
	[0053.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG", pszSpec="*.tar") returned 0
	[0053.419] lstrlenA (lpString="*.tar") returned 5
	[0053.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG", pszSpec="*.gzip") returned 0
	[0053.419] lstrlenA (lpString="*.gzip") returned 6
	[0053.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG", pszSpec="*.jpg") returned 1
	[0053.420] lstrlenA (lpString="*.jpg") returned 5
	[0053.420] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG"
	[0053.420] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG"
	[0053.420] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG."
	[0053.420] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG.exe"
	[0053.420] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0053.420] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x955d
	[0053.420] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe7cecf4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe7cecf4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe81b154, dwHighDateTime=0x1d327e8)) returned 1
	[0053.420] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.420] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x951b, lpOverlapped=0x0) returned 1
	[0053.422] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned="J0148798.JPG"
	[0053.422] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.422] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x951b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x951b, lpOverlapped=0x0) returned 1
	[0053.422] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.422] CloseHandle (hObject=0x214) returned 1
	[0053.424] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg.exe")) returned 1
	[0053.424] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe7f4eef, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe7f4eef, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe84140d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6b01, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149018.JPG", cAlternateFileName="")) returned 1
	[0053.424] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.424] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0149018.JPG") returned -1
	[0053.424] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0149018.JPG") returned -1
	[0053.424] lstrcmpiA (lpString1="", lpString2="J0149018.JPG") returned -1
	[0053.425] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned="J0148798.JPG"
	[0053.425] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.425] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.425] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.425] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.425] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0149018.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG"
	[0053.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG", pszSpec="*.zip") returned 0
	[0053.425] lstrlenA (lpString="*.zip") returned 5
	[0053.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG", pszSpec="*.rar") returned 0
	[0053.425] lstrlenA (lpString="*.rar") returned 5
	[0053.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG", pszSpec="*.7z") returned 0
	[0053.425] lstrlenA (lpString="*.7z") returned 4
	[0053.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG", pszSpec="*.tar") returned 0
	[0053.425] lstrlenA (lpString="*.tar") returned 5
	[0053.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG", pszSpec="*.gzip") returned 0
	[0053.425] lstrlenA (lpString="*.gzip") returned 6
	[0053.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG", pszSpec="*.jpg") returned 1
	[0053.425] lstrlenA (lpString="*.jpg") returned 5
	[0053.425] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG"
	[0053.425] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG"
	[0053.425] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG."
	[0053.425] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG.exe"
	[0053.425] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0053.426] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6b01
	[0053.426] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe7f4eef, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe7f4eef, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe84140d, dwHighDateTime=0x1d327e8)) returned 1
	[0053.426] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.426] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x6abf, lpOverlapped=0x0) returned 1
	[0053.428] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned="J0149018.JPG"
	[0053.428] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.428] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x6abf, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x6abf, lpOverlapped=0x0) returned 1
	[0053.428] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.428] CloseHandle (hObject=0x214) returned 1
	[0053.429] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg.exe")) returned 1
	[0053.430] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe7cecf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe7cecf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe81b154, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xfd22, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149118.JPG", cAlternateFileName="")) returned 1
	[0053.430] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.430] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0149118.JPG") returned -1
	[0053.430] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0149118.JPG") returned -1
	[0053.430] lstrcmpiA (lpString1="", lpString2="J0149118.JPG") returned -1
	[0053.430] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned="J0149018.JPG"
	[0053.430] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.430] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.430] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.430] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.430] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0149118.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG"
	[0053.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG", pszSpec="*.zip") returned 0
	[0053.430] lstrlenA (lpString="*.zip") returned 5
	[0053.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG", pszSpec="*.rar") returned 0
	[0053.430] lstrlenA (lpString="*.rar") returned 5
	[0053.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG", pszSpec="*.7z") returned 0
	[0053.430] lstrlenA (lpString="*.7z") returned 4
	[0053.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG", pszSpec="*.tar") returned 0
	[0053.430] lstrlenA (lpString="*.tar") returned 5
	[0053.431] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG", pszSpec="*.gzip") returned 0
	[0053.431] lstrlenA (lpString="*.gzip") returned 6
	[0053.431] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG", pszSpec="*.jpg") returned 1
	[0053.431] lstrlenA (lpString="*.jpg") returned 5
	[0053.431] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG"
	[0053.431] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG"
	[0053.431] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG."
	[0053.431] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG.exe"
	[0053.431] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0053.431] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfd22
	[0053.431] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe7cecf4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe7cecf4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe81b154, dwHighDateTime=0x1d327e8)) returned 1
	[0053.431] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.431] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xfce0, lpOverlapped=0x0) returned 1
	[0053.433] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned="J0149118.JPG"
	[0053.433] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.433] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xfce0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xfce0, lpOverlapped=0x0) returned 1
	[0053.433] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.433] CloseHandle (hObject=0x214) returned 1
	[0053.437] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg.exe")) returned 1
	[0053.438] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe7cecf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe7cecf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe81b154, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb544, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0150150.WMF", cAlternateFileName="")) returned 1
	[0053.438] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.438] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0150150.WMF") returned -1
	[0053.438] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0150150.WMF") returned -1
	[0053.438] lstrcmpiA (lpString1="", lpString2="J0150150.WMF") returned -1
	[0053.438] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned="J0149118.JPG"
	[0053.438] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.438] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.438] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.438] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.438] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0150150.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF"
	[0053.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.zip") returned 0
	[0053.438] lstrlenA (lpString="*.zip") returned 5
	[0053.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.rar") returned 0
	[0053.438] lstrlenA (lpString="*.rar") returned 5
	[0053.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.7z") returned 0
	[0053.438] lstrlenA (lpString="*.7z") returned 4
	[0053.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.tar") returned 0
	[0053.438] lstrlenA (lpString="*.tar") returned 5
	[0053.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.gzip") returned 0
	[0053.438] lstrlenA (lpString="*.gzip") returned 6
	[0053.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.jpg") returned 0
	[0053.439] lstrlenA (lpString="*.jpg") returned 5
	[0053.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.jpeg") returned 0
	[0053.439] lstrlenA (lpString="*.jpeg") returned 6
	[0053.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.bmp") returned 0
	[0053.439] lstrlenA (lpString="*.bmp") returned 5
	[0053.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.gif") returned 0
	[0053.439] lstrlenA (lpString="*.gif") returned 5
	[0053.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.png") returned 0
	[0053.439] lstrlenA (lpString="*.png") returned 5
	[0053.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.doc") returned 0
	[0053.439] lstrlenA (lpString="*.doc") returned 5
	[0053.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.docx") returned 0
	[0053.439] lstrlenA (lpString="*.docx") returned 6
	[0053.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.xls") returned 0
	[0053.439] lstrlenA (lpString="*.xls") returned 5
	[0053.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.xlsx") returned 0
	[0053.439] lstrlenA (lpString="*.xlsx") returned 6
	[0053.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.ppt") returned 0
	[0053.439] lstrlenA (lpString="*.ppt") returned 5
	[0053.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.pptx") returned 0
	[0053.439] lstrlenA (lpString="*.pptx") returned 6
	[0053.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.txt") returned 0
	[0053.439] lstrlenA (lpString="*.txt") returned 5
	[0053.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.pdf") returned 0
	[0053.439] lstrlenA (lpString="*.pdf") returned 5
	[0053.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.htm") returned 0
	[0053.439] lstrlenA (lpString="*.htm") returned 5
	[0053.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.html") returned 0
	[0053.439] lstrlenA (lpString="*.html") returned 6
	[0053.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.mdb") returned 0
	[0053.439] lstrlenA (lpString="*.mdb") returned 5
	[0053.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.pfx") returned 0
	[0053.440] lstrlenA (lpString="*.pfx") returned 5
	[0053.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.md") returned 0
	[0053.440] lstrlenA (lpString="*.md") returned 4
	[0053.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.lnk") returned 0
	[0053.440] lstrlenA (lpString="*.lnk") returned 5
	[0053.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.torrent") returned 0
	[0053.440] lstrlenA (lpString="*.torrent") returned 9
	[0053.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.mov") returned 0
	[0053.440] lstrlenA (lpString="*.mov") returned 5
	[0053.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.3gp") returned 0
	[0053.440] lstrlenA (lpString="*.3gp") returned 5
	[0053.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.mpeg") returned 0
	[0053.440] lstrlenA (lpString="*.mpeg") returned 6
	[0053.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.mpg") returned 0
	[0053.440] lstrlenA (lpString="*.mpg") returned 5
	[0053.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.flv") returned 0
	[0053.440] lstrlenA (lpString="*.flv") returned 5
	[0053.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.avi") returned 0
	[0053.440] lstrlenA (lpString="*.avi") returned 5
	[0053.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.mp4") returned 0
	[0053.440] lstrlenA (lpString="*.mp4") returned 5
	[0053.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.wmv") returned 0
	[0053.440] lstrlenA (lpString="*.wmv") returned 5
	[0053.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.mkv") returned 0
	[0053.440] lstrlenA (lpString="*.mkv") returned 5
	[0053.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.mp3") returned 0
	[0053.440] lstrlenA (lpString="*.mp3") returned 5
	[0053.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.wav") returned 0
	[0053.440] lstrlenA (lpString="*.wav") returned 5
	[0053.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.flac") returned 0
	[0053.440] lstrlenA (lpString="*.flac") returned 6
	[0053.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.wma") returned 0
	[0053.440] lstrlenA (lpString="*.wma") returned 5
	[0053.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.au3") returned 0
	[0053.441] lstrlenA (lpString="*.au3") returned 5
	[0053.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.ahk") returned 0
	[0053.441] lstrlenA (lpString="*.ahk") returned 5
	[0053.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.c") returned 0
	[0053.441] lstrlenA (lpString="*.c") returned 3
	[0053.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.cc") returned 0
	[0053.441] lstrlenA (lpString="*.cc") returned 4
	[0053.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.cpp") returned 0
	[0053.441] lstrlenA (lpString="*.cpp") returned 5
	[0053.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.cxx") returned 0
	[0053.441] lstrlenA (lpString="*.cxx") returned 5
	[0053.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.c++") returned 0
	[0053.441] lstrlenA (lpString="*.c++") returned 5
	[0053.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.cs") returned 0
	[0053.441] lstrlenA (lpString="*.cs") returned 4
	[0053.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.vb") returned 0
	[0053.441] lstrlenA (lpString="*.vb") returned 4
	[0053.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.bas") returned 0
	[0053.441] lstrlenA (lpString="*.bas") returned 5
	[0053.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.csproj") returned 0
	[0053.441] lstrlenA (lpString="*.csproj") returned 8
	[0053.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.vbproj") returned 0
	[0053.441] lstrlenA (lpString="*.vbproj") returned 8
	[0053.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.vcxproj") returned 0
	[0053.441] lstrlenA (lpString="*.vcxproj") returned 9
	[0053.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.manifest") returned 0
	[0053.441] lstrlenA (lpString="*.manifest") returned 10
	[0053.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.php") returned 0
	[0053.441] lstrlenA (lpString="*.php") returned 5
	[0053.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.vbe") returned 0
	[0053.441] lstrlenA (lpString="*.vbe") returned 5
	[0053.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.vba") returned 0
	[0053.442] lstrlenA (lpString="*.vba") returned 5
	[0053.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.vbs") returned 0
	[0053.442] lstrlenA (lpString="*.vbs") returned 5
	[0053.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.bat") returned 0
	[0053.442] lstrlenA (lpString="*.bat") returned 5
	[0053.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.cmd") returned 0
	[0053.442] lstrlenA (lpString="*.cmd") returned 5
	[0053.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.js") returned 0
	[0053.442] lstrlenA (lpString="*.js") returned 4
	[0053.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.jscript") returned 0
	[0053.442] lstrlenA (lpString="*.jscript") returned 9
	[0053.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.hta") returned 0
	[0053.442] lstrlenA (lpString="*.hta") returned 5
	[0053.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.php7") returned 0
	[0053.442] lstrlenA (lpString="*.php7") returned 6
	[0053.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.db") returned 0
	[0053.442] lstrlenA (lpString="*.db") returned 4
	[0053.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.swf") returned 0
	[0053.442] lstrlenA (lpString="*.swf") returned 5
	[0053.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.eml") returned 0
	[0053.442] lstrlenA (lpString="*.eml") returned 5
	[0053.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.part") returned 0
	[0053.442] lstrlenA (lpString="*.part") returned 6
	[0053.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.nfo") returned 0
	[0053.442] lstrlenA (lpString="*.nfo") returned 5
	[0053.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.rsa") returned 0
	[0053.442] lstrlenA (lpString="*.rsa") returned 5
	[0053.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.key") returned 0
	[0053.442] lstrlenA (lpString="*.key") returned 5
	[0053.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.aes") returned 0
	[0053.442] lstrlenA (lpString="*.aes") returned 5
	[0053.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.blob") returned 0
	[0053.442] lstrlenA (lpString="*.blob") returned 6
	[0053.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.btc") returned 0
	[0053.443] lstrlenA (lpString="*.btc") returned 5
	[0053.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF", pszSpec="*.wallet") returned 0
	[0053.443] lstrlenA (lpString="*.wallet") returned 8
	[0053.443] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe7cecf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe7cecf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe7f4eef, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x212e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0150861.WMF", cAlternateFileName="")) returned 1
	[0053.443] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.443] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0150861.WMF") returned -1
	[0053.443] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0150861.WMF") returned -1
	[0053.443] lstrcmpiA (lpString1="", lpString2="J0150861.WMF") returned -1
	[0053.443] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned="J0150150.WMF"
	[0053.443] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.443] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.443] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.443] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.443] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0150861.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF"
	[0053.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.zip") returned 0
	[0053.443] lstrlenA (lpString="*.zip") returned 5
	[0053.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.rar") returned 0
	[0053.443] lstrlenA (lpString="*.rar") returned 5
	[0053.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.7z") returned 0
	[0053.443] lstrlenA (lpString="*.7z") returned 4
	[0053.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.tar") returned 0
	[0053.443] lstrlenA (lpString="*.tar") returned 5
	[0053.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.gzip") returned 0
	[0053.443] lstrlenA (lpString="*.gzip") returned 6
	[0053.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.jpg") returned 0
	[0053.443] lstrlenA (lpString="*.jpg") returned 5
	[0053.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.jpeg") returned 0
	[0053.443] lstrlenA (lpString="*.jpeg") returned 6
	[0053.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.bmp") returned 0
	[0053.444] lstrlenA (lpString="*.bmp") returned 5
	[0053.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.gif") returned 0
	[0053.444] lstrlenA (lpString="*.gif") returned 5
	[0053.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.png") returned 0
	[0053.444] lstrlenA (lpString="*.png") returned 5
	[0053.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.doc") returned 0
	[0053.444] lstrlenA (lpString="*.doc") returned 5
	[0053.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.docx") returned 0
	[0053.444] lstrlenA (lpString="*.docx") returned 6
	[0053.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.xls") returned 0
	[0053.444] lstrlenA (lpString="*.xls") returned 5
	[0053.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.xlsx") returned 0
	[0053.444] lstrlenA (lpString="*.xlsx") returned 6
	[0053.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.ppt") returned 0
	[0053.444] lstrlenA (lpString="*.ppt") returned 5
	[0053.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.pptx") returned 0
	[0053.444] lstrlenA (lpString="*.pptx") returned 6
	[0053.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.txt") returned 0
	[0053.444] lstrlenA (lpString="*.txt") returned 5
	[0053.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.pdf") returned 0
	[0053.444] lstrlenA (lpString="*.pdf") returned 5
	[0053.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.htm") returned 0
	[0053.444] lstrlenA (lpString="*.htm") returned 5
	[0053.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.html") returned 0
	[0053.444] lstrlenA (lpString="*.html") returned 6
	[0053.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.mdb") returned 0
	[0053.444] lstrlenA (lpString="*.mdb") returned 5
	[0053.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.pfx") returned 0
	[0053.444] lstrlenA (lpString="*.pfx") returned 5
	[0053.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.md") returned 0
	[0053.444] lstrlenA (lpString="*.md") returned 4
	[0053.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.lnk") returned 0
	[0053.444] lstrlenA (lpString="*.lnk") returned 5
	[0053.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.torrent") returned 0
	[0053.445] lstrlenA (lpString="*.torrent") returned 9
	[0053.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.mov") returned 0
	[0053.445] lstrlenA (lpString="*.mov") returned 5
	[0053.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.3gp") returned 0
	[0053.445] lstrlenA (lpString="*.3gp") returned 5
	[0053.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.mpeg") returned 0
	[0053.445] lstrlenA (lpString="*.mpeg") returned 6
	[0053.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.mpg") returned 0
	[0053.445] lstrlenA (lpString="*.mpg") returned 5
	[0053.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.flv") returned 0
	[0053.445] lstrlenA (lpString="*.flv") returned 5
	[0053.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.avi") returned 0
	[0053.445] lstrlenA (lpString="*.avi") returned 5
	[0053.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.mp4") returned 0
	[0053.445] lstrlenA (lpString="*.mp4") returned 5
	[0053.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.wmv") returned 0
	[0053.445] lstrlenA (lpString="*.wmv") returned 5
	[0053.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.mkv") returned 0
	[0053.445] lstrlenA (lpString="*.mkv") returned 5
	[0053.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.mp3") returned 0
	[0053.445] lstrlenA (lpString="*.mp3") returned 5
	[0053.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.wav") returned 0
	[0053.445] lstrlenA (lpString="*.wav") returned 5
	[0053.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.flac") returned 0
	[0053.445] lstrlenA (lpString="*.flac") returned 6
	[0053.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.wma") returned 0
	[0053.445] lstrlenA (lpString="*.wma") returned 5
	[0053.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.au3") returned 0
	[0053.445] lstrlenA (lpString="*.au3") returned 5
	[0053.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.ahk") returned 0
	[0053.445] lstrlenA (lpString="*.ahk") returned 5
	[0053.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.c") returned 0
	[0053.445] lstrlenA (lpString="*.c") returned 3
	[0053.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.cc") returned 0
	[0053.446] lstrlenA (lpString="*.cc") returned 4
	[0053.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.cpp") returned 0
	[0053.446] lstrlenA (lpString="*.cpp") returned 5
	[0053.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.cxx") returned 0
	[0053.446] lstrlenA (lpString="*.cxx") returned 5
	[0053.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.c++") returned 0
	[0053.446] lstrlenA (lpString="*.c++") returned 5
	[0053.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.cs") returned 0
	[0053.446] lstrlenA (lpString="*.cs") returned 4
	[0053.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.vb") returned 0
	[0053.446] lstrlenA (lpString="*.vb") returned 4
	[0053.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.bas") returned 0
	[0053.446] lstrlenA (lpString="*.bas") returned 5
	[0053.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.csproj") returned 0
	[0053.446] lstrlenA (lpString="*.csproj") returned 8
	[0053.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.vbproj") returned 0
	[0053.446] lstrlenA (lpString="*.vbproj") returned 8
	[0053.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.vcxproj") returned 0
	[0053.446] lstrlenA (lpString="*.vcxproj") returned 9
	[0053.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.manifest") returned 0
	[0053.446] lstrlenA (lpString="*.manifest") returned 10
	[0053.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.php") returned 0
	[0053.446] lstrlenA (lpString="*.php") returned 5
	[0053.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.vbe") returned 0
	[0053.446] lstrlenA (lpString="*.vbe") returned 5
	[0053.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.vba") returned 0
	[0053.446] lstrlenA (lpString="*.vba") returned 5
	[0053.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.vbs") returned 0
	[0053.446] lstrlenA (lpString="*.vbs") returned 5
	[0053.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.bat") returned 0
	[0053.446] lstrlenA (lpString="*.bat") returned 5
	[0053.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.cmd") returned 0
	[0053.446] lstrlenA (lpString="*.cmd") returned 5
	[0053.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.js") returned 0
	[0053.447] lstrlenA (lpString="*.js") returned 4
	[0053.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.jscript") returned 0
	[0053.447] lstrlenA (lpString="*.jscript") returned 9
	[0053.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.hta") returned 0
	[0053.447] lstrlenA (lpString="*.hta") returned 5
	[0053.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.php7") returned 0
	[0053.447] lstrlenA (lpString="*.php7") returned 6
	[0053.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.db") returned 0
	[0053.447] lstrlenA (lpString="*.db") returned 4
	[0053.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.swf") returned 0
	[0053.447] lstrlenA (lpString="*.swf") returned 5
	[0053.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.eml") returned 0
	[0053.447] lstrlenA (lpString="*.eml") returned 5
	[0053.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.part") returned 0
	[0053.447] lstrlenA (lpString="*.part") returned 6
	[0053.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.nfo") returned 0
	[0053.447] lstrlenA (lpString="*.nfo") returned 5
	[0053.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.rsa") returned 0
	[0053.447] lstrlenA (lpString="*.rsa") returned 5
	[0053.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.key") returned 0
	[0053.447] lstrlenA (lpString="*.key") returned 5
	[0053.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.aes") returned 0
	[0053.447] lstrlenA (lpString="*.aes") returned 5
	[0053.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.blob") returned 0
	[0053.447] lstrlenA (lpString="*.blob") returned 6
	[0053.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.btc") returned 0
	[0053.447] lstrlenA (lpString="*.btc") returned 5
	[0053.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF", pszSpec="*.wallet") returned 0
	[0053.447] lstrlenA (lpString="*.wallet") returned 8
	[0053.447] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe84140d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe84140d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe867602, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1104, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151041.WMF", cAlternateFileName="")) returned 1
	[0053.447] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.447] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0151041.WMF") returned -1
	[0053.447] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0151041.WMF") returned -1
	[0053.448] lstrcmpiA (lpString1="", lpString2="J0151041.WMF") returned -1
	[0053.448] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned="J0150861.WMF"
	[0053.448] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.448] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.448] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.448] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.448] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0151041.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF"
	[0053.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.zip") returned 0
	[0053.448] lstrlenA (lpString="*.zip") returned 5
	[0053.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.rar") returned 0
	[0053.448] lstrlenA (lpString="*.rar") returned 5
	[0053.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.7z") returned 0
	[0053.448] lstrlenA (lpString="*.7z") returned 4
	[0053.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.tar") returned 0
	[0053.448] lstrlenA (lpString="*.tar") returned 5
	[0053.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.gzip") returned 0
	[0053.448] lstrlenA (lpString="*.gzip") returned 6
	[0053.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.jpg") returned 0
	[0053.448] lstrlenA (lpString="*.jpg") returned 5
	[0053.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.jpeg") returned 0
	[0053.448] lstrlenA (lpString="*.jpeg") returned 6
	[0053.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.bmp") returned 0
	[0053.448] lstrlenA (lpString="*.bmp") returned 5
	[0053.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.gif") returned 0
	[0053.448] lstrlenA (lpString="*.gif") returned 5
	[0053.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.png") returned 0
	[0053.448] lstrlenA (lpString="*.png") returned 5
	[0053.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.doc") returned 0
	[0053.448] lstrlenA (lpString="*.doc") returned 5
	[0053.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.docx") returned 0
	[0053.448] lstrlenA (lpString="*.docx") returned 6
	[0053.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.xls") returned 0
	[0053.449] lstrlenA (lpString="*.xls") returned 5
	[0053.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.xlsx") returned 0
	[0053.449] lstrlenA (lpString="*.xlsx") returned 6
	[0053.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.ppt") returned 0
	[0053.449] lstrlenA (lpString="*.ppt") returned 5
	[0053.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.pptx") returned 0
	[0053.449] lstrlenA (lpString="*.pptx") returned 6
	[0053.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.txt") returned 0
	[0053.449] lstrlenA (lpString="*.txt") returned 5
	[0053.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.pdf") returned 0
	[0053.449] lstrlenA (lpString="*.pdf") returned 5
	[0053.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.htm") returned 0
	[0053.449] lstrlenA (lpString="*.htm") returned 5
	[0053.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.html") returned 0
	[0053.449] lstrlenA (lpString="*.html") returned 6
	[0053.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.mdb") returned 0
	[0053.449] lstrlenA (lpString="*.mdb") returned 5
	[0053.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.pfx") returned 0
	[0053.449] lstrlenA (lpString="*.pfx") returned 5
	[0053.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.md") returned 0
	[0053.449] lstrlenA (lpString="*.md") returned 4
	[0053.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.lnk") returned 0
	[0053.449] lstrlenA (lpString="*.lnk") returned 5
	[0053.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.torrent") returned 0
	[0053.449] lstrlenA (lpString="*.torrent") returned 9
	[0053.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.mov") returned 0
	[0053.449] lstrlenA (lpString="*.mov") returned 5
	[0053.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.3gp") returned 0
	[0053.449] lstrlenA (lpString="*.3gp") returned 5
	[0053.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.mpeg") returned 0
	[0053.449] lstrlenA (lpString="*.mpeg") returned 6
	[0053.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.mpg") returned 0
	[0053.449] lstrlenA (lpString="*.mpg") returned 5
	[0053.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.flv") returned 0
	[0053.628] lstrlenA (lpString="*.flv") returned 5
	[0053.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.avi") returned 0
	[0053.628] lstrlenA (lpString="*.avi") returned 5
	[0053.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.mp4") returned 0
	[0053.628] lstrlenA (lpString="*.mp4") returned 5
	[0053.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.wmv") returned 0
	[0053.628] lstrlenA (lpString="*.wmv") returned 5
	[0053.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.mkv") returned 0
	[0053.628] lstrlenA (lpString="*.mkv") returned 5
	[0053.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.mp3") returned 0
	[0053.628] lstrlenA (lpString="*.mp3") returned 5
	[0053.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.wav") returned 0
	[0053.628] lstrlenA (lpString="*.wav") returned 5
	[0053.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.flac") returned 0
	[0053.628] lstrlenA (lpString="*.flac") returned 6
	[0053.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.wma") returned 0
	[0053.628] lstrlenA (lpString="*.wma") returned 5
	[0053.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.au3") returned 0
	[0053.628] lstrlenA (lpString="*.au3") returned 5
	[0053.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.ahk") returned 0
	[0053.628] lstrlenA (lpString="*.ahk") returned 5
	[0053.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.c") returned 0
	[0053.628] lstrlenA (lpString="*.c") returned 3
	[0053.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.cc") returned 0
	[0053.628] lstrlenA (lpString="*.cc") returned 4
	[0053.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.cpp") returned 0
	[0053.628] lstrlenA (lpString="*.cpp") returned 5
	[0053.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.cxx") returned 0
	[0053.628] lstrlenA (lpString="*.cxx") returned 5
	[0053.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.c++") returned 0
	[0053.628] lstrlenA (lpString="*.c++") returned 5
	[0053.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.cs") returned 0
	[0053.629] lstrlenA (lpString="*.cs") returned 4
	[0053.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.vb") returned 0
	[0053.629] lstrlenA (lpString="*.vb") returned 4
	[0053.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.bas") returned 0
	[0053.629] lstrlenA (lpString="*.bas") returned 5
	[0053.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.csproj") returned 0
	[0053.629] lstrlenA (lpString="*.csproj") returned 8
	[0053.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.vbproj") returned 0
	[0053.629] lstrlenA (lpString="*.vbproj") returned 8
	[0053.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.vcxproj") returned 0
	[0053.629] lstrlenA (lpString="*.vcxproj") returned 9
	[0053.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.manifest") returned 0
	[0053.629] lstrlenA (lpString="*.manifest") returned 10
	[0053.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.php") returned 0
	[0053.629] lstrlenA (lpString="*.php") returned 5
	[0053.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.vbe") returned 0
	[0053.629] lstrlenA (lpString="*.vbe") returned 5
	[0053.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.vba") returned 0
	[0053.629] lstrlenA (lpString="*.vba") returned 5
	[0053.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.vbs") returned 0
	[0053.629] lstrlenA (lpString="*.vbs") returned 5
	[0053.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.bat") returned 0
	[0053.629] lstrlenA (lpString="*.bat") returned 5
	[0053.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.cmd") returned 0
	[0053.629] lstrlenA (lpString="*.cmd") returned 5
	[0053.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.js") returned 0
	[0053.629] lstrlenA (lpString="*.js") returned 4
	[0053.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.jscript") returned 0
	[0053.629] lstrlenA (lpString="*.jscript") returned 9
	[0053.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.hta") returned 0
	[0053.629] lstrlenA (lpString="*.hta") returned 5
	[0053.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.php7") returned 0
	[0053.630] lstrlenA (lpString="*.php7") returned 6
	[0053.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.db") returned 0
	[0053.630] lstrlenA (lpString="*.db") returned 4
	[0053.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.swf") returned 0
	[0053.630] lstrlenA (lpString="*.swf") returned 5
	[0053.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.eml") returned 0
	[0053.630] lstrlenA (lpString="*.eml") returned 5
	[0053.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.part") returned 0
	[0053.630] lstrlenA (lpString="*.part") returned 6
	[0053.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.nfo") returned 0
	[0053.630] lstrlenA (lpString="*.nfo") returned 5
	[0053.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.rsa") returned 0
	[0053.630] lstrlenA (lpString="*.rsa") returned 5
	[0053.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.key") returned 0
	[0053.630] lstrlenA (lpString="*.key") returned 5
	[0053.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.aes") returned 0
	[0053.630] lstrlenA (lpString="*.aes") returned 5
	[0053.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.blob") returned 0
	[0053.630] lstrlenA (lpString="*.blob") returned 6
	[0053.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.btc") returned 0
	[0053.630] lstrlenA (lpString="*.btc") returned 5
	[0053.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF", pszSpec="*.wallet") returned 0
	[0053.630] lstrlenA (lpString="*.wallet") returned 8
	[0053.630] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe84140d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe84140d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe84140d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3c68, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151045.WMF", cAlternateFileName="")) returned 1
	[0053.631] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.631] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0151045.WMF") returned -1
	[0053.631] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0151045.WMF") returned -1
	[0053.631] lstrcmpiA (lpString1="", lpString2="J0151045.WMF") returned -1
	[0053.631] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned="J0151041.WMF"
	[0053.632] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.632] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.632] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.632] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.632] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0151045.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF"
	[0053.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.zip") returned 0
	[0053.632] lstrlenA (lpString="*.zip") returned 5
	[0053.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.rar") returned 0
	[0053.632] lstrlenA (lpString="*.rar") returned 5
	[0053.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.7z") returned 0
	[0053.632] lstrlenA (lpString="*.7z") returned 4
	[0053.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.tar") returned 0
	[0053.632] lstrlenA (lpString="*.tar") returned 5
	[0053.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.gzip") returned 0
	[0053.632] lstrlenA (lpString="*.gzip") returned 6
	[0053.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.jpg") returned 0
	[0053.632] lstrlenA (lpString="*.jpg") returned 5
	[0053.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.jpeg") returned 0
	[0053.632] lstrlenA (lpString="*.jpeg") returned 6
	[0053.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.bmp") returned 0
	[0053.632] lstrlenA (lpString="*.bmp") returned 5
	[0053.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.gif") returned 0
	[0053.632] lstrlenA (lpString="*.gif") returned 5
	[0053.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.png") returned 0
	[0053.632] lstrlenA (lpString="*.png") returned 5
	[0053.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.doc") returned 0
	[0053.632] lstrlenA (lpString="*.doc") returned 5
	[0053.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.docx") returned 0
	[0053.632] lstrlenA (lpString="*.docx") returned 6
	[0053.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.xls") returned 0
	[0053.633] lstrlenA (lpString="*.xls") returned 5
	[0053.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.xlsx") returned 0
	[0053.633] lstrlenA (lpString="*.xlsx") returned 6
	[0053.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.ppt") returned 0
	[0053.633] lstrlenA (lpString="*.ppt") returned 5
	[0053.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.pptx") returned 0
	[0053.633] lstrlenA (lpString="*.pptx") returned 6
	[0053.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.txt") returned 0
	[0053.633] lstrlenA (lpString="*.txt") returned 5
	[0053.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.pdf") returned 0
	[0053.633] lstrlenA (lpString="*.pdf") returned 5
	[0053.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.htm") returned 0
	[0053.633] lstrlenA (lpString="*.htm") returned 5
	[0053.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.html") returned 0
	[0053.633] lstrlenA (lpString="*.html") returned 6
	[0053.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.mdb") returned 0
	[0053.633] lstrlenA (lpString="*.mdb") returned 5
	[0053.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.pfx") returned 0
	[0053.633] lstrlenA (lpString="*.pfx") returned 5
	[0053.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.md") returned 0
	[0053.633] lstrlenA (lpString="*.md") returned 4
	[0053.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.lnk") returned 0
	[0053.633] lstrlenA (lpString="*.lnk") returned 5
	[0053.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.torrent") returned 0
	[0053.633] lstrlenA (lpString="*.torrent") returned 9
	[0053.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.mov") returned 0
	[0053.633] lstrlenA (lpString="*.mov") returned 5
	[0053.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.3gp") returned 0
	[0053.633] lstrlenA (lpString="*.3gp") returned 5
	[0053.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.mpeg") returned 0
	[0053.633] lstrlenA (lpString="*.mpeg") returned 6
	[0053.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.mpg") returned 0
	[0053.633] lstrlenA (lpString="*.mpg") returned 5
	[0053.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF", pszSpec="*.flv") returned 0
	[0053.634] lstrlenA (lpString="*.flv") returned 5
	[0053.634] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe84140d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe84140d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe84140d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4844, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151047.WMF", cAlternateFileName="")) returned 1
	[0053.634] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.634] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0151047.WMF") returned -1
	[0053.634] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0151047.WMF") returned -1
	[0053.634] lstrcmpiA (lpString1="", lpString2="J0151047.WMF") returned -1
	[0053.634] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned="J0151045.WMF"
	[0053.634] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.634] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.634] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.634] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.634] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0151047.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF"
	[0053.634] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe84140d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe84140d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe84140d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3928, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151055.WMF", cAlternateFileName="")) returned 1
	[0053.634] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.634] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0151055.WMF") returned -1
	[0053.634] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0151055.WMF") returned -1
	[0053.634] lstrcmpiA (lpString1="", lpString2="J0151055.WMF") returned -1
	[0053.635] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned="J0151047.WMF"
	[0053.635] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.635] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.635] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.635] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.635] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0151055.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF"
	[0053.635] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe84140d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe84140d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe84140d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151061.WMF", cAlternateFileName="")) returned 1
	[0053.635] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.635] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0151061.WMF") returned -1
	[0053.635] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0151061.WMF") returned -1
	[0053.635] lstrcmpiA (lpString1="", lpString2="J0151061.WMF") returned -1
	[0053.635] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned="J0151055.WMF"
	[0053.635] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.635] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.635] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.635] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.635] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0151061.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF"
	[0053.635] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe84140d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe84140d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe84140d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151063.WMF", cAlternateFileName="")) returned 1
	[0053.635] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.635] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0151063.WMF") returned -1
	[0053.635] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0151063.WMF") returned -1
	[0053.635] lstrcmpiA (lpString1="", lpString2="J0151063.WMF") returned -1
	[0053.635] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned="J0151061.WMF"
	[0053.635] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.635] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.636] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.636] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.636] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0151063.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF"
	[0053.636] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe84140d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe84140d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe84140d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3394, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151067.WMF", cAlternateFileName="")) returned 1
	[0053.636] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.636] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0151067.WMF") returned -1
	[0053.636] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0151067.WMF") returned -1
	[0053.636] lstrcmpiA (lpString1="", lpString2="J0151067.WMF") returned -1
	[0053.636] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned="J0151063.WMF"
	[0053.636] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.636] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.636] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.636] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.636] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0151067.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF"
	[0053.636] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe84140d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe84140d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe84140d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3418, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151073.WMF", cAlternateFileName="")) returned 1
	[0053.636] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.636] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0151073.WMF") returned -1
	[0053.636] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0151073.WMF") returned -1
	[0053.636] lstrcmpiA (lpString1="", lpString2="J0151073.WMF") returned -1
	[0053.636] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned="J0151067.WMF"
	[0053.636] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.636] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.636] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.636] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.637] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0151073.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF"
	[0053.637] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe84140d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe84140d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe84140d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151581.WMF", cAlternateFileName="")) returned 1
	[0053.637] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.637] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0151581.WMF") returned -1
	[0053.637] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0151581.WMF") returned -1
	[0053.637] lstrcmpiA (lpString1="", lpString2="J0151581.WMF") returned -1
	[0053.637] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned="J0151073.WMF"
	[0053.637] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.637] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.637] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.637] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.637] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0151581.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF"
	[0053.637] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe84140d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe84140d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe84140d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x610c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152414.WMF", cAlternateFileName="")) returned 1
	[0053.637] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.637] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0152414.WMF") returned -1
	[0053.637] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0152414.WMF") returned -1
	[0053.637] lstrcmpiA (lpString1="", lpString2="J0152414.WMF") returned -1
	[0053.637] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned="J0151581.WMF"
	[0053.637] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.637] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.637] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.637] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.638] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0152414.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF"
	[0053.638] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe867602, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe867602, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe8d9e20, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152430.WMF", cAlternateFileName="")) returned 1
	[0053.638] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.638] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0152430.WMF") returned -1
	[0053.638] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0152430.WMF") returned -1
	[0053.638] lstrcmpiA (lpString1="", lpString2="J0152430.WMF") returned -1
	[0053.638] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned="J0152414.WMF"
	[0053.638] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.638] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.638] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.638] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.638] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0152430.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF"
	[0053.638] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe867602, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe867602, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe88d87c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x406c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152432.WMF", cAlternateFileName="")) returned 1
	[0053.638] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.638] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0152432.WMF") returned -1
	[0053.638] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0152432.WMF") returned -1
	[0053.638] lstrcmpiA (lpString1="", lpString2="J0152432.WMF") returned -1
	[0053.638] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned="J0152430.WMF"
	[0053.638] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.638] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.638] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.638] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.638] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0152432.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF"
	[0053.639] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe867602, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe867602, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe8b3ab6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2c4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152436.WMF", cAlternateFileName="")) returned 1
	[0053.639] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.688] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0152436.WMF") returned -1
	[0053.688] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0152436.WMF") returned -1
	[0053.688] lstrcmpiA (lpString1="", lpString2="J0152436.WMF") returned -1
	[0053.688] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned="J0152432.WMF"
	[0053.688] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.688] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.688] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.688] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.688] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0152436.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF"
	[0053.688] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe867602, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe867602, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe867602, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4030, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152556.WMF", cAlternateFileName="")) returned 1
	[0053.688] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.688] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0152556.WMF") returned -1
	[0053.688] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0152556.WMF") returned -1
	[0053.688] lstrcmpiA (lpString1="", lpString2="J0152556.WMF") returned -1
	[0053.688] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned="J0152436.WMF"
	[0053.688] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.689] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.689] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.689] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.689] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0152556.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF"
	[0053.689] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe84140d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe84140d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe867602, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3eb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152558.WMF", cAlternateFileName="")) returned 1
	[0053.689] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.689] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0152558.WMF") returned -1
	[0053.689] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0152558.WMF") returned -1
	[0053.689] lstrcmpiA (lpString1="", lpString2="J0152558.WMF") returned -1
	[0053.689] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned="J0152556.WMF"
	[0053.689] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.689] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.689] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.689] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.689] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0152558.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF"
	[0053.689] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe84140d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe84140d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe84140d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2a80, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152560.WMF", cAlternateFileName="")) returned 1
	[0053.689] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.689] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0152560.WMF") returned -1
	[0053.689] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0152560.WMF") returned -1
	[0053.689] lstrcmpiA (lpString1="", lpString2="J0152560.WMF") returned -1
	[0053.689] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned="J0152558.WMF"
	[0053.689] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.689] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.689] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.690] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.690] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0152560.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF"
	[0053.690] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe867602, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe867602, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe88d87c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe70, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152568.WMF", cAlternateFileName="")) returned 1
	[0053.690] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.690] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0152568.WMF") returned -1
	[0053.690] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0152568.WMF") returned -1
	[0053.690] lstrcmpiA (lpString1="", lpString2="J0152568.WMF") returned -1
	[0053.690] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned="J0152560.WMF"
	[0053.690] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.690] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.690] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.690] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.690] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0152568.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF"
	[0053.690] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe84140d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe84140d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe867602, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd28, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152570.WMF", cAlternateFileName="")) returned 1
	[0053.690] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.690] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0152570.WMF") returned -1
	[0053.690] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0152570.WMF") returned -1
	[0053.690] lstrcmpiA (lpString1="", lpString2="J0152570.WMF") returned -1
	[0053.690] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned="J0152568.WMF"
	[0053.690] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.690] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.690] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.690] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.691] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0152570.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF"
	[0053.691] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe84140d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe84140d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe867602, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ab4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152590.WMF", cAlternateFileName="")) returned 1
	[0053.691] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.691] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0152590.WMF") returned -1
	[0053.691] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0152590.WMF") returned -1
	[0053.691] lstrcmpiA (lpString1="", lpString2="J0152590.WMF") returned -1
	[0053.691] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned="J0152570.WMF"
	[0053.691] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.691] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.691] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.691] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.691] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0152590.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF"
	[0053.691] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe84140d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe84140d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe867602, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x18c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152594.WMF", cAlternateFileName="")) returned 1
	[0053.691] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.691] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0152594.WMF") returned -1
	[0053.691] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0152594.WMF") returned -1
	[0053.691] lstrcmpiA (lpString1="", lpString2="J0152594.WMF") returned -1
	[0053.691] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned="J0152590.WMF"
	[0053.691] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.691] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.691] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.691] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.691] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0152594.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF"
	[0053.692] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe9261f7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe9261f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe9261f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2628, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152600.WMF", cAlternateFileName="")) returned 1
	[0053.692] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.692] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0152600.WMF") returned -1
	[0053.692] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0152600.WMF") returned -1
	[0053.692] lstrcmpiA (lpString1="", lpString2="J0152600.WMF") returned -1
	[0053.692] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned="J0152594.WMF"
	[0053.692] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.692] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.692] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.692] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.692] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0152600.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF"
	[0053.692] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe9261f7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe9261f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe94c4b9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1884, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152602.WMF", cAlternateFileName="")) returned 1
	[0053.692] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.692] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0152602.WMF") returned -1
	[0053.692] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0152602.WMF") returned -1
	[0053.692] lstrcmpiA (lpString1="", lpString2="J0152602.WMF") returned -1
	[0053.692] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned="J0152600.WMF"
	[0053.692] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.692] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.692] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.692] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.692] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0152602.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF"
	[0053.692] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe9261f7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe9261f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe9261f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x40f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152606.WMF", cAlternateFileName="")) returned 1
	[0053.692] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.693] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0152606.WMF") returned -1
	[0053.693] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0152606.WMF") returned -1
	[0053.693] lstrcmpiA (lpString1="", lpString2="J0152606.WMF") returned -1
	[0053.693] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned="J0152602.WMF"
	[0053.693] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.693] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.693] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.693] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.693] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0152606.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF"
	[0053.693] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe9261f7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe9261f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe9261f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3094, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152608.WMF", cAlternateFileName="")) returned 1
	[0053.693] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.693] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0152608.WMF") returned -1
	[0053.693] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0152608.WMF") returned -1
	[0053.693] lstrcmpiA (lpString1="", lpString2="J0152608.WMF") returned -1
	[0053.693] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned="J0152606.WMF"
	[0053.693] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.693] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.693] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.693] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.693] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0152608.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF"
	[0053.693] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe8fff80, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe8fff80, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe9261f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1748, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152610.WMF", cAlternateFileName="")) returned 1
	[0053.693] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.693] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0152610.WMF") returned -1
	[0053.693] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0152610.WMF") returned -1
	[0053.693] lstrcmpiA (lpString1="", lpString2="J0152610.WMF") returned -1
	[0053.693] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned="J0152608.WMF"
	[0053.694] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.694] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.694] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.694] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.694] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0152610.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF"
	[0053.694] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe88d87c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe88d87c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe8b3ab6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2584, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152622.WMF", cAlternateFileName="")) returned 1
	[0053.694] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.694] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0152622.WMF") returned -1
	[0053.694] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0152622.WMF") returned -1
	[0053.694] lstrcmpiA (lpString1="", lpString2="J0152622.WMF") returned -1
	[0053.694] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned="J0152610.WMF"
	[0053.694] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.694] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.694] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.694] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.694] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0152622.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF"
	[0053.694] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe8fff80, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe8fff80, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe9261f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6688, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152626.WMF", cAlternateFileName="")) returned 1
	[0053.694] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.694] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0152626.WMF") returned -1
	[0053.694] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0152626.WMF") returned -1
	[0053.694] lstrcmpiA (lpString1="", lpString2="J0152626.WMF") returned -1
	[0053.694] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned="J0152622.WMF"
	[0053.694] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.694] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.695] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.695] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.695] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0152626.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF"
	[0053.695] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe8d9e20, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe8d9e20, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe9261f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x785c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152628.WMF", cAlternateFileName="")) returned 1
	[0053.695] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.695] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0152628.WMF") returned -1
	[0053.695] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0152628.WMF") returned -1
	[0053.695] lstrcmpiA (lpString1="", lpString2="J0152628.WMF") returned -1
	[0053.695] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned="J0152626.WMF"
	[0053.695] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.695] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.695] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.695] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.695] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0152628.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF"
	[0053.695] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe8b3ab6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe8b3ab6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe8fff80, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8774, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152688.WMF", cAlternateFileName="")) returned 1
	[0053.695] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.695] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0152688.WMF") returned -1
	[0053.695] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0152688.WMF") returned -1
	[0053.695] lstrcmpiA (lpString1="", lpString2="J0152688.WMF") returned -1
	[0053.695] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned="J0152628.WMF"
	[0053.695] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.695] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.695] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.695] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.696] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0152688.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF"
	[0053.696] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe88d87c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe88d87c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe8fff80, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152690.WMF", cAlternateFileName="")) returned 1
	[0053.696] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.696] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0152690.WMF") returned -1
	[0053.696] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0152690.WMF") returned -1
	[0053.696] lstrcmpiA (lpString1="", lpString2="J0152690.WMF") returned -1
	[0053.696] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned="J0152688.WMF"
	[0053.696] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.696] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.696] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.696] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.696] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0152690.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF"
	[0053.696] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xea574b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xea574b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xea574b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x544, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152694.WMF", cAlternateFileName="")) returned 1
	[0053.696] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.696] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0152694.WMF") returned -1
	[0053.696] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0152694.WMF") returned -1
	[0053.696] lstrcmpiA (lpString1="", lpString2="J0152694.WMF") returned -1
	[0053.696] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned="J0152690.WMF"
	[0053.696] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.696] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.696] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.696] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.696] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0152694.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF"
	[0053.697] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xea574b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xea574b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xea574b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c98, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152696.WMF", cAlternateFileName="")) returned 1
	[0053.697] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.697] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0152696.WMF") returned -1
	[0053.697] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0152696.WMF") returned -1
	[0053.697] lstrcmpiA (lpString1="", lpString2="J0152696.WMF") returned -1
	[0053.697] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned="J0152694.WMF"
	[0053.697] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.697] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.697] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.697] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.697] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0152696.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF"
	[0053.697] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xea312e2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xea312e2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xea574b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152698.WMF", cAlternateFileName="")) returned 1
	[0053.697] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.697] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0152698.WMF") returned -1
	[0053.697] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0152698.WMF") returned -1
	[0053.697] lstrcmpiA (lpString1="", lpString2="J0152698.WMF") returned -1
	[0053.697] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned="J0152696.WMF"
	[0053.697] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.697] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.697] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.697] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.697] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0152698.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF"
	[0053.697] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe9e4dce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe9e4dce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xea574b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152702.WMF", cAlternateFileName="")) returned 1
	[0053.697] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.697] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0152702.WMF") returned -1
	[0053.697] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0152702.WMF") returned -1
	[0053.698] lstrcmpiA (lpString1="", lpString2="J0152702.WMF") returned -1
	[0053.698] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned="J0152698.WMF"
	[0053.698] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.698] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.698] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.698] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.698] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0152702.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF"
	[0053.698] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe9726d1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe9726d1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xea574b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x674, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152704.WMF", cAlternateFileName="")) returned 1
	[0053.698] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.698] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0152704.WMF") returned -1
	[0053.698] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0152704.WMF") returned -1
	[0053.698] lstrcmpiA (lpString1="", lpString2="J0152704.WMF") returned -1
	[0053.698] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned="J0152702.WMF"
	[0053.698] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.698] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.698] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.698] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.698] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0152704.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF"
	[0053.698] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe9261f7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe9261f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe9726d1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x132c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152708.WMF", cAlternateFileName="")) returned 1
	[0053.699] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.699] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0152708.WMF") returned -1
	[0053.699] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0152708.WMF") returned -1
	[0053.699] lstrcmpiA (lpString1="", lpString2="J0152708.WMF") returned -1
	[0053.699] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned="J0152704.WMF"
	[0053.699] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.700] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.700] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.700] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.700] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0152708.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF"
	[0053.700] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe998993, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe998993, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xea574b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152716.WMF", cAlternateFileName="")) returned 1
	[0053.700] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.700] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0152716.WMF") returned -1
	[0053.700] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0152716.WMF") returned -1
	[0053.700] lstrcmpiA (lpString1="", lpString2="J0152716.WMF") returned -1
	[0053.700] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned="J0152708.WMF"
	[0053.700] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.700] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.700] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.700] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.700] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0152716.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF"
	[0053.700] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe94c4b9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe94c4b9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe998993, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1b6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152722.WMF", cAlternateFileName="")) returned 1
	[0053.700] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.700] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0152722.WMF") returned -1
	[0053.700] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0152722.WMF") returned -1
	[0053.700] lstrcmpiA (lpString1="", lpString2="J0152722.WMF") returned -1
	[0053.700] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned="J0152716.WMF"
	[0053.700] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.701] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.701] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.701] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.701] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0152722.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF"
	[0053.701] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe9261f7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe9261f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe9e4dce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1ec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152876.WMF", cAlternateFileName="")) returned 1
	[0053.701] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.701] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0152876.WMF") returned -1
	[0053.701] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0152876.WMF") returned -1
	[0053.701] lstrcmpiA (lpString1="", lpString2="J0152876.WMF") returned -1
	[0053.701] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned="J0152722.WMF"
	[0053.701] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.701] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.701] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.701] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.701] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0152876.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF"
	[0053.701] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe9261f7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe9261f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe94c4b9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3a28, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152878.WMF", cAlternateFileName="")) returned 1
	[0053.701] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.701] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0152878.WMF") returned -1
	[0053.701] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0152878.WMF") returned -1
	[0053.701] lstrcmpiA (lpString1="", lpString2="J0152878.WMF") returned -1
	[0053.701] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned="J0152876.WMF"
	[0053.701] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.701] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.701] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.701] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.702] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0152878.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF"
	[0053.702] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xea574b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xea574b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xea574b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2370, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152882.WMF", cAlternateFileName="")) returned 1
	[0053.702] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.702] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0152882.WMF") returned -1
	[0053.702] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0152882.WMF") returned -1
	[0053.702] lstrcmpiA (lpString1="", lpString2="J0152882.WMF") returned -1
	[0053.702] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned="J0152878.WMF"
	[0053.702] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.702] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.702] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.702] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.702] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0152882.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF"
	[0053.702] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xea574b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xea574b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xea574b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1b2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152884.WMF", cAlternateFileName="")) returned 1
	[0053.702] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.702] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0152884.WMF") returned -1
	[0053.702] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0152884.WMF") returned -1
	[0053.702] lstrcmpiA (lpString1="", lpString2="J0152884.WMF") returned -1
	[0053.702] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned="J0152882.WMF"
	[0053.702] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.702] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.702] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.702] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.702] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0152884.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF"
	[0053.703] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xea574b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xea574b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xea574b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x794, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152890.WMF", cAlternateFileName="")) returned 1
	[0053.703] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.703] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0152890.WMF") returned -1
	[0053.703] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0152890.WMF") returned -1
	[0053.703] lstrcmpiA (lpString1="", lpString2="J0152890.WMF") returned -1
	[0053.703] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned="J0152884.WMF"
	[0053.703] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.703] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.703] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.703] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.703] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0152890.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF"
	[0053.703] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xea574b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xea574b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xea574b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x29ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152892.WMF", cAlternateFileName="")) returned 1
	[0053.703] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.703] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0152892.WMF") returned -1
	[0053.703] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0152892.WMF") returned -1
	[0053.703] lstrcmpiA (lpString1="", lpString2="J0152892.WMF") returned -1
	[0053.703] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned="J0152890.WMF"
	[0053.703] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.703] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.703] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.703] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.703] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0152892.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF"
	[0053.703] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xea574b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xea574b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xea574b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2c54, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152894.WMF", cAlternateFileName="")) returned 1
	[0053.703] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.704] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0152894.WMF") returned -1
	[0053.704] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0152894.WMF") returned -1
	[0053.704] lstrcmpiA (lpString1="", lpString2="J0152894.WMF") returned -1
	[0053.704] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned="J0152892.WMF"
	[0053.704] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.704] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.704] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.704] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.704] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0152894.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF"
	[0053.704] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xea574b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xea574b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xea574b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1190, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152898.WMF", cAlternateFileName="")) returned 1
	[0053.704] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.704] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0152898.WMF") returned -1
	[0053.704] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0152898.WMF") returned -1
	[0053.704] lstrcmpiA (lpString1="", lpString2="J0152898.WMF") returned -1
	[0053.704] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned="J0152894.WMF"
	[0053.704] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.704] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.704] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.704] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.704] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0152898.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF"
	[0053.704] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xea574b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xea574b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xea574b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x812c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153047.WMF", cAlternateFileName="")) returned 1
	[0053.704] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.704] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0153047.WMF") returned -1
	[0053.704] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0153047.WMF") returned -1
	[0053.704] lstrcmpiA (lpString1="", lpString2="J0153047.WMF") returned -1
	[0053.704] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned="J0152898.WMF"
	[0053.705] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.705] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.705] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.705] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.705] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0153047.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF"
	[0053.705] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xea574b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xea574b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xea574b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x778, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153087.WMF", cAlternateFileName="")) returned 1
	[0053.705] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.705] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0153087.WMF") returned -1
	[0053.705] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0153087.WMF") returned -1
	[0053.705] lstrcmpiA (lpString1="", lpString2="J0153087.WMF") returned -1
	[0053.705] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned="J0153047.WMF"
	[0053.705] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.705] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.705] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.705] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.705] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0153087.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF"
	[0053.705] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xea574b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xea574b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xea574b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1ea8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153089.WMF", cAlternateFileName="")) returned 1
	[0053.705] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.705] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0153089.WMF") returned -1
	[0053.705] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0153089.WMF") returned -1
	[0053.705] lstrcmpiA (lpString1="", lpString2="J0153089.WMF") returned -1
	[0053.705] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned="J0153087.WMF"
	[0053.705] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.705] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.705] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.706] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.706] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0153089.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF"
	[0053.706] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xea574b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xea574b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xea574b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153091.WMF", cAlternateFileName="")) returned 1
	[0053.706] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.706] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0153091.WMF") returned -1
	[0053.706] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0153091.WMF") returned -1
	[0053.706] lstrcmpiA (lpString1="", lpString2="J0153091.WMF") returned -1
	[0053.706] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned="J0153089.WMF"
	[0053.706] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.706] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.706] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.706] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.706] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0153091.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF"
	[0053.706] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xea7d707, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xea7d707, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xea7d707, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x22b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153093.WMF", cAlternateFileName="")) returned 1
	[0053.706] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.706] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0153093.WMF") returned -1
	[0053.706] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0153093.WMF") returned -1
	[0053.706] lstrcmpiA (lpString1="", lpString2="J0153093.WMF") returned -1
	[0053.706] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned="J0153091.WMF"
	[0053.706] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.706] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.706] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.706] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.706] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0153093.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF"
	[0053.707] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xea7d707, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xea7d707, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xea7d707, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe78, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153095.WMF", cAlternateFileName="")) returned 1
	[0053.707] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.707] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0153095.WMF") returned -1
	[0053.707] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0153095.WMF") returned -1
	[0053.707] lstrcmpiA (lpString1="", lpString2="J0153095.WMF") returned -1
	[0053.707] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned="J0153093.WMF"
	[0053.707] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.707] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.707] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.707] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.707] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0153095.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF"
	[0053.707] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xea7d707, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xea7d707, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xea7d707, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153265.WMF", cAlternateFileName="")) returned 1
	[0053.707] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.707] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0153265.WMF") returned -1
	[0053.707] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0153265.WMF") returned -1
	[0053.707] lstrcmpiA (lpString1="", lpString2="J0153265.WMF") returned -1
	[0053.707] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned="J0153095.WMF"
	[0053.707] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.707] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.707] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.707] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.707] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0153265.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF"
	[0053.707] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xea574b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xea574b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xea7d707, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4e80, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153273.WMF", cAlternateFileName="")) returned 1
	[0053.708] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.708] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0153273.WMF") returned -1
	[0053.708] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0153273.WMF") returned -1
	[0053.708] lstrcmpiA (lpString1="", lpString2="J0153273.WMF") returned -1
	[0053.708] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned="J0153265.WMF"
	[0053.708] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.708] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.708] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.708] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.708] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0153273.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF"
	[0053.708] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xea574b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xea574b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xea7d707, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8f0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153299.WMF", cAlternateFileName="")) returned 1
	[0053.708] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.708] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0153299.WMF") returned -1
	[0053.708] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0153299.WMF") returned -1
	[0053.708] lstrcmpiA (lpString1="", lpString2="J0153299.WMF") returned -1
	[0053.708] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF") returned="J0153273.WMF"
	[0053.708] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.708] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.708] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.708] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.708] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0153299.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF"
	[0053.708] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xea574b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xea574b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xea574b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7850, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153302.WMF", cAlternateFileName="")) returned 1
	[0053.708] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.708] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0153302.WMF") returned -1
	[0053.708] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0153302.WMF") returned -1
	[0053.708] lstrcmpiA (lpString1="", lpString2="J0153302.WMF") returned -1
	[0053.709] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned="J0153299.WMF"
	[0053.709] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.709] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.709] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.709] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.709] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0153302.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF"
	[0053.709] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xea574b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xea574b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xea7d707, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9658, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153305.WMF", cAlternateFileName="")) returned 1
	[0053.709] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.709] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0153305.WMF") returned -1
	[0053.709] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0153305.WMF") returned -1
	[0053.709] lstrcmpiA (lpString1="", lpString2="J0153305.WMF") returned -1
	[0053.709] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned="J0153302.WMF"
	[0053.709] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.709] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.709] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.709] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.709] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0153305.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF"
	[0053.709] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xea574b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xea574b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xea7d707, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153307.WMF", cAlternateFileName="")) returned 1
	[0053.709] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.709] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0153307.WMF") returned -1
	[0053.709] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0153307.WMF") returned -1
	[0053.709] lstrcmpiA (lpString1="", lpString2="J0153307.WMF") returned -1
	[0053.709] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned="J0153305.WMF"
	[0053.709] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.709] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.710] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.710] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.710] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0153307.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF"
	[0053.710] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xea574b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xea574b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xea574b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4238, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153313.WMF", cAlternateFileName="")) returned 1
	[0053.710] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.710] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0153313.WMF") returned -1
	[0053.710] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0153313.WMF") returned -1
	[0053.710] lstrcmpiA (lpString1="", lpString2="J0153313.WMF") returned -1
	[0053.710] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF") returned="J0153307.WMF"
	[0053.710] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.710] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.710] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.710] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.710] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0153313.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF"
	[0053.710] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xea574b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xea574b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xea7d707, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4464, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153398.WMF", cAlternateFileName="")) returned 1
	[0053.710] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.710] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0153398.WMF") returned -1
	[0053.710] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0153398.WMF") returned -1
	[0053.710] lstrcmpiA (lpString1="", lpString2="J0153398.WMF") returned -1
	[0053.710] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned="J0153313.WMF"
	[0053.710] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.710] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.710] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.710] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.711] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0153398.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF"
	[0053.711] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xea7d707, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xea7d707, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeaa396f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x85d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153508.WMF", cAlternateFileName="")) returned 1
	[0053.711] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.711] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0153508.WMF") returned -1
	[0053.711] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0153508.WMF") returned -1
	[0053.711] lstrcmpiA (lpString1="", lpString2="J0153508.WMF") returned -1
	[0053.711] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned="J0153398.WMF"
	[0053.711] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.711] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.711] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.711] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.711] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0153508.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF"
	[0053.711] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xea7d707, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xea7d707, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xea7d707, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x31d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153514.WMF", cAlternateFileName="")) returned 1
	[0053.711] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.711] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0153514.WMF") returned -1
	[0053.711] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0153514.WMF") returned -1
	[0053.711] lstrcmpiA (lpString1="", lpString2="J0153514.WMF") returned -1
	[0053.711] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned="J0153508.WMF"
	[0053.711] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.711] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.711] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.711] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.711] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0153514.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF"
	[0053.711] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xea7d707, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xea7d707, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xea7d707, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1d08, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153516.WMF", cAlternateFileName="")) returned 1
	[0053.712] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.712] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0153516.WMF") returned -1
	[0053.712] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0153516.WMF") returned -1
	[0053.712] lstrcmpiA (lpString1="", lpString2="J0153516.WMF") returned -1
	[0053.712] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF") returned="J0153514.WMF"
	[0053.712] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.712] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.712] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.712] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.712] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0153516.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF"
	[0053.712] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xea7d707, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xea7d707, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xea7d707, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x30f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153518.WMF", cAlternateFileName="")) returned 1
	[0053.712] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.712] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0153518.WMF") returned -1
	[0053.712] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0153518.WMF") returned -1
	[0053.712] lstrcmpiA (lpString1="", lpString2="J0153518.WMF") returned -1
	[0053.712] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned="J0153516.WMF"
	[0053.712] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.712] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.712] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.712] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.712] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0153518.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF"
	[0053.712] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xea7d707, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xea7d707, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xea7d707, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x560, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0156537.WMF", cAlternateFileName="")) returned 1
	[0053.712] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.712] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0156537.WMF") returned -1
	[0053.713] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0156537.WMF") returned -1
	[0053.713] lstrcmpiA (lpString1="", lpString2="J0156537.WMF") returned -1
	[0053.713] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned="J0153518.WMF"
	[0053.713] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.713] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.713] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.713] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.713] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0156537.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF"
	[0053.713] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xea7d707, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xea7d707, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xea7d707, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb66e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0157167.WMF", cAlternateFileName="")) returned 1
	[0053.713] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.713] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0157167.WMF") returned -1
	[0053.713] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0157167.WMF") returned -1
	[0053.713] lstrcmpiA (lpString1="", lpString2="J0157167.WMF") returned -1
	[0053.713] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned="J0156537.WMF"
	[0053.713] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.713] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.713] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.713] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.713] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0157167.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF"
	[0053.713] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xea7d707, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xea7d707, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xea7d707, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x54d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0157177.WMF", cAlternateFileName="")) returned 1
	[0053.713] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.713] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0157177.WMF") returned -1
	[0053.713] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0157177.WMF") returned -1
	[0053.713] lstrcmpiA (lpString1="", lpString2="J0157177.WMF") returned -1
	[0053.714] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF") returned="J0157167.WMF"
	[0053.714] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.714] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.714] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.714] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.714] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0157177.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF"
	[0053.714] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xea7d707, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xea7d707, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xea7d707, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x45f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0157191.WMF", cAlternateFileName="")) returned 1
	[0053.714] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.714] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0157191.WMF") returned -1
	[0053.714] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0157191.WMF") returned -1
	[0053.714] lstrcmpiA (lpString1="", lpString2="J0157191.WMF") returned -1
	[0053.714] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned="J0157177.WMF"
	[0053.714] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.714] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.714] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.714] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.714] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0157191.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF"
	[0053.714] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xea7d707, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xea7d707, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xea7d707, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2c84, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0157831.WMF", cAlternateFileName="")) returned 1
	[0053.714] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.714] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0157831.WMF") returned -1
	[0053.714] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0157831.WMF") returned -1
	[0053.714] lstrcmpiA (lpString1="", lpString2="J0157831.WMF") returned -1
	[0053.714] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned="J0157191.WMF"
	[0053.714] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.715] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.715] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.715] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.715] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0157831.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF"
	[0053.715] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xea7d707, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xea7d707, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xea7d707, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x48dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0158071.WMF", cAlternateFileName="")) returned 1
	[0053.719] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.719] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0158071.WMF") returned -1
	[0053.719] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0158071.WMF") returned -1
	[0053.719] lstrcmpiA (lpString1="", lpString2="J0158071.WMF") returned -1
	[0053.719] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned="J0157831.WMF"
	[0053.719] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.719] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.719] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.719] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.719] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0158071.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF"
	[0053.719] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeac9c22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeac9c22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeac9c22, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x462e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0158477.WMF", cAlternateFileName="")) returned 1
	[0053.719] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.719] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0158477.WMF") returned -1
	[0053.719] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0158477.WMF") returned -1
	[0053.719] lstrcmpiA (lpString1="", lpString2="J0158477.WMF") returned -1
	[0053.719] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF") returned="J0158071.WMF"
	[0053.719] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.719] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.719] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.719] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.719] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0158477.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF"
	[0053.719] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeac9c22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeac9c22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeac9c22, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x72de, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0160590.WMF", cAlternateFileName="")) returned 1
	[0053.720] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.720] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0160590.WMF") returned -1
	[0053.720] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0160590.WMF") returned -1
	[0053.720] lstrcmpiA (lpString1="", lpString2="J0160590.WMF") returned -1
	[0053.720] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned="J0158477.WMF"
	[0053.720] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.720] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.720] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.720] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.720] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0160590.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF"
	[0053.720] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeac9c22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeac9c22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeac9c22, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb594, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0164153.JPG", cAlternateFileName="")) returned 1
	[0053.720] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.720] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0164153.JPG") returned -1
	[0053.720] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0164153.JPG") returned -1
	[0053.720] lstrcmpiA (lpString1="", lpString2="J0164153.JPG") returned -1
	[0053.720] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned="J0160590.WMF"
	[0053.720] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.720] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.720] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.720] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.720] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0164153.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG"
	[0053.720] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG"
	[0053.720] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG"
	[0053.720] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG."
	[0053.720] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG.exe"
	[0053.721] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0053.847] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb594
	[0053.847] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xeac9c22, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xeac9c22, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xeac9c22, dwHighDateTime=0x1d327e8)) returned 1
	[0053.847] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.847] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xb552, lpOverlapped=0x0) returned 1
	[0053.849] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned="J0164153.JPG"
	[0053.849] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.849] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xb552, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xb552, lpOverlapped=0x0) returned 1
	[0053.849] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.849] CloseHandle (hObject=0x214) returned 1
	[0053.851] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg.exe")) returned 1
	[0053.852] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeaa396f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeaa396f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeac9c22, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x51aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0168644.WMF", cAlternateFileName="")) returned 1
	[0053.852] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.852] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0168644.WMF") returned -1
	[0053.852] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0168644.WMF") returned -1
	[0053.852] lstrcmpiA (lpString1="", lpString2="J0168644.WMF") returned -1
	[0053.852] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned="J0164153.JPG"
	[0053.852] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.852] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.852] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.852] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.852] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0168644.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF"
	[0053.852] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.zip") returned 0
	[0053.852] lstrlenA (lpString="*.zip") returned 5
	[0053.852] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.rar") returned 0
	[0053.852] lstrlenA (lpString="*.rar") returned 5
	[0053.852] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.7z") returned 0
	[0053.852] lstrlenA (lpString="*.7z") returned 4
	[0053.852] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.tar") returned 0
	[0053.852] lstrlenA (lpString="*.tar") returned 5
	[0053.852] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.gzip") returned 0
	[0053.852] lstrlenA (lpString="*.gzip") returned 6
	[0053.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.jpg") returned 0
	[0053.853] lstrlenA (lpString="*.jpg") returned 5
	[0053.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.jpeg") returned 0
	[0053.853] lstrlenA (lpString="*.jpeg") returned 6
	[0053.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.bmp") returned 0
	[0053.853] lstrlenA (lpString="*.bmp") returned 5
	[0053.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.gif") returned 0
	[0053.853] lstrlenA (lpString="*.gif") returned 5
	[0053.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.png") returned 0
	[0053.853] lstrlenA (lpString="*.png") returned 5
	[0053.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.doc") returned 0
	[0053.853] lstrlenA (lpString="*.doc") returned 5
	[0053.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.docx") returned 0
	[0053.853] lstrlenA (lpString="*.docx") returned 6
	[0053.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.xls") returned 0
	[0053.853] lstrlenA (lpString="*.xls") returned 5
	[0053.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.xlsx") returned 0
	[0053.853] lstrlenA (lpString="*.xlsx") returned 6
	[0053.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.ppt") returned 0
	[0053.853] lstrlenA (lpString="*.ppt") returned 5
	[0053.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.pptx") returned 0
	[0053.853] lstrlenA (lpString="*.pptx") returned 6
	[0053.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.txt") returned 0
	[0053.853] lstrlenA (lpString="*.txt") returned 5
	[0053.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.pdf") returned 0
	[0053.853] lstrlenA (lpString="*.pdf") returned 5
	[0053.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.htm") returned 0
	[0053.853] lstrlenA (lpString="*.htm") returned 5
	[0053.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.html") returned 0
	[0053.853] lstrlenA (lpString="*.html") returned 6
	[0053.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.mdb") returned 0
	[0053.853] lstrlenA (lpString="*.mdb") returned 5
	[0053.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.pfx") returned 0
	[0053.853] lstrlenA (lpString="*.pfx") returned 5
	[0053.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.md") returned 0
	[0053.854] lstrlenA (lpString="*.md") returned 4
	[0053.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.lnk") returned 0
	[0053.854] lstrlenA (lpString="*.lnk") returned 5
	[0053.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.torrent") returned 0
	[0053.854] lstrlenA (lpString="*.torrent") returned 9
	[0053.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.mov") returned 0
	[0053.854] lstrlenA (lpString="*.mov") returned 5
	[0053.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.3gp") returned 0
	[0053.854] lstrlenA (lpString="*.3gp") returned 5
	[0053.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.mpeg") returned 0
	[0053.854] lstrlenA (lpString="*.mpeg") returned 6
	[0053.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.mpg") returned 0
	[0053.854] lstrlenA (lpString="*.mpg") returned 5
	[0053.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.flv") returned 0
	[0053.854] lstrlenA (lpString="*.flv") returned 5
	[0053.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.avi") returned 0
	[0053.854] lstrlenA (lpString="*.avi") returned 5
	[0053.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.mp4") returned 0
	[0053.854] lstrlenA (lpString="*.mp4") returned 5
	[0053.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.wmv") returned 0
	[0053.854] lstrlenA (lpString="*.wmv") returned 5
	[0053.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.mkv") returned 0
	[0053.854] lstrlenA (lpString="*.mkv") returned 5
	[0053.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.mp3") returned 0
	[0053.854] lstrlenA (lpString="*.mp3") returned 5
	[0053.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.wav") returned 0
	[0053.854] lstrlenA (lpString="*.wav") returned 5
	[0053.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.flac") returned 0
	[0053.854] lstrlenA (lpString="*.flac") returned 6
	[0053.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.wma") returned 0
	[0053.854] lstrlenA (lpString="*.wma") returned 5
	[0053.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.au3") returned 0
	[0053.854] lstrlenA (lpString="*.au3") returned 5
	[0053.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.ahk") returned 0
	[0053.855] lstrlenA (lpString="*.ahk") returned 5
	[0053.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.c") returned 0
	[0053.855] lstrlenA (lpString="*.c") returned 3
	[0053.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.cc") returned 0
	[0053.855] lstrlenA (lpString="*.cc") returned 4
	[0053.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.cpp") returned 0
	[0053.855] lstrlenA (lpString="*.cpp") returned 5
	[0053.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.cxx") returned 0
	[0053.855] lstrlenA (lpString="*.cxx") returned 5
	[0053.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.c++") returned 0
	[0053.855] lstrlenA (lpString="*.c++") returned 5
	[0053.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.cs") returned 0
	[0053.855] lstrlenA (lpString="*.cs") returned 4
	[0053.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.vb") returned 0
	[0053.855] lstrlenA (lpString="*.vb") returned 4
	[0053.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.bas") returned 0
	[0053.855] lstrlenA (lpString="*.bas") returned 5
	[0053.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.csproj") returned 0
	[0053.855] lstrlenA (lpString="*.csproj") returned 8
	[0053.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.vbproj") returned 0
	[0053.855] lstrlenA (lpString="*.vbproj") returned 8
	[0053.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.vcxproj") returned 0
	[0053.855] lstrlenA (lpString="*.vcxproj") returned 9
	[0053.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.manifest") returned 0
	[0053.855] lstrlenA (lpString="*.manifest") returned 10
	[0053.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.php") returned 0
	[0053.855] lstrlenA (lpString="*.php") returned 5
	[0053.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.vbe") returned 0
	[0053.855] lstrlenA (lpString="*.vbe") returned 5
	[0053.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.vba") returned 0
	[0053.855] lstrlenA (lpString="*.vba") returned 5
	[0053.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.vbs") returned 0
	[0053.855] lstrlenA (lpString="*.vbs") returned 5
	[0053.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.bat") returned 0
	[0053.856] lstrlenA (lpString="*.bat") returned 5
	[0053.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.cmd") returned 0
	[0053.856] lstrlenA (lpString="*.cmd") returned 5
	[0053.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.js") returned 0
	[0053.856] lstrlenA (lpString="*.js") returned 4
	[0053.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.jscript") returned 0
	[0053.856] lstrlenA (lpString="*.jscript") returned 9
	[0053.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.hta") returned 0
	[0053.856] lstrlenA (lpString="*.hta") returned 5
	[0053.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.php7") returned 0
	[0053.856] lstrlenA (lpString="*.php7") returned 6
	[0053.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.db") returned 0
	[0053.856] lstrlenA (lpString="*.db") returned 4
	[0053.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.swf") returned 0
	[0053.856] lstrlenA (lpString="*.swf") returned 5
	[0053.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.eml") returned 0
	[0053.856] lstrlenA (lpString="*.eml") returned 5
	[0053.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.part") returned 0
	[0053.856] lstrlenA (lpString="*.part") returned 6
	[0053.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.nfo") returned 0
	[0053.857] lstrlenA (lpString="*.nfo") returned 5
	[0053.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.rsa") returned 0
	[0053.857] lstrlenA (lpString="*.rsa") returned 5
	[0053.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.key") returned 0
	[0053.857] lstrlenA (lpString="*.key") returned 5
	[0053.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.aes") returned 0
	[0053.857] lstrlenA (lpString="*.aes") returned 5
	[0053.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.blob") returned 0
	[0053.857] lstrlenA (lpString="*.blob") returned 6
	[0053.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.btc") returned 0
	[0053.857] lstrlenA (lpString="*.btc") returned 5
	[0053.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF", pszSpec="*.wallet") returned 0
	[0053.857] lstrlenA (lpString="*.wallet") returned 8
	[0053.857] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xea7d707, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xea7d707, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeac9c22, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3888, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0171685.WMF", cAlternateFileName="")) returned 1
	[0053.857] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.857] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0171685.WMF") returned -1
	[0053.857] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0171685.WMF") returned -1
	[0053.857] lstrcmpiA (lpString1="", lpString2="J0171685.WMF") returned -1
	[0053.857] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned="J0168644.WMF"
	[0053.857] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.857] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.857] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.857] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.857] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0171685.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF"
	[0053.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.zip") returned 0
	[0053.857] lstrlenA (lpString="*.zip") returned 5
	[0053.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.rar") returned 0
	[0053.857] lstrlenA (lpString="*.rar") returned 5
	[0053.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.7z") returned 0
	[0053.858] lstrlenA (lpString="*.7z") returned 4
	[0053.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.tar") returned 0
	[0053.858] lstrlenA (lpString="*.tar") returned 5
	[0053.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.gzip") returned 0
	[0053.858] lstrlenA (lpString="*.gzip") returned 6
	[0053.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.jpg") returned 0
	[0053.858] lstrlenA (lpString="*.jpg") returned 5
	[0053.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.jpeg") returned 0
	[0053.858] lstrlenA (lpString="*.jpeg") returned 6
	[0053.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.bmp") returned 0
	[0053.858] lstrlenA (lpString="*.bmp") returned 5
	[0053.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.gif") returned 0
	[0053.858] lstrlenA (lpString="*.gif") returned 5
	[0053.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.png") returned 0
	[0053.858] lstrlenA (lpString="*.png") returned 5
	[0053.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.doc") returned 0
	[0053.858] lstrlenA (lpString="*.doc") returned 5
	[0053.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.docx") returned 0
	[0053.858] lstrlenA (lpString="*.docx") returned 6
	[0053.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.xls") returned 0
	[0053.858] lstrlenA (lpString="*.xls") returned 5
	[0053.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.xlsx") returned 0
	[0053.858] lstrlenA (lpString="*.xlsx") returned 6
	[0053.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.ppt") returned 0
	[0053.858] lstrlenA (lpString="*.ppt") returned 5
	[0053.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.pptx") returned 0
	[0053.858] lstrlenA (lpString="*.pptx") returned 6
	[0053.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.txt") returned 0
	[0053.858] lstrlenA (lpString="*.txt") returned 5
	[0053.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.pdf") returned 0
	[0053.858] lstrlenA (lpString="*.pdf") returned 5
	[0053.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.htm") returned 0
	[0053.858] lstrlenA (lpString="*.htm") returned 5
	[0053.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.html") returned 0
	[0053.859] lstrlenA (lpString="*.html") returned 6
	[0053.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.mdb") returned 0
	[0053.859] lstrlenA (lpString="*.mdb") returned 5
	[0053.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.pfx") returned 0
	[0053.859] lstrlenA (lpString="*.pfx") returned 5
	[0053.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.md") returned 0
	[0053.859] lstrlenA (lpString="*.md") returned 4
	[0053.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.lnk") returned 0
	[0053.859] lstrlenA (lpString="*.lnk") returned 5
	[0053.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.torrent") returned 0
	[0053.859] lstrlenA (lpString="*.torrent") returned 9
	[0053.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.mov") returned 0
	[0053.859] lstrlenA (lpString="*.mov") returned 5
	[0053.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.3gp") returned 0
	[0053.859] lstrlenA (lpString="*.3gp") returned 5
	[0053.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.mpeg") returned 0
	[0053.859] lstrlenA (lpString="*.mpeg") returned 6
	[0053.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.mpg") returned 0
	[0053.859] lstrlenA (lpString="*.mpg") returned 5
	[0053.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.flv") returned 0
	[0053.859] lstrlenA (lpString="*.flv") returned 5
	[0053.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.avi") returned 0
	[0053.859] lstrlenA (lpString="*.avi") returned 5
	[0053.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.mp4") returned 0
	[0053.859] lstrlenA (lpString="*.mp4") returned 5
	[0053.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.wmv") returned 0
	[0053.859] lstrlenA (lpString="*.wmv") returned 5
	[0053.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.mkv") returned 0
	[0053.859] lstrlenA (lpString="*.mkv") returned 5
	[0053.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.mp3") returned 0
	[0053.859] lstrlenA (lpString="*.mp3") returned 5
	[0053.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.wav") returned 0
	[0053.859] lstrlenA (lpString="*.wav") returned 5
	[0053.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.flac") returned 0
	[0053.860] lstrlenA (lpString="*.flac") returned 6
	[0053.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.wma") returned 0
	[0053.860] lstrlenA (lpString="*.wma") returned 5
	[0053.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.au3") returned 0
	[0053.860] lstrlenA (lpString="*.au3") returned 5
	[0053.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.ahk") returned 0
	[0053.860] lstrlenA (lpString="*.ahk") returned 5
	[0053.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.c") returned 0
	[0053.860] lstrlenA (lpString="*.c") returned 3
	[0053.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.cc") returned 0
	[0053.860] lstrlenA (lpString="*.cc") returned 4
	[0053.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.cpp") returned 0
	[0053.860] lstrlenA (lpString="*.cpp") returned 5
	[0053.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.cxx") returned 0
	[0053.860] lstrlenA (lpString="*.cxx") returned 5
	[0053.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.c++") returned 0
	[0053.860] lstrlenA (lpString="*.c++") returned 5
	[0053.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.cs") returned 0
	[0053.860] lstrlenA (lpString="*.cs") returned 4
	[0053.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.vb") returned 0
	[0053.860] lstrlenA (lpString="*.vb") returned 4
	[0053.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.bas") returned 0
	[0053.860] lstrlenA (lpString="*.bas") returned 5
	[0053.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.csproj") returned 0
	[0053.860] lstrlenA (lpString="*.csproj") returned 8
	[0053.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.vbproj") returned 0
	[0053.860] lstrlenA (lpString="*.vbproj") returned 8
	[0053.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.vcxproj") returned 0
	[0053.860] lstrlenA (lpString="*.vcxproj") returned 9
	[0053.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.manifest") returned 0
	[0053.860] lstrlenA (lpString="*.manifest") returned 10
	[0053.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.php") returned 0
	[0053.860] lstrlenA (lpString="*.php") returned 5
	[0053.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.vbe") returned 0
	[0053.861] lstrlenA (lpString="*.vbe") returned 5
	[0053.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.vba") returned 0
	[0053.861] lstrlenA (lpString="*.vba") returned 5
	[0053.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.vbs") returned 0
	[0053.861] lstrlenA (lpString="*.vbs") returned 5
	[0053.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.bat") returned 0
	[0053.861] lstrlenA (lpString="*.bat") returned 5
	[0053.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.cmd") returned 0
	[0053.861] lstrlenA (lpString="*.cmd") returned 5
	[0053.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.js") returned 0
	[0053.861] lstrlenA (lpString="*.js") returned 4
	[0053.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.jscript") returned 0
	[0053.861] lstrlenA (lpString="*.jscript") returned 9
	[0053.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.hta") returned 0
	[0053.861] lstrlenA (lpString="*.hta") returned 5
	[0053.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.php7") returned 0
	[0053.861] lstrlenA (lpString="*.php7") returned 6
	[0053.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.db") returned 0
	[0053.861] lstrlenA (lpString="*.db") returned 4
	[0053.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.swf") returned 0
	[0053.861] lstrlenA (lpString="*.swf") returned 5
	[0053.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.eml") returned 0
	[0053.861] lstrlenA (lpString="*.eml") returned 5
	[0053.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.part") returned 0
	[0053.861] lstrlenA (lpString="*.part") returned 6
	[0053.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.nfo") returned 0
	[0053.861] lstrlenA (lpString="*.nfo") returned 5
	[0053.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.rsa") returned 0
	[0053.861] lstrlenA (lpString="*.rsa") returned 5
	[0053.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.key") returned 0
	[0053.861] lstrlenA (lpString="*.key") returned 5
	[0053.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.aes") returned 0
	[0053.861] lstrlenA (lpString="*.aes") returned 5
	[0053.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.blob") returned 0
	[0053.862] lstrlenA (lpString="*.blob") returned 6
	[0053.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.btc") returned 0
	[0053.862] lstrlenA (lpString="*.btc") returned 5
	[0053.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF", pszSpec="*.wallet") returned 0
	[0053.862] lstrlenA (lpString="*.wallet") returned 8
	[0053.862] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xea7d707, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xea7d707, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeaa396f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1ae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0171847.WMF", cAlternateFileName="")) returned 1
	[0053.862] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.862] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0171847.WMF") returned -1
	[0053.862] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0171847.WMF") returned -1
	[0053.862] lstrcmpiA (lpString1="", lpString2="J0171847.WMF") returned -1
	[0053.862] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF") returned="J0171685.WMF"
	[0053.862] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.862] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.862] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.862] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.862] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0171847.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF"
	[0053.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.zip") returned 0
	[0053.862] lstrlenA (lpString="*.zip") returned 5
	[0053.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.rar") returned 0
	[0053.862] lstrlenA (lpString="*.rar") returned 5
	[0053.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.7z") returned 0
	[0053.862] lstrlenA (lpString="*.7z") returned 4
	[0053.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.tar") returned 0
	[0053.862] lstrlenA (lpString="*.tar") returned 5
	[0053.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.gzip") returned 0
	[0053.862] lstrlenA (lpString="*.gzip") returned 6
	[0053.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.jpg") returned 0
	[0053.862] lstrlenA (lpString="*.jpg") returned 5
	[0053.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.jpeg") returned 0
	[0053.862] lstrlenA (lpString="*.jpeg") returned 6
	[0053.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.bmp") returned 0
	[0053.863] lstrlenA (lpString="*.bmp") returned 5
	[0053.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.gif") returned 0
	[0053.863] lstrlenA (lpString="*.gif") returned 5
	[0053.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.png") returned 0
	[0053.863] lstrlenA (lpString="*.png") returned 5
	[0053.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.doc") returned 0
	[0053.863] lstrlenA (lpString="*.doc") returned 5
	[0053.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.docx") returned 0
	[0053.863] lstrlenA (lpString="*.docx") returned 6
	[0053.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.xls") returned 0
	[0053.863] lstrlenA (lpString="*.xls") returned 5
	[0053.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.xlsx") returned 0
	[0053.863] lstrlenA (lpString="*.xlsx") returned 6
	[0053.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.ppt") returned 0
	[0053.863] lstrlenA (lpString="*.ppt") returned 5
	[0053.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.pptx") returned 0
	[0053.863] lstrlenA (lpString="*.pptx") returned 6
	[0053.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.txt") returned 0
	[0053.863] lstrlenA (lpString="*.txt") returned 5
	[0053.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.pdf") returned 0
	[0053.863] lstrlenA (lpString="*.pdf") returned 5
	[0053.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.htm") returned 0
	[0053.863] lstrlenA (lpString="*.htm") returned 5
	[0053.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.html") returned 0
	[0053.863] lstrlenA (lpString="*.html") returned 6
	[0053.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.mdb") returned 0
	[0053.863] lstrlenA (lpString="*.mdb") returned 5
	[0053.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.pfx") returned 0
	[0053.863] lstrlenA (lpString="*.pfx") returned 5
	[0053.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.md") returned 0
	[0053.863] lstrlenA (lpString="*.md") returned 4
	[0053.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.lnk") returned 0
	[0053.863] lstrlenA (lpString="*.lnk") returned 5
	[0053.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.torrent") returned 0
	[0053.864] lstrlenA (lpString="*.torrent") returned 9
	[0053.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.mov") returned 0
	[0053.864] lstrlenA (lpString="*.mov") returned 5
	[0053.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.3gp") returned 0
	[0053.864] lstrlenA (lpString="*.3gp") returned 5
	[0053.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.mpeg") returned 0
	[0053.864] lstrlenA (lpString="*.mpeg") returned 6
	[0053.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.mpg") returned 0
	[0053.864] lstrlenA (lpString="*.mpg") returned 5
	[0053.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.flv") returned 0
	[0053.864] lstrlenA (lpString="*.flv") returned 5
	[0053.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.avi") returned 0
	[0053.864] lstrlenA (lpString="*.avi") returned 5
	[0053.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.mp4") returned 0
	[0053.864] lstrlenA (lpString="*.mp4") returned 5
	[0053.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.wmv") returned 0
	[0053.864] lstrlenA (lpString="*.wmv") returned 5
	[0053.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.mkv") returned 0
	[0053.864] lstrlenA (lpString="*.mkv") returned 5
	[0053.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.mp3") returned 0
	[0053.864] lstrlenA (lpString="*.mp3") returned 5
	[0053.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.wav") returned 0
	[0053.864] lstrlenA (lpString="*.wav") returned 5
	[0053.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.flac") returned 0
	[0053.864] lstrlenA (lpString="*.flac") returned 6
	[0053.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.wma") returned 0
	[0053.864] lstrlenA (lpString="*.wma") returned 5
	[0053.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.au3") returned 0
	[0053.864] lstrlenA (lpString="*.au3") returned 5
	[0053.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.ahk") returned 0
	[0053.864] lstrlenA (lpString="*.ahk") returned 5
	[0053.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.c") returned 0
	[0053.865] lstrlenA (lpString="*.c") returned 3
	[0053.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.cc") returned 0
	[0053.865] lstrlenA (lpString="*.cc") returned 4
	[0053.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.cpp") returned 0
	[0053.865] lstrlenA (lpString="*.cpp") returned 5
	[0053.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.cxx") returned 0
	[0053.865] lstrlenA (lpString="*.cxx") returned 5
	[0053.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.c++") returned 0
	[0053.865] lstrlenA (lpString="*.c++") returned 5
	[0053.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.cs") returned 0
	[0053.865] lstrlenA (lpString="*.cs") returned 4
	[0053.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.vb") returned 0
	[0053.865] lstrlenA (lpString="*.vb") returned 4
	[0053.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.bas") returned 0
	[0053.865] lstrlenA (lpString="*.bas") returned 5
	[0053.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.csproj") returned 0
	[0053.865] lstrlenA (lpString="*.csproj") returned 8
	[0053.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.vbproj") returned 0
	[0053.865] lstrlenA (lpString="*.vbproj") returned 8
	[0053.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.vcxproj") returned 0
	[0053.865] lstrlenA (lpString="*.vcxproj") returned 9
	[0053.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.manifest") returned 0
	[0053.865] lstrlenA (lpString="*.manifest") returned 10
	[0053.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.php") returned 0
	[0053.865] lstrlenA (lpString="*.php") returned 5
	[0053.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.vbe") returned 0
	[0053.865] lstrlenA (lpString="*.vbe") returned 5
	[0053.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.vba") returned 0
	[0053.865] lstrlenA (lpString="*.vba") returned 5
	[0053.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.vbs") returned 0
	[0053.865] lstrlenA (lpString="*.vbs") returned 5
	[0053.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.bat") returned 0
	[0053.865] lstrlenA (lpString="*.bat") returned 5
	[0053.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.cmd") returned 0
	[0053.866] lstrlenA (lpString="*.cmd") returned 5
	[0053.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.js") returned 0
	[0053.866] lstrlenA (lpString="*.js") returned 4
	[0053.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.jscript") returned 0
	[0053.866] lstrlenA (lpString="*.jscript") returned 9
	[0053.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.hta") returned 0
	[0053.866] lstrlenA (lpString="*.hta") returned 5
	[0053.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.php7") returned 0
	[0053.866] lstrlenA (lpString="*.php7") returned 6
	[0053.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.db") returned 0
	[0053.866] lstrlenA (lpString="*.db") returned 4
	[0053.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.swf") returned 0
	[0053.866] lstrlenA (lpString="*.swf") returned 5
	[0053.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.eml") returned 0
	[0053.866] lstrlenA (lpString="*.eml") returned 5
	[0053.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.part") returned 0
	[0053.866] lstrlenA (lpString="*.part") returned 6
	[0053.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.nfo") returned 0
	[0053.866] lstrlenA (lpString="*.nfo") returned 5
	[0053.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.rsa") returned 0
	[0053.866] lstrlenA (lpString="*.rsa") returned 5
	[0053.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.key") returned 0
	[0053.866] lstrlenA (lpString="*.key") returned 5
	[0053.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.aes") returned 0
	[0053.866] lstrlenA (lpString="*.aes") returned 5
	[0053.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.blob") returned 0
	[0053.866] lstrlenA (lpString="*.blob") returned 6
	[0053.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.btc") returned 0
	[0053.866] lstrlenA (lpString="*.btc") returned 5
	[0053.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF", pszSpec="*.wallet") returned 0
	[0053.866] lstrlenA (lpString="*.wallet") returned 8
	[0053.866] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeaa396f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeaa396f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeac9c22, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1d18, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0172035.WMF", cAlternateFileName="")) returned 1
	[0053.866] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.867] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0172035.WMF") returned -1
	[0053.867] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0172035.WMF") returned -1
	[0053.867] lstrcmpiA (lpString1="", lpString2="J0172035.WMF") returned -1
	[0053.867] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned="J0171847.WMF"
	[0053.867] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.867] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.867] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.867] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.867] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0172035.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF"
	[0053.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.zip") returned 0
	[0053.867] lstrlenA (lpString="*.zip") returned 5
	[0053.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.rar") returned 0
	[0053.867] lstrlenA (lpString="*.rar") returned 5
	[0053.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.7z") returned 0
	[0053.867] lstrlenA (lpString="*.7z") returned 4
	[0053.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.tar") returned 0
	[0053.867] lstrlenA (lpString="*.tar") returned 5
	[0053.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.gzip") returned 0
	[0053.867] lstrlenA (lpString="*.gzip") returned 6
	[0053.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.jpg") returned 0
	[0053.867] lstrlenA (lpString="*.jpg") returned 5
	[0053.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.jpeg") returned 0
	[0053.867] lstrlenA (lpString="*.jpeg") returned 6
	[0053.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.bmp") returned 0
	[0053.867] lstrlenA (lpString="*.bmp") returned 5
	[0053.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.gif") returned 0
	[0053.867] lstrlenA (lpString="*.gif") returned 5
	[0053.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.png") returned 0
	[0053.867] lstrlenA (lpString="*.png") returned 5
	[0053.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.doc") returned 0
	[0053.867] lstrlenA (lpString="*.doc") returned 5
	[0053.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.docx") returned 0
	[0053.868] lstrlenA (lpString="*.docx") returned 6
	[0053.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.xls") returned 0
	[0053.868] lstrlenA (lpString="*.xls") returned 5
	[0053.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.xlsx") returned 0
	[0053.868] lstrlenA (lpString="*.xlsx") returned 6
	[0053.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.ppt") returned 0
	[0053.868] lstrlenA (lpString="*.ppt") returned 5
	[0053.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.pptx") returned 0
	[0053.868] lstrlenA (lpString="*.pptx") returned 6
	[0053.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.txt") returned 0
	[0053.868] lstrlenA (lpString="*.txt") returned 5
	[0053.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.pdf") returned 0
	[0053.868] lstrlenA (lpString="*.pdf") returned 5
	[0053.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.htm") returned 0
	[0053.868] lstrlenA (lpString="*.htm") returned 5
	[0053.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.html") returned 0
	[0053.868] lstrlenA (lpString="*.html") returned 6
	[0053.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.mdb") returned 0
	[0053.868] lstrlenA (lpString="*.mdb") returned 5
	[0053.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.pfx") returned 0
	[0053.868] lstrlenA (lpString="*.pfx") returned 5
	[0053.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.md") returned 0
	[0053.868] lstrlenA (lpString="*.md") returned 4
	[0053.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.lnk") returned 0
	[0053.868] lstrlenA (lpString="*.lnk") returned 5
	[0053.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.torrent") returned 0
	[0053.868] lstrlenA (lpString="*.torrent") returned 9
	[0053.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.mov") returned 0
	[0053.868] lstrlenA (lpString="*.mov") returned 5
	[0053.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.3gp") returned 0
	[0053.868] lstrlenA (lpString="*.3gp") returned 5
	[0053.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.mpeg") returned 0
	[0053.868] lstrlenA (lpString="*.mpeg") returned 6
	[0053.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.mpg") returned 0
	[0053.869] lstrlenA (lpString="*.mpg") returned 5
	[0053.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF", pszSpec="*.flv") returned 0
	[0053.869] lstrlenA (lpString="*.flv") returned 5
	[0053.869] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xea7d707, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xea7d707, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeac9c22, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1b74, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0172067.WMF", cAlternateFileName="")) returned 1
	[0053.869] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.869] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0172067.WMF") returned -1
	[0053.869] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0172067.WMF") returned -1
	[0053.869] lstrcmpiA (lpString1="", lpString2="J0172067.WMF") returned -1
	[0053.869] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned="J0172035.WMF"
	[0053.869] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.869] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.869] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.869] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.869] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0172067.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF"
	[0053.869] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xea7d707, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xea7d707, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeaa396f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3198, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0172193.WMF", cAlternateFileName="")) returned 1
	[0053.869] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.869] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0172193.WMF") returned -1
	[0053.869] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0172193.WMF") returned -1
	[0053.870] lstrcmpiA (lpString1="", lpString2="J0172193.WMF") returned -1
	[0053.870] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned="J0172067.WMF"
	[0053.870] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.870] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.870] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.870] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.870] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0172193.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF"
	[0053.870] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xea7d707, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xea7d707, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeac9c22, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x16e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0174315.WMF", cAlternateFileName="")) returned 1
	[0053.870] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.870] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0174315.WMF") returned -1
	[0053.870] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0174315.WMF") returned -1
	[0053.870] lstrcmpiA (lpString1="", lpString2="J0174315.WMF") returned -1
	[0053.870] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF") returned="J0172193.WMF"
	[0053.870] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.870] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.870] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.870] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.870] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0174315.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF"
	[0053.870] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeac9c22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeac9c22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeaefe14, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2608, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0174635.WMF", cAlternateFileName="")) returned 1
	[0053.870] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.870] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0174635.WMF") returned -1
	[0053.870] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0174635.WMF") returned -1
	[0053.870] lstrcmpiA (lpString1="", lpString2="J0174635.WMF") returned -1
	[0053.870] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned="J0174315.WMF"
	[0053.870] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.870] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.871] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.871] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.871] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0174635.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF"
	[0053.871] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeac9c22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeac9c22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeaefe14, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0174639.WMF", cAlternateFileName="")) returned 1
	[0053.871] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.871] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0174639.WMF") returned -1
	[0053.871] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0174639.WMF") returned -1
	[0053.871] lstrcmpiA (lpString1="", lpString2="J0174639.WMF") returned -1
	[0053.871] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned="J0174635.WMF"
	[0053.871] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.871] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.871] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.871] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.871] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0174639.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF"
	[0053.871] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeac9c22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeac9c22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeaefe14, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6196, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0174952.JPG", cAlternateFileName="")) returned 1
	[0053.871] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.871] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0174952.JPG") returned -1
	[0053.871] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0174952.JPG") returned -1
	[0053.871] lstrcmpiA (lpString1="", lpString2="J0174952.JPG") returned -1
	[0053.871] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned="J0174639.WMF"
	[0053.871] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.871] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.871] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.872] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.872] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0174952.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG"
	[0053.872] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG"
	[0053.872] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG"
	[0053.872] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG."
	[0053.872] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG.exe"
	[0053.872] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174952.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0053.874] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6196
	[0053.874] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xeac9c22, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xeac9c22, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xeaefe14, dwHighDateTime=0x1d327e8)) returned 1
	[0053.874] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.874] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x6154, lpOverlapped=0x0) returned 1
	[0053.876] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned="J0174952.JPG"
	[0053.876] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.876] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x6154, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x6154, lpOverlapped=0x0) returned 1
	[0053.876] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.876] CloseHandle (hObject=0x214) returned 1
	[0053.877] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174952.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174952.jpg.exe")) returned 1
	[0053.878] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeac9c22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeac9c22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeac9c22, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb57d, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0175361.JPG", cAlternateFileName="")) returned 1
	[0053.878] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.878] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0175361.JPG") returned -1
	[0053.878] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0175361.JPG") returned -1
	[0053.878] lstrcmpiA (lpString1="", lpString2="J0175361.JPG") returned -1
	[0053.878] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned="J0174952.JPG"
	[0053.878] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.878] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.878] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.878] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.878] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0175361.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG"
	[0053.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG", pszSpec="*.zip") returned 0
	[0053.878] lstrlenA (lpString="*.zip") returned 5
	[0053.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG", pszSpec="*.rar") returned 0
	[0053.878] lstrlenA (lpString="*.rar") returned 5
	[0053.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG", pszSpec="*.7z") returned 0
	[0053.879] lstrlenA (lpString="*.7z") returned 4
	[0053.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG", pszSpec="*.tar") returned 0
	[0053.879] lstrlenA (lpString="*.tar") returned 5
	[0053.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG", pszSpec="*.gzip") returned 0
	[0053.879] lstrlenA (lpString="*.gzip") returned 6
	[0053.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG", pszSpec="*.jpg") returned 1
	[0053.879] lstrlenA (lpString="*.jpg") returned 5
	[0053.879] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG"
	[0053.879] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG"
	[0053.879] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG."
	[0053.879] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG.exe"
	[0053.879] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0053.880] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb57d
	[0053.880] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xeac9c22, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xeac9c22, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xeac9c22, dwHighDateTime=0x1d327e8)) returned 1
	[0053.880] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.880] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xb53b, lpOverlapped=0x0) returned 1
	[0053.911] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned="J0175361.JPG"
	[0053.911] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.911] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xb53b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xb53b, lpOverlapped=0x0) returned 1
	[0053.911] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.912] CloseHandle (hObject=0x214) returned 1
	[0053.931] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg.exe")) returned 1
	[0053.936] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeac9c22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeac9c22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeac9c22, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x38d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0175428.JPG", cAlternateFileName="")) returned 1
	[0053.936] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.936] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0175428.JPG") returned -1
	[0053.936] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0175428.JPG") returned -1
	[0053.936] lstrcmpiA (lpString1="", lpString2="J0175428.JPG") returned -1
	[0053.937] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned="J0175361.JPG"
	[0053.937] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.937] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.937] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.937] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.937] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0175428.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG"
	[0053.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG", pszSpec="*.zip") returned 0
	[0053.937] lstrlenA (lpString="*.zip") returned 5
	[0053.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG", pszSpec="*.rar") returned 0
	[0053.937] lstrlenA (lpString="*.rar") returned 5
	[0053.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG", pszSpec="*.7z") returned 0
	[0053.937] lstrlenA (lpString="*.7z") returned 4
	[0053.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG", pszSpec="*.tar") returned 0
	[0053.937] lstrlenA (lpString="*.tar") returned 5
	[0053.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG", pszSpec="*.gzip") returned 0
	[0053.937] lstrlenA (lpString="*.gzip") returned 6
	[0053.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG", pszSpec="*.jpg") returned 1
	[0053.937] lstrlenA (lpString="*.jpg") returned 5
	[0053.937] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG"
	[0053.937] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG"
	[0053.937] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG."
	[0053.937] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0053.938] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x38d8
	[0053.938] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xeac9c22, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xeac9c22, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xeac9c22, dwHighDateTime=0x1d327e8)) returned 1
	[0053.938] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.938] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x3896, lpOverlapped=0x0) returned 1
	[0053.940] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned="J0175428.JPG"
	[0053.940] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.940] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x3896, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x3896, lpOverlapped=0x0) returned 1
	[0053.940] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.940] CloseHandle (hObject=0x214) returned 1
	[0053.941] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg.exe")) returned 1
	[0053.941] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeac9c22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeac9c22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeac9c22, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb12e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0177257.JPG", cAlternateFileName="")) returned 1
	[0053.941] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.942] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0177257.JPG") returned -1
	[0053.942] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0177257.JPG") returned -1
	[0053.942] lstrcmpiA (lpString1="", lpString2="J0177257.JPG") returned -1
	[0053.942] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned="J0175428.JPG"
	[0053.942] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.942] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.942] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.942] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0177257.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG"
	[0053.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG", pszSpec="*.zip") returned 0
	[0053.942] lstrlenA (lpString="*.zip") returned 5
	[0053.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG", pszSpec="*.rar") returned 0
	[0053.942] lstrlenA (lpString="*.rar") returned 5
	[0053.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG", pszSpec="*.7z") returned 0
	[0053.942] lstrlenA (lpString="*.7z") returned 4
	[0053.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG", pszSpec="*.tar") returned 0
	[0053.942] lstrlenA (lpString="*.tar") returned 5
	[0053.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG", pszSpec="*.gzip") returned 0
	[0053.942] lstrlenA (lpString="*.gzip") returned 6
	[0053.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG", pszSpec="*.jpg") returned 1
	[0053.942] lstrlenA (lpString="*.jpg") returned 5
	[0053.942] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG"
	[0053.942] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG"
	[0053.942] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG."
	[0053.942] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG.exe"
	[0053.942] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0053.943] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb12e
	[0053.943] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xeac9c22, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xeac9c22, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xeac9c22, dwHighDateTime=0x1d327e8)) returned 1
	[0053.943] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.943] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xb0ec, lpOverlapped=0x0) returned 1
	[0053.950] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned="J0177257.JPG"
	[0053.950] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.950] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xb0ec, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xb0ec, lpOverlapped=0x0) returned 1
	[0053.950] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.950] CloseHandle (hObject=0x214) returned 1
	[0053.952] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg.exe")) returned 1
	[0053.952] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeac9c22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeac9c22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeac9c22, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd902, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0177806.JPG", cAlternateFileName="")) returned 1
	[0053.952] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.952] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0177806.JPG") returned -1
	[0053.952] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0177806.JPG") returned -1
	[0053.952] lstrcmpiA (lpString1="", lpString2="J0177806.JPG") returned -1
	[0053.952] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned="J0177257.JPG"
	[0053.953] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.953] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.953] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.953] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.953] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0177806.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG"
	[0053.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG", pszSpec="*.zip") returned 0
	[0053.953] lstrlenA (lpString="*.zip") returned 5
	[0053.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG", pszSpec="*.rar") returned 0
	[0053.953] lstrlenA (lpString="*.rar") returned 5
	[0053.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG", pszSpec="*.7z") returned 0
	[0053.953] lstrlenA (lpString="*.7z") returned 4
	[0053.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG", pszSpec="*.tar") returned 0
	[0053.953] lstrlenA (lpString="*.tar") returned 5
	[0053.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG", pszSpec="*.gzip") returned 0
	[0053.953] lstrlenA (lpString="*.gzip") returned 6
	[0053.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG", pszSpec="*.jpg") returned 1
	[0053.953] lstrlenA (lpString="*.jpg") returned 5
	[0053.953] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG"
	[0053.953] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG"
	[0053.953] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG."
	[0053.953] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG.exe"
	[0053.953] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177806.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0053.953] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd902
	[0053.953] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xeac9c22, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xeac9c22, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xeac9c22, dwHighDateTime=0x1d327e8)) returned 1
	[0053.954] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.954] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xd8c0, lpOverlapped=0x0) returned 1
	[0053.955] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned="J0177806.JPG"
	[0053.955] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.955] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xd8c0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xd8c0, lpOverlapped=0x0) returned 1
	[0053.956] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.956] CloseHandle (hObject=0x214) returned 1
	[0053.957] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177806.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177806.jpg.exe")) returned 1
	[0053.958] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeac9c22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeac9c22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeac9c22, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x907d, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0178348.JPG", cAlternateFileName="")) returned 1
	[0053.958] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.958] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0178348.JPG") returned -1
	[0053.958] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0178348.JPG") returned -1
	[0053.958] lstrcmpiA (lpString1="", lpString2="J0178348.JPG") returned -1
	[0053.958] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned="J0177806.JPG"
	[0053.958] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.958] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.958] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.958] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.958] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0178348.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG"
	[0053.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG", pszSpec="*.zip") returned 0
	[0053.958] lstrlenA (lpString="*.zip") returned 5
	[0053.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG", pszSpec="*.rar") returned 0
	[0053.958] lstrlenA (lpString="*.rar") returned 5
	[0053.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG", pszSpec="*.7z") returned 0
	[0053.958] lstrlenA (lpString="*.7z") returned 4
	[0053.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG", pszSpec="*.tar") returned 0
	[0053.958] lstrlenA (lpString="*.tar") returned 5
	[0053.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG", pszSpec="*.gzip") returned 0
	[0053.959] lstrlenA (lpString="*.gzip") returned 6
	[0053.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG", pszSpec="*.jpg") returned 1
	[0053.959] lstrlenA (lpString="*.jpg") returned 5
	[0053.959] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG"
	[0053.959] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG"
	[0053.959] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG."
	[0053.959] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG.exe"
	[0053.959] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0053.959] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x907d
	[0053.959] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xeac9c22, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xeac9c22, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xeac9c22, dwHighDateTime=0x1d327e8)) returned 1
	[0053.959] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.959] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x903b, lpOverlapped=0x0) returned 1
	[0053.961] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned="J0178348.JPG"
	[0053.961] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.961] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x903b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x903b, lpOverlapped=0x0) returned 1
	[0053.961] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.961] CloseHandle (hObject=0x214) returned 1
	[0053.963] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg.exe")) returned 1
	[0053.963] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeac9c22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeac9c22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeac9c22, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7214, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0178459.JPG", cAlternateFileName="")) returned 1
	[0053.963] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.963] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0178459.JPG") returned -1
	[0053.963] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0178459.JPG") returned -1
	[0053.963] lstrcmpiA (lpString1="", lpString2="J0178459.JPG") returned -1
	[0053.963] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned="J0178348.JPG"
	[0053.963] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.963] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.963] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.963] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.963] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0178459.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG"
	[0053.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG", pszSpec="*.zip") returned 0
	[0053.964] lstrlenA (lpString="*.zip") returned 5
	[0053.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG", pszSpec="*.rar") returned 0
	[0053.964] lstrlenA (lpString="*.rar") returned 5
	[0053.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG", pszSpec="*.7z") returned 0
	[0053.964] lstrlenA (lpString="*.7z") returned 4
	[0053.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG", pszSpec="*.tar") returned 0
	[0053.964] lstrlenA (lpString="*.tar") returned 5
	[0053.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG", pszSpec="*.gzip") returned 0
	[0053.964] lstrlenA (lpString="*.gzip") returned 6
	[0053.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG", pszSpec="*.jpg") returned 1
	[0053.964] lstrlenA (lpString="*.jpg") returned 5
	[0053.964] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG"
	[0053.964] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG"
	[0053.964] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG."
	[0053.964] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG.exe"
	[0053.964] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0053.965] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7214
	[0053.965] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xeac9c22, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xeac9c22, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xeac9c22, dwHighDateTime=0x1d327e8)) returned 1
	[0053.965] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.965] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x71d2, lpOverlapped=0x0) returned 1
	[0053.967] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned="J0178459.JPG"
	[0053.967] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.967] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x71d2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x71d2, lpOverlapped=0x0) returned 1
	[0053.967] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.967] CloseHandle (hObject=0x214) returned 1
	[0053.968] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg.exe")) returned 1
	[0053.969] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeac9c22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeac9c22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeac9c22, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x67a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0178460.JPG", cAlternateFileName="")) returned 1
	[0053.969] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.969] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0178460.JPG") returned -1
	[0053.969] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0178460.JPG") returned -1
	[0053.969] lstrcmpiA (lpString1="", lpString2="J0178460.JPG") returned -1
	[0053.969] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned="J0178459.JPG"
	[0053.969] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.969] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.969] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.969] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.969] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0178460.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG"
	[0053.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG", pszSpec="*.zip") returned 0
	[0053.969] lstrlenA (lpString="*.zip") returned 5
	[0053.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG", pszSpec="*.rar") returned 0
	[0053.969] lstrlenA (lpString="*.rar") returned 5
	[0053.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG", pszSpec="*.7z") returned 0
	[0053.970] lstrlenA (lpString="*.7z") returned 4
	[0053.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG", pszSpec="*.tar") returned 0
	[0053.970] lstrlenA (lpString="*.tar") returned 5
	[0053.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG", pszSpec="*.gzip") returned 0
	[0053.970] lstrlenA (lpString="*.gzip") returned 6
	[0053.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG", pszSpec="*.jpg") returned 1
	[0053.970] lstrlenA (lpString="*.jpg") returned 5
	[0053.970] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG"
	[0053.970] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG"
	[0053.970] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG."
	[0053.970] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG.exe"
	[0053.970] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0053.970] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x67a3
	[0053.970] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xeac9c22, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xeac9c22, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xeac9c22, dwHighDateTime=0x1d327e8)) returned 1
	[0053.970] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.970] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x6761, lpOverlapped=0x0) returned 1
	[0053.972] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned="J0178460.JPG"
	[0053.972] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.972] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x6761, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x6761, lpOverlapped=0x0) returned 1
	[0053.972] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.972] CloseHandle (hObject=0x214) returned 1
	[0053.973] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg.exe")) returned 1
	[0053.974] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeaefe14, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeaefe14, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeaefe14, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5de2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0178523.JPG", cAlternateFileName="")) returned 1
	[0053.974] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.974] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0178523.JPG") returned -1
	[0053.974] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0178523.JPG") returned -1
	[0053.974] lstrcmpiA (lpString1="", lpString2="J0178523.JPG") returned -1
	[0053.974] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned="J0178460.JPG"
	[0053.974] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.974] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.974] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.974] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.974] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0178523.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG"
	[0053.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG", pszSpec="*.zip") returned 0
	[0053.974] lstrlenA (lpString="*.zip") returned 5
	[0053.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG", pszSpec="*.rar") returned 0
	[0053.974] lstrlenA (lpString="*.rar") returned 5
	[0053.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG", pszSpec="*.7z") returned 0
	[0053.974] lstrlenA (lpString="*.7z") returned 4
	[0053.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG", pszSpec="*.tar") returned 0
	[0053.974] lstrlenA (lpString="*.tar") returned 5
	[0053.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG", pszSpec="*.gzip") returned 0
	[0053.974] lstrlenA (lpString="*.gzip") returned 6
	[0053.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG", pszSpec="*.jpg") returned 1
	[0053.975] lstrlenA (lpString="*.jpg") returned 5
	[0053.975] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG"
	[0053.975] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG"
	[0053.975] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG."
	[0053.975] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG.exe"
	[0053.975] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178523.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0053.975] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5de2
	[0053.975] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xeaefe14, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xeaefe14, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xeaefe14, dwHighDateTime=0x1d327e8)) returned 1
	[0053.975] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.975] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x5da0, lpOverlapped=0x0) returned 1
	[0053.977] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned="J0178523.JPG"
	[0053.977] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.977] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x5da0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x5da0, lpOverlapped=0x0) returned 1
	[0053.977] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.977] CloseHandle (hObject=0x214) returned 1
	[0053.978] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178523.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178523.jpg.exe")) returned 1
	[0053.979] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeaefe14, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeaefe14, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeaefe14, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5b2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0178632.JPG", cAlternateFileName="")) returned 1
	[0053.979] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.979] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0178632.JPG") returned -1
	[0053.979] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0178632.JPG") returned -1
	[0053.979] lstrcmpiA (lpString1="", lpString2="J0178632.JPG") returned -1
	[0053.979] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned="J0178523.JPG"
	[0053.979] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.979] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.979] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.979] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.979] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0178632.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG"
	[0053.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG", pszSpec="*.zip") returned 0
	[0053.979] lstrlenA (lpString="*.zip") returned 5
	[0053.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG", pszSpec="*.rar") returned 0
	[0053.979] lstrlenA (lpString="*.rar") returned 5
	[0053.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG", pszSpec="*.7z") returned 0
	[0053.979] lstrlenA (lpString="*.7z") returned 4
	[0053.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG", pszSpec="*.tar") returned 0
	[0053.979] lstrlenA (lpString="*.tar") returned 5
	[0053.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG", pszSpec="*.gzip") returned 0
	[0053.979] lstrlenA (lpString="*.gzip") returned 6
	[0053.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG", pszSpec="*.jpg") returned 1
	[0053.979] lstrlenA (lpString="*.jpg") returned 5
	[0053.979] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG"
	[0053.980] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG"
	[0053.980] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG."
	[0053.980] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG.exe"
	[0053.980] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0053.980] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5b2a
	[0053.980] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xeaefe14, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xeaefe14, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xeaefe14, dwHighDateTime=0x1d327e8)) returned 1
	[0053.980] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.980] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x5ae8, lpOverlapped=0x0) returned 1
	[0053.982] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned="J0178632.JPG"
	[0053.982] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.982] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x5ae8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x5ae8, lpOverlapped=0x0) returned 1
	[0053.982] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.982] CloseHandle (hObject=0x214) returned 1
	[0053.983] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg.exe")) returned 1
	[0053.984] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeaefe14, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeaefe14, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeaefe14, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7d26, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0178639.JPG", cAlternateFileName="")) returned 1
	[0053.984] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0053.984] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0178639.JPG") returned -1
	[0053.984] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0178639.JPG") returned -1
	[0053.984] lstrcmpiA (lpString1="", lpString2="J0178639.JPG") returned -1
	[0053.984] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned="J0178632.JPG"
	[0053.984] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0053.984] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0053.984] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0053.984] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0053.984] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0178639.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG"
	[0053.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG", pszSpec="*.zip") returned 0
	[0053.984] lstrlenA (lpString="*.zip") returned 5
	[0053.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG", pszSpec="*.rar") returned 0
	[0053.984] lstrlenA (lpString="*.rar") returned 5
	[0053.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG", pszSpec="*.7z") returned 0
	[0053.984] lstrlenA (lpString="*.7z") returned 4
	[0053.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG", pszSpec="*.tar") returned 0
	[0053.984] lstrlenA (lpString="*.tar") returned 5
	[0053.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG", pszSpec="*.gzip") returned 0
	[0053.984] lstrlenA (lpString="*.gzip") returned 6
	[0053.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG", pszSpec="*.jpg") returned 1
	[0053.984] lstrlenA (lpString="*.jpg") returned 5
	[0053.984] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG"
	[0053.984] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG"
	[0053.985] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG."
	[0053.985] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG.exe"
	[0053.985] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0053.985] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7d26
	[0053.985] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xeaefe14, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xeaefe14, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xeaefe14, dwHighDateTime=0x1d327e8)) returned 1
	[0053.985] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0053.985] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7ce4, lpOverlapped=0x0) returned 1
	[0054.001] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned="J0178639.JPG"
	[0054.001] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.001] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7ce4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7ce4, lpOverlapped=0x0) returned 1
	[0054.002] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.002] CloseHandle (hObject=0x214) returned 1
	[0054.003] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg.exe")) returned 1
	[0054.004] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeaefe14, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeaefe14, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeaefe14, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8a0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0178932.JPG", cAlternateFileName="")) returned 1
	[0054.004] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.004] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0178932.JPG") returned -1
	[0054.004] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0178932.JPG") returned -1
	[0054.004] lstrcmpiA (lpString1="", lpString2="J0178932.JPG") returned -1
	[0054.004] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned="J0178639.JPG"
	[0054.004] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.004] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.004] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.004] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.004] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0178932.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG"
	[0054.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG", pszSpec="*.zip") returned 0
	[0054.004] lstrlenA (lpString="*.zip") returned 5
	[0054.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG", pszSpec="*.rar") returned 0
	[0054.004] lstrlenA (lpString="*.rar") returned 5
	[0054.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG", pszSpec="*.7z") returned 0
	[0054.004] lstrlenA (lpString="*.7z") returned 4
	[0054.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG", pszSpec="*.tar") returned 0
	[0054.004] lstrlenA (lpString="*.tar") returned 5
	[0054.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG", pszSpec="*.gzip") returned 0
	[0054.004] lstrlenA (lpString="*.gzip") returned 6
	[0054.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG", pszSpec="*.jpg") returned 1
	[0054.004] lstrlenA (lpString="*.jpg") returned 5
	[0054.004] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG"
	[0054.004] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG"
	[0054.004] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG."
	[0054.004] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG.exe"
	[0054.004] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0054.005] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8a0c
	[0054.005] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xeaefe14, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xeaefe14, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xeaefe14, dwHighDateTime=0x1d327e8)) returned 1
	[0054.005] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.005] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x89ca, lpOverlapped=0x0) returned 1
	[0054.009] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned="J0178932.JPG"
	[0054.009] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.009] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x89ca, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x89ca, lpOverlapped=0x0) returned 1
	[0054.009] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.009] CloseHandle (hObject=0x214) returned 1
	[0054.013] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg.exe")) returned 1
	[0054.013] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeaefe14, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeaefe14, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeaefe14, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7d6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0179963.JPG", cAlternateFileName="")) returned 1
	[0054.013] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.013] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0179963.JPG") returned -1
	[0054.013] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0179963.JPG") returned -1
	[0054.013] lstrcmpiA (lpString1="", lpString2="J0179963.JPG") returned -1
	[0054.014] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned="J0178932.JPG"
	[0054.014] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.014] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.014] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.014] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.014] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0179963.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG"
	[0054.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG", pszSpec="*.zip") returned 0
	[0054.014] lstrlenA (lpString="*.zip") returned 5
	[0054.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG", pszSpec="*.rar") returned 0
	[0054.014] lstrlenA (lpString="*.rar") returned 5
	[0054.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG", pszSpec="*.7z") returned 0
	[0054.014] lstrlenA (lpString="*.7z") returned 4
	[0054.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG", pszSpec="*.tar") returned 0
	[0054.014] lstrlenA (lpString="*.tar") returned 5
	[0054.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG", pszSpec="*.gzip") returned 0
	[0054.014] lstrlenA (lpString="*.gzip") returned 6
	[0054.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG", pszSpec="*.jpg") returned 1
	[0054.014] lstrlenA (lpString="*.jpg") returned 5
	[0054.014] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG"
	[0054.014] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG"
	[0054.014] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG."
	[0054.014] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG.exe"
	[0054.014] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0054.015] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7d6e
	[0054.015] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xeaefe14, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xeaefe14, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xeaefe14, dwHighDateTime=0x1d327e8)) returned 1
	[0054.015] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.015] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7d2c, lpOverlapped=0x0) returned 1
	[0054.016] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned="J0179963.JPG"
	[0054.017] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.017] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7d2c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7d2c, lpOverlapped=0x0) returned 1
	[0054.017] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.017] CloseHandle (hObject=0x214) returned 1
	[0054.018] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg.exe")) returned 1
	[0054.019] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeac9c22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeac9c22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeaefe14, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x40e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0182689.JPG", cAlternateFileName="")) returned 1
	[0054.019] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.019] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0182689.JPG") returned -1
	[0054.019] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0182689.JPG") returned -1
	[0054.019] lstrcmpiA (lpString1="", lpString2="J0182689.JPG") returned -1
	[0054.019] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned="J0179963.JPG"
	[0054.019] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.019] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.019] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.019] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.019] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0182689.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG"
	[0054.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG", pszSpec="*.zip") returned 0
	[0054.019] lstrlenA (lpString="*.zip") returned 5
	[0054.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG", pszSpec="*.rar") returned 0
	[0054.019] lstrlenA (lpString="*.rar") returned 5
	[0054.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG", pszSpec="*.7z") returned 0
	[0054.019] lstrlenA (lpString="*.7z") returned 4
	[0054.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG", pszSpec="*.tar") returned 0
	[0054.019] lstrlenA (lpString="*.tar") returned 5
	[0054.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG", pszSpec="*.gzip") returned 0
	[0054.019] lstrlenA (lpString="*.gzip") returned 6
	[0054.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG", pszSpec="*.jpg") returned 1
	[0054.019] lstrlenA (lpString="*.jpg") returned 5
	[0054.019] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG"
	[0054.019] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG"
	[0054.020] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG."
	[0054.020] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG.exe"
	[0054.020] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182689.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0054.020] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40e7
	[0054.020] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xeac9c22, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xeac9c22, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xeaefe14, dwHighDateTime=0x1d327e8)) returned 1
	[0054.020] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.020] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x40a5, lpOverlapped=0x0) returned 1
	[0054.022] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned="J0182689.JPG"
	[0054.022] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.022] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x40a5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x40a5, lpOverlapped=0x0) returned 1
	[0054.022] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.022] CloseHandle (hObject=0x214) returned 1
	[0054.023] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182689.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182689.jpg.exe")) returned 1
	[0054.024] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeaefe14, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeaefe14, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeaefe14, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5f48, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0182888.WMF", cAlternateFileName="")) returned 1
	[0054.024] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.024] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0182888.WMF") returned -1
	[0054.024] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0182888.WMF") returned -1
	[0054.024] lstrcmpiA (lpString1="", lpString2="J0182888.WMF") returned -1
	[0054.024] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned="J0182689.JPG"
	[0054.024] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.024] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.024] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.024] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.024] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0182888.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF"
	[0054.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.zip") returned 0
	[0054.024] lstrlenA (lpString="*.zip") returned 5
	[0054.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.rar") returned 0
	[0054.024] lstrlenA (lpString="*.rar") returned 5
	[0054.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.7z") returned 0
	[0054.024] lstrlenA (lpString="*.7z") returned 4
	[0054.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.tar") returned 0
	[0054.024] lstrlenA (lpString="*.tar") returned 5
	[0054.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.gzip") returned 0
	[0054.025] lstrlenA (lpString="*.gzip") returned 6
	[0054.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.jpg") returned 0
	[0054.025] lstrlenA (lpString="*.jpg") returned 5
	[0054.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.jpeg") returned 0
	[0054.025] lstrlenA (lpString="*.jpeg") returned 6
	[0054.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.bmp") returned 0
	[0054.025] lstrlenA (lpString="*.bmp") returned 5
	[0054.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.gif") returned 0
	[0054.025] lstrlenA (lpString="*.gif") returned 5
	[0054.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.png") returned 0
	[0054.025] lstrlenA (lpString="*.png") returned 5
	[0054.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.doc") returned 0
	[0054.025] lstrlenA (lpString="*.doc") returned 5
	[0054.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.docx") returned 0
	[0054.025] lstrlenA (lpString="*.docx") returned 6
	[0054.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.xls") returned 0
	[0054.025] lstrlenA (lpString="*.xls") returned 5
	[0054.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.xlsx") returned 0
	[0054.025] lstrlenA (lpString="*.xlsx") returned 6
	[0054.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.ppt") returned 0
	[0054.025] lstrlenA (lpString="*.ppt") returned 5
	[0054.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.pptx") returned 0
	[0054.025] lstrlenA (lpString="*.pptx") returned 6
	[0054.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.txt") returned 0
	[0054.025] lstrlenA (lpString="*.txt") returned 5
	[0054.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.pdf") returned 0
	[0054.025] lstrlenA (lpString="*.pdf") returned 5
	[0054.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.htm") returned 0
	[0054.025] lstrlenA (lpString="*.htm") returned 5
	[0054.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.html") returned 0
	[0054.025] lstrlenA (lpString="*.html") returned 6
	[0054.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.mdb") returned 0
	[0054.025] lstrlenA (lpString="*.mdb") returned 5
	[0054.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.pfx") returned 0
	[0054.025] lstrlenA (lpString="*.pfx") returned 5
	[0054.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.md") returned 0
	[0054.026] lstrlenA (lpString="*.md") returned 4
	[0054.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.lnk") returned 0
	[0054.026] lstrlenA (lpString="*.lnk") returned 5
	[0054.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.torrent") returned 0
	[0054.026] lstrlenA (lpString="*.torrent") returned 9
	[0054.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.mov") returned 0
	[0054.026] lstrlenA (lpString="*.mov") returned 5
	[0054.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.3gp") returned 0
	[0054.026] lstrlenA (lpString="*.3gp") returned 5
	[0054.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.mpeg") returned 0
	[0054.026] lstrlenA (lpString="*.mpeg") returned 6
	[0054.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.mpg") returned 0
	[0054.026] lstrlenA (lpString="*.mpg") returned 5
	[0054.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.flv") returned 0
	[0054.026] lstrlenA (lpString="*.flv") returned 5
	[0054.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.avi") returned 0
	[0054.026] lstrlenA (lpString="*.avi") returned 5
	[0054.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.mp4") returned 0
	[0054.026] lstrlenA (lpString="*.mp4") returned 5
	[0054.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.wmv") returned 0
	[0054.026] lstrlenA (lpString="*.wmv") returned 5
	[0054.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.mkv") returned 0
	[0054.026] lstrlenA (lpString="*.mkv") returned 5
	[0054.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.mp3") returned 0
	[0054.026] lstrlenA (lpString="*.mp3") returned 5
	[0054.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.wav") returned 0
	[0054.026] lstrlenA (lpString="*.wav") returned 5
	[0054.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.flac") returned 0
	[0054.026] lstrlenA (lpString="*.flac") returned 6
	[0054.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.wma") returned 0
	[0054.026] lstrlenA (lpString="*.wma") returned 5
	[0054.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.au3") returned 0
	[0054.026] lstrlenA (lpString="*.au3") returned 5
	[0054.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.ahk") returned 0
	[0054.026] lstrlenA (lpString="*.ahk") returned 5
	[0054.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.c") returned 0
	[0054.027] lstrlenA (lpString="*.c") returned 3
	[0054.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.cc") returned 0
	[0054.027] lstrlenA (lpString="*.cc") returned 4
	[0054.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.cpp") returned 0
	[0054.027] lstrlenA (lpString="*.cpp") returned 5
	[0054.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.cxx") returned 0
	[0054.027] lstrlenA (lpString="*.cxx") returned 5
	[0054.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.c++") returned 0
	[0054.027] lstrlenA (lpString="*.c++") returned 5
	[0054.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.cs") returned 0
	[0054.027] lstrlenA (lpString="*.cs") returned 4
	[0054.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.vb") returned 0
	[0054.027] lstrlenA (lpString="*.vb") returned 4
	[0054.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.bas") returned 0
	[0054.027] lstrlenA (lpString="*.bas") returned 5
	[0054.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.csproj") returned 0
	[0054.027] lstrlenA (lpString="*.csproj") returned 8
	[0054.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.vbproj") returned 0
	[0054.027] lstrlenA (lpString="*.vbproj") returned 8
	[0054.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.vcxproj") returned 0
	[0054.027] lstrlenA (lpString="*.vcxproj") returned 9
	[0054.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.manifest") returned 0
	[0054.027] lstrlenA (lpString="*.manifest") returned 10
	[0054.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.php") returned 0
	[0054.027] lstrlenA (lpString="*.php") returned 5
	[0054.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.vbe") returned 0
	[0054.027] lstrlenA (lpString="*.vbe") returned 5
	[0054.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.vba") returned 0
	[0054.027] lstrlenA (lpString="*.vba") returned 5
	[0054.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.vbs") returned 0
	[0054.027] lstrlenA (lpString="*.vbs") returned 5
	[0054.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.bat") returned 0
	[0054.027] lstrlenA (lpString="*.bat") returned 5
	[0054.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.cmd") returned 0
	[0054.028] lstrlenA (lpString="*.cmd") returned 5
	[0054.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.js") returned 0
	[0054.028] lstrlenA (lpString="*.js") returned 4
	[0054.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.jscript") returned 0
	[0054.028] lstrlenA (lpString="*.jscript") returned 9
	[0054.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.hta") returned 0
	[0054.028] lstrlenA (lpString="*.hta") returned 5
	[0054.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.php7") returned 0
	[0054.028] lstrlenA (lpString="*.php7") returned 6
	[0054.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.db") returned 0
	[0054.028] lstrlenA (lpString="*.db") returned 4
	[0054.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.swf") returned 0
	[0054.028] lstrlenA (lpString="*.swf") returned 5
	[0054.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.eml") returned 0
	[0054.028] lstrlenA (lpString="*.eml") returned 5
	[0054.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.part") returned 0
	[0054.028] lstrlenA (lpString="*.part") returned 6
	[0054.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.nfo") returned 0
	[0054.028] lstrlenA (lpString="*.nfo") returned 5
	[0054.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.rsa") returned 0
	[0054.028] lstrlenA (lpString="*.rsa") returned 5
	[0054.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.key") returned 0
	[0054.028] lstrlenA (lpString="*.key") returned 5
	[0054.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.aes") returned 0
	[0054.028] lstrlenA (lpString="*.aes") returned 5
	[0054.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.blob") returned 0
	[0054.028] lstrlenA (lpString="*.blob") returned 6
	[0054.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.btc") returned 0
	[0054.029] lstrlenA (lpString="*.btc") returned 5
	[0054.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF", pszSpec="*.wallet") returned 0
	[0054.029] lstrlenA (lpString="*.wallet") returned 8
	[0054.029] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeaefe14, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeaefe14, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeaefe14, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0182898.WMF", cAlternateFileName="")) returned 1
	[0054.029] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.029] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0182898.WMF") returned -1
	[0054.029] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0182898.WMF") returned -1
	[0054.029] lstrcmpiA (lpString1="", lpString2="J0182898.WMF") returned -1
	[0054.029] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned="J0182888.WMF"
	[0054.029] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.029] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.029] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.029] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.029] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0182898.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF"
	[0054.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.zip") returned 0
	[0054.029] lstrlenA (lpString="*.zip") returned 5
	[0054.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.rar") returned 0
	[0054.029] lstrlenA (lpString="*.rar") returned 5
	[0054.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.7z") returned 0
	[0054.029] lstrlenA (lpString="*.7z") returned 4
	[0054.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.tar") returned 0
	[0054.029] lstrlenA (lpString="*.tar") returned 5
	[0054.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.gzip") returned 0
	[0054.029] lstrlenA (lpString="*.gzip") returned 6
	[0054.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.jpg") returned 0
	[0054.029] lstrlenA (lpString="*.jpg") returned 5
	[0054.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.jpeg") returned 0
	[0054.029] lstrlenA (lpString="*.jpeg") returned 6
	[0054.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.bmp") returned 0
	[0054.029] lstrlenA (lpString="*.bmp") returned 5
	[0054.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.gif") returned 0
	[0054.029] lstrlenA (lpString="*.gif") returned 5
	[0054.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.png") returned 0
	[0054.030] lstrlenA (lpString="*.png") returned 5
	[0054.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.doc") returned 0
	[0054.030] lstrlenA (lpString="*.doc") returned 5
	[0054.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.docx") returned 0
	[0054.030] lstrlenA (lpString="*.docx") returned 6
	[0054.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.xls") returned 0
	[0054.030] lstrlenA (lpString="*.xls") returned 5
	[0054.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.xlsx") returned 0
	[0054.030] lstrlenA (lpString="*.xlsx") returned 6
	[0054.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.ppt") returned 0
	[0054.030] lstrlenA (lpString="*.ppt") returned 5
	[0054.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.pptx") returned 0
	[0054.030] lstrlenA (lpString="*.pptx") returned 6
	[0054.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.txt") returned 0
	[0054.030] lstrlenA (lpString="*.txt") returned 5
	[0054.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.pdf") returned 0
	[0054.030] lstrlenA (lpString="*.pdf") returned 5
	[0054.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.htm") returned 0
	[0054.030] lstrlenA (lpString="*.htm") returned 5
	[0054.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.html") returned 0
	[0054.030] lstrlenA (lpString="*.html") returned 6
	[0054.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.mdb") returned 0
	[0054.030] lstrlenA (lpString="*.mdb") returned 5
	[0054.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.pfx") returned 0
	[0054.030] lstrlenA (lpString="*.pfx") returned 5
	[0054.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.md") returned 0
	[0054.030] lstrlenA (lpString="*.md") returned 4
	[0054.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.lnk") returned 0
	[0054.030] lstrlenA (lpString="*.lnk") returned 5
	[0054.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.torrent") returned 0
	[0054.030] lstrlenA (lpString="*.torrent") returned 9
	[0054.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.mov") returned 0
	[0054.030] lstrlenA (lpString="*.mov") returned 5
	[0054.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.3gp") returned 0
	[0054.030] lstrlenA (lpString="*.3gp") returned 5
	[0054.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.mpeg") returned 0
	[0054.031] lstrlenA (lpString="*.mpeg") returned 6
	[0054.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.mpg") returned 0
	[0054.031] lstrlenA (lpString="*.mpg") returned 5
	[0054.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.flv") returned 0
	[0054.031] lstrlenA (lpString="*.flv") returned 5
	[0054.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.avi") returned 0
	[0054.031] lstrlenA (lpString="*.avi") returned 5
	[0054.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.mp4") returned 0
	[0054.031] lstrlenA (lpString="*.mp4") returned 5
	[0054.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.wmv") returned 0
	[0054.031] lstrlenA (lpString="*.wmv") returned 5
	[0054.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.mkv") returned 0
	[0054.031] lstrlenA (lpString="*.mkv") returned 5
	[0054.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.mp3") returned 0
	[0054.031] lstrlenA (lpString="*.mp3") returned 5
	[0054.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.wav") returned 0
	[0054.031] lstrlenA (lpString="*.wav") returned 5
	[0054.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.flac") returned 0
	[0054.031] lstrlenA (lpString="*.flac") returned 6
	[0054.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.wma") returned 0
	[0054.031] lstrlenA (lpString="*.wma") returned 5
	[0054.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.au3") returned 0
	[0054.031] lstrlenA (lpString="*.au3") returned 5
	[0054.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.ahk") returned 0
	[0054.031] lstrlenA (lpString="*.ahk") returned 5
	[0054.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.c") returned 0
	[0054.031] lstrlenA (lpString="*.c") returned 3
	[0054.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.cc") returned 0
	[0054.031] lstrlenA (lpString="*.cc") returned 4
	[0054.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.cpp") returned 0
	[0054.031] lstrlenA (lpString="*.cpp") returned 5
	[0054.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.cxx") returned 0
	[0054.031] lstrlenA (lpString="*.cxx") returned 5
	[0054.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.c++") returned 0
	[0054.031] lstrlenA (lpString="*.c++") returned 5
	[0054.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.cs") returned 0
	[0054.032] lstrlenA (lpString="*.cs") returned 4
	[0054.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.vb") returned 0
	[0054.032] lstrlenA (lpString="*.vb") returned 4
	[0054.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.bas") returned 0
	[0054.032] lstrlenA (lpString="*.bas") returned 5
	[0054.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.csproj") returned 0
	[0054.032] lstrlenA (lpString="*.csproj") returned 8
	[0054.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.vbproj") returned 0
	[0054.032] lstrlenA (lpString="*.vbproj") returned 8
	[0054.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.vcxproj") returned 0
	[0054.032] lstrlenA (lpString="*.vcxproj") returned 9
	[0054.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.manifest") returned 0
	[0054.032] lstrlenA (lpString="*.manifest") returned 10
	[0054.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.php") returned 0
	[0054.032] lstrlenA (lpString="*.php") returned 5
	[0054.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.vbe") returned 0
	[0054.032] lstrlenA (lpString="*.vbe") returned 5
	[0054.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.vba") returned 0
	[0054.032] lstrlenA (lpString="*.vba") returned 5
	[0054.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.vbs") returned 0
	[0054.032] lstrlenA (lpString="*.vbs") returned 5
	[0054.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.bat") returned 0
	[0054.032] lstrlenA (lpString="*.bat") returned 5
	[0054.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.cmd") returned 0
	[0054.032] lstrlenA (lpString="*.cmd") returned 5
	[0054.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.js") returned 0
	[0054.032] lstrlenA (lpString="*.js") returned 4
	[0054.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.jscript") returned 0
	[0054.032] lstrlenA (lpString="*.jscript") returned 9
	[0054.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.hta") returned 0
	[0054.032] lstrlenA (lpString="*.hta") returned 5
	[0054.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.php7") returned 0
	[0054.032] lstrlenA (lpString="*.php7") returned 6
	[0054.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.db") returned 0
	[0054.032] lstrlenA (lpString="*.db") returned 4
	[0054.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.swf") returned 0
	[0054.033] lstrlenA (lpString="*.swf") returned 5
	[0054.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.eml") returned 0
	[0054.033] lstrlenA (lpString="*.eml") returned 5
	[0054.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.part") returned 0
	[0054.033] lstrlenA (lpString="*.part") returned 6
	[0054.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.nfo") returned 0
	[0054.033] lstrlenA (lpString="*.nfo") returned 5
	[0054.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.rsa") returned 0
	[0054.033] lstrlenA (lpString="*.rsa") returned 5
	[0054.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.key") returned 0
	[0054.033] lstrlenA (lpString="*.key") returned 5
	[0054.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.aes") returned 0
	[0054.033] lstrlenA (lpString="*.aes") returned 5
	[0054.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.blob") returned 0
	[0054.033] lstrlenA (lpString="*.blob") returned 6
	[0054.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.btc") returned 0
	[0054.033] lstrlenA (lpString="*.btc") returned 5
	[0054.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF", pszSpec="*.wallet") returned 0
	[0054.033] lstrlenA (lpString="*.wallet") returned 8
	[0054.033] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeaefe14, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeaefe14, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeaefe14, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1e8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0182902.WMF", cAlternateFileName="")) returned 1
	[0054.033] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.033] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0182902.WMF") returned -1
	[0054.033] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0182902.WMF") returned -1
	[0054.033] lstrcmpiA (lpString1="", lpString2="J0182902.WMF") returned -1
	[0054.033] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned="J0182898.WMF"
	[0054.033] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.033] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.033] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.033] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.033] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0182902.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF"
	[0054.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.zip") returned 0
	[0054.033] lstrlenA (lpString="*.zip") returned 5
	[0054.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.rar") returned 0
	[0054.033] lstrlenA (lpString="*.rar") returned 5
	[0054.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.7z") returned 0
	[0054.034] lstrlenA (lpString="*.7z") returned 4
	[0054.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.tar") returned 0
	[0054.034] lstrlenA (lpString="*.tar") returned 5
	[0054.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.gzip") returned 0
	[0054.034] lstrlenA (lpString="*.gzip") returned 6
	[0054.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.jpg") returned 0
	[0054.034] lstrlenA (lpString="*.jpg") returned 5
	[0054.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.jpeg") returned 0
	[0054.034] lstrlenA (lpString="*.jpeg") returned 6
	[0054.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.bmp") returned 0
	[0054.034] lstrlenA (lpString="*.bmp") returned 5
	[0054.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.gif") returned 0
	[0054.034] lstrlenA (lpString="*.gif") returned 5
	[0054.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.png") returned 0
	[0054.034] lstrlenA (lpString="*.png") returned 5
	[0054.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.doc") returned 0
	[0054.034] lstrlenA (lpString="*.doc") returned 5
	[0054.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.docx") returned 0
	[0054.034] lstrlenA (lpString="*.docx") returned 6
	[0054.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.xls") returned 0
	[0054.034] lstrlenA (lpString="*.xls") returned 5
	[0054.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.xlsx") returned 0
	[0054.034] lstrlenA (lpString="*.xlsx") returned 6
	[0054.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.ppt") returned 0
	[0054.034] lstrlenA (lpString="*.ppt") returned 5
	[0054.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.pptx") returned 0
	[0054.034] lstrlenA (lpString="*.pptx") returned 6
	[0054.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.txt") returned 0
	[0054.034] lstrlenA (lpString="*.txt") returned 5
	[0054.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.pdf") returned 0
	[0054.034] lstrlenA (lpString="*.pdf") returned 5
	[0054.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.htm") returned 0
	[0054.034] lstrlenA (lpString="*.htm") returned 5
	[0054.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.html") returned 0
	[0054.034] lstrlenA (lpString="*.html") returned 6
	[0054.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.mdb") returned 0
	[0054.035] lstrlenA (lpString="*.mdb") returned 5
	[0054.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.pfx") returned 0
	[0054.035] lstrlenA (lpString="*.pfx") returned 5
	[0054.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.md") returned 0
	[0054.035] lstrlenA (lpString="*.md") returned 4
	[0054.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.lnk") returned 0
	[0054.035] lstrlenA (lpString="*.lnk") returned 5
	[0054.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.torrent") returned 0
	[0054.035] lstrlenA (lpString="*.torrent") returned 9
	[0054.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.mov") returned 0
	[0054.035] lstrlenA (lpString="*.mov") returned 5
	[0054.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.3gp") returned 0
	[0054.035] lstrlenA (lpString="*.3gp") returned 5
	[0054.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.mpeg") returned 0
	[0054.035] lstrlenA (lpString="*.mpeg") returned 6
	[0054.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.mpg") returned 0
	[0054.035] lstrlenA (lpString="*.mpg") returned 5
	[0054.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.flv") returned 0
	[0054.035] lstrlenA (lpString="*.flv") returned 5
	[0054.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.avi") returned 0
	[0054.035] lstrlenA (lpString="*.avi") returned 5
	[0054.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.mp4") returned 0
	[0054.035] lstrlenA (lpString="*.mp4") returned 5
	[0054.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.wmv") returned 0
	[0054.035] lstrlenA (lpString="*.wmv") returned 5
	[0054.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.mkv") returned 0
	[0054.035] lstrlenA (lpString="*.mkv") returned 5
	[0054.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.mp3") returned 0
	[0054.035] lstrlenA (lpString="*.mp3") returned 5
	[0054.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.wav") returned 0
	[0054.035] lstrlenA (lpString="*.wav") returned 5
	[0054.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.flac") returned 0
	[0054.035] lstrlenA (lpString="*.flac") returned 6
	[0054.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.wma") returned 0
	[0054.035] lstrlenA (lpString="*.wma") returned 5
	[0054.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.au3") returned 0
	[0054.036] lstrlenA (lpString="*.au3") returned 5
	[0054.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.ahk") returned 0
	[0054.036] lstrlenA (lpString="*.ahk") returned 5
	[0054.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.c") returned 0
	[0054.036] lstrlenA (lpString="*.c") returned 3
	[0054.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.cc") returned 0
	[0054.036] lstrlenA (lpString="*.cc") returned 4
	[0054.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.cpp") returned 0
	[0054.036] lstrlenA (lpString="*.cpp") returned 5
	[0054.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.cxx") returned 0
	[0054.036] lstrlenA (lpString="*.cxx") returned 5
	[0054.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.c++") returned 0
	[0054.036] lstrlenA (lpString="*.c++") returned 5
	[0054.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.cs") returned 0
	[0054.036] lstrlenA (lpString="*.cs") returned 4
	[0054.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.vb") returned 0
	[0054.036] lstrlenA (lpString="*.vb") returned 4
	[0054.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.bas") returned 0
	[0054.036] lstrlenA (lpString="*.bas") returned 5
	[0054.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.csproj") returned 0
	[0054.036] lstrlenA (lpString="*.csproj") returned 8
	[0054.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.vbproj") returned 0
	[0054.036] lstrlenA (lpString="*.vbproj") returned 8
	[0054.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.vcxproj") returned 0
	[0054.036] lstrlenA (lpString="*.vcxproj") returned 9
	[0054.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.manifest") returned 0
	[0054.036] lstrlenA (lpString="*.manifest") returned 10
	[0054.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.php") returned 0
	[0054.036] lstrlenA (lpString="*.php") returned 5
	[0054.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.vbe") returned 0
	[0054.036] lstrlenA (lpString="*.vbe") returned 5
	[0054.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.vba") returned 0
	[0054.036] lstrlenA (lpString="*.vba") returned 5
	[0054.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.vbs") returned 0
	[0054.036] lstrlenA (lpString="*.vbs") returned 5
	[0054.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.bat") returned 0
	[0054.037] lstrlenA (lpString="*.bat") returned 5
	[0054.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.cmd") returned 0
	[0054.037] lstrlenA (lpString="*.cmd") returned 5
	[0054.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.js") returned 0
	[0054.037] lstrlenA (lpString="*.js") returned 4
	[0054.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.jscript") returned 0
	[0054.037] lstrlenA (lpString="*.jscript") returned 9
	[0054.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.hta") returned 0
	[0054.037] lstrlenA (lpString="*.hta") returned 5
	[0054.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.php7") returned 0
	[0054.037] lstrlenA (lpString="*.php7") returned 6
	[0054.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.db") returned 0
	[0054.037] lstrlenA (lpString="*.db") returned 4
	[0054.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.swf") returned 0
	[0054.037] lstrlenA (lpString="*.swf") returned 5
	[0054.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.eml") returned 0
	[0054.037] lstrlenA (lpString="*.eml") returned 5
	[0054.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.part") returned 0
	[0054.037] lstrlenA (lpString="*.part") returned 6
	[0054.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.nfo") returned 0
	[0054.037] lstrlenA (lpString="*.nfo") returned 5
	[0054.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.rsa") returned 0
	[0054.037] lstrlenA (lpString="*.rsa") returned 5
	[0054.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.key") returned 0
	[0054.037] lstrlenA (lpString="*.key") returned 5
	[0054.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.aes") returned 0
	[0054.037] lstrlenA (lpString="*.aes") returned 5
	[0054.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.blob") returned 0
	[0054.037] lstrlenA (lpString="*.blob") returned 6
	[0054.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.btc") returned 0
	[0054.037] lstrlenA (lpString="*.btc") returned 5
	[0054.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF", pszSpec="*.wallet") returned 0
	[0054.037] lstrlenA (lpString="*.wallet") returned 8
	[0054.037] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeac9c22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeac9c22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeaefe14, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3ed2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0182946.WMF", cAlternateFileName="")) returned 1
	[0054.037] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.037] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0182946.WMF") returned -1
	[0054.038] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0182946.WMF") returned -1
	[0054.038] lstrcmpiA (lpString1="", lpString2="J0182946.WMF") returned -1
	[0054.038] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned="J0182902.WMF"
	[0054.038] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.038] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.038] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.038] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.038] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0182946.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF"
	[0054.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.zip") returned 0
	[0054.038] lstrlenA (lpString="*.zip") returned 5
	[0054.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.rar") returned 0
	[0054.038] lstrlenA (lpString="*.rar") returned 5
	[0054.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.7z") returned 0
	[0054.038] lstrlenA (lpString="*.7z") returned 4
	[0054.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.tar") returned 0
	[0054.038] lstrlenA (lpString="*.tar") returned 5
	[0054.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.gzip") returned 0
	[0054.038] lstrlenA (lpString="*.gzip") returned 6
	[0054.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.jpg") returned 0
	[0054.038] lstrlenA (lpString="*.jpg") returned 5
	[0054.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.jpeg") returned 0
	[0054.038] lstrlenA (lpString="*.jpeg") returned 6
	[0054.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.bmp") returned 0
	[0054.038] lstrlenA (lpString="*.bmp") returned 5
	[0054.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.gif") returned 0
	[0054.038] lstrlenA (lpString="*.gif") returned 5
	[0054.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.png") returned 0
	[0054.038] lstrlenA (lpString="*.png") returned 5
	[0054.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.doc") returned 0
	[0054.038] lstrlenA (lpString="*.doc") returned 5
	[0054.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.docx") returned 0
	[0054.038] lstrlenA (lpString="*.docx") returned 6
	[0054.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.xls") returned 0
	[0054.038] lstrlenA (lpString="*.xls") returned 5
	[0054.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.xlsx") returned 0
	[0054.039] lstrlenA (lpString="*.xlsx") returned 6
	[0054.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.ppt") returned 0
	[0054.039] lstrlenA (lpString="*.ppt") returned 5
	[0054.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.pptx") returned 0
	[0054.039] lstrlenA (lpString="*.pptx") returned 6
	[0054.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.txt") returned 0
	[0054.039] lstrlenA (lpString="*.txt") returned 5
	[0054.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.pdf") returned 0
	[0054.039] lstrlenA (lpString="*.pdf") returned 5
	[0054.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.htm") returned 0
	[0054.039] lstrlenA (lpString="*.htm") returned 5
	[0054.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.html") returned 0
	[0054.039] lstrlenA (lpString="*.html") returned 6
	[0054.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.mdb") returned 0
	[0054.039] lstrlenA (lpString="*.mdb") returned 5
	[0054.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.pfx") returned 0
	[0054.039] lstrlenA (lpString="*.pfx") returned 5
	[0054.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.md") returned 0
	[0054.039] lstrlenA (lpString="*.md") returned 4
	[0054.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.lnk") returned 0
	[0054.039] lstrlenA (lpString="*.lnk") returned 5
	[0054.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.torrent") returned 0
	[0054.039] lstrlenA (lpString="*.torrent") returned 9
	[0054.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.mov") returned 0
	[0054.039] lstrlenA (lpString="*.mov") returned 5
	[0054.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.3gp") returned 0
	[0054.039] lstrlenA (lpString="*.3gp") returned 5
	[0054.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.mpeg") returned 0
	[0054.039] lstrlenA (lpString="*.mpeg") returned 6
	[0054.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.mpg") returned 0
	[0054.039] lstrlenA (lpString="*.mpg") returned 5
	[0054.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF", pszSpec="*.flv") returned 0
	[0054.040] lstrlenA (lpString="*.flv") returned 5
	[0054.040] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb1606f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb1606f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb1606f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x745c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183172.WMF", cAlternateFileName="")) returned 1
	[0054.040] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.040] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0183172.WMF") returned -1
	[0054.040] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0183172.WMF") returned -1
	[0054.040] lstrcmpiA (lpString1="", lpString2="J0183172.WMF") returned -1
	[0054.040] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF") returned="J0182946.WMF"
	[0054.040] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.040] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.040] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.040] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.040] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0183172.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF"
	[0054.040] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeaefe14, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeaefe14, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb1606f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6fd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183174.WMF", cAlternateFileName="")) returned 1
	[0054.040] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.040] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0183174.WMF") returned -1
	[0054.040] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0183174.WMF") returned -1
	[0054.040] lstrcmpiA (lpString1="", lpString2="J0183174.WMF") returned -1
	[0054.040] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned="J0183172.WMF"
	[0054.040] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.040] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.041] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.041] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.041] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0183174.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF"
	[0054.041] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeaefe14, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeaefe14, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb1606f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5f6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183198.WMF", cAlternateFileName="")) returned 1
	[0054.041] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.041] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0183198.WMF") returned -1
	[0054.041] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0183198.WMF") returned -1
	[0054.041] lstrcmpiA (lpString1="", lpString2="J0183198.WMF") returned -1
	[0054.041] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned="J0183174.WMF"
	[0054.041] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.041] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.041] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.041] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.041] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0183198.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF"
	[0054.041] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeaefe14, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeaefe14, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb1606f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4b4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183574.WMF", cAlternateFileName="")) returned 1
	[0054.143] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.143] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0183574.WMF") returned -1
	[0054.143] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0183574.WMF") returned -1
	[0054.143] lstrcmpiA (lpString1="", lpString2="J0183574.WMF") returned -1
	[0054.143] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned="J0183198.WMF"
	[0054.143] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.143] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.143] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.143] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.143] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0183574.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF"
	[0054.143] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeaefe14, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeaefe14, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeaefe14, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c88, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185670.WMF", cAlternateFileName="")) returned 1
	[0054.143] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.143] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0185670.WMF") returned -1
	[0054.143] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0185670.WMF") returned -1
	[0054.143] lstrcmpiA (lpString1="", lpString2="J0185670.WMF") returned -1
	[0054.143] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF") returned="J0183574.WMF"
	[0054.143] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.143] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.143] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.144] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.144] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0185670.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF"
	[0054.144] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeaefe14, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeaefe14, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeaefe14, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4e46, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185774.WMF", cAlternateFileName="")) returned 1
	[0054.144] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.144] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0185774.WMF") returned -1
	[0054.144] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0185774.WMF") returned -1
	[0054.144] lstrcmpiA (lpString1="", lpString2="J0185774.WMF") returned -1
	[0054.144] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned="J0185670.WMF"
	[0054.144] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.144] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.144] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.144] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.144] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0185774.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF"
	[0054.144] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeaefe14, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeaefe14, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb1606f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x69d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185776.WMF", cAlternateFileName="")) returned 1
	[0054.144] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.144] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0185776.WMF") returned -1
	[0054.144] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0185776.WMF") returned -1
	[0054.144] lstrcmpiA (lpString1="", lpString2="J0185776.WMF") returned -1
	[0054.144] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned="J0185774.WMF"
	[0054.144] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.144] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.144] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.144] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.144] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0185776.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF"
	[0054.144] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeaefe14, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeaefe14, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeaefe14, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x62e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185778.WMF", cAlternateFileName="")) returned 1
	[0054.145] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.145] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0185778.WMF") returned -1
	[0054.145] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0185778.WMF") returned -1
	[0054.145] lstrcmpiA (lpString1="", lpString2="J0185778.WMF") returned -1
	[0054.145] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned="J0185776.WMF"
	[0054.145] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.145] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.145] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.145] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.145] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0185778.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF"
	[0054.145] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeaefe14, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeaefe14, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeaefe14, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe956, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185780.WMF", cAlternateFileName="")) returned 1
	[0054.145] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.145] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0185780.WMF") returned -1
	[0054.145] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0185780.WMF") returned -1
	[0054.145] lstrcmpiA (lpString1="", lpString2="J0185780.WMF") returned -1
	[0054.145] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF") returned="J0185778.WMF"
	[0054.145] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.145] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.145] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.145] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.145] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0185780.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF"
	[0054.145] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeaefe14, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeaefe14, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeaefe14, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x99a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185786.WMF", cAlternateFileName="")) returned 1
	[0054.145] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.145] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0185786.WMF") returned -1
	[0054.145] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0185786.WMF") returned -1
	[0054.145] lstrcmpiA (lpString1="", lpString2="J0185786.WMF") returned -1
	[0054.145] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned="J0185780.WMF"
	[0054.146] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.146] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.146] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.146] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.146] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0185786.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF"
	[0054.146] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb1606f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb1606f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb1606f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x50b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185790.WMF", cAlternateFileName="")) returned 1
	[0054.146] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.146] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0185790.WMF") returned -1
	[0054.146] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0185790.WMF") returned -1
	[0054.146] lstrcmpiA (lpString1="", lpString2="J0185790.WMF") returned -1
	[0054.146] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned="J0185786.WMF"
	[0054.146] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.146] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.146] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.146] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.146] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0185790.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF"
	[0054.146] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb1606f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb1606f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb1606f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x650c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185796.WMF", cAlternateFileName="")) returned 1
	[0054.146] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.146] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0185796.WMF") returned -1
	[0054.146] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0185796.WMF") returned -1
	[0054.146] lstrcmpiA (lpString1="", lpString2="J0185796.WMF") returned -1
	[0054.146] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned="J0185790.WMF"
	[0054.146] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.146] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.146] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.146] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.147] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0185796.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF"
	[0054.147] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb1606f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb1606f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb1606f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8420, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185798.WMF", cAlternateFileName="")) returned 1
	[0054.147] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.187] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0185798.WMF") returned -1
	[0054.187] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0185798.WMF") returned -1
	[0054.187] lstrcmpiA (lpString1="", lpString2="J0185798.WMF") returned -1
	[0054.187] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF") returned="J0185796.WMF"
	[0054.187] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.187] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.187] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.187] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.187] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0185798.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF"
	[0054.187] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb1606f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb1606f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb1606f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5eae, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185800.WMF", cAlternateFileName="")) returned 1
	[0054.187] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.187] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0185800.WMF") returned -1
	[0054.187] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0185800.WMF") returned -1
	[0054.187] lstrcmpiA (lpString1="", lpString2="J0185800.WMF") returned -1
	[0054.187] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned="J0185798.WMF"
	[0054.187] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.187] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.187] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.187] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.188] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0185800.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF"
	[0054.188] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb1606f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb1606f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb1606f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x773a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185806.WMF", cAlternateFileName="")) returned 1
	[0054.188] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.188] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0185806.WMF") returned -1
	[0054.188] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0185806.WMF") returned -1
	[0054.188] lstrcmpiA (lpString1="", lpString2="J0185806.WMF") returned -1
	[0054.188] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned="J0185800.WMF"
	[0054.188] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.188] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.188] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.188] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.188] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0185806.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF"
	[0054.188] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb1606f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb1606f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb1606f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8b8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185818.WMF", cAlternateFileName="")) returned 1
	[0054.188] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.188] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0185818.WMF") returned -1
	[0054.188] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0185818.WMF") returned -1
	[0054.188] lstrcmpiA (lpString1="", lpString2="J0185818.WMF") returned -1
	[0054.188] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned="J0185806.WMF"
	[0054.188] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.188] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.188] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.188] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.188] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0185818.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF"
	[0054.188] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb1606f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb1606f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb1606f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1e74, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185828.WMF", cAlternateFileName="")) returned 1
	[0054.188] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.188] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0185828.WMF") returned -1
	[0054.189] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0185828.WMF") returned -1
	[0054.189] lstrcmpiA (lpString1="", lpString2="J0185828.WMF") returned -1
	[0054.189] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF") returned="J0185818.WMF"
	[0054.189] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.189] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.189] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.189] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.189] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0185828.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF"
	[0054.189] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb1606f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb1606f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb1606f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2182, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185834.WMF", cAlternateFileName="")) returned 1
	[0054.189] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.189] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0185834.WMF") returned -1
	[0054.189] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0185834.WMF") returned -1
	[0054.189] lstrcmpiA (lpString1="", lpString2="J0185834.WMF") returned -1
	[0054.189] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned="J0185828.WMF"
	[0054.189] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.189] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.189] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.189] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.189] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0185834.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF"
	[0054.189] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb1606f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb1606f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb1606f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x37e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185842.WMF", cAlternateFileName="")) returned 1
	[0054.189] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.189] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0185842.WMF") returned -1
	[0054.189] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0185842.WMF") returned -1
	[0054.189] lstrcmpiA (lpString1="", lpString2="J0185842.WMF") returned -1
	[0054.189] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned="J0185834.WMF"
	[0054.189] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.189] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.190] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.190] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.190] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0185842.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF"
	[0054.190] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb1606f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb1606f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb1606f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x21da, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0186346.WMF", cAlternateFileName="")) returned 1
	[0054.190] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.190] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0186346.WMF") returned -1
	[0054.190] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0186346.WMF") returned -1
	[0054.190] lstrcmpiA (lpString1="", lpString2="J0186346.WMF") returned -1
	[0054.190] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned="J0185842.WMF"
	[0054.190] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.190] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.190] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.190] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.190] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0186346.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF"
	[0054.190] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb3c2ce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb3c2ce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb3c2ce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x843a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0186360.WMF", cAlternateFileName="")) returned 1
	[0054.190] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.190] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0186360.WMF") returned -1
	[0054.190] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0186360.WMF") returned -1
	[0054.190] lstrcmpiA (lpString1="", lpString2="J0186360.WMF") returned -1
	[0054.190] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned="J0186346.WMF"
	[0054.190] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.190] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.190] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.190] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.190] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0186360.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF"
	[0054.191] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb1606f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb1606f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb3c2ce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x44fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0186362.WMF", cAlternateFileName="")) returned 1
	[0054.191] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.191] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0186362.WMF") returned -1
	[0054.191] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0186362.WMF") returned -1
	[0054.191] lstrcmpiA (lpString1="", lpString2="J0186362.WMF") returned -1
	[0054.191] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned="J0186360.WMF"
	[0054.191] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.191] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.191] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.191] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.191] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0186362.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF"
	[0054.191] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb1606f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb1606f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb3c2ce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4724, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0186364.WMF", cAlternateFileName="")) returned 1
	[0054.191] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.191] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0186364.WMF") returned -1
	[0054.191] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0186364.WMF") returned -1
	[0054.191] lstrcmpiA (lpString1="", lpString2="J0186364.WMF") returned -1
	[0054.191] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned="J0186362.WMF"
	[0054.191] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.191] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.191] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.191] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.191] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0186364.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF"
	[0054.191] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb1606f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb1606f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb3c2ce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x19c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187647.WMF", cAlternateFileName="")) returned 1
	[0054.191] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.191] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0187647.WMF") returned -1
	[0054.191] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0187647.WMF") returned -1
	[0054.192] lstrcmpiA (lpString1="", lpString2="J0187647.WMF") returned -1
	[0054.192] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned="J0186364.WMF"
	[0054.192] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.192] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.192] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.192] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.192] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0187647.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF"
	[0054.192] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb1606f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb1606f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb1606f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1500, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187815.WMF", cAlternateFileName="")) returned 1
	[0054.192] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.192] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0187815.WMF") returned -1
	[0054.192] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0187815.WMF") returned -1
	[0054.192] lstrcmpiA (lpString1="", lpString2="J0187815.WMF") returned -1
	[0054.192] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF") returned="J0187647.WMF"
	[0054.192] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.192] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.192] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.192] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.192] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0187815.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF"
	[0054.192] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb1606f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb1606f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb1606f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2d7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187817.WMF", cAlternateFileName="")) returned 1
	[0054.192] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.192] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0187817.WMF") returned -1
	[0054.192] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0187817.WMF") returned -1
	[0054.192] lstrcmpiA (lpString1="", lpString2="J0187817.WMF") returned -1
	[0054.192] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned="J0187815.WMF"
	[0054.192] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.193] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.193] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.193] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.193] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0187817.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF"
	[0054.193] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb1606f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb1606f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb3c2ce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2870, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187819.WMF", cAlternateFileName="")) returned 1
	[0054.193] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.193] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0187819.WMF") returned -1
	[0054.193] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0187819.WMF") returned -1
	[0054.193] lstrcmpiA (lpString1="", lpString2="J0187819.WMF") returned -1
	[0054.193] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned="J0187817.WMF"
	[0054.193] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.193] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.193] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.193] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.193] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0187819.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF"
	[0054.193] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb1606f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb1606f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb3c2ce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1d4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187825.WMF", cAlternateFileName="")) returned 1
	[0054.193] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.193] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0187825.WMF") returned -1
	[0054.193] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0187825.WMF") returned -1
	[0054.193] lstrcmpiA (lpString1="", lpString2="J0187825.WMF") returned -1
	[0054.194] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned="J0187819.WMF"
	[0054.194] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.194] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.194] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.194] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.194] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0187825.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF"
	[0054.194] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb1606f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb1606f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb1606f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3040, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187829.WMF", cAlternateFileName="")) returned 1
	[0054.194] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.194] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0187829.WMF") returned -1
	[0054.194] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0187829.WMF") returned -1
	[0054.194] lstrcmpiA (lpString1="", lpString2="J0187829.WMF") returned -1
	[0054.194] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned="J0187825.WMF"
	[0054.194] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.194] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.194] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.194] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.194] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0187829.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF"
	[0054.194] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb1606f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb1606f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb1606f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2480, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187835.WMF", cAlternateFileName="")) returned 1
	[0054.194] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.194] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0187835.WMF") returned -1
	[0054.195] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0187835.WMF") returned -1
	[0054.195] lstrcmpiA (lpString1="", lpString2="J0187835.WMF") returned -1
	[0054.195] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned="J0187829.WMF"
	[0054.195] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.195] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.195] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.195] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.195] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0187835.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF"
	[0054.195] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb3c2ce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb3c2ce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb3c2ce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3fe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187837.WMF", cAlternateFileName="")) returned 1
	[0054.195] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.195] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0187837.WMF") returned -1
	[0054.195] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0187837.WMF") returned -1
	[0054.195] lstrcmpiA (lpString1="", lpString2="J0187837.WMF") returned -1
	[0054.195] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned="J0187835.WMF"
	[0054.195] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.195] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.195] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.195] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.195] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0187837.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF"
	[0054.195] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb3c2ce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb3c2ce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb3c2ce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187839.WMF", cAlternateFileName="")) returned 1
	[0054.195] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.195] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0187839.WMF") returned -1
	[0054.195] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0187839.WMF") returned -1
	[0054.195] lstrcmpiA (lpString1="", lpString2="J0187839.WMF") returned -1
	[0054.195] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned="J0187837.WMF"
	[0054.196] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.196] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.196] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.196] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.196] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0187839.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF"
	[0054.196] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb3c2ce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb3c2ce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb3c2ce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1bcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187847.WMF", cAlternateFileName="")) returned 1
	[0054.196] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.196] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0187847.WMF") returned -1
	[0054.196] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0187847.WMF") returned -1
	[0054.196] lstrcmpiA (lpString1="", lpString2="J0187847.WMF") returned -1
	[0054.196] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF") returned="J0187839.WMF"
	[0054.196] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.196] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.196] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.196] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.196] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0187847.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF"
	[0054.196] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb3c2ce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb3c2ce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb3c2ce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1d94, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187849.WMF", cAlternateFileName="")) returned 1
	[0054.196] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.196] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0187849.WMF") returned -1
	[0054.196] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0187849.WMF") returned -1
	[0054.196] lstrcmpiA (lpString1="", lpString2="J0187849.WMF") returned -1
	[0054.196] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned="J0187847.WMF"
	[0054.196] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.196] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.196] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.196] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.197] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0187849.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF"
	[0054.197] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb3c2ce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb3c2ce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb3c2ce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x221c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187851.WMF", cAlternateFileName="")) returned 1
	[0054.197] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.197] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0187851.WMF") returned -1
	[0054.197] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0187851.WMF") returned -1
	[0054.197] lstrcmpiA (lpString1="", lpString2="J0187851.WMF") returned -1
	[0054.197] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned="J0187849.WMF"
	[0054.197] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.197] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.197] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.197] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.197] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0187851.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF"
	[0054.197] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb3c2ce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb3c2ce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb3c2ce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xaac, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187859.WMF", cAlternateFileName="")) returned 1
	[0054.197] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.197] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0187859.WMF") returned -1
	[0054.197] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0187859.WMF") returned -1
	[0054.197] lstrcmpiA (lpString1="", lpString2="J0187859.WMF") returned -1
	[0054.197] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned="J0187851.WMF"
	[0054.197] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.197] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.197] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.197] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.197] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0187859.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF"
	[0054.197] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb3c2ce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb3c2ce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb3c2ce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2394, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187861.WMF", cAlternateFileName="")) returned 1
	[0054.197] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.197] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0187861.WMF") returned -1
	[0054.198] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0187861.WMF") returned -1
	[0054.198] lstrcmpiA (lpString1="", lpString2="J0187861.WMF") returned -1
	[0054.198] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF") returned="J0187859.WMF"
	[0054.198] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.198] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.198] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.198] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.198] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0187861.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF"
	[0054.198] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb3c2ce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb3c2ce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb3c2ce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2a44, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187863.WMF", cAlternateFileName="")) returned 1
	[0054.199] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.199] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0187863.WMF") returned -1
	[0054.199] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0187863.WMF") returned -1
	[0054.199] lstrcmpiA (lpString1="", lpString2="J0187863.WMF") returned -1
	[0054.199] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned="J0187861.WMF"
	[0054.199] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.199] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.199] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.199] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.199] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0187863.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF"
	[0054.199] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb3c2ce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb3c2ce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb3c2ce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1258, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187881.WMF", cAlternateFileName="")) returned 1
	[0054.199] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.199] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0187881.WMF") returned -1
	[0054.199] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0187881.WMF") returned -1
	[0054.199] lstrcmpiA (lpString1="", lpString2="J0187881.WMF") returned -1
	[0054.199] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF") returned="J0187863.WMF"
	[0054.199] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.199] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.199] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.199] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.200] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0187881.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF"
	[0054.200] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb3c2ce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb3c2ce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb3c2ce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x834, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187883.WMF", cAlternateFileName="")) returned 1
	[0054.200] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.200] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0187883.WMF") returned -1
	[0054.200] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0187883.WMF") returned -1
	[0054.200] lstrcmpiA (lpString1="", lpString2="J0187883.WMF") returned -1
	[0054.200] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned="J0187881.WMF"
	[0054.200] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.200] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.200] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.200] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.200] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0187883.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF"
	[0054.200] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb62536, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb62536, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb62536, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x15f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187893.WMF", cAlternateFileName="")) returned 1
	[0054.200] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.200] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0187893.WMF") returned -1
	[0054.200] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0187893.WMF") returned -1
	[0054.200] lstrcmpiA (lpString1="", lpString2="J0187893.WMF") returned -1
	[0054.200] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF") returned="J0187883.WMF"
	[0054.200] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.200] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.200] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.200] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.201] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0187893.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF"
	[0054.201] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb62536, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb62536, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb62536, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187895.WMF", cAlternateFileName="")) returned 1
	[0054.201] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.201] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0187895.WMF") returned -1
	[0054.201] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0187895.WMF") returned -1
	[0054.201] lstrcmpiA (lpString1="", lpString2="J0187895.WMF") returned -1
	[0054.201] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF") returned="J0187893.WMF"
	[0054.201] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.201] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.201] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.201] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.201] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0187895.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF"
	[0054.201] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb62536, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb62536, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb62536, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1388, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187921.WMF", cAlternateFileName="")) returned 1
	[0054.201] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.201] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0187921.WMF") returned -1
	[0054.201] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0187921.WMF") returned -1
	[0054.201] lstrcmpiA (lpString1="", lpString2="J0187921.WMF") returned -1
	[0054.201] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned="J0187895.WMF"
	[0054.201] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.201] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.201] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.201] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.201] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0187921.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF"
	[0054.201] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb62536, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb62536, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb62536, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x29dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0188511.WMF", cAlternateFileName="")) returned 1
	[0054.201] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.202] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0188511.WMF") returned -1
	[0054.202] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0188511.WMF") returned -1
	[0054.202] lstrcmpiA (lpString1="", lpString2="J0188511.WMF") returned -1
	[0054.202] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF") returned="J0187921.WMF"
	[0054.202] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.202] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.202] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.202] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.202] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0188511.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF"
	[0054.202] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb62536, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb62536, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb62536, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3004, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0188513.WMF", cAlternateFileName="")) returned 1
	[0054.202] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.202] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0188513.WMF") returned -1
	[0054.202] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0188513.WMF") returned -1
	[0054.202] lstrcmpiA (lpString1="", lpString2="J0188513.WMF") returned -1
	[0054.202] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF") returned="J0188511.WMF"
	[0054.202] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.202] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.202] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.202] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.202] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0188513.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF"
	[0054.202] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb3c2ce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb3c2ce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb3c2ce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x16c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0188519.WMF", cAlternateFileName="")) returned 1
	[0054.202] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.202] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0188519.WMF") returned -1
	[0054.202] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0188519.WMF") returned -1
	[0054.202] lstrcmpiA (lpString1="", lpString2="J0188519.WMF") returned -1
	[0054.202] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF") returned="J0188513.WMF"
	[0054.202] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.202] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.203] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.203] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.203] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0188519.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF"
	[0054.203] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb62536, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb62536, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb62536, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3b5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0188587.WMF", cAlternateFileName="")) returned 1
	[0054.203] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.203] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0188587.WMF") returned -1
	[0054.203] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0188587.WMF") returned -1
	[0054.203] lstrcmpiA (lpString1="", lpString2="J0188587.WMF") returned -1
	[0054.203] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF") returned="J0188519.WMF"
	[0054.203] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.203] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.203] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.203] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.203] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0188587.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF"
	[0054.203] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb62536, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb62536, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb62536, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3e9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0188667.WMF", cAlternateFileName="")) returned 1
	[0054.203] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.203] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0188667.WMF") returned -1
	[0054.203] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0188667.WMF") returned -1
	[0054.203] lstrcmpiA (lpString1="", lpString2="J0188667.WMF") returned -1
	[0054.203] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF") returned="J0188587.WMF"
	[0054.203] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.203] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.203] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.203] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.203] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0188667.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF"
	[0054.204] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb62536, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb62536, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb62536, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x73a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0188669.WMF", cAlternateFileName="")) returned 1
	[0054.204] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.204] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0188669.WMF") returned -1
	[0054.204] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0188669.WMF") returned -1
	[0054.204] lstrcmpiA (lpString1="", lpString2="J0188669.WMF") returned -1
	[0054.204] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF") returned="J0188667.WMF"
	[0054.204] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.204] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.204] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.204] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.204] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0188669.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF"
	[0054.204] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb3c2ce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb3c2ce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb3c2ce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x336a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0188679.WMF", cAlternateFileName="")) returned 1
	[0054.204] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.204] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0188679.WMF") returned -1
	[0054.204] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0188679.WMF") returned -1
	[0054.204] lstrcmpiA (lpString1="", lpString2="J0188679.WMF") returned -1
	[0054.204] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF") returned="J0188669.WMF"
	[0054.204] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.204] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.204] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.204] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.204] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0188679.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF"
	[0054.204] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb88785, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb88785, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb88785, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1ca4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195248.WMF", cAlternateFileName="")) returned 1
	[0054.204] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.204] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0195248.WMF") returned -1
	[0054.204] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0195248.WMF") returned -1
	[0054.204] lstrcmpiA (lpString1="", lpString2="J0195248.WMF") returned -1
	[0054.205] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF") returned="J0188679.WMF"
	[0054.205] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.205] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.205] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.205] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.205] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0195248.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF"
	[0054.205] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb88785, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb88785, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb88785, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195254.WMF", cAlternateFileName="")) returned 1
	[0054.205] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.205] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0195254.WMF") returned -1
	[0054.205] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0195254.WMF") returned -1
	[0054.205] lstrcmpiA (lpString1="", lpString2="J0195254.WMF") returned -1
	[0054.205] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF") returned="J0195248.WMF"
	[0054.205] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.205] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.205] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.205] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.205] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0195254.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF"
	[0054.205] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb62536, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb62536, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb88785, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x207a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195260.WMF", cAlternateFileName="")) returned 1
	[0054.205] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.205] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0195260.WMF") returned -1
	[0054.205] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0195260.WMF") returned -1
	[0054.205] lstrcmpiA (lpString1="", lpString2="J0195260.WMF") returned -1
	[0054.205] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF") returned="J0195254.WMF"
	[0054.205] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.205] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.205] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.205] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.206] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0195260.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF"
	[0054.206] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb88785, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb88785, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb88785, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x72f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195320.WMF", cAlternateFileName="")) returned 1
	[0054.206] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.206] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0195320.WMF") returned -1
	[0054.206] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0195320.WMF") returned -1
	[0054.206] lstrcmpiA (lpString1="", lpString2="J0195320.WMF") returned -1
	[0054.206] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF") returned="J0195260.WMF"
	[0054.206] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.206] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.206] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.206] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.206] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0195320.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF"
	[0054.206] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb62536, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb62536, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb62536, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5350, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195342.WMF", cAlternateFileName="")) returned 1
	[0054.206] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.206] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0195342.WMF") returned -1
	[0054.206] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0195342.WMF") returned -1
	[0054.206] lstrcmpiA (lpString1="", lpString2="J0195342.WMF") returned -1
	[0054.206] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF") returned="J0195320.WMF"
	[0054.206] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.206] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.206] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.206] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.206] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0195342.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF"
	[0054.206] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb62536, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb62536, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb62536, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x48be, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195428.WMF", cAlternateFileName="")) returned 1
	[0054.206] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.207] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0195428.WMF") returned -1
	[0054.207] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0195428.WMF") returned -1
	[0054.207] lstrcmpiA (lpString1="", lpString2="J0195428.WMF") returned -1
	[0054.207] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF") returned="J0195342.WMF"
	[0054.207] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.207] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.207] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.207] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.207] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0195428.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF"
	[0054.207] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb62536, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb62536, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb62536, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe60, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195772.WMF", cAlternateFileName="")) returned 1
	[0054.207] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.207] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0195772.WMF") returned -1
	[0054.207] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0195772.WMF") returned -1
	[0054.207] lstrcmpiA (lpString1="", lpString2="J0195772.WMF") returned -1
	[0054.207] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF") returned="J0195428.WMF"
	[0054.207] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.207] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.207] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.207] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.207] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0195772.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF"
	[0054.207] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb62536, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb62536, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb62536, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195788.WMF", cAlternateFileName="")) returned 1
	[0054.207] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.207] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0195788.WMF") returned -1
	[0054.207] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0195788.WMF") returned -1
	[0054.207] lstrcmpiA (lpString1="", lpString2="J0195788.WMF") returned -1
	[0054.207] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF") returned="J0195772.WMF"
	[0054.207] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.207] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.208] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.208] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.208] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0195788.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF"
	[0054.208] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb62536, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb62536, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb62536, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x128e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196060.WMF", cAlternateFileName="")) returned 1
	[0054.208] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.208] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0196060.WMF") returned -1
	[0054.208] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0196060.WMF") returned -1
	[0054.208] lstrcmpiA (lpString1="", lpString2="J0196060.WMF") returned -1
	[0054.208] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF") returned="J0195788.WMF"
	[0054.208] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.208] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.208] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.208] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.208] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0196060.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF"
	[0054.208] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb62536, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb62536, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb62536, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196110.WMF", cAlternateFileName="")) returned 1
	[0054.208] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.208] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0196110.WMF") returned -1
	[0054.208] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0196110.WMF") returned -1
	[0054.208] lstrcmpiA (lpString1="", lpString2="J0196110.WMF") returned -1
	[0054.208] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF") returned="J0196060.WMF"
	[0054.208] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.208] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.208] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.208] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.208] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0196110.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF"
	[0054.209] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebae9de, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebae9de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebae9de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xef2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196142.WMF", cAlternateFileName="")) returned 1
	[0054.209] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.209] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0196142.WMF") returned -1
	[0054.209] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0196142.WMF") returned -1
	[0054.209] lstrcmpiA (lpString1="", lpString2="J0196142.WMF") returned -1
	[0054.209] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF") returned="J0196110.WMF"
	[0054.209] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.209] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.209] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.209] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.209] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0196142.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF"
	[0054.209] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebae9de, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebae9de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebae9de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3586, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196354.WMF", cAlternateFileName="")) returned 1
	[0054.209] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.209] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0196354.WMF") returned -1
	[0054.209] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0196354.WMF") returned -1
	[0054.209] lstrcmpiA (lpString1="", lpString2="J0196354.WMF") returned -1
	[0054.209] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF") returned="J0196142.WMF"
	[0054.209] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.209] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.209] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.209] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.209] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0196354.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF"
	[0054.209] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb88785, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb88785, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb88785, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196358.WMF", cAlternateFileName="")) returned 1
	[0054.209] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.209] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0196358.WMF") returned -1
	[0054.209] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0196358.WMF") returned -1
	[0054.209] lstrcmpiA (lpString1="", lpString2="J0196358.WMF") returned -1
	[0054.209] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF") returned="J0196354.WMF"
	[0054.210] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.210] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.210] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.210] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.210] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0196358.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF"
	[0054.210] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb88785, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb88785, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb88785, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x164c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196364.WMF", cAlternateFileName="")) returned 1
	[0054.210] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.210] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0196364.WMF") returned -1
	[0054.210] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0196364.WMF") returned -1
	[0054.210] lstrcmpiA (lpString1="", lpString2="J0196364.WMF") returned -1
	[0054.210] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF") returned="J0196358.WMF"
	[0054.210] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.210] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.210] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.210] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.210] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0196364.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF"
	[0054.210] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb88785, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb88785, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb88785, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9d26, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0197979.WMF", cAlternateFileName="")) returned 1
	[0054.210] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.210] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0197979.WMF") returned -1
	[0054.210] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0197979.WMF") returned -1
	[0054.210] lstrcmpiA (lpString1="", lpString2="J0197979.WMF") returned -1
	[0054.210] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF") returned="J0196364.WMF"
	[0054.210] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.210] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.210] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.210] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.211] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0197979.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF"
	[0054.211] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb88785, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb88785, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb88785, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x668c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0197983.WMF", cAlternateFileName="")) returned 1
	[0054.211] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.211] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0197983.WMF") returned -1
	[0054.211] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0197983.WMF") returned -1
	[0054.211] lstrcmpiA (lpString1="", lpString2="J0197983.WMF") returned -1
	[0054.211] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF") returned="J0197979.WMF"
	[0054.211] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.211] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.211] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.211] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.211] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0197983.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF"
	[0054.211] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb88785, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb88785, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb88785, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x849c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198016.WMF", cAlternateFileName="")) returned 1
	[0054.211] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.211] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0198016.WMF") returned -1
	[0054.211] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0198016.WMF") returned -1
	[0054.211] lstrcmpiA (lpString1="", lpString2="J0198016.WMF") returned -1
	[0054.211] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF") returned="J0197983.WMF"
	[0054.211] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.211] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.211] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.211] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.211] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0198016.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198016.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198016.WMF"
	[0054.211] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb88785, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb88785, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb88785, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5cae, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198020.WMF", cAlternateFileName="")) returned 1
	[0054.211] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.211] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0198020.WMF") returned -1
	[0054.212] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0198020.WMF") returned -1
	[0054.212] lstrcmpiA (lpString1="", lpString2="J0198020.WMF") returned -1
	[0054.212] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198016.WMF") returned="J0198016.WMF"
	[0054.212] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.212] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.212] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.212] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.212] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0198020.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF"
	[0054.212] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb88785, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb88785, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb88785, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8860, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198021.WMF", cAlternateFileName="")) returned 1
	[0054.212] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.212] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0198021.WMF") returned -1
	[0054.212] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0198021.WMF") returned -1
	[0054.212] lstrcmpiA (lpString1="", lpString2="J0198021.WMF") returned -1
	[0054.212] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF") returned="J0198020.WMF"
	[0054.212] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.212] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.212] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.212] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.212] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0198021.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF"
	[0054.212] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb88785, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb88785, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb88785, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6624, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198022.WMF", cAlternateFileName="")) returned 1
	[0054.212] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.212] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0198022.WMF") returned -1
	[0054.212] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0198022.WMF") returned -1
	[0054.212] lstrcmpiA (lpString1="", lpString2="J0198022.WMF") returned -1
	[0054.212] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF") returned="J0198021.WMF"
	[0054.212] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.212] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.212] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.213] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.213] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0198022.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF"
	[0054.213] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebae9de, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebae9de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebae9de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3cce, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198025.WMF", cAlternateFileName="")) returned 1
	[0054.213] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.213] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0198025.WMF") returned -1
	[0054.213] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0198025.WMF") returned -1
	[0054.213] lstrcmpiA (lpString1="", lpString2="J0198025.WMF") returned -1
	[0054.213] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF") returned="J0198022.WMF"
	[0054.213] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.213] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.213] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.213] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.213] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0198025.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198025.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198025.WMF"
	[0054.213] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebae9de, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebae9de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebae9de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd6b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198102.WMF", cAlternateFileName="")) returned 1
	[0054.215] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.215] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0198102.WMF") returned -1
	[0054.215] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0198102.WMF") returned -1
	[0054.215] lstrcmpiA (lpString1="", lpString2="J0198102.WMF") returned -1
	[0054.215] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198025.WMF") returned="J0198025.WMF"
	[0054.215] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.215] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.215] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.215] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.215] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0198102.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF"
	[0054.215] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebae9de, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebae9de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebae9de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa520, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198113.WMF", cAlternateFileName="")) returned 1
	[0054.215] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.215] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0198113.WMF") returned -1
	[0054.215] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0198113.WMF") returned -1
	[0054.215] lstrcmpiA (lpString1="", lpString2="J0198113.WMF") returned -1
	[0054.215] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF") returned="J0198102.WMF"
	[0054.215] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.215] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.216] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.216] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.216] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0198113.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF"
	[0054.216] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebae9de, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebae9de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebae9de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa3b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198226.WMF", cAlternateFileName="")) returned 1
	[0054.216] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.216] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0198226.WMF") returned -1
	[0054.216] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0198226.WMF") returned -1
	[0054.216] lstrcmpiA (lpString1="", lpString2="J0198226.WMF") returned -1
	[0054.216] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF") returned="J0198113.WMF"
	[0054.216] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.216] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.216] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.216] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.216] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0198226.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF"
	[0054.216] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebae9de, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebae9de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebae9de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa69e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198234.WMF", cAlternateFileName="")) returned 1
	[0054.216] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.216] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0198234.WMF") returned -1
	[0054.216] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0198234.WMF") returned -1
	[0054.216] lstrcmpiA (lpString1="", lpString2="J0198234.WMF") returned -1
	[0054.216] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF") returned="J0198226.WMF"
	[0054.216] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.216] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.216] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.216] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.216] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0198234.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198234.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198234.WMF"
	[0054.217] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebae9de, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebae9de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebae9de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6f9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198372.WMF", cAlternateFileName="")) returned 1
	[0054.217] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.217] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0198372.WMF") returned -1
	[0054.217] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0198372.WMF") returned -1
	[0054.217] lstrcmpiA (lpString1="", lpString2="J0198372.WMF") returned -1
	[0054.217] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198234.WMF") returned="J0198234.WMF"
	[0054.217] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.217] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.217] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.217] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.217] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0198372.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF"
	[0054.217] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebae9de, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebae9de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebae9de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9d6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198377.WMF", cAlternateFileName="")) returned 1
	[0054.217] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.217] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0198377.WMF") returned -1
	[0054.217] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0198377.WMF") returned -1
	[0054.217] lstrcmpiA (lpString1="", lpString2="J0198377.WMF") returned -1
	[0054.217] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF") returned="J0198372.WMF"
	[0054.217] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.217] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.217] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.217] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.217] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0198377.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF"
	[0054.217] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebae9de, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebae9de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebae9de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198447.WMF", cAlternateFileName="")) returned 1
	[0054.217] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.217] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0198447.WMF") returned -1
	[0054.217] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0198447.WMF") returned -1
	[0054.218] lstrcmpiA (lpString1="", lpString2="J0198447.WMF") returned -1
	[0054.218] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF") returned="J0198377.WMF"
	[0054.218] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.218] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.218] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.218] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.218] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0198447.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF"
	[0054.218] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebae9de, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebae9de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebae9de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xae08, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198494.WMF", cAlternateFileName="")) returned 1
	[0054.218] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.218] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0198494.WMF") returned -1
	[0054.218] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0198494.WMF") returned -1
	[0054.218] lstrcmpiA (lpString1="", lpString2="J0198494.WMF") returned -1
	[0054.218] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF") returned="J0198447.WMF"
	[0054.218] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.218] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.218] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.218] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.218] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0198494.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198494.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198494.WMF"
	[0054.218] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebae9de, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebae9de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebae9de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198712.WMF", cAlternateFileName="")) returned 1
	[0054.218] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.218] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198494.WMF") returned="J0198494.WMF"
	[0054.218] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.218] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.218] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.219] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.219] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0198712.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF"
	[0054.219] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebd4c33, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebd4c33, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebd4c33, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x714e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199279.WMF", cAlternateFileName="")) returned 1
	[0054.219] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.219] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF") returned="J0198712.WMF"
	[0054.219] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.219] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.219] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.219] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.219] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0199279.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF"
	[0054.219] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebd4c33, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebd4c33, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebd4c33, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7c4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199303.WMF", cAlternateFileName="")) returned 1
	[0054.219] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.219] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF") returned="J0199279.WMF"
	[0054.219] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.219] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.219] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.219] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.219] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0199303.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF"
	[0054.219] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebd4c33, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebd4c33, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebd4c33, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199307.WMF", cAlternateFileName="")) returned 1
	[0054.219] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.219] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF") returned="J0199303.WMF"
	[0054.219] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.219] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.219] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.220] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.220] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0199307.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199307.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199307.WMF"
	[0054.220] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebd4c33, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebd4c33, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebd4c33, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x662a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199423.WMF", cAlternateFileName="")) returned 1
	[0054.220] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.220] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199307.WMF") returned="J0199307.WMF"
	[0054.220] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.220] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.220] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.220] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.220] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0199423.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF"
	[0054.220] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebd4c33, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebd4c33, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebd4c33, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199429.WMF", cAlternateFileName="")) returned 1
	[0054.220] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.220] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF") returned="J0199423.WMF"
	[0054.220] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.220] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.220] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.220] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.220] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0199429.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199429.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199429.WMF"
	[0054.220] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebd4c33, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebd4c33, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebd4c33, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199465.WMF", cAlternateFileName="")) returned 1
	[0054.220] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.220] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199429.WMF") returned="J0199429.WMF"
	[0054.220] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.220] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.221] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.221] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.221] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0199465.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF"
	[0054.221] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebd4c33, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebd4c33, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebd4c33, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x35bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199469.WMF", cAlternateFileName="")) returned 1
	[0054.221] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.221] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF") returned="J0199465.WMF"
	[0054.221] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.221] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.221] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.221] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.221] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0199469.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF"
	[0054.221] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebd4c33, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebd4c33, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebd4c33, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199473.WMF", cAlternateFileName="")) returned 1
	[0054.221] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.221] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF") returned="J0199469.WMF"
	[0054.221] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.221] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.221] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.221] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.221] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0199473.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF"
	[0054.221] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebd4c33, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebd4c33, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebd4c33, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1484, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199475.WMF", cAlternateFileName="")) returned 1
	[0054.221] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.221] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF") returned="J0199473.WMF"
	[0054.221] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.221] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.222] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.222] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.222] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0199475.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199475.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199475.WMF"
	[0054.222] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebae9de, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebae9de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebd4c33, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x27b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199483.WMF", cAlternateFileName="")) returned 1
	[0054.222] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.222] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199475.WMF") returned="J0199475.WMF"
	[0054.222] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.222] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.222] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.222] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.222] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0199483.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF"
	[0054.222] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebfae8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebfae8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebfae8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x302c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199609.WMF", cAlternateFileName="")) returned 1
	[0054.222] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.222] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF") returned="J0199483.WMF"
	[0054.222] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.222] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.222] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.222] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.222] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0199609.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF"
	[0054.222] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebfae8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebfae8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebfae8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2004, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200151.WMF", cAlternateFileName="")) returned 1
	[0054.222] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.222] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF") returned="J0199609.WMF"
	[0054.222] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.223] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.223] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.223] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.223] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0200151.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF"
	[0054.223] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebfae8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebfae8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebfae8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200163.WMF", cAlternateFileName="")) returned 1
	[0054.223] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.223] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF") returned="J0200151.WMF"
	[0054.223] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.223] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.223] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.223] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.223] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0200163.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200163.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200163.WMF"
	[0054.223] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebfae8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebfae8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebfae8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200183.WMF", cAlternateFileName="")) returned 1
	[0054.223] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.223] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200163.WMF") returned="J0200163.WMF"
	[0054.223] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.223] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.223] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.223] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.223] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0200183.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF"
	[0054.223] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebfae8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebfae8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebfae8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200189.WMF", cAlternateFileName="")) returned 1
	[0054.223] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.223] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF") returned="J0200183.WMF"
	[0054.223] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.224] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.224] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.224] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.224] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0200189.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF"
	[0054.224] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebd4c33, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebd4c33, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebd4c33, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7a46, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200273.WMF", cAlternateFileName="")) returned 1
	[0054.224] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.224] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF") returned="J0200189.WMF"
	[0054.224] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.224] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.224] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.224] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.224] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0200273.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF"
	[0054.224] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebfae8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebfae8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebfae8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4c0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200279.WMF", cAlternateFileName="")) returned 1
	[0054.224] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.224] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF") returned="J0200273.WMF"
	[0054.224] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.224] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.224] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.224] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.224] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0200279.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200279.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200279.WMF"
	[0054.224] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebd4c33, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebd4c33, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebd4c33, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa0b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200289.WMF", cAlternateFileName="")) returned 1
	[0054.224] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.224] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200279.WMF") returned="J0200279.WMF"
	[0054.225] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.225] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.225] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.225] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.225] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0200289.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF"
	[0054.225] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebd4c33, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebd4c33, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebd4c33, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f08, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200377.WMF", cAlternateFileName="")) returned 1
	[0054.225] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.225] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF") returned="J0200289.WMF"
	[0054.225] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.225] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.225] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.225] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.225] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0200377.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF"
	[0054.225] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebd4c33, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebd4c33, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebd4c33, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5398, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200383.WMF", cAlternateFileName="")) returned 1
	[0054.225] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.225] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF") returned="J0200377.WMF"
	[0054.225] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.225] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.225] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.225] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec210f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec210f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec210f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x366e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200467.WMF", cAlternateFileName="")) returned 1
	[0054.225] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.225] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF") returned="J0200383.WMF"
	[0054.225] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.226] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.226] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.226] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebfae8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebfae8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebfae8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x273e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200521.WMF", cAlternateFileName="")) returned 1
	[0054.226] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.226] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.226] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.226] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebfae8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebfae8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebfae8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf36, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200611.WMF", cAlternateFileName="")) returned 1
	[0054.226] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.226] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.226] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.226] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebfae8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebfae8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebfae8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa50e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0202045.JPG", cAlternateFileName="")) returned 1
	[0054.226] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.226] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.226] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.226] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0202045.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0054.267] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa50e
	[0054.267] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xebfae8f, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xebfae8f, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xebfae8f, dwHighDateTime=0x1d327e8)) returned 1
	[0054.267] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.268] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xa4cc, lpOverlapped=0x0) returned 1
	[0054.271] CloseHandle (hObject=0x214) returned 1
	[0054.271] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0202045.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0202045.jpg.exe")) returned 1
	[0054.272] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec210f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec210f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec210f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6e74, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0211981.WMF", cAlternateFileName="")) returned 1
	[0054.272] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.272] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.272] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.zip") returned 0
	[0054.272] lstrlenA (lpString="*.zip") returned 5
	[0054.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.rar") returned 0
	[0054.272] lstrlenA (lpString="*.rar") returned 5
	[0054.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.7z") returned 0
	[0054.272] lstrlenA (lpString="*.7z") returned 4
	[0054.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.tar") returned 0
	[0054.272] lstrlenA (lpString="*.tar") returned 5
	[0054.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.gzip") returned 0
	[0054.272] lstrlenA (lpString="*.gzip") returned 6
	[0054.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.jpg") returned 0
	[0054.273] lstrlenA (lpString="*.jpg") returned 5
	[0054.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.jpeg") returned 0
	[0054.273] lstrlenA (lpString="*.jpeg") returned 6
	[0054.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.bmp") returned 0
	[0054.273] lstrlenA (lpString="*.bmp") returned 5
	[0054.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.gif") returned 0
	[0054.273] lstrlenA (lpString="*.gif") returned 5
	[0054.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.png") returned 0
	[0054.273] lstrlenA (lpString="*.png") returned 5
	[0054.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.doc") returned 0
	[0054.273] lstrlenA (lpString="*.doc") returned 5
	[0054.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.docx") returned 0
	[0054.273] lstrlenA (lpString="*.docx") returned 6
	[0054.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.xls") returned 0
	[0054.273] lstrlenA (lpString="*.xls") returned 5
	[0054.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.xlsx") returned 0
	[0054.273] lstrlenA (lpString="*.xlsx") returned 6
	[0054.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.ppt") returned 0
	[0054.273] lstrlenA (lpString="*.ppt") returned 5
	[0054.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.pptx") returned 0
	[0054.273] lstrlenA (lpString="*.pptx") returned 6
	[0054.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.txt") returned 0
	[0054.273] lstrlenA (lpString="*.txt") returned 5
	[0054.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.pdf") returned 0
	[0054.273] lstrlenA (lpString="*.pdf") returned 5
	[0054.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.htm") returned 0
	[0054.273] lstrlenA (lpString="*.htm") returned 5
	[0054.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.html") returned 0
	[0054.273] lstrlenA (lpString="*.html") returned 6
	[0054.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.mdb") returned 0
	[0054.273] lstrlenA (lpString="*.mdb") returned 5
	[0054.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.pfx") returned 0
	[0054.273] lstrlenA (lpString="*.pfx") returned 5
	[0054.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.md") returned 0
	[0054.273] lstrlenA (lpString="*.md") returned 4
	[0054.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.lnk") returned 0
	[0054.274] lstrlenA (lpString="*.lnk") returned 5
	[0054.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.torrent") returned 0
	[0054.274] lstrlenA (lpString="*.torrent") returned 9
	[0054.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.mov") returned 0
	[0054.274] lstrlenA (lpString="*.mov") returned 5
	[0054.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.3gp") returned 0
	[0054.274] lstrlenA (lpString="*.3gp") returned 5
	[0054.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.mpeg") returned 0
	[0054.274] lstrlenA (lpString="*.mpeg") returned 6
	[0054.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.mpg") returned 0
	[0054.274] lstrlenA (lpString="*.mpg") returned 5
	[0054.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.flv") returned 0
	[0054.274] lstrlenA (lpString="*.flv") returned 5
	[0054.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.avi") returned 0
	[0054.274] lstrlenA (lpString="*.avi") returned 5
	[0054.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.mp4") returned 0
	[0054.274] lstrlenA (lpString="*.mp4") returned 5
	[0054.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.wmv") returned 0
	[0054.274] lstrlenA (lpString="*.wmv") returned 5
	[0054.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.mkv") returned 0
	[0054.274] lstrlenA (lpString="*.mkv") returned 5
	[0054.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.mp3") returned 0
	[0054.274] lstrlenA (lpString="*.mp3") returned 5
	[0054.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.wav") returned 0
	[0054.274] lstrlenA (lpString="*.wav") returned 5
	[0054.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.flac") returned 0
	[0054.274] lstrlenA (lpString="*.flac") returned 6
	[0054.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.wma") returned 0
	[0054.274] lstrlenA (lpString="*.wma") returned 5
	[0054.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.au3") returned 0
	[0054.274] lstrlenA (lpString="*.au3") returned 5
	[0054.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.ahk") returned 0
	[0054.274] lstrlenA (lpString="*.ahk") returned 5
	[0054.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.c") returned 0
	[0054.274] lstrlenA (lpString="*.c") returned 3
	[0054.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.cc") returned 0
	[0054.275] lstrlenA (lpString="*.cc") returned 4
	[0054.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.cpp") returned 0
	[0054.275] lstrlenA (lpString="*.cpp") returned 5
	[0054.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.cxx") returned 0
	[0054.275] lstrlenA (lpString="*.cxx") returned 5
	[0054.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.c++") returned 0
	[0054.275] lstrlenA (lpString="*.c++") returned 5
	[0054.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.cs") returned 0
	[0054.275] lstrlenA (lpString="*.cs") returned 4
	[0054.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.vb") returned 0
	[0054.275] lstrlenA (lpString="*.vb") returned 4
	[0054.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.bas") returned 0
	[0054.275] lstrlenA (lpString="*.bas") returned 5
	[0054.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.csproj") returned 0
	[0054.275] lstrlenA (lpString="*.csproj") returned 8
	[0054.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.vbproj") returned 0
	[0054.275] lstrlenA (lpString="*.vbproj") returned 8
	[0054.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.vcxproj") returned 0
	[0054.275] lstrlenA (lpString="*.vcxproj") returned 9
	[0054.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.manifest") returned 0
	[0054.275] lstrlenA (lpString="*.manifest") returned 10
	[0054.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.php") returned 0
	[0054.275] lstrlenA (lpString="*.php") returned 5
	[0054.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.vbe") returned 0
	[0054.275] lstrlenA (lpString="*.vbe") returned 5
	[0054.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.vba") returned 0
	[0054.275] lstrlenA (lpString="*.vba") returned 5
	[0054.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.vbs") returned 0
	[0054.275] lstrlenA (lpString="*.vbs") returned 5
	[0054.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.bat") returned 0
	[0054.275] lstrlenA (lpString="*.bat") returned 5
	[0054.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.cmd") returned 0
	[0054.275] lstrlenA (lpString="*.cmd") returned 5
	[0054.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.js") returned 0
	[0054.275] lstrlenA (lpString="*.js") returned 4
	[0054.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.jscript") returned 0
	[0054.275] lstrlenA (lpString="*.jscript") returned 9
	[0054.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.hta") returned 0
	[0054.276] lstrlenA (lpString="*.hta") returned 5
	[0054.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.php7") returned 0
	[0054.276] lstrlenA (lpString="*.php7") returned 6
	[0054.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.db") returned 0
	[0054.276] lstrlenA (lpString="*.db") returned 4
	[0054.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.swf") returned 0
	[0054.276] lstrlenA (lpString="*.swf") returned 5
	[0054.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.eml") returned 0
	[0054.276] lstrlenA (lpString="*.eml") returned 5
	[0054.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.part") returned 0
	[0054.276] lstrlenA (lpString="*.part") returned 6
	[0054.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.nfo") returned 0
	[0054.276] lstrlenA (lpString="*.nfo") returned 5
	[0054.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.rsa") returned 0
	[0054.276] lstrlenA (lpString="*.rsa") returned 5
	[0054.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.key") returned 0
	[0054.276] lstrlenA (lpString="*.key") returned 5
	[0054.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.aes") returned 0
	[0054.276] lstrlenA (lpString="*.aes") returned 5
	[0054.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.blob") returned 0
	[0054.276] lstrlenA (lpString="*.blob") returned 6
	[0054.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.btc") returned 0
	[0054.276] lstrlenA (lpString="*.btc") returned 5
	[0054.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF", pszSpec="*.wallet") returned 0
	[0054.276] lstrlenA (lpString="*.wallet") returned 8
	[0054.276] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebfae8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebfae8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebfae8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x180e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212299.WMF", cAlternateFileName="")) returned 1
	[0054.277] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.277] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0212299.WMF") returned -1
	[0054.277] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0212299.WMF") returned -1
	[0054.277] lstrcmpiA (lpString1="", lpString2="J0212299.WMF") returned -1
	[0054.277] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.277] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.277] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.277] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.277] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0212299.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF"
	[0054.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.zip") returned 0
	[0054.277] lstrlenA (lpString="*.zip") returned 5
	[0054.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.rar") returned 0
	[0054.277] lstrlenA (lpString="*.rar") returned 5
	[0054.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.7z") returned 0
	[0054.277] lstrlenA (lpString="*.7z") returned 4
	[0054.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.tar") returned 0
	[0054.277] lstrlenA (lpString="*.tar") returned 5
	[0054.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.gzip") returned 0
	[0054.277] lstrlenA (lpString="*.gzip") returned 6
	[0054.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.jpg") returned 0
	[0054.277] lstrlenA (lpString="*.jpg") returned 5
	[0054.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.jpeg") returned 0
	[0054.277] lstrlenA (lpString="*.jpeg") returned 6
	[0054.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.bmp") returned 0
	[0054.277] lstrlenA (lpString="*.bmp") returned 5
	[0054.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.gif") returned 0
	[0054.278] lstrlenA (lpString="*.gif") returned 5
	[0054.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.png") returned 0
	[0054.278] lstrlenA (lpString="*.png") returned 5
	[0054.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.doc") returned 0
	[0054.278] lstrlenA (lpString="*.doc") returned 5
	[0054.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.docx") returned 0
	[0054.278] lstrlenA (lpString="*.docx") returned 6
	[0054.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.xls") returned 0
	[0054.278] lstrlenA (lpString="*.xls") returned 5
	[0054.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.xlsx") returned 0
	[0054.278] lstrlenA (lpString="*.xlsx") returned 6
	[0054.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.ppt") returned 0
	[0054.278] lstrlenA (lpString="*.ppt") returned 5
	[0054.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.pptx") returned 0
	[0054.278] lstrlenA (lpString="*.pptx") returned 6
	[0054.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.txt") returned 0
	[0054.278] lstrlenA (lpString="*.txt") returned 5
	[0054.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.pdf") returned 0
	[0054.278] lstrlenA (lpString="*.pdf") returned 5
	[0054.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.htm") returned 0
	[0054.278] lstrlenA (lpString="*.htm") returned 5
	[0054.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.html") returned 0
	[0054.279] lstrlenA (lpString="*.html") returned 6
	[0054.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.mdb") returned 0
	[0054.279] lstrlenA (lpString="*.mdb") returned 5
	[0054.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.pfx") returned 0
	[0054.279] lstrlenA (lpString="*.pfx") returned 5
	[0054.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.md") returned 0
	[0054.279] lstrlenA (lpString="*.md") returned 4
	[0054.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.lnk") returned 0
	[0054.279] lstrlenA (lpString="*.lnk") returned 5
	[0054.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.torrent") returned 0
	[0054.279] lstrlenA (lpString="*.torrent") returned 9
	[0054.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.mov") returned 0
	[0054.279] lstrlenA (lpString="*.mov") returned 5
	[0054.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.3gp") returned 0
	[0054.279] lstrlenA (lpString="*.3gp") returned 5
	[0054.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.mpeg") returned 0
	[0054.279] lstrlenA (lpString="*.mpeg") returned 6
	[0054.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.mpg") returned 0
	[0054.279] lstrlenA (lpString="*.mpg") returned 5
	[0054.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.flv") returned 0
	[0054.279] lstrlenA (lpString="*.flv") returned 5
	[0054.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.avi") returned 0
	[0054.279] lstrlenA (lpString="*.avi") returned 5
	[0054.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.mp4") returned 0
	[0054.279] lstrlenA (lpString="*.mp4") returned 5
	[0054.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.wmv") returned 0
	[0054.279] lstrlenA (lpString="*.wmv") returned 5
	[0054.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.mkv") returned 0
	[0054.279] lstrlenA (lpString="*.mkv") returned 5
	[0054.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.mp3") returned 0
	[0054.279] lstrlenA (lpString="*.mp3") returned 5
	[0054.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.wav") returned 0
	[0054.279] lstrlenA (lpString="*.wav") returned 5
	[0054.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.flac") returned 0
	[0054.279] lstrlenA (lpString="*.flac") returned 6
	[0054.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.wma") returned 0
	[0054.279] lstrlenA (lpString="*.wma") returned 5
	[0054.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.au3") returned 0
	[0054.280] lstrlenA (lpString="*.au3") returned 5
	[0054.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.ahk") returned 0
	[0054.280] lstrlenA (lpString="*.ahk") returned 5
	[0054.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.c") returned 0
	[0054.280] lstrlenA (lpString="*.c") returned 3
	[0054.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.cc") returned 0
	[0054.280] lstrlenA (lpString="*.cc") returned 4
	[0054.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.cpp") returned 0
	[0054.280] lstrlenA (lpString="*.cpp") returned 5
	[0054.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.cxx") returned 0
	[0054.280] lstrlenA (lpString="*.cxx") returned 5
	[0054.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.c++") returned 0
	[0054.280] lstrlenA (lpString="*.c++") returned 5
	[0054.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.cs") returned 0
	[0054.280] lstrlenA (lpString="*.cs") returned 4
	[0054.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.vb") returned 0
	[0054.280] lstrlenA (lpString="*.vb") returned 4
	[0054.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.bas") returned 0
	[0054.280] lstrlenA (lpString="*.bas") returned 5
	[0054.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.csproj") returned 0
	[0054.280] lstrlenA (lpString="*.csproj") returned 8
	[0054.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.vbproj") returned 0
	[0054.280] lstrlenA (lpString="*.vbproj") returned 8
	[0054.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.vcxproj") returned 0
	[0054.280] lstrlenA (lpString="*.vcxproj") returned 9
	[0054.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.manifest") returned 0
	[0054.280] lstrlenA (lpString="*.manifest") returned 10
	[0054.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.php") returned 0
	[0054.280] lstrlenA (lpString="*.php") returned 5
	[0054.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.vbe") returned 0
	[0054.280] lstrlenA (lpString="*.vbe") returned 5
	[0054.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.vba") returned 0
	[0054.280] lstrlenA (lpString="*.vba") returned 5
	[0054.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.vbs") returned 0
	[0054.280] lstrlenA (lpString="*.vbs") returned 5
	[0054.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.bat") returned 0
	[0054.281] lstrlenA (lpString="*.bat") returned 5
	[0054.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.cmd") returned 0
	[0054.281] lstrlenA (lpString="*.cmd") returned 5
	[0054.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.js") returned 0
	[0054.281] lstrlenA (lpString="*.js") returned 4
	[0054.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.jscript") returned 0
	[0054.281] lstrlenA (lpString="*.jscript") returned 9
	[0054.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.hta") returned 0
	[0054.281] lstrlenA (lpString="*.hta") returned 5
	[0054.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.php7") returned 0
	[0054.281] lstrlenA (lpString="*.php7") returned 6
	[0054.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.db") returned 0
	[0054.281] lstrlenA (lpString="*.db") returned 4
	[0054.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.swf") returned 0
	[0054.281] lstrlenA (lpString="*.swf") returned 5
	[0054.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.eml") returned 0
	[0054.281] lstrlenA (lpString="*.eml") returned 5
	[0054.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.part") returned 0
	[0054.281] lstrlenA (lpString="*.part") returned 6
	[0054.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.nfo") returned 0
	[0054.281] lstrlenA (lpString="*.nfo") returned 5
	[0054.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.rsa") returned 0
	[0054.281] lstrlenA (lpString="*.rsa") returned 5
	[0054.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.key") returned 0
	[0054.281] lstrlenA (lpString="*.key") returned 5
	[0054.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.aes") returned 0
	[0054.281] lstrlenA (lpString="*.aes") returned 5
	[0054.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.blob") returned 0
	[0054.281] lstrlenA (lpString="*.blob") returned 6
	[0054.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.btc") returned 0
	[0054.281] lstrlenA (lpString="*.btc") returned 5
	[0054.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF", pszSpec="*.wallet") returned 0
	[0054.281] lstrlenA (lpString="*.wallet") returned 8
	[0054.281] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebfae8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebfae8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebfae8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x25cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212601.WMF", cAlternateFileName="")) returned 1
	[0054.281] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.281] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0212601.WMF") returned -1
	[0054.282] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0212601.WMF") returned -1
	[0054.282] lstrcmpiA (lpString1="", lpString2="J0212601.WMF") returned -1
	[0054.282] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF") returned="J0212299.WMF"
	[0054.282] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.282] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.282] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.282] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.282] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0212601.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF"
	[0054.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.zip") returned 0
	[0054.282] lstrlenA (lpString="*.zip") returned 5
	[0054.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.rar") returned 0
	[0054.282] lstrlenA (lpString="*.rar") returned 5
	[0054.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.7z") returned 0
	[0054.282] lstrlenA (lpString="*.7z") returned 4
	[0054.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.tar") returned 0
	[0054.282] lstrlenA (lpString="*.tar") returned 5
	[0054.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.gzip") returned 0
	[0054.282] lstrlenA (lpString="*.gzip") returned 6
	[0054.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.jpg") returned 0
	[0054.282] lstrlenA (lpString="*.jpg") returned 5
	[0054.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.jpeg") returned 0
	[0054.282] lstrlenA (lpString="*.jpeg") returned 6
	[0054.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.bmp") returned 0
	[0054.282] lstrlenA (lpString="*.bmp") returned 5
	[0054.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.gif") returned 0
	[0054.282] lstrlenA (lpString="*.gif") returned 5
	[0054.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.png") returned 0
	[0054.282] lstrlenA (lpString="*.png") returned 5
	[0054.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.doc") returned 0
	[0054.282] lstrlenA (lpString="*.doc") returned 5
	[0054.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.docx") returned 0
	[0054.282] lstrlenA (lpString="*.docx") returned 6
	[0054.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.xls") returned 0
	[0054.282] lstrlenA (lpString="*.xls") returned 5
	[0054.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.xlsx") returned 0
	[0054.283] lstrlenA (lpString="*.xlsx") returned 6
	[0054.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.ppt") returned 0
	[0054.283] lstrlenA (lpString="*.ppt") returned 5
	[0054.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.pptx") returned 0
	[0054.283] lstrlenA (lpString="*.pptx") returned 6
	[0054.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.txt") returned 0
	[0054.283] lstrlenA (lpString="*.txt") returned 5
	[0054.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.pdf") returned 0
	[0054.283] lstrlenA (lpString="*.pdf") returned 5
	[0054.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.htm") returned 0
	[0054.283] lstrlenA (lpString="*.htm") returned 5
	[0054.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.html") returned 0
	[0054.283] lstrlenA (lpString="*.html") returned 6
	[0054.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.mdb") returned 0
	[0054.283] lstrlenA (lpString="*.mdb") returned 5
	[0054.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.pfx") returned 0
	[0054.283] lstrlenA (lpString="*.pfx") returned 5
	[0054.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.md") returned 0
	[0054.283] lstrlenA (lpString="*.md") returned 4
	[0054.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.lnk") returned 0
	[0054.283] lstrlenA (lpString="*.lnk") returned 5
	[0054.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.torrent") returned 0
	[0054.283] lstrlenA (lpString="*.torrent") returned 9
	[0054.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.mov") returned 0
	[0054.283] lstrlenA (lpString="*.mov") returned 5
	[0054.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.3gp") returned 0
	[0054.283] lstrlenA (lpString="*.3gp") returned 5
	[0054.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.mpeg") returned 0
	[0054.283] lstrlenA (lpString="*.mpeg") returned 6
	[0054.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.mpg") returned 0
	[0054.283] lstrlenA (lpString="*.mpg") returned 5
	[0054.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.flv") returned 0
	[0054.283] lstrlenA (lpString="*.flv") returned 5
	[0054.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.avi") returned 0
	[0054.283] lstrlenA (lpString="*.avi") returned 5
	[0054.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.mp4") returned 0
	[0054.284] lstrlenA (lpString="*.mp4") returned 5
	[0054.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.wmv") returned 0
	[0054.284] lstrlenA (lpString="*.wmv") returned 5
	[0054.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.mkv") returned 0
	[0054.284] lstrlenA (lpString="*.mkv") returned 5
	[0054.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.mp3") returned 0
	[0054.284] lstrlenA (lpString="*.mp3") returned 5
	[0054.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.wav") returned 0
	[0054.284] lstrlenA (lpString="*.wav") returned 5
	[0054.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.flac") returned 0
	[0054.284] lstrlenA (lpString="*.flac") returned 6
	[0054.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.wma") returned 0
	[0054.284] lstrlenA (lpString="*.wma") returned 5
	[0054.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.au3") returned 0
	[0054.284] lstrlenA (lpString="*.au3") returned 5
	[0054.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.ahk") returned 0
	[0054.284] lstrlenA (lpString="*.ahk") returned 5
	[0054.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.c") returned 0
	[0054.284] lstrlenA (lpString="*.c") returned 3
	[0054.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.cc") returned 0
	[0054.284] lstrlenA (lpString="*.cc") returned 4
	[0054.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.cpp") returned 0
	[0054.284] lstrlenA (lpString="*.cpp") returned 5
	[0054.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.cxx") returned 0
	[0054.284] lstrlenA (lpString="*.cxx") returned 5
	[0054.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.c++") returned 0
	[0054.284] lstrlenA (lpString="*.c++") returned 5
	[0054.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.cs") returned 0
	[0054.284] lstrlenA (lpString="*.cs") returned 4
	[0054.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.vb") returned 0
	[0054.284] lstrlenA (lpString="*.vb") returned 4
	[0054.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.bas") returned 0
	[0054.284] lstrlenA (lpString="*.bas") returned 5
	[0054.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.csproj") returned 0
	[0054.284] lstrlenA (lpString="*.csproj") returned 8
	[0054.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.vbproj") returned 0
	[0054.284] lstrlenA (lpString="*.vbproj") returned 8
	[0054.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.vcxproj") returned 0
	[0054.285] lstrlenA (lpString="*.vcxproj") returned 9
	[0054.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.manifest") returned 0
	[0054.285] lstrlenA (lpString="*.manifest") returned 10
	[0054.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.php") returned 0
	[0054.285] lstrlenA (lpString="*.php") returned 5
	[0054.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.vbe") returned 0
	[0054.285] lstrlenA (lpString="*.vbe") returned 5
	[0054.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.vba") returned 0
	[0054.285] lstrlenA (lpString="*.vba") returned 5
	[0054.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.vbs") returned 0
	[0054.285] lstrlenA (lpString="*.vbs") returned 5
	[0054.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.bat") returned 0
	[0054.285] lstrlenA (lpString="*.bat") returned 5
	[0054.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.cmd") returned 0
	[0054.285] lstrlenA (lpString="*.cmd") returned 5
	[0054.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.js") returned 0
	[0054.285] lstrlenA (lpString="*.js") returned 4
	[0054.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.jscript") returned 0
	[0054.285] lstrlenA (lpString="*.jscript") returned 9
	[0054.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.hta") returned 0
	[0054.285] lstrlenA (lpString="*.hta") returned 5
	[0054.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.php7") returned 0
	[0054.285] lstrlenA (lpString="*.php7") returned 6
	[0054.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.db") returned 0
	[0054.285] lstrlenA (lpString="*.db") returned 4
	[0054.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.swf") returned 0
	[0054.285] lstrlenA (lpString="*.swf") returned 5
	[0054.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.eml") returned 0
	[0054.285] lstrlenA (lpString="*.eml") returned 5
	[0054.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.part") returned 0
	[0054.285] lstrlenA (lpString="*.part") returned 6
	[0054.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.nfo") returned 0
	[0054.285] lstrlenA (lpString="*.nfo") returned 5
	[0054.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.rsa") returned 0
	[0054.285] lstrlenA (lpString="*.rsa") returned 5
	[0054.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.key") returned 0
	[0054.286] lstrlenA (lpString="*.key") returned 5
	[0054.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.aes") returned 0
	[0054.286] lstrlenA (lpString="*.aes") returned 5
	[0054.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.blob") returned 0
	[0054.286] lstrlenA (lpString="*.blob") returned 6
	[0054.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.btc") returned 0
	[0054.286] lstrlenA (lpString="*.btc") returned 5
	[0054.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF", pszSpec="*.wallet") returned 0
	[0054.286] lstrlenA (lpString="*.wallet") returned 8
	[0054.286] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebfae8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebfae8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec210f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x199a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212685.WMF", cAlternateFileName="")) returned 1
	[0054.286] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.286] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0212685.WMF") returned -1
	[0054.286] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0212685.WMF") returned -1
	[0054.286] lstrcmpiA (lpString1="", lpString2="J0212685.WMF") returned -1
	[0054.286] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF") returned="J0212601.WMF"
	[0054.286] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.286] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.286] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.286] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.286] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0212685.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF"
	[0054.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.zip") returned 0
	[0054.286] lstrlenA (lpString="*.zip") returned 5
	[0054.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.rar") returned 0
	[0054.286] lstrlenA (lpString="*.rar") returned 5
	[0054.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.7z") returned 0
	[0054.286] lstrlenA (lpString="*.7z") returned 4
	[0054.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.tar") returned 0
	[0054.286] lstrlenA (lpString="*.tar") returned 5
	[0054.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.gzip") returned 0
	[0054.286] lstrlenA (lpString="*.gzip") returned 6
	[0054.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.jpg") returned 0
	[0054.286] lstrlenA (lpString="*.jpg") returned 5
	[0054.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.jpeg") returned 0
	[0054.287] lstrlenA (lpString="*.jpeg") returned 6
	[0054.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.bmp") returned 0
	[0054.287] lstrlenA (lpString="*.bmp") returned 5
	[0054.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.gif") returned 0
	[0054.287] lstrlenA (lpString="*.gif") returned 5
	[0054.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.png") returned 0
	[0054.287] lstrlenA (lpString="*.png") returned 5
	[0054.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.doc") returned 0
	[0054.287] lstrlenA (lpString="*.doc") returned 5
	[0054.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.docx") returned 0
	[0054.287] lstrlenA (lpString="*.docx") returned 6
	[0054.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.xls") returned 0
	[0054.287] lstrlenA (lpString="*.xls") returned 5
	[0054.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.xlsx") returned 0
	[0054.287] lstrlenA (lpString="*.xlsx") returned 6
	[0054.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.ppt") returned 0
	[0054.287] lstrlenA (lpString="*.ppt") returned 5
	[0054.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.pptx") returned 0
	[0054.287] lstrlenA (lpString="*.pptx") returned 6
	[0054.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.txt") returned 0
	[0054.287] lstrlenA (lpString="*.txt") returned 5
	[0054.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.pdf") returned 0
	[0054.287] lstrlenA (lpString="*.pdf") returned 5
	[0054.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.htm") returned 0
	[0054.287] lstrlenA (lpString="*.htm") returned 5
	[0054.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.html") returned 0
	[0054.287] lstrlenA (lpString="*.html") returned 6
	[0054.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.mdb") returned 0
	[0054.287] lstrlenA (lpString="*.mdb") returned 5
	[0054.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.pfx") returned 0
	[0054.287] lstrlenA (lpString="*.pfx") returned 5
	[0054.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.md") returned 0
	[0054.287] lstrlenA (lpString="*.md") returned 4
	[0054.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.lnk") returned 0
	[0054.287] lstrlenA (lpString="*.lnk") returned 5
	[0054.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.torrent") returned 0
	[0054.287] lstrlenA (lpString="*.torrent") returned 9
	[0054.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.mov") returned 0
	[0054.288] lstrlenA (lpString="*.mov") returned 5
	[0054.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.3gp") returned 0
	[0054.288] lstrlenA (lpString="*.3gp") returned 5
	[0054.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.mpeg") returned 0
	[0054.288] lstrlenA (lpString="*.mpeg") returned 6
	[0054.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.mpg") returned 0
	[0054.288] lstrlenA (lpString="*.mpg") returned 5
	[0054.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF", pszSpec="*.flv") returned 0
	[0054.288] lstrlenA (lpString="*.flv") returned 5
	[0054.288] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebfae8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebfae8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebfae8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x80c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212751.WMF", cAlternateFileName="")) returned 1
	[0054.288] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.288] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0212751.WMF") returned -1
	[0054.288] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0212751.WMF") returned -1
	[0054.288] lstrcmpiA (lpString1="", lpString2="J0212751.WMF") returned -1
	[0054.288] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF") returned="J0212685.WMF"
	[0054.288] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.288] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.288] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.288] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.288] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0212751.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212751.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212751.WMF"
	[0054.288] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebfae8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebfae8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebfae8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212953.WMF", cAlternateFileName="")) returned 1
	[0054.289] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.289] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0212953.WMF") returned -1
	[0054.289] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0212953.WMF") returned -1
	[0054.289] lstrcmpiA (lpString1="", lpString2="J0212953.WMF") returned -1
	[0054.289] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212751.WMF") returned="J0212751.WMF"
	[0054.289] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.289] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.289] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.289] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.289] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0212953.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF"
	[0054.289] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45328f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf45328f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf45328f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0213243.WMF", cAlternateFileName="")) returned 1
	[0054.289] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.289] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0213243.WMF") returned -1
	[0054.289] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0213243.WMF") returned -1
	[0054.289] lstrcmpiA (lpString1="", lpString2="J0213243.WMF") returned -1
	[0054.289] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF") returned="J0212953.WMF"
	[0054.289] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.289] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.289] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.289] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.289] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0213243.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF"
	[0054.289] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec210f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec210f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec210f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf00, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0213449.WMF", cAlternateFileName="")) returned 1
	[0054.289] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.289] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0213449.WMF") returned -1
	[0054.289] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0213449.WMF") returned -1
	[0054.289] lstrcmpiA (lpString1="", lpString2="J0213449.WMF") returned -1
	[0054.289] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF") returned="J0213243.WMF"
	[0054.289] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.290] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.290] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.290] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.290] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0213449.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF"
	[0054.290] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec210f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec210f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec210f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7cb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0214934.WMF", cAlternateFileName="")) returned 1
	[0054.290] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.331] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0214934.WMF") returned -1
	[0054.331] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0214934.WMF") returned -1
	[0054.331] lstrcmpiA (lpString1="", lpString2="J0214934.WMF") returned -1
	[0054.331] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF") returned="J0213449.WMF"
	[0054.331] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.331] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.331] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.331] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.331] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0214934.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214934.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214934.WMF"
	[0054.332] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec210f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec210f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec210f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xaefa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0214948.WMF", cAlternateFileName="")) returned 1
	[0054.332] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.332] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0214948.WMF") returned -1
	[0054.332] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0214948.WMF") returned -1
	[0054.332] lstrcmpiA (lpString1="", lpString2="J0214948.WMF") returned -1
	[0054.332] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214934.WMF") returned="J0214934.WMF"
	[0054.332] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.332] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.332] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.332] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.332] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0214948.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF"
	[0054.332] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebfae8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebfae8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec210f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2d6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0215070.WMF", cAlternateFileName="")) returned 1
	[0054.332] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.332] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0215070.WMF") returned -1
	[0054.332] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0215070.WMF") returned -1
	[0054.332] lstrcmpiA (lpString1="", lpString2="J0215070.WMF") returned -1
	[0054.332] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF") returned="J0214948.WMF"
	[0054.332] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.332] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.332] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.332] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.332] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0215070.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF"
	[0054.332] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec210f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec210f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec210f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f50, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0215076.WMF", cAlternateFileName="")) returned 1
	[0054.332] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.332] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0215076.WMF") returned -1
	[0054.332] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0215076.WMF") returned -1
	[0054.332] lstrcmpiA (lpString1="", lpString2="J0215076.WMF") returned -1
	[0054.332] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF") returned="J0215070.WMF"
	[0054.333] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.333] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.333] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.333] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.333] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0215076.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF"
	[0054.333] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec210f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec210f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec210f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x81ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0215210.WMF", cAlternateFileName="")) returned 1
	[0054.333] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.333] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0215210.WMF") returned -1
	[0054.333] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0215210.WMF") returned -1
	[0054.333] lstrcmpiA (lpString1="", lpString2="J0215210.WMF") returned -1
	[0054.333] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF") returned="J0215076.WMF"
	[0054.333] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.333] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.333] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.333] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.333] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0215210.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215210.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215210.WMF"
	[0054.333] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebfae8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebfae8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec210f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x244a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0215709.WMF", cAlternateFileName="")) returned 1
	[0054.333] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.333] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0215709.WMF") returned -1
	[0054.333] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0215709.WMF") returned -1
	[0054.333] lstrcmpiA (lpString1="", lpString2="J0215709.WMF") returned -1
	[0054.333] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215210.WMF") returned="J0215210.WMF"
	[0054.333] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.333] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.333] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.333] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.334] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0215709.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF"
	[0054.334] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebfae8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebfae8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebfae8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x45a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0215710.WMF", cAlternateFileName="")) returned 1
	[0054.334] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.334] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0215710.WMF") returned -1
	[0054.334] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0215710.WMF") returned -1
	[0054.334] lstrcmpiA (lpString1="", lpString2="J0215710.WMF") returned -1
	[0054.334] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF") returned="J0215709.WMF"
	[0054.334] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.334] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.334] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.334] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.334] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0215710.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF"
	[0054.334] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebfae8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebfae8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebfae8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x15f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0215718.WMF", cAlternateFileName="")) returned 1
	[0054.334] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.334] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0215718.WMF") returned -1
	[0054.334] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0215718.WMF") returned -1
	[0054.334] lstrcmpiA (lpString1="", lpString2="J0215718.WMF") returned -1
	[0054.334] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF") returned="J0215710.WMF"
	[0054.334] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.334] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.334] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.334] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.334] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0215718.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF"
	[0054.334] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec9380a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec9380a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf42d018, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa783, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216112.JPG", cAlternateFileName="")) returned 1
	[0054.334] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.335] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0216112.JPG") returned -1
	[0054.335] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0216112.JPG") returned -1
	[0054.335] lstrcmpiA (lpString1="", lpString2="J0216112.JPG") returned -1
	[0054.335] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF") returned="J0215718.WMF"
	[0054.335] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.335] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.335] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.335] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.335] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0216112.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG"
	[0054.335] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG"
	[0054.335] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG"
	[0054.335] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG."
	[0054.335] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG.exe"
	[0054.335] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216112.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0054.335] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa783
	[0054.335] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xec9380a, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xec9380a, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf42d018, dwHighDateTime=0x1d327e8)) returned 1
	[0054.335] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.335] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xa741, lpOverlapped=0x0) returned 1
	[0054.337] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG") returned="J0216112.JPG"
	[0054.337] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.337] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xa741, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xa741, lpOverlapped=0x0) returned 1
	[0054.337] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.337] CloseHandle (hObject=0x214) returned 1
	[0054.339] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216112.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216112.jpg.exe")) returned 1
	[0054.340] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec9380a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec9380a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec9380a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5474, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216153.JPG", cAlternateFileName="")) returned 1
	[0054.340] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.340] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0216153.JPG") returned -1
	[0054.340] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0216153.JPG") returned -1
	[0054.340] lstrcmpiA (lpString1="", lpString2="J0216153.JPG") returned -1
	[0054.340] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG") returned="J0216112.JPG"
	[0054.340] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.340] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.340] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.340] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.340] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0216153.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG"
	[0054.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG", pszSpec="*.zip") returned 0
	[0054.341] lstrlenA (lpString="*.zip") returned 5
	[0054.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG", pszSpec="*.rar") returned 0
	[0054.341] lstrlenA (lpString="*.rar") returned 5
	[0054.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG", pszSpec="*.7z") returned 0
	[0054.341] lstrlenA (lpString="*.7z") returned 4
	[0054.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG", pszSpec="*.tar") returned 0
	[0054.341] lstrlenA (lpString="*.tar") returned 5
	[0054.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG", pszSpec="*.gzip") returned 0
	[0054.341] lstrlenA (lpString="*.gzip") returned 6
	[0054.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG", pszSpec="*.jpg") returned 1
	[0054.341] lstrlenA (lpString="*.jpg") returned 5
	[0054.341] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG"
	[0054.341] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG"
	[0054.341] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG."
	[0054.341] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG.exe"
	[0054.341] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0054.341] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5474
	[0054.341] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xec9380a, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xec9380a, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xec9380a, dwHighDateTime=0x1d327e8)) returned 1
	[0054.341] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.342] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x5432, lpOverlapped=0x0) returned 1
	[0054.343] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG") returned="J0216153.JPG"
	[0054.344] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.344] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x5432, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x5432, lpOverlapped=0x0) returned 1
	[0054.344] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.344] CloseHandle (hObject=0x214) returned 1
	[0054.345] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216153.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216153.jpg.exe")) returned 1
	[0054.345] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec9380a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec9380a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf42d018, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa488, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216540.WMF", cAlternateFileName="")) returned 1
	[0054.345] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.345] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0216540.WMF") returned -1
	[0054.345] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0216540.WMF") returned -1
	[0054.345] lstrcmpiA (lpString1="", lpString2="J0216540.WMF") returned -1
	[0054.345] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG") returned="J0216153.JPG"
	[0054.346] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.346] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.346] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.346] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.346] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0216540.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF"
	[0054.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.zip") returned 0
	[0054.346] lstrlenA (lpString="*.zip") returned 5
	[0054.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.rar") returned 0
	[0054.346] lstrlenA (lpString="*.rar") returned 5
	[0054.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.7z") returned 0
	[0054.346] lstrlenA (lpString="*.7z") returned 4
	[0054.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.tar") returned 0
	[0054.346] lstrlenA (lpString="*.tar") returned 5
	[0054.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.gzip") returned 0
	[0054.346] lstrlenA (lpString="*.gzip") returned 6
	[0054.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.jpg") returned 0
	[0054.346] lstrlenA (lpString="*.jpg") returned 5
	[0054.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.jpeg") returned 0
	[0054.346] lstrlenA (lpString="*.jpeg") returned 6
	[0054.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.bmp") returned 0
	[0054.346] lstrlenA (lpString="*.bmp") returned 5
	[0054.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.gif") returned 0
	[0054.346] lstrlenA (lpString="*.gif") returned 5
	[0054.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.png") returned 0
	[0054.346] lstrlenA (lpString="*.png") returned 5
	[0054.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.doc") returned 0
	[0054.346] lstrlenA (lpString="*.doc") returned 5
	[0054.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.docx") returned 0
	[0054.346] lstrlenA (lpString="*.docx") returned 6
	[0054.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.xls") returned 0
	[0054.346] lstrlenA (lpString="*.xls") returned 5
	[0054.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.xlsx") returned 0
	[0054.346] lstrlenA (lpString="*.xlsx") returned 6
	[0054.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.ppt") returned 0
	[0054.347] lstrlenA (lpString="*.ppt") returned 5
	[0054.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.pptx") returned 0
	[0054.347] lstrlenA (lpString="*.pptx") returned 6
	[0054.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.txt") returned 0
	[0054.347] lstrlenA (lpString="*.txt") returned 5
	[0054.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.pdf") returned 0
	[0054.347] lstrlenA (lpString="*.pdf") returned 5
	[0054.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.htm") returned 0
	[0054.347] lstrlenA (lpString="*.htm") returned 5
	[0054.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.html") returned 0
	[0054.347] lstrlenA (lpString="*.html") returned 6
	[0054.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.mdb") returned 0
	[0054.347] lstrlenA (lpString="*.mdb") returned 5
	[0054.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.pfx") returned 0
	[0054.347] lstrlenA (lpString="*.pfx") returned 5
	[0054.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.md") returned 0
	[0054.347] lstrlenA (lpString="*.md") returned 4
	[0054.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.lnk") returned 0
	[0054.347] lstrlenA (lpString="*.lnk") returned 5
	[0054.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.torrent") returned 0
	[0054.347] lstrlenA (lpString="*.torrent") returned 9
	[0054.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.mov") returned 0
	[0054.347] lstrlenA (lpString="*.mov") returned 5
	[0054.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.3gp") returned 0
	[0054.347] lstrlenA (lpString="*.3gp") returned 5
	[0054.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.mpeg") returned 0
	[0054.347] lstrlenA (lpString="*.mpeg") returned 6
	[0054.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.mpg") returned 0
	[0054.347] lstrlenA (lpString="*.mpg") returned 5
	[0054.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.flv") returned 0
	[0054.347] lstrlenA (lpString="*.flv") returned 5
	[0054.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.avi") returned 0
	[0054.347] lstrlenA (lpString="*.avi") returned 5
	[0054.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.mp4") returned 0
	[0054.347] lstrlenA (lpString="*.mp4") returned 5
	[0054.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.wmv") returned 0
	[0054.348] lstrlenA (lpString="*.wmv") returned 5
	[0054.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.mkv") returned 0
	[0054.348] lstrlenA (lpString="*.mkv") returned 5
	[0054.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.mp3") returned 0
	[0054.348] lstrlenA (lpString="*.mp3") returned 5
	[0054.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.wav") returned 0
	[0054.348] lstrlenA (lpString="*.wav") returned 5
	[0054.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.flac") returned 0
	[0054.348] lstrlenA (lpString="*.flac") returned 6
	[0054.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.wma") returned 0
	[0054.348] lstrlenA (lpString="*.wma") returned 5
	[0054.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.au3") returned 0
	[0054.348] lstrlenA (lpString="*.au3") returned 5
	[0054.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.ahk") returned 0
	[0054.348] lstrlenA (lpString="*.ahk") returned 5
	[0054.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.c") returned 0
	[0054.348] lstrlenA (lpString="*.c") returned 3
	[0054.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.cc") returned 0
	[0054.348] lstrlenA (lpString="*.cc") returned 4
	[0054.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.cpp") returned 0
	[0054.348] lstrlenA (lpString="*.cpp") returned 5
	[0054.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.cxx") returned 0
	[0054.348] lstrlenA (lpString="*.cxx") returned 5
	[0054.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.c++") returned 0
	[0054.348] lstrlenA (lpString="*.c++") returned 5
	[0054.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.cs") returned 0
	[0054.348] lstrlenA (lpString="*.cs") returned 4
	[0054.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.vb") returned 0
	[0054.348] lstrlenA (lpString="*.vb") returned 4
	[0054.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.bas") returned 0
	[0054.348] lstrlenA (lpString="*.bas") returned 5
	[0054.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.csproj") returned 0
	[0054.348] lstrlenA (lpString="*.csproj") returned 8
	[0054.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.vbproj") returned 0
	[0054.348] lstrlenA (lpString="*.vbproj") returned 8
	[0054.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.vcxproj") returned 0
	[0054.349] lstrlenA (lpString="*.vcxproj") returned 9
	[0054.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.manifest") returned 0
	[0054.349] lstrlenA (lpString="*.manifest") returned 10
	[0054.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.php") returned 0
	[0054.349] lstrlenA (lpString="*.php") returned 5
	[0054.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.vbe") returned 0
	[0054.349] lstrlenA (lpString="*.vbe") returned 5
	[0054.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.vba") returned 0
	[0054.349] lstrlenA (lpString="*.vba") returned 5
	[0054.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.vbs") returned 0
	[0054.349] lstrlenA (lpString="*.vbs") returned 5
	[0054.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.bat") returned 0
	[0054.349] lstrlenA (lpString="*.bat") returned 5
	[0054.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.cmd") returned 0
	[0054.349] lstrlenA (lpString="*.cmd") returned 5
	[0054.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.js") returned 0
	[0054.349] lstrlenA (lpString="*.js") returned 4
	[0054.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.jscript") returned 0
	[0054.349] lstrlenA (lpString="*.jscript") returned 9
	[0054.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.hta") returned 0
	[0054.349] lstrlenA (lpString="*.hta") returned 5
	[0054.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.php7") returned 0
	[0054.349] lstrlenA (lpString="*.php7") returned 6
	[0054.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.db") returned 0
	[0054.349] lstrlenA (lpString="*.db") returned 4
	[0054.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.swf") returned 0
	[0054.349] lstrlenA (lpString="*.swf") returned 5
	[0054.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.eml") returned 0
	[0054.349] lstrlenA (lpString="*.eml") returned 5
	[0054.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.part") returned 0
	[0054.349] lstrlenA (lpString="*.part") returned 6
	[0054.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.nfo") returned 0
	[0054.349] lstrlenA (lpString="*.nfo") returned 5
	[0054.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.rsa") returned 0
	[0054.349] lstrlenA (lpString="*.rsa") returned 5
	[0054.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.key") returned 0
	[0054.349] lstrlenA (lpString="*.key") returned 5
	[0054.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.aes") returned 0
	[0054.350] lstrlenA (lpString="*.aes") returned 5
	[0054.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.blob") returned 0
	[0054.350] lstrlenA (lpString="*.blob") returned 6
	[0054.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.btc") returned 0
	[0054.350] lstrlenA (lpString="*.btc") returned 5
	[0054.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF", pszSpec="*.wallet") returned 0
	[0054.350] lstrlenA (lpString="*.wallet") returned 8
	[0054.350] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec9380a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec9380a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec9380a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x60dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216570.WMF", cAlternateFileName="")) returned 1
	[0054.350] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.350] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0216570.WMF") returned -1
	[0054.350] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0216570.WMF") returned -1
	[0054.350] lstrcmpiA (lpString1="", lpString2="J0216570.WMF") returned -1
	[0054.350] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF") returned="J0216540.WMF"
	[0054.350] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.350] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.350] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.350] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.350] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0216570.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF"
	[0054.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.zip") returned 0
	[0054.350] lstrlenA (lpString="*.zip") returned 5
	[0054.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.rar") returned 0
	[0054.350] lstrlenA (lpString="*.rar") returned 5
	[0054.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.7z") returned 0
	[0054.350] lstrlenA (lpString="*.7z") returned 4
	[0054.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.tar") returned 0
	[0054.350] lstrlenA (lpString="*.tar") returned 5
	[0054.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.gzip") returned 0
	[0054.350] lstrlenA (lpString="*.gzip") returned 6
	[0054.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.jpg") returned 0
	[0054.350] lstrlenA (lpString="*.jpg") returned 5
	[0054.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.jpeg") returned 0
	[0054.350] lstrlenA (lpString="*.jpeg") returned 6
	[0054.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.bmp") returned 0
	[0054.351] lstrlenA (lpString="*.bmp") returned 5
	[0054.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.gif") returned 0
	[0054.351] lstrlenA (lpString="*.gif") returned 5
	[0054.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.png") returned 0
	[0054.351] lstrlenA (lpString="*.png") returned 5
	[0054.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.doc") returned 0
	[0054.351] lstrlenA (lpString="*.doc") returned 5
	[0054.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.docx") returned 0
	[0054.351] lstrlenA (lpString="*.docx") returned 6
	[0054.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.xls") returned 0
	[0054.351] lstrlenA (lpString="*.xls") returned 5
	[0054.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.xlsx") returned 0
	[0054.351] lstrlenA (lpString="*.xlsx") returned 6
	[0054.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.ppt") returned 0
	[0054.351] lstrlenA (lpString="*.ppt") returned 5
	[0054.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.pptx") returned 0
	[0054.351] lstrlenA (lpString="*.pptx") returned 6
	[0054.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.txt") returned 0
	[0054.351] lstrlenA (lpString="*.txt") returned 5
	[0054.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.pdf") returned 0
	[0054.351] lstrlenA (lpString="*.pdf") returned 5
	[0054.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.htm") returned 0
	[0054.351] lstrlenA (lpString="*.htm") returned 5
	[0054.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.html") returned 0
	[0054.351] lstrlenA (lpString="*.html") returned 6
	[0054.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.mdb") returned 0
	[0054.351] lstrlenA (lpString="*.mdb") returned 5
	[0054.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.pfx") returned 0
	[0054.351] lstrlenA (lpString="*.pfx") returned 5
	[0054.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.md") returned 0
	[0054.351] lstrlenA (lpString="*.md") returned 4
	[0054.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.lnk") returned 0
	[0054.351] lstrlenA (lpString="*.lnk") returned 5
	[0054.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.torrent") returned 0
	[0054.351] lstrlenA (lpString="*.torrent") returned 9
	[0054.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.mov") returned 0
	[0054.351] lstrlenA (lpString="*.mov") returned 5
	[0054.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.3gp") returned 0
	[0054.352] lstrlenA (lpString="*.3gp") returned 5
	[0054.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.mpeg") returned 0
	[0054.352] lstrlenA (lpString="*.mpeg") returned 6
	[0054.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.mpg") returned 0
	[0054.352] lstrlenA (lpString="*.mpg") returned 5
	[0054.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.flv") returned 0
	[0054.352] lstrlenA (lpString="*.flv") returned 5
	[0054.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.avi") returned 0
	[0054.352] lstrlenA (lpString="*.avi") returned 5
	[0054.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.mp4") returned 0
	[0054.352] lstrlenA (lpString="*.mp4") returned 5
	[0054.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.wmv") returned 0
	[0054.352] lstrlenA (lpString="*.wmv") returned 5
	[0054.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.mkv") returned 0
	[0054.352] lstrlenA (lpString="*.mkv") returned 5
	[0054.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.mp3") returned 0
	[0054.352] lstrlenA (lpString="*.mp3") returned 5
	[0054.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.wav") returned 0
	[0054.352] lstrlenA (lpString="*.wav") returned 5
	[0054.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.flac") returned 0
	[0054.352] lstrlenA (lpString="*.flac") returned 6
	[0054.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.wma") returned 0
	[0054.352] lstrlenA (lpString="*.wma") returned 5
	[0054.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.au3") returned 0
	[0054.352] lstrlenA (lpString="*.au3") returned 5
	[0054.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.ahk") returned 0
	[0054.352] lstrlenA (lpString="*.ahk") returned 5
	[0054.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.c") returned 0
	[0054.352] lstrlenA (lpString="*.c") returned 3
	[0054.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.cc") returned 0
	[0054.352] lstrlenA (lpString="*.cc") returned 4
	[0054.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.cpp") returned 0
	[0054.352] lstrlenA (lpString="*.cpp") returned 5
	[0054.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.cxx") returned 0
	[0054.352] lstrlenA (lpString="*.cxx") returned 5
	[0054.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.c++") returned 0
	[0054.353] lstrlenA (lpString="*.c++") returned 5
	[0054.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.cs") returned 0
	[0054.353] lstrlenA (lpString="*.cs") returned 4
	[0054.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.vb") returned 0
	[0054.353] lstrlenA (lpString="*.vb") returned 4
	[0054.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.bas") returned 0
	[0054.353] lstrlenA (lpString="*.bas") returned 5
	[0054.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.csproj") returned 0
	[0054.353] lstrlenA (lpString="*.csproj") returned 8
	[0054.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.vbproj") returned 0
	[0054.353] lstrlenA (lpString="*.vbproj") returned 8
	[0054.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.vcxproj") returned 0
	[0054.353] lstrlenA (lpString="*.vcxproj") returned 9
	[0054.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.manifest") returned 0
	[0054.353] lstrlenA (lpString="*.manifest") returned 10
	[0054.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.php") returned 0
	[0054.353] lstrlenA (lpString="*.php") returned 5
	[0054.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.vbe") returned 0
	[0054.353] lstrlenA (lpString="*.vbe") returned 5
	[0054.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.vba") returned 0
	[0054.353] lstrlenA (lpString="*.vba") returned 5
	[0054.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.vbs") returned 0
	[0054.353] lstrlenA (lpString="*.vbs") returned 5
	[0054.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.bat") returned 0
	[0054.353] lstrlenA (lpString="*.bat") returned 5
	[0054.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.cmd") returned 0
	[0054.353] lstrlenA (lpString="*.cmd") returned 5
	[0054.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.js") returned 0
	[0054.353] lstrlenA (lpString="*.js") returned 4
	[0054.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.jscript") returned 0
	[0054.353] lstrlenA (lpString="*.jscript") returned 9
	[0054.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.hta") returned 0
	[0054.353] lstrlenA (lpString="*.hta") returned 5
	[0054.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.php7") returned 0
	[0054.353] lstrlenA (lpString="*.php7") returned 6
	[0054.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.db") returned 0
	[0054.353] lstrlenA (lpString="*.db") returned 4
	[0054.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.swf") returned 0
	[0054.354] lstrlenA (lpString="*.swf") returned 5
	[0054.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.eml") returned 0
	[0054.354] lstrlenA (lpString="*.eml") returned 5
	[0054.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.part") returned 0
	[0054.354] lstrlenA (lpString="*.part") returned 6
	[0054.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.nfo") returned 0
	[0054.354] lstrlenA (lpString="*.nfo") returned 5
	[0054.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.rsa") returned 0
	[0054.354] lstrlenA (lpString="*.rsa") returned 5
	[0054.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.key") returned 0
	[0054.354] lstrlenA (lpString="*.key") returned 5
	[0054.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.aes") returned 0
	[0054.354] lstrlenA (lpString="*.aes") returned 5
	[0054.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.blob") returned 0
	[0054.354] lstrlenA (lpString="*.blob") returned 6
	[0054.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.btc") returned 0
	[0054.354] lstrlenA (lpString="*.btc") returned 5
	[0054.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF", pszSpec="*.wallet") returned 0
	[0054.354] lstrlenA (lpString="*.wallet") returned 8
	[0054.354] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec210f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec210f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec9380a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f46, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216600.WMF", cAlternateFileName="")) returned 1
	[0054.354] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.354] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0216600.WMF") returned -1
	[0054.354] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0216600.WMF") returned -1
	[0054.354] lstrcmpiA (lpString1="", lpString2="J0216600.WMF") returned -1
	[0054.354] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF") returned="J0216570.WMF"
	[0054.354] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.354] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.354] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.354] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.354] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0216600.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF"
	[0054.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.zip") returned 0
	[0054.354] lstrlenA (lpString="*.zip") returned 5
	[0054.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.rar") returned 0
	[0054.354] lstrlenA (lpString="*.rar") returned 5
	[0054.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.7z") returned 0
	[0054.355] lstrlenA (lpString="*.7z") returned 4
	[0054.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.tar") returned 0
	[0054.355] lstrlenA (lpString="*.tar") returned 5
	[0054.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.gzip") returned 0
	[0054.355] lstrlenA (lpString="*.gzip") returned 6
	[0054.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.jpg") returned 0
	[0054.355] lstrlenA (lpString="*.jpg") returned 5
	[0054.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.jpeg") returned 0
	[0054.355] lstrlenA (lpString="*.jpeg") returned 6
	[0054.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.bmp") returned 0
	[0054.355] lstrlenA (lpString="*.bmp") returned 5
	[0054.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.gif") returned 0
	[0054.355] lstrlenA (lpString="*.gif") returned 5
	[0054.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.png") returned 0
	[0054.355] lstrlenA (lpString="*.png") returned 5
	[0054.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.doc") returned 0
	[0054.355] lstrlenA (lpString="*.doc") returned 5
	[0054.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.docx") returned 0
	[0054.355] lstrlenA (lpString="*.docx") returned 6
	[0054.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.xls") returned 0
	[0054.355] lstrlenA (lpString="*.xls") returned 5
	[0054.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.xlsx") returned 0
	[0054.355] lstrlenA (lpString="*.xlsx") returned 6
	[0054.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.ppt") returned 0
	[0054.355] lstrlenA (lpString="*.ppt") returned 5
	[0054.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.pptx") returned 0
	[0054.355] lstrlenA (lpString="*.pptx") returned 6
	[0054.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.txt") returned 0
	[0054.355] lstrlenA (lpString="*.txt") returned 5
	[0054.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.pdf") returned 0
	[0054.355] lstrlenA (lpString="*.pdf") returned 5
	[0054.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.htm") returned 0
	[0054.355] lstrlenA (lpString="*.htm") returned 5
	[0054.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.html") returned 0
	[0054.355] lstrlenA (lpString="*.html") returned 6
	[0054.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.mdb") returned 0
	[0054.356] lstrlenA (lpString="*.mdb") returned 5
	[0054.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.pfx") returned 0
	[0054.356] lstrlenA (lpString="*.pfx") returned 5
	[0054.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.md") returned 0
	[0054.356] lstrlenA (lpString="*.md") returned 4
	[0054.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.lnk") returned 0
	[0054.356] lstrlenA (lpString="*.lnk") returned 5
	[0054.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.torrent") returned 0
	[0054.356] lstrlenA (lpString="*.torrent") returned 9
	[0054.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.mov") returned 0
	[0054.356] lstrlenA (lpString="*.mov") returned 5
	[0054.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.3gp") returned 0
	[0054.356] lstrlenA (lpString="*.3gp") returned 5
	[0054.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.mpeg") returned 0
	[0054.356] lstrlenA (lpString="*.mpeg") returned 6
	[0054.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.mpg") returned 0
	[0054.356] lstrlenA (lpString="*.mpg") returned 5
	[0054.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.flv") returned 0
	[0054.356] lstrlenA (lpString="*.flv") returned 5
	[0054.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.avi") returned 0
	[0054.356] lstrlenA (lpString="*.avi") returned 5
	[0054.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.mp4") returned 0
	[0054.356] lstrlenA (lpString="*.mp4") returned 5
	[0054.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.wmv") returned 0
	[0054.356] lstrlenA (lpString="*.wmv") returned 5
	[0054.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.mkv") returned 0
	[0054.356] lstrlenA (lpString="*.mkv") returned 5
	[0054.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.mp3") returned 0
	[0054.356] lstrlenA (lpString="*.mp3") returned 5
	[0054.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.wav") returned 0
	[0054.356] lstrlenA (lpString="*.wav") returned 5
	[0054.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.flac") returned 0
	[0054.356] lstrlenA (lpString="*.flac") returned 6
	[0054.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.wma") returned 0
	[0054.357] lstrlenA (lpString="*.wma") returned 5
	[0054.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.au3") returned 0
	[0054.357] lstrlenA (lpString="*.au3") returned 5
	[0054.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.ahk") returned 0
	[0054.357] lstrlenA (lpString="*.ahk") returned 5
	[0054.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.c") returned 0
	[0054.357] lstrlenA (lpString="*.c") returned 3
	[0054.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.cc") returned 0
	[0054.357] lstrlenA (lpString="*.cc") returned 4
	[0054.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.cpp") returned 0
	[0054.357] lstrlenA (lpString="*.cpp") returned 5
	[0054.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.cxx") returned 0
	[0054.357] lstrlenA (lpString="*.cxx") returned 5
	[0054.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.c++") returned 0
	[0054.357] lstrlenA (lpString="*.c++") returned 5
	[0054.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.cs") returned 0
	[0054.357] lstrlenA (lpString="*.cs") returned 4
	[0054.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.vb") returned 0
	[0054.357] lstrlenA (lpString="*.vb") returned 4
	[0054.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.bas") returned 0
	[0054.357] lstrlenA (lpString="*.bas") returned 5
	[0054.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.csproj") returned 0
	[0054.357] lstrlenA (lpString="*.csproj") returned 8
	[0054.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.vbproj") returned 0
	[0054.357] lstrlenA (lpString="*.vbproj") returned 8
	[0054.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.vcxproj") returned 0
	[0054.357] lstrlenA (lpString="*.vcxproj") returned 9
	[0054.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.manifest") returned 0
	[0054.357] lstrlenA (lpString="*.manifest") returned 10
	[0054.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.php") returned 0
	[0054.357] lstrlenA (lpString="*.php") returned 5
	[0054.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.vbe") returned 0
	[0054.357] lstrlenA (lpString="*.vbe") returned 5
	[0054.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.vba") returned 0
	[0054.357] lstrlenA (lpString="*.vba") returned 5
	[0054.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.vbs") returned 0
	[0054.358] lstrlenA (lpString="*.vbs") returned 5
	[0054.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.bat") returned 0
	[0054.358] lstrlenA (lpString="*.bat") returned 5
	[0054.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.cmd") returned 0
	[0054.358] lstrlenA (lpString="*.cmd") returned 5
	[0054.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.js") returned 0
	[0054.358] lstrlenA (lpString="*.js") returned 4
	[0054.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.jscript") returned 0
	[0054.358] lstrlenA (lpString="*.jscript") returned 9
	[0054.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.hta") returned 0
	[0054.358] lstrlenA (lpString="*.hta") returned 5
	[0054.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.php7") returned 0
	[0054.358] lstrlenA (lpString="*.php7") returned 6
	[0054.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.db") returned 0
	[0054.358] lstrlenA (lpString="*.db") returned 4
	[0054.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.swf") returned 0
	[0054.358] lstrlenA (lpString="*.swf") returned 5
	[0054.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.eml") returned 0
	[0054.358] lstrlenA (lpString="*.eml") returned 5
	[0054.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.part") returned 0
	[0054.358] lstrlenA (lpString="*.part") returned 6
	[0054.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.nfo") returned 0
	[0054.358] lstrlenA (lpString="*.nfo") returned 5
	[0054.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.rsa") returned 0
	[0054.358] lstrlenA (lpString="*.rsa") returned 5
	[0054.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.key") returned 0
	[0054.358] lstrlenA (lpString="*.key") returned 5
	[0054.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.aes") returned 0
	[0054.358] lstrlenA (lpString="*.aes") returned 5
	[0054.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.blob") returned 0
	[0054.358] lstrlenA (lpString="*.blob") returned 6
	[0054.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.btc") returned 0
	[0054.358] lstrlenA (lpString="*.btc") returned 5
	[0054.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF", pszSpec="*.wallet") returned 0
	[0054.358] lstrlenA (lpString="*.wallet") returned 8
	[0054.358] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec210f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec210f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec210f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x24e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216612.WMF", cAlternateFileName="")) returned 1
	[0054.358] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.359] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0216612.WMF") returned -1
	[0054.359] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0216612.WMF") returned -1
	[0054.359] lstrcmpiA (lpString1="", lpString2="J0216612.WMF") returned -1
	[0054.359] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF") returned="J0216600.WMF"
	[0054.359] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.359] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.359] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.359] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.359] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0216612.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF"
	[0054.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.zip") returned 0
	[0054.359] lstrlenA (lpString="*.zip") returned 5
	[0054.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.rar") returned 0
	[0054.359] lstrlenA (lpString="*.rar") returned 5
	[0054.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.7z") returned 0
	[0054.359] lstrlenA (lpString="*.7z") returned 4
	[0054.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.tar") returned 0
	[0054.359] lstrlenA (lpString="*.tar") returned 5
	[0054.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.gzip") returned 0
	[0054.359] lstrlenA (lpString="*.gzip") returned 6
	[0054.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.jpg") returned 0
	[0054.359] lstrlenA (lpString="*.jpg") returned 5
	[0054.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.jpeg") returned 0
	[0054.359] lstrlenA (lpString="*.jpeg") returned 6
	[0054.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.bmp") returned 0
	[0054.359] lstrlenA (lpString="*.bmp") returned 5
	[0054.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.gif") returned 0
	[0054.359] lstrlenA (lpString="*.gif") returned 5
	[0054.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.png") returned 0
	[0054.359] lstrlenA (lpString="*.png") returned 5
	[0054.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.doc") returned 0
	[0054.359] lstrlenA (lpString="*.doc") returned 5
	[0054.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.docx") returned 0
	[0054.359] lstrlenA (lpString="*.docx") returned 6
	[0054.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.xls") returned 0
	[0054.360] lstrlenA (lpString="*.xls") returned 5
	[0054.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.xlsx") returned 0
	[0054.360] lstrlenA (lpString="*.xlsx") returned 6
	[0054.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.ppt") returned 0
	[0054.360] lstrlenA (lpString="*.ppt") returned 5
	[0054.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.pptx") returned 0
	[0054.360] lstrlenA (lpString="*.pptx") returned 6
	[0054.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.txt") returned 0
	[0054.360] lstrlenA (lpString="*.txt") returned 5
	[0054.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.pdf") returned 0
	[0054.360] lstrlenA (lpString="*.pdf") returned 5
	[0054.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.htm") returned 0
	[0054.360] lstrlenA (lpString="*.htm") returned 5
	[0054.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.html") returned 0
	[0054.360] lstrlenA (lpString="*.html") returned 6
	[0054.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.mdb") returned 0
	[0054.360] lstrlenA (lpString="*.mdb") returned 5
	[0054.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.pfx") returned 0
	[0054.360] lstrlenA (lpString="*.pfx") returned 5
	[0054.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.md") returned 0
	[0054.360] lstrlenA (lpString="*.md") returned 4
	[0054.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.lnk") returned 0
	[0054.360] lstrlenA (lpString="*.lnk") returned 5
	[0054.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.torrent") returned 0
	[0054.360] lstrlenA (lpString="*.torrent") returned 9
	[0054.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.mov") returned 0
	[0054.360] lstrlenA (lpString="*.mov") returned 5
	[0054.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.3gp") returned 0
	[0054.360] lstrlenA (lpString="*.3gp") returned 5
	[0054.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.mpeg") returned 0
	[0054.360] lstrlenA (lpString="*.mpeg") returned 6
	[0054.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.mpg") returned 0
	[0054.360] lstrlenA (lpString="*.mpg") returned 5
	[0054.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF", pszSpec="*.flv") returned 0
	[0054.360] lstrlenA (lpString="*.flv") returned 5
	[0054.361] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45328f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf45328f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf45328f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9b3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216874.WMF", cAlternateFileName="")) returned 1
	[0054.361] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.361] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0216874.WMF") returned -1
	[0054.361] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0216874.WMF") returned -1
	[0054.361] lstrcmpiA (lpString1="", lpString2="J0216874.WMF") returned -1
	[0054.361] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF") returned="J0216612.WMF"
	[0054.361] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.361] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.361] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.361] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.361] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0216874.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF"
	[0054.361] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45328f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf45328f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf45328f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1484, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0217262.WMF", cAlternateFileName="")) returned 1
	[0054.361] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.361] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0217262.WMF") returned -1
	[0054.361] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0217262.WMF") returned -1
	[0054.361] lstrcmpiA (lpString1="", lpString2="J0217262.WMF") returned -1
	[0054.361] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF") returned="J0216874.WMF"
	[0054.361] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.361] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.361] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.361] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.361] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0217262.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF"
	[0054.362] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45328f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf45328f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf45328f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0217302.WMF", cAlternateFileName="")) returned 1
	[0054.362] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.362] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0217302.WMF") returned -1
	[0054.362] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0217302.WMF") returned -1
	[0054.362] lstrcmpiA (lpString1="", lpString2="J0217302.WMF") returned -1
	[0054.362] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF") returned="J0217262.WMF"
	[0054.362] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.362] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.362] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.362] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.362] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0217302.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217302.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217302.WMF"
	[0054.362] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45328f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf45328f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf45328f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1ca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0217872.WMF", cAlternateFileName="")) returned 1
	[0054.362] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.362] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0217872.WMF") returned -1
	[0054.362] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0217872.WMF") returned -1
	[0054.362] lstrcmpiA (lpString1="", lpString2="J0217872.WMF") returned -1
	[0054.362] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217302.WMF") returned="J0217302.WMF"
	[0054.362] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.362] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.362] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.362] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.362] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0217872.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF"
	[0054.362] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec9380a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec9380a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecb9a46, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8ad6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0227419.JPG", cAlternateFileName="")) returned 1
	[0054.362] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.362] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0227419.JPG") returned -1
	[0054.363] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0227419.JPG") returned -1
	[0054.363] lstrcmpiA (lpString1="", lpString2="J0227419.JPG") returned -1
	[0054.363] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF") returned="J0217872.WMF"
	[0054.363] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.363] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.363] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.363] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.363] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0227419.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG"
	[0054.363] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG"
	[0054.363] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG"
	[0054.363] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG."
	[0054.363] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG.exe"
	[0054.363] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227419.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0054.363] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8ad6
	[0054.363] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xec9380a, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xec9380a, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xecb9a46, dwHighDateTime=0x1d327e8)) returned 1
	[0054.363] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.363] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x8a94, lpOverlapped=0x0) returned 1
	[0054.451] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG") returned="J0227419.JPG"
	[0054.451] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.451] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x8a94, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x8a94, lpOverlapped=0x0) returned 1
	[0054.451] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.451] CloseHandle (hObject=0x214) returned 1
	[0054.453] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227419.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227419.jpg.exe")) returned 1
	[0054.454] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec9380a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec9380a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecb9a46, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe2e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0227558.JPG", cAlternateFileName="")) returned 1
	[0054.454] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.454] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0227558.JPG") returned -1
	[0054.454] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0227558.JPG") returned -1
	[0054.454] lstrcmpiA (lpString1="", lpString2="J0227558.JPG") returned -1
	[0054.454] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG") returned="J0227419.JPG"
	[0054.454] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.454] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.454] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.454] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.454] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0227558.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG"
	[0054.454] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG", pszSpec="*.zip") returned 0
	[0054.454] lstrlenA (lpString="*.zip") returned 5
	[0054.454] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG", pszSpec="*.rar") returned 0
	[0054.454] lstrlenA (lpString="*.rar") returned 5
	[0054.454] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG", pszSpec="*.7z") returned 0
	[0054.454] lstrlenA (lpString="*.7z") returned 4
	[0054.454] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG", pszSpec="*.tar") returned 0
	[0054.454] lstrlenA (lpString="*.tar") returned 5
	[0054.454] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG", pszSpec="*.gzip") returned 0
	[0054.455] lstrlenA (lpString="*.gzip") returned 6
	[0054.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG", pszSpec="*.jpg") returned 1
	[0054.455] lstrlenA (lpString="*.jpg") returned 5
	[0054.455] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG"
	[0054.455] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG"
	[0054.455] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG."
	[0054.455] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG.exe"
	[0054.455] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227558.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0054.455] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe2e9
	[0054.455] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xec9380a, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xec9380a, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xecb9a46, dwHighDateTime=0x1d327e8)) returned 1
	[0054.455] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.455] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xe2a7, lpOverlapped=0x0) returned 1
	[0054.457] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG") returned="J0227558.JPG"
	[0054.457] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.457] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xe2a7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xe2a7, lpOverlapped=0x0) returned 1
	[0054.457] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.457] CloseHandle (hObject=0x214) returned 1
	[0054.459] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227558.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227558.jpg.exe")) returned 1
	[0054.461] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42d018, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf42d018, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf45328f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x65a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0228823.WMF", cAlternateFileName="")) returned 1
	[0054.461] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.461] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0228823.WMF") returned -1
	[0054.461] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0228823.WMF") returned -1
	[0054.461] lstrcmpiA (lpString1="", lpString2="J0228823.WMF") returned -1
	[0054.462] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG") returned="J0227558.JPG"
	[0054.462] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.462] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.462] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.462] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.462] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0228823.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF"
	[0054.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.zip") returned 0
	[0054.462] lstrlenA (lpString="*.zip") returned 5
	[0054.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.rar") returned 0
	[0054.462] lstrlenA (lpString="*.rar") returned 5
	[0054.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.7z") returned 0
	[0054.462] lstrlenA (lpString="*.7z") returned 4
	[0054.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.tar") returned 0
	[0054.462] lstrlenA (lpString="*.tar") returned 5
	[0054.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.gzip") returned 0
	[0054.462] lstrlenA (lpString="*.gzip") returned 6
	[0054.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.jpg") returned 0
	[0054.462] lstrlenA (lpString="*.jpg") returned 5
	[0054.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.jpeg") returned 0
	[0054.462] lstrlenA (lpString="*.jpeg") returned 6
	[0054.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.bmp") returned 0
	[0054.462] lstrlenA (lpString="*.bmp") returned 5
	[0054.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.gif") returned 0
	[0054.462] lstrlenA (lpString="*.gif") returned 5
	[0054.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.png") returned 0
	[0054.462] lstrlenA (lpString="*.png") returned 5
	[0054.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.doc") returned 0
	[0054.462] lstrlenA (lpString="*.doc") returned 5
	[0054.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.docx") returned 0
	[0054.462] lstrlenA (lpString="*.docx") returned 6
	[0054.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.xls") returned 0
	[0054.462] lstrlenA (lpString="*.xls") returned 5
	[0054.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.xlsx") returned 0
	[0054.463] lstrlenA (lpString="*.xlsx") returned 6
	[0054.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.ppt") returned 0
	[0054.463] lstrlenA (lpString="*.ppt") returned 5
	[0054.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.pptx") returned 0
	[0054.463] lstrlenA (lpString="*.pptx") returned 6
	[0054.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.txt") returned 0
	[0054.463] lstrlenA (lpString="*.txt") returned 5
	[0054.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.pdf") returned 0
	[0054.463] lstrlenA (lpString="*.pdf") returned 5
	[0054.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.htm") returned 0
	[0054.463] lstrlenA (lpString="*.htm") returned 5
	[0054.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.html") returned 0
	[0054.463] lstrlenA (lpString="*.html") returned 6
	[0054.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.mdb") returned 0
	[0054.463] lstrlenA (lpString="*.mdb") returned 5
	[0054.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.pfx") returned 0
	[0054.463] lstrlenA (lpString="*.pfx") returned 5
	[0054.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.md") returned 0
	[0054.463] lstrlenA (lpString="*.md") returned 4
	[0054.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.lnk") returned 0
	[0054.463] lstrlenA (lpString="*.lnk") returned 5
	[0054.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.torrent") returned 0
	[0054.463] lstrlenA (lpString="*.torrent") returned 9
	[0054.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.mov") returned 0
	[0054.463] lstrlenA (lpString="*.mov") returned 5
	[0054.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.3gp") returned 0
	[0054.463] lstrlenA (lpString="*.3gp") returned 5
	[0054.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.mpeg") returned 0
	[0054.463] lstrlenA (lpString="*.mpeg") returned 6
	[0054.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.mpg") returned 0
	[0054.463] lstrlenA (lpString="*.mpg") returned 5
	[0054.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.flv") returned 0
	[0054.463] lstrlenA (lpString="*.flv") returned 5
	[0054.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.avi") returned 0
	[0054.463] lstrlenA (lpString="*.avi") returned 5
	[0054.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.mp4") returned 0
	[0054.463] lstrlenA (lpString="*.mp4") returned 5
	[0054.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.wmv") returned 0
	[0054.464] lstrlenA (lpString="*.wmv") returned 5
	[0054.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.mkv") returned 0
	[0054.464] lstrlenA (lpString="*.mkv") returned 5
	[0054.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.mp3") returned 0
	[0054.464] lstrlenA (lpString="*.mp3") returned 5
	[0054.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.wav") returned 0
	[0054.464] lstrlenA (lpString="*.wav") returned 5
	[0054.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.flac") returned 0
	[0054.464] lstrlenA (lpString="*.flac") returned 6
	[0054.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.wma") returned 0
	[0054.464] lstrlenA (lpString="*.wma") returned 5
	[0054.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.au3") returned 0
	[0054.464] lstrlenA (lpString="*.au3") returned 5
	[0054.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.ahk") returned 0
	[0054.464] lstrlenA (lpString="*.ahk") returned 5
	[0054.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.c") returned 0
	[0054.464] lstrlenA (lpString="*.c") returned 3
	[0054.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.cc") returned 0
	[0054.464] lstrlenA (lpString="*.cc") returned 4
	[0054.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.cpp") returned 0
	[0054.464] lstrlenA (lpString="*.cpp") returned 5
	[0054.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.cxx") returned 0
	[0054.464] lstrlenA (lpString="*.cxx") returned 5
	[0054.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.c++") returned 0
	[0054.464] lstrlenA (lpString="*.c++") returned 5
	[0054.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.cs") returned 0
	[0054.464] lstrlenA (lpString="*.cs") returned 4
	[0054.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.vb") returned 0
	[0054.464] lstrlenA (lpString="*.vb") returned 4
	[0054.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.bas") returned 0
	[0054.464] lstrlenA (lpString="*.bas") returned 5
	[0054.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.csproj") returned 0
	[0054.464] lstrlenA (lpString="*.csproj") returned 8
	[0054.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.vbproj") returned 0
	[0054.464] lstrlenA (lpString="*.vbproj") returned 8
	[0054.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.vcxproj") returned 0
	[0054.464] lstrlenA (lpString="*.vcxproj") returned 9
	[0054.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.manifest") returned 0
	[0054.465] lstrlenA (lpString="*.manifest") returned 10
	[0054.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.php") returned 0
	[0054.465] lstrlenA (lpString="*.php") returned 5
	[0054.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.vbe") returned 0
	[0054.465] lstrlenA (lpString="*.vbe") returned 5
	[0054.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.vba") returned 0
	[0054.465] lstrlenA (lpString="*.vba") returned 5
	[0054.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.vbs") returned 0
	[0054.465] lstrlenA (lpString="*.vbs") returned 5
	[0054.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.bat") returned 0
	[0054.465] lstrlenA (lpString="*.bat") returned 5
	[0054.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.cmd") returned 0
	[0054.465] lstrlenA (lpString="*.cmd") returned 5
	[0054.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.js") returned 0
	[0054.465] lstrlenA (lpString="*.js") returned 4
	[0054.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.jscript") returned 0
	[0054.465] lstrlenA (lpString="*.jscript") returned 9
	[0054.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.hta") returned 0
	[0054.465] lstrlenA (lpString="*.hta") returned 5
	[0054.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.php7") returned 0
	[0054.465] lstrlenA (lpString="*.php7") returned 6
	[0054.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.db") returned 0
	[0054.465] lstrlenA (lpString="*.db") returned 4
	[0054.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.swf") returned 0
	[0054.465] lstrlenA (lpString="*.swf") returned 5
	[0054.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.eml") returned 0
	[0054.465] lstrlenA (lpString="*.eml") returned 5
	[0054.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.part") returned 0
	[0054.465] lstrlenA (lpString="*.part") returned 6
	[0054.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.nfo") returned 0
	[0054.465] lstrlenA (lpString="*.nfo") returned 5
	[0054.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.rsa") returned 0
	[0054.465] lstrlenA (lpString="*.rsa") returned 5
	[0054.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.key") returned 0
	[0054.466] lstrlenA (lpString="*.key") returned 5
	[0054.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.aes") returned 0
	[0054.466] lstrlenA (lpString="*.aes") returned 5
	[0054.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.blob") returned 0
	[0054.466] lstrlenA (lpString="*.blob") returned 6
	[0054.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.btc") returned 0
	[0054.466] lstrlenA (lpString="*.btc") returned 5
	[0054.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF", pszSpec="*.wallet") returned 0
	[0054.466] lstrlenA (lpString="*.wallet") returned 8
	[0054.466] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec9380a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec9380a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec9380a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x918c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0228959.WMF", cAlternateFileName="")) returned 1
	[0054.466] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.466] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0228959.WMF") returned -1
	[0054.466] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0228959.WMF") returned -1
	[0054.466] lstrcmpiA (lpString1="", lpString2="J0228959.WMF") returned -1
	[0054.466] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF") returned="J0228823.WMF"
	[0054.466] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.466] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.466] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.466] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.466] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0228959.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF"
	[0054.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.zip") returned 0
	[0054.466] lstrlenA (lpString="*.zip") returned 5
	[0054.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.rar") returned 0
	[0054.466] lstrlenA (lpString="*.rar") returned 5
	[0054.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.7z") returned 0
	[0054.466] lstrlenA (lpString="*.7z") returned 4
	[0054.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.tar") returned 0
	[0054.466] lstrlenA (lpString="*.tar") returned 5
	[0054.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.gzip") returned 0
	[0054.466] lstrlenA (lpString="*.gzip") returned 6
	[0054.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.jpg") returned 0
	[0054.466] lstrlenA (lpString="*.jpg") returned 5
	[0054.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.jpeg") returned 0
	[0054.467] lstrlenA (lpString="*.jpeg") returned 6
	[0054.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.bmp") returned 0
	[0054.467] lstrlenA (lpString="*.bmp") returned 5
	[0054.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.gif") returned 0
	[0054.467] lstrlenA (lpString="*.gif") returned 5
	[0054.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.png") returned 0
	[0054.467] lstrlenA (lpString="*.png") returned 5
	[0054.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.doc") returned 0
	[0054.467] lstrlenA (lpString="*.doc") returned 5
	[0054.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.docx") returned 0
	[0054.467] lstrlenA (lpString="*.docx") returned 6
	[0054.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.xls") returned 0
	[0054.467] lstrlenA (lpString="*.xls") returned 5
	[0054.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.xlsx") returned 0
	[0054.467] lstrlenA (lpString="*.xlsx") returned 6
	[0054.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.ppt") returned 0
	[0054.467] lstrlenA (lpString="*.ppt") returned 5
	[0054.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.pptx") returned 0
	[0054.467] lstrlenA (lpString="*.pptx") returned 6
	[0054.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.txt") returned 0
	[0054.467] lstrlenA (lpString="*.txt") returned 5
	[0054.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.pdf") returned 0
	[0054.467] lstrlenA (lpString="*.pdf") returned 5
	[0054.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.htm") returned 0
	[0054.467] lstrlenA (lpString="*.htm") returned 5
	[0054.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.html") returned 0
	[0054.467] lstrlenA (lpString="*.html") returned 6
	[0054.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.mdb") returned 0
	[0054.467] lstrlenA (lpString="*.mdb") returned 5
	[0054.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.pfx") returned 0
	[0054.467] lstrlenA (lpString="*.pfx") returned 5
	[0054.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.md") returned 0
	[0054.467] lstrlenA (lpString="*.md") returned 4
	[0054.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.lnk") returned 0
	[0054.467] lstrlenA (lpString="*.lnk") returned 5
	[0054.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.torrent") returned 0
	[0054.468] lstrlenA (lpString="*.torrent") returned 9
	[0054.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.mov") returned 0
	[0054.468] lstrlenA (lpString="*.mov") returned 5
	[0054.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.3gp") returned 0
	[0054.468] lstrlenA (lpString="*.3gp") returned 5
	[0054.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.mpeg") returned 0
	[0054.468] lstrlenA (lpString="*.mpeg") returned 6
	[0054.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.mpg") returned 0
	[0054.468] lstrlenA (lpString="*.mpg") returned 5
	[0054.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.flv") returned 0
	[0054.468] lstrlenA (lpString="*.flv") returned 5
	[0054.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.avi") returned 0
	[0054.468] lstrlenA (lpString="*.avi") returned 5
	[0054.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.mp4") returned 0
	[0054.468] lstrlenA (lpString="*.mp4") returned 5
	[0054.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.wmv") returned 0
	[0054.468] lstrlenA (lpString="*.wmv") returned 5
	[0054.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.mkv") returned 0
	[0054.468] lstrlenA (lpString="*.mkv") returned 5
	[0054.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.mp3") returned 0
	[0054.468] lstrlenA (lpString="*.mp3") returned 5
	[0054.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.wav") returned 0
	[0054.468] lstrlenA (lpString="*.wav") returned 5
	[0054.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.flac") returned 0
	[0054.468] lstrlenA (lpString="*.flac") returned 6
	[0054.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.wma") returned 0
	[0054.468] lstrlenA (lpString="*.wma") returned 5
	[0054.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.au3") returned 0
	[0054.468] lstrlenA (lpString="*.au3") returned 5
	[0054.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.ahk") returned 0
	[0054.468] lstrlenA (lpString="*.ahk") returned 5
	[0054.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.c") returned 0
	[0054.468] lstrlenA (lpString="*.c") returned 3
	[0054.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.cc") returned 0
	[0054.468] lstrlenA (lpString="*.cc") returned 4
	[0054.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.cpp") returned 0
	[0054.468] lstrlenA (lpString="*.cpp") returned 5
	[0054.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.cxx") returned 0
	[0054.469] lstrlenA (lpString="*.cxx") returned 5
	[0054.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.c++") returned 0
	[0054.469] lstrlenA (lpString="*.c++") returned 5
	[0054.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.cs") returned 0
	[0054.469] lstrlenA (lpString="*.cs") returned 4
	[0054.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.vb") returned 0
	[0054.469] lstrlenA (lpString="*.vb") returned 4
	[0054.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.bas") returned 0
	[0054.469] lstrlenA (lpString="*.bas") returned 5
	[0054.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.csproj") returned 0
	[0054.469] lstrlenA (lpString="*.csproj") returned 8
	[0054.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.vbproj") returned 0
	[0054.469] lstrlenA (lpString="*.vbproj") returned 8
	[0054.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.vcxproj") returned 0
	[0054.469] lstrlenA (lpString="*.vcxproj") returned 9
	[0054.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.manifest") returned 0
	[0054.469] lstrlenA (lpString="*.manifest") returned 10
	[0054.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.php") returned 0
	[0054.469] lstrlenA (lpString="*.php") returned 5
	[0054.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.vbe") returned 0
	[0054.469] lstrlenA (lpString="*.vbe") returned 5
	[0054.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.vba") returned 0
	[0054.469] lstrlenA (lpString="*.vba") returned 5
	[0054.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.vbs") returned 0
	[0054.469] lstrlenA (lpString="*.vbs") returned 5
	[0054.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.bat") returned 0
	[0054.469] lstrlenA (lpString="*.bat") returned 5
	[0054.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.cmd") returned 0
	[0054.469] lstrlenA (lpString="*.cmd") returned 5
	[0054.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.js") returned 0
	[0054.469] lstrlenA (lpString="*.js") returned 4
	[0054.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.jscript") returned 0
	[0054.469] lstrlenA (lpString="*.jscript") returned 9
	[0054.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.hta") returned 0
	[0054.470] lstrlenA (lpString="*.hta") returned 5
	[0054.470] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.php7") returned 0
	[0054.470] lstrlenA (lpString="*.php7") returned 6
	[0054.470] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.db") returned 0
	[0054.470] lstrlenA (lpString="*.db") returned 4
	[0054.470] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.swf") returned 0
	[0054.470] lstrlenA (lpString="*.swf") returned 5
	[0054.470] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.eml") returned 0
	[0054.470] lstrlenA (lpString="*.eml") returned 5
	[0054.470] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.part") returned 0
	[0054.470] lstrlenA (lpString="*.part") returned 6
	[0054.470] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.nfo") returned 0
	[0054.470] lstrlenA (lpString="*.nfo") returned 5
	[0054.470] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.rsa") returned 0
	[0054.470] lstrlenA (lpString="*.rsa") returned 5
	[0054.470] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.key") returned 0
	[0054.470] lstrlenA (lpString="*.key") returned 5
	[0054.470] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.aes") returned 0
	[0054.470] lstrlenA (lpString="*.aes") returned 5
	[0054.470] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.blob") returned 0
	[0054.470] lstrlenA (lpString="*.blob") returned 6
	[0054.470] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.btc") returned 0
	[0054.470] lstrlenA (lpString="*.btc") returned 5
	[0054.470] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF", pszSpec="*.wallet") returned 0
	[0054.470] lstrlenA (lpString="*.wallet") returned 8
	[0054.470] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec9380a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec9380a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecb9a46, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1daa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0230553.WMF", cAlternateFileName="")) returned 1
	[0054.470] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.470] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0230553.WMF") returned -1
	[0054.470] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0230553.WMF") returned -1
	[0054.470] lstrcmpiA (lpString1="", lpString2="J0230553.WMF") returned -1
	[0054.470] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF") returned="J0228959.WMF"
	[0054.470] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.470] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.470] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.471] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.471] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0230553.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF"
	[0054.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.zip") returned 0
	[0054.471] lstrlenA (lpString="*.zip") returned 5
	[0054.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.rar") returned 0
	[0054.471] lstrlenA (lpString="*.rar") returned 5
	[0054.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.7z") returned 0
	[0054.471] lstrlenA (lpString="*.7z") returned 4
	[0054.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.tar") returned 0
	[0054.471] lstrlenA (lpString="*.tar") returned 5
	[0054.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.gzip") returned 0
	[0054.471] lstrlenA (lpString="*.gzip") returned 6
	[0054.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.jpg") returned 0
	[0054.471] lstrlenA (lpString="*.jpg") returned 5
	[0054.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.jpeg") returned 0
	[0054.471] lstrlenA (lpString="*.jpeg") returned 6
	[0054.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.bmp") returned 0
	[0054.471] lstrlenA (lpString="*.bmp") returned 5
	[0054.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.gif") returned 0
	[0054.471] lstrlenA (lpString="*.gif") returned 5
	[0054.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.png") returned 0
	[0054.471] lstrlenA (lpString="*.png") returned 5
	[0054.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.doc") returned 0
	[0054.471] lstrlenA (lpString="*.doc") returned 5
	[0054.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.docx") returned 0
	[0054.471] lstrlenA (lpString="*.docx") returned 6
	[0054.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.xls") returned 0
	[0054.471] lstrlenA (lpString="*.xls") returned 5
	[0054.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.xlsx") returned 0
	[0054.471] lstrlenA (lpString="*.xlsx") returned 6
	[0054.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.ppt") returned 0
	[0054.471] lstrlenA (lpString="*.ppt") returned 5
	[0054.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.pptx") returned 0
	[0054.471] lstrlenA (lpString="*.pptx") returned 6
	[0054.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.txt") returned 0
	[0054.472] lstrlenA (lpString="*.txt") returned 5
	[0054.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.pdf") returned 0
	[0054.472] lstrlenA (lpString="*.pdf") returned 5
	[0054.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.htm") returned 0
	[0054.472] lstrlenA (lpString="*.htm") returned 5
	[0054.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.html") returned 0
	[0054.472] lstrlenA (lpString="*.html") returned 6
	[0054.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.mdb") returned 0
	[0054.472] lstrlenA (lpString="*.mdb") returned 5
	[0054.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.pfx") returned 0
	[0054.472] lstrlenA (lpString="*.pfx") returned 5
	[0054.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.md") returned 0
	[0054.472] lstrlenA (lpString="*.md") returned 4
	[0054.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.lnk") returned 0
	[0054.472] lstrlenA (lpString="*.lnk") returned 5
	[0054.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.torrent") returned 0
	[0054.472] lstrlenA (lpString="*.torrent") returned 9
	[0054.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.mov") returned 0
	[0054.472] lstrlenA (lpString="*.mov") returned 5
	[0054.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.3gp") returned 0
	[0054.472] lstrlenA (lpString="*.3gp") returned 5
	[0054.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.mpeg") returned 0
	[0054.472] lstrlenA (lpString="*.mpeg") returned 6
	[0054.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.mpg") returned 0
	[0054.472] lstrlenA (lpString="*.mpg") returned 5
	[0054.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.flv") returned 0
	[0054.472] lstrlenA (lpString="*.flv") returned 5
	[0054.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.avi") returned 0
	[0054.472] lstrlenA (lpString="*.avi") returned 5
	[0054.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.mp4") returned 0
	[0054.472] lstrlenA (lpString="*.mp4") returned 5
	[0054.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.wmv") returned 0
	[0054.472] lstrlenA (lpString="*.wmv") returned 5
	[0054.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.mkv") returned 0
	[0054.472] lstrlenA (lpString="*.mkv") returned 5
	[0054.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.mp3") returned 0
	[0054.473] lstrlenA (lpString="*.mp3") returned 5
	[0054.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.wav") returned 0
	[0054.473] lstrlenA (lpString="*.wav") returned 5
	[0054.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.flac") returned 0
	[0054.473] lstrlenA (lpString="*.flac") returned 6
	[0054.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.wma") returned 0
	[0054.473] lstrlenA (lpString="*.wma") returned 5
	[0054.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.au3") returned 0
	[0054.473] lstrlenA (lpString="*.au3") returned 5
	[0054.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.ahk") returned 0
	[0054.473] lstrlenA (lpString="*.ahk") returned 5
	[0054.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.c") returned 0
	[0054.473] lstrlenA (lpString="*.c") returned 3
	[0054.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.cc") returned 0
	[0054.473] lstrlenA (lpString="*.cc") returned 4
	[0054.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.cpp") returned 0
	[0054.473] lstrlenA (lpString="*.cpp") returned 5
	[0054.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.cxx") returned 0
	[0054.473] lstrlenA (lpString="*.cxx") returned 5
	[0054.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.c++") returned 0
	[0054.473] lstrlenA (lpString="*.c++") returned 5
	[0054.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.cs") returned 0
	[0054.473] lstrlenA (lpString="*.cs") returned 4
	[0054.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.vb") returned 0
	[0054.473] lstrlenA (lpString="*.vb") returned 4
	[0054.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.bas") returned 0
	[0054.473] lstrlenA (lpString="*.bas") returned 5
	[0054.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.csproj") returned 0
	[0054.473] lstrlenA (lpString="*.csproj") returned 8
	[0054.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.vbproj") returned 0
	[0054.473] lstrlenA (lpString="*.vbproj") returned 8
	[0054.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.vcxproj") returned 0
	[0054.473] lstrlenA (lpString="*.vcxproj") returned 9
	[0054.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.manifest") returned 0
	[0054.473] lstrlenA (lpString="*.manifest") returned 10
	[0054.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.php") returned 0
	[0054.473] lstrlenA (lpString="*.php") returned 5
	[0054.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.vbe") returned 0
	[0054.474] lstrlenA (lpString="*.vbe") returned 5
	[0054.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.vba") returned 0
	[0054.474] lstrlenA (lpString="*.vba") returned 5
	[0054.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.vbs") returned 0
	[0054.474] lstrlenA (lpString="*.vbs") returned 5
	[0054.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.bat") returned 0
	[0054.474] lstrlenA (lpString="*.bat") returned 5
	[0054.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.cmd") returned 0
	[0054.474] lstrlenA (lpString="*.cmd") returned 5
	[0054.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.js") returned 0
	[0054.474] lstrlenA (lpString="*.js") returned 4
	[0054.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.jscript") returned 0
	[0054.474] lstrlenA (lpString="*.jscript") returned 9
	[0054.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.hta") returned 0
	[0054.474] lstrlenA (lpString="*.hta") returned 5
	[0054.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.php7") returned 0
	[0054.474] lstrlenA (lpString="*.php7") returned 6
	[0054.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.db") returned 0
	[0054.474] lstrlenA (lpString="*.db") returned 4
	[0054.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.swf") returned 0
	[0054.474] lstrlenA (lpString="*.swf") returned 5
	[0054.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.eml") returned 0
	[0054.474] lstrlenA (lpString="*.eml") returned 5
	[0054.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.part") returned 0
	[0054.474] lstrlenA (lpString="*.part") returned 6
	[0054.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.nfo") returned 0
	[0054.474] lstrlenA (lpString="*.nfo") returned 5
	[0054.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.rsa") returned 0
	[0054.474] lstrlenA (lpString="*.rsa") returned 5
	[0054.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.key") returned 0
	[0054.474] lstrlenA (lpString="*.key") returned 5
	[0054.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.aes") returned 0
	[0054.474] lstrlenA (lpString="*.aes") returned 5
	[0054.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.blob") returned 0
	[0054.474] lstrlenA (lpString="*.blob") returned 6
	[0054.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.btc") returned 0
	[0054.475] lstrlenA (lpString="*.btc") returned 5
	[0054.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF", pszSpec="*.wallet") returned 0
	[0054.475] lstrlenA (lpString="*.wallet") returned 8
	[0054.475] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec9380a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec9380a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec9380a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1066, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0230558.WMF", cAlternateFileName="")) returned 1
	[0054.475] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.475] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0230558.WMF") returned -1
	[0054.475] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0230558.WMF") returned -1
	[0054.475] lstrcmpiA (lpString1="", lpString2="J0230558.WMF") returned -1
	[0054.475] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF") returned="J0230553.WMF"
	[0054.475] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.475] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.475] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.475] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.475] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0230558.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF"
	[0054.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.zip") returned 0
	[0054.475] lstrlenA (lpString="*.zip") returned 5
	[0054.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.rar") returned 0
	[0054.475] lstrlenA (lpString="*.rar") returned 5
	[0054.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.7z") returned 0
	[0054.475] lstrlenA (lpString="*.7z") returned 4
	[0054.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.tar") returned 0
	[0054.475] lstrlenA (lpString="*.tar") returned 5
	[0054.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.gzip") returned 0
	[0054.475] lstrlenA (lpString="*.gzip") returned 6
	[0054.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.jpg") returned 0
	[0054.475] lstrlenA (lpString="*.jpg") returned 5
	[0054.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.jpeg") returned 0
	[0054.475] lstrlenA (lpString="*.jpeg") returned 6
	[0054.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.bmp") returned 0
	[0054.475] lstrlenA (lpString="*.bmp") returned 5
	[0054.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.gif") returned 0
	[0054.475] lstrlenA (lpString="*.gif") returned 5
	[0054.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.png") returned 0
	[0054.476] lstrlenA (lpString="*.png") returned 5
	[0054.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.doc") returned 0
	[0054.476] lstrlenA (lpString="*.doc") returned 5
	[0054.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.docx") returned 0
	[0054.476] lstrlenA (lpString="*.docx") returned 6
	[0054.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.xls") returned 0
	[0054.476] lstrlenA (lpString="*.xls") returned 5
	[0054.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.xlsx") returned 0
	[0054.476] lstrlenA (lpString="*.xlsx") returned 6
	[0054.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.ppt") returned 0
	[0054.476] lstrlenA (lpString="*.ppt") returned 5
	[0054.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.pptx") returned 0
	[0054.476] lstrlenA (lpString="*.pptx") returned 6
	[0054.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.txt") returned 0
	[0054.476] lstrlenA (lpString="*.txt") returned 5
	[0054.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.pdf") returned 0
	[0054.476] lstrlenA (lpString="*.pdf") returned 5
	[0054.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.htm") returned 0
	[0054.476] lstrlenA (lpString="*.htm") returned 5
	[0054.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.html") returned 0
	[0054.476] lstrlenA (lpString="*.html") returned 6
	[0054.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.mdb") returned 0
	[0054.476] lstrlenA (lpString="*.mdb") returned 5
	[0054.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.pfx") returned 0
	[0054.476] lstrlenA (lpString="*.pfx") returned 5
	[0054.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.md") returned 0
	[0054.476] lstrlenA (lpString="*.md") returned 4
	[0054.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.lnk") returned 0
	[0054.476] lstrlenA (lpString="*.lnk") returned 5
	[0054.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.torrent") returned 0
	[0054.476] lstrlenA (lpString="*.torrent") returned 9
	[0054.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.mov") returned 0
	[0054.476] lstrlenA (lpString="*.mov") returned 5
	[0054.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.3gp") returned 0
	[0054.476] lstrlenA (lpString="*.3gp") returned 5
	[0054.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.mpeg") returned 0
	[0054.476] lstrlenA (lpString="*.mpeg") returned 6
	[0054.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.mpg") returned 0
	[0054.477] lstrlenA (lpString="*.mpg") returned 5
	[0054.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF", pszSpec="*.flv") returned 0
	[0054.477] lstrlenA (lpString="*.flv") returned 5
	[0054.477] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec9380a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec9380a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf42d018, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x332a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0232171.WMF", cAlternateFileName="")) returned 1
	[0054.477] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.477] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0232171.WMF") returned -1
	[0054.477] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0232171.WMF") returned -1
	[0054.477] lstrcmpiA (lpString1="", lpString2="J0232171.WMF") returned -1
	[0054.477] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF") returned="J0230558.WMF"
	[0054.477] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.477] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.477] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.477] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.477] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0232171.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232171.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232171.WMF"
	[0054.477] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec9380a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec9380a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec9380a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6bc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0232393.WMF", cAlternateFileName="")) returned 1
	[0054.477] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.477] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0232393.WMF") returned -1
	[0054.477] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0232393.WMF") returned -1
	[0054.477] lstrcmpiA (lpString1="", lpString2="J0232393.WMF") returned -1
	[0054.477] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232171.WMF") returned="J0232171.WMF"
	[0054.477] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.478] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.478] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.478] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.478] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0232393.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF"
	[0054.478] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec9380a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec9380a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf42d018, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa086, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0232395.WMF", cAlternateFileName="")) returned 1
	[0054.478] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.478] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0232395.WMF") returned -1
	[0054.478] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0232395.WMF") returned -1
	[0054.478] lstrcmpiA (lpString1="", lpString2="J0232395.WMF") returned -1
	[0054.478] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF") returned="J0232393.WMF"
	[0054.478] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.478] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.478] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.478] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.478] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0232395.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF"
	[0054.478] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec9380a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec9380a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec9380a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x380a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0232795.WMF", cAlternateFileName="")) returned 1
	[0054.479] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.479] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0232795.WMF") returned -1
	[0054.479] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0232795.WMF") returned -1
	[0054.479] lstrcmpiA (lpString1="", lpString2="J0232795.WMF") returned -1
	[0054.479] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF") returned="J0232395.WMF"
	[0054.479] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.479] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.479] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.479] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.479] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0232795.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF"
	[0054.480] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45328f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf45328f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf45328f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x899c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0232797.WMF", cAlternateFileName="")) returned 1
	[0054.480] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.480] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0232797.WMF") returned -1
	[0054.480] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0232797.WMF") returned -1
	[0054.480] lstrcmpiA (lpString1="", lpString2="J0232797.WMF") returned -1
	[0054.480] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF") returned="J0232795.WMF"
	[0054.480] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.480] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.480] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.480] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.480] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0232797.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232797.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232797.WMF"
	[0054.480] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xecb9a46, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xecb9a46, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecb9a46, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4de6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0232803.WMF", cAlternateFileName="")) returned 1
	[0054.480] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.480] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0232803.WMF") returned -1
	[0054.480] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0232803.WMF") returned -1
	[0054.480] lstrcmpiA (lpString1="", lpString2="J0232803.WMF") returned -1
	[0054.480] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232797.WMF") returned="J0232797.WMF"
	[0054.480] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.480] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.480] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.480] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.480] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0232803.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF"
	[0054.480] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xecb9a46, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xecb9a46, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecb9a46, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x26e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233512.WMF", cAlternateFileName="")) returned 1
	[0054.480] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.480] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0233512.WMF") returned -1
	[0054.480] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0233512.WMF") returned -1
	[0054.480] lstrcmpiA (lpString1="", lpString2="J0233512.WMF") returned -1
	[0054.480] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF") returned="J0232803.WMF"
	[0054.481] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.481] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.481] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.481] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.481] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0233512.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF"
	[0054.482] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xecb9a46, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xecb9a46, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecb9a46, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x312c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233665.WMF", cAlternateFileName="")) returned 1
	[0054.482] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.482] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0233665.WMF") returned -1
	[0054.482] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0233665.WMF") returned -1
	[0054.482] lstrcmpiA (lpString1="", lpString2="J0233665.WMF") returned -1
	[0054.482] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF") returned="J0233512.WMF"
	[0054.482] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.482] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.482] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.482] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.482] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0233665.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF"
	[0054.482] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xecb9a46, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xecb9a46, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecb9a46, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x975e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233992.WMF", cAlternateFileName="")) returned 1
	[0054.482] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.482] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0233992.WMF") returned -1
	[0054.482] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0233992.WMF") returned -1
	[0054.482] lstrcmpiA (lpString1="", lpString2="J0233992.WMF") returned -1
	[0054.482] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF") returned="J0233665.WMF"
	[0054.482] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.482] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.482] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.482] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.482] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0233992.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233992.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233992.WMF"
	[0054.482] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xecb9a46, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xecb9a46, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecb9a46, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xcec6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234000.WMF", cAlternateFileName="")) returned 1
	[0054.482] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.482] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0234000.WMF") returned -1
	[0054.482] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0234000.WMF") returned -1
	[0054.483] lstrcmpiA (lpString1="", lpString2="J0234000.WMF") returned -1
	[0054.483] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233992.WMF") returned="J0233992.WMF"
	[0054.483] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.483] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.483] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.483] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.483] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0234000.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF"
	[0054.483] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec9380a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec9380a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecb9a46, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4b40, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234001.WMF", cAlternateFileName="")) returned 1
	[0054.483] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.483] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0234001.WMF") returned -1
	[0054.483] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0234001.WMF") returned -1
	[0054.483] lstrcmpiA (lpString1="", lpString2="J0234001.WMF") returned -1
	[0054.483] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF") returned="J0234000.WMF"
	[0054.483] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.483] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.483] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.483] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.483] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0234001.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF"
	[0054.483] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xecb9a46, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xecb9a46, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecb9a46, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x80d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234376.WMF", cAlternateFileName="")) returned 1
	[0054.483] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.483] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0234376.WMF") returned -1
	[0054.483] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0234376.WMF") returned -1
	[0054.483] lstrcmpiA (lpString1="", lpString2="J0234376.WMF") returned -1
	[0054.483] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF") returned="J0234001.WMF"
	[0054.483] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.483] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.483] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.484] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.484] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0234376.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF"
	[0054.484] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xecb9a46, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xecb9a46, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecb9a46, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xcba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0237225.WMF", cAlternateFileName="")) returned 1
	[0054.484] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.484] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0237225.WMF") returned -1
	[0054.484] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0237225.WMF") returned -1
	[0054.484] lstrcmpiA (lpString1="", lpString2="J0237225.WMF") returned -1
	[0054.484] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF") returned="J0234376.WMF"
	[0054.484] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.484] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.484] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.484] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.484] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0237225.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237225.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237225.WMF"
	[0054.484] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec9380a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec9380a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecb9a46, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5700, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0237228.WMF", cAlternateFileName="")) returned 1
	[0054.484] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.484] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0237228.WMF") returned -1
	[0054.484] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0237228.WMF") returned -1
	[0054.484] lstrcmpiA (lpString1="", lpString2="J0237228.WMF") returned -1
	[0054.484] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237225.WMF") returned="J0237225.WMF"
	[0054.484] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.484] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.484] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.484] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.484] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0237228.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF"
	[0054.484] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xecb9a46, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xecb9a46, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecdfcbb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x60c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0237336.WMF", cAlternateFileName="")) returned 1
	[0054.485] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.485] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0237336.WMF") returned -1
	[0054.485] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0237336.WMF") returned -1
	[0054.485] lstrcmpiA (lpString1="", lpString2="J0237336.WMF") returned -1
	[0054.485] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF") returned="J0237228.WMF"
	[0054.485] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.485] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.485] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.485] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.485] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0237336.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF"
	[0054.485] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xecb9a46, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xecb9a46, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecdfcbb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x51be, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0237759.WMF", cAlternateFileName="")) returned 1
	[0054.485] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.485] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0237759.WMF") returned -1
	[0054.485] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0237759.WMF") returned -1
	[0054.485] lstrcmpiA (lpString1="", lpString2="J0237759.WMF") returned -1
	[0054.485] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF") returned="J0237336.WMF"
	[0054.485] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.485] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.485] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.485] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.485] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0237759.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF"
	[0054.485] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xecb9a46, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xecb9a46, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecdfcbb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x59a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0238333.WMF", cAlternateFileName="")) returned 1
	[0054.485] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.485] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0238333.WMF") returned -1
	[0054.485] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0238333.WMF") returned -1
	[0054.485] lstrcmpiA (lpString1="", lpString2="J0238333.WMF") returned -1
	[0054.485] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF") returned="J0237759.WMF"
	[0054.485] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.486] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.486] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.486] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.486] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0238333.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF"
	[0054.486] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xecb9a46, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xecb9a46, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecdfcbb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1334, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0238927.WMF", cAlternateFileName="")) returned 1
	[0054.486] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.486] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0238927.WMF") returned -1
	[0054.486] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0238927.WMF") returned -1
	[0054.486] lstrcmpiA (lpString1="", lpString2="J0238927.WMF") returned -1
	[0054.486] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF") returned="J0238333.WMF"
	[0054.486] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.486] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.486] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.486] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.486] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0238927.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF"
	[0054.486] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xecb9a46, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xecb9a46, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecb9a46, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1d3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0238959.WMF", cAlternateFileName="")) returned 1
	[0054.486] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.486] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0238959.WMF") returned -1
	[0054.486] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0238959.WMF") returned -1
	[0054.486] lstrcmpiA (lpString1="", lpString2="J0238959.WMF") returned -1
	[0054.486] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF") returned="J0238927.WMF"
	[0054.486] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.486] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.486] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.486] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.486] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0238959.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF"
	[0054.487] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xecb9a46, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xecb9a46, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecb9a46, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0238983.WMF", cAlternateFileName="")) returned 1
	[0054.487] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.487] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0238983.WMF") returned -1
	[0054.487] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0238983.WMF") returned -1
	[0054.487] lstrcmpiA (lpString1="", lpString2="J0238983.WMF") returned -1
	[0054.487] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF") returned="J0238959.WMF"
	[0054.487] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.487] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.487] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.487] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.487] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0238983.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF"
	[0054.487] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xecb9a46, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xecb9a46, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecb9a46, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1284, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239057.WMF", cAlternateFileName="")) returned 1
	[0054.487] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.487] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0239057.WMF") returned -1
	[0054.487] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0239057.WMF") returned -1
	[0054.487] lstrcmpiA (lpString1="", lpString2="J0239057.WMF") returned -1
	[0054.487] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF") returned="J0238983.WMF"
	[0054.487] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.487] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.487] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.487] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.487] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0239057.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239057.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239057.WMF"
	[0054.487] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xecb9a46, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xecb9a46, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecb9a46, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239063.WMF", cAlternateFileName="")) returned 1
	[0054.487] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.487] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0239063.WMF") returned -1
	[0054.488] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0239063.WMF") returned -1
	[0054.488] lstrcmpiA (lpString1="", lpString2="J0239063.WMF") returned -1
	[0054.488] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239057.WMF") returned="J0239057.WMF"
	[0054.488] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.488] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.488] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.488] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.488] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0239063.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF"
	[0054.488] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xecb9a46, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xecb9a46, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecb9a46, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1294, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239079.WMF", cAlternateFileName="")) returned 1
	[0054.488] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.488] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0239079.WMF") returned -1
	[0054.488] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0239079.WMF") returned -1
	[0054.488] lstrcmpiA (lpString1="", lpString2="J0239079.WMF") returned -1
	[0054.488] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF") returned="J0239063.WMF"
	[0054.488] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.488] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.488] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.488] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.488] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0239079.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF"
	[0054.488] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xecb9a46, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xecb9a46, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecb9a46, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1464, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239191.WMF", cAlternateFileName="")) returned 1
	[0054.488] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.488] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0239191.WMF") returned -1
	[0054.488] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0239191.WMF") returned -1
	[0054.488] lstrcmpiA (lpString1="", lpString2="J0239191.WMF") returned -1
	[0054.488] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF") returned="J0239079.WMF"
	[0054.488] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.488] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.489] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.489] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.489] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0239191.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF"
	[0054.489] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xecdfcbb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xecdfcbb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecdfcbb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8424, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239611.WMF", cAlternateFileName="")) returned 1
	[0054.489] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.489] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0239611.WMF") returned -1
	[0054.489] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0239611.WMF") returned -1
	[0054.489] lstrcmpiA (lpString1="", lpString2="J0239611.WMF") returned -1
	[0054.489] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF") returned="J0239191.WMF"
	[0054.489] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.489] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.489] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.489] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.489] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0239611.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239611.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239611.WMF"
	[0054.489] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xecdfcbb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xecdfcbb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecdfcbb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1314, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239935.WMF", cAlternateFileName="")) returned 1
	[0054.489] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.489] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0239935.WMF") returned -1
	[0054.489] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0239935.WMF") returned -1
	[0054.489] lstrcmpiA (lpString1="", lpString2="J0239935.WMF") returned -1
	[0054.489] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239611.WMF") returned="J0239611.WMF"
	[0054.489] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.489] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.489] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.489] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.489] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0239935.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF"
	[0054.490] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xecdfcbb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xecdfcbb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecdfcbb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1418, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239941.WMF", cAlternateFileName="")) returned 1
	[0054.490] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.490] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0239941.WMF") returned -1
	[0054.490] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0239941.WMF") returned -1
	[0054.490] lstrcmpiA (lpString1="", lpString2="J0239941.WMF") returned -1
	[0054.490] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF") returned="J0239935.WMF"
	[0054.490] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.490] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.490] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.490] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.490] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0239941.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF"
	[0054.490] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xecdfcbb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xecdfcbb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecdfcbb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1998, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239943.WMF", cAlternateFileName="")) returned 1
	[0054.490] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.490] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0239943.WMF") returned -1
	[0054.490] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0239943.WMF") returned -1
	[0054.490] lstrcmpiA (lpString1="", lpString2="J0239943.WMF") returned -1
	[0054.490] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF") returned="J0239941.WMF"
	[0054.490] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.490] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.490] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.490] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.490] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0239943.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF"
	[0054.490] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xecdfcbb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xecdfcbb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecdfcbb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239951.WMF", cAlternateFileName="")) returned 1
	[0054.490] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.490] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0239951.WMF") returned -1
	[0054.490] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0239951.WMF") returned -1
	[0054.490] lstrcmpiA (lpString1="", lpString2="J0239951.WMF") returned -1
	[0054.491] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF") returned="J0239943.WMF"
	[0054.491] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.491] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.491] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.491] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.491] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0239951.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239951.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239951.WMF"
	[0054.491] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xecb9a46, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xecb9a46, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecdfcbb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1bc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239953.WMF", cAlternateFileName="")) returned 1
	[0054.491] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.491] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0239953.WMF") returned -1
	[0054.491] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0239953.WMF") returned -1
	[0054.491] lstrcmpiA (lpString1="", lpString2="J0239953.WMF") returned -1
	[0054.491] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239951.WMF") returned="J0239951.WMF"
	[0054.491] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.491] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.491] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.491] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.491] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0239953.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF"
	[0054.491] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xecdfcbb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xecdfcbb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecdfcbb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1348, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239955.WMF", cAlternateFileName="")) returned 1
	[0054.491] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.491] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0239955.WMF") returned -1
	[0054.491] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0239955.WMF") returned -1
	[0054.491] lstrcmpiA (lpString1="", lpString2="J0239955.WMF") returned -1
	[0054.491] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF") returned="J0239953.WMF"
	[0054.491] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.491] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.491] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.491] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.492] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0239955.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF"
	[0054.492] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xecdfcbb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xecdfcbb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecdfcbb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1720, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239965.WMF", cAlternateFileName="")) returned 1
	[0054.492] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.492] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0239965.WMF") returned -1
	[0054.492] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0239965.WMF") returned -1
	[0054.492] lstrcmpiA (lpString1="", lpString2="J0239965.WMF") returned -1
	[0054.492] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF") returned="J0239955.WMF"
	[0054.492] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.492] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.492] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.492] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.492] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0239965.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF"
	[0054.492] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xecdfcbb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xecdfcbb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecdfcbb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x154c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239967.WMF", cAlternateFileName="")) returned 1
	[0054.492] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.492] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0239967.WMF") returned -1
	[0054.492] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0239967.WMF") returned -1
	[0054.492] lstrcmpiA (lpString1="", lpString2="J0239967.WMF") returned -1
	[0054.492] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF") returned="J0239965.WMF"
	[0054.492] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.492] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.492] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.492] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.492] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0239967.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239967.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239967.WMF"
	[0054.492] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xecdfcbb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xecdfcbb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecdfcbb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239973.WMF", cAlternateFileName="")) returned 1
	[0054.492] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.493] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0239973.WMF") returned -1
	[0054.493] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0239973.WMF") returned -1
	[0054.493] lstrcmpiA (lpString1="", lpString2="J0239973.WMF") returned -1
	[0054.493] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239967.WMF") returned="J0239967.WMF"
	[0054.493] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.493] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.493] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.493] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.493] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0239973.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF"
	[0054.493] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xed05f07, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xed05f07, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xed05f07, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239975.WMF", cAlternateFileName="")) returned 1
	[0054.493] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.493] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0239975.WMF") returned -1
	[0054.493] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0239975.WMF") returned -1
	[0054.493] lstrcmpiA (lpString1="", lpString2="J0239975.WMF") returned -1
	[0054.493] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF") returned="J0239973.WMF"
	[0054.493] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.493] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.493] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.493] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.493] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0239975.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF"
	[0054.493] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xed05f07, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xed05f07, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf2fbd2e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xcd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239997.WMF", cAlternateFileName="")) returned 1
	[0054.493] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.493] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0239997.WMF") returned -1
	[0054.493] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0239997.WMF") returned -1
	[0054.493] lstrcmpiA (lpString1="", lpString2="J0239997.WMF") returned -1
	[0054.493] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF") returned="J0239975.WMF"
	[0054.493] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.493] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.494] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.494] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.494] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0239997.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF"
	[0054.494] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xecdfcbb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xecdfcbb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xed05f07, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1df8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0240157.WMF", cAlternateFileName="")) returned 1
	[0054.494] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.494] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0240157.WMF") returned -1
	[0054.494] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0240157.WMF") returned -1
	[0054.494] lstrcmpiA (lpString1="", lpString2="J0240157.WMF") returned -1
	[0054.494] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF") returned="J0239997.WMF"
	[0054.494] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.494] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.494] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.494] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.494] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0240157.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240157.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240157.WMF"
	[0054.494] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xecdfcbb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xecdfcbb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xed05f07, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa410, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0240175.WMF", cAlternateFileName="")) returned 1
	[0054.593] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.593] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0240175.WMF") returned -1
	[0054.593] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0240175.WMF") returned -1
	[0054.593] lstrcmpiA (lpString1="", lpString2="J0240175.WMF") returned -1
	[0054.593] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240157.WMF") returned="J0240157.WMF"
	[0054.593] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.593] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.593] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.593] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.593] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0240175.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF"
	[0054.593] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xecdfcbb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xecdfcbb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xed05f07, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0240189.WMF", cAlternateFileName="")) returned 1
	[0054.593] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.593] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0240189.WMF") returned -1
	[0054.593] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0240189.WMF") returned -1
	[0054.593] lstrcmpiA (lpString1="", lpString2="J0240189.WMF") returned -1
	[0054.593] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF") returned="J0240175.WMF"
	[0054.593] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.593] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.593] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.593] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.593] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0240189.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF"
	[0054.594] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xecdfcbb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xecdfcbb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecdfcbb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1476, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0240291.WMF", cAlternateFileName="")) returned 1
	[0054.594] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.594] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0240291.WMF") returned -1
	[0054.594] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0240291.WMF") returned -1
	[0054.594] lstrcmpiA (lpString1="", lpString2="J0240291.WMF") returned -1
	[0054.594] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF") returned="J0240189.WMF"
	[0054.594] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.594] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.594] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.594] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.594] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0240291.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF"
	[0054.594] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xecdfcbb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xecdfcbb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xed05f07, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x92e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0241019.WMF", cAlternateFileName="")) returned 1
	[0054.594] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.594] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0241019.WMF") returned -1
	[0054.594] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0241019.WMF") returned -1
	[0054.594] lstrcmpiA (lpString1="", lpString2="J0241019.WMF") returned -1
	[0054.594] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF") returned="J0240291.WMF"
	[0054.594] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.594] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.594] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.594] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.594] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0241019.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241019.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241019.WMF"
	[0054.594] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xecdfcbb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xecdfcbb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecdfcbb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0241037.WMF", cAlternateFileName="")) returned 1
	[0054.594] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.594] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0241037.WMF") returned -1
	[0054.595] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0241037.WMF") returned -1
	[0054.595] lstrcmpiA (lpString1="", lpString2="J0241037.WMF") returned -1
	[0054.595] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241019.WMF") returned="J0241019.WMF"
	[0054.595] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.595] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.595] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.595] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.595] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0241037.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF"
	[0054.595] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xecdfcbb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xecdfcbb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecdfcbb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x926, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0241041.WMF", cAlternateFileName="")) returned 1
	[0054.595] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.595] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0241041.WMF") returned -1
	[0054.595] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0241041.WMF") returned -1
	[0054.595] lstrcmpiA (lpString1="", lpString2="J0241041.WMF") returned -1
	[0054.595] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF") returned="J0241037.WMF"
	[0054.595] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.595] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.595] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.595] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.595] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0241041.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF"
	[0054.595] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xecdfcbb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xecdfcbb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecdfcbb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xab2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0241043.WMF", cAlternateFileName="")) returned 1
	[0054.595] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.595] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0241043.WMF") returned -1
	[0054.595] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0241043.WMF") returned -1
	[0054.595] lstrcmpiA (lpString1="", lpString2="J0241043.WMF") returned -1
	[0054.595] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF") returned="J0241041.WMF"
	[0054.595] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.595] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.595] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.596] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.596] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0241043.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF"
	[0054.596] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf34834b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf34834b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf36e46d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x82a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0241077.WMF", cAlternateFileName="")) returned 1
	[0054.596] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.596] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0241077.WMF") returned -1
	[0054.596] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0241077.WMF") returned -1
	[0054.596] lstrcmpiA (lpString1="", lpString2="J0241077.WMF") returned -1
	[0054.596] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF") returned="J0241043.WMF"
	[0054.596] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.596] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.596] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.596] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.596] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0241077.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241077.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241077.WMF"
	[0054.596] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf34834b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf34834b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf36e46d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xcbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0241773.WMF", cAlternateFileName="")) returned 1
	[0054.596] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.596] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0241773.WMF") returned -1
	[0054.596] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0241773.WMF") returned -1
	[0054.596] lstrcmpiA (lpString1="", lpString2="J0241773.WMF") returned -1
	[0054.596] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241077.WMF") returned="J0241077.WMF"
	[0054.596] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.596] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.596] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.596] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.596] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0241773.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF"
	[0054.597] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf34834b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf34834b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf36e46d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0241781.WMF", cAlternateFileName="")) returned 1
	[0054.597] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.597] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0241781.WMF") returned -1
	[0054.597] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0241781.WMF") returned -1
	[0054.597] lstrcmpiA (lpString1="", lpString2="J0241781.WMF") returned -1
	[0054.597] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF") returned="J0241773.WMF"
	[0054.597] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.597] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.597] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.597] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.597] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0241781.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF"
	[0054.597] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf34834b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf34834b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf36e46d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7938, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0250504.WMF", cAlternateFileName="")) returned 1
	[0054.597] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.597] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0250504.WMF") returned -1
	[0054.597] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0250504.WMF") returned -1
	[0054.597] lstrcmpiA (lpString1="", lpString2="J0250504.WMF") returned -1
	[0054.597] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF") returned="J0241781.WMF"
	[0054.597] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.597] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.597] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.597] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.597] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0250504.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF"
	[0054.597] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf2fbd2e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf2fbd2e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf34834b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6958, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0250997.WMF", cAlternateFileName="")) returned 1
	[0054.597] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.597] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0250997.WMF") returned -1
	[0054.597] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0250997.WMF") returned -1
	[0054.597] lstrcmpiA (lpString1="", lpString2="J0250997.WMF") returned -1
	[0054.597] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF") returned="J0250504.WMF"
	[0054.598] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.598] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.598] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.598] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.598] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0250997.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250997.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250997.WMF"
	[0054.598] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xed05f07, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xed05f07, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf34834b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1100c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0251007.WMF", cAlternateFileName="")) returned 1
	[0054.598] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.598] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0251007.WMF") returned -1
	[0054.598] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0251007.WMF") returned -1
	[0054.598] lstrcmpiA (lpString1="", lpString2="J0251007.WMF") returned -1
	[0054.598] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250997.WMF") returned="J0250997.WMF"
	[0054.598] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.598] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.598] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.598] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.598] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0251007.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF"
	[0054.598] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf34834b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf34834b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf34834b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xae2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0252629.WMF", cAlternateFileName="")) returned 1
	[0054.598] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.598] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0252629.WMF") returned -1
	[0054.598] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0252629.WMF") returned -1
	[0054.598] lstrcmpiA (lpString1="", lpString2="J0252629.WMF") returned -1
	[0054.598] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF") returned="J0251007.WMF"
	[0054.598] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.598] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.598] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.598] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.599] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0252629.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF"
	[0054.599] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf2fbd2e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf2fbd2e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf34834b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf56, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0252669.WMF", cAlternateFileName="")) returned 1
	[0054.599] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.599] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0252669.WMF") returned -1
	[0054.599] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0252669.WMF") returned -1
	[0054.599] lstrcmpiA (lpString1="", lpString2="J0252669.WMF") returned -1
	[0054.599] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF") returned="J0252629.WMF"
	[0054.599] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.599] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.599] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.599] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.599] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0252669.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252669.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252669.WMF"
	[0054.599] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xed05f07, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xed05f07, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf34834b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0278702.WMF", cAlternateFileName="")) returned 1
	[0054.599] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.599] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0278702.WMF") returned -1
	[0054.599] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0278702.WMF") returned -1
	[0054.599] lstrcmpiA (lpString1="", lpString2="J0278702.WMF") returned -1
	[0054.599] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252669.WMF") returned="J0252669.WMF"
	[0054.599] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.599] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.599] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.599] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.599] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0278702.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF"
	[0054.599] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xed05f07, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xed05f07, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf2fbd2e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4330, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0279644.WMF", cAlternateFileName="")) returned 1
	[0054.599] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.599] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0279644.WMF") returned -1
	[0054.600] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0279644.WMF") returned -1
	[0054.600] lstrcmpiA (lpString1="", lpString2="J0279644.WMF") returned -1
	[0054.600] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF") returned="J0278702.WMF"
	[0054.600] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.600] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.600] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.600] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.600] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0279644.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF"
	[0054.600] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf36e46d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf36e46d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf36e46d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11dee, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0280468.WMF", cAlternateFileName="")) returned 1
	[0054.600] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.600] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0280468.WMF") returned -1
	[0054.600] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0280468.WMF") returned -1
	[0054.600] lstrcmpiA (lpString1="", lpString2="J0280468.WMF") returned -1
	[0054.600] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF") returned="J0279644.WMF"
	[0054.600] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.600] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.600] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.600] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.600] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0280468.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF"
	[0054.600] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf36e46d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf36e46d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf36e46d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x94c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0281008.WMF", cAlternateFileName="")) returned 1
	[0054.600] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.600] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0281008.WMF") returned -1
	[0054.600] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0281008.WMF") returned -1
	[0054.600] lstrcmpiA (lpString1="", lpString2="J0281008.WMF") returned -1
	[0054.600] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF") returned="J0280468.WMF"
	[0054.600] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.600] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.601] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.601] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.601] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0281008.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281008.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281008.WMF"
	[0054.601] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf36e46d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf36e46d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf36e46d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb5b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0281243.WMF", cAlternateFileName="")) returned 1
	[0054.601] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.601] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0281243.WMF") returned -1
	[0054.601] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0281243.WMF") returned -1
	[0054.601] lstrcmpiA (lpString1="", lpString2="J0281243.WMF") returned -1
	[0054.601] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281008.WMF") returned="J0281008.WMF"
	[0054.601] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.601] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.601] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.601] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.601] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0281243.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF"
	[0054.601] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf36e46d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf36e46d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf36e46d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x31dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0281630.WMF", cAlternateFileName="")) returned 1
	[0054.601] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.601] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0281630.WMF") returned -1
	[0054.601] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0281630.WMF") returned -1
	[0054.601] lstrcmpiA (lpString1="", lpString2="J0281630.WMF") returned -1
	[0054.601] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF") returned="J0281243.WMF"
	[0054.601] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.601] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.601] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.601] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.601] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0281630.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF"
	[0054.602] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf36e46d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf36e46d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf36e46d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3854, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0281632.WMF", cAlternateFileName="")) returned 1
	[0054.602] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.602] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0281632.WMF") returned -1
	[0054.602] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0281632.WMF") returned -1
	[0054.602] lstrcmpiA (lpString1="", lpString2="J0281632.WMF") returned -1
	[0054.602] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF") returned="J0281630.WMF"
	[0054.602] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.602] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.602] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.602] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.602] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0281632.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF"
	[0054.602] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf34834b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf34834b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf36e46d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e88, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0281638.WMF", cAlternateFileName="")) returned 1
	[0054.602] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.602] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0281638.WMF") returned -1
	[0054.602] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0281638.WMF") returned -1
	[0054.602] lstrcmpiA (lpString1="", lpString2="J0281638.WMF") returned -1
	[0054.602] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF") returned="J0281632.WMF"
	[0054.602] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.602] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.602] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.602] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.602] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0281638.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281638.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281638.WMF"
	[0054.602] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf36e46d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf36e46d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf36e46d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x30f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0281640.WMF", cAlternateFileName="")) returned 1
	[0054.602] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.602] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0281640.WMF") returned -1
	[0054.602] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0281640.WMF") returned -1
	[0054.602] lstrcmpiA (lpString1="", lpString2="J0281640.WMF") returned -1
	[0054.602] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281638.WMF") returned="J0281638.WMF"
	[0054.603] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.603] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.603] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.603] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.603] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0281640.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF"
	[0054.603] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf36e46d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf36e46d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf36e46d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3c9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0282126.WMF", cAlternateFileName="")) returned 1
	[0054.603] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.603] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0282126.WMF") returned -1
	[0054.603] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0282126.WMF") returned -1
	[0054.603] lstrcmpiA (lpString1="", lpString2="J0282126.WMF") returned -1
	[0054.603] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF") returned="J0281640.WMF"
	[0054.603] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.603] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.603] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.603] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.603] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0282126.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF"
	[0054.603] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf36e46d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf36e46d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf36e46d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8166, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0282928.WMF", cAlternateFileName="")) returned 1
	[0054.603] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.603] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0282928.WMF") returned -1
	[0054.603] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0282928.WMF") returned -1
	[0054.603] lstrcmpiA (lpString1="", lpString2="J0282928.WMF") returned -1
	[0054.603] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF") returned="J0282126.WMF"
	[0054.603] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.603] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.603] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.603] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.603] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0282928.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF"
	[0054.604] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf34834b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf34834b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf36e46d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3700, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0282932.WMF", cAlternateFileName="")) returned 1
	[0054.604] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.604] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0282932.WMF") returned -1
	[0054.604] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0282932.WMF") returned -1
	[0054.604] lstrcmpiA (lpString1="", lpString2="J0282932.WMF") returned -1
	[0054.604] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF") returned="J0282928.WMF"
	[0054.604] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.604] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.604] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.604] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.604] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0282932.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282932.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282932.WMF"
	[0054.604] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3946e4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3946e4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3946e4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x388a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285462.WMF", cAlternateFileName="")) returned 1
	[0054.604] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.604] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0285462.WMF") returned -1
	[0054.604] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0285462.WMF") returned -1
	[0054.604] lstrcmpiA (lpString1="", lpString2="J0285462.WMF") returned -1
	[0054.604] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282932.WMF") returned="J0282932.WMF"
	[0054.604] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.604] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.604] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.604] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.604] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0285462.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF"
	[0054.604] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3946e4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3946e4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3946e4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2440, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285484.WMF", cAlternateFileName="")) returned 1
	[0054.604] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.604] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0285484.WMF") returned -1
	[0054.604] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0285484.WMF") returned -1
	[0054.605] lstrcmpiA (lpString1="", lpString2="J0285484.WMF") returned -1
	[0054.605] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF") returned="J0285462.WMF"
	[0054.605] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.605] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.605] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.605] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.605] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0285484.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF"
	[0054.605] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3946e4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3946e4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3946e4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x795c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285780.WMF", cAlternateFileName="")) returned 1
	[0054.605] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.605] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0285780.WMF") returned -1
	[0054.605] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0285780.WMF") returned -1
	[0054.605] lstrcmpiA (lpString1="", lpString2="J0285780.WMF") returned -1
	[0054.605] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF") returned="J0285484.WMF"
	[0054.605] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.605] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.605] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.605] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.605] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0285780.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285780.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285780.WMF"
	[0054.605] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf36e46d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf36e46d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3946e4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x523e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285782.WMF", cAlternateFileName="")) returned 1
	[0054.605] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.605] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0285782.WMF") returned -1
	[0054.605] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0285782.WMF") returned -1
	[0054.605] lstrcmpiA (lpString1="", lpString2="J0285782.WMF") returned -1
	[0054.605] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285780.WMF") returned="J0285780.WMF"
	[0054.605] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.605] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.605] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.605] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.606] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0285782.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285782.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285782.WMF"
	[0054.606] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf36e46d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf36e46d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3946e4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2eb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285792.WMF", cAlternateFileName="")) returned 1
	[0054.606] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.606] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0285792.WMF") returned -1
	[0054.606] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0285792.WMF") returned -1
	[0054.607] lstrcmpiA (lpString1="", lpString2="J0285792.WMF") returned -1
	[0054.607] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285782.WMF") returned="J0285782.WMF"
	[0054.607] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.607] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.607] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.607] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.607] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0285792.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF"
	[0054.608] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf36e46d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf36e46d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf36e46d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3550, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285796.WMF", cAlternateFileName="")) returned 1
	[0054.608] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.608] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0285796.WMF") returned -1
	[0054.608] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0285796.WMF") returned -1
	[0054.608] lstrcmpiA (lpString1="", lpString2="J0285796.WMF") returned -1
	[0054.608] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF") returned="J0285792.WMF"
	[0054.608] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.608] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.608] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.608] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.608] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0285796.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285796.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285796.WMF"
	[0054.608] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf36e46d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf36e46d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3946e4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x23f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285808.WMF", cAlternateFileName="")) returned 1
	[0054.608] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.608] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0285808.WMF") returned -1
	[0054.608] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0285808.WMF") returned -1
	[0054.608] lstrcmpiA (lpString1="", lpString2="J0285808.WMF") returned -1
	[0054.608] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285796.WMF") returned="J0285796.WMF"
	[0054.608] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.608] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.608] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.608] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.608] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0285808.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285808.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285808.WMF"
	[0054.608] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf36e46d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf36e46d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3946e4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2210, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285820.WMF", cAlternateFileName="")) returned 1
	[0054.609] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.609] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0285820.WMF") returned -1
	[0054.609] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0285820.WMF") returned -1
	[0054.609] lstrcmpiA (lpString1="", lpString2="J0285820.WMF") returned -1
	[0054.609] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285808.WMF") returned="J0285808.WMF"
	[0054.609] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.609] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.610] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.610] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.610] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0285820.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285820.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285820.WMF"
	[0054.610] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf36e46d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf36e46d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3946e4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x21a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285822.WMF", cAlternateFileName="")) returned 1
	[0054.610] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.610] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0285822.WMF") returned -1
	[0054.610] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0285822.WMF") returned -1
	[0054.610] lstrcmpiA (lpString1="", lpString2="J0285822.WMF") returned -1
	[0054.610] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285820.WMF") returned="J0285820.WMF"
	[0054.610] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.610] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.610] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.610] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.610] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0285822.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285822.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285822.WMF"
	[0054.610] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf36e46d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf36e46d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf36e46d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7898, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287018.WMF", cAlternateFileName="")) returned 1
	[0054.610] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.610] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0287018.WMF") returned -1
	[0054.610] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0287018.WMF") returned -1
	[0054.610] lstrcmpiA (lpString1="", lpString2="J0287018.WMF") returned -1
	[0054.610] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285822.WMF") returned="J0285822.WMF"
	[0054.610] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.610] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.610] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.610] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.611] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0287018.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287018.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287018.WMF"
	[0054.611] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3ba90e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3ba90e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3ba90e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x931a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287019.WMF", cAlternateFileName="")) returned 1
	[0054.611] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.611] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0287019.WMF") returned -1
	[0054.611] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0287019.WMF") returned -1
	[0054.611] lstrcmpiA (lpString1="", lpString2="J0287019.WMF") returned -1
	[0054.611] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287018.WMF") returned="J0287018.WMF"
	[0054.611] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.611] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.611] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.611] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.611] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0287019.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287019.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287019.WMF"
	[0054.611] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3ba90e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3ba90e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3ba90e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x80d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287020.WMF", cAlternateFileName="")) returned 1
	[0054.611] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.611] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0287020.WMF") returned -1
	[0054.611] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0287020.WMF") returned -1
	[0054.611] lstrcmpiA (lpString1="", lpString2="J0287020.WMF") returned -1
	[0054.611] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287019.WMF") returned="J0287019.WMF"
	[0054.611] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.611] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.611] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.611] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.611] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0287020.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287020.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287020.WMF"
	[0054.611] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3946e4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3946e4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3ba90e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc6d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287024.WMF", cAlternateFileName="")) returned 1
	[0054.611] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.620] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0287024.WMF") returned -1
	[0054.735] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0287024.WMF") returned -1
	[0054.741] lstrcmpiA (lpString1="", lpString2="J0287024.WMF") returned -1
	[0054.743] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287020.WMF") returned="J0287020.WMF"
	[0054.743] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.743] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.743] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.743] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.743] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0287024.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287024.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287024.WMF"
	[0054.743] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3946e4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3946e4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3ba90e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xcd10, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287408.WMF", cAlternateFileName="")) returned 1
	[0054.743] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.744] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0287408.WMF") returned -1
	[0054.744] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0287408.WMF") returned -1
	[0054.744] lstrcmpiA (lpString1="", lpString2="J0287408.WMF") returned -1
	[0054.744] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287024.WMF") returned="J0287024.WMF"
	[0054.744] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.744] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.744] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.744] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.744] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0287408.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287408.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287408.WMF"
	[0054.744] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3946e4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3946e4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3ba90e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa80c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287415.WMF", cAlternateFileName="")) returned 1
	[0054.744] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.744] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0287415.WMF") returned -1
	[0054.744] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0287415.WMF") returned -1
	[0054.744] lstrcmpiA (lpString1="", lpString2="J0287415.WMF") returned -1
	[0054.744] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287408.WMF") returned="J0287408.WMF"
	[0054.744] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.744] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.744] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.744] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.744] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0287415.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287415.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287415.WMF"
	[0054.744] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3946e4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3946e4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3946e4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd6bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287417.WMF", cAlternateFileName="")) returned 1
	[0054.744] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.744] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287415.WMF") returned="J0287415.WMF"
	[0054.745] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.745] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.745] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.745] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.745] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0287417.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287417.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287417.WMF"
	[0054.745] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3946e4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3946e4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3ba90e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x89a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287641.JPG", cAlternateFileName="")) returned 1
	[0054.745] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.745] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287417.WMF") returned="J0287417.WMF"
	[0054.745] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.745] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.745] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.745] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.745] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0287641.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287641.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287641.JPG"
	[0054.745] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287641.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0054.746] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x89a4
	[0054.746] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf3946e4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf3946e4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf3ba90e, dwHighDateTime=0x1d327e8)) returned 1
	[0054.746] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.746] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x8962, lpOverlapped=0x0) returned 1
	[0054.749] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287641.JPG") returned="J0287641.JPG"
	[0054.749] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.749] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x8962, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x8962, lpOverlapped=0x0) returned 1
	[0054.750] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.750] CloseHandle (hObject=0x214) returned 1
	[0054.751] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287641.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287641.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287641.jpg.exe")) returned 1
	[0054.752] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3946e4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3946e4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3946e4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x42d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287642.JPG", cAlternateFileName="")) returned 1
	[0054.752] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.752] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0287642.JPG") returned -1
	[0054.752] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0287642.JPG") returned -1
	[0054.752] lstrcmpiA (lpString1="", lpString2="J0287642.JPG") returned -1
	[0054.752] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287641.JPG") returned="J0287641.JPG"
	[0054.752] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.752] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.752] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.752] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.752] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0287642.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG"
	[0054.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG", pszSpec="*.zip") returned 0
	[0054.752] lstrlenA (lpString="*.zip") returned 5
	[0054.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG", pszSpec="*.rar") returned 0
	[0054.752] lstrlenA (lpString="*.rar") returned 5
	[0054.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG", pszSpec="*.7z") returned 0
	[0054.752] lstrlenA (lpString="*.7z") returned 4
	[0054.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG", pszSpec="*.tar") returned 0
	[0054.752] lstrlenA (lpString="*.tar") returned 5
	[0054.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG", pszSpec="*.gzip") returned 0
	[0054.752] lstrlenA (lpString="*.gzip") returned 6
	[0054.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG", pszSpec="*.jpg") returned 1
	[0054.752] lstrlenA (lpString="*.jpg") returned 5
	[0054.753] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG"
	[0054.753] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG"
	[0054.753] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG."
	[0054.753] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG.exe"
	[0054.753] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287642.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0054.753] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x42d1
	[0054.753] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf3946e4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf3946e4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf3946e4, dwHighDateTime=0x1d327e8)) returned 1
	[0054.753] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.753] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x428f, lpOverlapped=0x0) returned 1
	[0054.755] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG") returned="J0287642.JPG"
	[0054.755] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.755] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x428f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x428f, lpOverlapped=0x0) returned 1
	[0054.755] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.755] CloseHandle (hObject=0x214) returned 1
	[0054.756] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287642.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287642.jpg.exe")) returned 1
	[0054.757] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3946e4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3946e4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3946e4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3e91, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287643.JPG", cAlternateFileName="")) returned 1
	[0054.757] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.757] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0287643.JPG") returned -1
	[0054.757] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0287643.JPG") returned -1
	[0054.757] lstrcmpiA (lpString1="", lpString2="J0287643.JPG") returned -1
	[0054.757] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG") returned="J0287642.JPG"
	[0054.757] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.757] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.757] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.757] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.757] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0287643.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG"
	[0054.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG", pszSpec="*.zip") returned 0
	[0054.757] lstrlenA (lpString="*.zip") returned 5
	[0054.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG", pszSpec="*.rar") returned 0
	[0054.757] lstrlenA (lpString="*.rar") returned 5
	[0054.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG", pszSpec="*.7z") returned 0
	[0054.757] lstrlenA (lpString="*.7z") returned 4
	[0054.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG", pszSpec="*.tar") returned 0
	[0054.757] lstrlenA (lpString="*.tar") returned 5
	[0054.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG", pszSpec="*.gzip") returned 0
	[0054.757] lstrlenA (lpString="*.gzip") returned 6
	[0054.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG", pszSpec="*.jpg") returned 1
	[0054.757] lstrlenA (lpString="*.jpg") returned 5
	[0054.757] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG"
	[0054.757] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG"
	[0054.758] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG."
	[0054.758] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG.exe"
	[0054.758] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287643.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0054.758] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e91
	[0054.758] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf3946e4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf3946e4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf3946e4, dwHighDateTime=0x1d327e8)) returned 1
	[0054.758] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.758] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x3e4f, lpOverlapped=0x0) returned 1
	[0054.759] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG") returned="J0287643.JPG"
	[0054.759] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.759] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x3e4f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x3e4f, lpOverlapped=0x0) returned 1
	[0054.760] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.760] CloseHandle (hObject=0x214) returned 1
	[0054.761] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287643.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287643.jpg.exe")) returned 1
	[0054.761] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3946e4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3946e4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3946e4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x43c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287644.JPG", cAlternateFileName="")) returned 1
	[0054.761] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.761] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0287644.JPG") returned -1
	[0054.761] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0287644.JPG") returned -1
	[0054.761] lstrcmpiA (lpString1="", lpString2="J0287644.JPG") returned -1
	[0054.761] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG") returned="J0287643.JPG"
	[0054.761] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.761] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.761] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.761] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.761] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0287644.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG"
	[0054.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG", pszSpec="*.zip") returned 0
	[0054.761] lstrlenA (lpString="*.zip") returned 5
	[0054.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG", pszSpec="*.rar") returned 0
	[0054.762] lstrlenA (lpString="*.rar") returned 5
	[0054.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG", pszSpec="*.7z") returned 0
	[0054.762] lstrlenA (lpString="*.7z") returned 4
	[0054.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG", pszSpec="*.tar") returned 0
	[0054.762] lstrlenA (lpString="*.tar") returned 5
	[0054.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG", pszSpec="*.gzip") returned 0
	[0054.762] lstrlenA (lpString="*.gzip") returned 6
	[0054.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG", pszSpec="*.jpg") returned 1
	[0054.762] lstrlenA (lpString="*.jpg") returned 5
	[0054.762] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG"
	[0054.762] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG"
	[0054.762] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG."
	[0054.762] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG.exe"
	[0054.762] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287644.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0054.816] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43c5
	[0054.816] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf3946e4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf3946e4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf3946e4, dwHighDateTime=0x1d327e8)) returned 1
	[0054.816] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.816] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x4383, lpOverlapped=0x0) returned 1
	[0054.818] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG") returned="J0287644.JPG"
	[0054.818] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.818] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x4383, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x4383, lpOverlapped=0x0) returned 1
	[0054.818] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.818] CloseHandle (hObject=0x214) returned 1
	[0054.819] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287644.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287644.jpg.exe")) returned 1
	[0054.820] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3ba90e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3ba90e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3ba90e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8d86, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287645.JPG", cAlternateFileName="")) returned 1
	[0054.820] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.820] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0287645.JPG") returned -1
	[0054.820] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0287645.JPG") returned -1
	[0054.820] lstrcmpiA (lpString1="", lpString2="J0287645.JPG") returned -1
	[0054.820] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG") returned="J0287644.JPG"
	[0054.820] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.820] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.820] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.820] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.820] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0287645.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG"
	[0054.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG", pszSpec="*.zip") returned 0
	[0054.820] lstrlenA (lpString="*.zip") returned 5
	[0054.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG", pszSpec="*.rar") returned 0
	[0054.821] lstrlenA (lpString="*.rar") returned 5
	[0054.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG", pszSpec="*.7z") returned 0
	[0054.821] lstrlenA (lpString="*.7z") returned 4
	[0054.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG", pszSpec="*.tar") returned 0
	[0054.821] lstrlenA (lpString="*.tar") returned 5
	[0054.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG", pszSpec="*.gzip") returned 0
	[0054.821] lstrlenA (lpString="*.gzip") returned 6
	[0054.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG", pszSpec="*.jpg") returned 1
	[0054.821] lstrlenA (lpString="*.jpg") returned 5
	[0054.821] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG"
	[0054.821] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG"
	[0054.821] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG."
	[0054.821] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG.exe"
	[0054.821] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287645.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0054.822] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8d86
	[0054.822] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf3ba90e, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf3ba90e, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf3ba90e, dwHighDateTime=0x1d327e8)) returned 1
	[0054.822] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.822] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x8d44, lpOverlapped=0x0) returned 1
	[0054.823] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG") returned="J0287645.JPG"
	[0054.823] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.823] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x8d44, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x8d44, lpOverlapped=0x0) returned 1
	[0054.824] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.824] CloseHandle (hObject=0x214) returned 1
	[0054.825] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287645.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287645.jpg.exe")) returned 1
	[0054.826] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3ba90e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3ba90e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3ba90e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2d21, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0289430.JPG", cAlternateFileName="")) returned 1
	[0054.826] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.826] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0289430.JPG") returned -1
	[0054.826] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0289430.JPG") returned -1
	[0054.826] lstrcmpiA (lpString1="", lpString2="J0289430.JPG") returned -1
	[0054.826] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG") returned="J0287645.JPG"
	[0054.826] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.826] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.826] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.826] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG", pszSpec="*.zip") returned 0
	[0054.826] lstrlenA (lpString="*.zip") returned 5
	[0054.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG", pszSpec="*.rar") returned 0
	[0054.826] lstrlenA (lpString="*.rar") returned 5
	[0054.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG", pszSpec="*.7z") returned 0
	[0054.827] lstrlenA (lpString="*.7z") returned 4
	[0054.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG", pszSpec="*.tar") returned 0
	[0054.827] lstrlenA (lpString="*.tar") returned 5
	[0054.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG", pszSpec="*.gzip") returned 0
	[0054.827] lstrlenA (lpString="*.gzip") returned 6
	[0054.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG", pszSpec="*.jpg") returned 1
	[0054.827] lstrlenA (lpString="*.jpg") returned 5
	[0054.827] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG"
	[0054.827] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG"
	[0054.827] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0289430.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0054.827] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d21
	[0054.827] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf3ba90e, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf3ba90e, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf3ba90e, dwHighDateTime=0x1d327e8)) returned 1
	[0054.827] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.828] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x2cdf, lpOverlapped=0x0) returned 1
	[0054.829] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG") returned="J0289430.JPG"
	[0054.829] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.829] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x2cdf, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x2cdf, lpOverlapped=0x0) returned 1
	[0054.829] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.829] CloseHandle (hObject=0x214) returned 1
	[0054.830] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0289430.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0289430.jpg.exe")) returned 1
	[0054.830] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3ba90e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3ba90e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3ba90e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9e8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0290548.WMF", cAlternateFileName="")) returned 1
	[0054.830] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.830] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0290548.WMF") returned -1
	[0054.830] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0290548.WMF") returned -1
	[0054.830] lstrcmpiA (lpString1="", lpString2="J0290548.WMF") returned -1
	[0054.830] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG") returned="J0289430.JPG"
	[0054.831] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.831] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.831] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.831] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.831] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0290548.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF"
	[0054.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.zip") returned 0
	[0054.831] lstrlenA (lpString="*.zip") returned 5
	[0054.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.rar") returned 0
	[0054.831] lstrlenA (lpString="*.rar") returned 5
	[0054.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.7z") returned 0
	[0054.831] lstrlenA (lpString="*.7z") returned 4
	[0054.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.tar") returned 0
	[0054.831] lstrlenA (lpString="*.tar") returned 5
	[0054.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.gzip") returned 0
	[0054.831] lstrlenA (lpString="*.gzip") returned 6
	[0054.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.jpg") returned 0
	[0054.831] lstrlenA (lpString="*.jpg") returned 5
	[0054.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.jpeg") returned 0
	[0054.831] lstrlenA (lpString="*.jpeg") returned 6
	[0054.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.bmp") returned 0
	[0054.831] lstrlenA (lpString="*.bmp") returned 5
	[0054.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.gif") returned 0
	[0054.831] lstrlenA (lpString="*.gif") returned 5
	[0054.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.png") returned 0
	[0054.831] lstrlenA (lpString="*.png") returned 5
	[0054.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.doc") returned 0
	[0054.831] lstrlenA (lpString="*.doc") returned 5
	[0054.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.docx") returned 0
	[0054.831] lstrlenA (lpString="*.docx") returned 6
	[0054.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.xls") returned 0
	[0054.831] lstrlenA (lpString="*.xls") returned 5
	[0054.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.xlsx") returned 0
	[0054.831] lstrlenA (lpString="*.xlsx") returned 6
	[0054.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.ppt") returned 0
	[0054.832] lstrlenA (lpString="*.ppt") returned 5
	[0054.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.pptx") returned 0
	[0054.832] lstrlenA (lpString="*.pptx") returned 6
	[0054.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.txt") returned 0
	[0054.832] lstrlenA (lpString="*.txt") returned 5
	[0054.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.pdf") returned 0
	[0054.832] lstrlenA (lpString="*.pdf") returned 5
	[0054.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.htm") returned 0
	[0054.832] lstrlenA (lpString="*.htm") returned 5
	[0054.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.html") returned 0
	[0054.832] lstrlenA (lpString="*.html") returned 6
	[0054.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.mdb") returned 0
	[0054.832] lstrlenA (lpString="*.mdb") returned 5
	[0054.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.pfx") returned 0
	[0054.832] lstrlenA (lpString="*.pfx") returned 5
	[0054.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.md") returned 0
	[0054.832] lstrlenA (lpString="*.md") returned 4
	[0054.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.lnk") returned 0
	[0054.832] lstrlenA (lpString="*.lnk") returned 5
	[0054.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.torrent") returned 0
	[0054.832] lstrlenA (lpString="*.torrent") returned 9
	[0054.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.mov") returned 0
	[0054.832] lstrlenA (lpString="*.mov") returned 5
	[0054.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.3gp") returned 0
	[0054.832] lstrlenA (lpString="*.3gp") returned 5
	[0054.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.mpeg") returned 0
	[0054.832] lstrlenA (lpString="*.mpeg") returned 6
	[0054.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.mpg") returned 0
	[0054.832] lstrlenA (lpString="*.mpg") returned 5
	[0054.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.flv") returned 0
	[0054.832] lstrlenA (lpString="*.flv") returned 5
	[0054.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.avi") returned 0
	[0054.832] lstrlenA (lpString="*.avi") returned 5
	[0054.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.mp4") returned 0
	[0054.832] lstrlenA (lpString="*.mp4") returned 5
	[0054.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.wmv") returned 0
	[0054.833] lstrlenA (lpString="*.wmv") returned 5
	[0054.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.mkv") returned 0
	[0054.833] lstrlenA (lpString="*.mkv") returned 5
	[0054.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.mp3") returned 0
	[0054.833] lstrlenA (lpString="*.mp3") returned 5
	[0054.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.wav") returned 0
	[0054.833] lstrlenA (lpString="*.wav") returned 5
	[0054.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.flac") returned 0
	[0054.833] lstrlenA (lpString="*.flac") returned 6
	[0054.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.wma") returned 0
	[0054.833] lstrlenA (lpString="*.wma") returned 5
	[0054.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.au3") returned 0
	[0054.833] lstrlenA (lpString="*.au3") returned 5
	[0054.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.ahk") returned 0
	[0054.833] lstrlenA (lpString="*.ahk") returned 5
	[0054.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.c") returned 0
	[0054.833] lstrlenA (lpString="*.c") returned 3
	[0054.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.cc") returned 0
	[0054.833] lstrlenA (lpString="*.cc") returned 4
	[0054.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.cpp") returned 0
	[0054.833] lstrlenA (lpString="*.cpp") returned 5
	[0054.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.cxx") returned 0
	[0054.833] lstrlenA (lpString="*.cxx") returned 5
	[0054.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.c++") returned 0
	[0054.833] lstrlenA (lpString="*.c++") returned 5
	[0054.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.cs") returned 0
	[0054.833] lstrlenA (lpString="*.cs") returned 4
	[0054.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.vb") returned 0
	[0054.833] lstrlenA (lpString="*.vb") returned 4
	[0054.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.bas") returned 0
	[0054.833] lstrlenA (lpString="*.bas") returned 5
	[0054.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.csproj") returned 0
	[0054.833] lstrlenA (lpString="*.csproj") returned 8
	[0054.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.vbproj") returned 0
	[0054.833] lstrlenA (lpString="*.vbproj") returned 8
	[0054.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.vcxproj") returned 0
	[0054.834] lstrlenA (lpString="*.vcxproj") returned 9
	[0054.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.manifest") returned 0
	[0054.834] lstrlenA (lpString="*.manifest") returned 10
	[0054.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.php") returned 0
	[0054.834] lstrlenA (lpString="*.php") returned 5
	[0054.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.vbe") returned 0
	[0054.834] lstrlenA (lpString="*.vbe") returned 5
	[0054.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.vba") returned 0
	[0054.834] lstrlenA (lpString="*.vba") returned 5
	[0054.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.vbs") returned 0
	[0054.834] lstrlenA (lpString="*.vbs") returned 5
	[0054.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.bat") returned 0
	[0054.834] lstrlenA (lpString="*.bat") returned 5
	[0054.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.cmd") returned 0
	[0054.834] lstrlenA (lpString="*.cmd") returned 5
	[0054.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.js") returned 0
	[0054.834] lstrlenA (lpString="*.js") returned 4
	[0054.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.jscript") returned 0
	[0054.834] lstrlenA (lpString="*.jscript") returned 9
	[0054.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.hta") returned 0
	[0054.834] lstrlenA (lpString="*.hta") returned 5
	[0054.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.php7") returned 0
	[0054.834] lstrlenA (lpString="*.php7") returned 6
	[0054.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.db") returned 0
	[0054.834] lstrlenA (lpString="*.db") returned 4
	[0054.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.swf") returned 0
	[0054.834] lstrlenA (lpString="*.swf") returned 5
	[0054.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.eml") returned 0
	[0054.834] lstrlenA (lpString="*.eml") returned 5
	[0054.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.part") returned 0
	[0054.834] lstrlenA (lpString="*.part") returned 6
	[0054.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.nfo") returned 0
	[0054.834] lstrlenA (lpString="*.nfo") returned 5
	[0054.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.rsa") returned 0
	[0054.834] lstrlenA (lpString="*.rsa") returned 5
	[0054.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.key") returned 0
	[0054.835] lstrlenA (lpString="*.key") returned 5
	[0054.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.aes") returned 0
	[0054.835] lstrlenA (lpString="*.aes") returned 5
	[0054.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.blob") returned 0
	[0054.835] lstrlenA (lpString="*.blob") returned 6
	[0054.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.btc") returned 0
	[0054.835] lstrlenA (lpString="*.btc") returned 5
	[0054.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF", pszSpec="*.wallet") returned 0
	[0054.835] lstrlenA (lpString="*.wallet") returned 8
	[0054.835] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3ba90e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3ba90e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3ba90e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2590, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0291794.WMF", cAlternateFileName="")) returned 1
	[0054.835] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.835] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0291794.WMF") returned -1
	[0054.835] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0291794.WMF") returned -1
	[0054.835] lstrcmpiA (lpString1="", lpString2="J0291794.WMF") returned -1
	[0054.835] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF") returned="J0290548.WMF"
	[0054.835] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.835] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.835] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.835] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.835] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0291794.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF"
	[0054.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.zip") returned 0
	[0054.835] lstrlenA (lpString="*.zip") returned 5
	[0054.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.rar") returned 0
	[0054.835] lstrlenA (lpString="*.rar") returned 5
	[0054.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.7z") returned 0
	[0054.835] lstrlenA (lpString="*.7z") returned 4
	[0054.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.tar") returned 0
	[0054.835] lstrlenA (lpString="*.tar") returned 5
	[0054.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.gzip") returned 0
	[0054.835] lstrlenA (lpString="*.gzip") returned 6
	[0054.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.jpg") returned 0
	[0054.835] lstrlenA (lpString="*.jpg") returned 5
	[0054.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.jpeg") returned 0
	[0054.836] lstrlenA (lpString="*.jpeg") returned 6
	[0054.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.bmp") returned 0
	[0054.836] lstrlenA (lpString="*.bmp") returned 5
	[0054.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.gif") returned 0
	[0054.836] lstrlenA (lpString="*.gif") returned 5
	[0054.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.png") returned 0
	[0054.836] lstrlenA (lpString="*.png") returned 5
	[0054.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.doc") returned 0
	[0054.836] lstrlenA (lpString="*.doc") returned 5
	[0054.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.docx") returned 0
	[0054.836] lstrlenA (lpString="*.docx") returned 6
	[0054.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.xls") returned 0
	[0054.836] lstrlenA (lpString="*.xls") returned 5
	[0054.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.xlsx") returned 0
	[0054.836] lstrlenA (lpString="*.xlsx") returned 6
	[0054.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.ppt") returned 0
	[0054.836] lstrlenA (lpString="*.ppt") returned 5
	[0054.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.pptx") returned 0
	[0054.836] lstrlenA (lpString="*.pptx") returned 6
	[0054.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.txt") returned 0
	[0054.836] lstrlenA (lpString="*.txt") returned 5
	[0054.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.pdf") returned 0
	[0054.836] lstrlenA (lpString="*.pdf") returned 5
	[0054.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.htm") returned 0
	[0054.836] lstrlenA (lpString="*.htm") returned 5
	[0054.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.html") returned 0
	[0054.836] lstrlenA (lpString="*.html") returned 6
	[0054.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.mdb") returned 0
	[0054.836] lstrlenA (lpString="*.mdb") returned 5
	[0054.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.pfx") returned 0
	[0054.836] lstrlenA (lpString="*.pfx") returned 5
	[0054.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.md") returned 0
	[0054.836] lstrlenA (lpString="*.md") returned 4
	[0054.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.lnk") returned 0
	[0054.836] lstrlenA (lpString="*.lnk") returned 5
	[0054.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.torrent") returned 0
	[0054.837] lstrlenA (lpString="*.torrent") returned 9
	[0054.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.mov") returned 0
	[0054.837] lstrlenA (lpString="*.mov") returned 5
	[0054.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.3gp") returned 0
	[0054.837] lstrlenA (lpString="*.3gp") returned 5
	[0054.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.mpeg") returned 0
	[0054.837] lstrlenA (lpString="*.mpeg") returned 6
	[0054.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.mpg") returned 0
	[0054.837] lstrlenA (lpString="*.mpg") returned 5
	[0054.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.flv") returned 0
	[0054.837] lstrlenA (lpString="*.flv") returned 5
	[0054.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.avi") returned 0
	[0054.837] lstrlenA (lpString="*.avi") returned 5
	[0054.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.mp4") returned 0
	[0054.837] lstrlenA (lpString="*.mp4") returned 5
	[0054.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.wmv") returned 0
	[0054.837] lstrlenA (lpString="*.wmv") returned 5
	[0054.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.mkv") returned 0
	[0054.837] lstrlenA (lpString="*.mkv") returned 5
	[0054.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.mp3") returned 0
	[0054.837] lstrlenA (lpString="*.mp3") returned 5
	[0054.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.wav") returned 0
	[0054.837] lstrlenA (lpString="*.wav") returned 5
	[0054.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.flac") returned 0
	[0054.837] lstrlenA (lpString="*.flac") returned 6
	[0054.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.wma") returned 0
	[0054.837] lstrlenA (lpString="*.wma") returned 5
	[0054.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.au3") returned 0
	[0054.837] lstrlenA (lpString="*.au3") returned 5
	[0054.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.ahk") returned 0
	[0054.837] lstrlenA (lpString="*.ahk") returned 5
	[0054.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.c") returned 0
	[0054.837] lstrlenA (lpString="*.c") returned 3
	[0054.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.cc") returned 0
	[0054.837] lstrlenA (lpString="*.cc") returned 4
	[0054.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.cpp") returned 0
	[0054.837] lstrlenA (lpString="*.cpp") returned 5
	[0054.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.cxx") returned 0
	[0054.838] lstrlenA (lpString="*.cxx") returned 5
	[0054.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.c++") returned 0
	[0054.838] lstrlenA (lpString="*.c++") returned 5
	[0054.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.cs") returned 0
	[0054.838] lstrlenA (lpString="*.cs") returned 4
	[0054.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.vb") returned 0
	[0054.838] lstrlenA (lpString="*.vb") returned 4
	[0054.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.bas") returned 0
	[0054.838] lstrlenA (lpString="*.bas") returned 5
	[0054.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.csproj") returned 0
	[0054.838] lstrlenA (lpString="*.csproj") returned 8
	[0054.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.vbproj") returned 0
	[0054.838] lstrlenA (lpString="*.vbproj") returned 8
	[0054.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.vcxproj") returned 0
	[0054.838] lstrlenA (lpString="*.vcxproj") returned 9
	[0054.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.manifest") returned 0
	[0054.838] lstrlenA (lpString="*.manifest") returned 10
	[0054.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.php") returned 0
	[0054.838] lstrlenA (lpString="*.php") returned 5
	[0054.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.vbe") returned 0
	[0054.838] lstrlenA (lpString="*.vbe") returned 5
	[0054.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.vba") returned 0
	[0054.838] lstrlenA (lpString="*.vba") returned 5
	[0054.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.vbs") returned 0
	[0054.838] lstrlenA (lpString="*.vbs") returned 5
	[0054.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.bat") returned 0
	[0054.838] lstrlenA (lpString="*.bat") returned 5
	[0054.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.cmd") returned 0
	[0054.838] lstrlenA (lpString="*.cmd") returned 5
	[0054.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.js") returned 0
	[0054.838] lstrlenA (lpString="*.js") returned 4
	[0054.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.jscript") returned 0
	[0054.838] lstrlenA (lpString="*.jscript") returned 9
	[0054.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.hta") returned 0
	[0054.838] lstrlenA (lpString="*.hta") returned 5
	[0054.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.php7") returned 0
	[0054.839] lstrlenA (lpString="*.php7") returned 6
	[0054.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.db") returned 0
	[0054.839] lstrlenA (lpString="*.db") returned 4
	[0054.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.swf") returned 0
	[0054.839] lstrlenA (lpString="*.swf") returned 5
	[0054.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.eml") returned 0
	[0054.839] lstrlenA (lpString="*.eml") returned 5
	[0054.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.part") returned 0
	[0054.839] lstrlenA (lpString="*.part") returned 6
	[0054.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.nfo") returned 0
	[0054.839] lstrlenA (lpString="*.nfo") returned 5
	[0054.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.rsa") returned 0
	[0054.839] lstrlenA (lpString="*.rsa") returned 5
	[0054.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.key") returned 0
	[0054.839] lstrlenA (lpString="*.key") returned 5
	[0054.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.aes") returned 0
	[0054.839] lstrlenA (lpString="*.aes") returned 5
	[0054.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.blob") returned 0
	[0054.839] lstrlenA (lpString="*.blob") returned 6
	[0054.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.btc") returned 0
	[0054.839] lstrlenA (lpString="*.btc") returned 5
	[0054.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF", pszSpec="*.wallet") returned 0
	[0054.839] lstrlenA (lpString="*.wallet") returned 8
	[0054.839] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3ba90e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3ba90e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3ba90e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x20e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292248.WMF", cAlternateFileName="")) returned 1
	[0054.839] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.839] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0292248.WMF") returned -1
	[0054.839] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0292248.WMF") returned -1
	[0054.839] lstrcmpiA (lpString1="", lpString2="J0292248.WMF") returned -1
	[0054.839] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF") returned="J0291794.WMF"
	[0054.839] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.839] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.839] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.839] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.840] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0292248.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF"
	[0054.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.zip") returned 0
	[0054.840] lstrlenA (lpString="*.zip") returned 5
	[0054.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.rar") returned 0
	[0054.840] lstrlenA (lpString="*.rar") returned 5
	[0054.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.7z") returned 0
	[0054.840] lstrlenA (lpString="*.7z") returned 4
	[0054.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.tar") returned 0
	[0054.840] lstrlenA (lpString="*.tar") returned 5
	[0054.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.gzip") returned 0
	[0054.840] lstrlenA (lpString="*.gzip") returned 6
	[0054.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.jpg") returned 0
	[0054.840] lstrlenA (lpString="*.jpg") returned 5
	[0054.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.jpeg") returned 0
	[0054.840] lstrlenA (lpString="*.jpeg") returned 6
	[0054.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.bmp") returned 0
	[0054.840] lstrlenA (lpString="*.bmp") returned 5
	[0054.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.gif") returned 0
	[0054.840] lstrlenA (lpString="*.gif") returned 5
	[0054.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.png") returned 0
	[0054.840] lstrlenA (lpString="*.png") returned 5
	[0054.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.doc") returned 0
	[0054.840] lstrlenA (lpString="*.doc") returned 5
	[0054.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.docx") returned 0
	[0054.876] lstrlenA (lpString="*.docx") returned 6
	[0054.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.xls") returned 0
	[0054.880] lstrlenA (lpString="*.xls") returned 5
	[0054.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.xlsx") returned 0
	[0054.888] lstrlenA (lpString="*.xlsx") returned 6
	[0054.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.ppt") returned 0
	[0054.894] lstrlenA (lpString="*.ppt") returned 5
	[0054.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.pptx") returned 0
	[0054.896] lstrlenA (lpString="*.pptx") returned 6
	[0054.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.txt") returned 0
	[0054.897] lstrlenA (lpString="*.txt") returned 5
	[0054.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.pdf") returned 0
	[0054.897] lstrlenA (lpString="*.pdf") returned 5
	[0054.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.htm") returned 0
	[0054.897] lstrlenA (lpString="*.htm") returned 5
	[0054.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.html") returned 0
	[0054.897] lstrlenA (lpString="*.html") returned 6
	[0054.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.mdb") returned 0
	[0054.897] lstrlenA (lpString="*.mdb") returned 5
	[0054.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.pfx") returned 0
	[0054.897] lstrlenA (lpString="*.pfx") returned 5
	[0054.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.md") returned 0
	[0054.897] lstrlenA (lpString="*.md") returned 4
	[0054.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.lnk") returned 0
	[0054.897] lstrlenA (lpString="*.lnk") returned 5
	[0054.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.torrent") returned 0
	[0054.897] lstrlenA (lpString="*.torrent") returned 9
	[0054.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.mov") returned 0
	[0054.897] lstrlenA (lpString="*.mov") returned 5
	[0054.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.3gp") returned 0
	[0054.897] lstrlenA (lpString="*.3gp") returned 5
	[0054.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.mpeg") returned 0
	[0054.897] lstrlenA (lpString="*.mpeg") returned 6
	[0054.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.mpg") returned 0
	[0054.897] lstrlenA (lpString="*.mpg") returned 5
	[0054.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.flv") returned 0
	[0054.897] lstrlenA (lpString="*.flv") returned 5
	[0054.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.avi") returned 0
	[0054.897] lstrlenA (lpString="*.avi") returned 5
	[0054.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.mp4") returned 0
	[0054.898] lstrlenA (lpString="*.mp4") returned 5
	[0054.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.wmv") returned 0
	[0054.898] lstrlenA (lpString="*.wmv") returned 5
	[0054.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.mkv") returned 0
	[0054.898] lstrlenA (lpString="*.mkv") returned 5
	[0054.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.mp3") returned 0
	[0054.898] lstrlenA (lpString="*.mp3") returned 5
	[0054.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.wav") returned 0
	[0054.898] lstrlenA (lpString="*.wav") returned 5
	[0054.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.flac") returned 0
	[0054.898] lstrlenA (lpString="*.flac") returned 6
	[0054.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.wma") returned 0
	[0054.898] lstrlenA (lpString="*.wma") returned 5
	[0054.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.au3") returned 0
	[0054.898] lstrlenA (lpString="*.au3") returned 5
	[0054.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.ahk") returned 0
	[0054.898] lstrlenA (lpString="*.ahk") returned 5
	[0054.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.c") returned 0
	[0054.898] lstrlenA (lpString="*.c") returned 3
	[0054.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.cc") returned 0
	[0054.898] lstrlenA (lpString="*.cc") returned 4
	[0054.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.cpp") returned 0
	[0054.898] lstrlenA (lpString="*.cpp") returned 5
	[0054.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.cxx") returned 0
	[0054.898] lstrlenA (lpString="*.cxx") returned 5
	[0054.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.c++") returned 0
	[0054.898] lstrlenA (lpString="*.c++") returned 5
	[0054.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.cs") returned 0
	[0054.898] lstrlenA (lpString="*.cs") returned 4
	[0054.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.vb") returned 0
	[0054.898] lstrlenA (lpString="*.vb") returned 4
	[0054.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.bas") returned 0
	[0054.898] lstrlenA (lpString="*.bas") returned 5
	[0054.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.csproj") returned 0
	[0054.898] lstrlenA (lpString="*.csproj") returned 8
	[0054.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.vbproj") returned 0
	[0054.899] lstrlenA (lpString="*.vbproj") returned 8
	[0054.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.vcxproj") returned 0
	[0054.899] lstrlenA (lpString="*.vcxproj") returned 9
	[0054.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.manifest") returned 0
	[0054.899] lstrlenA (lpString="*.manifest") returned 10
	[0054.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.php") returned 0
	[0054.899] lstrlenA (lpString="*.php") returned 5
	[0054.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.vbe") returned 0
	[0054.899] lstrlenA (lpString="*.vbe") returned 5
	[0054.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.vba") returned 0
	[0054.899] lstrlenA (lpString="*.vba") returned 5
	[0054.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.vbs") returned 0
	[0054.899] lstrlenA (lpString="*.vbs") returned 5
	[0054.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.bat") returned 0
	[0054.899] lstrlenA (lpString="*.bat") returned 5
	[0054.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.cmd") returned 0
	[0054.899] lstrlenA (lpString="*.cmd") returned 5
	[0054.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.js") returned 0
	[0054.899] lstrlenA (lpString="*.js") returned 4
	[0054.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.jscript") returned 0
	[0054.899] lstrlenA (lpString="*.jscript") returned 9
	[0054.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.hta") returned 0
	[0054.899] lstrlenA (lpString="*.hta") returned 5
	[0054.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.php7") returned 0
	[0054.899] lstrlenA (lpString="*.php7") returned 6
	[0054.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.db") returned 0
	[0054.899] lstrlenA (lpString="*.db") returned 4
	[0054.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.swf") returned 0
	[0054.899] lstrlenA (lpString="*.swf") returned 5
	[0054.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.eml") returned 0
	[0054.899] lstrlenA (lpString="*.eml") returned 5
	[0054.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.part") returned 0
	[0054.899] lstrlenA (lpString="*.part") returned 6
	[0054.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.nfo") returned 0
	[0054.899] lstrlenA (lpString="*.nfo") returned 5
	[0054.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.rsa") returned 0
	[0054.899] lstrlenA (lpString="*.rsa") returned 5
	[0054.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.key") returned 0
	[0054.900] lstrlenA (lpString="*.key") returned 5
	[0054.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.aes") returned 0
	[0054.900] lstrlenA (lpString="*.aes") returned 5
	[0054.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.blob") returned 0
	[0054.900] lstrlenA (lpString="*.blob") returned 6
	[0054.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.btc") returned 0
	[0054.900] lstrlenA (lpString="*.btc") returned 5
	[0054.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF", pszSpec="*.wallet") returned 0
	[0054.900] lstrlenA (lpString="*.wallet") returned 8
	[0054.900] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3ba90e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3ba90e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3ba90e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7aa6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292270.WMF", cAlternateFileName="")) returned 1
	[0054.900] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.900] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0292270.WMF") returned -1
	[0054.900] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0292270.WMF") returned -1
	[0054.900] lstrcmpiA (lpString1="", lpString2="J0292270.WMF") returned -1
	[0054.900] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF") returned="J0292248.WMF"
	[0054.900] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.900] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.900] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.900] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.900] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0292270.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF"
	[0054.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.zip") returned 0
	[0054.900] lstrlenA (lpString="*.zip") returned 5
	[0054.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.rar") returned 0
	[0054.900] lstrlenA (lpString="*.rar") returned 5
	[0054.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.7z") returned 0
	[0054.900] lstrlenA (lpString="*.7z") returned 4
	[0054.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.tar") returned 0
	[0054.900] lstrlenA (lpString="*.tar") returned 5
	[0054.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.gzip") returned 0
	[0054.900] lstrlenA (lpString="*.gzip") returned 6
	[0054.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.jpg") returned 0
	[0054.901] lstrlenA (lpString="*.jpg") returned 5
	[0054.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.jpeg") returned 0
	[0054.901] lstrlenA (lpString="*.jpeg") returned 6
	[0054.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.bmp") returned 0
	[0054.901] lstrlenA (lpString="*.bmp") returned 5
	[0054.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.gif") returned 0
	[0054.901] lstrlenA (lpString="*.gif") returned 5
	[0054.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.png") returned 0
	[0054.901] lstrlenA (lpString="*.png") returned 5
	[0054.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.doc") returned 0
	[0054.901] lstrlenA (lpString="*.doc") returned 5
	[0054.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.docx") returned 0
	[0054.901] lstrlenA (lpString="*.docx") returned 6
	[0054.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.xls") returned 0
	[0054.901] lstrlenA (lpString="*.xls") returned 5
	[0054.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.xlsx") returned 0
	[0054.901] lstrlenA (lpString="*.xlsx") returned 6
	[0054.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.ppt") returned 0
	[0054.901] lstrlenA (lpString="*.ppt") returned 5
	[0054.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.pptx") returned 0
	[0054.901] lstrlenA (lpString="*.pptx") returned 6
	[0054.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.txt") returned 0
	[0054.901] lstrlenA (lpString="*.txt") returned 5
	[0054.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.pdf") returned 0
	[0054.901] lstrlenA (lpString="*.pdf") returned 5
	[0054.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.htm") returned 0
	[0054.901] lstrlenA (lpString="*.htm") returned 5
	[0054.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.html") returned 0
	[0054.901] lstrlenA (lpString="*.html") returned 6
	[0054.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.mdb") returned 0
	[0054.901] lstrlenA (lpString="*.mdb") returned 5
	[0054.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.pfx") returned 0
	[0054.901] lstrlenA (lpString="*.pfx") returned 5
	[0054.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.md") returned 0
	[0054.901] lstrlenA (lpString="*.md") returned 4
	[0054.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.lnk") returned 0
	[0054.902] lstrlenA (lpString="*.lnk") returned 5
	[0054.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.torrent") returned 0
	[0054.902] lstrlenA (lpString="*.torrent") returned 9
	[0054.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.mov") returned 0
	[0054.902] lstrlenA (lpString="*.mov") returned 5
	[0054.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.3gp") returned 0
	[0054.902] lstrlenA (lpString="*.3gp") returned 5
	[0054.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.mpeg") returned 0
	[0054.902] lstrlenA (lpString="*.mpeg") returned 6
	[0054.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.mpg") returned 0
	[0054.902] lstrlenA (lpString="*.mpg") returned 5
	[0054.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF", pszSpec="*.flv") returned 0
	[0054.902] lstrlenA (lpString="*.flv") returned 5
	[0054.902] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3ba90e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3ba90e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3ba90e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1b64, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292272.WMF", cAlternateFileName="")) returned 1
	[0054.902] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.902] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0292272.WMF") returned -1
	[0054.902] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0292272.WMF") returned -1
	[0054.902] lstrcmpiA (lpString1="", lpString2="J0292272.WMF") returned -1
	[0054.902] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF") returned="J0292270.WMF"
	[0054.902] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.902] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.902] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.902] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.903] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0292272.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292272.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292272.WMF"
	[0054.903] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3ba90e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3ba90e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3ba90e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3658, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292278.WMF", cAlternateFileName="")) returned 1
	[0054.903] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.903] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0292278.WMF") returned -1
	[0054.903] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0292278.WMF") returned -1
	[0054.903] lstrcmpiA (lpString1="", lpString2="J0292278.WMF") returned -1
	[0054.903] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292272.WMF") returned="J0292272.WMF"
	[0054.903] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.903] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.903] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.903] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.904] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0292278.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292278.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292278.WMF"
	[0054.904] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3ba90e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3ba90e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3ba90e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4b56, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292286.WMF", cAlternateFileName="")) returned 1
	[0054.904] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.904] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0292286.WMF") returned -1
	[0054.904] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0292286.WMF") returned -1
	[0054.904] lstrcmpiA (lpString1="", lpString2="J0292286.WMF") returned -1
	[0054.904] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292278.WMF") returned="J0292278.WMF"
	[0054.904] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.904] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.904] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.904] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.904] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0292286.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292286.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292286.WMF"
	[0054.904] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3ba90e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3ba90e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3ba90e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x12a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293800.WMF", cAlternateFileName="")) returned 1
	[0054.904] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.904] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0293800.WMF") returned -1
	[0054.904] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0293800.WMF") returned -1
	[0054.904] lstrcmpiA (lpString1="", lpString2="J0293800.WMF") returned -1
	[0054.904] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292286.WMF") returned="J0292286.WMF"
	[0054.904] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.904] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.904] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.904] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.905] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0293800.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293800.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293800.WMF"
	[0054.905] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3e0b76, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3e0b76, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3e0b76, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17be, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293832.WMF", cAlternateFileName="")) returned 1
	[0054.905] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.905] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0293832.WMF") returned -1
	[0054.905] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0293832.WMF") returned -1
	[0054.905] lstrcmpiA (lpString1="", lpString2="J0293832.WMF") returned -1
	[0054.905] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293800.WMF") returned="J0293800.WMF"
	[0054.905] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.905] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.905] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.905] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.905] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0293832.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293832.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293832.WMF"
	[0054.905] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3e0b76, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3e0b76, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3e0b76, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x37de, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0294989.WMF", cAlternateFileName="")) returned 1
	[0054.905] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.905] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0294989.WMF") returned -1
	[0054.905] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0294989.WMF") returned -1
	[0054.905] lstrcmpiA (lpString1="", lpString2="J0294989.WMF") returned -1
	[0054.905] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293832.WMF") returned="J0293832.WMF"
	[0054.905] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.905] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.905] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.905] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.905] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0294989.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294989.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294989.WMF"
	[0054.906] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3e0b76, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3e0b76, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3e0b76, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6180, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0294991.WMF", cAlternateFileName="")) returned 1
	[0054.906] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.906] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0294991.WMF") returned -1
	[0054.906] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0294991.WMF") returned -1
	[0054.906] lstrcmpiA (lpString1="", lpString2="J0294991.WMF") returned -1
	[0054.906] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294989.WMF") returned="J0294989.WMF"
	[0054.906] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.906] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.906] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.906] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.906] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0294991.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294991.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294991.WMF"
	[0054.906] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3e0b76, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3e0b76, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3e0b76, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x21b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0295069.WMF", cAlternateFileName="")) returned 1
	[0054.906] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.906] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0295069.WMF") returned -1
	[0054.906] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0295069.WMF") returned -1
	[0054.906] lstrcmpiA (lpString1="", lpString2="J0295069.WMF") returned -1
	[0054.906] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294991.WMF") returned="J0294991.WMF"
	[0054.906] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.906] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.906] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.906] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.906] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0295069.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0295069.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0295069.WMF"
	[0054.906] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3ba90e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3ba90e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3e0b76, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe42c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0296277.WMF", cAlternateFileName="")) returned 1
	[0054.906] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.906] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0296277.WMF") returned -1
	[0054.907] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0296277.WMF") returned -1
	[0054.907] lstrcmpiA (lpString1="", lpString2="J0296277.WMF") returned -1
	[0054.907] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0295069.WMF") returned="J0295069.WMF"
	[0054.907] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.907] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.907] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.907] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.907] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0296277.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296277.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296277.WMF"
	[0054.907] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3ba90e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3ba90e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3e0b76, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1088e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0296279.WMF", cAlternateFileName="")) returned 1
	[0054.907] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.907] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0296279.WMF") returned -1
	[0054.907] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0296279.WMF") returned -1
	[0054.907] lstrcmpiA (lpString1="", lpString2="J0296279.WMF") returned -1
	[0054.907] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296277.WMF") returned="J0296277.WMF"
	[0054.907] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.907] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.907] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.907] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.907] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0296279.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296279.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296279.WMF"
	[0054.907] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3e0b76, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3e0b76, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3e0b76, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x107ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0296288.WMF", cAlternateFileName="")) returned 1
	[0054.907] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.907] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0296288.WMF") returned -1
	[0054.907] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0296288.WMF") returned -1
	[0054.907] lstrcmpiA (lpString1="", lpString2="J0296288.WMF") returned -1
	[0054.907] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296279.WMF") returned="J0296279.WMF"
	[0054.907] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.907] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.907] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.908] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.908] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0296288.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296288.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296288.WMF"
	[0054.908] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3ba90e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3ba90e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3e0b76, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x59ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297229.WMF", cAlternateFileName="")) returned 1
	[0054.908] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.908] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0297229.WMF") returned -1
	[0054.908] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0297229.WMF") returned -1
	[0054.908] lstrcmpiA (lpString1="", lpString2="J0297229.WMF") returned -1
	[0054.908] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296288.WMF") returned="J0296288.WMF"
	[0054.908] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.908] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.908] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.908] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.908] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0297229.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297229.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297229.WMF"
	[0054.908] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3ba90e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3ba90e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3e0b76, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3d24, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297269.WMF", cAlternateFileName="")) returned 1
	[0054.908] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.908] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0297269.WMF") returned -1
	[0054.908] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0297269.WMF") returned -1
	[0054.908] lstrcmpiA (lpString1="", lpString2="J0297269.WMF") returned -1
	[0054.908] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297229.WMF") returned="J0297229.WMF"
	[0054.908] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.908] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.908] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.908] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.908] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0297269.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297269.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297269.WMF"
	[0054.909] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3ba90e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3ba90e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3e0b76, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4236, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297725.WMF", cAlternateFileName="")) returned 1
	[0054.909] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.909] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0297725.WMF") returned -1
	[0054.909] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0297725.WMF") returned -1
	[0054.909] lstrcmpiA (lpString1="", lpString2="J0297725.WMF") returned -1
	[0054.909] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297269.WMF") returned="J0297269.WMF"
	[0054.909] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.909] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.909] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.909] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.909] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0297725.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297725.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297725.WMF"
	[0054.909] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3e0b76, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3e0b76, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf406dcf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3c9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297727.WMF", cAlternateFileName="")) returned 1
	[0054.909] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.909] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0297727.WMF") returned -1
	[0054.909] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0297727.WMF") returned -1
	[0054.909] lstrcmpiA (lpString1="", lpString2="J0297727.WMF") returned -1
	[0054.909] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297725.WMF") returned="J0297725.WMF"
	[0054.909] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.909] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.909] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.909] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.909] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0297727.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297727.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297727.WMF"
	[0054.909] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3e0b76, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3e0b76, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf406dcf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x493e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297757.WMF", cAlternateFileName="")) returned 1
	[0054.909] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.909] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0297757.WMF") returned -1
	[0054.910] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0297757.WMF") returned -1
	[0054.910] lstrcmpiA (lpString1="", lpString2="J0297757.WMF") returned -1
	[0054.910] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297727.WMF") returned="J0297727.WMF"
	[0054.910] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.910] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.910] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.910] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.910] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0297757.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297757.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297757.WMF"
	[0054.910] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3e0b76, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3e0b76, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3e0b76, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4960, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297759.WMF", cAlternateFileName="")) returned 1
	[0054.910] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.910] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0297759.WMF") returned -1
	[0054.910] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0297759.WMF") returned -1
	[0054.910] lstrcmpiA (lpString1="", lpString2="J0297759.WMF") returned -1
	[0054.910] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297757.WMF") returned="J0297757.WMF"
	[0054.910] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.910] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.910] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.910] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.910] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0297759.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297759.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297759.WMF"
	[0054.910] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3e0b76, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3e0b76, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3e0b76, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4584, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0300862.WMF", cAlternateFileName="")) returned 1
	[0054.910] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.910] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0300862.WMF") returned -1
	[0054.910] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0300862.WMF") returned -1
	[0054.910] lstrcmpiA (lpString1="", lpString2="J0300862.WMF") returned -1
	[0054.910] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297759.WMF") returned="J0297759.WMF"
	[0054.910] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.910] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.911] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.911] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.911] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0300862.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0300862.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0300862.WMF"
	[0054.911] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3e0b76, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3e0b76, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3e0b76, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2b0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301044.WMF", cAlternateFileName="")) returned 1
	[0054.911] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.911] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0301044.WMF") returned -1
	[0054.911] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0301044.WMF") returned -1
	[0054.911] lstrcmpiA (lpString1="", lpString2="J0301044.WMF") returned -1
	[0054.911] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0300862.WMF") returned="J0300862.WMF"
	[0054.911] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.911] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.911] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.911] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.911] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0301044.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301044.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301044.WMF"
	[0054.911] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3e0b76, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3e0b76, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3e0b76, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301052.WMF", cAlternateFileName="")) returned 1
	[0054.911] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.911] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0301052.WMF") returned -1
	[0054.911] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0301052.WMF") returned -1
	[0054.911] lstrcmpiA (lpString1="", lpString2="J0301052.WMF") returned -1
	[0054.911] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301044.WMF") returned="J0301044.WMF"
	[0054.911] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.911] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.911] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.911] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.911] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0301052.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301052.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301052.WMF"
	[0054.912] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3e0b76, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3e0b76, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3e0b76, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4a5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301418.WMF", cAlternateFileName="")) returned 1
	[0054.912] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.912] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0301418.WMF") returned -1
	[0054.912] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0301418.WMF") returned -1
	[0054.912] lstrcmpiA (lpString1="", lpString2="J0301418.WMF") returned -1
	[0054.912] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301052.WMF") returned="J0301052.WMF"
	[0054.912] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.912] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.912] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.912] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.912] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0301418.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301418.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301418.WMF"
	[0054.912] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3e0b76, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3e0b76, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3e0b76, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4dfa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301432.WMF", cAlternateFileName="")) returned 1
	[0054.912] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.912] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0301432.WMF") returned -1
	[0054.912] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0301432.WMF") returned -1
	[0054.912] lstrcmpiA (lpString1="", lpString2="J0301432.WMF") returned -1
	[0054.912] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301418.WMF") returned="J0301418.WMF"
	[0054.912] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.912] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.912] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.912] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.912] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0301432.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301432.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301432.WMF"
	[0054.912] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3e0b76, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3e0b76, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3e0b76, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0304371.WMF", cAlternateFileName="")) returned 1
	[0054.912] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.912] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0304371.WMF") returned -1
	[0054.913] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0304371.WMF") returned -1
	[0054.913] lstrcmpiA (lpString1="", lpString2="J0304371.WMF") returned -1
	[0054.913] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301432.WMF") returned="J0301432.WMF"
	[0054.913] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.913] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.913] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.913] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.913] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0304371.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304371.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304371.WMF"
	[0054.913] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3e0b76, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3e0b76, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf3e0b76, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x103e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0304405.WMF", cAlternateFileName="")) returned 1
	[0054.913] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.913] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0304405.WMF") returned -1
	[0054.913] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0304405.WMF") returned -1
	[0054.913] lstrcmpiA (lpString1="", lpString2="J0304405.WMF") returned -1
	[0054.913] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304371.WMF") returned="J0304371.WMF"
	[0054.913] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.913] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.913] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.913] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.913] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0304405.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304405.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304405.WMF"
	[0054.913] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42d018, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf42d018, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf42d018, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4a0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0304853.WMF", cAlternateFileName="")) returned 1
	[0054.913] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.913] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0304853.WMF") returned -1
	[0054.913] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0304853.WMF") returned -1
	[0054.913] lstrcmpiA (lpString1="", lpString2="J0304853.WMF") returned -1
	[0054.913] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304405.WMF") returned="J0304405.WMF"
	[0054.913] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.913] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.914] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.914] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.914] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0304853.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304853.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304853.WMF"
	[0054.914] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42d018, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf42d018, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf42d018, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2cf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0304861.WMF", cAlternateFileName="")) returned 1
	[0054.914] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.914] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0304861.WMF") returned -1
	[0054.914] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0304861.WMF") returned -1
	[0054.914] lstrcmpiA (lpString1="", lpString2="J0304861.WMF") returned -1
	[0054.914] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304853.WMF") returned="J0304853.WMF"
	[0054.914] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.914] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.914] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.914] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.914] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0304861.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304861.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304861.WMF"
	[0054.914] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42d018, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf42d018, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf42d018, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0304875.WMF", cAlternateFileName="")) returned 1
	[0054.914] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.914] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0304875.WMF") returned -1
	[0054.914] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0304875.WMF") returned -1
	[0054.914] lstrcmpiA (lpString1="", lpString2="J0304875.WMF") returned -1
	[0054.914] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304861.WMF") returned="J0304861.WMF"
	[0054.914] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.914] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.914] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.914] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.914] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0304875.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304875.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304875.WMF"
	[0054.915] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42d018, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf42d018, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf42d018, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x29c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0309480.JPG", cAlternateFileName="")) returned 1
	[0054.915] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.915] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0309480.JPG") returned -1
	[0054.915] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0309480.JPG") returned -1
	[0054.915] lstrcmpiA (lpString1="", lpString2="J0309480.JPG") returned -1
	[0054.915] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304875.WMF") returned="J0304875.WMF"
	[0054.915] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.915] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.915] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.915] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.915] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0309480.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309480.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309480.JPG"
	[0054.915] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309480.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309480.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309480.JPG"
	[0054.915] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309480.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309480.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309480.JPG"
	[0054.915] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309480.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309480.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309480.JPG."
	[0054.915] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309480.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309480.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309480.JPG.exe"
	[0054.915] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309480.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0054.916] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29c4
	[0054.916] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf42d018, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf42d018, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf42d018, dwHighDateTime=0x1d327e8)) returned 1
	[0054.916] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.916] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x2982, lpOverlapped=0x0) returned 1
	[0054.917] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309480.JPG") returned="J0309480.JPG"
	[0054.918] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.918] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x2982, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x2982, lpOverlapped=0x0) returned 1
	[0054.918] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.918] CloseHandle (hObject=0x214) returned 1
	[0054.919] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309480.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309480.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309480.jpg.exe")) returned 1
	[0054.920] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf406dcf, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf406dcf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf42d018, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x544c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0309567.JPG", cAlternateFileName="")) returned 1
	[0054.920] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.920] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0309567.JPG") returned -1
	[0054.920] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0309567.JPG") returned -1
	[0054.920] lstrcmpiA (lpString1="", lpString2="J0309567.JPG") returned -1
	[0054.920] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309480.JPG") returned="J0309480.JPG"
	[0054.920] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.920] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.920] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.920] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.920] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0309567.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG"
	[0054.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG", pszSpec="*.zip") returned 0
	[0054.920] lstrlenA (lpString="*.zip") returned 5
	[0054.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG", pszSpec="*.rar") returned 0
	[0054.920] lstrlenA (lpString="*.rar") returned 5
	[0054.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG", pszSpec="*.7z") returned 0
	[0054.920] lstrlenA (lpString="*.7z") returned 4
	[0054.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG", pszSpec="*.tar") returned 0
	[0054.920] lstrlenA (lpString="*.tar") returned 5
	[0054.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG", pszSpec="*.gzip") returned 0
	[0054.920] lstrlenA (lpString="*.gzip") returned 6
	[0054.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG", pszSpec="*.jpg") returned 1
	[0054.920] lstrlenA (lpString="*.jpg") returned 5
	[0054.920] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG"
	[0054.920] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG"
	[0054.920] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG."
	[0054.920] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG.exe"
	[0054.920] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309567.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0054.921] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x544c
	[0054.921] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf406dcf, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf406dcf, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf42d018, dwHighDateTime=0x1d327e8)) returned 1
	[0054.921] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.921] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x540a, lpOverlapped=0x0) returned 1
	[0054.923] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG") returned="J0309567.JPG"
	[0054.923] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.923] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x540a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x540a, lpOverlapped=0x0) returned 1
	[0054.923] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.923] CloseHandle (hObject=0x214) returned 1
	[0054.924] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309567.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309567.jpg.exe")) returned 1
	[0054.925] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3e0b76, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3e0b76, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf406dcf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9a8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0309585.JPG", cAlternateFileName="")) returned 1
	[0054.925] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.925] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0309585.JPG") returned -1
	[0054.925] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0309585.JPG") returned -1
	[0054.925] lstrcmpiA (lpString1="", lpString2="J0309585.JPG") returned -1
	[0054.925] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG") returned="J0309567.JPG"
	[0054.925] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.925] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.925] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.925] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.925] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0309585.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG"
	[0054.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG", pszSpec="*.zip") returned 0
	[0054.926] lstrlenA (lpString="*.zip") returned 5
	[0054.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG", pszSpec="*.rar") returned 0
	[0054.926] lstrlenA (lpString="*.rar") returned 5
	[0054.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG", pszSpec="*.7z") returned 0
	[0054.926] lstrlenA (lpString="*.7z") returned 4
	[0054.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG", pszSpec="*.tar") returned 0
	[0054.926] lstrlenA (lpString="*.tar") returned 5
	[0054.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG", pszSpec="*.gzip") returned 0
	[0054.926] lstrlenA (lpString="*.gzip") returned 6
	[0054.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG", pszSpec="*.jpg") returned 1
	[0054.926] lstrlenA (lpString="*.jpg") returned 5
	[0054.926] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG"
	[0054.926] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG"
	[0054.926] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG."
	[0054.926] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG.exe"
	[0054.926] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309585.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0054.927] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9a8b
	[0054.927] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf3e0b76, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf3e0b76, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf406dcf, dwHighDateTime=0x1d327e8)) returned 1
	[0054.927] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.927] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x9a49, lpOverlapped=0x0) returned 1
	[0054.928] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG") returned="J0309585.JPG"
	[0054.928] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.928] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x9a49, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x9a49, lpOverlapped=0x0) returned 1
	[0054.929] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.929] CloseHandle (hObject=0x214) returned 1
	[0054.930] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309585.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309585.jpg.exe")) returned 1
	[0054.930] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf406dcf, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf406dcf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf42d018, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x81f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0309598.JPG", cAlternateFileName="")) returned 1
	[0054.930] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.931] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0309598.JPG") returned -1
	[0054.931] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0309598.JPG") returned -1
	[0054.931] lstrcmpiA (lpString1="", lpString2="J0309598.JPG") returned -1
	[0054.931] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG") returned="J0309585.JPG"
	[0054.931] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.931] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.931] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.931] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.931] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0309598.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG"
	[0054.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG", pszSpec="*.zip") returned 0
	[0054.931] lstrlenA (lpString="*.zip") returned 5
	[0054.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG", pszSpec="*.rar") returned 0
	[0054.931] lstrlenA (lpString="*.rar") returned 5
	[0054.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG", pszSpec="*.7z") returned 0
	[0054.931] lstrlenA (lpString="*.7z") returned 4
	[0054.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG", pszSpec="*.tar") returned 0
	[0054.931] lstrlenA (lpString="*.tar") returned 5
	[0054.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG", pszSpec="*.gzip") returned 0
	[0054.931] lstrlenA (lpString="*.gzip") returned 6
	[0054.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG", pszSpec="*.jpg") returned 1
	[0054.931] lstrlenA (lpString="*.jpg") returned 5
	[0054.931] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG"
	[0054.931] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG"
	[0054.931] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG."
	[0054.931] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG.exe"
	[0054.931] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309598.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0054.931] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x81f0
	[0054.932] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf406dcf, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf406dcf, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf42d018, dwHighDateTime=0x1d327e8)) returned 1
	[0054.932] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.932] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x81ae, lpOverlapped=0x0) returned 1
	[0054.984] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG") returned="J0309598.JPG"
	[0054.984] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.984] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x81ae, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x81ae, lpOverlapped=0x0) returned 1
	[0054.985] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.985] CloseHandle (hObject=0x214) returned 1
	[0054.986] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309598.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309598.jpg.exe")) returned 1
	[0054.987] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf406dcf, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf406dcf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf42d018, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xaabb, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0309664.JPG", cAlternateFileName="")) returned 1
	[0054.987] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.987] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0309664.JPG") returned -1
	[0054.987] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0309664.JPG") returned -1
	[0054.987] lstrcmpiA (lpString1="", lpString2="J0309664.JPG") returned -1
	[0054.987] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG") returned="J0309598.JPG"
	[0054.987] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.987] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.987] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.987] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.987] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0309664.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG"
	[0054.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG", pszSpec="*.zip") returned 0
	[0054.987] lstrlenA (lpString="*.zip") returned 5
	[0054.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG", pszSpec="*.rar") returned 0
	[0054.987] lstrlenA (lpString="*.rar") returned 5
	[0054.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG", pszSpec="*.7z") returned 0
	[0054.987] lstrlenA (lpString="*.7z") returned 4
	[0054.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG", pszSpec="*.tar") returned 0
	[0054.987] lstrlenA (lpString="*.tar") returned 5
	[0054.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG", pszSpec="*.gzip") returned 0
	[0054.987] lstrlenA (lpString="*.gzip") returned 6
	[0054.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG", pszSpec="*.jpg") returned 1
	[0054.987] lstrlenA (lpString="*.jpg") returned 5
	[0054.987] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG"
	[0054.987] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG"
	[0054.987] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG."
	[0054.987] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG.exe"
	[0054.988] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309664.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0054.988] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaabb
	[0054.988] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf406dcf, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf406dcf, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf42d018, dwHighDateTime=0x1d327e8)) returned 1
	[0054.988] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.988] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xaa79, lpOverlapped=0x0) returned 1
	[0054.990] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG") returned="J0309664.JPG"
	[0054.990] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.990] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xaa79, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xaa79, lpOverlapped=0x0) returned 1
	[0054.990] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.990] CloseHandle (hObject=0x214) returned 1
	[0054.992] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309664.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309664.jpg.exe")) returned 1
	[0054.992] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf406dcf, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf406dcf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf42d018, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4ada, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0309705.JPG", cAlternateFileName="")) returned 1
	[0054.993] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.993] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0309705.JPG") returned -1
	[0054.993] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0309705.JPG") returned -1
	[0054.993] lstrcmpiA (lpString1="", lpString2="J0309705.JPG") returned -1
	[0054.993] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG") returned="J0309664.JPG"
	[0054.993] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.993] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.993] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.993] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.993] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0309705.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG"
	[0054.993] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG", pszSpec="*.zip") returned 0
	[0054.993] lstrlenA (lpString="*.zip") returned 5
	[0054.993] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG", pszSpec="*.rar") returned 0
	[0054.993] lstrlenA (lpString="*.rar") returned 5
	[0054.993] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG", pszSpec="*.7z") returned 0
	[0054.993] lstrlenA (lpString="*.7z") returned 4
	[0054.993] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG", pszSpec="*.tar") returned 0
	[0054.993] lstrlenA (lpString="*.tar") returned 5
	[0054.993] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG", pszSpec="*.gzip") returned 0
	[0054.993] lstrlenA (lpString="*.gzip") returned 6
	[0054.993] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG", pszSpec="*.jpg") returned 1
	[0054.993] lstrlenA (lpString="*.jpg") returned 5
	[0054.993] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG"
	[0054.993] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG"
	[0054.993] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG."
	[0054.993] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG.exe"
	[0054.994] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309705.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0054.994] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ada
	[0054.994] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf406dcf, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf406dcf, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf42d018, dwHighDateTime=0x1d327e8)) returned 1
	[0054.994] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.994] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x4a98, lpOverlapped=0x0) returned 1
	[0054.996] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG") returned="J0309705.JPG"
	[0054.996] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0054.996] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x4a98, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x4a98, lpOverlapped=0x0) returned 1
	[0054.996] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.996] CloseHandle (hObject=0x214) returned 1
	[0054.997] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309705.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309705.jpg.exe")) returned 1
	[0054.998] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3e0b76, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf3e0b76, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf406dcf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0309902.WMF", cAlternateFileName="")) returned 1
	[0054.998] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0054.998] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0309902.WMF") returned -1
	[0054.998] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0309902.WMF") returned -1
	[0054.998] lstrcmpiA (lpString1="", lpString2="J0309902.WMF") returned -1
	[0054.998] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG") returned="J0309705.JPG"
	[0054.998] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0054.998] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0054.998] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0054.998] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0054.998] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0309902.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF"
	[0054.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.zip") returned 0
	[0054.998] lstrlenA (lpString="*.zip") returned 5
	[0054.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.rar") returned 0
	[0054.998] lstrlenA (lpString="*.rar") returned 5
	[0054.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.7z") returned 0
	[0054.998] lstrlenA (lpString="*.7z") returned 4
	[0054.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.tar") returned 0
	[0054.998] lstrlenA (lpString="*.tar") returned 5
	[0054.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.gzip") returned 0
	[0054.998] lstrlenA (lpString="*.gzip") returned 6
	[0054.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.jpg") returned 0
	[0054.998] lstrlenA (lpString="*.jpg") returned 5
	[0054.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.jpeg") returned 0
	[0054.998] lstrlenA (lpString="*.jpeg") returned 6
	[0054.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.bmp") returned 0
	[0054.998] lstrlenA (lpString="*.bmp") returned 5
	[0054.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.gif") returned 0
	[0054.998] lstrlenA (lpString="*.gif") returned 5
	[0054.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.png") returned 0
	[0054.999] lstrlenA (lpString="*.png") returned 5
	[0054.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.doc") returned 0
	[0054.999] lstrlenA (lpString="*.doc") returned 5
	[0054.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.docx") returned 0
	[0054.999] lstrlenA (lpString="*.docx") returned 6
	[0054.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.xls") returned 0
	[0054.999] lstrlenA (lpString="*.xls") returned 5
	[0054.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.xlsx") returned 0
	[0054.999] lstrlenA (lpString="*.xlsx") returned 6
	[0054.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.ppt") returned 0
	[0054.999] lstrlenA (lpString="*.ppt") returned 5
	[0054.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.pptx") returned 0
	[0054.999] lstrlenA (lpString="*.pptx") returned 6
	[0054.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.txt") returned 0
	[0054.999] lstrlenA (lpString="*.txt") returned 5
	[0054.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.pdf") returned 0
	[0054.999] lstrlenA (lpString="*.pdf") returned 5
	[0054.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.htm") returned 0
	[0054.999] lstrlenA (lpString="*.htm") returned 5
	[0054.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.html") returned 0
	[0054.999] lstrlenA (lpString="*.html") returned 6
	[0054.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.mdb") returned 0
	[0054.999] lstrlenA (lpString="*.mdb") returned 5
	[0054.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.pfx") returned 0
	[0054.999] lstrlenA (lpString="*.pfx") returned 5
	[0054.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.md") returned 0
	[0054.999] lstrlenA (lpString="*.md") returned 4
	[0054.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.lnk") returned 0
	[0054.999] lstrlenA (lpString="*.lnk") returned 5
	[0054.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.torrent") returned 0
	[0054.999] lstrlenA (lpString="*.torrent") returned 9
	[0054.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.mov") returned 0
	[0054.999] lstrlenA (lpString="*.mov") returned 5
	[0054.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.3gp") returned 0
	[0054.999] lstrlenA (lpString="*.3gp") returned 5
	[0054.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.mpeg") returned 0
	[0055.000] lstrlenA (lpString="*.mpeg") returned 6
	[0055.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.mpg") returned 0
	[0055.000] lstrlenA (lpString="*.mpg") returned 5
	[0055.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.flv") returned 0
	[0055.000] lstrlenA (lpString="*.flv") returned 5
	[0055.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.avi") returned 0
	[0055.000] lstrlenA (lpString="*.avi") returned 5
	[0055.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.mp4") returned 0
	[0055.000] lstrlenA (lpString="*.mp4") returned 5
	[0055.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.wmv") returned 0
	[0055.000] lstrlenA (lpString="*.wmv") returned 5
	[0055.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.mkv") returned 0
	[0055.000] lstrlenA (lpString="*.mkv") returned 5
	[0055.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.mp3") returned 0
	[0055.000] lstrlenA (lpString="*.mp3") returned 5
	[0055.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.wav") returned 0
	[0055.000] lstrlenA (lpString="*.wav") returned 5
	[0055.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.flac") returned 0
	[0055.000] lstrlenA (lpString="*.flac") returned 6
	[0055.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.wma") returned 0
	[0055.000] lstrlenA (lpString="*.wma") returned 5
	[0055.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.au3") returned 0
	[0055.000] lstrlenA (lpString="*.au3") returned 5
	[0055.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.ahk") returned 0
	[0055.000] lstrlenA (lpString="*.ahk") returned 5
	[0055.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.c") returned 0
	[0055.000] lstrlenA (lpString="*.c") returned 3
	[0055.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.cc") returned 0
	[0055.000] lstrlenA (lpString="*.cc") returned 4
	[0055.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.cpp") returned 0
	[0055.000] lstrlenA (lpString="*.cpp") returned 5
	[0055.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.cxx") returned 0
	[0055.000] lstrlenA (lpString="*.cxx") returned 5
	[0055.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.c++") returned 0
	[0055.000] lstrlenA (lpString="*.c++") returned 5
	[0055.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.cs") returned 0
	[0055.001] lstrlenA (lpString="*.cs") returned 4
	[0055.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.vb") returned 0
	[0055.001] lstrlenA (lpString="*.vb") returned 4
	[0055.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.bas") returned 0
	[0055.001] lstrlenA (lpString="*.bas") returned 5
	[0055.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.csproj") returned 0
	[0055.001] lstrlenA (lpString="*.csproj") returned 8
	[0055.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.vbproj") returned 0
	[0055.001] lstrlenA (lpString="*.vbproj") returned 8
	[0055.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.vcxproj") returned 0
	[0055.001] lstrlenA (lpString="*.vcxproj") returned 9
	[0055.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.manifest") returned 0
	[0055.001] lstrlenA (lpString="*.manifest") returned 10
	[0055.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.php") returned 0
	[0055.001] lstrlenA (lpString="*.php") returned 5
	[0055.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.vbe") returned 0
	[0055.001] lstrlenA (lpString="*.vbe") returned 5
	[0055.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.vba") returned 0
	[0055.001] lstrlenA (lpString="*.vba") returned 5
	[0055.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.vbs") returned 0
	[0055.001] lstrlenA (lpString="*.vbs") returned 5
	[0055.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.bat") returned 0
	[0055.001] lstrlenA (lpString="*.bat") returned 5
	[0055.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.cmd") returned 0
	[0055.001] lstrlenA (lpString="*.cmd") returned 5
	[0055.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.js") returned 0
	[0055.001] lstrlenA (lpString="*.js") returned 4
	[0055.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.jscript") returned 0
	[0055.001] lstrlenA (lpString="*.jscript") returned 9
	[0055.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.hta") returned 0
	[0055.001] lstrlenA (lpString="*.hta") returned 5
	[0055.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.php7") returned 0
	[0055.001] lstrlenA (lpString="*.php7") returned 6
	[0055.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.db") returned 0
	[0055.001] lstrlenA (lpString="*.db") returned 4
	[0055.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.swf") returned 0
	[0055.001] lstrlenA (lpString="*.swf") returned 5
	[0055.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.eml") returned 0
	[0055.002] lstrlenA (lpString="*.eml") returned 5
	[0055.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.part") returned 0
	[0055.002] lstrlenA (lpString="*.part") returned 6
	[0055.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.nfo") returned 0
	[0055.002] lstrlenA (lpString="*.nfo") returned 5
	[0055.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.rsa") returned 0
	[0055.002] lstrlenA (lpString="*.rsa") returned 5
	[0055.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.key") returned 0
	[0055.002] lstrlenA (lpString="*.key") returned 5
	[0055.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.aes") returned 0
	[0055.002] lstrlenA (lpString="*.aes") returned 5
	[0055.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.blob") returned 0
	[0055.002] lstrlenA (lpString="*.blob") returned 6
	[0055.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.btc") returned 0
	[0055.002] lstrlenA (lpString="*.btc") returned 5
	[0055.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF", pszSpec="*.wallet") returned 0
	[0055.002] lstrlenA (lpString="*.wallet") returned 8
	[0055.002] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42d018, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf42d018, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf45328f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x20e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0309904.WMF", cAlternateFileName="")) returned 1
	[0055.002] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.002] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0309904.WMF") returned -1
	[0055.002] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0309904.WMF") returned -1
	[0055.002] lstrcmpiA (lpString1="", lpString2="J0309904.WMF") returned -1
	[0055.002] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF") returned="J0309902.WMF"
	[0055.002] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.002] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.002] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.002] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.002] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0309904.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF"
	[0055.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.zip") returned 0
	[0055.002] lstrlenA (lpString="*.zip") returned 5
	[0055.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.rar") returned 0
	[0055.002] lstrlenA (lpString="*.rar") returned 5
	[0055.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.7z") returned 0
	[0055.003] lstrlenA (lpString="*.7z") returned 4
	[0055.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.tar") returned 0
	[0055.003] lstrlenA (lpString="*.tar") returned 5
	[0055.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.gzip") returned 0
	[0055.003] lstrlenA (lpString="*.gzip") returned 6
	[0055.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.jpg") returned 0
	[0055.003] lstrlenA (lpString="*.jpg") returned 5
	[0055.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.jpeg") returned 0
	[0055.003] lstrlenA (lpString="*.jpeg") returned 6
	[0055.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.bmp") returned 0
	[0055.003] lstrlenA (lpString="*.bmp") returned 5
	[0055.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.gif") returned 0
	[0055.003] lstrlenA (lpString="*.gif") returned 5
	[0055.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.png") returned 0
	[0055.003] lstrlenA (lpString="*.png") returned 5
	[0055.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.doc") returned 0
	[0055.003] lstrlenA (lpString="*.doc") returned 5
	[0055.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.docx") returned 0
	[0055.003] lstrlenA (lpString="*.docx") returned 6
	[0055.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.xls") returned 0
	[0055.003] lstrlenA (lpString="*.xls") returned 5
	[0055.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.xlsx") returned 0
	[0055.003] lstrlenA (lpString="*.xlsx") returned 6
	[0055.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.ppt") returned 0
	[0055.003] lstrlenA (lpString="*.ppt") returned 5
	[0055.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.pptx") returned 0
	[0055.003] lstrlenA (lpString="*.pptx") returned 6
	[0055.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.txt") returned 0
	[0055.003] lstrlenA (lpString="*.txt") returned 5
	[0055.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.pdf") returned 0
	[0055.003] lstrlenA (lpString="*.pdf") returned 5
	[0055.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.htm") returned 0
	[0055.003] lstrlenA (lpString="*.htm") returned 5
	[0055.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.html") returned 0
	[0055.003] lstrlenA (lpString="*.html") returned 6
	[0055.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.mdb") returned 0
	[0055.003] lstrlenA (lpString="*.mdb") returned 5
	[0055.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.pfx") returned 0
	[0055.004] lstrlenA (lpString="*.pfx") returned 5
	[0055.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.md") returned 0
	[0055.004] lstrlenA (lpString="*.md") returned 4
	[0055.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.lnk") returned 0
	[0055.004] lstrlenA (lpString="*.lnk") returned 5
	[0055.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.torrent") returned 0
	[0055.004] lstrlenA (lpString="*.torrent") returned 9
	[0055.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.mov") returned 0
	[0055.004] lstrlenA (lpString="*.mov") returned 5
	[0055.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.3gp") returned 0
	[0055.004] lstrlenA (lpString="*.3gp") returned 5
	[0055.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.mpeg") returned 0
	[0055.004] lstrlenA (lpString="*.mpeg") returned 6
	[0055.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.mpg") returned 0
	[0055.004] lstrlenA (lpString="*.mpg") returned 5
	[0055.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.flv") returned 0
	[0055.004] lstrlenA (lpString="*.flv") returned 5
	[0055.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.avi") returned 0
	[0055.004] lstrlenA (lpString="*.avi") returned 5
	[0055.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.mp4") returned 0
	[0055.004] lstrlenA (lpString="*.mp4") returned 5
	[0055.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.wmv") returned 0
	[0055.004] lstrlenA (lpString="*.wmv") returned 5
	[0055.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.mkv") returned 0
	[0055.004] lstrlenA (lpString="*.mkv") returned 5
	[0055.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.mp3") returned 0
	[0055.004] lstrlenA (lpString="*.mp3") returned 5
	[0055.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.wav") returned 0
	[0055.004] lstrlenA (lpString="*.wav") returned 5
	[0055.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.flac") returned 0
	[0055.004] lstrlenA (lpString="*.flac") returned 6
	[0055.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.wma") returned 0
	[0055.004] lstrlenA (lpString="*.wma") returned 5
	[0055.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.au3") returned 0
	[0055.004] lstrlenA (lpString="*.au3") returned 5
	[0055.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.ahk") returned 0
	[0055.005] lstrlenA (lpString="*.ahk") returned 5
	[0055.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.c") returned 0
	[0055.005] lstrlenA (lpString="*.c") returned 3
	[0055.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.cc") returned 0
	[0055.005] lstrlenA (lpString="*.cc") returned 4
	[0055.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.cpp") returned 0
	[0055.005] lstrlenA (lpString="*.cpp") returned 5
	[0055.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.cxx") returned 0
	[0055.005] lstrlenA (lpString="*.cxx") returned 5
	[0055.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.c++") returned 0
	[0055.005] lstrlenA (lpString="*.c++") returned 5
	[0055.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.cs") returned 0
	[0055.005] lstrlenA (lpString="*.cs") returned 4
	[0055.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.vb") returned 0
	[0055.005] lstrlenA (lpString="*.vb") returned 4
	[0055.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.bas") returned 0
	[0055.005] lstrlenA (lpString="*.bas") returned 5
	[0055.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.csproj") returned 0
	[0055.005] lstrlenA (lpString="*.csproj") returned 8
	[0055.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.vbproj") returned 0
	[0055.005] lstrlenA (lpString="*.vbproj") returned 8
	[0055.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.vcxproj") returned 0
	[0055.005] lstrlenA (lpString="*.vcxproj") returned 9
	[0055.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.manifest") returned 0
	[0055.005] lstrlenA (lpString="*.manifest") returned 10
	[0055.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.php") returned 0
	[0055.005] lstrlenA (lpString="*.php") returned 5
	[0055.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.vbe") returned 0
	[0055.005] lstrlenA (lpString="*.vbe") returned 5
	[0055.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.vba") returned 0
	[0055.005] lstrlenA (lpString="*.vba") returned 5
	[0055.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.vbs") returned 0
	[0055.005] lstrlenA (lpString="*.vbs") returned 5
	[0055.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.bat") returned 0
	[0055.005] lstrlenA (lpString="*.bat") returned 5
	[0055.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.cmd") returned 0
	[0055.005] lstrlenA (lpString="*.cmd") returned 5
	[0055.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.js") returned 0
	[0055.006] lstrlenA (lpString="*.js") returned 4
	[0055.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.jscript") returned 0
	[0055.006] lstrlenA (lpString="*.jscript") returned 9
	[0055.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.hta") returned 0
	[0055.006] lstrlenA (lpString="*.hta") returned 5
	[0055.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.php7") returned 0
	[0055.006] lstrlenA (lpString="*.php7") returned 6
	[0055.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.db") returned 0
	[0055.006] lstrlenA (lpString="*.db") returned 4
	[0055.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.swf") returned 0
	[0055.006] lstrlenA (lpString="*.swf") returned 5
	[0055.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.eml") returned 0
	[0055.006] lstrlenA (lpString="*.eml") returned 5
	[0055.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.part") returned 0
	[0055.006] lstrlenA (lpString="*.part") returned 6
	[0055.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.nfo") returned 0
	[0055.006] lstrlenA (lpString="*.nfo") returned 5
	[0055.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.rsa") returned 0
	[0055.006] lstrlenA (lpString="*.rsa") returned 5
	[0055.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.key") returned 0
	[0055.006] lstrlenA (lpString="*.key") returned 5
	[0055.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.aes") returned 0
	[0055.006] lstrlenA (lpString="*.aes") returned 5
	[0055.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.blob") returned 0
	[0055.006] lstrlenA (lpString="*.blob") returned 6
	[0055.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.btc") returned 0
	[0055.006] lstrlenA (lpString="*.btc") returned 5
	[0055.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF", pszSpec="*.wallet") returned 0
	[0055.007] lstrlenA (lpString="*.wallet") returned 8
	[0055.007] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42d018, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf42d018, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf45328f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2b38, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0309920.WMF", cAlternateFileName="")) returned 1
	[0055.007] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.007] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0309920.WMF") returned -1
	[0055.007] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0309920.WMF") returned -1
	[0055.007] lstrcmpiA (lpString1="", lpString2="J0309920.WMF") returned -1
	[0055.007] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF") returned="J0309904.WMF"
	[0055.007] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.007] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.007] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.007] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.007] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0309920.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF"
	[0055.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.zip") returned 0
	[0055.007] lstrlenA (lpString="*.zip") returned 5
	[0055.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.rar") returned 0
	[0055.007] lstrlenA (lpString="*.rar") returned 5
	[0055.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.7z") returned 0
	[0055.007] lstrlenA (lpString="*.7z") returned 4
	[0055.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.tar") returned 0
	[0055.008] lstrlenA (lpString="*.tar") returned 5
	[0055.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.gzip") returned 0
	[0055.008] lstrlenA (lpString="*.gzip") returned 6
	[0055.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.jpg") returned 0
	[0055.008] lstrlenA (lpString="*.jpg") returned 5
	[0055.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.jpeg") returned 0
	[0055.008] lstrlenA (lpString="*.jpeg") returned 6
	[0055.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.bmp") returned 0
	[0055.008] lstrlenA (lpString="*.bmp") returned 5
	[0055.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.gif") returned 0
	[0055.008] lstrlenA (lpString="*.gif") returned 5
	[0055.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.png") returned 0
	[0055.008] lstrlenA (lpString="*.png") returned 5
	[0055.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.doc") returned 0
	[0055.008] lstrlenA (lpString="*.doc") returned 5
	[0055.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.docx") returned 0
	[0055.008] lstrlenA (lpString="*.docx") returned 6
	[0055.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.xls") returned 0
	[0055.008] lstrlenA (lpString="*.xls") returned 5
	[0055.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.xlsx") returned 0
	[0055.008] lstrlenA (lpString="*.xlsx") returned 6
	[0055.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.ppt") returned 0
	[0055.008] lstrlenA (lpString="*.ppt") returned 5
	[0055.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.pptx") returned 0
	[0055.008] lstrlenA (lpString="*.pptx") returned 6
	[0055.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.txt") returned 0
	[0055.008] lstrlenA (lpString="*.txt") returned 5
	[0055.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.pdf") returned 0
	[0055.008] lstrlenA (lpString="*.pdf") returned 5
	[0055.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.htm") returned 0
	[0055.008] lstrlenA (lpString="*.htm") returned 5
	[0055.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.html") returned 0
	[0055.008] lstrlenA (lpString="*.html") returned 6
	[0055.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.mdb") returned 0
	[0055.008] lstrlenA (lpString="*.mdb") returned 5
	[0055.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.pfx") returned 0
	[0055.009] lstrlenA (lpString="*.pfx") returned 5
	[0055.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.md") returned 0
	[0055.009] lstrlenA (lpString="*.md") returned 4
	[0055.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.lnk") returned 0
	[0055.009] lstrlenA (lpString="*.lnk") returned 5
	[0055.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.torrent") returned 0
	[0055.009] lstrlenA (lpString="*.torrent") returned 9
	[0055.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.mov") returned 0
	[0055.009] lstrlenA (lpString="*.mov") returned 5
	[0055.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.3gp") returned 0
	[0055.009] lstrlenA (lpString="*.3gp") returned 5
	[0055.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.mpeg") returned 0
	[0055.009] lstrlenA (lpString="*.mpeg") returned 6
	[0055.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.mpg") returned 0
	[0055.009] lstrlenA (lpString="*.mpg") returned 5
	[0055.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.flv") returned 0
	[0055.009] lstrlenA (lpString="*.flv") returned 5
	[0055.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.avi") returned 0
	[0055.009] lstrlenA (lpString="*.avi") returned 5
	[0055.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.mp4") returned 0
	[0055.009] lstrlenA (lpString="*.mp4") returned 5
	[0055.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.wmv") returned 0
	[0055.009] lstrlenA (lpString="*.wmv") returned 5
	[0055.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.mkv") returned 0
	[0055.009] lstrlenA (lpString="*.mkv") returned 5
	[0055.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.mp3") returned 0
	[0055.009] lstrlenA (lpString="*.mp3") returned 5
	[0055.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.wav") returned 0
	[0055.009] lstrlenA (lpString="*.wav") returned 5
	[0055.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.flac") returned 0
	[0055.009] lstrlenA (lpString="*.flac") returned 6
	[0055.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.wma") returned 0
	[0055.009] lstrlenA (lpString="*.wma") returned 5
	[0055.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.au3") returned 0
	[0055.009] lstrlenA (lpString="*.au3") returned 5
	[0055.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.ahk") returned 0
	[0055.009] lstrlenA (lpString="*.ahk") returned 5
	[0055.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.c") returned 0
	[0055.010] lstrlenA (lpString="*.c") returned 3
	[0055.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.cc") returned 0
	[0055.010] lstrlenA (lpString="*.cc") returned 4
	[0055.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.cpp") returned 0
	[0055.010] lstrlenA (lpString="*.cpp") returned 5
	[0055.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.cxx") returned 0
	[0055.010] lstrlenA (lpString="*.cxx") returned 5
	[0055.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.c++") returned 0
	[0055.010] lstrlenA (lpString="*.c++") returned 5
	[0055.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.cs") returned 0
	[0055.010] lstrlenA (lpString="*.cs") returned 4
	[0055.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.vb") returned 0
	[0055.010] lstrlenA (lpString="*.vb") returned 4
	[0055.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.bas") returned 0
	[0055.010] lstrlenA (lpString="*.bas") returned 5
	[0055.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.csproj") returned 0
	[0055.010] lstrlenA (lpString="*.csproj") returned 8
	[0055.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.vbproj") returned 0
	[0055.010] lstrlenA (lpString="*.vbproj") returned 8
	[0055.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.vcxproj") returned 0
	[0055.010] lstrlenA (lpString="*.vcxproj") returned 9
	[0055.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.manifest") returned 0
	[0055.010] lstrlenA (lpString="*.manifest") returned 10
	[0055.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.php") returned 0
	[0055.010] lstrlenA (lpString="*.php") returned 5
	[0055.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.vbe") returned 0
	[0055.010] lstrlenA (lpString="*.vbe") returned 5
	[0055.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.vba") returned 0
	[0055.010] lstrlenA (lpString="*.vba") returned 5
	[0055.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.vbs") returned 0
	[0055.010] lstrlenA (lpString="*.vbs") returned 5
	[0055.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.bat") returned 0
	[0055.010] lstrlenA (lpString="*.bat") returned 5
	[0055.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.cmd") returned 0
	[0055.010] lstrlenA (lpString="*.cmd") returned 5
	[0055.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.js") returned 0
	[0055.011] lstrlenA (lpString="*.js") returned 4
	[0055.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.jscript") returned 0
	[0055.011] lstrlenA (lpString="*.jscript") returned 9
	[0055.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.hta") returned 0
	[0055.011] lstrlenA (lpString="*.hta") returned 5
	[0055.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.php7") returned 0
	[0055.011] lstrlenA (lpString="*.php7") returned 6
	[0055.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.db") returned 0
	[0055.011] lstrlenA (lpString="*.db") returned 4
	[0055.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.swf") returned 0
	[0055.011] lstrlenA (lpString="*.swf") returned 5
	[0055.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.eml") returned 0
	[0055.011] lstrlenA (lpString="*.eml") returned 5
	[0055.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.part") returned 0
	[0055.011] lstrlenA (lpString="*.part") returned 6
	[0055.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.nfo") returned 0
	[0055.011] lstrlenA (lpString="*.nfo") returned 5
	[0055.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.rsa") returned 0
	[0055.011] lstrlenA (lpString="*.rsa") returned 5
	[0055.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.key") returned 0
	[0055.011] lstrlenA (lpString="*.key") returned 5
	[0055.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.aes") returned 0
	[0055.011] lstrlenA (lpString="*.aes") returned 5
	[0055.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.blob") returned 0
	[0055.011] lstrlenA (lpString="*.blob") returned 6
	[0055.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.btc") returned 0
	[0055.011] lstrlenA (lpString="*.btc") returned 5
	[0055.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF", pszSpec="*.wallet") returned 0
	[0055.011] lstrlenA (lpString="*.wallet") returned 8
	[0055.011] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42d018, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf42d018, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf42d018, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x911a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0313896.JPG", cAlternateFileName="")) returned 1
	[0055.011] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.011] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0313896.JPG") returned -1
	[0055.011] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0313896.JPG") returned -1
	[0055.011] lstrcmpiA (lpString1="", lpString2="J0313896.JPG") returned -1
	[0055.011] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF") returned="J0309920.WMF"
	[0055.011] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.011] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.012] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.012] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.012] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0313896.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG"
	[0055.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG", pszSpec="*.zip") returned 0
	[0055.012] lstrlenA (lpString="*.zip") returned 5
	[0055.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG", pszSpec="*.rar") returned 0
	[0055.012] lstrlenA (lpString="*.rar") returned 5
	[0055.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG", pszSpec="*.7z") returned 0
	[0055.012] lstrlenA (lpString="*.7z") returned 4
	[0055.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG", pszSpec="*.tar") returned 0
	[0055.012] lstrlenA (lpString="*.tar") returned 5
	[0055.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG", pszSpec="*.gzip") returned 0
	[0055.012] lstrlenA (lpString="*.gzip") returned 6
	[0055.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG", pszSpec="*.jpg") returned 1
	[0055.012] lstrlenA (lpString="*.jpg") returned 5
	[0055.012] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG"
	[0055.012] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG"
	[0055.012] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG."
	[0055.012] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG.exe"
	[0055.012] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313896.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.013] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x911a
	[0055.013] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf42d018, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf42d018, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf42d018, dwHighDateTime=0x1d327e8)) returned 1
	[0055.013] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.013] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x90d8, lpOverlapped=0x0) returned 1
	[0055.015] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG") returned="J0313896.JPG"
	[0055.015] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.015] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x90d8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x90d8, lpOverlapped=0x0) returned 1
	[0055.016] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.016] CloseHandle (hObject=0x214) returned 1
	[0055.017] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313896.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313896.jpg.exe")) returned 1
	[0055.017] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42d018, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf42d018, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf42d018, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa75a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0313965.JPG", cAlternateFileName="")) returned 1
	[0055.017] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.018] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0313965.JPG") returned -1
	[0055.018] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0313965.JPG") returned -1
	[0055.018] lstrcmpiA (lpString1="", lpString2="J0313965.JPG") returned -1
	[0055.018] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG") returned="J0313896.JPG"
	[0055.018] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.018] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.018] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.018] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.018] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0313965.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG"
	[0055.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG", pszSpec="*.zip") returned 0
	[0055.018] lstrlenA (lpString="*.zip") returned 5
	[0055.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG", pszSpec="*.rar") returned 0
	[0055.018] lstrlenA (lpString="*.rar") returned 5
	[0055.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG", pszSpec="*.7z") returned 0
	[0055.018] lstrlenA (lpString="*.7z") returned 4
	[0055.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG", pszSpec="*.tar") returned 0
	[0055.018] lstrlenA (lpString="*.tar") returned 5
	[0055.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG", pszSpec="*.gzip") returned 0
	[0055.018] lstrlenA (lpString="*.gzip") returned 6
	[0055.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG", pszSpec="*.jpg") returned 1
	[0055.018] lstrlenA (lpString="*.jpg") returned 5
	[0055.018] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG"
	[0055.018] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG"
	[0055.018] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG."
	[0055.018] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG.exe"
	[0055.018] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313965.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.018] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa75a
	[0055.019] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf42d018, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf42d018, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf42d018, dwHighDateTime=0x1d327e8)) returned 1
	[0055.019] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.019] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xa718, lpOverlapped=0x0) returned 1
	[0055.139] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG") returned="J0313965.JPG"
	[0055.139] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.139] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xa718, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xa718, lpOverlapped=0x0) returned 1
	[0055.139] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.139] CloseHandle (hObject=0x214) returned 1
	[0055.141] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313965.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313965.jpg.exe")) returned 1
	[0055.142] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42d018, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf42d018, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf42d018, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x81ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0313970.JPG", cAlternateFileName="")) returned 1
	[0055.142] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.142] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0313970.JPG") returned -1
	[0055.142] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0313970.JPG") returned -1
	[0055.142] lstrcmpiA (lpString1="", lpString2="J0313970.JPG") returned -1
	[0055.142] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG") returned="J0313965.JPG"
	[0055.142] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.142] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.142] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.142] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.142] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0313970.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG"
	[0055.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG", pszSpec="*.zip") returned 0
	[0055.142] lstrlenA (lpString="*.zip") returned 5
	[0055.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG", pszSpec="*.rar") returned 0
	[0055.142] lstrlenA (lpString="*.rar") returned 5
	[0055.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG", pszSpec="*.7z") returned 0
	[0055.142] lstrlenA (lpString="*.7z") returned 4
	[0055.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG", pszSpec="*.tar") returned 0
	[0055.142] lstrlenA (lpString="*.tar") returned 5
	[0055.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG", pszSpec="*.gzip") returned 0
	[0055.142] lstrlenA (lpString="*.gzip") returned 6
	[0055.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG", pszSpec="*.jpg") returned 1
	[0055.142] lstrlenA (lpString="*.jpg") returned 5
	[0055.142] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG"
	[0055.142] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG"
	[0055.142] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG."
	[0055.142] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG.exe"
	[0055.142] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313970.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.143] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x81ab
	[0055.143] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf42d018, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf42d018, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf42d018, dwHighDateTime=0x1d327e8)) returned 1
	[0055.143] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.143] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x8169, lpOverlapped=0x0) returned 1
	[0055.145] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG") returned="J0313970.JPG"
	[0055.145] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.145] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x8169, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x8169, lpOverlapped=0x0) returned 1
	[0055.145] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.145] CloseHandle (hObject=0x214) returned 1
	[0055.147] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313970.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313970.jpg.exe")) returned 1
	[0055.147] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42d018, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf42d018, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf42d018, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb9d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0313974.JPG", cAlternateFileName="")) returned 1
	[0055.147] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.147] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0313974.JPG") returned -1
	[0055.147] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0313974.JPG") returned -1
	[0055.147] lstrcmpiA (lpString1="", lpString2="J0313974.JPG") returned -1
	[0055.147] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG") returned="J0313970.JPG"
	[0055.147] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.147] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.147] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.147] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.147] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0313974.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG"
	[0055.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG", pszSpec="*.zip") returned 0
	[0055.147] lstrlenA (lpString="*.zip") returned 5
	[0055.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG", pszSpec="*.rar") returned 0
	[0055.148] lstrlenA (lpString="*.rar") returned 5
	[0055.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG", pszSpec="*.7z") returned 0
	[0055.148] lstrlenA (lpString="*.7z") returned 4
	[0055.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG", pszSpec="*.tar") returned 0
	[0055.148] lstrlenA (lpString="*.tar") returned 5
	[0055.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG", pszSpec="*.gzip") returned 0
	[0055.148] lstrlenA (lpString="*.gzip") returned 6
	[0055.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG", pszSpec="*.jpg") returned 1
	[0055.148] lstrlenA (lpString="*.jpg") returned 5
	[0055.148] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG"
	[0055.148] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG"
	[0055.148] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG."
	[0055.148] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG.exe"
	[0055.148] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313974.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.149] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9d1
	[0055.149] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf42d018, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf42d018, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf42d018, dwHighDateTime=0x1d327e8)) returned 1
	[0055.149] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.149] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xb98f, lpOverlapped=0x0) returned 1
	[0055.151] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG") returned="J0313974.JPG"
	[0055.151] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.151] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xb98f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xb98f, lpOverlapped=0x0) returned 1
	[0055.151] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.151] CloseHandle (hObject=0x214) returned 1
	[0055.153] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313974.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313974.jpg.exe")) returned 1
	[0055.153] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42d018, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf42d018, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf42d018, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x40f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0314068.JPG", cAlternateFileName="")) returned 1
	[0055.153] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.154] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0314068.JPG") returned -1
	[0055.154] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0314068.JPG") returned -1
	[0055.154] lstrcmpiA (lpString1="", lpString2="J0314068.JPG") returned -1
	[0055.154] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG") returned="J0313974.JPG"
	[0055.154] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.154] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.154] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.154] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.154] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0314068.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG"
	[0055.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG", pszSpec="*.zip") returned 0
	[0055.154] lstrlenA (lpString="*.zip") returned 5
	[0055.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG", pszSpec="*.rar") returned 0
	[0055.154] lstrlenA (lpString="*.rar") returned 5
	[0055.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG", pszSpec="*.7z") returned 0
	[0055.154] lstrlenA (lpString="*.7z") returned 4
	[0055.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG", pszSpec="*.tar") returned 0
	[0055.154] lstrlenA (lpString="*.tar") returned 5
	[0055.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG", pszSpec="*.gzip") returned 0
	[0055.154] lstrlenA (lpString="*.gzip") returned 6
	[0055.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG", pszSpec="*.jpg") returned 1
	[0055.154] lstrlenA (lpString="*.jpg") returned 5
	[0055.154] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG"
	[0055.154] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG"
	[0055.154] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG."
	[0055.154] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG.exe"
	[0055.154] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0314068.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.154] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40f2
	[0055.155] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf42d018, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf42d018, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf42d018, dwHighDateTime=0x1d327e8)) returned 1
	[0055.155] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.155] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x40b0, lpOverlapped=0x0) returned 1
	[0055.156] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG") returned="J0314068.JPG"
	[0055.156] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.156] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x40b0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x40b0, lpOverlapped=0x0) returned 1
	[0055.156] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.156] CloseHandle (hObject=0x214) returned 1
	[0055.157] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0314068.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0314068.jpg.exe")) returned 1
	[0055.158] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42d018, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf42d018, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf42d018, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4b02, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0315580.JPG", cAlternateFileName="")) returned 1
	[0055.158] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.158] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0315580.JPG") returned -1
	[0055.158] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0315580.JPG") returned -1
	[0055.158] lstrcmpiA (lpString1="", lpString2="J0315580.JPG") returned -1
	[0055.158] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG") returned="J0314068.JPG"
	[0055.158] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.158] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.158] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.158] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.158] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0315580.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG"
	[0055.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG", pszSpec="*.zip") returned 0
	[0055.158] lstrlenA (lpString="*.zip") returned 5
	[0055.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG", pszSpec="*.rar") returned 0
	[0055.158] lstrlenA (lpString="*.rar") returned 5
	[0055.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG", pszSpec="*.7z") returned 0
	[0055.158] lstrlenA (lpString="*.7z") returned 4
	[0055.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG", pszSpec="*.tar") returned 0
	[0055.158] lstrlenA (lpString="*.tar") returned 5
	[0055.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG", pszSpec="*.gzip") returned 0
	[0055.159] lstrlenA (lpString="*.gzip") returned 6
	[0055.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG", pszSpec="*.jpg") returned 1
	[0055.159] lstrlenA (lpString="*.jpg") returned 5
	[0055.159] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG"
	[0055.159] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG"
	[0055.159] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG."
	[0055.159] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG.exe"
	[0055.159] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315580.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.159] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4b02
	[0055.159] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf42d018, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf42d018, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf42d018, dwHighDateTime=0x1d327e8)) returned 1
	[0055.159] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.159] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x4ac0, lpOverlapped=0x0) returned 1
	[0055.161] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG") returned="J0315580.JPG"
	[0055.161] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.161] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x4ac0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x4ac0, lpOverlapped=0x0) returned 1
	[0055.161] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.161] CloseHandle (hObject=0x214) returned 1
	[0055.162] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315580.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315580.jpg.exe")) returned 1
	[0055.163] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42d018, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf42d018, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf42d018, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x423a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0315612.JPG", cAlternateFileName="")) returned 1
	[0055.163] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.163] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0315612.JPG") returned -1
	[0055.163] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0315612.JPG") returned -1
	[0055.163] lstrcmpiA (lpString1="", lpString2="J0315612.JPG") returned -1
	[0055.163] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG") returned="J0315580.JPG"
	[0055.163] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.163] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.163] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.163] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.163] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0315612.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG"
	[0055.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG", pszSpec="*.zip") returned 0
	[0055.163] lstrlenA (lpString="*.zip") returned 5
	[0055.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG", pszSpec="*.rar") returned 0
	[0055.163] lstrlenA (lpString="*.rar") returned 5
	[0055.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG", pszSpec="*.7z") returned 0
	[0055.163] lstrlenA (lpString="*.7z") returned 4
	[0055.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG", pszSpec="*.tar") returned 0
	[0055.163] lstrlenA (lpString="*.tar") returned 5
	[0055.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG", pszSpec="*.gzip") returned 0
	[0055.163] lstrlenA (lpString="*.gzip") returned 6
	[0055.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG", pszSpec="*.jpg") returned 1
	[0055.163] lstrlenA (lpString="*.jpg") returned 5
	[0055.163] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG"
	[0055.163] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG"
	[0055.164] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG."
	[0055.164] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG.exe"
	[0055.164] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315612.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.164] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x423a
	[0055.164] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf42d018, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf42d018, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf42d018, dwHighDateTime=0x1d327e8)) returned 1
	[0055.164] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.164] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x41f8, lpOverlapped=0x0) returned 1
	[0055.166] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG") returned="J0315612.JPG"
	[0055.166] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.166] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x41f8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x41f8, lpOverlapped=0x0) returned 1
	[0055.166] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.166] CloseHandle (hObject=0x214) returned 1
	[0055.167] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315612.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315612.jpg.exe")) returned 1
	[0055.168] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42d018, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf42d018, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf42d018, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4180, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0318448.WMF", cAlternateFileName="")) returned 1
	[0055.168] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.168] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0318448.WMF") returned -1
	[0055.168] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0318448.WMF") returned -1
	[0055.168] lstrcmpiA (lpString1="", lpString2="J0318448.WMF") returned -1
	[0055.168] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG") returned="J0315612.JPG"
	[0055.168] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.168] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.168] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.168] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.168] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0318448.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF"
	[0055.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.zip") returned 0
	[0055.168] lstrlenA (lpString="*.zip") returned 5
	[0055.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.rar") returned 0
	[0055.168] lstrlenA (lpString="*.rar") returned 5
	[0055.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.7z") returned 0
	[0055.168] lstrlenA (lpString="*.7z") returned 4
	[0055.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.tar") returned 0
	[0055.168] lstrlenA (lpString="*.tar") returned 5
	[0055.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.gzip") returned 0
	[0055.168] lstrlenA (lpString="*.gzip") returned 6
	[0055.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.jpg") returned 0
	[0055.168] lstrlenA (lpString="*.jpg") returned 5
	[0055.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.jpeg") returned 0
	[0055.168] lstrlenA (lpString="*.jpeg") returned 6
	[0055.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.bmp") returned 0
	[0055.168] lstrlenA (lpString="*.bmp") returned 5
	[0055.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.gif") returned 0
	[0055.169] lstrlenA (lpString="*.gif") returned 5
	[0055.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.png") returned 0
	[0055.169] lstrlenA (lpString="*.png") returned 5
	[0055.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.doc") returned 0
	[0055.169] lstrlenA (lpString="*.doc") returned 5
	[0055.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.docx") returned 0
	[0055.169] lstrlenA (lpString="*.docx") returned 6
	[0055.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.xls") returned 0
	[0055.169] lstrlenA (lpString="*.xls") returned 5
	[0055.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.xlsx") returned 0
	[0055.169] lstrlenA (lpString="*.xlsx") returned 6
	[0055.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.ppt") returned 0
	[0055.169] lstrlenA (lpString="*.ppt") returned 5
	[0055.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.pptx") returned 0
	[0055.169] lstrlenA (lpString="*.pptx") returned 6
	[0055.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.txt") returned 0
	[0055.169] lstrlenA (lpString="*.txt") returned 5
	[0055.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.pdf") returned 0
	[0055.169] lstrlenA (lpString="*.pdf") returned 5
	[0055.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.htm") returned 0
	[0055.169] lstrlenA (lpString="*.htm") returned 5
	[0055.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.html") returned 0
	[0055.169] lstrlenA (lpString="*.html") returned 6
	[0055.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.mdb") returned 0
	[0055.169] lstrlenA (lpString="*.mdb") returned 5
	[0055.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.pfx") returned 0
	[0055.169] lstrlenA (lpString="*.pfx") returned 5
	[0055.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.md") returned 0
	[0055.169] lstrlenA (lpString="*.md") returned 4
	[0055.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.lnk") returned 0
	[0055.170] lstrlenA (lpString="*.lnk") returned 5
	[0055.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.torrent") returned 0
	[0055.170] lstrlenA (lpString="*.torrent") returned 9
	[0055.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.mov") returned 0
	[0055.170] lstrlenA (lpString="*.mov") returned 5
	[0055.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.3gp") returned 0
	[0055.170] lstrlenA (lpString="*.3gp") returned 5
	[0055.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.mpeg") returned 0
	[0055.170] lstrlenA (lpString="*.mpeg") returned 6
	[0055.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.mpg") returned 0
	[0055.170] lstrlenA (lpString="*.mpg") returned 5
	[0055.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.flv") returned 0
	[0055.170] lstrlenA (lpString="*.flv") returned 5
	[0055.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.avi") returned 0
	[0055.170] lstrlenA (lpString="*.avi") returned 5
	[0055.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.mp4") returned 0
	[0055.170] lstrlenA (lpString="*.mp4") returned 5
	[0055.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.wmv") returned 0
	[0055.170] lstrlenA (lpString="*.wmv") returned 5
	[0055.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.mkv") returned 0
	[0055.170] lstrlenA (lpString="*.mkv") returned 5
	[0055.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.mp3") returned 0
	[0055.170] lstrlenA (lpString="*.mp3") returned 5
	[0055.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.wav") returned 0
	[0055.170] lstrlenA (lpString="*.wav") returned 5
	[0055.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.flac") returned 0
	[0055.170] lstrlenA (lpString="*.flac") returned 6
	[0055.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.wma") returned 0
	[0055.170] lstrlenA (lpString="*.wma") returned 5
	[0055.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.au3") returned 0
	[0055.171] lstrlenA (lpString="*.au3") returned 5
	[0055.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.ahk") returned 0
	[0055.171] lstrlenA (lpString="*.ahk") returned 5
	[0055.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.c") returned 0
	[0055.171] lstrlenA (lpString="*.c") returned 3
	[0055.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.cc") returned 0
	[0055.171] lstrlenA (lpString="*.cc") returned 4
	[0055.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.cpp") returned 0
	[0055.171] lstrlenA (lpString="*.cpp") returned 5
	[0055.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.cxx") returned 0
	[0055.171] lstrlenA (lpString="*.cxx") returned 5
	[0055.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.c++") returned 0
	[0055.171] lstrlenA (lpString="*.c++") returned 5
	[0055.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.cs") returned 0
	[0055.171] lstrlenA (lpString="*.cs") returned 4
	[0055.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.vb") returned 0
	[0055.171] lstrlenA (lpString="*.vb") returned 4
	[0055.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.bas") returned 0
	[0055.171] lstrlenA (lpString="*.bas") returned 5
	[0055.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.csproj") returned 0
	[0055.171] lstrlenA (lpString="*.csproj") returned 8
	[0055.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.vbproj") returned 0
	[0055.171] lstrlenA (lpString="*.vbproj") returned 8
	[0055.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.vcxproj") returned 0
	[0055.171] lstrlenA (lpString="*.vcxproj") returned 9
	[0055.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.manifest") returned 0
	[0055.171] lstrlenA (lpString="*.manifest") returned 10
	[0055.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.php") returned 0
	[0055.171] lstrlenA (lpString="*.php") returned 5
	[0055.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.vbe") returned 0
	[0055.172] lstrlenA (lpString="*.vbe") returned 5
	[0055.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.vba") returned 0
	[0055.172] lstrlenA (lpString="*.vba") returned 5
	[0055.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.vbs") returned 0
	[0055.172] lstrlenA (lpString="*.vbs") returned 5
	[0055.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.bat") returned 0
	[0055.172] lstrlenA (lpString="*.bat") returned 5
	[0055.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.cmd") returned 0
	[0055.172] lstrlenA (lpString="*.cmd") returned 5
	[0055.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.js") returned 0
	[0055.172] lstrlenA (lpString="*.js") returned 4
	[0055.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.jscript") returned 0
	[0055.172] lstrlenA (lpString="*.jscript") returned 9
	[0055.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.hta") returned 0
	[0055.172] lstrlenA (lpString="*.hta") returned 5
	[0055.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.php7") returned 0
	[0055.172] lstrlenA (lpString="*.php7") returned 6
	[0055.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.db") returned 0
	[0055.172] lstrlenA (lpString="*.db") returned 4
	[0055.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.swf") returned 0
	[0055.172] lstrlenA (lpString="*.swf") returned 5
	[0055.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.eml") returned 0
	[0055.172] lstrlenA (lpString="*.eml") returned 5
	[0055.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.part") returned 0
	[0055.172] lstrlenA (lpString="*.part") returned 6
	[0055.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.nfo") returned 0
	[0055.172] lstrlenA (lpString="*.nfo") returned 5
	[0055.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.rsa") returned 0
	[0055.172] lstrlenA (lpString="*.rsa") returned 5
	[0055.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.key") returned 0
	[0055.172] lstrlenA (lpString="*.key") returned 5
	[0055.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.aes") returned 0
	[0055.172] lstrlenA (lpString="*.aes") returned 5
	[0055.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.blob") returned 0
	[0055.172] lstrlenA (lpString="*.blob") returned 6
	[0055.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.btc") returned 0
	[0055.173] lstrlenA (lpString="*.btc") returned 5
	[0055.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF", pszSpec="*.wallet") returned 0
	[0055.173] lstrlenA (lpString="*.wallet") returned 8
	[0055.173] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45328f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf45328f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf45328f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2dfa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0318804.WMF", cAlternateFileName="")) returned 1
	[0055.173] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.173] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0318804.WMF") returned -1
	[0055.173] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0318804.WMF") returned -1
	[0055.173] lstrcmpiA (lpString1="", lpString2="J0318804.WMF") returned -1
	[0055.173] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF") returned="J0318448.WMF"
	[0055.173] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.173] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.173] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.173] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.173] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0318804.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF"
	[0055.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.zip") returned 0
	[0055.173] lstrlenA (lpString="*.zip") returned 5
	[0055.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.rar") returned 0
	[0055.173] lstrlenA (lpString="*.rar") returned 5
	[0055.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.7z") returned 0
	[0055.173] lstrlenA (lpString="*.7z") returned 4
	[0055.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.tar") returned 0
	[0055.173] lstrlenA (lpString="*.tar") returned 5
	[0055.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.gzip") returned 0
	[0055.173] lstrlenA (lpString="*.gzip") returned 6
	[0055.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.jpg") returned 0
	[0055.173] lstrlenA (lpString="*.jpg") returned 5
	[0055.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.jpeg") returned 0
	[0055.173] lstrlenA (lpString="*.jpeg") returned 6
	[0055.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.bmp") returned 0
	[0055.173] lstrlenA (lpString="*.bmp") returned 5
	[0055.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.gif") returned 0
	[0055.173] lstrlenA (lpString="*.gif") returned 5
	[0055.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.png") returned 0
	[0055.174] lstrlenA (lpString="*.png") returned 5
	[0055.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.doc") returned 0
	[0055.174] lstrlenA (lpString="*.doc") returned 5
	[0055.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.docx") returned 0
	[0055.174] lstrlenA (lpString="*.docx") returned 6
	[0055.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.xls") returned 0
	[0055.174] lstrlenA (lpString="*.xls") returned 5
	[0055.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.xlsx") returned 0
	[0055.174] lstrlenA (lpString="*.xlsx") returned 6
	[0055.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.ppt") returned 0
	[0055.174] lstrlenA (lpString="*.ppt") returned 5
	[0055.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.pptx") returned 0
	[0055.174] lstrlenA (lpString="*.pptx") returned 6
	[0055.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.txt") returned 0
	[0055.174] lstrlenA (lpString="*.txt") returned 5
	[0055.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.pdf") returned 0
	[0055.174] lstrlenA (lpString="*.pdf") returned 5
	[0055.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.htm") returned 0
	[0055.174] lstrlenA (lpString="*.htm") returned 5
	[0055.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.html") returned 0
	[0055.174] lstrlenA (lpString="*.html") returned 6
	[0055.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.mdb") returned 0
	[0055.174] lstrlenA (lpString="*.mdb") returned 5
	[0055.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.pfx") returned 0
	[0055.174] lstrlenA (lpString="*.pfx") returned 5
	[0055.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.md") returned 0
	[0055.174] lstrlenA (lpString="*.md") returned 4
	[0055.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.lnk") returned 0
	[0055.174] lstrlenA (lpString="*.lnk") returned 5
	[0055.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.torrent") returned 0
	[0055.174] lstrlenA (lpString="*.torrent") returned 9
	[0055.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.mov") returned 0
	[0055.174] lstrlenA (lpString="*.mov") returned 5
	[0055.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.3gp") returned 0
	[0055.174] lstrlenA (lpString="*.3gp") returned 5
	[0055.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.mpeg") returned 0
	[0055.175] lstrlenA (lpString="*.mpeg") returned 6
	[0055.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.mpg") returned 0
	[0055.175] lstrlenA (lpString="*.mpg") returned 5
	[0055.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.flv") returned 0
	[0055.175] lstrlenA (lpString="*.flv") returned 5
	[0055.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.avi") returned 0
	[0055.175] lstrlenA (lpString="*.avi") returned 5
	[0055.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.mp4") returned 0
	[0055.175] lstrlenA (lpString="*.mp4") returned 5
	[0055.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.wmv") returned 0
	[0055.175] lstrlenA (lpString="*.wmv") returned 5
	[0055.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.mkv") returned 0
	[0055.175] lstrlenA (lpString="*.mkv") returned 5
	[0055.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.mp3") returned 0
	[0055.175] lstrlenA (lpString="*.mp3") returned 5
	[0055.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.wav") returned 0
	[0055.175] lstrlenA (lpString="*.wav") returned 5
	[0055.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.flac") returned 0
	[0055.175] lstrlenA (lpString="*.flac") returned 6
	[0055.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.wma") returned 0
	[0055.175] lstrlenA (lpString="*.wma") returned 5
	[0055.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.au3") returned 0
	[0055.175] lstrlenA (lpString="*.au3") returned 5
	[0055.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.ahk") returned 0
	[0055.175] lstrlenA (lpString="*.ahk") returned 5
	[0055.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.c") returned 0
	[0055.175] lstrlenA (lpString="*.c") returned 3
	[0055.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.cc") returned 0
	[0055.175] lstrlenA (lpString="*.cc") returned 4
	[0055.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.cpp") returned 0
	[0055.175] lstrlenA (lpString="*.cpp") returned 5
	[0055.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.cxx") returned 0
	[0055.175] lstrlenA (lpString="*.cxx") returned 5
	[0055.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.c++") returned 0
	[0055.175] lstrlenA (lpString="*.c++") returned 5
	[0055.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.cs") returned 0
	[0055.176] lstrlenA (lpString="*.cs") returned 4
	[0055.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.vb") returned 0
	[0055.176] lstrlenA (lpString="*.vb") returned 4
	[0055.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.bas") returned 0
	[0055.176] lstrlenA (lpString="*.bas") returned 5
	[0055.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.csproj") returned 0
	[0055.176] lstrlenA (lpString="*.csproj") returned 8
	[0055.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.vbproj") returned 0
	[0055.176] lstrlenA (lpString="*.vbproj") returned 8
	[0055.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.vcxproj") returned 0
	[0055.176] lstrlenA (lpString="*.vcxproj") returned 9
	[0055.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.manifest") returned 0
	[0055.176] lstrlenA (lpString="*.manifest") returned 10
	[0055.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.php") returned 0
	[0055.176] lstrlenA (lpString="*.php") returned 5
	[0055.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.vbe") returned 0
	[0055.176] lstrlenA (lpString="*.vbe") returned 5
	[0055.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.vba") returned 0
	[0055.176] lstrlenA (lpString="*.vba") returned 5
	[0055.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.vbs") returned 0
	[0055.176] lstrlenA (lpString="*.vbs") returned 5
	[0055.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.bat") returned 0
	[0055.176] lstrlenA (lpString="*.bat") returned 5
	[0055.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.cmd") returned 0
	[0055.176] lstrlenA (lpString="*.cmd") returned 5
	[0055.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.js") returned 0
	[0055.176] lstrlenA (lpString="*.js") returned 4
	[0055.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.jscript") returned 0
	[0055.176] lstrlenA (lpString="*.jscript") returned 9
	[0055.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.hta") returned 0
	[0055.176] lstrlenA (lpString="*.hta") returned 5
	[0055.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.php7") returned 0
	[0055.176] lstrlenA (lpString="*.php7") returned 6
	[0055.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.db") returned 0
	[0055.177] lstrlenA (lpString="*.db") returned 4
	[0055.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.swf") returned 0
	[0055.177] lstrlenA (lpString="*.swf") returned 5
	[0055.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.eml") returned 0
	[0055.177] lstrlenA (lpString="*.eml") returned 5
	[0055.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.part") returned 0
	[0055.177] lstrlenA (lpString="*.part") returned 6
	[0055.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.nfo") returned 0
	[0055.177] lstrlenA (lpString="*.nfo") returned 5
	[0055.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.rsa") returned 0
	[0055.177] lstrlenA (lpString="*.rsa") returned 5
	[0055.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.key") returned 0
	[0055.177] lstrlenA (lpString="*.key") returned 5
	[0055.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.aes") returned 0
	[0055.177] lstrlenA (lpString="*.aes") returned 5
	[0055.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.blob") returned 0
	[0055.177] lstrlenA (lpString="*.blob") returned 6
	[0055.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.btc") returned 0
	[0055.177] lstrlenA (lpString="*.btc") returned 5
	[0055.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF", pszSpec="*.wallet") returned 0
	[0055.177] lstrlenA (lpString="*.wallet") returned 8
	[0055.177] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45328f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf45328f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf45328f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x28be, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0318810.WMF", cAlternateFileName="")) returned 1
	[0055.177] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.177] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0318810.WMF") returned -1
	[0055.177] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0318810.WMF") returned -1
	[0055.177] lstrcmpiA (lpString1="", lpString2="J0318810.WMF") returned -1
	[0055.177] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF") returned="J0318804.WMF"
	[0055.177] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.177] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.177] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.177] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.177] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0318810.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF"
	[0055.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.zip") returned 0
	[0055.178] lstrlenA (lpString="*.zip") returned 5
	[0055.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.rar") returned 0
	[0055.178] lstrlenA (lpString="*.rar") returned 5
	[0055.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.7z") returned 0
	[0055.178] lstrlenA (lpString="*.7z") returned 4
	[0055.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.tar") returned 0
	[0055.178] lstrlenA (lpString="*.tar") returned 5
	[0055.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.gzip") returned 0
	[0055.178] lstrlenA (lpString="*.gzip") returned 6
	[0055.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.jpg") returned 0
	[0055.178] lstrlenA (lpString="*.jpg") returned 5
	[0055.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.jpeg") returned 0
	[0055.178] lstrlenA (lpString="*.jpeg") returned 6
	[0055.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.bmp") returned 0
	[0055.178] lstrlenA (lpString="*.bmp") returned 5
	[0055.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.gif") returned 0
	[0055.178] lstrlenA (lpString="*.gif") returned 5
	[0055.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.png") returned 0
	[0055.178] lstrlenA (lpString="*.png") returned 5
	[0055.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.doc") returned 0
	[0055.178] lstrlenA (lpString="*.doc") returned 5
	[0055.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.docx") returned 0
	[0055.178] lstrlenA (lpString="*.docx") returned 6
	[0055.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.xls") returned 0
	[0055.178] lstrlenA (lpString="*.xls") returned 5
	[0055.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.xlsx") returned 0
	[0055.178] lstrlenA (lpString="*.xlsx") returned 6
	[0055.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.ppt") returned 0
	[0055.178] lstrlenA (lpString="*.ppt") returned 5
	[0055.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.pptx") returned 0
	[0055.178] lstrlenA (lpString="*.pptx") returned 6
	[0055.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.txt") returned 0
	[0055.178] lstrlenA (lpString="*.txt") returned 5
	[0055.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.pdf") returned 0
	[0055.179] lstrlenA (lpString="*.pdf") returned 5
	[0055.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.htm") returned 0
	[0055.179] lstrlenA (lpString="*.htm") returned 5
	[0055.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.html") returned 0
	[0055.179] lstrlenA (lpString="*.html") returned 6
	[0055.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.mdb") returned 0
	[0055.179] lstrlenA (lpString="*.mdb") returned 5
	[0055.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.pfx") returned 0
	[0055.179] lstrlenA (lpString="*.pfx") returned 5
	[0055.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.md") returned 0
	[0055.179] lstrlenA (lpString="*.md") returned 4
	[0055.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.lnk") returned 0
	[0055.179] lstrlenA (lpString="*.lnk") returned 5
	[0055.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.torrent") returned 0
	[0055.179] lstrlenA (lpString="*.torrent") returned 9
	[0055.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.mov") returned 0
	[0055.179] lstrlenA (lpString="*.mov") returned 5
	[0055.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.3gp") returned 0
	[0055.179] lstrlenA (lpString="*.3gp") returned 5
	[0055.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.mpeg") returned 0
	[0055.179] lstrlenA (lpString="*.mpeg") returned 6
	[0055.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.mpg") returned 0
	[0055.179] lstrlenA (lpString="*.mpg") returned 5
	[0055.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.flv") returned 0
	[0055.179] lstrlenA (lpString="*.flv") returned 5
	[0055.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.avi") returned 0
	[0055.179] lstrlenA (lpString="*.avi") returned 5
	[0055.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.mp4") returned 0
	[0055.179] lstrlenA (lpString="*.mp4") returned 5
	[0055.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.wmv") returned 0
	[0055.179] lstrlenA (lpString="*.wmv") returned 5
	[0055.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.mkv") returned 0
	[0055.179] lstrlenA (lpString="*.mkv") returned 5
	[0055.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.mp3") returned 0
	[0055.179] lstrlenA (lpString="*.mp3") returned 5
	[0055.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.wav") returned 0
	[0055.180] lstrlenA (lpString="*.wav") returned 5
	[0055.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.flac") returned 0
	[0055.180] lstrlenA (lpString="*.flac") returned 6
	[0055.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.wma") returned 0
	[0055.180] lstrlenA (lpString="*.wma") returned 5
	[0055.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.au3") returned 0
	[0055.180] lstrlenA (lpString="*.au3") returned 5
	[0055.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.ahk") returned 0
	[0055.180] lstrlenA (lpString="*.ahk") returned 5
	[0055.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.c") returned 0
	[0055.180] lstrlenA (lpString="*.c") returned 3
	[0055.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.cc") returned 0
	[0055.180] lstrlenA (lpString="*.cc") returned 4
	[0055.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.cpp") returned 0
	[0055.180] lstrlenA (lpString="*.cpp") returned 5
	[0055.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.cxx") returned 0
	[0055.180] lstrlenA (lpString="*.cxx") returned 5
	[0055.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.c++") returned 0
	[0055.180] lstrlenA (lpString="*.c++") returned 5
	[0055.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.cs") returned 0
	[0055.180] lstrlenA (lpString="*.cs") returned 4
	[0055.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.vb") returned 0
	[0055.180] lstrlenA (lpString="*.vb") returned 4
	[0055.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.bas") returned 0
	[0055.180] lstrlenA (lpString="*.bas") returned 5
	[0055.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.csproj") returned 0
	[0055.180] lstrlenA (lpString="*.csproj") returned 8
	[0055.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.vbproj") returned 0
	[0055.180] lstrlenA (lpString="*.vbproj") returned 8
	[0055.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.vcxproj") returned 0
	[0055.180] lstrlenA (lpString="*.vcxproj") returned 9
	[0055.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.manifest") returned 0
	[0055.180] lstrlenA (lpString="*.manifest") returned 10
	[0055.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.php") returned 0
	[0055.181] lstrlenA (lpString="*.php") returned 5
	[0055.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.vbe") returned 0
	[0055.181] lstrlenA (lpString="*.vbe") returned 5
	[0055.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.vba") returned 0
	[0055.181] lstrlenA (lpString="*.vba") returned 5
	[0055.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.vbs") returned 0
	[0055.181] lstrlenA (lpString="*.vbs") returned 5
	[0055.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.bat") returned 0
	[0055.181] lstrlenA (lpString="*.bat") returned 5
	[0055.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.cmd") returned 0
	[0055.181] lstrlenA (lpString="*.cmd") returned 5
	[0055.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.js") returned 0
	[0055.181] lstrlenA (lpString="*.js") returned 4
	[0055.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.jscript") returned 0
	[0055.181] lstrlenA (lpString="*.jscript") returned 9
	[0055.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.hta") returned 0
	[0055.181] lstrlenA (lpString="*.hta") returned 5
	[0055.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.php7") returned 0
	[0055.181] lstrlenA (lpString="*.php7") returned 6
	[0055.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.db") returned 0
	[0055.181] lstrlenA (lpString="*.db") returned 4
	[0055.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.swf") returned 0
	[0055.181] lstrlenA (lpString="*.swf") returned 5
	[0055.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.eml") returned 0
	[0055.181] lstrlenA (lpString="*.eml") returned 5
	[0055.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.part") returned 0
	[0055.181] lstrlenA (lpString="*.part") returned 6
	[0055.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.nfo") returned 0
	[0055.181] lstrlenA (lpString="*.nfo") returned 5
	[0055.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.rsa") returned 0
	[0055.181] lstrlenA (lpString="*.rsa") returned 5
	[0055.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.key") returned 0
	[0055.181] lstrlenA (lpString="*.key") returned 5
	[0055.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.aes") returned 0
	[0055.182] lstrlenA (lpString="*.aes") returned 5
	[0055.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.blob") returned 0
	[0055.182] lstrlenA (lpString="*.blob") returned 6
	[0055.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.btc") returned 0
	[0055.182] lstrlenA (lpString="*.btc") returned 5
	[0055.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF", pszSpec="*.wallet") returned 0
	[0055.182] lstrlenA (lpString="*.wallet") returned 8
	[0055.182] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45328f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf45328f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf45328f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x24d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0321179.JPG", cAlternateFileName="")) returned 1
	[0055.182] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.182] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0321179.JPG") returned -1
	[0055.182] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0321179.JPG") returned -1
	[0055.182] lstrcmpiA (lpString1="", lpString2="J0321179.JPG") returned -1
	[0055.182] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF") returned="J0318810.WMF"
	[0055.182] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.182] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.182] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.182] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.182] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0321179.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG"
	[0055.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG", pszSpec="*.zip") returned 0
	[0055.182] lstrlenA (lpString="*.zip") returned 5
	[0055.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG", pszSpec="*.rar") returned 0
	[0055.182] lstrlenA (lpString="*.rar") returned 5
	[0055.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG", pszSpec="*.7z") returned 0
	[0055.182] lstrlenA (lpString="*.7z") returned 4
	[0055.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG", pszSpec="*.tar") returned 0
	[0055.182] lstrlenA (lpString="*.tar") returned 5
	[0055.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG", pszSpec="*.gzip") returned 0
	[0055.182] lstrlenA (lpString="*.gzip") returned 6
	[0055.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG", pszSpec="*.jpg") returned 1
	[0055.182] lstrlenA (lpString="*.jpg") returned 5
	[0055.182] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG"
	[0055.182] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG"
	[0055.183] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG."
	[0055.183] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG.exe"
	[0055.183] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0321179.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.262] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x24d7
	[0055.262] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8)) returned 1
	[0055.262] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.263] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x2495, lpOverlapped=0x0) returned 1
	[0055.264] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG") returned="J0321179.JPG"
	[0055.264] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.264] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x2495, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x2495, lpOverlapped=0x0) returned 1
	[0055.264] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.264] CloseHandle (hObject=0x214) returned 1
	[0055.265] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0321179.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0321179.jpg.exe")) returned 1
	[0055.279] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45328f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf45328f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf45328f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ff8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0324694.WMF", cAlternateFileName="")) returned 1
	[0055.279] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.279] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0324694.WMF") returned -1
	[0055.279] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0324694.WMF") returned -1
	[0055.279] lstrcmpiA (lpString1="", lpString2="J0324694.WMF") returned -1
	[0055.279] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG") returned="J0321179.JPG"
	[0055.279] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.279] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.279] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.279] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.279] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0324694.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF"
	[0055.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.zip") returned 0
	[0055.279] lstrlenA (lpString="*.zip") returned 5
	[0055.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.rar") returned 0
	[0055.279] lstrlenA (lpString="*.rar") returned 5
	[0055.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.7z") returned 0
	[0055.279] lstrlenA (lpString="*.7z") returned 4
	[0055.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.tar") returned 0
	[0055.279] lstrlenA (lpString="*.tar") returned 5
	[0055.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.gzip") returned 0
	[0055.280] lstrlenA (lpString="*.gzip") returned 6
	[0055.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.jpg") returned 0
	[0055.280] lstrlenA (lpString="*.jpg") returned 5
	[0055.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.jpeg") returned 0
	[0055.280] lstrlenA (lpString="*.jpeg") returned 6
	[0055.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.bmp") returned 0
	[0055.280] lstrlenA (lpString="*.bmp") returned 5
	[0055.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.gif") returned 0
	[0055.280] lstrlenA (lpString="*.gif") returned 5
	[0055.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.png") returned 0
	[0055.280] lstrlenA (lpString="*.png") returned 5
	[0055.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.doc") returned 0
	[0055.280] lstrlenA (lpString="*.doc") returned 5
	[0055.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.docx") returned 0
	[0055.280] lstrlenA (lpString="*.docx") returned 6
	[0055.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.xls") returned 0
	[0055.280] lstrlenA (lpString="*.xls") returned 5
	[0055.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.xlsx") returned 0
	[0055.280] lstrlenA (lpString="*.xlsx") returned 6
	[0055.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.ppt") returned 0
	[0055.280] lstrlenA (lpString="*.ppt") returned 5
	[0055.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.pptx") returned 0
	[0055.280] lstrlenA (lpString="*.pptx") returned 6
	[0055.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.txt") returned 0
	[0055.280] lstrlenA (lpString="*.txt") returned 5
	[0055.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.pdf") returned 0
	[0055.280] lstrlenA (lpString="*.pdf") returned 5
	[0055.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.htm") returned 0
	[0055.280] lstrlenA (lpString="*.htm") returned 5
	[0055.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.html") returned 0
	[0055.280] lstrlenA (lpString="*.html") returned 6
	[0055.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.mdb") returned 0
	[0055.280] lstrlenA (lpString="*.mdb") returned 5
	[0055.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.pfx") returned 0
	[0055.280] lstrlenA (lpString="*.pfx") returned 5
	[0055.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.md") returned 0
	[0055.281] lstrlenA (lpString="*.md") returned 4
	[0055.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.lnk") returned 0
	[0055.281] lstrlenA (lpString="*.lnk") returned 5
	[0055.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.torrent") returned 0
	[0055.281] lstrlenA (lpString="*.torrent") returned 9
	[0055.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.mov") returned 0
	[0055.281] lstrlenA (lpString="*.mov") returned 5
	[0055.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.3gp") returned 0
	[0055.281] lstrlenA (lpString="*.3gp") returned 5
	[0055.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.mpeg") returned 0
	[0055.281] lstrlenA (lpString="*.mpeg") returned 6
	[0055.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.mpg") returned 0
	[0055.281] lstrlenA (lpString="*.mpg") returned 5
	[0055.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.flv") returned 0
	[0055.281] lstrlenA (lpString="*.flv") returned 5
	[0055.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.avi") returned 0
	[0055.281] lstrlenA (lpString="*.avi") returned 5
	[0055.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.mp4") returned 0
	[0055.281] lstrlenA (lpString="*.mp4") returned 5
	[0055.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.wmv") returned 0
	[0055.281] lstrlenA (lpString="*.wmv") returned 5
	[0055.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.mkv") returned 0
	[0055.281] lstrlenA (lpString="*.mkv") returned 5
	[0055.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.mp3") returned 0
	[0055.281] lstrlenA (lpString="*.mp3") returned 5
	[0055.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.wav") returned 0
	[0055.281] lstrlenA (lpString="*.wav") returned 5
	[0055.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.flac") returned 0
	[0055.281] lstrlenA (lpString="*.flac") returned 6
	[0055.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.wma") returned 0
	[0055.281] lstrlenA (lpString="*.wma") returned 5
	[0055.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.au3") returned 0
	[0055.281] lstrlenA (lpString="*.au3") returned 5
	[0055.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.ahk") returned 0
	[0055.281] lstrlenA (lpString="*.ahk") returned 5
	[0055.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.c") returned 0
	[0055.281] lstrlenA (lpString="*.c") returned 3
	[0055.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.cc") returned 0
	[0055.282] lstrlenA (lpString="*.cc") returned 4
	[0055.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.cpp") returned 0
	[0055.282] lstrlenA (lpString="*.cpp") returned 5
	[0055.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.cxx") returned 0
	[0055.282] lstrlenA (lpString="*.cxx") returned 5
	[0055.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.c++") returned 0
	[0055.282] lstrlenA (lpString="*.c++") returned 5
	[0055.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.cs") returned 0
	[0055.282] lstrlenA (lpString="*.cs") returned 4
	[0055.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.vb") returned 0
	[0055.282] lstrlenA (lpString="*.vb") returned 4
	[0055.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.bas") returned 0
	[0055.282] lstrlenA (lpString="*.bas") returned 5
	[0055.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.csproj") returned 0
	[0055.282] lstrlenA (lpString="*.csproj") returned 8
	[0055.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.vbproj") returned 0
	[0055.282] lstrlenA (lpString="*.vbproj") returned 8
	[0055.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.vcxproj") returned 0
	[0055.282] lstrlenA (lpString="*.vcxproj") returned 9
	[0055.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.manifest") returned 0
	[0055.282] lstrlenA (lpString="*.manifest") returned 10
	[0055.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.php") returned 0
	[0055.282] lstrlenA (lpString="*.php") returned 5
	[0055.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.vbe") returned 0
	[0055.282] lstrlenA (lpString="*.vbe") returned 5
	[0055.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.vba") returned 0
	[0055.282] lstrlenA (lpString="*.vba") returned 5
	[0055.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.vbs") returned 0
	[0055.282] lstrlenA (lpString="*.vbs") returned 5
	[0055.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.bat") returned 0
	[0055.282] lstrlenA (lpString="*.bat") returned 5
	[0055.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.cmd") returned 0
	[0055.282] lstrlenA (lpString="*.cmd") returned 5
	[0055.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.js") returned 0
	[0055.282] lstrlenA (lpString="*.js") returned 4
	[0055.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.jscript") returned 0
	[0055.283] lstrlenA (lpString="*.jscript") returned 9
	[0055.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.hta") returned 0
	[0055.283] lstrlenA (lpString="*.hta") returned 5
	[0055.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.php7") returned 0
	[0055.283] lstrlenA (lpString="*.php7") returned 6
	[0055.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.db") returned 0
	[0055.283] lstrlenA (lpString="*.db") returned 4
	[0055.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.swf") returned 0
	[0055.283] lstrlenA (lpString="*.swf") returned 5
	[0055.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.eml") returned 0
	[0055.283] lstrlenA (lpString="*.eml") returned 5
	[0055.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.part") returned 0
	[0055.283] lstrlenA (lpString="*.part") returned 6
	[0055.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.nfo") returned 0
	[0055.283] lstrlenA (lpString="*.nfo") returned 5
	[0055.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.rsa") returned 0
	[0055.283] lstrlenA (lpString="*.rsa") returned 5
	[0055.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.key") returned 0
	[0055.283] lstrlenA (lpString="*.key") returned 5
	[0055.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.aes") returned 0
	[0055.283] lstrlenA (lpString="*.aes") returned 5
	[0055.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.blob") returned 0
	[0055.283] lstrlenA (lpString="*.blob") returned 6
	[0055.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.btc") returned 0
	[0055.283] lstrlenA (lpString="*.btc") returned 5
	[0055.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF", pszSpec="*.wallet") returned 0
	[0055.283] lstrlenA (lpString="*.wallet") returned 8
	[0055.283] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45328f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf45328f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf45328f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0324704.WMF", cAlternateFileName="")) returned 1
	[0055.283] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.283] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0324704.WMF") returned -1
	[0055.283] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0324704.WMF") returned -1
	[0055.283] lstrcmpiA (lpString1="", lpString2="J0324704.WMF") returned -1
	[0055.283] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF") returned="J0324694.WMF"
	[0055.283] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.283] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.283] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.284] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.284] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0324704.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF"
	[0055.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.zip") returned 0
	[0055.284] lstrlenA (lpString="*.zip") returned 5
	[0055.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.rar") returned 0
	[0055.284] lstrlenA (lpString="*.rar") returned 5
	[0055.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.7z") returned 0
	[0055.284] lstrlenA (lpString="*.7z") returned 4
	[0055.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.tar") returned 0
	[0055.284] lstrlenA (lpString="*.tar") returned 5
	[0055.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.gzip") returned 0
	[0055.284] lstrlenA (lpString="*.gzip") returned 6
	[0055.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.jpg") returned 0
	[0055.284] lstrlenA (lpString="*.jpg") returned 5
	[0055.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.jpeg") returned 0
	[0055.284] lstrlenA (lpString="*.jpeg") returned 6
	[0055.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.bmp") returned 0
	[0055.284] lstrlenA (lpString="*.bmp") returned 5
	[0055.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.gif") returned 0
	[0055.284] lstrlenA (lpString="*.gif") returned 5
	[0055.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.png") returned 0
	[0055.284] lstrlenA (lpString="*.png") returned 5
	[0055.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.doc") returned 0
	[0055.284] lstrlenA (lpString="*.doc") returned 5
	[0055.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.docx") returned 0
	[0055.284] lstrlenA (lpString="*.docx") returned 6
	[0055.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.xls") returned 0
	[0055.284] lstrlenA (lpString="*.xls") returned 5
	[0055.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.xlsx") returned 0
	[0055.284] lstrlenA (lpString="*.xlsx") returned 6
	[0055.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.ppt") returned 0
	[0055.284] lstrlenA (lpString="*.ppt") returned 5
	[0055.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.pptx") returned 0
	[0055.284] lstrlenA (lpString="*.pptx") returned 6
	[0055.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.txt") returned 0
	[0055.284] lstrlenA (lpString="*.txt") returned 5
	[0055.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.pdf") returned 0
	[0055.285] lstrlenA (lpString="*.pdf") returned 5
	[0055.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.htm") returned 0
	[0055.285] lstrlenA (lpString="*.htm") returned 5
	[0055.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.html") returned 0
	[0055.285] lstrlenA (lpString="*.html") returned 6
	[0055.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.mdb") returned 0
	[0055.285] lstrlenA (lpString="*.mdb") returned 5
	[0055.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.pfx") returned 0
	[0055.285] lstrlenA (lpString="*.pfx") returned 5
	[0055.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.md") returned 0
	[0055.285] lstrlenA (lpString="*.md") returned 4
	[0055.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.lnk") returned 0
	[0055.285] lstrlenA (lpString="*.lnk") returned 5
	[0055.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.torrent") returned 0
	[0055.285] lstrlenA (lpString="*.torrent") returned 9
	[0055.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.mov") returned 0
	[0055.285] lstrlenA (lpString="*.mov") returned 5
	[0055.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.3gp") returned 0
	[0055.285] lstrlenA (lpString="*.3gp") returned 5
	[0055.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.mpeg") returned 0
	[0055.285] lstrlenA (lpString="*.mpeg") returned 6
	[0055.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.mpg") returned 0
	[0055.285] lstrlenA (lpString="*.mpg") returned 5
	[0055.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.flv") returned 0
	[0055.285] lstrlenA (lpString="*.flv") returned 5
	[0055.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.avi") returned 0
	[0055.285] lstrlenA (lpString="*.avi") returned 5
	[0055.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.mp4") returned 0
	[0055.285] lstrlenA (lpString="*.mp4") returned 5
	[0055.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.wmv") returned 0
	[0055.285] lstrlenA (lpString="*.wmv") returned 5
	[0055.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.mkv") returned 0
	[0055.285] lstrlenA (lpString="*.mkv") returned 5
	[0055.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.mp3") returned 0
	[0055.286] lstrlenA (lpString="*.mp3") returned 5
	[0055.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.wav") returned 0
	[0055.286] lstrlenA (lpString="*.wav") returned 5
	[0055.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.flac") returned 0
	[0055.286] lstrlenA (lpString="*.flac") returned 6
	[0055.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.wma") returned 0
	[0055.286] lstrlenA (lpString="*.wma") returned 5
	[0055.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.au3") returned 0
	[0055.286] lstrlenA (lpString="*.au3") returned 5
	[0055.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.ahk") returned 0
	[0055.286] lstrlenA (lpString="*.ahk") returned 5
	[0055.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.c") returned 0
	[0055.286] lstrlenA (lpString="*.c") returned 3
	[0055.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.cc") returned 0
	[0055.286] lstrlenA (lpString="*.cc") returned 4
	[0055.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.cpp") returned 0
	[0055.286] lstrlenA (lpString="*.cpp") returned 5
	[0055.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.cxx") returned 0
	[0055.286] lstrlenA (lpString="*.cxx") returned 5
	[0055.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.c++") returned 0
	[0055.286] lstrlenA (lpString="*.c++") returned 5
	[0055.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.cs") returned 0
	[0055.286] lstrlenA (lpString="*.cs") returned 4
	[0055.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.vb") returned 0
	[0055.286] lstrlenA (lpString="*.vb") returned 4
	[0055.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.bas") returned 0
	[0055.286] lstrlenA (lpString="*.bas") returned 5
	[0055.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.csproj") returned 0
	[0055.286] lstrlenA (lpString="*.csproj") returned 8
	[0055.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.vbproj") returned 0
	[0055.287] lstrlenA (lpString="*.vbproj") returned 8
	[0055.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.vcxproj") returned 0
	[0055.287] lstrlenA (lpString="*.vcxproj") returned 9
	[0055.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.manifest") returned 0
	[0055.287] lstrlenA (lpString="*.manifest") returned 10
	[0055.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.php") returned 0
	[0055.287] lstrlenA (lpString="*.php") returned 5
	[0055.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.vbe") returned 0
	[0055.287] lstrlenA (lpString="*.vbe") returned 5
	[0055.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.vba") returned 0
	[0055.287] lstrlenA (lpString="*.vba") returned 5
	[0055.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.vbs") returned 0
	[0055.287] lstrlenA (lpString="*.vbs") returned 5
	[0055.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.bat") returned 0
	[0055.287] lstrlenA (lpString="*.bat") returned 5
	[0055.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.cmd") returned 0
	[0055.287] lstrlenA (lpString="*.cmd") returned 5
	[0055.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.js") returned 0
	[0055.287] lstrlenA (lpString="*.js") returned 4
	[0055.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.jscript") returned 0
	[0055.287] lstrlenA (lpString="*.jscript") returned 9
	[0055.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.hta") returned 0
	[0055.287] lstrlenA (lpString="*.hta") returned 5
	[0055.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.php7") returned 0
	[0055.287] lstrlenA (lpString="*.php7") returned 6
	[0055.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.db") returned 0
	[0055.287] lstrlenA (lpString="*.db") returned 4
	[0055.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.swf") returned 0
	[0055.287] lstrlenA (lpString="*.swf") returned 5
	[0055.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.eml") returned 0
	[0055.287] lstrlenA (lpString="*.eml") returned 5
	[0055.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.part") returned 0
	[0055.287] lstrlenA (lpString="*.part") returned 6
	[0055.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.nfo") returned 0
	[0055.287] lstrlenA (lpString="*.nfo") returned 5
	[0055.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.rsa") returned 0
	[0055.288] lstrlenA (lpString="*.rsa") returned 5
	[0055.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.key") returned 0
	[0055.288] lstrlenA (lpString="*.key") returned 5
	[0055.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.aes") returned 0
	[0055.288] lstrlenA (lpString="*.aes") returned 5
	[0055.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.blob") returned 0
	[0055.288] lstrlenA (lpString="*.blob") returned 6
	[0055.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.btc") returned 0
	[0055.288] lstrlenA (lpString="*.btc") returned 5
	[0055.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF", pszSpec="*.wallet") returned 0
	[0055.288] lstrlenA (lpString="*.wallet") returned 8
	[0055.288] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45328f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf45328f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf45328f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3260, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0337280.JPG", cAlternateFileName="")) returned 1
	[0055.289] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.289] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0337280.JPG") returned -1
	[0055.289] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0337280.JPG") returned -1
	[0055.289] lstrcmpiA (lpString1="", lpString2="J0337280.JPG") returned -1
	[0055.289] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF") returned="J0324704.WMF"
	[0055.289] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.289] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.289] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.289] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.289] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0337280.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG"
	[0055.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG", pszSpec="*.zip") returned 0
	[0055.289] lstrlenA (lpString="*.zip") returned 5
	[0055.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG", pszSpec="*.rar") returned 0
	[0055.289] lstrlenA (lpString="*.rar") returned 5
	[0055.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG", pszSpec="*.7z") returned 0
	[0055.289] lstrlenA (lpString="*.7z") returned 4
	[0055.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG", pszSpec="*.tar") returned 0
	[0055.289] lstrlenA (lpString="*.tar") returned 5
	[0055.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG", pszSpec="*.gzip") returned 0
	[0055.289] lstrlenA (lpString="*.gzip") returned 6
	[0055.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG", pszSpec="*.jpg") returned 1
	[0055.290] lstrlenA (lpString="*.jpg") returned 5
	[0055.290] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG"
	[0055.290] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG"
	[0055.290] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG."
	[0055.290] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG.exe"
	[0055.290] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0337280.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.290] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3260
	[0055.290] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8)) returned 1
	[0055.290] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.290] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x321e, lpOverlapped=0x0) returned 1
	[0055.292] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG") returned="J0337280.JPG"
	[0055.292] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.292] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x321e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x321e, lpOverlapped=0x0) returned 1
	[0055.292] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.292] CloseHandle (hObject=0x214) returned 1
	[0055.293] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0337280.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0337280.jpg.exe")) returned 1
	[0055.294] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45328f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf45328f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf45328f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x27d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341328.JPG", cAlternateFileName="")) returned 1
	[0055.294] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.294] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0341328.JPG") returned -1
	[0055.294] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0341328.JPG") returned -1
	[0055.294] lstrcmpiA (lpString1="", lpString2="J0341328.JPG") returned -1
	[0055.294] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG") returned="J0337280.JPG"
	[0055.294] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.294] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.294] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.294] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.294] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0341328.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG"
	[0055.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG", pszSpec="*.zip") returned 0
	[0055.294] lstrlenA (lpString="*.zip") returned 5
	[0055.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG", pszSpec="*.rar") returned 0
	[0055.294] lstrlenA (lpString="*.rar") returned 5
	[0055.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG", pszSpec="*.7z") returned 0
	[0055.294] lstrlenA (lpString="*.7z") returned 4
	[0055.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG", pszSpec="*.tar") returned 0
	[0055.294] lstrlenA (lpString="*.tar") returned 5
	[0055.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG", pszSpec="*.gzip") returned 0
	[0055.294] lstrlenA (lpString="*.gzip") returned 6
	[0055.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG", pszSpec="*.jpg") returned 1
	[0055.294] lstrlenA (lpString="*.jpg") returned 5
	[0055.294] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG"
	[0055.294] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG"
	[0055.294] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG."
	[0055.294] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG.exe"
	[0055.295] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341328.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.317] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x27d4
	[0055.317] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8)) returned 1
	[0055.317] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.317] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x2792, lpOverlapped=0x0) returned 1
	[0055.319] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG") returned="J0341328.JPG"
	[0055.319] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.319] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x2792, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x2792, lpOverlapped=0x0) returned 1
	[0055.319] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.319] CloseHandle (hObject=0x214) returned 1
	[0055.320] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341328.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341328.jpg.exe")) returned 1
	[0055.321] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45328f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf45328f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf45328f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2cdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341344.JPG", cAlternateFileName="")) returned 1
	[0055.321] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.321] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0341344.JPG") returned -1
	[0055.321] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0341344.JPG") returned -1
	[0055.321] lstrcmpiA (lpString1="", lpString2="J0341344.JPG") returned -1
	[0055.321] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG") returned="J0341328.JPG"
	[0055.321] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.321] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.321] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.321] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.322] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0341344.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG"
	[0055.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG", pszSpec="*.zip") returned 0
	[0055.322] lstrlenA (lpString="*.zip") returned 5
	[0055.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG", pszSpec="*.rar") returned 0
	[0055.322] lstrlenA (lpString="*.rar") returned 5
	[0055.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG", pszSpec="*.7z") returned 0
	[0055.322] lstrlenA (lpString="*.7z") returned 4
	[0055.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG", pszSpec="*.tar") returned 0
	[0055.322] lstrlenA (lpString="*.tar") returned 5
	[0055.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG", pszSpec="*.gzip") returned 0
	[0055.322] lstrlenA (lpString="*.gzip") returned 6
	[0055.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG", pszSpec="*.jpg") returned 1
	[0055.322] lstrlenA (lpString="*.jpg") returned 5
	[0055.322] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG"
	[0055.322] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG"
	[0055.322] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG."
	[0055.322] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG.exe"
	[0055.322] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341344.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.322] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2cdd
	[0055.322] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8)) returned 1
	[0055.323] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.323] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x2c9b, lpOverlapped=0x0) returned 1
	[0055.324] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG") returned="J0341344.JPG"
	[0055.324] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.324] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x2c9b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x2c9b, lpOverlapped=0x0) returned 1
	[0055.324] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.324] CloseHandle (hObject=0x214) returned 1
	[0055.325] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341344.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341344.jpg.exe")) returned 1
	[0055.326] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45328f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf45328f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf45328f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4c6d, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341439.JPG", cAlternateFileName="")) returned 1
	[0055.326] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.326] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0341439.JPG") returned -1
	[0055.326] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0341439.JPG") returned -1
	[0055.326] lstrcmpiA (lpString1="", lpString2="J0341439.JPG") returned -1
	[0055.326] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG") returned="J0341344.JPG"
	[0055.326] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.326] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.326] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.326] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.326] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0341439.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG"
	[0055.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG", pszSpec="*.zip") returned 0
	[0055.326] lstrlenA (lpString="*.zip") returned 5
	[0055.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG", pszSpec="*.rar") returned 0
	[0055.326] lstrlenA (lpString="*.rar") returned 5
	[0055.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG", pszSpec="*.7z") returned 0
	[0055.326] lstrlenA (lpString="*.7z") returned 4
	[0055.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG", pszSpec="*.tar") returned 0
	[0055.326] lstrlenA (lpString="*.tar") returned 5
	[0055.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG", pszSpec="*.gzip") returned 0
	[0055.326] lstrlenA (lpString="*.gzip") returned 6
	[0055.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG", pszSpec="*.jpg") returned 1
	[0055.327] lstrlenA (lpString="*.jpg") returned 5
	[0055.327] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG"
	[0055.327] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG"
	[0055.327] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG."
	[0055.327] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG.exe"
	[0055.327] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341439.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.327] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4c6d
	[0055.327] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8)) returned 1
	[0055.327] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.327] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x4c2b, lpOverlapped=0x0) returned 1
	[0055.329] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG") returned="J0341439.JPG"
	[0055.329] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.329] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x4c2b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x4c2b, lpOverlapped=0x0) returned 1
	[0055.329] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.329] CloseHandle (hObject=0x214) returned 1
	[0055.330] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341439.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341439.jpg.exe")) returned 1
	[0055.331] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42d018, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf42d018, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf45328f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341447.JPG", cAlternateFileName="")) returned 1
	[0055.331] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.331] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0341447.JPG") returned -1
	[0055.331] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0341447.JPG") returned -1
	[0055.331] lstrcmpiA (lpString1="", lpString2="J0341447.JPG") returned -1
	[0055.331] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG") returned="J0341439.JPG"
	[0055.331] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.331] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.331] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.331] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.331] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0341447.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG"
	[0055.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG", pszSpec="*.zip") returned 0
	[0055.331] lstrlenA (lpString="*.zip") returned 5
	[0055.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG", pszSpec="*.rar") returned 0
	[0055.331] lstrlenA (lpString="*.rar") returned 5
	[0055.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG", pszSpec="*.7z") returned 0
	[0055.331] lstrlenA (lpString="*.7z") returned 4
	[0055.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG", pszSpec="*.tar") returned 0
	[0055.331] lstrlenA (lpString="*.tar") returned 5
	[0055.332] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG", pszSpec="*.gzip") returned 0
	[0055.332] lstrlenA (lpString="*.gzip") returned 6
	[0055.332] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG", pszSpec="*.jpg") returned 1
	[0055.332] lstrlenA (lpString="*.jpg") returned 5
	[0055.332] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG"
	[0055.332] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG"
	[0055.332] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG."
	[0055.332] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG.exe"
	[0055.332] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341447.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.333] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ad8
	[0055.333] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf42d018, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf42d018, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8)) returned 1
	[0055.333] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.333] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x4a96, lpOverlapped=0x0) returned 1
	[0055.334] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG") returned="J0341447.JPG"
	[0055.334] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.334] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x4a96, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x4a96, lpOverlapped=0x0) returned 1
	[0055.334] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.335] CloseHandle (hObject=0x214) returned 1
	[0055.336] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341447.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341447.jpg.exe")) returned 1
	[0055.336] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45328f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf45328f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4794eb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x52c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341448.JPG", cAlternateFileName="")) returned 1
	[0055.336] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.336] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0341448.JPG") returned -1
	[0055.336] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0341448.JPG") returned -1
	[0055.336] lstrcmpiA (lpString1="", lpString2="J0341448.JPG") returned -1
	[0055.336] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG") returned="J0341447.JPG"
	[0055.336] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.336] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.336] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.336] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.336] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0341448.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG"
	[0055.337] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG", pszSpec="*.zip") returned 0
	[0055.337] lstrlenA (lpString="*.zip") returned 5
	[0055.337] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG", pszSpec="*.rar") returned 0
	[0055.337] lstrlenA (lpString="*.rar") returned 5
	[0055.337] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG", pszSpec="*.7z") returned 0
	[0055.337] lstrlenA (lpString="*.7z") returned 4
	[0055.337] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG", pszSpec="*.tar") returned 0
	[0055.337] lstrlenA (lpString="*.tar") returned 5
	[0055.337] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG", pszSpec="*.gzip") returned 0
	[0055.337] lstrlenA (lpString="*.gzip") returned 6
	[0055.337] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG", pszSpec="*.jpg") returned 1
	[0055.337] lstrlenA (lpString="*.jpg") returned 5
	[0055.337] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG"
	[0055.337] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG"
	[0055.337] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG."
	[0055.337] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG.exe"
	[0055.337] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341448.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.337] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x52c3
	[0055.337] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4794eb, dwHighDateTime=0x1d327e8)) returned 1
	[0055.337] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.337] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x5281, lpOverlapped=0x0) returned 1
	[0055.339] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG") returned="J0341448.JPG"
	[0055.339] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.339] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x5281, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x5281, lpOverlapped=0x0) returned 1
	[0055.339] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.339] CloseHandle (hObject=0x214) returned 1
	[0055.341] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341448.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341448.jpg.exe")) returned 1
	[0055.341] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45328f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf45328f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf45328f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7457, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341455.JPG", cAlternateFileName="")) returned 1
	[0055.341] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.341] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0341455.JPG") returned -1
	[0055.341] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0341455.JPG") returned -1
	[0055.341] lstrcmpiA (lpString1="", lpString2="J0341455.JPG") returned -1
	[0055.341] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG") returned="J0341448.JPG"
	[0055.341] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.341] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.341] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.341] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.341] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0341455.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG"
	[0055.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG", pszSpec="*.zip") returned 0
	[0055.341] lstrlenA (lpString="*.zip") returned 5
	[0055.342] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG", pszSpec="*.rar") returned 0
	[0055.342] lstrlenA (lpString="*.rar") returned 5
	[0055.342] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG", pszSpec="*.7z") returned 0
	[0055.342] lstrlenA (lpString="*.7z") returned 4
	[0055.342] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG", pszSpec="*.tar") returned 0
	[0055.342] lstrlenA (lpString="*.tar") returned 5
	[0055.342] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG", pszSpec="*.gzip") returned 0
	[0055.342] lstrlenA (lpString="*.gzip") returned 6
	[0055.342] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG", pszSpec="*.jpg") returned 1
	[0055.342] lstrlenA (lpString="*.jpg") returned 5
	[0055.342] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG"
	[0055.342] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG"
	[0055.342] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG."
	[0055.342] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG.exe"
	[0055.342] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341455.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.343] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7457
	[0055.343] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8)) returned 1
	[0055.343] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.343] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7415, lpOverlapped=0x0) returned 1
	[0055.344] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG") returned="J0341455.JPG"
	[0055.344] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.344] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7415, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7415, lpOverlapped=0x0) returned 1
	[0055.345] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.345] CloseHandle (hObject=0x214) returned 1
	[0055.346] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341455.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341455.jpg.exe")) returned 1
	[0055.346] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45328f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf45328f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf45328f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa9e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341475.JPG", cAlternateFileName="")) returned 1
	[0055.346] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.346] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0341475.JPG") returned -1
	[0055.346] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0341475.JPG") returned -1
	[0055.347] lstrcmpiA (lpString1="", lpString2="J0341475.JPG") returned -1
	[0055.347] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG") returned="J0341455.JPG"
	[0055.347] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.347] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.347] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.347] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.347] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0341475.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG"
	[0055.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG", pszSpec="*.zip") returned 0
	[0055.347] lstrlenA (lpString="*.zip") returned 5
	[0055.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG", pszSpec="*.rar") returned 0
	[0055.347] lstrlenA (lpString="*.rar") returned 5
	[0055.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG", pszSpec="*.7z") returned 0
	[0055.347] lstrlenA (lpString="*.7z") returned 4
	[0055.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG", pszSpec="*.tar") returned 0
	[0055.347] lstrlenA (lpString="*.tar") returned 5
	[0055.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG", pszSpec="*.gzip") returned 0
	[0055.347] lstrlenA (lpString="*.gzip") returned 6
	[0055.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG", pszSpec="*.jpg") returned 1
	[0055.347] lstrlenA (lpString="*.jpg") returned 5
	[0055.347] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG"
	[0055.347] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG"
	[0055.347] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG."
	[0055.347] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG.exe"
	[0055.347] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341475.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.347] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa9e2
	[0055.348] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8)) returned 1
	[0055.348] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.348] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xa9a0, lpOverlapped=0x0) returned 1
	[0055.350] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG") returned="J0341475.JPG"
	[0055.350] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.350] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xa9a0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xa9a0, lpOverlapped=0x0) returned 1
	[0055.350] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.350] CloseHandle (hObject=0x214) returned 1
	[0055.352] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341475.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341475.jpg.exe")) returned 1
	[0055.352] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45328f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf45328f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4794eb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3ee3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341499.JPG", cAlternateFileName="")) returned 1
	[0055.352] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.352] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0341499.JPG") returned -1
	[0055.352] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0341499.JPG") returned -1
	[0055.353] lstrcmpiA (lpString1="", lpString2="J0341499.JPG") returned -1
	[0055.353] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG") returned="J0341475.JPG"
	[0055.353] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.353] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.353] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.353] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.353] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0341499.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG"
	[0055.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG", pszSpec="*.zip") returned 0
	[0055.353] lstrlenA (lpString="*.zip") returned 5
	[0055.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG", pszSpec="*.rar") returned 0
	[0055.353] lstrlenA (lpString="*.rar") returned 5
	[0055.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG", pszSpec="*.7z") returned 0
	[0055.353] lstrlenA (lpString="*.7z") returned 4
	[0055.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG", pszSpec="*.tar") returned 0
	[0055.353] lstrlenA (lpString="*.tar") returned 5
	[0055.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG", pszSpec="*.gzip") returned 0
	[0055.353] lstrlenA (lpString="*.gzip") returned 6
	[0055.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG", pszSpec="*.jpg") returned 1
	[0055.353] lstrlenA (lpString="*.jpg") returned 5
	[0055.353] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG"
	[0055.353] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG"
	[0055.353] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG."
	[0055.353] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG.exe"
	[0055.353] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341499.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.354] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ee3
	[0055.354] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4794eb, dwHighDateTime=0x1d327e8)) returned 1
	[0055.354] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.354] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x3ea1, lpOverlapped=0x0) returned 1
	[0055.366] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG") returned="J0341499.JPG"
	[0055.366] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.366] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x3ea1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x3ea1, lpOverlapped=0x0) returned 1
	[0055.367] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.367] CloseHandle (hObject=0x214) returned 1
	[0055.368] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341499.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341499.jpg.exe")) returned 1
	[0055.368] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45328f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf45328f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf45328f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341534.JPG", cAlternateFileName="")) returned 1
	[0055.369] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.369] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0341534.JPG") returned -1
	[0055.369] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0341534.JPG") returned -1
	[0055.369] lstrcmpiA (lpString1="", lpString2="J0341534.JPG") returned -1
	[0055.369] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG") returned="J0341499.JPG"
	[0055.369] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.369] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.369] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.369] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.369] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0341534.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG"
	[0055.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG", pszSpec="*.zip") returned 0
	[0055.369] lstrlenA (lpString="*.zip") returned 5
	[0055.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG", pszSpec="*.rar") returned 0
	[0055.369] lstrlenA (lpString="*.rar") returned 5
	[0055.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG", pszSpec="*.7z") returned 0
	[0055.369] lstrlenA (lpString="*.7z") returned 4
	[0055.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG", pszSpec="*.tar") returned 0
	[0055.369] lstrlenA (lpString="*.tar") returned 5
	[0055.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG", pszSpec="*.gzip") returned 0
	[0055.369] lstrlenA (lpString="*.gzip") returned 6
	[0055.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG", pszSpec="*.jpg") returned 1
	[0055.369] lstrlenA (lpString="*.jpg") returned 5
	[0055.369] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG"
	[0055.369] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG"
	[0055.369] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG."
	[0055.369] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG.exe"
	[0055.370] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341534.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.370] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f8a
	[0055.370] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8)) returned 1
	[0055.370] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.371] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1f48, lpOverlapped=0x0) returned 1
	[0055.373] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG") returned="J0341534.JPG"
	[0055.373] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.373] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1f48, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1f48, lpOverlapped=0x0) returned 1
	[0055.373] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.373] CloseHandle (hObject=0x214) returned 1
	[0055.374] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341534.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341534.jpg.exe")) returned 1
	[0055.375] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45328f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf45328f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf45328f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5a56, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341551.JPG", cAlternateFileName="")) returned 1
	[0055.375] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.375] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0341551.JPG") returned -1
	[0055.375] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0341551.JPG") returned -1
	[0055.375] lstrcmpiA (lpString1="", lpString2="J0341551.JPG") returned -1
	[0055.375] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG") returned="J0341534.JPG"
	[0055.375] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.375] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.375] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.375] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.375] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0341551.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG"
	[0055.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG", pszSpec="*.zip") returned 0
	[0055.375] lstrlenA (lpString="*.zip") returned 5
	[0055.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG", pszSpec="*.rar") returned 0
	[0055.375] lstrlenA (lpString="*.rar") returned 5
	[0055.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG", pszSpec="*.7z") returned 0
	[0055.375] lstrlenA (lpString="*.7z") returned 4
	[0055.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG", pszSpec="*.tar") returned 0
	[0055.375] lstrlenA (lpString="*.tar") returned 5
	[0055.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG", pszSpec="*.gzip") returned 0
	[0055.375] lstrlenA (lpString="*.gzip") returned 6
	[0055.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG", pszSpec="*.jpg") returned 1
	[0055.376] lstrlenA (lpString="*.jpg") returned 5
	[0055.376] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG"
	[0055.376] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG"
	[0055.376] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG."
	[0055.376] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG.exe"
	[0055.376] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341551.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.376] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5a56
	[0055.376] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8)) returned 1
	[0055.376] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.376] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x5a14, lpOverlapped=0x0) returned 1
	[0055.378] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG") returned="J0341551.JPG"
	[0055.378] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.378] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x5a14, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x5a14, lpOverlapped=0x0) returned 1
	[0055.378] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.378] CloseHandle (hObject=0x214) returned 1
	[0055.379] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341551.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341551.jpg.exe")) returned 1
	[0055.380] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45328f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf45328f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf45328f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6f43, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341554.JPG", cAlternateFileName="")) returned 1
	[0055.380] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.380] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0341554.JPG") returned -1
	[0055.380] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0341554.JPG") returned -1
	[0055.380] lstrcmpiA (lpString1="", lpString2="J0341554.JPG") returned -1
	[0055.380] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG") returned="J0341551.JPG"
	[0055.380] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.380] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.380] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.380] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.380] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0341554.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG"
	[0055.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG", pszSpec="*.zip") returned 0
	[0055.380] lstrlenA (lpString="*.zip") returned 5
	[0055.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG", pszSpec="*.rar") returned 0
	[0055.380] lstrlenA (lpString="*.rar") returned 5
	[0055.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG", pszSpec="*.7z") returned 0
	[0055.381] lstrlenA (lpString="*.7z") returned 4
	[0055.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG", pszSpec="*.tar") returned 0
	[0055.381] lstrlenA (lpString="*.tar") returned 5
	[0055.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG", pszSpec="*.gzip") returned 0
	[0055.381] lstrlenA (lpString="*.gzip") returned 6
	[0055.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG", pszSpec="*.jpg") returned 1
	[0055.381] lstrlenA (lpString="*.jpg") returned 5
	[0055.381] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG"
	[0055.381] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG"
	[0055.381] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG."
	[0055.381] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG.exe"
	[0055.381] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341554.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.381] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6f43
	[0055.381] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8)) returned 1
	[0055.381] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.381] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x6f01, lpOverlapped=0x0) returned 1
	[0055.383] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG") returned="J0341554.JPG"
	[0055.383] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.383] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x6f01, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x6f01, lpOverlapped=0x0) returned 1
	[0055.383] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.383] CloseHandle (hObject=0x214) returned 1
	[0055.384] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341554.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341554.jpg.exe")) returned 1
	[0055.385] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45328f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf45328f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf45328f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341557.JPG", cAlternateFileName="")) returned 1
	[0055.385] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.385] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0341557.JPG") returned -1
	[0055.385] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0341557.JPG") returned -1
	[0055.385] lstrcmpiA (lpString1="", lpString2="J0341557.JPG") returned -1
	[0055.385] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG") returned="J0341554.JPG"
	[0055.385] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.385] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.385] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.385] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.385] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0341557.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG"
	[0055.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG", pszSpec="*.zip") returned 0
	[0055.385] lstrlenA (lpString="*.zip") returned 5
	[0055.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG", pszSpec="*.rar") returned 0
	[0055.386] lstrlenA (lpString="*.rar") returned 5
	[0055.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG", pszSpec="*.7z") returned 0
	[0055.386] lstrlenA (lpString="*.7z") returned 4
	[0055.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG", pszSpec="*.tar") returned 0
	[0055.386] lstrlenA (lpString="*.tar") returned 5
	[0055.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG", pszSpec="*.gzip") returned 0
	[0055.386] lstrlenA (lpString="*.gzip") returned 6
	[0055.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG", pszSpec="*.jpg") returned 1
	[0055.386] lstrlenA (lpString="*.jpg") returned 5
	[0055.386] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG"
	[0055.386] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG"
	[0055.386] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG."
	[0055.386] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG.exe"
	[0055.386] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341557.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.386] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6aa8
	[0055.386] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8)) returned 1
	[0055.386] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.386] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x6a66, lpOverlapped=0x0) returned 1
	[0055.388] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG") returned="J0341557.JPG"
	[0055.388] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.389] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x6a66, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x6a66, lpOverlapped=0x0) returned 1
	[0055.389] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.389] CloseHandle (hObject=0x214) returned 1
	[0055.390] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341557.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341557.jpg.exe")) returned 1
	[0055.391] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45328f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf45328f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf45328f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6873, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341559.JPG", cAlternateFileName="")) returned 1
	[0055.391] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.391] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0341559.JPG") returned -1
	[0055.391] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0341559.JPG") returned -1
	[0055.391] lstrcmpiA (lpString1="", lpString2="J0341559.JPG") returned -1
	[0055.391] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG") returned="J0341557.JPG"
	[0055.391] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.391] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.391] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.391] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.391] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0341559.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG"
	[0055.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG", pszSpec="*.zip") returned 0
	[0055.391] lstrlenA (lpString="*.zip") returned 5
	[0055.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG", pszSpec="*.rar") returned 0
	[0055.391] lstrlenA (lpString="*.rar") returned 5
	[0055.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG", pszSpec="*.7z") returned 0
	[0055.391] lstrlenA (lpString="*.7z") returned 4
	[0055.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG", pszSpec="*.tar") returned 0
	[0055.391] lstrlenA (lpString="*.tar") returned 5
	[0055.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG", pszSpec="*.gzip") returned 0
	[0055.392] lstrlenA (lpString="*.gzip") returned 6
	[0055.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG", pszSpec="*.jpg") returned 1
	[0055.392] lstrlenA (lpString="*.jpg") returned 5
	[0055.392] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG"
	[0055.392] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG"
	[0055.392] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG."
	[0055.392] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG.exe"
	[0055.392] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341559.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.392] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6873
	[0055.392] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8)) returned 1
	[0055.392] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.392] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x6831, lpOverlapped=0x0) returned 1
	[0055.394] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG") returned="J0341559.JPG"
	[0055.394] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.394] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x6831, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x6831, lpOverlapped=0x0) returned 1
	[0055.394] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.394] CloseHandle (hObject=0x214) returned 1
	[0055.395] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341559.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341559.jpg.exe")) returned 1
	[0055.396] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45328f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf45328f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf45328f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa497, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341561.JPG", cAlternateFileName="")) returned 1
	[0055.396] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.396] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0341561.JPG") returned -1
	[0055.396] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0341561.JPG") returned -1
	[0055.396] lstrcmpiA (lpString1="", lpString2="J0341561.JPG") returned -1
	[0055.396] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG") returned="J0341559.JPG"
	[0055.396] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.396] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.396] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.396] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.397] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0341561.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG"
	[0055.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG", pszSpec="*.zip") returned 0
	[0055.397] lstrlenA (lpString="*.zip") returned 5
	[0055.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG", pszSpec="*.rar") returned 0
	[0055.397] lstrlenA (lpString="*.rar") returned 5
	[0055.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG", pszSpec="*.7z") returned 0
	[0055.397] lstrlenA (lpString="*.7z") returned 4
	[0055.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG", pszSpec="*.tar") returned 0
	[0055.397] lstrlenA (lpString="*.tar") returned 5
	[0055.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG", pszSpec="*.gzip") returned 0
	[0055.397] lstrlenA (lpString="*.gzip") returned 6
	[0055.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG", pszSpec="*.jpg") returned 1
	[0055.397] lstrlenA (lpString="*.jpg") returned 5
	[0055.397] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG"
	[0055.397] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG"
	[0055.397] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG."
	[0055.397] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG.exe"
	[0055.397] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341561.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.397] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa497
	[0055.397] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf45328f, dwHighDateTime=0x1d327e8)) returned 1
	[0055.397] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.397] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xa455, lpOverlapped=0x0) returned 1
	[0055.399] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG") returned="J0341561.JPG"
	[0055.399] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.399] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xa455, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xa455, lpOverlapped=0x0) returned 1
	[0055.399] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.399] CloseHandle (hObject=0x214) returned 1
	[0055.401] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341561.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341561.jpg.exe")) returned 1
	[0055.456] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4794eb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf4794eb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4794eb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1e7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341634.JPG", cAlternateFileName="")) returned 1
	[0055.456] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.456] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0341634.JPG") returned -1
	[0055.456] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0341634.JPG") returned -1
	[0055.456] lstrcmpiA (lpString1="", lpString2="J0341634.JPG") returned -1
	[0055.456] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG") returned="J0341561.JPG"
	[0055.456] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.456] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.456] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.456] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.456] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0341634.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG"
	[0055.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG", pszSpec="*.zip") returned 0
	[0055.456] lstrlenA (lpString="*.zip") returned 5
	[0055.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG", pszSpec="*.rar") returned 0
	[0055.456] lstrlenA (lpString="*.rar") returned 5
	[0055.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG", pszSpec="*.7z") returned 0
	[0055.456] lstrlenA (lpString="*.7z") returned 4
	[0055.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG", pszSpec="*.tar") returned 0
	[0055.457] lstrlenA (lpString="*.tar") returned 5
	[0055.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG", pszSpec="*.gzip") returned 0
	[0055.457] lstrlenA (lpString="*.gzip") returned 6
	[0055.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG", pszSpec="*.jpg") returned 1
	[0055.457] lstrlenA (lpString="*.jpg") returned 5
	[0055.457] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG"
	[0055.457] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG"
	[0055.457] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG."
	[0055.457] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG.exe"
	[0055.457] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341634.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.458] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1e7b
	[0055.458] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf4794eb, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf4794eb, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4794eb, dwHighDateTime=0x1d327e8)) returned 1
	[0055.458] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.458] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1e39, lpOverlapped=0x0) returned 1
	[0055.459] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG") returned="J0341634.JPG"
	[0055.459] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.459] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1e39, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1e39, lpOverlapped=0x0) returned 1
	[0055.460] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.460] CloseHandle (hObject=0x214) returned 1
	[0055.461] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341634.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341634.jpg.exe")) returned 1
	[0055.461] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4794eb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf4794eb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4794eb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3615, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341636.JPG", cAlternateFileName="")) returned 1
	[0055.461] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.461] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0341636.JPG") returned -1
	[0055.461] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0341636.JPG") returned -1
	[0055.461] lstrcmpiA (lpString1="", lpString2="J0341636.JPG") returned -1
	[0055.461] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG") returned="J0341634.JPG"
	[0055.461] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.461] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.461] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.461] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.462] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0341636.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG"
	[0055.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG", pszSpec="*.zip") returned 0
	[0055.462] lstrlenA (lpString="*.zip") returned 5
	[0055.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG", pszSpec="*.rar") returned 0
	[0055.462] lstrlenA (lpString="*.rar") returned 5
	[0055.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG", pszSpec="*.7z") returned 0
	[0055.462] lstrlenA (lpString="*.7z") returned 4
	[0055.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG", pszSpec="*.tar") returned 0
	[0055.462] lstrlenA (lpString="*.tar") returned 5
	[0055.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG", pszSpec="*.gzip") returned 0
	[0055.462] lstrlenA (lpString="*.gzip") returned 6
	[0055.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG", pszSpec="*.jpg") returned 1
	[0055.462] lstrlenA (lpString="*.jpg") returned 5
	[0055.462] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG"
	[0055.462] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG"
	[0055.462] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG."
	[0055.462] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG.exe"
	[0055.462] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341636.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.462] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3615
	[0055.462] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf4794eb, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf4794eb, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4794eb, dwHighDateTime=0x1d327e8)) returned 1
	[0055.463] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.463] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x35d3, lpOverlapped=0x0) returned 1
	[0055.464] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG") returned="J0341636.JPG"
	[0055.464] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.464] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x35d3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x35d3, lpOverlapped=0x0) returned 1
	[0055.464] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.464] CloseHandle (hObject=0x214) returned 1
	[0055.466] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341636.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341636.jpg.exe")) returned 1
	[0055.467] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4794eb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf4794eb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4794eb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341645.JPG", cAlternateFileName="")) returned 1
	[0055.467] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.467] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0341645.JPG") returned -1
	[0055.467] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0341645.JPG") returned -1
	[0055.467] lstrcmpiA (lpString1="", lpString2="J0341645.JPG") returned -1
	[0055.467] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG") returned="J0341636.JPG"
	[0055.467] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.467] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.467] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.467] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.467] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0341645.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG"
	[0055.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG", pszSpec="*.zip") returned 0
	[0055.467] lstrlenA (lpString="*.zip") returned 5
	[0055.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG", pszSpec="*.rar") returned 0
	[0055.467] lstrlenA (lpString="*.rar") returned 5
	[0055.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG", pszSpec="*.7z") returned 0
	[0055.467] lstrlenA (lpString="*.7z") returned 4
	[0055.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG", pszSpec="*.tar") returned 0
	[0055.467] lstrlenA (lpString="*.tar") returned 5
	[0055.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG", pszSpec="*.gzip") returned 0
	[0055.467] lstrlenA (lpString="*.gzip") returned 6
	[0055.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG", pszSpec="*.jpg") returned 1
	[0055.468] lstrlenA (lpString="*.jpg") returned 5
	[0055.468] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG"
	[0055.468] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG"
	[0055.468] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG."
	[0055.468] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG.exe"
	[0055.468] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341645.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.468] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2026
	[0055.469] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf4794eb, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf4794eb, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4794eb, dwHighDateTime=0x1d327e8)) returned 1
	[0055.469] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.469] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1fe4, lpOverlapped=0x0) returned 1
	[0055.470] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG") returned="J0341645.JPG"
	[0055.470] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.470] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1fe4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1fe4, lpOverlapped=0x0) returned 1
	[0055.470] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.470] CloseHandle (hObject=0x214) returned 1
	[0055.471] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341645.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341645.jpg.exe")) returned 1
	[0055.472] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4794eb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf4794eb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4794eb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3df7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341653.JPG", cAlternateFileName="")) returned 1
	[0055.472] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.472] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0341653.JPG") returned -1
	[0055.472] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0341653.JPG") returned -1
	[0055.472] lstrcmpiA (lpString1="", lpString2="J0341653.JPG") returned -1
	[0055.472] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG") returned="J0341645.JPG"
	[0055.472] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.472] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.472] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.472] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.472] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0341653.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG"
	[0055.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG", pszSpec="*.zip") returned 0
	[0055.472] lstrlenA (lpString="*.zip") returned 5
	[0055.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG", pszSpec="*.rar") returned 0
	[0055.472] lstrlenA (lpString="*.rar") returned 5
	[0055.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG", pszSpec="*.7z") returned 0
	[0055.472] lstrlenA (lpString="*.7z") returned 4
	[0055.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG", pszSpec="*.tar") returned 0
	[0055.472] lstrlenA (lpString="*.tar") returned 5
	[0055.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG", pszSpec="*.gzip") returned 0
	[0055.472] lstrlenA (lpString="*.gzip") returned 6
	[0055.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG", pszSpec="*.jpg") returned 1
	[0055.473] lstrlenA (lpString="*.jpg") returned 5
	[0055.473] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG"
	[0055.473] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG"
	[0055.473] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG."
	[0055.473] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG.exe"
	[0055.473] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341653.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.473] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3df7
	[0055.473] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf4794eb, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf4794eb, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4794eb, dwHighDateTime=0x1d327e8)) returned 1
	[0055.473] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.473] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x3db5, lpOverlapped=0x0) returned 1
	[0055.475] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG") returned="J0341653.JPG"
	[0055.475] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.475] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x3db5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x3db5, lpOverlapped=0x0) returned 1
	[0055.475] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.475] CloseHandle (hObject=0x214) returned 1
	[0055.476] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341653.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341653.jpg.exe")) returned 1
	[0055.477] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4794eb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf4794eb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4794eb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3d7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341654.JPG", cAlternateFileName="")) returned 1
	[0055.477] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.477] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0341654.JPG") returned -1
	[0055.477] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0341654.JPG") returned -1
	[0055.477] lstrcmpiA (lpString1="", lpString2="J0341654.JPG") returned -1
	[0055.477] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG") returned="J0341653.JPG"
	[0055.477] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.477] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.477] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.477] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.477] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0341654.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG"
	[0055.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG", pszSpec="*.zip") returned 0
	[0055.477] lstrlenA (lpString="*.zip") returned 5
	[0055.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG", pszSpec="*.rar") returned 0
	[0055.477] lstrlenA (lpString="*.rar") returned 5
	[0055.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG", pszSpec="*.7z") returned 0
	[0055.477] lstrlenA (lpString="*.7z") returned 4
	[0055.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG", pszSpec="*.tar") returned 0
	[0055.477] lstrlenA (lpString="*.tar") returned 5
	[0055.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG", pszSpec="*.gzip") returned 0
	[0055.477] lstrlenA (lpString="*.gzip") returned 6
	[0055.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG", pszSpec="*.jpg") returned 1
	[0055.477] lstrlenA (lpString="*.jpg") returned 5
	[0055.477] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG"
	[0055.478] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG"
	[0055.478] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG."
	[0055.478] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG.exe"
	[0055.478] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341654.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.478] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d7f
	[0055.478] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf4794eb, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf4794eb, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4794eb, dwHighDateTime=0x1d327e8)) returned 1
	[0055.478] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.479] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x3d3d, lpOverlapped=0x0) returned 1
	[0055.481] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG") returned="J0341654.JPG"
	[0055.481] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.481] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x3d3d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x3d3d, lpOverlapped=0x0) returned 1
	[0055.482] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.482] CloseHandle (hObject=0x214) returned 1
	[0055.483] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341654.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341654.jpg.exe")) returned 1
	[0055.484] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4794eb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf4794eb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4794eb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4ec6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341738.JPG", cAlternateFileName="")) returned 1
	[0055.484] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.484] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0341738.JPG") returned -1
	[0055.484] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0341738.JPG") returned -1
	[0055.484] lstrcmpiA (lpString1="", lpString2="J0341738.JPG") returned -1
	[0055.484] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG") returned="J0341654.JPG"
	[0055.484] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.484] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.484] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.484] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.484] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0341738.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG"
	[0055.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG", pszSpec="*.zip") returned 0
	[0055.484] lstrlenA (lpString="*.zip") returned 5
	[0055.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG", pszSpec="*.rar") returned 0
	[0055.484] lstrlenA (lpString="*.rar") returned 5
	[0055.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG", pszSpec="*.7z") returned 0
	[0055.484] lstrlenA (lpString="*.7z") returned 4
	[0055.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG", pszSpec="*.tar") returned 0
	[0055.484] lstrlenA (lpString="*.tar") returned 5
	[0055.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG", pszSpec="*.gzip") returned 0
	[0055.484] lstrlenA (lpString="*.gzip") returned 6
	[0055.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG", pszSpec="*.jpg") returned 1
	[0055.484] lstrlenA (lpString="*.jpg") returned 5
	[0055.485] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG"
	[0055.485] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG"
	[0055.485] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG."
	[0055.485] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG.exe"
	[0055.485] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341738.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.485] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ec6
	[0055.485] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf4794eb, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf4794eb, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4794eb, dwHighDateTime=0x1d327e8)) returned 1
	[0055.485] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.485] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x4e84, lpOverlapped=0x0) returned 1
	[0055.487] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG") returned="J0341738.JPG"
	[0055.487] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.487] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x4e84, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x4e84, lpOverlapped=0x0) returned 1
	[0055.487] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.487] CloseHandle (hObject=0x214) returned 1
	[0055.488] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341738.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341738.jpg.exe")) returned 1
	[0055.489] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4794eb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf4794eb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4794eb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x49ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341742.JPG", cAlternateFileName="")) returned 1
	[0055.489] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.489] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0341742.JPG") returned -1
	[0055.489] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0341742.JPG") returned -1
	[0055.489] lstrcmpiA (lpString1="", lpString2="J0341742.JPG") returned -1
	[0055.489] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG") returned="J0341738.JPG"
	[0055.489] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.489] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.489] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.489] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.489] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0341742.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG"
	[0055.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG", pszSpec="*.zip") returned 0
	[0055.489] lstrlenA (lpString="*.zip") returned 5
	[0055.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG", pszSpec="*.rar") returned 0
	[0055.489] lstrlenA (lpString="*.rar") returned 5
	[0055.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG", pszSpec="*.7z") returned 0
	[0055.489] lstrlenA (lpString="*.7z") returned 4
	[0055.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG", pszSpec="*.tar") returned 0
	[0055.489] lstrlenA (lpString="*.tar") returned 5
	[0055.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG", pszSpec="*.gzip") returned 0
	[0055.489] lstrlenA (lpString="*.gzip") returned 6
	[0055.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG", pszSpec="*.jpg") returned 1
	[0055.489] lstrlenA (lpString="*.jpg") returned 5
	[0055.489] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG"
	[0055.489] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG"
	[0055.489] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG."
	[0055.490] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG.exe"
	[0055.490] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341742.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.490] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x49ba
	[0055.490] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf4794eb, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf4794eb, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4794eb, dwHighDateTime=0x1d327e8)) returned 1
	[0055.490] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.490] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x4978, lpOverlapped=0x0) returned 1
	[0055.491] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG") returned="J0341742.JPG"
	[0055.492] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.492] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x4978, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x4978, lpOverlapped=0x0) returned 1
	[0055.492] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.492] CloseHandle (hObject=0x214) returned 1
	[0055.493] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341742.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341742.jpg.exe")) returned 1
	[0055.494] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4794eb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf4794eb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4794eb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10bdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382836.JPG", cAlternateFileName="")) returned 1
	[0055.494] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.494] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0382836.JPG") returned -1
	[0055.494] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0382836.JPG") returned -1
	[0055.494] lstrcmpiA (lpString1="", lpString2="J0382836.JPG") returned -1
	[0055.494] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG") returned="J0341742.JPG"
	[0055.494] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.494] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.494] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.494] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.494] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0382836.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG"
	[0055.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG", pszSpec="*.zip") returned 0
	[0055.494] lstrlenA (lpString="*.zip") returned 5
	[0055.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG", pszSpec="*.rar") returned 0
	[0055.494] lstrlenA (lpString="*.rar") returned 5
	[0055.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG", pszSpec="*.7z") returned 0
	[0055.494] lstrlenA (lpString="*.7z") returned 4
	[0055.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG", pszSpec="*.tar") returned 0
	[0055.494] lstrlenA (lpString="*.tar") returned 5
	[0055.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG", pszSpec="*.gzip") returned 0
	[0055.494] lstrlenA (lpString="*.gzip") returned 6
	[0055.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG", pszSpec="*.jpg") returned 1
	[0055.495] lstrlenA (lpString="*.jpg") returned 5
	[0055.495] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG"
	[0055.495] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG"
	[0055.495] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG."
	[0055.495] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG.exe"
	[0055.495] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382836.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.495] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10bdc
	[0055.495] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf4794eb, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf4794eb, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4794eb, dwHighDateTime=0x1d327e8)) returned 1
	[0055.495] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.495] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x10b9a, lpOverlapped=0x0) returned 1
	[0055.547] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG") returned="J0382836.JPG"
	[0055.547] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.547] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x10b9a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x10b9a, lpOverlapped=0x0) returned 1
	[0055.547] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.547] CloseHandle (hObject=0x214) returned 1
	[0055.550] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382836.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382836.jpg.exe")) returned 1
	[0055.550] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4794eb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf4794eb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4794eb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1ce5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382925.JPG", cAlternateFileName="")) returned 1
	[0055.550] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.550] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0382925.JPG") returned -1
	[0055.550] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0382925.JPG") returned -1
	[0055.551] lstrcmpiA (lpString1="", lpString2="J0382925.JPG") returned -1
	[0055.551] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG") returned="J0382836.JPG"
	[0055.551] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.551] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.551] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.551] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.551] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0382925.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG"
	[0055.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG", pszSpec="*.zip") returned 0
	[0055.551] lstrlenA (lpString="*.zip") returned 5
	[0055.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG", pszSpec="*.rar") returned 0
	[0055.551] lstrlenA (lpString="*.rar") returned 5
	[0055.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG", pszSpec="*.7z") returned 0
	[0055.551] lstrlenA (lpString="*.7z") returned 4
	[0055.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG", pszSpec="*.tar") returned 0
	[0055.551] lstrlenA (lpString="*.tar") returned 5
	[0055.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG", pszSpec="*.gzip") returned 0
	[0055.551] lstrlenA (lpString="*.gzip") returned 6
	[0055.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG", pszSpec="*.jpg") returned 1
	[0055.551] lstrlenA (lpString="*.jpg") returned 5
	[0055.551] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG"
	[0055.551] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG"
	[0055.551] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG."
	[0055.551] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG.exe"
	[0055.551] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382925.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.552] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ce5a
	[0055.552] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf4794eb, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf4794eb, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4794eb, dwHighDateTime=0x1d327e8)) returned 1
	[0055.552] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.552] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1ce18, lpOverlapped=0x0) returned 1
	[0055.560] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG") returned="J0382925.JPG"
	[0055.560] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.560] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1ce18, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1ce18, lpOverlapped=0x0) returned 1
	[0055.561] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.561] CloseHandle (hObject=0x214) returned 1
	[0055.563] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382925.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382925.jpg.exe")) returned 1
	[0055.564] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4794eb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf4794eb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4794eb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1672c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382926.JPG", cAlternateFileName="")) returned 1
	[0055.564] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.564] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0382926.JPG") returned -1
	[0055.564] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0382926.JPG") returned -1
	[0055.564] lstrcmpiA (lpString1="", lpString2="J0382926.JPG") returned -1
	[0055.564] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG") returned="J0382925.JPG"
	[0055.564] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.564] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.564] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.564] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.564] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0382926.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG"
	[0055.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG", pszSpec="*.zip") returned 0
	[0055.564] lstrlenA (lpString="*.zip") returned 5
	[0055.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG", pszSpec="*.rar") returned 0
	[0055.565] lstrlenA (lpString="*.rar") returned 5
	[0055.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG", pszSpec="*.7z") returned 0
	[0055.565] lstrlenA (lpString="*.7z") returned 4
	[0055.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG", pszSpec="*.tar") returned 0
	[0055.565] lstrlenA (lpString="*.tar") returned 5
	[0055.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG", pszSpec="*.gzip") returned 0
	[0055.565] lstrlenA (lpString="*.gzip") returned 6
	[0055.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG", pszSpec="*.jpg") returned 1
	[0055.565] lstrlenA (lpString="*.jpg") returned 5
	[0055.565] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG"
	[0055.565] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG"
	[0055.565] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG."
	[0055.565] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG.exe"
	[0055.565] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382926.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.565] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1672c
	[0055.565] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf4794eb, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf4794eb, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4794eb, dwHighDateTime=0x1d327e8)) returned 1
	[0055.565] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.565] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x166ea, lpOverlapped=0x0) returned 1
	[0055.567] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG") returned="J0382926.JPG"
	[0055.568] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.568] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x166ea, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x166ea, lpOverlapped=0x0) returned 1
	[0055.568] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.568] CloseHandle (hObject=0x214) returned 1
	[0055.571] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382926.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382926.jpg.exe")) returned 1
	[0055.571] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf49f727, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf49f727, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4c596d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f86c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382927.JPG", cAlternateFileName="")) returned 1
	[0055.571] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.571] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0382927.JPG") returned -1
	[0055.571] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0382927.JPG") returned -1
	[0055.571] lstrcmpiA (lpString1="", lpString2="J0382927.JPG") returned -1
	[0055.571] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG") returned="J0382926.JPG"
	[0055.571] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.571] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.571] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.572] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.572] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0382927.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG"
	[0055.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG", pszSpec="*.zip") returned 0
	[0055.572] lstrlenA (lpString="*.zip") returned 5
	[0055.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG", pszSpec="*.rar") returned 0
	[0055.572] lstrlenA (lpString="*.rar") returned 5
	[0055.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG", pszSpec="*.7z") returned 0
	[0055.572] lstrlenA (lpString="*.7z") returned 4
	[0055.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG", pszSpec="*.tar") returned 0
	[0055.572] lstrlenA (lpString="*.tar") returned 5
	[0055.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG", pszSpec="*.gzip") returned 0
	[0055.572] lstrlenA (lpString="*.gzip") returned 6
	[0055.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG", pszSpec="*.jpg") returned 1
	[0055.572] lstrlenA (lpString="*.jpg") returned 5
	[0055.572] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG"
	[0055.572] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG"
	[0055.572] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG."
	[0055.572] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG.exe"
	[0055.572] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382927.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.573] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f86c
	[0055.573] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf49f727, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf49f727, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4c596d, dwHighDateTime=0x1d327e8)) returned 1
	[0055.573] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.573] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1f82a, lpOverlapped=0x0) returned 1
	[0055.576] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG") returned="J0382927.JPG"
	[0055.577] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.577] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1f82a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1f82a, lpOverlapped=0x0) returned 1
	[0055.577] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.577] CloseHandle (hObject=0x214) returned 1
	[0055.582] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382927.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382927.jpg.exe")) returned 1
	[0055.582] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4c596d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf4c596d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4c596d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1b83a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382930.JPG", cAlternateFileName="")) returned 1
	[0055.582] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.582] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0382930.JPG") returned -1
	[0055.582] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0382930.JPG") returned -1
	[0055.582] lstrcmpiA (lpString1="", lpString2="J0382930.JPG") returned -1
	[0055.582] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG") returned="J0382927.JPG"
	[0055.582] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.582] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.582] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.583] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.583] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0382930.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG"
	[0055.583] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG", pszSpec="*.zip") returned 0
	[0055.583] lstrlenA (lpString="*.zip") returned 5
	[0055.583] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG", pszSpec="*.rar") returned 0
	[0055.583] lstrlenA (lpString="*.rar") returned 5
	[0055.583] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG", pszSpec="*.7z") returned 0
	[0055.583] lstrlenA (lpString="*.7z") returned 4
	[0055.583] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG", pszSpec="*.tar") returned 0
	[0055.583] lstrlenA (lpString="*.tar") returned 5
	[0055.583] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG", pszSpec="*.gzip") returned 0
	[0055.583] lstrlenA (lpString="*.gzip") returned 6
	[0055.583] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG", pszSpec="*.jpg") returned 1
	[0055.583] lstrlenA (lpString="*.jpg") returned 5
	[0055.583] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG"
	[0055.583] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG"
	[0055.583] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG."
	[0055.583] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG.exe"
	[0055.583] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382930.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.586] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b83a
	[0055.586] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf4c596d, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf4c596d, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4c596d, dwHighDateTime=0x1d327e8)) returned 1
	[0055.586] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.587] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1b7f8, lpOverlapped=0x0) returned 1
	[0055.608] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG") returned="J0382930.JPG"
	[0055.609] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.609] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1b7f8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1b7f8, lpOverlapped=0x0) returned 1
	[0055.609] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.609] CloseHandle (hObject=0x214) returned 1
	[0055.612] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382930.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382930.jpg.exe")) returned 1
	[0055.613] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4c596d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf4c596d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4c596d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1df43, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382931.JPG", cAlternateFileName="")) returned 1
	[0055.613] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.613] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0382931.JPG") returned -1
	[0055.613] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0382931.JPG") returned -1
	[0055.613] lstrcmpiA (lpString1="", lpString2="J0382931.JPG") returned -1
	[0055.613] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG") returned="J0382930.JPG"
	[0055.613] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.613] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.613] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.613] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.613] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0382931.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG"
	[0055.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG", pszSpec="*.zip") returned 0
	[0055.613] lstrlenA (lpString="*.zip") returned 5
	[0055.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG", pszSpec="*.rar") returned 0
	[0055.613] lstrlenA (lpString="*.rar") returned 5
	[0055.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG", pszSpec="*.7z") returned 0
	[0055.613] lstrlenA (lpString="*.7z") returned 4
	[0055.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG", pszSpec="*.tar") returned 0
	[0055.613] lstrlenA (lpString="*.tar") returned 5
	[0055.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG", pszSpec="*.gzip") returned 0
	[0055.613] lstrlenA (lpString="*.gzip") returned 6
	[0055.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG", pszSpec="*.jpg") returned 1
	[0055.613] lstrlenA (lpString="*.jpg") returned 5
	[0055.613] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG"
	[0055.614] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG"
	[0055.614] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG."
	[0055.614] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG.exe"
	[0055.614] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382931.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.615] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1df43
	[0055.615] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf4c596d, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf4c596d, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4c596d, dwHighDateTime=0x1d327e8)) returned 1
	[0055.615] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.615] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1df01, lpOverlapped=0x0) returned 1
	[0055.617] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG") returned="J0382931.JPG"
	[0055.617] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.617] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1df01, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1df01, lpOverlapped=0x0) returned 1
	[0055.618] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.618] CloseHandle (hObject=0x214) returned 1
	[0055.621] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382931.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382931.jpg.exe")) returned 1
	[0055.621] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5aa7bb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5aa7bb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5aa7bb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x184d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382938.JPG", cAlternateFileName="")) returned 1
	[0055.621] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.621] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0382938.JPG") returned -1
	[0055.621] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0382938.JPG") returned -1
	[0055.621] lstrcmpiA (lpString1="", lpString2="J0382938.JPG") returned -1
	[0055.622] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG") returned="J0382931.JPG"
	[0055.622] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.622] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.622] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.622] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.622] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0382938.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG"
	[0055.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG", pszSpec="*.zip") returned 0
	[0055.622] lstrlenA (lpString="*.zip") returned 5
	[0055.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG", pszSpec="*.rar") returned 0
	[0055.622] lstrlenA (lpString="*.rar") returned 5
	[0055.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG", pszSpec="*.7z") returned 0
	[0055.622] lstrlenA (lpString="*.7z") returned 4
	[0055.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG", pszSpec="*.tar") returned 0
	[0055.622] lstrlenA (lpString="*.tar") returned 5
	[0055.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG", pszSpec="*.gzip") returned 0
	[0055.622] lstrlenA (lpString="*.gzip") returned 6
	[0055.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG", pszSpec="*.jpg") returned 1
	[0055.622] lstrlenA (lpString="*.jpg") returned 5
	[0055.622] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG"
	[0055.622] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG"
	[0055.622] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG."
	[0055.623] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG.exe"
	[0055.623] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382938.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.631] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x184d3
	[0055.631] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf5aa7bb, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf5aa7bb, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf5aa7bb, dwHighDateTime=0x1d327e8)) returned 1
	[0055.631] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.631] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x18491, lpOverlapped=0x0) returned 1
	[0055.634] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG") returned="J0382938.JPG"
	[0055.634] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.634] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x18491, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x18491, lpOverlapped=0x0) returned 1
	[0055.634] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.635] CloseHandle (hObject=0x214) returned 1
	[0055.637] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382938.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382938.jpg.exe")) returned 1
	[0055.638] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4c596d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf4c596d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4c596d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1aba5, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382939.JPG", cAlternateFileName="")) returned 1
	[0055.638] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.638] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0382939.JPG") returned -1
	[0055.638] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0382939.JPG") returned -1
	[0055.638] lstrcmpiA (lpString1="", lpString2="J0382939.JPG") returned -1
	[0055.638] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG") returned="J0382938.JPG"
	[0055.638] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.638] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.638] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.638] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.638] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0382939.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG"
	[0055.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG", pszSpec="*.zip") returned 0
	[0055.638] lstrlenA (lpString="*.zip") returned 5
	[0055.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG", pszSpec="*.rar") returned 0
	[0055.638] lstrlenA (lpString="*.rar") returned 5
	[0055.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG", pszSpec="*.7z") returned 0
	[0055.638] lstrlenA (lpString="*.7z") returned 4
	[0055.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG", pszSpec="*.tar") returned 0
	[0055.638] lstrlenA (lpString="*.tar") returned 5
	[0055.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG", pszSpec="*.gzip") returned 0
	[0055.639] lstrlenA (lpString="*.gzip") returned 6
	[0055.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG", pszSpec="*.jpg") returned 1
	[0055.639] lstrlenA (lpString="*.jpg") returned 5
	[0055.639] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG"
	[0055.639] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG"
	[0055.639] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG."
	[0055.639] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG.exe"
	[0055.639] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382939.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.640] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1aba5
	[0055.640] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf4c596d, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf4c596d, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4c596d, dwHighDateTime=0x1d327e8)) returned 1
	[0055.640] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.640] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1ab63, lpOverlapped=0x0) returned 1
	[0055.641] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG") returned="J0382939.JPG"
	[0055.642] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.642] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1ab63, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1ab63, lpOverlapped=0x0) returned 1
	[0055.642] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.642] CloseHandle (hObject=0x214) returned 1
	[0055.645] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382939.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382939.jpg.exe")) returned 1
	[0055.646] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4c596d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf4c596d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4c596d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1653a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382942.JPG", cAlternateFileName="")) returned 1
	[0055.646] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.646] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0382942.JPG") returned -1
	[0055.646] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0382942.JPG") returned -1
	[0055.646] lstrcmpiA (lpString1="", lpString2="J0382942.JPG") returned -1
	[0055.646] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG") returned="J0382939.JPG"
	[0055.646] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.646] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.646] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.646] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.646] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0382942.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG"
	[0055.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG", pszSpec="*.zip") returned 0
	[0055.646] lstrlenA (lpString="*.zip") returned 5
	[0055.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG", pszSpec="*.rar") returned 0
	[0055.646] lstrlenA (lpString="*.rar") returned 5
	[0055.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG", pszSpec="*.7z") returned 0
	[0055.646] lstrlenA (lpString="*.7z") returned 4
	[0055.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG", pszSpec="*.tar") returned 0
	[0055.646] lstrlenA (lpString="*.tar") returned 5
	[0055.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG", pszSpec="*.gzip") returned 0
	[0055.646] lstrlenA (lpString="*.gzip") returned 6
	[0055.647] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG", pszSpec="*.jpg") returned 1
	[0055.647] lstrlenA (lpString="*.jpg") returned 5
	[0055.647] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG"
	[0055.647] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG"
	[0055.647] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG."
	[0055.647] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG.exe"
	[0055.647] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382942.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.672] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1653a
	[0055.672] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf4c596d, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf4c596d, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4c596d, dwHighDateTime=0x1d327e8)) returned 1
	[0055.672] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.672] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x164f8, lpOverlapped=0x0) returned 1
	[0055.674] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG") returned="J0382942.JPG"
	[0055.675] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.675] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x164f8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x164f8, lpOverlapped=0x0) returned 1
	[0055.675] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.675] CloseHandle (hObject=0x214) returned 1
	[0055.678] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382942.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382942.jpg.exe")) returned 1
	[0055.679] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf49f727, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf49f727, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4c596d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13e1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382944.JPG", cAlternateFileName="")) returned 1
	[0055.679] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.679] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0382944.JPG") returned -1
	[0055.679] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0382944.JPG") returned -1
	[0055.679] lstrcmpiA (lpString1="", lpString2="J0382944.JPG") returned -1
	[0055.680] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG") returned="J0382942.JPG"
	[0055.680] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.680] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.680] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.680] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.680] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0382944.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG"
	[0055.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG", pszSpec="*.zip") returned 0
	[0055.680] lstrlenA (lpString="*.zip") returned 5
	[0055.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG", pszSpec="*.rar") returned 0
	[0055.680] lstrlenA (lpString="*.rar") returned 5
	[0055.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG", pszSpec="*.7z") returned 0
	[0055.680] lstrlenA (lpString="*.7z") returned 4
	[0055.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG", pszSpec="*.tar") returned 0
	[0055.680] lstrlenA (lpString="*.tar") returned 5
	[0055.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG", pszSpec="*.gzip") returned 0
	[0055.680] lstrlenA (lpString="*.gzip") returned 6
	[0055.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG", pszSpec="*.jpg") returned 1
	[0055.680] lstrlenA (lpString="*.jpg") returned 5
	[0055.680] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG"
	[0055.680] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG"
	[0055.680] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG."
	[0055.681] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG.exe"
	[0055.681] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382944.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.681] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13e1d
	[0055.681] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf49f727, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf49f727, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4c596d, dwHighDateTime=0x1d327e8)) returned 1
	[0055.681] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.681] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x13ddb, lpOverlapped=0x0) returned 1
	[0055.684] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG") returned="J0382944.JPG"
	[0055.684] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.684] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x13ddb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x13ddb, lpOverlapped=0x0) returned 1
	[0055.685] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.685] CloseHandle (hObject=0x214) returned 1
	[0055.687] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382944.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382944.jpg.exe")) returned 1
	[0055.688] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4c596d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf4c596d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4c596d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1531c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382947.JPG", cAlternateFileName="")) returned 1
	[0055.688] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.688] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0382947.JPG") returned -1
	[0055.688] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0382947.JPG") returned -1
	[0055.688] lstrcmpiA (lpString1="", lpString2="J0382947.JPG") returned -1
	[0055.688] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG") returned="J0382944.JPG"
	[0055.688] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.688] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.688] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.688] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.689] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0382947.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG"
	[0055.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG", pszSpec="*.zip") returned 0
	[0055.689] lstrlenA (lpString="*.zip") returned 5
	[0055.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG", pszSpec="*.rar") returned 0
	[0055.689] lstrlenA (lpString="*.rar") returned 5
	[0055.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG", pszSpec="*.7z") returned 0
	[0055.689] lstrlenA (lpString="*.7z") returned 4
	[0055.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG", pszSpec="*.tar") returned 0
	[0055.689] lstrlenA (lpString="*.tar") returned 5
	[0055.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG", pszSpec="*.gzip") returned 0
	[0055.689] lstrlenA (lpString="*.gzip") returned 6
	[0055.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG", pszSpec="*.jpg") returned 1
	[0055.689] lstrlenA (lpString="*.jpg") returned 5
	[0055.689] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG"
	[0055.689] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG"
	[0055.689] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG."
	[0055.689] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG.exe"
	[0055.689] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382947.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.689] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1531c
	[0055.689] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf4c596d, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf4c596d, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4c596d, dwHighDateTime=0x1d327e8)) returned 1
	[0055.689] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.689] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x152da, lpOverlapped=0x0) returned 1
	[0055.692] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG") returned="J0382947.JPG"
	[0055.692] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.692] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x152da, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x152da, lpOverlapped=0x0) returned 1
	[0055.692] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.692] CloseHandle (hObject=0x214) returned 1
	[0055.695] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382947.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382947.jpg.exe")) returned 1
	[0055.696] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4c596d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf4c596d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4c596d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1ad37, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382948.JPG", cAlternateFileName="")) returned 1
	[0055.696] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.696] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0382948.JPG") returned -1
	[0055.696] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0382948.JPG") returned -1
	[0055.696] lstrcmpiA (lpString1="", lpString2="J0382948.JPG") returned -1
	[0055.696] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG") returned="J0382947.JPG"
	[0055.696] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.696] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.696] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.696] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.696] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0382948.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG"
	[0055.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG", pszSpec="*.zip") returned 0
	[0055.696] lstrlenA (lpString="*.zip") returned 5
	[0055.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG", pszSpec="*.rar") returned 0
	[0055.696] lstrlenA (lpString="*.rar") returned 5
	[0055.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG", pszSpec="*.7z") returned 0
	[0055.696] lstrlenA (lpString="*.7z") returned 4
	[0055.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG", pszSpec="*.tar") returned 0
	[0055.696] lstrlenA (lpString="*.tar") returned 5
	[0055.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG", pszSpec="*.gzip") returned 0
	[0055.696] lstrlenA (lpString="*.gzip") returned 6
	[0055.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG", pszSpec="*.jpg") returned 1
	[0055.696] lstrlenA (lpString="*.jpg") returned 5
	[0055.696] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG"
	[0055.697] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG"
	[0055.697] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG."
	[0055.697] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG.exe"
	[0055.697] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382948.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.697] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ad37
	[0055.697] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf4c596d, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf4c596d, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4c596d, dwHighDateTime=0x1d327e8)) returned 1
	[0055.697] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.697] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1acf5, lpOverlapped=0x0) returned 1
	[0055.700] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG") returned="J0382948.JPG"
	[0055.701] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.701] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1acf5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1acf5, lpOverlapped=0x0) returned 1
	[0055.701] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.701] CloseHandle (hObject=0x214) returned 1
	[0055.704] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382948.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382948.jpg.exe")) returned 1
	[0055.704] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4c596d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf4c596d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4c596d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x178d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382950.JPG", cAlternateFileName="")) returned 1
	[0055.705] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.705] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0382950.JPG") returned -1
	[0055.705] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0382950.JPG") returned -1
	[0055.705] lstrcmpiA (lpString1="", lpString2="J0382950.JPG") returned -1
	[0055.705] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG") returned="J0382948.JPG"
	[0055.705] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.705] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.705] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.705] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.705] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0382950.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG"
	[0055.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG", pszSpec="*.zip") returned 0
	[0055.705] lstrlenA (lpString="*.zip") returned 5
	[0055.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG", pszSpec="*.rar") returned 0
	[0055.705] lstrlenA (lpString="*.rar") returned 5
	[0055.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG", pszSpec="*.7z") returned 0
	[0055.705] lstrlenA (lpString="*.7z") returned 4
	[0055.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG", pszSpec="*.tar") returned 0
	[0055.705] lstrlenA (lpString="*.tar") returned 5
	[0055.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG", pszSpec="*.gzip") returned 0
	[0055.705] lstrlenA (lpString="*.gzip") returned 6
	[0055.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG", pszSpec="*.jpg") returned 1
	[0055.705] lstrlenA (lpString="*.jpg") returned 5
	[0055.705] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG"
	[0055.705] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG"
	[0055.705] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG."
	[0055.705] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG.exe"
	[0055.706] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382950.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.706] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x178d2
	[0055.706] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf4c596d, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf4c596d, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4c596d, dwHighDateTime=0x1d327e8)) returned 1
	[0055.706] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.706] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x17890, lpOverlapped=0x0) returned 1
	[0055.733] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG") returned="J0382950.JPG"
	[0055.734] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.734] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x17890, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x17890, lpOverlapped=0x0) returned 1
	[0055.734] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.734] CloseHandle (hObject=0x214) returned 1
	[0055.738] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382950.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382950.jpg.exe")) returned 1
	[0055.738] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4c596d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf4c596d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4c596d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17749, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382952.JPG", cAlternateFileName="")) returned 1
	[0055.738] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.738] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0382952.JPG") returned -1
	[0055.738] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0382952.JPG") returned -1
	[0055.738] lstrcmpiA (lpString1="", lpString2="J0382952.JPG") returned -1
	[0055.738] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG") returned="J0382950.JPG"
	[0055.739] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.739] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.739] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.739] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.739] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0382952.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG"
	[0055.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG", pszSpec="*.zip") returned 0
	[0055.739] lstrlenA (lpString="*.zip") returned 5
	[0055.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG", pszSpec="*.rar") returned 0
	[0055.739] lstrlenA (lpString="*.rar") returned 5
	[0055.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG", pszSpec="*.7z") returned 0
	[0055.739] lstrlenA (lpString="*.7z") returned 4
	[0055.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG", pszSpec="*.tar") returned 0
	[0055.739] lstrlenA (lpString="*.tar") returned 5
	[0055.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG", pszSpec="*.gzip") returned 0
	[0055.739] lstrlenA (lpString="*.gzip") returned 6
	[0055.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG", pszSpec="*.jpg") returned 1
	[0055.739] lstrlenA (lpString="*.jpg") returned 5
	[0055.739] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG"
	[0055.739] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG"
	[0055.739] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG."
	[0055.739] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG.exe"
	[0055.739] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382952.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.739] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17749
	[0055.740] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf4c596d, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf4c596d, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4c596d, dwHighDateTime=0x1d327e8)) returned 1
	[0055.740] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.740] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x17707, lpOverlapped=0x0) returned 1
	[0055.741] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG") returned="J0382952.JPG"
	[0055.742] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.742] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x17707, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x17707, lpOverlapped=0x0) returned 1
	[0055.742] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.742] CloseHandle (hObject=0x214) returned 1
	[0055.745] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382952.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382952.jpg.exe")) returned 1
	[0055.746] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x110c9494, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x110c9494, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x110ef705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x15a7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382954.JPG", cAlternateFileName="")) returned 1
	[0055.746] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.758] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0382954.JPG") returned -1
	[0055.758] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0382954.JPG") returned -1
	[0055.758] lstrcmpiA (lpString1="", lpString2="J0382954.JPG") returned -1
	[0055.758] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG") returned="J0382952.JPG"
	[0055.758] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.758] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.758] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.758] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.758] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0382954.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG"
	[0055.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG", pszSpec="*.zip") returned 0
	[0055.758] lstrlenA (lpString="*.zip") returned 5
	[0055.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG", pszSpec="*.rar") returned 0
	[0055.758] lstrlenA (lpString="*.rar") returned 5
	[0055.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG", pszSpec="*.7z") returned 0
	[0055.758] lstrlenA (lpString="*.7z") returned 4
	[0055.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG", pszSpec="*.tar") returned 0
	[0055.758] lstrlenA (lpString="*.tar") returned 5
	[0055.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG", pszSpec="*.gzip") returned 0
	[0055.758] lstrlenA (lpString="*.gzip") returned 6
	[0055.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG", pszSpec="*.jpg") returned 1
	[0055.758] lstrlenA (lpString="*.jpg") returned 5
	[0055.758] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG"
	[0055.758] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG"
	[0055.758] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG."
	[0055.758] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG.exe"
	[0055.759] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382954.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.760] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15a7f
	[0055.760] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x110c9494, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x110c9494, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x110ef705, dwHighDateTime=0x1d327e8)) returned 1
	[0055.760] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.760] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x15a3d, lpOverlapped=0x0) returned 1
	[0055.816] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG") returned="J0382954.JPG"
	[0055.816] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.816] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x15a3d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x15a3d, lpOverlapped=0x0) returned 1
	[0055.817] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.817] CloseHandle (hObject=0x214) returned 1
	[0055.819] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382954.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382954.jpg.exe")) returned 1
	[0055.820] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf58455c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf58455c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5aa7bb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x15fef, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382955.JPG", cAlternateFileName="")) returned 1
	[0055.820] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.821] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0382955.JPG") returned -1
	[0055.821] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0382955.JPG") returned -1
	[0055.822] lstrcmpiA (lpString1="", lpString2="J0382955.JPG") returned -1
	[0055.822] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG") returned="J0382954.JPG"
	[0055.822] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.822] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.822] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.822] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.822] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0382955.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG"
	[0055.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG", pszSpec="*.zip") returned 0
	[0055.822] lstrlenA (lpString="*.zip") returned 5
	[0055.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG", pszSpec="*.rar") returned 0
	[0055.822] lstrlenA (lpString="*.rar") returned 5
	[0055.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG", pszSpec="*.7z") returned 0
	[0055.822] lstrlenA (lpString="*.7z") returned 4
	[0055.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG", pszSpec="*.tar") returned 0
	[0055.822] lstrlenA (lpString="*.tar") returned 5
	[0055.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG", pszSpec="*.gzip") returned 0
	[0055.822] lstrlenA (lpString="*.gzip") returned 6
	[0055.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG", pszSpec="*.jpg") returned 1
	[0055.822] lstrlenA (lpString="*.jpg") returned 5
	[0055.822] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG"
	[0055.822] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG"
	[0055.822] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG."
	[0055.822] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG.exe"
	[0055.822] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382955.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.823] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15fef
	[0055.823] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf58455c, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf58455c, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf5aa7bb, dwHighDateTime=0x1d327e8)) returned 1
	[0055.823] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.823] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x15fad, lpOverlapped=0x0) returned 1
	[0055.929] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG") returned="J0382955.JPG"
	[0055.929] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.930] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x15fad, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x15fad, lpOverlapped=0x0) returned 1
	[0055.930] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.930] CloseHandle (hObject=0x214) returned 1
	[0055.933] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382955.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382955.jpg.exe")) returned 1
	[0055.934] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf58455c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf58455c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5aa7bb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1a9ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382957.JPG", cAlternateFileName="")) returned 1
	[0055.934] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.934] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0382957.JPG") returned -1
	[0055.934] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0382957.JPG") returned -1
	[0055.934] lstrcmpiA (lpString1="", lpString2="J0382957.JPG") returned -1
	[0055.934] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG") returned="J0382955.JPG"
	[0055.934] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.934] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.934] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.935] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.935] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0382957.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG"
	[0055.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG", pszSpec="*.zip") returned 0
	[0055.935] lstrlenA (lpString="*.zip") returned 5
	[0055.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG", pszSpec="*.rar") returned 0
	[0055.935] lstrlenA (lpString="*.rar") returned 5
	[0055.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG", pszSpec="*.7z") returned 0
	[0055.935] lstrlenA (lpString="*.7z") returned 4
	[0055.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG", pszSpec="*.tar") returned 0
	[0055.935] lstrlenA (lpString="*.tar") returned 5
	[0055.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG", pszSpec="*.gzip") returned 0
	[0055.935] lstrlenA (lpString="*.gzip") returned 6
	[0055.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG", pszSpec="*.jpg") returned 1
	[0055.935] lstrlenA (lpString="*.jpg") returned 5
	[0055.935] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG"
	[0055.935] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG"
	[0055.935] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG."
	[0055.935] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG.exe"
	[0055.935] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382957.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.936] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a9ed
	[0055.936] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf58455c, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf58455c, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf5aa7bb, dwHighDateTime=0x1d327e8)) returned 1
	[0055.936] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.936] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1a9ab, lpOverlapped=0x0) returned 1
	[0055.938] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG") returned="J0382957.JPG"
	[0055.939] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.939] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1a9ab, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1a9ab, lpOverlapped=0x0) returned 1
	[0055.939] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.939] CloseHandle (hObject=0x214) returned 1
	[0055.942] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382957.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382957.jpg.exe")) returned 1
	[0055.943] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4c596d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf4c596d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4c596d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x193e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382958.JPG", cAlternateFileName="")) returned 1
	[0055.943] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.943] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0382958.JPG") returned -1
	[0055.943] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0382958.JPG") returned -1
	[0055.943] lstrcmpiA (lpString1="", lpString2="J0382958.JPG") returned -1
	[0055.943] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG") returned="J0382957.JPG"
	[0055.943] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.943] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.943] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.943] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.943] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0382958.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG"
	[0055.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG", pszSpec="*.zip") returned 0
	[0055.943] lstrlenA (lpString="*.zip") returned 5
	[0055.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG", pszSpec="*.rar") returned 0
	[0055.943] lstrlenA (lpString="*.rar") returned 5
	[0055.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG", pszSpec="*.7z") returned 0
	[0055.943] lstrlenA (lpString="*.7z") returned 4
	[0055.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG", pszSpec="*.tar") returned 0
	[0055.943] lstrlenA (lpString="*.tar") returned 5
	[0055.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG", pszSpec="*.gzip") returned 0
	[0055.944] lstrlenA (lpString="*.gzip") returned 6
	[0055.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG", pszSpec="*.jpg") returned 1
	[0055.944] lstrlenA (lpString="*.jpg") returned 5
	[0055.944] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG"
	[0055.944] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG"
	[0055.944] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG."
	[0055.944] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG.exe"
	[0055.944] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382958.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.944] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x193e7
	[0055.944] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf4c596d, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf4c596d, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4c596d, dwHighDateTime=0x1d327e8)) returned 1
	[0055.944] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.944] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x193a5, lpOverlapped=0x0) returned 1
	[0055.946] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG") returned="J0382958.JPG"
	[0055.947] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.947] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x193a5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x193a5, lpOverlapped=0x0) returned 1
	[0055.947] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.947] CloseHandle (hObject=0x214) returned 1
	[0055.950] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382958.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382958.jpg.exe")) returned 1
	[0055.967] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf58455c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf58455c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5aa7bb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14f8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382959.JPG", cAlternateFileName="")) returned 1
	[0055.967] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.967] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0382959.JPG") returned -1
	[0055.967] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0382959.JPG") returned -1
	[0055.967] lstrcmpiA (lpString1="", lpString2="J0382959.JPG") returned -1
	[0055.967] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG") returned="J0382958.JPG"
	[0055.967] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.967] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.967] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.967] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.967] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0382959.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG"
	[0055.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG", pszSpec="*.zip") returned 0
	[0055.968] lstrlenA (lpString="*.zip") returned 5
	[0055.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG", pszSpec="*.rar") returned 0
	[0055.968] lstrlenA (lpString="*.rar") returned 5
	[0055.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG", pszSpec="*.7z") returned 0
	[0055.968] lstrlenA (lpString="*.7z") returned 4
	[0055.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG", pszSpec="*.tar") returned 0
	[0055.968] lstrlenA (lpString="*.tar") returned 5
	[0055.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG", pszSpec="*.gzip") returned 0
	[0055.968] lstrlenA (lpString="*.gzip") returned 6
	[0055.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG", pszSpec="*.jpg") returned 1
	[0055.968] lstrlenA (lpString="*.jpg") returned 5
	[0055.968] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG"
	[0055.968] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG"
	[0055.968] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG."
	[0055.968] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG.exe"
	[0055.968] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382959.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.968] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14f8a
	[0055.968] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf58455c, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf58455c, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf5aa7bb, dwHighDateTime=0x1d327e8)) returned 1
	[0055.969] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.969] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x14f48, lpOverlapped=0x0) returned 1
	[0055.971] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG") returned="J0382959.JPG"
	[0055.971] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.971] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x14f48, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x14f48, lpOverlapped=0x0) returned 1
	[0055.972] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.972] CloseHandle (hObject=0x214) returned 1
	[0055.974] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382959.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382959.jpg.exe")) returned 1
	[0055.975] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4ebbf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf4ebbf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4ebbf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1a3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382960.JPG", cAlternateFileName="")) returned 1
	[0055.975] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.975] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0382960.JPG") returned -1
	[0055.975] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0382960.JPG") returned -1
	[0055.975] lstrcmpiA (lpString1="", lpString2="J0382960.JPG") returned -1
	[0055.975] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG") returned="J0382959.JPG"
	[0055.975] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.975] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.975] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.975] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.975] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0382960.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG"
	[0055.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG", pszSpec="*.zip") returned 0
	[0055.975] lstrlenA (lpString="*.zip") returned 5
	[0055.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG", pszSpec="*.rar") returned 0
	[0055.975] lstrlenA (lpString="*.rar") returned 5
	[0055.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG", pszSpec="*.7z") returned 0
	[0055.975] lstrlenA (lpString="*.7z") returned 4
	[0055.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG", pszSpec="*.tar") returned 0
	[0055.975] lstrlenA (lpString="*.tar") returned 5
	[0055.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG", pszSpec="*.gzip") returned 0
	[0055.975] lstrlenA (lpString="*.gzip") returned 6
	[0055.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG", pszSpec="*.jpg") returned 1
	[0055.975] lstrlenA (lpString="*.jpg") returned 5
	[0055.975] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG"
	[0055.975] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG"
	[0055.975] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG."
	[0055.976] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG.exe"
	[0055.976] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382960.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.977] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a3f4
	[0055.977] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf4ebbf4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf4ebbf4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4ebbf4, dwHighDateTime=0x1d327e8)) returned 1
	[0055.977] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.977] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1a3b2, lpOverlapped=0x0) returned 1
	[0055.979] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG") returned="J0382960.JPG"
	[0055.980] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.980] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1a3b2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1a3b2, lpOverlapped=0x0) returned 1
	[0055.980] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.980] CloseHandle (hObject=0x214) returned 1
	[0055.983] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382960.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382960.jpg.exe")) returned 1
	[0055.983] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4c596d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf4c596d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4c596d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x18ac4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382961.JPG", cAlternateFileName="")) returned 1
	[0055.984] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.984] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0382961.JPG") returned -1
	[0055.984] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0382961.JPG") returned -1
	[0055.984] lstrcmpiA (lpString1="", lpString2="J0382961.JPG") returned -1
	[0055.984] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG") returned="J0382960.JPG"
	[0055.984] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.984] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.984] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.984] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.984] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0382961.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG"
	[0055.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG", pszSpec="*.zip") returned 0
	[0055.984] lstrlenA (lpString="*.zip") returned 5
	[0055.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG", pszSpec="*.rar") returned 0
	[0055.984] lstrlenA (lpString="*.rar") returned 5
	[0055.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG", pszSpec="*.7z") returned 0
	[0055.984] lstrlenA (lpString="*.7z") returned 4
	[0055.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG", pszSpec="*.tar") returned 0
	[0055.984] lstrlenA (lpString="*.tar") returned 5
	[0055.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG", pszSpec="*.gzip") returned 0
	[0055.984] lstrlenA (lpString="*.gzip") returned 6
	[0055.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG", pszSpec="*.jpg") returned 1
	[0055.984] lstrlenA (lpString="*.jpg") returned 5
	[0055.984] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG"
	[0055.984] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG"
	[0055.984] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG."
	[0055.984] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG.exe"
	[0055.984] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382961.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.985] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18ac4
	[0055.985] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf4c596d, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf4c596d, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4c596d, dwHighDateTime=0x1d327e8)) returned 1
	[0055.985] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.985] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x18a82, lpOverlapped=0x0) returned 1
	[0055.987] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG") returned="J0382961.JPG"
	[0055.988] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.988] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x18a82, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x18a82, lpOverlapped=0x0) returned 1
	[0055.988] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.988] CloseHandle (hObject=0x214) returned 1
	[0055.991] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382961.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382961.jpg.exe")) returned 1
	[0055.991] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4c596d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf4c596d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4c596d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1bef7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382962.JPG", cAlternateFileName="")) returned 1
	[0055.991] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0055.991] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0382962.JPG") returned -1
	[0055.991] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0382962.JPG") returned -1
	[0055.991] lstrcmpiA (lpString1="", lpString2="J0382962.JPG") returned -1
	[0055.991] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG") returned="J0382961.JPG"
	[0055.991] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0055.991] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0055.992] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0055.992] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0055.992] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0382962.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG"
	[0055.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG", pszSpec="*.zip") returned 0
	[0055.992] lstrlenA (lpString="*.zip") returned 5
	[0055.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG", pszSpec="*.rar") returned 0
	[0055.992] lstrlenA (lpString="*.rar") returned 5
	[0055.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG", pszSpec="*.7z") returned 0
	[0055.992] lstrlenA (lpString="*.7z") returned 4
	[0055.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG", pszSpec="*.tar") returned 0
	[0055.992] lstrlenA (lpString="*.tar") returned 5
	[0055.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG", pszSpec="*.gzip") returned 0
	[0055.992] lstrlenA (lpString="*.gzip") returned 6
	[0055.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG", pszSpec="*.jpg") returned 1
	[0055.992] lstrlenA (lpString="*.jpg") returned 5
	[0055.992] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG"
	[0055.992] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG"
	[0055.992] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG."
	[0055.992] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG.exe"
	[0055.992] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382962.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0055.992] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1bef7
	[0055.992] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf4c596d, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf4c596d, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4c596d, dwHighDateTime=0x1d327e8)) returned 1
	[0055.992] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.992] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1beb5, lpOverlapped=0x0) returned 1
	[0055.994] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG") returned="J0382962.JPG"
	[0055.995] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0055.995] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1beb5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1beb5, lpOverlapped=0x0) returned 1
	[0055.995] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.995] CloseHandle (hObject=0x214) returned 1
	[0056.016] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382962.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382962.jpg.exe")) returned 1
	[0056.017] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4c596d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf4c596d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4c596d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17dee, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382963.JPG", cAlternateFileName="")) returned 1
	[0056.017] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.017] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0382963.JPG") returned -1
	[0056.017] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0382963.JPG") returned -1
	[0056.017] lstrcmpiA (lpString1="", lpString2="J0382963.JPG") returned -1
	[0056.017] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG") returned="J0382962.JPG"
	[0056.017] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.017] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.017] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.017] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.017] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0382963.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG"
	[0056.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG", pszSpec="*.zip") returned 0
	[0056.017] lstrlenA (lpString="*.zip") returned 5
	[0056.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG", pszSpec="*.rar") returned 0
	[0056.017] lstrlenA (lpString="*.rar") returned 5
	[0056.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG", pszSpec="*.7z") returned 0
	[0056.017] lstrlenA (lpString="*.7z") returned 4
	[0056.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG", pszSpec="*.tar") returned 0
	[0056.017] lstrlenA (lpString="*.tar") returned 5
	[0056.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG", pszSpec="*.gzip") returned 0
	[0056.017] lstrlenA (lpString="*.gzip") returned 6
	[0056.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG", pszSpec="*.jpg") returned 1
	[0056.017] lstrlenA (lpString="*.jpg") returned 5
	[0056.017] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG"
	[0056.017] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG"
	[0056.017] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG."
	[0056.017] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG.exe"
	[0056.017] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382963.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.018] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17dee
	[0056.018] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf4c596d, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf4c596d, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4c596d, dwHighDateTime=0x1d327e8)) returned 1
	[0056.018] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.018] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x17dac, lpOverlapped=0x0) returned 1
	[0056.020] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG") returned="J0382963.JPG"
	[0056.020] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.020] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x17dac, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x17dac, lpOverlapped=0x0) returned 1
	[0056.021] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.021] CloseHandle (hObject=0x214) returned 1
	[0056.023] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382963.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382963.jpg.exe")) returned 1
	[0056.024] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf511e53, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf511e53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf511e53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1bb02, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382965.JPG", cAlternateFileName="")) returned 1
	[0056.024] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.024] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0382965.JPG") returned -1
	[0056.024] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0382965.JPG") returned -1
	[0056.024] lstrcmpiA (lpString1="", lpString2="J0382965.JPG") returned -1
	[0056.024] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG") returned="J0382963.JPG"
	[0056.024] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.024] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.024] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.024] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.024] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0382965.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG"
	[0056.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG", pszSpec="*.zip") returned 0
	[0056.024] lstrlenA (lpString="*.zip") returned 5
	[0056.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG", pszSpec="*.rar") returned 0
	[0056.024] lstrlenA (lpString="*.rar") returned 5
	[0056.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG", pszSpec="*.7z") returned 0
	[0056.024] lstrlenA (lpString="*.7z") returned 4
	[0056.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG", pszSpec="*.tar") returned 0
	[0056.024] lstrlenA (lpString="*.tar") returned 5
	[0056.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG", pszSpec="*.gzip") returned 0
	[0056.024] lstrlenA (lpString="*.gzip") returned 6
	[0056.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG", pszSpec="*.jpg") returned 1
	[0056.025] lstrlenA (lpString="*.jpg") returned 5
	[0056.025] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG"
	[0056.025] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG"
	[0056.025] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG."
	[0056.025] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG.exe"
	[0056.025] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382965.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.025] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1bb02
	[0056.025] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8)) returned 1
	[0056.026] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.026] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1bac0, lpOverlapped=0x0) returned 1
	[0056.027] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG") returned="J0382965.JPG"
	[0056.028] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.028] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1bac0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1bac0, lpOverlapped=0x0) returned 1
	[0056.029] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.029] CloseHandle (hObject=0x214) returned 1
	[0056.031] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382965.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382965.jpg.exe")) returned 1
	[0056.032] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf511e53, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf511e53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf511e53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x18888, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382966.JPG", cAlternateFileName="")) returned 1
	[0056.032] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.032] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0382966.JPG") returned -1
	[0056.032] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0382966.JPG") returned -1
	[0056.032] lstrcmpiA (lpString1="", lpString2="J0382966.JPG") returned -1
	[0056.032] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG") returned="J0382965.JPG"
	[0056.032] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.032] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.032] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.032] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.032] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0382966.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG"
	[0056.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG", pszSpec="*.zip") returned 0
	[0056.032] lstrlenA (lpString="*.zip") returned 5
	[0056.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG", pszSpec="*.rar") returned 0
	[0056.032] lstrlenA (lpString="*.rar") returned 5
	[0056.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG", pszSpec="*.7z") returned 0
	[0056.032] lstrlenA (lpString="*.7z") returned 4
	[0056.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG", pszSpec="*.tar") returned 0
	[0056.032] lstrlenA (lpString="*.tar") returned 5
	[0056.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG", pszSpec="*.gzip") returned 0
	[0056.033] lstrlenA (lpString="*.gzip") returned 6
	[0056.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG", pszSpec="*.jpg") returned 1
	[0056.033] lstrlenA (lpString="*.jpg") returned 5
	[0056.033] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG"
	[0056.033] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG"
	[0056.033] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG."
	[0056.033] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG.exe"
	[0056.033] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382966.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.033] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18888
	[0056.033] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8)) returned 1
	[0056.033] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.033] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x18846, lpOverlapped=0x0) returned 1
	[0056.035] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG") returned="J0382966.JPG"
	[0056.036] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.036] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x18846, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x18846, lpOverlapped=0x0) returned 1
	[0056.036] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.036] CloseHandle (hObject=0x214) returned 1
	[0056.039] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382966.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382966.jpg.exe")) returned 1
	[0056.039] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4ebbf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf4ebbf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf511e53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x16d08, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382967.JPG", cAlternateFileName="")) returned 1
	[0056.039] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.039] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0382967.JPG") returned -1
	[0056.039] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0382967.JPG") returned -1
	[0056.039] lstrcmpiA (lpString1="", lpString2="J0382967.JPG") returned -1
	[0056.039] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG") returned="J0382966.JPG"
	[0056.040] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.040] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.040] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.040] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.040] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0382967.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG"
	[0056.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG", pszSpec="*.zip") returned 0
	[0056.040] lstrlenA (lpString="*.zip") returned 5
	[0056.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG", pszSpec="*.rar") returned 0
	[0056.040] lstrlenA (lpString="*.rar") returned 5
	[0056.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG", pszSpec="*.7z") returned 0
	[0056.040] lstrlenA (lpString="*.7z") returned 4
	[0056.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG", pszSpec="*.tar") returned 0
	[0056.040] lstrlenA (lpString="*.tar") returned 5
	[0056.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG", pszSpec="*.gzip") returned 0
	[0056.040] lstrlenA (lpString="*.gzip") returned 6
	[0056.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG", pszSpec="*.jpg") returned 1
	[0056.040] lstrlenA (lpString="*.jpg") returned 5
	[0056.040] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG"
	[0056.040] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG"
	[0056.040] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG."
	[0056.040] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG.exe"
	[0056.040] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382967.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.041] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16d08
	[0056.041] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf4ebbf4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf4ebbf4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8)) returned 1
	[0056.041] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.041] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x16cc6, lpOverlapped=0x0) returned 1
	[0056.043] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG") returned="J0382967.JPG"
	[0056.043] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.043] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x16cc6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x16cc6, lpOverlapped=0x0) returned 1
	[0056.044] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.044] CloseHandle (hObject=0x214) returned 1
	[0056.046] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382967.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382967.jpg.exe")) returned 1
	[0056.047] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4ebbf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf4ebbf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4ebbf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1b75f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382968.JPG", cAlternateFileName="")) returned 1
	[0056.047] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.047] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0382968.JPG") returned -1
	[0056.047] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0382968.JPG") returned -1
	[0056.047] lstrcmpiA (lpString1="", lpString2="J0382968.JPG") returned -1
	[0056.047] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG") returned="J0382967.JPG"
	[0056.047] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.047] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.047] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.047] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.047] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0382968.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG"
	[0056.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG", pszSpec="*.zip") returned 0
	[0056.047] lstrlenA (lpString="*.zip") returned 5
	[0056.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG", pszSpec="*.rar") returned 0
	[0056.047] lstrlenA (lpString="*.rar") returned 5
	[0056.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG", pszSpec="*.7z") returned 0
	[0056.047] lstrlenA (lpString="*.7z") returned 4
	[0056.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG", pszSpec="*.tar") returned 0
	[0056.047] lstrlenA (lpString="*.tar") returned 5
	[0056.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG", pszSpec="*.gzip") returned 0
	[0056.047] lstrlenA (lpString="*.gzip") returned 6
	[0056.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG", pszSpec="*.jpg") returned 1
	[0056.047] lstrlenA (lpString="*.jpg") returned 5
	[0056.047] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG"
	[0056.047] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG"
	[0056.047] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG."
	[0056.047] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG.exe"
	[0056.047] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382968.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.048] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b75f
	[0056.048] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf4ebbf4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf4ebbf4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4ebbf4, dwHighDateTime=0x1d327e8)) returned 1
	[0056.048] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.048] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1b71d, lpOverlapped=0x0) returned 1
	[0056.069] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG") returned="J0382968.JPG"
	[0056.069] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.069] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1b71d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1b71d, lpOverlapped=0x0) returned 1
	[0056.070] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.070] CloseHandle (hObject=0x214) returned 1
	[0056.073] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382968.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382968.jpg.exe")) returned 1
	[0056.074] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4ebbf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf4ebbf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4ebbf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1779f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382969.JPG", cAlternateFileName="")) returned 1
	[0056.074] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.074] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0382969.JPG") returned -1
	[0056.074] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0382969.JPG") returned -1
	[0056.074] lstrcmpiA (lpString1="", lpString2="J0382969.JPG") returned -1
	[0056.074] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG") returned="J0382968.JPG"
	[0056.074] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.074] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.074] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.074] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.074] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0382969.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG"
	[0056.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG", pszSpec="*.zip") returned 0
	[0056.074] lstrlenA (lpString="*.zip") returned 5
	[0056.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG", pszSpec="*.rar") returned 0
	[0056.074] lstrlenA (lpString="*.rar") returned 5
	[0056.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG", pszSpec="*.7z") returned 0
	[0056.074] lstrlenA (lpString="*.7z") returned 4
	[0056.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG", pszSpec="*.tar") returned 0
	[0056.074] lstrlenA (lpString="*.tar") returned 5
	[0056.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG", pszSpec="*.gzip") returned 0
	[0056.074] lstrlenA (lpString="*.gzip") returned 6
	[0056.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG", pszSpec="*.jpg") returned 1
	[0056.074] lstrlenA (lpString="*.jpg") returned 5
	[0056.074] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG"
	[0056.074] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG"
	[0056.074] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG."
	[0056.074] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG.exe"
	[0056.074] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382969.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.082] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1779f
	[0056.082] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf4ebbf4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf4ebbf4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4ebbf4, dwHighDateTime=0x1d327e8)) returned 1
	[0056.082] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.082] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1775d, lpOverlapped=0x0) returned 1
	[0056.084] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG") returned="J0382969.JPG"
	[0056.084] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.084] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1775d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1775d, lpOverlapped=0x0) returned 1
	[0056.085] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.085] CloseHandle (hObject=0x214) returned 1
	[0056.087] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382969.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382969.jpg.exe")) returned 1
	[0056.088] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4ebbf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf4ebbf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4ebbf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x15b94, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382970.JPG", cAlternateFileName="")) returned 1
	[0056.088] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.088] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0382970.JPG") returned -1
	[0056.088] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0382970.JPG") returned -1
	[0056.088] lstrcmpiA (lpString1="", lpString2="J0382970.JPG") returned -1
	[0056.088] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG") returned="J0382969.JPG"
	[0056.088] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.088] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.088] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.088] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.088] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0382970.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG"
	[0056.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG", pszSpec="*.zip") returned 0
	[0056.088] lstrlenA (lpString="*.zip") returned 5
	[0056.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG", pszSpec="*.rar") returned 0
	[0056.088] lstrlenA (lpString="*.rar") returned 5
	[0056.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG", pszSpec="*.7z") returned 0
	[0056.088] lstrlenA (lpString="*.7z") returned 4
	[0056.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG", pszSpec="*.tar") returned 0
	[0056.088] lstrlenA (lpString="*.tar") returned 5
	[0056.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG", pszSpec="*.gzip") returned 0
	[0056.088] lstrlenA (lpString="*.gzip") returned 6
	[0056.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG", pszSpec="*.jpg") returned 1
	[0056.088] lstrlenA (lpString="*.jpg") returned 5
	[0056.089] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG"
	[0056.089] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG"
	[0056.089] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG."
	[0056.089] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG.exe"
	[0056.089] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382970.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.089] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15b94
	[0056.089] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf4ebbf4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf4ebbf4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4ebbf4, dwHighDateTime=0x1d327e8)) returned 1
	[0056.089] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.089] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x15b52, lpOverlapped=0x0) returned 1
	[0056.103] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG") returned="J0382970.JPG"
	[0056.103] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.103] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x15b52, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x15b52, lpOverlapped=0x0) returned 1
	[0056.104] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.104] CloseHandle (hObject=0x214) returned 1
	[0056.107] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382970.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382970.jpg.exe")) returned 1
	[0056.108] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4ebbf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf4ebbf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4ebbf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x190e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0384862.JPG", cAlternateFileName="")) returned 1
	[0056.108] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.108] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0384862.JPG") returned -1
	[0056.108] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0384862.JPG") returned -1
	[0056.108] lstrcmpiA (lpString1="", lpString2="J0384862.JPG") returned -1
	[0056.108] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG") returned="J0382970.JPG"
	[0056.108] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.108] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.108] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.108] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.108] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0384862.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG"
	[0056.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG", pszSpec="*.zip") returned 0
	[0056.108] lstrlenA (lpString="*.zip") returned 5
	[0056.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG", pszSpec="*.rar") returned 0
	[0056.109] lstrlenA (lpString="*.rar") returned 5
	[0056.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG", pszSpec="*.7z") returned 0
	[0056.109] lstrlenA (lpString="*.7z") returned 4
	[0056.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG", pszSpec="*.tar") returned 0
	[0056.109] lstrlenA (lpString="*.tar") returned 5
	[0056.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG", pszSpec="*.gzip") returned 0
	[0056.109] lstrlenA (lpString="*.gzip") returned 6
	[0056.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG", pszSpec="*.jpg") returned 1
	[0056.109] lstrlenA (lpString="*.jpg") returned 5
	[0056.109] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG"
	[0056.109] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG"
	[0056.109] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG."
	[0056.109] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG.exe"
	[0056.109] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384862.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.109] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x190e9
	[0056.109] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf4ebbf4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf4ebbf4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4ebbf4, dwHighDateTime=0x1d327e8)) returned 1
	[0056.109] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.109] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x190a7, lpOverlapped=0x0) returned 1
	[0056.112] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG") returned="J0384862.JPG"
	[0056.112] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.112] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x190a7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x190a7, lpOverlapped=0x0) returned 1
	[0056.112] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.113] CloseHandle (hObject=0x214) returned 1
	[0056.115] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384862.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384862.jpg.exe")) returned 1
	[0056.116] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4ebbf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf4ebbf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4ebbf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17b79, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0384885.JPG", cAlternateFileName="")) returned 1
	[0056.116] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.116] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0384885.JPG") returned -1
	[0056.116] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0384885.JPG") returned -1
	[0056.116] lstrcmpiA (lpString1="", lpString2="J0384885.JPG") returned -1
	[0056.116] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG") returned="J0384862.JPG"
	[0056.116] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.116] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.116] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.116] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.116] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0384885.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG"
	[0056.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG", pszSpec="*.zip") returned 0
	[0056.116] lstrlenA (lpString="*.zip") returned 5
	[0056.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG", pszSpec="*.rar") returned 0
	[0056.116] lstrlenA (lpString="*.rar") returned 5
	[0056.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG", pszSpec="*.7z") returned 0
	[0056.116] lstrlenA (lpString="*.7z") returned 4
	[0056.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG", pszSpec="*.tar") returned 0
	[0056.116] lstrlenA (lpString="*.tar") returned 5
	[0056.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG", pszSpec="*.gzip") returned 0
	[0056.116] lstrlenA (lpString="*.gzip") returned 6
	[0056.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG", pszSpec="*.jpg") returned 1
	[0056.116] lstrlenA (lpString="*.jpg") returned 5
	[0056.116] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG"
	[0056.116] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG"
	[0056.116] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG."
	[0056.116] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG.exe"
	[0056.116] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384885.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.117] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17b79
	[0056.117] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf4ebbf4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf4ebbf4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4ebbf4, dwHighDateTime=0x1d327e8)) returned 1
	[0056.117] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.117] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x17b37, lpOverlapped=0x0) returned 1
	[0056.119] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG") returned="J0384885.JPG"
	[0056.119] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.120] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x17b37, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x17b37, lpOverlapped=0x0) returned 1
	[0056.120] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.120] CloseHandle (hObject=0x214) returned 1
	[0056.123] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384885.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384885.jpg.exe")) returned 1
	[0056.123] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4ebbf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf4ebbf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4ebbf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14033, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0384888.JPG", cAlternateFileName="")) returned 1
	[0056.124] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.124] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0384888.JPG") returned -1
	[0056.124] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0384888.JPG") returned -1
	[0056.124] lstrcmpiA (lpString1="", lpString2="J0384888.JPG") returned -1
	[0056.124] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG") returned="J0384885.JPG"
	[0056.124] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.124] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.124] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.124] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.124] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0384888.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG"
	[0056.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG", pszSpec="*.zip") returned 0
	[0056.124] lstrlenA (lpString="*.zip") returned 5
	[0056.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG", pszSpec="*.rar") returned 0
	[0056.124] lstrlenA (lpString="*.rar") returned 5
	[0056.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG", pszSpec="*.7z") returned 0
	[0056.124] lstrlenA (lpString="*.7z") returned 4
	[0056.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG", pszSpec="*.tar") returned 0
	[0056.124] lstrlenA (lpString="*.tar") returned 5
	[0056.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG", pszSpec="*.gzip") returned 0
	[0056.124] lstrlenA (lpString="*.gzip") returned 6
	[0056.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG", pszSpec="*.jpg") returned 1
	[0056.124] lstrlenA (lpString="*.jpg") returned 5
	[0056.124] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG"
	[0056.124] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG"
	[0056.124] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG."
	[0056.124] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG.exe"
	[0056.124] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384888.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.125] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14033
	[0056.125] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf4ebbf4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf4ebbf4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4ebbf4, dwHighDateTime=0x1d327e8)) returned 1
	[0056.125] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.125] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x13ff1, lpOverlapped=0x0) returned 1
	[0056.169] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG") returned="J0384888.JPG"
	[0056.170] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.170] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x13ff1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x13ff1, lpOverlapped=0x0) returned 1
	[0056.170] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.170] CloseHandle (hObject=0x214) returned 1
	[0056.173] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384888.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384888.jpg.exe")) returned 1
	[0056.173] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4ebbf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf4ebbf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4ebbf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd8f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0384895.JPG", cAlternateFileName="")) returned 1
	[0056.173] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.173] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0384895.JPG") returned -1
	[0056.173] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0384895.JPG") returned -1
	[0056.173] lstrcmpiA (lpString1="", lpString2="J0384895.JPG") returned -1
	[0056.173] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG") returned="J0384888.JPG"
	[0056.174] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.174] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.174] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.174] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.174] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0384895.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG"
	[0056.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG", pszSpec="*.zip") returned 0
	[0056.174] lstrlenA (lpString="*.zip") returned 5
	[0056.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG", pszSpec="*.rar") returned 0
	[0056.174] lstrlenA (lpString="*.rar") returned 5
	[0056.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG", pszSpec="*.7z") returned 0
	[0056.174] lstrlenA (lpString="*.7z") returned 4
	[0056.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG", pszSpec="*.tar") returned 0
	[0056.174] lstrlenA (lpString="*.tar") returned 5
	[0056.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG", pszSpec="*.gzip") returned 0
	[0056.174] lstrlenA (lpString="*.gzip") returned 6
	[0056.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG", pszSpec="*.jpg") returned 1
	[0056.174] lstrlenA (lpString="*.jpg") returned 5
	[0056.174] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG"
	[0056.174] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG"
	[0056.174] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG."
	[0056.174] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG.exe"
	[0056.174] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.175] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd8f6
	[0056.175] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf4ebbf4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf4ebbf4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4ebbf4, dwHighDateTime=0x1d327e8)) returned 1
	[0056.175] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.175] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xd8b4, lpOverlapped=0x0) returned 1
	[0056.177] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG") returned="J0384895.JPG"
	[0056.177] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.177] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xd8b4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xd8b4, lpOverlapped=0x0) returned 1
	[0056.177] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.177] CloseHandle (hObject=0x214) returned 1
	[0056.179] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384895.jpg.exe")) returned 1
	[0056.180] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf511e53, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf511e53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf511e53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11780, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0384900.JPG", cAlternateFileName="")) returned 1
	[0056.180] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.180] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0384900.JPG") returned -1
	[0056.180] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0384900.JPG") returned -1
	[0056.180] lstrcmpiA (lpString1="", lpString2="J0384900.JPG") returned -1
	[0056.180] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG") returned="J0384895.JPG"
	[0056.180] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.180] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.180] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.180] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.180] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0384900.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG"
	[0056.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG", pszSpec="*.zip") returned 0
	[0056.180] lstrlenA (lpString="*.zip") returned 5
	[0056.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG", pszSpec="*.rar") returned 0
	[0056.180] lstrlenA (lpString="*.rar") returned 5
	[0056.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG", pszSpec="*.7z") returned 0
	[0056.180] lstrlenA (lpString="*.7z") returned 4
	[0056.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG", pszSpec="*.tar") returned 0
	[0056.180] lstrlenA (lpString="*.tar") returned 5
	[0056.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG", pszSpec="*.gzip") returned 0
	[0056.180] lstrlenA (lpString="*.gzip") returned 6
	[0056.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG", pszSpec="*.jpg") returned 1
	[0056.180] lstrlenA (lpString="*.jpg") returned 5
	[0056.180] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG"
	[0056.180] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG"
	[0056.180] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG."
	[0056.180] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG.exe"
	[0056.180] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384900.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.181] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11780
	[0056.181] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8)) returned 1
	[0056.181] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.181] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1173e, lpOverlapped=0x0) returned 1
	[0056.183] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG") returned="J0384900.JPG"
	[0056.183] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.183] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1173e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1173e, lpOverlapped=0x0) returned 1
	[0056.183] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.184] CloseHandle (hObject=0x214) returned 1
	[0056.186] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384900.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384900.jpg.exe")) returned 1
	[0056.186] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf511e53, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf511e53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf511e53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x787a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0386120.JPG", cAlternateFileName="")) returned 1
	[0056.186] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.186] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0386120.JPG") returned -1
	[0056.186] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0386120.JPG") returned -1
	[0056.186] lstrcmpiA (lpString1="", lpString2="J0386120.JPG") returned -1
	[0056.186] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG") returned="J0384900.JPG"
	[0056.186] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.186] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.186] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.187] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.187] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0386120.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG"
	[0056.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG", pszSpec="*.zip") returned 0
	[0056.187] lstrlenA (lpString="*.zip") returned 5
	[0056.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG", pszSpec="*.rar") returned 0
	[0056.187] lstrlenA (lpString="*.rar") returned 5
	[0056.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG", pszSpec="*.7z") returned 0
	[0056.187] lstrlenA (lpString="*.7z") returned 4
	[0056.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG", pszSpec="*.tar") returned 0
	[0056.187] lstrlenA (lpString="*.tar") returned 5
	[0056.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG", pszSpec="*.gzip") returned 0
	[0056.187] lstrlenA (lpString="*.gzip") returned 6
	[0056.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG", pszSpec="*.jpg") returned 1
	[0056.187] lstrlenA (lpString="*.jpg") returned 5
	[0056.187] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG"
	[0056.187] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG"
	[0056.187] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG."
	[0056.187] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG.exe"
	[0056.187] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386120.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.187] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x787a
	[0056.187] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8)) returned 1
	[0056.187] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.187] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7838, lpOverlapped=0x0) returned 1
	[0056.189] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG") returned="J0386120.JPG"
	[0056.189] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.189] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7838, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7838, lpOverlapped=0x0) returned 1
	[0056.189] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.189] CloseHandle (hObject=0x214) returned 1
	[0056.191] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386120.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386120.jpg.exe")) returned 1
	[0056.191] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf511e53, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf511e53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf511e53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa91e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0386267.JPG", cAlternateFileName="")) returned 1
	[0056.191] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.191] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0386267.JPG") returned -1
	[0056.191] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0386267.JPG") returned -1
	[0056.191] lstrcmpiA (lpString1="", lpString2="J0386267.JPG") returned -1
	[0056.191] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG") returned="J0386120.JPG"
	[0056.191] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.191] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.191] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.191] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.192] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0386267.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG"
	[0056.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG", pszSpec="*.zip") returned 0
	[0056.192] lstrlenA (lpString="*.zip") returned 5
	[0056.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG", pszSpec="*.rar") returned 0
	[0056.192] lstrlenA (lpString="*.rar") returned 5
	[0056.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG", pszSpec="*.7z") returned 0
	[0056.192] lstrlenA (lpString="*.7z") returned 4
	[0056.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG", pszSpec="*.tar") returned 0
	[0056.192] lstrlenA (lpString="*.tar") returned 5
	[0056.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG", pszSpec="*.gzip") returned 0
	[0056.192] lstrlenA (lpString="*.gzip") returned 6
	[0056.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG", pszSpec="*.jpg") returned 1
	[0056.192] lstrlenA (lpString="*.jpg") returned 5
	[0056.192] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG"
	[0056.192] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG"
	[0056.192] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG."
	[0056.192] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG.exe"
	[0056.192] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386267.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.192] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa91e
	[0056.192] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8)) returned 1
	[0056.192] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.192] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xa8dc, lpOverlapped=0x0) returned 1
	[0056.194] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG") returned="J0386267.JPG"
	[0056.194] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.194] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xa8dc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xa8dc, lpOverlapped=0x0) returned 1
	[0056.195] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.195] CloseHandle (hObject=0x214) returned 1
	[0056.196] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386267.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386267.jpg.exe")) returned 1
	[0056.197] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf511e53, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf511e53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf511e53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3b43, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0386270.JPG", cAlternateFileName="")) returned 1
	[0056.197] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.197] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0386270.JPG") returned -1
	[0056.197] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0386270.JPG") returned -1
	[0056.197] lstrcmpiA (lpString1="", lpString2="J0386270.JPG") returned -1
	[0056.197] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG") returned="J0386267.JPG"
	[0056.197] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.197] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.197] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.197] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.197] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0386270.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG"
	[0056.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG", pszSpec="*.zip") returned 0
	[0056.197] lstrlenA (lpString="*.zip") returned 5
	[0056.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG", pszSpec="*.rar") returned 0
	[0056.197] lstrlenA (lpString="*.rar") returned 5
	[0056.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG", pszSpec="*.7z") returned 0
	[0056.197] lstrlenA (lpString="*.7z") returned 4
	[0056.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG", pszSpec="*.tar") returned 0
	[0056.198] lstrlenA (lpString="*.tar") returned 5
	[0056.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG", pszSpec="*.gzip") returned 0
	[0056.198] lstrlenA (lpString="*.gzip") returned 6
	[0056.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG", pszSpec="*.jpg") returned 1
	[0056.198] lstrlenA (lpString="*.jpg") returned 5
	[0056.198] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG"
	[0056.198] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG"
	[0056.198] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG."
	[0056.198] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG.exe"
	[0056.198] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386270.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.199] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b43
	[0056.199] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8)) returned 1
	[0056.199] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.199] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x3b01, lpOverlapped=0x0) returned 1
	[0056.200] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG") returned="J0386270.JPG"
	[0056.200] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.200] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x3b01, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x3b01, lpOverlapped=0x0) returned 1
	[0056.201] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.201] CloseHandle (hObject=0x214) returned 1
	[0056.202] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386270.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386270.jpg.exe")) returned 1
	[0056.202] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf511e53, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf511e53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf511e53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x396a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0386485.JPG", cAlternateFileName="")) returned 1
	[0056.202] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.202] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0386485.JPG") returned -1
	[0056.202] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0386485.JPG") returned -1
	[0056.202] lstrcmpiA (lpString1="", lpString2="J0386485.JPG") returned -1
	[0056.202] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG") returned="J0386270.JPG"
	[0056.202] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.202] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.202] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.202] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.202] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0386485.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG"
	[0056.203] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG", pszSpec="*.zip") returned 0
	[0056.203] lstrlenA (lpString="*.zip") returned 5
	[0056.203] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG", pszSpec="*.rar") returned 0
	[0056.203] lstrlenA (lpString="*.rar") returned 5
	[0056.203] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG", pszSpec="*.7z") returned 0
	[0056.203] lstrlenA (lpString="*.7z") returned 4
	[0056.203] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG", pszSpec="*.tar") returned 0
	[0056.203] lstrlenA (lpString="*.tar") returned 5
	[0056.203] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG", pszSpec="*.gzip") returned 0
	[0056.203] lstrlenA (lpString="*.gzip") returned 6
	[0056.203] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG", pszSpec="*.jpg") returned 1
	[0056.203] lstrlenA (lpString="*.jpg") returned 5
	[0056.203] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG"
	[0056.203] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG"
	[0056.203] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG."
	[0056.203] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG.exe"
	[0056.203] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386485.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.203] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x396a
	[0056.203] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8)) returned 1
	[0056.203] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.203] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x3928, lpOverlapped=0x0) returned 1
	[0056.246] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG") returned="J0386485.JPG"
	[0056.246] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.246] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x3928, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x3928, lpOverlapped=0x0) returned 1
	[0056.247] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.247] CloseHandle (hObject=0x214) returned 1
	[0056.248] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386485.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386485.jpg.exe")) returned 1
	[0056.249] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf511e53, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf511e53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf511e53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x693e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0386764.JPG", cAlternateFileName="")) returned 1
	[0056.249] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.249] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0386764.JPG") returned -1
	[0056.249] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0386764.JPG") returned -1
	[0056.249] lstrcmpiA (lpString1="", lpString2="J0386764.JPG") returned -1
	[0056.249] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG") returned="J0386485.JPG"
	[0056.249] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.249] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.249] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.249] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.249] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0386764.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG"
	[0056.250] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG", pszSpec="*.zip") returned 0
	[0056.250] lstrlenA (lpString="*.zip") returned 5
	[0056.250] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG", pszSpec="*.rar") returned 0
	[0056.250] lstrlenA (lpString="*.rar") returned 5
	[0056.250] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG", pszSpec="*.7z") returned 0
	[0056.250] lstrlenA (lpString="*.7z") returned 4
	[0056.250] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG", pszSpec="*.tar") returned 0
	[0056.250] lstrlenA (lpString="*.tar") returned 5
	[0056.250] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG", pszSpec="*.gzip") returned 0
	[0056.250] lstrlenA (lpString="*.gzip") returned 6
	[0056.250] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG", pszSpec="*.jpg") returned 1
	[0056.250] lstrlenA (lpString="*.jpg") returned 5
	[0056.250] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG"
	[0056.250] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG"
	[0056.250] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG."
	[0056.250] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG.exe"
	[0056.250] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386764.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.251] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x693e
	[0056.251] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8)) returned 1
	[0056.251] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.251] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x68fc, lpOverlapped=0x0) returned 1
	[0056.252] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG") returned="J0386764.JPG"
	[0056.252] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.253] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x68fc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x68fc, lpOverlapped=0x0) returned 1
	[0056.253] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.253] CloseHandle (hObject=0x214) returned 1
	[0056.254] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386764.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386764.jpg.exe")) returned 1
	[0056.255] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf511e53, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf511e53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf511e53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xcb0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0387337.JPG", cAlternateFileName="")) returned 1
	[0056.255] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.255] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0387337.JPG") returned -1
	[0056.255] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0387337.JPG") returned -1
	[0056.255] lstrcmpiA (lpString1="", lpString2="J0387337.JPG") returned -1
	[0056.255] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG") returned="J0386764.JPG"
	[0056.255] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.255] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.255] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.255] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.255] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0387337.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387337.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387337.JPG"
	[0056.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387337.JPG", pszSpec="*.zip") returned 0
	[0056.255] lstrlenA (lpString="*.zip") returned 5
	[0056.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387337.JPG", pszSpec="*.rar") returned 0
	[0056.255] lstrlenA (lpString="*.rar") returned 5
	[0056.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387337.JPG", pszSpec="*.7z") returned 0
	[0056.255] lstrlenA (lpString="*.7z") returned 4
	[0056.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387337.JPG", pszSpec="*.tar") returned 0
	[0056.255] lstrlenA (lpString="*.tar") returned 5
	[0056.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387337.JPG", pszSpec="*.gzip") returned 0
	[0056.255] lstrlenA (lpString="*.gzip") returned 6
	[0056.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387337.JPG", pszSpec="*.jpg") returned 1
	[0056.255] lstrlenA (lpString="*.jpg") returned 5
	[0056.255] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387337.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387337.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387337.JPG"
	[0056.255] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387337.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387337.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387337.JPG"
	[0056.255] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387337.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387337.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387337.JPG."
	[0056.255] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387337.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387337.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387337.JPG.exe"
	[0056.255] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387337.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.256] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcb0a
	[0056.256] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8)) returned 1
	[0056.256] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.256] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xcac8, lpOverlapped=0x0) returned 1
	[0056.257] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387337.JPG") returned="J0387337.JPG"
	[0056.258] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.258] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xcac8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xcac8, lpOverlapped=0x0) returned 1
	[0056.258] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.258] CloseHandle (hObject=0x214) returned 1
	[0056.260] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387337.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387337.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387337.jpg.exe")) returned 1
	[0056.261] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf511e53, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf511e53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf511e53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6cec, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0387578.JPG", cAlternateFileName="")) returned 1
	[0056.261] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.261] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0387578.JPG") returned -1
	[0056.261] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0387578.JPG") returned -1
	[0056.261] lstrcmpiA (lpString1="", lpString2="J0387578.JPG") returned -1
	[0056.261] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387337.JPG") returned="J0387337.JPG"
	[0056.261] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.261] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.261] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.261] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.261] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0387578.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG"
	[0056.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG", pszSpec="*.zip") returned 0
	[0056.261] lstrlenA (lpString="*.zip") returned 5
	[0056.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG", pszSpec="*.rar") returned 0
	[0056.261] lstrlenA (lpString="*.rar") returned 5
	[0056.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG", pszSpec="*.7z") returned 0
	[0056.261] lstrlenA (lpString="*.7z") returned 4
	[0056.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG", pszSpec="*.tar") returned 0
	[0056.261] lstrlenA (lpString="*.tar") returned 5
	[0056.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG", pszSpec="*.gzip") returned 0
	[0056.261] lstrlenA (lpString="*.gzip") returned 6
	[0056.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG", pszSpec="*.jpg") returned 1
	[0056.261] lstrlenA (lpString="*.jpg") returned 5
	[0056.261] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG"
	[0056.261] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG"
	[0056.261] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG."
	[0056.261] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG.exe"
	[0056.262] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387578.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.262] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6cec
	[0056.262] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8)) returned 1
	[0056.262] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.262] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x6caa, lpOverlapped=0x0) returned 1
	[0056.264] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG") returned="J0387578.JPG"
	[0056.264] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.264] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x6caa, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x6caa, lpOverlapped=0x0) returned 1
	[0056.264] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.264] CloseHandle (hObject=0x214) returned 1
	[0056.265] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387578.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387578.jpg.exe")) returned 1
	[0056.266] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf511e53, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf511e53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf511e53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x98c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0387591.JPG", cAlternateFileName="")) returned 1
	[0056.266] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.266] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0387591.JPG") returned -1
	[0056.266] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0387591.JPG") returned -1
	[0056.266] lstrcmpiA (lpString1="", lpString2="J0387591.JPG") returned -1
	[0056.266] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG") returned="J0387578.JPG"
	[0056.266] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.266] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.266] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.266] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.267] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0387591.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG"
	[0056.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG", pszSpec="*.zip") returned 0
	[0056.267] lstrlenA (lpString="*.zip") returned 5
	[0056.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG", pszSpec="*.rar") returned 0
	[0056.267] lstrlenA (lpString="*.rar") returned 5
	[0056.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG", pszSpec="*.7z") returned 0
	[0056.267] lstrlenA (lpString="*.7z") returned 4
	[0056.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG", pszSpec="*.tar") returned 0
	[0056.267] lstrlenA (lpString="*.tar") returned 5
	[0056.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG", pszSpec="*.gzip") returned 0
	[0056.267] lstrlenA (lpString="*.gzip") returned 6
	[0056.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG", pszSpec="*.jpg") returned 1
	[0056.267] lstrlenA (lpString="*.jpg") returned 5
	[0056.267] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG"
	[0056.267] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG"
	[0056.267] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG."
	[0056.267] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG.exe"
	[0056.267] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387591.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.267] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x98c7
	[0056.267] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8)) returned 1
	[0056.267] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.267] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x9885, lpOverlapped=0x0) returned 1
	[0056.269] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG") returned="J0387591.JPG"
	[0056.269] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.269] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x9885, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x9885, lpOverlapped=0x0) returned 1
	[0056.269] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.269] CloseHandle (hObject=0x214) returned 1
	[0056.271] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387591.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387591.jpg.exe")) returned 1
	[0056.271] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf511e53, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf511e53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf511e53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb9bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0387604.JPG", cAlternateFileName="")) returned 1
	[0056.271] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.271] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0387604.JPG") returned -1
	[0056.271] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0387604.JPG") returned -1
	[0056.271] lstrcmpiA (lpString1="", lpString2="J0387604.JPG") returned -1
	[0056.271] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG") returned="J0387591.JPG"
	[0056.272] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.272] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.272] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.272] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.272] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0387604.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG"
	[0056.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG", pszSpec="*.zip") returned 0
	[0056.272] lstrlenA (lpString="*.zip") returned 5
	[0056.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG", pszSpec="*.rar") returned 0
	[0056.272] lstrlenA (lpString="*.rar") returned 5
	[0056.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG", pszSpec="*.7z") returned 0
	[0056.272] lstrlenA (lpString="*.7z") returned 4
	[0056.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG", pszSpec="*.tar") returned 0
	[0056.272] lstrlenA (lpString="*.tar") returned 5
	[0056.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG", pszSpec="*.gzip") returned 0
	[0056.272] lstrlenA (lpString="*.gzip") returned 6
	[0056.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG", pszSpec="*.jpg") returned 1
	[0056.272] lstrlenA (lpString="*.jpg") returned 5
	[0056.272] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG"
	[0056.272] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG"
	[0056.272] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG."
	[0056.272] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG.exe"
	[0056.272] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387604.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.272] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9bf
	[0056.272] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8)) returned 1
	[0056.272] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.273] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xb97d, lpOverlapped=0x0) returned 1
	[0056.274] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG") returned="J0387604.JPG"
	[0056.274] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.274] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xb97d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xb97d, lpOverlapped=0x0) returned 1
	[0056.275] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.275] CloseHandle (hObject=0x214) returned 1
	[0056.276] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387604.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387604.jpg.exe")) returned 1
	[0056.277] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5380be, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5380be, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5380be, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x98ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0387882.JPG", cAlternateFileName="")) returned 1
	[0056.277] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.277] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0387882.JPG") returned -1
	[0056.277] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0387882.JPG") returned -1
	[0056.277] lstrcmpiA (lpString1="", lpString2="J0387882.JPG") returned -1
	[0056.277] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG") returned="J0387604.JPG"
	[0056.277] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.277] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.277] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.277] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.277] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0387882.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG"
	[0056.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG", pszSpec="*.zip") returned 0
	[0056.277] lstrlenA (lpString="*.zip") returned 5
	[0056.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG", pszSpec="*.rar") returned 0
	[0056.277] lstrlenA (lpString="*.rar") returned 5
	[0056.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG", pszSpec="*.7z") returned 0
	[0056.277] lstrlenA (lpString="*.7z") returned 4
	[0056.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG", pszSpec="*.tar") returned 0
	[0056.277] lstrlenA (lpString="*.tar") returned 5
	[0056.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG", pszSpec="*.gzip") returned 0
	[0056.277] lstrlenA (lpString="*.gzip") returned 6
	[0056.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG", pszSpec="*.jpg") returned 1
	[0056.277] lstrlenA (lpString="*.jpg") returned 5
	[0056.278] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG"
	[0056.278] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG"
	[0056.278] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG."
	[0056.278] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG.exe"
	[0056.278] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387882.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.279] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x98ec
	[0056.279] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf5380be, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf5380be, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf5380be, dwHighDateTime=0x1d327e8)) returned 1
	[0056.279] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.279] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x98aa, lpOverlapped=0x0) returned 1
	[0056.280] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG") returned="J0387882.JPG"
	[0056.280] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.280] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x98aa, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x98aa, lpOverlapped=0x0) returned 1
	[0056.281] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.281] CloseHandle (hObject=0x214) returned 1
	[0056.282] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387882.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387882.jpg.exe")) returned 1
	[0056.283] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5380be, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5380be, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5380be, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7df3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0387895.JPG", cAlternateFileName="")) returned 1
	[0056.283] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.283] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0387895.JPG") returned -1
	[0056.283] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0387895.JPG") returned -1
	[0056.283] lstrcmpiA (lpString1="", lpString2="J0387895.JPG") returned -1
	[0056.283] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG") returned="J0387882.JPG"
	[0056.283] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.283] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.283] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.283] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.283] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0387895.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387895.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387895.JPG"
	[0056.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387895.JPG", pszSpec="*.zip") returned 0
	[0056.283] lstrlenA (lpString="*.zip") returned 5
	[0056.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387895.JPG", pszSpec="*.rar") returned 0
	[0056.283] lstrlenA (lpString="*.rar") returned 5
	[0056.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387895.JPG", pszSpec="*.7z") returned 0
	[0056.283] lstrlenA (lpString="*.7z") returned 4
	[0056.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387895.JPG", pszSpec="*.tar") returned 0
	[0056.283] lstrlenA (lpString="*.tar") returned 5
	[0056.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387895.JPG", pszSpec="*.gzip") returned 0
	[0056.283] lstrlenA (lpString="*.gzip") returned 6
	[0056.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387895.JPG", pszSpec="*.jpg") returned 1
	[0056.283] lstrlenA (lpString="*.jpg") returned 5
	[0056.283] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387895.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387895.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387895.JPG"
	[0056.283] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387895.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387895.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387895.JPG"
	[0056.283] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387895.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387895.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387895.JPG."
	[0056.283] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387895.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387895.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387895.JPG.exe"
	[0056.283] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.319] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7df3
	[0056.321] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf5380be, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf5380be, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf5380be, dwHighDateTime=0x1d327e8)) returned 1
	[0056.334] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.336] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7db1, lpOverlapped=0x0) returned 1
	[0056.338] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387895.JPG") returned="J0387895.JPG"
	[0056.338] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.338] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7db1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7db1, lpOverlapped=0x0) returned 1
	[0056.338] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.338] CloseHandle (hObject=0x214) returned 1
	[0056.340] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387895.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387895.jpg.exe")) returned 1
	[0056.341] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5380be, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5380be, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5380be, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x351c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0390072.JPG", cAlternateFileName="")) returned 1
	[0056.341] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.341] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0390072.JPG") returned -1
	[0056.341] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0390072.JPG") returned -1
	[0056.341] lstrcmpiA (lpString1="", lpString2="J0390072.JPG") returned -1
	[0056.341] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387895.JPG") returned="J0387895.JPG"
	[0056.341] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.341] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.341] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.341] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.341] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0390072.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG"
	[0056.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG", pszSpec="*.zip") returned 0
	[0056.341] lstrlenA (lpString="*.zip") returned 5
	[0056.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG", pszSpec="*.rar") returned 0
	[0056.341] lstrlenA (lpString="*.rar") returned 5
	[0056.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG", pszSpec="*.7z") returned 0
	[0056.341] lstrlenA (lpString="*.7z") returned 4
	[0056.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG", pszSpec="*.tar") returned 0
	[0056.341] lstrlenA (lpString="*.tar") returned 5
	[0056.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG", pszSpec="*.gzip") returned 0
	[0056.341] lstrlenA (lpString="*.gzip") returned 6
	[0056.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG", pszSpec="*.jpg") returned 1
	[0056.341] lstrlenA (lpString="*.jpg") returned 5
	[0056.342] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG"
	[0056.342] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG"
	[0056.342] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG."
	[0056.342] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG.exe"
	[0056.342] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0390072.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.344] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x351c
	[0056.344] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf5380be, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf5380be, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf5380be, dwHighDateTime=0x1d327e8)) returned 1
	[0056.344] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.344] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x34da, lpOverlapped=0x0) returned 1
	[0056.345] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG") returned="J0390072.JPG"
	[0056.345] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.345] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x34da, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x34da, lpOverlapped=0x0) returned 1
	[0056.345] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.346] CloseHandle (hObject=0x214) returned 1
	[0056.347] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0390072.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0390072.jpg.exe")) returned 1
	[0056.347] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5380be, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5380be, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5380be, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x31883, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0400001.PNG", cAlternateFileName="")) returned 1
	[0056.348] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.348] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0400001.PNG") returned -1
	[0056.348] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0400001.PNG") returned -1
	[0056.348] lstrcmpiA (lpString1="", lpString2="J0400001.PNG") returned -1
	[0056.348] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG") returned="J0390072.JPG"
	[0056.348] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.348] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.348] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.349] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.349] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0400001.PNG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG"
	[0056.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG", pszSpec="*.zip") returned 0
	[0056.349] lstrlenA (lpString="*.zip") returned 5
	[0056.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG", pszSpec="*.rar") returned 0
	[0056.349] lstrlenA (lpString="*.rar") returned 5
	[0056.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG", pszSpec="*.7z") returned 0
	[0056.349] lstrlenA (lpString="*.7z") returned 4
	[0056.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG", pszSpec="*.tar") returned 0
	[0056.349] lstrlenA (lpString="*.tar") returned 5
	[0056.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG", pszSpec="*.gzip") returned 0
	[0056.349] lstrlenA (lpString="*.gzip") returned 6
	[0056.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG", pszSpec="*.jpg") returned 0
	[0056.349] lstrlenA (lpString="*.jpg") returned 5
	[0056.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG", pszSpec="*.jpeg") returned 0
	[0056.349] lstrlenA (lpString="*.jpeg") returned 6
	[0056.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG", pszSpec="*.bmp") returned 0
	[0056.349] lstrlenA (lpString="*.bmp") returned 5
	[0056.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG", pszSpec="*.gif") returned 0
	[0056.349] lstrlenA (lpString="*.gif") returned 5
	[0056.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG", pszSpec="*.png") returned 1
	[0056.349] lstrlenA (lpString="*.png") returned 5
	[0056.349] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG"
	[0056.349] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG"
	[0056.349] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG."
	[0056.349] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG.exe"
	[0056.349] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400001.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.350] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x31883
	[0056.350] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf5380be, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf5380be, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf5380be, dwHighDateTime=0x1d327e8)) returned 1
	[0056.350] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.350] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x31841, lpOverlapped=0x0) returned 1
	[0056.353] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG") returned="J0400001.PNG"
	[0056.353] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.353] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x31841, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x31841, lpOverlapped=0x0) returned 1
	[0056.354] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.354] CloseHandle (hObject=0x214) returned 1
	[0056.358] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400001.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400001.png.exe")) returned 1
	[0056.359] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5380be, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5380be, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5380be, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x15d49, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0400002.PNG", cAlternateFileName="")) returned 1
	[0056.359] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.359] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0400002.PNG") returned -1
	[0056.359] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0400002.PNG") returned -1
	[0056.359] lstrcmpiA (lpString1="", lpString2="J0400002.PNG") returned -1
	[0056.359] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG") returned="J0400001.PNG"
	[0056.359] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.359] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.359] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.359] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.359] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0400002.PNG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG"
	[0056.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG", pszSpec="*.zip") returned 0
	[0056.359] lstrlenA (lpString="*.zip") returned 5
	[0056.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG", pszSpec="*.rar") returned 0
	[0056.359] lstrlenA (lpString="*.rar") returned 5
	[0056.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG", pszSpec="*.7z") returned 0
	[0056.359] lstrlenA (lpString="*.7z") returned 4
	[0056.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG", pszSpec="*.tar") returned 0
	[0056.359] lstrlenA (lpString="*.tar") returned 5
	[0056.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG", pszSpec="*.gzip") returned 0
	[0056.359] lstrlenA (lpString="*.gzip") returned 6
	[0056.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG", pszSpec="*.jpg") returned 0
	[0056.359] lstrlenA (lpString="*.jpg") returned 5
	[0056.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG", pszSpec="*.jpeg") returned 0
	[0056.359] lstrlenA (lpString="*.jpeg") returned 6
	[0056.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG", pszSpec="*.bmp") returned 0
	[0056.359] lstrlenA (lpString="*.bmp") returned 5
	[0056.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG", pszSpec="*.gif") returned 0
	[0056.359] lstrlenA (lpString="*.gif") returned 5
	[0056.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG", pszSpec="*.png") returned 1
	[0056.359] lstrlenA (lpString="*.png") returned 5
	[0056.360] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG"
	[0056.360] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG"
	[0056.360] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG."
	[0056.360] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG.exe"
	[0056.360] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400002.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.360] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15d49
	[0056.360] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf5380be, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf5380be, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf5380be, dwHighDateTime=0x1d327e8)) returned 1
	[0056.360] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.360] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x15d07, lpOverlapped=0x0) returned 1
	[0056.362] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG") returned="J0400002.PNG"
	[0056.362] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.362] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x15d07, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x15d07, lpOverlapped=0x0) returned 1
	[0056.363] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.363] CloseHandle (hObject=0x214) returned 1
	[0056.365] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400002.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400002.png.exe")) returned 1
	[0056.366] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5380be, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5380be, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5380be, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1e836, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0400003.PNG", cAlternateFileName="")) returned 1
	[0056.366] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.366] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0400003.PNG") returned -1
	[0056.366] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0400003.PNG") returned -1
	[0056.366] lstrcmpiA (lpString1="", lpString2="J0400003.PNG") returned -1
	[0056.366] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG") returned="J0400002.PNG"
	[0056.366] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.366] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.366] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.366] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.366] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0400003.PNG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400003.PNG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400003.PNG"
	[0056.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400003.PNG", pszSpec="*.zip") returned 0
	[0056.366] lstrlenA (lpString="*.zip") returned 5
	[0056.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400003.PNG", pszSpec="*.rar") returned 0
	[0056.366] lstrlenA (lpString="*.rar") returned 5
	[0056.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400003.PNG", pszSpec="*.7z") returned 0
	[0056.366] lstrlenA (lpString="*.7z") returned 4
	[0056.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400003.PNG", pszSpec="*.tar") returned 0
	[0056.366] lstrlenA (lpString="*.tar") returned 5
	[0056.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400003.PNG", pszSpec="*.gzip") returned 0
	[0056.366] lstrlenA (lpString="*.gzip") returned 6
	[0056.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400003.PNG", pszSpec="*.jpg") returned 0
	[0056.366] lstrlenA (lpString="*.jpg") returned 5
	[0056.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400003.PNG", pszSpec="*.jpeg") returned 0
	[0056.366] lstrlenA (lpString="*.jpeg") returned 6
	[0056.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400003.PNG", pszSpec="*.bmp") returned 0
	[0056.366] lstrlenA (lpString="*.bmp") returned 5
	[0056.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400003.PNG", pszSpec="*.gif") returned 0
	[0056.367] lstrlenA (lpString="*.gif") returned 5
	[0056.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400003.PNG", pszSpec="*.png") returned 1
	[0056.367] lstrlenA (lpString="*.png") returned 5
	[0056.367] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400003.PNG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400003.PNG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400003.PNG"
	[0056.367] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400003.PNG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400003.PNG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400003.PNG"
	[0056.367] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400003.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400003.PNG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400003.PNG."
	[0056.367] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400003.PNG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400003.PNG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400003.PNG.exe"
	[0056.367] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400003.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.368] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1e836
	[0056.368] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf5380be, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf5380be, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf5380be, dwHighDateTime=0x1d327e8)) returned 1
	[0056.368] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.368] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1e7f4, lpOverlapped=0x0) returned 1
	[0056.370] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400003.PNG") returned="J0400003.PNG"
	[0056.371] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.371] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1e7f4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1e7f4, lpOverlapped=0x0) returned 1
	[0056.371] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.371] CloseHandle (hObject=0x214) returned 1
	[0056.427] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400003.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400003.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400003.png.exe")) returned 1
	[0056.428] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf511e53, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf511e53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf511e53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x19a5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0400004.PNG", cAlternateFileName="")) returned 1
	[0056.428] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.428] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0400004.PNG") returned -1
	[0056.428] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0400004.PNG") returned -1
	[0056.428] lstrcmpiA (lpString1="", lpString2="J0400004.PNG") returned -1
	[0056.428] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400003.PNG") returned="J0400003.PNG"
	[0056.428] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.428] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.428] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.428] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.428] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0400004.PNG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG"
	[0056.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG", pszSpec="*.zip") returned 0
	[0056.428] lstrlenA (lpString="*.zip") returned 5
	[0056.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG", pszSpec="*.rar") returned 0
	[0056.428] lstrlenA (lpString="*.rar") returned 5
	[0056.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG", pszSpec="*.7z") returned 0
	[0056.428] lstrlenA (lpString="*.7z") returned 4
	[0056.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG", pszSpec="*.tar") returned 0
	[0056.429] lstrlenA (lpString="*.tar") returned 5
	[0056.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG", pszSpec="*.gzip") returned 0
	[0056.429] lstrlenA (lpString="*.gzip") returned 6
	[0056.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG", pszSpec="*.jpg") returned 0
	[0056.429] lstrlenA (lpString="*.jpg") returned 5
	[0056.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG", pszSpec="*.jpeg") returned 0
	[0056.429] lstrlenA (lpString="*.jpeg") returned 6
	[0056.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG", pszSpec="*.bmp") returned 0
	[0056.429] lstrlenA (lpString="*.bmp") returned 5
	[0056.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG", pszSpec="*.gif") returned 0
	[0056.429] lstrlenA (lpString="*.gif") returned 5
	[0056.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG", pszSpec="*.png") returned 1
	[0056.429] lstrlenA (lpString="*.png") returned 5
	[0056.429] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG"
	[0056.429] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG"
	[0056.429] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG."
	[0056.429] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG.exe"
	[0056.429] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400004.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.429] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19a5d
	[0056.429] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf511e53, dwHighDateTime=0x1d327e8)) returned 1
	[0056.429] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.429] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x19a1b, lpOverlapped=0x0) returned 1
	[0056.431] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG") returned="J0400004.PNG"
	[0056.432] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.432] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x19a1b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x19a1b, lpOverlapped=0x0) returned 1
	[0056.432] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.432] CloseHandle (hObject=0x214) returned 1
	[0056.435] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400004.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400004.png.exe")) returned 1
	[0056.436] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5380be, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5380be, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5380be, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17742, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0400005.PNG", cAlternateFileName="")) returned 1
	[0056.436] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.436] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0400005.PNG") returned -1
	[0056.436] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0400005.PNG") returned -1
	[0056.436] lstrcmpiA (lpString1="", lpString2="J0400005.PNG") returned -1
	[0056.436] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG") returned="J0400004.PNG"
	[0056.436] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.436] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.436] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.436] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.436] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="J0400005.PNG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG"
	[0056.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG", pszSpec="*.zip") returned 0
	[0056.436] lstrlenA (lpString="*.zip") returned 5
	[0056.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG", pszSpec="*.rar") returned 0
	[0056.436] lstrlenA (lpString="*.rar") returned 5
	[0056.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG", pszSpec="*.7z") returned 0
	[0056.436] lstrlenA (lpString="*.7z") returned 4
	[0056.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG", pszSpec="*.tar") returned 0
	[0056.436] lstrlenA (lpString="*.tar") returned 5
	[0056.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG", pszSpec="*.gzip") returned 0
	[0056.436] lstrlenA (lpString="*.gzip") returned 6
	[0056.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG", pszSpec="*.jpg") returned 0
	[0056.436] lstrlenA (lpString="*.jpg") returned 5
	[0056.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG", pszSpec="*.jpeg") returned 0
	[0056.436] lstrlenA (lpString="*.jpeg") returned 6
	[0056.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG", pszSpec="*.bmp") returned 0
	[0056.437] lstrlenA (lpString="*.bmp") returned 5
	[0056.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG", pszSpec="*.gif") returned 0
	[0056.437] lstrlenA (lpString="*.gif") returned 5
	[0056.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG", pszSpec="*.png") returned 1
	[0056.437] lstrlenA (lpString="*.png") returned 5
	[0056.437] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG"
	[0056.437] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG"
	[0056.437] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG."
	[0056.437] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG.exe"
	[0056.437] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400005.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.437] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17742
	[0056.437] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf5380be, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf5380be, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf5380be, dwHighDateTime=0x1d327e8)) returned 1
	[0056.437] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.437] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x17700, lpOverlapped=0x0) returned 1
	[0056.439] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG") returned="J0400005.PNG"
	[0056.439] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.439] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x17700, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x17700, lpOverlapped=0x0) returned 1
	[0056.440] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.440] CloseHandle (hObject=0x214) returned 1
	[0056.442] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400005.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400005.png.exe")) returned 1
	[0056.442] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf511e53, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf511e53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5380be, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2645, dwReserved0=0x0, dwReserved1=0x0, cFileName="JAVA_01.MID", cAlternateFileName="")) returned 1
	[0056.442] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.442] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="JAVA_01.MID") returned -1
	[0056.442] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="JAVA_01.MID") returned -1
	[0056.442] lstrcmpiA (lpString1="", lpString2="JAVA_01.MID") returned -1
	[0056.442] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG") returned="J0400005.PNG"
	[0056.442] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.442] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.443] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.443] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.443] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="JAVA_01.MID" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID"
	[0056.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.zip") returned 0
	[0056.443] lstrlenA (lpString="*.zip") returned 5
	[0056.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.rar") returned 0
	[0056.443] lstrlenA (lpString="*.rar") returned 5
	[0056.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.7z") returned 0
	[0056.443] lstrlenA (lpString="*.7z") returned 4
	[0056.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.tar") returned 0
	[0056.443] lstrlenA (lpString="*.tar") returned 5
	[0056.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.gzip") returned 0
	[0056.443] lstrlenA (lpString="*.gzip") returned 6
	[0056.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.jpg") returned 0
	[0056.443] lstrlenA (lpString="*.jpg") returned 5
	[0056.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.jpeg") returned 0
	[0056.443] lstrlenA (lpString="*.jpeg") returned 6
	[0056.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.bmp") returned 0
	[0056.443] lstrlenA (lpString="*.bmp") returned 5
	[0056.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.gif") returned 0
	[0056.443] lstrlenA (lpString="*.gif") returned 5
	[0056.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.png") returned 0
	[0056.443] lstrlenA (lpString="*.png") returned 5
	[0056.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.doc") returned 0
	[0056.443] lstrlenA (lpString="*.doc") returned 5
	[0056.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.docx") returned 0
	[0056.443] lstrlenA (lpString="*.docx") returned 6
	[0056.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.xls") returned 0
	[0056.443] lstrlenA (lpString="*.xls") returned 5
	[0056.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.xlsx") returned 0
	[0056.443] lstrlenA (lpString="*.xlsx") returned 6
	[0056.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.ppt") returned 0
	[0056.443] lstrlenA (lpString="*.ppt") returned 5
	[0056.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.pptx") returned 0
	[0056.443] lstrlenA (lpString="*.pptx") returned 6
	[0056.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.txt") returned 0
	[0056.444] lstrlenA (lpString="*.txt") returned 5
	[0056.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.pdf") returned 0
	[0056.444] lstrlenA (lpString="*.pdf") returned 5
	[0056.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.htm") returned 0
	[0056.444] lstrlenA (lpString="*.htm") returned 5
	[0056.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.html") returned 0
	[0056.444] lstrlenA (lpString="*.html") returned 6
	[0056.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.mdb") returned 0
	[0056.444] lstrlenA (lpString="*.mdb") returned 5
	[0056.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.pfx") returned 0
	[0056.444] lstrlenA (lpString="*.pfx") returned 5
	[0056.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.md") returned 0
	[0056.444] lstrlenA (lpString="*.md") returned 4
	[0056.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.lnk") returned 0
	[0056.444] lstrlenA (lpString="*.lnk") returned 5
	[0056.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.torrent") returned 0
	[0056.444] lstrlenA (lpString="*.torrent") returned 9
	[0056.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.mov") returned 0
	[0056.444] lstrlenA (lpString="*.mov") returned 5
	[0056.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.3gp") returned 0
	[0056.444] lstrlenA (lpString="*.3gp") returned 5
	[0056.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.mpeg") returned 0
	[0056.444] lstrlenA (lpString="*.mpeg") returned 6
	[0056.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.mpg") returned 0
	[0056.444] lstrlenA (lpString="*.mpg") returned 5
	[0056.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.flv") returned 0
	[0056.444] lstrlenA (lpString="*.flv") returned 5
	[0056.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.avi") returned 0
	[0056.444] lstrlenA (lpString="*.avi") returned 5
	[0056.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.mp4") returned 0
	[0056.444] lstrlenA (lpString="*.mp4") returned 5
	[0056.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.wmv") returned 0
	[0056.444] lstrlenA (lpString="*.wmv") returned 5
	[0056.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.mkv") returned 0
	[0056.444] lstrlenA (lpString="*.mkv") returned 5
	[0056.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.mp3") returned 0
	[0056.444] lstrlenA (lpString="*.mp3") returned 5
	[0056.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.wav") returned 0
	[0056.445] lstrlenA (lpString="*.wav") returned 5
	[0056.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.flac") returned 0
	[0056.445] lstrlenA (lpString="*.flac") returned 6
	[0056.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.wma") returned 0
	[0056.445] lstrlenA (lpString="*.wma") returned 5
	[0056.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.au3") returned 0
	[0056.445] lstrlenA (lpString="*.au3") returned 5
	[0056.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.ahk") returned 0
	[0056.445] lstrlenA (lpString="*.ahk") returned 5
	[0056.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.c") returned 0
	[0056.445] lstrlenA (lpString="*.c") returned 3
	[0056.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.cc") returned 0
	[0056.445] lstrlenA (lpString="*.cc") returned 4
	[0056.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.cpp") returned 0
	[0056.445] lstrlenA (lpString="*.cpp") returned 5
	[0056.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.cxx") returned 0
	[0056.445] lstrlenA (lpString="*.cxx") returned 5
	[0056.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.c++") returned 0
	[0056.445] lstrlenA (lpString="*.c++") returned 5
	[0056.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.cs") returned 0
	[0056.445] lstrlenA (lpString="*.cs") returned 4
	[0056.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.vb") returned 0
	[0056.445] lstrlenA (lpString="*.vb") returned 4
	[0056.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.bas") returned 0
	[0056.445] lstrlenA (lpString="*.bas") returned 5
	[0056.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.csproj") returned 0
	[0056.445] lstrlenA (lpString="*.csproj") returned 8
	[0056.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.vbproj") returned 0
	[0056.445] lstrlenA (lpString="*.vbproj") returned 8
	[0056.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.vcxproj") returned 0
	[0056.445] lstrlenA (lpString="*.vcxproj") returned 9
	[0056.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.manifest") returned 0
	[0056.445] lstrlenA (lpString="*.manifest") returned 10
	[0056.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.php") returned 0
	[0056.445] lstrlenA (lpString="*.php") returned 5
	[0056.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.vbe") returned 0
	[0056.445] lstrlenA (lpString="*.vbe") returned 5
	[0056.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.vba") returned 0
	[0056.446] lstrlenA (lpString="*.vba") returned 5
	[0056.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.vbs") returned 0
	[0056.446] lstrlenA (lpString="*.vbs") returned 5
	[0056.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.bat") returned 0
	[0056.446] lstrlenA (lpString="*.bat") returned 5
	[0056.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.cmd") returned 0
	[0056.446] lstrlenA (lpString="*.cmd") returned 5
	[0056.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.js") returned 0
	[0056.446] lstrlenA (lpString="*.js") returned 4
	[0056.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.jscript") returned 0
	[0056.446] lstrlenA (lpString="*.jscript") returned 9
	[0056.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.hta") returned 0
	[0056.446] lstrlenA (lpString="*.hta") returned 5
	[0056.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.php7") returned 0
	[0056.446] lstrlenA (lpString="*.php7") returned 6
	[0056.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.db") returned 0
	[0056.446] lstrlenA (lpString="*.db") returned 4
	[0056.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.swf") returned 0
	[0056.446] lstrlenA (lpString="*.swf") returned 5
	[0056.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.eml") returned 0
	[0056.446] lstrlenA (lpString="*.eml") returned 5
	[0056.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.part") returned 0
	[0056.446] lstrlenA (lpString="*.part") returned 6
	[0056.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.nfo") returned 0
	[0056.446] lstrlenA (lpString="*.nfo") returned 5
	[0056.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.rsa") returned 0
	[0056.446] lstrlenA (lpString="*.rsa") returned 5
	[0056.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.key") returned 0
	[0056.446] lstrlenA (lpString="*.key") returned 5
	[0056.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.aes") returned 0
	[0056.446] lstrlenA (lpString="*.aes") returned 5
	[0056.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.blob") returned 0
	[0056.446] lstrlenA (lpString="*.blob") returned 6
	[0056.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.btc") returned 0
	[0056.446] lstrlenA (lpString="*.btc") returned 5
	[0056.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID", pszSpec="*.wallet") returned 0
	[0056.447] lstrlenA (lpString="*.wallet") returned 8
	[0056.447] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf511e53, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf511e53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf511e53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x16d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="JNGLE_01.MID", cAlternateFileName="")) returned 1
	[0056.447] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.447] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="JNGLE_01.MID") returned -1
	[0056.447] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="JNGLE_01.MID") returned -1
	[0056.447] lstrcmpiA (lpString1="", lpString2="JNGLE_01.MID") returned -1
	[0056.447] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned="JAVA_01.MID"
	[0056.447] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.447] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.447] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.447] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.447] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="JNGLE_01.MID" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID"
	[0056.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.zip") returned 0
	[0056.447] lstrlenA (lpString="*.zip") returned 5
	[0056.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.rar") returned 0
	[0056.447] lstrlenA (lpString="*.rar") returned 5
	[0056.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.7z") returned 0
	[0056.447] lstrlenA (lpString="*.7z") returned 4
	[0056.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.tar") returned 0
	[0056.447] lstrlenA (lpString="*.tar") returned 5
	[0056.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.gzip") returned 0
	[0056.447] lstrlenA (lpString="*.gzip") returned 6
	[0056.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.jpg") returned 0
	[0056.447] lstrlenA (lpString="*.jpg") returned 5
	[0056.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.jpeg") returned 0
	[0056.447] lstrlenA (lpString="*.jpeg") returned 6
	[0056.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.bmp") returned 0
	[0056.447] lstrlenA (lpString="*.bmp") returned 5
	[0056.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.gif") returned 0
	[0056.447] lstrlenA (lpString="*.gif") returned 5
	[0056.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.png") returned 0
	[0056.447] lstrlenA (lpString="*.png") returned 5
	[0056.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.doc") returned 0
	[0056.447] lstrlenA (lpString="*.doc") returned 5
	[0056.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.docx") returned 0
	[0056.447] lstrlenA (lpString="*.docx") returned 6
	[0056.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.xls") returned 0
	[0056.448] lstrlenA (lpString="*.xls") returned 5
	[0056.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.xlsx") returned 0
	[0056.448] lstrlenA (lpString="*.xlsx") returned 6
	[0056.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.ppt") returned 0
	[0056.448] lstrlenA (lpString="*.ppt") returned 5
	[0056.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.pptx") returned 0
	[0056.448] lstrlenA (lpString="*.pptx") returned 6
	[0056.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.txt") returned 0
	[0056.448] lstrlenA (lpString="*.txt") returned 5
	[0056.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.pdf") returned 0
	[0056.448] lstrlenA (lpString="*.pdf") returned 5
	[0056.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.htm") returned 0
	[0056.448] lstrlenA (lpString="*.htm") returned 5
	[0056.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.html") returned 0
	[0056.448] lstrlenA (lpString="*.html") returned 6
	[0056.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.mdb") returned 0
	[0056.448] lstrlenA (lpString="*.mdb") returned 5
	[0056.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.pfx") returned 0
	[0056.448] lstrlenA (lpString="*.pfx") returned 5
	[0056.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.md") returned 0
	[0056.448] lstrlenA (lpString="*.md") returned 4
	[0056.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.lnk") returned 0
	[0056.448] lstrlenA (lpString="*.lnk") returned 5
	[0056.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.torrent") returned 0
	[0056.448] lstrlenA (lpString="*.torrent") returned 9
	[0056.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.mov") returned 0
	[0056.448] lstrlenA (lpString="*.mov") returned 5
	[0056.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.3gp") returned 0
	[0056.448] lstrlenA (lpString="*.3gp") returned 5
	[0056.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.mpeg") returned 0
	[0056.448] lstrlenA (lpString="*.mpeg") returned 6
	[0056.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.mpg") returned 0
	[0056.448] lstrlenA (lpString="*.mpg") returned 5
	[0056.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.flv") returned 0
	[0056.448] lstrlenA (lpString="*.flv") returned 5
	[0056.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.avi") returned 0
	[0056.449] lstrlenA (lpString="*.avi") returned 5
	[0056.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.mp4") returned 0
	[0056.449] lstrlenA (lpString="*.mp4") returned 5
	[0056.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.wmv") returned 0
	[0056.449] lstrlenA (lpString="*.wmv") returned 5
	[0056.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.mkv") returned 0
	[0056.449] lstrlenA (lpString="*.mkv") returned 5
	[0056.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.mp3") returned 0
	[0056.449] lstrlenA (lpString="*.mp3") returned 5
	[0056.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.wav") returned 0
	[0056.449] lstrlenA (lpString="*.wav") returned 5
	[0056.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.flac") returned 0
	[0056.449] lstrlenA (lpString="*.flac") returned 6
	[0056.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.wma") returned 0
	[0056.449] lstrlenA (lpString="*.wma") returned 5
	[0056.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.au3") returned 0
	[0056.449] lstrlenA (lpString="*.au3") returned 5
	[0056.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.ahk") returned 0
	[0056.449] lstrlenA (lpString="*.ahk") returned 5
	[0056.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.c") returned 0
	[0056.449] lstrlenA (lpString="*.c") returned 3
	[0056.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.cc") returned 0
	[0056.449] lstrlenA (lpString="*.cc") returned 4
	[0056.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.cpp") returned 0
	[0056.449] lstrlenA (lpString="*.cpp") returned 5
	[0056.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.cxx") returned 0
	[0056.449] lstrlenA (lpString="*.cxx") returned 5
	[0056.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.c++") returned 0
	[0056.449] lstrlenA (lpString="*.c++") returned 5
	[0056.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.cs") returned 0
	[0056.449] lstrlenA (lpString="*.cs") returned 4
	[0056.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.vb") returned 0
	[0056.449] lstrlenA (lpString="*.vb") returned 4
	[0056.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.bas") returned 0
	[0056.449] lstrlenA (lpString="*.bas") returned 5
	[0056.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.csproj") returned 0
	[0056.449] lstrlenA (lpString="*.csproj") returned 8
	[0056.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.vbproj") returned 0
	[0056.450] lstrlenA (lpString="*.vbproj") returned 8
	[0056.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.vcxproj") returned 0
	[0056.450] lstrlenA (lpString="*.vcxproj") returned 9
	[0056.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.manifest") returned 0
	[0056.450] lstrlenA (lpString="*.manifest") returned 10
	[0056.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.php") returned 0
	[0056.450] lstrlenA (lpString="*.php") returned 5
	[0056.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.vbe") returned 0
	[0056.450] lstrlenA (lpString="*.vbe") returned 5
	[0056.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.vba") returned 0
	[0056.450] lstrlenA (lpString="*.vba") returned 5
	[0056.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.vbs") returned 0
	[0056.450] lstrlenA (lpString="*.vbs") returned 5
	[0056.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.bat") returned 0
	[0056.450] lstrlenA (lpString="*.bat") returned 5
	[0056.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.cmd") returned 0
	[0056.450] lstrlenA (lpString="*.cmd") returned 5
	[0056.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.js") returned 0
	[0056.450] lstrlenA (lpString="*.js") returned 4
	[0056.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.jscript") returned 0
	[0056.450] lstrlenA (lpString="*.jscript") returned 9
	[0056.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.hta") returned 0
	[0056.450] lstrlenA (lpString="*.hta") returned 5
	[0056.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.php7") returned 0
	[0056.450] lstrlenA (lpString="*.php7") returned 6
	[0056.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.db") returned 0
	[0056.450] lstrlenA (lpString="*.db") returned 4
	[0056.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.swf") returned 0
	[0056.450] lstrlenA (lpString="*.swf") returned 5
	[0056.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.eml") returned 0
	[0056.450] lstrlenA (lpString="*.eml") returned 5
	[0056.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.part") returned 0
	[0056.450] lstrlenA (lpString="*.part") returned 6
	[0056.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.nfo") returned 0
	[0056.450] lstrlenA (lpString="*.nfo") returned 5
	[0056.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.rsa") returned 0
	[0056.451] lstrlenA (lpString="*.rsa") returned 5
	[0056.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.key") returned 0
	[0056.451] lstrlenA (lpString="*.key") returned 5
	[0056.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.aes") returned 0
	[0056.451] lstrlenA (lpString="*.aes") returned 5
	[0056.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.blob") returned 0
	[0056.451] lstrlenA (lpString="*.blob") returned 6
	[0056.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.btc") returned 0
	[0056.451] lstrlenA (lpString="*.btc") returned 5
	[0056.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID", pszSpec="*.wallet") returned 0
	[0056.451] lstrlenA (lpString="*.wallet") returned 8
	[0056.451] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf58455c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf58455c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf58455c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x15f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="MP00021_.WMF", cAlternateFileName="")) returned 1
	[0056.451] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.451] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="MP00021_.WMF") returned -1
	[0056.451] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="MP00021_.WMF") returned -1
	[0056.451] lstrcmpiA (lpString1="", lpString2="MP00021_.WMF") returned -1
	[0056.451] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned="JNGLE_01.MID"
	[0056.451] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.451] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.451] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.451] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.451] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="MP00021_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF"
	[0056.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.zip") returned 0
	[0056.451] lstrlenA (lpString="*.zip") returned 5
	[0056.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.rar") returned 0
	[0056.451] lstrlenA (lpString="*.rar") returned 5
	[0056.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.7z") returned 0
	[0056.451] lstrlenA (lpString="*.7z") returned 4
	[0056.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.tar") returned 0
	[0056.451] lstrlenA (lpString="*.tar") returned 5
	[0056.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.gzip") returned 0
	[0056.451] lstrlenA (lpString="*.gzip") returned 6
	[0056.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.jpg") returned 0
	[0056.451] lstrlenA (lpString="*.jpg") returned 5
	[0056.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.jpeg") returned 0
	[0056.452] lstrlenA (lpString="*.jpeg") returned 6
	[0056.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.bmp") returned 0
	[0056.452] lstrlenA (lpString="*.bmp") returned 5
	[0056.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.gif") returned 0
	[0056.452] lstrlenA (lpString="*.gif") returned 5
	[0056.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.png") returned 0
	[0056.452] lstrlenA (lpString="*.png") returned 5
	[0056.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.doc") returned 0
	[0056.452] lstrlenA (lpString="*.doc") returned 5
	[0056.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.docx") returned 0
	[0056.452] lstrlenA (lpString="*.docx") returned 6
	[0056.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.xls") returned 0
	[0056.452] lstrlenA (lpString="*.xls") returned 5
	[0056.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.xlsx") returned 0
	[0056.452] lstrlenA (lpString="*.xlsx") returned 6
	[0056.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.ppt") returned 0
	[0056.452] lstrlenA (lpString="*.ppt") returned 5
	[0056.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.pptx") returned 0
	[0056.452] lstrlenA (lpString="*.pptx") returned 6
	[0056.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.txt") returned 0
	[0056.452] lstrlenA (lpString="*.txt") returned 5
	[0056.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.pdf") returned 0
	[0056.452] lstrlenA (lpString="*.pdf") returned 5
	[0056.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.htm") returned 0
	[0056.452] lstrlenA (lpString="*.htm") returned 5
	[0056.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.html") returned 0
	[0056.452] lstrlenA (lpString="*.html") returned 6
	[0056.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.mdb") returned 0
	[0056.452] lstrlenA (lpString="*.mdb") returned 5
	[0056.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.pfx") returned 0
	[0056.452] lstrlenA (lpString="*.pfx") returned 5
	[0056.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.md") returned 0
	[0056.452] lstrlenA (lpString="*.md") returned 4
	[0056.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.lnk") returned 0
	[0056.452] lstrlenA (lpString="*.lnk") returned 5
	[0056.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.torrent") returned 0
	[0056.452] lstrlenA (lpString="*.torrent") returned 9
	[0056.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.mov") returned 0
	[0056.453] lstrlenA (lpString="*.mov") returned 5
	[0056.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.3gp") returned 0
	[0056.453] lstrlenA (lpString="*.3gp") returned 5
	[0056.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.mpeg") returned 0
	[0056.453] lstrlenA (lpString="*.mpeg") returned 6
	[0056.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.mpg") returned 0
	[0056.453] lstrlenA (lpString="*.mpg") returned 5
	[0056.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.flv") returned 0
	[0056.453] lstrlenA (lpString="*.flv") returned 5
	[0056.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.avi") returned 0
	[0056.453] lstrlenA (lpString="*.avi") returned 5
	[0056.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.mp4") returned 0
	[0056.453] lstrlenA (lpString="*.mp4") returned 5
	[0056.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.wmv") returned 0
	[0056.453] lstrlenA (lpString="*.wmv") returned 5
	[0056.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.mkv") returned 0
	[0056.453] lstrlenA (lpString="*.mkv") returned 5
	[0056.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.mp3") returned 0
	[0056.453] lstrlenA (lpString="*.mp3") returned 5
	[0056.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.wav") returned 0
	[0056.453] lstrlenA (lpString="*.wav") returned 5
	[0056.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.flac") returned 0
	[0056.453] lstrlenA (lpString="*.flac") returned 6
	[0056.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.wma") returned 0
	[0056.453] lstrlenA (lpString="*.wma") returned 5
	[0056.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.au3") returned 0
	[0056.453] lstrlenA (lpString="*.au3") returned 5
	[0056.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.ahk") returned 0
	[0056.453] lstrlenA (lpString="*.ahk") returned 5
	[0056.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.c") returned 0
	[0056.453] lstrlenA (lpString="*.c") returned 3
	[0056.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.cc") returned 0
	[0056.453] lstrlenA (lpString="*.cc") returned 4
	[0056.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.cpp") returned 0
	[0056.453] lstrlenA (lpString="*.cpp") returned 5
	[0056.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.cxx") returned 0
	[0056.454] lstrlenA (lpString="*.cxx") returned 5
	[0056.454] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.c++") returned 0
	[0056.454] lstrlenA (lpString="*.c++") returned 5
	[0056.454] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.cs") returned 0
	[0056.454] lstrlenA (lpString="*.cs") returned 4
	[0056.454] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.vb") returned 0
	[0056.454] lstrlenA (lpString="*.vb") returned 4
	[0056.454] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.bas") returned 0
	[0056.454] lstrlenA (lpString="*.bas") returned 5
	[0056.454] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.csproj") returned 0
	[0056.454] lstrlenA (lpString="*.csproj") returned 8
	[0056.454] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.vbproj") returned 0
	[0056.454] lstrlenA (lpString="*.vbproj") returned 8
	[0056.454] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.vcxproj") returned 0
	[0056.454] lstrlenA (lpString="*.vcxproj") returned 9
	[0056.454] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.manifest") returned 0
	[0056.454] lstrlenA (lpString="*.manifest") returned 10
	[0056.454] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.php") returned 0
	[0056.454] lstrlenA (lpString="*.php") returned 5
	[0056.454] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.vbe") returned 0
	[0056.454] lstrlenA (lpString="*.vbe") returned 5
	[0056.454] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.vba") returned 0
	[0056.454] lstrlenA (lpString="*.vba") returned 5
	[0056.454] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.vbs") returned 0
	[0056.454] lstrlenA (lpString="*.vbs") returned 5
	[0056.454] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.bat") returned 0
	[0056.454] lstrlenA (lpString="*.bat") returned 5
	[0056.454] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.cmd") returned 0
	[0056.454] lstrlenA (lpString="*.cmd") returned 5
	[0056.454] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.js") returned 0
	[0056.455] lstrlenA (lpString="*.js") returned 4
	[0056.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.jscript") returned 0
	[0056.455] lstrlenA (lpString="*.jscript") returned 9
	[0056.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.hta") returned 0
	[0056.455] lstrlenA (lpString="*.hta") returned 5
	[0056.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.php7") returned 0
	[0056.455] lstrlenA (lpString="*.php7") returned 6
	[0056.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.db") returned 0
	[0056.455] lstrlenA (lpString="*.db") returned 4
	[0056.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.swf") returned 0
	[0056.455] lstrlenA (lpString="*.swf") returned 5
	[0056.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.eml") returned 0
	[0056.455] lstrlenA (lpString="*.eml") returned 5
	[0056.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.part") returned 0
	[0056.455] lstrlenA (lpString="*.part") returned 6
	[0056.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.nfo") returned 0
	[0056.455] lstrlenA (lpString="*.nfo") returned 5
	[0056.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.rsa") returned 0
	[0056.455] lstrlenA (lpString="*.rsa") returned 5
	[0056.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.key") returned 0
	[0056.455] lstrlenA (lpString="*.key") returned 5
	[0056.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.aes") returned 0
	[0056.455] lstrlenA (lpString="*.aes") returned 5
	[0056.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.blob") returned 0
	[0056.455] lstrlenA (lpString="*.blob") returned 6
	[0056.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.btc") returned 0
	[0056.455] lstrlenA (lpString="*.btc") returned 5
	[0056.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF", pszSpec="*.wallet") returned 0
	[0056.455] lstrlenA (lpString="*.wallet") returned 8
	[0056.455] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf58455c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf58455c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf58455c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1090, dwReserved0=0x0, dwReserved1=0x0, cFileName="MP00132_.WMF", cAlternateFileName="")) returned 1
	[0056.455] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.456] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="MP00132_.WMF") returned -1
	[0056.456] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="MP00132_.WMF") returned -1
	[0056.456] lstrcmpiA (lpString1="", lpString2="MP00132_.WMF") returned -1
	[0056.456] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF") returned="MP00021_.WMF"
	[0056.456] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.456] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.456] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.456] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.456] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="MP00132_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00132_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00132_.WMF"
	[0056.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.zip") returned 0
	[0056.456] lstrlenA (lpString="*.zip") returned 5
	[0056.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.rar") returned 0
	[0056.456] lstrlenA (lpString="*.rar") returned 5
	[0056.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.7z") returned 0
	[0056.456] lstrlenA (lpString="*.7z") returned 4
	[0056.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.tar") returned 0
	[0056.456] lstrlenA (lpString="*.tar") returned 5
	[0056.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.gzip") returned 0
	[0056.456] lstrlenA (lpString="*.gzip") returned 6
	[0056.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.jpg") returned 0
	[0056.456] lstrlenA (lpString="*.jpg") returned 5
	[0056.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.jpeg") returned 0
	[0056.456] lstrlenA (lpString="*.jpeg") returned 6
	[0056.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.bmp") returned 0
	[0056.456] lstrlenA (lpString="*.bmp") returned 5
	[0056.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.gif") returned 0
	[0056.456] lstrlenA (lpString="*.gif") returned 5
	[0056.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.png") returned 0
	[0056.456] lstrlenA (lpString="*.png") returned 5
	[0056.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.doc") returned 0
	[0056.457] lstrlenA (lpString="*.doc") returned 5
	[0056.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.docx") returned 0
	[0056.457] lstrlenA (lpString="*.docx") returned 6
	[0056.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.xls") returned 0
	[0056.457] lstrlenA (lpString="*.xls") returned 5
	[0056.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.xlsx") returned 0
	[0056.457] lstrlenA (lpString="*.xlsx") returned 6
	[0056.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.ppt") returned 0
	[0056.457] lstrlenA (lpString="*.ppt") returned 5
	[0056.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.pptx") returned 0
	[0056.457] lstrlenA (lpString="*.pptx") returned 6
	[0056.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.txt") returned 0
	[0056.457] lstrlenA (lpString="*.txt") returned 5
	[0056.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.pdf") returned 0
	[0056.457] lstrlenA (lpString="*.pdf") returned 5
	[0056.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.htm") returned 0
	[0056.457] lstrlenA (lpString="*.htm") returned 5
	[0056.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.html") returned 0
	[0056.457] lstrlenA (lpString="*.html") returned 6
	[0056.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.mdb") returned 0
	[0056.457] lstrlenA (lpString="*.mdb") returned 5
	[0056.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.pfx") returned 0
	[0056.457] lstrlenA (lpString="*.pfx") returned 5
	[0056.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.md") returned 0
	[0056.457] lstrlenA (lpString="*.md") returned 4
	[0056.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.lnk") returned 0
	[0056.457] lstrlenA (lpString="*.lnk") returned 5
	[0056.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.torrent") returned 0
	[0056.457] lstrlenA (lpString="*.torrent") returned 9
	[0056.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.mov") returned 0
	[0056.457] lstrlenA (lpString="*.mov") returned 5
	[0056.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.3gp") returned 0
	[0056.457] lstrlenA (lpString="*.3gp") returned 5
	[0056.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.mpeg") returned 0
	[0056.457] lstrlenA (lpString="*.mpeg") returned 6
	[0056.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.mpg") returned 0
	[0056.458] lstrlenA (lpString="*.mpg") returned 5
	[0056.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00132_.WMF", pszSpec="*.flv") returned 0
	[0056.458] lstrlenA (lpString="*.flv") returned 5
	[0056.458] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf55e30d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf55e30d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf55e30d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x31e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="MP00646_.WMF", cAlternateFileName="")) returned 1
	[0056.458] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.458] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="MP00646_.WMF") returned -1
	[0056.458] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="MP00646_.WMF") returned -1
	[0056.458] lstrcmpiA (lpString1="", lpString2="MP00646_.WMF") returned -1
	[0056.458] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00132_.WMF") returned="MP00132_.WMF"
	[0056.458] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.458] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.458] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.458] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.458] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="MP00646_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00646_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00646_.WMF"
	[0056.458] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf58455c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf58455c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf58455c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1ae0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUSIC_01.MID", cAlternateFileName="")) returned 1
	[0056.458] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.458] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="MUSIC_01.MID") returned -1
	[0056.458] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="MUSIC_01.MID") returned -1
	[0056.458] lstrcmpiA (lpString1="", lpString2="MUSIC_01.MID") returned -1
	[0056.458] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00646_.WMF") returned="MP00646_.WMF"
	[0056.459] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.459] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.459] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.459] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.459] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="MUSIC_01.MID" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID"
	[0056.459] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf55e30d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf55e30d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf55e30d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5044, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00042_.WMF", cAlternateFileName="")) returned 1
	[0056.459] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.459] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA00042_.WMF") returned -1
	[0056.459] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA00042_.WMF") returned -1
	[0056.459] lstrcmpiA (lpString1="", lpString2="NA00042_.WMF") returned -1
	[0056.459] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned="MUSIC_01.MID"
	[0056.459] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.459] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.459] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.459] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.459] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA00042_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00042_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00042_.WMF"
	[0056.459] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5380be, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5380be, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5380be, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2a42, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00057_.WMF", cAlternateFileName="")) returned 1
	[0056.459] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.459] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA00057_.WMF") returned -1
	[0056.459] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA00057_.WMF") returned -1
	[0056.459] lstrcmpiA (lpString1="", lpString2="NA00057_.WMF") returned -1
	[0056.459] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00042_.WMF") returned="NA00042_.WMF"
	[0056.459] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.459] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.459] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.459] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.459] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA00057_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00057_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00057_.WMF"
	[0056.460] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5380be, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5380be, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5380be, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xeaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00058_.WMF", cAlternateFileName="")) returned 1
	[0056.460] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.460] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA00058_.WMF") returned -1
	[0056.460] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA00058_.WMF") returned -1
	[0056.460] lstrcmpiA (lpString1="", lpString2="NA00058_.WMF") returned -1
	[0056.460] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00057_.WMF") returned="NA00057_.WMF"
	[0056.460] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.460] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.460] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.460] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.460] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA00058_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00058_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00058_.WMF"
	[0056.460] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5380be, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5380be, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5380be, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1324, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00068_.WMF", cAlternateFileName="")) returned 1
	[0056.460] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.460] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA00068_.WMF") returned -1
	[0056.460] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA00068_.WMF") returned -1
	[0056.460] lstrcmpiA (lpString1="", lpString2="NA00068_.WMF") returned -1
	[0056.460] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00058_.WMF") returned="NA00058_.WMF"
	[0056.460] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.460] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.460] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.460] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.460] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA00068_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00068_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00068_.WMF"
	[0056.460] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5380be, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5380be, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5380be, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1384, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00238_.WMF", cAlternateFileName="")) returned 1
	[0056.460] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.460] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA00238_.WMF") returned -1
	[0056.460] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA00238_.WMF") returned -1
	[0056.461] lstrcmpiA (lpString1="", lpString2="NA00238_.WMF") returned -1
	[0056.461] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00068_.WMF") returned="NA00068_.WMF"
	[0056.461] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.461] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.461] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.461] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.461] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA00238_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00238_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00238_.WMF"
	[0056.461] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5380be, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5380be, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5380be, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x864, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00330_.WMF", cAlternateFileName="")) returned 1
	[0056.461] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.461] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA00330_.WMF") returned -1
	[0056.461] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA00330_.WMF") returned -1
	[0056.461] lstrcmpiA (lpString1="", lpString2="NA00330_.WMF") returned -1
	[0056.461] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00238_.WMF") returned="NA00238_.WMF"
	[0056.461] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.461] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.461] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.461] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.461] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA00330_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00330_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00330_.WMF"
	[0056.461] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf58455c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf58455c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf58455c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1172, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00388_.WMF", cAlternateFileName="")) returned 1
	[0056.461] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.461] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA00388_.WMF") returned -1
	[0056.461] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA00388_.WMF") returned -1
	[0056.461] lstrcmpiA (lpString1="", lpString2="NA00388_.WMF") returned -1
	[0056.461] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00330_.WMF") returned="NA00330_.WMF"
	[0056.461] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.461] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.461] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.462] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.462] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA00388_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00388_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00388_.WMF"
	[0056.462] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf55e30d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf55e30d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf55e30d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x20ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00389_.WMF", cAlternateFileName="")) returned 1
	[0056.462] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.462] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA00389_.WMF") returned -1
	[0056.462] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA00389_.WMF") returned -1
	[0056.462] lstrcmpiA (lpString1="", lpString2="NA00389_.WMF") returned -1
	[0056.462] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00388_.WMF") returned="NA00388_.WMF"
	[0056.462] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.462] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.462] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.462] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.462] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA00389_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00389_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00389_.WMF"
	[0056.462] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf55e30d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf55e30d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf55e30d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x21c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00390_.WMF", cAlternateFileName="")) returned 1
	[0056.462] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.462] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA00390_.WMF") returned -1
	[0056.462] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA00390_.WMF") returned -1
	[0056.462] lstrcmpiA (lpString1="", lpString2="NA00390_.WMF") returned -1
	[0056.462] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00389_.WMF") returned="NA00389_.WMF"
	[0056.462] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.462] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.462] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.462] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.462] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA00390_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00390_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00390_.WMF"
	[0056.462] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf55e30d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf55e30d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf55e30d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x21ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00391_.WMF", cAlternateFileName="")) returned 1
	[0056.463] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.463] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA00391_.WMF") returned -1
	[0056.463] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA00391_.WMF") returned -1
	[0056.463] lstrcmpiA (lpString1="", lpString2="NA00391_.WMF") returned -1
	[0056.463] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00390_.WMF") returned="NA00390_.WMF"
	[0056.463] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.463] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.463] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.463] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.463] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA00391_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00391_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00391_.WMF"
	[0056.463] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf55e30d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf55e30d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf55e30d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ad4, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00394_.WMF", cAlternateFileName="")) returned 1
	[0056.463] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.463] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA00394_.WMF") returned -1
	[0056.463] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA00394_.WMF") returned -1
	[0056.463] lstrcmpiA (lpString1="", lpString2="NA00394_.WMF") returned -1
	[0056.463] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00391_.WMF") returned="NA00391_.WMF"
	[0056.463] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.463] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.463] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.463] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.463] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA00394_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00394_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00394_.WMF"
	[0056.463] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf55e30d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf55e30d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf55e30d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x194a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00395_.WMF", cAlternateFileName="")) returned 1
	[0056.463] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.463] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA00395_.WMF") returned -1
	[0056.463] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA00395_.WMF") returned -1
	[0056.463] lstrcmpiA (lpString1="", lpString2="NA00395_.WMF") returned -1
	[0056.463] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00394_.WMF") returned="NA00394_.WMF"
	[0056.463] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.463] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.464] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.464] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.464] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA00395_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00395_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00395_.WMF"
	[0056.464] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf58455c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf58455c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf58455c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x38c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00396_.WMF", cAlternateFileName="")) returned 1
	[0056.464] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.464] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA00396_.WMF") returned -1
	[0056.464] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA00396_.WMF") returned -1
	[0056.464] lstrcmpiA (lpString1="", lpString2="NA00396_.WMF") returned -1
	[0056.464] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00395_.WMF") returned="NA00395_.WMF"
	[0056.464] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.464] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.464] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.464] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.464] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA00396_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00396_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00396_.WMF"
	[0056.464] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf55e30d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf55e30d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf55e30d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x173e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00417_.WMF", cAlternateFileName="")) returned 1
	[0056.464] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.464] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA00417_.WMF") returned -1
	[0056.464] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA00417_.WMF") returned -1
	[0056.464] lstrcmpiA (lpString1="", lpString2="NA00417_.WMF") returned -1
	[0056.464] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00396_.WMF") returned="NA00396_.WMF"
	[0056.464] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.464] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.464] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.464] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.464] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA00417_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00417_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00417_.WMF"
	[0056.465] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf58455c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf58455c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf58455c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4696, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00433_.WMF", cAlternateFileName="")) returned 1
	[0056.465] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.465] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA00433_.WMF") returned -1
	[0056.465] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA00433_.WMF") returned -1
	[0056.465] lstrcmpiA (lpString1="", lpString2="NA00433_.WMF") returned -1
	[0056.465] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00417_.WMF") returned="NA00417_.WMF"
	[0056.465] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.465] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.465] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.465] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.465] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA00433_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00433_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00433_.WMF"
	[0056.465] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf55e30d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf55e30d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf55e30d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2f38, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00438_.WMF", cAlternateFileName="")) returned 1
	[0056.465] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.465] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA00438_.WMF") returned -1
	[0056.465] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA00438_.WMF") returned -1
	[0056.465] lstrcmpiA (lpString1="", lpString2="NA00438_.WMF") returned -1
	[0056.465] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00433_.WMF") returned="NA00433_.WMF"
	[0056.465] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.465] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.511] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.511] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.511] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA00438_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00438_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00438_.WMF"
	[0056.511] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf58455c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf58455c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf58455c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00452_.WMF", cAlternateFileName="")) returned 1
	[0056.511] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.511] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA00452_.WMF") returned -1
	[0056.511] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA00452_.WMF") returned -1
	[0056.511] lstrcmpiA (lpString1="", lpString2="NA00452_.WMF") returned -1
	[0056.511] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00438_.WMF") returned="NA00438_.WMF"
	[0056.511] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.512] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.512] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.512] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.512] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA00452_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF"
	[0056.512] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf58455c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf58455c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf58455c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1580, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00454_.WMF", cAlternateFileName="")) returned 1
	[0056.512] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.512] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA00454_.WMF") returned -1
	[0056.512] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA00454_.WMF") returned -1
	[0056.512] lstrcmpiA (lpString1="", lpString2="NA00454_.WMF") returned -1
	[0056.512] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF") returned="NA00452_.WMF"
	[0056.512] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.512] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.512] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.512] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.512] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA00454_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF"
	[0056.512] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf58455c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf58455c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf58455c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00458_.WMF", cAlternateFileName="")) returned 1
	[0056.512] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.512] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA00458_.WMF") returned -1
	[0056.512] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA00458_.WMF") returned -1
	[0056.513] lstrcmpiA (lpString1="", lpString2="NA00458_.WMF") returned -1
	[0056.513] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF") returned="NA00454_.WMF"
	[0056.513] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.513] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.513] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.513] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.513] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA00458_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF"
	[0056.513] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf58455c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf58455c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf58455c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00462_.WMF", cAlternateFileName="")) returned 1
	[0056.513] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.513] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA00462_.WMF") returned -1
	[0056.513] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA00462_.WMF") returned -1
	[0056.513] lstrcmpiA (lpString1="", lpString2="NA00462_.WMF") returned -1
	[0056.513] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF") returned="NA00458_.WMF"
	[0056.513] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.513] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.513] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.513] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.513] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA00462_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00462_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00462_.WMF"
	[0056.513] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf58455c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf58455c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf58455c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc10, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00487_.WMF", cAlternateFileName="")) returned 1
	[0056.513] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.513] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA00487_.WMF") returned -1
	[0056.513] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA00487_.WMF") returned -1
	[0056.513] lstrcmpiA (lpString1="", lpString2="NA00487_.WMF") returned -1
	[0056.513] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00462_.WMF") returned="NA00462_.WMF"
	[0056.513] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.513] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.513] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.514] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.514] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA00487_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF"
	[0056.514] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf55e30d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf55e30d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf55e30d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x938, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00494_.WMF", cAlternateFileName="")) returned 1
	[0056.514] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.514] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA00494_.WMF") returned -1
	[0056.514] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA00494_.WMF") returned -1
	[0056.514] lstrcmpiA (lpString1="", lpString2="NA00494_.WMF") returned -1
	[0056.514] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF") returned="NA00487_.WMF"
	[0056.514] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.514] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.514] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.514] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.514] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA00494_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00494_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00494_.WMF"
	[0056.514] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf55e30d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf55e30d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf58455c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00512_.WMF", cAlternateFileName="")) returned 1
	[0056.514] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.514] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA00512_.WMF") returned -1
	[0056.514] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA00512_.WMF") returned -1
	[0056.514] lstrcmpiA (lpString1="", lpString2="NA00512_.WMF") returned -1
	[0056.514] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00494_.WMF") returned="NA00494_.WMF"
	[0056.514] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.514] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.514] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.514] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.514] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA00512_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00512_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00512_.WMF"
	[0056.514] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf55e30d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf55e30d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf55e30d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6efa, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00523_.WMF", cAlternateFileName="")) returned 1
	[0056.515] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.516] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA00523_.WMF") returned -1
	[0056.516] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA00523_.WMF") returned -1
	[0056.516] lstrcmpiA (lpString1="", lpString2="NA00523_.WMF") returned -1
	[0056.516] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00512_.WMF") returned="NA00512_.WMF"
	[0056.516] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.516] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.516] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.516] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.516] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA00523_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00523_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00523_.WMF"
	[0056.516] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf55e30d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf55e30d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf55e30d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5880, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00525_.WMF", cAlternateFileName="")) returned 1
	[0056.516] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.516] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA00525_.WMF") returned -1
	[0056.516] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA00525_.WMF") returned -1
	[0056.516] lstrcmpiA (lpString1="", lpString2="NA00525_.WMF") returned -1
	[0056.516] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00523_.WMF") returned="NA00523_.WMF"
	[0056.516] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.516] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.516] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.516] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.516] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA00525_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00525_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00525_.WMF"
	[0056.516] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf55e30d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf55e30d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf55e30d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x477c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00530_.WMF", cAlternateFileName="")) returned 1
	[0056.516] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.516] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA00530_.WMF") returned -1
	[0056.516] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA00530_.WMF") returned -1
	[0056.516] lstrcmpiA (lpString1="", lpString2="NA00530_.WMF") returned -1
	[0056.516] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00525_.WMF") returned="NA00525_.WMF"
	[0056.517] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.517] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.517] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.517] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.517] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA00530_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00530_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00530_.WMF"
	[0056.517] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf58455c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf58455c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5aa7bb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x530, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00532_.WMF", cAlternateFileName="")) returned 1
	[0056.517] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.517] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA00532_.WMF") returned -1
	[0056.517] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA00532_.WMF") returned -1
	[0056.517] lstrcmpiA (lpString1="", lpString2="NA00532_.WMF") returned -1
	[0056.517] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00530_.WMF") returned="NA00530_.WMF"
	[0056.517] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.517] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.517] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.517] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.517] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA00532_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00532_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00532_.WMF"
	[0056.517] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf58455c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf58455c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5aa7bb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7d14, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00538_.WMF", cAlternateFileName="")) returned 1
	[0056.517] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.517] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA00538_.WMF") returned -1
	[0056.517] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA00538_.WMF") returned -1
	[0056.517] lstrcmpiA (lpString1="", lpString2="NA00538_.WMF") returned -1
	[0056.517] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00532_.WMF") returned="NA00532_.WMF"
	[0056.517] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.517] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.517] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.517] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.518] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA00538_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00538_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00538_.WMF"
	[0056.518] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5aa7bb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5aa7bb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5aa7bb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00641_.WMF", cAlternateFileName="")) returned 1
	[0056.518] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.518] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA00641_.WMF") returned -1
	[0056.518] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA00641_.WMF") returned -1
	[0056.518] lstrcmpiA (lpString1="", lpString2="NA00641_.WMF") returned -1
	[0056.518] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00538_.WMF") returned="NA00538_.WMF"
	[0056.518] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.518] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.518] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.518] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.518] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA00641_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00641_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00641_.WMF"
	[0056.518] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf58455c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf58455c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5aa7bb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7658, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00784_.WMF", cAlternateFileName="")) returned 1
	[0056.518] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.518] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA00784_.WMF") returned -1
	[0056.518] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA00784_.WMF") returned -1
	[0056.518] lstrcmpiA (lpString1="", lpString2="NA00784_.WMF") returned -1
	[0056.518] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00641_.WMF") returned="NA00641_.WMF"
	[0056.518] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.518] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.518] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.518] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.518] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA00784_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00784_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00784_.WMF"
	[0056.518] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf58455c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf58455c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf58455c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x23f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00798_.WMF", cAlternateFileName="")) returned 1
	[0056.518] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.518] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA00798_.WMF") returned -1
	[0056.519] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA00798_.WMF") returned -1
	[0056.519] lstrcmpiA (lpString1="", lpString2="NA00798_.WMF") returned -1
	[0056.519] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00784_.WMF") returned="NA00784_.WMF"
	[0056.519] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.519] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.519] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.519] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.519] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA00798_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00798_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00798_.WMF"
	[0056.519] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf58455c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf58455c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf58455c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x788, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00806_.WMF", cAlternateFileName="")) returned 1
	[0056.519] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.519] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA00806_.WMF") returned -1
	[0056.519] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA00806_.WMF") returned -1
	[0056.519] lstrcmpiA (lpString1="", lpString2="NA00806_.WMF") returned -1
	[0056.519] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00798_.WMF") returned="NA00798_.WMF"
	[0056.519] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.519] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.519] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.519] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.519] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA00806_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00806_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00806_.WMF"
	[0056.519] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5aa7bb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5aa7bb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5aa7bb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xba4, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00807_.WMF", cAlternateFileName="")) returned 1
	[0056.520] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.520] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA00807_.WMF") returned -1
	[0056.520] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA00807_.WMF") returned -1
	[0056.520] lstrcmpiA (lpString1="", lpString2="NA00807_.WMF") returned -1
	[0056.520] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00806_.WMF") returned="NA00806_.WMF"
	[0056.520] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.520] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.520] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.520] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.520] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA00807_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00807_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00807_.WMF"
	[0056.520] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf58455c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf58455c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf58455c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x514, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00808_.WMF", cAlternateFileName="")) returned 1
	[0056.520] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.520] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA00808_.WMF") returned -1
	[0056.520] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA00808_.WMF") returned -1
	[0056.520] lstrcmpiA (lpString1="", lpString2="NA00808_.WMF") returned -1
	[0056.520] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00807_.WMF") returned="NA00807_.WMF"
	[0056.520] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.520] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.520] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.520] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.520] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA00808_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00808_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00808_.WMF"
	[0056.521] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf58455c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf58455c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf58455c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x608, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00809_.WMF", cAlternateFileName="")) returned 1
	[0056.521] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.521] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA00809_.WMF") returned -1
	[0056.521] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA00809_.WMF") returned -1
	[0056.521] lstrcmpiA (lpString1="", lpString2="NA00809_.WMF") returned -1
	[0056.521] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00808_.WMF") returned="NA00808_.WMF"
	[0056.521] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.521] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.521] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.521] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.521] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA00809_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00809_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00809_.WMF"
	[0056.521] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf58455c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf58455c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf58455c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd58, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00810_.WMF", cAlternateFileName="")) returned 1
	[0056.521] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.521] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA00810_.WMF") returned -1
	[0056.521] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA00810_.WMF") returned -1
	[0056.521] lstrcmpiA (lpString1="", lpString2="NA00810_.WMF") returned -1
	[0056.521] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00809_.WMF") returned="NA00809_.WMF"
	[0056.521] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.521] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.521] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.521] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.521] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA00810_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00810_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00810_.WMF"
	[0056.522] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5aa7bb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5aa7bb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5aa7bb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3210, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00932_.WMF", cAlternateFileName="")) returned 1
	[0056.522] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.522] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA00932_.WMF") returned -1
	[0056.522] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA00932_.WMF") returned -1
	[0056.522] lstrcmpiA (lpString1="", lpString2="NA00932_.WMF") returned -1
	[0056.522] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00810_.WMF") returned="NA00810_.WMF"
	[0056.522] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.522] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.522] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.522] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.522] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA00932_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00932_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00932_.WMF"
	[0056.522] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x110c9494, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x110c9494, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x110ef705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7c46, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01064_.WMF", cAlternateFileName="")) returned 1
	[0056.522] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.522] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA01064_.WMF") returned -1
	[0056.522] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA01064_.WMF") returned -1
	[0056.522] lstrcmpiA (lpString1="", lpString2="NA01064_.WMF") returned -1
	[0056.522] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00932_.WMF") returned="NA00932_.WMF"
	[0056.522] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.522] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.522] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.522] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.522] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA01064_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01064_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01064_.WMF"
	[0056.522] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5aa7bb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5aa7bb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5aa7bb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x54a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01066_.WMF", cAlternateFileName="")) returned 1
	[0056.522] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.522] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA01066_.WMF") returned -1
	[0056.522] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA01066_.WMF") returned -1
	[0056.523] lstrcmpiA (lpString1="", lpString2="NA01066_.WMF") returned -1
	[0056.523] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01064_.WMF") returned="NA01064_.WMF"
	[0056.523] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.523] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.523] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.523] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.523] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA01066_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01066_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01066_.WMF"
	[0056.523] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5aa7bb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5aa7bb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5aa7bb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1a7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01069_.WMF", cAlternateFileName="")) returned 1
	[0056.523] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.523] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA01069_.WMF") returned -1
	[0056.523] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA01069_.WMF") returned -1
	[0056.523] lstrcmpiA (lpString1="", lpString2="NA01069_.WMF") returned -1
	[0056.523] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01066_.WMF") returned="NA01066_.WMF"
	[0056.523] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.523] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.523] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.523] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.523] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA01069_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01069_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01069_.WMF"
	[0056.523] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5aa7bb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5aa7bb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5aa7bb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01123_.WMF", cAlternateFileName="")) returned 1
	[0056.523] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.523] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA01123_.WMF") returned -1
	[0056.523] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA01123_.WMF") returned -1
	[0056.523] lstrcmpiA (lpString1="", lpString2="NA01123_.WMF") returned -1
	[0056.523] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01069_.WMF") returned="NA01069_.WMF"
	[0056.523] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.523] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.523] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.523] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.524] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA01123_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01123_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01123_.WMF"
	[0056.524] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5aa7bb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5aa7bb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5aa7bb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01126_.WMF", cAlternateFileName="")) returned 1
	[0056.524] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.524] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA01126_.WMF") returned -1
	[0056.524] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA01126_.WMF") returned -1
	[0056.524] lstrcmpiA (lpString1="", lpString2="NA01126_.WMF") returned -1
	[0056.524] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01123_.WMF") returned="NA01123_.WMF"
	[0056.524] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.524] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.524] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.524] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.524] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA01126_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01126_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01126_.WMF"
	[0056.524] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5aa7bb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5aa7bb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5aa7bb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x16a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01130_.WMF", cAlternateFileName="")) returned 1
	[0056.524] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.524] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA01130_.WMF") returned -1
	[0056.524] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA01130_.WMF") returned -1
	[0056.524] lstrcmpiA (lpString1="", lpString2="NA01130_.WMF") returned -1
	[0056.524] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01126_.WMF") returned="NA01126_.WMF"
	[0056.524] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.524] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.524] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.524] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.524] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA01130_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01130_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01130_.WMF"
	[0056.524] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5aa7bb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5aa7bb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5aa7bb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x16d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01141_.WMF", cAlternateFileName="")) returned 1
	[0056.524] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.525] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA01141_.WMF") returned -1
	[0056.525] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA01141_.WMF") returned -1
	[0056.525] lstrcmpiA (lpString1="", lpString2="NA01141_.WMF") returned -1
	[0056.525] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01130_.WMF") returned="NA01130_.WMF"
	[0056.525] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.525] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.525] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.525] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.525] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA01141_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF"
	[0056.525] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5aa7bb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5aa7bb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5aa7bb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f38, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01148_.WMF", cAlternateFileName="")) returned 1
	[0056.525] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.525] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA01148_.WMF") returned -1
	[0056.525] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA01148_.WMF") returned -1
	[0056.525] lstrcmpiA (lpString1="", lpString2="NA01148_.WMF") returned -1
	[0056.525] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF") returned="NA01141_.WMF"
	[0056.525] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.525] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.525] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.525] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.525] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA01148_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF"
	[0056.525] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5aa7bb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5aa7bb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5aa7bb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1248, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01149_.WMF", cAlternateFileName="")) returned 1
	[0056.525] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.525] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA01149_.WMF") returned -1
	[0056.525] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA01149_.WMF") returned -1
	[0056.525] lstrcmpiA (lpString1="", lpString2="NA01149_.WMF") returned -1
	[0056.525] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF") returned="NA01148_.WMF"
	[0056.525] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.525] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.525] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.526] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.526] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA01149_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01149_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01149_.WMF"
	[0056.526] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x110c9494, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x110c9494, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x110ef705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2230, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01152_.WMF", cAlternateFileName="")) returned 1
	[0056.526] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.526] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA01152_.WMF") returned -1
	[0056.526] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA01152_.WMF") returned -1
	[0056.526] lstrcmpiA (lpString1="", lpString2="NA01152_.WMF") returned -1
	[0056.526] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01149_.WMF") returned="NA01149_.WMF"
	[0056.526] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.526] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.526] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.526] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.526] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA01152_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01152_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01152_.WMF"
	[0056.526] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10386305, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10386305, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103ac532, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x15b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01154_.WMF", cAlternateFileName="")) returned 1
	[0056.526] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.526] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA01154_.WMF") returned -1
	[0056.526] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA01154_.WMF") returned -1
	[0056.526] lstrcmpiA (lpString1="", lpString2="NA01154_.WMF") returned -1
	[0056.526] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01152_.WMF") returned="NA01152_.WMF"
	[0056.526] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.526] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.526] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.526] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.526] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA01154_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01154_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01154_.WMF"
	[0056.526] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5aa7bb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5aa7bb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5aa7bb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1858, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01157_.WMF", cAlternateFileName="")) returned 1
	[0056.527] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.527] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA01157_.WMF") returned -1
	[0056.527] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA01157_.WMF") returned -1
	[0056.527] lstrcmpiA (lpString1="", lpString2="NA01157_.WMF") returned -1
	[0056.527] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01154_.WMF") returned="NA01154_.WMF"
	[0056.527] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.527] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.527] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.527] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.527] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA01157_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01157_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01157_.WMF"
	[0056.527] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x101e2909, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x101e2909, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x101e2909, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c74, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01158_.WMF", cAlternateFileName="")) returned 1
	[0056.527] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.527] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA01158_.WMF") returned -1
	[0056.527] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA01158_.WMF") returned -1
	[0056.527] lstrcmpiA (lpString1="", lpString2="NA01158_.WMF") returned -1
	[0056.527] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01157_.WMF") returned="NA01157_.WMF"
	[0056.527] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.527] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.527] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.527] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.527] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA01158_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01158_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01158_.WMF"
	[0056.527] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102a14ae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102a14ae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102a14ae, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1694, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01161_.WMF", cAlternateFileName="")) returned 1
	[0056.527] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.527] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA01161_.WMF") returned -1
	[0056.527] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA01161_.WMF") returned -1
	[0056.527] lstrcmpiA (lpString1="", lpString2="NA01161_.WMF") returned -1
	[0056.527] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01158_.WMF") returned="NA01158_.WMF"
	[0056.527] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.528] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.528] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.528] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.528] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA01161_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01161_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01161_.WMF"
	[0056.528] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5d0a20, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5d0a20, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5f6d6e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa04, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01164_.WMF", cAlternateFileName="")) returned 1
	[0056.528] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.528] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA01164_.WMF") returned -1
	[0056.528] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA01164_.WMF") returned -1
	[0056.528] lstrcmpiA (lpString1="", lpString2="NA01164_.WMF") returned -1
	[0056.528] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01161_.WMF") returned="NA01161_.WMF"
	[0056.528] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.528] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.528] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.528] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.528] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA01164_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01164_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01164_.WMF"
	[0056.529] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5aa7bb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5aa7bb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5d0a20, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x70f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01293_.WMF", cAlternateFileName="")) returned 1
	[0056.529] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.529] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA01293_.WMF") returned -1
	[0056.529] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA01293_.WMF") returned -1
	[0056.529] lstrcmpiA (lpString1="", lpString2="NA01293_.WMF") returned -1
	[0056.529] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01164_.WMF") returned="NA01164_.WMF"
	[0056.529] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.529] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.529] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.529] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.529] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA01293_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01293_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01293_.WMF"
	[0056.529] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5aa7bb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5aa7bb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5aa7bb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x16ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01354_.WMF", cAlternateFileName="")) returned 1
	[0056.529] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.529] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA01354_.WMF") returned -1
	[0056.529] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA01354_.WMF") returned -1
	[0056.529] lstrcmpiA (lpString1="", lpString2="NA01354_.WMF") returned -1
	[0056.529] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01293_.WMF") returned="NA01293_.WMF"
	[0056.529] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.529] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.529] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.529] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.529] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA01354_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01354_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01354_.WMF"
	[0056.529] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5aa7bb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5aa7bb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5aa7bb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4732, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01356_.WMF", cAlternateFileName="")) returned 1
	[0056.529] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.529] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA01356_.WMF") returned -1
	[0056.529] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA01356_.WMF") returned -1
	[0056.529] lstrcmpiA (lpString1="", lpString2="NA01356_.WMF") returned -1
	[0056.530] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01354_.WMF") returned="NA01354_.WMF"
	[0056.530] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.530] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.530] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.530] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.530] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA01356_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01356_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01356_.WMF"
	[0056.530] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5aa7bb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5aa7bb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5aa7bb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6bf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01357_.WMF", cAlternateFileName="")) returned 1
	[0056.530] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.530] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA01357_.WMF") returned -1
	[0056.530] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA01357_.WMF") returned -1
	[0056.530] lstrcmpiA (lpString1="", lpString2="NA01357_.WMF") returned -1
	[0056.530] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01356_.WMF") returned="NA01356_.WMF"
	[0056.530] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.530] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.530] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.530] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.530] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA01357_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01357_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01357_.WMF"
	[0056.530] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf61cf5d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf61cf5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf61cf5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01358_.WMF", cAlternateFileName="")) returned 1
	[0056.530] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.545] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA01358_.WMF") returned -1
	[0056.545] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA01358_.WMF") returned -1
	[0056.545] lstrcmpiA (lpString1="", lpString2="NA01358_.WMF") returned -1
	[0056.545] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01357_.WMF") returned="NA01357_.WMF"
	[0056.545] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.545] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.545] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.546] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.546] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA01358_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01358_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01358_.WMF"
	[0056.546] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5f6d6e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5f6d6e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5f6d6e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1b74, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01361_.WMF", cAlternateFileName="")) returned 1
	[0056.546] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.546] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA01361_.WMF") returned -1
	[0056.546] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA01361_.WMF") returned -1
	[0056.546] lstrcmpiA (lpString1="", lpString2="NA01361_.WMF") returned -1
	[0056.546] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01358_.WMF") returned="NA01358_.WMF"
	[0056.546] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.547] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.547] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.547] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.547] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA01361_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01361_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01361_.WMF"
	[0056.547] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5f6d6e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5f6d6e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5f6d6e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x40412, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01368_.WMF", cAlternateFileName="")) returned 1
	[0056.547] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.547] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA01368_.WMF") returned -1
	[0056.547] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA01368_.WMF") returned -1
	[0056.547] lstrcmpiA (lpString1="", lpString2="NA01368_.WMF") returned -1
	[0056.547] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01361_.WMF") returned="NA01361_.WMF"
	[0056.547] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.547] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.547] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.547] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.547] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA01368_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01368_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01368_.WMF"
	[0056.547] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5f6d6e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5f6d6e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5f6d6e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2b16e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01421_.WMF", cAlternateFileName="")) returned 1
	[0056.547] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.547] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA01421_.WMF") returned -1
	[0056.547] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA01421_.WMF") returned -1
	[0056.547] lstrcmpiA (lpString1="", lpString2="NA01421_.WMF") returned -1
	[0056.547] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01368_.WMF") returned="NA01368_.WMF"
	[0056.547] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.547] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.547] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.547] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.548] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA01421_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01421_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01421_.WMF"
	[0056.548] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x100fdad1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x100fdad1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10123d5b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4e82, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01468_.WMF", cAlternateFileName="")) returned 1
	[0056.548] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.548] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA01468_.WMF") returned -1
	[0056.548] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA01468_.WMF") returned -1
	[0056.548] lstrcmpiA (lpString1="", lpString2="NA01468_.WMF") returned -1
	[0056.548] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01421_.WMF") returned="NA01421_.WMF"
	[0056.548] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.548] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.548] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.548] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.548] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA01468_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01468_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01468_.WMF"
	[0056.548] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5d0a20, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5d0a20, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5f6d6e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4ada, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01470_.WMF", cAlternateFileName="")) returned 1
	[0056.548] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.548] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA01470_.WMF") returned -1
	[0056.548] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA01470_.WMF") returned -1
	[0056.548] lstrcmpiA (lpString1="", lpString2="NA01470_.WMF") returned -1
	[0056.548] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01468_.WMF") returned="NA01468_.WMF"
	[0056.548] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.548] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.548] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.548] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.548] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA01470_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01470_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01470_.WMF"
	[0056.548] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5f6d6e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5f6d6e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5f6d6e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2028, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01472_.WMF", cAlternateFileName="")) returned 1
	[0056.548] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.549] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA01472_.WMF") returned -1
	[0056.549] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA01472_.WMF") returned -1
	[0056.549] lstrcmpiA (lpString1="", lpString2="NA01472_.WMF") returned -1
	[0056.549] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01470_.WMF") returned="NA01470_.WMF"
	[0056.549] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.549] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.549] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.549] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.549] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA01472_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01472_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01472_.WMF"
	[0056.549] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1027b233, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1027b233, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102a14ae, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x28ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01473_.WMF", cAlternateFileName="")) returned 1
	[0056.549] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.549] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA01473_.WMF") returned -1
	[0056.549] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA01473_.WMF") returned -1
	[0056.549] lstrcmpiA (lpString1="", lpString2="NA01473_.WMF") returned -1
	[0056.549] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01472_.WMF") returned="NA01472_.WMF"
	[0056.549] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.549] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.549] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.549] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.549] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA01473_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01473_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01473_.WMF"
	[0056.549] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102a14ae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102a14ae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102a14ae, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x349c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01474_.WMF", cAlternateFileName="")) returned 1
	[0056.549] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.549] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA01474_.WMF") returned -1
	[0056.549] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA01474_.WMF") returned -1
	[0056.549] lstrcmpiA (lpString1="", lpString2="NA01474_.WMF") returned -1
	[0056.549] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01473_.WMF") returned="NA01473_.WMF"
	[0056.549] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.549] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.550] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.550] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.550] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA01474_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01474_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01474_.WMF"
	[0056.550] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6b584f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf6b584f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf6b584f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01627_.WMF", cAlternateFileName="")) returned 1
	[0056.550] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.550] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA01627_.WMF") returned -1
	[0056.550] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA01627_.WMF") returned -1
	[0056.550] lstrcmpiA (lpString1="", lpString2="NA01627_.WMF") returned -1
	[0056.550] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01474_.WMF") returned="NA01474_.WMF"
	[0056.550] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.550] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.550] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.550] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.550] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA01627_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01627_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01627_.WMF"
	[0056.550] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf61cf5d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf61cf5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf61cf5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01680_.WMF", cAlternateFileName="")) returned 1
	[0056.550] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.550] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA01680_.WMF") returned -1
	[0056.550] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA01680_.WMF") returned -1
	[0056.550] lstrcmpiA (lpString1="", lpString2="NA01680_.WMF") returned -1
	[0056.550] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01627_.WMF") returned="NA01627_.WMF"
	[0056.550] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.550] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.550] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.550] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.550] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA01680_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01680_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01680_.WMF"
	[0056.551] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf61cf5d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf61cf5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf61cf5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc88, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01682_.WMF", cAlternateFileName="")) returned 1
	[0056.551] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.551] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA01682_.WMF") returned -1
	[0056.551] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA01682_.WMF") returned -1
	[0056.551] lstrcmpiA (lpString1="", lpString2="NA01682_.WMF") returned -1
	[0056.551] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01680_.WMF") returned="NA01680_.WMF"
	[0056.551] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.551] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.551] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.551] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.551] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA01682_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01682_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01682_.WMF"
	[0056.551] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5f6d6e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5f6d6e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf61cf5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01701_.WMF", cAlternateFileName="")) returned 1
	[0056.551] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.551] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA01701_.WMF") returned -1
	[0056.551] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA01701_.WMF") returned -1
	[0056.551] lstrcmpiA (lpString1="", lpString2="NA01701_.WMF") returned -1
	[0056.551] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01682_.WMF") returned="NA01682_.WMF"
	[0056.551] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.551] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.551] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.551] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.551] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA01701_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01701_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01701_.WMF"
	[0056.551] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5f6d6e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5f6d6e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5f6d6e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01848_.WMF", cAlternateFileName="")) returned 1
	[0056.551] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.551] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA01848_.WMF") returned -1
	[0056.551] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA01848_.WMF") returned -1
	[0056.551] lstrcmpiA (lpString1="", lpString2="NA01848_.WMF") returned -1
	[0056.552] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01701_.WMF") returned="NA01701_.WMF"
	[0056.552] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.552] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.552] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.552] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.552] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA01848_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01848_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01848_.WMF"
	[0056.552] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf61cf5d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf61cf5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf61cf5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x270, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01849_.WMF", cAlternateFileName="")) returned 1
	[0056.552] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.552] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA01849_.WMF") returned -1
	[0056.552] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA01849_.WMF") returned -1
	[0056.552] lstrcmpiA (lpString1="", lpString2="NA01849_.WMF") returned -1
	[0056.552] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01848_.WMF") returned="NA01848_.WMF"
	[0056.552] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.552] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.552] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.552] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.552] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA01849_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01849_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01849_.WMF"
	[0056.552] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5f6d6e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5f6d6e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf61cf5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01852_.WMF", cAlternateFileName="")) returned 1
	[0056.552] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.552] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA01852_.WMF") returned -1
	[0056.552] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA01852_.WMF") returned -1
	[0056.552] lstrcmpiA (lpString1="", lpString2="NA01852_.WMF") returned -1
	[0056.552] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01849_.WMF") returned="NA01849_.WMF"
	[0056.552] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.552] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.552] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.552] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.553] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA01852_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01852_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01852_.WMF"
	[0056.553] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5f6d6e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5f6d6e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf61cf5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01858_.WMF", cAlternateFileName="")) returned 1
	[0056.553] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.553] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA01858_.WMF") returned -1
	[0056.553] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA01858_.WMF") returned -1
	[0056.553] lstrcmpiA (lpString1="", lpString2="NA01858_.WMF") returned -1
	[0056.553] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01852_.WMF") returned="NA01852_.WMF"
	[0056.553] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.553] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.553] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.553] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.553] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA01858_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01858_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01858_.WMF"
	[0056.553] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5f6d6e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5f6d6e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5f6d6e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01866_.WMF", cAlternateFileName="")) returned 1
	[0056.553] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.553] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA01866_.WMF") returned -1
	[0056.553] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA01866_.WMF") returned -1
	[0056.553] lstrcmpiA (lpString1="", lpString2="NA01866_.WMF") returned -1
	[0056.553] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01858_.WMF") returned="NA01858_.WMF"
	[0056.553] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.553] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.553] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.553] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.553] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA01866_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01866_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01866_.WMF"
	[0056.553] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5f6d6e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5f6d6e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf61cf5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x27e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02009_.WMF", cAlternateFileName="")) returned 1
	[0056.553] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.553] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA02009_.WMF") returned -1
	[0056.554] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA02009_.WMF") returned -1
	[0056.554] lstrcmpiA (lpString1="", lpString2="NA02009_.WMF") returned -1
	[0056.554] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01866_.WMF") returned="NA01866_.WMF"
	[0056.554] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.554] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.554] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.554] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.554] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA02009_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02009_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02009_.WMF"
	[0056.554] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf68f613, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf68f613, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf68f613, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x918, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02041_.WMF", cAlternateFileName="")) returned 1
	[0056.554] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.554] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA02041_.WMF") returned -1
	[0056.554] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA02041_.WMF") returned -1
	[0056.554] lstrcmpiA (lpString1="", lpString2="NA02041_.WMF") returned -1
	[0056.554] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02009_.WMF") returned="NA02009_.WMF"
	[0056.554] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.554] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.554] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.554] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.554] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA02041_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02041_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02041_.WMF"
	[0056.554] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf68f613, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf68f613, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf68f613, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x43c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02066_.WMF", cAlternateFileName="")) returned 1
	[0056.554] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.554] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NA02066_.WMF") returned -1
	[0056.554] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NA02066_.WMF") returned -1
	[0056.554] lstrcmpiA (lpString1="", lpString2="NA02066_.WMF") returned -1
	[0056.554] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02041_.WMF") returned="NA02041_.WMF"
	[0056.554] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.554] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.554] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.555] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.555] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA02066_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02066_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02066_.WMF"
	[0056.555] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf66941e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf66941e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf66941e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x474, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02091_.WMF", cAlternateFileName="")) returned 1
	[0056.555] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.555] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02066_.WMF") returned="NA02066_.WMF"
	[0056.555] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.555] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.555] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.555] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.555] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA02091_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02091_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02091_.WMF"
	[0056.555] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf66941e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf66941e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf66941e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x66c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02092_.WMF", cAlternateFileName="")) returned 1
	[0056.555] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.555] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02091_.WMF") returned="NA02091_.WMF"
	[0056.555] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.555] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.555] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.555] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.555] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA02092_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02092_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02092_.WMF"
	[0056.555] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf643165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf643165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf643165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02093_.WMF", cAlternateFileName="")) returned 1
	[0056.555] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.555] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02092_.WMF") returned="NA02092_.WMF"
	[0056.556] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.556] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.556] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.556] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.556] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA02093_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02093_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02093_.WMF"
	[0056.556] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf61cf5d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf61cf5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf61cf5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1fe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02124_.WMF", cAlternateFileName="")) returned 1
	[0056.556] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.556] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02093_.WMF") returned="NA02093_.WMF"
	[0056.556] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.556] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.556] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.556] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.556] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA02124_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02124_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02124_.WMF"
	[0056.556] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf643165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf643165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf643165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4816, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02125_.WMF", cAlternateFileName="")) returned 1
	[0056.556] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.556] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02124_.WMF") returned="NA02124_.WMF"
	[0056.556] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.556] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.556] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.556] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.556] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA02125_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02125_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02125_.WMF"
	[0056.556] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10170232, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10170232, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10196468, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02126_.WMF", cAlternateFileName="")) returned 1
	[0056.556] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.556] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02125_.WMF") returned="NA02125_.WMF"
	[0056.557] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.557] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.557] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.557] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.557] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA02126_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02126_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02126_.WMF"
	[0056.557] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf61cf5d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf61cf5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf61cf5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xfe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02127_.WMF", cAlternateFileName="")) returned 1
	[0056.557] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.557] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02126_.WMF") returned="NA02126_.WMF"
	[0056.557] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.557] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.557] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.557] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.557] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA02127_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02127_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02127_.WMF"
	[0056.557] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf61cf5d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf61cf5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf61cf5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd00, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02262_.WMF", cAlternateFileName="")) returned 1
	[0056.557] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.557] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02127_.WMF") returned="NA02127_.WMF"
	[0056.557] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.557] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.557] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.557] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.557] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA02262_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02262_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02262_.WMF"
	[0056.557] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x100fdad1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x100fdad1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x100fdad1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02264_.WMF", cAlternateFileName="")) returned 1
	[0056.557] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.557] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02262_.WMF") returned="NA02262_.WMF"
	[0056.558] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.558] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.558] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.558] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.558] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA02264_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02264_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02264_.WMF"
	[0056.558] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6b584f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf6b584f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf6b584f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe14, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02356_.WMF", cAlternateFileName="")) returned 1
	[0056.558] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.558] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02264_.WMF") returned="NA02264_.WMF"
	[0056.558] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.558] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.558] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.558] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.558] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA02356_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02356_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02356_.WMF"
	[0056.558] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6b584f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf6b584f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf6b584f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02361_.WMF", cAlternateFileName="")) returned 1
	[0056.558] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.558] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02356_.WMF") returned="NA02356_.WMF"
	[0056.558] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.558] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.558] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.558] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.558] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA02361_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02361_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02361_.WMF"
	[0056.558] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6b584f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf6b584f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf6b584f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd28, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02368_.WMF", cAlternateFileName="")) returned 1
	[0056.558] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.559] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02361_.WMF") returned="NA02361_.WMF"
	[0056.559] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.559] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.559] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.559] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.559] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA02368_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02368_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02368_.WMF"
	[0056.559] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf68f613, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf68f613, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf6b584f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02371_.WMF", cAlternateFileName="")) returned 1
	[0056.559] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.559] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02368_.WMF") returned="NA02368_.WMF"
	[0056.559] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.559] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.559] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.559] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.559] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA02371_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02371_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02371_.WMF"
	[0056.559] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf68f613, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf68f613, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf68f613, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xcec, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02373_.WMF", cAlternateFileName="")) returned 1
	[0056.559] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.560] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02371_.WMF") returned="NA02371_.WMF"
	[0056.560] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.560] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.560] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.560] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.560] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA02373_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02373_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02373_.WMF"
	[0056.560] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6b584f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf6b584f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf6b584f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02384_.WMF", cAlternateFileName="")) returned 1
	[0056.561] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.561] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02373_.WMF") returned="NA02373_.WMF"
	[0056.561] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.561] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.561] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.561] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.561] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA02384_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02384_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02384_.WMF"
	[0056.561] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf68f613, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf68f613, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf68f613, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02386_.WMF", cAlternateFileName="")) returned 1
	[0056.561] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.561] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02384_.WMF") returned="NA02384_.WMF"
	[0056.561] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.561] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.561] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.561] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.561] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA02386_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02386_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02386_.WMF"
	[0056.561] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6b584f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf6b584f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf6b584f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc84, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02388_.WMF", cAlternateFileName="")) returned 1
	[0056.561] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.561] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02386_.WMF") returned="NA02386_.WMF"
	[0056.561] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.561] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.561] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.562] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.562] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA02388_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02388_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02388_.WMF"
	[0056.562] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf68f613, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf68f613, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf68f613, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02389_.WMF", cAlternateFileName="")) returned 1
	[0056.562] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.562] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02388_.WMF") returned="NA02388_.WMF"
	[0056.562] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.562] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.562] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.562] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.562] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA02389_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02389_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02389_.WMF"
	[0056.562] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10196468, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10196468, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10196468, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe64, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02390_.WMF", cAlternateFileName="")) returned 1
	[0056.562] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.562] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02389_.WMF") returned="NA02389_.WMF"
	[0056.562] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.562] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.562] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.562] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.562] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA02390_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02390_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02390_.WMF"
	[0056.562] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6b584f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf6b584f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf6dbaae, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1e98, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02398_.WMF", cAlternateFileName="")) returned 1
	[0056.562] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.562] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02390_.WMF") returned="NA02390_.WMF"
	[0056.562] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.563] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.563] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.563] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.563] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA02398_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02398_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02398_.WMF"
	[0056.563] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6b584f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf6b584f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf6b584f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd24, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02400_.WMF", cAlternateFileName="")) returned 1
	[0056.563] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.563] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02398_.WMF") returned="NA02398_.WMF"
	[0056.563] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.563] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.563] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.563] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.563] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA02400_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02400_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02400_.WMF"
	[0056.563] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6b584f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf6b584f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf6b584f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2120, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02404_.WMF", cAlternateFileName="")) returned 1
	[0056.563] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.563] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02400_.WMF") returned="NA02400_.WMF"
	[0056.563] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.563] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.563] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.563] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.563] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA02404_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02404_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02404_.WMF"
	[0056.563] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6b584f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf6b584f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf6b584f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5080, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02405_.WMF", cAlternateFileName="")) returned 1
	[0056.563] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.563] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02404_.WMF") returned="NA02404_.WMF"
	[0056.563] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.564] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.564] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.564] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.564] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA02405_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02405_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02405_.WMF"
	[0056.564] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6b584f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf6b584f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf6b584f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02407_.WMF", cAlternateFileName="")) returned 1
	[0056.564] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.564] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02405_.WMF") returned="NA02405_.WMF"
	[0056.564] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.564] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.564] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.564] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.564] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA02407_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02407_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02407_.WMF"
	[0056.564] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6b584f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf6b584f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf6b584f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x28ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02413_.WMF", cAlternateFileName="")) returned 1
	[0056.564] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.564] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02407_.WMF") returned="NA02407_.WMF"
	[0056.564] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.564] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.564] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.564] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.564] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA02413_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02413_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02413_.WMF"
	[0056.564] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6b584f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf6b584f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf6b584f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb24, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02417_.WMF", cAlternateFileName="")) returned 1
	[0056.564] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.564] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02413_.WMF") returned="NA02413_.WMF"
	[0056.564] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.565] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.565] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.565] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.565] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA02417_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02417_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02417_.WMF"
	[0056.565] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6b584f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf6b584f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf6b584f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2fb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02423_.WMF", cAlternateFileName="")) returned 1
	[0056.565] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.565] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02417_.WMF") returned="NA02417_.WMF"
	[0056.565] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.565] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.565] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.565] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.565] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA02423_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02423_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02423_.WMF"
	[0056.565] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6b584f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf6b584f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf6b584f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x53c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02424_.WMF", cAlternateFileName="")) returned 1
	[0056.565] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.565] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02423_.WMF") returned="NA02423_.WMF"
	[0056.565] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.565] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.565] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.565] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.565] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA02424_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02424_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02424_.WMF"
	[0056.565] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6dbaae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf6dbaae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf6dbaae, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1948, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02426_.WMF", cAlternateFileName="")) returned 1
	[0056.565] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.565] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02424_.WMF") returned="NA02424_.WMF"
	[0056.566] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.566] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.566] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.566] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.566] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="NA02426_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02426_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02426_.WMF"
	[0056.566] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6dbaae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf6dbaae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf6dbaae, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02431_.WMF", cAlternateFileName="")) returned 1
	[0056.566] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.566] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02426_.WMF") returned="NA02426_.WMF"
	[0056.566] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.566] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.566] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.566] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.566] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6dbaae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf6dbaae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf6dbaae, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xff8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02435_.WMF", cAlternateFileName="")) returned 1
	[0056.566] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.566] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02431_.WMF") returned="NA02431_.WMF"
	[0056.566] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.566] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.566] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.566] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6dbaae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf6dbaae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf6dbaae, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1434, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02439_.WMF", cAlternateFileName="")) returned 1
	[0056.566] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.566] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02435_.WMF") returned="NA02435_.WMF"
	[0056.566] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.566] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.567] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.567] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6dbaae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf6dbaae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf6dbaae, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3218, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02441_.WMF", cAlternateFileName="")) returned 1
	[0056.567] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.567] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02439_.WMF") returned="NA02439_.WMF"
	[0056.567] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.567] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.567] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.567] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6b584f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf6b584f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf6dbaae, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x55c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02443_.WMF", cAlternateFileName="")) returned 1
	[0056.567] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.567] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02441_.WMF") returned="NA02441_.WMF"
	[0056.567] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.567] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.567] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.567] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6dbaae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf6dbaae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf6dbaae, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x88c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02444_.WMF", cAlternateFileName="")) returned 1
	[0056.567] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.567] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02443_.WMF") returned="NA02443_.WMF"
	[0056.567] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.567] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.567] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.568] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6dbaae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf6dbaae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf6dbaae, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa34, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02446_.WMF", cAlternateFileName="")) returned 1
	[0056.568] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.568] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02444_.WMF") returned="NA02444_.WMF"
	[0056.568] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.568] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.568] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.568] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6dbaae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf6dbaae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf6dbaae, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02448_.WMF", cAlternateFileName="")) returned 1
	[0056.568] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.568] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02446_.WMF") returned="NA02446_.WMF"
	[0056.568] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.568] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.568] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.568] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6dbaae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf6dbaae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf6dbaae, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc28, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02450_.WMF", cAlternateFileName="")) returned 1
	[0056.568] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.568] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02448_.WMF") returned="NA02448_.WMF"
	[0056.568] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.568] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.568] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.568] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf74e1ae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf74e1ae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf74e1ae, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd70, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02451_.WMF", cAlternateFileName="")) returned 1
	[0056.568] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.569] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02450_.WMF") returned="NA02450_.WMF"
	[0056.569] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.569] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.569] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.569] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf701d25, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf701d25, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf701d25, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02453_.WMF", cAlternateFileName="")) returned 1
	[0056.569] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.569] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02451_.WMF") returned="NA02451_.WMF"
	[0056.569] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.569] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.569] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.569] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf701d25, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf701d25, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf701d25, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1750, dwReserved0=0x0, dwReserved1=0x0, cFileName="NBOOK_01.MID", cAlternateFileName="")) returned 1
	[0056.569] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.569] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02453_.WMF") returned="NA02453_.WMF"
	[0056.569] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.569] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.569] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.569] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6dbaae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf6dbaae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf701d25, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1540, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCEAN_01.MID", cAlternateFileName="")) returned 1
	[0056.569] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.569] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned="NBOOK_01.MID"
	[0056.569] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.569] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.569] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.570] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6dbaae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf6dbaae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf6dbaae, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x19f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTDR_01.MID", cAlternateFileName="")) returned 1
	[0056.570] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.570] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned="OCEAN_01.MID"
	[0056.570] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.570] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.570] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.570] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6dbaae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf6dbaae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf6dbaae, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1a6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPER_01.MID", cAlternateFileName="")) returned 1
	[0056.570] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.570] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned="OUTDR_01.MID"
	[0056.570] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.570] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.570] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.570] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6dbaae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf6dbaae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf6dbaae, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x195b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_01.MID", cAlternateFileName="")) returned 1
	[0056.570] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.570] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned="PAPER_01.MID"
	[0056.570] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.570] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.570] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.570] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6dbaae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf6dbaae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf6dbaae, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1652, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_02.MID", cAlternateFileName="")) returned 1
	[0056.570] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.571] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned="PARNT_01.MID"
	[0056.571] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.571] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.571] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.571] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6dbaae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf6dbaae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf6dbaae, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x215a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_03.MID", cAlternateFileName="")) returned 1
	[0056.571] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.571] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned="PARNT_02.MID"
	[0056.571] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.571] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.571] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.571] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6dbaae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf6dbaae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf6dbaae, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_04.MID", cAlternateFileName="")) returned 1
	[0056.571] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.571] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned="PARNT_03.MID"
	[0056.571] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.571] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.571] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.571] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x100fdad1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x100fdad1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10149fbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1784, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_05.MID", cAlternateFileName="")) returned 1
	[0056.572] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.572] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned="PARNT_04.MID"
	[0056.572] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.572] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.572] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.573] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x100fdad1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x100fdad1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10123d5b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_06.MID", cAlternateFileName="")) returned 1
	[0056.573] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.573] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned="PARNT_05.MID"
	[0056.573] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.573] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.573] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.573] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x100fdad1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x100fdad1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10123d5b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x19a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_07.MID", cAlternateFileName="")) returned 1
	[0056.573] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.573] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned="PARNT_06.MID"
	[0056.573] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.573] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.573] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.573] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x100fdad1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x100fdad1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x100fdad1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1cb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_08.MID", cAlternateFileName="")) returned 1
	[0056.573] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.573] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned="PARNT_07.MID"
	[0056.573] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.573] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.573] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.573] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x100fdad1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x100fdad1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10149fbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1a6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_09.MID", cAlternateFileName="")) returned 1
	[0056.573] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.574] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned="PARNT_08.MID"
	[0056.574] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.574] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.574] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.574] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf74e1ae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf74e1ae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x100fdad1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1511, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_10.MID", cAlternateFileName="")) returned 1
	[0056.574] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.574] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned="PARNT_09.MID"
	[0056.574] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.574] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.574] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.574] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x100fdad1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x100fdad1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x100fdad1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6140, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00013_.WMF", cAlternateFileName="")) returned 1
	[0056.574] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.574] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned="PARNT_10.MID"
	[0056.574] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.574] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.574] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.574] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x100fdad1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x100fdad1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x100fdad1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x411a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00014_.WMF", cAlternateFileName="")) returned 1
	[0056.574] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.574] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00013_.WMF") returned="PE00013_.WMF"
	[0056.574] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.574] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.574] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.575] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x100fdad1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x100fdad1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x100fdad1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3d5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00034_.WMF", cAlternateFileName="")) returned 1
	[0056.575] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.575] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00014_.WMF") returned="PE00014_.WMF"
	[0056.575] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.575] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.575] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.575] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1003f0d3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1003f0d3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x100fdad1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00049_.WMF", cAlternateFileName="")) returned 1
	[0056.575] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.575] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00034_.WMF") returned="PE00034_.WMF"
	[0056.575] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.575] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.575] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.575] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10123d5b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10123d5b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10123d5b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4d18, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00050_.WMF", cAlternateFileName="")) returned 1
	[0056.575] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.575] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00049_.WMF") returned="PE00049_.WMF"
	[0056.575] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.575] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.575] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.576] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10123d5b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10123d5b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10123d5b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x47ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00052_.WMF", cAlternateFileName="")) returned 1
	[0056.576] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.576] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00050_.WMF") returned="PE00050_.WMF"
	[0056.576] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.576] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.576] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.576] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10123d5b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10123d5b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10123d5b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00231_.WMF", cAlternateFileName="")) returned 1
	[0056.576] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.576] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00052_.WMF") returned="PE00052_.WMF"
	[0056.576] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.576] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.576] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.576] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10123d5b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10123d5b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10123d5b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xaf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00272_.WMF", cAlternateFileName="")) returned 1
	[0056.576] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.576] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00231_.WMF") returned="PE00231_.WMF"
	[0056.576] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.576] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.576] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.576] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10123d5b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10123d5b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10123d5b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5aa4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00468_.WMF", cAlternateFileName="")) returned 1
	[0056.576] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.576] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00272_.WMF") returned="PE00272_.WMF"
	[0056.576] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.577] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.577] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.577] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10149fbd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10149fbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10149fbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1cf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00478_.WMF", cAlternateFileName="")) returned 1
	[0056.577] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.577] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00468_.WMF") returned="PE00468_.WMF"
	[0056.577] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.577] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.577] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.577] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10123d5b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10123d5b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10123d5b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00485_.WMF", cAlternateFileName="")) returned 1
	[0056.577] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.577] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00478_.WMF") returned="PE00478_.WMF"
	[0056.577] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.577] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.577] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.577] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10123d5b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10123d5b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10123d5b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1402c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00489_.WMF", cAlternateFileName="")) returned 1
	[0056.577] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.577] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00485_.WMF") returned="PE00485_.WMF"
	[0056.577] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.577] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.577] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.578] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10123d5b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10123d5b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10123d5b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1ee4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00531_.WMF", cAlternateFileName="")) returned 1
	[0056.578] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.578] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00489_.WMF") returned="PE00489_.WMF"
	[0056.578] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.578] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.578] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.578] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10123d5b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10123d5b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10123d5b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00542_.WMF", cAlternateFileName="")) returned 1
	[0056.578] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.578] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00531_.WMF") returned="PE00531_.WMF"
	[0056.578] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.578] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.578] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.578] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10149fbd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10149fbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10149fbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x140c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00555_.WMF", cAlternateFileName="")) returned 1
	[0056.578] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.578] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00542_.WMF") returned="PE00542_.WMF"
	[0056.578] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.578] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.578] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.578] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10149fbd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10149fbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10170232, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x26b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00559_.WMF", cAlternateFileName="")) returned 1
	[0056.578] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.578] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00555_.WMF") returned="PE00555_.WMF"
	[0056.578] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.578] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.579] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.579] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10123d5b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10123d5b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10123d5b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5670, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00563_.WMF", cAlternateFileName="")) returned 1
	[0056.579] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.579] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00559_.WMF") returned="PE00559_.WMF"
	[0056.579] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.579] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.579] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.579] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10123d5b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10123d5b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10123d5b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1ae6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00578_.WMF", cAlternateFileName="")) returned 1
	[0056.579] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.579] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00563_.WMF") returned="PE00563_.WMF"
	[0056.579] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.579] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.579] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.579] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10123d5b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10123d5b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10123d5b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1928, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00608_.WMF", cAlternateFileName="")) returned 1
	[0056.579] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.579] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00578_.WMF") returned="PE00578_.WMF"
	[0056.579] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.579] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.579] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.579] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10123d5b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10123d5b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10123d5b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4cea, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00633_.WMF", cAlternateFileName="")) returned 1
	[0056.580] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.580] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00608_.WMF") returned="PE00608_.WMF"
	[0056.580] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.580] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.580] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.580] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10123d5b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10123d5b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10123d5b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb12c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00640_.WMF", cAlternateFileName="")) returned 1
	[0056.580] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.580] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00633_.WMF") returned="PE00633_.WMF"
	[0056.580] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.580] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.580] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.580] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10149fbd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10149fbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10149fbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6028, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00668_.WMF", cAlternateFileName="")) returned 1
	[0056.580] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.580] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00640_.WMF") returned="PE00640_.WMF"
	[0056.580] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.580] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.580] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.580] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10123d5b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10123d5b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10123d5b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x108a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00685_.WMF", cAlternateFileName="")) returned 1
	[0056.580] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.580] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00668_.WMF") returned="PE00668_.WMF"
	[0056.580] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.580] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.581] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.581] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10123d5b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10123d5b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10123d5b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x112e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00686_.WMF", cAlternateFileName="")) returned 1
	[0056.581] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.581] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00685_.WMF") returned="PE00685_.WMF"
	[0056.581] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.581] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.581] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.581] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10149fbd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10149fbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10170232, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00693_.WMF", cAlternateFileName="")) returned 1
	[0056.581] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.581] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00686_.WMF") returned="PE00686_.WMF"
	[0056.581] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.581] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.581] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.581] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10149fbd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10149fbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10170232, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3926, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00720_.WMF", cAlternateFileName="")) returned 1
	[0056.581] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.614] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00693_.WMF") returned="PE00693_.WMF"
	[0056.614] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.614] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.614] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.614] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10149fbd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10149fbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10149fbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1afc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00723_.WMF", cAlternateFileName="")) returned 1
	[0056.614] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.614] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00720_.WMF") returned="PE00720_.WMF"
	[0056.614] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.614] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.614] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.615] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10149fbd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10149fbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10149fbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb1a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00726_.WMF", cAlternateFileName="")) returned 1
	[0056.615] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.615] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00723_.WMF") returned="PE00723_.WMF"
	[0056.615] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.615] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.615] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.615] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10149fbd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10149fbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10149fbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9e2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00737_.WMF", cAlternateFileName="")) returned 1
	[0056.616] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.616] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00726_.WMF") returned="PE00726_.WMF"
	[0056.616] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.616] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.616] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.617] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10149fbd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10149fbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10149fbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1ca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00833_.WMF", cAlternateFileName="")) returned 1
	[0056.617] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.617] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00737_.WMF") returned="PE00737_.WMF"
	[0056.617] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.617] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.617] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.617] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10149fbd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10149fbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10170232, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1908, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00898_.WMF", cAlternateFileName="")) returned 1
	[0056.617] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.617] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00833_.WMF") returned="PE00833_.WMF"
	[0056.617] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.617] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.617] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.617] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10149fbd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10149fbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10170232, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3100, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00934_.WMF", cAlternateFileName="")) returned 1
	[0056.617] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.617] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00898_.WMF") returned="PE00898_.WMF"
	[0056.617] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.617] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.617] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.617] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10149fbd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10149fbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10149fbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2904, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00998_.WMF", cAlternateFileName="")) returned 1
	[0056.617] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.617] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00934_.WMF") returned="PE00934_.WMF"
	[0056.617] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.617] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.618] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.618] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10149fbd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10149fbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10149fbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE01160_.WMF", cAlternateFileName="")) returned 1
	[0056.618] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.618] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00998_.WMF") returned="PE00998_.WMF"
	[0056.618] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.618] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.618] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.618] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10170232, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10170232, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10170232, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x59c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE01172_.WMF", cAlternateFileName="")) returned 1
	[0056.618] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.618] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01160_.WMF") returned="PE01160_.WMF"
	[0056.618] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.618] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.618] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.618] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10170232, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10170232, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10196468, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3f9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE01191_.WMF", cAlternateFileName="")) returned 1
	[0056.618] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.618] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01172_.WMF") returned="PE01172_.WMF"
	[0056.618] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.618] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.618] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.619] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10170232, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10170232, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10170232, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1418, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE01661_.WMF", cAlternateFileName="")) returned 1
	[0056.619] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.619] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01191_.WMF") returned="PE01191_.WMF"
	[0056.619] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.619] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.619] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.619] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10170232, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10170232, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10170232, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE01797_.WMF", cAlternateFileName="")) returned 1
	[0056.619] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.619] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01661_.WMF") returned="PE01661_.WMF"
	[0056.619] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.619] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.619] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.619] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10196468, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10196468, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10196468, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x23d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02120_.WMF", cAlternateFileName="")) returned 1
	[0056.619] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.619] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01797_.WMF") returned="PE01797_.WMF"
	[0056.619] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.619] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.619] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.619] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10149fbd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10149fbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10170232, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1fc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02169_.WMF", cAlternateFileName="")) returned 1
	[0056.619] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.619] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02120_.WMF") returned="PE02120_.WMF"
	[0056.619] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.620] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.620] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.620] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10170232, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10170232, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10170232, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x75e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02262_.WMF", cAlternateFileName="")) returned 1
	[0056.620] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.620] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02169_.WMF") returned="PE02169_.WMF"
	[0056.620] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.620] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.620] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.620] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10149fbd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10149fbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10170232, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x824e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02263_.WMF", cAlternateFileName="")) returned 1
	[0056.620] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.620] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02262_.WMF") returned="PE02262_.WMF"
	[0056.620] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.620] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.620] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.620] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10149fbd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10149fbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10170232, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x62b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02265_.WMF", cAlternateFileName="")) returned 1
	[0056.620] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.620] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02263_.WMF") returned="PE02263_.WMF"
	[0056.620] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.620] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.620] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.621] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10149fbd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10149fbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10170232, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x78e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02267_.WMF", cAlternateFileName="")) returned 1
	[0056.621] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.621] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02265_.WMF") returned="PE02265_.WMF"
	[0056.621] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.621] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.621] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.621] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10196468, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10196468, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10196468, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6f26, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02270_.WMF", cAlternateFileName="")) returned 1
	[0056.621] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.621] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02267_.WMF") returned="PE02267_.WMF"
	[0056.621] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.621] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.621] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.621] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10170232, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10170232, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10196468, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb9c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02278_.WMF", cAlternateFileName="")) returned 1
	[0056.621] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.621] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02270_.WMF") returned="PE02270_.WMF"
	[0056.621] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.621] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.621] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.621] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10170232, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10170232, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10196468, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6928, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02280_.WMF", cAlternateFileName="")) returned 1
	[0056.622] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.622] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02278_.WMF") returned="PE02278_.WMF"
	[0056.622] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.622] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.622] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.622] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10170232, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10170232, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10196468, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02282_.WMF", cAlternateFileName="")) returned 1
	[0056.622] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.622] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02280_.WMF") returned="PE02280_.WMF"
	[0056.622] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.622] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.623] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.623] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10170232, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10170232, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10196468, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4090, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02285_.WMF", cAlternateFileName="")) returned 1
	[0056.623] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.623] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02282_.WMF") returned="PE02282_.WMF"
	[0056.623] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.623] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.623] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.623] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10170232, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10170232, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10170232, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4584, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02287_.WMF", cAlternateFileName="")) returned 1
	[0056.623] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.623] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02285_.WMF") returned="PE02285_.WMF"
	[0056.623] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.623] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.623] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.623] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10170232, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10170232, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10196468, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x76e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02288_.WMF", cAlternateFileName="")) returned 1
	[0056.623] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.623] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02287_.WMF") returned="PE02287_.WMF"
	[0056.623] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.623] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.623] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.623] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10170232, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10170232, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10170232, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5850, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02293_.WMF", cAlternateFileName="")) returned 1
	[0056.624] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.624] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02288_.WMF") returned="PE02288_.WMF"
	[0056.624] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.624] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.624] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.624] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10170232, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10170232, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10196468, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5328, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02296_.WMF", cAlternateFileName="")) returned 1
	[0056.624] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.624] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02293_.WMF") returned="PE02293_.WMF"
	[0056.624] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.624] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.624] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.624] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10170232, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10170232, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10170232, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02369_.WMF", cAlternateFileName="")) returned 1
	[0056.624] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.624] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02296_.WMF") returned="PE02296_.WMF"
	[0056.624] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.624] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.624] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.624] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x101e2909, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x101e2909, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x101e2909, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x39f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02522_.WMF", cAlternateFileName="")) returned 1
	[0056.624] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.624] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02369_.WMF") returned="PE02369_.WMF"
	[0056.624] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.624] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.625] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.625] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10196468, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10196468, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10196468, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1d2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02950_.WMF", cAlternateFileName="")) returned 1
	[0056.625] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.625] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02522_.WMF") returned="PE02522_.WMF"
	[0056.625] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.625] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.625] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.625] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10196468, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10196468, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10196468, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc70, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02957_.WMF", cAlternateFileName="")) returned 1
	[0056.625] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.625] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02950_.WMF") returned="PE02950_.WMF"
	[0056.625] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.625] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.625] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.625] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10196468, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10196468, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10196468, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x614, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03236_.WMF", cAlternateFileName="")) returned 1
	[0056.625] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.625] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02957_.WMF") returned="PE02957_.WMF"
	[0056.625] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.625] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.625] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.625] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10196468, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10196468, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10196468, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03241_.WMF", cAlternateFileName="")) returned 1
	[0056.626] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.626] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03236_.WMF") returned="PE03236_.WMF"
	[0056.626] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.626] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.626] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.626] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x101bc6d0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x101bc6d0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x101bc6d0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3380, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03257_.WMF", cAlternateFileName="")) returned 1
	[0056.626] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.626] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03241_.WMF") returned="PE03241_.WMF"
	[0056.626] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.626] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.626] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.626] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10196468, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10196468, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10196468, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03331_.WMF", cAlternateFileName="")) returned 1
	[0056.626] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.626] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03257_.WMF") returned="PE03257_.WMF"
	[0056.626] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.626] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.626] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.626] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10196468, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10196468, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10196468, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x282c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03339_.WMF", cAlternateFileName="")) returned 1
	[0056.626] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.626] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03331_.WMF") returned="PE03331_.WMF"
	[0056.626] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.626] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.627] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.627] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10196468, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10196468, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10196468, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2108, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03451_.WMF", cAlternateFileName="")) returned 1
	[0056.628] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.628] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03339_.WMF") returned="PE03339_.WMF"
	[0056.628] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.628] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.628] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.628] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10196468, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10196468, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10196468, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f24, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03453_.WMF", cAlternateFileName="")) returned 1
	[0056.628] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.628] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03451_.WMF") returned="PE03451_.WMF"
	[0056.628] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.628] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.628] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.628] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x101bc6d0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x101bc6d0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x101bc6d0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2178, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03459_.WMF", cAlternateFileName="")) returned 1
	[0056.628] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.628] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03453_.WMF") returned="PE03453_.WMF"
	[0056.628] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.628] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.628] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.628] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x101bc6d0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x101bc6d0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x101bc6d0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1664, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03464_.WMF", cAlternateFileName="")) returned 1
	[0056.628] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.628] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03459_.WMF") returned="PE03459_.WMF"
	[0056.629] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.629] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.629] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.629] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x101bc6d0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x101bc6d0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x101bc6d0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x41a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03466_.WMF", cAlternateFileName="")) returned 1
	[0056.629] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.629] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03464_.WMF") returned="PE03464_.WMF"
	[0056.629] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.629] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.629] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.629] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x101bc6d0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x101bc6d0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x101bc6d0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3998, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03470_.WMF", cAlternateFileName="")) returned 1
	[0056.629] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.629] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03466_.WMF") returned="PE03466_.WMF"
	[0056.629] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.629] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.629] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.629] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10196468, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10196468, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x101bc6d0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03513_.WMF", cAlternateFileName="")) returned 1
	[0056.629] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.629] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03470_.WMF") returned="PE03470_.WMF"
	[0056.629] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.629] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.629] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.630] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1027b233, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1027b233, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1027b233, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1868, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03668_.WMF", cAlternateFileName="")) returned 1
	[0056.630] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.630] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03513_.WMF") returned="PE03513_.WMF"
	[0056.630] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.630] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.630] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.630] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x101bc6d0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x101bc6d0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x101e2909, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03731_.WMF", cAlternateFileName="")) returned 1
	[0056.630] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.630] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03668_.WMF") returned="PE03668_.WMF"
	[0056.630] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.630] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.630] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.630] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x101bc6d0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x101bc6d0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x101e2909, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03795_.WMF", cAlternateFileName="")) returned 1
	[0056.630] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.630] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03731_.WMF") returned="PE03731_.WMF"
	[0056.630] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.630] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.630] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.630] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10196468, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10196468, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x101bc6d0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1020, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE04050_.WMF", cAlternateFileName="")) returned 1
	[0056.630] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.631] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03795_.WMF") returned="PE03795_.WMF"
	[0056.631] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.631] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.631] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.631] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10196468, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10196468, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x101bc6d0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x37f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE05665_.WMF", cAlternateFileName="")) returned 1
	[0056.631] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.631] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE04050_.WMF") returned="PE04050_.WMF"
	[0056.631] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.631] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.631] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.631] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x101bc6d0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x101bc6d0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x101e2909, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x167c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE05710_.WMF", cAlternateFileName="")) returned 1
	[0056.631] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.631] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05665_.WMF") returned="PE05665_.WMF"
	[0056.631] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.631] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.631] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.631] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x101bc6d0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x101bc6d0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x101e2909, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x608, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE05869_.WMF", cAlternateFileName="")) returned 1
	[0056.631] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.631] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05710_.WMF") returned="PE05710_.WMF"
	[0056.631] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.631] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.631] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.632] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x101e2909, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x101e2909, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x101e2909, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE05870_.WMF", cAlternateFileName="")) returned 1
	[0056.632] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.632] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05869_.WMF") returned="PE05869_.WMF"
	[0056.632] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.632] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.632] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.632] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x101e2909, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x101e2909, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x101e2909, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7fce, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE05930_.WMF", cAlternateFileName="")) returned 1
	[0056.632] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.632] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05870_.WMF") returned="PE05870_.WMF"
	[0056.632] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.632] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.632] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.632] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x101bc6d0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x101bc6d0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x101bc6d0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x121c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE06049_.WMF", cAlternateFileName="")) returned 1
	[0056.632] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.632] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05930_.WMF") returned="PE05930_.WMF"
	[0056.632] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.632] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.632] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.632] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x101bc6d0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x101bc6d0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x101e2909, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4048, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE06450_.WMF", cAlternateFileName="")) returned 1
	[0056.632] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.633] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06049_.WMF") returned="PE06049_.WMF"
	[0056.633] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.633] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.633] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.633] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x101bc6d0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x101bc6d0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x101bc6d0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x629, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH00601G.GIF", cAlternateFileName="")) returned 1
	[0056.633] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.633] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06450_.WMF") returned="PE06450_.WMF"
	[0056.633] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.633] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.633] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.633] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph00601g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.634] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x629
	[0056.635] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x101bc6d0, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x101bc6d0, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x101bc6d0, dwHighDateTime=0x1d327e8)) returned 1
	[0056.635] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.635] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x5e7, lpOverlapped=0x0) returned 1
	[0056.636] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00601G.GIF") returned="PH00601G.GIF"
	[0056.636] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.636] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x5e7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x5e7, lpOverlapped=0x0) returned 1
	[0056.636] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.636] CloseHandle (hObject=0x214) returned 1
	[0056.640] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph00601g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00601G.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph00601g.gif.exe")) returned 1
	[0056.641] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x101bc6d0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x101bc6d0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x101bc6d0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8628, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH00780U.BMP", cAlternateFileName="")) returned 1
	[0056.641] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.641] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH00780U.BMP") returned -1
	[0056.641] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH00780U.BMP") returned -1
	[0056.641] lstrcmpiA (lpString1="", lpString2="PH00780U.BMP") returned -1
	[0056.641] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00601G.GIF") returned="PH00601G.GIF"
	[0056.641] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.641] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.641] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.641] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.641] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH00780U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP"
	[0056.641] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP", pszSpec="*.zip") returned 0
	[0056.641] lstrlenA (lpString="*.zip") returned 5
	[0056.641] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP", pszSpec="*.rar") returned 0
	[0056.641] lstrlenA (lpString="*.rar") returned 5
	[0056.641] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP", pszSpec="*.7z") returned 0
	[0056.641] lstrlenA (lpString="*.7z") returned 4
	[0056.641] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP", pszSpec="*.tar") returned 0
	[0056.641] lstrlenA (lpString="*.tar") returned 5
	[0056.641] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP", pszSpec="*.gzip") returned 0
	[0056.641] lstrlenA (lpString="*.gzip") returned 6
	[0056.641] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP", pszSpec="*.jpg") returned 0
	[0056.641] lstrlenA (lpString="*.jpg") returned 5
	[0056.641] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP", pszSpec="*.jpeg") returned 0
	[0056.641] lstrlenA (lpString="*.jpeg") returned 6
	[0056.641] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP", pszSpec="*.bmp") returned 1
	[0056.642] lstrlenA (lpString="*.bmp") returned 5
	[0056.642] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP"
	[0056.642] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP"
	[0056.642] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP."
	[0056.642] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP.exe"
	[0056.642] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph00780u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.642] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8628
	[0056.642] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x101bc6d0, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x101bc6d0, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x101bc6d0, dwHighDateTime=0x1d327e8)) returned 1
	[0056.642] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.642] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x85e6, lpOverlapped=0x0) returned 1
	[0056.644] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP") returned="PH00780U.BMP"
	[0056.644] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.644] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x85e6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x85e6, lpOverlapped=0x0) returned 1
	[0056.644] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.644] CloseHandle (hObject=0x214) returned 1
	[0056.646] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph00780u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph00780u.bmp.exe")) returned 1
	[0056.651] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x101bc6d0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x101bc6d0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x101e2909, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7e90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01035U.BMP", cAlternateFileName="")) returned 1
	[0056.651] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.651] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH01035U.BMP") returned -1
	[0056.651] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH01035U.BMP") returned -1
	[0056.651] lstrcmpiA (lpString1="", lpString2="PH01035U.BMP") returned -1
	[0056.651] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP") returned="PH00780U.BMP"
	[0056.651] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.651] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.651] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.651] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.651] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH01035U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP"
	[0056.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP", pszSpec="*.zip") returned 0
	[0056.651] lstrlenA (lpString="*.zip") returned 5
	[0056.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP", pszSpec="*.rar") returned 0
	[0056.651] lstrlenA (lpString="*.rar") returned 5
	[0056.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP", pszSpec="*.7z") returned 0
	[0056.651] lstrlenA (lpString="*.7z") returned 4
	[0056.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP", pszSpec="*.tar") returned 0
	[0056.651] lstrlenA (lpString="*.tar") returned 5
	[0056.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP", pszSpec="*.gzip") returned 0
	[0056.651] lstrlenA (lpString="*.gzip") returned 6
	[0056.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP", pszSpec="*.jpg") returned 0
	[0056.651] lstrlenA (lpString="*.jpg") returned 5
	[0056.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP", pszSpec="*.jpeg") returned 0
	[0056.651] lstrlenA (lpString="*.jpeg") returned 6
	[0056.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP", pszSpec="*.bmp") returned 1
	[0056.652] lstrlenA (lpString="*.bmp") returned 5
	[0056.652] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP"
	[0056.652] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP"
	[0056.652] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP."
	[0056.652] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP.exe"
	[0056.652] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01035u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.690] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7e90
	[0056.690] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x101bc6d0, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x101bc6d0, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x101e2909, dwHighDateTime=0x1d327e8)) returned 1
	[0056.690] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.690] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7e4e, lpOverlapped=0x0) returned 1
	[0056.692] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP") returned="PH01035U.BMP"
	[0056.692] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.692] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7e4e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7e4e, lpOverlapped=0x0) returned 1
	[0056.692] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.692] CloseHandle (hObject=0x214) returned 1
	[0056.694] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01035u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01035u.bmp.exe")) returned 1
	[0056.694] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x101bc6d0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x101bc6d0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x101bc6d0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x211bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01046J.JPG", cAlternateFileName="")) returned 1
	[0056.695] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.695] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH01046J.JPG") returned -1
	[0056.695] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH01046J.JPG") returned -1
	[0056.695] lstrcmpiA (lpString1="", lpString2="PH01046J.JPG") returned -1
	[0056.695] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP") returned="PH01035U.BMP"
	[0056.695] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.695] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.695] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.695] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.695] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH01046J.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG"
	[0056.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG", pszSpec="*.zip") returned 0
	[0056.695] lstrlenA (lpString="*.zip") returned 5
	[0056.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG", pszSpec="*.rar") returned 0
	[0056.695] lstrlenA (lpString="*.rar") returned 5
	[0056.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG", pszSpec="*.7z") returned 0
	[0056.695] lstrlenA (lpString="*.7z") returned 4
	[0056.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG", pszSpec="*.tar") returned 0
	[0056.695] lstrlenA (lpString="*.tar") returned 5
	[0056.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG", pszSpec="*.gzip") returned 0
	[0056.695] lstrlenA (lpString="*.gzip") returned 6
	[0056.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG", pszSpec="*.jpg") returned 1
	[0056.695] lstrlenA (lpString="*.jpg") returned 5
	[0056.695] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG"
	[0056.695] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG"
	[0056.695] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG."
	[0056.695] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG.exe"
	[0056.695] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01046j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.696] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x211bb
	[0056.696] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x101bc6d0, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x101bc6d0, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x101bc6d0, dwHighDateTime=0x1d327e8)) returned 1
	[0056.696] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.696] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x21179, lpOverlapped=0x0) returned 1
	[0056.699] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG") returned="PH01046J.JPG"
	[0056.699] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.699] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x21179, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x21179, lpOverlapped=0x0) returned 1
	[0056.700] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.700] CloseHandle (hObject=0x214) returned 1
	[0056.703] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01046j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01046j.jpg.exe")) returned 1
	[0056.703] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102ed99a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102ed99a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102ed99a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa202, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01179J.JPG", cAlternateFileName="")) returned 1
	[0056.703] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.703] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH01179J.JPG") returned -1
	[0056.703] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH01179J.JPG") returned -1
	[0056.704] lstrcmpiA (lpString1="", lpString2="PH01179J.JPG") returned -1
	[0056.704] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG") returned="PH01046J.JPG"
	[0056.704] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.704] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.704] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.704] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.704] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH01179J.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01179J.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01179J.JPG"
	[0056.704] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01179J.JPG", pszSpec="*.zip") returned 0
	[0056.704] lstrlenA (lpString="*.zip") returned 5
	[0056.704] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01179J.JPG", pszSpec="*.rar") returned 0
	[0056.704] lstrlenA (lpString="*.rar") returned 5
	[0056.704] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01179J.JPG", pszSpec="*.7z") returned 0
	[0056.704] lstrlenA (lpString="*.7z") returned 4
	[0056.704] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01179J.JPG", pszSpec="*.tar") returned 0
	[0056.704] lstrlenA (lpString="*.tar") returned 5
	[0056.704] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01179J.JPG", pszSpec="*.gzip") returned 0
	[0056.704] lstrlenA (lpString="*.gzip") returned 6
	[0056.704] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01179J.JPG", pszSpec="*.jpg") returned 1
	[0056.704] lstrlenA (lpString="*.jpg") returned 5
	[0056.704] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01179J.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01179J.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01179J.JPG"
	[0056.704] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01179J.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01179J.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01179J.JPG"
	[0056.704] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01179J.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01179J.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01179J.JPG."
	[0056.704] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01179J.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01179J.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01179J.JPG.exe"
	[0056.704] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01179j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.705] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa202
	[0056.705] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x102ed99a, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x102ed99a, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x102ed99a, dwHighDateTime=0x1d327e8)) returned 1
	[0056.705] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.705] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xa1c0, lpOverlapped=0x0) returned 1
	[0056.707] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01179J.JPG") returned="PH01179J.JPG"
	[0056.707] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.707] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xa1c0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xa1c0, lpOverlapped=0x0) returned 1
	[0056.707] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.708] CloseHandle (hObject=0x214) returned 1
	[0056.709] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01179j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01179J.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01179j.jpg.exe")) returned 1
	[0056.709] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x101e2909, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x101e2909, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x101e2909, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x18be, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01213K.JPG", cAlternateFileName="")) returned 1
	[0056.709] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.709] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH01213K.JPG") returned -1
	[0056.709] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH01213K.JPG") returned -1
	[0056.710] lstrcmpiA (lpString1="", lpString2="PH01213K.JPG") returned -1
	[0056.710] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01179J.JPG") returned="PH01179J.JPG"
	[0056.710] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.710] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.710] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.710] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.710] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH01213K.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG"
	[0056.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG", pszSpec="*.zip") returned 0
	[0056.710] lstrlenA (lpString="*.zip") returned 5
	[0056.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG", pszSpec="*.rar") returned 0
	[0056.710] lstrlenA (lpString="*.rar") returned 5
	[0056.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG", pszSpec="*.7z") returned 0
	[0056.710] lstrlenA (lpString="*.7z") returned 4
	[0056.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG", pszSpec="*.tar") returned 0
	[0056.710] lstrlenA (lpString="*.tar") returned 5
	[0056.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG", pszSpec="*.gzip") returned 0
	[0056.710] lstrlenA (lpString="*.gzip") returned 6
	[0056.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG", pszSpec="*.jpg") returned 1
	[0056.710] lstrlenA (lpString="*.jpg") returned 5
	[0056.710] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01213k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.710] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18be
	[0056.710] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x101e2909, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x101e2909, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x101e2909, dwHighDateTime=0x1d327e8)) returned 1
	[0056.710] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.711] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x187c, lpOverlapped=0x0) returned 1
	[0056.712] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG") returned="PH01213K.JPG"
	[0056.712] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.712] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x187c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x187c, lpOverlapped=0x0) returned 1
	[0056.712] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.712] CloseHandle (hObject=0x214) returned 1
	[0056.713] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01213k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01213k.jpg.exe")) returned 1
	[0056.713] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x101e2909, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x101e2909, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x101e2909, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c94, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01221K.JPG", cAlternateFileName="")) returned 1
	[0056.714] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.714] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH01221K.JPG") returned -1
	[0056.714] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH01221K.JPG") returned -1
	[0056.714] lstrcmpiA (lpString1="", lpString2="PH01221K.JPG") returned -1
	[0056.714] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG") returned="PH01213K.JPG"
	[0056.714] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.714] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.714] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.714] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH01221K.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG"
	[0056.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG", pszSpec="*.zip") returned 0
	[0056.714] lstrlenA (lpString="*.zip") returned 5
	[0056.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG", pszSpec="*.rar") returned 0
	[0056.714] lstrlenA (lpString="*.rar") returned 5
	[0056.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG", pszSpec="*.7z") returned 0
	[0056.714] lstrlenA (lpString="*.7z") returned 4
	[0056.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG", pszSpec="*.tar") returned 0
	[0056.714] lstrlenA (lpString="*.tar") returned 5
	[0056.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG", pszSpec="*.gzip") returned 0
	[0056.714] lstrlenA (lpString="*.gzip") returned 6
	[0056.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG", pszSpec="*.jpg") returned 1
	[0056.714] lstrlenA (lpString="*.jpg") returned 5
	[0056.714] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG"
	[0056.714] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG"
	[0056.714] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG."
	[0056.714] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG.exe"
	[0056.714] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01221k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.716] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c94
	[0056.716] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x101e2909, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x101e2909, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x101e2909, dwHighDateTime=0x1d327e8)) returned 1
	[0056.716] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.716] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1c52, lpOverlapped=0x0) returned 1
	[0056.717] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG") returned="PH01221K.JPG"
	[0056.717] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.717] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1c52, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1c52, lpOverlapped=0x0) returned 1
	[0056.718] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.718] CloseHandle (hObject=0x214) returned 1
	[0056.718] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01221k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01221k.jpg.exe")) returned 1
	[0056.719] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x101e2909, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x101e2909, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x101e2909, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01235U.BMP", cAlternateFileName="")) returned 1
	[0056.719] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.719] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH01235U.BMP") returned -1
	[0056.719] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH01235U.BMP") returned -1
	[0056.719] lstrcmpiA (lpString1="", lpString2="PH01235U.BMP") returned -1
	[0056.719] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG") returned="PH01221K.JPG"
	[0056.719] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.719] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.719] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.719] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.719] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH01235U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP"
	[0056.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP", pszSpec="*.zip") returned 0
	[0056.719] lstrlenA (lpString="*.zip") returned 5
	[0056.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP", pszSpec="*.rar") returned 0
	[0056.719] lstrlenA (lpString="*.rar") returned 5
	[0056.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP", pszSpec="*.7z") returned 0
	[0056.719] lstrlenA (lpString="*.7z") returned 4
	[0056.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP", pszSpec="*.tar") returned 0
	[0056.720] lstrlenA (lpString="*.tar") returned 5
	[0056.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP", pszSpec="*.gzip") returned 0
	[0056.720] lstrlenA (lpString="*.gzip") returned 6
	[0056.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP", pszSpec="*.jpg") returned 0
	[0056.720] lstrlenA (lpString="*.jpg") returned 5
	[0056.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP", pszSpec="*.jpeg") returned 0
	[0056.720] lstrlenA (lpString="*.jpeg") returned 6
	[0056.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP", pszSpec="*.bmp") returned 1
	[0056.720] lstrlenA (lpString="*.bmp") returned 5
	[0056.720] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP"
	[0056.720] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP"
	[0056.720] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP."
	[0056.720] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP.exe"
	[0056.720] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01235u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.720] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7db8
	[0056.720] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x101e2909, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x101e2909, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x101e2909, dwHighDateTime=0x1d327e8)) returned 1
	[0056.720] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.720] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7d76, lpOverlapped=0x0) returned 1
	[0056.722] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP") returned="PH01235U.BMP"
	[0056.722] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.722] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7d76, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7d76, lpOverlapped=0x0) returned 1
	[0056.722] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.722] CloseHandle (hObject=0x214) returned 1
	[0056.723] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01235u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01235u.bmp.exe")) returned 1
	[0056.724] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x101e2909, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x101e2909, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x101e2909, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01236U.BMP", cAlternateFileName="")) returned 1
	[0056.724] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.724] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH01236U.BMP") returned -1
	[0056.724] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH01236U.BMP") returned -1
	[0056.724] lstrcmpiA (lpString1="", lpString2="PH01236U.BMP") returned -1
	[0056.724] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP") returned="PH01235U.BMP"
	[0056.724] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.724] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.724] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.724] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.724] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH01236U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01236U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01236U.BMP"
	[0056.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01236U.BMP", pszSpec="*.zip") returned 0
	[0056.724] lstrlenA (lpString="*.zip") returned 5
	[0056.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01236U.BMP", pszSpec="*.rar") returned 0
	[0056.724] lstrlenA (lpString="*.rar") returned 5
	[0056.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01236U.BMP", pszSpec="*.7z") returned 0
	[0056.724] lstrlenA (lpString="*.7z") returned 4
	[0056.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01236U.BMP", pszSpec="*.tar") returned 0
	[0056.724] lstrlenA (lpString="*.tar") returned 5
	[0056.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01236U.BMP", pszSpec="*.gzip") returned 0
	[0056.724] lstrlenA (lpString="*.gzip") returned 6
	[0056.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01236U.BMP", pszSpec="*.jpg") returned 0
	[0056.725] lstrlenA (lpString="*.jpg") returned 5
	[0056.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01236U.BMP", pszSpec="*.jpeg") returned 0
	[0056.725] lstrlenA (lpString="*.jpeg") returned 6
	[0056.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01236U.BMP", pszSpec="*.bmp") returned 1
	[0056.725] lstrlenA (lpString="*.bmp") returned 5
	[0056.725] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01236U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01236U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01236U.BMP"
	[0056.725] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01236U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01236U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01236U.BMP"
	[0056.725] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01236U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01236U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01236U.BMP."
	[0056.725] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01236U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01236U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01236U.BMP.exe"
	[0056.725] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01236u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.834] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7ce0
	[0056.834] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x101e2909, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x101e2909, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x101e2909, dwHighDateTime=0x1d327e8)) returned 1
	[0056.834] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.834] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7c9e, lpOverlapped=0x0) returned 1
	[0056.836] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01236U.BMP") returned="PH01236U.BMP"
	[0056.836] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.836] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7c9e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7c9e, lpOverlapped=0x0) returned 1
	[0056.836] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.836] CloseHandle (hObject=0x214) returned 1
	[0056.838] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01236u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01236U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01236u.bmp.exe")) returned 1
	[0056.839] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x101e2909, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x101e2909, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x101e2909, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1764, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01239K.JPG", cAlternateFileName="")) returned 1
	[0056.839] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.839] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH01239K.JPG") returned -1
	[0056.839] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH01239K.JPG") returned -1
	[0056.839] lstrcmpiA (lpString1="", lpString2="PH01239K.JPG") returned -1
	[0056.839] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01236U.BMP") returned="PH01236U.BMP"
	[0056.839] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.839] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.839] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.839] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.839] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH01239K.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG"
	[0056.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG", pszSpec="*.zip") returned 0
	[0056.839] lstrlenA (lpString="*.zip") returned 5
	[0056.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG", pszSpec="*.rar") returned 0
	[0056.839] lstrlenA (lpString="*.rar") returned 5
	[0056.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG", pszSpec="*.7z") returned 0
	[0056.839] lstrlenA (lpString="*.7z") returned 4
	[0056.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG", pszSpec="*.tar") returned 0
	[0056.839] lstrlenA (lpString="*.tar") returned 5
	[0056.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG", pszSpec="*.gzip") returned 0
	[0056.839] lstrlenA (lpString="*.gzip") returned 6
	[0056.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG", pszSpec="*.jpg") returned 1
	[0056.839] lstrlenA (lpString="*.jpg") returned 5
	[0056.839] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG"
	[0056.839] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG"
	[0056.839] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG."
	[0056.840] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG.exe"
	[0056.840] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01239k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.840] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1764
	[0056.840] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x101e2909, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x101e2909, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x101e2909, dwHighDateTime=0x1d327e8)) returned 1
	[0056.840] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.840] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1722, lpOverlapped=0x0) returned 1
	[0056.841] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.841] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1722, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1722, lpOverlapped=0x0) returned 1
	[0056.842] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.842] CloseHandle (hObject=0x214) returned 1
	[0056.842] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01239k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01239k.jpg.exe")) returned 1
	[0056.843] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x101e2909, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x101e2909, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x101e2909, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01247U.BMP", cAlternateFileName="")) returned 1
	[0056.843] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.843] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH01247U.BMP") returned -1
	[0056.843] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH01247U.BMP") returned -1
	[0056.843] lstrcmpiA (lpString1="", lpString2="PH01247U.BMP") returned -1
	[0056.843] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.843] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.843] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.843] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.843] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH01247U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP"
	[0056.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP", pszSpec="*.zip") returned 0
	[0056.844] lstrlenA (lpString="*.zip") returned 5
	[0056.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP", pszSpec="*.rar") returned 0
	[0056.844] lstrlenA (lpString="*.rar") returned 5
	[0056.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP", pszSpec="*.7z") returned 0
	[0056.844] lstrlenA (lpString="*.7z") returned 4
	[0056.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP", pszSpec="*.tar") returned 0
	[0056.844] lstrlenA (lpString="*.tar") returned 5
	[0056.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP", pszSpec="*.gzip") returned 0
	[0056.844] lstrlenA (lpString="*.gzip") returned 6
	[0056.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP", pszSpec="*.jpg") returned 0
	[0056.844] lstrlenA (lpString="*.jpg") returned 5
	[0056.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP", pszSpec="*.jpeg") returned 0
	[0056.844] lstrlenA (lpString="*.jpeg") returned 6
	[0056.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP", pszSpec="*.bmp") returned 1
	[0056.844] lstrlenA (lpString="*.bmp") returned 5
	[0056.844] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP"
	[0056.844] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP"
	[0056.844] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP."
	[0056.844] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP.exe"
	[0056.844] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01247u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.844] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7c08
	[0056.844] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x101e2909, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x101e2909, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x101e2909, dwHighDateTime=0x1d327e8)) returned 1
	[0056.845] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.845] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7bc6, lpOverlapped=0x0) returned 1
	[0056.846] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP") returned="PH01247U.BMP"
	[0056.846] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.847] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7bc6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7bc6, lpOverlapped=0x0) returned 1
	[0056.847] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.847] CloseHandle (hObject=0x214) returned 1
	[0056.848] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01247u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01247u.bmp.exe")) returned 1
	[0056.849] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x101e2909, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x101e2909, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x101e2909, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1e55, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01255G.GIF", cAlternateFileName="")) returned 1
	[0056.849] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.849] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH01255G.GIF") returned -1
	[0056.849] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH01255G.GIF") returned -1
	[0056.849] lstrcmpiA (lpString1="", lpString2="PH01255G.GIF") returned -1
	[0056.849] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP") returned="PH01247U.BMP"
	[0056.849] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.849] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.849] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.849] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.849] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH01255G.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF"
	[0056.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF", pszSpec="*.zip") returned 0
	[0056.849] lstrlenA (lpString="*.zip") returned 5
	[0056.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF", pszSpec="*.rar") returned 0
	[0056.849] lstrlenA (lpString="*.rar") returned 5
	[0056.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF", pszSpec="*.7z") returned 0
	[0056.849] lstrlenA (lpString="*.7z") returned 4
	[0056.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF", pszSpec="*.tar") returned 0
	[0056.849] lstrlenA (lpString="*.tar") returned 5
	[0056.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF", pszSpec="*.gzip") returned 0
	[0056.849] lstrlenA (lpString="*.gzip") returned 6
	[0056.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF", pszSpec="*.jpg") returned 0
	[0056.849] lstrlenA (lpString="*.jpg") returned 5
	[0056.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF", pszSpec="*.jpeg") returned 0
	[0056.849] lstrlenA (lpString="*.jpeg") returned 6
	[0056.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF", pszSpec="*.bmp") returned 0
	[0056.849] lstrlenA (lpString="*.bmp") returned 5
	[0056.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF", pszSpec="*.gif") returned 1
	[0056.850] lstrlenA (lpString="*.gif") returned 5
	[0056.850] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF"
	[0056.850] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF"
	[0056.850] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF."
	[0056.850] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF.exe"
	[0056.850] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01255g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.850] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1e55
	[0056.850] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x101e2909, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x101e2909, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x101e2909, dwHighDateTime=0x1d327e8)) returned 1
	[0056.850] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.851] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1e13, lpOverlapped=0x0) returned 1
	[0056.852] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF") returned="PH01255G.GIF"
	[0056.852] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.852] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1e13, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1e13, lpOverlapped=0x0) returned 1
	[0056.852] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.852] CloseHandle (hObject=0x214) returned 1
	[0056.853] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01255g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01255g.gif.exe")) returned 1
	[0056.853] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x101e2909, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x101e2909, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10208b6e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01265U.BMP", cAlternateFileName="")) returned 1
	[0056.853] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.853] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH01265U.BMP") returned -1
	[0056.854] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH01265U.BMP") returned -1
	[0056.854] lstrcmpiA (lpString1="", lpString2="PH01265U.BMP") returned -1
	[0056.854] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF") returned="PH01255G.GIF"
	[0056.854] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.854] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.854] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.854] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.854] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH01265U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01265U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01265U.BMP"
	[0056.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01265U.BMP", pszSpec="*.zip") returned 0
	[0056.854] lstrlenA (lpString="*.zip") returned 5
	[0056.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01265U.BMP", pszSpec="*.rar") returned 0
	[0056.854] lstrlenA (lpString="*.rar") returned 5
	[0056.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01265U.BMP", pszSpec="*.7z") returned 0
	[0056.854] lstrlenA (lpString="*.7z") returned 4
	[0056.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01265U.BMP", pszSpec="*.tar") returned 0
	[0056.854] lstrlenA (lpString="*.tar") returned 5
	[0056.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01265U.BMP", pszSpec="*.gzip") returned 0
	[0056.854] lstrlenA (lpString="*.gzip") returned 6
	[0056.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01265U.BMP", pszSpec="*.jpg") returned 0
	[0056.854] lstrlenA (lpString="*.jpg") returned 5
	[0056.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01265U.BMP", pszSpec="*.jpeg") returned 0
	[0056.854] lstrlenA (lpString="*.jpeg") returned 6
	[0056.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01265U.BMP", pszSpec="*.bmp") returned 1
	[0056.854] lstrlenA (lpString="*.bmp") returned 5
	[0056.854] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01265U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01265U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01265U.BMP"
	[0056.854] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01265U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01265U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01265U.BMP"
	[0056.854] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01265U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01265U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01265U.BMP."
	[0056.854] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01265U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01265U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01265U.BMP.exe"
	[0056.854] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01265u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.855] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7c08
	[0056.855] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x101e2909, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x101e2909, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x10208b6e, dwHighDateTime=0x1d327e8)) returned 1
	[0056.855] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.855] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7bc6, lpOverlapped=0x0) returned 1
	[0056.858] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01265U.BMP") returned="PH01265U.BMP"
	[0056.858] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.858] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7bc6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7bc6, lpOverlapped=0x0) returned 1
	[0056.858] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.858] CloseHandle (hObject=0x214) returned 1
	[0056.859] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01265u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01265U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01265u.bmp.exe")) returned 1
	[0056.860] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x101e2909, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x101e2909, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x101e2909, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01332U.BMP", cAlternateFileName="")) returned 1
	[0056.860] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.860] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH01332U.BMP") returned -1
	[0056.860] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH01332U.BMP") returned -1
	[0056.860] lstrcmpiA (lpString1="", lpString2="PH01332U.BMP") returned -1
	[0056.860] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01265U.BMP") returned="PH01265U.BMP"
	[0056.860] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.860] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.860] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.860] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.860] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH01332U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP"
	[0056.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP", pszSpec="*.zip") returned 0
	[0056.860] lstrlenA (lpString="*.zip") returned 5
	[0056.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP", pszSpec="*.rar") returned 0
	[0056.860] lstrlenA (lpString="*.rar") returned 5
	[0056.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP", pszSpec="*.7z") returned 0
	[0056.860] lstrlenA (lpString="*.7z") returned 4
	[0056.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP", pszSpec="*.tar") returned 0
	[0056.860] lstrlenA (lpString="*.tar") returned 5
	[0056.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP", pszSpec="*.gzip") returned 0
	[0056.860] lstrlenA (lpString="*.gzip") returned 6
	[0056.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP", pszSpec="*.jpg") returned 0
	[0056.861] lstrlenA (lpString="*.jpg") returned 5
	[0056.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP", pszSpec="*.jpeg") returned 0
	[0056.861] lstrlenA (lpString="*.jpeg") returned 6
	[0056.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP", pszSpec="*.bmp") returned 1
	[0056.861] lstrlenA (lpString="*.bmp") returned 5
	[0056.861] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP"
	[0056.861] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP"
	[0056.861] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP."
	[0056.861] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP.exe"
	[0056.861] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01332u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.861] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7db8
	[0056.861] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x101e2909, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x101e2909, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x101e2909, dwHighDateTime=0x1d327e8)) returned 1
	[0056.862] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.862] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7d76, lpOverlapped=0x0) returned 1
	[0056.865] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP") returned="PH01332U.BMP"
	[0056.865] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.865] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7d76, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7d76, lpOverlapped=0x0) returned 1
	[0056.865] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.866] CloseHandle (hObject=0x214) returned 1
	[0056.867] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01332u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01332u.bmp.exe")) returned 1
	[0056.867] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1022edb4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1022edb4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1027b233, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01478U.BMP", cAlternateFileName="")) returned 1
	[0056.867] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.867] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH01478U.BMP") returned -1
	[0056.867] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH01478U.BMP") returned -1
	[0056.867] lstrcmpiA (lpString1="", lpString2="PH01478U.BMP") returned -1
	[0056.867] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP") returned="PH01332U.BMP"
	[0056.868] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.868] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.868] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.868] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.868] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH01478U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP"
	[0056.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP", pszSpec="*.zip") returned 0
	[0056.868] lstrlenA (lpString="*.zip") returned 5
	[0056.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP", pszSpec="*.rar") returned 0
	[0056.868] lstrlenA (lpString="*.rar") returned 5
	[0056.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP", pszSpec="*.7z") returned 0
	[0056.868] lstrlenA (lpString="*.7z") returned 4
	[0056.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP", pszSpec="*.tar") returned 0
	[0056.868] lstrlenA (lpString="*.tar") returned 5
	[0056.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP", pszSpec="*.gzip") returned 0
	[0056.868] lstrlenA (lpString="*.gzip") returned 6
	[0056.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP", pszSpec="*.jpg") returned 0
	[0056.868] lstrlenA (lpString="*.jpg") returned 5
	[0056.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP", pszSpec="*.jpeg") returned 0
	[0056.868] lstrlenA (lpString="*.jpeg") returned 6
	[0056.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP", pszSpec="*.bmp") returned 1
	[0056.868] lstrlenA (lpString="*.bmp") returned 5
	[0056.868] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP"
	[0056.868] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP"
	[0056.868] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP."
	[0056.868] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP.exe"
	[0056.868] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01478u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.910] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7ce0
	[0056.910] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1027b233, dwHighDateTime=0x1d327e8)) returned 1
	[0056.910] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.910] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7c9e, lpOverlapped=0x0) returned 1
	[0056.912] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP") returned="PH01478U.BMP"
	[0056.912] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.912] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7c9e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7c9e, lpOverlapped=0x0) returned 1
	[0056.912] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.912] CloseHandle (hObject=0x214) returned 1
	[0056.914] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01478u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01478u.bmp.exe")) returned 1
	[0056.915] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10208b6e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10208b6e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1022edb4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01562U.BMP", cAlternateFileName="")) returned 1
	[0056.915] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.915] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH01562U.BMP") returned -1
	[0056.915] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH01562U.BMP") returned -1
	[0056.915] lstrcmpiA (lpString1="", lpString2="PH01562U.BMP") returned -1
	[0056.915] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP") returned="PH01478U.BMP"
	[0056.915] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.915] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.915] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.915] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.915] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH01562U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP"
	[0056.915] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP", pszSpec="*.zip") returned 0
	[0056.915] lstrlenA (lpString="*.zip") returned 5
	[0056.915] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP", pszSpec="*.rar") returned 0
	[0056.915] lstrlenA (lpString="*.rar") returned 5
	[0056.915] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP", pszSpec="*.7z") returned 0
	[0056.915] lstrlenA (lpString="*.7z") returned 4
	[0056.915] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP", pszSpec="*.tar") returned 0
	[0056.915] lstrlenA (lpString="*.tar") returned 5
	[0056.915] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP", pszSpec="*.gzip") returned 0
	[0056.915] lstrlenA (lpString="*.gzip") returned 6
	[0056.915] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP", pszSpec="*.jpg") returned 0
	[0056.915] lstrlenA (lpString="*.jpg") returned 5
	[0056.915] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP", pszSpec="*.jpeg") returned 0
	[0056.915] lstrlenA (lpString="*.jpeg") returned 6
	[0056.915] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP", pszSpec="*.bmp") returned 1
	[0056.916] lstrlenA (lpString="*.bmp") returned 5
	[0056.916] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP"
	[0056.916] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP"
	[0056.916] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP."
	[0056.916] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP.exe"
	[0056.916] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01562u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.916] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7db8
	[0056.916] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x10208b6e, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x10208b6e, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8)) returned 1
	[0056.916] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.917] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7d76, lpOverlapped=0x0) returned 1
	[0056.918] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP") returned="PH01562U.BMP"
	[0056.918] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.918] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7d76, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7d76, lpOverlapped=0x0) returned 1
	[0056.931] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.931] CloseHandle (hObject=0x214) returned 1
	[0056.932] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01562u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01562u.bmp.exe")) returned 1
	[0056.933] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10208b6e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10208b6e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10208b6e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01607U.BMP", cAlternateFileName="")) returned 1
	[0056.934] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.934] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH01607U.BMP") returned -1
	[0056.934] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH01607U.BMP") returned -1
	[0056.934] lstrcmpiA (lpString1="", lpString2="PH01607U.BMP") returned -1
	[0056.934] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP") returned="PH01562U.BMP"
	[0056.934] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.934] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.934] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.935] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.935] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH01607U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP"
	[0056.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP", pszSpec="*.zip") returned 0
	[0056.935] lstrlenA (lpString="*.zip") returned 5
	[0056.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP", pszSpec="*.rar") returned 0
	[0056.935] lstrlenA (lpString="*.rar") returned 5
	[0056.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP", pszSpec="*.7z") returned 0
	[0056.935] lstrlenA (lpString="*.7z") returned 4
	[0056.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP", pszSpec="*.tar") returned 0
	[0056.935] lstrlenA (lpString="*.tar") returned 5
	[0056.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP", pszSpec="*.gzip") returned 0
	[0056.935] lstrlenA (lpString="*.gzip") returned 6
	[0056.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP", pszSpec="*.jpg") returned 0
	[0056.935] lstrlenA (lpString="*.jpg") returned 5
	[0056.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP", pszSpec="*.jpeg") returned 0
	[0056.935] lstrlenA (lpString="*.jpeg") returned 6
	[0056.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP", pszSpec="*.bmp") returned 1
	[0056.935] lstrlenA (lpString="*.bmp") returned 5
	[0056.935] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP"
	[0056.935] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP"
	[0056.935] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP."
	[0056.935] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP.exe"
	[0056.935] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01607u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.936] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7ce0
	[0056.936] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x10208b6e, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x10208b6e, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x10208b6e, dwHighDateTime=0x1d327e8)) returned 1
	[0056.936] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.936] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7c9e, lpOverlapped=0x0) returned 1
	[0056.937] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP") returned="PH01607U.BMP"
	[0056.937] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.937] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7c9e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7c9e, lpOverlapped=0x0) returned 1
	[0056.938] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.938] CloseHandle (hObject=0x214) returned 1
	[0056.939] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01607u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01607u.bmp.exe")) returned 1
	[0056.940] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10208b6e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10208b6e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1022edb4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9abe, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01931J.JPG", cAlternateFileName="")) returned 1
	[0056.940] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.940] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH01931J.JPG") returned -1
	[0056.940] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH01931J.JPG") returned -1
	[0056.940] lstrcmpiA (lpString1="", lpString2="PH01931J.JPG") returned -1
	[0056.940] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP") returned="PH01607U.BMP"
	[0056.940] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.940] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.940] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.940] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.940] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH01931J.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG"
	[0056.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG", pszSpec="*.zip") returned 0
	[0056.940] lstrlenA (lpString="*.zip") returned 5
	[0056.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG", pszSpec="*.rar") returned 0
	[0056.940] lstrlenA (lpString="*.rar") returned 5
	[0056.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG", pszSpec="*.7z") returned 0
	[0056.940] lstrlenA (lpString="*.7z") returned 4
	[0056.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG", pszSpec="*.tar") returned 0
	[0056.940] lstrlenA (lpString="*.tar") returned 5
	[0056.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG", pszSpec="*.gzip") returned 0
	[0056.940] lstrlenA (lpString="*.gzip") returned 6
	[0056.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG", pszSpec="*.jpg") returned 1
	[0056.940] lstrlenA (lpString="*.jpg") returned 5
	[0056.940] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG"
	[0056.940] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG"
	[0056.940] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG."
	[0056.940] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG.exe"
	[0056.941] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01931j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.941] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9abe
	[0056.941] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x10208b6e, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x10208b6e, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8)) returned 1
	[0056.941] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.941] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x9a7c, lpOverlapped=0x0) returned 1
	[0056.942] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG") returned="PH01931J.JPG"
	[0056.942] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.943] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x9a7c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x9a7c, lpOverlapped=0x0) returned 1
	[0056.943] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.943] CloseHandle (hObject=0x214) returned 1
	[0056.944] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01931j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01931j.jpg.exe")) returned 1
	[0056.945] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10208b6e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10208b6e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10208b6e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x451e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02028K.JPG", cAlternateFileName="")) returned 1
	[0056.945] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.945] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02028K.JPG") returned -1
	[0056.945] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02028K.JPG") returned -1
	[0056.945] lstrcmpiA (lpString1="", lpString2="PH02028K.JPG") returned -1
	[0056.945] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG") returned="PH01931J.JPG"
	[0056.945] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.945] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.945] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.945] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.945] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02028K.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG"
	[0056.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG", pszSpec="*.zip") returned 0
	[0056.945] lstrlenA (lpString="*.zip") returned 5
	[0056.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG", pszSpec="*.rar") returned 0
	[0056.945] lstrlenA (lpString="*.rar") returned 5
	[0056.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG", pszSpec="*.7z") returned 0
	[0056.945] lstrlenA (lpString="*.7z") returned 4
	[0056.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG", pszSpec="*.tar") returned 0
	[0056.945] lstrlenA (lpString="*.tar") returned 5
	[0056.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG", pszSpec="*.gzip") returned 0
	[0056.945] lstrlenA (lpString="*.gzip") returned 6
	[0056.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG", pszSpec="*.jpg") returned 1
	[0056.945] lstrlenA (lpString="*.jpg") returned 5
	[0056.945] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG"
	[0056.945] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG"
	[0056.946] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG."
	[0056.946] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG.exe"
	[0056.946] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02028k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.946] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x451e
	[0056.946] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x10208b6e, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x10208b6e, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x10208b6e, dwHighDateTime=0x1d327e8)) returned 1
	[0056.946] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.946] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x44dc, lpOverlapped=0x0) returned 1
	[0056.947] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG") returned="PH02028K.JPG"
	[0056.947] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.947] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x44dc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x44dc, lpOverlapped=0x0) returned 1
	[0056.948] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.948] CloseHandle (hObject=0x214) returned 1
	[0056.949] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02028k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02028k.jpg.exe")) returned 1
	[0056.949] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10208b6e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10208b6e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10208b6e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02039U.BMP", cAlternateFileName="")) returned 1
	[0056.949] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0056.949] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02039U.BMP") returned -1
	[0056.949] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02039U.BMP") returned -1
	[0056.949] lstrcmpiA (lpString1="", lpString2="PH02039U.BMP") returned -1
	[0056.949] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG") returned="PH02028K.JPG"
	[0056.949] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0056.949] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0056.949] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0056.949] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0056.950] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02039U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP"
	[0056.950] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP", pszSpec="*.zip") returned 0
	[0056.950] lstrlenA (lpString="*.zip") returned 5
	[0056.950] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP", pszSpec="*.rar") returned 0
	[0056.950] lstrlenA (lpString="*.rar") returned 5
	[0056.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP", pszSpec="*.7z") returned 0
	[0056.951] lstrlenA (lpString="*.7z") returned 4
	[0056.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP", pszSpec="*.tar") returned 0
	[0056.951] lstrlenA (lpString="*.tar") returned 5
	[0056.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP", pszSpec="*.gzip") returned 0
	[0056.951] lstrlenA (lpString="*.gzip") returned 6
	[0056.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP", pszSpec="*.jpg") returned 0
	[0056.951] lstrlenA (lpString="*.jpg") returned 5
	[0056.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP", pszSpec="*.jpeg") returned 0
	[0056.951] lstrlenA (lpString="*.jpeg") returned 6
	[0056.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP", pszSpec="*.bmp") returned 1
	[0056.951] lstrlenA (lpString="*.bmp") returned 5
	[0056.951] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP"
	[0056.951] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP"
	[0056.951] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP."
	[0056.951] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP.exe"
	[0056.951] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02039u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0056.951] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7ce0
	[0056.951] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x10208b6e, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x10208b6e, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x10208b6e, dwHighDateTime=0x1d327e8)) returned 1
	[0056.951] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.951] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7c9e, lpOverlapped=0x0) returned 1
	[0056.953] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP") returned="PH02039U.BMP"
	[0056.953] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0056.953] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7c9e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7c9e, lpOverlapped=0x0) returned 1
	[0057.192] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.192] CloseHandle (hObject=0x214) returned 1
	[0057.194] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02039u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02039u.bmp.exe")) returned 1
	[0057.195] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x101e2909, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x101e2909, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x101e2909, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02040U.BMP", cAlternateFileName="")) returned 1
	[0057.196] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0057.196] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02040U.BMP") returned -1
	[0057.196] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02040U.BMP") returned -1
	[0057.196] lstrcmpiA (lpString1="", lpString2="PH02040U.BMP") returned -1
	[0057.196] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP") returned="PH02039U.BMP"
	[0057.196] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0057.196] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0057.196] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0057.196] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0057.196] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02040U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP"
	[0057.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP", pszSpec="*.zip") returned 0
	[0057.196] lstrlenA (lpString="*.zip") returned 5
	[0057.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP", pszSpec="*.rar") returned 0
	[0057.196] lstrlenA (lpString="*.rar") returned 5
	[0057.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP", pszSpec="*.7z") returned 0
	[0057.196] lstrlenA (lpString="*.7z") returned 4
	[0057.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP", pszSpec="*.tar") returned 0
	[0057.196] lstrlenA (lpString="*.tar") returned 5
	[0057.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP", pszSpec="*.gzip") returned 0
	[0057.196] lstrlenA (lpString="*.gzip") returned 6
	[0057.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP", pszSpec="*.jpg") returned 0
	[0057.196] lstrlenA (lpString="*.jpg") returned 5
	[0057.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP", pszSpec="*.jpeg") returned 0
	[0057.196] lstrlenA (lpString="*.jpeg") returned 6
	[0057.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP", pszSpec="*.bmp") returned 1
	[0057.277] lstrlenA (lpString="*.bmp") returned 5
	[0057.277] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP"
	[0057.277] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP"
	[0057.277] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP."
	[0057.277] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP.exe"
	[0057.277] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02040u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0057.278] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7db8
	[0057.278] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x101e2909, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x101e2909, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x101e2909, dwHighDateTime=0x1d327e8)) returned 1
	[0057.278] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.278] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7d76, lpOverlapped=0x0) returned 1
	[0057.280] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP") returned="PH02040U.BMP"
	[0057.280] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.280] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7d76, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7d76, lpOverlapped=0x0) returned 1
	[0057.280] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.280] CloseHandle (hObject=0x214) returned 1
	[0057.282] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02040u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02040u.bmp.exe")) returned 1
	[0057.282] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x101e2909, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x101e2909, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10208b6e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6afc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02053J.JPG", cAlternateFileName="")) returned 1
	[0057.282] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0057.283] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02053J.JPG") returned -1
	[0057.283] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02053J.JPG") returned -1
	[0057.283] lstrcmpiA (lpString1="", lpString2="PH02053J.JPG") returned -1
	[0057.283] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP") returned="PH02040U.BMP"
	[0057.283] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0057.283] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0057.283] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0057.283] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0057.283] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02053J.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02053J.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02053J.JPG"
	[0057.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02053J.JPG", pszSpec="*.zip") returned 0
	[0057.283] lstrlenA (lpString="*.zip") returned 5
	[0057.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02053J.JPG", pszSpec="*.rar") returned 0
	[0057.283] lstrlenA (lpString="*.rar") returned 5
	[0057.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02053J.JPG", pszSpec="*.7z") returned 0
	[0057.283] lstrlenA (lpString="*.7z") returned 4
	[0057.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02053J.JPG", pszSpec="*.tar") returned 0
	[0057.283] lstrlenA (lpString="*.tar") returned 5
	[0057.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02053J.JPG", pszSpec="*.gzip") returned 0
	[0057.283] lstrlenA (lpString="*.gzip") returned 6
	[0057.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02053J.JPG", pszSpec="*.jpg") returned 1
	[0057.283] lstrlenA (lpString="*.jpg") returned 5
	[0057.283] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02053J.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02053J.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02053J.JPG"
	[0057.283] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02053J.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02053J.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02053J.JPG"
	[0057.283] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02053J.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02053J.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02053J.JPG."
	[0057.283] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02053J.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02053J.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02053J.JPG.exe"
	[0057.283] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02053j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0057.284] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6afc
	[0057.284] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x101e2909, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x101e2909, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x10208b6e, dwHighDateTime=0x1d327e8)) returned 1
	[0057.284] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.284] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x6aba, lpOverlapped=0x0) returned 1
	[0057.285] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02053J.JPG") returned="PH02053J.JPG"
	[0057.285] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.285] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x6aba, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x6aba, lpOverlapped=0x0) returned 1
	[0057.286] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.286] CloseHandle (hObject=0x214) returned 1
	[0057.287] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02053j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02053J.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02053j.jpg.exe")) returned 1
	[0057.287] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10208b6e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10208b6e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10208b6e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02058U.BMP", cAlternateFileName="")) returned 1
	[0057.287] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0057.287] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02058U.BMP") returned -1
	[0057.287] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02058U.BMP") returned -1
	[0057.288] lstrcmpiA (lpString1="", lpString2="PH02058U.BMP") returned -1
	[0057.288] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02053J.JPG") returned="PH02053J.JPG"
	[0057.288] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0057.288] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0057.288] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0057.288] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0057.288] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02058U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP"
	[0057.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP", pszSpec="*.zip") returned 0
	[0057.288] lstrlenA (lpString="*.zip") returned 5
	[0057.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP", pszSpec="*.rar") returned 0
	[0057.288] lstrlenA (lpString="*.rar") returned 5
	[0057.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP", pszSpec="*.7z") returned 0
	[0057.288] lstrlenA (lpString="*.7z") returned 4
	[0057.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP", pszSpec="*.tar") returned 0
	[0057.288] lstrlenA (lpString="*.tar") returned 5
	[0057.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP", pszSpec="*.gzip") returned 0
	[0057.288] lstrlenA (lpString="*.gzip") returned 6
	[0057.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP", pszSpec="*.jpg") returned 0
	[0057.288] lstrlenA (lpString="*.jpg") returned 5
	[0057.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP", pszSpec="*.jpeg") returned 0
	[0057.288] lstrlenA (lpString="*.jpeg") returned 6
	[0057.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP", pszSpec="*.bmp") returned 1
	[0057.288] lstrlenA (lpString="*.bmp") returned 5
	[0057.288] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP"
	[0057.288] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP"
	[0057.288] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP."
	[0057.288] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP.exe"
	[0057.288] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02058u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0057.289] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7ce0
	[0057.289] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x10208b6e, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x10208b6e, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x10208b6e, dwHighDateTime=0x1d327e8)) returned 1
	[0057.289] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.289] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7c9e, lpOverlapped=0x0) returned 1
	[0057.290] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP") returned="PH02058U.BMP"
	[0057.291] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.291] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7c9e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7c9e, lpOverlapped=0x0) returned 1
	[0057.291] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.291] CloseHandle (hObject=0x214) returned 1
	[0057.292] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02058u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02058u.bmp.exe")) returned 1
	[0057.293] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x101e2909, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x101e2909, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x101e2909, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02062U.BMP", cAlternateFileName="")) returned 1
	[0057.293] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0057.293] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02062U.BMP") returned -1
	[0057.293] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02062U.BMP") returned -1
	[0057.293] lstrcmpiA (lpString1="", lpString2="PH02062U.BMP") returned -1
	[0057.293] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP") returned="PH02058U.BMP"
	[0057.293] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0057.293] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0057.293] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0057.293] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0057.293] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02062U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP"
	[0057.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP", pszSpec="*.zip") returned 0
	[0057.293] lstrlenA (lpString="*.zip") returned 5
	[0057.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP", pszSpec="*.rar") returned 0
	[0057.293] lstrlenA (lpString="*.rar") returned 5
	[0057.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP", pszSpec="*.7z") returned 0
	[0057.293] lstrlenA (lpString="*.7z") returned 4
	[0057.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP", pszSpec="*.tar") returned 0
	[0057.293] lstrlenA (lpString="*.tar") returned 5
	[0057.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP", pszSpec="*.gzip") returned 0
	[0057.293] lstrlenA (lpString="*.gzip") returned 6
	[0057.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP", pszSpec="*.jpg") returned 0
	[0057.293] lstrlenA (lpString="*.jpg") returned 5
	[0057.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP", pszSpec="*.jpeg") returned 0
	[0057.294] lstrlenA (lpString="*.jpeg") returned 6
	[0057.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP", pszSpec="*.bmp") returned 1
	[0057.294] lstrlenA (lpString="*.bmp") returned 5
	[0057.294] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP"
	[0057.294] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP"
	[0057.294] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP."
	[0057.294] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP.exe"
	[0057.294] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02062u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0057.294] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7ce0
	[0057.294] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x101e2909, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x101e2909, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x101e2909, dwHighDateTime=0x1d327e8)) returned 1
	[0057.294] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.294] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7c9e, lpOverlapped=0x0) returned 1
	[0057.295] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP") returned="PH02062U.BMP"
	[0057.296] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.296] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7c9e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7c9e, lpOverlapped=0x0) returned 1
	[0057.296] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.296] CloseHandle (hObject=0x214) returned 1
	[0057.297] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02062u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02062u.bmp.exe")) returned 1
	[0057.298] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1022edb4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1022edb4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1022edb4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7297, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02069J.JPG", cAlternateFileName="")) returned 1
	[0057.298] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0057.298] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02069J.JPG") returned -1
	[0057.298] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02069J.JPG") returned -1
	[0057.298] lstrcmpiA (lpString1="", lpString2="PH02069J.JPG") returned -1
	[0057.298] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP") returned="PH02062U.BMP"
	[0057.298] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0057.298] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0057.298] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0057.298] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0057.298] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02069J.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG"
	[0057.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG", pszSpec="*.zip") returned 0
	[0057.298] lstrlenA (lpString="*.zip") returned 5
	[0057.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG", pszSpec="*.rar") returned 0
	[0057.298] lstrlenA (lpString="*.rar") returned 5
	[0057.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG", pszSpec="*.7z") returned 0
	[0057.298] lstrlenA (lpString="*.7z") returned 4
	[0057.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG", pszSpec="*.tar") returned 0
	[0057.298] lstrlenA (lpString="*.tar") returned 5
	[0057.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG", pszSpec="*.gzip") returned 0
	[0057.298] lstrlenA (lpString="*.gzip") returned 6
	[0057.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG", pszSpec="*.jpg") returned 1
	[0057.299] lstrlenA (lpString="*.jpg") returned 5
	[0057.299] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG"
	[0057.299] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG"
	[0057.299] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG."
	[0057.299] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG.exe"
	[0057.299] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02069j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0057.300] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7297
	[0057.300] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8)) returned 1
	[0057.300] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.300] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7255, lpOverlapped=0x0) returned 1
	[0057.301] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG") returned="PH02069J.JPG"
	[0057.301] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.301] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7255, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7255, lpOverlapped=0x0) returned 1
	[0057.302] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.302] CloseHandle (hObject=0x214) returned 1
	[0057.303] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02069j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02069j.jpg.exe")) returned 1
	[0057.303] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1022edb4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1022edb4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1022edb4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02071U.BMP", cAlternateFileName="")) returned 1
	[0057.304] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0057.304] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02071U.BMP") returned -1
	[0057.304] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02071U.BMP") returned -1
	[0057.304] lstrcmpiA (lpString1="", lpString2="PH02071U.BMP") returned -1
	[0057.304] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG") returned="PH02069J.JPG"
	[0057.304] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0057.304] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0057.304] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0057.304] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0057.304] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02071U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02071U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02071U.BMP"
	[0057.304] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02071U.BMP", pszSpec="*.zip") returned 0
	[0057.304] lstrlenA (lpString="*.zip") returned 5
	[0057.304] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02071U.BMP", pszSpec="*.rar") returned 0
	[0057.304] lstrlenA (lpString="*.rar") returned 5
	[0057.304] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02071U.BMP", pszSpec="*.7z") returned 0
	[0057.304] lstrlenA (lpString="*.7z") returned 4
	[0057.304] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02071U.BMP", pszSpec="*.tar") returned 0
	[0057.304] lstrlenA (lpString="*.tar") returned 5
	[0057.304] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02071U.BMP", pszSpec="*.gzip") returned 0
	[0057.304] lstrlenA (lpString="*.gzip") returned 6
	[0057.304] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02071U.BMP", pszSpec="*.jpg") returned 0
	[0057.304] lstrlenA (lpString="*.jpg") returned 5
	[0057.304] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02071U.BMP", pszSpec="*.jpeg") returned 0
	[0057.304] lstrlenA (lpString="*.jpeg") returned 6
	[0057.304] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02071U.BMP", pszSpec="*.bmp") returned 1
	[0057.304] lstrlenA (lpString="*.bmp") returned 5
	[0057.304] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02071U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02071U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02071U.BMP"
	[0057.304] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02071U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02071U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02071U.BMP"
	[0057.304] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02071U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02071U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02071U.BMP."
	[0057.304] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02071U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02071U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02071U.BMP.exe"
	[0057.304] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02071u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0057.305] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7db8
	[0057.305] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8)) returned 1
	[0057.305] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.305] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7d76, lpOverlapped=0x0) returned 1
	[0057.307] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02071U.BMP") returned="PH02071U.BMP"
	[0057.307] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.307] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7d76, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7d76, lpOverlapped=0x0) returned 1
	[0057.308] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.308] CloseHandle (hObject=0x214) returned 1
	[0057.309] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02071u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02071U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02071u.bmp.exe")) returned 1
	[0057.310] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1022edb4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1022edb4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1022edb4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02074U.BMP", cAlternateFileName="")) returned 1
	[0057.310] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0057.310] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02074U.BMP") returned -1
	[0057.310] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02074U.BMP") returned -1
	[0057.310] lstrcmpiA (lpString1="", lpString2="PH02074U.BMP") returned -1
	[0057.310] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02071U.BMP") returned="PH02071U.BMP"
	[0057.310] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0057.310] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0057.310] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0057.310] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0057.310] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02074U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP"
	[0057.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP", pszSpec="*.zip") returned 0
	[0057.310] lstrlenA (lpString="*.zip") returned 5
	[0057.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP", pszSpec="*.rar") returned 0
	[0057.310] lstrlenA (lpString="*.rar") returned 5
	[0057.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP", pszSpec="*.7z") returned 0
	[0057.310] lstrlenA (lpString="*.7z") returned 4
	[0057.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP", pszSpec="*.tar") returned 0
	[0057.311] lstrlenA (lpString="*.tar") returned 5
	[0057.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP", pszSpec="*.gzip") returned 0
	[0057.311] lstrlenA (lpString="*.gzip") returned 6
	[0057.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP", pszSpec="*.jpg") returned 0
	[0057.311] lstrlenA (lpString="*.jpg") returned 5
	[0057.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP", pszSpec="*.jpeg") returned 0
	[0057.311] lstrlenA (lpString="*.jpeg") returned 6
	[0057.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP", pszSpec="*.bmp") returned 1
	[0057.311] lstrlenA (lpString="*.bmp") returned 5
	[0057.311] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP"
	[0057.311] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP"
	[0057.311] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP."
	[0057.311] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP.exe"
	[0057.311] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02074u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0057.312] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7ce0
	[0057.312] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8)) returned 1
	[0057.312] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.312] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7c9e, lpOverlapped=0x0) returned 1
	[0057.399] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP") returned="PH02074U.BMP"
	[0057.399] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.400] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7c9e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7c9e, lpOverlapped=0x0) returned 1
	[0057.400] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.400] CloseHandle (hObject=0x214) returned 1
	[0057.401] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02074u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02074u.bmp.exe")) returned 1
	[0057.402] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10208b6e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10208b6e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1022edb4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02208U.BMP", cAlternateFileName="")) returned 1
	[0057.402] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0057.402] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02208U.BMP") returned -1
	[0057.402] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02208U.BMP") returned -1
	[0057.402] lstrcmpiA (lpString1="", lpString2="PH02208U.BMP") returned -1
	[0057.402] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP") returned="PH02074U.BMP"
	[0057.402] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0057.403] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0057.403] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0057.403] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0057.403] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02208U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP"
	[0057.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP", pszSpec="*.zip") returned 0
	[0057.403] lstrlenA (lpString="*.zip") returned 5
	[0057.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP", pszSpec="*.rar") returned 0
	[0057.403] lstrlenA (lpString="*.rar") returned 5
	[0057.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP", pszSpec="*.7z") returned 0
	[0057.403] lstrlenA (lpString="*.7z") returned 4
	[0057.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP", pszSpec="*.tar") returned 0
	[0057.403] lstrlenA (lpString="*.tar") returned 5
	[0057.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP", pszSpec="*.gzip") returned 0
	[0057.403] lstrlenA (lpString="*.gzip") returned 6
	[0057.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP", pszSpec="*.jpg") returned 0
	[0057.403] lstrlenA (lpString="*.jpg") returned 5
	[0057.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP", pszSpec="*.jpeg") returned 0
	[0057.403] lstrlenA (lpString="*.jpeg") returned 6
	[0057.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP", pszSpec="*.bmp") returned 1
	[0057.403] lstrlenA (lpString="*.bmp") returned 5
	[0057.403] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP"
	[0057.403] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP"
	[0057.403] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP."
	[0057.403] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP.exe"
	[0057.403] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02208u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0057.404] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7ce0
	[0057.404] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x10208b6e, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x10208b6e, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8)) returned 1
	[0057.404] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.404] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7c9e, lpOverlapped=0x0) returned 1
	[0057.405] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP") returned="PH02208U.BMP"
	[0057.405] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.406] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7c9e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7c9e, lpOverlapped=0x0) returned 1
	[0057.406] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.406] CloseHandle (hObject=0x214) returned 1
	[0057.407] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02208u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02208u.bmp.exe")) returned 1
	[0057.408] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1022edb4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1022edb4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1022edb4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02223U.BMP", cAlternateFileName="")) returned 1
	[0057.408] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0057.408] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02223U.BMP") returned -1
	[0057.408] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02223U.BMP") returned -1
	[0057.408] lstrcmpiA (lpString1="", lpString2="PH02223U.BMP") returned -1
	[0057.408] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP") returned="PH02208U.BMP"
	[0057.408] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0057.408] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0057.408] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0057.408] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0057.408] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02223U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP"
	[0057.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP", pszSpec="*.zip") returned 0
	[0057.408] lstrlenA (lpString="*.zip") returned 5
	[0057.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP", pszSpec="*.rar") returned 0
	[0057.408] lstrlenA (lpString="*.rar") returned 5
	[0057.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP", pszSpec="*.7z") returned 0
	[0057.408] lstrlenA (lpString="*.7z") returned 4
	[0057.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP", pszSpec="*.tar") returned 0
	[0057.409] lstrlenA (lpString="*.tar") returned 5
	[0057.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP", pszSpec="*.gzip") returned 0
	[0057.409] lstrlenA (lpString="*.gzip") returned 6
	[0057.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP", pszSpec="*.jpg") returned 0
	[0057.409] lstrlenA (lpString="*.jpg") returned 5
	[0057.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP", pszSpec="*.jpeg") returned 0
	[0057.409] lstrlenA (lpString="*.jpeg") returned 6
	[0057.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP", pszSpec="*.bmp") returned 1
	[0057.409] lstrlenA (lpString="*.bmp") returned 5
	[0057.409] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP"
	[0057.409] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP"
	[0057.409] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP."
	[0057.409] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP.exe"
	[0057.409] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02223u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0057.409] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7db8
	[0057.409] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8)) returned 1
	[0057.409] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.409] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7d76, lpOverlapped=0x0) returned 1
	[0057.411] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP") returned="PH02223U.BMP"
	[0057.411] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.411] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7d76, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7d76, lpOverlapped=0x0) returned 1
	[0057.411] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.411] CloseHandle (hObject=0x214) returned 1
	[0057.413] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02223u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02223u.bmp.exe")) returned 1
	[0057.413] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10208b6e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10208b6e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1022edb4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02291U.BMP", cAlternateFileName="")) returned 1
	[0057.413] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0057.413] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02291U.BMP") returned -1
	[0057.413] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02291U.BMP") returned -1
	[0057.413] lstrcmpiA (lpString1="", lpString2="PH02291U.BMP") returned -1
	[0057.413] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP") returned="PH02223U.BMP"
	[0057.413] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0057.413] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0057.413] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0057.414] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0057.414] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02291U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02291U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02291U.BMP"
	[0057.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02291U.BMP", pszSpec="*.zip") returned 0
	[0057.414] lstrlenA (lpString="*.zip") returned 5
	[0057.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02291U.BMP", pszSpec="*.rar") returned 0
	[0057.414] lstrlenA (lpString="*.rar") returned 5
	[0057.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02291U.BMP", pszSpec="*.7z") returned 0
	[0057.414] lstrlenA (lpString="*.7z") returned 4
	[0057.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02291U.BMP", pszSpec="*.tar") returned 0
	[0057.414] lstrlenA (lpString="*.tar") returned 5
	[0057.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02291U.BMP", pszSpec="*.gzip") returned 0
	[0057.414] lstrlenA (lpString="*.gzip") returned 6
	[0057.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02291U.BMP", pszSpec="*.jpg") returned 0
	[0057.414] lstrlenA (lpString="*.jpg") returned 5
	[0057.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02291U.BMP", pszSpec="*.jpeg") returned 0
	[0057.414] lstrlenA (lpString="*.jpeg") returned 6
	[0057.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02291U.BMP", pszSpec="*.bmp") returned 1
	[0057.414] lstrlenA (lpString="*.bmp") returned 5
	[0057.414] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02291U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02291U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02291U.BMP"
	[0057.414] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02291U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02291U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02291U.BMP"
	[0057.414] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02291U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02291U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02291U.BMP."
	[0057.414] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02291U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02291U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02291U.BMP.exe"
	[0057.414] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02291u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0057.415] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7db8
	[0057.415] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x10208b6e, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x10208b6e, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8)) returned 1
	[0057.415] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.415] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7d76, lpOverlapped=0x0) returned 1
	[0057.417] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02291U.BMP") returned="PH02291U.BMP"
	[0057.417] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.417] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7d76, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7d76, lpOverlapped=0x0) returned 1
	[0057.417] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.417] CloseHandle (hObject=0x214) returned 1
	[0057.418] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02291u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02291U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02291u.bmp.exe")) returned 1
	[0057.419] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1022edb4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1022edb4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1022edb4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02398U.BMP", cAlternateFileName="")) returned 1
	[0057.419] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0057.419] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02398U.BMP") returned -1
	[0057.419] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02398U.BMP") returned -1
	[0057.419] lstrcmpiA (lpString1="", lpString2="PH02398U.BMP") returned -1
	[0057.419] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02291U.BMP") returned="PH02291U.BMP"
	[0057.419] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0057.419] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0057.419] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0057.419] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0057.419] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02398U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP"
	[0057.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP", pszSpec="*.zip") returned 0
	[0057.419] lstrlenA (lpString="*.zip") returned 5
	[0057.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP", pszSpec="*.rar") returned 0
	[0057.419] lstrlenA (lpString="*.rar") returned 5
	[0057.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP", pszSpec="*.7z") returned 0
	[0057.420] lstrlenA (lpString="*.7z") returned 4
	[0057.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP", pszSpec="*.tar") returned 0
	[0057.420] lstrlenA (lpString="*.tar") returned 5
	[0057.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP", pszSpec="*.gzip") returned 0
	[0057.420] lstrlenA (lpString="*.gzip") returned 6
	[0057.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP", pszSpec="*.jpg") returned 0
	[0057.420] lstrlenA (lpString="*.jpg") returned 5
	[0057.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP", pszSpec="*.jpeg") returned 0
	[0057.420] lstrlenA (lpString="*.jpeg") returned 6
	[0057.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP", pszSpec="*.bmp") returned 1
	[0057.420] lstrlenA (lpString="*.bmp") returned 5
	[0057.420] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP"
	[0057.420] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP"
	[0057.420] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP."
	[0057.420] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP.exe"
	[0057.420] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02398u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0057.420] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7ce0
	[0057.420] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8)) returned 1
	[0057.420] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.420] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7c9e, lpOverlapped=0x0) returned 1
	[0057.422] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP") returned="PH02398U.BMP"
	[0057.422] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.422] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7c9e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7c9e, lpOverlapped=0x0) returned 1
	[0057.422] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.422] CloseHandle (hObject=0x214) returned 1
	[0057.423] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02398u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02398u.bmp.exe")) returned 1
	[0057.424] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10208b6e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10208b6e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1022edb4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02412K.JPG", cAlternateFileName="")) returned 1
	[0057.424] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0057.424] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02412K.JPG") returned -1
	[0057.424] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02412K.JPG") returned -1
	[0057.424] lstrcmpiA (lpString1="", lpString2="PH02412K.JPG") returned -1
	[0057.424] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP") returned="PH02398U.BMP"
	[0057.424] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0057.424] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0057.424] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0057.424] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0057.424] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02412K.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG"
	[0057.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG", pszSpec="*.zip") returned 0
	[0057.424] lstrlenA (lpString="*.zip") returned 5
	[0057.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG", pszSpec="*.rar") returned 0
	[0057.424] lstrlenA (lpString="*.rar") returned 5
	[0057.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG", pszSpec="*.7z") returned 0
	[0057.424] lstrlenA (lpString="*.7z") returned 4
	[0057.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG", pszSpec="*.tar") returned 0
	[0057.424] lstrlenA (lpString="*.tar") returned 5
	[0057.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG", pszSpec="*.gzip") returned 0
	[0057.424] lstrlenA (lpString="*.gzip") returned 6
	[0057.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG", pszSpec="*.jpg") returned 1
	[0057.424] lstrlenA (lpString="*.jpg") returned 5
	[0057.424] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG"
	[0057.425] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG"
	[0057.425] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG."
	[0057.425] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG.exe"
	[0057.425] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02412k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0057.425] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd5
	[0057.425] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x10208b6e, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x10208b6e, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8)) returned 1
	[0057.425] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.425] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xd93, lpOverlapped=0x0) returned 1
	[0057.427] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG") returned="PH02412K.JPG"
	[0057.427] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.427] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xd93, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xd93, lpOverlapped=0x0) returned 1
	[0057.427] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.427] CloseHandle (hObject=0x214) returned 1
	[0057.428] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02412k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02412k.jpg.exe")) returned 1
	[0057.429] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10208b6e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10208b6e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1022edb4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02417U.BMP", cAlternateFileName="")) returned 1
	[0057.429] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0057.429] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02417U.BMP") returned -1
	[0057.429] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02417U.BMP") returned -1
	[0057.429] lstrcmpiA (lpString1="", lpString2="PH02417U.BMP") returned -1
	[0057.429] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG") returned="PH02412K.JPG"
	[0057.429] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0057.429] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0057.429] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0057.429] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0057.429] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02417U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP"
	[0057.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP", pszSpec="*.zip") returned 0
	[0057.429] lstrlenA (lpString="*.zip") returned 5
	[0057.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP", pszSpec="*.rar") returned 0
	[0057.429] lstrlenA (lpString="*.rar") returned 5
	[0057.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP", pszSpec="*.7z") returned 0
	[0057.429] lstrlenA (lpString="*.7z") returned 4
	[0057.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP", pszSpec="*.tar") returned 0
	[0057.429] lstrlenA (lpString="*.tar") returned 5
	[0057.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP", pszSpec="*.gzip") returned 0
	[0057.429] lstrlenA (lpString="*.gzip") returned 6
	[0057.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP", pszSpec="*.jpg") returned 0
	[0057.429] lstrlenA (lpString="*.jpg") returned 5
	[0057.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP", pszSpec="*.jpeg") returned 0
	[0057.429] lstrlenA (lpString="*.jpeg") returned 6
	[0057.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP", pszSpec="*.bmp") returned 1
	[0057.430] lstrlenA (lpString="*.bmp") returned 5
	[0057.430] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP"
	[0057.430] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP"
	[0057.430] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP."
	[0057.430] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP.exe"
	[0057.430] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02417u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0057.430] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7ce0
	[0057.430] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x10208b6e, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x10208b6e, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8)) returned 1
	[0057.430] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.430] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7c9e, lpOverlapped=0x0) returned 1
	[0057.432] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP") returned="PH02417U.BMP"
	[0057.432] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.432] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7c9e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7c9e, lpOverlapped=0x0) returned 1
	[0057.432] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.432] CloseHandle (hObject=0x214) returned 1
	[0057.434] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02417u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02417u.bmp.exe")) returned 1
	[0057.434] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10208b6e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10208b6e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1022edb4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02466U.BMP", cAlternateFileName="")) returned 1
	[0057.434] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0057.434] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02466U.BMP") returned -1
	[0057.434] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02466U.BMP") returned -1
	[0057.434] lstrcmpiA (lpString1="", lpString2="PH02466U.BMP") returned -1
	[0057.434] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP") returned="PH02417U.BMP"
	[0057.434] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0057.434] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0057.434] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0057.435] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0057.435] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02466U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02466U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02466U.BMP"
	[0057.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02466U.BMP", pszSpec="*.zip") returned 0
	[0057.435] lstrlenA (lpString="*.zip") returned 5
	[0057.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02466U.BMP", pszSpec="*.rar") returned 0
	[0057.435] lstrlenA (lpString="*.rar") returned 5
	[0057.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02466U.BMP", pszSpec="*.7z") returned 0
	[0057.435] lstrlenA (lpString="*.7z") returned 4
	[0057.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02466U.BMP", pszSpec="*.tar") returned 0
	[0057.435] lstrlenA (lpString="*.tar") returned 5
	[0057.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02466U.BMP", pszSpec="*.gzip") returned 0
	[0057.435] lstrlenA (lpString="*.gzip") returned 6
	[0057.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02466U.BMP", pszSpec="*.jpg") returned 0
	[0057.435] lstrlenA (lpString="*.jpg") returned 5
	[0057.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02466U.BMP", pszSpec="*.jpeg") returned 0
	[0057.435] lstrlenA (lpString="*.jpeg") returned 6
	[0057.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02466U.BMP", pszSpec="*.bmp") returned 1
	[0057.435] lstrlenA (lpString="*.bmp") returned 5
	[0057.435] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02466U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02466U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02466U.BMP"
	[0057.435] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02466U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02466U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02466U.BMP"
	[0057.435] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02466U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02466U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02466U.BMP."
	[0057.435] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02466U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02466U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02466U.BMP.exe"
	[0057.435] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02466u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0057.435] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7c08
	[0057.435] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x10208b6e, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x10208b6e, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8)) returned 1
	[0057.435] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.436] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7bc6, lpOverlapped=0x0) returned 1
	[0057.544] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02466U.BMP") returned="PH02466U.BMP"
	[0057.544] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.544] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7bc6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7bc6, lpOverlapped=0x0) returned 1
	[0057.544] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.544] CloseHandle (hObject=0x214) returned 1
	[0057.546] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02466u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02466U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02466u.bmp.exe")) returned 1
	[0057.546] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1022edb4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1022edb4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1027b233, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x48fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02470U.BMP", cAlternateFileName="")) returned 1
	[0057.546] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0057.546] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02470U.BMP") returned -1
	[0057.547] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02470U.BMP") returned -1
	[0057.547] lstrcmpiA (lpString1="", lpString2="PH02470U.BMP") returned -1
	[0057.547] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02466U.BMP") returned="PH02466U.BMP"
	[0057.547] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0057.547] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0057.547] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0057.547] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0057.547] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02470U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP"
	[0057.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP", pszSpec="*.zip") returned 0
	[0057.547] lstrlenA (lpString="*.zip") returned 5
	[0057.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP", pszSpec="*.rar") returned 0
	[0057.547] lstrlenA (lpString="*.rar") returned 5
	[0057.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP", pszSpec="*.7z") returned 0
	[0057.547] lstrlenA (lpString="*.7z") returned 4
	[0057.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP", pszSpec="*.tar") returned 0
	[0057.547] lstrlenA (lpString="*.tar") returned 5
	[0057.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP", pszSpec="*.gzip") returned 0
	[0057.547] lstrlenA (lpString="*.gzip") returned 6
	[0057.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP", pszSpec="*.jpg") returned 0
	[0057.547] lstrlenA (lpString="*.jpg") returned 5
	[0057.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP", pszSpec="*.jpeg") returned 0
	[0057.547] lstrlenA (lpString="*.jpeg") returned 6
	[0057.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP", pszSpec="*.bmp") returned 1
	[0057.547] lstrlenA (lpString="*.bmp") returned 5
	[0057.547] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP"
	[0057.547] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP"
	[0057.547] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP."
	[0057.547] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP.exe"
	[0057.547] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02470u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0057.548] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x48fc
	[0057.548] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1027b233, dwHighDateTime=0x1d327e8)) returned 1
	[0057.548] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.548] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x48ba, lpOverlapped=0x0) returned 1
	[0057.549] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP") returned="PH02470U.BMP"
	[0057.549] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.549] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x48ba, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x48ba, lpOverlapped=0x0) returned 1
	[0057.550] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.550] CloseHandle (hObject=0x214) returned 1
	[0057.551] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02470u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02470u.bmp.exe")) returned 1
	[0057.551] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1022edb4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1022edb4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1027b233, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02503U.BMP", cAlternateFileName="")) returned 1
	[0057.551] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0057.551] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02503U.BMP") returned -1
	[0057.551] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02503U.BMP") returned -1
	[0057.551] lstrcmpiA (lpString1="", lpString2="PH02503U.BMP") returned -1
	[0057.551] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP") returned="PH02470U.BMP"
	[0057.551] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0057.551] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0057.551] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0057.551] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0057.552] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02503U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP"
	[0057.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP", pszSpec="*.zip") returned 0
	[0057.552] lstrlenA (lpString="*.zip") returned 5
	[0057.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP", pszSpec="*.rar") returned 0
	[0057.552] lstrlenA (lpString="*.rar") returned 5
	[0057.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP", pszSpec="*.7z") returned 0
	[0057.552] lstrlenA (lpString="*.7z") returned 4
	[0057.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP", pszSpec="*.tar") returned 0
	[0057.552] lstrlenA (lpString="*.tar") returned 5
	[0057.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP", pszSpec="*.gzip") returned 0
	[0057.552] lstrlenA (lpString="*.gzip") returned 6
	[0057.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP", pszSpec="*.jpg") returned 0
	[0057.552] lstrlenA (lpString="*.jpg") returned 5
	[0057.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP", pszSpec="*.jpeg") returned 0
	[0057.552] lstrlenA (lpString="*.jpeg") returned 6
	[0057.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP", pszSpec="*.bmp") returned 1
	[0057.552] lstrlenA (lpString="*.bmp") returned 5
	[0057.552] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP"
	[0057.552] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP"
	[0057.552] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP."
	[0057.552] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP.exe"
	[0057.552] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02503u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0057.553] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7ce0
	[0057.553] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1027b233, dwHighDateTime=0x1d327e8)) returned 1
	[0057.553] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.553] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7c9e, lpOverlapped=0x0) returned 1
	[0057.554] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP") returned="PH02503U.BMP"
	[0057.555] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.555] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7c9e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7c9e, lpOverlapped=0x0) returned 1
	[0057.555] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.555] CloseHandle (hObject=0x214) returned 1
	[0057.556] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02503u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02503u.bmp.exe")) returned 1
	[0057.557] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1022edb4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1022edb4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1027b233, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8499, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02567J.JPG", cAlternateFileName="")) returned 1
	[0057.557] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0057.557] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02567J.JPG") returned -1
	[0057.557] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02567J.JPG") returned -1
	[0057.557] lstrcmpiA (lpString1="", lpString2="PH02567J.JPG") returned -1
	[0057.557] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP") returned="PH02503U.BMP"
	[0057.557] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0057.557] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0057.557] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0057.557] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0057.557] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02567J.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG"
	[0057.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG", pszSpec="*.zip") returned 0
	[0057.557] lstrlenA (lpString="*.zip") returned 5
	[0057.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG", pszSpec="*.rar") returned 0
	[0057.557] lstrlenA (lpString="*.rar") returned 5
	[0057.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG", pszSpec="*.7z") returned 0
	[0057.557] lstrlenA (lpString="*.7z") returned 4
	[0057.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG", pszSpec="*.tar") returned 0
	[0057.557] lstrlenA (lpString="*.tar") returned 5
	[0057.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG", pszSpec="*.gzip") returned 0
	[0057.557] lstrlenA (lpString="*.gzip") returned 6
	[0057.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG", pszSpec="*.jpg") returned 1
	[0057.558] lstrlenA (lpString="*.jpg") returned 5
	[0057.558] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG"
	[0057.558] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG"
	[0057.558] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG."
	[0057.558] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG.exe"
	[0057.558] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02567j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0057.558] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8499
	[0057.558] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1027b233, dwHighDateTime=0x1d327e8)) returned 1
	[0057.558] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.558] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x8457, lpOverlapped=0x0) returned 1
	[0057.559] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG") returned="PH02567J.JPG"
	[0057.560] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.560] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x8457, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x8457, lpOverlapped=0x0) returned 1
	[0057.560] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.560] CloseHandle (hObject=0x214) returned 1
	[0057.562] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02567j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02567j.jpg.exe")) returned 1
	[0057.562] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1022edb4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1022edb4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1025500d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x639b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02736G.GIF", cAlternateFileName="")) returned 1
	[0057.562] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0057.562] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02736G.GIF") returned -1
	[0057.562] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02736G.GIF") returned -1
	[0057.562] lstrcmpiA (lpString1="", lpString2="PH02736G.GIF") returned -1
	[0057.562] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG") returned="PH02567J.JPG"
	[0057.562] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0057.562] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0057.562] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0057.562] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0057.562] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02736G.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736G.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736G.GIF"
	[0057.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736G.GIF", pszSpec="*.zip") returned 0
	[0057.562] lstrlenA (lpString="*.zip") returned 5
	[0057.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736G.GIF", pszSpec="*.rar") returned 0
	[0057.562] lstrlenA (lpString="*.rar") returned 5
	[0057.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736G.GIF", pszSpec="*.7z") returned 0
	[0057.563] lstrlenA (lpString="*.7z") returned 4
	[0057.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736G.GIF", pszSpec="*.tar") returned 0
	[0057.563] lstrlenA (lpString="*.tar") returned 5
	[0057.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736G.GIF", pszSpec="*.gzip") returned 0
	[0057.563] lstrlenA (lpString="*.gzip") returned 6
	[0057.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736G.GIF", pszSpec="*.jpg") returned 0
	[0057.563] lstrlenA (lpString="*.jpg") returned 5
	[0057.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736G.GIF", pszSpec="*.jpeg") returned 0
	[0057.563] lstrlenA (lpString="*.jpeg") returned 6
	[0057.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736G.GIF", pszSpec="*.bmp") returned 0
	[0057.563] lstrlenA (lpString="*.bmp") returned 5
	[0057.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736G.GIF", pszSpec="*.gif") returned 1
	[0057.563] lstrlenA (lpString="*.gif") returned 5
	[0057.563] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736G.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736G.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736G.GIF"
	[0057.563] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736G.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736G.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736G.GIF"
	[0057.563] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736G.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736G.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736G.GIF."
	[0057.563] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736G.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736G.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736G.GIF.exe"
	[0057.563] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02736g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0057.563] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x639b
	[0057.563] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1025500d, dwHighDateTime=0x1d327e8)) returned 1
	[0057.563] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.563] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x6359, lpOverlapped=0x0) returned 1
	[0057.565] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736G.GIF") returned="PH02736G.GIF"
	[0057.565] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.565] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x6359, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x6359, lpOverlapped=0x0) returned 1
	[0057.565] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.565] CloseHandle (hObject=0x214) returned 1
	[0057.566] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02736g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736G.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02736g.gif.exe")) returned 1
	[0057.567] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1022edb4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1022edb4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1022edb4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7e90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02736U.BMP", cAlternateFileName="")) returned 1
	[0057.567] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0057.567] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02736U.BMP") returned -1
	[0057.567] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02736U.BMP") returned -1
	[0057.567] lstrcmpiA (lpString1="", lpString2="PH02736U.BMP") returned -1
	[0057.567] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736G.GIF") returned="PH02736G.GIF"
	[0057.567] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0057.567] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0057.567] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0057.567] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0057.567] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02736U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP"
	[0057.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP", pszSpec="*.zip") returned 0
	[0057.567] lstrlenA (lpString="*.zip") returned 5
	[0057.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP", pszSpec="*.rar") returned 0
	[0057.568] lstrlenA (lpString="*.rar") returned 5
	[0057.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP", pszSpec="*.7z") returned 0
	[0057.568] lstrlenA (lpString="*.7z") returned 4
	[0057.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP", pszSpec="*.tar") returned 0
	[0057.568] lstrlenA (lpString="*.tar") returned 5
	[0057.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP", pszSpec="*.gzip") returned 0
	[0057.568] lstrlenA (lpString="*.gzip") returned 6
	[0057.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP", pszSpec="*.jpg") returned 0
	[0057.568] lstrlenA (lpString="*.jpg") returned 5
	[0057.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP", pszSpec="*.jpeg") returned 0
	[0057.568] lstrlenA (lpString="*.jpeg") returned 6
	[0057.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP", pszSpec="*.bmp") returned 1
	[0057.568] lstrlenA (lpString="*.bmp") returned 5
	[0057.568] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP"
	[0057.568] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP"
	[0057.568] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP."
	[0057.568] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP.exe"
	[0057.568] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02736u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0057.568] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7e90
	[0057.568] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8)) returned 1
	[0057.568] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.568] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7e4e, lpOverlapped=0x0) returned 1
	[0057.570] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP") returned="PH02736U.BMP"
	[0057.570] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.570] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7e4e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7e4e, lpOverlapped=0x0) returned 1
	[0057.570] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.570] CloseHandle (hObject=0x214) returned 1
	[0057.572] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02736u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02736u.bmp.exe")) returned 1
	[0057.576] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1022edb4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1022edb4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1022edb4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8118, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02738U.BMP", cAlternateFileName="")) returned 1
	[0057.576] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0057.576] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02738U.BMP") returned -1
	[0057.576] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02738U.BMP") returned -1
	[0057.576] lstrcmpiA (lpString1="", lpString2="PH02738U.BMP") returned -1
	[0057.576] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP") returned="PH02736U.BMP"
	[0057.576] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0057.576] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0057.576] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0057.576] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0057.576] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02738U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP"
	[0057.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP", pszSpec="*.zip") returned 0
	[0057.577] lstrlenA (lpString="*.zip") returned 5
	[0057.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP", pszSpec="*.rar") returned 0
	[0057.577] lstrlenA (lpString="*.rar") returned 5
	[0057.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP", pszSpec="*.7z") returned 0
	[0057.577] lstrlenA (lpString="*.7z") returned 4
	[0057.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP", pszSpec="*.tar") returned 0
	[0057.577] lstrlenA (lpString="*.tar") returned 5
	[0057.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP", pszSpec="*.gzip") returned 0
	[0057.577] lstrlenA (lpString="*.gzip") returned 6
	[0057.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP", pszSpec="*.jpg") returned 0
	[0057.577] lstrlenA (lpString="*.jpg") returned 5
	[0057.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP", pszSpec="*.jpeg") returned 0
	[0057.577] lstrlenA (lpString="*.jpeg") returned 6
	[0057.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP", pszSpec="*.bmp") returned 1
	[0057.577] lstrlenA (lpString="*.bmp") returned 5
	[0057.577] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP"
	[0057.577] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP"
	[0057.577] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP."
	[0057.577] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP.exe"
	[0057.577] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02738u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0057.577] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8118
	[0057.577] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8)) returned 1
	[0057.577] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.577] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x80d6, lpOverlapped=0x0) returned 1
	[0057.665] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP") returned="PH02738U.BMP"
	[0057.665] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.665] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x80d6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x80d6, lpOverlapped=0x0) returned 1
	[0057.665] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.665] CloseHandle (hObject=0x214) returned 1
	[0057.667] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02738u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02738u.bmp.exe")) returned 1
	[0057.668] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1022edb4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1022edb4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1025500d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5f2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02740G.GIF", cAlternateFileName="")) returned 1
	[0057.668] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0057.668] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02740G.GIF") returned -1
	[0057.668] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02740G.GIF") returned -1
	[0057.668] lstrcmpiA (lpString1="", lpString2="PH02740G.GIF") returned -1
	[0057.668] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP") returned="PH02738U.BMP"
	[0057.668] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0057.668] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0057.668] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0057.668] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0057.668] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02740G.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF"
	[0057.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF", pszSpec="*.zip") returned 0
	[0057.668] lstrlenA (lpString="*.zip") returned 5
	[0057.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF", pszSpec="*.rar") returned 0
	[0057.668] lstrlenA (lpString="*.rar") returned 5
	[0057.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF", pszSpec="*.7z") returned 0
	[0057.668] lstrlenA (lpString="*.7z") returned 4
	[0057.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF", pszSpec="*.tar") returned 0
	[0057.668] lstrlenA (lpString="*.tar") returned 5
	[0057.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF", pszSpec="*.gzip") returned 0
	[0057.669] lstrlenA (lpString="*.gzip") returned 6
	[0057.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF", pszSpec="*.jpg") returned 0
	[0057.669] lstrlenA (lpString="*.jpg") returned 5
	[0057.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF", pszSpec="*.jpeg") returned 0
	[0057.669] lstrlenA (lpString="*.jpeg") returned 6
	[0057.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF", pszSpec="*.bmp") returned 0
	[0057.669] lstrlenA (lpString="*.bmp") returned 5
	[0057.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF", pszSpec="*.gif") returned 1
	[0057.669] lstrlenA (lpString="*.gif") returned 5
	[0057.669] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF"
	[0057.669] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF"
	[0057.669] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF."
	[0057.669] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF.exe"
	[0057.669] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02740g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0057.669] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5f2b
	[0057.669] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1025500d, dwHighDateTime=0x1d327e8)) returned 1
	[0057.669] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.669] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x5ee9, lpOverlapped=0x0) returned 1
	[0057.671] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF") returned="PH02740G.GIF"
	[0057.671] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.671] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x5ee9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x5ee9, lpOverlapped=0x0) returned 1
	[0057.671] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.671] CloseHandle (hObject=0x214) returned 1
	[0057.672] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02740g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02740g.gif.exe")) returned 1
	[0057.673] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1022edb4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1022edb4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1027b233, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02740U.BMP", cAlternateFileName="")) returned 1
	[0057.673] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0057.673] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02740U.BMP") returned -1
	[0057.673] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02740U.BMP") returned -1
	[0057.673] lstrcmpiA (lpString1="", lpString2="PH02740U.BMP") returned -1
	[0057.673] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF") returned="PH02740G.GIF"
	[0057.673] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0057.673] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0057.673] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0057.673] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0057.673] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02740U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740U.BMP"
	[0057.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740U.BMP", pszSpec="*.zip") returned 0
	[0057.673] lstrlenA (lpString="*.zip") returned 5
	[0057.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740U.BMP", pszSpec="*.rar") returned 0
	[0057.673] lstrlenA (lpString="*.rar") returned 5
	[0057.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740U.BMP", pszSpec="*.7z") returned 0
	[0057.673] lstrlenA (lpString="*.7z") returned 4
	[0057.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740U.BMP", pszSpec="*.tar") returned 0
	[0057.673] lstrlenA (lpString="*.tar") returned 5
	[0057.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740U.BMP", pszSpec="*.gzip") returned 0
	[0057.674] lstrlenA (lpString="*.gzip") returned 6
	[0057.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740U.BMP", pszSpec="*.jpg") returned 0
	[0057.674] lstrlenA (lpString="*.jpg") returned 5
	[0057.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740U.BMP", pszSpec="*.jpeg") returned 0
	[0057.674] lstrlenA (lpString="*.jpeg") returned 6
	[0057.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740U.BMP", pszSpec="*.bmp") returned 1
	[0057.674] lstrlenA (lpString="*.bmp") returned 5
	[0057.674] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740U.BMP"
	[0057.674] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740U.BMP"
	[0057.674] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740U.BMP."
	[0057.674] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740U.BMP.exe"
	[0057.674] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02740u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0057.674] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7f68
	[0057.674] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1027b233, dwHighDateTime=0x1d327e8)) returned 1
	[0057.674] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.674] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7f26, lpOverlapped=0x0) returned 1
	[0057.676] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740U.BMP") returned="PH02740U.BMP"
	[0057.676] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.676] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7f26, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7f26, lpOverlapped=0x0) returned 1
	[0057.676] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.676] CloseHandle (hObject=0x214) returned 1
	[0057.677] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02740u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02740u.bmp.exe")) returned 1
	[0057.678] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1022edb4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1022edb4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1022edb4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x50a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02742G.GIF", cAlternateFileName="")) returned 1
	[0057.678] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0057.678] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02742G.GIF") returned -1
	[0057.678] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02742G.GIF") returned -1
	[0057.678] lstrcmpiA (lpString1="", lpString2="PH02742G.GIF") returned -1
	[0057.678] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740U.BMP") returned="PH02740U.BMP"
	[0057.678] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0057.678] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0057.678] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0057.678] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0057.678] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02742G.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF"
	[0057.678] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF", pszSpec="*.zip") returned 0
	[0057.678] lstrlenA (lpString="*.zip") returned 5
	[0057.678] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF", pszSpec="*.rar") returned 0
	[0057.678] lstrlenA (lpString="*.rar") returned 5
	[0057.678] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF", pszSpec="*.7z") returned 0
	[0057.678] lstrlenA (lpString="*.7z") returned 4
	[0057.678] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF", pszSpec="*.tar") returned 0
	[0057.679] lstrlenA (lpString="*.tar") returned 5
	[0057.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF", pszSpec="*.gzip") returned 0
	[0057.679] lstrlenA (lpString="*.gzip") returned 6
	[0057.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF", pszSpec="*.jpg") returned 0
	[0057.679] lstrlenA (lpString="*.jpg") returned 5
	[0057.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF", pszSpec="*.jpeg") returned 0
	[0057.679] lstrlenA (lpString="*.jpeg") returned 6
	[0057.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF", pszSpec="*.bmp") returned 0
	[0057.679] lstrlenA (lpString="*.bmp") returned 5
	[0057.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF", pszSpec="*.gif") returned 1
	[0057.679] lstrlenA (lpString="*.gif") returned 5
	[0057.679] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF"
	[0057.679] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF"
	[0057.679] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF."
	[0057.679] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF.exe"
	[0057.679] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02742g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0057.679] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x50a5
	[0057.679] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8)) returned 1
	[0057.679] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.679] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x5063, lpOverlapped=0x0) returned 1
	[0057.685] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF") returned="PH02742G.GIF"
	[0057.685] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.685] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x5063, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x5063, lpOverlapped=0x0) returned 1
	[0057.685] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.685] CloseHandle (hObject=0x214) returned 1
	[0057.686] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02742g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02742g.gif.exe")) returned 1
	[0057.687] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1022edb4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1022edb4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1022edb4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02742U.BMP", cAlternateFileName="")) returned 1
	[0057.687] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0057.687] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02742U.BMP") returned -1
	[0057.687] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02742U.BMP") returned -1
	[0057.687] lstrcmpiA (lpString1="", lpString2="PH02742U.BMP") returned -1
	[0057.687] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF") returned="PH02742G.GIF"
	[0057.687] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0057.687] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0057.687] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0057.687] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0057.687] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02742U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP"
	[0057.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP", pszSpec="*.zip") returned 0
	[0057.687] lstrlenA (lpString="*.zip") returned 5
	[0057.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP", pszSpec="*.rar") returned 0
	[0057.687] lstrlenA (lpString="*.rar") returned 5
	[0057.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP", pszSpec="*.7z") returned 0
	[0057.687] lstrlenA (lpString="*.7z") returned 4
	[0057.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP", pszSpec="*.tar") returned 0
	[0057.687] lstrlenA (lpString="*.tar") returned 5
	[0057.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP", pszSpec="*.gzip") returned 0
	[0057.687] lstrlenA (lpString="*.gzip") returned 6
	[0057.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP", pszSpec="*.jpg") returned 0
	[0057.687] lstrlenA (lpString="*.jpg") returned 5
	[0057.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP", pszSpec="*.jpeg") returned 0
	[0057.687] lstrlenA (lpString="*.jpeg") returned 6
	[0057.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP", pszSpec="*.bmp") returned 1
	[0057.687] lstrlenA (lpString="*.bmp") returned 5
	[0057.688] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP"
	[0057.688] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP"
	[0057.688] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP."
	[0057.688] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP.exe"
	[0057.688] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02742u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0057.688] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7ce0
	[0057.688] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8)) returned 1
	[0057.688] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.688] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7c9e, lpOverlapped=0x0) returned 1
	[0057.689] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP") returned="PH02742U.BMP"
	[0057.690] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.690] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7c9e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7c9e, lpOverlapped=0x0) returned 1
	[0057.690] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.690] CloseHandle (hObject=0x214) returned 1
	[0057.691] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02742u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02742u.bmp.exe")) returned 1
	[0057.692] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102a14ae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102a14ae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102a14ae, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6d86, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02743G.GIF", cAlternateFileName="")) returned 1
	[0057.692] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0057.899] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02743G.GIF") returned -1
	[0057.899] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02743G.GIF") returned -1
	[0057.899] lstrcmpiA (lpString1="", lpString2="PH02743G.GIF") returned -1
	[0057.899] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP") returned="PH02742U.BMP"
	[0057.899] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0057.899] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0057.899] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0057.899] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0057.900] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02743G.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF"
	[0057.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF", pszSpec="*.zip") returned 0
	[0057.900] lstrlenA (lpString="*.zip") returned 5
	[0057.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF", pszSpec="*.rar") returned 0
	[0057.900] lstrlenA (lpString="*.rar") returned 5
	[0057.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF", pszSpec="*.7z") returned 0
	[0057.900] lstrlenA (lpString="*.7z") returned 4
	[0057.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF", pszSpec="*.tar") returned 0
	[0057.900] lstrlenA (lpString="*.tar") returned 5
	[0057.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF", pszSpec="*.gzip") returned 0
	[0057.900] lstrlenA (lpString="*.gzip") returned 6
	[0057.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF", pszSpec="*.jpg") returned 0
	[0057.900] lstrlenA (lpString="*.jpg") returned 5
	[0057.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF", pszSpec="*.jpeg") returned 0
	[0057.900] lstrlenA (lpString="*.jpeg") returned 6
	[0057.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF", pszSpec="*.bmp") returned 0
	[0057.900] lstrlenA (lpString="*.bmp") returned 5
	[0057.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF", pszSpec="*.gif") returned 1
	[0057.900] lstrlenA (lpString="*.gif") returned 5
	[0057.900] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF"
	[0057.900] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF"
	[0057.900] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF."
	[0057.900] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF.exe"
	[0057.900] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02743g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0057.901] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6d86
	[0057.901] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x102a14ae, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x102a14ae, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x102a14ae, dwHighDateTime=0x1d327e8)) returned 1
	[0057.901] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.901] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x6d44, lpOverlapped=0x0) returned 1
	[0057.903] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF") returned="PH02743G.GIF"
	[0057.903] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.903] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x6d44, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x6d44, lpOverlapped=0x0) returned 1
	[0057.903] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.903] CloseHandle (hObject=0x214) returned 1
	[0057.906] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02743g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02743g.gif.exe")) returned 1
	[0057.907] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1027b233, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1027b233, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1027b233, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5e7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02746G.GIF", cAlternateFileName="")) returned 1
	[0057.907] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0057.907] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02746G.GIF") returned -1
	[0057.907] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02746G.GIF") returned -1
	[0057.907] lstrcmpiA (lpString1="", lpString2="PH02746G.GIF") returned -1
	[0057.907] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF") returned="PH02743G.GIF"
	[0057.907] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0057.907] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0057.907] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0057.907] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0057.907] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02746G.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746G.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746G.GIF"
	[0057.907] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746G.GIF", pszSpec="*.zip") returned 0
	[0057.907] lstrlenA (lpString="*.zip") returned 5
	[0057.907] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746G.GIF", pszSpec="*.rar") returned 0
	[0057.908] lstrlenA (lpString="*.rar") returned 5
	[0057.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746G.GIF", pszSpec="*.7z") returned 0
	[0057.908] lstrlenA (lpString="*.7z") returned 4
	[0057.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746G.GIF", pszSpec="*.tar") returned 0
	[0057.908] lstrlenA (lpString="*.tar") returned 5
	[0057.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746G.GIF", pszSpec="*.gzip") returned 0
	[0057.908] lstrlenA (lpString="*.gzip") returned 6
	[0057.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746G.GIF", pszSpec="*.jpg") returned 0
	[0057.908] lstrlenA (lpString="*.jpg") returned 5
	[0057.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746G.GIF", pszSpec="*.jpeg") returned 0
	[0057.908] lstrlenA (lpString="*.jpeg") returned 6
	[0057.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746G.GIF", pszSpec="*.bmp") returned 0
	[0057.908] lstrlenA (lpString="*.bmp") returned 5
	[0057.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746G.GIF", pszSpec="*.gif") returned 1
	[0057.908] lstrlenA (lpString="*.gif") returned 5
	[0057.908] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746G.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746G.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746G.GIF"
	[0057.908] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746G.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746G.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746G.GIF"
	[0057.908] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746G.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746G.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746G.GIF."
	[0057.908] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746G.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746G.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746G.GIF.exe"
	[0057.908] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02746g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0057.909] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5e7b
	[0057.909] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1027b233, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1027b233, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1027b233, dwHighDateTime=0x1d327e8)) returned 1
	[0057.909] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.909] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x5e39, lpOverlapped=0x0) returned 1
	[0057.910] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746G.GIF") returned="PH02746G.GIF"
	[0057.910] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.910] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x5e39, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x5e39, lpOverlapped=0x0) returned 1
	[0057.911] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.911] CloseHandle (hObject=0x214) returned 1
	[0057.911] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02746g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746G.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02746g.gif.exe")) returned 1
	[0057.911] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1027b233, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1027b233, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102a14ae, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7d84, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02746U.BMP", cAlternateFileName="")) returned 1
	[0057.911] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0057.911] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02746U.BMP") returned -1
	[0057.911] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02746U.BMP") returned -1
	[0057.911] lstrcmpiA (lpString1="", lpString2="PH02746U.BMP") returned -1
	[0057.911] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746G.GIF") returned="PH02746G.GIF"
	[0057.911] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0057.911] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0057.911] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0057.912] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0057.912] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02746U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP"
	[0057.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP", pszSpec="*.zip") returned 0
	[0057.912] lstrlenA (lpString="*.zip") returned 5
	[0057.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP", pszSpec="*.rar") returned 0
	[0057.912] lstrlenA (lpString="*.rar") returned 5
	[0057.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP", pszSpec="*.7z") returned 0
	[0057.912] lstrlenA (lpString="*.7z") returned 4
	[0057.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP", pszSpec="*.tar") returned 0
	[0057.912] lstrlenA (lpString="*.tar") returned 5
	[0057.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP", pszSpec="*.gzip") returned 0
	[0057.912] lstrlenA (lpString="*.gzip") returned 6
	[0057.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP", pszSpec="*.jpg") returned 0
	[0057.912] lstrlenA (lpString="*.jpg") returned 5
	[0057.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP", pszSpec="*.jpeg") returned 0
	[0057.912] lstrlenA (lpString="*.jpeg") returned 6
	[0057.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP", pszSpec="*.bmp") returned 1
	[0057.912] lstrlenA (lpString="*.bmp") returned 5
	[0057.912] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP"
	[0057.912] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP"
	[0057.912] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP."
	[0057.912] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP.exe"
	[0057.912] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02746u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0057.913] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7d84
	[0057.913] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1027b233, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1027b233, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x102a14ae, dwHighDateTime=0x1d327e8)) returned 1
	[0057.913] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.913] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7d42, lpOverlapped=0x0) returned 1
	[0057.915] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP") returned="PH02746U.BMP"
	[0057.915] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.915] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7d42, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7d42, lpOverlapped=0x0) returned 1
	[0057.915] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.915] CloseHandle (hObject=0x214) returned 1
	[0057.915] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02746u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02746u.bmp.exe")) returned 1
	[0057.916] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1027b233, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1027b233, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102a14ae, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6090, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02748G.GIF", cAlternateFileName="")) returned 1
	[0057.916] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0057.916] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02748G.GIF") returned -1
	[0057.916] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02748G.GIF") returned -1
	[0057.916] lstrcmpiA (lpString1="", lpString2="PH02748G.GIF") returned -1
	[0057.916] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP") returned="PH02746U.BMP"
	[0057.916] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0057.916] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0057.916] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0057.916] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0057.916] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02748G.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF"
	[0057.916] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF", pszSpec="*.zip") returned 0
	[0057.916] lstrlenA (lpString="*.zip") returned 5
	[0057.916] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF", pszSpec="*.rar") returned 0
	[0057.916] lstrlenA (lpString="*.rar") returned 5
	[0057.916] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF", pszSpec="*.7z") returned 0
	[0057.916] lstrlenA (lpString="*.7z") returned 4
	[0057.916] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF", pszSpec="*.tar") returned 0
	[0057.916] lstrlenA (lpString="*.tar") returned 5
	[0057.916] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF", pszSpec="*.gzip") returned 0
	[0057.916] lstrlenA (lpString="*.gzip") returned 6
	[0057.916] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF", pszSpec="*.jpg") returned 0
	[0057.916] lstrlenA (lpString="*.jpg") returned 5
	[0057.916] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF", pszSpec="*.jpeg") returned 0
	[0057.916] lstrlenA (lpString="*.jpeg") returned 6
	[0057.916] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF", pszSpec="*.bmp") returned 0
	[0057.917] lstrlenA (lpString="*.bmp") returned 5
	[0057.917] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF", pszSpec="*.gif") returned 1
	[0057.917] lstrlenA (lpString="*.gif") returned 5
	[0057.917] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF"
	[0057.917] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF"
	[0057.917] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF."
	[0057.917] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF.exe"
	[0057.917] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02748g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0057.917] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6090
	[0057.917] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1027b233, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1027b233, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x102a14ae, dwHighDateTime=0x1d327e8)) returned 1
	[0057.917] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.917] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x604e, lpOverlapped=0x0) returned 1
	[0057.919] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF") returned="PH02748G.GIF"
	[0057.919] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.919] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x604e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x604e, lpOverlapped=0x0) returned 1
	[0057.919] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.919] CloseHandle (hObject=0x214) returned 1
	[0057.919] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02748g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02748g.gif.exe")) returned 1
	[0057.919] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1025500d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1025500d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1027b233, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7e90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02748U.BMP", cAlternateFileName="")) returned 1
	[0057.920] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0057.920] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02748U.BMP") returned -1
	[0057.920] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02748U.BMP") returned -1
	[0057.920] lstrcmpiA (lpString1="", lpString2="PH02748U.BMP") returned -1
	[0057.920] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF") returned="PH02748G.GIF"
	[0057.920] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0057.920] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0057.920] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0057.920] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0057.920] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02748U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP"
	[0057.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP", pszSpec="*.zip") returned 0
	[0057.920] lstrlenA (lpString="*.zip") returned 5
	[0057.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP", pszSpec="*.rar") returned 0
	[0057.920] lstrlenA (lpString="*.rar") returned 5
	[0057.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP", pszSpec="*.7z") returned 0
	[0057.920] lstrlenA (lpString="*.7z") returned 4
	[0057.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP", pszSpec="*.tar") returned 0
	[0057.920] lstrlenA (lpString="*.tar") returned 5
	[0057.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP", pszSpec="*.gzip") returned 0
	[0057.920] lstrlenA (lpString="*.gzip") returned 6
	[0057.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP", pszSpec="*.jpg") returned 0
	[0057.920] lstrlenA (lpString="*.jpg") returned 5
	[0057.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP", pszSpec="*.jpeg") returned 0
	[0057.920] lstrlenA (lpString="*.jpeg") returned 6
	[0057.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP", pszSpec="*.bmp") returned 1
	[0057.920] lstrlenA (lpString="*.bmp") returned 5
	[0057.920] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP"
	[0057.920] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP"
	[0057.920] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP."
	[0057.920] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP.exe"
	[0057.920] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02748u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0057.921] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7e90
	[0057.921] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1025500d, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1025500d, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1027b233, dwHighDateTime=0x1d327e8)) returned 1
	[0057.921] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.921] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7e4e, lpOverlapped=0x0) returned 1
	[0057.923] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP") returned="PH02748U.BMP"
	[0057.923] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.923] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7e4e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7e4e, lpOverlapped=0x0) returned 1
	[0057.923] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.923] CloseHandle (hObject=0x214) returned 1
	[0057.923] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02748u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02748u.bmp.exe")) returned 1
	[0057.924] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1027b233, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1027b233, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1027b233, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8795, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02749G.GIF", cAlternateFileName="")) returned 1
	[0057.924] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0057.924] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02749G.GIF") returned -1
	[0057.924] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02749G.GIF") returned -1
	[0057.924] lstrcmpiA (lpString1="", lpString2="PH02749G.GIF") returned -1
	[0057.924] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP") returned="PH02748U.BMP"
	[0057.924] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0057.924] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0057.924] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0057.924] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0057.924] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02749G.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749G.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749G.GIF"
	[0057.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749G.GIF", pszSpec="*.zip") returned 0
	[0057.924] lstrlenA (lpString="*.zip") returned 5
	[0057.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749G.GIF", pszSpec="*.rar") returned 0
	[0057.924] lstrlenA (lpString="*.rar") returned 5
	[0057.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749G.GIF", pszSpec="*.7z") returned 0
	[0057.924] lstrlenA (lpString="*.7z") returned 4
	[0057.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749G.GIF", pszSpec="*.tar") returned 0
	[0057.924] lstrlenA (lpString="*.tar") returned 5
	[0057.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749G.GIF", pszSpec="*.gzip") returned 0
	[0057.924] lstrlenA (lpString="*.gzip") returned 6
	[0057.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749G.GIF", pszSpec="*.jpg") returned 0
	[0057.924] lstrlenA (lpString="*.jpg") returned 5
	[0057.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749G.GIF", pszSpec="*.jpeg") returned 0
	[0057.924] lstrlenA (lpString="*.jpeg") returned 6
	[0057.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749G.GIF", pszSpec="*.bmp") returned 0
	[0057.924] lstrlenA (lpString="*.bmp") returned 5
	[0057.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749G.GIF", pszSpec="*.gif") returned 1
	[0057.924] lstrlenA (lpString="*.gif") returned 5
	[0057.925] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749G.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749G.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749G.GIF"
	[0057.925] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749G.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749G.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749G.GIF"
	[0057.925] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749G.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749G.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749G.GIF."
	[0057.925] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749G.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749G.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749G.GIF.exe"
	[0057.925] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02749g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0057.925] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8795
	[0057.925] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1027b233, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1027b233, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1027b233, dwHighDateTime=0x1d327e8)) returned 1
	[0057.925] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.925] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x8753, lpOverlapped=0x0) returned 1
	[0057.926] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749G.GIF") returned="PH02749G.GIF"
	[0057.927] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.927] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x8753, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x8753, lpOverlapped=0x0) returned 1
	[0057.927] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.927] CloseHandle (hObject=0x214) returned 1
	[0057.927] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02749g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749G.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02749g.gif.exe")) returned 1
	[0057.928] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1022edb4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1022edb4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1027b233, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8118, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02749U.BMP", cAlternateFileName="")) returned 1
	[0057.928] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0057.928] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02749U.BMP") returned -1
	[0057.928] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02749U.BMP") returned -1
	[0057.928] lstrcmpiA (lpString1="", lpString2="PH02749U.BMP") returned -1
	[0057.928] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749G.GIF") returned="PH02749G.GIF"
	[0057.928] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0057.928] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0057.928] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0057.928] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0057.928] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02749U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP"
	[0057.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP", pszSpec="*.zip") returned 0
	[0057.928] lstrlenA (lpString="*.zip") returned 5
	[0057.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP", pszSpec="*.rar") returned 0
	[0057.929] lstrlenA (lpString="*.rar") returned 5
	[0057.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP", pszSpec="*.7z") returned 0
	[0057.929] lstrlenA (lpString="*.7z") returned 4
	[0057.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP", pszSpec="*.tar") returned 0
	[0057.929] lstrlenA (lpString="*.tar") returned 5
	[0057.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP", pszSpec="*.gzip") returned 0
	[0057.929] lstrlenA (lpString="*.gzip") returned 6
	[0057.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP", pszSpec="*.jpg") returned 0
	[0057.929] lstrlenA (lpString="*.jpg") returned 5
	[0057.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP", pszSpec="*.jpeg") returned 0
	[0057.929] lstrlenA (lpString="*.jpeg") returned 6
	[0057.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP", pszSpec="*.bmp") returned 1
	[0057.929] lstrlenA (lpString="*.bmp") returned 5
	[0057.929] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP"
	[0057.929] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP"
	[0057.929] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP."
	[0057.929] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP.exe"
	[0057.929] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02749u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0057.929] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8118
	[0057.929] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1027b233, dwHighDateTime=0x1d327e8)) returned 1
	[0057.929] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.929] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x80d6, lpOverlapped=0x0) returned 1
	[0057.931] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP") returned="PH02749U.BMP"
	[0057.931] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.931] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x80d6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x80d6, lpOverlapped=0x0) returned 1
	[0057.931] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.931] CloseHandle (hObject=0x214) returned 1
	[0057.932] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02749u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02749u.bmp.exe")) returned 1
	[0057.932] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1025500d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1025500d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1027b233, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x64c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02750G.GIF", cAlternateFileName="")) returned 1
	[0057.932] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0057.932] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02750G.GIF") returned -1
	[0057.932] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02750G.GIF") returned -1
	[0057.932] lstrcmpiA (lpString1="", lpString2="PH02750G.GIF") returned -1
	[0057.932] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP") returned="PH02749U.BMP"
	[0057.932] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0057.932] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0057.932] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0057.933] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0057.933] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02750G.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF"
	[0057.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF", pszSpec="*.zip") returned 0
	[0057.933] lstrlenA (lpString="*.zip") returned 5
	[0057.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF", pszSpec="*.rar") returned 0
	[0057.933] lstrlenA (lpString="*.rar") returned 5
	[0057.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF", pszSpec="*.7z") returned 0
	[0057.933] lstrlenA (lpString="*.7z") returned 4
	[0057.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF", pszSpec="*.tar") returned 0
	[0057.933] lstrlenA (lpString="*.tar") returned 5
	[0057.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF", pszSpec="*.gzip") returned 0
	[0057.933] lstrlenA (lpString="*.gzip") returned 6
	[0057.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF", pszSpec="*.jpg") returned 0
	[0057.933] lstrlenA (lpString="*.jpg") returned 5
	[0057.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF", pszSpec="*.jpeg") returned 0
	[0057.933] lstrlenA (lpString="*.jpeg") returned 6
	[0057.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF", pszSpec="*.bmp") returned 0
	[0057.933] lstrlenA (lpString="*.bmp") returned 5
	[0057.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF", pszSpec="*.gif") returned 1
	[0057.933] lstrlenA (lpString="*.gif") returned 5
	[0057.933] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF"
	[0057.933] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF"
	[0057.933] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF."
	[0057.933] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF.exe"
	[0057.933] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02750g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0057.933] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x64c7
	[0057.933] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1025500d, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1025500d, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1027b233, dwHighDateTime=0x1d327e8)) returned 1
	[0057.934] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0057.934] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x6485, lpOverlapped=0x0) returned 1
	[0058.025] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF") returned="PH02750G.GIF"
	[0058.025] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.025] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x6485, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x6485, lpOverlapped=0x0) returned 1
	[0058.025] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.025] CloseHandle (hObject=0x214) returned 1
	[0058.025] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02750g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02750g.gif.exe")) returned 1
	[0058.026] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1027b233, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1027b233, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1027b233, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x16f40, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02750U.BMP", cAlternateFileName="")) returned 1
	[0058.026] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.026] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02750U.BMP") returned -1
	[0058.026] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02750U.BMP") returned -1
	[0058.026] lstrcmpiA (lpString1="", lpString2="PH02750U.BMP") returned -1
	[0058.026] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF") returned="PH02750G.GIF"
	[0058.026] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.026] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.026] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.026] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.026] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02750U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP"
	[0058.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP", pszSpec="*.zip") returned 0
	[0058.026] lstrlenA (lpString="*.zip") returned 5
	[0058.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP", pszSpec="*.rar") returned 0
	[0058.026] lstrlenA (lpString="*.rar") returned 5
	[0058.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP", pszSpec="*.7z") returned 0
	[0058.026] lstrlenA (lpString="*.7z") returned 4
	[0058.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP", pszSpec="*.tar") returned 0
	[0058.026] lstrlenA (lpString="*.tar") returned 5
	[0058.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP", pszSpec="*.gzip") returned 0
	[0058.027] lstrlenA (lpString="*.gzip") returned 6
	[0058.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP", pszSpec="*.jpg") returned 0
	[0058.027] lstrlenA (lpString="*.jpg") returned 5
	[0058.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP", pszSpec="*.jpeg") returned 0
	[0058.027] lstrlenA (lpString="*.jpeg") returned 6
	[0058.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP", pszSpec="*.bmp") returned 1
	[0058.027] lstrlenA (lpString="*.bmp") returned 5
	[0058.027] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP"
	[0058.027] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP"
	[0058.027] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP."
	[0058.027] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP.exe"
	[0058.027] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02750u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0058.027] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16f40
	[0058.027] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1027b233, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1027b233, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1027b233, dwHighDateTime=0x1d327e8)) returned 1
	[0058.027] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.027] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x16efe, lpOverlapped=0x0) returned 1
	[0058.029] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP") returned="PH02750U.BMP"
	[0058.029] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.030] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x16efe, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x16efe, lpOverlapped=0x0) returned 1
	[0058.030] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.030] CloseHandle (hObject=0x214) returned 1
	[0058.030] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02750u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02750u.bmp.exe")) returned 1
	[0058.031] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1022edb4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1022edb4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1027b233, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc382, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02752G.GIF", cAlternateFileName="")) returned 1
	[0058.031] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.031] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02752G.GIF") returned -1
	[0058.031] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02752G.GIF") returned -1
	[0058.031] lstrcmpiA (lpString1="", lpString2="PH02752G.GIF") returned -1
	[0058.031] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP") returned="PH02750U.BMP"
	[0058.031] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.031] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.031] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.031] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.031] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02752G.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752G.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752G.GIF"
	[0058.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752G.GIF", pszSpec="*.zip") returned 0
	[0058.031] lstrlenA (lpString="*.zip") returned 5
	[0058.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752G.GIF", pszSpec="*.rar") returned 0
	[0058.031] lstrlenA (lpString="*.rar") returned 5
	[0058.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752G.GIF", pszSpec="*.7z") returned 0
	[0058.031] lstrlenA (lpString="*.7z") returned 4
	[0058.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752G.GIF", pszSpec="*.tar") returned 0
	[0058.031] lstrlenA (lpString="*.tar") returned 5
	[0058.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752G.GIF", pszSpec="*.gzip") returned 0
	[0058.031] lstrlenA (lpString="*.gzip") returned 6
	[0058.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752G.GIF", pszSpec="*.jpg") returned 0
	[0058.031] lstrlenA (lpString="*.jpg") returned 5
	[0058.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752G.GIF", pszSpec="*.jpeg") returned 0
	[0058.031] lstrlenA (lpString="*.jpeg") returned 6
	[0058.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752G.GIF", pszSpec="*.bmp") returned 0
	[0058.031] lstrlenA (lpString="*.bmp") returned 5
	[0058.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752G.GIF", pszSpec="*.gif") returned 1
	[0058.031] lstrlenA (lpString="*.gif") returned 5
	[0058.031] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752G.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752G.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752G.GIF"
	[0058.031] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752G.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752G.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752G.GIF"
	[0058.032] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752G.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752G.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752G.GIF."
	[0058.032] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752G.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752G.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752G.GIF.exe"
	[0058.032] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02752g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0058.032] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc382
	[0058.032] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1022edb4, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1027b233, dwHighDateTime=0x1d327e8)) returned 1
	[0058.032] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.032] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xc340, lpOverlapped=0x0) returned 1
	[0058.033] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752G.GIF") returned="PH02752G.GIF"
	[0058.034] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.034] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xc340, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xc340, lpOverlapped=0x0) returned 1
	[0058.034] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.034] CloseHandle (hObject=0x214) returned 1
	[0058.034] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02752g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752G.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02752g.gif.exe")) returned 1
	[0058.035] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102a14ae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102a14ae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102a14ae, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02752U.BMP", cAlternateFileName="")) returned 1
	[0058.035] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.035] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02752U.BMP") returned -1
	[0058.035] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02752U.BMP") returned -1
	[0058.035] lstrcmpiA (lpString1="", lpString2="PH02752U.BMP") returned -1
	[0058.035] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752G.GIF") returned="PH02752G.GIF"
	[0058.035] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.035] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.035] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.035] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.035] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02752U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP"
	[0058.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP", pszSpec="*.zip") returned 0
	[0058.035] lstrlenA (lpString="*.zip") returned 5
	[0058.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP", pszSpec="*.rar") returned 0
	[0058.035] lstrlenA (lpString="*.rar") returned 5
	[0058.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP", pszSpec="*.7z") returned 0
	[0058.035] lstrlenA (lpString="*.7z") returned 4
	[0058.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP", pszSpec="*.tar") returned 0
	[0058.035] lstrlenA (lpString="*.tar") returned 5
	[0058.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP", pszSpec="*.gzip") returned 0
	[0058.035] lstrlenA (lpString="*.gzip") returned 6
	[0058.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP", pszSpec="*.jpg") returned 0
	[0058.035] lstrlenA (lpString="*.jpg") returned 5
	[0058.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP", pszSpec="*.jpeg") returned 0
	[0058.035] lstrlenA (lpString="*.jpeg") returned 6
	[0058.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP", pszSpec="*.bmp") returned 1
	[0058.035] lstrlenA (lpString="*.bmp") returned 5
	[0058.035] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP"
	[0058.035] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP"
	[0058.035] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP."
	[0058.036] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP.exe"
	[0058.036] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02752u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0058.036] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7c08
	[0058.036] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x102a14ae, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x102a14ae, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x102a14ae, dwHighDateTime=0x1d327e8)) returned 1
	[0058.036] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.036] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7bc6, lpOverlapped=0x0) returned 1
	[0058.037] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP") returned="PH02752U.BMP"
	[0058.037] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.037] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7bc6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7bc6, lpOverlapped=0x0) returned 1
	[0058.038] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.038] CloseHandle (hObject=0x214) returned 1
	[0058.038] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02752u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02752u.bmp.exe")) returned 1
	[0058.038] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102a14ae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102a14ae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102a14ae, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1a6b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02753U.BMP", cAlternateFileName="")) returned 1
	[0058.038] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.038] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02753U.BMP") returned -1
	[0058.038] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02753U.BMP") returned -1
	[0058.038] lstrcmpiA (lpString1="", lpString2="PH02753U.BMP") returned -1
	[0058.039] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP") returned="PH02752U.BMP"
	[0058.039] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.039] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.039] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.039] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.039] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02753U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP"
	[0058.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP", pszSpec="*.zip") returned 0
	[0058.039] lstrlenA (lpString="*.zip") returned 5
	[0058.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP", pszSpec="*.rar") returned 0
	[0058.039] lstrlenA (lpString="*.rar") returned 5
	[0058.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP", pszSpec="*.7z") returned 0
	[0058.039] lstrlenA (lpString="*.7z") returned 4
	[0058.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP", pszSpec="*.tar") returned 0
	[0058.039] lstrlenA (lpString="*.tar") returned 5
	[0058.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP", pszSpec="*.gzip") returned 0
	[0058.039] lstrlenA (lpString="*.gzip") returned 6
	[0058.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP", pszSpec="*.jpg") returned 0
	[0058.039] lstrlenA (lpString="*.jpg") returned 5
	[0058.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP", pszSpec="*.jpeg") returned 0
	[0058.039] lstrlenA (lpString="*.jpeg") returned 6
	[0058.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP", pszSpec="*.bmp") returned 1
	[0058.039] lstrlenA (lpString="*.bmp") returned 5
	[0058.039] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP"
	[0058.039] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP"
	[0058.039] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP."
	[0058.040] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP.exe"
	[0058.040] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02753u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0058.041] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a6b8
	[0058.041] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x102a14ae, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x102a14ae, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x102a14ae, dwHighDateTime=0x1d327e8)) returned 1
	[0058.041] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.041] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1a676, lpOverlapped=0x0) returned 1
	[0058.043] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP") returned="PH02753U.BMP"
	[0058.044] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.044] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1a676, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1a676, lpOverlapped=0x0) returned 1
	[0058.044] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.044] CloseHandle (hObject=0x214) returned 1
	[0058.044] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02753u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02753u.bmp.exe")) returned 1
	[0058.045] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102a14ae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102a14ae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102a14ae, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1a7d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02754U.BMP", cAlternateFileName="")) returned 1
	[0058.045] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.045] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02754U.BMP") returned -1
	[0058.045] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02754U.BMP") returned -1
	[0058.045] lstrcmpiA (lpString1="", lpString2="PH02754U.BMP") returned -1
	[0058.045] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP") returned="PH02753U.BMP"
	[0058.045] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.045] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.045] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.045] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.045] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02754U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP"
	[0058.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP", pszSpec="*.zip") returned 0
	[0058.045] lstrlenA (lpString="*.zip") returned 5
	[0058.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP", pszSpec="*.rar") returned 0
	[0058.045] lstrlenA (lpString="*.rar") returned 5
	[0058.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP", pszSpec="*.7z") returned 0
	[0058.045] lstrlenA (lpString="*.7z") returned 4
	[0058.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP", pszSpec="*.tar") returned 0
	[0058.045] lstrlenA (lpString="*.tar") returned 5
	[0058.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP", pszSpec="*.gzip") returned 0
	[0058.045] lstrlenA (lpString="*.gzip") returned 6
	[0058.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP", pszSpec="*.jpg") returned 0
	[0058.045] lstrlenA (lpString="*.jpg") returned 5
	[0058.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP", pszSpec="*.jpeg") returned 0
	[0058.045] lstrlenA (lpString="*.jpeg") returned 6
	[0058.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP", pszSpec="*.bmp") returned 1
	[0058.045] lstrlenA (lpString="*.bmp") returned 5
	[0058.045] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP"
	[0058.045] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP"
	[0058.046] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP."
	[0058.046] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP.exe"
	[0058.046] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02754u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0058.046] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a7d8
	[0058.046] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x102a14ae, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x102a14ae, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x102a14ae, dwHighDateTime=0x1d327e8)) returned 1
	[0058.046] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.046] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1a796, lpOverlapped=0x0) returned 1
	[0058.048] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP") returned="PH02754U.BMP"
	[0058.048] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.048] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1a796, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1a796, lpOverlapped=0x0) returned 1
	[0058.049] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.049] CloseHandle (hObject=0x214) returned 1
	[0058.049] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02754u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02754u.bmp.exe")) returned 1
	[0058.049] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102a14ae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102a14ae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102a14ae, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1a7d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02755U.BMP", cAlternateFileName="")) returned 1
	[0058.049] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.049] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02755U.BMP") returned -1
	[0058.049] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02755U.BMP") returned -1
	[0058.049] lstrcmpiA (lpString1="", lpString2="PH02755U.BMP") returned -1
	[0058.049] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP") returned="PH02754U.BMP"
	[0058.049] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.050] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.050] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.050] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.050] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02755U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02755U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02755U.BMP"
	[0058.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02755U.BMP", pszSpec="*.zip") returned 0
	[0058.050] lstrlenA (lpString="*.zip") returned 5
	[0058.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02755U.BMP", pszSpec="*.rar") returned 0
	[0058.050] lstrlenA (lpString="*.rar") returned 5
	[0058.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02755U.BMP", pszSpec="*.7z") returned 0
	[0058.050] lstrlenA (lpString="*.7z") returned 4
	[0058.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02755U.BMP", pszSpec="*.tar") returned 0
	[0058.050] lstrlenA (lpString="*.tar") returned 5
	[0058.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02755U.BMP", pszSpec="*.gzip") returned 0
	[0058.050] lstrlenA (lpString="*.gzip") returned 6
	[0058.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02755U.BMP", pszSpec="*.jpg") returned 0
	[0058.050] lstrlenA (lpString="*.jpg") returned 5
	[0058.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02755U.BMP", pszSpec="*.jpeg") returned 0
	[0058.050] lstrlenA (lpString="*.jpeg") returned 6
	[0058.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02755U.BMP", pszSpec="*.bmp") returned 1
	[0058.050] lstrlenA (lpString="*.bmp") returned 5
	[0058.050] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02755U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02755U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02755U.BMP"
	[0058.050] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02755U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02755U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02755U.BMP"
	[0058.050] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02755U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02755U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02755U.BMP."
	[0058.050] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02755U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02755U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02755U.BMP.exe"
	[0058.050] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02755u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0058.050] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a7d8
	[0058.051] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x102a14ae, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x102a14ae, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x102a14ae, dwHighDateTime=0x1d327e8)) returned 1
	[0058.051] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.051] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1a796, lpOverlapped=0x0) returned 1
	[0058.052] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02755U.BMP") returned="PH02755U.BMP"
	[0058.053] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.053] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1a796, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1a796, lpOverlapped=0x0) returned 1
	[0058.053] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.053] CloseHandle (hObject=0x214) returned 1
	[0058.053] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02755u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02755U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02755u.bmp.exe")) returned 1
	[0058.054] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103f89f0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103f89f0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103f89f0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x30408, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02756U.BMP", cAlternateFileName="")) returned 1
	[0058.054] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.054] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02756U.BMP") returned -1
	[0058.054] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02756U.BMP") returned -1
	[0058.054] lstrcmpiA (lpString1="", lpString2="PH02756U.BMP") returned -1
	[0058.054] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02755U.BMP") returned="PH02755U.BMP"
	[0058.054] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.054] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.054] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.054] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.054] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02756U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP"
	[0058.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP", pszSpec="*.zip") returned 0
	[0058.054] lstrlenA (lpString="*.zip") returned 5
	[0058.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP", pszSpec="*.rar") returned 0
	[0058.054] lstrlenA (lpString="*.rar") returned 5
	[0058.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP", pszSpec="*.7z") returned 0
	[0058.054] lstrlenA (lpString="*.7z") returned 4
	[0058.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP", pszSpec="*.tar") returned 0
	[0058.054] lstrlenA (lpString="*.tar") returned 5
	[0058.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP", pszSpec="*.gzip") returned 0
	[0058.055] lstrlenA (lpString="*.gzip") returned 6
	[0058.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP", pszSpec="*.jpg") returned 0
	[0058.055] lstrlenA (lpString="*.jpg") returned 5
	[0058.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP", pszSpec="*.jpeg") returned 0
	[0058.055] lstrlenA (lpString="*.jpeg") returned 6
	[0058.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP", pszSpec="*.bmp") returned 1
	[0058.055] lstrlenA (lpString="*.bmp") returned 5
	[0058.055] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP"
	[0058.055] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP"
	[0058.055] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP."
	[0058.055] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP.exe"
	[0058.055] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02756u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0058.056] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x30408
	[0058.056] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x103f89f0, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x103f89f0, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x103f89f0, dwHighDateTime=0x1d327e8)) returned 1
	[0058.057] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.057] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x303c6, lpOverlapped=0x0) returned 1
	[0058.107] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP") returned="PH02756U.BMP"
	[0058.108] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.108] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x303c6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x303c6, lpOverlapped=0x0) returned 1
	[0058.109] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.109] CloseHandle (hObject=0x214) returned 1
	[0058.109] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02756u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02756u.bmp.exe")) returned 1
	[0058.110] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1027b233, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1027b233, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1027b233, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x30408, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02757U.BMP", cAlternateFileName="")) returned 1
	[0058.110] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.110] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02757U.BMP") returned -1
	[0058.110] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02757U.BMP") returned -1
	[0058.110] lstrcmpiA (lpString1="", lpString2="PH02757U.BMP") returned -1
	[0058.110] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP") returned="PH02756U.BMP"
	[0058.110] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.110] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.110] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.110] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.110] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02757U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP"
	[0058.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP", pszSpec="*.zip") returned 0
	[0058.110] lstrlenA (lpString="*.zip") returned 5
	[0058.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP", pszSpec="*.rar") returned 0
	[0058.110] lstrlenA (lpString="*.rar") returned 5
	[0058.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP", pszSpec="*.7z") returned 0
	[0058.110] lstrlenA (lpString="*.7z") returned 4
	[0058.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP", pszSpec="*.tar") returned 0
	[0058.110] lstrlenA (lpString="*.tar") returned 5
	[0058.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP", pszSpec="*.gzip") returned 0
	[0058.110] lstrlenA (lpString="*.gzip") returned 6
	[0058.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP", pszSpec="*.jpg") returned 0
	[0058.111] lstrlenA (lpString="*.jpg") returned 5
	[0058.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP", pszSpec="*.jpeg") returned 0
	[0058.111] lstrlenA (lpString="*.jpeg") returned 6
	[0058.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP", pszSpec="*.bmp") returned 1
	[0058.111] lstrlenA (lpString="*.bmp") returned 5
	[0058.111] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP"
	[0058.111] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP"
	[0058.111] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP."
	[0058.111] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP.exe"
	[0058.111] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02757u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0058.111] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x30408
	[0058.111] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1027b233, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1027b233, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1027b233, dwHighDateTime=0x1d327e8)) returned 1
	[0058.111] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.111] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x303c6, lpOverlapped=0x0) returned 1
	[0058.116] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP") returned="PH02757U.BMP"
	[0058.117] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.117] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x303c6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x303c6, lpOverlapped=0x0) returned 1
	[0058.119] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.119] CloseHandle (hObject=0x214) returned 1
	[0058.119] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02757u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02757u.bmp.exe")) returned 1
	[0058.120] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10386305, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10386305, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10386305, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x307f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02758U.BMP", cAlternateFileName="")) returned 1
	[0058.120] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.120] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02758U.BMP") returned -1
	[0058.120] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02758U.BMP") returned -1
	[0058.120] lstrcmpiA (lpString1="", lpString2="PH02758U.BMP") returned -1
	[0058.120] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP") returned="PH02757U.BMP"
	[0058.120] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.120] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.120] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.120] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.121] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02758U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP"
	[0058.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP", pszSpec="*.zip") returned 0
	[0058.121] lstrlenA (lpString="*.zip") returned 5
	[0058.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP", pszSpec="*.rar") returned 0
	[0058.121] lstrlenA (lpString="*.rar") returned 5
	[0058.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP", pszSpec="*.7z") returned 0
	[0058.121] lstrlenA (lpString="*.7z") returned 4
	[0058.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP", pszSpec="*.tar") returned 0
	[0058.123] lstrlenA (lpString="*.tar") returned 5
	[0058.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP", pszSpec="*.gzip") returned 0
	[0058.123] lstrlenA (lpString="*.gzip") returned 6
	[0058.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP", pszSpec="*.jpg") returned 0
	[0058.123] lstrlenA (lpString="*.jpg") returned 5
	[0058.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP", pszSpec="*.jpeg") returned 0
	[0058.123] lstrlenA (lpString="*.jpeg") returned 6
	[0058.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP", pszSpec="*.bmp") returned 1
	[0058.123] lstrlenA (lpString="*.bmp") returned 5
	[0058.123] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP"
	[0058.123] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP"
	[0058.123] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP."
	[0058.123] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP.exe"
	[0058.123] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02758u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0058.128] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x307f8
	[0058.128] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x10386305, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x10386305, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x10386305, dwHighDateTime=0x1d327e8)) returned 1
	[0058.128] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.128] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x307b6, lpOverlapped=0x0) returned 1
	[0058.176] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP") returned="PH02758U.BMP"
	[0058.177] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.177] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x307b6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x307b6, lpOverlapped=0x0) returned 1
	[0058.177] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.178] CloseHandle (hObject=0x214) returned 1
	[0058.178] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02758u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02758u.bmp.exe")) returned 1
	[0058.178] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102a14ae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102a14ae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102a14ae, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa0d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02759J.JPG", cAlternateFileName="")) returned 1
	[0058.179] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.179] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02759J.JPG") returned -1
	[0058.179] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02759J.JPG") returned -1
	[0058.179] lstrcmpiA (lpString1="", lpString2="PH02759J.JPG") returned -1
	[0058.179] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP") returned="PH02758U.BMP"
	[0058.179] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.179] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.179] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.179] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.179] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02759J.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02759J.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02759J.JPG"
	[0058.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02759J.JPG", pszSpec="*.zip") returned 0
	[0058.179] lstrlenA (lpString="*.zip") returned 5
	[0058.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02759J.JPG", pszSpec="*.rar") returned 0
	[0058.179] lstrlenA (lpString="*.rar") returned 5
	[0058.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02759J.JPG", pszSpec="*.7z") returned 0
	[0058.179] lstrlenA (lpString="*.7z") returned 4
	[0058.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02759J.JPG", pszSpec="*.tar") returned 0
	[0058.179] lstrlenA (lpString="*.tar") returned 5
	[0058.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02759J.JPG", pszSpec="*.gzip") returned 0
	[0058.179] lstrlenA (lpString="*.gzip") returned 6
	[0058.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02759J.JPG", pszSpec="*.jpg") returned 1
	[0058.180] lstrlenA (lpString="*.jpg") returned 5
	[0058.180] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02759J.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02759J.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02759J.JPG"
	[0058.180] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02759J.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02759J.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02759J.JPG"
	[0058.180] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02759J.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02759J.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02759J.JPG."
	[0058.180] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02759J.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02759J.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02759J.JPG.exe"
	[0058.180] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02759j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0058.181] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa0d2
	[0058.181] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x102a14ae, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x102a14ae, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x102a14ae, dwHighDateTime=0x1d327e8)) returned 1
	[0058.181] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.181] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xa090, lpOverlapped=0x0) returned 1
	[0058.183] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02759J.JPG") returned="PH02759J.JPG"
	[0058.183] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.183] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xa090, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xa090, lpOverlapped=0x0) returned 1
	[0058.183] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.183] CloseHandle (hObject=0x214) returned 1
	[0058.183] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02759j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02759J.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02759j.jpg.exe")) returned 1
	[0058.184] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103f89f0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103f89f0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103f89f0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc5d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02810J.JPG", cAlternateFileName="")) returned 1
	[0058.184] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.184] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02810J.JPG") returned -1
	[0058.184] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02810J.JPG") returned -1
	[0058.184] lstrcmpiA (lpString1="", lpString2="PH02810J.JPG") returned -1
	[0058.184] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02759J.JPG") returned="PH02759J.JPG"
	[0058.184] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.184] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.184] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.184] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.184] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02810J.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG"
	[0058.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG", pszSpec="*.zip") returned 0
	[0058.185] lstrlenA (lpString="*.zip") returned 5
	[0058.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG", pszSpec="*.rar") returned 0
	[0058.185] lstrlenA (lpString="*.rar") returned 5
	[0058.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG", pszSpec="*.7z") returned 0
	[0058.185] lstrlenA (lpString="*.7z") returned 4
	[0058.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG", pszSpec="*.tar") returned 0
	[0058.185] lstrlenA (lpString="*.tar") returned 5
	[0058.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG", pszSpec="*.gzip") returned 0
	[0058.185] lstrlenA (lpString="*.gzip") returned 6
	[0058.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG", pszSpec="*.jpg") returned 1
	[0058.185] lstrlenA (lpString="*.jpg") returned 5
	[0058.185] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG"
	[0058.185] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG"
	[0058.185] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG."
	[0058.185] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG.exe"
	[0058.185] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02810j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0058.185] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc5d7
	[0058.185] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x103f89f0, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x103f89f0, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x103f89f0, dwHighDateTime=0x1d327e8)) returned 1
	[0058.185] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.185] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xc595, lpOverlapped=0x0) returned 1
	[0058.187] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG") returned="PH02810J.JPG"
	[0058.187] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.187] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xc595, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xc595, lpOverlapped=0x0) returned 1
	[0058.188] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.188] CloseHandle (hObject=0x214) returned 1
	[0058.188] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02810j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02810j.jpg.exe")) returned 1
	[0058.189] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1027b233, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1027b233, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1027b233, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf438, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02829J.JPG", cAlternateFileName="")) returned 1
	[0058.189] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.189] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02829J.JPG") returned -1
	[0058.189] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02829J.JPG") returned -1
	[0058.189] lstrcmpiA (lpString1="", lpString2="PH02829J.JPG") returned -1
	[0058.189] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG") returned="PH02810J.JPG"
	[0058.189] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.189] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.189] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.189] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.189] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02829J.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG"
	[0058.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG", pszSpec="*.zip") returned 0
	[0058.189] lstrlenA (lpString="*.zip") returned 5
	[0058.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG", pszSpec="*.rar") returned 0
	[0058.189] lstrlenA (lpString="*.rar") returned 5
	[0058.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG", pszSpec="*.7z") returned 0
	[0058.189] lstrlenA (lpString="*.7z") returned 4
	[0058.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG", pszSpec="*.tar") returned 0
	[0058.189] lstrlenA (lpString="*.tar") returned 5
	[0058.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG", pszSpec="*.gzip") returned 0
	[0058.189] lstrlenA (lpString="*.gzip") returned 6
	[0058.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG", pszSpec="*.jpg") returned 1
	[0058.190] lstrlenA (lpString="*.jpg") returned 5
	[0058.190] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG"
	[0058.190] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG"
	[0058.190] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG."
	[0058.190] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG.exe"
	[0058.190] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02829j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0058.190] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf438
	[0058.190] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1027b233, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1027b233, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1027b233, dwHighDateTime=0x1d327e8)) returned 1
	[0058.190] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.190] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xf3f6, lpOverlapped=0x0) returned 1
	[0058.192] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG") returned="PH02829J.JPG"
	[0058.192] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.192] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xf3f6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xf3f6, lpOverlapped=0x0) returned 1
	[0058.192] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.192] CloseHandle (hObject=0x214) returned 1
	[0058.193] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02829j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02829j.jpg.exe")) returned 1
	[0058.193] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102a14ae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102a14ae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102c771c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x30f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02845G.GIF", cAlternateFileName="")) returned 1
	[0058.193] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.193] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02845G.GIF") returned -1
	[0058.193] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02845G.GIF") returned -1
	[0058.193] lstrcmpiA (lpString1="", lpString2="PH02845G.GIF") returned -1
	[0058.193] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG") returned="PH02829J.JPG"
	[0058.193] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.193] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.193] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.193] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.193] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02845G.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF"
	[0058.193] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF", pszSpec="*.zip") returned 0
	[0058.193] lstrlenA (lpString="*.zip") returned 5
	[0058.193] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF", pszSpec="*.rar") returned 0
	[0058.193] lstrlenA (lpString="*.rar") returned 5
	[0058.193] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF", pszSpec="*.7z") returned 0
	[0058.194] lstrlenA (lpString="*.7z") returned 4
	[0058.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF", pszSpec="*.tar") returned 0
	[0058.194] lstrlenA (lpString="*.tar") returned 5
	[0058.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF", pszSpec="*.gzip") returned 0
	[0058.194] lstrlenA (lpString="*.gzip") returned 6
	[0058.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF", pszSpec="*.jpg") returned 0
	[0058.194] lstrlenA (lpString="*.jpg") returned 5
	[0058.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF", pszSpec="*.jpeg") returned 0
	[0058.194] lstrlenA (lpString="*.jpeg") returned 6
	[0058.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF", pszSpec="*.bmp") returned 0
	[0058.194] lstrlenA (lpString="*.bmp") returned 5
	[0058.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF", pszSpec="*.gif") returned 1
	[0058.194] lstrlenA (lpString="*.gif") returned 5
	[0058.194] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF"
	[0058.194] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF"
	[0058.194] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF."
	[0058.194] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF.exe"
	[0058.194] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02845g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0058.289] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x30f2
	[0058.289] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x102a14ae, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x102a14ae, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x102c771c, dwHighDateTime=0x1d327e8)) returned 1
	[0058.290] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.290] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x30b0, lpOverlapped=0x0) returned 1
	[0058.291] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF") returned="PH02845G.GIF"
	[0058.291] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.291] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x30b0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x30b0, lpOverlapped=0x0) returned 1
	[0058.291] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.292] CloseHandle (hObject=0x214) returned 1
	[0058.292] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02845g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02845g.gif.exe")) returned 1
	[0058.292] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102c771c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102c771c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102c771c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3c45, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02897J.JPG", cAlternateFileName="")) returned 1
	[0058.292] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.292] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH02897J.JPG") returned -1
	[0058.292] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH02897J.JPG") returned -1
	[0058.292] lstrcmpiA (lpString1="", lpString2="PH02897J.JPG") returned -1
	[0058.292] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF") returned="PH02845G.GIF"
	[0058.292] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.292] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.292] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.293] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.293] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH02897J.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02897J.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02897J.JPG"
	[0058.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02897J.JPG", pszSpec="*.zip") returned 0
	[0058.293] lstrlenA (lpString="*.zip") returned 5
	[0058.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02897J.JPG", pszSpec="*.rar") returned 0
	[0058.293] lstrlenA (lpString="*.rar") returned 5
	[0058.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02897J.JPG", pszSpec="*.7z") returned 0
	[0058.293] lstrlenA (lpString="*.7z") returned 4
	[0058.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02897J.JPG", pszSpec="*.tar") returned 0
	[0058.293] lstrlenA (lpString="*.tar") returned 5
	[0058.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02897J.JPG", pszSpec="*.gzip") returned 0
	[0058.293] lstrlenA (lpString="*.gzip") returned 6
	[0058.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02897J.JPG", pszSpec="*.jpg") returned 1
	[0058.293] lstrlenA (lpString="*.jpg") returned 5
	[0058.293] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02897J.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02897J.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02897J.JPG"
	[0058.293] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02897J.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02897J.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02897J.JPG"
	[0058.293] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02897J.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02897J.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02897J.JPG."
	[0058.293] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02897J.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02897J.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02897J.JPG.exe"
	[0058.293] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02897j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0058.293] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3c45
	[0058.293] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x102c771c, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x102c771c, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x102c771c, dwHighDateTime=0x1d327e8)) returned 1
	[0058.294] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.294] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x3c03, lpOverlapped=0x0) returned 1
	[0058.295] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02897J.JPG") returned="PH02897J.JPG"
	[0058.295] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.295] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x3c03, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x3c03, lpOverlapped=0x0) returned 1
	[0058.295] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.295] CloseHandle (hObject=0x214) returned 1
	[0058.295] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02897j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02897J.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02897j.jpg.exe")) returned 1
	[0058.296] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102a14ae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102a14ae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102c771c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3c76, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03011U.BMP", cAlternateFileName="")) returned 1
	[0058.296] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.296] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH03011U.BMP") returned -1
	[0058.296] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH03011U.BMP") returned -1
	[0058.296] lstrcmpiA (lpString1="", lpString2="PH03011U.BMP") returned -1
	[0058.296] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02897J.JPG") returned="PH02897J.JPG"
	[0058.296] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.296] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.296] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.296] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.296] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH03011U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP"
	[0058.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP", pszSpec="*.zip") returned 0
	[0058.296] lstrlenA (lpString="*.zip") returned 5
	[0058.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP", pszSpec="*.rar") returned 0
	[0058.297] lstrlenA (lpString="*.rar") returned 5
	[0058.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP", pszSpec="*.7z") returned 0
	[0058.297] lstrlenA (lpString="*.7z") returned 4
	[0058.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP", pszSpec="*.tar") returned 0
	[0058.297] lstrlenA (lpString="*.tar") returned 5
	[0058.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP", pszSpec="*.gzip") returned 0
	[0058.297] lstrlenA (lpString="*.gzip") returned 6
	[0058.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP", pszSpec="*.jpg") returned 0
	[0058.297] lstrlenA (lpString="*.jpg") returned 5
	[0058.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP", pszSpec="*.jpeg") returned 0
	[0058.297] lstrlenA (lpString="*.jpeg") returned 6
	[0058.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP", pszSpec="*.bmp") returned 1
	[0058.297] lstrlenA (lpString="*.bmp") returned 5
	[0058.297] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP"
	[0058.297] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP"
	[0058.297] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP."
	[0058.297] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP.exe"
	[0058.297] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03011u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0058.298] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3c76
	[0058.298] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x102a14ae, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x102a14ae, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x102c771c, dwHighDateTime=0x1d327e8)) returned 1
	[0058.298] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.298] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x3c34, lpOverlapped=0x0) returned 1
	[0058.299] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP") returned="PH03011U.BMP"
	[0058.299] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.299] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x3c34, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x3c34, lpOverlapped=0x0) returned 1
	[0058.299] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.300] CloseHandle (hObject=0x214) returned 1
	[0058.300] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03011u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03011u.bmp.exe")) returned 1
	[0058.300] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102a14ae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102a14ae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102c771c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1016, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03012U.BMP", cAlternateFileName="")) returned 1
	[0058.300] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.300] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH03012U.BMP") returned -1
	[0058.300] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH03012U.BMP") returned -1
	[0058.300] lstrcmpiA (lpString1="", lpString2="PH03012U.BMP") returned -1
	[0058.300] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP") returned="PH03011U.BMP"
	[0058.300] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.300] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.300] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.300] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.300] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH03012U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP"
	[0058.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP", pszSpec="*.zip") returned 0
	[0058.300] lstrlenA (lpString="*.zip") returned 5
	[0058.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP", pszSpec="*.rar") returned 0
	[0058.301] lstrlenA (lpString="*.rar") returned 5
	[0058.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP", pszSpec="*.7z") returned 0
	[0058.301] lstrlenA (lpString="*.7z") returned 4
	[0058.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP", pszSpec="*.tar") returned 0
	[0058.301] lstrlenA (lpString="*.tar") returned 5
	[0058.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP", pszSpec="*.gzip") returned 0
	[0058.301] lstrlenA (lpString="*.gzip") returned 6
	[0058.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP", pszSpec="*.jpg") returned 0
	[0058.301] lstrlenA (lpString="*.jpg") returned 5
	[0058.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP", pszSpec="*.jpeg") returned 0
	[0058.301] lstrlenA (lpString="*.jpeg") returned 6
	[0058.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP", pszSpec="*.bmp") returned 1
	[0058.301] lstrlenA (lpString="*.bmp") returned 5
	[0058.301] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP"
	[0058.301] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP"
	[0058.301] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP."
	[0058.301] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP.exe"
	[0058.301] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03012u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0058.301] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1016
	[0058.301] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x102a14ae, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x102a14ae, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x102c771c, dwHighDateTime=0x1d327e8)) returned 1
	[0058.301] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.301] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xfd4, lpOverlapped=0x0) returned 1
	[0058.303] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP") returned="PH03012U.BMP"
	[0058.303] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.303] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xfd4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xfd4, lpOverlapped=0x0) returned 1
	[0058.303] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.303] CloseHandle (hObject=0x214) returned 1
	[0058.303] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03012u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03012u.bmp.exe")) returned 1
	[0058.303] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102a14ae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102a14ae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102c771c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x49d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03014_.GIF", cAlternateFileName="")) returned 1
	[0058.304] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.304] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH03014_.GIF") returned -1
	[0058.304] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH03014_.GIF") returned -1
	[0058.304] lstrcmpiA (lpString1="", lpString2="PH03014_.GIF") returned -1
	[0058.304] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP") returned="PH03012U.BMP"
	[0058.304] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.304] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.304] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.304] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.304] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH03014_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF"
	[0058.304] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF", pszSpec="*.zip") returned 0
	[0058.304] lstrlenA (lpString="*.zip") returned 5
	[0058.304] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF", pszSpec="*.rar") returned 0
	[0058.304] lstrlenA (lpString="*.rar") returned 5
	[0058.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF", pszSpec="*.7z") returned 0
	[0058.391] lstrlenA (lpString="*.7z") returned 4
	[0058.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF", pszSpec="*.tar") returned 0
	[0058.391] lstrlenA (lpString="*.tar") returned 5
	[0058.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF", pszSpec="*.gzip") returned 0
	[0058.391] lstrlenA (lpString="*.gzip") returned 6
	[0058.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF", pszSpec="*.jpg") returned 0
	[0058.391] lstrlenA (lpString="*.jpg") returned 5
	[0058.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF", pszSpec="*.jpeg") returned 0
	[0058.391] lstrlenA (lpString="*.jpeg") returned 6
	[0058.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF", pszSpec="*.bmp") returned 0
	[0058.391] lstrlenA (lpString="*.bmp") returned 5
	[0058.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF", pszSpec="*.gif") returned 1
	[0058.391] lstrlenA (lpString="*.gif") returned 5
	[0058.391] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF"
	[0058.391] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF"
	[0058.391] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF."
	[0058.391] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF.exe"
	[0058.391] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03014_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0058.391] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x49d2
	[0058.392] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x102a14ae, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x102a14ae, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x102c771c, dwHighDateTime=0x1d327e8)) returned 1
	[0058.392] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.392] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x4990, lpOverlapped=0x0) returned 1
	[0058.515] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF") returned="PH03014_.GIF"
	[0058.518] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.518] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x4990, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x4990, lpOverlapped=0x0) returned 1
	[0058.518] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.518] CloseHandle (hObject=0x214) returned 1
	[0058.518] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03014_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03014_.gif.exe")) returned 1
	[0058.519] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102a14ae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102a14ae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102c771c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x78af, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03041I.JPG", cAlternateFileName="")) returned 1
	[0058.519] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.519] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH03041I.JPG") returned -1
	[0058.519] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH03041I.JPG") returned -1
	[0058.519] lstrcmpiA (lpString1="", lpString2="PH03041I.JPG") returned -1
	[0058.519] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF") returned="PH03014_.GIF"
	[0058.519] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.519] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.519] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.519] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.519] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH03041I.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03041I.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03041I.JPG"
	[0058.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03041I.JPG", pszSpec="*.zip") returned 0
	[0058.520] lstrlenA (lpString="*.zip") returned 5
	[0058.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03041I.JPG", pszSpec="*.rar") returned 0
	[0058.520] lstrlenA (lpString="*.rar") returned 5
	[0058.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03041I.JPG", pszSpec="*.7z") returned 0
	[0058.520] lstrlenA (lpString="*.7z") returned 4
	[0058.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03041I.JPG", pszSpec="*.tar") returned 0
	[0058.520] lstrlenA (lpString="*.tar") returned 5
	[0058.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03041I.JPG", pszSpec="*.gzip") returned 0
	[0058.520] lstrlenA (lpString="*.gzip") returned 6
	[0058.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03041I.JPG", pszSpec="*.jpg") returned 1
	[0058.520] lstrlenA (lpString="*.jpg") returned 5
	[0058.520] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03041I.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03041I.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03041I.JPG"
	[0058.520] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03041I.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03041I.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03041I.JPG"
	[0058.520] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03041I.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03041I.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03041I.JPG."
	[0058.520] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03041I.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03041I.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03041I.JPG.exe"
	[0058.520] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03041i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0058.520] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x78af
	[0058.520] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x102a14ae, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x102a14ae, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x102c771c, dwHighDateTime=0x1d327e8)) returned 1
	[0058.520] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.520] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x786d, lpOverlapped=0x0) returned 1
	[0058.522] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03041I.JPG") returned="PH03041I.JPG"
	[0058.522] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.522] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x786d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x786d, lpOverlapped=0x0) returned 1
	[0058.523] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.523] CloseHandle (hObject=0x214) returned 1
	[0058.523] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03041i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03041I.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03041i.jpg.exe")) returned 1
	[0058.523] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102a14ae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102a14ae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102a14ae, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7450, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03143I.JPG", cAlternateFileName="")) returned 1
	[0058.523] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.523] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH03143I.JPG") returned -1
	[0058.523] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH03143I.JPG") returned -1
	[0058.523] lstrcmpiA (lpString1="", lpString2="PH03143I.JPG") returned -1
	[0058.523] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03041I.JPG") returned="PH03041I.JPG"
	[0058.523] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.523] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.523] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.523] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.524] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH03143I.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG"
	[0058.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG", pszSpec="*.zip") returned 0
	[0058.524] lstrlenA (lpString="*.zip") returned 5
	[0058.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG", pszSpec="*.rar") returned 0
	[0058.524] lstrlenA (lpString="*.rar") returned 5
	[0058.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG", pszSpec="*.7z") returned 0
	[0058.524] lstrlenA (lpString="*.7z") returned 4
	[0058.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG", pszSpec="*.tar") returned 0
	[0058.524] lstrlenA (lpString="*.tar") returned 5
	[0058.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG", pszSpec="*.gzip") returned 0
	[0058.524] lstrlenA (lpString="*.gzip") returned 6
	[0058.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG", pszSpec="*.jpg") returned 1
	[0058.524] lstrlenA (lpString="*.jpg") returned 5
	[0058.524] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG"
	[0058.524] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG"
	[0058.524] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG."
	[0058.524] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG.exe"
	[0058.524] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03143i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0058.524] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7450
	[0058.524] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x102a14ae, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x102a14ae, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x102a14ae, dwHighDateTime=0x1d327e8)) returned 1
	[0058.524] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.524] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x740e, lpOverlapped=0x0) returned 1
	[0058.526] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG") returned="PH03143I.JPG"
	[0058.526] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.526] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x740e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x740e, lpOverlapped=0x0) returned 1
	[0058.526] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.526] CloseHandle (hObject=0x214) returned 1
	[0058.526] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03143i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03143i.jpg.exe")) returned 1
	[0058.527] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102c771c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102c771c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102c771c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa343, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03205I.JPG", cAlternateFileName="")) returned 1
	[0058.527] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.527] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH03205I.JPG") returned -1
	[0058.527] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH03205I.JPG") returned -1
	[0058.527] lstrcmpiA (lpString1="", lpString2="PH03205I.JPG") returned -1
	[0058.527] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG") returned="PH03143I.JPG"
	[0058.527] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.527] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.527] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.527] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.527] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH03205I.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG"
	[0058.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG", pszSpec="*.zip") returned 0
	[0058.527] lstrlenA (lpString="*.zip") returned 5
	[0058.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG", pszSpec="*.rar") returned 0
	[0058.527] lstrlenA (lpString="*.rar") returned 5
	[0058.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG", pszSpec="*.7z") returned 0
	[0058.527] lstrlenA (lpString="*.7z") returned 4
	[0058.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG", pszSpec="*.tar") returned 0
	[0058.527] lstrlenA (lpString="*.tar") returned 5
	[0058.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG", pszSpec="*.gzip") returned 0
	[0058.527] lstrlenA (lpString="*.gzip") returned 6
	[0058.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG", pszSpec="*.jpg") returned 1
	[0058.527] lstrlenA (lpString="*.jpg") returned 5
	[0058.528] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG"
	[0058.528] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG"
	[0058.528] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG."
	[0058.528] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG.exe"
	[0058.528] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03205i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0058.529] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa343
	[0058.529] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x102c771c, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x102c771c, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x102c771c, dwHighDateTime=0x1d327e8)) returned 1
	[0058.529] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.529] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xa301, lpOverlapped=0x0) returned 1
	[0058.530] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG") returned="PH03205I.JPG"
	[0058.530] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.531] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xa301, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xa301, lpOverlapped=0x0) returned 1
	[0058.531] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.531] CloseHandle (hObject=0x214) returned 1
	[0058.531] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03205i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03205i.jpg.exe")) returned 1
	[0058.531] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102c771c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102c771c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102c771c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa445, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03224I.JPG", cAlternateFileName="")) returned 1
	[0058.531] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.531] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH03224I.JPG") returned -1
	[0058.532] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH03224I.JPG") returned -1
	[0058.532] lstrcmpiA (lpString1="", lpString2="PH03224I.JPG") returned -1
	[0058.532] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG") returned="PH03205I.JPG"
	[0058.532] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.532] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.532] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.532] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.532] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH03224I.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG"
	[0058.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG", pszSpec="*.zip") returned 0
	[0058.532] lstrlenA (lpString="*.zip") returned 5
	[0058.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG", pszSpec="*.rar") returned 0
	[0058.532] lstrlenA (lpString="*.rar") returned 5
	[0058.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG", pszSpec="*.7z") returned 0
	[0058.532] lstrlenA (lpString="*.7z") returned 4
	[0058.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG", pszSpec="*.tar") returned 0
	[0058.532] lstrlenA (lpString="*.tar") returned 5
	[0058.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG", pszSpec="*.gzip") returned 0
	[0058.532] lstrlenA (lpString="*.gzip") returned 6
	[0058.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG", pszSpec="*.jpg") returned 1
	[0058.532] lstrlenA (lpString="*.jpg") returned 5
	[0058.532] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG"
	[0058.532] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG"
	[0058.532] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG."
	[0058.532] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG.exe"
	[0058.532] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03224i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0058.533] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa445
	[0058.533] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x102c771c, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x102c771c, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x102c771c, dwHighDateTime=0x1d327e8)) returned 1
	[0058.533] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.533] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xa403, lpOverlapped=0x0) returned 1
	[0058.535] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG") returned="PH03224I.JPG"
	[0058.535] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.535] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xa403, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xa403, lpOverlapped=0x0) returned 1
	[0058.535] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.535] CloseHandle (hObject=0x214) returned 1
	[0058.535] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03224i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03224i.jpg.exe")) returned 1
	[0058.536] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102a14ae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102a14ae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102c771c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ba2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03379I.JPG", cAlternateFileName="")) returned 1
	[0058.536] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.536] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH03379I.JPG") returned -1
	[0058.536] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH03379I.JPG") returned -1
	[0058.536] lstrcmpiA (lpString1="", lpString2="PH03379I.JPG") returned -1
	[0058.536] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG") returned="PH03224I.JPG"
	[0058.536] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.536] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.536] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.536] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.536] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH03379I.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03379I.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03379I.JPG"
	[0058.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03379I.JPG", pszSpec="*.zip") returned 0
	[0058.536] lstrlenA (lpString="*.zip") returned 5
	[0058.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03379I.JPG", pszSpec="*.rar") returned 0
	[0058.536] lstrlenA (lpString="*.rar") returned 5
	[0058.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03379I.JPG", pszSpec="*.7z") returned 0
	[0058.536] lstrlenA (lpString="*.7z") returned 4
	[0058.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03379I.JPG", pszSpec="*.tar") returned 0
	[0058.536] lstrlenA (lpString="*.tar") returned 5
	[0058.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03379I.JPG", pszSpec="*.gzip") returned 0
	[0058.536] lstrlenA (lpString="*.gzip") returned 6
	[0058.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03379I.JPG", pszSpec="*.jpg") returned 1
	[0058.536] lstrlenA (lpString="*.jpg") returned 5
	[0058.536] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03379I.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03379I.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03379I.JPG"
	[0058.536] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03379I.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03379I.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03379I.JPG"
	[0058.536] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03379I.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03379I.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03379I.JPG."
	[0058.536] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03379I.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03379I.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03379I.JPG.exe"
	[0058.536] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03379i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0058.537] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ba2
	[0058.537] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x102a14ae, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x102a14ae, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x102c771c, dwHighDateTime=0x1d327e8)) returned 1
	[0058.537] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.537] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x2b60, lpOverlapped=0x0) returned 1
	[0058.538] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03379I.JPG") returned="PH03379I.JPG"
	[0058.538] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.538] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x2b60, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x2b60, lpOverlapped=0x0) returned 1
	[0058.539] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.539] CloseHandle (hObject=0x214) returned 1
	[0058.539] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03379i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03379I.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03379i.jpg.exe")) returned 1
	[0058.539] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102c771c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102c771c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102c771c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x321f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03380I.JPG", cAlternateFileName="")) returned 1
	[0058.539] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.539] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH03380I.JPG") returned -1
	[0058.539] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH03380I.JPG") returned -1
	[0058.539] lstrcmpiA (lpString1="", lpString2="PH03380I.JPG") returned -1
	[0058.539] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03379I.JPG") returned="PH03379I.JPG"
	[0058.540] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.540] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.540] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.540] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.540] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH03380I.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG"
	[0058.540] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG", pszSpec="*.zip") returned 0
	[0058.540] lstrlenA (lpString="*.zip") returned 5
	[0058.540] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG", pszSpec="*.rar") returned 0
	[0058.540] lstrlenA (lpString="*.rar") returned 5
	[0058.540] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG", pszSpec="*.7z") returned 0
	[0058.540] lstrlenA (lpString="*.7z") returned 4
	[0058.540] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG", pszSpec="*.tar") returned 0
	[0058.540] lstrlenA (lpString="*.tar") returned 5
	[0058.540] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG", pszSpec="*.gzip") returned 0
	[0058.540] lstrlenA (lpString="*.gzip") returned 6
	[0058.540] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG", pszSpec="*.jpg") returned 1
	[0058.540] lstrlenA (lpString="*.jpg") returned 5
	[0058.540] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG"
	[0058.540] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG"
	[0058.540] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG."
	[0058.540] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG.exe"
	[0058.540] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03380i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0058.541] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x321f
	[0058.541] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x102c771c, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x102c771c, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x102c771c, dwHighDateTime=0x1d327e8)) returned 1
	[0058.541] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.541] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x31dd, lpOverlapped=0x0) returned 1
	[0058.542] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG") returned="PH03380I.JPG"
	[0058.542] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.542] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x31dd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x31dd, lpOverlapped=0x0) returned 1
	[0058.543] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.543] CloseHandle (hObject=0x214) returned 1
	[0058.543] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03380i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03380i.jpg.exe")) returned 1
	[0058.543] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102c771c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102c771c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102c771c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbdae, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03425I.JPG", cAlternateFileName="")) returned 1
	[0058.543] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.543] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PH03425I.JPG") returned -1
	[0058.543] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PH03425I.JPG") returned -1
	[0058.543] lstrcmpiA (lpString1="", lpString2="PH03425I.JPG") returned -1
	[0058.544] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG") returned="PH03380I.JPG"
	[0058.544] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.544] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.544] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.544] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.544] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PH03425I.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG"
	[0058.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG", pszSpec="*.zip") returned 0
	[0058.544] lstrlenA (lpString="*.zip") returned 5
	[0058.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG", pszSpec="*.rar") returned 0
	[0058.544] lstrlenA (lpString="*.rar") returned 5
	[0058.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG", pszSpec="*.7z") returned 0
	[0058.544] lstrlenA (lpString="*.7z") returned 4
	[0058.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG", pszSpec="*.tar") returned 0
	[0058.544] lstrlenA (lpString="*.tar") returned 5
	[0058.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG", pszSpec="*.gzip") returned 0
	[0058.544] lstrlenA (lpString="*.gzip") returned 6
	[0058.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG", pszSpec="*.jpg") returned 1
	[0058.544] lstrlenA (lpString="*.jpg") returned 5
	[0058.544] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG"
	[0058.544] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG"
	[0058.544] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG."
	[0058.544] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG.exe"
	[0058.545] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03425i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0058.545] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbdae
	[0058.545] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x102c771c, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x102c771c, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x102c771c, dwHighDateTime=0x1d327e8)) returned 1
	[0058.545] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.545] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xbd6c, lpOverlapped=0x0) returned 1
	[0058.546] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG") returned="PH03425I.JPG"
	[0058.546] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0058.547] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xbd6c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xbd6c, lpOverlapped=0x0) returned 1
	[0058.547] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.547] CloseHandle (hObject=0x214) returned 1
	[0058.547] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03425i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03425i.jpg.exe")) returned 1
	[0058.547] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102c771c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102c771c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102c771c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xef6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRRT.WMF", cAlternateFileName="")) returned 1
	[0058.547] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.548] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PRRT.WMF") returned -1
	[0058.548] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PRRT.WMF") returned -1
	[0058.548] lstrcmpiA (lpString1="", lpString2="PRRT.WMF") returned -1
	[0058.548] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG") returned="PH03425I.JPG"
	[0058.548] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.548] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.548] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.548] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.548] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PRRT.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF"
	[0058.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.zip") returned 0
	[0058.548] lstrlenA (lpString="*.zip") returned 5
	[0058.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.rar") returned 0
	[0058.548] lstrlenA (lpString="*.rar") returned 5
	[0058.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.7z") returned 0
	[0058.548] lstrlenA (lpString="*.7z") returned 4
	[0058.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.tar") returned 0
	[0058.548] lstrlenA (lpString="*.tar") returned 5
	[0058.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.gzip") returned 0
	[0058.548] lstrlenA (lpString="*.gzip") returned 6
	[0058.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.jpg") returned 0
	[0058.548] lstrlenA (lpString="*.jpg") returned 5
	[0058.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.jpeg") returned 0
	[0058.548] lstrlenA (lpString="*.jpeg") returned 6
	[0058.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.bmp") returned 0
	[0058.548] lstrlenA (lpString="*.bmp") returned 5
	[0058.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.gif") returned 0
	[0058.548] lstrlenA (lpString="*.gif") returned 5
	[0058.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.png") returned 0
	[0058.548] lstrlenA (lpString="*.png") returned 5
	[0058.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.doc") returned 0
	[0058.548] lstrlenA (lpString="*.doc") returned 5
	[0058.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.docx") returned 0
	[0058.548] lstrlenA (lpString="*.docx") returned 6
	[0058.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.xls") returned 0
	[0058.549] lstrlenA (lpString="*.xls") returned 5
	[0058.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.xlsx") returned 0
	[0058.549] lstrlenA (lpString="*.xlsx") returned 6
	[0058.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.ppt") returned 0
	[0058.549] lstrlenA (lpString="*.ppt") returned 5
	[0058.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.pptx") returned 0
	[0058.549] lstrlenA (lpString="*.pptx") returned 6
	[0058.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.txt") returned 0
	[0058.549] lstrlenA (lpString="*.txt") returned 5
	[0058.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.pdf") returned 0
	[0058.549] lstrlenA (lpString="*.pdf") returned 5
	[0058.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.htm") returned 0
	[0058.549] lstrlenA (lpString="*.htm") returned 5
	[0058.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.html") returned 0
	[0058.549] lstrlenA (lpString="*.html") returned 6
	[0058.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.mdb") returned 0
	[0058.549] lstrlenA (lpString="*.mdb") returned 5
	[0058.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.pfx") returned 0
	[0058.549] lstrlenA (lpString="*.pfx") returned 5
	[0058.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.md") returned 0
	[0058.549] lstrlenA (lpString="*.md") returned 4
	[0058.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.lnk") returned 0
	[0058.549] lstrlenA (lpString="*.lnk") returned 5
	[0058.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.torrent") returned 0
	[0058.549] lstrlenA (lpString="*.torrent") returned 9
	[0058.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.mov") returned 0
	[0058.549] lstrlenA (lpString="*.mov") returned 5
	[0058.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.3gp") returned 0
	[0058.549] lstrlenA (lpString="*.3gp") returned 5
	[0058.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.mpeg") returned 0
	[0058.549] lstrlenA (lpString="*.mpeg") returned 6
	[0058.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.mpg") returned 0
	[0058.549] lstrlenA (lpString="*.mpg") returned 5
	[0058.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.flv") returned 0
	[0058.549] lstrlenA (lpString="*.flv") returned 5
	[0058.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.avi") returned 0
	[0058.550] lstrlenA (lpString="*.avi") returned 5
	[0058.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.mp4") returned 0
	[0058.550] lstrlenA (lpString="*.mp4") returned 5
	[0058.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.wmv") returned 0
	[0058.550] lstrlenA (lpString="*.wmv") returned 5
	[0058.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.mkv") returned 0
	[0058.550] lstrlenA (lpString="*.mkv") returned 5
	[0058.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.mp3") returned 0
	[0058.550] lstrlenA (lpString="*.mp3") returned 5
	[0058.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.wav") returned 0
	[0058.550] lstrlenA (lpString="*.wav") returned 5
	[0058.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.flac") returned 0
	[0058.550] lstrlenA (lpString="*.flac") returned 6
	[0058.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.wma") returned 0
	[0058.550] lstrlenA (lpString="*.wma") returned 5
	[0058.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.au3") returned 0
	[0058.550] lstrlenA (lpString="*.au3") returned 5
	[0058.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.ahk") returned 0
	[0058.550] lstrlenA (lpString="*.ahk") returned 5
	[0058.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.c") returned 0
	[0058.550] lstrlenA (lpString="*.c") returned 3
	[0058.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.cc") returned 0
	[0058.550] lstrlenA (lpString="*.cc") returned 4
	[0058.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.cpp") returned 0
	[0058.550] lstrlenA (lpString="*.cpp") returned 5
	[0058.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.cxx") returned 0
	[0058.550] lstrlenA (lpString="*.cxx") returned 5
	[0058.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.c++") returned 0
	[0058.550] lstrlenA (lpString="*.c++") returned 5
	[0058.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.cs") returned 0
	[0058.550] lstrlenA (lpString="*.cs") returned 4
	[0058.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.vb") returned 0
	[0058.550] lstrlenA (lpString="*.vb") returned 4
	[0058.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.bas") returned 0
	[0058.550] lstrlenA (lpString="*.bas") returned 5
	[0058.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.csproj") returned 0
	[0058.551] lstrlenA (lpString="*.csproj") returned 8
	[0058.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.vbproj") returned 0
	[0058.551] lstrlenA (lpString="*.vbproj") returned 8
	[0058.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.vcxproj") returned 0
	[0058.551] lstrlenA (lpString="*.vcxproj") returned 9
	[0058.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.manifest") returned 0
	[0058.551] lstrlenA (lpString="*.manifest") returned 10
	[0058.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.php") returned 0
	[0058.551] lstrlenA (lpString="*.php") returned 5
	[0058.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.vbe") returned 0
	[0058.551] lstrlenA (lpString="*.vbe") returned 5
	[0058.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.vba") returned 0
	[0058.551] lstrlenA (lpString="*.vba") returned 5
	[0058.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.vbs") returned 0
	[0058.551] lstrlenA (lpString="*.vbs") returned 5
	[0058.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.bat") returned 0
	[0058.551] lstrlenA (lpString="*.bat") returned 5
	[0058.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.cmd") returned 0
	[0058.551] lstrlenA (lpString="*.cmd") returned 5
	[0058.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.js") returned 0
	[0058.551] lstrlenA (lpString="*.js") returned 4
	[0058.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.jscript") returned 0
	[0058.551] lstrlenA (lpString="*.jscript") returned 9
	[0058.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.hta") returned 0
	[0058.551] lstrlenA (lpString="*.hta") returned 5
	[0058.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.php7") returned 0
	[0058.551] lstrlenA (lpString="*.php7") returned 6
	[0058.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.db") returned 0
	[0058.551] lstrlenA (lpString="*.db") returned 4
	[0058.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.swf") returned 0
	[0058.551] lstrlenA (lpString="*.swf") returned 5
	[0058.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.eml") returned 0
	[0058.551] lstrlenA (lpString="*.eml") returned 5
	[0058.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.part") returned 0
	[0058.551] lstrlenA (lpString="*.part") returned 6
	[0058.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.nfo") returned 0
	[0058.552] lstrlenA (lpString="*.nfo") returned 5
	[0058.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.rsa") returned 0
	[0058.552] lstrlenA (lpString="*.rsa") returned 5
	[0058.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.key") returned 0
	[0058.552] lstrlenA (lpString="*.key") returned 5
	[0058.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.aes") returned 0
	[0058.552] lstrlenA (lpString="*.aes") returned 5
	[0058.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.blob") returned 0
	[0058.552] lstrlenA (lpString="*.blob") returned 6
	[0058.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.btc") returned 0
	[0058.552] lstrlenA (lpString="*.btc") returned 5
	[0058.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF", pszSpec="*.wallet") returned 0
	[0058.552] lstrlenA (lpString="*.wallet") returned 8
	[0058.552] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102c771c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102c771c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102c771c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7aac, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRRTINST.WMF", cAlternateFileName="")) returned 1
	[0058.552] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.552] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PRRTINST.WMF") returned -1
	[0058.552] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PRRTINST.WMF") returned -1
	[0058.552] lstrcmpiA (lpString1="", lpString2="PRRTINST.WMF") returned -1
	[0058.552] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF") returned="PRRT.WMF"
	[0058.552] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.552] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.552] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.552] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.552] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PRRTINST.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF"
	[0058.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.zip") returned 0
	[0058.552] lstrlenA (lpString="*.zip") returned 5
	[0058.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.rar") returned 0
	[0058.552] lstrlenA (lpString="*.rar") returned 5
	[0058.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.7z") returned 0
	[0058.552] lstrlenA (lpString="*.7z") returned 4
	[0058.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.tar") returned 0
	[0058.552] lstrlenA (lpString="*.tar") returned 5
	[0058.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.gzip") returned 0
	[0058.552] lstrlenA (lpString="*.gzip") returned 6
	[0058.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.jpg") returned 0
	[0058.553] lstrlenA (lpString="*.jpg") returned 5
	[0058.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.jpeg") returned 0
	[0058.553] lstrlenA (lpString="*.jpeg") returned 6
	[0058.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.bmp") returned 0
	[0058.553] lstrlenA (lpString="*.bmp") returned 5
	[0058.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.gif") returned 0
	[0058.553] lstrlenA (lpString="*.gif") returned 5
	[0058.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.png") returned 0
	[0058.553] lstrlenA (lpString="*.png") returned 5
	[0058.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.doc") returned 0
	[0058.553] lstrlenA (lpString="*.doc") returned 5
	[0058.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.docx") returned 0
	[0058.553] lstrlenA (lpString="*.docx") returned 6
	[0058.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.xls") returned 0
	[0058.553] lstrlenA (lpString="*.xls") returned 5
	[0058.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.xlsx") returned 0
	[0058.553] lstrlenA (lpString="*.xlsx") returned 6
	[0058.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.ppt") returned 0
	[0058.553] lstrlenA (lpString="*.ppt") returned 5
	[0058.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.pptx") returned 0
	[0058.553] lstrlenA (lpString="*.pptx") returned 6
	[0058.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.txt") returned 0
	[0058.553] lstrlenA (lpString="*.txt") returned 5
	[0058.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.pdf") returned 0
	[0058.553] lstrlenA (lpString="*.pdf") returned 5
	[0058.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.htm") returned 0
	[0058.553] lstrlenA (lpString="*.htm") returned 5
	[0058.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.html") returned 0
	[0058.553] lstrlenA (lpString="*.html") returned 6
	[0058.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.mdb") returned 0
	[0058.553] lstrlenA (lpString="*.mdb") returned 5
	[0058.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.pfx") returned 0
	[0058.553] lstrlenA (lpString="*.pfx") returned 5
	[0058.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.md") returned 0
	[0058.553] lstrlenA (lpString="*.md") returned 4
	[0058.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.lnk") returned 0
	[0058.554] lstrlenA (lpString="*.lnk") returned 5
	[0058.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.torrent") returned 0
	[0058.554] lstrlenA (lpString="*.torrent") returned 9
	[0058.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.mov") returned 0
	[0058.554] lstrlenA (lpString="*.mov") returned 5
	[0058.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.3gp") returned 0
	[0058.554] lstrlenA (lpString="*.3gp") returned 5
	[0058.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.mpeg") returned 0
	[0058.554] lstrlenA (lpString="*.mpeg") returned 6
	[0058.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.mpg") returned 0
	[0058.554] lstrlenA (lpString="*.mpg") returned 5
	[0058.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.flv") returned 0
	[0058.554] lstrlenA (lpString="*.flv") returned 5
	[0058.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.avi") returned 0
	[0058.554] lstrlenA (lpString="*.avi") returned 5
	[0058.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.mp4") returned 0
	[0058.554] lstrlenA (lpString="*.mp4") returned 5
	[0058.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.wmv") returned 0
	[0058.554] lstrlenA (lpString="*.wmv") returned 5
	[0058.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.mkv") returned 0
	[0058.554] lstrlenA (lpString="*.mkv") returned 5
	[0058.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.mp3") returned 0
	[0058.554] lstrlenA (lpString="*.mp3") returned 5
	[0058.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.wav") returned 0
	[0058.554] lstrlenA (lpString="*.wav") returned 5
	[0058.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.flac") returned 0
	[0058.554] lstrlenA (lpString="*.flac") returned 6
	[0058.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.wma") returned 0
	[0058.554] lstrlenA (lpString="*.wma") returned 5
	[0058.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.au3") returned 0
	[0058.554] lstrlenA (lpString="*.au3") returned 5
	[0058.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.ahk") returned 0
	[0058.554] lstrlenA (lpString="*.ahk") returned 5
	[0058.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.c") returned 0
	[0058.554] lstrlenA (lpString="*.c") returned 3
	[0058.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.cc") returned 0
	[0058.555] lstrlenA (lpString="*.cc") returned 4
	[0058.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.cpp") returned 0
	[0058.555] lstrlenA (lpString="*.cpp") returned 5
	[0058.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.cxx") returned 0
	[0058.555] lstrlenA (lpString="*.cxx") returned 5
	[0058.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.c++") returned 0
	[0058.555] lstrlenA (lpString="*.c++") returned 5
	[0058.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.cs") returned 0
	[0058.555] lstrlenA (lpString="*.cs") returned 4
	[0058.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.vb") returned 0
	[0058.556] lstrlenA (lpString="*.vb") returned 4
	[0058.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.bas") returned 0
	[0058.556] lstrlenA (lpString="*.bas") returned 5
	[0058.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.csproj") returned 0
	[0058.556] lstrlenA (lpString="*.csproj") returned 8
	[0058.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.vbproj") returned 0
	[0058.556] lstrlenA (lpString="*.vbproj") returned 8
	[0058.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.vcxproj") returned 0
	[0058.556] lstrlenA (lpString="*.vcxproj") returned 9
	[0058.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.manifest") returned 0
	[0058.556] lstrlenA (lpString="*.manifest") returned 10
	[0058.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.php") returned 0
	[0058.556] lstrlenA (lpString="*.php") returned 5
	[0058.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.vbe") returned 0
	[0058.556] lstrlenA (lpString="*.vbe") returned 5
	[0058.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.vba") returned 0
	[0058.556] lstrlenA (lpString="*.vba") returned 5
	[0058.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.vbs") returned 0
	[0058.556] lstrlenA (lpString="*.vbs") returned 5
	[0058.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.bat") returned 0
	[0058.556] lstrlenA (lpString="*.bat") returned 5
	[0058.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.cmd") returned 0
	[0058.556] lstrlenA (lpString="*.cmd") returned 5
	[0058.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.js") returned 0
	[0058.556] lstrlenA (lpString="*.js") returned 4
	[0058.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.jscript") returned 0
	[0058.556] lstrlenA (lpString="*.jscript") returned 9
	[0058.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.hta") returned 0
	[0058.556] lstrlenA (lpString="*.hta") returned 5
	[0058.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.php7") returned 0
	[0058.556] lstrlenA (lpString="*.php7") returned 6
	[0058.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.db") returned 0
	[0058.556] lstrlenA (lpString="*.db") returned 4
	[0058.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.swf") returned 0
	[0058.556] lstrlenA (lpString="*.swf") returned 5
	[0058.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.eml") returned 0
	[0058.556] lstrlenA (lpString="*.eml") returned 5
	[0058.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.part") returned 0
	[0058.557] lstrlenA (lpString="*.part") returned 6
	[0058.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.nfo") returned 0
	[0058.557] lstrlenA (lpString="*.nfo") returned 5
	[0058.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.rsa") returned 0
	[0058.557] lstrlenA (lpString="*.rsa") returned 5
	[0058.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.key") returned 0
	[0058.557] lstrlenA (lpString="*.key") returned 5
	[0058.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.aes") returned 0
	[0058.557] lstrlenA (lpString="*.aes") returned 5
	[0058.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.blob") returned 0
	[0058.557] lstrlenA (lpString="*.blob") returned 6
	[0058.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.btc") returned 0
	[0058.557] lstrlenA (lpString="*.btc") returned 5
	[0058.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF", pszSpec="*.wallet") returned 0
	[0058.557] lstrlenA (lpString="*.wallet") returned 8
	[0058.557] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102c771c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102c771c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102c771c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSRETRO.WMF", cAlternateFileName="")) returned 1
	[0058.557] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.557] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PSRETRO.WMF") returned -1
	[0058.557] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PSRETRO.WMF") returned -1
	[0058.557] lstrcmpiA (lpString1="", lpString2="PSRETRO.WMF") returned -1
	[0058.557] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF") returned="PRRTINST.WMF"
	[0058.557] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.557] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.557] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.557] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.557] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PSRETRO.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF"
	[0058.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.zip") returned 0
	[0058.557] lstrlenA (lpString="*.zip") returned 5
	[0058.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.rar") returned 0
	[0058.557] lstrlenA (lpString="*.rar") returned 5
	[0058.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.7z") returned 0
	[0058.557] lstrlenA (lpString="*.7z") returned 4
	[0058.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.tar") returned 0
	[0058.558] lstrlenA (lpString="*.tar") returned 5
	[0058.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.gzip") returned 0
	[0058.558] lstrlenA (lpString="*.gzip") returned 6
	[0058.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.jpg") returned 0
	[0058.558] lstrlenA (lpString="*.jpg") returned 5
	[0058.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.jpeg") returned 0
	[0058.558] lstrlenA (lpString="*.jpeg") returned 6
	[0058.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.bmp") returned 0
	[0058.558] lstrlenA (lpString="*.bmp") returned 5
	[0058.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.gif") returned 0
	[0058.558] lstrlenA (lpString="*.gif") returned 5
	[0058.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.png") returned 0
	[0058.558] lstrlenA (lpString="*.png") returned 5
	[0058.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.doc") returned 0
	[0058.558] lstrlenA (lpString="*.doc") returned 5
	[0058.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.docx") returned 0
	[0058.558] lstrlenA (lpString="*.docx") returned 6
	[0058.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.xls") returned 0
	[0058.558] lstrlenA (lpString="*.xls") returned 5
	[0058.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.xlsx") returned 0
	[0058.558] lstrlenA (lpString="*.xlsx") returned 6
	[0058.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.ppt") returned 0
	[0058.558] lstrlenA (lpString="*.ppt") returned 5
	[0058.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.pptx") returned 0
	[0058.558] lstrlenA (lpString="*.pptx") returned 6
	[0058.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.txt") returned 0
	[0058.558] lstrlenA (lpString="*.txt") returned 5
	[0058.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.pdf") returned 0
	[0058.558] lstrlenA (lpString="*.pdf") returned 5
	[0058.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.htm") returned 0
	[0058.558] lstrlenA (lpString="*.htm") returned 5
	[0058.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.html") returned 0
	[0058.558] lstrlenA (lpString="*.html") returned 6
	[0058.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.mdb") returned 0
	[0058.558] lstrlenA (lpString="*.mdb") returned 5
	[0058.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.pfx") returned 0
	[0058.559] lstrlenA (lpString="*.pfx") returned 5
	[0058.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.md") returned 0
	[0058.559] lstrlenA (lpString="*.md") returned 4
	[0058.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.lnk") returned 0
	[0058.559] lstrlenA (lpString="*.lnk") returned 5
	[0058.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.torrent") returned 0
	[0058.559] lstrlenA (lpString="*.torrent") returned 9
	[0058.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.mov") returned 0
	[0058.559] lstrlenA (lpString="*.mov") returned 5
	[0058.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.3gp") returned 0
	[0058.559] lstrlenA (lpString="*.3gp") returned 5
	[0058.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.mpeg") returned 0
	[0058.559] lstrlenA (lpString="*.mpeg") returned 6
	[0058.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.mpg") returned 0
	[0058.559] lstrlenA (lpString="*.mpg") returned 5
	[0058.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.flv") returned 0
	[0058.559] lstrlenA (lpString="*.flv") returned 5
	[0058.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.avi") returned 0
	[0058.559] lstrlenA (lpString="*.avi") returned 5
	[0058.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.mp4") returned 0
	[0058.559] lstrlenA (lpString="*.mp4") returned 5
	[0058.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.wmv") returned 0
	[0058.559] lstrlenA (lpString="*.wmv") returned 5
	[0058.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.mkv") returned 0
	[0058.559] lstrlenA (lpString="*.mkv") returned 5
	[0058.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.mp3") returned 0
	[0058.559] lstrlenA (lpString="*.mp3") returned 5
	[0058.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.wav") returned 0
	[0058.559] lstrlenA (lpString="*.wav") returned 5
	[0058.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.flac") returned 0
	[0058.559] lstrlenA (lpString="*.flac") returned 6
	[0058.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.wma") returned 0
	[0058.559] lstrlenA (lpString="*.wma") returned 5
	[0058.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.au3") returned 0
	[0058.559] lstrlenA (lpString="*.au3") returned 5
	[0058.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.ahk") returned 0
	[0058.559] lstrlenA (lpString="*.ahk") returned 5
	[0058.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.c") returned 0
	[0058.560] lstrlenA (lpString="*.c") returned 3
	[0058.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.cc") returned 0
	[0058.560] lstrlenA (lpString="*.cc") returned 4
	[0058.666] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.cpp") returned 0
	[0058.666] lstrlenA (lpString="*.cpp") returned 5
	[0058.666] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.cxx") returned 0
	[0058.666] lstrlenA (lpString="*.cxx") returned 5
	[0058.666] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.c++") returned 0
	[0058.666] lstrlenA (lpString="*.c++") returned 5
	[0058.666] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.cs") returned 0
	[0058.666] lstrlenA (lpString="*.cs") returned 4
	[0058.666] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.vb") returned 0
	[0058.666] lstrlenA (lpString="*.vb") returned 4
	[0058.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.bas") returned 0
	[0058.667] lstrlenA (lpString="*.bas") returned 5
	[0058.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.csproj") returned 0
	[0058.667] lstrlenA (lpString="*.csproj") returned 8
	[0058.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.vbproj") returned 0
	[0058.667] lstrlenA (lpString="*.vbproj") returned 8
	[0058.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.vcxproj") returned 0
	[0058.667] lstrlenA (lpString="*.vcxproj") returned 9
	[0058.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.manifest") returned 0
	[0058.667] lstrlenA (lpString="*.manifest") returned 10
	[0058.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.php") returned 0
	[0058.667] lstrlenA (lpString="*.php") returned 5
	[0058.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.vbe") returned 0
	[0058.667] lstrlenA (lpString="*.vbe") returned 5
	[0058.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.vba") returned 0
	[0058.667] lstrlenA (lpString="*.vba") returned 5
	[0058.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.vbs") returned 0
	[0058.667] lstrlenA (lpString="*.vbs") returned 5
	[0058.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.bat") returned 0
	[0058.667] lstrlenA (lpString="*.bat") returned 5
	[0058.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.cmd") returned 0
	[0058.667] lstrlenA (lpString="*.cmd") returned 5
	[0058.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.js") returned 0
	[0058.667] lstrlenA (lpString="*.js") returned 4
	[0058.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.jscript") returned 0
	[0058.667] lstrlenA (lpString="*.jscript") returned 9
	[0058.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.hta") returned 0
	[0058.667] lstrlenA (lpString="*.hta") returned 5
	[0058.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.php7") returned 0
	[0058.667] lstrlenA (lpString="*.php7") returned 6
	[0058.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.db") returned 0
	[0058.667] lstrlenA (lpString="*.db") returned 4
	[0058.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.swf") returned 0
	[0058.667] lstrlenA (lpString="*.swf") returned 5
	[0058.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.eml") returned 0
	[0058.667] lstrlenA (lpString="*.eml") returned 5
	[0058.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.part") returned 0
	[0058.667] lstrlenA (lpString="*.part") returned 6
	[0058.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.nfo") returned 0
	[0058.668] lstrlenA (lpString="*.nfo") returned 5
	[0058.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.rsa") returned 0
	[0058.668] lstrlenA (lpString="*.rsa") returned 5
	[0058.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.key") returned 0
	[0058.668] lstrlenA (lpString="*.key") returned 5
	[0058.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.aes") returned 0
	[0058.668] lstrlenA (lpString="*.aes") returned 5
	[0058.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.blob") returned 0
	[0058.668] lstrlenA (lpString="*.blob") returned 6
	[0058.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.btc") returned 0
	[0058.668] lstrlenA (lpString="*.btc") returned 5
	[0058.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF", pszSpec="*.wallet") returned 0
	[0058.668] lstrlenA (lpString="*.wallet") returned 8
	[0058.668] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102c771c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102c771c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102c771c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSSKETLG.WMF", cAlternateFileName="")) returned 1
	[0058.668] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.668] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PSSKETLG.WMF") returned -1
	[0058.668] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PSSKETLG.WMF") returned -1
	[0058.668] lstrcmpiA (lpString1="", lpString2="PSSKETLG.WMF") returned -1
	[0058.668] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF") returned="PSRETRO.WMF"
	[0058.668] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.668] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.668] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.668] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.668] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PSSKETLG.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF"
	[0058.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.zip") returned 0
	[0058.668] lstrlenA (lpString="*.zip") returned 5
	[0058.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.rar") returned 0
	[0058.668] lstrlenA (lpString="*.rar") returned 5
	[0058.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.7z") returned 0
	[0058.669] lstrlenA (lpString="*.7z") returned 4
	[0058.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.tar") returned 0
	[0058.669] lstrlenA (lpString="*.tar") returned 5
	[0058.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.gzip") returned 0
	[0058.669] lstrlenA (lpString="*.gzip") returned 6
	[0058.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.jpg") returned 0
	[0058.669] lstrlenA (lpString="*.jpg") returned 5
	[0058.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.jpeg") returned 0
	[0058.669] lstrlenA (lpString="*.jpeg") returned 6
	[0058.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.bmp") returned 0
	[0058.669] lstrlenA (lpString="*.bmp") returned 5
	[0058.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.gif") returned 0
	[0058.669] lstrlenA (lpString="*.gif") returned 5
	[0058.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.png") returned 0
	[0058.669] lstrlenA (lpString="*.png") returned 5
	[0058.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.doc") returned 0
	[0058.669] lstrlenA (lpString="*.doc") returned 5
	[0058.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.docx") returned 0
	[0058.669] lstrlenA (lpString="*.docx") returned 6
	[0058.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.xls") returned 0
	[0058.669] lstrlenA (lpString="*.xls") returned 5
	[0058.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.xlsx") returned 0
	[0058.669] lstrlenA (lpString="*.xlsx") returned 6
	[0058.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.ppt") returned 0
	[0058.669] lstrlenA (lpString="*.ppt") returned 5
	[0058.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.pptx") returned 0
	[0058.669] lstrlenA (lpString="*.pptx") returned 6
	[0058.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.txt") returned 0
	[0058.669] lstrlenA (lpString="*.txt") returned 5
	[0058.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.pdf") returned 0
	[0058.669] lstrlenA (lpString="*.pdf") returned 5
	[0058.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.htm") returned 0
	[0058.669] lstrlenA (lpString="*.htm") returned 5
	[0058.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.html") returned 0
	[0058.670] lstrlenA (lpString="*.html") returned 6
	[0058.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.mdb") returned 0
	[0058.670] lstrlenA (lpString="*.mdb") returned 5
	[0058.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.pfx") returned 0
	[0058.670] lstrlenA (lpString="*.pfx") returned 5
	[0058.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.md") returned 0
	[0058.670] lstrlenA (lpString="*.md") returned 4
	[0058.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.lnk") returned 0
	[0058.670] lstrlenA (lpString="*.lnk") returned 5
	[0058.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.torrent") returned 0
	[0058.670] lstrlenA (lpString="*.torrent") returned 9
	[0058.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.mov") returned 0
	[0058.670] lstrlenA (lpString="*.mov") returned 5
	[0058.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.3gp") returned 0
	[0058.670] lstrlenA (lpString="*.3gp") returned 5
	[0058.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.mpeg") returned 0
	[0058.670] lstrlenA (lpString="*.mpeg") returned 6
	[0058.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.mpg") returned 0
	[0058.670] lstrlenA (lpString="*.mpg") returned 5
	[0058.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF", pszSpec="*.flv") returned 0
	[0058.670] lstrlenA (lpString="*.flv") returned 5
	[0058.670] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102a14ae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102a14ae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102c771c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x776, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSSKETSM.WMF", cAlternateFileName="")) returned 1
	[0058.670] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.670] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PSSKETSM.WMF") returned -1
	[0058.670] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PSSKETSM.WMF") returned -1
	[0058.670] lstrcmpiA (lpString1="", lpString2="PSSKETSM.WMF") returned -1
	[0058.671] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF") returned="PSSKETLG.WMF"
	[0058.671] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.671] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.671] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.671] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.671] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PSSKETSM.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETSM.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETSM.WMF"
	[0058.671] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102c771c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102c771c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102c771c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb12, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSWAVY.WMF", cAlternateFileName="")) returned 1
	[0058.671] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.671] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PSWAVY.WMF") returned -1
	[0058.671] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PSWAVY.WMF") returned -1
	[0058.671] lstrcmpiA (lpString1="", lpString2="PSWAVY.WMF") returned -1
	[0058.671] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETSM.WMF") returned="PSSKETSM.WMF"
	[0058.671] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.671] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.671] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.671] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.671] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="PSWAVY.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSWAVY.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSWAVY.WMF"
	[0058.671] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102c771c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102c771c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102c771c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="RE00006_.WMF", cAlternateFileName="")) returned 1
	[0058.671] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.671] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="RE00006_.WMF") returned -1
	[0058.671] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="RE00006_.WMF") returned -1
	[0058.671] lstrcmpiA (lpString1="", lpString2="RE00006_.WMF") returned -1
	[0058.671] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSWAVY.WMF") returned="PSWAVY.WMF"
	[0058.671] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.671] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.671] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.672] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.672] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="RE00006_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RE00006_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RE00006_.WMF"
	[0058.672] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102ed99a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102ed99a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102ed99a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd16, dwReserved0=0x0, dwReserved1=0x0, cFileName="RECYCLE.WMF", cAlternateFileName="")) returned 1
	[0058.672] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.672] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="RECYCLE.WMF") returned -1
	[0058.672] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="RECYCLE.WMF") returned -1
	[0058.672] lstrcmpiA (lpString1="", lpString2="RECYCLE.WMF") returned -1
	[0058.672] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RE00006_.WMF") returned="RE00006_.WMF"
	[0058.672] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.672] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.672] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.672] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.672] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="RECYCLE.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RECYCLE.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RECYCLE.WMF"
	[0058.672] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102c771c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102c771c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102ed99a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x175f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ROAD_01.MID", cAlternateFileName="")) returned 1
	[0058.673] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.673] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="ROAD_01.MID") returned -1
	[0058.673] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="ROAD_01.MID") returned -1
	[0058.673] lstrcmpiA (lpString1="", lpString2="ROAD_01.MID") returned -1
	[0058.673] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RECYCLE.WMF") returned="RECYCLE.WMF"
	[0058.673] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.673] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.673] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.673] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.673] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="ROAD_01.MID" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID"
	[0058.674] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102ed99a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102ed99a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102ed99a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x278a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAFRI_01.MID", cAlternateFileName="")) returned 1
	[0058.674] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.674] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SAFRI_01.MID") returned -1
	[0058.674] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SAFRI_01.MID") returned -1
	[0058.674] lstrcmpiA (lpString1="", lpString2="SAFRI_01.MID") returned -1
	[0058.674] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned="ROAD_01.MID"
	[0058.674] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.674] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.674] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.674] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.674] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SAFRI_01.MID" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID"
	[0058.674] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102c771c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102c771c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102ed99a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHOL_02.MID", cAlternateFileName="")) returned 1
	[0058.674] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.674] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SCHOL_02.MID") returned -1
	[0058.674] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SCHOL_02.MID") returned -1
	[0058.674] lstrcmpiA (lpString1="", lpString2="SCHOL_02.MID") returned -1
	[0058.674] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned="SAFRI_01.MID"
	[0058.674] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.674] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.674] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.674] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.674] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SCHOL_02.MID" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID"
	[0058.674] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102c771c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102c771c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102ed99a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x18f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHOW_01.MID", cAlternateFileName="")) returned 1
	[0058.674] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.674] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SHOW_01.MID") returned -1
	[0058.675] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SHOW_01.MID") returned -1
	[0058.675] lstrcmpiA (lpString1="", lpString2="SHOW_01.MID") returned -1
	[0058.675] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned="SCHOL_02.MID"
	[0058.675] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.675] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.675] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.675] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.675] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SHOW_01.MID" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID"
	[0058.675] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102c771c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102c771c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102ed99a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2a0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00256_.WMF", cAlternateFileName="")) returned 1
	[0058.675] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.675] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SL00256_.WMF") returned -1
	[0058.675] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SL00256_.WMF") returned -1
	[0058.675] lstrcmpiA (lpString1="", lpString2="SL00256_.WMF") returned -1
	[0058.675] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned="SHOW_01.MID"
	[0058.675] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.675] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.675] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.675] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.675] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SL00256_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00256_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00256_.WMF"
	[0058.675] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102c771c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102c771c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102ed99a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7ca4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00260_.WMF", cAlternateFileName="")) returned 1
	[0058.675] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.675] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SL00260_.WMF") returned -1
	[0058.675] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SL00260_.WMF") returned -1
	[0058.675] lstrcmpiA (lpString1="", lpString2="SL00260_.WMF") returned -1
	[0058.675] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00256_.WMF") returned="SL00256_.WMF"
	[0058.675] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.675] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.675] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.676] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.676] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SL00260_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00260_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00260_.WMF"
	[0058.676] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102c771c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102c771c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102c771c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00268_.WMF", cAlternateFileName="")) returned 1
	[0058.676] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.676] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SL00268_.WMF") returned -1
	[0058.676] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SL00268_.WMF") returned -1
	[0058.676] lstrcmpiA (lpString1="", lpString2="SL00268_.WMF") returned -1
	[0058.676] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00260_.WMF") returned="SL00260_.WMF"
	[0058.676] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.676] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.676] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.676] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.676] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SL00268_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00268_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00268_.WMF"
	[0058.676] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102ed99a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102ed99a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102ed99a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1dac, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00286_.WMF", cAlternateFileName="")) returned 1
	[0058.676] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.676] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SL00286_.WMF") returned -1
	[0058.676] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SL00286_.WMF") returned -1
	[0058.676] lstrcmpiA (lpString1="", lpString2="SL00286_.WMF") returned -1
	[0058.676] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00268_.WMF") returned="SL00268_.WMF"
	[0058.676] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.676] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.676] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.676] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.677] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SL00286_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00286_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00286_.WMF"
	[0058.677] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102c771c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102c771c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102c771c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1268, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00298_.WMF", cAlternateFileName="")) returned 1
	[0058.677] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.677] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SL00298_.WMF") returned -1
	[0058.677] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SL00298_.WMF") returned -1
	[0058.677] lstrcmpiA (lpString1="", lpString2="SL00298_.WMF") returned -1
	[0058.677] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00286_.WMF") returned="SL00286_.WMF"
	[0058.677] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.677] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.677] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.677] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.677] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SL00298_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00298_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00298_.WMF"
	[0058.677] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102c771c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102c771c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102ed99a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x20e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00308_.WMF", cAlternateFileName="")) returned 1
	[0058.677] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.677] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SL00308_.WMF") returned -1
	[0058.677] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SL00308_.WMF") returned -1
	[0058.677] lstrcmpiA (lpString1="", lpString2="SL00308_.WMF") returned -1
	[0058.677] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00298_.WMF") returned="SL00298_.WMF"
	[0058.677] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.677] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.678] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.678] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.678] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SL00308_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00308_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00308_.WMF"
	[0058.678] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102ed99a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102ed99a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10313bcd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xae4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00345_.WMF", cAlternateFileName="")) returned 1
	[0058.678] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.678] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SL00345_.WMF") returned -1
	[0058.678] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SL00345_.WMF") returned -1
	[0058.678] lstrcmpiA (lpString1="", lpString2="SL00345_.WMF") returned -1
	[0058.678] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00308_.WMF") returned="SL00308_.WMF"
	[0058.678] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.678] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.678] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.678] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.678] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SL00345_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00345_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00345_.WMF"
	[0058.678] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102ed99a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102ed99a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102ed99a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x540, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00452_.WMF", cAlternateFileName="")) returned 1
	[0058.678] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.678] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SL00452_.WMF") returned -1
	[0058.678] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SL00452_.WMF") returned -1
	[0058.678] lstrcmpiA (lpString1="", lpString2="SL00452_.WMF") returned -1
	[0058.679] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00345_.WMF") returned="SL00345_.WMF"
	[0058.679] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.679] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.679] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.679] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.679] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SL00452_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00452_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00452_.WMF"
	[0058.679] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102ed99a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102ed99a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102ed99a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00712_.WMF", cAlternateFileName="")) returned 1
	[0058.679] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.679] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SL00712_.WMF") returned -1
	[0058.679] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SL00712_.WMF") returned -1
	[0058.679] lstrcmpiA (lpString1="", lpString2="SL00712_.WMF") returned -1
	[0058.679] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00452_.WMF") returned="SL00452_.WMF"
	[0058.679] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.679] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.679] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.679] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.679] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SL00712_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00712_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00712_.WMF"
	[0058.679] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102ed99a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102ed99a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102ed99a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xcdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL01040_.WMF", cAlternateFileName="")) returned 1
	[0058.679] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.679] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SL01040_.WMF") returned -1
	[0058.679] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SL01040_.WMF") returned -1
	[0058.680] lstrcmpiA (lpString1="", lpString2="SL01040_.WMF") returned -1
	[0058.680] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00712_.WMF") returned="SL00712_.WMF"
	[0058.680] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.680] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.680] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.680] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.680] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SL01040_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01040_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01040_.WMF"
	[0058.680] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10313bcd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10313bcd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10339e29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x60c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL01041_.WMF", cAlternateFileName="")) returned 1
	[0058.680] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.680] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SL01041_.WMF") returned -1
	[0058.680] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SL01041_.WMF") returned -1
	[0058.680] lstrcmpiA (lpString1="", lpString2="SL01041_.WMF") returned -1
	[0058.680] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01040_.WMF") returned="SL01040_.WMF"
	[0058.680] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.680] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.680] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.680] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.680] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SL01041_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01041_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01041_.WMF"
	[0058.680] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102ed99a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102ed99a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102ed99a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1b04, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL01394_.WMF", cAlternateFileName="")) returned 1
	[0058.680] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.680] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SL01394_.WMF") returned -1
	[0058.680] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SL01394_.WMF") returned -1
	[0058.680] lstrcmpiA (lpString1="", lpString2="SL01394_.WMF") returned -1
	[0058.680] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01041_.WMF") returned="SL01041_.WMF"
	[0058.680] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.680] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.680] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.681] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.681] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SL01394_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01394_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01394_.WMF"
	[0058.681] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102c771c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102c771c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102ed99a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL01395_.WMF", cAlternateFileName="")) returned 1
	[0058.681] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.681] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SL01395_.WMF") returned -1
	[0058.681] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SL01395_.WMF") returned -1
	[0058.681] lstrcmpiA (lpString1="", lpString2="SL01395_.WMF") returned -1
	[0058.681] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01394_.WMF") returned="SL01394_.WMF"
	[0058.681] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.681] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.681] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.681] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.681] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SL01395_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01395_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01395_.WMF"
	[0058.681] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102ed99a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102ed99a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102ed99a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6cc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL01565_.WMF", cAlternateFileName="")) returned 1
	[0058.681] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.681] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SL01565_.WMF") returned -1
	[0058.681] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SL01565_.WMF") returned -1
	[0058.681] lstrcmpiA (lpString1="", lpString2="SL01565_.WMF") returned -1
	[0058.681] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01395_.WMF") returned="SL01395_.WMF"
	[0058.681] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.681] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.681] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.681] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.681] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SL01565_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01565_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01565_.WMF"
	[0058.682] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102ed99a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102ed99a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102ed99a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x36aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00017_.WMF", cAlternateFileName="")) returned 1
	[0058.682] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.682] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00017_.WMF") returned -1
	[0058.682] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00017_.WMF") returned -1
	[0058.682] lstrcmpiA (lpString1="", lpString2="SO00017_.WMF") returned -1
	[0058.682] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01565_.WMF") returned="SL01565_.WMF"
	[0058.682] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.682] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.682] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.682] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.682] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00017_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00017_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00017_.WMF"
	[0058.682] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102ed99a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102ed99a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102ed99a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x32f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00018_.WMF", cAlternateFileName="")) returned 1
	[0058.682] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.682] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00018_.WMF") returned -1
	[0058.682] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00018_.WMF") returned -1
	[0058.682] lstrcmpiA (lpString1="", lpString2="SO00018_.WMF") returned -1
	[0058.682] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00017_.WMF") returned="SO00017_.WMF"
	[0058.682] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.682] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.682] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.682] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.682] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00018_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00018_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00018_.WMF"
	[0058.682] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10313bcd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10313bcd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10313bcd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7a80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00152_.WMF", cAlternateFileName="")) returned 1
	[0058.682] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.682] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00152_.WMF") returned -1
	[0058.682] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00152_.WMF") returned -1
	[0058.682] lstrcmpiA (lpString1="", lpString2="SO00152_.WMF") returned -1
	[0058.683] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00018_.WMF") returned="SO00018_.WMF"
	[0058.683] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.683] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.683] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.683] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.683] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00152_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00152_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00152_.WMF"
	[0058.683] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10313bcd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10313bcd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10313bcd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4754, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00157_.WMF", cAlternateFileName="")) returned 1
	[0058.683] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.683] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00157_.WMF") returned -1
	[0058.683] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00157_.WMF") returned -1
	[0058.683] lstrcmpiA (lpString1="", lpString2="SO00157_.WMF") returned -1
	[0058.683] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00152_.WMF") returned="SO00152_.WMF"
	[0058.683] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.683] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.683] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.683] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.683] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00157_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00157_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00157_.WMF"
	[0058.683] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102ed99a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102ed99a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10313bcd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00159_.WMF", cAlternateFileName="")) returned 1
	[0058.683] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.683] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00159_.WMF") returned -1
	[0058.683] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00159_.WMF") returned -1
	[0058.683] lstrcmpiA (lpString1="", lpString2="SO00159_.WMF") returned -1
	[0058.683] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00157_.WMF") returned="SO00157_.WMF"
	[0058.683] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.683] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.683] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.683] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.684] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00159_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00159_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00159_.WMF"
	[0058.684] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102ed99a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102ed99a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10313bcd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x35b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00166_.WMF", cAlternateFileName="")) returned 1
	[0058.684] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.684] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00166_.WMF") returned -1
	[0058.684] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00166_.WMF") returned -1
	[0058.684] lstrcmpiA (lpString1="", lpString2="SO00166_.WMF") returned -1
	[0058.684] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00159_.WMF") returned="SO00159_.WMF"
	[0058.684] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.684] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.684] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.684] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.684] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00166_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00166_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00166_.WMF"
	[0058.684] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102ed99a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102ed99a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10313bcd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00168_.WMF", cAlternateFileName="")) returned 1
	[0058.684] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.684] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00168_.WMF") returned -1
	[0058.684] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00168_.WMF") returned -1
	[0058.684] lstrcmpiA (lpString1="", lpString2="SO00168_.WMF") returned -1
	[0058.684] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00166_.WMF") returned="SO00166_.WMF"
	[0058.684] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.684] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.684] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.684] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.684] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00168_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00168_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00168_.WMF"
	[0058.684] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102ed99a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102ed99a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102ed99a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2242, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00170_.WMF", cAlternateFileName="")) returned 1
	[0058.684] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.685] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00170_.WMF") returned -1
	[0058.685] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00170_.WMF") returned -1
	[0058.685] lstrcmpiA (lpString1="", lpString2="SO00170_.WMF") returned -1
	[0058.685] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00168_.WMF") returned="SO00168_.WMF"
	[0058.685] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.685] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.685] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.685] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.685] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00170_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00170_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00170_.WMF"
	[0058.685] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102ed99a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102ed99a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102ed99a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8f0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00177_.WMF", cAlternateFileName="")) returned 1
	[0058.685] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.685] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00177_.WMF") returned -1
	[0058.685] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00177_.WMF") returned -1
	[0058.685] lstrcmpiA (lpString1="", lpString2="SO00177_.WMF") returned -1
	[0058.685] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00170_.WMF") returned="SO00170_.WMF"
	[0058.685] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.686] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.686] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.686] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.686] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00177_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00177_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00177_.WMF"
	[0058.686] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102ed99a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102ed99a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10313bcd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x283c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00183_.WMF", cAlternateFileName="")) returned 1
	[0058.686] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.686] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00183_.WMF") returned -1
	[0058.686] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00183_.WMF") returned -1
	[0058.686] lstrcmpiA (lpString1="", lpString2="SO00183_.WMF") returned -1
	[0058.686] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00177_.WMF") returned="SO00177_.WMF"
	[0058.686] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.686] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.686] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.686] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.686] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00183_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00183_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00183_.WMF"
	[0058.686] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102ed99a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102ed99a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10313bcd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x514c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00190_.WMF", cAlternateFileName="")) returned 1
	[0058.686] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.686] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00190_.WMF") returned -1
	[0058.686] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00190_.WMF") returned -1
	[0058.686] lstrcmpiA (lpString1="", lpString2="SO00190_.WMF") returned -1
	[0058.686] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00183_.WMF") returned="SO00183_.WMF"
	[0058.686] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.686] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.686] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.686] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.687] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00190_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00190_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00190_.WMF"
	[0058.687] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102ed99a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102ed99a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10313bcd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2090, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00191_.WMF", cAlternateFileName="")) returned 1
	[0058.687] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.687] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00191_.WMF") returned -1
	[0058.687] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00191_.WMF") returned -1
	[0058.687] lstrcmpiA (lpString1="", lpString2="SO00191_.WMF") returned -1
	[0058.687] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00190_.WMF") returned="SO00190_.WMF"
	[0058.687] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.687] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.687] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.687] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.687] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00191_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00191_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00191_.WMF"
	[0058.687] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10339e29, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10339e29, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10339e29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x280c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00192_.WMF", cAlternateFileName="")) returned 1
	[0058.687] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.687] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00192_.WMF") returned -1
	[0058.687] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00192_.WMF") returned -1
	[0058.687] lstrcmpiA (lpString1="", lpString2="SO00192_.WMF") returned -1
	[0058.687] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00191_.WMF") returned="SO00191_.WMF"
	[0058.687] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.687] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.687] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.687] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.687] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00192_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00192_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00192_.WMF"
	[0058.687] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10339e29, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10339e29, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10339e29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x27c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00194_.WMF", cAlternateFileName="")) returned 1
	[0058.687] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.687] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00194_.WMF") returned -1
	[0058.688] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00194_.WMF") returned -1
	[0058.688] lstrcmpiA (lpString1="", lpString2="SO00194_.WMF") returned -1
	[0058.688] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00192_.WMF") returned="SO00192_.WMF"
	[0058.688] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.688] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.688] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.688] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.688] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00194_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00194_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00194_.WMF"
	[0058.688] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10313bcd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10313bcd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10339e29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x238c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00197_.WMF", cAlternateFileName="")) returned 1
	[0058.688] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.688] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00197_.WMF") returned -1
	[0058.688] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00197_.WMF") returned -1
	[0058.688] lstrcmpiA (lpString1="", lpString2="SO00197_.WMF") returned -1
	[0058.688] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00194_.WMF") returned="SO00194_.WMF"
	[0058.688] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.688] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.688] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.688] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.688] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00197_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00197_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00197_.WMF"
	[0058.688] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10313bcd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10313bcd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10313bcd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x15fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00199_.WMF", cAlternateFileName="")) returned 1
	[0058.688] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.688] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00199_.WMF") returned -1
	[0058.688] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00199_.WMF") returned -1
	[0058.688] lstrcmpiA (lpString1="", lpString2="SO00199_.WMF") returned -1
	[0058.688] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00197_.WMF") returned="SO00197_.WMF"
	[0058.688] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.688] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.688] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.689] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.689] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00199_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00199_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00199_.WMF"
	[0058.689] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10313bcd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10313bcd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10313bcd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2926, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00200_.WMF", cAlternateFileName="")) returned 1
	[0058.690] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.690] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00200_.WMF") returned -1
	[0058.690] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00200_.WMF") returned -1
	[0058.690] lstrcmpiA (lpString1="", lpString2="SO00200_.WMF") returned -1
	[0058.690] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00199_.WMF") returned="SO00199_.WMF"
	[0058.690] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.690] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.690] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.690] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.690] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00200_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00200_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00200_.WMF"
	[0058.690] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10313bcd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10313bcd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10313bcd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00208_.WMF", cAlternateFileName="")) returned 1
	[0058.690] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.690] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00208_.WMF") returned -1
	[0058.690] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00208_.WMF") returned -1
	[0058.690] lstrcmpiA (lpString1="", lpString2="SO00208_.WMF") returned -1
	[0058.690] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00200_.WMF") returned="SO00200_.WMF"
	[0058.690] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.690] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.690] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.690] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.690] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00208_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00208_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00208_.WMF"
	[0058.690] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10386305, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10386305, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10386305, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f72, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00212_.WMF", cAlternateFileName="")) returned 1
	[0058.690] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.691] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00212_.WMF") returned -1
	[0058.691] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00212_.WMF") returned -1
	[0058.691] lstrcmpiA (lpString1="", lpString2="SO00212_.WMF") returned -1
	[0058.691] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00208_.WMF") returned="SO00208_.WMF"
	[0058.691] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.691] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.691] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.691] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.691] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00212_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00212_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00212_.WMF"
	[0058.691] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102ed99a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102ed99a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10313bcd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f74, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00221_.WMF", cAlternateFileName="")) returned 1
	[0058.691] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.691] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00221_.WMF") returned -1
	[0058.691] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00221_.WMF") returned -1
	[0058.691] lstrcmpiA (lpString1="", lpString2="SO00221_.WMF") returned -1
	[0058.691] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00212_.WMF") returned="SO00212_.WMF"
	[0058.691] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.691] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.691] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.691] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.691] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00221_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00221_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00221_.WMF"
	[0058.691] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10313bcd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10313bcd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10339e29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1e5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00222_.WMF", cAlternateFileName="")) returned 1
	[0058.691] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.691] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00222_.WMF") returned -1
	[0058.691] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00222_.WMF") returned -1
	[0058.691] lstrcmpiA (lpString1="", lpString2="SO00222_.WMF") returned -1
	[0058.691] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00221_.WMF") returned="SO00221_.WMF"
	[0058.691] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.691] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.692] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.692] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.692] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00222_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00222_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00222_.WMF"
	[0058.692] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10313bcd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10313bcd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10313bcd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3642, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00223_.WMF", cAlternateFileName="")) returned 1
	[0058.692] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.692] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00223_.WMF") returned -1
	[0058.692] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00223_.WMF") returned -1
	[0058.692] lstrcmpiA (lpString1="", lpString2="SO00223_.WMF") returned -1
	[0058.692] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00222_.WMF") returned="SO00222_.WMF"
	[0058.692] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.692] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.692] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.692] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.692] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00223_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00223_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00223_.WMF"
	[0058.692] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10339e29, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10339e29, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10339e29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x476e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00257_.WMF", cAlternateFileName="")) returned 1
	[0058.692] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.692] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00257_.WMF") returned -1
	[0058.692] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00257_.WMF") returned -1
	[0058.692] lstrcmpiA (lpString1="", lpString2="SO00257_.WMF") returned -1
	[0058.692] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00223_.WMF") returned="SO00223_.WMF"
	[0058.692] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.692] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.692] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.692] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.692] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00257_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00257_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00257_.WMF"
	[0058.693] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10339e29, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10339e29, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10339e29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd8e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00289_.WMF", cAlternateFileName="")) returned 1
	[0058.693] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.693] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00289_.WMF") returned -1
	[0058.693] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00289_.WMF") returned -1
	[0058.693] lstrcmpiA (lpString1="", lpString2="SO00289_.WMF") returned -1
	[0058.693] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00257_.WMF") returned="SO00257_.WMF"
	[0058.693] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.693] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.693] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.693] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.693] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00289_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00289_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00289_.WMF"
	[0058.693] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10339e29, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10339e29, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10339e29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10cb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00299_.WMF", cAlternateFileName="")) returned 1
	[0058.693] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.693] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00299_.WMF") returned -1
	[0058.693] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00299_.WMF") returned -1
	[0058.693] lstrcmpiA (lpString1="", lpString2="SO00299_.WMF") returned -1
	[0058.693] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00289_.WMF") returned="SO00289_.WMF"
	[0058.693] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.693] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.693] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.693] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.693] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00299_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00299_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00299_.WMF"
	[0058.693] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10339e29, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10339e29, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10339e29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7a04, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00305_.WMF", cAlternateFileName="")) returned 1
	[0058.693] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.693] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00305_.WMF") returned -1
	[0058.693] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00305_.WMF") returned -1
	[0058.693] lstrcmpiA (lpString1="", lpString2="SO00305_.WMF") returned -1
	[0058.693] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00299_.WMF") returned="SO00299_.WMF"
	[0058.694] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.694] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.694] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.694] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.694] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00305_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00305_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00305_.WMF"
	[0058.694] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10313bcd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10313bcd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10339e29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xee4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00333_.WMF", cAlternateFileName="")) returned 1
	[0058.694] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.694] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00333_.WMF") returned -1
	[0058.694] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00333_.WMF") returned -1
	[0058.694] lstrcmpiA (lpString1="", lpString2="SO00333_.WMF") returned -1
	[0058.694] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00305_.WMF") returned="SO00305_.WMF"
	[0058.694] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.694] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.694] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.694] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.694] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00333_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00333_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00333_.WMF"
	[0058.694] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10313bcd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10313bcd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10313bcd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8b96, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00345_.WMF", cAlternateFileName="")) returned 1
	[0058.694] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.694] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00345_.WMF") returned -1
	[0058.694] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00345_.WMF") returned -1
	[0058.694] lstrcmpiA (lpString1="", lpString2="SO00345_.WMF") returned -1
	[0058.694] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00333_.WMF") returned="SO00333_.WMF"
	[0058.694] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.694] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.694] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.695] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.695] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00345_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00345_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00345_.WMF"
	[0058.695] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10339e29, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10339e29, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10339e29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbbe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00350_.WMF", cAlternateFileName="")) returned 1
	[0058.695] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.695] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00350_.WMF") returned -1
	[0058.695] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00350_.WMF") returned -1
	[0058.695] lstrcmpiA (lpString1="", lpString2="SO00350_.WMF") returned -1
	[0058.695] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00345_.WMF") returned="SO00345_.WMF"
	[0058.695] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.695] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.695] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.695] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.695] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00350_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00350_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00350_.WMF"
	[0058.695] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10339e29, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10339e29, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10339e29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x934c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00352_.WMF", cAlternateFileName="")) returned 1
	[0058.695] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.695] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00352_.WMF") returned -1
	[0058.695] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00352_.WMF") returned -1
	[0058.695] lstrcmpiA (lpString1="", lpString2="SO00352_.WMF") returned -1
	[0058.695] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00350_.WMF") returned="SO00350_.WMF"
	[0058.695] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.695] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.695] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.695] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.695] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00352_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00352_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00352_.WMF"
	[0058.695] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10339e29, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10339e29, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10339e29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1948, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00364_.WMF", cAlternateFileName="")) returned 1
	[0058.696] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.696] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00364_.WMF") returned -1
	[0058.696] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00364_.WMF") returned -1
	[0058.696] lstrcmpiA (lpString1="", lpString2="SO00364_.WMF") returned -1
	[0058.696] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00352_.WMF") returned="SO00352_.WMF"
	[0058.696] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.696] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.696] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.696] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.696] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00364_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00364_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00364_.WMF"
	[0058.696] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10313bcd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10313bcd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10339e29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x51ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00367_.WMF", cAlternateFileName="")) returned 1
	[0058.696] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.696] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00367_.WMF") returned -1
	[0058.696] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00367_.WMF") returned -1
	[0058.696] lstrcmpiA (lpString1="", lpString2="SO00367_.WMF") returned -1
	[0058.696] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00364_.WMF") returned="SO00364_.WMF"
	[0058.696] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.696] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.696] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.696] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.696] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00367_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00367_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00367_.WMF"
	[0058.696] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10339e29, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10339e29, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10339e29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3308, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00373_.WMF", cAlternateFileName="")) returned 1
	[0058.696] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.696] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00373_.WMF") returned -1
	[0058.696] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00373_.WMF") returned -1
	[0058.696] lstrcmpiA (lpString1="", lpString2="SO00373_.WMF") returned -1
	[0058.696] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00367_.WMF") returned="SO00367_.WMF"
	[0058.696] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.697] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.697] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.697] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.697] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00373_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00373_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00373_.WMF"
	[0058.697] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10339e29, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10339e29, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10360091, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x27f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00382_.WMF", cAlternateFileName="")) returned 1
	[0058.697] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.697] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00382_.WMF") returned -1
	[0058.697] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00382_.WMF") returned -1
	[0058.697] lstrcmpiA (lpString1="", lpString2="SO00382_.WMF") returned -1
	[0058.697] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00373_.WMF") returned="SO00373_.WMF"
	[0058.697] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.697] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.697] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.697] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.697] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00382_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00382_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00382_.WMF"
	[0058.697] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10339e29, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10339e29, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10339e29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00390_.WMF", cAlternateFileName="")) returned 1
	[0058.697] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.697] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00390_.WMF") returned -1
	[0058.697] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00390_.WMF") returned -1
	[0058.697] lstrcmpiA (lpString1="", lpString2="SO00390_.WMF") returned -1
	[0058.697] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00382_.WMF") returned="SO00382_.WMF"
	[0058.697] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.697] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.697] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.697] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.697] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00390_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00390_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00390_.WMF"
	[0058.698] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10339e29, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10339e29, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10339e29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00391_.WMF", cAlternateFileName="")) returned 1
	[0058.698] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.698] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00391_.WMF") returned -1
	[0058.698] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00391_.WMF") returned -1
	[0058.698] lstrcmpiA (lpString1="", lpString2="SO00391_.WMF") returned -1
	[0058.698] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00390_.WMF") returned="SO00390_.WMF"
	[0058.698] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.698] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.698] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.698] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.698] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00391_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00391_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00391_.WMF"
	[0058.698] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10339e29, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10339e29, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10339e29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x704e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00416_.WMF", cAlternateFileName="")) returned 1
	[0058.698] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.698] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00416_.WMF") returned -1
	[0058.698] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00416_.WMF") returned -1
	[0058.698] lstrcmpiA (lpString1="", lpString2="SO00416_.WMF") returned -1
	[0058.698] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00391_.WMF") returned="SO00391_.WMF"
	[0058.698] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.698] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.698] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.698] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.698] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00416_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00416_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00416_.WMF"
	[0058.698] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10386305, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10386305, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10386305, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x143c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00423_.WMF", cAlternateFileName="")) returned 1
	[0058.698] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.698] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00423_.WMF") returned -1
	[0058.698] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00423_.WMF") returned -1
	[0058.699] lstrcmpiA (lpString1="", lpString2="SO00423_.WMF") returned -1
	[0058.699] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00416_.WMF") returned="SO00416_.WMF"
	[0058.699] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.699] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.699] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.699] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.699] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00423_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00423_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00423_.WMF"
	[0058.699] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10339e29, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10339e29, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10339e29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1544, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00444_.WMF", cAlternateFileName="")) returned 1
	[0058.699] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.699] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00444_.WMF") returned -1
	[0058.699] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00444_.WMF") returned -1
	[0058.699] lstrcmpiA (lpString1="", lpString2="SO00444_.WMF") returned -1
	[0058.699] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00423_.WMF") returned="SO00423_.WMF"
	[0058.699] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.699] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.699] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.699] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.699] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00444_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00444_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00444_.WMF"
	[0058.699] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10339e29, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10339e29, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10339e29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00452_.WMF", cAlternateFileName="")) returned 1
	[0058.699] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.699] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00452_.WMF") returned -1
	[0058.699] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00452_.WMF") returned -1
	[0058.699] lstrcmpiA (lpString1="", lpString2="SO00452_.WMF") returned -1
	[0058.699] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00444_.WMF") returned="SO00444_.WMF"
	[0058.699] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.699] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.699] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.699] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.700] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00452_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00452_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00452_.WMF"
	[0058.700] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10339e29, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10339e29, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10339e29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x59ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00453_.WMF", cAlternateFileName="")) returned 1
	[0058.700] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.700] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00453_.WMF") returned -1
	[0058.700] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00453_.WMF") returned -1
	[0058.700] lstrcmpiA (lpString1="", lpString2="SO00453_.WMF") returned -1
	[0058.700] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00452_.WMF") returned="SO00452_.WMF"
	[0058.700] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.700] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.700] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.700] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.700] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00453_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00453_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00453_.WMF"
	[0058.700] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10339e29, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10339e29, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10339e29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00454_.WMF", cAlternateFileName="")) returned 1
	[0058.700] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.925] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00454_.WMF") returned -1
	[0058.925] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00454_.WMF") returned -1
	[0058.925] lstrcmpiA (lpString1="", lpString2="SO00454_.WMF") returned -1
	[0058.925] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00453_.WMF") returned="SO00453_.WMF"
	[0058.925] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.925] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.925] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.925] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.925] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00454_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00454_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00454_.WMF"
	[0058.925] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103d2836, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103d2836, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103d2836, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00466_.WMF", cAlternateFileName="")) returned 1
	[0058.925] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.926] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00466_.WMF") returned -1
	[0058.926] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00466_.WMF") returned -1
	[0058.926] lstrcmpiA (lpString1="", lpString2="SO00466_.WMF") returned -1
	[0058.926] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00454_.WMF") returned="SO00454_.WMF"
	[0058.926] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.926] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.926] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.926] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.926] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00466_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00466_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00466_.WMF"
	[0058.926] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10386305, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10386305, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10386305, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xfc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00476_.WMF", cAlternateFileName="")) returned 1
	[0058.926] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.926] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00476_.WMF") returned -1
	[0058.926] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00476_.WMF") returned -1
	[0058.926] lstrcmpiA (lpString1="", lpString2="SO00476_.WMF") returned -1
	[0058.926] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00466_.WMF") returned="SO00466_.WMF"
	[0058.926] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.926] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.926] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.926] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.926] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00476_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00476_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00476_.WMF"
	[0058.926] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10360091, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10360091, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10360091, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5b08, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00479_.WMF", cAlternateFileName="")) returned 1
	[0058.926] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.926] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00479_.WMF") returned -1
	[0058.927] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00479_.WMF") returned -1
	[0058.927] lstrcmpiA (lpString1="", lpString2="SO00479_.WMF") returned -1
	[0058.927] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00476_.WMF") returned="SO00476_.WMF"
	[0058.927] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.927] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.927] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.927] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.927] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00479_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00479_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00479_.WMF"
	[0058.927] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10360091, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10360091, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10360091, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2bb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00483_.WMF", cAlternateFileName="")) returned 1
	[0058.927] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.927] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00483_.WMF") returned -1
	[0058.927] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00483_.WMF") returned -1
	[0058.927] lstrcmpiA (lpString1="", lpString2="SO00483_.WMF") returned -1
	[0058.927] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00479_.WMF") returned="SO00479_.WMF"
	[0058.927] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.927] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.927] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.927] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.927] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00483_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00483_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00483_.WMF"
	[0058.927] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10339e29, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10339e29, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10360091, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00486_.WMF", cAlternateFileName="")) returned 1
	[0058.927] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.927] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00486_.WMF") returned -1
	[0058.927] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00486_.WMF") returned -1
	[0058.927] lstrcmpiA (lpString1="", lpString2="SO00486_.WMF") returned -1
	[0058.927] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00483_.WMF") returned="SO00483_.WMF"
	[0058.927] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.927] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.928] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.928] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.928] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00486_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00486_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00486_.WMF"
	[0058.928] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10339e29, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10339e29, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10360091, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xaa4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00505_.WMF", cAlternateFileName="")) returned 1
	[0058.928] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.928] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00505_.WMF") returned -1
	[0058.928] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00505_.WMF") returned -1
	[0058.928] lstrcmpiA (lpString1="", lpString2="SO00505_.WMF") returned -1
	[0058.928] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00486_.WMF") returned="SO00486_.WMF"
	[0058.928] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.928] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.928] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.928] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.928] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00505_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00505_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00505_.WMF"
	[0058.928] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10339e29, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10339e29, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10360091, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1724, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00513_.WMF", cAlternateFileName="")) returned 1
	[0058.928] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.928] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00513_.WMF") returned -1
	[0058.928] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00513_.WMF") returned -1
	[0058.928] lstrcmpiA (lpString1="", lpString2="SO00513_.WMF") returned -1
	[0058.928] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00505_.WMF") returned="SO00505_.WMF"
	[0058.928] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.928] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.928] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.928] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.929] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00513_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00513_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00513_.WMF"
	[0058.929] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10339e29, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10339e29, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10339e29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2602, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00555_.WMF", cAlternateFileName="")) returned 1
	[0058.929] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.929] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00555_.WMF") returned -1
	[0058.929] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00555_.WMF") returned -1
	[0058.929] lstrcmpiA (lpString1="", lpString2="SO00555_.WMF") returned -1
	[0058.929] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00513_.WMF") returned="SO00513_.WMF"
	[0058.929] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.929] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.929] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.929] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.929] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00555_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00555_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00555_.WMF"
	[0058.929] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10360091, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10360091, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10360091, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6260, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00603_.WMF", cAlternateFileName="")) returned 1
	[0058.930] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.930] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00603_.WMF") returned -1
	[0058.930] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00603_.WMF") returned -1
	[0058.930] lstrcmpiA (lpString1="", lpString2="SO00603_.WMF") returned -1
	[0058.930] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00555_.WMF") returned="SO00555_.WMF"
	[0058.930] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.930] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.930] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.930] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.930] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00603_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00603_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00603_.WMF"
	[0058.930] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10339e29, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10339e29, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10339e29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9c80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00610_.WMF", cAlternateFileName="")) returned 1
	[0058.930] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.930] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00610_.WMF") returned -1
	[0058.930] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00610_.WMF") returned -1
	[0058.930] lstrcmpiA (lpString1="", lpString2="SO00610_.WMF") returned -1
	[0058.930] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00603_.WMF") returned="SO00603_.WMF"
	[0058.930] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.930] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.930] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.930] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.930] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00610_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00610_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00610_.WMF"
	[0058.931] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10360091, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10360091, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10360091, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xfe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00629_.WMF", cAlternateFileName="")) returned 1
	[0058.931] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.931] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00629_.WMF") returned -1
	[0058.931] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00629_.WMF") returned -1
	[0058.931] lstrcmpiA (lpString1="", lpString2="SO00629_.WMF") returned -1
	[0058.931] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00610_.WMF") returned="SO00610_.WMF"
	[0058.931] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.931] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.931] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.931] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.931] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00629_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00629_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00629_.WMF"
	[0058.931] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10360091, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10360091, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10360091, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5006, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00633_.WMF", cAlternateFileName="")) returned 1
	[0058.931] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.931] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00633_.WMF") returned -1
	[0058.931] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00633_.WMF") returned -1
	[0058.931] lstrcmpiA (lpString1="", lpString2="SO00633_.WMF") returned -1
	[0058.931] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00629_.WMF") returned="SO00629_.WMF"
	[0058.931] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.931] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.931] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.931] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.931] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00633_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00633_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00633_.WMF"
	[0058.931] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10360091, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10360091, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10360091, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1aba, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00638_.WMF", cAlternateFileName="")) returned 1
	[0058.931] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.931] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00638_.WMF") returned -1
	[0058.931] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00638_.WMF") returned -1
	[0058.931] lstrcmpiA (lpString1="", lpString2="SO00638_.WMF") returned -1
	[0058.932] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00633_.WMF") returned="SO00633_.WMF"
	[0058.932] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.932] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.932] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.932] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.932] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00638_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00638_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00638_.WMF"
	[0058.932] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10360091, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10360091, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10360091, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x584, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00656_.WMF", cAlternateFileName="")) returned 1
	[0058.932] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.932] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00656_.WMF") returned -1
	[0058.932] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00656_.WMF") returned -1
	[0058.932] lstrcmpiA (lpString1="", lpString2="SO00656_.WMF") returned -1
	[0058.932] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00638_.WMF") returned="SO00638_.WMF"
	[0058.932] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.932] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.932] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.932] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.932] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00656_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00656_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00656_.WMF"
	[0058.932] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10360091, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10360091, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10360091, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1652, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00668_.WMF", cAlternateFileName="")) returned 1
	[0058.932] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.932] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SO00668_.WMF") returned -1
	[0058.932] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SO00668_.WMF") returned -1
	[0058.932] lstrcmpiA (lpString1="", lpString2="SO00668_.WMF") returned -1
	[0058.932] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00656_.WMF") returned="SO00656_.WMF"
	[0058.932] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.932] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.932] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.932] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.933] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00668_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00668_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00668_.WMF"
	[0058.933] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10360091, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10360091, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10360091, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x16c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00670_.WMF", cAlternateFileName="")) returned 1
	[0058.933] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.933] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00668_.WMF") returned="SO00668_.WMF"
	[0058.933] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.933] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.933] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.933] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.933] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00670_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00670_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00670_.WMF"
	[0058.933] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10360091, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10360091, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10360091, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00671_.WMF", cAlternateFileName="")) returned 1
	[0058.933] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.933] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00670_.WMF") returned="SO00670_.WMF"
	[0058.933] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.933] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.933] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.933] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.933] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00671_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00671_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00671_.WMF"
	[0058.933] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10360091, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10360091, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10360091, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x62b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00683_.WMF", cAlternateFileName="")) returned 1
	[0058.933] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.934] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00671_.WMF") returned="SO00671_.WMF"
	[0058.934] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.934] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.934] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.934] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.934] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00683_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00683_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00683_.WMF"
	[0058.934] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10360091, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10360091, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10360091, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6302, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00694_.WMF", cAlternateFileName="")) returned 1
	[0058.934] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.934] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00683_.WMF") returned="SO00683_.WMF"
	[0058.934] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.934] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.934] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.934] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.934] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00694_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00694_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00694_.WMF"
	[0058.934] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10360091, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10360091, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10360091, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3636, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00704_.WMF", cAlternateFileName="")) returned 1
	[0058.934] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.934] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00694_.WMF") returned="SO00694_.WMF"
	[0058.934] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.934] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.934] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.934] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.934] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00704_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00704_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00704_.WMF"
	[0058.935] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10386305, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10386305, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10386305, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x16478, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00726_.WMF", cAlternateFileName="")) returned 1
	[0058.935] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.935] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00704_.WMF") returned="SO00704_.WMF"
	[0058.935] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.935] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.935] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.935] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.935] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00726_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00726_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00726_.WMF"
	[0058.935] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10386305, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10386305, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10386305, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00728_.WMF", cAlternateFileName="")) returned 1
	[0058.935] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.935] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00726_.WMF") returned="SO00726_.WMF"
	[0058.935] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.935] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.936] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.936] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.936] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00728_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00728_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00728_.WMF"
	[0058.936] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10386305, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10386305, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10386305, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00732_.WMF", cAlternateFileName="")) returned 1
	[0058.936] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.936] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00728_.WMF") returned="SO00728_.WMF"
	[0058.936] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.936] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.936] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.936] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.936] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00732_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00732_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00732_.WMF"
	[0058.936] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10386305, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10386305, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10386305, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x660, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00734_.WMF", cAlternateFileName="")) returned 1
	[0058.936] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.936] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00732_.WMF") returned="SO00732_.WMF"
	[0058.936] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.936] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.936] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.936] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.936] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00734_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00734_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00734_.WMF"
	[0058.936] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10386305, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10386305, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10386305, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00735_.WMF", cAlternateFileName="")) returned 1
	[0058.936] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.936] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00734_.WMF") returned="SO00734_.WMF"
	[0058.936] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.937] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.937] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.937] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.937] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00735_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00735_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00735_.WMF"
	[0058.937] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10386305, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10386305, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10386305, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x184c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00736_.WMF", cAlternateFileName="")) returned 1
	[0058.937] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.937] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00735_.WMF") returned="SO00735_.WMF"
	[0058.937] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.937] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.937] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.937] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.937] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00736_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00736_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00736_.WMF"
	[0058.937] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10386305, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10386305, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10386305, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x543a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00768_.WMF", cAlternateFileName="")) returned 1
	[0058.937] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.937] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00736_.WMF") returned="SO00736_.WMF"
	[0058.937] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.937] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.937] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.938] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.938] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00768_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00768_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00768_.WMF"
	[0058.938] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10386305, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10386305, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10386305, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x16ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00783_.WMF", cAlternateFileName="")) returned 1
	[0058.938] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.938] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00768_.WMF") returned="SO00768_.WMF"
	[0058.938] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.938] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.938] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.938] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.938] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00783_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00783_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00783_.WMF"
	[0058.938] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10360091, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10360091, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10360091, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x41c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00820_.WMF", cAlternateFileName="")) returned 1
	[0058.938] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.938] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00783_.WMF") returned="SO00783_.WMF"
	[0058.938] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.938] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.938] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.938] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.938] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00820_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00820_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00820_.WMF"
	[0058.939] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10360091, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10360091, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10360091, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x28ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00828_.WMF", cAlternateFileName="")) returned 1
	[0058.939] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.939] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00820_.WMF") returned="SO00820_.WMF"
	[0058.939] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.939] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.939] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.939] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.939] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00828_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00828_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00828_.WMF"
	[0058.939] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10386305, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10386305, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10386305, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x36da, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00834_.WMF", cAlternateFileName="")) returned 1
	[0058.939] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.939] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00828_.WMF") returned="SO00828_.WMF"
	[0058.939] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.939] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.939] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.939] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.939] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00834_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00834_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00834_.WMF"
	[0058.940] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10386305, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10386305, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10386305, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3fe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00837_.WMF", cAlternateFileName="")) returned 1
	[0058.940] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.940] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00834_.WMF") returned="SO00834_.WMF"
	[0058.940] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.940] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.940] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.940] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.940] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00837_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00837_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00837_.WMF"
	[0058.940] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103ac532, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103ac532, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103ac532, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1898, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00910_.WMF", cAlternateFileName="")) returned 1
	[0058.940] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.940] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00837_.WMF") returned="SO00837_.WMF"
	[0058.940] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.940] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.940] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.940] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.940] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00910_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00910_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00910_.WMF"
	[0058.940] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10386305, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10386305, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10386305, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x29f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00911_.WMF", cAlternateFileName="")) returned 1
	[0058.940] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.940] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00910_.WMF") returned="SO00910_.WMF"
	[0058.940] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.940] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.940] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.940] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.941] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00911_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00911_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00911_.WMF"
	[0058.941] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103f89f0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103f89f0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103f89f0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x28b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00913_.WMF", cAlternateFileName="")) returned 1
	[0058.941] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.941] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00911_.WMF") returned="SO00911_.WMF"
	[0058.941] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.941] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.941] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.941] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.941] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00913_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00913_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00913_.WMF"
	[0058.941] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10386305, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10386305, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10386305, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1b0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00914_.WMF", cAlternateFileName="")) returned 1
	[0058.941] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.941] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00913_.WMF") returned="SO00913_.WMF"
	[0058.941] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.941] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.941] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.941] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.941] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00914_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00914_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00914_.WMF"
	[0058.941] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10386305, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10386305, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103ac532, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1bf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00915_.WMF", cAlternateFileName="")) returned 1
	[0058.941] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.941] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00914_.WMF") returned="SO00914_.WMF"
	[0058.941] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.941] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.941] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.941] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.942] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00915_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00915_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00915_.WMF"
	[0058.942] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10386305, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10386305, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10386305, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1270, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00916_.WMF", cAlternateFileName="")) returned 1
	[0058.942] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.942] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00915_.WMF") returned="SO00915_.WMF"
	[0058.942] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.942] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.942] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.942] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.942] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00916_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00916_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00916_.WMF"
	[0058.942] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10386305, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10386305, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10386305, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x25ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00917_.WMF", cAlternateFileName="")) returned 1
	[0058.942] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.942] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00916_.WMF") returned="SO00916_.WMF"
	[0058.942] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.942] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.942] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.942] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.942] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00917_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00917_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00917_.WMF"
	[0058.942] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10386305, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10386305, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10386305, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00918_.WMF", cAlternateFileName="")) returned 1
	[0058.942] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.942] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00917_.WMF") returned="SO00917_.WMF"
	[0058.942] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.942] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.942] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.943] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.943] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00918_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00918_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00918_.WMF"
	[0058.943] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10386305, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10386305, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103ac532, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2944, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00935_.WMF", cAlternateFileName="")) returned 1
	[0058.943] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.943] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00918_.WMF") returned="SO00918_.WMF"
	[0058.943] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.943] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.943] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.943] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.943] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00935_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00935_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00935_.WMF"
	[0058.943] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103ac532, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103ac532, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103d2836, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1960, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00938_.WMF", cAlternateFileName="")) returned 1
	[0058.943] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.943] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00935_.WMF") returned="SO00935_.WMF"
	[0058.943] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.943] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.943] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.943] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.943] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="SO00938_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00938_.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00938_.WMF"
	[0058.943] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103ac532, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103ac532, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103ac532, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1708, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00941_.WMF", cAlternateFileName="")) returned 1
	[0058.944] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.944] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00938_.WMF") returned="SO00938_.WMF"
	[0058.944] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.944] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.944] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0058.944] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.945] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103ac532, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103ac532, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103ac532, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1264, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00942_.WMF", cAlternateFileName="")) returned 1
	[0058.945] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.945] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00941_.WMF") returned="SO00941_.WMF"
	[0058.945] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.945] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.945] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.945] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103ac532, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103ac532, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103ac532, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1d84, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00943_.WMF", cAlternateFileName="")) returned 1
	[0058.945] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.945] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00942_.WMF") returned="SO00942_.WMF"
	[0058.945] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.945] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.945] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.945] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103ac532, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103ac532, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103ac532, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xae1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01044_.WMF", cAlternateFileName="")) returned 1
	[0058.945] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.945] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00943_.WMF") returned="SO00943_.WMF"
	[0058.945] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.945] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.945] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.945] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103ac532, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103ac532, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103ac532, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5b38, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01063_.WMF", cAlternateFileName="")) returned 1
	[0058.945] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.946] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01044_.WMF") returned="SO01044_.WMF"
	[0058.946] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.946] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.946] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.946] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10386305, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10386305, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103ac532, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1075e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01236_.WMF", cAlternateFileName="")) returned 1
	[0058.946] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.946] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01063_.WMF") returned="SO01063_.WMF"
	[0058.946] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.946] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.946] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.946] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10386305, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10386305, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10386305, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x43b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01560_.WMF", cAlternateFileName="")) returned 1
	[0058.946] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.946] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01236_.WMF") returned="SO01236_.WMF"
	[0058.946] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.946] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.946] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.946] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103ac532, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103ac532, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103ac532, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x59d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01561_.WMF", cAlternateFileName="")) returned 1
	[0058.946] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.946] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01560_.WMF") returned="SO01560_.WMF"
	[0058.946] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.946] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.946] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.947] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103ac532, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103ac532, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103ac532, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x75ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01563_.WMF", cAlternateFileName="")) returned 1
	[0058.947] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.947] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01561_.WMF") returned="SO01561_.WMF"
	[0058.947] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.947] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.947] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.947] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103ac532, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103ac532, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103ac532, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x51a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01566_.WMF", cAlternateFileName="")) returned 1
	[0058.947] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.947] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01563_.WMF") returned="SO01563_.WMF"
	[0058.947] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.947] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.947] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.947] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103ac532, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103ac532, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103ac532, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x54b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01568_.WMF", cAlternateFileName="")) returned 1
	[0058.947] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.947] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01566_.WMF") returned="SO01566_.WMF"
	[0058.947] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.947] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.947] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.947] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103ac532, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103ac532, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103d2836, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01569_.WMF", cAlternateFileName="")) returned 1
	[0058.947] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.948] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01568_.WMF") returned="SO01568_.WMF"
	[0058.948] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.948] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.948] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.948] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103f89f0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103f89f0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103f89f0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa8a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01575_.WMF", cAlternateFileName="")) returned 1
	[0058.948] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.948] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01569_.WMF") returned="SO01569_.WMF"
	[0058.948] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.948] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.948] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.948] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103ac532, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103ac532, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103ac532, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2566, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01777_.WMF", cAlternateFileName="")) returned 1
	[0058.948] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.948] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01575_.WMF") returned="SO01575_.WMF"
	[0058.948] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.948] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.948] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.948] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103ac532, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103ac532, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103ac532, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6ca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01785_.WMF", cAlternateFileName="")) returned 1
	[0058.948] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.948] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01777_.WMF") returned="SO01777_.WMF"
	[0058.948] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.948] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.948] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.949] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103ac532, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103ac532, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103ac532, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1088, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01805_.WMF", cAlternateFileName="")) returned 1
	[0058.949] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.949] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01785_.WMF") returned="SO01785_.WMF"
	[0058.949] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.949] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.949] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.949] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103ac532, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103ac532, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103ac532, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01905_.WMF", cAlternateFileName="")) returned 1
	[0058.949] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.949] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01805_.WMF") returned="SO01805_.WMF"
	[0058.949] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.949] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.949] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.949] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103ac532, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103ac532, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103ac532, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3086, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01954_.WMF", cAlternateFileName="")) returned 1
	[0058.949] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.949] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01905_.WMF") returned="SO01905_.WMF"
	[0058.949] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.949] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.949] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.949] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103d2836, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103d2836, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103f89f0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1d14, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02009_.WMF", cAlternateFileName="")) returned 1
	[0058.949] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.949] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01954_.WMF") returned="SO01954_.WMF"
	[0058.950] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.950] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.950] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.950] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103d2836, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103d2836, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103d2836, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02022_.WMF", cAlternateFileName="")) returned 1
	[0058.950] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.950] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02009_.WMF") returned="SO02009_.WMF"
	[0058.950] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.950] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.950] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.950] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103d2836, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103d2836, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103d2836, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x23a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02024_.WMF", cAlternateFileName="")) returned 1
	[0058.950] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.950] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02022_.WMF") returned="SO02022_.WMF"
	[0058.950] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.950] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.950] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.951] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103d2836, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103d2836, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103d2836, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2016, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02025_.WMF", cAlternateFileName="")) returned 1
	[0058.951] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.951] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02024_.WMF") returned="SO02024_.WMF"
	[0058.951] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.951] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.952] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.952] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103ac532, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103ac532, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103d2836, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x24c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02028_.WMF", cAlternateFileName="")) returned 1
	[0058.952] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.952] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02025_.WMF") returned="SO02025_.WMF"
	[0058.952] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.952] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.952] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.952] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103ac532, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103ac532, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103d2836, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x266c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02045_.WMF", cAlternateFileName="")) returned 1
	[0058.952] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.952] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02028_.WMF") returned="SO02028_.WMF"
	[0058.952] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.952] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.952] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.952] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103ac532, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103ac532, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103d2836, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1fde, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02048_.WMF", cAlternateFileName="")) returned 1
	[0058.952] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.952] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02045_.WMF") returned="SO02045_.WMF"
	[0058.952] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.952] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.952] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.953] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103ac532, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103ac532, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103ac532, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2c2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02051_.WMF", cAlternateFileName="")) returned 1
	[0058.953] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.953] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02048_.WMF") returned="SO02048_.WMF"
	[0058.953] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.953] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.953] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.953] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103ac532, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103ac532, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103d2836, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x30ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02054_.WMF", cAlternateFileName="")) returned 1
	[0058.953] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.953] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02051_.WMF") returned="SO02051_.WMF"
	[0058.953] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.953] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.953] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.953] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103ac532, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103ac532, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103ac532, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4c4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02055_.WMF", cAlternateFileName="")) returned 1
	[0058.953] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.953] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02054_.WMF") returned="SO02054_.WMF"
	[0058.953] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.953] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.953] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.953] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103d2836, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103d2836, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103d2836, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x382a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02067_.WMF", cAlternateFileName="")) returned 1
	[0058.953] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.953] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02055_.WMF") returned="SO02055_.WMF"
	[0058.954] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.954] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.954] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.954] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103d2836, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103d2836, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103f89f0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1b4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02094_.WMF", cAlternateFileName="")) returned 1
	[0058.954] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.954] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02067_.WMF") returned="SO02067_.WMF"
	[0058.954] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.954] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.954] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.954] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103d2836, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103d2836, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103d2836, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x540, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02227_.WMF", cAlternateFileName="")) returned 1
	[0058.954] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.954] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02094_.WMF") returned="SO02094_.WMF"
	[0058.954] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.954] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.954] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.954] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103d2836, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103d2836, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103d2836, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x334, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02228_.WMF", cAlternateFileName="")) returned 1
	[0058.954] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.954] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02227_.WMF") returned="SO02227_.WMF"
	[0058.954] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.954] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.954] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.955] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103d2836, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103d2836, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103d2836, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x900, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02233_.WMF", cAlternateFileName="")) returned 1
	[0058.955] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.955] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02228_.WMF") returned="SO02228_.WMF"
	[0058.955] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.955] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.955] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.955] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103ac532, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103ac532, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103d2836, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe88, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02252_.WMF", cAlternateFileName="")) returned 1
	[0058.955] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.955] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02233_.WMF") returned="SO02233_.WMF"
	[0058.955] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.955] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.955] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.955] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103d2836, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103d2836, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103d2836, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02253_.WMF", cAlternateFileName="")) returned 1
	[0058.956] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.956] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02252_.WMF") returned="SO02252_.WMF"
	[0058.956] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.956] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.956] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.957] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103d2836, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103d2836, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103d2836, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x818, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02261_.WMF", cAlternateFileName="")) returned 1
	[0058.957] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.957] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02253_.WMF") returned="SO02253_.WMF"
	[0058.957] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.957] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.957] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.957] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103d2836, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103d2836, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103d2836, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa94, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02263_.WMF", cAlternateFileName="")) returned 1
	[0058.957] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.957] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02261_.WMF") returned="SO02261_.WMF"
	[0058.957] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.957] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.957] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.957] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103ac532, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103ac532, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103d2836, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x38c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02265_.WMF", cAlternateFileName="")) returned 1
	[0058.957] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.957] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02263_.WMF") returned="SO02263_.WMF"
	[0058.957] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.957] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.957] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.958] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10491364, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10491364, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02268_.WMF", cAlternateFileName="")) returned 1
	[0058.958] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.958] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02265_.WMF") returned="SO02265_.WMF"
	[0058.958] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.958] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.958] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.958] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103d2836, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103d2836, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103d2836, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xaf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02269_.WMF", cAlternateFileName="")) returned 1
	[0058.958] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.958] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02268_.WMF") returned="SO02268_.WMF"
	[0058.958] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.958] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.958] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.958] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1041ec4b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1041ec4b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1041ec4b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa68, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02270_.WMF", cAlternateFileName="")) returned 1
	[0058.958] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.958] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02269_.WMF") returned="SO02269_.WMF"
	[0058.958] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.958] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.958] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.958] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1041ec4b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1041ec4b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1041ec4b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02276_.WMF", cAlternateFileName="")) returned 1
	[0058.958] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.958] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02270_.WMF") returned="SO02270_.WMF"
	[0058.959] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.959] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.959] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.959] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103d2836, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103d2836, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103f89f0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17a1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02413_.WMF", cAlternateFileName="")) returned 1
	[0058.959] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.959] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02276_.WMF") returned="SO02276_.WMF"
	[0058.959] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.959] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.959] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.959] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103d2836, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103d2836, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103f89f0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x670, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02431_.WMF", cAlternateFileName="")) returned 1
	[0058.959] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.959] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02413_.WMF") returned="SO02413_.WMF"
	[0058.959] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.959] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.959] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.959] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103d2836, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103d2836, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103f89f0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02437_.WMF", cAlternateFileName="")) returned 1
	[0058.959] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.959] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02431_.WMF") returned="SO02431_.WMF"
	[0058.959] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.959] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.959] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.960] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103d2836, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103d2836, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103d2836, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02439_.WMF", cAlternateFileName="")) returned 1
	[0058.960] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.960] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02437_.WMF") returned="SO02437_.WMF"
	[0058.960] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.960] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.960] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.960] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103d2836, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103d2836, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103d2836, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1a54, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02464_.WMF", cAlternateFileName="")) returned 1
	[0058.960] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.960] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02439_.WMF") returned="SO02439_.WMF"
	[0058.960] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.960] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.960] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.960] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103d2836, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103d2836, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103f89f0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x574, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02465_.WMF", cAlternateFileName="")) returned 1
	[0058.960] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.960] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02464_.WMF") returned="SO02464_.WMF"
	[0058.960] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.960] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.960] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.960] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1041ec4b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1041ec4b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1041ec4b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x19ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02578_.WMF", cAlternateFileName="")) returned 1
	[0058.960] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.960] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02465_.WMF") returned="SO02465_.WMF"
	[0058.961] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.961] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.961] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.961] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103f89f0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103f89f0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103f89f0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5fec, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02617_.WMF", cAlternateFileName="")) returned 1
	[0058.961] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.961] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02578_.WMF") returned="SO02578_.WMF"
	[0058.961] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.961] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.961] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.961] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103f89f0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103f89f0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103f89f0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7f4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02790_.WMF", cAlternateFileName="")) returned 1
	[0058.961] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.961] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02617_.WMF") returned="SO02617_.WMF"
	[0058.961] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.961] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.961] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.961] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103f89f0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103f89f0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103f89f0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x430c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02791_.WMF", cAlternateFileName="")) returned 1
	[0058.961] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.961] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02790_.WMF") returned="SO02790_.WMF"
	[0058.961] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.961] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.961] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.962] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103f89f0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103f89f0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103f89f0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5b70, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02793_.WMF", cAlternateFileName="")) returned 1
	[0058.962] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.962] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02791_.WMF") returned="SO02791_.WMF"
	[0058.962] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.962] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.962] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.962] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103d2836, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103d2836, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103f89f0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4b7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02794_.WMF", cAlternateFileName="")) returned 1
	[0058.962] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.962] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02793_.WMF") returned="SO02793_.WMF"
	[0058.962] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.962] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.962] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.962] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103f89f0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103f89f0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103f89f0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1262e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02862_.WMF", cAlternateFileName="")) returned 1
	[0058.962] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.962] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02794_.WMF") returned="SO02794_.WMF"
	[0058.962] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.962] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.962] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.962] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103f89f0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103f89f0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103f89f0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x967a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02886_.WMF", cAlternateFileName="")) returned 1
	[0058.962] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0058.963] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02862_.WMF") returned="SO02862_.WMF"
	[0058.963] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0058.963] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0058.963] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0058.963] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103f89f0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103f89f0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103f89f0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x22f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02958_.WMF", cAlternateFileName="")) returned 1
	[0058.963] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.030] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02886_.WMF") returned="SO02886_.WMF"
	[0059.030] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.030] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.030] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.030] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103d2836, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103d2836, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103f89f0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x107b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPACE_01.MID", cAlternateFileName="")) returned 1
	[0059.030] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.030] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02958_.WMF") returned="SO02958_.WMF"
	[0059.030] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.030] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.030] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.030] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1046b0f3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1046b0f3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1046b0f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1a2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRNG_01.MID", cAlternateFileName="")) returned 1
	[0059.030] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.030] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned="SPACE_01.MID"
	[0059.030] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.030] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.031] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.031] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1041ec4b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1041ec4b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1041ec4b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUBBY1.WMF", cAlternateFileName="")) returned 1
	[0059.031] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.031] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned="SPRNG_01.MID"
	[0059.031] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.031] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.031] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.031] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1041ec4b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1041ec4b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1041ec4b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUBBY2.WMF", cAlternateFileName="")) returned 1
	[0059.031] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.031] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\STUBBY1.WMF") returned="STUBBY1.WMF"
	[0059.031] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.031] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.031] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.031] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1041ec4b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1041ec4b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1041ec4b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x36dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMER_01.MID", cAlternateFileName="")) returned 1
	[0059.031] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.031] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\STUBBY2.WMF") returned="STUBBY2.WMF"
	[0059.031] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.031] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.031] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.032] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1041ec4b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1041ec4b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1041ec4b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2135, dwReserved0=0x0, dwReserved1=0x0, cFileName="SWEST_01.MID", cAlternateFileName="")) returned 1
	[0059.032] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.032] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned="SUMER_01.MID"
	[0059.032] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.032] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.032] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.032] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1041ec4b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1041ec4b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1041ec4b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00110_.WMF", cAlternateFileName="")) returned 1
	[0059.032] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.032] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned="SWEST_01.MID"
	[0059.032] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.032] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.032] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.032] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1041ec4b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1041ec4b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1041ec4b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1844, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00127_.WMF", cAlternateFileName="")) returned 1
	[0059.032] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.032] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00110_.WMF") returned="SY00110_.WMF"
	[0059.032] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.032] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.032] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.032] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1041ec4b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1041ec4b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1041ec4b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x81c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00132_.WMF", cAlternateFileName="")) returned 1
	[0059.032] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.032] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00127_.WMF") returned="SY00127_.WMF"
	[0059.032] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.032] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.033] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.033] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1041ec4b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1041ec4b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1041ec4b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1412, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00170_.WMF", cAlternateFileName="")) returned 1
	[0059.033] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.033] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00132_.WMF") returned="SY00132_.WMF"
	[0059.033] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.033] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.033] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.033] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1041ec4b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1041ec4b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1041ec4b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x50c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00560_.WMF", cAlternateFileName="")) returned 1
	[0059.033] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.033] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00170_.WMF") returned="SY00170_.WMF"
	[0059.033] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.033] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.033] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.033] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10444f68, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10444f68, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10444f68, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x778, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00642_.WMF", cAlternateFileName="")) returned 1
	[0059.034] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.034] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00560_.WMF") returned="SY00560_.WMF"
	[0059.034] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.034] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.034] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.035] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10444f68, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10444f68, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10444f68, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2094, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00788_.WMF", cAlternateFileName="")) returned 1
	[0059.035] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.035] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00642_.WMF") returned="SY00642_.WMF"
	[0059.035] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.035] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.035] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.035] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10444f68, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10444f68, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10444f68, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2fdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00792_.WMF", cAlternateFileName="")) returned 1
	[0059.035] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.035] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00788_.WMF") returned="SY00788_.WMF"
	[0059.035] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.035] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.035] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.035] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10444f68, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10444f68, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10444f68, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2764, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00795_.WMF", cAlternateFileName="")) returned 1
	[0059.035] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.035] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00792_.WMF") returned="SY00792_.WMF"
	[0059.035] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.035] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.035] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.035] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x110a3267, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x110a3267, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x110ef705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00882_.WMF", cAlternateFileName="")) returned 1
	[0059.035] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.035] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00795_.WMF") returned="SY00795_.WMF"
	[0059.035] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.036] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.036] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.036] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10444f68, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10444f68, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10444f68, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY01006_.WMF", cAlternateFileName="")) returned 1
	[0059.036] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.036] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00882_.WMF") returned="SY00882_.WMF"
	[0059.036] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.036] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.036] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.036] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1041ec4b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1041ec4b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1041ec4b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2734, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY01252_.WMF", cAlternateFileName="")) returned 1
	[0059.036] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.036] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01006_.WMF") returned="SY01006_.WMF"
	[0059.036] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.036] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.036] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.036] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1113bba3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY01253_.WMF", cAlternateFileName="")) returned 1
	[0059.036] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.036] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01252_.WMF") returned="SY01252_.WMF"
	[0059.036] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.036] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.036] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.037] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x110c9494, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x110c9494, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x110ef705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY01462_.WMF", cAlternateFileName="")) returned 1
	[0059.037] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.037] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01253_.WMF") returned="SY01253_.WMF"
	[0059.037] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.037] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.037] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.037] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10444f68, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10444f68, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10444f68, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY01491_.WMF", cAlternateFileName="")) returned 1
	[0059.037] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.037] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01462_.WMF") returned="SY01462_.WMF"
	[0059.037] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.037] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.037] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.037] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10444f68, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10444f68, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1046b0f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY01563_.WMF", cAlternateFileName="")) returned 1
	[0059.037] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.037] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01491_.WMF") returned="SY01491_.WMF"
	[0059.037] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.037] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.037] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.037] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10444f68, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10444f68, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10444f68, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY01572_.WMF", cAlternateFileName="")) returned 1
	[0059.037] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.037] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01563_.WMF") returned="SY01563_.WMF"
	[0059.038] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.038] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.038] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.038] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10444f68, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10444f68, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10444f68, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x338e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY01590_.WMF", cAlternateFileName="")) returned 1
	[0059.038] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.038] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01572_.WMF") returned="SY01572_.WMF"
	[0059.038] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.038] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.038] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.038] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10444f68, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10444f68, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10444f68, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAIL.WMF", cAlternateFileName="")) returned 1
	[0059.038] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.038] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01590_.WMF") returned="SY01590_.WMF"
	[0059.038] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.038] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.038] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.038] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10444f68, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10444f68, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10444f68, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbde2, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00011_.WMF", cAlternateFileName="")) returned 1
	[0059.038] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.038] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TAIL.WMF") returned="TAIL.WMF"
	[0059.038] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.038] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.038] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.039] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10444f68, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10444f68, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10444f68, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1d5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00014_.WMF", cAlternateFileName="")) returned 1
	[0059.039] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.039] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00011_.WMF") returned="TN00011_.WMF"
	[0059.039] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.039] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.039] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.039] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10444f68, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10444f68, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10444f68, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x243c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00018_.WMF", cAlternateFileName="")) returned 1
	[0059.039] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.039] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00014_.WMF") returned="TN00014_.WMF"
	[0059.039] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.039] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.039] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.039] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10444f68, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10444f68, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10444f68, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x175a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00095_.WMF", cAlternateFileName="")) returned 1
	[0059.039] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.039] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00018_.WMF") returned="TN00018_.WMF"
	[0059.039] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.039] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.039] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.039] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10444f68, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10444f68, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10444f68, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00211_.WMF", cAlternateFileName="")) returned 1
	[0059.039] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.040] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00095_.WMF") returned="TN00095_.WMF"
	[0059.040] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.040] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.040] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.040] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10444f68, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10444f68, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1046b0f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1224, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00217_.WMF", cAlternateFileName="")) returned 1
	[0059.040] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.040] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00211_.WMF") returned="TN00211_.WMF"
	[0059.040] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.040] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.040] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.040] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10444f68, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10444f68, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10444f68, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1bc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00218_.WMF", cAlternateFileName="")) returned 1
	[0059.040] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.040] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00217_.WMF") returned="TN00217_.WMF"
	[0059.040] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.040] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.040] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.040] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10444f68, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10444f68, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10444f68, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00231_.WMF", cAlternateFileName="")) returned 1
	[0059.040] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.040] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00218_.WMF") returned="TN00218_.WMF"
	[0059.040] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.040] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.040] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.041] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10444f68, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10444f68, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1046b0f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc68, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00234_.WMF", cAlternateFileName="")) returned 1
	[0059.041] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.041] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00231_.WMF") returned="TN00231_.WMF"
	[0059.041] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.041] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.041] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.041] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10444f68, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10444f68, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1046b0f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00241_.WMF", cAlternateFileName="")) returned 1
	[0059.041] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.041] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00234_.WMF") returned="TN00234_.WMF"
	[0059.041] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.041] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.041] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.041] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10444f68, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10444f68, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10444f68, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf74, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00246_.WMF", cAlternateFileName="")) returned 1
	[0059.041] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.041] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00241_.WMF") returned="TN00241_.WMF"
	[0059.041] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.041] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.041] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.041] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10444f68, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10444f68, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10444f68, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x15bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00253_.WMF", cAlternateFileName="")) returned 1
	[0059.041] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.042] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00246_.WMF") returned="TN00246_.WMF"
	[0059.042] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.042] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.042] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.042] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10444f68, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10444f68, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10444f68, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00255_.WMF", cAlternateFileName="")) returned 1
	[0059.042] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.042] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00253_.WMF") returned="TN00253_.WMF"
	[0059.042] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.042] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.042] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.042] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10444f68, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10444f68, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10444f68, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00330_.WMF", cAlternateFileName="")) returned 1
	[0059.042] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.042] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00255_.WMF") returned="TN00255_.WMF"
	[0059.042] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.042] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.042] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.042] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1046b0f3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1046b0f3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1046b0f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf72, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00411_.WMF", cAlternateFileName="")) returned 1
	[0059.042] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.042] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00330_.WMF") returned="TN00330_.WMF"
	[0059.042] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.042] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.042] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.043] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10444f68, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10444f68, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10444f68, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00687_.WMF", cAlternateFileName="")) returned 1
	[0059.043] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.043] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00411_.WMF") returned="TN00411_.WMF"
	[0059.043] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.043] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.043] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.043] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1046b0f3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1046b0f3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1046b0f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN01164_.WMF", cAlternateFileName="")) returned 1
	[0059.043] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.043] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00687_.WMF") returned="TN00687_.WMF"
	[0059.043] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.043] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.043] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.043] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1046b0f3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1046b0f3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1046b0f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x66a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN01165_.WMF", cAlternateFileName="")) returned 1
	[0059.043] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.043] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN01164_.WMF") returned="TN01164_.WMF"
	[0059.043] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.043] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.043] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.043] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1046b0f3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1046b0f3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1046b0f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4e02, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN01308_.WMF", cAlternateFileName="")) returned 1
	[0059.043] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.044] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN01165_.WMF") returned="TN01165_.WMF"
	[0059.044] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.044] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.044] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.044] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1046b0f3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1046b0f3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1046b0f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x276a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00006_.WMF", cAlternateFileName="")) returned 1
	[0059.044] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.044] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN01308_.WMF") returned="TN01308_.WMF"
	[0059.044] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.044] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.044] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.044] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10444f68, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10444f68, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1046b0f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x228c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00095_.WMF", cAlternateFileName="")) returned 1
	[0059.045] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.045] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00006_.WMF") returned="TR00006_.WMF"
	[0059.045] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.045] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.045] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.045] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1046b0f3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1046b0f3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1046b0f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00097_.WMF", cAlternateFileName="")) returned 1
	[0059.045] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.045] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00095_.WMF") returned="TR00095_.WMF"
	[0059.045] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.045] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.045] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.045] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10444f68, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10444f68, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1046b0f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x25bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00116_.WMF", cAlternateFileName="")) returned 1
	[0059.045] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.045] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00097_.WMF") returned="TR00097_.WMF"
	[0059.045] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.045] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.046] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.046] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1046b0f3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1046b0f3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1046b0f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1234, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00126_.WMF", cAlternateFileName="")) returned 1
	[0059.046] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.046] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00116_.WMF") returned="TR00116_.WMF"
	[0059.046] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.046] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.046] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.046] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10444f68, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10444f68, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1046b0f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x235c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00172_.WMF", cAlternateFileName="")) returned 1
	[0059.046] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.046] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00126_.WMF") returned="TR00126_.WMF"
	[0059.046] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.046] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.046] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.046] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10444f68, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10444f68, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1046b0f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2142, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00178_.WMF", cAlternateFileName="")) returned 1
	[0059.046] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.046] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00172_.WMF") returned="TR00172_.WMF"
	[0059.046] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.046] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.046] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.047] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1046b0f3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1046b0f3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1046b0f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00232_.WMF", cAlternateFileName="")) returned 1
	[0059.047] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.047] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00178_.WMF") returned="TR00178_.WMF"
	[0059.047] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.047] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.047] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.047] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1046b0f3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1046b0f3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1046b0f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00233_.WMF", cAlternateFileName="")) returned 1
	[0059.047] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.047] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00232_.WMF") returned="TR00232_.WMF"
	[0059.047] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.047] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.047] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.047] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1046b0f3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1046b0f3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1046b0f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00402_.WMF", cAlternateFileName="")) returned 1
	[0059.047] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.047] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00233_.WMF") returned="TR00233_.WMF"
	[0059.047] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.047] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.047] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.047] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1046b0f3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1046b0f3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1046b0f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2054, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00482_.WMF", cAlternateFileName="")) returned 1
	[0059.047] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.047] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00402_.WMF") returned="TR00402_.WMF"
	[0059.048] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.048] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.048] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.048] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1046b0f3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1046b0f3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10491364, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00494_.WMF", cAlternateFileName="")) returned 1
	[0059.048] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.048] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00482_.WMF") returned="TR00482_.WMF"
	[0059.048] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.048] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.048] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.048] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1046b0f3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1046b0f3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1046b0f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x342e, dwReserved0=0x0, dwReserved1=0x0, cFileName="URBAN_01.MID", cAlternateFileName="")) returned 1
	[0059.048] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.048] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00494_.WMF") returned="TR00494_.WMF"
	[0059.048] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.048] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.048] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.048] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1046b0f3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1046b0f3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1046b0f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1361, dwReserved0=0x0, dwReserved1=0x0, cFileName="VCTRN_01.MID", cAlternateFileName="")) returned 1
	[0059.048] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.048] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned="URBAN_01.MID"
	[0059.048] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.048] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.048] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.049] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1046b0f3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1046b0f3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1046b0f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01219_.GIF", cAlternateFileName="")) returned 1
	[0059.049] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.049] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned="VCTRN_01.MID"
	[0059.049] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.049] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.049] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.049] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01219_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.050] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2e4
	[0059.050] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1046b0f3, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1046b0f3, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1046b0f3, dwHighDateTime=0x1d327e8)) returned 1
	[0059.050] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.050] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x2a2, lpOverlapped=0x0) returned 1
	[0059.051] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01219_.GIF") returned="WB01219_.GIF"
	[0059.051] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.051] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x2a2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x2a2, lpOverlapped=0x0) returned 1
	[0059.051] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.052] CloseHandle (hObject=0x214) returned 1
	[0059.052] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01219_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01219_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01219_.gif.exe")) returned 1
	[0059.052] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1046b0f3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1046b0f3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1046b0f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01237_.GIF", cAlternateFileName="")) returned 1
	[0059.052] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.052] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01237_.GIF") returned -1
	[0059.052] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01237_.GIF") returned -1
	[0059.052] lstrcmpiA (lpString1="", lpString2="WB01237_.GIF") returned -1
	[0059.052] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01219_.GIF") returned="WB01219_.GIF"
	[0059.052] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.052] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.052] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.052] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.052] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01237_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01237_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01237_.GIF"
	[0059.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01237_.GIF", pszSpec="*.zip") returned 0
	[0059.053] lstrlenA (lpString="*.zip") returned 5
	[0059.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01237_.GIF", pszSpec="*.rar") returned 0
	[0059.053] lstrlenA (lpString="*.rar") returned 5
	[0059.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01237_.GIF", pszSpec="*.7z") returned 0
	[0059.053] lstrlenA (lpString="*.7z") returned 4
	[0059.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01237_.GIF", pszSpec="*.tar") returned 0
	[0059.053] lstrlenA (lpString="*.tar") returned 5
	[0059.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01237_.GIF", pszSpec="*.gzip") returned 0
	[0059.053] lstrlenA (lpString="*.gzip") returned 6
	[0059.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01237_.GIF", pszSpec="*.jpg") returned 0
	[0059.053] lstrlenA (lpString="*.jpg") returned 5
	[0059.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01237_.GIF", pszSpec="*.jpeg") returned 0
	[0059.053] lstrlenA (lpString="*.jpeg") returned 6
	[0059.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01237_.GIF", pszSpec="*.bmp") returned 0
	[0059.053] lstrlenA (lpString="*.bmp") returned 5
	[0059.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01237_.GIF", pszSpec="*.gif") returned 1
	[0059.053] lstrlenA (lpString="*.gif") returned 5
	[0059.053] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01237_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01237_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01237_.GIF"
	[0059.053] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01237_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01237_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01237_.GIF"
	[0059.053] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01237_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01237_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01237_.GIF."
	[0059.053] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01237_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01237_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01237_.GIF.exe"
	[0059.053] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01237_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.054] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16b
	[0059.054] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1046b0f3, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1046b0f3, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1046b0f3, dwHighDateTime=0x1d327e8)) returned 1
	[0059.054] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.054] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x129, lpOverlapped=0x0) returned 1
	[0059.055] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01237_.GIF") returned="WB01237_.GIF"
	[0059.055] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.055] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x129, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x129, lpOverlapped=0x0) returned 1
	[0059.055] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.055] CloseHandle (hObject=0x214) returned 1
	[0059.055] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01237_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01237_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01237_.gif.exe")) returned 1
	[0059.057] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1046b0f3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1046b0f3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1046b0f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x167, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01238_.GIF", cAlternateFileName="")) returned 1
	[0059.057] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.057] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01238_.GIF") returned -1
	[0059.057] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01238_.GIF") returned -1
	[0059.057] lstrcmpiA (lpString1="", lpString2="WB01238_.GIF") returned -1
	[0059.057] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01237_.GIF") returned="WB01237_.GIF"
	[0059.057] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.057] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.057] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01238_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01238_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01238_.GIF"
	[0059.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01238_.GIF", pszSpec="*.zip") returned 0
	[0059.057] lstrlenA (lpString="*.zip") returned 5
	[0059.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01238_.GIF", pszSpec="*.rar") returned 0
	[0059.057] lstrlenA (lpString="*.rar") returned 5
	[0059.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01238_.GIF", pszSpec="*.7z") returned 0
	[0059.057] lstrlenA (lpString="*.7z") returned 4
	[0059.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01238_.GIF", pszSpec="*.tar") returned 0
	[0059.057] lstrlenA (lpString="*.tar") returned 5
	[0059.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01238_.GIF", pszSpec="*.gzip") returned 0
	[0059.057] lstrlenA (lpString="*.gzip") returned 6
	[0059.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01238_.GIF", pszSpec="*.jpg") returned 0
	[0059.057] lstrlenA (lpString="*.jpg") returned 5
	[0059.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01238_.GIF", pszSpec="*.jpeg") returned 0
	[0059.057] lstrlenA (lpString="*.jpeg") returned 6
	[0059.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01238_.GIF", pszSpec="*.bmp") returned 0
	[0059.057] lstrlenA (lpString="*.bmp") returned 5
	[0059.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01238_.GIF", pszSpec="*.gif") returned 1
	[0059.057] lstrlenA (lpString="*.gif") returned 5
	[0059.057] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01238_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01238_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01238_.GIF"
	[0059.057] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01238_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01238_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01238_.GIF"
	[0059.058] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01238_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01238_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01238_.GIF."
	[0059.058] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01238_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01238_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01238_.GIF.exe"
	[0059.058] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01238_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.058] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x167
	[0059.058] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1046b0f3, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1046b0f3, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1046b0f3, dwHighDateTime=0x1d327e8)) returned 1
	[0059.058] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.058] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x125, lpOverlapped=0x0) returned 1
	[0059.059] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01238_.GIF") returned="WB01238_.GIF"
	[0059.059] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.059] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x125, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x125, lpOverlapped=0x0) returned 1
	[0059.059] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.059] CloseHandle (hObject=0x214) returned 1
	[0059.059] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01238_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01238_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01238_.gif.exe")) returned 1
	[0059.060] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10491364, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10491364, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10491364, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01239_.GIF", cAlternateFileName="")) returned 1
	[0059.060] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.060] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01239_.GIF") returned -1
	[0059.060] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01239_.GIF") returned -1
	[0059.060] lstrcmpiA (lpString1="", lpString2="WB01239_.GIF") returned -1
	[0059.060] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01238_.GIF") returned="WB01238_.GIF"
	[0059.060] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.060] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.060] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.060] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.060] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01239_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01239_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01239_.GIF"
	[0059.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01239_.GIF", pszSpec="*.zip") returned 0
	[0059.060] lstrlenA (lpString="*.zip") returned 5
	[0059.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01239_.GIF", pszSpec="*.rar") returned 0
	[0059.060] lstrlenA (lpString="*.rar") returned 5
	[0059.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01239_.GIF", pszSpec="*.7z") returned 0
	[0059.060] lstrlenA (lpString="*.7z") returned 4
	[0059.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01239_.GIF", pszSpec="*.tar") returned 0
	[0059.060] lstrlenA (lpString="*.tar") returned 5
	[0059.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01239_.GIF", pszSpec="*.gzip") returned 0
	[0059.060] lstrlenA (lpString="*.gzip") returned 6
	[0059.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01239_.GIF", pszSpec="*.jpg") returned 0
	[0059.060] lstrlenA (lpString="*.jpg") returned 5
	[0059.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01239_.GIF", pszSpec="*.jpeg") returned 0
	[0059.060] lstrlenA (lpString="*.jpeg") returned 6
	[0059.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01239_.GIF", pszSpec="*.bmp") returned 0
	[0059.061] lstrlenA (lpString="*.bmp") returned 5
	[0059.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01239_.GIF", pszSpec="*.gif") returned 1
	[0059.061] lstrlenA (lpString="*.gif") returned 5
	[0059.061] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01239_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01239_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01239_.GIF"
	[0059.061] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01239_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01239_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01239_.GIF"
	[0059.061] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01239_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01239_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01239_.GIF."
	[0059.061] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01239_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01239_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01239_.GIF.exe"
	[0059.061] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01239_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.061] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19a
	[0059.061] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8)) returned 1
	[0059.061] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.062] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x158, lpOverlapped=0x0) returned 1
	[0059.062] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01239_.GIF") returned="WB01239_.GIF"
	[0059.063] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.063] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x158, lpOverlapped=0x0) returned 1
	[0059.063] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.063] CloseHandle (hObject=0x214) returned 1
	[0059.063] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01239_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01239_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01239_.gif.exe")) returned 1
	[0059.063] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10c77030, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01240_.GIF", cAlternateFileName="")) returned 1
	[0059.063] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.063] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01240_.GIF") returned -1
	[0059.063] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01240_.GIF") returned -1
	[0059.063] lstrcmpiA (lpString1="", lpString2="WB01240_.GIF") returned -1
	[0059.063] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01239_.GIF") returned="WB01239_.GIF"
	[0059.064] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.064] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.064] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.064] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.064] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01240_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01240_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01240_.GIF"
	[0059.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01240_.GIF", pszSpec="*.zip") returned 0
	[0059.064] lstrlenA (lpString="*.zip") returned 5
	[0059.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01240_.GIF", pszSpec="*.rar") returned 0
	[0059.064] lstrlenA (lpString="*.rar") returned 5
	[0059.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01240_.GIF", pszSpec="*.7z") returned 0
	[0059.064] lstrlenA (lpString="*.7z") returned 4
	[0059.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01240_.GIF", pszSpec="*.tar") returned 0
	[0059.064] lstrlenA (lpString="*.tar") returned 5
	[0059.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01240_.GIF", pszSpec="*.gzip") returned 0
	[0059.064] lstrlenA (lpString="*.gzip") returned 6
	[0059.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01240_.GIF", pszSpec="*.jpg") returned 0
	[0059.064] lstrlenA (lpString="*.jpg") returned 5
	[0059.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01240_.GIF", pszSpec="*.jpeg") returned 0
	[0059.064] lstrlenA (lpString="*.jpeg") returned 6
	[0059.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01240_.GIF", pszSpec="*.bmp") returned 0
	[0059.064] lstrlenA (lpString="*.bmp") returned 5
	[0059.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01240_.GIF", pszSpec="*.gif") returned 1
	[0059.064] lstrlenA (lpString="*.gif") returned 5
	[0059.064] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01240_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01240_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01240_.GIF"
	[0059.064] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01240_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01240_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01240_.GIF"
	[0059.064] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01240_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01240_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01240_.GIF."
	[0059.064] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01240_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01240_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01240_.GIF.exe"
	[0059.064] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01240_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.149] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14d
	[0059.150] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x104b75c6, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x104b75c6, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x10c77030, dwHighDateTime=0x1d327e8)) returned 1
	[0059.150] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.150] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x10b, lpOverlapped=0x0) returned 1
	[0059.151] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01240_.GIF") returned="WB01240_.GIF"
	[0059.151] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.151] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x10b, lpOverlapped=0x0) returned 1
	[0059.151] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.151] CloseHandle (hObject=0x214) returned 1
	[0059.151] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01240_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01240_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01240_.gif.exe")) returned 1
	[0059.152] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1046b0f3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1046b0f3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10491364, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01241_.GIF", cAlternateFileName="")) returned 1
	[0059.152] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.152] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01241_.GIF") returned -1
	[0059.152] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01241_.GIF") returned -1
	[0059.152] lstrcmpiA (lpString1="", lpString2="WB01241_.GIF") returned -1
	[0059.152] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01240_.GIF") returned="WB01240_.GIF"
	[0059.152] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.152] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.152] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.152] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.152] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01241_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01241_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01241_.GIF"
	[0059.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01241_.GIF", pszSpec="*.zip") returned 0
	[0059.152] lstrlenA (lpString="*.zip") returned 5
	[0059.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01241_.GIF", pszSpec="*.rar") returned 0
	[0059.152] lstrlenA (lpString="*.rar") returned 5
	[0059.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01241_.GIF", pszSpec="*.7z") returned 0
	[0059.152] lstrlenA (lpString="*.7z") returned 4
	[0059.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01241_.GIF", pszSpec="*.tar") returned 0
	[0059.152] lstrlenA (lpString="*.tar") returned 5
	[0059.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01241_.GIF", pszSpec="*.gzip") returned 0
	[0059.152] lstrlenA (lpString="*.gzip") returned 6
	[0059.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01241_.GIF", pszSpec="*.jpg") returned 0
	[0059.152] lstrlenA (lpString="*.jpg") returned 5
	[0059.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01241_.GIF", pszSpec="*.jpeg") returned 0
	[0059.153] lstrlenA (lpString="*.jpeg") returned 6
	[0059.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01241_.GIF", pszSpec="*.bmp") returned 0
	[0059.153] lstrlenA (lpString="*.bmp") returned 5
	[0059.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01241_.GIF", pszSpec="*.gif") returned 1
	[0059.153] lstrlenA (lpString="*.gif") returned 5
	[0059.153] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01241_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01241_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01241_.GIF"
	[0059.153] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01241_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01241_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01241_.GIF"
	[0059.153] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01241_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01241_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01241_.GIF."
	[0059.153] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01241_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01241_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01241_.GIF.exe"
	[0059.153] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01241_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.154] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x182
	[0059.155] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1046b0f3, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1046b0f3, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8)) returned 1
	[0059.155] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.155] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x140, lpOverlapped=0x0) returned 1
	[0059.156] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01241_.GIF") returned="WB01241_.GIF"
	[0059.156] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.156] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x140, lpOverlapped=0x0) returned 1
	[0059.156] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.156] CloseHandle (hObject=0x214) returned 1
	[0059.156] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01241_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01241_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01241_.gif.exe")) returned 1
	[0059.156] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1046b0f3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1046b0f3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10491364, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01242_.GIF", cAlternateFileName="")) returned 1
	[0059.156] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.156] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01242_.GIF") returned -1
	[0059.157] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01242_.GIF") returned -1
	[0059.157] lstrcmpiA (lpString1="", lpString2="WB01242_.GIF") returned -1
	[0059.157] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01241_.GIF") returned="WB01241_.GIF"
	[0059.157] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.157] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.157] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.157] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.157] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01242_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01242_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01242_.GIF"
	[0059.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01242_.GIF", pszSpec="*.zip") returned 0
	[0059.157] lstrlenA (lpString="*.zip") returned 5
	[0059.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01242_.GIF", pszSpec="*.rar") returned 0
	[0059.157] lstrlenA (lpString="*.rar") returned 5
	[0059.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01242_.GIF", pszSpec="*.7z") returned 0
	[0059.157] lstrlenA (lpString="*.7z") returned 4
	[0059.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01242_.GIF", pszSpec="*.tar") returned 0
	[0059.157] lstrlenA (lpString="*.tar") returned 5
	[0059.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01242_.GIF", pszSpec="*.gzip") returned 0
	[0059.157] lstrlenA (lpString="*.gzip") returned 6
	[0059.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01242_.GIF", pszSpec="*.jpg") returned 0
	[0059.157] lstrlenA (lpString="*.jpg") returned 5
	[0059.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01242_.GIF", pszSpec="*.jpeg") returned 0
	[0059.157] lstrlenA (lpString="*.jpeg") returned 6
	[0059.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01242_.GIF", pszSpec="*.bmp") returned 0
	[0059.157] lstrlenA (lpString="*.bmp") returned 5
	[0059.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01242_.GIF", pszSpec="*.gif") returned 1
	[0059.157] lstrlenA (lpString="*.gif") returned 5
	[0059.157] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01242_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01242_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01242_.GIF"
	[0059.157] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01242_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01242_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01242_.GIF"
	[0059.157] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01242_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01242_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01242_.GIF."
	[0059.157] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01242_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01242_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01242_.GIF.exe"
	[0059.157] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01242_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.158] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x158
	[0059.158] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1046b0f3, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1046b0f3, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8)) returned 1
	[0059.158] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.158] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x116, lpOverlapped=0x0) returned 1
	[0059.159] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01242_.GIF") returned="WB01242_.GIF"
	[0059.159] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.159] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x116, lpOverlapped=0x0) returned 1
	[0059.159] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.159] CloseHandle (hObject=0x214) returned 1
	[0059.160] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01242_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01242_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01242_.gif.exe")) returned 1
	[0059.160] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1046b0f3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1046b0f3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1046b0f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1af, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01243_.GIF", cAlternateFileName="")) returned 1
	[0059.160] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.160] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01243_.GIF") returned -1
	[0059.160] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01243_.GIF") returned -1
	[0059.160] lstrcmpiA (lpString1="", lpString2="WB01243_.GIF") returned -1
	[0059.160] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01242_.GIF") returned="WB01242_.GIF"
	[0059.160] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.160] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.160] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.160] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.160] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01243_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01243_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01243_.GIF"
	[0059.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01243_.GIF", pszSpec="*.zip") returned 0
	[0059.160] lstrlenA (lpString="*.zip") returned 5
	[0059.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01243_.GIF", pszSpec="*.rar") returned 0
	[0059.161] lstrlenA (lpString="*.rar") returned 5
	[0059.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01243_.GIF", pszSpec="*.7z") returned 0
	[0059.161] lstrlenA (lpString="*.7z") returned 4
	[0059.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01243_.GIF", pszSpec="*.tar") returned 0
	[0059.161] lstrlenA (lpString="*.tar") returned 5
	[0059.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01243_.GIF", pszSpec="*.gzip") returned 0
	[0059.161] lstrlenA (lpString="*.gzip") returned 6
	[0059.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01243_.GIF", pszSpec="*.jpg") returned 0
	[0059.161] lstrlenA (lpString="*.jpg") returned 5
	[0059.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01243_.GIF", pszSpec="*.jpeg") returned 0
	[0059.161] lstrlenA (lpString="*.jpeg") returned 6
	[0059.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01243_.GIF", pszSpec="*.bmp") returned 0
	[0059.161] lstrlenA (lpString="*.bmp") returned 5
	[0059.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01243_.GIF", pszSpec="*.gif") returned 1
	[0059.161] lstrlenA (lpString="*.gif") returned 5
	[0059.161] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01243_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01243_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01243_.GIF"
	[0059.161] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01243_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01243_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01243_.GIF"
	[0059.161] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01243_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01243_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01243_.GIF."
	[0059.161] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01243_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01243_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01243_.GIF.exe"
	[0059.161] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01243_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.161] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1af
	[0059.161] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1046b0f3, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1046b0f3, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1046b0f3, dwHighDateTime=0x1d327e8)) returned 1
	[0059.161] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.161] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x16d, lpOverlapped=0x0) returned 1
	[0059.162] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01243_.GIF") returned="WB01243_.GIF"
	[0059.162] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.162] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x16d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x16d, lpOverlapped=0x0) returned 1
	[0059.163] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.163] CloseHandle (hObject=0x214) returned 1
	[0059.163] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01243_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01243_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01243_.gif.exe")) returned 1
	[0059.163] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1046b0f3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1046b0f3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1046b0f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01244_.GIF", cAlternateFileName="")) returned 1
	[0059.163] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.163] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01244_.GIF") returned -1
	[0059.163] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01244_.GIF") returned -1
	[0059.163] lstrcmpiA (lpString1="", lpString2="WB01244_.GIF") returned -1
	[0059.163] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01243_.GIF") returned="WB01243_.GIF"
	[0059.163] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.163] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.163] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.163] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.164] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01244_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01244_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01244_.GIF"
	[0059.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01244_.GIF", pszSpec="*.zip") returned 0
	[0059.164] lstrlenA (lpString="*.zip") returned 5
	[0059.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01244_.GIF", pszSpec="*.rar") returned 0
	[0059.164] lstrlenA (lpString="*.rar") returned 5
	[0059.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01244_.GIF", pszSpec="*.7z") returned 0
	[0059.164] lstrlenA (lpString="*.7z") returned 4
	[0059.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01244_.GIF", pszSpec="*.tar") returned 0
	[0059.164] lstrlenA (lpString="*.tar") returned 5
	[0059.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01244_.GIF", pszSpec="*.gzip") returned 0
	[0059.164] lstrlenA (lpString="*.gzip") returned 6
	[0059.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01244_.GIF", pszSpec="*.jpg") returned 0
	[0059.164] lstrlenA (lpString="*.jpg") returned 5
	[0059.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01244_.GIF", pszSpec="*.jpeg") returned 0
	[0059.164] lstrlenA (lpString="*.jpeg") returned 6
	[0059.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01244_.GIF", pszSpec="*.bmp") returned 0
	[0059.164] lstrlenA (lpString="*.bmp") returned 5
	[0059.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01244_.GIF", pszSpec="*.gif") returned 1
	[0059.164] lstrlenA (lpString="*.gif") returned 5
	[0059.164] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01244_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01244_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01244_.GIF"
	[0059.164] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01244_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01244_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01244_.GIF"
	[0059.164] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01244_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01244_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01244_.GIF."
	[0059.164] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01244_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01244_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01244_.GIF.exe"
	[0059.164] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01244_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.164] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d3
	[0059.164] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1046b0f3, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1046b0f3, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1046b0f3, dwHighDateTime=0x1d327e8)) returned 1
	[0059.165] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.165] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x191, lpOverlapped=0x0) returned 1
	[0059.166] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01244_.GIF") returned="WB01244_.GIF"
	[0059.166] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.166] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x191, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x191, lpOverlapped=0x0) returned 1
	[0059.166] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.166] CloseHandle (hObject=0x214) returned 1
	[0059.166] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01244_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01244_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01244_.gif.exe")) returned 1
	[0059.167] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10491364, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10491364, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10491364, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01245_.GIF", cAlternateFileName="")) returned 1
	[0059.167] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.167] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01245_.GIF") returned -1
	[0059.167] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01245_.GIF") returned -1
	[0059.167] lstrcmpiA (lpString1="", lpString2="WB01245_.GIF") returned -1
	[0059.167] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01244_.GIF") returned="WB01244_.GIF"
	[0059.167] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.167] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.167] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.167] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.167] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01245_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01245_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01245_.GIF"
	[0059.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01245_.GIF", pszSpec="*.zip") returned 0
	[0059.167] lstrlenA (lpString="*.zip") returned 5
	[0059.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01245_.GIF", pszSpec="*.rar") returned 0
	[0059.167] lstrlenA (lpString="*.rar") returned 5
	[0059.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01245_.GIF", pszSpec="*.7z") returned 0
	[0059.168] lstrlenA (lpString="*.7z") returned 4
	[0059.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01245_.GIF", pszSpec="*.tar") returned 0
	[0059.168] lstrlenA (lpString="*.tar") returned 5
	[0059.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01245_.GIF", pszSpec="*.gzip") returned 0
	[0059.168] lstrlenA (lpString="*.gzip") returned 6
	[0059.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01245_.GIF", pszSpec="*.jpg") returned 0
	[0059.168] lstrlenA (lpString="*.jpg") returned 5
	[0059.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01245_.GIF", pszSpec="*.jpeg") returned 0
	[0059.168] lstrlenA (lpString="*.jpeg") returned 6
	[0059.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01245_.GIF", pszSpec="*.bmp") returned 0
	[0059.168] lstrlenA (lpString="*.bmp") returned 5
	[0059.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01245_.GIF", pszSpec="*.gif") returned 1
	[0059.168] lstrlenA (lpString="*.gif") returned 5
	[0059.168] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01245_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01245_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01245_.GIF"
	[0059.168] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01245_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01245_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01245_.GIF"
	[0059.168] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01245_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01245_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01245_.GIF."
	[0059.168] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01245_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01245_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01245_.GIF.exe"
	[0059.168] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01245_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.169] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155
	[0059.169] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8)) returned 1
	[0059.169] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.169] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x113, lpOverlapped=0x0) returned 1
	[0059.170] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01245_.GIF") returned="WB01245_.GIF"
	[0059.170] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.170] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x113, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x113, lpOverlapped=0x0) returned 1
	[0059.170] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.171] CloseHandle (hObject=0x214) returned 1
	[0059.171] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01245_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01245_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01245_.gif.exe")) returned 1
	[0059.171] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1046b0f3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1046b0f3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1046b0f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01246_.GIF", cAlternateFileName="")) returned 1
	[0059.171] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.171] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01246_.GIF") returned -1
	[0059.171] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01246_.GIF") returned -1
	[0059.171] lstrcmpiA (lpString1="", lpString2="WB01246_.GIF") returned -1
	[0059.171] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01245_.GIF") returned="WB01245_.GIF"
	[0059.171] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.171] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.171] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.171] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.172] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01246_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01246_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01246_.GIF"
	[0059.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01246_.GIF", pszSpec="*.zip") returned 0
	[0059.172] lstrlenA (lpString="*.zip") returned 5
	[0059.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01246_.GIF", pszSpec="*.rar") returned 0
	[0059.172] lstrlenA (lpString="*.rar") returned 5
	[0059.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01246_.GIF", pszSpec="*.7z") returned 0
	[0059.172] lstrlenA (lpString="*.7z") returned 4
	[0059.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01246_.GIF", pszSpec="*.tar") returned 0
	[0059.172] lstrlenA (lpString="*.tar") returned 5
	[0059.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01246_.GIF", pszSpec="*.gzip") returned 0
	[0059.172] lstrlenA (lpString="*.gzip") returned 6
	[0059.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01246_.GIF", pszSpec="*.jpg") returned 0
	[0059.172] lstrlenA (lpString="*.jpg") returned 5
	[0059.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01246_.GIF", pszSpec="*.jpeg") returned 0
	[0059.172] lstrlenA (lpString="*.jpeg") returned 6
	[0059.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01246_.GIF", pszSpec="*.bmp") returned 0
	[0059.172] lstrlenA (lpString="*.bmp") returned 5
	[0059.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01246_.GIF", pszSpec="*.gif") returned 1
	[0059.172] lstrlenA (lpString="*.gif") returned 5
	[0059.172] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01246_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01246_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01246_.GIF"
	[0059.172] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01246_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01246_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01246_.GIF"
	[0059.172] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01246_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01246_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01246_.GIF."
	[0059.172] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01246_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01246_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01246_.GIF.exe"
	[0059.172] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01246_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.173] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ce
	[0059.173] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1046b0f3, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1046b0f3, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1046b0f3, dwHighDateTime=0x1d327e8)) returned 1
	[0059.173] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.173] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x18c, lpOverlapped=0x0) returned 1
	[0059.174] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01246_.GIF") returned="WB01246_.GIF"
	[0059.174] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.174] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x18c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x18c, lpOverlapped=0x0) returned 1
	[0059.174] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.174] CloseHandle (hObject=0x214) returned 1
	[0059.174] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01246_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01246_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01246_.gif.exe")) returned 1
	[0059.175] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1046b0f3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1046b0f3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1046b0f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xff7, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01253_.GIF", cAlternateFileName="")) returned 1
	[0059.175] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.175] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01253_.GIF") returned -1
	[0059.175] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01253_.GIF") returned -1
	[0059.175] lstrcmpiA (lpString1="", lpString2="WB01253_.GIF") returned -1
	[0059.175] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01246_.GIF") returned="WB01246_.GIF"
	[0059.175] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.175] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.175] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.175] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.175] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01253_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01253_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01253_.GIF"
	[0059.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01253_.GIF", pszSpec="*.zip") returned 0
	[0059.175] lstrlenA (lpString="*.zip") returned 5
	[0059.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01253_.GIF", pszSpec="*.rar") returned 0
	[0059.175] lstrlenA (lpString="*.rar") returned 5
	[0059.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01253_.GIF", pszSpec="*.7z") returned 0
	[0059.175] lstrlenA (lpString="*.7z") returned 4
	[0059.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01253_.GIF", pszSpec="*.tar") returned 0
	[0059.175] lstrlenA (lpString="*.tar") returned 5
	[0059.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01253_.GIF", pszSpec="*.gzip") returned 0
	[0059.175] lstrlenA (lpString="*.gzip") returned 6
	[0059.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01253_.GIF", pszSpec="*.jpg") returned 0
	[0059.175] lstrlenA (lpString="*.jpg") returned 5
	[0059.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01253_.GIF", pszSpec="*.jpeg") returned 0
	[0059.176] lstrlenA (lpString="*.jpeg") returned 6
	[0059.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01253_.GIF", pszSpec="*.bmp") returned 0
	[0059.176] lstrlenA (lpString="*.bmp") returned 5
	[0059.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01253_.GIF", pszSpec="*.gif") returned 1
	[0059.176] lstrlenA (lpString="*.gif") returned 5
	[0059.176] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01253_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01253_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01253_.GIF"
	[0059.176] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01253_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01253_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01253_.GIF"
	[0059.176] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01253_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01253_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01253_.GIF."
	[0059.176] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01253_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01253_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01253_.GIF.exe"
	[0059.176] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01253_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.176] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xff7
	[0059.176] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1046b0f3, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1046b0f3, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1046b0f3, dwHighDateTime=0x1d327e8)) returned 1
	[0059.176] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.176] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xfb5, lpOverlapped=0x0) returned 1
	[0059.269] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01253_.GIF") returned="WB01253_.GIF"
	[0059.296] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.297] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xfb5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xfb5, lpOverlapped=0x0) returned 1
	[0059.297] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.297] CloseHandle (hObject=0x214) returned 1
	[0059.297] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01253_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01253_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01253_.gif.exe")) returned 1
	[0059.298] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1046b0f3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1046b0f3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1046b0f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01268_.GIF", cAlternateFileName="")) returned 1
	[0059.298] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.298] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01268_.GIF") returned -1
	[0059.298] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01268_.GIF") returned -1
	[0059.298] lstrcmpiA (lpString1="", lpString2="WB01268_.GIF") returned -1
	[0059.298] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01253_.GIF") returned="WB01253_.GIF"
	[0059.298] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.298] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.298] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.298] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.298] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01268_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01268_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01268_.GIF"
	[0059.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01268_.GIF", pszSpec="*.zip") returned 0
	[0059.298] lstrlenA (lpString="*.zip") returned 5
	[0059.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01268_.GIF", pszSpec="*.rar") returned 0
	[0059.298] lstrlenA (lpString="*.rar") returned 5
	[0059.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01268_.GIF", pszSpec="*.7z") returned 0
	[0059.298] lstrlenA (lpString="*.7z") returned 4
	[0059.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01268_.GIF", pszSpec="*.tar") returned 0
	[0059.298] lstrlenA (lpString="*.tar") returned 5
	[0059.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01268_.GIF", pszSpec="*.gzip") returned 0
	[0059.298] lstrlenA (lpString="*.gzip") returned 6
	[0059.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01268_.GIF", pszSpec="*.jpg") returned 0
	[0059.298] lstrlenA (lpString="*.jpg") returned 5
	[0059.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01268_.GIF", pszSpec="*.jpeg") returned 0
	[0059.298] lstrlenA (lpString="*.jpeg") returned 6
	[0059.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01268_.GIF", pszSpec="*.bmp") returned 0
	[0059.298] lstrlenA (lpString="*.bmp") returned 5
	[0059.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01268_.GIF", pszSpec="*.gif") returned 1
	[0059.298] lstrlenA (lpString="*.gif") returned 5
	[0059.298] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01268_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01268_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01268_.GIF"
	[0059.299] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01268_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01268_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01268_.GIF"
	[0059.299] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01268_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01268_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01268_.GIF."
	[0059.299] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01268_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01268_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01268_.GIF.exe"
	[0059.299] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01268_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.299] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ab
	[0059.299] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1046b0f3, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1046b0f3, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1046b0f3, dwHighDateTime=0x1d327e8)) returned 1
	[0059.299] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.299] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x169, lpOverlapped=0x0) returned 1
	[0059.300] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01268_.GIF") returned="WB01268_.GIF"
	[0059.300] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.300] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x169, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x169, lpOverlapped=0x0) returned 1
	[0059.300] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.301] CloseHandle (hObject=0x214) returned 1
	[0059.301] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01268_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01268_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01268_.gif.exe")) returned 1
	[0059.301] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10491364, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10491364, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10491364, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01292_.GIF", cAlternateFileName="")) returned 1
	[0059.301] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.301] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01292_.GIF") returned -1
	[0059.301] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01292_.GIF") returned -1
	[0059.301] lstrcmpiA (lpString1="", lpString2="WB01292_.GIF") returned -1
	[0059.301] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01268_.GIF") returned="WB01268_.GIF"
	[0059.301] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.301] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.301] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.301] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.301] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01292_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01292_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01292_.GIF"
	[0059.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01292_.GIF", pszSpec="*.zip") returned 0
	[0059.302] lstrlenA (lpString="*.zip") returned 5
	[0059.302] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01292_.GIF", pszSpec="*.rar") returned 0
	[0059.302] lstrlenA (lpString="*.rar") returned 5
	[0059.302] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01292_.GIF", pszSpec="*.7z") returned 0
	[0059.302] lstrlenA (lpString="*.7z") returned 4
	[0059.302] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01292_.GIF", pszSpec="*.tar") returned 0
	[0059.302] lstrlenA (lpString="*.tar") returned 5
	[0059.302] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01292_.GIF", pszSpec="*.gzip") returned 0
	[0059.302] lstrlenA (lpString="*.gzip") returned 6
	[0059.302] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01292_.GIF", pszSpec="*.jpg") returned 0
	[0059.302] lstrlenA (lpString="*.jpg") returned 5
	[0059.302] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01292_.GIF", pszSpec="*.jpeg") returned 0
	[0059.302] lstrlenA (lpString="*.jpeg") returned 6
	[0059.302] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01292_.GIF", pszSpec="*.bmp") returned 0
	[0059.302] lstrlenA (lpString="*.bmp") returned 5
	[0059.302] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01292_.GIF", pszSpec="*.gif") returned 1
	[0059.302] lstrlenA (lpString="*.gif") returned 5
	[0059.302] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01292_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01292_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01292_.GIF"
	[0059.302] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01292_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01292_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01292_.GIF"
	[0059.302] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01292_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01292_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01292_.GIF."
	[0059.302] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01292_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01292_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01292_.GIF.exe"
	[0059.302] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01292_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.303] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x255
	[0059.303] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8)) returned 1
	[0059.303] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.303] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x213, lpOverlapped=0x0) returned 1
	[0059.305] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01292_.GIF") returned="WB01292_.GIF"
	[0059.305] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.305] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x213, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x213, lpOverlapped=0x0) returned 1
	[0059.305] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.305] CloseHandle (hObject=0x214) returned 1
	[0059.305] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01292_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01292_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01292_.gif.exe")) returned 1
	[0059.306] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10491364, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10491364, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10491364, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01293_.GIF", cAlternateFileName="")) returned 1
	[0059.306] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.306] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01293_.GIF") returned -1
	[0059.306] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01293_.GIF") returned -1
	[0059.306] lstrcmpiA (lpString1="", lpString2="WB01293_.GIF") returned -1
	[0059.306] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01292_.GIF") returned="WB01292_.GIF"
	[0059.306] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.306] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.306] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.306] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.306] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01293_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF"
	[0059.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF", pszSpec="*.zip") returned 0
	[0059.307] lstrlenA (lpString="*.zip") returned 5
	[0059.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF", pszSpec="*.rar") returned 0
	[0059.307] lstrlenA (lpString="*.rar") returned 5
	[0059.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF", pszSpec="*.7z") returned 0
	[0059.307] lstrlenA (lpString="*.7z") returned 4
	[0059.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF", pszSpec="*.tar") returned 0
	[0059.307] lstrlenA (lpString="*.tar") returned 5
	[0059.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF", pszSpec="*.gzip") returned 0
	[0059.307] lstrlenA (lpString="*.gzip") returned 6
	[0059.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF", pszSpec="*.jpg") returned 0
	[0059.307] lstrlenA (lpString="*.jpg") returned 5
	[0059.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF", pszSpec="*.jpeg") returned 0
	[0059.307] lstrlenA (lpString="*.jpeg") returned 6
	[0059.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF", pszSpec="*.bmp") returned 0
	[0059.307] lstrlenA (lpString="*.bmp") returned 5
	[0059.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF", pszSpec="*.gif") returned 1
	[0059.307] lstrlenA (lpString="*.gif") returned 5
	[0059.307] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF"
	[0059.307] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF"
	[0059.307] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF."
	[0059.307] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF.exe"
	[0059.307] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01293_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.307] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2a7
	[0059.307] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8)) returned 1
	[0059.307] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.307] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x265, lpOverlapped=0x0) returned 1
	[0059.308] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF") returned="WB01293_.GIF"
	[0059.308] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.308] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x265, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x265, lpOverlapped=0x0) returned 1
	[0059.309] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.309] CloseHandle (hObject=0x214) returned 1
	[0059.309] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01293_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01293_.gif.exe")) returned 1
	[0059.310] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10491364, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10491364, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10491364, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01294_.GIF", cAlternateFileName="")) returned 1
	[0059.310] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.310] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01294_.GIF") returned -1
	[0059.310] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01294_.GIF") returned -1
	[0059.310] lstrcmpiA (lpString1="", lpString2="WB01294_.GIF") returned -1
	[0059.310] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF") returned="WB01293_.GIF"
	[0059.310] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.310] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.310] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.311] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.311] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01294_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF"
	[0059.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF", pszSpec="*.zip") returned 0
	[0059.311] lstrlenA (lpString="*.zip") returned 5
	[0059.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF", pszSpec="*.rar") returned 0
	[0059.311] lstrlenA (lpString="*.rar") returned 5
	[0059.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF", pszSpec="*.7z") returned 0
	[0059.311] lstrlenA (lpString="*.7z") returned 4
	[0059.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF", pszSpec="*.tar") returned 0
	[0059.311] lstrlenA (lpString="*.tar") returned 5
	[0059.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF", pszSpec="*.gzip") returned 0
	[0059.311] lstrlenA (lpString="*.gzip") returned 6
	[0059.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF", pszSpec="*.jpg") returned 0
	[0059.311] lstrlenA (lpString="*.jpg") returned 5
	[0059.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF", pszSpec="*.jpeg") returned 0
	[0059.311] lstrlenA (lpString="*.jpeg") returned 6
	[0059.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF", pszSpec="*.bmp") returned 0
	[0059.311] lstrlenA (lpString="*.bmp") returned 5
	[0059.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF", pszSpec="*.gif") returned 1
	[0059.311] lstrlenA (lpString="*.gif") returned 5
	[0059.311] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF"
	[0059.311] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF"
	[0059.311] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF."
	[0059.311] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF.exe"
	[0059.311] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01294_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.311] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ad
	[0059.311] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8)) returned 1
	[0059.312] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.312] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x26b, lpOverlapped=0x0) returned 1
	[0059.313] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF") returned="WB01294_.GIF"
	[0059.313] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.313] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x26b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x26b, lpOverlapped=0x0) returned 1
	[0059.313] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.313] CloseHandle (hObject=0x214) returned 1
	[0059.313] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01294_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01294_.gif.exe")) returned 1
	[0059.314] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10491364, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10491364, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10491364, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x161, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01295_.GIF", cAlternateFileName="")) returned 1
	[0059.314] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.314] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01295_.GIF") returned -1
	[0059.314] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01295_.GIF") returned -1
	[0059.314] lstrcmpiA (lpString1="", lpString2="WB01295_.GIF") returned -1
	[0059.314] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF") returned="WB01294_.GIF"
	[0059.314] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.314] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.314] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.314] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.314] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01295_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF"
	[0059.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF", pszSpec="*.zip") returned 0
	[0059.314] lstrlenA (lpString="*.zip") returned 5
	[0059.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF", pszSpec="*.rar") returned 0
	[0059.314] lstrlenA (lpString="*.rar") returned 5
	[0059.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF", pszSpec="*.7z") returned 0
	[0059.314] lstrlenA (lpString="*.7z") returned 4
	[0059.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF", pszSpec="*.tar") returned 0
	[0059.314] lstrlenA (lpString="*.tar") returned 5
	[0059.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF", pszSpec="*.gzip") returned 0
	[0059.315] lstrlenA (lpString="*.gzip") returned 6
	[0059.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF", pszSpec="*.jpg") returned 0
	[0059.315] lstrlenA (lpString="*.jpg") returned 5
	[0059.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF", pszSpec="*.jpeg") returned 0
	[0059.315] lstrlenA (lpString="*.jpeg") returned 6
	[0059.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF", pszSpec="*.bmp") returned 0
	[0059.315] lstrlenA (lpString="*.bmp") returned 5
	[0059.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF", pszSpec="*.gif") returned 1
	[0059.315] lstrlenA (lpString="*.gif") returned 5
	[0059.315] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF"
	[0059.315] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF"
	[0059.315] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF."
	[0059.315] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF.exe"
	[0059.315] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01295_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.315] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x161
	[0059.315] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8)) returned 1
	[0059.315] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.315] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x11f, lpOverlapped=0x0) returned 1
	[0059.316] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF") returned="WB01295_.GIF"
	[0059.316] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.316] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x11f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x11f, lpOverlapped=0x0) returned 1
	[0059.316] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.316] CloseHandle (hObject=0x214) returned 1
	[0059.317] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01295_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01295_.gif.exe")) returned 1
	[0059.317] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1046b0f3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1046b0f3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10491364, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01296_.GIF", cAlternateFileName="")) returned 1
	[0059.317] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.317] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01296_.GIF") returned -1
	[0059.317] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01296_.GIF") returned -1
	[0059.317] lstrcmpiA (lpString1="", lpString2="WB01296_.GIF") returned -1
	[0059.317] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF") returned="WB01295_.GIF"
	[0059.317] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.317] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.317] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.317] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.317] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01296_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF"
	[0059.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF", pszSpec="*.zip") returned 0
	[0059.317] lstrlenA (lpString="*.zip") returned 5
	[0059.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF", pszSpec="*.rar") returned 0
	[0059.318] lstrlenA (lpString="*.rar") returned 5
	[0059.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF", pszSpec="*.7z") returned 0
	[0059.318] lstrlenA (lpString="*.7z") returned 4
	[0059.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF", pszSpec="*.tar") returned 0
	[0059.318] lstrlenA (lpString="*.tar") returned 5
	[0059.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF", pszSpec="*.gzip") returned 0
	[0059.318] lstrlenA (lpString="*.gzip") returned 6
	[0059.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF", pszSpec="*.jpg") returned 0
	[0059.318] lstrlenA (lpString="*.jpg") returned 5
	[0059.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF", pszSpec="*.jpeg") returned 0
	[0059.318] lstrlenA (lpString="*.jpeg") returned 6
	[0059.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF", pszSpec="*.bmp") returned 0
	[0059.318] lstrlenA (lpString="*.bmp") returned 5
	[0059.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF", pszSpec="*.gif") returned 1
	[0059.318] lstrlenA (lpString="*.gif") returned 5
	[0059.318] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF"
	[0059.318] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF"
	[0059.318] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF."
	[0059.318] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF.exe"
	[0059.318] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01296_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.319] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ef
	[0059.319] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1046b0f3, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1046b0f3, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8)) returned 1
	[0059.319] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.319] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1ad, lpOverlapped=0x0) returned 1
	[0059.320] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF") returned="WB01296_.GIF"
	[0059.320] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.320] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1ad, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1ad, lpOverlapped=0x0) returned 1
	[0059.320] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.320] CloseHandle (hObject=0x214) returned 1
	[0059.320] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01296_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01296_.gif.exe")) returned 1
	[0059.321] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1046b0f3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1046b0f3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1046b0f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01297_.GIF", cAlternateFileName="")) returned 1
	[0059.321] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.321] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01297_.GIF") returned -1
	[0059.321] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01297_.GIF") returned -1
	[0059.321] lstrcmpiA (lpString1="", lpString2="WB01297_.GIF") returned -1
	[0059.321] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF") returned="WB01296_.GIF"
	[0059.321] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.321] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.321] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.321] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.321] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01297_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF"
	[0059.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF", pszSpec="*.zip") returned 0
	[0059.321] lstrlenA (lpString="*.zip") returned 5
	[0059.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF", pszSpec="*.rar") returned 0
	[0059.321] lstrlenA (lpString="*.rar") returned 5
	[0059.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF", pszSpec="*.7z") returned 0
	[0059.321] lstrlenA (lpString="*.7z") returned 4
	[0059.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF", pszSpec="*.tar") returned 0
	[0059.321] lstrlenA (lpString="*.tar") returned 5
	[0059.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF", pszSpec="*.gzip") returned 0
	[0059.321] lstrlenA (lpString="*.gzip") returned 6
	[0059.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF", pszSpec="*.jpg") returned 0
	[0059.321] lstrlenA (lpString="*.jpg") returned 5
	[0059.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF", pszSpec="*.jpeg") returned 0
	[0059.321] lstrlenA (lpString="*.jpeg") returned 6
	[0059.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF", pszSpec="*.bmp") returned 0
	[0059.321] lstrlenA (lpString="*.bmp") returned 5
	[0059.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF", pszSpec="*.gif") returned 1
	[0059.321] lstrlenA (lpString="*.gif") returned 5
	[0059.321] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF"
	[0059.322] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF"
	[0059.322] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF."
	[0059.322] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF.exe"
	[0059.322] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01297_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.322] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x37e
	[0059.322] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1046b0f3, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1046b0f3, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1046b0f3, dwHighDateTime=0x1d327e8)) returned 1
	[0059.322] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.322] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x33c, lpOverlapped=0x0) returned 1
	[0059.448] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF") returned="WB01297_.GIF"
	[0059.449] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.452] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x33c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x33c, lpOverlapped=0x0) returned 1
	[0059.465] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.466] CloseHandle (hObject=0x214) returned 1
	[0059.466] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01297_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01297_.gif.exe")) returned 1
	[0059.469] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10491364, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10491364, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10491364, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01298_.GIF", cAlternateFileName="")) returned 1
	[0059.470] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.470] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01298_.GIF") returned -1
	[0059.470] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01298_.GIF") returned -1
	[0059.470] lstrcmpiA (lpString1="", lpString2="WB01298_.GIF") returned -1
	[0059.470] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF") returned="WB01297_.GIF"
	[0059.470] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.470] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.470] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.470] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.470] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01298_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF"
	[0059.470] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF", pszSpec="*.zip") returned 0
	[0059.470] lstrlenA (lpString="*.zip") returned 5
	[0059.470] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF", pszSpec="*.rar") returned 0
	[0059.470] lstrlenA (lpString="*.rar") returned 5
	[0059.470] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF", pszSpec="*.7z") returned 0
	[0059.470] lstrlenA (lpString="*.7z") returned 4
	[0059.470] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF", pszSpec="*.tar") returned 0
	[0059.470] lstrlenA (lpString="*.tar") returned 5
	[0059.470] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF", pszSpec="*.gzip") returned 0
	[0059.470] lstrlenA (lpString="*.gzip") returned 6
	[0059.470] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF", pszSpec="*.jpg") returned 0
	[0059.470] lstrlenA (lpString="*.jpg") returned 5
	[0059.470] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF", pszSpec="*.jpeg") returned 0
	[0059.470] lstrlenA (lpString="*.jpeg") returned 6
	[0059.470] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF", pszSpec="*.bmp") returned 0
	[0059.470] lstrlenA (lpString="*.bmp") returned 5
	[0059.470] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF", pszSpec="*.gif") returned 1
	[0059.470] lstrlenA (lpString="*.gif") returned 5
	[0059.470] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF"
	[0059.470] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF"
	[0059.471] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF."
	[0059.471] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF.exe"
	[0059.471] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01298_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.471] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2bc
	[0059.471] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8)) returned 1
	[0059.471] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.471] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x27a, lpOverlapped=0x0) returned 1
	[0059.472] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF") returned="WB01298_.GIF"
	[0059.472] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.472] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x27a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x27a, lpOverlapped=0x0) returned 1
	[0059.472] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.472] CloseHandle (hObject=0x214) returned 1
	[0059.472] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01298_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01298_.gif.exe")) returned 1
	[0059.474] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10491364, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10491364, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10491364, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01299_.GIF", cAlternateFileName="")) returned 1
	[0059.474] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.474] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01299_.GIF") returned -1
	[0059.474] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01299_.GIF") returned -1
	[0059.474] lstrcmpiA (lpString1="", lpString2="WB01299_.GIF") returned -1
	[0059.474] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF") returned="WB01298_.GIF"
	[0059.474] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.474] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.474] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.474] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.474] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01299_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF"
	[0059.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF", pszSpec="*.zip") returned 0
	[0059.475] lstrlenA (lpString="*.zip") returned 5
	[0059.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF", pszSpec="*.rar") returned 0
	[0059.475] lstrlenA (lpString="*.rar") returned 5
	[0059.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF", pszSpec="*.7z") returned 0
	[0059.475] lstrlenA (lpString="*.7z") returned 4
	[0059.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF", pszSpec="*.tar") returned 0
	[0059.475] lstrlenA (lpString="*.tar") returned 5
	[0059.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF", pszSpec="*.gzip") returned 0
	[0059.475] lstrlenA (lpString="*.gzip") returned 6
	[0059.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF", pszSpec="*.jpg") returned 0
	[0059.475] lstrlenA (lpString="*.jpg") returned 5
	[0059.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF", pszSpec="*.jpeg") returned 0
	[0059.475] lstrlenA (lpString="*.jpeg") returned 6
	[0059.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF", pszSpec="*.bmp") returned 0
	[0059.475] lstrlenA (lpString="*.bmp") returned 5
	[0059.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF", pszSpec="*.gif") returned 1
	[0059.475] lstrlenA (lpString="*.gif") returned 5
	[0059.475] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF"
	[0059.475] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF"
	[0059.475] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF."
	[0059.475] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF.exe"
	[0059.475] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01299_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.475] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13e
	[0059.475] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8)) returned 1
	[0059.475] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.475] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xfc, lpOverlapped=0x0) returned 1
	[0059.476] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF") returned="WB01299_.GIF"
	[0059.476] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.476] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xfc, lpOverlapped=0x0) returned 1
	[0059.477] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.477] CloseHandle (hObject=0x214) returned 1
	[0059.477] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01299_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01299_.gif.exe")) returned 1
	[0059.477] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10491364, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10491364, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10491364, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x250, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01300_.GIF", cAlternateFileName="")) returned 1
	[0059.477] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.477] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01300_.GIF") returned -1
	[0059.477] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01300_.GIF") returned -1
	[0059.477] lstrcmpiA (lpString1="", lpString2="WB01300_.GIF") returned -1
	[0059.477] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF") returned="WB01299_.GIF"
	[0059.477] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.477] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.477] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.478] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.478] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01300_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF"
	[0059.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF", pszSpec="*.zip") returned 0
	[0059.478] lstrlenA (lpString="*.zip") returned 5
	[0059.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF", pszSpec="*.rar") returned 0
	[0059.478] lstrlenA (lpString="*.rar") returned 5
	[0059.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF", pszSpec="*.7z") returned 0
	[0059.478] lstrlenA (lpString="*.7z") returned 4
	[0059.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF", pszSpec="*.tar") returned 0
	[0059.478] lstrlenA (lpString="*.tar") returned 5
	[0059.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF", pszSpec="*.gzip") returned 0
	[0059.478] lstrlenA (lpString="*.gzip") returned 6
	[0059.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF", pszSpec="*.jpg") returned 0
	[0059.478] lstrlenA (lpString="*.jpg") returned 5
	[0059.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF", pszSpec="*.jpeg") returned 0
	[0059.478] lstrlenA (lpString="*.jpeg") returned 6
	[0059.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF", pszSpec="*.bmp") returned 0
	[0059.478] lstrlenA (lpString="*.bmp") returned 5
	[0059.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF", pszSpec="*.gif") returned 1
	[0059.478] lstrlenA (lpString="*.gif") returned 5
	[0059.478] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF"
	[0059.478] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF"
	[0059.478] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF."
	[0059.478] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF.exe"
	[0059.478] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01300_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.478] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x250
	[0059.478] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8)) returned 1
	[0059.479] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.479] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x20e, lpOverlapped=0x0) returned 1
	[0059.480] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF") returned="WB01300_.GIF"
	[0059.480] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.480] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x20e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x20e, lpOverlapped=0x0) returned 1
	[0059.480] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.480] CloseHandle (hObject=0x214) returned 1
	[0059.480] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01300_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01300_.gif.exe")) returned 1
	[0059.480] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1046b0f3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1046b0f3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10491364, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01301_.GIF", cAlternateFileName="")) returned 1
	[0059.480] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.480] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01301_.GIF") returned -1
	[0059.480] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01301_.GIF") returned -1
	[0059.480] lstrcmpiA (lpString1="", lpString2="WB01301_.GIF") returned -1
	[0059.480] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF") returned="WB01300_.GIF"
	[0059.480] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.481] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.481] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.481] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.481] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01301_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF"
	[0059.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF", pszSpec="*.zip") returned 0
	[0059.481] lstrlenA (lpString="*.zip") returned 5
	[0059.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF", pszSpec="*.rar") returned 0
	[0059.481] lstrlenA (lpString="*.rar") returned 5
	[0059.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF", pszSpec="*.7z") returned 0
	[0059.481] lstrlenA (lpString="*.7z") returned 4
	[0059.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF", pszSpec="*.tar") returned 0
	[0059.481] lstrlenA (lpString="*.tar") returned 5
	[0059.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF", pszSpec="*.gzip") returned 0
	[0059.481] lstrlenA (lpString="*.gzip") returned 6
	[0059.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF", pszSpec="*.jpg") returned 0
	[0059.481] lstrlenA (lpString="*.jpg") returned 5
	[0059.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF", pszSpec="*.jpeg") returned 0
	[0059.481] lstrlenA (lpString="*.jpeg") returned 6
	[0059.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF", pszSpec="*.bmp") returned 0
	[0059.481] lstrlenA (lpString="*.bmp") returned 5
	[0059.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF", pszSpec="*.gif") returned 1
	[0059.481] lstrlenA (lpString="*.gif") returned 5
	[0059.481] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF"
	[0059.481] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF"
	[0059.481] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF."
	[0059.481] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF.exe"
	[0059.481] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01301_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.482] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2a9
	[0059.482] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1046b0f3, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1046b0f3, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8)) returned 1
	[0059.482] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.482] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x267, lpOverlapped=0x0) returned 1
	[0059.483] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF") returned="WB01301_.GIF"
	[0059.483] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.483] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x267, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x267, lpOverlapped=0x0) returned 1
	[0059.483] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.483] CloseHandle (hObject=0x214) returned 1
	[0059.483] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01301_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01301_.gif.exe")) returned 1
	[0059.485] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10491364, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10491364, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2076, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01304G.GIF", cAlternateFileName="")) returned 1
	[0059.485] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.485] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01304G.GIF") returned -1
	[0059.485] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01304G.GIF") returned -1
	[0059.485] lstrcmpiA (lpString1="", lpString2="WB01304G.GIF") returned -1
	[0059.485] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF") returned="WB01301_.GIF"
	[0059.485] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.485] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.485] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.485] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.485] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01304G.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF"
	[0059.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF", pszSpec="*.zip") returned 0
	[0059.485] lstrlenA (lpString="*.zip") returned 5
	[0059.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF", pszSpec="*.rar") returned 0
	[0059.485] lstrlenA (lpString="*.rar") returned 5
	[0059.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF", pszSpec="*.7z") returned 0
	[0059.485] lstrlenA (lpString="*.7z") returned 4
	[0059.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF", pszSpec="*.tar") returned 0
	[0059.485] lstrlenA (lpString="*.tar") returned 5
	[0059.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF", pszSpec="*.gzip") returned 0
	[0059.485] lstrlenA (lpString="*.gzip") returned 6
	[0059.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF", pszSpec="*.jpg") returned 0
	[0059.485] lstrlenA (lpString="*.jpg") returned 5
	[0059.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF", pszSpec="*.jpeg") returned 0
	[0059.485] lstrlenA (lpString="*.jpeg") returned 6
	[0059.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF", pszSpec="*.bmp") returned 0
	[0059.486] lstrlenA (lpString="*.bmp") returned 5
	[0059.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF", pszSpec="*.gif") returned 1
	[0059.486] lstrlenA (lpString="*.gif") returned 5
	[0059.486] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF"
	[0059.486] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF"
	[0059.486] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF."
	[0059.486] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF.exe"
	[0059.486] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01304g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.486] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2076
	[0059.486] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x104b75c6, dwHighDateTime=0x1d327e8)) returned 1
	[0059.486] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.487] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x2034, lpOverlapped=0x0) returned 1
	[0059.490] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF") returned="WB01304G.GIF"
	[0059.490] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.490] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x2034, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x2034, lpOverlapped=0x0) returned 1
	[0059.491] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.491] CloseHandle (hObject=0x214) returned 1
	[0059.491] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01304g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01304g.gif.exe")) returned 1
	[0059.491] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10491364, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10491364, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01330_.GIF", cAlternateFileName="")) returned 1
	[0059.491] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.491] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01330_.GIF") returned -1
	[0059.491] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01330_.GIF") returned -1
	[0059.491] lstrcmpiA (lpString1="", lpString2="WB01330_.GIF") returned -1
	[0059.491] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF") returned="WB01304G.GIF"
	[0059.491] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.491] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.492] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.492] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.492] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01330_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01330_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01330_.GIF"
	[0059.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01330_.GIF", pszSpec="*.zip") returned 0
	[0059.492] lstrlenA (lpString="*.zip") returned 5
	[0059.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01330_.GIF", pszSpec="*.rar") returned 0
	[0059.492] lstrlenA (lpString="*.rar") returned 5
	[0059.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01330_.GIF", pszSpec="*.7z") returned 0
	[0059.492] lstrlenA (lpString="*.7z") returned 4
	[0059.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01330_.GIF", pszSpec="*.tar") returned 0
	[0059.492] lstrlenA (lpString="*.tar") returned 5
	[0059.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01330_.GIF", pszSpec="*.gzip") returned 0
	[0059.492] lstrlenA (lpString="*.gzip") returned 6
	[0059.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01330_.GIF", pszSpec="*.jpg") returned 0
	[0059.492] lstrlenA (lpString="*.jpg") returned 5
	[0059.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01330_.GIF", pszSpec="*.jpeg") returned 0
	[0059.492] lstrlenA (lpString="*.jpeg") returned 6
	[0059.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01330_.GIF", pszSpec="*.bmp") returned 0
	[0059.492] lstrlenA (lpString="*.bmp") returned 5
	[0059.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01330_.GIF", pszSpec="*.gif") returned 1
	[0059.492] lstrlenA (lpString="*.gif") returned 5
	[0059.492] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01330_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01330_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01330_.GIF"
	[0059.492] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01330_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01330_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01330_.GIF"
	[0059.492] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01330_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01330_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01330_.GIF."
	[0059.492] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01330_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01330_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01330_.GIF.exe"
	[0059.492] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01330_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.514] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x172
	[0059.540] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x104b75c6, dwHighDateTime=0x1d327e8)) returned 1
	[0059.540] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.541] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x130, lpOverlapped=0x0) returned 1
	[0059.541] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01330_.GIF") returned="WB01330_.GIF"
	[0059.542] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.542] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x130, lpOverlapped=0x0) returned 1
	[0059.542] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.542] CloseHandle (hObject=0x214) returned 1
	[0059.542] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01330_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01330_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01330_.gif.exe")) returned 1
	[0059.543] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10491364, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10491364, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x899, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01734_.GIF", cAlternateFileName="")) returned 1
	[0059.543] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.543] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01734_.GIF") returned -1
	[0059.543] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01734_.GIF") returned -1
	[0059.543] lstrcmpiA (lpString1="", lpString2="WB01734_.GIF") returned -1
	[0059.543] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01330_.GIF") returned="WB01330_.GIF"
	[0059.543] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.543] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.543] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.543] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.543] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01734_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01734_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01734_.GIF"
	[0059.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01734_.GIF", pszSpec="*.zip") returned 0
	[0059.543] lstrlenA (lpString="*.zip") returned 5
	[0059.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01734_.GIF", pszSpec="*.rar") returned 0
	[0059.543] lstrlenA (lpString="*.rar") returned 5
	[0059.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01734_.GIF", pszSpec="*.7z") returned 0
	[0059.543] lstrlenA (lpString="*.7z") returned 4
	[0059.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01734_.GIF", pszSpec="*.tar") returned 0
	[0059.543] lstrlenA (lpString="*.tar") returned 5
	[0059.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01734_.GIF", pszSpec="*.gzip") returned 0
	[0059.543] lstrlenA (lpString="*.gzip") returned 6
	[0059.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01734_.GIF", pszSpec="*.jpg") returned 0
	[0059.543] lstrlenA (lpString="*.jpg") returned 5
	[0059.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01734_.GIF", pszSpec="*.jpeg") returned 0
	[0059.543] lstrlenA (lpString="*.jpeg") returned 6
	[0059.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01734_.GIF", pszSpec="*.bmp") returned 0
	[0059.544] lstrlenA (lpString="*.bmp") returned 5
	[0059.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01734_.GIF", pszSpec="*.gif") returned 1
	[0059.544] lstrlenA (lpString="*.gif") returned 5
	[0059.544] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01734_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01734_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01734_.GIF"
	[0059.544] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01734_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01734_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01734_.GIF"
	[0059.544] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01734_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01734_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01734_.GIF."
	[0059.544] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01734_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01734_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01734_.GIF.exe"
	[0059.544] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01734_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.544] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x899
	[0059.544] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x104b75c6, dwHighDateTime=0x1d327e8)) returned 1
	[0059.544] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.544] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x857, lpOverlapped=0x0) returned 1
	[0059.551] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01734_.GIF") returned="WB01734_.GIF"
	[0059.551] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.551] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x857, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x857, lpOverlapped=0x0) returned 1
	[0059.551] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.551] CloseHandle (hObject=0x214) returned 1
	[0059.551] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01734_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01734_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01734_.gif.exe")) returned 1
	[0059.552] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10491364, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10491364, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01740_.GIF", cAlternateFileName="")) returned 1
	[0059.552] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.552] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01740_.GIF") returned -1
	[0059.552] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01740_.GIF") returned -1
	[0059.552] lstrcmpiA (lpString1="", lpString2="WB01740_.GIF") returned -1
	[0059.552] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01734_.GIF") returned="WB01734_.GIF"
	[0059.552] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.552] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.552] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.552] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.552] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01740_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01740_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01740_.GIF"
	[0059.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01740_.GIF", pszSpec="*.zip") returned 0
	[0059.552] lstrlenA (lpString="*.zip") returned 5
	[0059.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01740_.GIF", pszSpec="*.rar") returned 0
	[0059.552] lstrlenA (lpString="*.rar") returned 5
	[0059.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01740_.GIF", pszSpec="*.7z") returned 0
	[0059.552] lstrlenA (lpString="*.7z") returned 4
	[0059.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01740_.GIF", pszSpec="*.tar") returned 0
	[0059.552] lstrlenA (lpString="*.tar") returned 5
	[0059.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01740_.GIF", pszSpec="*.gzip") returned 0
	[0059.552] lstrlenA (lpString="*.gzip") returned 6
	[0059.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01740_.GIF", pszSpec="*.jpg") returned 0
	[0059.552] lstrlenA (lpString="*.jpg") returned 5
	[0059.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01740_.GIF", pszSpec="*.jpeg") returned 0
	[0059.552] lstrlenA (lpString="*.jpeg") returned 6
	[0059.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01740_.GIF", pszSpec="*.bmp") returned 0
	[0059.553] lstrlenA (lpString="*.bmp") returned 5
	[0059.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01740_.GIF", pszSpec="*.gif") returned 1
	[0059.553] lstrlenA (lpString="*.gif") returned 5
	[0059.553] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01740_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01740_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01740_.GIF"
	[0059.553] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01740_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01740_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01740_.GIF"
	[0059.553] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01740_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01740_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01740_.GIF."
	[0059.553] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01740_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01740_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01740_.GIF.exe"
	[0059.553] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01740_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.553] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c3
	[0059.553] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x104b75c6, dwHighDateTime=0x1d327e8)) returned 1
	[0059.553] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.553] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x281, lpOverlapped=0x0) returned 1
	[0059.554] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01740_.GIF") returned="WB01740_.GIF"
	[0059.554] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.554] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x281, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x281, lpOverlapped=0x0) returned 1
	[0059.554] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.554] CloseHandle (hObject=0x214) returned 1
	[0059.554] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01740_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01740_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01740_.gif.exe")) returned 1
	[0059.590] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10491364, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10491364, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10491364, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01742_.GIF", cAlternateFileName="")) returned 1
	[0059.590] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.590] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01742_.GIF") returned -1
	[0059.590] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01742_.GIF") returned -1
	[0059.590] lstrcmpiA (lpString1="", lpString2="WB01742_.GIF") returned -1
	[0059.590] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01740_.GIF") returned="WB01740_.GIF"
	[0059.590] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.590] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.590] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.590] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.590] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01742_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01742_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01742_.GIF"
	[0059.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01742_.GIF", pszSpec="*.zip") returned 0
	[0059.590] lstrlenA (lpString="*.zip") returned 5
	[0059.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01742_.GIF", pszSpec="*.rar") returned 0
	[0059.590] lstrlenA (lpString="*.rar") returned 5
	[0059.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01742_.GIF", pszSpec="*.7z") returned 0
	[0059.590] lstrlenA (lpString="*.7z") returned 4
	[0059.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01742_.GIF", pszSpec="*.tar") returned 0
	[0059.591] lstrlenA (lpString="*.tar") returned 5
	[0059.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01742_.GIF", pszSpec="*.gzip") returned 0
	[0059.591] lstrlenA (lpString="*.gzip") returned 6
	[0059.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01742_.GIF", pszSpec="*.jpg") returned 0
	[0059.591] lstrlenA (lpString="*.jpg") returned 5
	[0059.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01742_.GIF", pszSpec="*.jpeg") returned 0
	[0059.591] lstrlenA (lpString="*.jpeg") returned 6
	[0059.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01742_.GIF", pszSpec="*.bmp") returned 0
	[0059.591] lstrlenA (lpString="*.bmp") returned 5
	[0059.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01742_.GIF", pszSpec="*.gif") returned 1
	[0059.591] lstrlenA (lpString="*.gif") returned 5
	[0059.592] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01742_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01742_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01742_.GIF"
	[0059.592] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01742_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01742_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01742_.GIF"
	[0059.592] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01742_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01742_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01742_.GIF."
	[0059.592] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01742_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01742_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01742_.GIF.exe"
	[0059.592] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01742_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.592] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x253
	[0059.592] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8)) returned 1
	[0059.592] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.592] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x211, lpOverlapped=0x0) returned 1
	[0059.593] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01742_.GIF") returned="WB01742_.GIF"
	[0059.593] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.593] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x211, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x211, lpOverlapped=0x0) returned 1
	[0059.593] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.593] CloseHandle (hObject=0x214) returned 1
	[0059.593] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01742_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01742_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01742_.gif.exe")) returned 1
	[0059.595] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10491364, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10491364, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10491364, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01743_.GIF", cAlternateFileName="")) returned 1
	[0059.595] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.595] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01743_.GIF") returned -1
	[0059.595] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01743_.GIF") returned -1
	[0059.595] lstrcmpiA (lpString1="", lpString2="WB01743_.GIF") returned -1
	[0059.595] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01742_.GIF") returned="WB01742_.GIF"
	[0059.595] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.595] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.595] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.595] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.595] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01743_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01743_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01743_.GIF"
	[0059.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01743_.GIF", pszSpec="*.zip") returned 0
	[0059.595] lstrlenA (lpString="*.zip") returned 5
	[0059.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01743_.GIF", pszSpec="*.rar") returned 0
	[0059.595] lstrlenA (lpString="*.rar") returned 5
	[0059.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01743_.GIF", pszSpec="*.7z") returned 0
	[0059.595] lstrlenA (lpString="*.7z") returned 4
	[0059.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01743_.GIF", pszSpec="*.tar") returned 0
	[0059.595] lstrlenA (lpString="*.tar") returned 5
	[0059.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01743_.GIF", pszSpec="*.gzip") returned 0
	[0059.595] lstrlenA (lpString="*.gzip") returned 6
	[0059.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01743_.GIF", pszSpec="*.jpg") returned 0
	[0059.595] lstrlenA (lpString="*.jpg") returned 5
	[0059.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01743_.GIF", pszSpec="*.jpeg") returned 0
	[0059.595] lstrlenA (lpString="*.jpeg") returned 6
	[0059.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01743_.GIF", pszSpec="*.bmp") returned 0
	[0059.595] lstrlenA (lpString="*.bmp") returned 5
	[0059.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01743_.GIF", pszSpec="*.gif") returned 1
	[0059.596] lstrlenA (lpString="*.gif") returned 5
	[0059.596] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01743_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01743_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01743_.GIF"
	[0059.596] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01743_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01743_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01743_.GIF"
	[0059.596] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01743_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01743_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01743_.GIF."
	[0059.596] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01743_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01743_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01743_.GIF.exe"
	[0059.596] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01743_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.596] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4d5
	[0059.596] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8)) returned 1
	[0059.596] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.596] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x493, lpOverlapped=0x0) returned 1
	[0059.609] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01743_.GIF") returned="WB01743_.GIF"
	[0059.609] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.609] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x493, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x493, lpOverlapped=0x0) returned 1
	[0059.609] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.609] CloseHandle (hObject=0x214) returned 1
	[0059.609] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01743_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01743_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01743_.gif.exe")) returned 1
	[0059.610] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10491364, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10491364, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x31f, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01744_.GIF", cAlternateFileName="")) returned 1
	[0059.610] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.610] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01744_.GIF") returned -1
	[0059.610] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01744_.GIF") returned -1
	[0059.610] lstrcmpiA (lpString1="", lpString2="WB01744_.GIF") returned -1
	[0059.610] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01743_.GIF") returned="WB01743_.GIF"
	[0059.610] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.610] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.610] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.610] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.610] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01744_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01744_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01744_.GIF"
	[0059.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01744_.GIF", pszSpec="*.zip") returned 0
	[0059.610] lstrlenA (lpString="*.zip") returned 5
	[0059.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01744_.GIF", pszSpec="*.rar") returned 0
	[0059.610] lstrlenA (lpString="*.rar") returned 5
	[0059.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01744_.GIF", pszSpec="*.7z") returned 0
	[0059.610] lstrlenA (lpString="*.7z") returned 4
	[0059.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01744_.GIF", pszSpec="*.tar") returned 0
	[0059.610] lstrlenA (lpString="*.tar") returned 5
	[0059.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01744_.GIF", pszSpec="*.gzip") returned 0
	[0059.610] lstrlenA (lpString="*.gzip") returned 6
	[0059.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01744_.GIF", pszSpec="*.jpg") returned 0
	[0059.611] lstrlenA (lpString="*.jpg") returned 5
	[0059.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01744_.GIF", pszSpec="*.jpeg") returned 0
	[0059.611] lstrlenA (lpString="*.jpeg") returned 6
	[0059.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01744_.GIF", pszSpec="*.bmp") returned 0
	[0059.611] lstrlenA (lpString="*.bmp") returned 5
	[0059.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01744_.GIF", pszSpec="*.gif") returned 1
	[0059.611] lstrlenA (lpString="*.gif") returned 5
	[0059.611] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01744_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01744_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01744_.GIF"
	[0059.611] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01744_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01744_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01744_.GIF"
	[0059.611] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01744_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01744_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01744_.GIF."
	[0059.611] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01744_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01744_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01744_.GIF.exe"
	[0059.611] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01744_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.611] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x31f
	[0059.611] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x104b75c6, dwHighDateTime=0x1d327e8)) returned 1
	[0059.611] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.611] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x2dd, lpOverlapped=0x0) returned 1
	[0059.624] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01744_.GIF") returned="WB01744_.GIF"
	[0059.624] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.624] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x2dd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x2dd, lpOverlapped=0x0) returned 1
	[0059.624] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.624] CloseHandle (hObject=0x214) returned 1
	[0059.624] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01744_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01744_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01744_.gif.exe")) returned 1
	[0059.625] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10491364, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10491364, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10491364, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01745_.GIF", cAlternateFileName="")) returned 1
	[0059.625] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.625] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01745_.GIF") returned -1
	[0059.625] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01745_.GIF") returned -1
	[0059.625] lstrcmpiA (lpString1="", lpString2="WB01745_.GIF") returned -1
	[0059.625] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01744_.GIF") returned="WB01744_.GIF"
	[0059.625] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.625] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.625] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.625] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.625] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01745_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01745_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01745_.GIF"
	[0059.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01745_.GIF", pszSpec="*.zip") returned 0
	[0059.625] lstrlenA (lpString="*.zip") returned 5
	[0059.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01745_.GIF", pszSpec="*.rar") returned 0
	[0059.625] lstrlenA (lpString="*.rar") returned 5
	[0059.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01745_.GIF", pszSpec="*.7z") returned 0
	[0059.625] lstrlenA (lpString="*.7z") returned 4
	[0059.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01745_.GIF", pszSpec="*.tar") returned 0
	[0059.625] lstrlenA (lpString="*.tar") returned 5
	[0059.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01745_.GIF", pszSpec="*.gzip") returned 0
	[0059.625] lstrlenA (lpString="*.gzip") returned 6
	[0059.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01745_.GIF", pszSpec="*.jpg") returned 0
	[0059.625] lstrlenA (lpString="*.jpg") returned 5
	[0059.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01745_.GIF", pszSpec="*.jpeg") returned 0
	[0059.625] lstrlenA (lpString="*.jpeg") returned 6
	[0059.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01745_.GIF", pszSpec="*.bmp") returned 0
	[0059.626] lstrlenA (lpString="*.bmp") returned 5
	[0059.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01745_.GIF", pszSpec="*.gif") returned 1
	[0059.626] lstrlenA (lpString="*.gif") returned 5
	[0059.626] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01745_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01745_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01745_.GIF"
	[0059.626] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01745_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01745_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01745_.GIF"
	[0059.626] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01745_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01745_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01745_.GIF."
	[0059.626] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01745_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01745_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01745_.GIF.exe"
	[0059.626] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01745_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.626] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5ac
	[0059.626] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8)) returned 1
	[0059.626] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.626] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x56a, lpOverlapped=0x0) returned 1
	[0059.631] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01745_.GIF") returned="WB01745_.GIF"
	[0059.631] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.631] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x56a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x56a, lpOverlapped=0x0) returned 1
	[0059.631] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.631] CloseHandle (hObject=0x214) returned 1
	[0059.631] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01745_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01745_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01745_.gif.exe")) returned 1
	[0059.632] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10491364, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10491364, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01746_.GIF", cAlternateFileName="")) returned 1
	[0059.632] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.632] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01746_.GIF") returned -1
	[0059.632] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01746_.GIF") returned -1
	[0059.632] lstrcmpiA (lpString1="", lpString2="WB01746_.GIF") returned -1
	[0059.632] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01745_.GIF") returned="WB01745_.GIF"
	[0059.632] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.632] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.632] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.632] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.632] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01746_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01746_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01746_.GIF"
	[0059.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01746_.GIF", pszSpec="*.zip") returned 0
	[0059.632] lstrlenA (lpString="*.zip") returned 5
	[0059.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01746_.GIF", pszSpec="*.rar") returned 0
	[0059.632] lstrlenA (lpString="*.rar") returned 5
	[0059.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01746_.GIF", pszSpec="*.7z") returned 0
	[0059.632] lstrlenA (lpString="*.7z") returned 4
	[0059.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01746_.GIF", pszSpec="*.tar") returned 0
	[0059.632] lstrlenA (lpString="*.tar") returned 5
	[0059.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01746_.GIF", pszSpec="*.gzip") returned 0
	[0059.632] lstrlenA (lpString="*.gzip") returned 6
	[0059.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01746_.GIF", pszSpec="*.jpg") returned 0
	[0059.633] lstrlenA (lpString="*.jpg") returned 5
	[0059.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01746_.GIF", pszSpec="*.jpeg") returned 0
	[0059.633] lstrlenA (lpString="*.jpeg") returned 6
	[0059.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01746_.GIF", pszSpec="*.bmp") returned 0
	[0059.633] lstrlenA (lpString="*.bmp") returned 5
	[0059.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01746_.GIF", pszSpec="*.gif") returned 1
	[0059.633] lstrlenA (lpString="*.gif") returned 5
	[0059.633] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01746_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01746_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01746_.GIF"
	[0059.633] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01746_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01746_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01746_.GIF"
	[0059.633] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01746_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01746_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01746_.GIF."
	[0059.633] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01746_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01746_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01746_.GIF.exe"
	[0059.633] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01746_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.633] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2e2
	[0059.633] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x104b75c6, dwHighDateTime=0x1d327e8)) returned 1
	[0059.633] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.633] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x2a0, lpOverlapped=0x0) returned 1
	[0059.636] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01746_.GIF") returned="WB01746_.GIF"
	[0059.636] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.636] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x2a0, lpOverlapped=0x0) returned 1
	[0059.636] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.636] CloseHandle (hObject=0x214) returned 1
	[0059.636] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01746_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01746_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01746_.gif.exe")) returned 1
	[0059.637] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10491364, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10491364, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10491364, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01747_.GIF", cAlternateFileName="")) returned 1
	[0059.637] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.637] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01747_.GIF") returned -1
	[0059.637] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01747_.GIF") returned -1
	[0059.637] lstrcmpiA (lpString1="", lpString2="WB01747_.GIF") returned -1
	[0059.637] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01746_.GIF") returned="WB01746_.GIF"
	[0059.637] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.637] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.637] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.637] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.637] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01747_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01747_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01747_.GIF"
	[0059.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01747_.GIF", pszSpec="*.zip") returned 0
	[0059.637] lstrlenA (lpString="*.zip") returned 5
	[0059.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01747_.GIF", pszSpec="*.rar") returned 0
	[0059.637] lstrlenA (lpString="*.rar") returned 5
	[0059.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01747_.GIF", pszSpec="*.7z") returned 0
	[0059.637] lstrlenA (lpString="*.7z") returned 4
	[0059.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01747_.GIF", pszSpec="*.tar") returned 0
	[0059.637] lstrlenA (lpString="*.tar") returned 5
	[0059.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01747_.GIF", pszSpec="*.gzip") returned 0
	[0059.638] lstrlenA (lpString="*.gzip") returned 6
	[0059.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01747_.GIF", pszSpec="*.jpg") returned 0
	[0059.638] lstrlenA (lpString="*.jpg") returned 5
	[0059.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01747_.GIF", pszSpec="*.jpeg") returned 0
	[0059.638] lstrlenA (lpString="*.jpeg") returned 6
	[0059.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01747_.GIF", pszSpec="*.bmp") returned 0
	[0059.638] lstrlenA (lpString="*.bmp") returned 5
	[0059.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01747_.GIF", pszSpec="*.gif") returned 1
	[0059.638] lstrlenA (lpString="*.gif") returned 5
	[0059.638] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01747_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01747_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01747_.GIF"
	[0059.638] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01747_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01747_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01747_.GIF"
	[0059.638] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01747_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01747_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01747_.GIF."
	[0059.638] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01747_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01747_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01747_.GIF.exe"
	[0059.638] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01747_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.638] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x387
	[0059.638] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8)) returned 1
	[0059.638] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.639] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x345, lpOverlapped=0x0) returned 1
	[0059.641] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01747_.GIF") returned="WB01747_.GIF"
	[0059.641] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.641] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x345, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x345, lpOverlapped=0x0) returned 1
	[0059.641] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.641] CloseHandle (hObject=0x214) returned 1
	[0059.641] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01747_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01747_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01747_.gif.exe")) returned 1
	[0059.641] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x110c9494, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x110c9494, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x110c9494, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01748_.GIF", cAlternateFileName="")) returned 1
	[0059.642] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.642] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01748_.GIF") returned -1
	[0059.642] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01748_.GIF") returned -1
	[0059.642] lstrcmpiA (lpString1="", lpString2="WB01748_.GIF") returned -1
	[0059.642] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01747_.GIF") returned="WB01747_.GIF"
	[0059.642] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.642] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.642] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.642] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.642] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01748_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01748_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01748_.GIF"
	[0059.642] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01748_.GIF", pszSpec="*.zip") returned 0
	[0059.642] lstrlenA (lpString="*.zip") returned 5
	[0059.642] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01748_.GIF", pszSpec="*.rar") returned 0
	[0059.642] lstrlenA (lpString="*.rar") returned 5
	[0059.642] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01748_.GIF", pszSpec="*.7z") returned 0
	[0059.642] lstrlenA (lpString="*.7z") returned 4
	[0059.642] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01748_.GIF", pszSpec="*.tar") returned 0
	[0059.642] lstrlenA (lpString="*.tar") returned 5
	[0059.642] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01748_.GIF", pszSpec="*.gzip") returned 0
	[0059.642] lstrlenA (lpString="*.gzip") returned 6
	[0059.642] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01748_.GIF", pszSpec="*.jpg") returned 0
	[0059.642] lstrlenA (lpString="*.jpg") returned 5
	[0059.642] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01748_.GIF", pszSpec="*.jpeg") returned 0
	[0059.642] lstrlenA (lpString="*.jpeg") returned 6
	[0059.642] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01748_.GIF", pszSpec="*.bmp") returned 0
	[0059.642] lstrlenA (lpString="*.bmp") returned 5
	[0059.642] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01748_.GIF", pszSpec="*.gif") returned 1
	[0059.642] lstrlenA (lpString="*.gif") returned 5
	[0059.642] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01748_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01748_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01748_.GIF"
	[0059.642] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01748_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01748_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01748_.GIF"
	[0059.642] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01748_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01748_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01748_.GIF."
	[0059.642] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01748_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01748_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01748_.GIF.exe"
	[0059.643] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01748_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.643] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d7
	[0059.643] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x110c9494, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x110c9494, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x110c9494, dwHighDateTime=0x1d327e8)) returned 1
	[0059.643] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.643] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x295, lpOverlapped=0x0) returned 1
	[0059.650] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01748_.GIF") returned="WB01748_.GIF"
	[0059.650] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.650] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x295, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x295, lpOverlapped=0x0) returned 1
	[0059.650] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.650] CloseHandle (hObject=0x214) returned 1
	[0059.650] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01748_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01748_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01748_.gif.exe")) returned 1
	[0059.651] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10491364, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10491364, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01749_.GIF", cAlternateFileName="")) returned 1
	[0059.651] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.651] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01749_.GIF") returned -1
	[0059.651] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01749_.GIF") returned -1
	[0059.651] lstrcmpiA (lpString1="", lpString2="WB01749_.GIF") returned -1
	[0059.651] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01748_.GIF") returned="WB01748_.GIF"
	[0059.651] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.651] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.651] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.651] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.651] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01749_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01749_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01749_.GIF"
	[0059.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01749_.GIF", pszSpec="*.zip") returned 0
	[0059.651] lstrlenA (lpString="*.zip") returned 5
	[0059.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01749_.GIF", pszSpec="*.rar") returned 0
	[0059.651] lstrlenA (lpString="*.rar") returned 5
	[0059.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01749_.GIF", pszSpec="*.7z") returned 0
	[0059.651] lstrlenA (lpString="*.7z") returned 4
	[0059.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01749_.GIF", pszSpec="*.tar") returned 0
	[0059.651] lstrlenA (lpString="*.tar") returned 5
	[0059.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01749_.GIF", pszSpec="*.gzip") returned 0
	[0059.651] lstrlenA (lpString="*.gzip") returned 6
	[0059.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01749_.GIF", pszSpec="*.jpg") returned 0
	[0059.651] lstrlenA (lpString="*.jpg") returned 5
	[0059.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01749_.GIF", pszSpec="*.jpeg") returned 0
	[0059.651] lstrlenA (lpString="*.jpeg") returned 6
	[0059.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01749_.GIF", pszSpec="*.bmp") returned 0
	[0059.651] lstrlenA (lpString="*.bmp") returned 5
	[0059.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01749_.GIF", pszSpec="*.gif") returned 1
	[0059.651] lstrlenA (lpString="*.gif") returned 5
	[0059.651] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01749_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01749_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01749_.GIF"
	[0059.652] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01749_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01749_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01749_.GIF"
	[0059.652] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01749_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01749_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01749_.GIF."
	[0059.652] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01749_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01749_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01749_.GIF.exe"
	[0059.652] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01749_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.652] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b4
	[0059.652] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x104b75c6, dwHighDateTime=0x1d327e8)) returned 1
	[0059.652] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.652] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x372, lpOverlapped=0x0) returned 1
	[0059.661] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01749_.GIF") returned="WB01749_.GIF"
	[0059.661] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.661] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x372, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x372, lpOverlapped=0x0) returned 1
	[0059.661] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.661] CloseHandle (hObject=0x214) returned 1
	[0059.662] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01749_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01749_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01749_.gif.exe")) returned 1
	[0059.662] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10c77030, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01750_.GIF", cAlternateFileName="")) returned 1
	[0059.662] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.662] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01750_.GIF") returned -1
	[0059.662] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01750_.GIF") returned -1
	[0059.662] lstrcmpiA (lpString1="", lpString2="WB01750_.GIF") returned -1
	[0059.662] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01749_.GIF") returned="WB01749_.GIF"
	[0059.662] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.662] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.662] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.662] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.662] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01750_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01750_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01750_.GIF"
	[0059.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01750_.GIF", pszSpec="*.zip") returned 0
	[0059.662] lstrlenA (lpString="*.zip") returned 5
	[0059.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01750_.GIF", pszSpec="*.rar") returned 0
	[0059.663] lstrlenA (lpString="*.rar") returned 5
	[0059.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01750_.GIF", pszSpec="*.7z") returned 0
	[0059.663] lstrlenA (lpString="*.7z") returned 4
	[0059.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01750_.GIF", pszSpec="*.tar") returned 0
	[0059.663] lstrlenA (lpString="*.tar") returned 5
	[0059.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01750_.GIF", pszSpec="*.gzip") returned 0
	[0059.663] lstrlenA (lpString="*.gzip") returned 6
	[0059.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01750_.GIF", pszSpec="*.jpg") returned 0
	[0059.663] lstrlenA (lpString="*.jpg") returned 5
	[0059.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01750_.GIF", pszSpec="*.jpeg") returned 0
	[0059.663] lstrlenA (lpString="*.jpeg") returned 6
	[0059.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01750_.GIF", pszSpec="*.bmp") returned 0
	[0059.663] lstrlenA (lpString="*.bmp") returned 5
	[0059.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01750_.GIF", pszSpec="*.gif") returned 1
	[0059.663] lstrlenA (lpString="*.gif") returned 5
	[0059.663] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01750_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01750_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01750_.GIF"
	[0059.663] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01750_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01750_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01750_.GIF"
	[0059.663] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01750_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01750_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01750_.GIF."
	[0059.663] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01750_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01750_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01750_.GIF.exe"
	[0059.663] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01750_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.664] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x494
	[0059.664] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x104b75c6, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x104b75c6, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x10c77030, dwHighDateTime=0x1d327e8)) returned 1
	[0059.664] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.664] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x452, lpOverlapped=0x0) returned 1
	[0059.672] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01750_.GIF") returned="WB01750_.GIF"
	[0059.672] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.672] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x452, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x452, lpOverlapped=0x0) returned 1
	[0059.672] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.672] CloseHandle (hObject=0x214) returned 1
	[0059.672] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01750_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01750_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01750_.gif.exe")) returned 1
	[0059.675] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10c77030, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01751_.GIF", cAlternateFileName="")) returned 1
	[0059.675] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.675] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01751_.GIF") returned -1
	[0059.675] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01751_.GIF") returned -1
	[0059.675] lstrcmpiA (lpString1="", lpString2="WB01751_.GIF") returned -1
	[0059.675] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01750_.GIF") returned="WB01750_.GIF"
	[0059.675] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.675] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.675] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.675] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.676] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01751_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01751_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01751_.GIF"
	[0059.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01751_.GIF", pszSpec="*.zip") returned 0
	[0059.676] lstrlenA (lpString="*.zip") returned 5
	[0059.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01751_.GIF", pszSpec="*.rar") returned 0
	[0059.676] lstrlenA (lpString="*.rar") returned 5
	[0059.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01751_.GIF", pszSpec="*.7z") returned 0
	[0059.676] lstrlenA (lpString="*.7z") returned 4
	[0059.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01751_.GIF", pszSpec="*.tar") returned 0
	[0059.676] lstrlenA (lpString="*.tar") returned 5
	[0059.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01751_.GIF", pszSpec="*.gzip") returned 0
	[0059.676] lstrlenA (lpString="*.gzip") returned 6
	[0059.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01751_.GIF", pszSpec="*.jpg") returned 0
	[0059.676] lstrlenA (lpString="*.jpg") returned 5
	[0059.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01751_.GIF", pszSpec="*.jpeg") returned 0
	[0059.676] lstrlenA (lpString="*.jpeg") returned 6
	[0059.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01751_.GIF", pszSpec="*.bmp") returned 0
	[0059.676] lstrlenA (lpString="*.bmp") returned 5
	[0059.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01751_.GIF", pszSpec="*.gif") returned 1
	[0059.676] lstrlenA (lpString="*.gif") returned 5
	[0059.676] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01751_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01751_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01751_.GIF"
	[0059.676] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01751_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01751_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01751_.GIF"
	[0059.676] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01751_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01751_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01751_.GIF."
	[0059.676] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01751_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01751_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01751_.GIF.exe"
	[0059.676] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01751_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.676] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b9
	[0059.676] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x104b75c6, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x104b75c6, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x10c77030, dwHighDateTime=0x1d327e8)) returned 1
	[0059.676] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.677] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x377, lpOverlapped=0x0) returned 1
	[0059.694] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01751_.GIF") returned="WB01751_.GIF"
	[0059.694] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.694] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x377, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x377, lpOverlapped=0x0) returned 1
	[0059.694] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.694] CloseHandle (hObject=0x214) returned 1
	[0059.694] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01751_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01751_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01751_.gif.exe")) returned 1
	[0059.695] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10c77030, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x304, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01770_.GIF", cAlternateFileName="")) returned 1
	[0059.695] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.695] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01770_.GIF") returned -1
	[0059.695] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01770_.GIF") returned -1
	[0059.695] lstrcmpiA (lpString1="", lpString2="WB01770_.GIF") returned -1
	[0059.695] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01751_.GIF") returned="WB01751_.GIF"
	[0059.695] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.695] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.695] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.695] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.695] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01770_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01770_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01770_.GIF"
	[0059.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01770_.GIF", pszSpec="*.zip") returned 0
	[0059.695] lstrlenA (lpString="*.zip") returned 5
	[0059.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01770_.GIF", pszSpec="*.rar") returned 0
	[0059.695] lstrlenA (lpString="*.rar") returned 5
	[0059.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01770_.GIF", pszSpec="*.7z") returned 0
	[0059.695] lstrlenA (lpString="*.7z") returned 4
	[0059.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01770_.GIF", pszSpec="*.tar") returned 0
	[0059.696] lstrlenA (lpString="*.tar") returned 5
	[0059.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01770_.GIF", pszSpec="*.gzip") returned 0
	[0059.696] lstrlenA (lpString="*.gzip") returned 6
	[0059.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01770_.GIF", pszSpec="*.jpg") returned 0
	[0059.696] lstrlenA (lpString="*.jpg") returned 5
	[0059.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01770_.GIF", pszSpec="*.jpeg") returned 0
	[0059.696] lstrlenA (lpString="*.jpeg") returned 6
	[0059.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01770_.GIF", pszSpec="*.bmp") returned 0
	[0059.696] lstrlenA (lpString="*.bmp") returned 5
	[0059.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01770_.GIF", pszSpec="*.gif") returned 1
	[0059.696] lstrlenA (lpString="*.gif") returned 5
	[0059.696] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01770_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01770_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01770_.GIF"
	[0059.696] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01770_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01770_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01770_.GIF"
	[0059.696] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01770_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01770_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01770_.GIF."
	[0059.696] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01770_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01770_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01770_.GIF.exe"
	[0059.696] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01770_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.696] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x304
	[0059.696] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x104b75c6, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x104b75c6, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x10c77030, dwHighDateTime=0x1d327e8)) returned 1
	[0059.696] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.696] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x2c2, lpOverlapped=0x0) returned 1
	[0059.703] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01770_.GIF") returned="WB01770_.GIF"
	[0059.703] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.703] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x2c2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x2c2, lpOverlapped=0x0) returned 1
	[0059.704] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.704] CloseHandle (hObject=0x214) returned 1
	[0059.704] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01770_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01770_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01770_.gif.exe")) returned 1
	[0059.704] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01838_.GIF", cAlternateFileName="")) returned 1
	[0059.704] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.704] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01838_.GIF") returned -1
	[0059.704] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01838_.GIF") returned -1
	[0059.704] lstrcmpiA (lpString1="", lpString2="WB01838_.GIF") returned -1
	[0059.704] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01770_.GIF") returned="WB01770_.GIF"
	[0059.704] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.704] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.705] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.705] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.705] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01838_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01838_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01838_.GIF"
	[0059.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01838_.GIF", pszSpec="*.zip") returned 0
	[0059.705] lstrlenA (lpString="*.zip") returned 5
	[0059.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01838_.GIF", pszSpec="*.rar") returned 0
	[0059.705] lstrlenA (lpString="*.rar") returned 5
	[0059.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01838_.GIF", pszSpec="*.7z") returned 0
	[0059.705] lstrlenA (lpString="*.7z") returned 4
	[0059.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01838_.GIF", pszSpec="*.tar") returned 0
	[0059.705] lstrlenA (lpString="*.tar") returned 5
	[0059.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01838_.GIF", pszSpec="*.gzip") returned 0
	[0059.705] lstrlenA (lpString="*.gzip") returned 6
	[0059.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01838_.GIF", pszSpec="*.jpg") returned 0
	[0059.705] lstrlenA (lpString="*.jpg") returned 5
	[0059.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01838_.GIF", pszSpec="*.jpeg") returned 0
	[0059.705] lstrlenA (lpString="*.jpeg") returned 6
	[0059.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01838_.GIF", pszSpec="*.bmp") returned 0
	[0059.705] lstrlenA (lpString="*.bmp") returned 5
	[0059.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01838_.GIF", pszSpec="*.gif") returned 1
	[0059.705] lstrlenA (lpString="*.gif") returned 5
	[0059.705] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01838_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01838_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01838_.GIF"
	[0059.705] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01838_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01838_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01838_.GIF"
	[0059.705] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01838_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01838_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01838_.GIF."
	[0059.705] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01838_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01838_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01838_.GIF.exe"
	[0059.705] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01838_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.706] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe44
	[0059.706] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x104b75c6, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x104b75c6, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x104b75c6, dwHighDateTime=0x1d327e8)) returned 1
	[0059.706] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.706] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xe02, lpOverlapped=0x0) returned 1
	[0059.713] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01838_.GIF") returned="WB01838_.GIF"
	[0059.713] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.713] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xe02, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xe02, lpOverlapped=0x0) returned 1
	[0059.713] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.713] CloseHandle (hObject=0x214) returned 1
	[0059.713] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01838_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01838_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01838_.gif.exe")) returned 1
	[0059.714] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01839_.GIF", cAlternateFileName="")) returned 1
	[0059.714] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.714] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01839_.GIF") returned -1
	[0059.714] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01839_.GIF") returned -1
	[0059.714] lstrcmpiA (lpString1="", lpString2="WB01839_.GIF") returned -1
	[0059.714] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01838_.GIF") returned="WB01838_.GIF"
	[0059.714] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.714] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.714] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.714] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.714] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01839_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01839_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01839_.GIF"
	[0059.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01839_.GIF", pszSpec="*.zip") returned 0
	[0059.714] lstrlenA (lpString="*.zip") returned 5
	[0059.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01839_.GIF", pszSpec="*.rar") returned 0
	[0059.714] lstrlenA (lpString="*.rar") returned 5
	[0059.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01839_.GIF", pszSpec="*.7z") returned 0
	[0059.714] lstrlenA (lpString="*.7z") returned 4
	[0059.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01839_.GIF", pszSpec="*.tar") returned 0
	[0059.714] lstrlenA (lpString="*.tar") returned 5
	[0059.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01839_.GIF", pszSpec="*.gzip") returned 0
	[0059.715] lstrlenA (lpString="*.gzip") returned 6
	[0059.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01839_.GIF", pszSpec="*.jpg") returned 0
	[0059.715] lstrlenA (lpString="*.jpg") returned 5
	[0059.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01839_.GIF", pszSpec="*.jpeg") returned 0
	[0059.715] lstrlenA (lpString="*.jpeg") returned 6
	[0059.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01839_.GIF", pszSpec="*.bmp") returned 0
	[0059.715] lstrlenA (lpString="*.bmp") returned 5
	[0059.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01839_.GIF", pszSpec="*.gif") returned 1
	[0059.715] lstrlenA (lpString="*.gif") returned 5
	[0059.715] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01839_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01839_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01839_.GIF"
	[0059.715] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01839_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01839_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01839_.GIF"
	[0059.715] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01839_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01839_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01839_.GIF."
	[0059.715] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01839_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01839_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01839_.GIF.exe"
	[0059.715] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01839_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.715] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x446
	[0059.715] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x104b75c6, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x104b75c6, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x104b75c6, dwHighDateTime=0x1d327e8)) returned 1
	[0059.715] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.715] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x404, lpOverlapped=0x0) returned 1
	[0059.722] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01839_.GIF") returned="WB01839_.GIF"
	[0059.722] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.722] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x404, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x404, lpOverlapped=0x0) returned 1
	[0059.722] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.722] CloseHandle (hObject=0x214) returned 1
	[0059.722] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01839_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01839_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01839_.gif.exe")) returned 1
	[0059.723] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1107d049, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1107d049, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1107d049, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01840_.GIF", cAlternateFileName="")) returned 1
	[0059.723] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.723] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01840_.GIF") returned -1
	[0059.723] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01840_.GIF") returned -1
	[0059.723] lstrcmpiA (lpString1="", lpString2="WB01840_.GIF") returned -1
	[0059.723] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01839_.GIF") returned="WB01839_.GIF"
	[0059.723] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.723] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.723] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.723] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.723] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01840_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01840_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01840_.GIF"
	[0059.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01840_.GIF", pszSpec="*.zip") returned 0
	[0059.723] lstrlenA (lpString="*.zip") returned 5
	[0059.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01840_.GIF", pszSpec="*.rar") returned 0
	[0059.723] lstrlenA (lpString="*.rar") returned 5
	[0059.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01840_.GIF", pszSpec="*.7z") returned 0
	[0059.723] lstrlenA (lpString="*.7z") returned 4
	[0059.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01840_.GIF", pszSpec="*.tar") returned 0
	[0059.723] lstrlenA (lpString="*.tar") returned 5
	[0059.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01840_.GIF", pszSpec="*.gzip") returned 0
	[0059.723] lstrlenA (lpString="*.gzip") returned 6
	[0059.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01840_.GIF", pszSpec="*.jpg") returned 0
	[0059.723] lstrlenA (lpString="*.jpg") returned 5
	[0059.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01840_.GIF", pszSpec="*.jpeg") returned 0
	[0059.723] lstrlenA (lpString="*.jpeg") returned 6
	[0059.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01840_.GIF", pszSpec="*.bmp") returned 0
	[0059.724] lstrlenA (lpString="*.bmp") returned 5
	[0059.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01840_.GIF", pszSpec="*.gif") returned 1
	[0059.724] lstrlenA (lpString="*.gif") returned 5
	[0059.724] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01840_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01840_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01840_.GIF"
	[0059.724] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01840_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01840_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01840_.GIF"
	[0059.724] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01840_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01840_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01840_.GIF."
	[0059.724] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01840_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01840_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01840_.GIF.exe"
	[0059.724] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01840_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.724] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5fe
	[0059.724] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8)) returned 1
	[0059.725] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.725] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x5bc, lpOverlapped=0x0) returned 1
	[0059.727] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01840_.GIF") returned="WB01840_.GIF"
	[0059.727] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.727] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x5bc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x5bc, lpOverlapped=0x0) returned 1
	[0059.727] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.727] CloseHandle (hObject=0x214) returned 1
	[0059.727] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01840_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01840_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01840_.gif.exe")) returned 1
	[0059.728] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10491364, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10491364, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x76c, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01842_.GIF", cAlternateFileName="")) returned 1
	[0059.728] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.735] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01842_.GIF") returned -1
	[0059.735] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01842_.GIF") returned -1
	[0059.735] lstrcmpiA (lpString1="", lpString2="WB01842_.GIF") returned -1
	[0059.735] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01840_.GIF") returned="WB01840_.GIF"
	[0059.735] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.735] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.735] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.735] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.735] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01842_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01842_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01842_.GIF"
	[0059.735] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01842_.GIF", pszSpec="*.zip") returned 0
	[0059.735] lstrlenA (lpString="*.zip") returned 5
	[0059.735] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01842_.GIF", pszSpec="*.rar") returned 0
	[0059.735] lstrlenA (lpString="*.rar") returned 5
	[0059.735] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01842_.GIF", pszSpec="*.7z") returned 0
	[0059.735] lstrlenA (lpString="*.7z") returned 4
	[0059.735] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01842_.GIF", pszSpec="*.tar") returned 0
	[0059.735] lstrlenA (lpString="*.tar") returned 5
	[0059.735] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01842_.GIF", pszSpec="*.gzip") returned 0
	[0059.735] lstrlenA (lpString="*.gzip") returned 6
	[0059.735] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01842_.GIF", pszSpec="*.jpg") returned 0
	[0059.735] lstrlenA (lpString="*.jpg") returned 5
	[0059.735] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01842_.GIF", pszSpec="*.jpeg") returned 0
	[0059.735] lstrlenA (lpString="*.jpeg") returned 6
	[0059.735] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01842_.GIF", pszSpec="*.bmp") returned 0
	[0059.735] lstrlenA (lpString="*.bmp") returned 5
	[0059.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01842_.GIF", pszSpec="*.gif") returned 1
	[0059.736] lstrlenA (lpString="*.gif") returned 5
	[0059.736] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01842_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01842_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01842_.GIF"
	[0059.736] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01842_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01842_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01842_.GIF"
	[0059.736] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01842_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01842_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01842_.GIF."
	[0059.736] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01842_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01842_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01842_.GIF.exe"
	[0059.736] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01842_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.736] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x76c
	[0059.736] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x104b75c6, dwHighDateTime=0x1d327e8)) returned 1
	[0059.736] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.736] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x72a, lpOverlapped=0x0) returned 1
	[0059.742] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01842_.GIF") returned="WB01842_.GIF"
	[0059.742] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.742] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x72a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x72a, lpOverlapped=0x0) returned 1
	[0059.742] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.743] CloseHandle (hObject=0x214) returned 1
	[0059.743] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01842_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01842_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01842_.gif.exe")) returned 1
	[0059.743] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10491364, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10491364, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x12d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01843_.GIF", cAlternateFileName="")) returned 1
	[0059.743] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.743] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01843_.GIF") returned -1
	[0059.743] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01843_.GIF") returned -1
	[0059.743] lstrcmpiA (lpString1="", lpString2="WB01843_.GIF") returned -1
	[0059.743] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01842_.GIF") returned="WB01842_.GIF"
	[0059.743] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.743] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.743] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.743] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.744] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB01843_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01843_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01843_.GIF"
	[0059.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01843_.GIF", pszSpec="*.zip") returned 0
	[0059.744] lstrlenA (lpString="*.zip") returned 5
	[0059.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01843_.GIF", pszSpec="*.rar") returned 0
	[0059.744] lstrlenA (lpString="*.rar") returned 5
	[0059.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01843_.GIF", pszSpec="*.7z") returned 0
	[0059.744] lstrlenA (lpString="*.7z") returned 4
	[0059.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01843_.GIF", pszSpec="*.tar") returned 0
	[0059.744] lstrlenA (lpString="*.tar") returned 5
	[0059.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01843_.GIF", pszSpec="*.gzip") returned 0
	[0059.744] lstrlenA (lpString="*.gzip") returned 6
	[0059.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01843_.GIF", pszSpec="*.jpg") returned 0
	[0059.744] lstrlenA (lpString="*.jpg") returned 5
	[0059.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01843_.GIF", pszSpec="*.jpeg") returned 0
	[0059.744] lstrlenA (lpString="*.jpeg") returned 6
	[0059.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01843_.GIF", pszSpec="*.bmp") returned 0
	[0059.744] lstrlenA (lpString="*.bmp") returned 5
	[0059.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01843_.GIF", pszSpec="*.gif") returned 1
	[0059.744] lstrlenA (lpString="*.gif") returned 5
	[0059.744] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01843_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01843_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01843_.GIF"
	[0059.744] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01843_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01843_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01843_.GIF"
	[0059.744] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01843_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01843_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01843_.GIF."
	[0059.744] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01843_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01843_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01843_.GIF.exe"
	[0059.744] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01843_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.744] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12d1
	[0059.745] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x10491364, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x104b75c6, dwHighDateTime=0x1d327e8)) returned 1
	[0059.745] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.745] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x128f, lpOverlapped=0x0) returned 1
	[0059.748] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01843_.GIF") returned="WB01843_.GIF"
	[0059.748] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.748] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x128f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x128f, lpOverlapped=0x0) returned 1
	[0059.749] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.749] CloseHandle (hObject=0x214) returned 1
	[0059.749] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01843_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01843_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01843_.gif.exe")) returned 1
	[0059.749] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x110a3267, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x110a3267, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x110c9494, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x102b, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02229_.GIF", cAlternateFileName="")) returned 1
	[0059.749] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.749] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB02229_.GIF") returned -1
	[0059.749] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB02229_.GIF") returned -1
	[0059.749] lstrcmpiA (lpString1="", lpString2="WB02229_.GIF") returned -1
	[0059.749] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01843_.GIF") returned="WB01843_.GIF"
	[0059.749] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.750] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.750] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.750] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.750] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WB02229_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB02229_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB02229_.GIF"
	[0059.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB02229_.GIF", pszSpec="*.zip") returned 0
	[0059.750] lstrlenA (lpString="*.zip") returned 5
	[0059.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB02229_.GIF", pszSpec="*.rar") returned 0
	[0059.750] lstrlenA (lpString="*.rar") returned 5
	[0059.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB02229_.GIF", pszSpec="*.7z") returned 0
	[0059.750] lstrlenA (lpString="*.7z") returned 4
	[0059.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB02229_.GIF", pszSpec="*.tar") returned 0
	[0059.750] lstrlenA (lpString="*.tar") returned 5
	[0059.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB02229_.GIF", pszSpec="*.gzip") returned 0
	[0059.750] lstrlenA (lpString="*.gzip") returned 6
	[0059.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB02229_.GIF", pszSpec="*.jpg") returned 0
	[0059.750] lstrlenA (lpString="*.jpg") returned 5
	[0059.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB02229_.GIF", pszSpec="*.jpeg") returned 0
	[0059.750] lstrlenA (lpString="*.jpeg") returned 6
	[0059.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB02229_.GIF", pszSpec="*.bmp") returned 0
	[0059.750] lstrlenA (lpString="*.bmp") returned 5
	[0059.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB02229_.GIF", pszSpec="*.gif") returned 1
	[0059.750] lstrlenA (lpString="*.gif") returned 5
	[0059.750] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB02229_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB02229_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB02229_.GIF"
	[0059.750] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB02229_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB02229_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB02229_.GIF"
	[0059.750] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB02229_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB02229_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB02229_.GIF."
	[0059.750] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB02229_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB02229_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB02229_.GIF.exe"
	[0059.750] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB02229_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb02229_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0059.752] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x102b
	[0059.753] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x110a3267, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x110a3267, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x110c9494, dwHighDateTime=0x1d327e8)) returned 1
	[0059.753] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.753] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xfe9, lpOverlapped=0x0) returned 1
	[0059.754] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB02229_.GIF") returned="WB02229_.GIF"
	[0059.754] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.754] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xfe9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xfe9, lpOverlapped=0x0) returned 1
	[0059.754] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.754] CloseHandle (hObject=0x214) returned 1
	[0059.754] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB02229_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb02229_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB02229_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb02229_.gif.exe")) returned 1
	[0059.755] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x110a3267, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x110a3267, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x110c9494, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHIRL1.WMF", cAlternateFileName="")) returned 1
	[0059.755] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.755] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WHIRL1.WMF") returned -1
	[0059.755] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WHIRL1.WMF") returned -1
	[0059.755] lstrcmpiA (lpString1="", lpString2="WHIRL1.WMF") returned -1
	[0059.755] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB02229_.GIF") returned="WB02229_.GIF"
	[0059.755] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.755] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.755] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.755] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.755] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WHIRL1.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF"
	[0059.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.zip") returned 0
	[0059.755] lstrlenA (lpString="*.zip") returned 5
	[0059.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.rar") returned 0
	[0059.755] lstrlenA (lpString="*.rar") returned 5
	[0059.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.7z") returned 0
	[0059.755] lstrlenA (lpString="*.7z") returned 4
	[0059.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.tar") returned 0
	[0059.755] lstrlenA (lpString="*.tar") returned 5
	[0059.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.gzip") returned 0
	[0059.755] lstrlenA (lpString="*.gzip") returned 6
	[0059.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.jpg") returned 0
	[0059.756] lstrlenA (lpString="*.jpg") returned 5
	[0059.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.jpeg") returned 0
	[0059.756] lstrlenA (lpString="*.jpeg") returned 6
	[0059.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.bmp") returned 0
	[0059.756] lstrlenA (lpString="*.bmp") returned 5
	[0059.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.gif") returned 0
	[0059.756] lstrlenA (lpString="*.gif") returned 5
	[0059.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.png") returned 0
	[0059.756] lstrlenA (lpString="*.png") returned 5
	[0059.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.doc") returned 0
	[0059.756] lstrlenA (lpString="*.doc") returned 5
	[0059.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.docx") returned 0
	[0059.756] lstrlenA (lpString="*.docx") returned 6
	[0059.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.xls") returned 0
	[0059.756] lstrlenA (lpString="*.xls") returned 5
	[0059.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.xlsx") returned 0
	[0059.756] lstrlenA (lpString="*.xlsx") returned 6
	[0059.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.ppt") returned 0
	[0059.756] lstrlenA (lpString="*.ppt") returned 5
	[0059.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.pptx") returned 0
	[0059.756] lstrlenA (lpString="*.pptx") returned 6
	[0059.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.txt") returned 0
	[0059.756] lstrlenA (lpString="*.txt") returned 5
	[0059.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.pdf") returned 0
	[0059.756] lstrlenA (lpString="*.pdf") returned 5
	[0059.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.htm") returned 0
	[0059.756] lstrlenA (lpString="*.htm") returned 5
	[0059.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.html") returned 0
	[0059.756] lstrlenA (lpString="*.html") returned 6
	[0059.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.mdb") returned 0
	[0059.756] lstrlenA (lpString="*.mdb") returned 5
	[0059.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.pfx") returned 0
	[0059.756] lstrlenA (lpString="*.pfx") returned 5
	[0059.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.md") returned 0
	[0059.756] lstrlenA (lpString="*.md") returned 4
	[0059.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.lnk") returned 0
	[0059.756] lstrlenA (lpString="*.lnk") returned 5
	[0059.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.torrent") returned 0
	[0059.757] lstrlenA (lpString="*.torrent") returned 9
	[0059.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.mov") returned 0
	[0059.757] lstrlenA (lpString="*.mov") returned 5
	[0059.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.3gp") returned 0
	[0059.757] lstrlenA (lpString="*.3gp") returned 5
	[0059.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.mpeg") returned 0
	[0059.757] lstrlenA (lpString="*.mpeg") returned 6
	[0059.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.mpg") returned 0
	[0059.757] lstrlenA (lpString="*.mpg") returned 5
	[0059.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.flv") returned 0
	[0059.757] lstrlenA (lpString="*.flv") returned 5
	[0059.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.avi") returned 0
	[0059.757] lstrlenA (lpString="*.avi") returned 5
	[0059.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.mp4") returned 0
	[0059.757] lstrlenA (lpString="*.mp4") returned 5
	[0059.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.wmv") returned 0
	[0059.757] lstrlenA (lpString="*.wmv") returned 5
	[0059.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.mkv") returned 0
	[0059.757] lstrlenA (lpString="*.mkv") returned 5
	[0059.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.mp3") returned 0
	[0059.757] lstrlenA (lpString="*.mp3") returned 5
	[0059.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.wav") returned 0
	[0059.757] lstrlenA (lpString="*.wav") returned 5
	[0059.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.flac") returned 0
	[0059.757] lstrlenA (lpString="*.flac") returned 6
	[0059.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.wma") returned 0
	[0059.757] lstrlenA (lpString="*.wma") returned 5
	[0059.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.au3") returned 0
	[0059.757] lstrlenA (lpString="*.au3") returned 5
	[0059.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.ahk") returned 0
	[0059.757] lstrlenA (lpString="*.ahk") returned 5
	[0059.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.c") returned 0
	[0059.757] lstrlenA (lpString="*.c") returned 3
	[0059.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.cc") returned 0
	[0059.757] lstrlenA (lpString="*.cc") returned 4
	[0059.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.cpp") returned 0
	[0059.758] lstrlenA (lpString="*.cpp") returned 5
	[0059.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.cxx") returned 0
	[0059.758] lstrlenA (lpString="*.cxx") returned 5
	[0059.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.c++") returned 0
	[0059.758] lstrlenA (lpString="*.c++") returned 5
	[0059.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.cs") returned 0
	[0059.758] lstrlenA (lpString="*.cs") returned 4
	[0059.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.vb") returned 0
	[0059.758] lstrlenA (lpString="*.vb") returned 4
	[0059.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.bas") returned 0
	[0059.758] lstrlenA (lpString="*.bas") returned 5
	[0059.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.csproj") returned 0
	[0059.758] lstrlenA (lpString="*.csproj") returned 8
	[0059.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.vbproj") returned 0
	[0059.758] lstrlenA (lpString="*.vbproj") returned 8
	[0059.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.vcxproj") returned 0
	[0059.758] lstrlenA (lpString="*.vcxproj") returned 9
	[0059.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.manifest") returned 0
	[0059.758] lstrlenA (lpString="*.manifest") returned 10
	[0059.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.php") returned 0
	[0059.758] lstrlenA (lpString="*.php") returned 5
	[0059.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.vbe") returned 0
	[0059.758] lstrlenA (lpString="*.vbe") returned 5
	[0059.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.vba") returned 0
	[0059.758] lstrlenA (lpString="*.vba") returned 5
	[0059.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.vbs") returned 0
	[0059.758] lstrlenA (lpString="*.vbs") returned 5
	[0059.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.bat") returned 0
	[0059.758] lstrlenA (lpString="*.bat") returned 5
	[0059.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.cmd") returned 0
	[0059.758] lstrlenA (lpString="*.cmd") returned 5
	[0059.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.js") returned 0
	[0059.758] lstrlenA (lpString="*.js") returned 4
	[0059.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.jscript") returned 0
	[0059.758] lstrlenA (lpString="*.jscript") returned 9
	[0059.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.hta") returned 0
	[0059.758] lstrlenA (lpString="*.hta") returned 5
	[0059.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.php7") returned 0
	[0059.759] lstrlenA (lpString="*.php7") returned 6
	[0059.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.db") returned 0
	[0059.759] lstrlenA (lpString="*.db") returned 4
	[0059.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.swf") returned 0
	[0059.759] lstrlenA (lpString="*.swf") returned 5
	[0059.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.eml") returned 0
	[0059.759] lstrlenA (lpString="*.eml") returned 5
	[0059.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.part") returned 0
	[0059.759] lstrlenA (lpString="*.part") returned 6
	[0059.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.nfo") returned 0
	[0059.759] lstrlenA (lpString="*.nfo") returned 5
	[0059.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.rsa") returned 0
	[0059.759] lstrlenA (lpString="*.rsa") returned 5
	[0059.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.key") returned 0
	[0059.759] lstrlenA (lpString="*.key") returned 5
	[0059.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.aes") returned 0
	[0059.759] lstrlenA (lpString="*.aes") returned 5
	[0059.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.blob") returned 0
	[0059.759] lstrlenA (lpString="*.blob") returned 6
	[0059.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.btc") returned 0
	[0059.759] lstrlenA (lpString="*.btc") returned 5
	[0059.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF", pszSpec="*.wallet") returned 0
	[0059.759] lstrlenA (lpString="*.wallet") returned 8
	[0059.759] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x110a3267, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x110a3267, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x110a3267, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHIRL2.WMF", cAlternateFileName="")) returned 1
	[0059.759] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.759] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WHIRL2.WMF") returned -1
	[0059.759] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WHIRL2.WMF") returned -1
	[0059.759] lstrcmpiA (lpString1="", lpString2="WHIRL2.WMF") returned -1
	[0059.759] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF") returned="WHIRL1.WMF"
	[0059.759] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.759] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.759] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.759] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.760] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WHIRL2.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF"
	[0059.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.zip") returned 0
	[0059.760] lstrlenA (lpString="*.zip") returned 5
	[0059.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.rar") returned 0
	[0059.760] lstrlenA (lpString="*.rar") returned 5
	[0059.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.7z") returned 0
	[0059.760] lstrlenA (lpString="*.7z") returned 4
	[0059.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.tar") returned 0
	[0059.760] lstrlenA (lpString="*.tar") returned 5
	[0059.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.gzip") returned 0
	[0059.760] lstrlenA (lpString="*.gzip") returned 6
	[0059.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.jpg") returned 0
	[0059.760] lstrlenA (lpString="*.jpg") returned 5
	[0059.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.jpeg") returned 0
	[0059.760] lstrlenA (lpString="*.jpeg") returned 6
	[0059.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.bmp") returned 0
	[0059.760] lstrlenA (lpString="*.bmp") returned 5
	[0059.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.gif") returned 0
	[0059.760] lstrlenA (lpString="*.gif") returned 5
	[0059.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.png") returned 0
	[0059.760] lstrlenA (lpString="*.png") returned 5
	[0059.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.doc") returned 0
	[0059.760] lstrlenA (lpString="*.doc") returned 5
	[0059.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.docx") returned 0
	[0059.760] lstrlenA (lpString="*.docx") returned 6
	[0059.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.xls") returned 0
	[0059.760] lstrlenA (lpString="*.xls") returned 5
	[0059.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.xlsx") returned 0
	[0059.760] lstrlenA (lpString="*.xlsx") returned 6
	[0059.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.ppt") returned 0
	[0059.760] lstrlenA (lpString="*.ppt") returned 5
	[0059.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.pptx") returned 0
	[0059.760] lstrlenA (lpString="*.pptx") returned 6
	[0059.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.txt") returned 0
	[0059.760] lstrlenA (lpString="*.txt") returned 5
	[0059.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.pdf") returned 0
	[0059.760] lstrlenA (lpString="*.pdf") returned 5
	[0059.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.htm") returned 0
	[0059.761] lstrlenA (lpString="*.htm") returned 5
	[0059.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.html") returned 0
	[0059.761] lstrlenA (lpString="*.html") returned 6
	[0059.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.mdb") returned 0
	[0059.761] lstrlenA (lpString="*.mdb") returned 5
	[0059.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.pfx") returned 0
	[0059.761] lstrlenA (lpString="*.pfx") returned 5
	[0059.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.md") returned 0
	[0059.761] lstrlenA (lpString="*.md") returned 4
	[0059.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.lnk") returned 0
	[0059.761] lstrlenA (lpString="*.lnk") returned 5
	[0059.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.torrent") returned 0
	[0059.761] lstrlenA (lpString="*.torrent") returned 9
	[0059.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.mov") returned 0
	[0059.761] lstrlenA (lpString="*.mov") returned 5
	[0059.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.3gp") returned 0
	[0059.761] lstrlenA (lpString="*.3gp") returned 5
	[0059.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.mpeg") returned 0
	[0059.761] lstrlenA (lpString="*.mpeg") returned 6
	[0059.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.mpg") returned 0
	[0059.761] lstrlenA (lpString="*.mpg") returned 5
	[0059.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.flv") returned 0
	[0059.761] lstrlenA (lpString="*.flv") returned 5
	[0059.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.avi") returned 0
	[0059.761] lstrlenA (lpString="*.avi") returned 5
	[0059.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.mp4") returned 0
	[0059.761] lstrlenA (lpString="*.mp4") returned 5
	[0059.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.wmv") returned 0
	[0059.761] lstrlenA (lpString="*.wmv") returned 5
	[0059.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.mkv") returned 0
	[0059.761] lstrlenA (lpString="*.mkv") returned 5
	[0059.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.mp3") returned 0
	[0059.761] lstrlenA (lpString="*.mp3") returned 5
	[0059.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.wav") returned 0
	[0059.761] lstrlenA (lpString="*.wav") returned 5
	[0059.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.flac") returned 0
	[0059.762] lstrlenA (lpString="*.flac") returned 6
	[0059.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.wma") returned 0
	[0059.762] lstrlenA (lpString="*.wma") returned 5
	[0059.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.au3") returned 0
	[0059.762] lstrlenA (lpString="*.au3") returned 5
	[0059.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.ahk") returned 0
	[0059.762] lstrlenA (lpString="*.ahk") returned 5
	[0059.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.c") returned 0
	[0059.762] lstrlenA (lpString="*.c") returned 3
	[0059.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.cc") returned 0
	[0059.762] lstrlenA (lpString="*.cc") returned 4
	[0059.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.cpp") returned 0
	[0059.762] lstrlenA (lpString="*.cpp") returned 5
	[0059.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.cxx") returned 0
	[0059.762] lstrlenA (lpString="*.cxx") returned 5
	[0059.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.c++") returned 0
	[0059.762] lstrlenA (lpString="*.c++") returned 5
	[0059.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.cs") returned 0
	[0059.762] lstrlenA (lpString="*.cs") returned 4
	[0059.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.vb") returned 0
	[0059.762] lstrlenA (lpString="*.vb") returned 4
	[0059.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.bas") returned 0
	[0059.762] lstrlenA (lpString="*.bas") returned 5
	[0059.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.csproj") returned 0
	[0059.762] lstrlenA (lpString="*.csproj") returned 8
	[0059.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.vbproj") returned 0
	[0059.762] lstrlenA (lpString="*.vbproj") returned 8
	[0059.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.vcxproj") returned 0
	[0059.762] lstrlenA (lpString="*.vcxproj") returned 9
	[0059.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.manifest") returned 0
	[0059.762] lstrlenA (lpString="*.manifest") returned 10
	[0059.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.php") returned 0
	[0059.762] lstrlenA (lpString="*.php") returned 5
	[0059.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.vbe") returned 0
	[0059.762] lstrlenA (lpString="*.vbe") returned 5
	[0059.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.vba") returned 0
	[0059.762] lstrlenA (lpString="*.vba") returned 5
	[0059.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.vbs") returned 0
	[0059.763] lstrlenA (lpString="*.vbs") returned 5
	[0059.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.bat") returned 0
	[0059.763] lstrlenA (lpString="*.bat") returned 5
	[0059.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.cmd") returned 0
	[0059.763] lstrlenA (lpString="*.cmd") returned 5
	[0059.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.js") returned 0
	[0059.763] lstrlenA (lpString="*.js") returned 4
	[0059.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.jscript") returned 0
	[0059.872] lstrlenA (lpString="*.jscript") returned 9
	[0059.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.hta") returned 0
	[0059.873] lstrlenA (lpString="*.hta") returned 5
	[0059.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.php7") returned 0
	[0059.873] lstrlenA (lpString="*.php7") returned 6
	[0059.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.db") returned 0
	[0059.873] lstrlenA (lpString="*.db") returned 4
	[0059.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.swf") returned 0
	[0059.873] lstrlenA (lpString="*.swf") returned 5
	[0059.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.eml") returned 0
	[0059.873] lstrlenA (lpString="*.eml") returned 5
	[0059.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.part") returned 0
	[0059.873] lstrlenA (lpString="*.part") returned 6
	[0059.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.nfo") returned 0
	[0059.873] lstrlenA (lpString="*.nfo") returned 5
	[0059.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.rsa") returned 0
	[0059.873] lstrlenA (lpString="*.rsa") returned 5
	[0059.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.key") returned 0
	[0059.873] lstrlenA (lpString="*.key") returned 5
	[0059.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.aes") returned 0
	[0059.873] lstrlenA (lpString="*.aes") returned 5
	[0059.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.blob") returned 0
	[0059.873] lstrlenA (lpString="*.blob") returned 6
	[0059.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.btc") returned 0
	[0059.873] lstrlenA (lpString="*.btc") returned 5
	[0059.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF", pszSpec="*.wallet") returned 0
	[0059.873] lstrlenA (lpString="*.wallet") returned 8
	[0059.873] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10c2accf, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10c2accf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11030b47, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x0, dwReserved1=0x0, cFileName="WING1.WMF", cAlternateFileName="")) returned 1
	[0059.873] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.873] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WING1.WMF") returned -1
	[0059.873] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WING1.WMF") returned -1
	[0059.873] lstrcmpiA (lpString1="", lpString2="WING1.WMF") returned -1
	[0059.873] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF") returned="WHIRL2.WMF"
	[0059.873] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.874] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.874] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.874] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.874] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WING1.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF"
	[0059.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.zip") returned 0
	[0059.874] lstrlenA (lpString="*.zip") returned 5
	[0059.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.rar") returned 0
	[0059.874] lstrlenA (lpString="*.rar") returned 5
	[0059.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.7z") returned 0
	[0059.874] lstrlenA (lpString="*.7z") returned 4
	[0059.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.tar") returned 0
	[0059.874] lstrlenA (lpString="*.tar") returned 5
	[0059.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.gzip") returned 0
	[0059.874] lstrlenA (lpString="*.gzip") returned 6
	[0059.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.jpg") returned 0
	[0059.874] lstrlenA (lpString="*.jpg") returned 5
	[0059.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.jpeg") returned 0
	[0059.874] lstrlenA (lpString="*.jpeg") returned 6
	[0059.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.bmp") returned 0
	[0059.874] lstrlenA (lpString="*.bmp") returned 5
	[0059.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.gif") returned 0
	[0059.874] lstrlenA (lpString="*.gif") returned 5
	[0059.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.png") returned 0
	[0059.874] lstrlenA (lpString="*.png") returned 5
	[0059.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.doc") returned 0
	[0059.874] lstrlenA (lpString="*.doc") returned 5
	[0059.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.docx") returned 0
	[0059.874] lstrlenA (lpString="*.docx") returned 6
	[0059.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.xls") returned 0
	[0059.875] lstrlenA (lpString="*.xls") returned 5
	[0059.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.xlsx") returned 0
	[0059.875] lstrlenA (lpString="*.xlsx") returned 6
	[0059.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.ppt") returned 0
	[0059.875] lstrlenA (lpString="*.ppt") returned 5
	[0059.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.pptx") returned 0
	[0059.875] lstrlenA (lpString="*.pptx") returned 6
	[0059.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.txt") returned 0
	[0059.875] lstrlenA (lpString="*.txt") returned 5
	[0059.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.pdf") returned 0
	[0059.875] lstrlenA (lpString="*.pdf") returned 5
	[0059.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.htm") returned 0
	[0059.875] lstrlenA (lpString="*.htm") returned 5
	[0059.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.html") returned 0
	[0059.875] lstrlenA (lpString="*.html") returned 6
	[0059.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.mdb") returned 0
	[0059.875] lstrlenA (lpString="*.mdb") returned 5
	[0059.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.pfx") returned 0
	[0059.875] lstrlenA (lpString="*.pfx") returned 5
	[0059.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.md") returned 0
	[0059.875] lstrlenA (lpString="*.md") returned 4
	[0059.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.lnk") returned 0
	[0059.875] lstrlenA (lpString="*.lnk") returned 5
	[0059.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.torrent") returned 0
	[0059.875] lstrlenA (lpString="*.torrent") returned 9
	[0059.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.mov") returned 0
	[0059.875] lstrlenA (lpString="*.mov") returned 5
	[0059.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.3gp") returned 0
	[0059.875] lstrlenA (lpString="*.3gp") returned 5
	[0059.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.mpeg") returned 0
	[0059.875] lstrlenA (lpString="*.mpeg") returned 6
	[0059.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.mpg") returned 0
	[0059.875] lstrlenA (lpString="*.mpg") returned 5
	[0059.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.flv") returned 0
	[0059.875] lstrlenA (lpString="*.flv") returned 5
	[0059.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.avi") returned 0
	[0059.875] lstrlenA (lpString="*.avi") returned 5
	[0059.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.mp4") returned 0
	[0059.876] lstrlenA (lpString="*.mp4") returned 5
	[0059.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.wmv") returned 0
	[0059.876] lstrlenA (lpString="*.wmv") returned 5
	[0059.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.mkv") returned 0
	[0059.876] lstrlenA (lpString="*.mkv") returned 5
	[0059.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.mp3") returned 0
	[0059.876] lstrlenA (lpString="*.mp3") returned 5
	[0059.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.wav") returned 0
	[0059.876] lstrlenA (lpString="*.wav") returned 5
	[0059.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.flac") returned 0
	[0059.876] lstrlenA (lpString="*.flac") returned 6
	[0059.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.wma") returned 0
	[0059.876] lstrlenA (lpString="*.wma") returned 5
	[0059.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.au3") returned 0
	[0059.876] lstrlenA (lpString="*.au3") returned 5
	[0059.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.ahk") returned 0
	[0059.876] lstrlenA (lpString="*.ahk") returned 5
	[0059.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.c") returned 0
	[0059.876] lstrlenA (lpString="*.c") returned 3
	[0059.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.cc") returned 0
	[0059.876] lstrlenA (lpString="*.cc") returned 4
	[0059.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.cpp") returned 0
	[0059.876] lstrlenA (lpString="*.cpp") returned 5
	[0059.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.cxx") returned 0
	[0059.876] lstrlenA (lpString="*.cxx") returned 5
	[0059.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.c++") returned 0
	[0059.876] lstrlenA (lpString="*.c++") returned 5
	[0059.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.cs") returned 0
	[0059.876] lstrlenA (lpString="*.cs") returned 4
	[0059.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.vb") returned 0
	[0059.876] lstrlenA (lpString="*.vb") returned 4
	[0059.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.bas") returned 0
	[0059.876] lstrlenA (lpString="*.bas") returned 5
	[0059.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.csproj") returned 0
	[0059.876] lstrlenA (lpString="*.csproj") returned 8
	[0059.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.vbproj") returned 0
	[0059.877] lstrlenA (lpString="*.vbproj") returned 8
	[0059.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.vcxproj") returned 0
	[0059.877] lstrlenA (lpString="*.vcxproj") returned 9
	[0059.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.manifest") returned 0
	[0059.877] lstrlenA (lpString="*.manifest") returned 10
	[0059.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.php") returned 0
	[0059.877] lstrlenA (lpString="*.php") returned 5
	[0059.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.vbe") returned 0
	[0059.877] lstrlenA (lpString="*.vbe") returned 5
	[0059.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.vba") returned 0
	[0059.877] lstrlenA (lpString="*.vba") returned 5
	[0059.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.vbs") returned 0
	[0059.877] lstrlenA (lpString="*.vbs") returned 5
	[0059.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.bat") returned 0
	[0059.877] lstrlenA (lpString="*.bat") returned 5
	[0059.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.cmd") returned 0
	[0059.877] lstrlenA (lpString="*.cmd") returned 5
	[0059.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.js") returned 0
	[0059.877] lstrlenA (lpString="*.js") returned 4
	[0059.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.jscript") returned 0
	[0059.877] lstrlenA (lpString="*.jscript") returned 9
	[0059.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.hta") returned 0
	[0059.877] lstrlenA (lpString="*.hta") returned 5
	[0059.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.php7") returned 0
	[0059.877] lstrlenA (lpString="*.php7") returned 6
	[0059.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.db") returned 0
	[0059.877] lstrlenA (lpString="*.db") returned 4
	[0059.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.swf") returned 0
	[0059.877] lstrlenA (lpString="*.swf") returned 5
	[0059.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.eml") returned 0
	[0059.877] lstrlenA (lpString="*.eml") returned 5
	[0059.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.part") returned 0
	[0059.877] lstrlenA (lpString="*.part") returned 6
	[0059.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.nfo") returned 0
	[0059.878] lstrlenA (lpString="*.nfo") returned 5
	[0059.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.rsa") returned 0
	[0059.878] lstrlenA (lpString="*.rsa") returned 5
	[0059.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.key") returned 0
	[0059.878] lstrlenA (lpString="*.key") returned 5
	[0059.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.aes") returned 0
	[0059.878] lstrlenA (lpString="*.aes") returned 5
	[0059.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.blob") returned 0
	[0059.878] lstrlenA (lpString="*.blob") returned 6
	[0059.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.btc") returned 0
	[0059.878] lstrlenA (lpString="*.btc") returned 5
	[0059.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF", pszSpec="*.wallet") returned 0
	[0059.878] lstrlenA (lpString="*.wallet") returned 8
	[0059.878] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11030b47, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11030b47, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11030b47, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x0, dwReserved1=0x0, cFileName="WING2.WMF", cAlternateFileName="")) returned 1
	[0059.878] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.878] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WING2.WMF") returned -1
	[0059.878] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WING2.WMF") returned -1
	[0059.878] lstrcmpiA (lpString1="", lpString2="WING2.WMF") returned -1
	[0059.878] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.878] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.878] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.878] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.878] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WING2.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING2.WMF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING2.WMF"
	[0059.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.zip") returned 0
	[0059.878] lstrlenA (lpString="*.zip") returned 5
	[0059.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.rar") returned 0
	[0059.878] lstrlenA (lpString="*.rar") returned 5
	[0059.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.7z") returned 0
	[0059.878] lstrlenA (lpString="*.7z") returned 4
	[0059.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.tar") returned 0
	[0059.878] lstrlenA (lpString="*.tar") returned 5
	[0059.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.gzip") returned 0
	[0059.879] lstrlenA (lpString="*.gzip") returned 6
	[0059.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.jpg") returned 0
	[0059.879] lstrlenA (lpString="*.jpg") returned 5
	[0059.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.jpeg") returned 0
	[0059.879] lstrlenA (lpString="*.jpeg") returned 6
	[0059.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.bmp") returned 0
	[0059.879] lstrlenA (lpString="*.bmp") returned 5
	[0059.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.gif") returned 0
	[0059.879] lstrlenA (lpString="*.gif") returned 5
	[0059.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.png") returned 0
	[0059.879] lstrlenA (lpString="*.png") returned 5
	[0059.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.doc") returned 0
	[0059.879] lstrlenA (lpString="*.doc") returned 5
	[0059.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.docx") returned 0
	[0059.879] lstrlenA (lpString="*.docx") returned 6
	[0059.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.xls") returned 0
	[0059.879] lstrlenA (lpString="*.xls") returned 5
	[0059.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.xlsx") returned 0
	[0059.879] lstrlenA (lpString="*.xlsx") returned 6
	[0059.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.ppt") returned 0
	[0059.879] lstrlenA (lpString="*.ppt") returned 5
	[0059.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.pptx") returned 0
	[0059.879] lstrlenA (lpString="*.pptx") returned 6
	[0059.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.txt") returned 0
	[0059.879] lstrlenA (lpString="*.txt") returned 5
	[0059.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.pdf") returned 0
	[0059.879] lstrlenA (lpString="*.pdf") returned 5
	[0059.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.htm") returned 0
	[0059.879] lstrlenA (lpString="*.htm") returned 5
	[0059.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.html") returned 0
	[0059.879] lstrlenA (lpString="*.html") returned 6
	[0059.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.mdb") returned 0
	[0059.879] lstrlenA (lpString="*.mdb") returned 5
	[0059.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.pfx") returned 0
	[0059.879] lstrlenA (lpString="*.pfx") returned 5
	[0059.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.md") returned 0
	[0059.880] lstrlenA (lpString="*.md") returned 4
	[0059.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.lnk") returned 0
	[0059.880] lstrlenA (lpString="*.lnk") returned 5
	[0059.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.torrent") returned 0
	[0059.880] lstrlenA (lpString="*.torrent") returned 9
	[0059.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.mov") returned 0
	[0059.880] lstrlenA (lpString="*.mov") returned 5
	[0059.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.3gp") returned 0
	[0059.880] lstrlenA (lpString="*.3gp") returned 5
	[0059.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.mpeg") returned 0
	[0059.880] lstrlenA (lpString="*.mpeg") returned 6
	[0059.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.mpg") returned 0
	[0059.880] lstrlenA (lpString="*.mpg") returned 5
	[0059.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING2.WMF", pszSpec="*.flv") returned 0
	[0059.880] lstrlenA (lpString="*.flv") returned 5
	[0059.880] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10c77030, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1b03, dwReserved0=0x0, dwReserved1=0x0, cFileName="WNTER_01.MID", cAlternateFileName="")) returned 1
	[0059.880] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0059.880] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WNTER_01.MID") returned -1
	[0059.880] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WNTER_01.MID") returned -1
	[0059.880] lstrcmpiA (lpString1="", lpString2="WNTER_01.MID") returned -1
	[0059.880] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\"
	[0059.880] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned=""
	[0059.880] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.880] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\how-to-decrypt-files.htm")) returned 0x20
	[0059.881] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", lpString2="WNTER_01.MID" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID"
	[0059.881] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10c77030, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1b03, dwReserved0=0x0, dwReserved1=0x0, cFileName="WNTER_01.MID", cAlternateFileName="")) returned 0
	[0059.881] FindClose (in: hFindFile=0x7cb590 | out: hFindFile=0x7cb590) returned 1
	[0059.881] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1
	[0059.881] lstrcmpA (lpString1=".", lpString2="Publisher") returned -1
	[0059.881] lstrcmpA (lpString1="..", lpString2="Publisher") returned -1
	[0059.881] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\", lpString2="Publisher" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher"
	[0059.881] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb590
	[0059.881] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0059.881] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0059.881] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0059.881] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0059.881] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 1
	[0059.881] lstrcmpA (lpString1=".", lpString2="Backgrounds") returned -1
	[0059.881] lstrcmpA (lpString1="..", lpString2="Backgrounds") returned -1
	[0059.881] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\", lpString2="Backgrounds" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds"
	[0059.881] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffffe, dwReserved1=0x7c82c8, cFileName=".", cAlternateFileName="")) returned 0x7cb650
	[0059.883] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0059.883] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffffe, dwReserved1=0x7c82c8, cFileName="..", cAlternateFileName="")) returned 1
	[0059.883] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0059.883] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0059.883] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11030b47, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11030b47, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11030b47, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf77, dwReserved0=0xfffffffe, dwReserved1=0x7c82c8, cFileName="J0143743.GIF", cAlternateFileName="")) returned 1
	[0059.883] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0059.883] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0143743.GIF") returned -1
	[0059.883] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0143743.GIF") returned -1
	[0059.883] lstrcmpiA (lpString1="", lpString2="J0143743.GIF") returned -1
	[0059.883] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\"
	[0059.883] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0059.883] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM"
	[0059.883] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0059.883] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0059.884] WriteFile (in: hFile=0x218, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0059.885] SetFileTime (hFile=0x218, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0059.885] CloseHandle (hObject=0x218) returned 1
	[0059.886] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="J0143743.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF"
	[0059.886] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF"
	[0059.886] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF"
	[0059.886] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF."
	[0059.886] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.exe"
	[0059.886] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143743.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0059.992] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf77
	[0059.992] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x11030b47, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x11030b47, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x11030b47, dwHighDateTime=0x1d327e8)) returned 1
	[0059.993] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0059.993] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xf35, lpOverlapped=0x0) returned 1
	[0060.019] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF") returned="J0143743.GIF"
	[0060.019] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.019] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xf35, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xf35, lpOverlapped=0x0) returned 1
	[0060.019] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.019] CloseHandle (hObject=0x218) returned 1
	[0060.019] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143743.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143743.gif.exe")) returned 1
	[0060.020] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10c77030, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2f, dwReserved0=0x33, dwReserved1=0x1, cFileName="J0143744.GIF", cAlternateFileName="")) returned 1
	[0060.020] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0060.020] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0143744.GIF") returned -1
	[0060.020] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0143744.GIF") returned -1
	[0060.020] lstrcmpiA (lpString1="", lpString2="J0143744.GIF") returned -1
	[0060.020] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF") returned="J0143743.GIF"
	[0060.020] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\"
	[0060.020] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0060.020] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.020] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\how-to-decrypt-files.htm")) returned 0x20
	[0060.020] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="J0143744.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF"
	[0060.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", pszSpec="*.zip") returned 0
	[0060.020] lstrlenA (lpString="*.zip") returned 5
	[0060.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", pszSpec="*.rar") returned 0
	[0060.020] lstrlenA (lpString="*.rar") returned 5
	[0060.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", pszSpec="*.7z") returned 0
	[0060.020] lstrlenA (lpString="*.7z") returned 4
	[0060.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", pszSpec="*.tar") returned 0
	[0060.020] lstrlenA (lpString="*.tar") returned 5
	[0060.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", pszSpec="*.gzip") returned 0
	[0060.020] lstrlenA (lpString="*.gzip") returned 6
	[0060.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", pszSpec="*.jpg") returned 0
	[0060.020] lstrlenA (lpString="*.jpg") returned 5
	[0060.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", pszSpec="*.jpeg") returned 0
	[0060.020] lstrlenA (lpString="*.jpeg") returned 6
	[0060.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", pszSpec="*.bmp") returned 0
	[0060.020] lstrlenA (lpString="*.bmp") returned 5
	[0060.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", pszSpec="*.gif") returned 1
	[0060.021] lstrlenA (lpString="*.gif") returned 5
	[0060.021] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF"
	[0060.021] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF"
	[0060.021] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF."
	[0060.021] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.exe"
	[0060.021] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143744.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0060.021] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2f
	[0060.021] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x104b75c6, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x104b75c6, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x10c77030, dwHighDateTime=0x1d327e8)) returned 1
	[0060.021] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.021] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x0, lpOverlapped=0x0) returned 1
	[0060.021] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.021] CloseHandle (hObject=0x218) returned 1
	[0060.021] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143744.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143744.gif.exe")) returned 1
	[0060.022] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10c77030, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2dd, dwReserved0=0x33, dwReserved1=0x1, cFileName="J0143745.GIF", cAlternateFileName="")) returned 1
	[0060.022] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0060.022] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0143745.GIF") returned -1
	[0060.022] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0143745.GIF") returned -1
	[0060.022] lstrcmpiA (lpString1="", lpString2="J0143745.GIF") returned -1
	[0060.022] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF") returned="J0143744.GIF"
	[0060.022] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\"
	[0060.022] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0060.022] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.022] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\how-to-decrypt-files.htm")) returned 0x20
	[0060.022] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="J0143745.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF"
	[0060.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", pszSpec="*.zip") returned 0
	[0060.022] lstrlenA (lpString="*.zip") returned 5
	[0060.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", pszSpec="*.rar") returned 0
	[0060.022] lstrlenA (lpString="*.rar") returned 5
	[0060.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", pszSpec="*.7z") returned 0
	[0060.022] lstrlenA (lpString="*.7z") returned 4
	[0060.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", pszSpec="*.tar") returned 0
	[0060.022] lstrlenA (lpString="*.tar") returned 5
	[0060.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", pszSpec="*.gzip") returned 0
	[0060.022] lstrlenA (lpString="*.gzip") returned 6
	[0060.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", pszSpec="*.jpg") returned 0
	[0060.022] lstrlenA (lpString="*.jpg") returned 5
	[0060.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", pszSpec="*.jpeg") returned 0
	[0060.023] lstrlenA (lpString="*.jpeg") returned 6
	[0060.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", pszSpec="*.bmp") returned 0
	[0060.023] lstrlenA (lpString="*.bmp") returned 5
	[0060.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", pszSpec="*.gif") returned 1
	[0060.023] lstrlenA (lpString="*.gif") returned 5
	[0060.023] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF"
	[0060.023] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF"
	[0060.023] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF."
	[0060.023] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.exe"
	[0060.023] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143745.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0060.023] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2dd
	[0060.023] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x104b75c6, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x104b75c6, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x10c77030, dwHighDateTime=0x1d327e8)) returned 1
	[0060.023] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.023] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x29b, lpOverlapped=0x0) returned 1
	[0060.025] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF") returned="J0143745.GIF"
	[0060.025] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.025] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x29b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x29b, lpOverlapped=0x0) returned 1
	[0060.025] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.025] CloseHandle (hObject=0x218) returned 1
	[0060.025] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143745.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143745.gif.exe")) returned 1
	[0060.026] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10c77030, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x595, dwReserved0=0x33, dwReserved1=0x1, cFileName="J0143746.GIF", cAlternateFileName="")) returned 1
	[0060.026] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0060.026] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0143746.GIF") returned -1
	[0060.026] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0143746.GIF") returned -1
	[0060.026] lstrcmpiA (lpString1="", lpString2="J0143746.GIF") returned -1
	[0060.026] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF") returned="J0143745.GIF"
	[0060.026] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\"
	[0060.026] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0060.026] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.026] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\how-to-decrypt-files.htm")) returned 0x20
	[0060.026] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="J0143746.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF"
	[0060.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", pszSpec="*.zip") returned 0
	[0060.026] lstrlenA (lpString="*.zip") returned 5
	[0060.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", pszSpec="*.rar") returned 0
	[0060.026] lstrlenA (lpString="*.rar") returned 5
	[0060.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", pszSpec="*.7z") returned 0
	[0060.026] lstrlenA (lpString="*.7z") returned 4
	[0060.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", pszSpec="*.tar") returned 0
	[0060.026] lstrlenA (lpString="*.tar") returned 5
	[0060.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", pszSpec="*.gzip") returned 0
	[0060.027] lstrlenA (lpString="*.gzip") returned 6
	[0060.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", pszSpec="*.jpg") returned 0
	[0060.027] lstrlenA (lpString="*.jpg") returned 5
	[0060.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", pszSpec="*.jpeg") returned 0
	[0060.027] lstrlenA (lpString="*.jpeg") returned 6
	[0060.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", pszSpec="*.bmp") returned 0
	[0060.027] lstrlenA (lpString="*.bmp") returned 5
	[0060.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", pszSpec="*.gif") returned 1
	[0060.027] lstrlenA (lpString="*.gif") returned 5
	[0060.027] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF"
	[0060.027] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF"
	[0060.027] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF."
	[0060.027] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.exe"
	[0060.027] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143746.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0060.027] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x595
	[0060.027] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x104b75c6, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x104b75c6, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x10c77030, dwHighDateTime=0x1d327e8)) returned 1
	[0060.027] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.027] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x553, lpOverlapped=0x0) returned 1
	[0060.064] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF") returned="J0143746.GIF"
	[0060.064] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.064] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x553, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x553, lpOverlapped=0x0) returned 1
	[0060.064] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.064] CloseHandle (hObject=0x218) returned 1
	[0060.065] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143746.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143746.gif.exe")) returned 1
	[0060.065] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1107d049, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1107d049, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1107d049, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11d1, dwReserved0=0x33, dwReserved1=0x1, cFileName="J0143748.GIF", cAlternateFileName="")) returned 1
	[0060.065] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0060.065] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0143748.GIF") returned -1
	[0060.065] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0143748.GIF") returned -1
	[0060.065] lstrcmpiA (lpString1="", lpString2="J0143748.GIF") returned -1
	[0060.065] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF") returned="J0143746.GIF"
	[0060.065] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\"
	[0060.065] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0060.065] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.065] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\how-to-decrypt-files.htm")) returned 0x20
	[0060.065] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="J0143748.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF"
	[0060.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", pszSpec="*.zip") returned 0
	[0060.066] lstrlenA (lpString="*.zip") returned 5
	[0060.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", pszSpec="*.rar") returned 0
	[0060.066] lstrlenA (lpString="*.rar") returned 5
	[0060.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", pszSpec="*.7z") returned 0
	[0060.066] lstrlenA (lpString="*.7z") returned 4
	[0060.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", pszSpec="*.tar") returned 0
	[0060.066] lstrlenA (lpString="*.tar") returned 5
	[0060.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", pszSpec="*.gzip") returned 0
	[0060.066] lstrlenA (lpString="*.gzip") returned 6
	[0060.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", pszSpec="*.jpg") returned 0
	[0060.066] lstrlenA (lpString="*.jpg") returned 5
	[0060.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", pszSpec="*.jpeg") returned 0
	[0060.066] lstrlenA (lpString="*.jpeg") returned 6
	[0060.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", pszSpec="*.bmp") returned 0
	[0060.066] lstrlenA (lpString="*.bmp") returned 5
	[0060.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", pszSpec="*.gif") returned 1
	[0060.066] lstrlenA (lpString="*.gif") returned 5
	[0060.066] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF"
	[0060.066] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF"
	[0060.066] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF."
	[0060.066] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.exe"
	[0060.066] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143748.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0060.067] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11d1
	[0060.067] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8)) returned 1
	[0060.067] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.067] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x118f, lpOverlapped=0x0) returned 1
	[0060.083] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF") returned="J0143748.GIF"
	[0060.083] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.083] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x118f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x118f, lpOverlapped=0x0) returned 1
	[0060.083] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.083] CloseHandle (hObject=0x218) returned 1
	[0060.083] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143748.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143748.gif.exe")) returned 1
	[0060.083] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1107d049, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1107d049, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1107d049, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1323, dwReserved0=0x33, dwReserved1=0x1, cFileName="J0143749.GIF", cAlternateFileName="")) returned 1
	[0060.084] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0060.084] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0143749.GIF") returned -1
	[0060.084] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0143749.GIF") returned -1
	[0060.084] lstrcmpiA (lpString1="", lpString2="J0143749.GIF") returned -1
	[0060.084] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF") returned="J0143748.GIF"
	[0060.084] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\"
	[0060.084] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0060.084] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.084] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\how-to-decrypt-files.htm")) returned 0x20
	[0060.084] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="J0143749.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF"
	[0060.084] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", pszSpec="*.zip") returned 0
	[0060.084] lstrlenA (lpString="*.zip") returned 5
	[0060.084] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", pszSpec="*.rar") returned 0
	[0060.084] lstrlenA (lpString="*.rar") returned 5
	[0060.084] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", pszSpec="*.7z") returned 0
	[0060.084] lstrlenA (lpString="*.7z") returned 4
	[0060.084] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", pszSpec="*.tar") returned 0
	[0060.084] lstrlenA (lpString="*.tar") returned 5
	[0060.084] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", pszSpec="*.gzip") returned 0
	[0060.084] lstrlenA (lpString="*.gzip") returned 6
	[0060.084] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", pszSpec="*.jpg") returned 0
	[0060.084] lstrlenA (lpString="*.jpg") returned 5
	[0060.084] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", pszSpec="*.jpeg") returned 0
	[0060.084] lstrlenA (lpString="*.jpeg") returned 6
	[0060.084] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", pszSpec="*.bmp") returned 0
	[0060.084] lstrlenA (lpString="*.bmp") returned 5
	[0060.084] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", pszSpec="*.gif") returned 1
	[0060.084] lstrlenA (lpString="*.gif") returned 5
	[0060.084] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF"
	[0060.084] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF"
	[0060.084] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF."
	[0060.084] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.exe"
	[0060.085] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143749.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0060.085] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1323
	[0060.085] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8)) returned 1
	[0060.085] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.085] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x12e1, lpOverlapped=0x0) returned 1
	[0060.114] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF") returned="J0143749.GIF"
	[0060.115] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.115] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x12e1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x12e1, lpOverlapped=0x0) returned 1
	[0060.115] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.115] CloseHandle (hObject=0x218) returned 1
	[0060.115] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143749.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143749.gif.exe")) returned 1
	[0060.116] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1107d049, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1107d049, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1107d049, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x43e, dwReserved0=0x33, dwReserved1=0x1, cFileName="J0143750.GIF", cAlternateFileName="")) returned 1
	[0060.116] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0060.116] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0143750.GIF") returned -1
	[0060.116] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0143750.GIF") returned -1
	[0060.116] lstrcmpiA (lpString1="", lpString2="J0143750.GIF") returned -1
	[0060.116] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF") returned="J0143749.GIF"
	[0060.116] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\"
	[0060.116] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0060.116] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.116] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\how-to-decrypt-files.htm")) returned 0x20
	[0060.116] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="J0143750.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF"
	[0060.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", pszSpec="*.zip") returned 0
	[0060.116] lstrlenA (lpString="*.zip") returned 5
	[0060.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", pszSpec="*.rar") returned 0
	[0060.116] lstrlenA (lpString="*.rar") returned 5
	[0060.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", pszSpec="*.7z") returned 0
	[0060.116] lstrlenA (lpString="*.7z") returned 4
	[0060.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", pszSpec="*.tar") returned 0
	[0060.116] lstrlenA (lpString="*.tar") returned 5
	[0060.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", pszSpec="*.gzip") returned 0
	[0060.116] lstrlenA (lpString="*.gzip") returned 6
	[0060.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", pszSpec="*.jpg") returned 0
	[0060.116] lstrlenA (lpString="*.jpg") returned 5
	[0060.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", pszSpec="*.jpeg") returned 0
	[0060.116] lstrlenA (lpString="*.jpeg") returned 6
	[0060.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", pszSpec="*.bmp") returned 0
	[0060.116] lstrlenA (lpString="*.bmp") returned 5
	[0060.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", pszSpec="*.gif") returned 1
	[0060.116] lstrlenA (lpString="*.gif") returned 5
	[0060.116] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF"
	[0060.116] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF"
	[0060.117] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF."
	[0060.117] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.exe"
	[0060.117] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143750.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0060.117] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43e
	[0060.117] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8)) returned 1
	[0060.117] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.117] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x3fc, lpOverlapped=0x0) returned 1
	[0060.119] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF") returned="J0143750.GIF"
	[0060.119] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.119] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x3fc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x3fc, lpOverlapped=0x0) returned 1
	[0060.120] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.120] CloseHandle (hObject=0x218) returned 1
	[0060.120] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143750.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143750.gif.exe")) returned 1
	[0060.120] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1107d049, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1107d049, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1107d049, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x412, dwReserved0=0x33, dwReserved1=0x1, cFileName="J0143752.GIF", cAlternateFileName="")) returned 1
	[0060.120] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0060.120] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0143752.GIF") returned -1
	[0060.120] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0143752.GIF") returned -1
	[0060.120] lstrcmpiA (lpString1="", lpString2="J0143752.GIF") returned -1
	[0060.120] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF") returned="J0143750.GIF"
	[0060.120] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\"
	[0060.120] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0060.120] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.121] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\how-to-decrypt-files.htm")) returned 0x20
	[0060.121] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="J0143752.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF"
	[0060.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", pszSpec="*.zip") returned 0
	[0060.121] lstrlenA (lpString="*.zip") returned 5
	[0060.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", pszSpec="*.rar") returned 0
	[0060.121] lstrlenA (lpString="*.rar") returned 5
	[0060.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", pszSpec="*.7z") returned 0
	[0060.121] lstrlenA (lpString="*.7z") returned 4
	[0060.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", pszSpec="*.tar") returned 0
	[0060.121] lstrlenA (lpString="*.tar") returned 5
	[0060.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", pszSpec="*.gzip") returned 0
	[0060.121] lstrlenA (lpString="*.gzip") returned 6
	[0060.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", pszSpec="*.jpg") returned 0
	[0060.121] lstrlenA (lpString="*.jpg") returned 5
	[0060.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", pszSpec="*.jpeg") returned 0
	[0060.121] lstrlenA (lpString="*.jpeg") returned 6
	[0060.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", pszSpec="*.bmp") returned 0
	[0060.121] lstrlenA (lpString="*.bmp") returned 5
	[0060.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", pszSpec="*.gif") returned 1
	[0060.121] lstrlenA (lpString="*.gif") returned 5
	[0060.121] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF"
	[0060.121] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF"
	[0060.121] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF."
	[0060.121] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.exe"
	[0060.121] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143752.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0060.121] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x412
	[0060.121] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8)) returned 1
	[0060.122] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.122] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x3d0, lpOverlapped=0x0) returned 1
	[0060.126] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF") returned="J0143752.GIF"
	[0060.126] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.126] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x3d0, lpOverlapped=0x0) returned 1
	[0060.126] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.126] CloseHandle (hObject=0x218) returned 1
	[0060.126] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143752.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143752.gif.exe")) returned 1
	[0060.127] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1107d049, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1107d049, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1107d049, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1b7f, dwReserved0=0x33, dwReserved1=0x1, cFileName="J0143753.GIF", cAlternateFileName="")) returned 1
	[0060.127] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0060.127] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0143753.GIF") returned -1
	[0060.127] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0143753.GIF") returned -1
	[0060.127] lstrcmpiA (lpString1="", lpString2="J0143753.GIF") returned -1
	[0060.127] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF") returned="J0143752.GIF"
	[0060.127] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\"
	[0060.127] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0060.127] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.127] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\how-to-decrypt-files.htm")) returned 0x20
	[0060.127] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="J0143753.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF"
	[0060.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", pszSpec="*.zip") returned 0
	[0060.127] lstrlenA (lpString="*.zip") returned 5
	[0060.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", pszSpec="*.rar") returned 0
	[0060.127] lstrlenA (lpString="*.rar") returned 5
	[0060.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", pszSpec="*.7z") returned 0
	[0060.127] lstrlenA (lpString="*.7z") returned 4
	[0060.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", pszSpec="*.tar") returned 0
	[0060.128] lstrlenA (lpString="*.tar") returned 5
	[0060.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", pszSpec="*.gzip") returned 0
	[0060.128] lstrlenA (lpString="*.gzip") returned 6
	[0060.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", pszSpec="*.jpg") returned 0
	[0060.128] lstrlenA (lpString="*.jpg") returned 5
	[0060.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", pszSpec="*.jpeg") returned 0
	[0060.128] lstrlenA (lpString="*.jpeg") returned 6
	[0060.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", pszSpec="*.bmp") returned 0
	[0060.128] lstrlenA (lpString="*.bmp") returned 5
	[0060.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", pszSpec="*.gif") returned 1
	[0060.128] lstrlenA (lpString="*.gif") returned 5
	[0060.128] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF"
	[0060.128] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF"
	[0060.128] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF."
	[0060.128] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.exe"
	[0060.128] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143753.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0060.129] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b7f
	[0060.129] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8)) returned 1
	[0060.129] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.129] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1b3d, lpOverlapped=0x0) returned 1
	[0060.131] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF") returned="J0143753.GIF"
	[0060.131] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.131] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1b3d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1b3d, lpOverlapped=0x0) returned 1
	[0060.131] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.131] CloseHandle (hObject=0x218) returned 1
	[0060.132] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143753.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143753.gif.exe")) returned 1
	[0060.132] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1107d049, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1107d049, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1107d049, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6ad, dwReserved0=0x33, dwReserved1=0x1, cFileName="J0143754.GIF", cAlternateFileName="")) returned 1
	[0060.132] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0060.132] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0143754.GIF") returned -1
	[0060.132] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0143754.GIF") returned -1
	[0060.132] lstrcmpiA (lpString1="", lpString2="J0143754.GIF") returned -1
	[0060.132] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF") returned="J0143753.GIF"
	[0060.132] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\"
	[0060.132] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0060.132] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.132] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\how-to-decrypt-files.htm")) returned 0x20
	[0060.132] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="J0143754.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF"
	[0060.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", pszSpec="*.zip") returned 0
	[0060.132] lstrlenA (lpString="*.zip") returned 5
	[0060.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", pszSpec="*.rar") returned 0
	[0060.132] lstrlenA (lpString="*.rar") returned 5
	[0060.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", pszSpec="*.7z") returned 0
	[0060.133] lstrlenA (lpString="*.7z") returned 4
	[0060.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", pszSpec="*.tar") returned 0
	[0060.133] lstrlenA (lpString="*.tar") returned 5
	[0060.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", pszSpec="*.gzip") returned 0
	[0060.133] lstrlenA (lpString="*.gzip") returned 6
	[0060.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", pszSpec="*.jpg") returned 0
	[0060.133] lstrlenA (lpString="*.jpg") returned 5
	[0060.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", pszSpec="*.jpeg") returned 0
	[0060.133] lstrlenA (lpString="*.jpeg") returned 6
	[0060.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", pszSpec="*.bmp") returned 0
	[0060.133] lstrlenA (lpString="*.bmp") returned 5
	[0060.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", pszSpec="*.gif") returned 1
	[0060.133] lstrlenA (lpString="*.gif") returned 5
	[0060.133] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF"
	[0060.133] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF"
	[0060.133] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF."
	[0060.133] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.exe"
	[0060.133] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143754.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0060.133] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6ad
	[0060.133] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8)) returned 1
	[0060.133] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.133] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x66b, lpOverlapped=0x0) returned 1
	[0060.170] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF") returned="J0143754.GIF"
	[0060.170] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.171] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x66b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x66b, lpOverlapped=0x0) returned 1
	[0060.171] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.171] CloseHandle (hObject=0x218) returned 1
	[0060.171] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143754.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143754.gif.exe")) returned 1
	[0060.171] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1107d049, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1107d049, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x110a3267, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x69f, dwReserved0=0x33, dwReserved1=0x1, cFileName="J0143758.GIF", cAlternateFileName="")) returned 1
	[0060.172] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0060.172] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J0143758.GIF") returned -1
	[0060.172] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J0143758.GIF") returned -1
	[0060.172] lstrcmpiA (lpString1="", lpString2="J0143758.GIF") returned -1
	[0060.172] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF") returned="J0143754.GIF"
	[0060.172] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\"
	[0060.172] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0060.172] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.172] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\how-to-decrypt-files.htm")) returned 0x20
	[0060.172] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="J0143758.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF"
	[0060.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", pszSpec="*.zip") returned 0
	[0060.172] lstrlenA (lpString="*.zip") returned 5
	[0060.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", pszSpec="*.rar") returned 0
	[0060.172] lstrlenA (lpString="*.rar") returned 5
	[0060.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", pszSpec="*.7z") returned 0
	[0060.172] lstrlenA (lpString="*.7z") returned 4
	[0060.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", pszSpec="*.tar") returned 0
	[0060.172] lstrlenA (lpString="*.tar") returned 5
	[0060.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", pszSpec="*.gzip") returned 0
	[0060.172] lstrlenA (lpString="*.gzip") returned 6
	[0060.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", pszSpec="*.jpg") returned 0
	[0060.172] lstrlenA (lpString="*.jpg") returned 5
	[0060.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", pszSpec="*.jpeg") returned 0
	[0060.172] lstrlenA (lpString="*.jpeg") returned 6
	[0060.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", pszSpec="*.bmp") returned 0
	[0060.172] lstrlenA (lpString="*.bmp") returned 5
	[0060.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", pszSpec="*.gif") returned 1
	[0060.172] lstrlenA (lpString="*.gif") returned 5
	[0060.172] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF"
	[0060.173] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF"
	[0060.173] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF."
	[0060.173] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.exe"
	[0060.173] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143758.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0060.173] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x69f
	[0060.173] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x110a3267, dwHighDateTime=0x1d327e8)) returned 1
	[0060.173] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.173] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x65d, lpOverlapped=0x0) returned 1
	[0060.176] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF") returned="J0143758.GIF"
	[0060.176] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.176] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x65d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x65d, lpOverlapped=0x0) returned 1
	[0060.176] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.176] CloseHandle (hObject=0x218) returned 1
	[0060.177] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143758.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143758.gif.exe")) returned 1
	[0060.177] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1107d049, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1107d049, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x110a3267, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x124a, dwReserved0=0x33, dwReserved1=0x1, cFileName="WB00516L.GIF", cAlternateFileName="")) returned 1
	[0060.177] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0060.177] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB00516L.GIF") returned -1
	[0060.177] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB00516L.GIF") returned -1
	[0060.177] lstrcmpiA (lpString1="", lpString2="WB00516L.GIF") returned -1
	[0060.177] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF") returned="J0143758.GIF"
	[0060.177] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\"
	[0060.177] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0060.177] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.177] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\how-to-decrypt-files.htm")) returned 0x20
	[0060.177] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB00516L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF"
	[0060.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", pszSpec="*.zip") returned 0
	[0060.177] lstrlenA (lpString="*.zip") returned 5
	[0060.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", pszSpec="*.rar") returned 0
	[0060.178] lstrlenA (lpString="*.rar") returned 5
	[0060.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", pszSpec="*.7z") returned 0
	[0060.178] lstrlenA (lpString="*.7z") returned 4
	[0060.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", pszSpec="*.tar") returned 0
	[0060.178] lstrlenA (lpString="*.tar") returned 5
	[0060.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", pszSpec="*.gzip") returned 0
	[0060.178] lstrlenA (lpString="*.gzip") returned 6
	[0060.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", pszSpec="*.jpg") returned 0
	[0060.178] lstrlenA (lpString="*.jpg") returned 5
	[0060.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", pszSpec="*.jpeg") returned 0
	[0060.178] lstrlenA (lpString="*.jpeg") returned 6
	[0060.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", pszSpec="*.bmp") returned 0
	[0060.178] lstrlenA (lpString="*.bmp") returned 5
	[0060.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", pszSpec="*.gif") returned 1
	[0060.178] lstrlenA (lpString="*.gif") returned 5
	[0060.178] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF"
	[0060.178] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF"
	[0060.178] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF."
	[0060.178] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.exe"
	[0060.178] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00516l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0060.178] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x124a
	[0060.178] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x110a3267, dwHighDateTime=0x1d327e8)) returned 1
	[0060.178] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.179] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1208, lpOverlapped=0x0) returned 1
	[0060.220] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF") returned="WB00516L.GIF"
	[0060.220] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.220] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1208, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1208, lpOverlapped=0x0) returned 1
	[0060.220] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.220] CloseHandle (hObject=0x218) returned 1
	[0060.220] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00516l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00516l.gif.exe")) returned 1
	[0060.221] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1107d049, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1107d049, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1107d049, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2017, dwReserved0=0x33, dwReserved1=0x1, cFileName="WB00531L.GIF", cAlternateFileName="")) returned 1
	[0060.221] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0060.221] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB00531L.GIF") returned -1
	[0060.221] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB00531L.GIF") returned -1
	[0060.221] lstrcmpiA (lpString1="", lpString2="WB00531L.GIF") returned -1
	[0060.221] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF") returned="WB00516L.GIF"
	[0060.221] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\"
	[0060.221] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0060.221] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.221] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\how-to-decrypt-files.htm")) returned 0x20
	[0060.221] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB00531L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF"
	[0060.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", pszSpec="*.zip") returned 0
	[0060.222] lstrlenA (lpString="*.zip") returned 5
	[0060.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", pszSpec="*.rar") returned 0
	[0060.222] lstrlenA (lpString="*.rar") returned 5
	[0060.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", pszSpec="*.7z") returned 0
	[0060.222] lstrlenA (lpString="*.7z") returned 4
	[0060.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", pszSpec="*.tar") returned 0
	[0060.222] lstrlenA (lpString="*.tar") returned 5
	[0060.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", pszSpec="*.gzip") returned 0
	[0060.222] lstrlenA (lpString="*.gzip") returned 6
	[0060.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", pszSpec="*.jpg") returned 0
	[0060.222] lstrlenA (lpString="*.jpg") returned 5
	[0060.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", pszSpec="*.jpeg") returned 0
	[0060.222] lstrlenA (lpString="*.jpeg") returned 6
	[0060.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", pszSpec="*.bmp") returned 0
	[0060.222] lstrlenA (lpString="*.bmp") returned 5
	[0060.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", pszSpec="*.gif") returned 1
	[0060.222] lstrlenA (lpString="*.gif") returned 5
	[0060.222] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF"
	[0060.222] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF"
	[0060.222] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF."
	[0060.222] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.exe"
	[0060.222] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00531l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0060.222] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2017
	[0060.222] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8)) returned 1
	[0060.223] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.223] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1fd5, lpOverlapped=0x0) returned 1
	[0060.226] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF") returned="WB00531L.GIF"
	[0060.226] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.226] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1fd5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1fd5, lpOverlapped=0x0) returned 1
	[0060.226] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.226] CloseHandle (hObject=0x218) returned 1
	[0060.226] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00531l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00531l.gif.exe")) returned 1
	[0060.227] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11030b47, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11030b47, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11030b47, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x20ee, dwReserved0=0x33, dwReserved1=0x1, cFileName="WB00673L.GIF", cAlternateFileName="")) returned 1
	[0060.227] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0060.227] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB00673L.GIF") returned -1
	[0060.227] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB00673L.GIF") returned -1
	[0060.227] lstrcmpiA (lpString1="", lpString2="WB00673L.GIF") returned -1
	[0060.227] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF") returned="WB00531L.GIF"
	[0060.227] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\"
	[0060.227] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0060.227] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.227] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\how-to-decrypt-files.htm")) returned 0x20
	[0060.227] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB00673L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF"
	[0060.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", pszSpec="*.zip") returned 0
	[0060.227] lstrlenA (lpString="*.zip") returned 5
	[0060.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", pszSpec="*.rar") returned 0
	[0060.227] lstrlenA (lpString="*.rar") returned 5
	[0060.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", pszSpec="*.7z") returned 0
	[0060.227] lstrlenA (lpString="*.7z") returned 4
	[0060.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", pszSpec="*.tar") returned 0
	[0060.227] lstrlenA (lpString="*.tar") returned 5
	[0060.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", pszSpec="*.gzip") returned 0
	[0060.227] lstrlenA (lpString="*.gzip") returned 6
	[0060.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", pszSpec="*.jpg") returned 0
	[0060.227] lstrlenA (lpString="*.jpg") returned 5
	[0060.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", pszSpec="*.jpeg") returned 0
	[0060.228] lstrlenA (lpString="*.jpeg") returned 6
	[0060.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", pszSpec="*.bmp") returned 0
	[0060.228] lstrlenA (lpString="*.bmp") returned 5
	[0060.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", pszSpec="*.gif") returned 1
	[0060.228] lstrlenA (lpString="*.gif") returned 5
	[0060.228] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF"
	[0060.228] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF"
	[0060.228] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF."
	[0060.228] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.exe"
	[0060.228] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00673l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0060.228] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x20ee
	[0060.228] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x11030b47, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x11030b47, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x11030b47, dwHighDateTime=0x1d327e8)) returned 1
	[0060.228] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.228] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x20ac, lpOverlapped=0x0) returned 1
	[0060.262] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF") returned="WB00673L.GIF"
	[0060.262] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.262] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x20ac, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x20ac, lpOverlapped=0x0) returned 1
	[0060.262] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.262] CloseHandle (hObject=0x218) returned 1
	[0060.263] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00673l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00673l.gif.exe")) returned 1
	[0060.264] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1107d049, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1107d049, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x110a3267, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0x33, dwReserved1=0x1, cFileName="WB00703L.GIF", cAlternateFileName="")) returned 1
	[0060.264] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0060.264] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB00703L.GIF") returned -1
	[0060.264] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB00703L.GIF") returned -1
	[0060.264] lstrcmpiA (lpString1="", lpString2="WB00703L.GIF") returned -1
	[0060.264] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF") returned="WB00673L.GIF"
	[0060.264] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\"
	[0060.264] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0060.264] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.264] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\how-to-decrypt-files.htm")) returned 0x20
	[0060.264] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB00703L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF"
	[0060.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", pszSpec="*.zip") returned 0
	[0060.264] lstrlenA (lpString="*.zip") returned 5
	[0060.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", pszSpec="*.rar") returned 0
	[0060.264] lstrlenA (lpString="*.rar") returned 5
	[0060.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", pszSpec="*.7z") returned 0
	[0060.264] lstrlenA (lpString="*.7z") returned 4
	[0060.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", pszSpec="*.tar") returned 0
	[0060.264] lstrlenA (lpString="*.tar") returned 5
	[0060.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", pszSpec="*.gzip") returned 0
	[0060.264] lstrlenA (lpString="*.gzip") returned 6
	[0060.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", pszSpec="*.jpg") returned 0
	[0060.264] lstrlenA (lpString="*.jpg") returned 5
	[0060.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", pszSpec="*.jpeg") returned 0
	[0060.264] lstrlenA (lpString="*.jpeg") returned 6
	[0060.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", pszSpec="*.bmp") returned 0
	[0060.264] lstrlenA (lpString="*.bmp") returned 5
	[0060.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", pszSpec="*.gif") returned 1
	[0060.265] lstrlenA (lpString="*.gif") returned 5
	[0060.265] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF"
	[0060.265] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF"
	[0060.265] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF."
	[0060.265] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.exe"
	[0060.265] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00703l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0060.265] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2026
	[0060.266] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x110a3267, dwHighDateTime=0x1d327e8)) returned 1
	[0060.266] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.266] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1fe4, lpOverlapped=0x0) returned 1
	[0060.267] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF") returned="WB00703L.GIF"
	[0060.268] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.268] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1fe4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1fe4, lpOverlapped=0x0) returned 1
	[0060.268] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.268] CloseHandle (hObject=0x218) returned 1
	[0060.268] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00703l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00703l.gif.exe")) returned 1
	[0060.268] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1107d049, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1107d049, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x110a3267, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2313, dwReserved0=0x33, dwReserved1=0x1, cFileName="WB00760L.GIF", cAlternateFileName="")) returned 1
	[0060.269] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0060.269] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB00760L.GIF") returned -1
	[0060.269] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB00760L.GIF") returned -1
	[0060.269] lstrcmpiA (lpString1="", lpString2="WB00760L.GIF") returned -1
	[0060.269] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF") returned="WB00703L.GIF"
	[0060.269] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\"
	[0060.269] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0060.269] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.269] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\how-to-decrypt-files.htm")) returned 0x20
	[0060.269] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB00760L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF"
	[0060.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", pszSpec="*.zip") returned 0
	[0060.269] lstrlenA (lpString="*.zip") returned 5
	[0060.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", pszSpec="*.rar") returned 0
	[0060.269] lstrlenA (lpString="*.rar") returned 5
	[0060.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", pszSpec="*.7z") returned 0
	[0060.269] lstrlenA (lpString="*.7z") returned 4
	[0060.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", pszSpec="*.tar") returned 0
	[0060.269] lstrlenA (lpString="*.tar") returned 5
	[0060.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", pszSpec="*.gzip") returned 0
	[0060.269] lstrlenA (lpString="*.gzip") returned 6
	[0060.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", pszSpec="*.jpg") returned 0
	[0060.269] lstrlenA (lpString="*.jpg") returned 5
	[0060.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", pszSpec="*.jpeg") returned 0
	[0060.269] lstrlenA (lpString="*.jpeg") returned 6
	[0060.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", pszSpec="*.bmp") returned 0
	[0060.269] lstrlenA (lpString="*.bmp") returned 5
	[0060.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", pszSpec="*.gif") returned 1
	[0060.269] lstrlenA (lpString="*.gif") returned 5
	[0060.269] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF"
	[0060.269] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF"
	[0060.270] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF."
	[0060.270] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.exe"
	[0060.270] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00760l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0060.270] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2313
	[0060.270] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x110a3267, dwHighDateTime=0x1d327e8)) returned 1
	[0060.270] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.270] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x22d1, lpOverlapped=0x0) returned 1
	[0060.272] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF") returned="WB00760L.GIF"
	[0060.272] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.272] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x22d1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x22d1, lpOverlapped=0x0) returned 1
	[0060.272] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.272] CloseHandle (hObject=0x218) returned 1
	[0060.272] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00760l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00760l.gif.exe")) returned 1
	[0060.273] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1107d049, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1107d049, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x110a3267, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f8f, dwReserved0=0x33, dwReserved1=0x1, cFileName="WB00780L.GIF", cAlternateFileName="")) returned 1
	[0060.273] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0060.273] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB00780L.GIF") returned -1
	[0060.273] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB00780L.GIF") returned -1
	[0060.273] lstrcmpiA (lpString1="", lpString2="WB00780L.GIF") returned -1
	[0060.273] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF") returned="WB00760L.GIF"
	[0060.273] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\"
	[0060.273] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0060.273] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.273] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\how-to-decrypt-files.htm")) returned 0x20
	[0060.273] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB00780L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF"
	[0060.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", pszSpec="*.zip") returned 0
	[0060.273] lstrlenA (lpString="*.zip") returned 5
	[0060.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", pszSpec="*.rar") returned 0
	[0060.273] lstrlenA (lpString="*.rar") returned 5
	[0060.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", pszSpec="*.7z") returned 0
	[0060.273] lstrlenA (lpString="*.7z") returned 4
	[0060.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", pszSpec="*.tar") returned 0
	[0060.273] lstrlenA (lpString="*.tar") returned 5
	[0060.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", pszSpec="*.gzip") returned 0
	[0060.273] lstrlenA (lpString="*.gzip") returned 6
	[0060.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", pszSpec="*.jpg") returned 0
	[0060.273] lstrlenA (lpString="*.jpg") returned 5
	[0060.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", pszSpec="*.jpeg") returned 0
	[0060.273] lstrlenA (lpString="*.jpeg") returned 6
	[0060.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", pszSpec="*.bmp") returned 0
	[0060.273] lstrlenA (lpString="*.bmp") returned 5
	[0060.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", pszSpec="*.gif") returned 1
	[0060.274] lstrlenA (lpString="*.gif") returned 5
	[0060.274] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF"
	[0060.274] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF"
	[0060.274] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF."
	[0060.274] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.exe"
	[0060.274] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00780l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0060.274] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f8f
	[0060.274] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x110a3267, dwHighDateTime=0x1d327e8)) returned 1
	[0060.274] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.274] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1f4d, lpOverlapped=0x0) returned 1
	[0060.276] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF") returned="WB00780L.GIF"
	[0060.277] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.277] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1f4d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1f4d, lpOverlapped=0x0) returned 1
	[0060.277] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.277] CloseHandle (hObject=0x218) returned 1
	[0060.277] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00780l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00780l.gif.exe")) returned 1
	[0060.277] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x110a3267, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x110a3267, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x110a3267, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe1d, dwReserved0=0x33, dwReserved1=0x1, cFileName="WB01741L.GIF", cAlternateFileName="")) returned 1
	[0060.277] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0060.278] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB01741L.GIF") returned -1
	[0060.278] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB01741L.GIF") returned -1
	[0060.278] lstrcmpiA (lpString1="", lpString2="WB01741L.GIF") returned -1
	[0060.278] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF") returned="WB00780L.GIF"
	[0060.278] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\"
	[0060.278] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0060.278] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.278] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\how-to-decrypt-files.htm")) returned 0x20
	[0060.278] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB01741L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF"
	[0060.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", pszSpec="*.zip") returned 0
	[0060.278] lstrlenA (lpString="*.zip") returned 5
	[0060.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", pszSpec="*.rar") returned 0
	[0060.278] lstrlenA (lpString="*.rar") returned 5
	[0060.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", pszSpec="*.7z") returned 0
	[0060.278] lstrlenA (lpString="*.7z") returned 4
	[0060.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", pszSpec="*.tar") returned 0
	[0060.278] lstrlenA (lpString="*.tar") returned 5
	[0060.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", pszSpec="*.gzip") returned 0
	[0060.278] lstrlenA (lpString="*.gzip") returned 6
	[0060.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", pszSpec="*.jpg") returned 0
	[0060.278] lstrlenA (lpString="*.jpg") returned 5
	[0060.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", pszSpec="*.jpeg") returned 0
	[0060.278] lstrlenA (lpString="*.jpeg") returned 6
	[0060.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", pszSpec="*.bmp") returned 0
	[0060.278] lstrlenA (lpString="*.bmp") returned 5
	[0060.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", pszSpec="*.gif") returned 1
	[0060.279] lstrlenA (lpString="*.gif") returned 5
	[0060.279] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF"
	[0060.279] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF"
	[0060.279] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF."
	[0060.279] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.exe"
	[0060.279] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb01741l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0060.279] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe1d
	[0060.279] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x110a3267, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x110a3267, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x110a3267, dwHighDateTime=0x1d327e8)) returned 1
	[0060.279] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.279] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xddb, lpOverlapped=0x0) returned 1
	[0060.314] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF") returned="WB01741L.GIF"
	[0060.314] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.314] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xddb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xddb, lpOverlapped=0x0) returned 1
	[0060.315] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.315] CloseHandle (hObject=0x218) returned 1
	[0060.315] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb01741l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb01741l.gif.exe")) returned 1
	[0060.315] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1107d049, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1107d049, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x110a3267, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x38c, dwReserved0=0x33, dwReserved1=0x1, cFileName="WB02039_.GIF", cAlternateFileName="")) returned 1
	[0060.315] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0060.316] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB02039_.GIF") returned -1
	[0060.316] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB02039_.GIF") returned -1
	[0060.316] lstrcmpiA (lpString1="", lpString2="WB02039_.GIF") returned -1
	[0060.316] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF") returned="WB01741L.GIF"
	[0060.316] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\"
	[0060.316] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0060.316] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.316] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\how-to-decrypt-files.htm")) returned 0x20
	[0060.316] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02039_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF"
	[0060.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", pszSpec="*.zip") returned 0
	[0060.316] lstrlenA (lpString="*.zip") returned 5
	[0060.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", pszSpec="*.rar") returned 0
	[0060.316] lstrlenA (lpString="*.rar") returned 5
	[0060.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", pszSpec="*.7z") returned 0
	[0060.316] lstrlenA (lpString="*.7z") returned 4
	[0060.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", pszSpec="*.tar") returned 0
	[0060.316] lstrlenA (lpString="*.tar") returned 5
	[0060.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", pszSpec="*.gzip") returned 0
	[0060.316] lstrlenA (lpString="*.gzip") returned 6
	[0060.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", pszSpec="*.jpg") returned 0
	[0060.316] lstrlenA (lpString="*.jpg") returned 5
	[0060.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", pszSpec="*.jpeg") returned 0
	[0060.316] lstrlenA (lpString="*.jpeg") returned 6
	[0060.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", pszSpec="*.bmp") returned 0
	[0060.316] lstrlenA (lpString="*.bmp") returned 5
	[0060.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", pszSpec="*.gif") returned 1
	[0060.316] lstrlenA (lpString="*.gif") returned 5
	[0060.317] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF"
	[0060.317] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF"
	[0060.317] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF."
	[0060.317] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.exe"
	[0060.317] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02039_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0060.317] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x38c
	[0060.317] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x110a3267, dwHighDateTime=0x1d327e8)) returned 1
	[0060.317] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.318] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x34a, lpOverlapped=0x0) returned 1
	[0060.319] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") returned="WB02039_.GIF"
	[0060.319] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.319] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x34a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x34a, lpOverlapped=0x0) returned 1
	[0060.319] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.319] CloseHandle (hObject=0x218) returned 1
	[0060.319] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02039_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02039_.gif.exe")) returned 1
	[0060.320] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1107d049, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1107d049, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x110a3267, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x987, dwReserved0=0x33, dwReserved1=0x1, cFileName="WB02055_.GIF", cAlternateFileName="")) returned 1
	[0060.320] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0060.320] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB02055_.GIF") returned -1
	[0060.320] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB02055_.GIF") returned -1
	[0060.320] lstrcmpiA (lpString1="", lpString2="WB02055_.GIF") returned -1
	[0060.320] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") returned="WB02039_.GIF"
	[0060.320] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\"
	[0060.320] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0060.320] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.320] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\how-to-decrypt-files.htm")) returned 0x20
	[0060.320] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02055_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF"
	[0060.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", pszSpec="*.zip") returned 0
	[0060.320] lstrlenA (lpString="*.zip") returned 5
	[0060.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", pszSpec="*.rar") returned 0
	[0060.320] lstrlenA (lpString="*.rar") returned 5
	[0060.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", pszSpec="*.7z") returned 0
	[0060.320] lstrlenA (lpString="*.7z") returned 4
	[0060.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", pszSpec="*.tar") returned 0
	[0060.320] lstrlenA (lpString="*.tar") returned 5
	[0060.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", pszSpec="*.gzip") returned 0
	[0060.320] lstrlenA (lpString="*.gzip") returned 6
	[0060.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", pszSpec="*.jpg") returned 0
	[0060.321] lstrlenA (lpString="*.jpg") returned 5
	[0060.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", pszSpec="*.jpeg") returned 0
	[0060.321] lstrlenA (lpString="*.jpeg") returned 6
	[0060.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", pszSpec="*.bmp") returned 0
	[0060.321] lstrlenA (lpString="*.bmp") returned 5
	[0060.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", pszSpec="*.gif") returned 1
	[0060.321] lstrlenA (lpString="*.gif") returned 5
	[0060.321] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF"
	[0060.321] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF"
	[0060.321] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF."
	[0060.321] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.exe"
	[0060.321] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02055_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0060.321] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x987
	[0060.321] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x110a3267, dwHighDateTime=0x1d327e8)) returned 1
	[0060.321] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.321] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x945, lpOverlapped=0x0) returned 1
	[0060.323] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF") returned="WB02055_.GIF"
	[0060.323] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.323] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x945, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x945, lpOverlapped=0x0) returned 1
	[0060.323] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.323] CloseHandle (hObject=0x218) returned 1
	[0060.323] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02055_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02055_.gif.exe")) returned 1
	[0060.324] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1107d049, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1107d049, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x110a3267, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x37d, dwReserved0=0x33, dwReserved1=0x1, cFileName="WB02073_.GIF", cAlternateFileName="")) returned 1
	[0060.324] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0060.324] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB02073_.GIF") returned -1
	[0060.324] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB02073_.GIF") returned -1
	[0060.324] lstrcmpiA (lpString1="", lpString2="WB02073_.GIF") returned -1
	[0060.324] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF") returned="WB02055_.GIF"
	[0060.324] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\"
	[0060.324] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0060.324] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.324] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\how-to-decrypt-files.htm")) returned 0x20
	[0060.324] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02073_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF"
	[0060.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", pszSpec="*.zip") returned 0
	[0060.324] lstrlenA (lpString="*.zip") returned 5
	[0060.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", pszSpec="*.rar") returned 0
	[0060.324] lstrlenA (lpString="*.rar") returned 5
	[0060.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", pszSpec="*.7z") returned 0
	[0060.324] lstrlenA (lpString="*.7z") returned 4
	[0060.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", pszSpec="*.tar") returned 0
	[0060.324] lstrlenA (lpString="*.tar") returned 5
	[0060.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", pszSpec="*.gzip") returned 0
	[0060.324] lstrlenA (lpString="*.gzip") returned 6
	[0060.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", pszSpec="*.jpg") returned 0
	[0060.324] lstrlenA (lpString="*.jpg") returned 5
	[0060.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", pszSpec="*.jpeg") returned 0
	[0060.324] lstrlenA (lpString="*.jpeg") returned 6
	[0060.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", pszSpec="*.bmp") returned 0
	[0060.324] lstrlenA (lpString="*.bmp") returned 5
	[0060.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", pszSpec="*.gif") returned 1
	[0060.324] lstrlenA (lpString="*.gif") returned 5
	[0060.324] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF"
	[0060.324] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF"
	[0060.324] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF."
	[0060.325] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.exe"
	[0060.325] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02073_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0060.325] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x37d
	[0060.325] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x110a3267, dwHighDateTime=0x1d327e8)) returned 1
	[0060.325] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.325] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x33b, lpOverlapped=0x0) returned 1
	[0060.362] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF") returned="WB02073_.GIF"
	[0060.362] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.362] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x33b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x33b, lpOverlapped=0x0) returned 1
	[0060.362] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.362] CloseHandle (hObject=0x218) returned 1
	[0060.362] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02073_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02073_.gif.exe")) returned 1
	[0060.363] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1107d049, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1107d049, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x110a3267, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x516, dwReserved0=0x33, dwReserved1=0x1, cFileName="WB02074_.GIF", cAlternateFileName="")) returned 1
	[0060.363] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0060.363] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB02074_.GIF") returned -1
	[0060.363] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB02074_.GIF") returned -1
	[0060.363] lstrcmpiA (lpString1="", lpString2="WB02074_.GIF") returned -1
	[0060.363] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF") returned="WB02073_.GIF"
	[0060.363] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\"
	[0060.363] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0060.363] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.363] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\how-to-decrypt-files.htm")) returned 0x20
	[0060.363] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02074_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF"
	[0060.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", pszSpec="*.zip") returned 0
	[0060.363] lstrlenA (lpString="*.zip") returned 5
	[0060.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", pszSpec="*.rar") returned 0
	[0060.363] lstrlenA (lpString="*.rar") returned 5
	[0060.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", pszSpec="*.7z") returned 0
	[0060.363] lstrlenA (lpString="*.7z") returned 4
	[0060.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", pszSpec="*.tar") returned 0
	[0060.363] lstrlenA (lpString="*.tar") returned 5
	[0060.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", pszSpec="*.gzip") returned 0
	[0060.363] lstrlenA (lpString="*.gzip") returned 6
	[0060.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", pszSpec="*.jpg") returned 0
	[0060.363] lstrlenA (lpString="*.jpg") returned 5
	[0060.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", pszSpec="*.jpeg") returned 0
	[0060.363] lstrlenA (lpString="*.jpeg") returned 6
	[0060.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", pszSpec="*.bmp") returned 0
	[0060.364] lstrlenA (lpString="*.bmp") returned 5
	[0060.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", pszSpec="*.gif") returned 1
	[0060.364] lstrlenA (lpString="*.gif") returned 5
	[0060.364] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF"
	[0060.364] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF"
	[0060.364] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF."
	[0060.364] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.exe"
	[0060.364] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02074_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0060.364] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x516
	[0060.364] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x110a3267, dwHighDateTime=0x1d327e8)) returned 1
	[0060.364] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.364] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x4d4, lpOverlapped=0x0) returned 1
	[0060.366] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF") returned="WB02074_.GIF"
	[0060.366] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.366] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x4d4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x4d4, lpOverlapped=0x0) returned 1
	[0060.366] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.366] CloseHandle (hObject=0x218) returned 1
	[0060.366] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02074_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02074_.gif.exe")) returned 1
	[0060.367] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1107d049, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1107d049, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x110a3267, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2fd, dwReserved0=0x33, dwReserved1=0x1, cFileName="WB02077_.GIF", cAlternateFileName="")) returned 1
	[0060.367] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0060.367] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB02077_.GIF") returned -1
	[0060.367] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB02077_.GIF") returned -1
	[0060.367] lstrcmpiA (lpString1="", lpString2="WB02077_.GIF") returned -1
	[0060.367] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF") returned="WB02074_.GIF"
	[0060.367] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\"
	[0060.367] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0060.367] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.367] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\how-to-decrypt-files.htm")) returned 0x20
	[0060.367] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02077_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF"
	[0060.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", pszSpec="*.zip") returned 0
	[0060.367] lstrlenA (lpString="*.zip") returned 5
	[0060.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", pszSpec="*.rar") returned 0
	[0060.367] lstrlenA (lpString="*.rar") returned 5
	[0060.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", pszSpec="*.7z") returned 0
	[0060.367] lstrlenA (lpString="*.7z") returned 4
	[0060.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", pszSpec="*.tar") returned 0
	[0060.368] lstrlenA (lpString="*.tar") returned 5
	[0060.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", pszSpec="*.gzip") returned 0
	[0060.368] lstrlenA (lpString="*.gzip") returned 6
	[0060.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", pszSpec="*.jpg") returned 0
	[0060.368] lstrlenA (lpString="*.jpg") returned 5
	[0060.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", pszSpec="*.jpeg") returned 0
	[0060.368] lstrlenA (lpString="*.jpeg") returned 6
	[0060.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", pszSpec="*.bmp") returned 0
	[0060.368] lstrlenA (lpString="*.bmp") returned 5
	[0060.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", pszSpec="*.gif") returned 1
	[0060.368] lstrlenA (lpString="*.gif") returned 5
	[0060.368] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF"
	[0060.368] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF"
	[0060.368] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF."
	[0060.368] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.exe"
	[0060.368] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02077_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0060.368] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2fd
	[0060.368] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x110a3267, dwHighDateTime=0x1d327e8)) returned 1
	[0060.368] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.368] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x2bb, lpOverlapped=0x0) returned 1
	[0060.408] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF") returned="WB02077_.GIF"
	[0060.408] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.408] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x2bb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x2bb, lpOverlapped=0x0) returned 1
	[0060.408] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.408] CloseHandle (hObject=0x218) returned 1
	[0060.408] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02077_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02077_.gif.exe")) returned 1
	[0060.409] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1107d049, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1107d049, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1107d049, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x996, dwReserved0=0x33, dwReserved1=0x1, cFileName="WB02082_.GIF", cAlternateFileName="")) returned 1
	[0060.409] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0060.409] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB02082_.GIF") returned -1
	[0060.409] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB02082_.GIF") returned -1
	[0060.409] lstrcmpiA (lpString1="", lpString2="WB02082_.GIF") returned -1
	[0060.409] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF") returned="WB02077_.GIF"
	[0060.409] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\"
	[0060.409] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0060.409] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.409] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\how-to-decrypt-files.htm")) returned 0x20
	[0060.409] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02082_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF"
	[0060.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", pszSpec="*.zip") returned 0
	[0060.409] lstrlenA (lpString="*.zip") returned 5
	[0060.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", pszSpec="*.rar") returned 0
	[0060.409] lstrlenA (lpString="*.rar") returned 5
	[0060.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", pszSpec="*.7z") returned 0
	[0060.409] lstrlenA (lpString="*.7z") returned 4
	[0060.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", pszSpec="*.tar") returned 0
	[0060.409] lstrlenA (lpString="*.tar") returned 5
	[0060.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", pszSpec="*.gzip") returned 0
	[0060.410] lstrlenA (lpString="*.gzip") returned 6
	[0060.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", pszSpec="*.jpg") returned 0
	[0060.410] lstrlenA (lpString="*.jpg") returned 5
	[0060.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", pszSpec="*.jpeg") returned 0
	[0060.410] lstrlenA (lpString="*.jpeg") returned 6
	[0060.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", pszSpec="*.bmp") returned 0
	[0060.410] lstrlenA (lpString="*.bmp") returned 5
	[0060.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", pszSpec="*.gif") returned 1
	[0060.410] lstrlenA (lpString="*.gif") returned 5
	[0060.410] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF"
	[0060.410] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF"
	[0060.410] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF."
	[0060.410] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.exe"
	[0060.410] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02082_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0060.410] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x996
	[0060.410] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1107d049, dwHighDateTime=0x1d327e8)) returned 1
	[0060.410] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.410] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x954, lpOverlapped=0x0) returned 1
	[0060.412] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF") returned="WB02082_.GIF"
	[0060.412] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.412] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x954, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x954, lpOverlapped=0x0) returned 1
	[0060.412] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.412] CloseHandle (hObject=0x218) returned 1
	[0060.412] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02082_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02082_.gif.exe")) returned 1
	[0060.413] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x110c9494, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x110c9494, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x110ef705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x90c, dwReserved0=0x33, dwReserved1=0x1, cFileName="WB02085_.GIF", cAlternateFileName="")) returned 1
	[0060.413] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0060.413] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB02085_.GIF") returned -1
	[0060.413] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB02085_.GIF") returned -1
	[0060.413] lstrcmpiA (lpString1="", lpString2="WB02085_.GIF") returned -1
	[0060.413] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF") returned="WB02082_.GIF"
	[0060.413] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\"
	[0060.413] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0060.413] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.413] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\how-to-decrypt-files.htm")) returned 0x20
	[0060.413] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02085_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF"
	[0060.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", pszSpec="*.zip") returned 0
	[0060.413] lstrlenA (lpString="*.zip") returned 5
	[0060.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", pszSpec="*.rar") returned 0
	[0060.413] lstrlenA (lpString="*.rar") returned 5
	[0060.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", pszSpec="*.7z") returned 0
	[0060.413] lstrlenA (lpString="*.7z") returned 4
	[0060.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", pszSpec="*.tar") returned 0
	[0060.413] lstrlenA (lpString="*.tar") returned 5
	[0060.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", pszSpec="*.gzip") returned 0
	[0060.413] lstrlenA (lpString="*.gzip") returned 6
	[0060.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", pszSpec="*.jpg") returned 0
	[0060.413] lstrlenA (lpString="*.jpg") returned 5
	[0060.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", pszSpec="*.jpeg") returned 0
	[0060.414] lstrlenA (lpString="*.jpeg") returned 6
	[0060.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", pszSpec="*.bmp") returned 0
	[0060.414] lstrlenA (lpString="*.bmp") returned 5
	[0060.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", pszSpec="*.gif") returned 1
	[0060.414] lstrlenA (lpString="*.gif") returned 5
	[0060.414] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF"
	[0060.414] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF"
	[0060.414] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF."
	[0060.414] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.exe"
	[0060.414] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02085_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0060.414] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x90c
	[0060.414] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x110c9494, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x110c9494, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x110ef705, dwHighDateTime=0x1d327e8)) returned 1
	[0060.414] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.414] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x8ca, lpOverlapped=0x0) returned 1
	[0060.416] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF") returned="WB02085_.GIF"
	[0060.416] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.416] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x8ca, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x8ca, lpOverlapped=0x0) returned 1
	[0060.416] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.416] CloseHandle (hObject=0x218) returned 1
	[0060.416] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02085_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02085_.gif.exe")) returned 1
	[0060.416] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x110ef705, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x110ef705, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x110ef705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x581, dwReserved0=0x33, dwReserved1=0x1, cFileName="WB02097_.GIF", cAlternateFileName="")) returned 1
	[0060.416] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0060.416] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB02097_.GIF") returned -1
	[0060.417] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB02097_.GIF") returned -1
	[0060.417] lstrcmpiA (lpString1="", lpString2="WB02097_.GIF") returned -1
	[0060.417] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF") returned="WB02085_.GIF"
	[0060.417] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\"
	[0060.417] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0060.417] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.417] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\how-to-decrypt-files.htm")) returned 0x20
	[0060.417] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02097_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF"
	[0060.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", pszSpec="*.zip") returned 0
	[0060.417] lstrlenA (lpString="*.zip") returned 5
	[0060.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", pszSpec="*.rar") returned 0
	[0060.417] lstrlenA (lpString="*.rar") returned 5
	[0060.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", pszSpec="*.7z") returned 0
	[0060.417] lstrlenA (lpString="*.7z") returned 4
	[0060.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", pszSpec="*.tar") returned 0
	[0060.417] lstrlenA (lpString="*.tar") returned 5
	[0060.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", pszSpec="*.gzip") returned 0
	[0060.417] lstrlenA (lpString="*.gzip") returned 6
	[0060.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", pszSpec="*.jpg") returned 0
	[0060.417] lstrlenA (lpString="*.jpg") returned 5
	[0060.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", pszSpec="*.jpeg") returned 0
	[0060.417] lstrlenA (lpString="*.jpeg") returned 6
	[0060.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", pszSpec="*.bmp") returned 0
	[0060.417] lstrlenA (lpString="*.bmp") returned 5
	[0060.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", pszSpec="*.gif") returned 1
	[0060.417] lstrlenA (lpString="*.gif") returned 5
	[0060.417] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF"
	[0060.417] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF"
	[0060.417] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF."
	[0060.417] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.exe"
	[0060.417] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02097_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0060.418] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x581
	[0060.418] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x110ef705, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x110ef705, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x110ef705, dwHighDateTime=0x1d327e8)) returned 1
	[0060.418] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.418] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x53f, lpOverlapped=0x0) returned 1
	[0060.423] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF") returned="WB02097_.GIF"
	[0060.423] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.423] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x53f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x53f, lpOverlapped=0x0) returned 1
	[0060.423] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.424] CloseHandle (hObject=0x218) returned 1
	[0060.424] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02097_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02097_.gif.exe")) returned 1
	[0060.424] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x110ef705, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x110ef705, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x110ef705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x15fa, dwReserved0=0x33, dwReserved1=0x1, cFileName="WB02106_.GIF", cAlternateFileName="")) returned 1
	[0060.424] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0060.424] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB02106_.GIF") returned -1
	[0060.424] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB02106_.GIF") returned -1
	[0060.424] lstrcmpiA (lpString1="", lpString2="WB02106_.GIF") returned -1
	[0060.424] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF") returned="WB02097_.GIF"
	[0060.424] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\"
	[0060.424] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0060.424] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.424] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\how-to-decrypt-files.htm")) returned 0x20
	[0060.424] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02106_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF"
	[0060.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", pszSpec="*.zip") returned 0
	[0060.425] lstrlenA (lpString="*.zip") returned 5
	[0060.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", pszSpec="*.rar") returned 0
	[0060.425] lstrlenA (lpString="*.rar") returned 5
	[0060.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", pszSpec="*.7z") returned 0
	[0060.425] lstrlenA (lpString="*.7z") returned 4
	[0060.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", pszSpec="*.tar") returned 0
	[0060.425] lstrlenA (lpString="*.tar") returned 5
	[0060.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", pszSpec="*.gzip") returned 0
	[0060.425] lstrlenA (lpString="*.gzip") returned 6
	[0060.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", pszSpec="*.jpg") returned 0
	[0060.425] lstrlenA (lpString="*.jpg") returned 5
	[0060.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", pszSpec="*.jpeg") returned 0
	[0060.425] lstrlenA (lpString="*.jpeg") returned 6
	[0060.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", pszSpec="*.bmp") returned 0
	[0060.425] lstrlenA (lpString="*.bmp") returned 5
	[0060.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", pszSpec="*.gif") returned 1
	[0060.425] lstrlenA (lpString="*.gif") returned 5
	[0060.425] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF"
	[0060.425] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF"
	[0060.425] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF."
	[0060.425] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.exe"
	[0060.425] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02106_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0060.425] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15fa
	[0060.425] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x110ef705, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x110ef705, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x110ef705, dwHighDateTime=0x1d327e8)) returned 1
	[0060.425] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.425] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x15b8, lpOverlapped=0x0) returned 1
	[0060.484] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF") returned="WB02106_.GIF"
	[0060.485] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.485] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x15b8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x15b8, lpOverlapped=0x0) returned 1
	[0060.485] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.485] CloseHandle (hObject=0x218) returned 1
	[0060.485] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02106_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02106_.gif.exe")) returned 1
	[0060.486] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1113bba3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3ef, dwReserved0=0x33, dwReserved1=0x1, cFileName="WB02116_.GIF", cAlternateFileName="")) returned 1
	[0060.486] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0060.486] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB02116_.GIF") returned -1
	[0060.486] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB02116_.GIF") returned -1
	[0060.486] lstrcmpiA (lpString1="", lpString2="WB02116_.GIF") returned -1
	[0060.486] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF") returned="WB02106_.GIF"
	[0060.486] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\"
	[0060.486] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0060.486] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.486] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\how-to-decrypt-files.htm")) returned 0x20
	[0060.486] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02116_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF"
	[0060.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", pszSpec="*.zip") returned 0
	[0060.486] lstrlenA (lpString="*.zip") returned 5
	[0060.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", pszSpec="*.rar") returned 0
	[0060.486] lstrlenA (lpString="*.rar") returned 5
	[0060.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", pszSpec="*.7z") returned 0
	[0060.486] lstrlenA (lpString="*.7z") returned 4
	[0060.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", pszSpec="*.tar") returned 0
	[0060.486] lstrlenA (lpString="*.tar") returned 5
	[0060.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", pszSpec="*.gzip") returned 0
	[0060.486] lstrlenA (lpString="*.gzip") returned 6
	[0060.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", pszSpec="*.jpg") returned 0
	[0060.486] lstrlenA (lpString="*.jpg") returned 5
	[0060.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", pszSpec="*.jpeg") returned 0
	[0060.486] lstrlenA (lpString="*.jpeg") returned 6
	[0060.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", pszSpec="*.bmp") returned 0
	[0060.486] lstrlenA (lpString="*.bmp") returned 5
	[0060.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", pszSpec="*.gif") returned 1
	[0060.486] lstrlenA (lpString="*.gif") returned 5
	[0060.486] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF"
	[0060.487] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF"
	[0060.487] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF."
	[0060.487] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.exe"
	[0060.487] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02116_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0060.488] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ef
	[0060.488] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1113bba3, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1113bba3, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1113bba3, dwHighDateTime=0x1d327e8)) returned 1
	[0060.488] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.488] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x3ad, lpOverlapped=0x0) returned 1
	[0060.523] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF") returned="WB02116_.GIF"
	[0060.523] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.523] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x3ad, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x3ad, lpOverlapped=0x0) returned 1
	[0060.523] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.523] CloseHandle (hObject=0x218) returned 1
	[0060.523] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02116_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02116_.gif.exe")) returned 1
	[0060.524] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x110c9494, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x110c9494, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x110c9494, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x97f, dwReserved0=0x33, dwReserved1=0x1, cFileName="WB02134_.GIF", cAlternateFileName="")) returned 1
	[0060.524] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0060.524] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB02134_.GIF") returned -1
	[0060.524] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB02134_.GIF") returned -1
	[0060.524] lstrcmpiA (lpString1="", lpString2="WB02134_.GIF") returned -1
	[0060.524] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF") returned="WB02116_.GIF"
	[0060.524] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\"
	[0060.524] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0060.524] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.524] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\how-to-decrypt-files.htm")) returned 0x20
	[0060.524] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02134_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF"
	[0060.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", pszSpec="*.zip") returned 0
	[0060.525] lstrlenA (lpString="*.zip") returned 5
	[0060.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", pszSpec="*.rar") returned 0
	[0060.525] lstrlenA (lpString="*.rar") returned 5
	[0060.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", pszSpec="*.7z") returned 0
	[0060.525] lstrlenA (lpString="*.7z") returned 4
	[0060.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", pszSpec="*.tar") returned 0
	[0060.525] lstrlenA (lpString="*.tar") returned 5
	[0060.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", pszSpec="*.gzip") returned 0
	[0060.525] lstrlenA (lpString="*.gzip") returned 6
	[0060.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", pszSpec="*.jpg") returned 0
	[0060.525] lstrlenA (lpString="*.jpg") returned 5
	[0060.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", pszSpec="*.jpeg") returned 0
	[0060.525] lstrlenA (lpString="*.jpeg") returned 6
	[0060.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", pszSpec="*.bmp") returned 0
	[0060.525] lstrlenA (lpString="*.bmp") returned 5
	[0060.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", pszSpec="*.gif") returned 1
	[0060.525] lstrlenA (lpString="*.gif") returned 5
	[0060.525] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF"
	[0060.525] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF"
	[0060.525] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF."
	[0060.525] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.exe"
	[0060.525] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02134_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0060.525] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x97f
	[0060.525] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x110c9494, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x110c9494, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x110c9494, dwHighDateTime=0x1d327e8)) returned 1
	[0060.525] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.526] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x93d, lpOverlapped=0x0) returned 1
	[0060.532] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF") returned="WB02134_.GIF"
	[0060.532] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.532] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x93d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x93d, lpOverlapped=0x0) returned 1
	[0060.532] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.532] CloseHandle (hObject=0x218) returned 1
	[0060.532] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02134_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02134_.gif.exe")) returned 1
	[0060.533] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x110a3267, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x110a3267, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x110c9494, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x579, dwReserved0=0x33, dwReserved1=0x1, cFileName="WB02187_.GIF", cAlternateFileName="")) returned 1
	[0060.533] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0060.533] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB02187_.GIF") returned -1
	[0060.533] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB02187_.GIF") returned -1
	[0060.533] lstrcmpiA (lpString1="", lpString2="WB02187_.GIF") returned -1
	[0060.533] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF") returned="WB02134_.GIF"
	[0060.533] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\"
	[0060.533] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0060.533] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.533] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\how-to-decrypt-files.htm")) returned 0x20
	[0060.533] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02187_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF"
	[0060.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", pszSpec="*.zip") returned 0
	[0060.533] lstrlenA (lpString="*.zip") returned 5
	[0060.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", pszSpec="*.rar") returned 0
	[0060.533] lstrlenA (lpString="*.rar") returned 5
	[0060.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", pszSpec="*.7z") returned 0
	[0060.533] lstrlenA (lpString="*.7z") returned 4
	[0060.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", pszSpec="*.tar") returned 0
	[0060.533] lstrlenA (lpString="*.tar") returned 5
	[0060.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", pszSpec="*.gzip") returned 0
	[0060.533] lstrlenA (lpString="*.gzip") returned 6
	[0060.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", pszSpec="*.jpg") returned 0
	[0060.533] lstrlenA (lpString="*.jpg") returned 5
	[0060.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", pszSpec="*.jpeg") returned 0
	[0060.533] lstrlenA (lpString="*.jpeg") returned 6
	[0060.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", pszSpec="*.bmp") returned 0
	[0060.534] lstrlenA (lpString="*.bmp") returned 5
	[0060.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", pszSpec="*.gif") returned 1
	[0060.534] lstrlenA (lpString="*.gif") returned 5
	[0060.534] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF"
	[0060.534] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF"
	[0060.534] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF."
	[0060.534] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.exe"
	[0060.534] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02187_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0060.534] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x579
	[0060.534] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x110a3267, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x110a3267, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x110c9494, dwHighDateTime=0x1d327e8)) returned 1
	[0060.534] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.535] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x537, lpOverlapped=0x0) returned 1
	[0060.536] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF") returned="WB02187_.GIF"
	[0060.536] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.536] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x537, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x537, lpOverlapped=0x0) returned 1
	[0060.536] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.536] CloseHandle (hObject=0x218) returned 1
	[0060.536] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02187_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02187_.gif.exe")) returned 1
	[0060.537] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x110a3267, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x110a3267, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x110a3267, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4abc, dwReserved0=0x33, dwReserved1=0x1, cFileName="WB02198_.GIF", cAlternateFileName="")) returned 1
	[0060.537] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0060.537] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB02198_.GIF") returned -1
	[0060.537] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB02198_.GIF") returned -1
	[0060.537] lstrcmpiA (lpString1="", lpString2="WB02198_.GIF") returned -1
	[0060.537] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF") returned="WB02187_.GIF"
	[0060.537] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\"
	[0060.537] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0060.537] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.537] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\how-to-decrypt-files.htm")) returned 0x20
	[0060.537] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02198_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF"
	[0060.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", pszSpec="*.zip") returned 0
	[0060.537] lstrlenA (lpString="*.zip") returned 5
	[0060.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", pszSpec="*.rar") returned 0
	[0060.537] lstrlenA (lpString="*.rar") returned 5
	[0060.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", pszSpec="*.7z") returned 0
	[0060.537] lstrlenA (lpString="*.7z") returned 4
	[0060.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", pszSpec="*.tar") returned 0
	[0060.537] lstrlenA (lpString="*.tar") returned 5
	[0060.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", pszSpec="*.gzip") returned 0
	[0060.537] lstrlenA (lpString="*.gzip") returned 6
	[0060.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", pszSpec="*.jpg") returned 0
	[0060.537] lstrlenA (lpString="*.jpg") returned 5
	[0060.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", pszSpec="*.jpeg") returned 0
	[0060.537] lstrlenA (lpString="*.jpeg") returned 6
	[0060.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", pszSpec="*.bmp") returned 0
	[0060.537] lstrlenA (lpString="*.bmp") returned 5
	[0060.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", pszSpec="*.gif") returned 1
	[0060.537] lstrlenA (lpString="*.gif") returned 5
	[0060.537] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF"
	[0060.538] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF"
	[0060.538] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF."
	[0060.538] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.exe"
	[0060.538] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02198_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0060.538] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4abc
	[0060.538] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x110a3267, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x110a3267, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x110a3267, dwHighDateTime=0x1d327e8)) returned 1
	[0060.538] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.538] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x4a7a, lpOverlapped=0x0) returned 1
	[0060.539] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF") returned="WB02198_.GIF"
	[0060.539] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.539] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x4a7a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x4a7a, lpOverlapped=0x0) returned 1
	[0060.540] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.540] CloseHandle (hObject=0x218) returned 1
	[0060.540] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02198_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02198_.gif.exe")) returned 1
	[0060.540] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x110a3267, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x110a3267, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x110a3267, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1653, dwReserved0=0x33, dwReserved1=0x1, cFileName="WB02201_.GIF", cAlternateFileName="")) returned 1
	[0060.540] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0060.540] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB02201_.GIF") returned -1
	[0060.540] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB02201_.GIF") returned -1
	[0060.540] lstrcmpiA (lpString1="", lpString2="WB02201_.GIF") returned -1
	[0060.540] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF") returned="WB02198_.GIF"
	[0060.540] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\"
	[0060.540] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0060.540] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.541] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\how-to-decrypt-files.htm")) returned 0x20
	[0060.541] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02201_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF"
	[0060.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", pszSpec="*.zip") returned 0
	[0060.541] lstrlenA (lpString="*.zip") returned 5
	[0060.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", pszSpec="*.rar") returned 0
	[0060.541] lstrlenA (lpString="*.rar") returned 5
	[0060.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", pszSpec="*.7z") returned 0
	[0060.541] lstrlenA (lpString="*.7z") returned 4
	[0060.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", pszSpec="*.tar") returned 0
	[0060.541] lstrlenA (lpString="*.tar") returned 5
	[0060.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", pszSpec="*.gzip") returned 0
	[0060.541] lstrlenA (lpString="*.gzip") returned 6
	[0060.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", pszSpec="*.jpg") returned 0
	[0060.541] lstrlenA (lpString="*.jpg") returned 5
	[0060.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", pszSpec="*.jpeg") returned 0
	[0060.541] lstrlenA (lpString="*.jpeg") returned 6
	[0060.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", pszSpec="*.bmp") returned 0
	[0060.541] lstrlenA (lpString="*.bmp") returned 5
	[0060.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", pszSpec="*.gif") returned 1
	[0060.541] lstrlenA (lpString="*.gif") returned 5
	[0060.541] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF"
	[0060.541] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF"
	[0060.541] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF."
	[0060.541] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.exe"
	[0060.541] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02201_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0060.542] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1653
	[0060.542] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x110a3267, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x110a3267, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x110a3267, dwHighDateTime=0x1d327e8)) returned 1
	[0060.542] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.542] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1611, lpOverlapped=0x0) returned 1
	[0060.570] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF") returned="WB02201_.GIF"
	[0060.570] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.571] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1611, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1611, lpOverlapped=0x0) returned 1
	[0060.571] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.571] CloseHandle (hObject=0x218) returned 1
	[0060.571] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02201_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02201_.gif.exe")) returned 1
	[0060.572] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x110a3267, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x110a3267, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x110c9494, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x136b, dwReserved0=0x33, dwReserved1=0x1, cFileName="WB02214_.GIF", cAlternateFileName="")) returned 1
	[0060.572] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0060.572] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB02214_.GIF") returned -1
	[0060.572] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB02214_.GIF") returned -1
	[0060.572] lstrcmpiA (lpString1="", lpString2="WB02214_.GIF") returned -1
	[0060.572] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF") returned="WB02201_.GIF"
	[0060.572] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\"
	[0060.572] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0060.572] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.572] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\how-to-decrypt-files.htm")) returned 0x20
	[0060.572] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02214_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF"
	[0060.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", pszSpec="*.zip") returned 0
	[0060.572] lstrlenA (lpString="*.zip") returned 5
	[0060.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", pszSpec="*.rar") returned 0
	[0060.572] lstrlenA (lpString="*.rar") returned 5
	[0060.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", pszSpec="*.7z") returned 0
	[0060.572] lstrlenA (lpString="*.7z") returned 4
	[0060.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", pszSpec="*.tar") returned 0
	[0060.572] lstrlenA (lpString="*.tar") returned 5
	[0060.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", pszSpec="*.gzip") returned 0
	[0060.572] lstrlenA (lpString="*.gzip") returned 6
	[0060.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", pszSpec="*.jpg") returned 0
	[0060.572] lstrlenA (lpString="*.jpg") returned 5
	[0060.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", pszSpec="*.jpeg") returned 0
	[0060.572] lstrlenA (lpString="*.jpeg") returned 6
	[0060.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", pszSpec="*.bmp") returned 0
	[0060.572] lstrlenA (lpString="*.bmp") returned 5
	[0060.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", pszSpec="*.gif") returned 1
	[0060.572] lstrlenA (lpString="*.gif") returned 5
	[0060.572] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF"
	[0060.573] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF"
	[0060.573] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF."
	[0060.573] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.exe"
	[0060.573] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02214_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0060.573] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x136b
	[0060.573] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x110a3267, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x110a3267, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x110c9494, dwHighDateTime=0x1d327e8)) returned 1
	[0060.573] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.573] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1329, lpOverlapped=0x0) returned 1
	[0060.635] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF") returned="WB02214_.GIF"
	[0060.635] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.635] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1329, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1329, lpOverlapped=0x0) returned 1
	[0060.635] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.635] CloseHandle (hObject=0x218) returned 1
	[0060.635] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02214_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02214_.gif.exe")) returned 1
	[0060.642] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x110a3267, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x110a3267, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x110ef705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x33, dwReserved1=0x1, cFileName="WB02218_.GIF", cAlternateFileName="")) returned 1
	[0060.642] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0060.642] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WB02218_.GIF") returned -1
	[0060.642] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WB02218_.GIF") returned -1
	[0060.642] lstrcmpiA (lpString1="", lpString2="WB02218_.GIF") returned -1
	[0060.642] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF") returned="WB02214_.GIF"
	[0060.642] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\"
	[0060.642] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0060.642] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.642] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\how-to-decrypt-files.htm")) returned 0x20
	[0060.642] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02218_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF"
	[0060.642] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", pszSpec="*.zip") returned 0
	[0060.642] lstrlenA (lpString="*.zip") returned 5
	[0060.642] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", pszSpec="*.rar") returned 0
	[0060.642] lstrlenA (lpString="*.rar") returned 5
	[0060.642] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", pszSpec="*.7z") returned 0
	[0060.642] lstrlenA (lpString="*.7z") returned 4
	[0060.643] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", pszSpec="*.tar") returned 0
	[0060.643] lstrlenA (lpString="*.tar") returned 5
	[0060.643] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", pszSpec="*.gzip") returned 0
	[0060.643] lstrlenA (lpString="*.gzip") returned 6
	[0060.643] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", pszSpec="*.jpg") returned 0
	[0060.643] lstrlenA (lpString="*.jpg") returned 5
	[0060.643] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", pszSpec="*.jpeg") returned 0
	[0060.643] lstrlenA (lpString="*.jpeg") returned 6
	[0060.643] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", pszSpec="*.bmp") returned 0
	[0060.643] lstrlenA (lpString="*.bmp") returned 5
	[0060.643] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", pszSpec="*.gif") returned 1
	[0060.643] lstrlenA (lpString="*.gif") returned 5
	[0060.643] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF"
	[0060.643] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF"
	[0060.643] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF."
	[0060.643] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.exe") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.exe"
	[0060.643] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02218_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0060.643] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbc4
	[0060.643] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x110a3267, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x110a3267, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x110ef705, dwHighDateTime=0x1d327e8)) returned 1
	[0060.643] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.643] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xb82, lpOverlapped=0x0) returned 1
	[0060.645] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF") returned="WB02218_.GIF"
	[0060.645] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0060.645] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xb82, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xb82, lpOverlapped=0x0) returned 1
	[0060.645] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.645] CloseHandle (hObject=0x218) returned 1
	[0060.645] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02218_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02218_.gif.exe")) returned 1
	[0060.645] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x110a3267, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x110a3267, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x110ef705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x33, dwReserved1=0x1, cFileName="WB02218_.GIF", cAlternateFileName="")) returned 0
	[0060.646] FindClose (in: hFindFile=0x7cb650 | out: hFindFile=0x7cb650) returned 1
	[0060.646] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 0
	[0060.646] FindClose (in: hFindFile=0x7cb590 | out: hFindFile=0x7cb590) returned 1
	[0060.646] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 0
	[0060.646] FindClose (in: hFindFile=0x7cbad0 | out: hFindFile=0x7cbad0) returned 1
	[0060.646] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x7d7d78, cFileName="Document Themes 16", cAlternateFileName="DOCUME~1")) returned 1
	[0060.646] lstrcmpA (lpString1=".", lpString2="Document Themes 16") returned -1
	[0060.646] lstrcmpA (lpString1="..", lpString2="Document Themes 16") returned -1
	[0060.646] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\*.*") returned="*.*"
	[0060.646] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\", lpString2="Document Themes 16" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16"
	[0060.646] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16") returned 57
	[0060.646] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb850
	[0060.647] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0060.647] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.647] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0060.647] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0060.647] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x110ef705, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x110ef705, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11161e0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb447d, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="Facet.thmx", cAlternateFileName="FACET~1.THM")) returned 1
	[0060.647] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0060.647] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Facet.thmx") returned -1
	[0060.647] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Facet.thmx") returned 1
	[0060.647] lstrcmpiA (lpString1="", lpString2="Facet.thmx") returned -1
	[0060.647] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\*.*") returned="*.*"
	[0060.647] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\"
	[0060.647] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\") returned=""
	[0060.647] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.647] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0060.647] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0060.648] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0060.648] WriteFile (in: hFile=0x210, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0060.649] SetFileTime (hFile=0x210, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0060.649] CloseHandle (hObject=0x210) returned 1
	[0060.649] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\", lpString2="Facet.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx"
	[0060.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.zip") returned 0
	[0060.649] lstrlenA (lpString="*.zip") returned 5
	[0060.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.rar") returned 0
	[0060.649] lstrlenA (lpString="*.rar") returned 5
	[0060.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.7z") returned 0
	[0060.649] lstrlenA (lpString="*.7z") returned 4
	[0060.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.tar") returned 0
	[0060.649] lstrlenA (lpString="*.tar") returned 5
	[0060.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.gzip") returned 0
	[0060.649] lstrlenA (lpString="*.gzip") returned 6
	[0060.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.jpg") returned 0
	[0060.649] lstrlenA (lpString="*.jpg") returned 5
	[0060.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.jpeg") returned 0
	[0060.650] lstrlenA (lpString="*.jpeg") returned 6
	[0060.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.bmp") returned 0
	[0060.650] lstrlenA (lpString="*.bmp") returned 5
	[0060.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.gif") returned 0
	[0060.650] lstrlenA (lpString="*.gif") returned 5
	[0060.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.png") returned 0
	[0060.650] lstrlenA (lpString="*.png") returned 5
	[0060.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.doc") returned 0
	[0060.650] lstrlenA (lpString="*.doc") returned 5
	[0060.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.docx") returned 0
	[0060.650] lstrlenA (lpString="*.docx") returned 6
	[0060.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.xls") returned 0
	[0060.650] lstrlenA (lpString="*.xls") returned 5
	[0060.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.xlsx") returned 0
	[0060.650] lstrlenA (lpString="*.xlsx") returned 6
	[0060.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.ppt") returned 0
	[0060.650] lstrlenA (lpString="*.ppt") returned 5
	[0060.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.pptx") returned 0
	[0060.650] lstrlenA (lpString="*.pptx") returned 6
	[0060.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.txt") returned 0
	[0060.650] lstrlenA (lpString="*.txt") returned 5
	[0060.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.pdf") returned 0
	[0060.650] lstrlenA (lpString="*.pdf") returned 5
	[0060.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.htm") returned 0
	[0060.650] lstrlenA (lpString="*.htm") returned 5
	[0060.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.html") returned 0
	[0060.650] lstrlenA (lpString="*.html") returned 6
	[0060.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.mdb") returned 0
	[0060.650] lstrlenA (lpString="*.mdb") returned 5
	[0060.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.pfx") returned 0
	[0060.650] lstrlenA (lpString="*.pfx") returned 5
	[0060.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.md") returned 0
	[0060.650] lstrlenA (lpString="*.md") returned 4
	[0060.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.lnk") returned 0
	[0060.650] lstrlenA (lpString="*.lnk") returned 5
	[0060.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.torrent") returned 0
	[0060.651] lstrlenA (lpString="*.torrent") returned 9
	[0060.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.mov") returned 0
	[0060.651] lstrlenA (lpString="*.mov") returned 5
	[0060.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.3gp") returned 0
	[0060.651] lstrlenA (lpString="*.3gp") returned 5
	[0060.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.mpeg") returned 0
	[0060.651] lstrlenA (lpString="*.mpeg") returned 6
	[0060.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.mpg") returned 0
	[0060.651] lstrlenA (lpString="*.mpg") returned 5
	[0060.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.flv") returned 0
	[0060.651] lstrlenA (lpString="*.flv") returned 5
	[0060.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.avi") returned 0
	[0060.651] lstrlenA (lpString="*.avi") returned 5
	[0060.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.mp4") returned 0
	[0060.651] lstrlenA (lpString="*.mp4") returned 5
	[0060.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.wmv") returned 0
	[0060.651] lstrlenA (lpString="*.wmv") returned 5
	[0060.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.mkv") returned 0
	[0060.651] lstrlenA (lpString="*.mkv") returned 5
	[0060.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.mp3") returned 0
	[0060.651] lstrlenA (lpString="*.mp3") returned 5
	[0060.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.wav") returned 0
	[0060.651] lstrlenA (lpString="*.wav") returned 5
	[0060.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.flac") returned 0
	[0060.651] lstrlenA (lpString="*.flac") returned 6
	[0060.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.wma") returned 0
	[0060.651] lstrlenA (lpString="*.wma") returned 5
	[0060.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.au3") returned 0
	[0060.651] lstrlenA (lpString="*.au3") returned 5
	[0060.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.ahk") returned 0
	[0060.651] lstrlenA (lpString="*.ahk") returned 5
	[0060.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.c") returned 0
	[0060.651] lstrlenA (lpString="*.c") returned 3
	[0060.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.cc") returned 0
	[0060.651] lstrlenA (lpString="*.cc") returned 4
	[0060.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.cpp") returned 0
	[0060.651] lstrlenA (lpString="*.cpp") returned 5
	[0060.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.cxx") returned 0
	[0060.652] lstrlenA (lpString="*.cxx") returned 5
	[0060.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.c++") returned 0
	[0060.652] lstrlenA (lpString="*.c++") returned 5
	[0060.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.cs") returned 0
	[0060.652] lstrlenA (lpString="*.cs") returned 4
	[0060.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.vb") returned 0
	[0060.652] lstrlenA (lpString="*.vb") returned 4
	[0060.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.bas") returned 0
	[0060.652] lstrlenA (lpString="*.bas") returned 5
	[0060.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.csproj") returned 0
	[0060.652] lstrlenA (lpString="*.csproj") returned 8
	[0060.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.vbproj") returned 0
	[0060.652] lstrlenA (lpString="*.vbproj") returned 8
	[0060.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.vcxproj") returned 0
	[0060.652] lstrlenA (lpString="*.vcxproj") returned 9
	[0060.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.manifest") returned 0
	[0060.652] lstrlenA (lpString="*.manifest") returned 10
	[0060.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.php") returned 0
	[0060.652] lstrlenA (lpString="*.php") returned 5
	[0060.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.vbe") returned 0
	[0060.652] lstrlenA (lpString="*.vbe") returned 5
	[0060.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.vba") returned 0
	[0060.652] lstrlenA (lpString="*.vba") returned 5
	[0060.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.vbs") returned 0
	[0060.652] lstrlenA (lpString="*.vbs") returned 5
	[0060.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.bat") returned 0
	[0060.652] lstrlenA (lpString="*.bat") returned 5
	[0060.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.cmd") returned 0
	[0060.652] lstrlenA (lpString="*.cmd") returned 5
	[0060.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.js") returned 0
	[0060.652] lstrlenA (lpString="*.js") returned 4
	[0060.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.jscript") returned 0
	[0060.652] lstrlenA (lpString="*.jscript") returned 9
	[0060.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.hta") returned 0
	[0060.652] lstrlenA (lpString="*.hta") returned 5
	[0060.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.php7") returned 0
	[0060.653] lstrlenA (lpString="*.php7") returned 6
	[0060.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.db") returned 0
	[0060.653] lstrlenA (lpString="*.db") returned 4
	[0060.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.swf") returned 0
	[0060.653] lstrlenA (lpString="*.swf") returned 5
	[0060.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.eml") returned 0
	[0060.653] lstrlenA (lpString="*.eml") returned 5
	[0060.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.part") returned 0
	[0060.653] lstrlenA (lpString="*.part") returned 6
	[0060.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.nfo") returned 0
	[0060.653] lstrlenA (lpString="*.nfo") returned 5
	[0060.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.rsa") returned 0
	[0060.653] lstrlenA (lpString="*.rsa") returned 5
	[0060.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.key") returned 0
	[0060.653] lstrlenA (lpString="*.key") returned 5
	[0060.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.aes") returned 0
	[0060.653] lstrlenA (lpString="*.aes") returned 5
	[0060.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.blob") returned 0
	[0060.653] lstrlenA (lpString="*.blob") returned 6
	[0060.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.btc") returned 0
	[0060.653] lstrlenA (lpString="*.btc") returned 5
	[0060.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx", pszSpec="*.wallet") returned 0
	[0060.653] lstrlenA (lpString="*.wallet") returned 8
	[0060.653] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x110ef705, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x110ef705, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1132ba98, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3495ac, dwReserved0=0x0, dwReserved1=0x1, cFileName="Integral.thmx", cAlternateFileName="INTEGR~1.THM")) returned 1
	[0060.653] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0060.653] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Integral.thmx") returned -1
	[0060.653] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Integral.thmx") returned -1
	[0060.653] lstrcmpiA (lpString1="", lpString2="Integral.thmx") returned -1
	[0060.653] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx") returned="Facet.thmx"
	[0060.653] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\"
	[0060.654] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\") returned=""
	[0060.654] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.654] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\how-to-decrypt-files.htm")) returned 0x20
	[0060.654] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\", lpString2="Integral.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx"
	[0060.654] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.zip") returned 0
	[0060.654] lstrlenA (lpString="*.zip") returned 5
	[0060.654] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.rar") returned 0
	[0060.654] lstrlenA (lpString="*.rar") returned 5
	[0060.654] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.7z") returned 0
	[0060.654] lstrlenA (lpString="*.7z") returned 4
	[0060.654] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.tar") returned 0
	[0060.654] lstrlenA (lpString="*.tar") returned 5
	[0060.654] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.gzip") returned 0
	[0060.654] lstrlenA (lpString="*.gzip") returned 6
	[0060.654] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.jpg") returned 0
	[0060.654] lstrlenA (lpString="*.jpg") returned 5
	[0060.654] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.jpeg") returned 0
	[0060.654] lstrlenA (lpString="*.jpeg") returned 6
	[0060.654] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.bmp") returned 0
	[0060.654] lstrlenA (lpString="*.bmp") returned 5
	[0060.654] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.gif") returned 0
	[0060.654] lstrlenA (lpString="*.gif") returned 5
	[0060.654] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.png") returned 0
	[0060.654] lstrlenA (lpString="*.png") returned 5
	[0060.654] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.doc") returned 0
	[0060.654] lstrlenA (lpString="*.doc") returned 5
	[0060.654] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.docx") returned 0
	[0060.654] lstrlenA (lpString="*.docx") returned 6
	[0060.654] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.xls") returned 0
	[0060.654] lstrlenA (lpString="*.xls") returned 5
	[0060.654] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.xlsx") returned 0
	[0060.654] lstrlenA (lpString="*.xlsx") returned 6
	[0060.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.ppt") returned 0
	[0060.655] lstrlenA (lpString="*.ppt") returned 5
	[0060.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.pptx") returned 0
	[0060.655] lstrlenA (lpString="*.pptx") returned 6
	[0060.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.txt") returned 0
	[0060.655] lstrlenA (lpString="*.txt") returned 5
	[0060.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.pdf") returned 0
	[0060.655] lstrlenA (lpString="*.pdf") returned 5
	[0060.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.htm") returned 0
	[0060.655] lstrlenA (lpString="*.htm") returned 5
	[0060.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.html") returned 0
	[0060.655] lstrlenA (lpString="*.html") returned 6
	[0060.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.mdb") returned 0
	[0060.655] lstrlenA (lpString="*.mdb") returned 5
	[0060.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.pfx") returned 0
	[0060.655] lstrlenA (lpString="*.pfx") returned 5
	[0060.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.md") returned 0
	[0060.655] lstrlenA (lpString="*.md") returned 4
	[0060.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.lnk") returned 0
	[0060.655] lstrlenA (lpString="*.lnk") returned 5
	[0060.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.torrent") returned 0
	[0060.655] lstrlenA (lpString="*.torrent") returned 9
	[0060.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.mov") returned 0
	[0060.655] lstrlenA (lpString="*.mov") returned 5
	[0060.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.3gp") returned 0
	[0060.655] lstrlenA (lpString="*.3gp") returned 5
	[0060.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.mpeg") returned 0
	[0060.655] lstrlenA (lpString="*.mpeg") returned 6
	[0060.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.mpg") returned 0
	[0060.655] lstrlenA (lpString="*.mpg") returned 5
	[0060.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.flv") returned 0
	[0060.655] lstrlenA (lpString="*.flv") returned 5
	[0060.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.avi") returned 0
	[0060.655] lstrlenA (lpString="*.avi") returned 5
	[0060.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.mp4") returned 0
	[0060.655] lstrlenA (lpString="*.mp4") returned 5
	[0060.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.wmv") returned 0
	[0060.656] lstrlenA (lpString="*.wmv") returned 5
	[0060.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.mkv") returned 0
	[0060.656] lstrlenA (lpString="*.mkv") returned 5
	[0060.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.mp3") returned 0
	[0060.656] lstrlenA (lpString="*.mp3") returned 5
	[0060.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.wav") returned 0
	[0060.656] lstrlenA (lpString="*.wav") returned 5
	[0060.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.flac") returned 0
	[0060.656] lstrlenA (lpString="*.flac") returned 6
	[0060.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.wma") returned 0
	[0060.656] lstrlenA (lpString="*.wma") returned 5
	[0060.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.au3") returned 0
	[0060.656] lstrlenA (lpString="*.au3") returned 5
	[0060.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.ahk") returned 0
	[0060.656] lstrlenA (lpString="*.ahk") returned 5
	[0060.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.c") returned 0
	[0060.656] lstrlenA (lpString="*.c") returned 3
	[0060.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.cc") returned 0
	[0060.656] lstrlenA (lpString="*.cc") returned 4
	[0060.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.cpp") returned 0
	[0060.656] lstrlenA (lpString="*.cpp") returned 5
	[0060.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.cxx") returned 0
	[0060.656] lstrlenA (lpString="*.cxx") returned 5
	[0060.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.c++") returned 0
	[0060.656] lstrlenA (lpString="*.c++") returned 5
	[0060.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.cs") returned 0
	[0060.656] lstrlenA (lpString="*.cs") returned 4
	[0060.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.vb") returned 0
	[0060.656] lstrlenA (lpString="*.vb") returned 4
	[0060.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.bas") returned 0
	[0060.656] lstrlenA (lpString="*.bas") returned 5
	[0060.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.csproj") returned 0
	[0060.656] lstrlenA (lpString="*.csproj") returned 8
	[0060.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.vbproj") returned 0
	[0060.656] lstrlenA (lpString="*.vbproj") returned 8
	[0060.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.vcxproj") returned 0
	[0060.657] lstrlenA (lpString="*.vcxproj") returned 9
	[0060.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.manifest") returned 0
	[0060.657] lstrlenA (lpString="*.manifest") returned 10
	[0060.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.php") returned 0
	[0060.657] lstrlenA (lpString="*.php") returned 5
	[0060.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.vbe") returned 0
	[0060.657] lstrlenA (lpString="*.vbe") returned 5
	[0060.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.vba") returned 0
	[0060.657] lstrlenA (lpString="*.vba") returned 5
	[0060.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.vbs") returned 0
	[0060.657] lstrlenA (lpString="*.vbs") returned 5
	[0060.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.bat") returned 0
	[0060.657] lstrlenA (lpString="*.bat") returned 5
	[0060.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.cmd") returned 0
	[0060.657] lstrlenA (lpString="*.cmd") returned 5
	[0060.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.js") returned 0
	[0060.657] lstrlenA (lpString="*.js") returned 4
	[0060.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.jscript") returned 0
	[0060.657] lstrlenA (lpString="*.jscript") returned 9
	[0060.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.hta") returned 0
	[0060.657] lstrlenA (lpString="*.hta") returned 5
	[0060.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.php7") returned 0
	[0060.657] lstrlenA (lpString="*.php7") returned 6
	[0060.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.db") returned 0
	[0060.657] lstrlenA (lpString="*.db") returned 4
	[0060.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.swf") returned 0
	[0060.657] lstrlenA (lpString="*.swf") returned 5
	[0060.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.eml") returned 0
	[0060.657] lstrlenA (lpString="*.eml") returned 5
	[0060.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.part") returned 0
	[0060.657] lstrlenA (lpString="*.part") returned 6
	[0060.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.nfo") returned 0
	[0060.657] lstrlenA (lpString="*.nfo") returned 5
	[0060.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.rsa") returned 0
	[0060.657] lstrlenA (lpString="*.rsa") returned 5
	[0060.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.key") returned 0
	[0060.657] lstrlenA (lpString="*.key") returned 5
	[0060.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.aes") returned 0
	[0060.658] lstrlenA (lpString="*.aes") returned 5
	[0060.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.blob") returned 0
	[0060.658] lstrlenA (lpString="*.blob") returned 6
	[0060.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.btc") returned 0
	[0060.658] lstrlenA (lpString="*.btc") returned 5
	[0060.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx", pszSpec="*.wallet") returned 0
	[0060.658] lstrlenA (lpString="*.wallet") returned 8
	[0060.658] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11161e0e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11161e0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1132ba98, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1855eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ion Boardroom.thmx", cAlternateFileName="IONBOA~1.THM")) returned 1
	[0060.658] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0060.658] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Ion Boardroom.thmx") returned -1
	[0060.658] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Ion Boardroom.thmx") returned -1
	[0060.658] lstrcmpiA (lpString1="", lpString2="Ion Boardroom.thmx") returned -1
	[0060.658] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx") returned="Integral.thmx"
	[0060.658] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\"
	[0060.658] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\") returned=""
	[0060.658] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.658] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\how-to-decrypt-files.htm")) returned 0x20
	[0060.658] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\", lpString2="Ion Boardroom.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx"
	[0060.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.zip") returned 0
	[0060.658] lstrlenA (lpString="*.zip") returned 5
	[0060.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.rar") returned 0
	[0060.658] lstrlenA (lpString="*.rar") returned 5
	[0060.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.7z") returned 0
	[0060.658] lstrlenA (lpString="*.7z") returned 4
	[0060.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.tar") returned 0
	[0060.658] lstrlenA (lpString="*.tar") returned 5
	[0060.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.gzip") returned 0
	[0060.658] lstrlenA (lpString="*.gzip") returned 6
	[0060.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.jpg") returned 0
	[0060.658] lstrlenA (lpString="*.jpg") returned 5
	[0060.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.jpeg") returned 0
	[0060.658] lstrlenA (lpString="*.jpeg") returned 6
	[0060.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.bmp") returned 0
	[0060.659] lstrlenA (lpString="*.bmp") returned 5
	[0060.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.gif") returned 0
	[0060.659] lstrlenA (lpString="*.gif") returned 5
	[0060.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.png") returned 0
	[0060.659] lstrlenA (lpString="*.png") returned 5
	[0060.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.doc") returned 0
	[0060.659] lstrlenA (lpString="*.doc") returned 5
	[0060.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.docx") returned 0
	[0060.659] lstrlenA (lpString="*.docx") returned 6
	[0060.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.xls") returned 0
	[0060.659] lstrlenA (lpString="*.xls") returned 5
	[0060.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.xlsx") returned 0
	[0060.659] lstrlenA (lpString="*.xlsx") returned 6
	[0060.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.ppt") returned 0
	[0060.659] lstrlenA (lpString="*.ppt") returned 5
	[0060.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.pptx") returned 0
	[0060.659] lstrlenA (lpString="*.pptx") returned 6
	[0060.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.txt") returned 0
	[0060.659] lstrlenA (lpString="*.txt") returned 5
	[0060.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.pdf") returned 0
	[0060.659] lstrlenA (lpString="*.pdf") returned 5
	[0060.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.htm") returned 0
	[0060.659] lstrlenA (lpString="*.htm") returned 5
	[0060.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.html") returned 0
	[0060.659] lstrlenA (lpString="*.html") returned 6
	[0060.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.mdb") returned 0
	[0060.659] lstrlenA (lpString="*.mdb") returned 5
	[0060.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.pfx") returned 0
	[0060.659] lstrlenA (lpString="*.pfx") returned 5
	[0060.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.md") returned 0
	[0060.659] lstrlenA (lpString="*.md") returned 4
	[0060.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.lnk") returned 0
	[0060.659] lstrlenA (lpString="*.lnk") returned 5
	[0060.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.torrent") returned 0
	[0060.659] lstrlenA (lpString="*.torrent") returned 9
	[0060.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.mov") returned 0
	[0060.660] lstrlenA (lpString="*.mov") returned 5
	[0060.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.3gp") returned 0
	[0060.660] lstrlenA (lpString="*.3gp") returned 5
	[0060.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.mpeg") returned 0
	[0060.660] lstrlenA (lpString="*.mpeg") returned 6
	[0060.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.mpg") returned 0
	[0060.660] lstrlenA (lpString="*.mpg") returned 5
	[0060.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.flv") returned 0
	[0060.660] lstrlenA (lpString="*.flv") returned 5
	[0060.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.avi") returned 0
	[0060.660] lstrlenA (lpString="*.avi") returned 5
	[0060.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.mp4") returned 0
	[0060.660] lstrlenA (lpString="*.mp4") returned 5
	[0060.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.wmv") returned 0
	[0060.660] lstrlenA (lpString="*.wmv") returned 5
	[0060.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.mkv") returned 0
	[0060.660] lstrlenA (lpString="*.mkv") returned 5
	[0060.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.mp3") returned 0
	[0060.660] lstrlenA (lpString="*.mp3") returned 5
	[0060.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.wav") returned 0
	[0060.660] lstrlenA (lpString="*.wav") returned 5
	[0060.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.flac") returned 0
	[0060.660] lstrlenA (lpString="*.flac") returned 6
	[0060.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.wma") returned 0
	[0060.660] lstrlenA (lpString="*.wma") returned 5
	[0060.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.au3") returned 0
	[0060.660] lstrlenA (lpString="*.au3") returned 5
	[0060.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.ahk") returned 0
	[0060.660] lstrlenA (lpString="*.ahk") returned 5
	[0060.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.c") returned 0
	[0060.660] lstrlenA (lpString="*.c") returned 3
	[0060.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.cc") returned 0
	[0060.660] lstrlenA (lpString="*.cc") returned 4
	[0060.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.cpp") returned 0
	[0060.661] lstrlenA (lpString="*.cpp") returned 5
	[0060.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.cxx") returned 0
	[0060.661] lstrlenA (lpString="*.cxx") returned 5
	[0060.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.c++") returned 0
	[0060.661] lstrlenA (lpString="*.c++") returned 5
	[0060.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.cs") returned 0
	[0060.661] lstrlenA (lpString="*.cs") returned 4
	[0060.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.vb") returned 0
	[0060.661] lstrlenA (lpString="*.vb") returned 4
	[0060.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.bas") returned 0
	[0060.661] lstrlenA (lpString="*.bas") returned 5
	[0060.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.csproj") returned 0
	[0060.661] lstrlenA (lpString="*.csproj") returned 8
	[0060.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.vbproj") returned 0
	[0060.661] lstrlenA (lpString="*.vbproj") returned 8
	[0060.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.vcxproj") returned 0
	[0060.661] lstrlenA (lpString="*.vcxproj") returned 9
	[0060.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.manifest") returned 0
	[0060.661] lstrlenA (lpString="*.manifest") returned 10
	[0060.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.php") returned 0
	[0060.661] lstrlenA (lpString="*.php") returned 5
	[0060.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.vbe") returned 0
	[0060.661] lstrlenA (lpString="*.vbe") returned 5
	[0060.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.vba") returned 0
	[0060.661] lstrlenA (lpString="*.vba") returned 5
	[0060.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.vbs") returned 0
	[0060.661] lstrlenA (lpString="*.vbs") returned 5
	[0060.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.bat") returned 0
	[0060.661] lstrlenA (lpString="*.bat") returned 5
	[0060.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.cmd") returned 0
	[0060.661] lstrlenA (lpString="*.cmd") returned 5
	[0060.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.js") returned 0
	[0060.661] lstrlenA (lpString="*.js") returned 4
	[0060.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.jscript") returned 0
	[0060.661] lstrlenA (lpString="*.jscript") returned 9
	[0060.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.hta") returned 0
	[0060.661] lstrlenA (lpString="*.hta") returned 5
	[0060.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.php7") returned 0
	[0060.662] lstrlenA (lpString="*.php7") returned 6
	[0060.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.db") returned 0
	[0060.662] lstrlenA (lpString="*.db") returned 4
	[0060.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.swf") returned 0
	[0060.662] lstrlenA (lpString="*.swf") returned 5
	[0060.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.eml") returned 0
	[0060.662] lstrlenA (lpString="*.eml") returned 5
	[0060.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.part") returned 0
	[0060.662] lstrlenA (lpString="*.part") returned 6
	[0060.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.nfo") returned 0
	[0060.662] lstrlenA (lpString="*.nfo") returned 5
	[0060.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.rsa") returned 0
	[0060.662] lstrlenA (lpString="*.rsa") returned 5
	[0060.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.key") returned 0
	[0060.662] lstrlenA (lpString="*.key") returned 5
	[0060.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.aes") returned 0
	[0060.662] lstrlenA (lpString="*.aes") returned 5
	[0060.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.blob") returned 0
	[0060.662] lstrlenA (lpString="*.blob") returned 6
	[0060.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.btc") returned 0
	[0060.662] lstrlenA (lpString="*.btc") returned 5
	[0060.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx", pszSpec="*.wallet") returned 0
	[0060.662] lstrlenA (lpString="*.wallet") returned 8
	[0060.662] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1118806a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1118806a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x111ae2aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c09db, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ion.thmx", cAlternateFileName="ION~1.THM")) returned 1
	[0060.662] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0060.662] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Ion.thmx") returned -1
	[0060.662] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Ion.thmx") returned -1
	[0060.662] lstrcmpiA (lpString1="", lpString2="Ion.thmx") returned -1
	[0060.662] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx") returned="Ion Boardroom.thmx"
	[0060.662] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\"
	[0060.662] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\") returned=""
	[0060.662] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.662] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\how-to-decrypt-files.htm")) returned 0x20
	[0060.663] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\", lpString2="Ion.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx"
	[0060.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx", pszSpec="*.zip") returned 0
	[0060.663] lstrlenA (lpString="*.zip") returned 5
	[0060.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx", pszSpec="*.rar") returned 0
	[0060.663] lstrlenA (lpString="*.rar") returned 5
	[0060.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx", pszSpec="*.7z") returned 0
	[0060.663] lstrlenA (lpString="*.7z") returned 4
	[0060.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx", pszSpec="*.tar") returned 0
	[0060.663] lstrlenA (lpString="*.tar") returned 5
	[0060.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx", pszSpec="*.gzip") returned 0
	[0060.663] lstrlenA (lpString="*.gzip") returned 6
	[0060.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx", pszSpec="*.jpg") returned 0
	[0060.663] lstrlenA (lpString="*.jpg") returned 5
	[0060.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx", pszSpec="*.jpeg") returned 0
	[0060.663] lstrlenA (lpString="*.jpeg") returned 6
	[0060.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx", pszSpec="*.bmp") returned 0
	[0060.663] lstrlenA (lpString="*.bmp") returned 5
	[0060.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx", pszSpec="*.gif") returned 0
	[0060.663] lstrlenA (lpString="*.gif") returned 5
	[0060.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx", pszSpec="*.png") returned 0
	[0060.663] lstrlenA (lpString="*.png") returned 5
	[0060.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx", pszSpec="*.doc") returned 0
	[0060.663] lstrlenA (lpString="*.doc") returned 5
	[0060.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx", pszSpec="*.docx") returned 0
	[0060.663] lstrlenA (lpString="*.docx") returned 6
	[0060.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx", pszSpec="*.xls") returned 0
	[0060.663] lstrlenA (lpString="*.xls") returned 5
	[0060.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx", pszSpec="*.xlsx") returned 0
	[0060.663] lstrlenA (lpString="*.xlsx") returned 6
	[0060.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx", pszSpec="*.ppt") returned 0
	[0060.663] lstrlenA (lpString="*.ppt") returned 5
	[0060.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx", pszSpec="*.pptx") returned 0
	[0060.663] lstrlenA (lpString="*.pptx") returned 6
	[0060.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx", pszSpec="*.txt") returned 0
	[0060.663] lstrlenA (lpString="*.txt") returned 5
	[0060.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx", pszSpec="*.pdf") returned 0
	[0060.663] lstrlenA (lpString="*.pdf") returned 5
	[0060.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx", pszSpec="*.htm") returned 0
	[0060.664] lstrlenA (lpString="*.htm") returned 5
	[0060.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx", pszSpec="*.html") returned 0
	[0060.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx", pszSpec="*.mdb") returned 0
	[0060.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx", pszSpec="*.pfx") returned 0
	[0060.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx", pszSpec="*.md") returned 0
	[0060.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx", pszSpec="*.lnk") returned 0
	[0060.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx", pszSpec="*.torrent") returned 0
	[0060.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx", pszSpec="*.mov") returned 0
	[0060.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx", pszSpec="*.3gp") returned 0
	[0060.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx", pszSpec="*.mpeg") returned 0
	[0060.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx", pszSpec="*.mpg") returned 0
	[0060.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx", pszSpec="*.flv") returned 0
	[0060.664] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1118806a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1118806a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x111fa76a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f98b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Theme.thmx", cAlternateFileName="OFFICE~1.THM")) returned 1
	[0060.664] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0060.664] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Office Theme.thmx") returned -1
	[0060.664] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Office Theme.thmx") returned -1
	[0060.664] lstrcmpiA (lpString1="", lpString2="Office Theme.thmx") returned -1
	[0060.664] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx") returned="Ion.thmx"
	[0060.664] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\"
	[0060.664] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\") returned=""
	[0060.664] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.665] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\how-to-decrypt-files.htm")) returned 0x20
	[0060.665] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\", lpString2="Office Theme.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Office Theme.thmx") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Office Theme.thmx"
	[0060.665] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x111d450b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x111d450b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1132ba98, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x84d621, dwReserved0=0x0, dwReserved1=0x0, cFileName="Organic.thmx", cAlternateFileName="ORGANI~1.THM")) returned 1
	[0060.665] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0060.665] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Organic.thmx") returned -1
	[0060.665] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Organic.thmx") returned -1
	[0060.665] lstrcmpiA (lpString1="", lpString2="Organic.thmx") returned -1
	[0060.665] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Office Theme.thmx") returned="Office Theme.thmx"
	[0060.665] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\"
	[0060.665] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\") returned=""
	[0060.665] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.665] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\how-to-decrypt-files.htm")) returned 0x20
	[0060.665] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\", lpString2="Organic.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Organic.thmx") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Organic.thmx"
	[0060.665] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1132ba98, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1132ba98, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1160070a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x18c4dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Retrospect.thmx", cAlternateFileName="RETROS~1.THM")) returned 1
	[0060.665] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0060.665] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Retrospect.thmx") returned -1
	[0060.665] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Retrospect.thmx") returned -1
	[0060.665] lstrcmpiA (lpString1="", lpString2="Retrospect.thmx") returned -1
	[0060.665] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Organic.thmx") returned="Organic.thmx"
	[0060.665] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\"
	[0060.665] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\") returned=""
	[0060.665] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.665] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\how-to-decrypt-files.htm")) returned 0x20
	[0060.665] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\", lpString2="Retrospect.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Retrospect.thmx") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Retrospect.thmx"
	[0060.666] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11377f40, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115b4243, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd322a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slice.thmx", cAlternateFileName="SLICE~1.THM")) returned 1
	[0060.666] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0060.666] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Slice.thmx") returned -1
	[0060.666] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Slice.thmx") returned -1
	[0060.666] lstrcmpiA (lpString1="", lpString2="Slice.thmx") returned -1
	[0060.666] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Retrospect.thmx") returned="Retrospect.thmx"
	[0060.666] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\"
	[0060.666] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\") returned=""
	[0060.666] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.666] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\how-to-decrypt-files.htm")) returned 0x20
	[0060.666] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\", lpString2="Slice.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Slice.thmx") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Slice.thmx"
	[0060.666] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1132ba98, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Theme Colors", cAlternateFileName="THEMEC~1")) returned 1
	[0060.666] lstrcmpA (lpString1=".", lpString2="Theme Colors") returned -1
	[0060.666] lstrcmpA (lpString1="..", lpString2="Theme Colors") returned -1
	[0060.666] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Slice.thmx") returned="Slice.thmx"
	[0060.666] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\", lpString2="Theme Colors" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors"
	[0060.666] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1132ba98, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0xb8, cFileName=".", cAlternateFileName="")) returned 0x7cbad0
	[0060.667] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0060.668] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1132ba98, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0xb8, cFileName="..", cAlternateFileName="")) returned 1
	[0060.668] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0060.668] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0060.668] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x115da4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e4, dwReserved0=0x7b0000, dwReserved1=0xb8, cFileName="Aspect.xml", cAlternateFileName="")) returned 1
	[0060.668] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.668] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Aspect.xml") returned 1
	[0060.668] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Aspect.xml") returned 1
	[0060.668] lstrcmpiA (lpString1="", lpString2="Aspect.xml") returned -1
	[0060.668] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\*.*") returned="*.*"
	[0060.668] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\"
	[0060.668] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned=""
	[0060.668] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.668] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0060.668] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0060.668] WriteFile (in: hFile=0x214, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0060.874] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0060.874] CloseHandle (hObject=0x214) returned 1
	[0060.874] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="Aspect.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Aspect.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Aspect.xml"
	[0060.874] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x115da4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e8, dwReserved0=0x0, dwReserved1=0x1, cFileName="Blue Green.xml", cAlternateFileName="BLUEGR~1.XML")) returned 1
	[0060.874] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.875] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Blue Green.xml") returned 1
	[0060.875] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Blue Green.xml") returned 1
	[0060.875] lstrcmpiA (lpString1="", lpString2="Blue Green.xml") returned -1
	[0060.875] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Aspect.xml") returned="Aspect.xml"
	[0060.875] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\"
	[0060.875] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned=""
	[0060.875] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.875] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\how-to-decrypt-files.htm")) returned 0x20
	[0060.875] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="Blue Green.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Blue Green.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Blue Green.xml"
	[0060.875] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1132ba98, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1132ba98, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1132ba98, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e5, dwReserved0=0x500059, dwReserved1=0x2d0054, cFileName="Blue II.xml", cAlternateFileName="BLUEII~1.XML")) returned 1
	[0060.875] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.875] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Blue II.xml") returned 1
	[0060.875] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Blue II.xml") returned 1
	[0060.875] lstrcmpiA (lpString1="", lpString2="Blue II.xml") returned -1
	[0060.875] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Blue Green.xml") returned="Blue Green.xml"
	[0060.875] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\"
	[0060.875] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned=""
	[0060.875] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.875] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\how-to-decrypt-files.htm")) returned 0x20
	[0060.875] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="Blue II.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Blue II.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Blue II.xml"
	[0060.875] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11377f40, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11377f40, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e7, dwReserved0=0x500059, dwReserved1=0x2d0054, cFileName="Blue Warm.xml", cAlternateFileName="BLUEWA~1.XML")) returned 1
	[0060.875] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.875] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Blue Warm.xml") returned 1
	[0060.875] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Blue Warm.xml") returned 1
	[0060.875] lstrcmpiA (lpString1="", lpString2="Blue Warm.xml") returned -1
	[0060.875] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Blue II.xml") returned="Blue II.xml"
	[0060.875] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\"
	[0060.875] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned=""
	[0060.876] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.876] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\how-to-decrypt-files.htm")) returned 0x20
	[0060.876] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="Blue Warm.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Blue Warm.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Blue Warm.xml"
	[0060.876] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11377f40, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11377f40, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x500059, dwReserved1=0x2d0054, cFileName="Blue.xml", cAlternateFileName="")) returned 1
	[0060.876] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.876] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Blue.xml") returned 1
	[0060.876] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Blue.xml") returned 1
	[0060.876] lstrcmpiA (lpString1="", lpString2="Blue.xml") returned -1
	[0060.876] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Blue Warm.xml") returned="Blue Warm.xml"
	[0060.876] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\"
	[0060.876] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned=""
	[0060.876] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.876] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\how-to-decrypt-files.htm")) returned 0x20
	[0060.876] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="Blue.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Blue.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Blue.xml"
	[0060.876] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1132ba98, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1132ba98, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11377f40, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e7, dwReserved0=0x500059, dwReserved1=0x2d0054, cFileName="Grayscale.xml", cAlternateFileName="GRAYSC~1.XML")) returned 1
	[0060.876] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.876] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Grayscale.xml") returned -1
	[0060.876] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Grayscale.xml") returned 1
	[0060.876] lstrcmpiA (lpString1="", lpString2="Grayscale.xml") returned -1
	[0060.876] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Blue.xml") returned="Blue.xml"
	[0060.876] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\"
	[0060.876] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned=""
	[0060.876] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.876] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\how-to-decrypt-files.htm")) returned 0x20
	[0060.876] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="Grayscale.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Grayscale.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Grayscale.xml"
	[0060.876] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1132ba98, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1132ba98, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1132ba98, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ea, dwReserved0=0x500059, dwReserved1=0x2d0054, cFileName="Green Yellow.xml", cAlternateFileName="GREENY~1.XML")) returned 1
	[0060.877] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.877] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Green Yellow.xml") returned -1
	[0060.877] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Green Yellow.xml") returned 1
	[0060.877] lstrcmpiA (lpString1="", lpString2="Green Yellow.xml") returned -1
	[0060.877] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Grayscale.xml") returned="Grayscale.xml"
	[0060.877] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\"
	[0060.877] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned=""
	[0060.877] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.877] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\how-to-decrypt-files.htm")) returned 0x20
	[0060.877] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="Green Yellow.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Green Yellow.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Green Yellow.xml"
	[0060.877] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1132ba98, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1132ba98, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1132ba98, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e3, dwReserved0=0x500059, dwReserved1=0x2d0054, cFileName="Green.xml", cAlternateFileName="")) returned 1
	[0060.877] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.877] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Green.xml") returned -1
	[0060.877] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Green.xml") returned 1
	[0060.877] lstrcmpiA (lpString1="", lpString2="Green.xml") returned -1
	[0060.877] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Green Yellow.xml") returned="Green Yellow.xml"
	[0060.877] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\"
	[0060.877] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned=""
	[0060.877] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.877] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\how-to-decrypt-files.htm")) returned 0x20
	[0060.877] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="Green.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Green.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Green.xml"
	[0060.877] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114108ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114108ca, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114108ca, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2d1, dwReserved0=0x500059, dwReserved1=0x2d0054, cFileName="Marquee.xml", cAlternateFileName="")) returned 1
	[0060.877] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.877] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Marquee.xml") returned -1
	[0060.877] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Marquee.xml") returned -1
	[0060.877] lstrcmpiA (lpString1="", lpString2="Marquee.xml") returned -1
	[0060.877] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Green.xml") returned="Green.xml"
	[0060.877] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\"
	[0060.877] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned=""
	[0060.877] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.878] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\how-to-decrypt-files.htm")) returned 0x20
	[0060.878] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="Marquee.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Marquee.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Marquee.xml"
	[0060.878] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11377f40, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1139e160, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e4, dwReserved0=0x500059, dwReserved1=0x2d0054, cFileName="Median.xml", cAlternateFileName="")) returned 1
	[0060.878] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.878] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Median.xml") returned -1
	[0060.878] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Median.xml") returned -1
	[0060.878] lstrcmpiA (lpString1="", lpString2="Median.xml") returned -1
	[0060.878] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Marquee.xml") returned="Marquee.xml"
	[0060.878] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\"
	[0060.878] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned=""
	[0060.878] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.878] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\how-to-decrypt-files.htm")) returned 0x20
	[0060.878] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="Median.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Median.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Median.xml"
	[0060.878] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11377f40, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1139e160, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ee, dwReserved0=0x500059, dwReserved1=0x2d0054, cFileName="Office 2007 - 2010.xml", cAlternateFileName="OFFICE~1.XML")) returned 1
	[0060.878] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.878] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Office 2007 - 2010.xml") returned -1
	[0060.878] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Office 2007 - 2010.xml") returned -1
	[0060.878] lstrcmpiA (lpString1="", lpString2="Office 2007 - 2010.xml") returned -1
	[0060.878] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Median.xml") returned="Median.xml"
	[0060.878] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\"
	[0060.878] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned=""
	[0060.878] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.878] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\how-to-decrypt-files.htm")) returned 0x20
	[0060.878] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="Office 2007 - 2010.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Office 2007 - 2010.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Office 2007 - 2010.xml"
	[0060.878] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11377f40, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1139e160, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e8, dwReserved0=0x500059, dwReserved1=0x2d0054, cFileName="Orange Red.xml", cAlternateFileName="ORANGE~1.XML")) returned 1
	[0060.878] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.879] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Orange Red.xml") returned -1
	[0060.879] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Orange Red.xml") returned -1
	[0060.879] lstrcmpiA (lpString1="", lpString2="Orange Red.xml") returned -1
	[0060.879] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Office 2007 - 2010.xml") returned="Office 2007 - 2010.xml"
	[0060.879] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\"
	[0060.879] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned=""
	[0060.879] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.879] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\how-to-decrypt-files.htm")) returned 0x20
	[0060.879] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="Orange Red.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Orange Red.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Orange Red.xml"
	[0060.879] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11377f40, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1139e160, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x500059, dwReserved1=0x2d0054, cFileName="Orange.xml", cAlternateFileName="")) returned 1
	[0060.879] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.879] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Orange.xml") returned -1
	[0060.879] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Orange.xml") returned -1
	[0060.879] lstrcmpiA (lpString1="", lpString2="Orange.xml") returned -1
	[0060.879] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Orange Red.xml") returned="Orange Red.xml"
	[0060.879] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\"
	[0060.879] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned=""
	[0060.879] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.879] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\how-to-decrypt-files.htm")) returned 0x20
	[0060.879] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="Orange.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Orange.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Orange.xml"
	[0060.879] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11377f40, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1139e160, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e3, dwReserved0=0x500059, dwReserved1=0x2d0054, cFileName="Paper.xml", cAlternateFileName="")) returned 1
	[0060.879] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.879] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Paper.xml") returned -1
	[0060.879] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Paper.xml") returned -1
	[0060.879] lstrcmpiA (lpString1="", lpString2="Paper.xml") returned -1
	[0060.879] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Orange.xml") returned="Orange.xml"
	[0060.879] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\"
	[0060.879] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned=""
	[0060.879] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.879] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\how-to-decrypt-files.htm")) returned 0x20
	[0060.880] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="Paper.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Paper.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Paper.xml"
	[0060.880] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11377f40, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11377f40, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e8, dwReserved0=0x500059, dwReserved1=0x2d0054, cFileName="Red Orange.xml", cAlternateFileName="REDORA~1.XML")) returned 1
	[0060.880] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.880] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Red Orange.xml") returned -1
	[0060.880] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Red Orange.xml") returned -1
	[0060.880] lstrcmpiA (lpString1="", lpString2="Red Orange.xml") returned -1
	[0060.880] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Paper.xml") returned="Paper.xml"
	[0060.880] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\"
	[0060.880] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned=""
	[0060.880] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.880] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\how-to-decrypt-files.htm")) returned 0x20
	[0060.880] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="Red Orange.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Red Orange.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Red Orange.xml"
	[0060.880] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114108ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114108ca, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11436ace, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e8, dwReserved0=0x500059, dwReserved1=0x2d0054, cFileName="Red Violet.xml", cAlternateFileName="REDVIO~1.XML")) returned 1
	[0060.880] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.880] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Red Violet.xml") returned -1
	[0060.880] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Red Violet.xml") returned -1
	[0060.880] lstrcmpiA (lpString1="", lpString2="Red Violet.xml") returned -1
	[0060.880] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Red Orange.xml") returned="Red Orange.xml"
	[0060.880] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\"
	[0060.880] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned=""
	[0060.880] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.880] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\how-to-decrypt-files.htm")) returned 0x20
	[0060.880] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="Red Violet.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Red Violet.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Red Violet.xml"
	[0060.880] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11377f40, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1139e160, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e1, dwReserved0=0x500059, dwReserved1=0x2d0054, cFileName="Red.xml", cAlternateFileName="")) returned 1
	[0060.880] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.880] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Red.xml") returned -1
	[0060.880] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Red.xml") returned -1
	[0060.881] lstrcmpiA (lpString1="", lpString2="Red.xml") returned -1
	[0060.881] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Red Violet.xml") returned="Red Violet.xml"
	[0060.881] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\"
	[0060.881] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned=""
	[0060.881] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.881] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\how-to-decrypt-files.htm")) returned 0x20
	[0060.881] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="Red.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Red.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Red.xml"
	[0060.881] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11377f40, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11377f40, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e8, dwReserved0=0x500059, dwReserved1=0x2d0054, cFileName="Slipstream.xml", cAlternateFileName="SLIPST~1.XML")) returned 1
	[0060.881] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.881] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Slipstream.xml") returned -1
	[0060.881] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Slipstream.xml") returned -1
	[0060.881] lstrcmpiA (lpString1="", lpString2="Slipstream.xml") returned -1
	[0060.881] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Red.xml") returned="Red.xml"
	[0060.881] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\"
	[0060.881] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned=""
	[0060.881] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.881] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\how-to-decrypt-files.htm")) returned 0x20
	[0060.881] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="Slipstream.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Slipstream.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Slipstream.xml"
	[0060.881] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11482f7f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e7, dwReserved0=0x500059, dwReserved1=0x2d0054, cFileName="Violet II.xml", cAlternateFileName="VIOLET~1.XML")) returned 1
	[0060.881] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.881] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Violet II.xml") returned -1
	[0060.881] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Violet II.xml") returned -1
	[0060.881] lstrcmpiA (lpString1="", lpString2="Violet II.xml") returned -1
	[0060.881] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Slipstream.xml") returned="Slipstream.xml"
	[0060.881] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\"
	[0060.881] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned=""
	[0060.881] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.881] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\how-to-decrypt-files.htm")) returned 0x20
	[0060.881] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="Violet II.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Violet II.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Violet II.xml"
	[0060.882] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114108ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114108ca, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114108ca, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e4, dwReserved0=0x500059, dwReserved1=0x2d0054, cFileName="Violet.xml", cAlternateFileName="")) returned 1
	[0060.882] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.882] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Violet.xml") returned -1
	[0060.882] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Violet.xml") returned -1
	[0060.882] lstrcmpiA (lpString1="", lpString2="Violet.xml") returned -1
	[0060.882] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Violet II.xml") returned="Violet II.xml"
	[0060.882] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\"
	[0060.882] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned=""
	[0060.882] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.882] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\how-to-decrypt-files.htm")) returned 0x20
	[0060.882] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="Violet.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Violet.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Violet.xml"
	[0060.882] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114108ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114108ca, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114108ca, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2eb, dwReserved0=0x500059, dwReserved1=0x2d0054, cFileName="Yellow Orange.xml", cAlternateFileName="YELLOW~1.XML")) returned 1
	[0060.882] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.882] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Yellow Orange.xml") returned -1
	[0060.882] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Yellow Orange.xml") returned -1
	[0060.882] lstrcmpiA (lpString1="", lpString2="Yellow Orange.xml") returned -1
	[0060.882] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Violet.xml") returned="Violet.xml"
	[0060.882] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\"
	[0060.882] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned=""
	[0060.882] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.882] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\how-to-decrypt-files.htm")) returned 0x20
	[0060.882] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="Yellow Orange.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Yellow Orange.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Yellow Orange.xml"
	[0060.882] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114108ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114108ca, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114108ca, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e4, dwReserved0=0x500059, dwReserved1=0x2d0054, cFileName="Yellow.xml", cAlternateFileName="")) returned 1
	[0060.882] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.882] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Yellow.xml") returned -1
	[0060.882] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Yellow.xml") returned -1
	[0060.882] lstrcmpiA (lpString1="", lpString2="Yellow.xml") returned -1
	[0060.883] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Yellow Orange.xml") returned="Yellow Orange.xml"
	[0060.883] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\"
	[0060.883] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\") returned=""
	[0060.883] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.883] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\how-to-decrypt-files.htm")) returned 0x20
	[0060.883] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\", lpString2="Yellow.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Yellow.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Yellow.xml"
	[0060.883] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114108ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114108ca, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114108ca, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e4, dwReserved0=0x500059, dwReserved1=0x2d0054, cFileName="Yellow.xml", cAlternateFileName="")) returned 0
	[0060.883] FindClose (in: hFindFile=0x7cbad0 | out: hFindFile=0x7cbad0) returned 1
	[0060.883] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="Theme Effects", cAlternateFileName="THEMEE~1")) returned 1
	[0060.883] lstrcmpA (lpString1=".", lpString2="Theme Effects") returned -1
	[0060.883] lstrcmpA (lpString1="..", lpString2="Theme Effects") returned -1
	[0060.883] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\*.*") returned="*.*"
	[0060.883] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\", lpString2="Theme Effects" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects"
	[0060.883] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects") returned 71
	[0060.883] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x500059, dwReserved1=0x2d0054, cFileName=".", cAlternateFileName="")) returned 0x7cbc50
	[0060.884] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0060.884] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x500059, dwReserved1=0x2d0054, cFileName="..", cAlternateFileName="")) returned 1
	[0060.885] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0060.885] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0060.885] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114108ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114108ca, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114108ca, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbaeb, dwReserved0=0x500059, dwReserved1=0x2d0054, cFileName="Banded Edge.eftx", cAlternateFileName="BANDED~1.EFT")) returned 1
	[0060.885] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.885] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Banded Edge.eftx") returned 1
	[0060.885] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Banded Edge.eftx") returned 1
	[0060.885] lstrcmpiA (lpString1="", lpString2="Banded Edge.eftx") returned -1
	[0060.885] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\*.*") returned="*.*"
	[0060.885] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\"
	[0060.885] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\") returned=""
	[0060.885] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.885] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0060.885] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0060.885] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0060.885] WriteFile (in: hFile=0x214, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0060.886] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0060.886] CloseHandle (hObject=0x214) returned 1
	[0060.886] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\", lpString2="Banded Edge.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx"
	[0060.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.zip") returned 0
	[0060.886] lstrlenA (lpString="*.zip") returned 5
	[0060.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.rar") returned 0
	[0060.887] lstrlenA (lpString="*.rar") returned 5
	[0060.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.7z") returned 0
	[0060.887] lstrlenA (lpString="*.7z") returned 4
	[0060.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.tar") returned 0
	[0060.887] lstrlenA (lpString="*.tar") returned 5
	[0060.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.gzip") returned 0
	[0060.887] lstrlenA (lpString="*.gzip") returned 6
	[0060.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.jpg") returned 0
	[0060.887] lstrlenA (lpString="*.jpg") returned 5
	[0060.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.jpeg") returned 0
	[0060.887] lstrlenA (lpString="*.jpeg") returned 6
	[0060.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.bmp") returned 0
	[0060.887] lstrlenA (lpString="*.bmp") returned 5
	[0060.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.gif") returned 0
	[0060.887] lstrlenA (lpString="*.gif") returned 5
	[0060.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.png") returned 0
	[0060.887] lstrlenA (lpString="*.png") returned 5
	[0060.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.doc") returned 0
	[0060.887] lstrlenA (lpString="*.doc") returned 5
	[0060.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.docx") returned 0
	[0060.887] lstrlenA (lpString="*.docx") returned 6
	[0060.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.xls") returned 0
	[0060.887] lstrlenA (lpString="*.xls") returned 5
	[0060.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.xlsx") returned 0
	[0060.887] lstrlenA (lpString="*.xlsx") returned 6
	[0060.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.ppt") returned 0
	[0060.887] lstrlenA (lpString="*.ppt") returned 5
	[0060.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.pptx") returned 0
	[0060.887] lstrlenA (lpString="*.pptx") returned 6
	[0060.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.txt") returned 0
	[0060.887] lstrlenA (lpString="*.txt") returned 5
	[0060.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.pdf") returned 0
	[0060.887] lstrlenA (lpString="*.pdf") returned 5
	[0060.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.htm") returned 0
	[0060.887] lstrlenA (lpString="*.htm") returned 5
	[0060.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.html") returned 0
	[0060.887] lstrlenA (lpString="*.html") returned 6
	[0060.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.mdb") returned 0
	[0060.887] lstrlenA (lpString="*.mdb") returned 5
	[0060.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.pfx") returned 0
	[0060.887] lstrlenA (lpString="*.pfx") returned 5
	[0060.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.md") returned 0
	[0060.888] lstrlenA (lpString="*.md") returned 4
	[0060.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.lnk") returned 0
	[0060.888] lstrlenA (lpString="*.lnk") returned 5
	[0060.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.torrent") returned 0
	[0060.888] lstrlenA (lpString="*.torrent") returned 9
	[0060.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.mov") returned 0
	[0060.888] lstrlenA (lpString="*.mov") returned 5
	[0060.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.3gp") returned 0
	[0060.888] lstrlenA (lpString="*.3gp") returned 5
	[0060.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.mpeg") returned 0
	[0060.888] lstrlenA (lpString="*.mpeg") returned 6
	[0060.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.mpg") returned 0
	[0060.888] lstrlenA (lpString="*.mpg") returned 5
	[0060.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.flv") returned 0
	[0060.888] lstrlenA (lpString="*.flv") returned 5
	[0060.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.avi") returned 0
	[0060.888] lstrlenA (lpString="*.avi") returned 5
	[0060.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.mp4") returned 0
	[0060.889] lstrlenA (lpString="*.mp4") returned 5
	[0060.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.wmv") returned 0
	[0060.889] lstrlenA (lpString="*.wmv") returned 5
	[0060.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.mkv") returned 0
	[0060.889] lstrlenA (lpString="*.mkv") returned 5
	[0060.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.mp3") returned 0
	[0060.889] lstrlenA (lpString="*.mp3") returned 5
	[0060.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.wav") returned 0
	[0060.889] lstrlenA (lpString="*.wav") returned 5
	[0060.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.flac") returned 0
	[0060.889] lstrlenA (lpString="*.flac") returned 6
	[0060.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.wma") returned 0
	[0060.889] lstrlenA (lpString="*.wma") returned 5
	[0060.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.au3") returned 0
	[0060.889] lstrlenA (lpString="*.au3") returned 5
	[0060.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.ahk") returned 0
	[0060.889] lstrlenA (lpString="*.ahk") returned 5
	[0060.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.c") returned 0
	[0060.889] lstrlenA (lpString="*.c") returned 3
	[0060.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.cc") returned 0
	[0060.889] lstrlenA (lpString="*.cc") returned 4
	[0060.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.cpp") returned 0
	[0060.889] lstrlenA (lpString="*.cpp") returned 5
	[0060.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.cxx") returned 0
	[0060.889] lstrlenA (lpString="*.cxx") returned 5
	[0060.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.c++") returned 0
	[0060.889] lstrlenA (lpString="*.c++") returned 5
	[0060.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.cs") returned 0
	[0060.889] lstrlenA (lpString="*.cs") returned 4
	[0060.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.vb") returned 0
	[0060.889] lstrlenA (lpString="*.vb") returned 4
	[0060.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.bas") returned 0
	[0060.889] lstrlenA (lpString="*.bas") returned 5
	[0060.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.csproj") returned 0
	[0060.889] lstrlenA (lpString="*.csproj") returned 8
	[0060.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.vbproj") returned 0
	[0060.889] lstrlenA (lpString="*.vbproj") returned 8
	[0060.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.vcxproj") returned 0
	[0060.889] lstrlenA (lpString="*.vcxproj") returned 9
	[0060.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.manifest") returned 0
	[0060.890] lstrlenA (lpString="*.manifest") returned 10
	[0060.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.php") returned 0
	[0060.890] lstrlenA (lpString="*.php") returned 5
	[0060.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.vbe") returned 0
	[0060.890] lstrlenA (lpString="*.vbe") returned 5
	[0060.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.vba") returned 0
	[0060.890] lstrlenA (lpString="*.vba") returned 5
	[0060.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.vbs") returned 0
	[0060.890] lstrlenA (lpString="*.vbs") returned 5
	[0060.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.bat") returned 0
	[0060.890] lstrlenA (lpString="*.bat") returned 5
	[0060.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.cmd") returned 0
	[0060.890] lstrlenA (lpString="*.cmd") returned 5
	[0060.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.js") returned 0
	[0060.890] lstrlenA (lpString="*.js") returned 4
	[0060.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.jscript") returned 0
	[0060.890] lstrlenA (lpString="*.jscript") returned 9
	[0060.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.hta") returned 0
	[0060.890] lstrlenA (lpString="*.hta") returned 5
	[0060.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.php7") returned 0
	[0060.890] lstrlenA (lpString="*.php7") returned 6
	[0060.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.db") returned 0
	[0060.890] lstrlenA (lpString="*.db") returned 4
	[0060.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.swf") returned 0
	[0060.890] lstrlenA (lpString="*.swf") returned 5
	[0060.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.eml") returned 0
	[0060.890] lstrlenA (lpString="*.eml") returned 5
	[0060.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.part") returned 0
	[0060.890] lstrlenA (lpString="*.part") returned 6
	[0060.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.nfo") returned 0
	[0060.890] lstrlenA (lpString="*.nfo") returned 5
	[0060.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.rsa") returned 0
	[0060.890] lstrlenA (lpString="*.rsa") returned 5
	[0060.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.key") returned 0
	[0060.890] lstrlenA (lpString="*.key") returned 5
	[0060.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.aes") returned 0
	[0060.890] lstrlenA (lpString="*.aes") returned 5
	[0060.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.blob") returned 0
	[0060.890] lstrlenA (lpString="*.blob") returned 6
	[0060.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.btc") returned 0
	[0060.891] lstrlenA (lpString="*.btc") returned 5
	[0060.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx", pszSpec="*.wallet") returned 0
	[0060.891] lstrlenA (lpString="*.wallet") returned 8
	[0060.891] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1139e160, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1139e160, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114108ca, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x530f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Extreme Shadow.eftx", cAlternateFileName="EXTREM~1.EFT")) returned 1
	[0060.891] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.891] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Extreme Shadow.eftx") returned -1
	[0060.891] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Extreme Shadow.eftx") returned 1
	[0060.891] lstrcmpiA (lpString1="", lpString2="Extreme Shadow.eftx") returned -1
	[0060.891] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned="Banded Edge.eftx"
	[0060.891] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\"
	[0060.891] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\") returned=""
	[0060.891] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.891] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\how-to-decrypt-files.htm")) returned 0x20
	[0060.891] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\", lpString2="Extreme Shadow.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx"
	[0060.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.zip") returned 0
	[0060.891] lstrlenA (lpString="*.zip") returned 5
	[0060.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.rar") returned 0
	[0060.891] lstrlenA (lpString="*.rar") returned 5
	[0060.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.7z") returned 0
	[0060.891] lstrlenA (lpString="*.7z") returned 4
	[0060.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.tar") returned 0
	[0060.891] lstrlenA (lpString="*.tar") returned 5
	[0060.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.gzip") returned 0
	[0060.891] lstrlenA (lpString="*.gzip") returned 6
	[0060.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.jpg") returned 0
	[0060.891] lstrlenA (lpString="*.jpg") returned 5
	[0060.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.jpeg") returned 0
	[0060.891] lstrlenA (lpString="*.jpeg") returned 6
	[0060.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.bmp") returned 0
	[0060.891] lstrlenA (lpString="*.bmp") returned 5
	[0060.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.gif") returned 0
	[0060.891] lstrlenA (lpString="*.gif") returned 5
	[0060.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.png") returned 0
	[0060.891] lstrlenA (lpString="*.png") returned 5
	[0060.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.doc") returned 0
	[0060.891] lstrlenA (lpString="*.doc") returned 5
	[0060.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.docx") returned 0
	[0060.892] lstrlenA (lpString="*.docx") returned 6
	[0060.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.xls") returned 0
	[0060.892] lstrlenA (lpString="*.xls") returned 5
	[0060.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.xlsx") returned 0
	[0060.892] lstrlenA (lpString="*.xlsx") returned 6
	[0060.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.ppt") returned 0
	[0060.892] lstrlenA (lpString="*.ppt") returned 5
	[0060.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.pptx") returned 0
	[0060.892] lstrlenA (lpString="*.pptx") returned 6
	[0060.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.txt") returned 0
	[0060.892] lstrlenA (lpString="*.txt") returned 5
	[0060.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.pdf") returned 0
	[0060.892] lstrlenA (lpString="*.pdf") returned 5
	[0060.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.htm") returned 0
	[0060.892] lstrlenA (lpString="*.htm") returned 5
	[0060.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.html") returned 0
	[0060.892] lstrlenA (lpString="*.html") returned 6
	[0060.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.mdb") returned 0
	[0060.892] lstrlenA (lpString="*.mdb") returned 5
	[0060.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.pfx") returned 0
	[0060.892] lstrlenA (lpString="*.pfx") returned 5
	[0060.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.md") returned 0
	[0060.892] lstrlenA (lpString="*.md") returned 4
	[0060.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.lnk") returned 0
	[0060.892] lstrlenA (lpString="*.lnk") returned 5
	[0060.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.torrent") returned 0
	[0060.892] lstrlenA (lpString="*.torrent") returned 9
	[0060.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.mov") returned 0
	[0060.892] lstrlenA (lpString="*.mov") returned 5
	[0060.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.3gp") returned 0
	[0060.892] lstrlenA (lpString="*.3gp") returned 5
	[0060.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.mpeg") returned 0
	[0060.892] lstrlenA (lpString="*.mpeg") returned 6
	[0060.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.mpg") returned 0
	[0060.892] lstrlenA (lpString="*.mpg") returned 5
	[0060.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.flv") returned 0
	[0060.892] lstrlenA (lpString="*.flv") returned 5
	[0060.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.avi") returned 0
	[0060.892] lstrlenA (lpString="*.avi") returned 5
	[0060.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.mp4") returned 0
	[0060.892] lstrlenA (lpString="*.mp4") returned 5
	[0060.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.wmv") returned 0
	[0060.893] lstrlenA (lpString="*.wmv") returned 5
	[0060.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.mkv") returned 0
	[0060.893] lstrlenA (lpString="*.mkv") returned 5
	[0060.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.mp3") returned 0
	[0060.893] lstrlenA (lpString="*.mp3") returned 5
	[0060.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.wav") returned 0
	[0060.893] lstrlenA (lpString="*.wav") returned 5
	[0060.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.flac") returned 0
	[0060.893] lstrlenA (lpString="*.flac") returned 6
	[0060.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.wma") returned 0
	[0060.893] lstrlenA (lpString="*.wma") returned 5
	[0060.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.au3") returned 0
	[0060.893] lstrlenA (lpString="*.au3") returned 5
	[0060.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.ahk") returned 0
	[0060.893] lstrlenA (lpString="*.ahk") returned 5
	[0060.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.c") returned 0
	[0060.893] lstrlenA (lpString="*.c") returned 3
	[0060.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.cc") returned 0
	[0060.893] lstrlenA (lpString="*.cc") returned 4
	[0060.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.cpp") returned 0
	[0060.893] lstrlenA (lpString="*.cpp") returned 5
	[0060.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.cxx") returned 0
	[0060.893] lstrlenA (lpString="*.cxx") returned 5
	[0060.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.c++") returned 0
	[0060.893] lstrlenA (lpString="*.c++") returned 5
	[0060.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.cs") returned 0
	[0060.893] lstrlenA (lpString="*.cs") returned 4
	[0060.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.vb") returned 0
	[0060.893] lstrlenA (lpString="*.vb") returned 4
	[0060.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.bas") returned 0
	[0060.893] lstrlenA (lpString="*.bas") returned 5
	[0060.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.csproj") returned 0
	[0060.893] lstrlenA (lpString="*.csproj") returned 8
	[0060.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.vbproj") returned 0
	[0060.893] lstrlenA (lpString="*.vbproj") returned 8
	[0060.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.vcxproj") returned 0
	[0060.893] lstrlenA (lpString="*.vcxproj") returned 9
	[0060.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.manifest") returned 0
	[0060.893] lstrlenA (lpString="*.manifest") returned 10
	[0060.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.php") returned 0
	[0060.893] lstrlenA (lpString="*.php") returned 5
	[0060.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.vbe") returned 0
	[0060.894] lstrlenA (lpString="*.vbe") returned 5
	[0060.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.vba") returned 0
	[0060.894] lstrlenA (lpString="*.vba") returned 5
	[0060.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.vbs") returned 0
	[0060.894] lstrlenA (lpString="*.vbs") returned 5
	[0060.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.bat") returned 0
	[0060.894] lstrlenA (lpString="*.bat") returned 5
	[0060.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.cmd") returned 0
	[0060.894] lstrlenA (lpString="*.cmd") returned 5
	[0060.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.js") returned 0
	[0060.894] lstrlenA (lpString="*.js") returned 4
	[0060.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.jscript") returned 0
	[0060.894] lstrlenA (lpString="*.jscript") returned 9
	[0060.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.hta") returned 0
	[0060.894] lstrlenA (lpString="*.hta") returned 5
	[0060.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.php7") returned 0
	[0060.894] lstrlenA (lpString="*.php7") returned 6
	[0060.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.db") returned 0
	[0060.894] lstrlenA (lpString="*.db") returned 4
	[0060.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.swf") returned 0
	[0060.894] lstrlenA (lpString="*.swf") returned 5
	[0060.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.eml") returned 0
	[0060.894] lstrlenA (lpString="*.eml") returned 5
	[0060.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.part") returned 0
	[0060.894] lstrlenA (lpString="*.part") returned 6
	[0060.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.nfo") returned 0
	[0060.894] lstrlenA (lpString="*.nfo") returned 5
	[0060.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.rsa") returned 0
	[0060.894] lstrlenA (lpString="*.rsa") returned 5
	[0060.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.key") returned 0
	[0060.894] lstrlenA (lpString="*.key") returned 5
	[0060.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.aes") returned 0
	[0060.894] lstrlenA (lpString="*.aes") returned 5
	[0060.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.blob") returned 0
	[0060.894] lstrlenA (lpString="*.blob") returned 6
	[0060.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.btc") returned 0
	[0060.894] lstrlenA (lpString="*.btc") returned 5
	[0060.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx", pszSpec="*.wallet") returned 0
	[0060.894] lstrlenA (lpString="*.wallet") returned 8
	[0060.894] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1139e160, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1139e160, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114108ca, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x51933, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Frosted Glass.eftx", cAlternateFileName="FROSTE~1.EFT")) returned 1
	[0060.894] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.895] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Frosted Glass.eftx") returned -1
	[0060.895] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Frosted Glass.eftx") returned 1
	[0060.895] lstrcmpiA (lpString1="", lpString2="Frosted Glass.eftx") returned -1
	[0060.895] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned="Extreme Shadow.eftx"
	[0060.895] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\"
	[0060.895] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\") returned=""
	[0060.895] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.895] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\how-to-decrypt-files.htm")) returned 0x20
	[0060.895] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\", lpString2="Frosted Glass.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx"
	[0060.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.zip") returned 0
	[0060.895] lstrlenA (lpString="*.zip") returned 5
	[0060.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.rar") returned 0
	[0060.895] lstrlenA (lpString="*.rar") returned 5
	[0060.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.7z") returned 0
	[0060.895] lstrlenA (lpString="*.7z") returned 4
	[0060.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.tar") returned 0
	[0060.895] lstrlenA (lpString="*.tar") returned 5
	[0060.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.gzip") returned 0
	[0060.895] lstrlenA (lpString="*.gzip") returned 6
	[0060.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.jpg") returned 0
	[0060.895] lstrlenA (lpString="*.jpg") returned 5
	[0060.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.jpeg") returned 0
	[0060.895] lstrlenA (lpString="*.jpeg") returned 6
	[0060.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.bmp") returned 0
	[0060.895] lstrlenA (lpString="*.bmp") returned 5
	[0060.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.gif") returned 0
	[0060.895] lstrlenA (lpString="*.gif") returned 5
	[0060.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.png") returned 0
	[0060.895] lstrlenA (lpString="*.png") returned 5
	[0060.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.doc") returned 0
	[0060.895] lstrlenA (lpString="*.doc") returned 5
	[0060.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.docx") returned 0
	[0060.895] lstrlenA (lpString="*.docx") returned 6
	[0060.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.xls") returned 0
	[0060.895] lstrlenA (lpString="*.xls") returned 5
	[0060.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.xlsx") returned 0
	[0060.895] lstrlenA (lpString="*.xlsx") returned 6
	[0060.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.ppt") returned 0
	[0060.896] lstrlenA (lpString="*.ppt") returned 5
	[0060.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.pptx") returned 0
	[0060.896] lstrlenA (lpString="*.pptx") returned 6
	[0060.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.txt") returned 0
	[0060.896] lstrlenA (lpString="*.txt") returned 5
	[0060.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.pdf") returned 0
	[0060.896] lstrlenA (lpString="*.pdf") returned 5
	[0060.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.htm") returned 0
	[0060.896] lstrlenA (lpString="*.htm") returned 5
	[0060.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.html") returned 0
	[0060.896] lstrlenA (lpString="*.html") returned 6
	[0060.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.mdb") returned 0
	[0060.896] lstrlenA (lpString="*.mdb") returned 5
	[0060.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.pfx") returned 0
	[0060.896] lstrlenA (lpString="*.pfx") returned 5
	[0060.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.md") returned 0
	[0060.896] lstrlenA (lpString="*.md") returned 4
	[0060.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.lnk") returned 0
	[0060.896] lstrlenA (lpString="*.lnk") returned 5
	[0060.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.torrent") returned 0
	[0060.896] lstrlenA (lpString="*.torrent") returned 9
	[0060.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.mov") returned 0
	[0060.896] lstrlenA (lpString="*.mov") returned 5
	[0060.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.3gp") returned 0
	[0060.896] lstrlenA (lpString="*.3gp") returned 5
	[0060.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.mpeg") returned 0
	[0060.896] lstrlenA (lpString="*.mpeg") returned 6
	[0060.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.mpg") returned 0
	[0060.896] lstrlenA (lpString="*.mpg") returned 5
	[0060.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.flv") returned 0
	[0060.896] lstrlenA (lpString="*.flv") returned 5
	[0060.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.avi") returned 0
	[0060.896] lstrlenA (lpString="*.avi") returned 5
	[0060.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.mp4") returned 0
	[0060.896] lstrlenA (lpString="*.mp4") returned 5
	[0060.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.wmv") returned 0
	[0060.896] lstrlenA (lpString="*.wmv") returned 5
	[0060.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.mkv") returned 0
	[0060.896] lstrlenA (lpString="*.mkv") returned 5
	[0060.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.mp3") returned 0
	[0060.896] lstrlenA (lpString="*.mp3") returned 5
	[0060.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.wav") returned 0
	[0060.897] lstrlenA (lpString="*.wav") returned 5
	[0060.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.flac") returned 0
	[0060.897] lstrlenA (lpString="*.flac") returned 6
	[0060.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.wma") returned 0
	[0060.897] lstrlenA (lpString="*.wma") returned 5
	[0060.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.au3") returned 0
	[0060.897] lstrlenA (lpString="*.au3") returned 5
	[0060.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.ahk") returned 0
	[0060.897] lstrlenA (lpString="*.ahk") returned 5
	[0060.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.c") returned 0
	[0060.897] lstrlenA (lpString="*.c") returned 3
	[0060.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.cc") returned 0
	[0060.897] lstrlenA (lpString="*.cc") returned 4
	[0060.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.cpp") returned 0
	[0060.897] lstrlenA (lpString="*.cpp") returned 5
	[0060.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.cxx") returned 0
	[0060.897] lstrlenA (lpString="*.cxx") returned 5
	[0060.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.c++") returned 0
	[0060.897] lstrlenA (lpString="*.c++") returned 5
	[0060.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.cs") returned 0
	[0060.897] lstrlenA (lpString="*.cs") returned 4
	[0060.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.vb") returned 0
	[0060.897] lstrlenA (lpString="*.vb") returned 4
	[0060.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.bas") returned 0
	[0060.897] lstrlenA (lpString="*.bas") returned 5
	[0060.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.csproj") returned 0
	[0060.897] lstrlenA (lpString="*.csproj") returned 8
	[0060.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.vbproj") returned 0
	[0060.897] lstrlenA (lpString="*.vbproj") returned 8
	[0060.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.vcxproj") returned 0
	[0060.897] lstrlenA (lpString="*.vcxproj") returned 9
	[0060.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.manifest") returned 0
	[0060.897] lstrlenA (lpString="*.manifest") returned 10
	[0060.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.php") returned 0
	[0060.897] lstrlenA (lpString="*.php") returned 5
	[0060.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.vbe") returned 0
	[0060.897] lstrlenA (lpString="*.vbe") returned 5
	[0060.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.vba") returned 0
	[0060.897] lstrlenA (lpString="*.vba") returned 5
	[0060.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.vbs") returned 0
	[0060.897] lstrlenA (lpString="*.vbs") returned 5
	[0060.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.bat") returned 0
	[0060.898] lstrlenA (lpString="*.bat") returned 5
	[0060.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.cmd") returned 0
	[0060.898] lstrlenA (lpString="*.cmd") returned 5
	[0060.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.js") returned 0
	[0060.898] lstrlenA (lpString="*.js") returned 4
	[0060.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.jscript") returned 0
	[0060.898] lstrlenA (lpString="*.jscript") returned 9
	[0060.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.hta") returned 0
	[0060.898] lstrlenA (lpString="*.hta") returned 5
	[0060.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.php7") returned 0
	[0060.898] lstrlenA (lpString="*.php7") returned 6
	[0060.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.db") returned 0
	[0060.898] lstrlenA (lpString="*.db") returned 4
	[0060.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.swf") returned 0
	[0060.898] lstrlenA (lpString="*.swf") returned 5
	[0060.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.eml") returned 0
	[0060.898] lstrlenA (lpString="*.eml") returned 5
	[0060.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.part") returned 0
	[0060.898] lstrlenA (lpString="*.part") returned 6
	[0060.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.nfo") returned 0
	[0060.898] lstrlenA (lpString="*.nfo") returned 5
	[0060.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.rsa") returned 0
	[0060.898] lstrlenA (lpString="*.rsa") returned 5
	[0060.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.key") returned 0
	[0060.898] lstrlenA (lpString="*.key") returned 5
	[0060.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.aes") returned 0
	[0060.898] lstrlenA (lpString="*.aes") returned 5
	[0060.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.blob") returned 0
	[0060.898] lstrlenA (lpString="*.blob") returned 6
	[0060.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.btc") returned 0
	[0060.898] lstrlenA (lpString="*.btc") returned 5
	[0060.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx", pszSpec="*.wallet") returned 0
	[0060.898] lstrlenA (lpString="*.wallet") returned 8
	[0060.898] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1139e160, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1139e160, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1145cd4f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x51cbe, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Glossy.eftx", cAlternateFileName="GLOSSY~1.EFT")) returned 1
	[0060.898] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.898] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Glossy.eftx") returned -1
	[0060.898] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Glossy.eftx") returned 1
	[0060.898] lstrcmpiA (lpString1="", lpString2="Glossy.eftx") returned -1
	[0060.898] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned="Frosted Glass.eftx"
	[0060.899] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\"
	[0060.899] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\") returned=""
	[0060.899] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.899] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\how-to-decrypt-files.htm")) returned 0x20
	[0060.899] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\", lpString2="Glossy.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx"
	[0060.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.zip") returned 0
	[0060.899] lstrlenA (lpString="*.zip") returned 5
	[0060.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.rar") returned 0
	[0060.899] lstrlenA (lpString="*.rar") returned 5
	[0060.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.7z") returned 0
	[0060.899] lstrlenA (lpString="*.7z") returned 4
	[0060.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.tar") returned 0
	[0060.899] lstrlenA (lpString="*.tar") returned 5
	[0060.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.gzip") returned 0
	[0060.899] lstrlenA (lpString="*.gzip") returned 6
	[0060.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.jpg") returned 0
	[0060.899] lstrlenA (lpString="*.jpg") returned 5
	[0060.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.jpeg") returned 0
	[0060.899] lstrlenA (lpString="*.jpeg") returned 6
	[0060.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.bmp") returned 0
	[0060.899] lstrlenA (lpString="*.bmp") returned 5
	[0060.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.gif") returned 0
	[0060.899] lstrlenA (lpString="*.gif") returned 5
	[0060.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.png") returned 0
	[0060.899] lstrlenA (lpString="*.png") returned 5
	[0060.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.doc") returned 0
	[0060.899] lstrlenA (lpString="*.doc") returned 5
	[0060.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.docx") returned 0
	[0060.899] lstrlenA (lpString="*.docx") returned 6
	[0060.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.xls") returned 0
	[0060.899] lstrlenA (lpString="*.xls") returned 5
	[0060.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.xlsx") returned 0
	[0060.899] lstrlenA (lpString="*.xlsx") returned 6
	[0060.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.ppt") returned 0
	[0060.899] lstrlenA (lpString="*.ppt") returned 5
	[0060.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.pptx") returned 0
	[0060.899] lstrlenA (lpString="*.pptx") returned 6
	[0060.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.txt") returned 0
	[0060.900] lstrlenA (lpString="*.txt") returned 5
	[0060.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.pdf") returned 0
	[0060.900] lstrlenA (lpString="*.pdf") returned 5
	[0060.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.htm") returned 0
	[0060.900] lstrlenA (lpString="*.htm") returned 5
	[0060.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.html") returned 0
	[0060.900] lstrlenA (lpString="*.html") returned 6
	[0060.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.mdb") returned 0
	[0060.900] lstrlenA (lpString="*.mdb") returned 5
	[0060.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.pfx") returned 0
	[0060.900] lstrlenA (lpString="*.pfx") returned 5
	[0060.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.md") returned 0
	[0060.900] lstrlenA (lpString="*.md") returned 4
	[0060.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.lnk") returned 0
	[0060.900] lstrlenA (lpString="*.lnk") returned 5
	[0060.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.torrent") returned 0
	[0060.900] lstrlenA (lpString="*.torrent") returned 9
	[0060.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.mov") returned 0
	[0060.900] lstrlenA (lpString="*.mov") returned 5
	[0060.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.3gp") returned 0
	[0060.900] lstrlenA (lpString="*.3gp") returned 5
	[0060.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.mpeg") returned 0
	[0060.900] lstrlenA (lpString="*.mpeg") returned 6
	[0060.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.mpg") returned 0
	[0060.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx", pszSpec="*.flv") returned 0
	[0060.900] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11482f7f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd44b, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Glow Edge.eftx", cAlternateFileName="GLOWED~1.EFT")) returned 1
	[0060.900] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.900] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Glow Edge.eftx") returned -1
	[0060.900] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Glow Edge.eftx") returned 1
	[0060.900] lstrcmpiA (lpString1="", lpString2="Glow Edge.eftx") returned -1
	[0060.901] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned="Glossy.eftx"
	[0060.901] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\"
	[0060.901] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\") returned=""
	[0060.901] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.901] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\how-to-decrypt-files.htm")) returned 0x20
	[0060.901] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\", lpString2="Glow Edge.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx"
	[0060.901] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11436ace, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11436ace, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x56208, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Grunge Texture.eftx", cAlternateFileName="GRUNGE~1.EFT")) returned 1
	[0060.901] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.901] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Grunge Texture.eftx") returned -1
	[0060.901] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Grunge Texture.eftx") returned 1
	[0060.901] lstrcmpiA (lpString1="", lpString2="Grunge Texture.eftx") returned -1
	[0060.901] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned="Glow Edge.eftx"
	[0060.901] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\"
	[0060.901] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\") returned=""
	[0060.901] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.901] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\how-to-decrypt-files.htm")) returned 0x20
	[0060.901] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\", lpString2="Grunge Texture.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx"
	[0060.901] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11436ace, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11436ace, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xafab, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Inset.eftx", cAlternateFileName="INSET~1.EFT")) returned 1
	[0060.901] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.901] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Inset.eftx") returned -1
	[0060.901] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Inset.eftx") returned -1
	[0060.901] lstrcmpiA (lpString1="", lpString2="Inset.eftx") returned -1
	[0060.901] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned="Grunge Texture.eftx"
	[0060.901] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\"
	[0060.901] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\") returned=""
	[0060.901] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.901] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\how-to-decrypt-files.htm")) returned 0x20
	[0060.902] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\", lpString2="Inset.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx"
	[0060.902] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114108ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114108ca, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114108ca, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb543, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Milk Glass.eftx", cAlternateFileName="MILKGL~1.EFT")) returned 1
	[0060.902] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.902] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Milk Glass.eftx") returned -1
	[0060.902] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Milk Glass.eftx") returned -1
	[0060.902] lstrcmpiA (lpString1="", lpString2="Milk Glass.eftx") returned -1
	[0060.902] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned="Inset.eftx"
	[0060.902] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\"
	[0060.902] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\") returned=""
	[0060.902] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.902] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\how-to-decrypt-files.htm")) returned 0x20
	[0060.902] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\", lpString2="Milk Glass.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx"
	[0060.902] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114108ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114108ca, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11436ace, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb0ad, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Office 2007 - 2010.eftx", cAlternateFileName="OFFICE~1.EFT")) returned 1
	[0060.902] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.902] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Office 2007 - 2010.eftx") returned -1
	[0060.902] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Office 2007 - 2010.eftx") returned -1
	[0060.902] lstrcmpiA (lpString1="", lpString2="Office 2007 - 2010.eftx") returned -1
	[0060.902] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned="Milk Glass.eftx"
	[0060.902] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\"
	[0060.902] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\") returned=""
	[0060.902] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.902] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\how-to-decrypt-files.htm")) returned 0x20
	[0060.902] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\", lpString2="Office 2007 - 2010.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx"
	[0060.902] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11436ace, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1145cd4f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbcee, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Reflection.eftx", cAlternateFileName="REFLEC~1.EFT")) returned 1
	[0060.902] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.902] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Reflection.eftx") returned -1
	[0060.902] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Reflection.eftx") returned -1
	[0060.902] lstrcmpiA (lpString1="", lpString2="Reflection.eftx") returned -1
	[0060.903] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned="Office 2007 - 2010.eftx"
	[0060.903] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\"
	[0060.903] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\") returned=""
	[0060.903] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.903] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\how-to-decrypt-files.htm")) returned 0x20
	[0060.903] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\", lpString2="Reflection.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx"
	[0060.903] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114108ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114108ca, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11436ace, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x480a2, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Riblet.eftx", cAlternateFileName="RIBLET~1.EFT")) returned 1
	[0060.903] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.903] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Riblet.eftx") returned -1
	[0060.903] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Riblet.eftx") returned -1
	[0060.903] lstrcmpiA (lpString1="", lpString2="Riblet.eftx") returned -1
	[0060.903] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned="Reflection.eftx"
	[0060.903] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\"
	[0060.903] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\") returned=""
	[0060.903] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.903] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\how-to-decrypt-files.htm")) returned 0x20
	[0060.903] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\", lpString2="Riblet.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx"
	[0060.903] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11482f7f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2d753, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Smokey Glass.eftx", cAlternateFileName="SMOKEY~1.EFT")) returned 1
	[0060.903] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.903] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Smokey Glass.eftx") returned -1
	[0060.903] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Smokey Glass.eftx") returned -1
	[0060.903] lstrcmpiA (lpString1="", lpString2="Smokey Glass.eftx") returned -1
	[0060.903] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned="Riblet.eftx"
	[0060.903] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\"
	[0060.903] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\") returned=""
	[0060.904] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.904] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\how-to-decrypt-files.htm")) returned 0x20
	[0060.904] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\", lpString2="Smokey Glass.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx"
	[0060.904] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11482f7f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb17b, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Subtle Solids.eftx", cAlternateFileName="SUBTLE~1.EFT")) returned 1
	[0060.904] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.904] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Subtle Solids.eftx") returned -1
	[0060.904] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Subtle Solids.eftx") returned -1
	[0060.904] lstrcmpiA (lpString1="", lpString2="Subtle Solids.eftx") returned -1
	[0060.904] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned="Smokey Glass.eftx"
	[0060.904] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\"
	[0060.904] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\") returned=""
	[0060.904] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.904] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\how-to-decrypt-files.htm")) returned 0x20
	[0060.904] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\", lpString2="Subtle Solids.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx"
	[0060.904] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11482f7f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xde70, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Top Shadow.eftx", cAlternateFileName="TOPSHA~1.EFT")) returned 1
	[0060.904] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.904] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Top Shadow.eftx") returned -1
	[0060.904] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Top Shadow.eftx") returned -1
	[0060.904] lstrcmpiA (lpString1="", lpString2="Top Shadow.eftx") returned -1
	[0060.904] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned="Subtle Solids.eftx"
	[0060.904] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\"
	[0060.904] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\") returned=""
	[0060.904] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.904] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\how-to-decrypt-files.htm")) returned 0x20
	[0060.904] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\", lpString2="Top Shadow.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx"
	[0060.905] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11482f7f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xde70, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Top Shadow.eftx", cAlternateFileName="TOPSHA~1.EFT")) returned 0
	[0060.905] FindClose (in: hFindFile=0x7cbc50 | out: hFindFile=0x7cbc50) returned 1
	[0060.905] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="Theme Fonts", cAlternateFileName="THEMEF~1")) returned 1
	[0060.905] lstrcmpA (lpString1=".", lpString2="Theme Fonts") returned -1
	[0060.905] lstrcmpA (lpString1="..", lpString2="Theme Fonts") returned -1
	[0060.905] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\*.*") returned="*.*"
	[0060.905] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\", lpString2="Theme Fonts" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts"
	[0060.905] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x590052, dwReserved1=0x540050, cFileName=".", cAlternateFileName="")) returned 0x7cb890
	[0060.956] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0060.956] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="..", cAlternateFileName="")) returned 1
	[0060.957] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0060.957] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0060.957] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11482f7f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdc9, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Arial Black-Arial.xml", cAlternateFileName="ARIALB~1.XML")) returned 1
	[0060.957] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.957] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Arial Black-Arial.xml") returned 1
	[0060.957] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Arial Black-Arial.xml") returned 1
	[0060.957] lstrcmpiA (lpString1="", lpString2="Arial Black-Arial.xml") returned -1
	[0060.957] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\*.*") returned="*.*"
	[0060.957] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\"
	[0060.957] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned=""
	[0060.957] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.957] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0060.957] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0060.958] WriteFile (in: hFile=0x214, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0060.959] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0060.959] CloseHandle (hObject=0x214) returned 1
	[0060.959] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="Arial Black-Arial.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml"
	[0060.959] lstrlenA (lpString="*.zip") returned 5
	[0060.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.rar") returned 0
	[0060.959] lstrlenA (lpString="*.rar") returned 5
	[0060.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.7z") returned 0
	[0060.959] lstrlenA (lpString="*.7z") returned 4
	[0060.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.tar") returned 0
	[0060.959] lstrlenA (lpString="*.tar") returned 5
	[0060.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.gzip") returned 0
	[0060.959] lstrlenA (lpString="*.gzip") returned 6
	[0060.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.jpg") returned 0
	[0060.959] lstrlenA (lpString="*.jpg") returned 5
	[0060.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.jpeg") returned 0
	[0060.959] lstrlenA (lpString="*.jpeg") returned 6
	[0060.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.bmp") returned 0
	[0060.959] lstrlenA (lpString="*.bmp") returned 5
	[0060.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.gif") returned 0
	[0060.959] lstrlenA (lpString="*.gif") returned 5
	[0060.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.png") returned 0
	[0060.959] lstrlenA (lpString="*.png") returned 5
	[0060.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.doc") returned 0
	[0060.960] lstrlenA (lpString="*.doc") returned 5
	[0060.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.docx") returned 0
	[0060.960] lstrlenA (lpString="*.docx") returned 6
	[0060.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.xls") returned 0
	[0060.960] lstrlenA (lpString="*.xls") returned 5
	[0060.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.xlsx") returned 0
	[0060.960] lstrlenA (lpString="*.xlsx") returned 6
	[0060.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.ppt") returned 0
	[0060.960] lstrlenA (lpString="*.ppt") returned 5
	[0060.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.pptx") returned 0
	[0060.960] lstrlenA (lpString="*.pptx") returned 6
	[0060.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.txt") returned 0
	[0060.960] lstrlenA (lpString="*.txt") returned 5
	[0060.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.pdf") returned 0
	[0060.960] lstrlenA (lpString="*.pdf") returned 5
	[0060.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.htm") returned 0
	[0060.960] lstrlenA (lpString="*.htm") returned 5
	[0060.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.html") returned 0
	[0060.960] lstrlenA (lpString="*.html") returned 6
	[0060.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.mdb") returned 0
	[0060.960] lstrlenA (lpString="*.mdb") returned 5
	[0060.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.pfx") returned 0
	[0060.960] lstrlenA (lpString="*.pfx") returned 5
	[0060.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.md") returned 0
	[0060.960] lstrlenA (lpString="*.md") returned 4
	[0060.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.lnk") returned 0
	[0060.960] lstrlenA (lpString="*.lnk") returned 5
	[0060.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.torrent") returned 0
	[0060.960] lstrlenA (lpString="*.torrent") returned 9
	[0060.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.mov") returned 0
	[0060.960] lstrlenA (lpString="*.mov") returned 5
	[0060.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.3gp") returned 0
	[0060.960] lstrlenA (lpString="*.3gp") returned 5
	[0060.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.mpeg") returned 0
	[0060.960] lstrlenA (lpString="*.mpeg") returned 6
	[0060.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.mpg") returned 0
	[0060.960] lstrlenA (lpString="*.mpg") returned 5
	[0060.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.flv") returned 0
	[0060.961] lstrlenA (lpString="*.flv") returned 5
	[0060.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.avi") returned 0
	[0060.961] lstrlenA (lpString="*.avi") returned 5
	[0060.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.mp4") returned 0
	[0060.961] lstrlenA (lpString="*.mp4") returned 5
	[0060.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.wmv") returned 0
	[0060.961] lstrlenA (lpString="*.wmv") returned 5
	[0060.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.mkv") returned 0
	[0060.961] lstrlenA (lpString="*.mkv") returned 5
	[0060.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.mp3") returned 0
	[0060.961] lstrlenA (lpString="*.mp3") returned 5
	[0060.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.wav") returned 0
	[0060.961] lstrlenA (lpString="*.wav") returned 5
	[0060.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.flac") returned 0
	[0060.961] lstrlenA (lpString="*.flac") returned 6
	[0060.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.wma") returned 0
	[0060.961] lstrlenA (lpString="*.wma") returned 5
	[0060.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.au3") returned 0
	[0060.961] lstrlenA (lpString="*.au3") returned 5
	[0060.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.ahk") returned 0
	[0060.961] lstrlenA (lpString="*.ahk") returned 5
	[0060.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.c") returned 0
	[0060.961] lstrlenA (lpString="*.c") returned 3
	[0060.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.cc") returned 0
	[0060.961] lstrlenA (lpString="*.cc") returned 4
	[0060.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.cpp") returned 0
	[0060.961] lstrlenA (lpString="*.cpp") returned 5
	[0060.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.cxx") returned 0
	[0060.961] lstrlenA (lpString="*.cxx") returned 5
	[0060.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.c++") returned 0
	[0060.961] lstrlenA (lpString="*.c++") returned 5
	[0060.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.cs") returned 0
	[0060.961] lstrlenA (lpString="*.cs") returned 4
	[0060.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.vb") returned 0
	[0060.961] lstrlenA (lpString="*.vb") returned 4
	[0060.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.bas") returned 0
	[0060.961] lstrlenA (lpString="*.bas") returned 5
	[0060.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.csproj") returned 0
	[0060.961] lstrlenA (lpString="*.csproj") returned 8
	[0060.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.vbproj") returned 0
	[0060.962] lstrlenA (lpString="*.vbproj") returned 8
	[0060.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.vcxproj") returned 0
	[0060.962] lstrlenA (lpString="*.vcxproj") returned 9
	[0060.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.manifest") returned 0
	[0060.962] lstrlenA (lpString="*.manifest") returned 10
	[0060.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.php") returned 0
	[0060.962] lstrlenA (lpString="*.php") returned 5
	[0060.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.vbe") returned 0
	[0060.962] lstrlenA (lpString="*.vbe") returned 5
	[0060.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.vba") returned 0
	[0060.962] lstrlenA (lpString="*.vba") returned 5
	[0060.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.vbs") returned 0
	[0060.962] lstrlenA (lpString="*.vbs") returned 5
	[0060.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.bat") returned 0
	[0060.962] lstrlenA (lpString="*.bat") returned 5
	[0060.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.cmd") returned 0
	[0060.962] lstrlenA (lpString="*.cmd") returned 5
	[0060.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.js") returned 0
	[0060.962] lstrlenA (lpString="*.js") returned 4
	[0060.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.jscript") returned 0
	[0060.962] lstrlenA (lpString="*.jscript") returned 9
	[0060.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.hta") returned 0
	[0060.962] lstrlenA (lpString="*.hta") returned 5
	[0060.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.php7") returned 0
	[0060.962] lstrlenA (lpString="*.php7") returned 6
	[0060.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.db") returned 0
	[0060.962] lstrlenA (lpString="*.db") returned 4
	[0060.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.swf") returned 0
	[0060.962] lstrlenA (lpString="*.swf") returned 5
	[0060.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.eml") returned 0
	[0060.962] lstrlenA (lpString="*.eml") returned 5
	[0060.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.part") returned 0
	[0060.962] lstrlenA (lpString="*.part") returned 6
	[0060.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.nfo") returned 0
	[0060.962] lstrlenA (lpString="*.nfo") returned 5
	[0060.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.rsa") returned 0
	[0060.962] lstrlenA (lpString="*.rsa") returned 5
	[0060.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.key") returned 0
	[0060.962] lstrlenA (lpString="*.key") returned 5
	[0060.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.aes") returned 0
	[0060.963] lstrlenA (lpString="*.aes") returned 5
	[0060.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.blob") returned 0
	[0060.963] lstrlenA (lpString="*.blob") returned 6
	[0060.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.btc") returned 0
	[0060.963] lstrlenA (lpString="*.btc") returned 5
	[0060.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", pszSpec="*.wallet") returned 0
	[0060.963] lstrlenA (lpString="*.wallet") returned 8
	[0060.963] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11482f7f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xde1, dwReserved0=0x0, dwReserved1=0x1, cFileName="Arial-Times New Roman.xml", cAlternateFileName="ARIAL-~1.XML")) returned 1
	[0060.963] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.963] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Arial-Times New Roman.xml") returned 1
	[0060.963] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Arial-Times New Roman.xml") returned 1
	[0060.963] lstrcmpiA (lpString1="", lpString2="Arial-Times New Roman.xml") returned -1
	[0060.963] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml") returned="Arial Black-Arial.xml"
	[0060.963] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\"
	[0060.963] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned=""
	[0060.963] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.963] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\how-to-decrypt-files.htm")) returned 0x20
	[0060.963] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="Arial-Times New Roman.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml"
	[0060.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.zip") returned 0
	[0060.963] lstrlenA (lpString="*.zip") returned 5
	[0060.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.rar") returned 0
	[0060.963] lstrlenA (lpString="*.rar") returned 5
	[0060.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.7z") returned 0
	[0060.963] lstrlenA (lpString="*.7z") returned 4
	[0060.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.tar") returned 0
	[0060.963] lstrlenA (lpString="*.tar") returned 5
	[0060.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.gzip") returned 0
	[0060.963] lstrlenA (lpString="*.gzip") returned 6
	[0060.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.jpg") returned 0
	[0060.963] lstrlenA (lpString="*.jpg") returned 5
	[0060.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.jpeg") returned 0
	[0060.963] lstrlenA (lpString="*.jpeg") returned 6
	[0060.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.bmp") returned 0
	[0060.963] lstrlenA (lpString="*.bmp") returned 5
	[0060.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.gif") returned 0
	[0060.963] lstrlenA (lpString="*.gif") returned 5
	[0060.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.png") returned 0
	[0060.964] lstrlenA (lpString="*.png") returned 5
	[0060.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.doc") returned 0
	[0060.964] lstrlenA (lpString="*.doc") returned 5
	[0060.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.docx") returned 0
	[0060.964] lstrlenA (lpString="*.docx") returned 6
	[0060.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.xls") returned 0
	[0060.964] lstrlenA (lpString="*.xls") returned 5
	[0060.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.xlsx") returned 0
	[0060.964] lstrlenA (lpString="*.xlsx") returned 6
	[0060.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.ppt") returned 0
	[0060.964] lstrlenA (lpString="*.ppt") returned 5
	[0060.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.pptx") returned 0
	[0060.964] lstrlenA (lpString="*.pptx") returned 6
	[0060.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.txt") returned 0
	[0060.964] lstrlenA (lpString="*.txt") returned 5
	[0060.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.pdf") returned 0
	[0060.964] lstrlenA (lpString="*.pdf") returned 5
	[0060.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.htm") returned 0
	[0060.964] lstrlenA (lpString="*.htm") returned 5
	[0060.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.html") returned 0
	[0060.964] lstrlenA (lpString="*.html") returned 6
	[0060.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.mdb") returned 0
	[0060.964] lstrlenA (lpString="*.mdb") returned 5
	[0060.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.pfx") returned 0
	[0060.964] lstrlenA (lpString="*.pfx") returned 5
	[0060.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.md") returned 0
	[0060.964] lstrlenA (lpString="*.md") returned 4
	[0060.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.lnk") returned 0
	[0060.964] lstrlenA (lpString="*.lnk") returned 5
	[0060.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.torrent") returned 0
	[0060.964] lstrlenA (lpString="*.torrent") returned 9
	[0060.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.mov") returned 0
	[0060.964] lstrlenA (lpString="*.mov") returned 5
	[0060.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.3gp") returned 0
	[0060.964] lstrlenA (lpString="*.3gp") returned 5
	[0060.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.mpeg") returned 0
	[0060.964] lstrlenA (lpString="*.mpeg") returned 6
	[0060.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.mpg") returned 0
	[0060.964] lstrlenA (lpString="*.mpg") returned 5
	[0060.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.flv") returned 0
	[0060.965] lstrlenA (lpString="*.flv") returned 5
	[0060.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.avi") returned 0
	[0060.965] lstrlenA (lpString="*.avi") returned 5
	[0060.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.mp4") returned 0
	[0060.965] lstrlenA (lpString="*.mp4") returned 5
	[0060.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.wmv") returned 0
	[0060.965] lstrlenA (lpString="*.wmv") returned 5
	[0060.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.mkv") returned 0
	[0060.965] lstrlenA (lpString="*.mkv") returned 5
	[0060.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.mp3") returned 0
	[0060.965] lstrlenA (lpString="*.mp3") returned 5
	[0060.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.wav") returned 0
	[0060.965] lstrlenA (lpString="*.wav") returned 5
	[0060.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.flac") returned 0
	[0060.965] lstrlenA (lpString="*.flac") returned 6
	[0060.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.wma") returned 0
	[0060.965] lstrlenA (lpString="*.wma") returned 5
	[0060.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.au3") returned 0
	[0060.965] lstrlenA (lpString="*.au3") returned 5
	[0060.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.ahk") returned 0
	[0060.965] lstrlenA (lpString="*.ahk") returned 5
	[0060.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.c") returned 0
	[0060.965] lstrlenA (lpString="*.c") returned 3
	[0060.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.cc") returned 0
	[0060.965] lstrlenA (lpString="*.cc") returned 4
	[0060.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.cpp") returned 0
	[0060.965] lstrlenA (lpString="*.cpp") returned 5
	[0060.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.cxx") returned 0
	[0060.965] lstrlenA (lpString="*.cxx") returned 5
	[0060.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.c++") returned 0
	[0060.965] lstrlenA (lpString="*.c++") returned 5
	[0060.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.cs") returned 0
	[0060.965] lstrlenA (lpString="*.cs") returned 4
	[0060.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.vb") returned 0
	[0060.965] lstrlenA (lpString="*.vb") returned 4
	[0060.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.bas") returned 0
	[0060.965] lstrlenA (lpString="*.bas") returned 5
	[0060.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.csproj") returned 0
	[0060.965] lstrlenA (lpString="*.csproj") returned 8
	[0060.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.vbproj") returned 0
	[0060.966] lstrlenA (lpString="*.vbproj") returned 8
	[0060.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.vcxproj") returned 0
	[0060.966] lstrlenA (lpString="*.vcxproj") returned 9
	[0060.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.manifest") returned 0
	[0060.966] lstrlenA (lpString="*.manifest") returned 10
	[0060.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.php") returned 0
	[0060.966] lstrlenA (lpString="*.php") returned 5
	[0060.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.vbe") returned 0
	[0060.966] lstrlenA (lpString="*.vbe") returned 5
	[0060.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.vba") returned 0
	[0060.966] lstrlenA (lpString="*.vba") returned 5
	[0060.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.vbs") returned 0
	[0060.966] lstrlenA (lpString="*.vbs") returned 5
	[0060.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.bat") returned 0
	[0060.966] lstrlenA (lpString="*.bat") returned 5
	[0060.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.cmd") returned 0
	[0060.967] lstrlenA (lpString="*.cmd") returned 5
	[0060.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.js") returned 0
	[0060.967] lstrlenA (lpString="*.js") returned 4
	[0060.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.jscript") returned 0
	[0060.967] lstrlenA (lpString="*.jscript") returned 9
	[0060.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.hta") returned 0
	[0060.967] lstrlenA (lpString="*.hta") returned 5
	[0060.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.php7") returned 0
	[0060.967] lstrlenA (lpString="*.php7") returned 6
	[0060.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.db") returned 0
	[0060.967] lstrlenA (lpString="*.db") returned 4
	[0060.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.swf") returned 0
	[0060.967] lstrlenA (lpString="*.swf") returned 5
	[0060.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.eml") returned 0
	[0060.967] lstrlenA (lpString="*.eml") returned 5
	[0060.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.part") returned 0
	[0060.967] lstrlenA (lpString="*.part") returned 6
	[0060.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.nfo") returned 0
	[0060.967] lstrlenA (lpString="*.nfo") returned 5
	[0060.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.rsa") returned 0
	[0060.967] lstrlenA (lpString="*.rsa") returned 5
	[0060.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.key") returned 0
	[0060.967] lstrlenA (lpString="*.key") returned 5
	[0060.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.aes") returned 0
	[0060.967] lstrlenA (lpString="*.aes") returned 5
	[0060.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.blob") returned 0
	[0060.967] lstrlenA (lpString="*.blob") returned 6
	[0060.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.btc") returned 0
	[0060.967] lstrlenA (lpString="*.btc") returned 5
	[0060.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", pszSpec="*.wallet") returned 0
	[0060.967] lstrlenA (lpString="*.wallet") returned 8
	[0060.967] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11436ace, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11436ace, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdb0, dwReserved0=0x540050, dwReserved1=0x46002d, cFileName="Arial.xml", cAlternateFileName="")) returned 1
	[0060.967] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.967] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Arial.xml") returned 1
	[0060.967] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Arial.xml") returned 1
	[0060.968] lstrcmpiA (lpString1="", lpString2="Arial.xml") returned -1
	[0060.968] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml") returned="Arial-Times New Roman.xml"
	[0060.968] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\"
	[0060.968] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned=""
	[0060.968] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.968] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\how-to-decrypt-files.htm")) returned 0x20
	[0060.968] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="Arial.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml"
	[0060.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.zip") returned 0
	[0060.968] lstrlenA (lpString="*.zip") returned 5
	[0060.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.rar") returned 0
	[0060.968] lstrlenA (lpString="*.rar") returned 5
	[0060.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.7z") returned 0
	[0060.968] lstrlenA (lpString="*.7z") returned 4
	[0060.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.tar") returned 0
	[0060.968] lstrlenA (lpString="*.tar") returned 5
	[0060.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.gzip") returned 0
	[0060.968] lstrlenA (lpString="*.gzip") returned 6
	[0060.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.jpg") returned 0
	[0060.968] lstrlenA (lpString="*.jpg") returned 5
	[0060.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.jpeg") returned 0
	[0060.968] lstrlenA (lpString="*.jpeg") returned 6
	[0060.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.bmp") returned 0
	[0060.968] lstrlenA (lpString="*.bmp") returned 5
	[0060.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.gif") returned 0
	[0060.968] lstrlenA (lpString="*.gif") returned 5
	[0060.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.png") returned 0
	[0060.968] lstrlenA (lpString="*.png") returned 5
	[0060.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.doc") returned 0
	[0060.968] lstrlenA (lpString="*.doc") returned 5
	[0060.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.docx") returned 0
	[0060.968] lstrlenA (lpString="*.docx") returned 6
	[0060.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.xls") returned 0
	[0060.968] lstrlenA (lpString="*.xls") returned 5
	[0060.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.xlsx") returned 0
	[0060.969] lstrlenA (lpString="*.xlsx") returned 6
	[0060.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.ppt") returned 0
	[0060.969] lstrlenA (lpString="*.ppt") returned 5
	[0060.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.pptx") returned 0
	[0060.969] lstrlenA (lpString="*.pptx") returned 6
	[0060.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.txt") returned 0
	[0060.969] lstrlenA (lpString="*.txt") returned 5
	[0060.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.pdf") returned 0
	[0060.969] lstrlenA (lpString="*.pdf") returned 5
	[0060.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.htm") returned 0
	[0060.969] lstrlenA (lpString="*.htm") returned 5
	[0060.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.html") returned 0
	[0060.969] lstrlenA (lpString="*.html") returned 6
	[0060.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.mdb") returned 0
	[0060.969] lstrlenA (lpString="*.mdb") returned 5
	[0060.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.pfx") returned 0
	[0060.969] lstrlenA (lpString="*.pfx") returned 5
	[0060.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.md") returned 0
	[0060.969] lstrlenA (lpString="*.md") returned 4
	[0060.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.lnk") returned 0
	[0060.969] lstrlenA (lpString="*.lnk") returned 5
	[0060.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.torrent") returned 0
	[0060.969] lstrlenA (lpString="*.torrent") returned 9
	[0060.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.mov") returned 0
	[0060.969] lstrlenA (lpString="*.mov") returned 5
	[0060.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.3gp") returned 0
	[0060.969] lstrlenA (lpString="*.3gp") returned 5
	[0060.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.mpeg") returned 0
	[0060.969] lstrlenA (lpString="*.mpeg") returned 6
	[0060.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.mpg") returned 0
	[0060.969] lstrlenA (lpString="*.mpg") returned 5
	[0060.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.flv") returned 0
	[0060.969] lstrlenA (lpString="*.flv") returned 5
	[0060.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.avi") returned 0
	[0060.969] lstrlenA (lpString="*.avi") returned 5
	[0060.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.mp4") returned 0
	[0060.970] lstrlenA (lpString="*.mp4") returned 5
	[0060.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.wmv") returned 0
	[0060.970] lstrlenA (lpString="*.wmv") returned 5
	[0060.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.mkv") returned 0
	[0060.970] lstrlenA (lpString="*.mkv") returned 5
	[0060.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.mp3") returned 0
	[0060.970] lstrlenA (lpString="*.mp3") returned 5
	[0060.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.wav") returned 0
	[0060.970] lstrlenA (lpString="*.wav") returned 5
	[0060.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.flac") returned 0
	[0060.970] lstrlenA (lpString="*.flac") returned 6
	[0060.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.wma") returned 0
	[0060.970] lstrlenA (lpString="*.wma") returned 5
	[0060.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.au3") returned 0
	[0060.970] lstrlenA (lpString="*.au3") returned 5
	[0060.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.ahk") returned 0
	[0060.970] lstrlenA (lpString="*.ahk") returned 5
	[0060.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.c") returned 0
	[0060.970] lstrlenA (lpString="*.c") returned 3
	[0060.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.cc") returned 0
	[0060.970] lstrlenA (lpString="*.cc") returned 4
	[0060.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.cpp") returned 0
	[0060.970] lstrlenA (lpString="*.cpp") returned 5
	[0060.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.cxx") returned 0
	[0060.970] lstrlenA (lpString="*.cxx") returned 5
	[0060.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.c++") returned 0
	[0060.970] lstrlenA (lpString="*.c++") returned 5
	[0060.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.cs") returned 0
	[0060.970] lstrlenA (lpString="*.cs") returned 4
	[0060.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.vb") returned 0
	[0060.970] lstrlenA (lpString="*.vb") returned 4
	[0060.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.bas") returned 0
	[0060.970] lstrlenA (lpString="*.bas") returned 5
	[0060.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.csproj") returned 0
	[0060.970] lstrlenA (lpString="*.csproj") returned 8
	[0060.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.vbproj") returned 0
	[0060.970] lstrlenA (lpString="*.vbproj") returned 8
	[0060.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.vcxproj") returned 0
	[0060.971] lstrlenA (lpString="*.vcxproj") returned 9
	[0060.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.manifest") returned 0
	[0060.971] lstrlenA (lpString="*.manifest") returned 10
	[0060.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.php") returned 0
	[0060.971] lstrlenA (lpString="*.php") returned 5
	[0060.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.vbe") returned 0
	[0060.971] lstrlenA (lpString="*.vbe") returned 5
	[0060.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.vba") returned 0
	[0060.971] lstrlenA (lpString="*.vba") returned 5
	[0060.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.vbs") returned 0
	[0060.971] lstrlenA (lpString="*.vbs") returned 5
	[0060.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.bat") returned 0
	[0060.971] lstrlenA (lpString="*.bat") returned 5
	[0060.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.cmd") returned 0
	[0060.971] lstrlenA (lpString="*.cmd") returned 5
	[0060.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.js") returned 0
	[0060.971] lstrlenA (lpString="*.js") returned 4
	[0060.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.jscript") returned 0
	[0060.971] lstrlenA (lpString="*.jscript") returned 9
	[0060.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.hta") returned 0
	[0060.971] lstrlenA (lpString="*.hta") returned 5
	[0060.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.php7") returned 0
	[0060.971] lstrlenA (lpString="*.php7") returned 6
	[0060.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.db") returned 0
	[0060.971] lstrlenA (lpString="*.db") returned 4
	[0060.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.swf") returned 0
	[0060.971] lstrlenA (lpString="*.swf") returned 5
	[0060.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.eml") returned 0
	[0060.971] lstrlenA (lpString="*.eml") returned 5
	[0060.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.part") returned 0
	[0060.971] lstrlenA (lpString="*.part") returned 6
	[0060.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.nfo") returned 0
	[0060.971] lstrlenA (lpString="*.nfo") returned 5
	[0060.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.rsa") returned 0
	[0060.971] lstrlenA (lpString="*.rsa") returned 5
	[0060.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.key") returned 0
	[0060.971] lstrlenA (lpString="*.key") returned 5
	[0060.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.aes") returned 0
	[0060.972] lstrlenA (lpString="*.aes") returned 5
	[0060.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.blob") returned 0
	[0060.972] lstrlenA (lpString="*.blob") returned 6
	[0060.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.btc") returned 0
	[0060.972] lstrlenA (lpString="*.btc") returned 5
	[0060.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", pszSpec="*.wallet") returned 0
	[0060.972] lstrlenA (lpString="*.wallet") returned 8
	[0060.972] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11436ace, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdff, dwReserved0=0x540050, dwReserved1=0x46002d, cFileName="Calibri Light-Constantia.xml", cAlternateFileName="CALIBR~1.XML")) returned 1
	[0060.972] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.972] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Calibri Light-Constantia.xml") returned 1
	[0060.972] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Calibri Light-Constantia.xml") returned 1
	[0060.972] lstrcmpiA (lpString1="", lpString2="Calibri Light-Constantia.xml") returned -1
	[0060.972] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml") returned="Arial.xml"
	[0060.972] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\"
	[0060.972] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned=""
	[0060.972] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.972] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\how-to-decrypt-files.htm")) returned 0x20
	[0060.972] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="Calibri Light-Constantia.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml"
	[0060.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.zip") returned 0
	[0060.972] lstrlenA (lpString="*.zip") returned 5
	[0060.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.rar") returned 0
	[0060.972] lstrlenA (lpString="*.rar") returned 5
	[0060.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.7z") returned 0
	[0060.972] lstrlenA (lpString="*.7z") returned 4
	[0060.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.tar") returned 0
	[0060.972] lstrlenA (lpString="*.tar") returned 5
	[0060.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.gzip") returned 0
	[0060.972] lstrlenA (lpString="*.gzip") returned 6
	[0060.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.jpg") returned 0
	[0060.972] lstrlenA (lpString="*.jpg") returned 5
	[0060.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.jpeg") returned 0
	[0060.972] lstrlenA (lpString="*.jpeg") returned 6
	[0060.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.bmp") returned 0
	[0060.973] lstrlenA (lpString="*.bmp") returned 5
	[0060.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.gif") returned 0
	[0060.973] lstrlenA (lpString="*.gif") returned 5
	[0060.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.png") returned 0
	[0060.973] lstrlenA (lpString="*.png") returned 5
	[0060.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.doc") returned 0
	[0060.973] lstrlenA (lpString="*.doc") returned 5
	[0060.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.docx") returned 0
	[0060.973] lstrlenA (lpString="*.docx") returned 6
	[0060.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.xls") returned 0
	[0060.973] lstrlenA (lpString="*.xls") returned 5
	[0060.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.xlsx") returned 0
	[0060.973] lstrlenA (lpString="*.xlsx") returned 6
	[0060.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.ppt") returned 0
	[0060.973] lstrlenA (lpString="*.ppt") returned 5
	[0060.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.pptx") returned 0
	[0060.973] lstrlenA (lpString="*.pptx") returned 6
	[0060.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.txt") returned 0
	[0060.973] lstrlenA (lpString="*.txt") returned 5
	[0060.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.pdf") returned 0
	[0060.973] lstrlenA (lpString="*.pdf") returned 5
	[0060.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.htm") returned 0
	[0060.973] lstrlenA (lpString="*.htm") returned 5
	[0060.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.html") returned 0
	[0060.973] lstrlenA (lpString="*.html") returned 6
	[0060.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.mdb") returned 0
	[0060.973] lstrlenA (lpString="*.mdb") returned 5
	[0060.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.pfx") returned 0
	[0060.973] lstrlenA (lpString="*.pfx") returned 5
	[0060.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.md") returned 0
	[0060.973] lstrlenA (lpString="*.md") returned 4
	[0060.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.lnk") returned 0
	[0060.973] lstrlenA (lpString="*.lnk") returned 5
	[0060.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.torrent") returned 0
	[0060.974] lstrlenA (lpString="*.torrent") returned 9
	[0060.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.mov") returned 0
	[0060.974] lstrlenA (lpString="*.mov") returned 5
	[0060.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.3gp") returned 0
	[0060.974] lstrlenA (lpString="*.3gp") returned 5
	[0060.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.mpeg") returned 0
	[0060.974] lstrlenA (lpString="*.mpeg") returned 6
	[0060.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.mpg") returned 0
	[0060.974] lstrlenA (lpString="*.mpg") returned 5
	[0060.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.flv") returned 0
	[0060.974] lstrlenA (lpString="*.flv") returned 5
	[0060.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", pszSpec="*.avi") returned 0
	[0060.974] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11482f7f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdd6, dwReserved0=0x540050, dwReserved1=0x46002d, cFileName="Calibri-Cambria.xml", cAlternateFileName="CALIBR~2.XML")) returned 1
	[0060.974] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.974] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Calibri-Cambria.xml") returned 1
	[0060.974] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Calibri-Cambria.xml") returned 1
	[0060.974] lstrcmpiA (lpString1="", lpString2="Calibri-Cambria.xml") returned -1
	[0060.974] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml") returned="Calibri Light-Constantia.xml"
	[0060.974] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\"
	[0060.974] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned=""
	[0060.974] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.974] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\how-to-decrypt-files.htm")) returned 0x20
	[0060.974] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="Calibri-Cambria.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml"
	[0060.975] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11436ace, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1145cd4f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdac, dwReserved0=0x540050, dwReserved1=0x46002d, cFileName="Calibri.xml", cAlternateFileName="")) returned 1
	[0060.975] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.975] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Calibri.xml") returned 1
	[0060.975] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Calibri.xml") returned 1
	[0060.975] lstrcmpiA (lpString1="", lpString2="Calibri.xml") returned -1
	[0060.975] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml") returned="Calibri-Cambria.xml"
	[0060.975] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\"
	[0060.975] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned=""
	[0060.975] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.975] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\how-to-decrypt-files.htm")) returned 0x20
	[0060.975] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="Calibri.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri.xml"
	[0060.975] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11436ace, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11436ace, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xde4, dwReserved0=0x540050, dwReserved1=0x46002d, cFileName="Cambria.xml", cAlternateFileName="")) returned 1
	[0060.975] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.975] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Cambria.xml") returned 1
	[0060.975] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Cambria.xml") returned 1
	[0060.975] lstrcmpiA (lpString1="", lpString2="Cambria.xml") returned -1
	[0060.975] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri.xml") returned="Calibri.xml"
	[0060.975] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\"
	[0060.975] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned=""
	[0060.975] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.975] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\how-to-decrypt-files.htm")) returned 0x20
	[0060.975] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="Cambria.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Cambria.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Cambria.xml"
	[0060.975] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11482f7f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdc0, dwReserved0=0x540050, dwReserved1=0x46002d, cFileName="Candara.xml", cAlternateFileName="")) returned 1
	[0060.975] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.975] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Candara.xml") returned 1
	[0060.975] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Candara.xml") returned 1
	[0060.975] lstrcmpiA (lpString1="", lpString2="Candara.xml") returned -1
	[0060.975] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Cambria.xml") returned="Cambria.xml"
	[0060.975] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\"
	[0060.976] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned=""
	[0060.976] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.976] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\how-to-decrypt-files.htm")) returned 0x20
	[0060.976] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="Candara.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Candara.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Candara.xml"
	[0060.976] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1151b8e4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1151b8e4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11567da2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe38, dwReserved0=0x540050, dwReserved1=0x46002d, cFileName="Century Gothic-Palatino Linotype.xml", cAlternateFileName="CENTUR~3.XML")) returned 1
	[0060.976] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.976] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Century Gothic-Palatino Linotype.xml") returned 1
	[0060.976] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Century Gothic-Palatino Linotype.xml") returned 1
	[0060.976] lstrcmpiA (lpString1="", lpString2="Century Gothic-Palatino Linotype.xml") returned -1
	[0060.976] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Candara.xml") returned="Candara.xml"
	[0060.976] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\"
	[0060.976] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned=""
	[0060.976] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.976] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\how-to-decrypt-files.htm")) returned 0x20
	[0060.976] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="Century Gothic-Palatino Linotype.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Gothic-Palatino Linotype.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Gothic-Palatino Linotype.xml"
	[0060.976] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdd7, dwReserved0=0x540050, dwReserved1=0x46002d, cFileName="Century Gothic.xml", cAlternateFileName="CENTUR~2.XML")) returned 1
	[0060.976] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.976] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Century Gothic.xml") returned 1
	[0060.976] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Century Gothic.xml") returned 1
	[0060.976] lstrcmpiA (lpString1="", lpString2="Century Gothic.xml") returned -1
	[0060.976] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Gothic-Palatino Linotype.xml") returned="Century Gothic-Palatino Linotype.xml"
	[0060.976] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\"
	[0060.976] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned=""
	[0060.976] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.976] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\how-to-decrypt-files.htm")) returned 0x20
	[0060.976] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="Century Gothic.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Gothic.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Gothic.xml"
	[0060.977] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11482f7f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe1f, dwReserved0=0x540050, dwReserved1=0x46002d, cFileName="Century Schoolbook.xml", cAlternateFileName="CENTUR~1.XML")) returned 1
	[0060.977] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.977] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Century Schoolbook.xml") returned 1
	[0060.977] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Century Schoolbook.xml") returned 1
	[0060.977] lstrcmpiA (lpString1="", lpString2="Century Schoolbook.xml") returned -1
	[0060.977] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Gothic.xml") returned="Century Gothic.xml"
	[0060.977] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\"
	[0060.977] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned=""
	[0060.977] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.977] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\how-to-decrypt-files.htm")) returned 0x20
	[0060.977] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="Century Schoolbook.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Schoolbook.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Schoolbook.xml"
	[0060.977] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x540050, dwReserved1=0x46002d, cFileName="Consolas-Verdana.xml", cAlternateFileName="CONSOL~1.XML")) returned 1
	[0060.977] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.977] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Consolas-Verdana.xml") returned 1
	[0060.977] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Consolas-Verdana.xml") returned 1
	[0060.977] lstrcmpiA (lpString1="", lpString2="Consolas-Verdana.xml") returned -1
	[0060.977] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Schoolbook.xml") returned="Century Schoolbook.xml"
	[0060.977] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\"
	[0060.977] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned=""
	[0060.977] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.977] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\how-to-decrypt-files.htm")) returned 0x20
	[0060.977] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="Consolas-Verdana.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Consolas-Verdana.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Consolas-Verdana.xml"
	[0060.977] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdf6, dwReserved0=0x540050, dwReserved1=0x46002d, cFileName="Constantia-Franklin Gothic Book.xml", cAlternateFileName="CONSTA~1.XML")) returned 1
	[0060.977] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0060.977] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Constantia-Franklin Gothic Book.xml") returned 1
	[0060.977] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Constantia-Franklin Gothic Book.xml") returned 1
	[0060.977] lstrcmpiA (lpString1="", lpString2="Constantia-Franklin Gothic Book.xml") returned -1
	[0060.977] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Consolas-Verdana.xml") returned="Consolas-Verdana.xml"
	[0060.977] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\"
	[0060.977] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned=""
	[0060.977] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0060.978] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\how-to-decrypt-files.htm")) returned 0x20
	[0060.978] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="Constantia-Franklin Gothic Book.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Constantia-Franklin Gothic Book.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Constantia-Franklin Gothic Book.xml"
	[0060.978] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11482f7f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdbd, dwReserved0=0x540050, dwReserved1=0x46002d, cFileName="Corbel.xml", cAlternateFileName="")) returned 1
	[0060.978] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0061.026] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Corbel.xml") returned 1
	[0061.026] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Corbel.xml") returned 1
	[0061.026] lstrcmpiA (lpString1="", lpString2="Corbel.xml") returned -1
	[0061.026] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Constantia-Franklin Gothic Book.xml") returned="Constantia-Franklin Gothic Book.xml"
	[0061.026] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\"
	[0061.026] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned=""
	[0061.026] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.026] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\how-to-decrypt-files.htm")) returned 0x20
	[0061.026] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="Corbel.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Corbel.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Corbel.xml"
	[0061.027] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11482f7f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xde3, dwReserved0=0x540050, dwReserved1=0x46002d, cFileName="Franklin Gothic.xml", cAlternateFileName="FRANKL~1.XML")) returned 1
	[0061.027] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0061.027] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Franklin Gothic.xml") returned -1
	[0061.027] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Franklin Gothic.xml") returned 1
	[0061.027] lstrcmpiA (lpString1="", lpString2="Franklin Gothic.xml") returned -1
	[0061.027] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Corbel.xml") returned="Corbel.xml"
	[0061.027] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\"
	[0061.027] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned=""
	[0061.027] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.027] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\how-to-decrypt-files.htm")) returned 0x20
	[0061.027] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="Franklin Gothic.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Franklin Gothic.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Franklin Gothic.xml"
	[0061.027] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11482f7f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdd4, dwReserved0=0x540050, dwReserved1=0x46002d, cFileName="Garamond-TrebuchetMs.xml", cAlternateFileName="GARAMO~1.XML")) returned 1
	[0061.027] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0061.027] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Garamond-TrebuchetMs.xml") returned -1
	[0061.027] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Garamond-TrebuchetMs.xml") returned 1
	[0061.027] lstrcmpiA (lpString1="", lpString2="Garamond-TrebuchetMs.xml") returned -1
	[0061.027] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Franklin Gothic.xml") returned="Franklin Gothic.xml"
	[0061.027] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\"
	[0061.027] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned=""
	[0061.027] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.027] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\how-to-decrypt-files.htm")) returned 0x20
	[0061.027] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="Garamond-TrebuchetMs.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Garamond-TrebuchetMs.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Garamond-TrebuchetMs.xml"
	[0061.027] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdbd, dwReserved0=0x540050, dwReserved1=0x46002d, cFileName="Garamond.xml", cAlternateFileName="")) returned 1
	[0061.027] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0061.027] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Garamond.xml") returned -1
	[0061.028] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Garamond.xml") returned 1
	[0061.028] lstrcmpiA (lpString1="", lpString2="Garamond.xml") returned -1
	[0061.028] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Garamond-TrebuchetMs.xml") returned="Garamond-TrebuchetMs.xml"
	[0061.028] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\"
	[0061.028] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned=""
	[0061.028] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.028] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\how-to-decrypt-files.htm")) returned 0x20
	[0061.028] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="Garamond.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Garamond.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Garamond.xml"
	[0061.028] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdc2, dwReserved0=0x540050, dwReserved1=0x46002d, cFileName="Georgia.xml", cAlternateFileName="")) returned 1
	[0061.028] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0061.028] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Georgia.xml") returned -1
	[0061.028] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Georgia.xml") returned 1
	[0061.028] lstrcmpiA (lpString1="", lpString2="Georgia.xml") returned -1
	[0061.028] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Garamond.xml") returned="Garamond.xml"
	[0061.028] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\"
	[0061.028] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned=""
	[0061.028] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.028] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\how-to-decrypt-files.htm")) returned 0x20
	[0061.028] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="Georgia.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Georgia.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Georgia.xml"
	[0061.028] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x115da4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xea1, dwReserved0=0x540050, dwReserved1=0x46002d, cFileName="Gill Sans MT.xml", cAlternateFileName="GILLSA~1.XML")) returned 1
	[0061.028] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0061.028] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Gill Sans MT.xml") returned -1
	[0061.028] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Gill Sans MT.xml") returned 1
	[0061.028] lstrcmpiA (lpString1="", lpString2="Gill Sans MT.xml") returned -1
	[0061.028] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Georgia.xml") returned="Georgia.xml"
	[0061.029] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\"
	[0061.029] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned=""
	[0061.029] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.029] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\how-to-decrypt-files.htm")) returned 0x20
	[0061.029] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="Gill Sans MT.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Gill Sans MT.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Gill Sans MT.xml"
	[0061.029] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11541b08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe35, dwReserved0=0x540050, dwReserved1=0x46002d, cFileName="Office 2007 - 2010.xml", cAlternateFileName="OFFICE~1.XML")) returned 1
	[0061.029] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0061.029] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Office 2007 - 2010.xml") returned -1
	[0061.029] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Office 2007 - 2010.xml") returned -1
	[0061.029] lstrcmpiA (lpString1="", lpString2="Office 2007 - 2010.xml") returned -1
	[0061.029] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Gill Sans MT.xml") returned="Gill Sans MT.xml"
	[0061.029] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\"
	[0061.029] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned=""
	[0061.029] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.029] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\how-to-decrypt-files.htm")) returned 0x20
	[0061.029] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="Office 2007 - 2010.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Office 2007 - 2010.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Office 2007 - 2010.xml"
	[0061.029] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xde1, dwReserved0=0x540050, dwReserved1=0x46002d, cFileName="Times New Roman-Arial.xml", cAlternateFileName="TIMESN~1.XML")) returned 1
	[0061.029] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0061.029] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Times New Roman-Arial.xml") returned -1
	[0061.029] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Times New Roman-Arial.xml") returned -1
	[0061.029] lstrcmpiA (lpString1="", lpString2="Times New Roman-Arial.xml") returned -1
	[0061.029] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Office 2007 - 2010.xml") returned="Office 2007 - 2010.xml"
	[0061.029] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\"
	[0061.029] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned=""
	[0061.030] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.030] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\how-to-decrypt-files.htm")) returned 0x20
	[0061.030] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="Times New Roman-Arial.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Times New Roman-Arial.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Times New Roman-Arial.xml"
	[0061.030] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11567da2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdd7, dwReserved0=0x540050, dwReserved1=0x46002d, cFileName="TrebuchetMs.xml", cAlternateFileName="TREBUC~1.XML")) returned 1
	[0061.030] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0061.030] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="TrebuchetMs.xml") returned -1
	[0061.030] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="TrebuchetMs.xml") returned -1
	[0061.030] lstrcmpiA (lpString1="", lpString2="TrebuchetMs.xml") returned -1
	[0061.030] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Times New Roman-Arial.xml") returned="Times New Roman-Arial.xml"
	[0061.030] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\"
	[0061.030] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned=""
	[0061.030] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.030] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\how-to-decrypt-files.htm")) returned 0x20
	[0061.030] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="TrebuchetMs.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\TrebuchetMs.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\TrebuchetMs.xml"
	[0061.030] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1151b8e4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1151b8e4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11567da2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe9e, dwReserved0=0x540050, dwReserved1=0x46002d, cFileName="Tw Cen MT-Rockwell.xml", cAlternateFileName="TWCENM~2.XML")) returned 1
	[0061.030] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0061.030] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Tw Cen MT-Rockwell.xml") returned -1
	[0061.030] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Tw Cen MT-Rockwell.xml") returned -1
	[0061.030] lstrcmpiA (lpString1="", lpString2="Tw Cen MT-Rockwell.xml") returned -1
	[0061.030] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\TrebuchetMs.xml") returned="TrebuchetMs.xml"
	[0061.030] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\"
	[0061.030] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned=""
	[0061.030] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.030] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\how-to-decrypt-files.htm")) returned 0x20
	[0061.031] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="Tw Cen MT-Rockwell.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Tw Cen MT-Rockwell.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Tw Cen MT-Rockwell.xml"
	[0061.031] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xea0, dwReserved0=0x540050, dwReserved1=0x46002d, cFileName="Tw Cen MT.xml", cAlternateFileName="TWCENM~1.XML")) returned 1
	[0061.031] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0061.031] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Tw Cen MT.xml") returned -1
	[0061.031] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Tw Cen MT.xml") returned -1
	[0061.031] lstrcmpiA (lpString1="", lpString2="Tw Cen MT.xml") returned -1
	[0061.031] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Tw Cen MT-Rockwell.xml") returned="Tw Cen MT-Rockwell.xml"
	[0061.031] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\"
	[0061.031] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\") returned=""
	[0061.031] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.031] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\how-to-decrypt-files.htm")) returned 0x20
	[0061.031] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\", lpString2="Tw Cen MT.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Tw Cen MT.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Tw Cen MT.xml"
	[0061.031] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xea0, dwReserved0=0x540050, dwReserved1=0x46002d, cFileName="Tw Cen MT.xml", cAlternateFileName="TWCENM~1.XML")) returned 0
	[0061.031] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1
	[0061.031] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11567da2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbc7c1, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="Wisp.thmx", cAlternateFileName="WISP~1.THM")) returned 1
	[0061.031] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.031] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Wisp.thmx") returned -1
	[0061.031] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Wisp.thmx") returned -1
	[0061.031] lstrcmpiA (lpString1="", lpString2="Wisp.thmx") returned -1
	[0061.031] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\*.*") returned="*.*"
	[0061.031] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\"
	[0061.031] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\") returned=""
	[0061.031] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.031] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\how-to-decrypt-files.htm")) returned 0x20
	[0061.032] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\", lpString2="Wisp.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Wisp.thmx") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Wisp.thmx"
	[0061.032] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11567da2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbc7c1, dwReserved0=0x7bf178, dwReserved1=0x0, cFileName="Wisp.thmx", cAlternateFileName="WISP~1.THM")) returned 0
	[0061.032] FindClose (in: hFindFile=0x7cb850 | out: hFindFile=0x7cb850) returned 1
	[0061.032] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114f5747, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114f5747, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x7d7d78, cFileName="Flattener", cAlternateFileName="FLATTE~1")) returned 1
	[0061.032] lstrcmpA (lpString1=".", lpString2="Flattener") returned -1
	[0061.032] lstrcmpA (lpString1="..", lpString2="Flattener") returned -1
	[0061.032] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\*.*") returned="*.*"
	[0061.032] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\", lpString2="Flattener" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener"
	[0061.032] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114f5747, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114f5747, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb750
	[0061.033] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0061.033] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114f5747, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114f5747, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.033] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0061.033] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0061.033] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa937f07, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa937f07, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfae22cc9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="APDEA0~1.DLL")) returned 1
	[0061.033] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.033] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="api-ms-win-core-file-l1-2-0.dll") returned 1
	[0061.033] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="api-ms-win-core-file-l1-2-0.dll") returned 1
	[0061.033] lstrcmpiA (lpString1="", lpString2="api-ms-win-core-file-l1-2-0.dll") returned -1
	[0061.033] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\*.*") returned="*.*"
	[0061.033] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.033] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.033] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.033] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0061.033] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0061.034] WriteFile (in: hFile=0x210, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0061.035] SetFileTime (hFile=0x210, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0061.035] CloseHandle (hObject=0x210) returned 1
	[0061.035] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="api-ms-win-core-file-l1-2-0.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll"
	[0061.035] lstrlenA (lpString="*.zip") returned 5
	[0061.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.rar") returned 0
	[0061.036] lstrlenA (lpString="*.rar") returned 5
	[0061.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.7z") returned 0
	[0061.036] lstrlenA (lpString="*.7z") returned 4
	[0061.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.tar") returned 0
	[0061.036] lstrlenA (lpString="*.tar") returned 5
	[0061.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.gzip") returned 0
	[0061.036] lstrlenA (lpString="*.gzip") returned 6
	[0061.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.jpg") returned 0
	[0061.036] lstrlenA (lpString="*.jpg") returned 5
	[0061.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.jpeg") returned 0
	[0061.036] lstrlenA (lpString="*.jpeg") returned 6
	[0061.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.bmp") returned 0
	[0061.036] lstrlenA (lpString="*.bmp") returned 5
	[0061.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.gif") returned 0
	[0061.036] lstrlenA (lpString="*.gif") returned 5
	[0061.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.png") returned 0
	[0061.036] lstrlenA (lpString="*.png") returned 5
	[0061.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.doc") returned 0
	[0061.036] lstrlenA (lpString="*.doc") returned 5
	[0061.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.docx") returned 0
	[0061.036] lstrlenA (lpString="*.docx") returned 6
	[0061.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.xls") returned 0
	[0061.036] lstrlenA (lpString="*.xls") returned 5
	[0061.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.xlsx") returned 0
	[0061.036] lstrlenA (lpString="*.xlsx") returned 6
	[0061.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.ppt") returned 0
	[0061.036] lstrlenA (lpString="*.ppt") returned 5
	[0061.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.pptx") returned 0
	[0061.036] lstrlenA (lpString="*.pptx") returned 6
	[0061.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.txt") returned 0
	[0061.036] lstrlenA (lpString="*.txt") returned 5
	[0061.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.pdf") returned 0
	[0061.036] lstrlenA (lpString="*.pdf") returned 5
	[0061.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.htm") returned 0
	[0061.036] lstrlenA (lpString="*.htm") returned 5
	[0061.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.html") returned 0
	[0061.036] lstrlenA (lpString="*.html") returned 6
	[0061.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.mdb") returned 0
	[0061.037] lstrlenA (lpString="*.mdb") returned 5
	[0061.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.pfx") returned 0
	[0061.037] lstrlenA (lpString="*.pfx") returned 5
	[0061.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.md") returned 0
	[0061.037] lstrlenA (lpString="*.md") returned 4
	[0061.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.lnk") returned 0
	[0061.037] lstrlenA (lpString="*.lnk") returned 5
	[0061.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.torrent") returned 0
	[0061.037] lstrlenA (lpString="*.torrent") returned 9
	[0061.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.mov") returned 0
	[0061.037] lstrlenA (lpString="*.mov") returned 5
	[0061.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.3gp") returned 0
	[0061.037] lstrlenA (lpString="*.3gp") returned 5
	[0061.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.mpeg") returned 0
	[0061.037] lstrlenA (lpString="*.mpeg") returned 6
	[0061.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.mpg") returned 0
	[0061.037] lstrlenA (lpString="*.mpg") returned 5
	[0061.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.flv") returned 0
	[0061.037] lstrlenA (lpString="*.flv") returned 5
	[0061.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.avi") returned 0
	[0061.037] lstrlenA (lpString="*.avi") returned 5
	[0061.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.mp4") returned 0
	[0061.037] lstrlenA (lpString="*.mp4") returned 5
	[0061.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.wmv") returned 0
	[0061.037] lstrlenA (lpString="*.wmv") returned 5
	[0061.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.mkv") returned 0
	[0061.037] lstrlenA (lpString="*.mkv") returned 5
	[0061.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.mp3") returned 0
	[0061.037] lstrlenA (lpString="*.mp3") returned 5
	[0061.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.wav") returned 0
	[0061.037] lstrlenA (lpString="*.wav") returned 5
	[0061.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.flac") returned 0
	[0061.037] lstrlenA (lpString="*.flac") returned 6
	[0061.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.wma") returned 0
	[0061.037] lstrlenA (lpString="*.wma") returned 5
	[0061.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.au3") returned 0
	[0061.038] lstrlenA (lpString="*.au3") returned 5
	[0061.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.ahk") returned 0
	[0061.038] lstrlenA (lpString="*.ahk") returned 5
	[0061.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.c") returned 0
	[0061.038] lstrlenA (lpString="*.c") returned 3
	[0061.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.cc") returned 0
	[0061.038] lstrlenA (lpString="*.cc") returned 4
	[0061.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.cpp") returned 0
	[0061.038] lstrlenA (lpString="*.cpp") returned 5
	[0061.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.cxx") returned 0
	[0061.038] lstrlenA (lpString="*.cxx") returned 5
	[0061.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.c++") returned 0
	[0061.038] lstrlenA (lpString="*.c++") returned 5
	[0061.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.cs") returned 0
	[0061.038] lstrlenA (lpString="*.cs") returned 4
	[0061.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.vb") returned 0
	[0061.038] lstrlenA (lpString="*.vb") returned 4
	[0061.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.bas") returned 0
	[0061.038] lstrlenA (lpString="*.bas") returned 5
	[0061.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.csproj") returned 0
	[0061.038] lstrlenA (lpString="*.csproj") returned 8
	[0061.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.vbproj") returned 0
	[0061.038] lstrlenA (lpString="*.vbproj") returned 8
	[0061.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.vcxproj") returned 0
	[0061.038] lstrlenA (lpString="*.vcxproj") returned 9
	[0061.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.manifest") returned 0
	[0061.038] lstrlenA (lpString="*.manifest") returned 10
	[0061.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.php") returned 0
	[0061.038] lstrlenA (lpString="*.php") returned 5
	[0061.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.vbe") returned 0
	[0061.038] lstrlenA (lpString="*.vbe") returned 5
	[0061.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.vba") returned 0
	[0061.038] lstrlenA (lpString="*.vba") returned 5
	[0061.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.vbs") returned 0
	[0061.038] lstrlenA (lpString="*.vbs") returned 5
	[0061.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.bat") returned 0
	[0061.039] lstrlenA (lpString="*.bat") returned 5
	[0061.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.cmd") returned 0
	[0061.039] lstrlenA (lpString="*.cmd") returned 5
	[0061.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.js") returned 0
	[0061.039] lstrlenA (lpString="*.js") returned 4
	[0061.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.jscript") returned 0
	[0061.039] lstrlenA (lpString="*.jscript") returned 9
	[0061.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.hta") returned 0
	[0061.039] lstrlenA (lpString="*.hta") returned 5
	[0061.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.php7") returned 0
	[0061.039] lstrlenA (lpString="*.php7") returned 6
	[0061.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.db") returned 0
	[0061.039] lstrlenA (lpString="*.db") returned 4
	[0061.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.swf") returned 0
	[0061.039] lstrlenA (lpString="*.swf") returned 5
	[0061.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.eml") returned 0
	[0061.039] lstrlenA (lpString="*.eml") returned 5
	[0061.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.part") returned 0
	[0061.039] lstrlenA (lpString="*.part") returned 6
	[0061.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.nfo") returned 0
	[0061.039] lstrlenA (lpString="*.nfo") returned 5
	[0061.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.rsa") returned 0
	[0061.039] lstrlenA (lpString="*.rsa") returned 5
	[0061.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.key") returned 0
	[0061.039] lstrlenA (lpString="*.key") returned 5
	[0061.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.aes") returned 0
	[0061.039] lstrlenA (lpString="*.aes") returned 5
	[0061.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.blob") returned 0
	[0061.039] lstrlenA (lpString="*.blob") returned 6
	[0061.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.btc") returned 0
	[0061.039] lstrlenA (lpString="*.btc") returned 5
	[0061.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.wallet") returned 0
	[0061.039] lstrlenA (lpString="*.wallet") returned 8
	[0061.039] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf035e09d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf035e09d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf035e09d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="API-MS~2.DLL")) returned 1
	[0061.039] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.039] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="api-ms-win-core-file-l2-1-0.dll") returned 1
	[0061.039] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="api-ms-win-core-file-l2-1-0.dll") returned 1
	[0061.040] lstrcmpiA (lpString1="", lpString2="api-ms-win-core-file-l2-1-0.dll") returned -1
	[0061.040] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned="api-ms-win-core-file-l1-2-0.dll"
	[0061.040] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.040] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.040] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.040] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.040] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="api-ms-win-core-file-l2-1-0.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll"
	[0061.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.zip") returned 0
	[0061.040] lstrlenA (lpString="*.zip") returned 5
	[0061.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.rar") returned 0
	[0061.040] lstrlenA (lpString="*.rar") returned 5
	[0061.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.7z") returned 0
	[0061.040] lstrlenA (lpString="*.7z") returned 4
	[0061.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.tar") returned 0
	[0061.040] lstrlenA (lpString="*.tar") returned 5
	[0061.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.gzip") returned 0
	[0061.040] lstrlenA (lpString="*.gzip") returned 6
	[0061.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.jpg") returned 0
	[0061.040] lstrlenA (lpString="*.jpg") returned 5
	[0061.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.jpeg") returned 0
	[0061.040] lstrlenA (lpString="*.jpeg") returned 6
	[0061.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.bmp") returned 0
	[0061.040] lstrlenA (lpString="*.bmp") returned 5
	[0061.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.gif") returned 0
	[0061.040] lstrlenA (lpString="*.gif") returned 5
	[0061.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.png") returned 0
	[0061.040] lstrlenA (lpString="*.png") returned 5
	[0061.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.doc") returned 0
	[0061.040] lstrlenA (lpString="*.doc") returned 5
	[0061.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.docx") returned 0
	[0061.040] lstrlenA (lpString="*.docx") returned 6
	[0061.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.xls") returned 0
	[0061.040] lstrlenA (lpString="*.xls") returned 5
	[0061.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.xlsx") returned 0
	[0061.041] lstrlenA (lpString="*.xlsx") returned 6
	[0061.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.ppt") returned 0
	[0061.041] lstrlenA (lpString="*.ppt") returned 5
	[0061.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.pptx") returned 0
	[0061.041] lstrlenA (lpString="*.pptx") returned 6
	[0061.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.txt") returned 0
	[0061.041] lstrlenA (lpString="*.txt") returned 5
	[0061.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.pdf") returned 0
	[0061.041] lstrlenA (lpString="*.pdf") returned 5
	[0061.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.htm") returned 0
	[0061.041] lstrlenA (lpString="*.htm") returned 5
	[0061.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.html") returned 0
	[0061.041] lstrlenA (lpString="*.html") returned 6
	[0061.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.mdb") returned 0
	[0061.041] lstrlenA (lpString="*.mdb") returned 5
	[0061.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.pfx") returned 0
	[0061.041] lstrlenA (lpString="*.pfx") returned 5
	[0061.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.md") returned 0
	[0061.041] lstrlenA (lpString="*.md") returned 4
	[0061.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.lnk") returned 0
	[0061.041] lstrlenA (lpString="*.lnk") returned 5
	[0061.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.torrent") returned 0
	[0061.041] lstrlenA (lpString="*.torrent") returned 9
	[0061.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.mov") returned 0
	[0061.041] lstrlenA (lpString="*.mov") returned 5
	[0061.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.3gp") returned 0
	[0061.041] lstrlenA (lpString="*.3gp") returned 5
	[0061.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.mpeg") returned 0
	[0061.041] lstrlenA (lpString="*.mpeg") returned 6
	[0061.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.mpg") returned 0
	[0061.041] lstrlenA (lpString="*.mpg") returned 5
	[0061.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.flv") returned 0
	[0061.041] lstrlenA (lpString="*.flv") returned 5
	[0061.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.avi") returned 0
	[0061.042] lstrlenA (lpString="*.avi") returned 5
	[0061.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.mp4") returned 0
	[0061.042] lstrlenA (lpString="*.mp4") returned 5
	[0061.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.wmv") returned 0
	[0061.042] lstrlenA (lpString="*.wmv") returned 5
	[0061.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.mkv") returned 0
	[0061.042] lstrlenA (lpString="*.mkv") returned 5
	[0061.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.mp3") returned 0
	[0061.042] lstrlenA (lpString="*.mp3") returned 5
	[0061.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.wav") returned 0
	[0061.042] lstrlenA (lpString="*.wav") returned 5
	[0061.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.flac") returned 0
	[0061.042] lstrlenA (lpString="*.flac") returned 6
	[0061.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.wma") returned 0
	[0061.042] lstrlenA (lpString="*.wma") returned 5
	[0061.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.au3") returned 0
	[0061.042] lstrlenA (lpString="*.au3") returned 5
	[0061.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.ahk") returned 0
	[0061.042] lstrlenA (lpString="*.ahk") returned 5
	[0061.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.c") returned 0
	[0061.042] lstrlenA (lpString="*.c") returned 3
	[0061.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.cc") returned 0
	[0061.042] lstrlenA (lpString="*.cc") returned 4
	[0061.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.cpp") returned 0
	[0061.042] lstrlenA (lpString="*.cpp") returned 5
	[0061.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.cxx") returned 0
	[0061.042] lstrlenA (lpString="*.cxx") returned 5
	[0061.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.c++") returned 0
	[0061.042] lstrlenA (lpString="*.c++") returned 5
	[0061.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.cs") returned 0
	[0061.042] lstrlenA (lpString="*.cs") returned 4
	[0061.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.vb") returned 0
	[0061.042] lstrlenA (lpString="*.vb") returned 4
	[0061.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.bas") returned 0
	[0061.042] lstrlenA (lpString="*.bas") returned 5
	[0061.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.csproj") returned 0
	[0061.043] lstrlenA (lpString="*.csproj") returned 8
	[0061.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.vbproj") returned 0
	[0061.043] lstrlenA (lpString="*.vbproj") returned 8
	[0061.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.vcxproj") returned 0
	[0061.043] lstrlenA (lpString="*.vcxproj") returned 9
	[0061.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.manifest") returned 0
	[0061.043] lstrlenA (lpString="*.manifest") returned 10
	[0061.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.php") returned 0
	[0061.043] lstrlenA (lpString="*.php") returned 5
	[0061.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.vbe") returned 0
	[0061.043] lstrlenA (lpString="*.vbe") returned 5
	[0061.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.vba") returned 0
	[0061.043] lstrlenA (lpString="*.vba") returned 5
	[0061.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.vbs") returned 0
	[0061.043] lstrlenA (lpString="*.vbs") returned 5
	[0061.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.bat") returned 0
	[0061.043] lstrlenA (lpString="*.bat") returned 5
	[0061.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.cmd") returned 0
	[0061.043] lstrlenA (lpString="*.cmd") returned 5
	[0061.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.js") returned 0
	[0061.043] lstrlenA (lpString="*.js") returned 4
	[0061.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.jscript") returned 0
	[0061.043] lstrlenA (lpString="*.jscript") returned 9
	[0061.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.hta") returned 0
	[0061.043] lstrlenA (lpString="*.hta") returned 5
	[0061.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.php7") returned 0
	[0061.043] lstrlenA (lpString="*.php7") returned 6
	[0061.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.db") returned 0
	[0061.043] lstrlenA (lpString="*.db") returned 4
	[0061.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.swf") returned 0
	[0061.043] lstrlenA (lpString="*.swf") returned 5
	[0061.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.eml") returned 0
	[0061.043] lstrlenA (lpString="*.eml") returned 5
	[0061.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.part") returned 0
	[0061.043] lstrlenA (lpString="*.part") returned 6
	[0061.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.nfo") returned 0
	[0061.043] lstrlenA (lpString="*.nfo") returned 5
	[0061.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.rsa") returned 0
	[0061.044] lstrlenA (lpString="*.rsa") returned 5
	[0061.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.key") returned 0
	[0061.044] lstrlenA (lpString="*.key") returned 5
	[0061.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.aes") returned 0
	[0061.044] lstrlenA (lpString="*.aes") returned 5
	[0061.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.blob") returned 0
	[0061.044] lstrlenA (lpString="*.blob") returned 6
	[0061.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.btc") returned 0
	[0061.044] lstrlenA (lpString="*.btc") returned 5
	[0061.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.wallet") returned 0
	[0061.044] lstrlenA (lpString="*.wallet") returned 8
	[0061.044] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5c164a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5c164a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5c164a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x52c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="AP6221~1.DLL")) returned 1
	[0061.044] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.044] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="api-ms-win-core-localization-l1-2-0.dll") returned 1
	[0061.044] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="api-ms-win-core-localization-l1-2-0.dll") returned 1
	[0061.044] lstrcmpiA (lpString1="", lpString2="api-ms-win-core-localization-l1-2-0.dll") returned -1
	[0061.044] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned="api-ms-win-core-file-l2-1-0.dll"
	[0061.044] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.044] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.044] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.044] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.044] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="api-ms-win-core-localization-l1-2-0.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll"
	[0061.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.zip") returned 0
	[0061.044] lstrlenA (lpString="*.zip") returned 5
	[0061.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.rar") returned 0
	[0061.044] lstrlenA (lpString="*.rar") returned 5
	[0061.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.7z") returned 0
	[0061.044] lstrlenA (lpString="*.7z") returned 4
	[0061.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.tar") returned 0
	[0061.045] lstrlenA (lpString="*.tar") returned 5
	[0061.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.gzip") returned 0
	[0061.045] lstrlenA (lpString="*.gzip") returned 6
	[0061.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.jpg") returned 0
	[0061.045] lstrlenA (lpString="*.jpg") returned 5
	[0061.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.jpeg") returned 0
	[0061.045] lstrlenA (lpString="*.jpeg") returned 6
	[0061.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.bmp") returned 0
	[0061.045] lstrlenA (lpString="*.bmp") returned 5
	[0061.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.gif") returned 0
	[0061.045] lstrlenA (lpString="*.gif") returned 5
	[0061.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.png") returned 0
	[0061.045] lstrlenA (lpString="*.png") returned 5
	[0061.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.doc") returned 0
	[0061.045] lstrlenA (lpString="*.doc") returned 5
	[0061.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.docx") returned 0
	[0061.045] lstrlenA (lpString="*.docx") returned 6
	[0061.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.xls") returned 0
	[0061.045] lstrlenA (lpString="*.xls") returned 5
	[0061.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.xlsx") returned 0
	[0061.045] lstrlenA (lpString="*.xlsx") returned 6
	[0061.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.ppt") returned 0
	[0061.045] lstrlenA (lpString="*.ppt") returned 5
	[0061.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.pptx") returned 0
	[0061.045] lstrlenA (lpString="*.pptx") returned 6
	[0061.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.txt") returned 0
	[0061.045] lstrlenA (lpString="*.txt") returned 5
	[0061.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.pdf") returned 0
	[0061.045] lstrlenA (lpString="*.pdf") returned 5
	[0061.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.htm") returned 0
	[0061.045] lstrlenA (lpString="*.htm") returned 5
	[0061.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.html") returned 0
	[0061.045] lstrlenA (lpString="*.html") returned 6
	[0061.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.mdb") returned 0
	[0061.045] lstrlenA (lpString="*.mdb") returned 5
	[0061.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.pfx") returned 0
	[0061.046] lstrlenA (lpString="*.pfx") returned 5
	[0061.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.md") returned 0
	[0061.046] lstrlenA (lpString="*.md") returned 4
	[0061.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.lnk") returned 0
	[0061.046] lstrlenA (lpString="*.lnk") returned 5
	[0061.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.torrent") returned 0
	[0061.046] lstrlenA (lpString="*.torrent") returned 9
	[0061.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.mov") returned 0
	[0061.046] lstrlenA (lpString="*.mov") returned 5
	[0061.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.3gp") returned 0
	[0061.046] lstrlenA (lpString="*.3gp") returned 5
	[0061.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.mpeg") returned 0
	[0061.046] lstrlenA (lpString="*.mpeg") returned 6
	[0061.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.mpg") returned 0
	[0061.046] lstrlenA (lpString="*.mpg") returned 5
	[0061.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.flv") returned 0
	[0061.046] lstrlenA (lpString="*.flv") returned 5
	[0061.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.avi") returned 0
	[0061.046] lstrlenA (lpString="*.avi") returned 5
	[0061.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.mp4") returned 0
	[0061.046] lstrlenA (lpString="*.mp4") returned 5
	[0061.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.wmv") returned 0
	[0061.046] lstrlenA (lpString="*.wmv") returned 5
	[0061.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.mkv") returned 0
	[0061.046] lstrlenA (lpString="*.mkv") returned 5
	[0061.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.mp3") returned 0
	[0061.046] lstrlenA (lpString="*.mp3") returned 5
	[0061.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.wav") returned 0
	[0061.046] lstrlenA (lpString="*.wav") returned 5
	[0061.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.flac") returned 0
	[0061.046] lstrlenA (lpString="*.flac") returned 6
	[0061.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.wma") returned 0
	[0061.046] lstrlenA (lpString="*.wma") returned 5
	[0061.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.au3") returned 0
	[0061.046] lstrlenA (lpString="*.au3") returned 5
	[0061.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.ahk") returned 0
	[0061.047] lstrlenA (lpString="*.ahk") returned 5
	[0061.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.c") returned 0
	[0061.047] lstrlenA (lpString="*.c") returned 3
	[0061.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.cc") returned 0
	[0061.047] lstrlenA (lpString="*.cc") returned 4
	[0061.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.cpp") returned 0
	[0061.047] lstrlenA (lpString="*.cpp") returned 5
	[0061.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.cxx") returned 0
	[0061.047] lstrlenA (lpString="*.cxx") returned 5
	[0061.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.c++") returned 0
	[0061.047] lstrlenA (lpString="*.c++") returned 5
	[0061.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.cs") returned 0
	[0061.047] lstrlenA (lpString="*.cs") returned 4
	[0061.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.vb") returned 0
	[0061.047] lstrlenA (lpString="*.vb") returned 4
	[0061.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.bas") returned 0
	[0061.047] lstrlenA (lpString="*.bas") returned 5
	[0061.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.csproj") returned 0
	[0061.047] lstrlenA (lpString="*.csproj") returned 8
	[0061.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.vbproj") returned 0
	[0061.047] lstrlenA (lpString="*.vbproj") returned 8
	[0061.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.vcxproj") returned 0
	[0061.047] lstrlenA (lpString="*.vcxproj") returned 9
	[0061.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.manifest") returned 0
	[0061.047] lstrlenA (lpString="*.manifest") returned 10
	[0061.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.php") returned 0
	[0061.047] lstrlenA (lpString="*.php") returned 5
	[0061.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.vbe") returned 0
	[0061.047] lstrlenA (lpString="*.vbe") returned 5
	[0061.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.vba") returned 0
	[0061.047] lstrlenA (lpString="*.vba") returned 5
	[0061.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.vbs") returned 0
	[0061.047] lstrlenA (lpString="*.vbs") returned 5
	[0061.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.bat") returned 0
	[0061.047] lstrlenA (lpString="*.bat") returned 5
	[0061.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.cmd") returned 0
	[0061.048] lstrlenA (lpString="*.cmd") returned 5
	[0061.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.js") returned 0
	[0061.048] lstrlenA (lpString="*.js") returned 4
	[0061.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.jscript") returned 0
	[0061.048] lstrlenA (lpString="*.jscript") returned 9
	[0061.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.hta") returned 0
	[0061.048] lstrlenA (lpString="*.hta") returned 5
	[0061.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.php7") returned 0
	[0061.048] lstrlenA (lpString="*.php7") returned 6
	[0061.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.db") returned 0
	[0061.048] lstrlenA (lpString="*.db") returned 4
	[0061.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.swf") returned 0
	[0061.048] lstrlenA (lpString="*.swf") returned 5
	[0061.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.eml") returned 0
	[0061.048] lstrlenA (lpString="*.eml") returned 5
	[0061.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.part") returned 0
	[0061.048] lstrlenA (lpString="*.part") returned 6
	[0061.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.nfo") returned 0
	[0061.048] lstrlenA (lpString="*.nfo") returned 5
	[0061.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.rsa") returned 0
	[0061.048] lstrlenA (lpString="*.rsa") returned 5
	[0061.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.key") returned 0
	[0061.048] lstrlenA (lpString="*.key") returned 5
	[0061.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.aes") returned 0
	[0061.048] lstrlenA (lpString="*.aes") returned 5
	[0061.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.blob") returned 0
	[0061.048] lstrlenA (lpString="*.blob") returned 6
	[0061.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.btc") returned 0
	[0061.048] lstrlenA (lpString="*.btc") returned 5
	[0061.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.wallet") returned 0
	[0061.048] lstrlenA (lpString="*.wallet") returned 8
	[0061.048] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5a3de35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a3de35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5a6407d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="AP750A~1.DLL")) returned 1
	[0061.048] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.048] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="api-ms-win-core-processthreads-l1-1-1.dll") returned 1
	[0061.048] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="api-ms-win-core-processthreads-l1-1-1.dll") returned 1
	[0061.048] lstrcmpiA (lpString1="", lpString2="api-ms-win-core-processthreads-l1-1-1.dll") returned -1
	[0061.049] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned="api-ms-win-core-localization-l1-2-0.dll"
	[0061.049] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.049] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.049] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.049] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.049] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="api-ms-win-core-processthreads-l1-1-1.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll"
	[0061.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.zip") returned 0
	[0061.049] lstrlenA (lpString="*.zip") returned 5
	[0061.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.rar") returned 0
	[0061.049] lstrlenA (lpString="*.rar") returned 5
	[0061.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.7z") returned 0
	[0061.049] lstrlenA (lpString="*.7z") returned 4
	[0061.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.tar") returned 0
	[0061.049] lstrlenA (lpString="*.tar") returned 5
	[0061.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.gzip") returned 0
	[0061.049] lstrlenA (lpString="*.gzip") returned 6
	[0061.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.jpg") returned 0
	[0061.049] lstrlenA (lpString="*.jpg") returned 5
	[0061.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.jpeg") returned 0
	[0061.049] lstrlenA (lpString="*.jpeg") returned 6
	[0061.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.bmp") returned 0
	[0061.049] lstrlenA (lpString="*.bmp") returned 5
	[0061.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.gif") returned 0
	[0061.049] lstrlenA (lpString="*.gif") returned 5
	[0061.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.png") returned 0
	[0061.049] lstrlenA (lpString="*.png") returned 5
	[0061.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.doc") returned 0
	[0061.049] lstrlenA (lpString="*.doc") returned 5
	[0061.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.docx") returned 0
	[0061.049] lstrlenA (lpString="*.docx") returned 6
	[0061.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.xls") returned 0
	[0061.049] lstrlenA (lpString="*.xls") returned 5
	[0061.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.xlsx") returned 0
	[0061.050] lstrlenA (lpString="*.xlsx") returned 6
	[0061.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.ppt") returned 0
	[0061.050] lstrlenA (lpString="*.ppt") returned 5
	[0061.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.pptx") returned 0
	[0061.050] lstrlenA (lpString="*.pptx") returned 6
	[0061.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.txt") returned 0
	[0061.050] lstrlenA (lpString="*.txt") returned 5
	[0061.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.pdf") returned 0
	[0061.050] lstrlenA (lpString="*.pdf") returned 5
	[0061.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.htm") returned 0
	[0061.050] lstrlenA (lpString="*.htm") returned 5
	[0061.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.html") returned 0
	[0061.050] lstrlenA (lpString="*.html") returned 6
	[0061.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.mdb") returned 0
	[0061.050] lstrlenA (lpString="*.mdb") returned 5
	[0061.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.pfx") returned 0
	[0061.050] lstrlenA (lpString="*.pfx") returned 5
	[0061.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.md") returned 0
	[0061.050] lstrlenA (lpString="*.md") returned 4
	[0061.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.lnk") returned 0
	[0061.050] lstrlenA (lpString="*.lnk") returned 5
	[0061.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.torrent") returned 0
	[0061.050] lstrlenA (lpString="*.torrent") returned 9
	[0061.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.mov") returned 0
	[0061.050] lstrlenA (lpString="*.mov") returned 5
	[0061.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.3gp") returned 0
	[0061.050] lstrlenA (lpString="*.3gp") returned 5
	[0061.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.mpeg") returned 0
	[0061.050] lstrlenA (lpString="*.mpeg") returned 6
	[0061.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.mpg") returned 0
	[0061.050] lstrlenA (lpString="*.mpg") returned 5
	[0061.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.flv") returned 0
	[0061.050] lstrlenA (lpString="*.flv") returned 5
	[0061.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.avi") returned 0
	[0061.051] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1814809, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="API-MS~3.DLL")) returned 1
	[0061.051] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.051] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="api-ms-win-core-synch-l1-2-0.dll") returned 1
	[0061.051] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="api-ms-win-core-synch-l1-2-0.dll") returned 1
	[0061.051] lstrcmpiA (lpString1="", lpString2="api-ms-win-core-synch-l1-2-0.dll") returned -1
	[0061.051] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned="api-ms-win-core-processthreads-l1-1-1.dll"
	[0061.051] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.051] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.051] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.051] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.051] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="api-ms-win-core-synch-l1-2-0.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll"
	[0061.051] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfbdee689, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbdee689, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbdee689, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="AP7902~1.DLL")) returned 1
	[0061.051] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.051] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="api-ms-win-core-timezone-l1-1-0.dll") returned 1
	[0061.051] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="api-ms-win-core-timezone-l1-1-0.dll") returned 1
	[0061.051] lstrcmpiA (lpString1="", lpString2="api-ms-win-core-timezone-l1-1-0.dll") returned -1
	[0061.051] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned="api-ms-win-core-synch-l1-2-0.dll"
	[0061.051] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.051] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.051] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.051] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.051] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="api-ms-win-core-timezone-l1-1-0.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll"
	[0061.052] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x37acc11, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37acc11, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37acc11, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l2-1-0.dll", cAlternateFileName="APA632~1.DLL")) returned 1
	[0061.052] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.052] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="api-ms-win-core-xstate-l2-1-0.dll") returned 1
	[0061.052] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="api-ms-win-core-xstate-l2-1-0.dll") returned 1
	[0061.052] lstrcmpiA (lpString1="", lpString2="api-ms-win-core-xstate-l2-1-0.dll") returned -1
	[0061.052] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned="api-ms-win-core-timezone-l1-1-0.dll"
	[0061.052] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.052] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.052] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.052] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.052] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="api-ms-win-core-xstate-l2-1-0.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll"
	[0061.052] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x44a38de, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x44a38de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x44a38de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-conio-l1-1-0.dll", cAlternateFileName="AP5C76~1.DLL")) returned 1
	[0061.052] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.052] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="api-ms-win-crt-conio-l1-1-0.dll") returned 1
	[0061.052] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="api-ms-win-crt-conio-l1-1-0.dll") returned 1
	[0061.052] lstrcmpiA (lpString1="", lpString2="api-ms-win-crt-conio-l1-1-0.dll") returned -1
	[0061.052] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned="api-ms-win-core-xstate-l2-1-0.dll"
	[0061.052] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.052] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.052] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.052] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.052] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="api-ms-win-crt-conio-l1-1-0.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll"
	[0061.052] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42d8c51, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42d8c51, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42d8c51, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x58c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-convert-l1-1-0.dll", cAlternateFileName="APFD9C~1.DLL")) returned 1
	[0061.052] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.052] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="api-ms-win-crt-convert-l1-1-0.dll") returned 1
	[0061.053] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="api-ms-win-crt-convert-l1-1-0.dll") returned 1
	[0061.053] lstrcmpiA (lpString1="", lpString2="api-ms-win-crt-convert-l1-1-0.dll") returned -1
	[0061.053] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned="api-ms-win-crt-conio-l1-1-0.dll"
	[0061.053] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.053] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.053] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.053] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.053] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="api-ms-win-crt-convert-l1-1-0.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll"
	[0061.053] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4cd5a2f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4cd5a2f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4cd5a2f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-environment-l1-1-0.dll", cAlternateFileName="APC00F~1.DLL")) returned 1
	[0061.053] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.053] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="api-ms-win-crt-environment-l1-1-0.dll") returned 1
	[0061.053] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="api-ms-win-crt-environment-l1-1-0.dll") returned 1
	[0061.053] lstrcmpiA (lpString1="", lpString2="api-ms-win-crt-environment-l1-1-0.dll") returned -1
	[0061.053] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned="api-ms-win-crt-convert-l1-1-0.dll"
	[0061.053] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.053] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.053] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.053] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.053] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="api-ms-win-crt-environment-l1-1-0.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll"
	[0061.053] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf7667bd3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf7667bd3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7b78b8d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x50c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll", cAlternateFileName="AP0479~1.DLL")) returned 1
	[0061.053] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.053] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="api-ms-win-crt-filesystem-l1-1-0.dll") returned 1
	[0061.053] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="api-ms-win-crt-filesystem-l1-1-0.dll") returned 1
	[0061.053] lstrcmpiA (lpString1="", lpString2="api-ms-win-crt-filesystem-l1-1-0.dll") returned -1
	[0061.053] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned="api-ms-win-crt-environment-l1-1-0.dll"
	[0061.053] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.053] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.054] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.054] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.054] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="api-ms-win-crt-filesystem-l1-1-0.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll"
	[0061.054] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf483611a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf483611a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4a25fae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-heap-l1-1-0.dll", cAlternateFileName="AP23C9~1.DLL")) returned 1
	[0061.054] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.054] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="api-ms-win-crt-heap-l1-1-0.dll") returned 1
	[0061.054] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="api-ms-win-crt-heap-l1-1-0.dll") returned 1
	[0061.054] lstrcmpiA (lpString1="", lpString2="api-ms-win-crt-heap-l1-1-0.dll") returned -1
	[0061.054] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned="api-ms-win-crt-filesystem-l1-1-0.dll"
	[0061.054] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.054] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.054] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.054] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.054] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="api-ms-win-crt-heap-l1-1-0.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll"
	[0061.054] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4903b8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4903b8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x54ef2e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-locale-l1-1-0.dll", cAlternateFileName="APCB40~1.DLL")) returned 1
	[0061.054] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.054] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="api-ms-win-crt-locale-l1-1-0.dll") returned 1
	[0061.054] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="api-ms-win-crt-locale-l1-1-0.dll") returned 1
	[0061.054] lstrcmpiA (lpString1="", lpString2="api-ms-win-crt-locale-l1-1-0.dll") returned -1
	[0061.054] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll") returned="api-ms-win-crt-heap-l1-1-0.dll"
	[0061.054] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.054] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.054] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.054] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.054] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="api-ms-win-crt-locale-l1-1-0.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll"
	[0061.055] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf63ed72c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf63ed72c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6a7bf80, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x72c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-math-l1-1-0.dll", cAlternateFileName="APAE51~1.DLL")) returned 1
	[0061.055] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.055] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="api-ms-win-crt-math-l1-1-0.dll") returned 1
	[0061.055] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="api-ms-win-crt-math-l1-1-0.dll") returned 1
	[0061.055] lstrcmpiA (lpString1="", lpString2="api-ms-win-crt-math-l1-1-0.dll") returned -1
	[0061.055] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll") returned="api-ms-win-crt-locale-l1-1-0.dll"
	[0061.055] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.055] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.055] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.055] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.055] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="api-ms-win-crt-math-l1-1-0.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll"
	[0061.055] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6971e7c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6971e7c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6971e7c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x68c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll", cAlternateFileName="AP972F~1.DLL")) returned 1
	[0061.055] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.055] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll") returned="api-ms-win-crt-math-l1-1-0.dll"
	[0061.055] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.055] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.055] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.055] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.055] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="api-ms-win-crt-multibyte-l1-1-0.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll"
	[0061.055] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x18d43c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18d43c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18d43c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11ec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-private-l1-1-0.dll", cAlternateFileName="AP7D9E~1.DLL")) returned 1
	[0061.055] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.055] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll") returned="api-ms-win-crt-multibyte-l1-1-0.dll"
	[0061.056] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.056] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.056] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.056] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.056] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="api-ms-win-crt-private-l1-1-0.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll"
	[0061.056] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xefd8e49f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd8e49f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefd8e49f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-process-l1-1-0.dll", cAlternateFileName="API-MS~1.DLL")) returned 1
	[0061.056] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.056] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll") returned="api-ms-win-crt-private-l1-1-0.dll"
	[0061.056] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.056] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.056] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.056] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.056] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="api-ms-win-crt-process-l1-1-0.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-process-l1-1-0.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-process-l1-1-0.dll"
	[0061.056] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6d9e0b3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6d9e0b3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d9e0b3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-runtime-l1-1-0.dll", cAlternateFileName="AP8F34~1.DLL")) returned 1
	[0061.056] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.056] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-process-l1-1-0.dll") returned="api-ms-win-crt-process-l1-1-0.dll"
	[0061.056] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.056] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.056] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.056] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.056] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="api-ms-win-crt-runtime-l1-1-0.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-runtime-l1-1-0.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-runtime-l1-1-0.dll"
	[0061.056] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1ac3289, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1ac3289, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x60c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-stdio-l1-1-0.dll", cAlternateFileName="API-MS~4.DLL")) returned 1
	[0061.056] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.056] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-runtime-l1-1-0.dll") returned="api-ms-win-crt-runtime-l1-1-0.dll"
	[0061.057] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.057] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.057] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="api-ms-win-crt-stdio-l1-1-0.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-stdio-l1-1-0.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-stdio-l1-1-0.dll"
	[0061.057] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfbdc8437, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbdc8437, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbdc8437, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x60c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-string-l1-1-0.dll", cAlternateFileName="APBF0F~1.DLL")) returned 1
	[0061.057] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.057] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-stdio-l1-1-0.dll") returned="api-ms-win-crt-stdio-l1-1-0.dll"
	[0061.057] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.057] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.057] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="api-ms-win-crt-string-l1-1-0.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll"
	[0061.057] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf34d6ecb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf34d6ecb, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf3b3f424, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x52c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-time-l1-1-0.dll", cAlternateFileName="AP5E4C~1.DLL")) returned 1
	[0061.057] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.057] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll") returned="api-ms-win-crt-string-l1-1-0.dll"
	[0061.057] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.057] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.057] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="api-ms-win-crt-time-l1-1-0.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-time-l1-1-0.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-time-l1-1-0.dll"
	[0061.057] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x68b32cb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x68b32cb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x68b32cb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-utility-l1-1-0.dll", cAlternateFileName="AP80F4~1.DLL")) returned 1
	[0061.057] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.058] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-time-l1-1-0.dll") returned="api-ms-win-crt-time-l1-1-0.dll"
	[0061.058] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.058] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.058] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.058] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.058] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="api-ms-win-crt-utility-l1-1-0.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll"
	[0061.058] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42b29f3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42b29f3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3f6d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVFileSystemMetadata.dll", cAlternateFileName="APPVFI~1.DLL")) returned 1
	[0061.058] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.058] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll") returned="api-ms-win-crt-utility-l1-1-0.dll"
	[0061.058] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.058] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.058] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.058] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.058] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="AppVFileSystemMetadata.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVFileSystemMetadata.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVFileSystemMetadata.dll"
	[0061.058] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45d3b76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf45d3b76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x115b4243, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf5ed8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVManifest.dll", cAlternateFileName="APPVMA~1.DLL")) returned 1
	[0061.058] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.058] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVFileSystemMetadata.dll") returned="AppVFileSystemMetadata.dll"
	[0061.058] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.058] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.058] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.058] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.058] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="AppVManifest.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll"
	[0061.058] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6cde4ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6cde4ae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x115b4243, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1bf6d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVOpcServices.dll", cAlternateFileName="APPVOP~1.DLL")) returned 1
	[0061.059] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.059] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll") returned="AppVManifest.dll"
	[0061.059] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.059] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.059] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.059] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.059] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="AppVOpcServices.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll"
	[0061.059] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf466c4e5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf466c4e5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4692737, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x221, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVOpcServices.dll.manifest", cAlternateFileName="APPVOP~1.MAN")) returned 1
	[0061.059] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.059] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned="AppVOpcServices.dll"
	[0061.059] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.059] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.059] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.059] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.059] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="AppVOpcServices.dll.manifest" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest"
	[0061.059] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0061.113] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x221
	[0061.113] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf466c4e5, dwHighDateTime=0x1d327e7), lpLastAccessTime=0x407536*(dwLowDateTime=0xf466c4e5, dwHighDateTime=0x1d327e7), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4692737, dwHighDateTime=0x1d327e7)) returned 1
	[0061.113] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0061.113] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1df, lpOverlapped=0x0) returned 1
	[0061.114] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned="AppVOpcServices.dll.manifest"
	[0061.114] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0061.114] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1df, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1df, lpOverlapped=0x0) returned 1
	[0061.115] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.115] CloseHandle (hObject=0x210) returned 1
	[0061.115] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest.exe" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest.exe")) returned 1
	[0061.115] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5f4ff2d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5f4ff2d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11541b08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8d2d8, dwReserved0=0x1f, dwReserved1=0x1, cFileName="AppVPackaging.dll", cAlternateFileName="APPVPA~1.DLL")) returned 1
	[0061.116] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.116] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="AppVPackaging.dll") returned 1
	[0061.116] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="AppVPackaging.dll") returned 1
	[0061.116] lstrcmpiA (lpString1="", lpString2="AppVPackaging.dll") returned -1
	[0061.116] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned="AppVOpcServices.dll.manifest"
	[0061.116] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.116] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.116] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.116] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.116] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="AppVPackaging.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll"
	[0061.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.zip") returned 0
	[0061.116] lstrlenA (lpString="*.zip") returned 5
	[0061.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.rar") returned 0
	[0061.116] lstrlenA (lpString="*.rar") returned 5
	[0061.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.7z") returned 0
	[0061.116] lstrlenA (lpString="*.7z") returned 4
	[0061.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.tar") returned 0
	[0061.116] lstrlenA (lpString="*.tar") returned 5
	[0061.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.gzip") returned 0
	[0061.116] lstrlenA (lpString="*.gzip") returned 6
	[0061.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.jpg") returned 0
	[0061.116] lstrlenA (lpString="*.jpg") returned 5
	[0061.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.jpeg") returned 0
	[0061.116] lstrlenA (lpString="*.jpeg") returned 6
	[0061.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.bmp") returned 0
	[0061.116] lstrlenA (lpString="*.bmp") returned 5
	[0061.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.gif") returned 0
	[0061.117] lstrlenA (lpString="*.gif") returned 5
	[0061.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.png") returned 0
	[0061.117] lstrlenA (lpString="*.png") returned 5
	[0061.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.doc") returned 0
	[0061.117] lstrlenA (lpString="*.doc") returned 5
	[0061.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.docx") returned 0
	[0061.117] lstrlenA (lpString="*.docx") returned 6
	[0061.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.xls") returned 0
	[0061.117] lstrlenA (lpString="*.xls") returned 5
	[0061.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.xlsx") returned 0
	[0061.117] lstrlenA (lpString="*.xlsx") returned 6
	[0061.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.ppt") returned 0
	[0061.117] lstrlenA (lpString="*.ppt") returned 5
	[0061.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.pptx") returned 0
	[0061.117] lstrlenA (lpString="*.pptx") returned 6
	[0061.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.txt") returned 0
	[0061.117] lstrlenA (lpString="*.txt") returned 5
	[0061.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.pdf") returned 0
	[0061.117] lstrlenA (lpString="*.pdf") returned 5
	[0061.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.htm") returned 0
	[0061.117] lstrlenA (lpString="*.htm") returned 5
	[0061.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.html") returned 0
	[0061.117] lstrlenA (lpString="*.html") returned 6
	[0061.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.mdb") returned 0
	[0061.117] lstrlenA (lpString="*.mdb") returned 5
	[0061.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.pfx") returned 0
	[0061.117] lstrlenA (lpString="*.pfx") returned 5
	[0061.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.md") returned 0
	[0061.117] lstrlenA (lpString="*.md") returned 4
	[0061.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.lnk") returned 0
	[0061.118] lstrlenA (lpString="*.lnk") returned 5
	[0061.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.torrent") returned 0
	[0061.118] lstrlenA (lpString="*.torrent") returned 9
	[0061.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.mov") returned 0
	[0061.118] lstrlenA (lpString="*.mov") returned 5
	[0061.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.3gp") returned 0
	[0061.118] lstrlenA (lpString="*.3gp") returned 5
	[0061.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.mpeg") returned 0
	[0061.118] lstrlenA (lpString="*.mpeg") returned 6
	[0061.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.mpg") returned 0
	[0061.118] lstrlenA (lpString="*.mpg") returned 5
	[0061.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.flv") returned 0
	[0061.118] lstrlenA (lpString="*.flv") returned 5
	[0061.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.avi") returned 0
	[0061.118] lstrlenA (lpString="*.avi") returned 5
	[0061.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.mp4") returned 0
	[0061.118] lstrlenA (lpString="*.mp4") returned 5
	[0061.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.wmv") returned 0
	[0061.118] lstrlenA (lpString="*.wmv") returned 5
	[0061.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.mkv") returned 0
	[0061.118] lstrlenA (lpString="*.mkv") returned 5
	[0061.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.mp3") returned 0
	[0061.118] lstrlenA (lpString="*.mp3") returned 5
	[0061.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.wav") returned 0
	[0061.118] lstrlenA (lpString="*.wav") returned 5
	[0061.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.flac") returned 0
	[0061.118] lstrlenA (lpString="*.flac") returned 6
	[0061.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.wma") returned 0
	[0061.119] lstrlenA (lpString="*.wma") returned 5
	[0061.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.au3") returned 0
	[0061.119] lstrlenA (lpString="*.au3") returned 5
	[0061.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.ahk") returned 0
	[0061.119] lstrlenA (lpString="*.ahk") returned 5
	[0061.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.c") returned 0
	[0061.119] lstrlenA (lpString="*.c") returned 3
	[0061.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.cc") returned 0
	[0061.119] lstrlenA (lpString="*.cc") returned 4
	[0061.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.cpp") returned 0
	[0061.119] lstrlenA (lpString="*.cpp") returned 5
	[0061.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.cxx") returned 0
	[0061.119] lstrlenA (lpString="*.cxx") returned 5
	[0061.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.c++") returned 0
	[0061.119] lstrlenA (lpString="*.c++") returned 5
	[0061.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.cs") returned 0
	[0061.119] lstrlenA (lpString="*.cs") returned 4
	[0061.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.vb") returned 0
	[0061.119] lstrlenA (lpString="*.vb") returned 4
	[0061.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.bas") returned 0
	[0061.119] lstrlenA (lpString="*.bas") returned 5
	[0061.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.csproj") returned 0
	[0061.119] lstrlenA (lpString="*.csproj") returned 8
	[0061.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.vbproj") returned 0
	[0061.119] lstrlenA (lpString="*.vbproj") returned 8
	[0061.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.vcxproj") returned 0
	[0061.119] lstrlenA (lpString="*.vcxproj") returned 9
	[0061.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.manifest") returned 0
	[0061.119] lstrlenA (lpString="*.manifest") returned 10
	[0061.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.php") returned 0
	[0061.119] lstrlenA (lpString="*.php") returned 5
	[0061.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.vbe") returned 0
	[0061.120] lstrlenA (lpString="*.vbe") returned 5
	[0061.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.vba") returned 0
	[0061.120] lstrlenA (lpString="*.vba") returned 5
	[0061.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.vbs") returned 0
	[0061.120] lstrlenA (lpString="*.vbs") returned 5
	[0061.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.bat") returned 0
	[0061.120] lstrlenA (lpString="*.bat") returned 5
	[0061.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.cmd") returned 0
	[0061.120] lstrlenA (lpString="*.cmd") returned 5
	[0061.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.js") returned 0
	[0061.120] lstrlenA (lpString="*.js") returned 4
	[0061.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.jscript") returned 0
	[0061.120] lstrlenA (lpString="*.jscript") returned 9
	[0061.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.hta") returned 0
	[0061.120] lstrlenA (lpString="*.hta") returned 5
	[0061.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.php7") returned 0
	[0061.120] lstrlenA (lpString="*.php7") returned 6
	[0061.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.db") returned 0
	[0061.120] lstrlenA (lpString="*.db") returned 4
	[0061.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.swf") returned 0
	[0061.120] lstrlenA (lpString="*.swf") returned 5
	[0061.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.eml") returned 0
	[0061.120] lstrlenA (lpString="*.eml") returned 5
	[0061.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.part") returned 0
	[0061.120] lstrlenA (lpString="*.part") returned 6
	[0061.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.nfo") returned 0
	[0061.120] lstrlenA (lpString="*.nfo") returned 5
	[0061.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.rsa") returned 0
	[0061.121] lstrlenA (lpString="*.rsa") returned 5
	[0061.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.key") returned 0
	[0061.121] lstrlenA (lpString="*.key") returned 5
	[0061.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.aes") returned 0
	[0061.121] lstrlenA (lpString="*.aes") returned 5
	[0061.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.blob") returned 0
	[0061.121] lstrlenA (lpString="*.blob") returned 6
	[0061.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.btc") returned 0
	[0061.121] lstrlenA (lpString="*.btc") returned 5
	[0061.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll", pszSpec="*.wallet") returned 0
	[0061.121] lstrlenA (lpString="*.wallet") returned 8
	[0061.121] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf13037fa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf13037fa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1565dae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVPackaging.dll.manifest", cAlternateFileName="APPVPA~1.MAN")) returned 1
	[0061.121] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.121] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="AppVPackaging.dll.manifest") returned 1
	[0061.121] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="AppVPackaging.dll.manifest") returned 1
	[0061.121] lstrcmpiA (lpString1="", lpString2="AppVPackaging.dll.manifest") returned -1
	[0061.121] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned="AppVPackaging.dll"
	[0061.121] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.121] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.121] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.121] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.121] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="AppVPackaging.dll.manifest" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest"
	[0061.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.zip") returned 0
	[0061.121] lstrlenA (lpString="*.zip") returned 5
	[0061.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.rar") returned 0
	[0061.121] lstrlenA (lpString="*.rar") returned 5
	[0061.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.7z") returned 0
	[0061.121] lstrlenA (lpString="*.7z") returned 4
	[0061.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.tar") returned 0
	[0061.121] lstrlenA (lpString="*.tar") returned 5
	[0061.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.gzip") returned 0
	[0061.121] lstrlenA (lpString="*.gzip") returned 6
	[0061.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.jpg") returned 0
	[0061.122] lstrlenA (lpString="*.jpg") returned 5
	[0061.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.jpeg") returned 0
	[0061.122] lstrlenA (lpString="*.jpeg") returned 6
	[0061.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.bmp") returned 0
	[0061.122] lstrlenA (lpString="*.bmp") returned 5
	[0061.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.gif") returned 0
	[0061.122] lstrlenA (lpString="*.gif") returned 5
	[0061.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.png") returned 0
	[0061.122] lstrlenA (lpString="*.png") returned 5
	[0061.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.doc") returned 0
	[0061.122] lstrlenA (lpString="*.doc") returned 5
	[0061.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.docx") returned 0
	[0061.122] lstrlenA (lpString="*.docx") returned 6
	[0061.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.xls") returned 0
	[0061.122] lstrlenA (lpString="*.xls") returned 5
	[0061.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.xlsx") returned 0
	[0061.122] lstrlenA (lpString="*.xlsx") returned 6
	[0061.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.ppt") returned 0
	[0061.122] lstrlenA (lpString="*.ppt") returned 5
	[0061.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.pptx") returned 0
	[0061.122] lstrlenA (lpString="*.pptx") returned 6
	[0061.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.txt") returned 0
	[0061.122] lstrlenA (lpString="*.txt") returned 5
	[0061.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.pdf") returned 0
	[0061.123] lstrlenA (lpString="*.pdf") returned 5
	[0061.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.htm") returned 0
	[0061.123] lstrlenA (lpString="*.htm") returned 5
	[0061.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.html") returned 0
	[0061.123] lstrlenA (lpString="*.html") returned 6
	[0061.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.mdb") returned 0
	[0061.123] lstrlenA (lpString="*.mdb") returned 5
	[0061.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.pfx") returned 0
	[0061.123] lstrlenA (lpString="*.pfx") returned 5
	[0061.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.md") returned 0
	[0061.123] lstrlenA (lpString="*.md") returned 4
	[0061.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.lnk") returned 0
	[0061.123] lstrlenA (lpString="*.lnk") returned 5
	[0061.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.torrent") returned 0
	[0061.123] lstrlenA (lpString="*.torrent") returned 9
	[0061.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.mov") returned 0
	[0061.123] lstrlenA (lpString="*.mov") returned 5
	[0061.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.3gp") returned 0
	[0061.123] lstrlenA (lpString="*.3gp") returned 5
	[0061.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.mpeg") returned 0
	[0061.123] lstrlenA (lpString="*.mpeg") returned 6
	[0061.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.mpg") returned 0
	[0061.123] lstrlenA (lpString="*.mpg") returned 5
	[0061.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.flv") returned 0
	[0061.123] lstrlenA (lpString="*.flv") returned 5
	[0061.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.avi") returned 0
	[0061.123] lstrlenA (lpString="*.avi") returned 5
	[0061.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.mp4") returned 0
	[0061.123] lstrlenA (lpString="*.mp4") returned 5
	[0061.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.wmv") returned 0
	[0061.123] lstrlenA (lpString="*.wmv") returned 5
	[0061.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.mkv") returned 0
	[0061.123] lstrlenA (lpString="*.mkv") returned 5
	[0061.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.mp3") returned 0
	[0061.123] lstrlenA (lpString="*.mp3") returned 5
	[0061.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.wav") returned 0
	[0061.124] lstrlenA (lpString="*.wav") returned 5
	[0061.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.flac") returned 0
	[0061.124] lstrlenA (lpString="*.flac") returned 6
	[0061.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.wma") returned 0
	[0061.124] lstrlenA (lpString="*.wma") returned 5
	[0061.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.au3") returned 0
	[0061.124] lstrlenA (lpString="*.au3") returned 5
	[0061.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.ahk") returned 0
	[0061.124] lstrlenA (lpString="*.ahk") returned 5
	[0061.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.c") returned 0
	[0061.124] lstrlenA (lpString="*.c") returned 3
	[0061.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.cc") returned 0
	[0061.124] lstrlenA (lpString="*.cc") returned 4
	[0061.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.cpp") returned 0
	[0061.124] lstrlenA (lpString="*.cpp") returned 5
	[0061.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.cxx") returned 0
	[0061.124] lstrlenA (lpString="*.cxx") returned 5
	[0061.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.c++") returned 0
	[0061.124] lstrlenA (lpString="*.c++") returned 5
	[0061.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.cs") returned 0
	[0061.124] lstrlenA (lpString="*.cs") returned 4
	[0061.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.vb") returned 0
	[0061.124] lstrlenA (lpString="*.vb") returned 4
	[0061.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.bas") returned 0
	[0061.124] lstrlenA (lpString="*.bas") returned 5
	[0061.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.csproj") returned 0
	[0061.124] lstrlenA (lpString="*.csproj") returned 8
	[0061.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.vbproj") returned 0
	[0061.124] lstrlenA (lpString="*.vbproj") returned 8
	[0061.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.vcxproj") returned 0
	[0061.124] lstrlenA (lpString="*.vcxproj") returned 9
	[0061.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", pszSpec="*.manifest") returned 1
	[0061.124] lstrlenA (lpString="*.manifest") returned 10
	[0061.125] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest"
	[0061.125] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest"
	[0061.125] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest."
	[0061.125] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.exe") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.exe"
	[0061.125] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0061.125] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c3
	[0061.126] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf13037fa, dwHighDateTime=0x1d327e7), lpLastAccessTime=0x407536*(dwLowDateTime=0xf13037fa, dwHighDateTime=0x1d327e7), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf1565dae, dwHighDateTime=0x1d327e7)) returned 1
	[0061.126] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0061.126] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x281, lpOverlapped=0x0) returned 1
	[0061.193] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned="AppVPackaging.dll.manifest"
	[0061.193] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0061.193] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x281, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x281, lpOverlapped=0x0) returned 1
	[0061.193] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.194] CloseHandle (hObject=0x210) returned 1
	[0061.194] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.exe" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest.exe")) returned 1
	[0061.194] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x48a9e4d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x48a9e4d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x48cfa7d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2f8d8, dwReserved0=0x1c, dwReserved1=0x1, cFileName="AppVStreamMap.dll", cAlternateFileName="APPVST~1.DLL")) returned 1
	[0061.194] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.194] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="AppVStreamMap.dll") returned 1
	[0061.194] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="AppVStreamMap.dll") returned 1
	[0061.194] lstrcmpiA (lpString1="", lpString2="AppVStreamMap.dll") returned -1
	[0061.194] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned="AppVPackaging.dll.manifest"
	[0061.194] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.195] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.195] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.195] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.195] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="AppVStreamMap.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll"
	[0061.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.zip") returned 0
	[0061.195] lstrlenA (lpString="*.zip") returned 5
	[0061.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.rar") returned 0
	[0061.195] lstrlenA (lpString="*.rar") returned 5
	[0061.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.7z") returned 0
	[0061.195] lstrlenA (lpString="*.7z") returned 4
	[0061.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.tar") returned 0
	[0061.195] lstrlenA (lpString="*.tar") returned 5
	[0061.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.gzip") returned 0
	[0061.195] lstrlenA (lpString="*.gzip") returned 6
	[0061.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.jpg") returned 0
	[0061.195] lstrlenA (lpString="*.jpg") returned 5
	[0061.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.jpeg") returned 0
	[0061.195] lstrlenA (lpString="*.jpeg") returned 6
	[0061.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.bmp") returned 0
	[0061.195] lstrlenA (lpString="*.bmp") returned 5
	[0061.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.gif") returned 0
	[0061.195] lstrlenA (lpString="*.gif") returned 5
	[0061.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.png") returned 0
	[0061.195] lstrlenA (lpString="*.png") returned 5
	[0061.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.doc") returned 0
	[0061.195] lstrlenA (lpString="*.doc") returned 5
	[0061.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.docx") returned 0
	[0061.195] lstrlenA (lpString="*.docx") returned 6
	[0061.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.xls") returned 0
	[0061.195] lstrlenA (lpString="*.xls") returned 5
	[0061.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.xlsx") returned 0
	[0061.195] lstrlenA (lpString="*.xlsx") returned 6
	[0061.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.ppt") returned 0
	[0061.195] lstrlenA (lpString="*.ppt") returned 5
	[0061.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.pptx") returned 0
	[0061.196] lstrlenA (lpString="*.pptx") returned 6
	[0061.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.txt") returned 0
	[0061.196] lstrlenA (lpString="*.txt") returned 5
	[0061.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.pdf") returned 0
	[0061.196] lstrlenA (lpString="*.pdf") returned 5
	[0061.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.htm") returned 0
	[0061.196] lstrlenA (lpString="*.htm") returned 5
	[0061.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.html") returned 0
	[0061.196] lstrlenA (lpString="*.html") returned 6
	[0061.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.mdb") returned 0
	[0061.196] lstrlenA (lpString="*.mdb") returned 5
	[0061.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.pfx") returned 0
	[0061.196] lstrlenA (lpString="*.pfx") returned 5
	[0061.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.md") returned 0
	[0061.196] lstrlenA (lpString="*.md") returned 4
	[0061.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.lnk") returned 0
	[0061.196] lstrlenA (lpString="*.lnk") returned 5
	[0061.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.torrent") returned 0
	[0061.196] lstrlenA (lpString="*.torrent") returned 9
	[0061.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.mov") returned 0
	[0061.196] lstrlenA (lpString="*.mov") returned 5
	[0061.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.3gp") returned 0
	[0061.196] lstrlenA (lpString="*.3gp") returned 5
	[0061.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.mpeg") returned 0
	[0061.196] lstrlenA (lpString="*.mpeg") returned 6
	[0061.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.mpg") returned 0
	[0061.196] lstrlenA (lpString="*.mpg") returned 5
	[0061.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.flv") returned 0
	[0061.196] lstrlenA (lpString="*.flv") returned 5
	[0061.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.avi") returned 0
	[0061.196] lstrlenA (lpString="*.avi") returned 5
	[0061.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.mp4") returned 0
	[0061.196] lstrlenA (lpString="*.mp4") returned 5
	[0061.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.wmv") returned 0
	[0061.196] lstrlenA (lpString="*.wmv") returned 5
	[0061.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.mkv") returned 0
	[0061.197] lstrlenA (lpString="*.mkv") returned 5
	[0061.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.mp3") returned 0
	[0061.197] lstrlenA (lpString="*.mp3") returned 5
	[0061.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.wav") returned 0
	[0061.197] lstrlenA (lpString="*.wav") returned 5
	[0061.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.flac") returned 0
	[0061.197] lstrlenA (lpString="*.flac") returned 6
	[0061.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.wma") returned 0
	[0061.197] lstrlenA (lpString="*.wma") returned 5
	[0061.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.au3") returned 0
	[0061.197] lstrlenA (lpString="*.au3") returned 5
	[0061.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.ahk") returned 0
	[0061.197] lstrlenA (lpString="*.ahk") returned 5
	[0061.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.c") returned 0
	[0061.197] lstrlenA (lpString="*.c") returned 3
	[0061.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.cc") returned 0
	[0061.197] lstrlenA (lpString="*.cc") returned 4
	[0061.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.cpp") returned 0
	[0061.197] lstrlenA (lpString="*.cpp") returned 5
	[0061.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.cxx") returned 0
	[0061.197] lstrlenA (lpString="*.cxx") returned 5
	[0061.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.c++") returned 0
	[0061.197] lstrlenA (lpString="*.c++") returned 5
	[0061.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.cs") returned 0
	[0061.197] lstrlenA (lpString="*.cs") returned 4
	[0061.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.vb") returned 0
	[0061.197] lstrlenA (lpString="*.vb") returned 4
	[0061.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.bas") returned 0
	[0061.197] lstrlenA (lpString="*.bas") returned 5
	[0061.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.csproj") returned 0
	[0061.197] lstrlenA (lpString="*.csproj") returned 8
	[0061.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.vbproj") returned 0
	[0061.197] lstrlenA (lpString="*.vbproj") returned 8
	[0061.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.vcxproj") returned 0
	[0061.197] lstrlenA (lpString="*.vcxproj") returned 9
	[0061.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.manifest") returned 0
	[0061.197] lstrlenA (lpString="*.manifest") returned 10
	[0061.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.php") returned 0
	[0061.198] lstrlenA (lpString="*.php") returned 5
	[0061.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.vbe") returned 0
	[0061.198] lstrlenA (lpString="*.vbe") returned 5
	[0061.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.vba") returned 0
	[0061.198] lstrlenA (lpString="*.vba") returned 5
	[0061.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.vbs") returned 0
	[0061.198] lstrlenA (lpString="*.vbs") returned 5
	[0061.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.bat") returned 0
	[0061.198] lstrlenA (lpString="*.bat") returned 5
	[0061.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.cmd") returned 0
	[0061.198] lstrlenA (lpString="*.cmd") returned 5
	[0061.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.js") returned 0
	[0061.198] lstrlenA (lpString="*.js") returned 4
	[0061.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.jscript") returned 0
	[0061.198] lstrlenA (lpString="*.jscript") returned 9
	[0061.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.hta") returned 0
	[0061.198] lstrlenA (lpString="*.hta") returned 5
	[0061.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.php7") returned 0
	[0061.198] lstrlenA (lpString="*.php7") returned 6
	[0061.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.db") returned 0
	[0061.198] lstrlenA (lpString="*.db") returned 4
	[0061.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.swf") returned 0
	[0061.198] lstrlenA (lpString="*.swf") returned 5
	[0061.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.eml") returned 0
	[0061.198] lstrlenA (lpString="*.eml") returned 5
	[0061.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.part") returned 0
	[0061.198] lstrlenA (lpString="*.part") returned 6
	[0061.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.nfo") returned 0
	[0061.198] lstrlenA (lpString="*.nfo") returned 5
	[0061.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.rsa") returned 0
	[0061.198] lstrlenA (lpString="*.rsa") returned 5
	[0061.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.key") returned 0
	[0061.198] lstrlenA (lpString="*.key") returned 5
	[0061.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.aes") returned 0
	[0061.198] lstrlenA (lpString="*.aes") returned 5
	[0061.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.blob") returned 0
	[0061.199] lstrlenA (lpString="*.blob") returned 6
	[0061.199] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.btc") returned 0
	[0061.199] lstrlenA (lpString="*.btc") returned 5
	[0061.199] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll", pszSpec="*.wallet") returned 0
	[0061.199] lstrlenA (lpString="*.wallet") returned 8
	[0061.199] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114f5747, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114f5747, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11567da2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommonSequencingProperties.xml", cAlternateFileName="COMMON~1.XML")) returned 1
	[0061.199] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.199] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="CommonSequencingProperties.xml") returned 1
	[0061.199] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="CommonSequencingProperties.xml") returned 1
	[0061.199] lstrcmpiA (lpString1="", lpString2="CommonSequencingProperties.xml") returned -1
	[0061.199] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned="AppVStreamMap.dll"
	[0061.199] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.199] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.199] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.199] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.199] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="CommonSequencingProperties.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml"
	[0061.199] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.zip") returned 0
	[0061.199] lstrlenA (lpString="*.zip") returned 5
	[0061.199] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.rar") returned 0
	[0061.199] lstrlenA (lpString="*.rar") returned 5
	[0061.199] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.7z") returned 0
	[0061.199] lstrlenA (lpString="*.7z") returned 4
	[0061.199] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.tar") returned 0
	[0061.199] lstrlenA (lpString="*.tar") returned 5
	[0061.199] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.gzip") returned 0
	[0061.199] lstrlenA (lpString="*.gzip") returned 6
	[0061.199] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.jpg") returned 0
	[0061.199] lstrlenA (lpString="*.jpg") returned 5
	[0061.199] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.jpeg") returned 0
	[0061.199] lstrlenA (lpString="*.jpeg") returned 6
	[0061.199] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.bmp") returned 0
	[0061.199] lstrlenA (lpString="*.bmp") returned 5
	[0061.199] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.gif") returned 0
	[0061.199] lstrlenA (lpString="*.gif") returned 5
	[0061.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.png") returned 0
	[0061.200] lstrlenA (lpString="*.png") returned 5
	[0061.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.doc") returned 0
	[0061.200] lstrlenA (lpString="*.doc") returned 5
	[0061.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.docx") returned 0
	[0061.200] lstrlenA (lpString="*.docx") returned 6
	[0061.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.xls") returned 0
	[0061.200] lstrlenA (lpString="*.xls") returned 5
	[0061.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.xlsx") returned 0
	[0061.200] lstrlenA (lpString="*.xlsx") returned 6
	[0061.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.ppt") returned 0
	[0061.200] lstrlenA (lpString="*.ppt") returned 5
	[0061.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.pptx") returned 0
	[0061.200] lstrlenA (lpString="*.pptx") returned 6
	[0061.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.txt") returned 0
	[0061.200] lstrlenA (lpString="*.txt") returned 5
	[0061.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.pdf") returned 0
	[0061.200] lstrlenA (lpString="*.pdf") returned 5
	[0061.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.htm") returned 0
	[0061.200] lstrlenA (lpString="*.htm") returned 5
	[0061.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.html") returned 0
	[0061.200] lstrlenA (lpString="*.html") returned 6
	[0061.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.mdb") returned 0
	[0061.200] lstrlenA (lpString="*.mdb") returned 5
	[0061.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.pfx") returned 0
	[0061.200] lstrlenA (lpString="*.pfx") returned 5
	[0061.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.md") returned 0
	[0061.201] lstrlenA (lpString="*.md") returned 4
	[0061.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.lnk") returned 0
	[0061.201] lstrlenA (lpString="*.lnk") returned 5
	[0061.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.torrent") returned 0
	[0061.201] lstrlenA (lpString="*.torrent") returned 9
	[0061.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.mov") returned 0
	[0061.201] lstrlenA (lpString="*.mov") returned 5
	[0061.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.3gp") returned 0
	[0061.201] lstrlenA (lpString="*.3gp") returned 5
	[0061.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.mpeg") returned 0
	[0061.201] lstrlenA (lpString="*.mpeg") returned 6
	[0061.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.mpg") returned 0
	[0061.201] lstrlenA (lpString="*.mpg") returned 5
	[0061.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.flv") returned 0
	[0061.201] lstrlenA (lpString="*.flv") returned 5
	[0061.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.avi") returned 0
	[0061.202] lstrlenA (lpString="*.avi") returned 5
	[0061.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.mp4") returned 0
	[0061.202] lstrlenA (lpString="*.mp4") returned 5
	[0061.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.wmv") returned 0
	[0061.202] lstrlenA (lpString="*.wmv") returned 5
	[0061.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.mkv") returned 0
	[0061.202] lstrlenA (lpString="*.mkv") returned 5
	[0061.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.mp3") returned 0
	[0061.202] lstrlenA (lpString="*.mp3") returned 5
	[0061.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.wav") returned 0
	[0061.202] lstrlenA (lpString="*.wav") returned 5
	[0061.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.flac") returned 0
	[0061.202] lstrlenA (lpString="*.flac") returned 6
	[0061.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.wma") returned 0
	[0061.202] lstrlenA (lpString="*.wma") returned 5
	[0061.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.au3") returned 0
	[0061.202] lstrlenA (lpString="*.au3") returned 5
	[0061.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.ahk") returned 0
	[0061.202] lstrlenA (lpString="*.ahk") returned 5
	[0061.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.c") returned 0
	[0061.202] lstrlenA (lpString="*.c") returned 3
	[0061.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.cc") returned 0
	[0061.202] lstrlenA (lpString="*.cc") returned 4
	[0061.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.cpp") returned 0
	[0061.202] lstrlenA (lpString="*.cpp") returned 5
	[0061.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.cxx") returned 0
	[0061.202] lstrlenA (lpString="*.cxx") returned 5
	[0061.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.c++") returned 0
	[0061.202] lstrlenA (lpString="*.c++") returned 5
	[0061.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.cs") returned 0
	[0061.202] lstrlenA (lpString="*.cs") returned 4
	[0061.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.vb") returned 0
	[0061.202] lstrlenA (lpString="*.vb") returned 4
	[0061.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.bas") returned 0
	[0061.202] lstrlenA (lpString="*.bas") returned 5
	[0061.203] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.csproj") returned 0
	[0061.203] lstrlenA (lpString="*.csproj") returned 8
	[0061.203] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.vbproj") returned 0
	[0061.203] lstrlenA (lpString="*.vbproj") returned 8
	[0061.203] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.vcxproj") returned 0
	[0061.203] lstrlenA (lpString="*.vcxproj") returned 9
	[0061.203] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.manifest") returned 0
	[0061.203] lstrlenA (lpString="*.manifest") returned 10
	[0061.203] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.php") returned 0
	[0061.203] lstrlenA (lpString="*.php") returned 5
	[0061.203] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.vbe") returned 0
	[0061.203] lstrlenA (lpString="*.vbe") returned 5
	[0061.203] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.vba") returned 0
	[0061.203] lstrlenA (lpString="*.vba") returned 5
	[0061.203] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.vbs") returned 0
	[0061.203] lstrlenA (lpString="*.vbs") returned 5
	[0061.203] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.bat") returned 0
	[0061.203] lstrlenA (lpString="*.bat") returned 5
	[0061.203] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.cmd") returned 0
	[0061.203] lstrlenA (lpString="*.cmd") returned 5
	[0061.203] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.js") returned 0
	[0061.203] lstrlenA (lpString="*.js") returned 4
	[0061.203] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.jscript") returned 0
	[0061.203] lstrlenA (lpString="*.jscript") returned 9
	[0061.203] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.hta") returned 0
	[0061.203] lstrlenA (lpString="*.hta") returned 5
	[0061.203] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.php7") returned 0
	[0061.203] lstrlenA (lpString="*.php7") returned 6
	[0061.203] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.db") returned 0
	[0061.203] lstrlenA (lpString="*.db") returned 4
	[0061.203] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.swf") returned 0
	[0061.203] lstrlenA (lpString="*.swf") returned 5
	[0061.203] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.eml") returned 0
	[0061.203] lstrlenA (lpString="*.eml") returned 5
	[0061.203] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.part") returned 0
	[0061.203] lstrlenA (lpString="*.part") returned 6
	[0061.204] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.nfo") returned 0
	[0061.204] lstrlenA (lpString="*.nfo") returned 5
	[0061.204] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.rsa") returned 0
	[0061.204] lstrlenA (lpString="*.rsa") returned 5
	[0061.204] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.key") returned 0
	[0061.204] lstrlenA (lpString="*.key") returned 5
	[0061.204] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.aes") returned 0
	[0061.204] lstrlenA (lpString="*.aes") returned 5
	[0061.204] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.blob") returned 0
	[0061.204] lstrlenA (lpString="*.blob") returned 6
	[0061.204] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.btc") returned 0
	[0061.204] lstrlenA (lpString="*.btc") returned 5
	[0061.204] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml", pszSpec="*.wallet") returned 0
	[0061.204] lstrlenA (lpString="*.wallet") returned 8
	[0061.204] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xffdb5707, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffdb5707, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffdb5707, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3b740, dwReserved0=0x0, dwReserved1=0x0, cFileName="concrt140.dll", cAlternateFileName="CONCRT~1.DLL")) returned 1
	[0061.204] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.204] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="concrt140.dll") returned 1
	[0061.204] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="concrt140.dll") returned 1
	[0061.204] lstrcmpiA (lpString1="", lpString2="concrt140.dll") returned -1
	[0061.204] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml") returned="CommonSequencingProperties.xml"
	[0061.204] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.204] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.204] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.204] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.204] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="concrt140.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll"
	[0061.204] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.zip") returned 0
	[0061.204] lstrlenA (lpString="*.zip") returned 5
	[0061.204] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.rar") returned 0
	[0061.204] lstrlenA (lpString="*.rar") returned 5
	[0061.204] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.7z") returned 0
	[0061.204] lstrlenA (lpString="*.7z") returned 4
	[0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.tar") returned 0
	[0061.205] lstrlenA (lpString="*.tar") returned 5
	[0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.gzip") returned 0
	[0061.205] lstrlenA (lpString="*.gzip") returned 6
	[0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.jpg") returned 0
	[0061.205] lstrlenA (lpString="*.jpg") returned 5
	[0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.jpeg") returned 0
	[0061.205] lstrlenA (lpString="*.jpeg") returned 6
	[0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.bmp") returned 0
	[0061.205] lstrlenA (lpString="*.bmp") returned 5
	[0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.gif") returned 0
	[0061.205] lstrlenA (lpString="*.gif") returned 5
	[0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.png") returned 0
	[0061.205] lstrlenA (lpString="*.png") returned 5
	[0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.doc") returned 0
	[0061.205] lstrlenA (lpString="*.doc") returned 5
	[0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.docx") returned 0
	[0061.205] lstrlenA (lpString="*.docx") returned 6
	[0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.xls") returned 0
	[0061.205] lstrlenA (lpString="*.xls") returned 5
	[0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.xlsx") returned 0
	[0061.205] lstrlenA (lpString="*.xlsx") returned 6
	[0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.ppt") returned 0
	[0061.205] lstrlenA (lpString="*.ppt") returned 5
	[0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.pptx") returned 0
	[0061.205] lstrlenA (lpString="*.pptx") returned 6
	[0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.txt") returned 0
	[0061.205] lstrlenA (lpString="*.txt") returned 5
	[0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.pdf") returned 0
	[0061.205] lstrlenA (lpString="*.pdf") returned 5
	[0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.htm") returned 0
	[0061.205] lstrlenA (lpString="*.htm") returned 5
	[0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.html") returned 0
	[0061.205] lstrlenA (lpString="*.html") returned 6
	[0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.mdb") returned 0
	[0061.205] lstrlenA (lpString="*.mdb") returned 5
	[0061.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.pfx") returned 0
	[0061.206] lstrlenA (lpString="*.pfx") returned 5
	[0061.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.md") returned 0
	[0061.206] lstrlenA (lpString="*.md") returned 4
	[0061.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.lnk") returned 0
	[0061.206] lstrlenA (lpString="*.lnk") returned 5
	[0061.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.torrent") returned 0
	[0061.206] lstrlenA (lpString="*.torrent") returned 9
	[0061.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.mov") returned 0
	[0061.206] lstrlenA (lpString="*.mov") returned 5
	[0061.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.3gp") returned 0
	[0061.206] lstrlenA (lpString="*.3gp") returned 5
	[0061.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.mpeg") returned 0
	[0061.206] lstrlenA (lpString="*.mpeg") returned 6
	[0061.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.mpg") returned 0
	[0061.206] lstrlenA (lpString="*.mpg") returned 5
	[0061.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.flv") returned 0
	[0061.206] lstrlenA (lpString="*.flv") returned 5
	[0061.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.avi") returned 0
	[0061.206] lstrlenA (lpString="*.avi") returned 5
	[0061.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.mp4") returned 0
	[0061.206] lstrlenA (lpString="*.mp4") returned 5
	[0061.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.wmv") returned 0
	[0061.206] lstrlenA (lpString="*.wmv") returned 5
	[0061.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.mkv") returned 0
	[0061.206] lstrlenA (lpString="*.mkv") returned 5
	[0061.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.mp3") returned 0
	[0061.206] lstrlenA (lpString="*.mp3") returned 5
	[0061.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.wav") returned 0
	[0061.206] lstrlenA (lpString="*.wav") returned 5
	[0061.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.flac") returned 0
	[0061.206] lstrlenA (lpString="*.flac") returned 6
	[0061.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.wma") returned 0
	[0061.206] lstrlenA (lpString="*.wma") returned 5
	[0061.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.au3") returned 0
	[0061.206] lstrlenA (lpString="*.au3") returned 5
	[0061.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.ahk") returned 0
	[0061.207] lstrlenA (lpString="*.ahk") returned 5
	[0061.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.c") returned 0
	[0061.207] lstrlenA (lpString="*.c") returned 3
	[0061.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.cc") returned 0
	[0061.207] lstrlenA (lpString="*.cc") returned 4
	[0061.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.cpp") returned 0
	[0061.207] lstrlenA (lpString="*.cpp") returned 5
	[0061.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.cxx") returned 0
	[0061.207] lstrlenA (lpString="*.cxx") returned 5
	[0061.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.c++") returned 0
	[0061.207] lstrlenA (lpString="*.c++") returned 5
	[0061.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.cs") returned 0
	[0061.207] lstrlenA (lpString="*.cs") returned 4
	[0061.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.vb") returned 0
	[0061.207] lstrlenA (lpString="*.vb") returned 4
	[0061.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.bas") returned 0
	[0061.207] lstrlenA (lpString="*.bas") returned 5
	[0061.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.csproj") returned 0
	[0061.207] lstrlenA (lpString="*.csproj") returned 8
	[0061.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.vbproj") returned 0
	[0061.207] lstrlenA (lpString="*.vbproj") returned 8
	[0061.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.vcxproj") returned 0
	[0061.207] lstrlenA (lpString="*.vcxproj") returned 9
	[0061.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.manifest") returned 0
	[0061.207] lstrlenA (lpString="*.manifest") returned 10
	[0061.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.php") returned 0
	[0061.207] lstrlenA (lpString="*.php") returned 5
	[0061.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.vbe") returned 0
	[0061.207] lstrlenA (lpString="*.vbe") returned 5
	[0061.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.vba") returned 0
	[0061.207] lstrlenA (lpString="*.vba") returned 5
	[0061.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.vbs") returned 0
	[0061.207] lstrlenA (lpString="*.vbs") returned 5
	[0061.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.bat") returned 0
	[0061.207] lstrlenA (lpString="*.bat") returned 5
	[0061.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.cmd") returned 0
	[0061.208] lstrlenA (lpString="*.cmd") returned 5
	[0061.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.js") returned 0
	[0061.208] lstrlenA (lpString="*.js") returned 4
	[0061.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.jscript") returned 0
	[0061.208] lstrlenA (lpString="*.jscript") returned 9
	[0061.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.hta") returned 0
	[0061.208] lstrlenA (lpString="*.hta") returned 5
	[0061.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.php7") returned 0
	[0061.208] lstrlenA (lpString="*.php7") returned 6
	[0061.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.db") returned 0
	[0061.208] lstrlenA (lpString="*.db") returned 4
	[0061.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.swf") returned 0
	[0061.208] lstrlenA (lpString="*.swf") returned 5
	[0061.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.eml") returned 0
	[0061.208] lstrlenA (lpString="*.eml") returned 5
	[0061.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.part") returned 0
	[0061.208] lstrlenA (lpString="*.part") returned 6
	[0061.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.nfo") returned 0
	[0061.208] lstrlenA (lpString="*.nfo") returned 5
	[0061.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.rsa") returned 0
	[0061.208] lstrlenA (lpString="*.rsa") returned 5
	[0061.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.key") returned 0
	[0061.208] lstrlenA (lpString="*.key") returned 5
	[0061.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.aes") returned 0
	[0061.208] lstrlenA (lpString="*.aes") returned 5
	[0061.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.blob") returned 0
	[0061.208] lstrlenA (lpString="*.blob") returned 6
	[0061.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.btc") returned 0
	[0061.208] lstrlenA (lpString="*.btc") returned 5
	[0061.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll", pszSpec="*.wallet") returned 0
	[0061.208] lstrlenA (lpString="*.wallet") returned 8
	[0061.208] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa68949f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa68949f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa6d5947, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb260, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flattener.exe", cAlternateFileName="FLATTE~1.EXE")) returned 1
	[0061.208] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.208] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Flattener.exe") returned -1
	[0061.208] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Flattener.exe") returned 1
	[0061.208] lstrcmpiA (lpString1="", lpString2="Flattener.exe") returned -1
	[0061.208] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned="concrt140.dll"
	[0061.209] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.209] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.209] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.209] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.209] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="Flattener.exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe"
	[0061.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe", pszSpec="*.zip") returned 0
	[0061.209] lstrlenA (lpString="*.zip") returned 5
	[0061.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe", pszSpec="*.rar") returned 0
	[0061.209] lstrlenA (lpString="*.rar") returned 5
	[0061.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe", pszSpec="*.7z") returned 0
	[0061.209] lstrlenA (lpString="*.7z") returned 4
	[0061.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe", pszSpec="*.tar") returned 0
	[0061.209] lstrlenA (lpString="*.tar") returned 5
	[0061.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe", pszSpec="*.gzip") returned 0
	[0061.209] lstrlenA (lpString="*.gzip") returned 6
	[0061.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe", pszSpec="*.jpg") returned 0
	[0061.209] lstrlenA (lpString="*.jpg") returned 5
	[0061.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe", pszSpec="*.jpeg") returned 0
	[0061.209] lstrlenA (lpString="*.jpeg") returned 6
	[0061.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe", pszSpec="*.bmp") returned 0
	[0061.209] lstrlenA (lpString="*.bmp") returned 5
	[0061.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe", pszSpec="*.gif") returned 0
	[0061.209] lstrlenA (lpString="*.gif") returned 5
	[0061.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe", pszSpec="*.png") returned 0
	[0061.209] lstrlenA (lpString="*.png") returned 5
	[0061.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe", pszSpec="*.doc") returned 0
	[0061.209] lstrlenA (lpString="*.doc") returned 5
	[0061.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe", pszSpec="*.docx") returned 0
	[0061.209] lstrlenA (lpString="*.docx") returned 6
	[0061.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe", pszSpec="*.xls") returned 0
	[0061.209] lstrlenA (lpString="*.xls") returned 5
	[0061.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe", pszSpec="*.xlsx") returned 0
	[0061.209] lstrlenA (lpString="*.xlsx") returned 6
	[0061.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe", pszSpec="*.ppt") returned 0
	[0061.210] lstrlenA (lpString="*.ppt") returned 5
	[0061.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe", pszSpec="*.pptx") returned 0
	[0061.210] lstrlenA (lpString="*.pptx") returned 6
	[0061.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe", pszSpec="*.txt") returned 0
	[0061.210] lstrlenA (lpString="*.txt") returned 5
	[0061.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe", pszSpec="*.pdf") returned 0
	[0061.210] lstrlenA (lpString="*.pdf") returned 5
	[0061.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe", pszSpec="*.htm") returned 0
	[0061.210] lstrlenA (lpString="*.htm") returned 5
	[0061.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe", pszSpec="*.html") returned 0
	[0061.210] lstrlenA (lpString="*.html") returned 6
	[0061.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe", pszSpec="*.mdb") returned 0
	[0061.210] lstrlenA (lpString="*.mdb") returned 5
	[0061.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe", pszSpec="*.pfx") returned 0
	[0061.210] lstrlenA (lpString="*.pfx") returned 5
	[0061.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe", pszSpec="*.md") returned 0
	[0061.210] lstrlenA (lpString="*.md") returned 4
	[0061.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe", pszSpec="*.lnk") returned 0
	[0061.210] lstrlenA (lpString="*.lnk") returned 5
	[0061.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe", pszSpec="*.torrent") returned 0
	[0061.210] lstrlenA (lpString="*.torrent") returned 9
	[0061.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe", pszSpec="*.mov") returned 0
	[0061.210] lstrlenA (lpString="*.mov") returned 5
	[0061.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe", pszSpec="*.3gp") returned 0
	[0061.210] lstrlenA (lpString="*.3gp") returned 5
	[0061.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe", pszSpec="*.mpeg") returned 0
	[0061.210] lstrlenA (lpString="*.mpeg") returned 6
	[0061.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe", pszSpec="*.mpg") returned 0
	[0061.210] lstrlenA (lpString="*.mpg") returned 5
	[0061.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe", pszSpec="*.flv") returned 0
	[0061.210] lstrlenA (lpString="*.flv") returned 5
	[0061.211] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa5ca8ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa5ca8ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa68949f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flattener.exe.config", cAlternateFileName="FLATTE~1.CON")) returned 1
	[0061.211] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.211] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Flattener.exe.config") returned -1
	[0061.211] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Flattener.exe.config") returned 1
	[0061.211] lstrcmpiA (lpString1="", lpString2="Flattener.exe.config") returned -1
	[0061.211] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned="Flattener.exe"
	[0061.211] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.211] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.211] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.211] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.211] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="Flattener.exe.config" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe.config") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe.config"
	[0061.211] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46742519, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x75f1db39, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x46742519, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x39e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW-TO-DECRYPT-FILES.HTM", cAlternateFileName="HOW-TO~1.HTM")) returned 1
	[0061.211] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.211] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="HOW-TO-DECRYPT-FILES.HTM") returned -1
	[0061.211] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="HOW-TO-DECRYPT-FILES.HTM") returned 0
	[0061.211] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6e5cc4e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x178d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AppV.Eventing.dll", cAlternateFileName="MI9EC4~1.DLL")) returned 1
	[0061.211] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.211] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft.AppV.Eventing.dll") returned -1
	[0061.211] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft.AppV.Eventing.dll") returned -1
	[0061.211] lstrcmpiA (lpString1="", lpString2="Microsoft.AppV.Eventing.dll") returned -1
	[0061.211] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe.config") returned="Flattener.exe.config"
	[0061.211] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.211] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.212] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.212] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.212] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="Microsoft.AppV.Eventing.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll"
	[0061.212] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa6d5947, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa6d5947, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa82ce6a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xc0d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AppV.Modernizer.Common.dll", cAlternateFileName="MICROS~3.DLL")) returned 1
	[0061.212] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.212] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft.AppV.Modernizer.Common.dll") returned -1
	[0061.212] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft.AppV.Modernizer.Common.dll") returned -1
	[0061.212] lstrcmpiA (lpString1="", lpString2="Microsoft.AppV.Modernizer.Common.dll") returned -1
	[0061.212] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned="Microsoft.AppV.Eventing.dll"
	[0061.212] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.212] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.212] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.212] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.212] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="Microsoft.AppV.Modernizer.Common.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll"
	[0061.212] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x58cd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AppV.Modernizer.CSharp.dll", cAlternateFileName="MICROS~4.DLL")) returned 1
	[0061.212] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.212] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft.AppV.Modernizer.CSharp.dll") returned -1
	[0061.212] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft.AppV.Modernizer.CSharp.dll") returned -1
	[0061.212] lstrcmpiA (lpString1="", lpString2="Microsoft.AppV.Modernizer.CSharp.dll") returned -1
	[0061.212] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned="Microsoft.AppV.Modernizer.Common.dll"
	[0061.212] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.212] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.212] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.212] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.213] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="Microsoft.AppV.Modernizer.CSharp.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll"
	[0061.213] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9862502, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9862502, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9888767, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6924d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AppV.Modernizer.ManagedCpp.dll", cAlternateFileName="MI5FC8~1.DLL")) returned 1
	[0061.213] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.213] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft.AppV.Modernizer.ManagedCpp.dll") returned -1
	[0061.213] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft.AppV.Modernizer.ManagedCpp.dll") returned -1
	[0061.213] lstrcmpiA (lpString1="", lpString2="Microsoft.AppV.Modernizer.ManagedCpp.dll") returned -1
	[0061.213] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned="Microsoft.AppV.Modernizer.CSharp.dll"
	[0061.213] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.213] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.213] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.213] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.213] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="Microsoft.AppV.Modernizer.ManagedCpp.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll"
	[0061.213] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4266542, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4266542, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42b29f3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x11e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Tools.BinaryStore.dll", cAlternateFileName="MICROS~1.DLL")) returned 1
	[0061.213] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.213] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft.Tools.BinaryStore.dll") returned -1
	[0061.213] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft.Tools.BinaryStore.dll") returned -1
	[0061.213] lstrcmpiA (lpString1="", lpString2="Microsoft.Tools.BinaryStore.dll") returned -1
	[0061.213] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned="Microsoft.AppV.Modernizer.ManagedCpp.dll"
	[0061.213] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.213] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.213] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.213] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.213] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="Microsoft.Tools.BinaryStore.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll"
	[0061.214] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6a7cf13, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a7cf13, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Tools.Office.C2R.Common.dll", cAlternateFileName="MI509C~1.DLL")) returned 1
	[0061.214] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.214] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft.Tools.Office.C2R.Common.dll") returned -1
	[0061.214] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft.Tools.Office.C2R.Common.dll") returned -1
	[0061.214] lstrcmpiA (lpString1="", lpString2="Microsoft.Tools.Office.C2R.Common.dll") returned -1
	[0061.214] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned="Microsoft.Tools.BinaryStore.dll"
	[0061.214] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.214] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.214] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.214] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.214] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="Microsoft.Tools.Office.C2R.Common.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll"
	[0061.214] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf480feb5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf483611a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x206c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Tools.Office.C2R.Packager.dll", cAlternateFileName="MICROS~2.DLL")) returned 1
	[0061.214] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.214] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft.Tools.Office.C2R.Packager.dll") returned -1
	[0061.214] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft.Tools.Office.C2R.Packager.dll") returned -1
	[0061.214] lstrcmpiA (lpString1="", lpString2="Microsoft.Tools.Office.C2R.Packager.dll") returned -1
	[0061.214] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned="Microsoft.Tools.Office.C2R.Common.dll"
	[0061.214] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.214] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.214] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.214] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.214] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="Microsoft.Tools.Office.C2R.Packager.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll"
	[0061.214] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1b5bbeb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1b5bbeb, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x11567da2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6f2b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp120.dll", cAlternateFileName="")) returned 1
	[0061.214] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.215] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="msvcp120.dll") returned -1
	[0061.215] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="msvcp120.dll") returned -1
	[0061.215] lstrcmpiA (lpString1="", lpString2="msvcp120.dll") returned -1
	[0061.215] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned="Microsoft.Tools.Office.C2R.Packager.dll"
	[0061.215] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.215] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.215] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.215] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.215] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="msvcp120.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll"
	[0061.215] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa178468, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa178468, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa2cf9c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6b538, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp140.dll", cAlternateFileName="")) returned 1
	[0061.215] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.215] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="msvcp140.dll") returned -1
	[0061.215] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="msvcp140.dll") returned -1
	[0061.215] lstrcmpiA (lpString1="", lpString2="msvcp140.dll") returned -1
	[0061.215] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned="msvcp120.dll"
	[0061.215] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.215] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.215] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.215] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.215] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="msvcp140.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll"
	[0061.215] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf44c8b33, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf44c8b33, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xec8b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr120.dll", cAlternateFileName="")) returned 1
	[0061.215] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.215] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="msvcr120.dll") returned -1
	[0061.215] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="msvcr120.dll") returned -1
	[0061.215] lstrcmpiA (lpString1="", lpString2="msvcr120.dll") returned -1
	[0061.215] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned="msvcp140.dll"
	[0061.215] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.215] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.216] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.216] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.216] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="msvcr120.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll"
	[0061.216] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9e310c7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9e310c7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9e572fe, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xdbcc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ucrtbase.dll", cAlternateFileName="")) returned 1
	[0061.216] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.216] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="ucrtbase.dll") returned -1
	[0061.216] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="ucrtbase.dll") returned -1
	[0061.216] lstrcmpiA (lpString1="", lpString2="ucrtbase.dll") returned -1
	[0061.216] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned="msvcr120.dll"
	[0061.216] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.216] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.216] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.216] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.216] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="ucrtbase.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll"
	[0061.217] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf80d6078, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80d6078, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80d6078, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x412b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vccorlib140.dll", cAlternateFileName="VCCORL~1.DLL")) returned 1
	[0061.217] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.217] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="vccorlib140.dll") returned -1
	[0061.217] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="vccorlib140.dll") returned -1
	[0061.217] lstrcmpiA (lpString1="", lpString2="vccorlib140.dll") returned -1
	[0061.217] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned="ucrtbase.dll"
	[0061.217] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.217] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.217] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.217] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.217] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="vccorlib140.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll"
	[0061.217] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6223b13, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6223b13, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6296213, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 1
	[0061.217] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.217] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="vcruntime140.dll") returned -1
	[0061.217] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="vcruntime140.dll") returned -1
	[0061.217] lstrcmpiA (lpString1="", lpString2="vcruntime140.dll") returned -1
	[0061.217] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned="vccorlib140.dll"
	[0061.217] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\"
	[0061.217] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned=""
	[0061.217] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.217] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\how-to-decrypt-files.htm")) returned 0x20
	[0061.217] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\", lpString2="vcruntime140.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll"
	[0061.217] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6223b13, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6223b13, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6296213, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 0
	[0061.217] FindClose (in: hFindFile=0x7cb750 | out: hFindFile=0x7cb750) returned 1
	[0061.217] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x7d7d78, cFileName="fre", cAlternateFileName="")) returned 1
	[0061.218] lstrcmpA (lpString1=".", lpString2="fre") returned -1
	[0061.218] lstrcmpA (lpString1="..", lpString2="fre") returned -1
	[0061.218] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\*.*") returned="*.*"
	[0061.218] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\", lpString2="fre" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre") returned="C:\\Program Files\\Microsoft Office\\root\\fre"
	[0061.218] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb7d0
	[0061.219] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0061.219] FindNextFileA (in: hFindFile=0x7cb7d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.219] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0061.219] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0061.219] FindNextFileA (in: hFindFile=0x7cb7d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1158e0a5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1158e0a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1158e0a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1e8fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="StartMenu_Win10.mp4", cAlternateFileName="STARTM~2.MP4")) returned 1
	[0061.219] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.219] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="StartMenu_Win10.mp4") returned -1
	[0061.219] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="StartMenu_Win10.mp4") returned -1
	[0061.219] lstrcmpiA (lpString1="", lpString2="StartMenu_Win10.mp4") returned -1
	[0061.219] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\fre\\*.*") returned="*.*"
	[0061.219] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\fre\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\"
	[0061.219] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\fre\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\fre\\") returned=""
	[0061.219] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.220] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\fre\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0061.220] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\fre\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0061.220] WriteFile (in: hFile=0x210, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0061.221] SetFileTime (hFile=0x210, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0061.221] CloseHandle (hObject=0x210) returned 1
	[0061.221] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\", lpString2="StartMenu_Win10.mp4" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4"
	[0061.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4", pszSpec="*.zip") returned 0
	[0061.221] lstrlenA (lpString="*.zip") returned 5
	[0061.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4", pszSpec="*.rar") returned 0
	[0061.221] lstrlenA (lpString="*.rar") returned 5
	[0061.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4", pszSpec="*.7z") returned 0
	[0061.221] lstrlenA (lpString="*.7z") returned 4
	[0061.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4", pszSpec="*.tar") returned 0
	[0061.221] lstrlenA (lpString="*.tar") returned 5
	[0061.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4", pszSpec="*.gzip") returned 0
	[0061.221] lstrlenA (lpString="*.gzip") returned 6
	[0061.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4", pszSpec="*.jpg") returned 0
	[0061.221] lstrlenA (lpString="*.jpg") returned 5
	[0061.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4", pszSpec="*.jpeg") returned 0
	[0061.221] lstrlenA (lpString="*.jpeg") returned 6
	[0061.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4", pszSpec="*.bmp") returned 0
	[0061.222] lstrlenA (lpString="*.bmp") returned 5
	[0061.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4", pszSpec="*.gif") returned 0
	[0061.222] lstrlenA (lpString="*.gif") returned 5
	[0061.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4", pszSpec="*.png") returned 0
	[0061.222] lstrlenA (lpString="*.png") returned 5
	[0061.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4", pszSpec="*.doc") returned 0
	[0061.222] lstrlenA (lpString="*.doc") returned 5
	[0061.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4", pszSpec="*.docx") returned 0
	[0061.222] lstrlenA (lpString="*.docx") returned 6
	[0061.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4", pszSpec="*.xls") returned 0
	[0061.222] lstrlenA (lpString="*.xls") returned 5
	[0061.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4", pszSpec="*.xlsx") returned 0
	[0061.222] lstrlenA (lpString="*.xlsx") returned 6
	[0061.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4", pszSpec="*.ppt") returned 0
	[0061.222] lstrlenA (lpString="*.ppt") returned 5
	[0061.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4", pszSpec="*.pptx") returned 0
	[0061.222] lstrlenA (lpString="*.pptx") returned 6
	[0061.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4", pszSpec="*.txt") returned 0
	[0061.222] lstrlenA (lpString="*.txt") returned 5
	[0061.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4", pszSpec="*.pdf") returned 0
	[0061.222] lstrlenA (lpString="*.pdf") returned 5
	[0061.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4", pszSpec="*.htm") returned 0
	[0061.222] lstrlenA (lpString="*.htm") returned 5
	[0061.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4", pszSpec="*.html") returned 0
	[0061.222] lstrlenA (lpString="*.html") returned 6
	[0061.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4", pszSpec="*.mdb") returned 0
	[0061.222] lstrlenA (lpString="*.mdb") returned 5
	[0061.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4", pszSpec="*.pfx") returned 0
	[0061.222] lstrlenA (lpString="*.pfx") returned 5
	[0061.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4", pszSpec="*.md") returned 0
	[0061.222] lstrlenA (lpString="*.md") returned 4
	[0061.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4", pszSpec="*.lnk") returned 0
	[0061.222] lstrlenA (lpString="*.lnk") returned 5
	[0061.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4", pszSpec="*.torrent") returned 0
	[0061.222] lstrlenA (lpString="*.torrent") returned 9
	[0061.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4", pszSpec="*.mov") returned 0
	[0061.223] lstrlenA (lpString="*.mov") returned 5
	[0061.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4", pszSpec="*.3gp") returned 0
	[0061.223] lstrlenA (lpString="*.3gp") returned 5
	[0061.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4", pszSpec="*.mpeg") returned 0
	[0061.223] lstrlenA (lpString="*.mpeg") returned 6
	[0061.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4", pszSpec="*.mpg") returned 0
	[0061.223] lstrlenA (lpString="*.mpg") returned 5
	[0061.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4", pszSpec="*.flv") returned 0
	[0061.223] lstrlenA (lpString="*.flv") returned 5
	[0061.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4", pszSpec="*.avi") returned 0
	[0061.223] lstrlenA (lpString="*.avi") returned 5
	[0061.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4", pszSpec="*.mp4") returned 1
	[0061.223] lstrlenA (lpString="*.mp4") returned 5
	[0061.223] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4"
	[0061.223] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4"
	[0061.223] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4.") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4."
	[0061.223] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win10.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0061.223] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1e8fb
	[0061.223] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1158e0a5, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x1158e0a5, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1158e0a5, dwHighDateTime=0x1d327e8)) returned 1
	[0061.223] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0061.223] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1e8b9, lpOverlapped=0x0) returned 1
	[0061.227] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4") returned="StartMenu_Win10.mp4"
	[0061.227] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0061.228] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1e8b9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1e8b9, lpOverlapped=0x0) returned 1
	[0061.228] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.228] CloseHandle (hObject=0x210) returned 1
	[0061.228] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win10.mp4"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4.exe" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win10.mp4.exe")) returned 1
	[0061.229] FindNextFileA (in: hFindFile=0x7cb7d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11567da2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11567da2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1158e0a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1ce1b, dwReserved0=0x0, dwReserved1=0x1, cFileName="StartMenu_Win10_RTL.mp4", cAlternateFileName="STARTM~1.MP4")) returned 1
	[0061.229] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.229] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="StartMenu_Win10_RTL.mp4") returned -1
	[0061.229] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="StartMenu_Win10_RTL.mp4") returned -1
	[0061.229] lstrcmpiA (lpString1="", lpString2="StartMenu_Win10_RTL.mp4") returned -1
	[0061.229] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4") returned="StartMenu_Win10.mp4"
	[0061.229] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\fre\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\"
	[0061.229] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\fre\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\fre\\") returned=""
	[0061.229] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\fre\\how-to-decrypt-files.htm")) returned 0x20
	[0061.229] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\", lpString2="StartMenu_Win10_RTL.mp4" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4"
	[0061.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4", pszSpec="*.zip") returned 0
	[0061.229] lstrlenA (lpString="*.zip") returned 5
	[0061.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4", pszSpec="*.rar") returned 0
	[0061.229] lstrlenA (lpString="*.rar") returned 5
	[0061.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4", pszSpec="*.7z") returned 0
	[0061.229] lstrlenA (lpString="*.7z") returned 4
	[0061.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4", pszSpec="*.tar") returned 0
	[0061.229] lstrlenA (lpString="*.tar") returned 5
	[0061.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4", pszSpec="*.gzip") returned 0
	[0061.229] lstrlenA (lpString="*.gzip") returned 6
	[0061.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4", pszSpec="*.jpg") returned 0
	[0061.229] lstrlenA (lpString="*.jpg") returned 5
	[0061.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4", pszSpec="*.jpeg") returned 0
	[0061.229] lstrlenA (lpString="*.jpeg") returned 6
	[0061.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4", pszSpec="*.bmp") returned 0
	[0061.229] lstrlenA (lpString="*.bmp") returned 5
	[0061.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4", pszSpec="*.gif") returned 0
	[0061.229] lstrlenA (lpString="*.gif") returned 5
	[0061.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4", pszSpec="*.png") returned 0
	[0061.230] lstrlenA (lpString="*.png") returned 5
	[0061.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4", pszSpec="*.doc") returned 0
	[0061.230] lstrlenA (lpString="*.doc") returned 5
	[0061.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4", pszSpec="*.docx") returned 0
	[0061.230] lstrlenA (lpString="*.docx") returned 6
	[0061.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4", pszSpec="*.xls") returned 0
	[0061.230] lstrlenA (lpString="*.xls") returned 5
	[0061.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4", pszSpec="*.xlsx") returned 0
	[0061.230] lstrlenA (lpString="*.xlsx") returned 6
	[0061.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4", pszSpec="*.ppt") returned 0
	[0061.230] lstrlenA (lpString="*.ppt") returned 5
	[0061.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4", pszSpec="*.pptx") returned 0
	[0061.230] lstrlenA (lpString="*.pptx") returned 6
	[0061.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4", pszSpec="*.txt") returned 0
	[0061.230] lstrlenA (lpString="*.txt") returned 5
	[0061.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4", pszSpec="*.pdf") returned 0
	[0061.230] lstrlenA (lpString="*.pdf") returned 5
	[0061.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4", pszSpec="*.htm") returned 0
	[0061.230] lstrlenA (lpString="*.htm") returned 5
	[0061.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4", pszSpec="*.html") returned 0
	[0061.230] lstrlenA (lpString="*.html") returned 6
	[0061.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4", pszSpec="*.mdb") returned 0
	[0061.230] lstrlenA (lpString="*.mdb") returned 5
	[0061.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4", pszSpec="*.pfx") returned 0
	[0061.230] lstrlenA (lpString="*.pfx") returned 5
	[0061.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4", pszSpec="*.md") returned 0
	[0061.230] lstrlenA (lpString="*.md") returned 4
	[0061.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4", pszSpec="*.lnk") returned 0
	[0061.230] lstrlenA (lpString="*.lnk") returned 5
	[0061.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4", pszSpec="*.torrent") returned 0
	[0061.230] lstrlenA (lpString="*.torrent") returned 9
	[0061.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4", pszSpec="*.mov") returned 0
	[0061.230] lstrlenA (lpString="*.mov") returned 5
	[0061.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4", pszSpec="*.3gp") returned 0
	[0061.230] lstrlenA (lpString="*.3gp") returned 5
	[0061.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4", pszSpec="*.mpeg") returned 0
	[0061.231] lstrlenA (lpString="*.mpeg") returned 6
	[0061.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4", pszSpec="*.mpg") returned 0
	[0061.231] lstrlenA (lpString="*.mpg") returned 5
	[0061.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4", pszSpec="*.flv") returned 0
	[0061.231] lstrlenA (lpString="*.flv") returned 5
	[0061.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4", pszSpec="*.avi") returned 0
	[0061.231] lstrlenA (lpString="*.avi") returned 5
	[0061.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4", pszSpec="*.mp4") returned 1
	[0061.231] lstrlenA (lpString="*.mp4") returned 5
	[0061.231] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4"
	[0061.231] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4"
	[0061.231] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4.") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4."
	[0061.231] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4.exe") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4.exe"
	[0061.231] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win10_rtl.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0061.231] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ce1b
	[0061.231] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x11567da2, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x11567da2, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1158e0a5, dwHighDateTime=0x1d327e8)) returned 1
	[0061.231] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0061.231] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1cdd9, lpOverlapped=0x0) returned 1
	[0061.309] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4") returned="StartMenu_Win10_RTL.mp4"
	[0061.310] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0061.310] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1cdd9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1cdd9, lpOverlapped=0x0) returned 1
	[0061.311] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.311] CloseHandle (hObject=0x210) returned 1
	[0061.311] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win10_rtl.mp4"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4.exe" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win10_rtl.mp4.exe")) returned 1
	[0061.312] FindNextFileA (in: hFindFile=0x7cb7d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11541b08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11541b08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115b4243, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7600b, dwReserved0=0x0, dwReserved1=0x1, cFileName="StartMenu_Win7.wmv", cAlternateFileName="STARTM~2.WMV")) returned 1
	[0061.312] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.312] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="StartMenu_Win7.wmv") returned -1
	[0061.312] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="StartMenu_Win7.wmv") returned -1
	[0061.312] lstrcmpiA (lpString1="", lpString2="StartMenu_Win7.wmv") returned -1
	[0061.312] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4") returned="StartMenu_Win10_RTL.mp4"
	[0061.312] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\fre\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\"
	[0061.312] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\fre\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\fre\\") returned=""
	[0061.312] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.312] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\fre\\how-to-decrypt-files.htm")) returned 0x20
	[0061.312] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\", lpString2="StartMenu_Win7.wmv" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv"
	[0061.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv", pszSpec="*.zip") returned 0
	[0061.312] lstrlenA (lpString="*.zip") returned 5
	[0061.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv", pszSpec="*.rar") returned 0
	[0061.312] lstrlenA (lpString="*.rar") returned 5
	[0061.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv", pszSpec="*.7z") returned 0
	[0061.312] lstrlenA (lpString="*.7z") returned 4
	[0061.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv", pszSpec="*.tar") returned 0
	[0061.312] lstrlenA (lpString="*.tar") returned 5
	[0061.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv", pszSpec="*.gzip") returned 0
	[0061.312] lstrlenA (lpString="*.gzip") returned 6
	[0061.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv", pszSpec="*.jpg") returned 0
	[0061.312] lstrlenA (lpString="*.jpg") returned 5
	[0061.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv", pszSpec="*.jpeg") returned 0
	[0061.312] lstrlenA (lpString="*.jpeg") returned 6
	[0061.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv", pszSpec="*.bmp") returned 0
	[0061.312] lstrlenA (lpString="*.bmp") returned 5
	[0061.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv", pszSpec="*.gif") returned 0
	[0061.312] lstrlenA (lpString="*.gif") returned 5
	[0061.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv", pszSpec="*.png") returned 0
	[0061.313] lstrlenA (lpString="*.png") returned 5
	[0061.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv", pszSpec="*.doc") returned 0
	[0061.313] lstrlenA (lpString="*.doc") returned 5
	[0061.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv", pszSpec="*.docx") returned 0
	[0061.313] lstrlenA (lpString="*.docx") returned 6
	[0061.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv", pszSpec="*.xls") returned 0
	[0061.313] lstrlenA (lpString="*.xls") returned 5
	[0061.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv", pszSpec="*.xlsx") returned 0
	[0061.313] lstrlenA (lpString="*.xlsx") returned 6
	[0061.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv", pszSpec="*.ppt") returned 0
	[0061.313] lstrlenA (lpString="*.ppt") returned 5
	[0061.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv", pszSpec="*.pptx") returned 0
	[0061.313] lstrlenA (lpString="*.pptx") returned 6
	[0061.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv", pszSpec="*.txt") returned 0
	[0061.313] lstrlenA (lpString="*.txt") returned 5
	[0061.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv", pszSpec="*.pdf") returned 0
	[0061.313] lstrlenA (lpString="*.pdf") returned 5
	[0061.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv", pszSpec="*.htm") returned 0
	[0061.313] lstrlenA (lpString="*.htm") returned 5
	[0061.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv", pszSpec="*.html") returned 0
	[0061.313] lstrlenA (lpString="*.html") returned 6
	[0061.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv", pszSpec="*.mdb") returned 0
	[0061.313] lstrlenA (lpString="*.mdb") returned 5
	[0061.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv", pszSpec="*.pfx") returned 0
	[0061.313] lstrlenA (lpString="*.pfx") returned 5
	[0061.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv", pszSpec="*.md") returned 0
	[0061.313] lstrlenA (lpString="*.md") returned 4
	[0061.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv", pszSpec="*.lnk") returned 0
	[0061.313] lstrlenA (lpString="*.lnk") returned 5
	[0061.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv", pszSpec="*.torrent") returned 0
	[0061.313] lstrlenA (lpString="*.torrent") returned 9
	[0061.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv", pszSpec="*.mov") returned 0
	[0061.313] lstrlenA (lpString="*.mov") returned 5
	[0061.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv", pszSpec="*.3gp") returned 0
	[0061.313] lstrlenA (lpString="*.3gp") returned 5
	[0061.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv", pszSpec="*.mpeg") returned 0
	[0061.313] lstrlenA (lpString="*.mpeg") returned 6
	[0061.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv", pszSpec="*.mpg") returned 0
	[0061.314] lstrlenA (lpString="*.mpg") returned 5
	[0061.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv", pszSpec="*.flv") returned 0
	[0061.314] lstrlenA (lpString="*.flv") returned 5
	[0061.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv", pszSpec="*.avi") returned 0
	[0061.314] lstrlenA (lpString="*.avi") returned 5
	[0061.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv", pszSpec="*.mp4") returned 0
	[0061.314] lstrlenA (lpString="*.mp4") returned 5
	[0061.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv", pszSpec="*.wmv") returned 1
	[0061.314] lstrlenA (lpString="*.wmv") returned 5
	[0061.314] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv"
	[0061.314] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv"
	[0061.314] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv.") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv."
	[0061.314] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv.exe") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv.exe"
	[0061.314] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win7.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0061.315] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7600b
	[0061.315] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x11541b08, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x11541b08, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x115b4243, dwHighDateTime=0x1d327e8)) returned 1
	[0061.315] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0061.315] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x75fc9, lpOverlapped=0x0) returned 1
	[0061.353] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv") returned="StartMenu_Win7.wmv"
	[0061.355] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0061.355] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x75fc9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x75fc9, lpOverlapped=0x0) returned 1
	[0061.356] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.356] CloseHandle (hObject=0x210) returned 1
	[0061.356] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win7.wmv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv.exe" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win7.wmv.exe")) returned 1
	[0061.357] FindNextFileA (in: hFindFile=0x7cb7d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11541b08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11541b08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1160070a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc8b14, dwReserved0=0x0, dwReserved1=0x1, cFileName="StartMenu_Win7_RTL.wmv", cAlternateFileName="STARTM~1.WMV")) returned 1
	[0061.357] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.357] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="StartMenu_Win7_RTL.wmv") returned -1
	[0061.357] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="StartMenu_Win7_RTL.wmv") returned -1
	[0061.357] lstrcmpiA (lpString1="", lpString2="StartMenu_Win7_RTL.wmv") returned -1
	[0061.357] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv") returned="StartMenu_Win7.wmv"
	[0061.357] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\fre\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\"
	[0061.357] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\fre\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\fre\\") returned=""
	[0061.357] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.357] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\fre\\how-to-decrypt-files.htm")) returned 0x20
	[0061.357] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\", lpString2="StartMenu_Win7_RTL.wmv" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv"
	[0061.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv", pszSpec="*.zip") returned 0
	[0061.358] lstrlenA (lpString="*.zip") returned 5
	[0061.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv", pszSpec="*.rar") returned 0
	[0061.358] lstrlenA (lpString="*.rar") returned 5
	[0061.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv", pszSpec="*.7z") returned 0
	[0061.358] lstrlenA (lpString="*.7z") returned 4
	[0061.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv", pszSpec="*.tar") returned 0
	[0061.358] lstrlenA (lpString="*.tar") returned 5
	[0061.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv", pszSpec="*.gzip") returned 0
	[0061.358] lstrlenA (lpString="*.gzip") returned 6
	[0061.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv", pszSpec="*.jpg") returned 0
	[0061.358] lstrlenA (lpString="*.jpg") returned 5
	[0061.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv", pszSpec="*.jpeg") returned 0
	[0061.358] lstrlenA (lpString="*.jpeg") returned 6
	[0061.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv", pszSpec="*.bmp") returned 0
	[0061.358] lstrlenA (lpString="*.bmp") returned 5
	[0061.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv", pszSpec="*.gif") returned 0
	[0061.358] lstrlenA (lpString="*.gif") returned 5
	[0061.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv", pszSpec="*.png") returned 0
	[0061.358] lstrlenA (lpString="*.png") returned 5
	[0061.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv", pszSpec="*.doc") returned 0
	[0061.358] lstrlenA (lpString="*.doc") returned 5
	[0061.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv", pszSpec="*.docx") returned 0
	[0061.358] lstrlenA (lpString="*.docx") returned 6
	[0061.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv", pszSpec="*.xls") returned 0
	[0061.358] lstrlenA (lpString="*.xls") returned 5
	[0061.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv", pszSpec="*.xlsx") returned 0
	[0061.358] lstrlenA (lpString="*.xlsx") returned 6
	[0061.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv", pszSpec="*.ppt") returned 0
	[0061.358] lstrlenA (lpString="*.ppt") returned 5
	[0061.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv", pszSpec="*.pptx") returned 0
	[0061.358] lstrlenA (lpString="*.pptx") returned 6
	[0061.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv", pszSpec="*.txt") returned 0
	[0061.358] lstrlenA (lpString="*.txt") returned 5
	[0061.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv", pszSpec="*.pdf") returned 0
	[0061.358] lstrlenA (lpString="*.pdf") returned 5
	[0061.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv", pszSpec="*.htm") returned 0
	[0061.359] lstrlenA (lpString="*.htm") returned 5
	[0061.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv", pszSpec="*.html") returned 0
	[0061.359] lstrlenA (lpString="*.html") returned 6
	[0061.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv", pszSpec="*.mdb") returned 0
	[0061.359] lstrlenA (lpString="*.mdb") returned 5
	[0061.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv", pszSpec="*.pfx") returned 0
	[0061.359] lstrlenA (lpString="*.pfx") returned 5
	[0061.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv", pszSpec="*.md") returned 0
	[0061.359] lstrlenA (lpString="*.md") returned 4
	[0061.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv", pszSpec="*.lnk") returned 0
	[0061.359] lstrlenA (lpString="*.lnk") returned 5
	[0061.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv", pszSpec="*.torrent") returned 0
	[0061.359] lstrlenA (lpString="*.torrent") returned 9
	[0061.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv", pszSpec="*.mov") returned 0
	[0061.359] lstrlenA (lpString="*.mov") returned 5
	[0061.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv", pszSpec="*.3gp") returned 0
	[0061.359] lstrlenA (lpString="*.3gp") returned 5
	[0061.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv", pszSpec="*.mpeg") returned 0
	[0061.359] lstrlenA (lpString="*.mpeg") returned 6
	[0061.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv", pszSpec="*.mpg") returned 0
	[0061.359] lstrlenA (lpString="*.mpg") returned 5
	[0061.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv", pszSpec="*.flv") returned 0
	[0061.359] lstrlenA (lpString="*.flv") returned 5
	[0061.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv", pszSpec="*.avi") returned 0
	[0061.359] lstrlenA (lpString="*.avi") returned 5
	[0061.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv", pszSpec="*.mp4") returned 0
	[0061.359] lstrlenA (lpString="*.mp4") returned 5
	[0061.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv", pszSpec="*.wmv") returned 1
	[0061.359] lstrlenA (lpString="*.wmv") returned 5
	[0061.359] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv"
	[0061.359] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv"
	[0061.359] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv.") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv."
	[0061.359] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv.exe") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv.exe"
	[0061.359] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win7_rtl.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0061.360] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc8b14
	[0061.360] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x11541b08, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x11541b08, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1160070a, dwHighDateTime=0x1d327e8)) returned 1
	[0061.360] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0061.360] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xc8ad2, lpOverlapped=0x0) returned 1
	[0061.507] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv") returned="StartMenu_Win7_RTL.wmv"
	[0061.510] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0061.510] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xc8ad2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xc8ad2, lpOverlapped=0x0) returned 1
	[0061.512] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.512] CloseHandle (hObject=0x210) returned 1
	[0061.512] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win7_rtl.wmv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv.exe" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win7_rtl.wmv.exe")) returned 1
	[0061.513] FindNextFileA (in: hFindFile=0x7cb7d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x115da4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x19768, dwReserved0=0x0, dwReserved1=0x1, cFileName="StartMenu_Win8.mp4", cAlternateFileName="STARTM~4.MP4")) returned 1
	[0061.513] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.513] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="StartMenu_Win8.mp4") returned -1
	[0061.513] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="StartMenu_Win8.mp4") returned -1
	[0061.513] lstrcmpiA (lpString1="", lpString2="StartMenu_Win8.mp4") returned -1
	[0061.513] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv") returned="StartMenu_Win7_RTL.wmv"
	[0061.513] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\fre\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\"
	[0061.513] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\fre\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\fre\\") returned=""
	[0061.513] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.513] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\fre\\how-to-decrypt-files.htm")) returned 0x20
	[0061.513] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\", lpString2="StartMenu_Win8.mp4" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4"
	[0061.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4", pszSpec="*.zip") returned 0
	[0061.514] lstrlenA (lpString="*.zip") returned 5
	[0061.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4", pszSpec="*.rar") returned 0
	[0061.514] lstrlenA (lpString="*.rar") returned 5
	[0061.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4", pszSpec="*.7z") returned 0
	[0061.514] lstrlenA (lpString="*.7z") returned 4
	[0061.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4", pszSpec="*.tar") returned 0
	[0061.514] lstrlenA (lpString="*.tar") returned 5
	[0061.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4", pszSpec="*.gzip") returned 0
	[0061.514] lstrlenA (lpString="*.gzip") returned 6
	[0061.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4", pszSpec="*.jpg") returned 0
	[0061.514] lstrlenA (lpString="*.jpg") returned 5
	[0061.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4", pszSpec="*.jpeg") returned 0
	[0061.514] lstrlenA (lpString="*.jpeg") returned 6
	[0061.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4", pszSpec="*.bmp") returned 0
	[0061.514] lstrlenA (lpString="*.bmp") returned 5
	[0061.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4", pszSpec="*.gif") returned 0
	[0061.514] lstrlenA (lpString="*.gif") returned 5
	[0061.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4", pszSpec="*.png") returned 0
	[0061.514] lstrlenA (lpString="*.png") returned 5
	[0061.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4", pszSpec="*.doc") returned 0
	[0061.514] lstrlenA (lpString="*.doc") returned 5
	[0061.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4", pszSpec="*.docx") returned 0
	[0061.514] lstrlenA (lpString="*.docx") returned 6
	[0061.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4", pszSpec="*.xls") returned 0
	[0061.514] lstrlenA (lpString="*.xls") returned 5
	[0061.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4", pszSpec="*.xlsx") returned 0
	[0061.514] lstrlenA (lpString="*.xlsx") returned 6
	[0061.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4", pszSpec="*.ppt") returned 0
	[0061.514] lstrlenA (lpString="*.ppt") returned 5
	[0061.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4", pszSpec="*.pptx") returned 0
	[0061.514] lstrlenA (lpString="*.pptx") returned 6
	[0061.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4", pszSpec="*.txt") returned 0
	[0061.514] lstrlenA (lpString="*.txt") returned 5
	[0061.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4", pszSpec="*.pdf") returned 0
	[0061.514] lstrlenA (lpString="*.pdf") returned 5
	[0061.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4", pszSpec="*.htm") returned 0
	[0061.515] lstrlenA (lpString="*.htm") returned 5
	[0061.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4", pszSpec="*.html") returned 0
	[0061.515] lstrlenA (lpString="*.html") returned 6
	[0061.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4", pszSpec="*.mdb") returned 0
	[0061.515] lstrlenA (lpString="*.mdb") returned 5
	[0061.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4", pszSpec="*.pfx") returned 0
	[0061.515] lstrlenA (lpString="*.pfx") returned 5
	[0061.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4", pszSpec="*.md") returned 0
	[0061.515] lstrlenA (lpString="*.md") returned 4
	[0061.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4", pszSpec="*.lnk") returned 0
	[0061.515] lstrlenA (lpString="*.lnk") returned 5
	[0061.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4", pszSpec="*.torrent") returned 0
	[0061.515] lstrlenA (lpString="*.torrent") returned 9
	[0061.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4", pszSpec="*.mov") returned 0
	[0061.515] lstrlenA (lpString="*.mov") returned 5
	[0061.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4", pszSpec="*.3gp") returned 0
	[0061.515] lstrlenA (lpString="*.3gp") returned 5
	[0061.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4", pszSpec="*.mpeg") returned 0
	[0061.515] lstrlenA (lpString="*.mpeg") returned 6
	[0061.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4", pszSpec="*.mpg") returned 0
	[0061.515] lstrlenA (lpString="*.mpg") returned 5
	[0061.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4", pszSpec="*.flv") returned 0
	[0061.515] lstrlenA (lpString="*.flv") returned 5
	[0061.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4", pszSpec="*.avi") returned 0
	[0061.515] lstrlenA (lpString="*.avi") returned 5
	[0061.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4", pszSpec="*.mp4") returned 1
	[0061.515] lstrlenA (lpString="*.mp4") returned 5
	[0061.515] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4"
	[0061.515] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4"
	[0061.515] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4.") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4."
	[0061.515] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4.exe") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4.exe"
	[0061.515] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win8.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0061.516] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19768
	[0061.516] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x115da4b2, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x115da4b2, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x115da4b2, dwHighDateTime=0x1d327e8)) returned 1
	[0061.516] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0061.516] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x19726, lpOverlapped=0x0) returned 1
	[0061.559] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4") returned="StartMenu_Win8.mp4"
	[0061.559] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0061.559] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x19726, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x19726, lpOverlapped=0x0) returned 1
	[0061.560] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.560] CloseHandle (hObject=0x210) returned 1
	[0061.560] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win8.mp4"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4.exe" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win8.mp4.exe")) returned 1
	[0061.561] FindNextFileA (in: hFindFile=0x7cb7d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x115b4243, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115b4243, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115b4243, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x19a00, dwReserved0=0x0, dwReserved1=0x1, cFileName="StartMenu_Win8_RTL.mp4", cAlternateFileName="STARTM~3.MP4")) returned 1
	[0061.561] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.561] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="StartMenu_Win8_RTL.mp4") returned -1
	[0061.561] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="StartMenu_Win8_RTL.mp4") returned -1
	[0061.561] lstrcmpiA (lpString1="", lpString2="StartMenu_Win8_RTL.mp4") returned -1
	[0061.561] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4") returned="StartMenu_Win8.mp4"
	[0061.561] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\fre\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\"
	[0061.561] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\fre\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\fre\\") returned=""
	[0061.561] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.561] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\fre\\how-to-decrypt-files.htm")) returned 0x20
	[0061.561] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\", lpString2="StartMenu_Win8_RTL.mp4" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4"
	[0061.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4", pszSpec="*.zip") returned 0
	[0061.561] lstrlenA (lpString="*.zip") returned 5
	[0061.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4", pszSpec="*.rar") returned 0
	[0061.561] lstrlenA (lpString="*.rar") returned 5
	[0061.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4", pszSpec="*.7z") returned 0
	[0061.561] lstrlenA (lpString="*.7z") returned 4
	[0061.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4", pszSpec="*.tar") returned 0
	[0061.562] lstrlenA (lpString="*.tar") returned 5
	[0061.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4", pszSpec="*.gzip") returned 0
	[0061.562] lstrlenA (lpString="*.gzip") returned 6
	[0061.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4", pszSpec="*.jpg") returned 0
	[0061.562] lstrlenA (lpString="*.jpg") returned 5
	[0061.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4", pszSpec="*.jpeg") returned 0
	[0061.562] lstrlenA (lpString="*.jpeg") returned 6
	[0061.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4", pszSpec="*.bmp") returned 0
	[0061.562] lstrlenA (lpString="*.bmp") returned 5
	[0061.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4", pszSpec="*.gif") returned 0
	[0061.562] lstrlenA (lpString="*.gif") returned 5
	[0061.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4", pszSpec="*.png") returned 0
	[0061.562] lstrlenA (lpString="*.png") returned 5
	[0061.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4", pszSpec="*.doc") returned 0
	[0061.562] lstrlenA (lpString="*.doc") returned 5
	[0061.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4", pszSpec="*.docx") returned 0
	[0061.562] lstrlenA (lpString="*.docx") returned 6
	[0061.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4", pszSpec="*.xls") returned 0
	[0061.562] lstrlenA (lpString="*.xls") returned 5
	[0061.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4", pszSpec="*.xlsx") returned 0
	[0061.562] lstrlenA (lpString="*.xlsx") returned 6
	[0061.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4", pszSpec="*.ppt") returned 0
	[0061.562] lstrlenA (lpString="*.ppt") returned 5
	[0061.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4", pszSpec="*.pptx") returned 0
	[0061.562] lstrlenA (lpString="*.pptx") returned 6
	[0061.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4", pszSpec="*.txt") returned 0
	[0061.562] lstrlenA (lpString="*.txt") returned 5
	[0061.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4", pszSpec="*.pdf") returned 0
	[0061.562] lstrlenA (lpString="*.pdf") returned 5
	[0061.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4", pszSpec="*.htm") returned 0
	[0061.562] lstrlenA (lpString="*.htm") returned 5
	[0061.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4", pszSpec="*.html") returned 0
	[0061.562] lstrlenA (lpString="*.html") returned 6
	[0061.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4", pszSpec="*.mdb") returned 0
	[0061.562] lstrlenA (lpString="*.mdb") returned 5
	[0061.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4", pszSpec="*.pfx") returned 0
	[0061.563] lstrlenA (lpString="*.pfx") returned 5
	[0061.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4", pszSpec="*.md") returned 0
	[0061.563] lstrlenA (lpString="*.md") returned 4
	[0061.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4", pszSpec="*.lnk") returned 0
	[0061.563] lstrlenA (lpString="*.lnk") returned 5
	[0061.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4", pszSpec="*.torrent") returned 0
	[0061.563] lstrlenA (lpString="*.torrent") returned 9
	[0061.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4", pszSpec="*.mov") returned 0
	[0061.563] lstrlenA (lpString="*.mov") returned 5
	[0061.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4", pszSpec="*.3gp") returned 0
	[0061.563] lstrlenA (lpString="*.3gp") returned 5
	[0061.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4", pszSpec="*.mpeg") returned 0
	[0061.563] lstrlenA (lpString="*.mpeg") returned 6
	[0061.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4", pszSpec="*.mpg") returned 0
	[0061.563] lstrlenA (lpString="*.mpg") returned 5
	[0061.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4", pszSpec="*.flv") returned 0
	[0061.563] lstrlenA (lpString="*.flv") returned 5
	[0061.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4", pszSpec="*.avi") returned 0
	[0061.563] lstrlenA (lpString="*.avi") returned 5
	[0061.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4", pszSpec="*.mp4") returned 1
	[0061.563] lstrlenA (lpString="*.mp4") returned 5
	[0061.563] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4"
	[0061.563] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4"
	[0061.563] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4.") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4."
	[0061.563] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4.", lpString2="exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4.exe") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4.exe"
	[0061.563] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win8_rtl.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0061.564] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19a00
	[0061.564] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x115b4243, dwHighDateTime=0x1d327e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x115b4243, dwHighDateTime=0x1d327e8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x115b4243, dwHighDateTime=0x1d327e8)) returned 1
	[0061.564] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0061.564] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x199be, lpOverlapped=0x0) returned 1
	[0061.597] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4") returned="StartMenu_Win8_RTL.mp4"
	[0061.598] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0061.598] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x199be, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x199be, lpOverlapped=0x0) returned 1
	[0061.598] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.598] CloseHandle (hObject=0x210) returned 1
	[0061.598] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win8_rtl.mp4"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4.exe" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win8_rtl.mp4.exe")) returned 1
	[0061.599] FindNextFileA (in: hFindFile=0x7cb7d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x115b4243, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115b4243, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115b4243, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x19a00, dwReserved0=0x0, dwReserved1=0x1, cFileName="StartMenu_Win8_RTL.mp4", cAlternateFileName="STARTM~3.MP4")) returned 0
	[0061.599] FindClose (in: hFindFile=0x7cb7d0 | out: hFindFile=0x7cb7d0) returned 1
	[0061.599] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd1f5fb21, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b2abe77, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2abe77, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x7d7d78, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 1
	[0061.599] lstrcmpA (lpString1=".", lpString2="Integration") returned -1
	[0061.599] lstrcmpA (lpString1="..", lpString2="Integration") returned -1
	[0061.599] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\*.*") returned="*.*"
	[0061.599] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\", lpString2="Integration" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration") returned="C:\\Program Files\\Microsoft Office\\root\\Integration"
	[0061.599] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration") returned 50
	[0061.599] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd1f5fb21, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b2abe77, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2abe77, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x7cb850
	[0061.601] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0061.601] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd1f5fb21, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b2abe77, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2abe77, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1
	[0061.602] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0061.602] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0061.603] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe33a4c67, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe33a4c67, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe3607185, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xc61000, dwReserved0=0x0, dwReserved1=0x1, cFileName="C2RInt.16.msi", cAlternateFileName="C2RINT~1.MSI")) returned 1
	[0061.603] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.603] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RInt.16.msi") returned 1
	[0061.603] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RInt.16.msi") returned 1
	[0061.603] lstrcmpiA (lpString1="", lpString2="C2RInt.16.msi") returned -1
	[0061.603] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\*.*") returned="*.*"
	[0061.603] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.603] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.603] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.603] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0061.603] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0061.603] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0061.603] WriteFile (in: hFile=0x210, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0061.604] SetFileTime (hFile=0x210, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0061.604] CloseHandle (hObject=0x210) returned 1
	[0061.604] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RInt.16.msi" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi"
	[0061.604] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.zip") returned 0
	[0061.605] lstrlenA (lpString="*.zip") returned 5
	[0061.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.rar") returned 0
	[0061.605] lstrlenA (lpString="*.rar") returned 5
	[0061.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.7z") returned 0
	[0061.605] lstrlenA (lpString="*.7z") returned 4
	[0061.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.tar") returned 0
	[0061.605] lstrlenA (lpString="*.tar") returned 5
	[0061.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.gzip") returned 0
	[0061.605] lstrlenA (lpString="*.gzip") returned 6
	[0061.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.jpg") returned 0
	[0061.605] lstrlenA (lpString="*.jpg") returned 5
	[0061.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.jpeg") returned 0
	[0061.605] lstrlenA (lpString="*.jpeg") returned 6
	[0061.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.bmp") returned 0
	[0061.605] lstrlenA (lpString="*.bmp") returned 5
	[0061.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.gif") returned 0
	[0061.605] lstrlenA (lpString="*.gif") returned 5
	[0061.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.png") returned 0
	[0061.605] lstrlenA (lpString="*.png") returned 5
	[0061.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.doc") returned 0
	[0061.605] lstrlenA (lpString="*.doc") returned 5
	[0061.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.docx") returned 0
	[0061.605] lstrlenA (lpString="*.docx") returned 6
	[0061.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.xls") returned 0
	[0061.605] lstrlenA (lpString="*.xls") returned 5
	[0061.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.xlsx") returned 0
	[0061.605] lstrlenA (lpString="*.xlsx") returned 6
	[0061.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.ppt") returned 0
	[0061.605] lstrlenA (lpString="*.ppt") returned 5
	[0061.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.pptx") returned 0
	[0061.605] lstrlenA (lpString="*.pptx") returned 6
	[0061.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.txt") returned 0
	[0061.605] lstrlenA (lpString="*.txt") returned 5
	[0061.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.pdf") returned 0
	[0061.605] lstrlenA (lpString="*.pdf") returned 5
	[0061.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.htm") returned 0
	[0061.606] lstrlenA (lpString="*.htm") returned 5
	[0061.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.html") returned 0
	[0061.606] lstrlenA (lpString="*.html") returned 6
	[0061.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.mdb") returned 0
	[0061.606] lstrlenA (lpString="*.mdb") returned 5
	[0061.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.pfx") returned 0
	[0061.606] lstrlenA (lpString="*.pfx") returned 5
	[0061.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.md") returned 0
	[0061.606] lstrlenA (lpString="*.md") returned 4
	[0061.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.lnk") returned 0
	[0061.606] lstrlenA (lpString="*.lnk") returned 5
	[0061.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.torrent") returned 0
	[0061.606] lstrlenA (lpString="*.torrent") returned 9
	[0061.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.mov") returned 0
	[0061.606] lstrlenA (lpString="*.mov") returned 5
	[0061.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.3gp") returned 0
	[0061.606] lstrlenA (lpString="*.3gp") returned 5
	[0061.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.mpeg") returned 0
	[0061.606] lstrlenA (lpString="*.mpeg") returned 6
	[0061.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.mpg") returned 0
	[0061.606] lstrlenA (lpString="*.mpg") returned 5
	[0061.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.flv") returned 0
	[0061.606] lstrlenA (lpString="*.flv") returned 5
	[0061.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.avi") returned 0
	[0061.606] lstrlenA (lpString="*.avi") returned 5
	[0061.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.mp4") returned 0
	[0061.606] lstrlenA (lpString="*.mp4") returned 5
	[0061.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.wmv") returned 0
	[0061.606] lstrlenA (lpString="*.wmv") returned 5
	[0061.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.mkv") returned 0
	[0061.606] lstrlenA (lpString="*.mkv") returned 5
	[0061.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.mp3") returned 0
	[0061.606] lstrlenA (lpString="*.mp3") returned 5
	[0061.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.wav") returned 0
	[0061.607] lstrlenA (lpString="*.wav") returned 5
	[0061.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.flac") returned 0
	[0061.607] lstrlenA (lpString="*.flac") returned 6
	[0061.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.wma") returned 0
	[0061.607] lstrlenA (lpString="*.wma") returned 5
	[0061.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.au3") returned 0
	[0061.607] lstrlenA (lpString="*.au3") returned 5
	[0061.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.ahk") returned 0
	[0061.607] lstrlenA (lpString="*.ahk") returned 5
	[0061.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.c") returned 0
	[0061.607] lstrlenA (lpString="*.c") returned 3
	[0061.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.cc") returned 0
	[0061.607] lstrlenA (lpString="*.cc") returned 4
	[0061.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.cpp") returned 0
	[0061.607] lstrlenA (lpString="*.cpp") returned 5
	[0061.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.cxx") returned 0
	[0061.607] lstrlenA (lpString="*.cxx") returned 5
	[0061.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.c++") returned 0
	[0061.607] lstrlenA (lpString="*.c++") returned 5
	[0061.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.cs") returned 0
	[0061.607] lstrlenA (lpString="*.cs") returned 4
	[0061.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.vb") returned 0
	[0061.607] lstrlenA (lpString="*.vb") returned 4
	[0061.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.bas") returned 0
	[0061.607] lstrlenA (lpString="*.bas") returned 5
	[0061.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.csproj") returned 0
	[0061.607] lstrlenA (lpString="*.csproj") returned 8
	[0061.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.vbproj") returned 0
	[0061.607] lstrlenA (lpString="*.vbproj") returned 8
	[0061.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.vcxproj") returned 0
	[0061.607] lstrlenA (lpString="*.vcxproj") returned 9
	[0061.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.manifest") returned 0
	[0061.608] lstrlenA (lpString="*.manifest") returned 10
	[0061.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.php") returned 0
	[0061.608] lstrlenA (lpString="*.php") returned 5
	[0061.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.vbe") returned 0
	[0061.608] lstrlenA (lpString="*.vbe") returned 5
	[0061.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.vba") returned 0
	[0061.608] lstrlenA (lpString="*.vba") returned 5
	[0061.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.vbs") returned 0
	[0061.608] lstrlenA (lpString="*.vbs") returned 5
	[0061.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.bat") returned 0
	[0061.608] lstrlenA (lpString="*.bat") returned 5
	[0061.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.cmd") returned 0
	[0061.608] lstrlenA (lpString="*.cmd") returned 5
	[0061.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.js") returned 0
	[0061.608] lstrlenA (lpString="*.js") returned 4
	[0061.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.jscript") returned 0
	[0061.608] lstrlenA (lpString="*.jscript") returned 9
	[0061.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.hta") returned 0
	[0061.608] lstrlenA (lpString="*.hta") returned 5
	[0061.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.php7") returned 0
	[0061.608] lstrlenA (lpString="*.php7") returned 6
	[0061.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.db") returned 0
	[0061.608] lstrlenA (lpString="*.db") returned 4
	[0061.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.swf") returned 0
	[0061.608] lstrlenA (lpString="*.swf") returned 5
	[0061.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.eml") returned 0
	[0061.608] lstrlenA (lpString="*.eml") returned 5
	[0061.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.part") returned 0
	[0061.608] lstrlenA (lpString="*.part") returned 6
	[0061.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.nfo") returned 0
	[0061.608] lstrlenA (lpString="*.nfo") returned 5
	[0061.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.rsa") returned 0
	[0061.608] lstrlenA (lpString="*.rsa") returned 5
	[0061.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.key") returned 0
	[0061.608] lstrlenA (lpString="*.key") returned 5
	[0061.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.aes") returned 0
	[0061.608] lstrlenA (lpString="*.aes") returned 5
	[0061.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.blob") returned 0
	[0061.609] lstrlenA (lpString="*.blob") returned 6
	[0061.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.btc") returned 0
	[0061.609] lstrlenA (lpString="*.btc") returned 5
	[0061.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi", pszSpec="*.wallet") returned 0
	[0061.609] lstrlenA (lpString="*.wallet") returned 8
	[0061.609] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe384358e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe384358e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe3acbcd3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RIntLoc.en-us.16.msi", cAlternateFileName="C2RINT~2.MSI")) returned 1
	[0061.609] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.609] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RIntLoc.en-us.16.msi") returned 1
	[0061.609] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RIntLoc.en-us.16.msi") returned 1
	[0061.609] lstrcmpiA (lpString1="", lpString2="C2RIntLoc.en-us.16.msi") returned -1
	[0061.609] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned="C2RInt.16.msi"
	[0061.609] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.609] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.609] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.609] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.609] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RIntLoc.en-us.16.msi" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi"
	[0061.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.zip") returned 0
	[0061.609] lstrlenA (lpString="*.zip") returned 5
	[0061.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.rar") returned 0
	[0061.609] lstrlenA (lpString="*.rar") returned 5
	[0061.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.7z") returned 0
	[0061.609] lstrlenA (lpString="*.7z") returned 4
	[0061.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.tar") returned 0
	[0061.609] lstrlenA (lpString="*.tar") returned 5
	[0061.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.gzip") returned 0
	[0061.609] lstrlenA (lpString="*.gzip") returned 6
	[0061.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.jpg") returned 0
	[0061.609] lstrlenA (lpString="*.jpg") returned 5
	[0061.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.jpeg") returned 0
	[0061.609] lstrlenA (lpString="*.jpeg") returned 6
	[0061.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.bmp") returned 0
	[0061.610] lstrlenA (lpString="*.bmp") returned 5
	[0061.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.gif") returned 0
	[0061.610] lstrlenA (lpString="*.gif") returned 5
	[0061.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.png") returned 0
	[0061.610] lstrlenA (lpString="*.png") returned 5
	[0061.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.doc") returned 0
	[0061.610] lstrlenA (lpString="*.doc") returned 5
	[0061.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.docx") returned 0
	[0061.610] lstrlenA (lpString="*.docx") returned 6
	[0061.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.xls") returned 0
	[0061.610] lstrlenA (lpString="*.xls") returned 5
	[0061.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.xlsx") returned 0
	[0061.610] lstrlenA (lpString="*.xlsx") returned 6
	[0061.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.ppt") returned 0
	[0061.610] lstrlenA (lpString="*.ppt") returned 5
	[0061.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.pptx") returned 0
	[0061.610] lstrlenA (lpString="*.pptx") returned 6
	[0061.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.txt") returned 0
	[0061.610] lstrlenA (lpString="*.txt") returned 5
	[0061.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.pdf") returned 0
	[0061.610] lstrlenA (lpString="*.pdf") returned 5
	[0061.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.htm") returned 0
	[0061.610] lstrlenA (lpString="*.htm") returned 5
	[0061.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.html") returned 0
	[0061.610] lstrlenA (lpString="*.html") returned 6
	[0061.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.mdb") returned 0
	[0061.610] lstrlenA (lpString="*.mdb") returned 5
	[0061.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.pfx") returned 0
	[0061.610] lstrlenA (lpString="*.pfx") returned 5
	[0061.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.md") returned 0
	[0061.610] lstrlenA (lpString="*.md") returned 4
	[0061.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.lnk") returned 0
	[0061.610] lstrlenA (lpString="*.lnk") returned 5
	[0061.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.torrent") returned 0
	[0061.610] lstrlenA (lpString="*.torrent") returned 9
	[0061.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.mov") returned 0
	[0061.611] lstrlenA (lpString="*.mov") returned 5
	[0061.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.3gp") returned 0
	[0061.611] lstrlenA (lpString="*.3gp") returned 5
	[0061.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.mpeg") returned 0
	[0061.611] lstrlenA (lpString="*.mpeg") returned 6
	[0061.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.mpg") returned 0
	[0061.611] lstrlenA (lpString="*.mpg") returned 5
	[0061.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.flv") returned 0
	[0061.611] lstrlenA (lpString="*.flv") returned 5
	[0061.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.avi") returned 0
	[0061.611] lstrlenA (lpString="*.avi") returned 5
	[0061.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.mp4") returned 0
	[0061.611] lstrlenA (lpString="*.mp4") returned 5
	[0061.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.wmv") returned 0
	[0061.611] lstrlenA (lpString="*.wmv") returned 5
	[0061.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.mkv") returned 0
	[0061.611] lstrlenA (lpString="*.mkv") returned 5
	[0061.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.mp3") returned 0
	[0061.611] lstrlenA (lpString="*.mp3") returned 5
	[0061.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.wav") returned 0
	[0061.611] lstrlenA (lpString="*.wav") returned 5
	[0061.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.flac") returned 0
	[0061.611] lstrlenA (lpString="*.flac") returned 6
	[0061.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.wma") returned 0
	[0061.611] lstrlenA (lpString="*.wma") returned 5
	[0061.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.au3") returned 0
	[0061.611] lstrlenA (lpString="*.au3") returned 5
	[0061.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.ahk") returned 0
	[0061.611] lstrlenA (lpString="*.ahk") returned 5
	[0061.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.c") returned 0
	[0061.611] lstrlenA (lpString="*.c") returned 3
	[0061.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.cc") returned 0
	[0061.611] lstrlenA (lpString="*.cc") returned 4
	[0061.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.cpp") returned 0
	[0061.611] lstrlenA (lpString="*.cpp") returned 5
	[0061.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.cxx") returned 0
	[0061.612] lstrlenA (lpString="*.cxx") returned 5
	[0061.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.c++") returned 0
	[0061.612] lstrlenA (lpString="*.c++") returned 5
	[0061.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.cs") returned 0
	[0061.612] lstrlenA (lpString="*.cs") returned 4
	[0061.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.vb") returned 0
	[0061.612] lstrlenA (lpString="*.vb") returned 4
	[0061.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.bas") returned 0
	[0061.612] lstrlenA (lpString="*.bas") returned 5
	[0061.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.csproj") returned 0
	[0061.612] lstrlenA (lpString="*.csproj") returned 8
	[0061.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.vbproj") returned 0
	[0061.612] lstrlenA (lpString="*.vbproj") returned 8
	[0061.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.vcxproj") returned 0
	[0061.612] lstrlenA (lpString="*.vcxproj") returned 9
	[0061.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.manifest") returned 0
	[0061.612] lstrlenA (lpString="*.manifest") returned 10
	[0061.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.php") returned 0
	[0061.612] lstrlenA (lpString="*.php") returned 5
	[0061.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.vbe") returned 0
	[0061.612] lstrlenA (lpString="*.vbe") returned 5
	[0061.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.vba") returned 0
	[0061.612] lstrlenA (lpString="*.vba") returned 5
	[0061.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.vbs") returned 0
	[0061.612] lstrlenA (lpString="*.vbs") returned 5
	[0061.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.bat") returned 0
	[0061.612] lstrlenA (lpString="*.bat") returned 5
	[0061.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.cmd") returned 0
	[0061.612] lstrlenA (lpString="*.cmd") returned 5
	[0061.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.js") returned 0
	[0061.613] lstrlenA (lpString="*.js") returned 4
	[0061.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.jscript") returned 0
	[0061.613] lstrlenA (lpString="*.jscript") returned 9
	[0061.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.hta") returned 0
	[0061.613] lstrlenA (lpString="*.hta") returned 5
	[0061.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.php7") returned 0
	[0061.613] lstrlenA (lpString="*.php7") returned 6
	[0061.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.db") returned 0
	[0061.613] lstrlenA (lpString="*.db") returned 4
	[0061.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.swf") returned 0
	[0061.613] lstrlenA (lpString="*.swf") returned 5
	[0061.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.eml") returned 0
	[0061.613] lstrlenA (lpString="*.eml") returned 5
	[0061.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.part") returned 0
	[0061.613] lstrlenA (lpString="*.part") returned 6
	[0061.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.nfo") returned 0
	[0061.613] lstrlenA (lpString="*.nfo") returned 5
	[0061.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.rsa") returned 0
	[0061.613] lstrlenA (lpString="*.rsa") returned 5
	[0061.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.key") returned 0
	[0061.613] lstrlenA (lpString="*.key") returned 5
	[0061.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.aes") returned 0
	[0061.613] lstrlenA (lpString="*.aes") returned 5
	[0061.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.blob") returned 0
	[0061.613] lstrlenA (lpString="*.blob") returned 6
	[0061.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.btc") returned 0
	[0061.613] lstrlenA (lpString="*.btc") returned 5
	[0061.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi", pszSpec="*.wallet") returned 0
	[0061.613] lstrlenA (lpString="*.wallet") returned 8
	[0061.614] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd23fe538, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd23fe538, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2686ce0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x91f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Access.Access.x-none.msi.16.x-none.xml", cAlternateFileName="C25A45~1.XML")) returned 1
	[0061.614] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.614] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.Access.Access.x-none.msi.16.x-none.xml") returned 1
	[0061.614] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.Access.Access.x-none.msi.16.x-none.xml") returned 1
	[0061.614] lstrcmpiA (lpString1="", lpString2="C2RManifest.Access.Access.x-none.msi.16.x-none.xml") returned -1
	[0061.614] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi") returned="C2RIntLoc.en-us.16.msi"
	[0061.614] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.614] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.614] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.614] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.614] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.Access.Access.x-none.msi.16.x-none.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml"
	[0061.614] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.zip") returned 0
	[0061.614] lstrlenA (lpString="*.zip") returned 5
	[0061.614] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.rar") returned 0
	[0061.614] lstrlenA (lpString="*.rar") returned 5
	[0061.614] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.7z") returned 0
	[0061.614] lstrlenA (lpString="*.7z") returned 4
	[0061.614] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.tar") returned 0
	[0061.614] lstrlenA (lpString="*.tar") returned 5
	[0061.614] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.gzip") returned 0
	[0061.614] lstrlenA (lpString="*.gzip") returned 6
	[0061.614] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.jpg") returned 0
	[0061.614] lstrlenA (lpString="*.jpg") returned 5
	[0061.614] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.jpeg") returned 0
	[0061.615] lstrlenA (lpString="*.jpeg") returned 6
	[0061.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.bmp") returned 0
	[0061.615] lstrlenA (lpString="*.bmp") returned 5
	[0061.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.gif") returned 0
	[0061.615] lstrlenA (lpString="*.gif") returned 5
	[0061.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.png") returned 0
	[0061.615] lstrlenA (lpString="*.png") returned 5
	[0061.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.doc") returned 0
	[0061.615] lstrlenA (lpString="*.doc") returned 5
	[0061.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.docx") returned 0
	[0061.615] lstrlenA (lpString="*.docx") returned 6
	[0061.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.xls") returned 0
	[0061.615] lstrlenA (lpString="*.xls") returned 5
	[0061.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.xlsx") returned 0
	[0061.615] lstrlenA (lpString="*.xlsx") returned 6
	[0061.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.ppt") returned 0
	[0061.615] lstrlenA (lpString="*.ppt") returned 5
	[0061.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.pptx") returned 0
	[0061.615] lstrlenA (lpString="*.pptx") returned 6
	[0061.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.txt") returned 0
	[0061.615] lstrlenA (lpString="*.txt") returned 5
	[0061.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.pdf") returned 0
	[0061.615] lstrlenA (lpString="*.pdf") returned 5
	[0061.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.htm") returned 0
	[0061.615] lstrlenA (lpString="*.htm") returned 5
	[0061.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.html") returned 0
	[0061.615] lstrlenA (lpString="*.html") returned 6
	[0061.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.mdb") returned 0
	[0061.615] lstrlenA (lpString="*.mdb") returned 5
	[0061.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.pfx") returned 0
	[0061.615] lstrlenA (lpString="*.pfx") returned 5
	[0061.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.md") returned 0
	[0061.615] lstrlenA (lpString="*.md") returned 4
	[0061.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.lnk") returned 0
	[0061.615] lstrlenA (lpString="*.lnk") returned 5
	[0061.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.torrent") returned 0
	[0061.616] lstrlenA (lpString="*.torrent") returned 9
	[0061.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.mov") returned 0
	[0061.616] lstrlenA (lpString="*.mov") returned 5
	[0061.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.3gp") returned 0
	[0061.616] lstrlenA (lpString="*.3gp") returned 5
	[0061.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.mpeg") returned 0
	[0061.616] lstrlenA (lpString="*.mpeg") returned 6
	[0061.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.mpg") returned 0
	[0061.616] lstrlenA (lpString="*.mpg") returned 5
	[0061.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.flv") returned 0
	[0061.616] lstrlenA (lpString="*.flv") returned 5
	[0061.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.avi") returned 0
	[0061.616] lstrlenA (lpString="*.avi") returned 5
	[0061.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.mp4") returned 0
	[0061.616] lstrlenA (lpString="*.mp4") returned 5
	[0061.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.wmv") returned 0
	[0061.616] lstrlenA (lpString="*.wmv") returned 5
	[0061.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.mkv") returned 0
	[0061.616] lstrlenA (lpString="*.mkv") returned 5
	[0061.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.mp3") returned 0
	[0061.616] lstrlenA (lpString="*.mp3") returned 5
	[0061.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.wav") returned 0
	[0061.616] lstrlenA (lpString="*.wav") returned 5
	[0061.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.flac") returned 0
	[0061.616] lstrlenA (lpString="*.flac") returned 6
	[0061.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.wma") returned 0
	[0061.616] lstrlenA (lpString="*.wma") returned 5
	[0061.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.au3") returned 0
	[0061.616] lstrlenA (lpString="*.au3") returned 5
	[0061.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.ahk") returned 0
	[0061.616] lstrlenA (lpString="*.ahk") returned 5
	[0061.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.c") returned 0
	[0061.616] lstrlenA (lpString="*.c") returned 3
	[0061.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.cc") returned 0
	[0061.616] lstrlenA (lpString="*.cc") returned 4
	[0061.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.cpp") returned 0
	[0061.616] lstrlenA (lpString="*.cpp") returned 5
	[0061.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.cxx") returned 0
	[0061.617] lstrlenA (lpString="*.cxx") returned 5
	[0061.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.c++") returned 0
	[0061.617] lstrlenA (lpString="*.c++") returned 5
	[0061.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.cs") returned 0
	[0061.617] lstrlenA (lpString="*.cs") returned 4
	[0061.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.vb") returned 0
	[0061.617] lstrlenA (lpString="*.vb") returned 4
	[0061.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.bas") returned 0
	[0061.617] lstrlenA (lpString="*.bas") returned 5
	[0061.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.csproj") returned 0
	[0061.617] lstrlenA (lpString="*.csproj") returned 8
	[0061.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.vbproj") returned 0
	[0061.617] lstrlenA (lpString="*.vbproj") returned 8
	[0061.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.vcxproj") returned 0
	[0061.617] lstrlenA (lpString="*.vcxproj") returned 9
	[0061.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.manifest") returned 0
	[0061.617] lstrlenA (lpString="*.manifest") returned 10
	[0061.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.php") returned 0
	[0061.617] lstrlenA (lpString="*.php") returned 5
	[0061.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.vbe") returned 0
	[0061.617] lstrlenA (lpString="*.vbe") returned 5
	[0061.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.vba") returned 0
	[0061.617] lstrlenA (lpString="*.vba") returned 5
	[0061.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.vbs") returned 0
	[0061.617] lstrlenA (lpString="*.vbs") returned 5
	[0061.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.bat") returned 0
	[0061.617] lstrlenA (lpString="*.bat") returned 5
	[0061.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.cmd") returned 0
	[0061.617] lstrlenA (lpString="*.cmd") returned 5
	[0061.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.js") returned 0
	[0061.617] lstrlenA (lpString="*.js") returned 4
	[0061.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.jscript") returned 0
	[0061.617] lstrlenA (lpString="*.jscript") returned 9
	[0061.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.hta") returned 0
	[0061.617] lstrlenA (lpString="*.hta") returned 5
	[0061.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.php7") returned 0
	[0061.618] lstrlenA (lpString="*.php7") returned 6
	[0061.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.db") returned 0
	[0061.618] lstrlenA (lpString="*.db") returned 4
	[0061.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.swf") returned 0
	[0061.618] lstrlenA (lpString="*.swf") returned 5
	[0061.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.eml") returned 0
	[0061.618] lstrlenA (lpString="*.eml") returned 5
	[0061.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.part") returned 0
	[0061.618] lstrlenA (lpString="*.part") returned 6
	[0061.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.nfo") returned 0
	[0061.618] lstrlenA (lpString="*.nfo") returned 5
	[0061.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.rsa") returned 0
	[0061.618] lstrlenA (lpString="*.rsa") returned 5
	[0061.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.key") returned 0
	[0061.618] lstrlenA (lpString="*.key") returned 5
	[0061.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.aes") returned 0
	[0061.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.blob") returned 0
	[0061.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.btc") returned 0
	[0061.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", pszSpec="*.wallet") returned 0
	[0061.618] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd32bedda, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd32bedda, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd356d87a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xe71c, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.accessmui.msi.16.en-us.xml", cAlternateFileName="C222C2~1.XML")) returned 1
	[0061.618] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.618] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.accessmui.msi.16.en-us.xml") returned 1
	[0061.618] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.accessmui.msi.16.en-us.xml") returned 1
	[0061.618] lstrcmpiA (lpString1="", lpString2="C2RManifest.accessmui.msi.16.en-us.xml") returned -1
	[0061.618] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml") returned="C2RManifest.Access.Access.x-none.msi.16.x-none.xml"
	[0061.618] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.618] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.618] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.618] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.619] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.accessmui.msi.16.en-us.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmui.msi.16.en-us.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmui.msi.16.en-us.xml"
	[0061.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmui.msi.16.en-us.xml", pszSpec="*.zip") returned 0
	[0061.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmui.msi.16.en-us.xml", pszSpec="*.rar") returned 0
	[0061.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmui.msi.16.en-us.xml", pszSpec="*.7z") returned 0
	[0061.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmui.msi.16.en-us.xml", pszSpec="*.tar") returned 0
	[0061.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmui.msi.16.en-us.xml", pszSpec="*.gzip") returned 0
	[0061.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmui.msi.16.en-us.xml", pszSpec="*.jpg") returned 0
	[0061.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmui.msi.16.en-us.xml", pszSpec="*.jpeg") returned 0
	[0061.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmui.msi.16.en-us.xml", pszSpec="*.bmp") returned 0
	[0061.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmui.msi.16.en-us.xml", pszSpec="*.gif") returned 0
	[0061.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmui.msi.16.en-us.xml", pszSpec="*.png") returned 0
	[0061.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmui.msi.16.en-us.xml", pszSpec="*.doc") returned 0
	[0061.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmui.msi.16.en-us.xml", pszSpec="*.docx") returned 0
	[0061.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmui.msi.16.en-us.xml", pszSpec="*.xls") returned 0
	[0061.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmui.msi.16.en-us.xml", pszSpec="*.xlsx") returned 0
	[0061.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmui.msi.16.en-us.xml", pszSpec="*.ppt") returned 0
	[0061.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmui.msi.16.en-us.xml", pszSpec="*.pptx") returned 0
	[0061.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmui.msi.16.en-us.xml", pszSpec="*.txt") returned 0
	[0061.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmui.msi.16.en-us.xml", pszSpec="*.pdf") returned 0
	[0061.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmui.msi.16.en-us.xml", pszSpec="*.htm") returned 0
	[0061.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmui.msi.16.en-us.xml", pszSpec="*.html") returned 0
	[0061.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmui.msi.16.en-us.xml", pszSpec="*.mdb") returned 0
	[0061.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmui.msi.16.en-us.xml", pszSpec="*.pfx") returned 0
	[0061.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmui.msi.16.en-us.xml", pszSpec="*.md") returned 0
	[0061.620] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmui.msi.16.en-us.xml", pszSpec="*.lnk") returned 0
	[0061.620] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmui.msi.16.en-us.xml", pszSpec="*.torrent") returned 0
	[0061.620] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmui.msi.16.en-us.xml", pszSpec="*.mov") returned 0
	[0061.620] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmui.msi.16.en-us.xml", pszSpec="*.3gp") returned 0
	[0061.620] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmui.msi.16.en-us.xml", pszSpec="*.mpeg") returned 0
	[0061.620] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmui.msi.16.en-us.xml", pszSpec="*.mpg") returned 0
	[0061.620] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmui.msi.16.en-us.xml", pszSpec="*.flv") returned 0
	[0061.620] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd2daddbf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2daddbf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd31d9ff6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.accessmuiset.msi.16.en-us.xml", cAlternateFileName="C2FB2E~1.XML")) returned 1
	[0061.620] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.620] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.accessmuiset.msi.16.en-us.xml") returned 1
	[0061.620] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.accessmuiset.msi.16.en-us.xml") returned 1
	[0061.620] lstrcmpiA (lpString1="", lpString2="C2RManifest.accessmuiset.msi.16.en-us.xml") returned -1
	[0061.620] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmui.msi.16.en-us.xml") returned="C2RManifest.accessmui.msi.16.en-us.xml"
	[0061.620] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.620] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.620] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.620] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.621] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.accessmuiset.msi.16.en-us.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmuiset.msi.16.en-us.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmuiset.msi.16.en-us.xml"
	[0061.621] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd23fe538, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd23fe538, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd26f9444, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3f14, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", cAlternateFileName="C2RMAN~4.XML")) returned 1
	[0061.621] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.621] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml") returned 1
	[0061.621] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml") returned 1
	[0061.621] lstrcmpiA (lpString1="", lpString2="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml") returned -1
	[0061.621] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmuiset.msi.16.en-us.xml") returned="C2RManifest.accessmuiset.msi.16.en-us.xml"
	[0061.621] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.621] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.621] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.621] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.621] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml"
	[0061.621] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd2dfa2a2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2dfa2a2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd31415cd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x265a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.dcfmui.msi.16.en-us.xml", cAlternateFileName="C206B0~1.XML")) returned 1
	[0061.621] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.621] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.dcfmui.msi.16.en-us.xml") returned 1
	[0061.621] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.dcfmui.msi.16.en-us.xml") returned 1
	[0061.621] lstrcmpiA (lpString1="", lpString2="C2RManifest.dcfmui.msi.16.en-us.xml") returned -1
	[0061.621] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml") returned="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml"
	[0061.621] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.621] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.621] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.621] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.621] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.dcfmui.msi.16.en-us.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.dcfmui.msi.16.en-us.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.dcfmui.msi.16.en-us.xml"
	[0061.622] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd1ff851e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd1ff851e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd252f7b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x39d9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", cAlternateFileName="C2RMAN~3.XML")) returned 1
	[0061.622] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.622] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml") returned 1
	[0061.622] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml") returned 1
	[0061.622] lstrcmpiA (lpString1="", lpString2="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml") returned -1
	[0061.622] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.dcfmui.msi.16.en-us.xml") returned="C2RManifest.dcfmui.msi.16.en-us.xml"
	[0061.622] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.622] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.622] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.622] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.622] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml"
	[0061.622] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd3200239, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd3200239, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd330b2e9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.excelmui.msi.16.en-us.xml", cAlternateFileName="C2D2CD~1.XML")) returned 1
	[0061.622] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.622] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.excelmui.msi.16.en-us.xml") returned 1
	[0061.623] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.excelmui.msi.16.en-us.xml") returned 1
	[0061.623] lstrcmpiA (lpString1="", lpString2="C2RManifest.excelmui.msi.16.en-us.xml") returned -1
	[0061.623] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml") returned="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml"
	[0061.623] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.623] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.623] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.623] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.623] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.excelmui.msi.16.en-us.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.excelmui.msi.16.en-us.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.excelmui.msi.16.en-us.xml"
	[0061.623] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd1f5fb21, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd1f5fb21, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd23fe538, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8f8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", cAlternateFileName="C2RMAN~1.XML")) returned 1
	[0061.623] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.623] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml") returned 1
	[0061.623] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml") returned 1
	[0061.623] lstrcmpiA (lpString1="", lpString2="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml") returned -1
	[0061.623] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.excelmui.msi.16.en-us.xml") returned="C2RManifest.excelmui.msi.16.en-us.xml"
	[0061.623] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.623] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.623] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.623] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.623] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml"
	[0061.624] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd31415cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd31415cd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3298bbd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x180e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.groovemui.msi.16.en-us.xml", cAlternateFileName="C26024~1.XML")) returned 1
	[0061.624] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.624] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.groovemui.msi.16.en-us.xml") returned 1
	[0061.624] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.groovemui.msi.16.en-us.xml") returned 1
	[0061.624] lstrcmpiA (lpString1="", lpString2="C2RManifest.groovemui.msi.16.en-us.xml") returned -1
	[0061.624] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml") returned="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml"
	[0061.624] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.624] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.624] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.624] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.624] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.groovemui.msi.16.en-us.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.groovemui.msi.16.en-us.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.groovemui.msi.16.en-us.xml"
	[0061.624] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd1ff851e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd1ff851e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd257bc65, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1979c, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", cAlternateFileName="C2RMAN~2.XML")) returned 1
	[0061.624] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.624] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml") returned 1
	[0061.624] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml") returned 1
	[0061.624] lstrcmpiA (lpString1="", lpString2="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml") returned -1
	[0061.624] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.groovemui.msi.16.en-us.xml") returned="C2RManifest.groovemui.msi.16.en-us.xml"
	[0061.624] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.624] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.624] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.624] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.624] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml"
	[0061.625] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd31415cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd31415cd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd32bedda, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5b94, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.lyncmui.msi.16.en-us.xml", cAlternateFileName="C2FCD6~1.XML")) returned 1
	[0061.625] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.625] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.lyncmui.msi.16.en-us.xml") returned 1
	[0061.625] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.lyncmui.msi.16.en-us.xml") returned 1
	[0061.625] lstrcmpiA (lpString1="", lpString2="C2RManifest.lyncmui.msi.16.en-us.xml") returned -1
	[0061.625] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml") returned="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml"
	[0061.625] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.625] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.625] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.625] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.625] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.lyncmui.msi.16.en-us.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.lyncmui.msi.16.en-us.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.lyncmui.msi.16.en-us.xml"
	[0061.625] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd32bedda, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd32bedda, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3593a88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6b4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.office32mui.msi.16.en-us.xml", cAlternateFileName="C2BADD~1.XML")) returned 1
	[0061.625] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.625] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.office32mui.msi.16.en-us.xml") returned 1
	[0061.625] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.office32mui.msi.16.en-us.xml") returned 1
	[0061.625] lstrcmpiA (lpString1="", lpString2="C2RManifest.office32mui.msi.16.en-us.xml") returned -1
	[0061.625] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.lyncmui.msi.16.en-us.xml") returned="C2RManifest.lyncmui.msi.16.en-us.xml"
	[0061.625] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.625] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.625] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.626] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.626] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.office32mui.msi.16.en-us.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.office32mui.msi.16.en-us.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.office32mui.msi.16.en-us.xml"
	[0061.626] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd2b97d2d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2b97d2d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2cc8f5f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4f3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.office32ww.msi.16.x-none.xml", cAlternateFileName="C2EBFE~1.XML")) returned 1
	[0061.626] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.626] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.office32ww.msi.16.x-none.xml") returned 1
	[0061.626] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.office32ww.msi.16.x-none.xml") returned 1
	[0061.626] lstrcmpiA (lpString1="", lpString2="C2RManifest.office32ww.msi.16.x-none.xml") returned -1
	[0061.626] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.office32mui.msi.16.en-us.xml") returned="C2RManifest.office32mui.msi.16.en-us.xml"
	[0061.626] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.626] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.626] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.626] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.626] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.office32ww.msi.16.x-none.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.office32ww.msi.16.x-none.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.office32ww.msi.16.x-none.xml"
	[0061.626] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd356d87a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd356d87a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd36c4db5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x19870, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.officemui.msi.16.en-us.xml", cAlternateFileName="C29059~1.XML")) returned 1
	[0061.627] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.627] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.officemui.msi.16.en-us.xml") returned 1
	[0061.627] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.officemui.msi.16.en-us.xml") returned 1
	[0061.627] lstrcmpiA (lpString1="", lpString2="C2RManifest.officemui.msi.16.en-us.xml") returned -1
	[0061.627] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.office32ww.msi.16.x-none.xml") returned="C2RManifest.office32ww.msi.16.x-none.xml"
	[0061.627] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.627] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.627] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.627] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.627] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.officemui.msi.16.en-us.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.officemui.msi.16.en-us.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.officemui.msi.16.en-us.xml"
	[0061.627] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd375d6d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd375d6d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd38424c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.officemuiset.msi.16.en-us.xml", cAlternateFileName="C2467F~1.XML")) returned 1
	[0061.627] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.627] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.officemuiset.msi.16.en-us.xml") returned 1
	[0061.627] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.officemuiset.msi.16.en-us.xml") returned 1
	[0061.627] lstrcmpiA (lpString1="", lpString2="C2RManifest.officemuiset.msi.16.en-us.xml") returned -1
	[0061.627] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.officemui.msi.16.en-us.xml") returned="C2RManifest.officemui.msi.16.en-us.xml"
	[0061.627] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.627] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.627] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.627] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.628] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.officemuiset.msi.16.en-us.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.officemuiset.msi.16.en-us.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.officemuiset.msi.16.en-us.xml"
	[0061.628] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd276bb03, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd276bb03, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd295b9b9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17b3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", cAlternateFileName="C21839~1.XML")) returned 1
	[0061.628] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.628] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml") returned 1
	[0061.628] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml") returned 1
	[0061.628] lstrcmpiA (lpString1="", lpString2="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml") returned -1
	[0061.628] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.officemuiset.msi.16.en-us.xml") returned="C2RManifest.officemuiset.msi.16.en-us.xml"
	[0061.628] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.628] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.628] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.628] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.628] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml"
	[0061.628] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd360620a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd360620a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd375d6d3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4a4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.onenotemui.msi.16.en-us.xml", cAlternateFileName="C24C3D~1.XML")) returned 1
	[0061.628] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.628] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.onenotemui.msi.16.en-us.xml") returned 1
	[0061.628] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.onenotemui.msi.16.en-us.xml") returned 1
	[0061.628] lstrcmpiA (lpString1="", lpString2="C2RManifest.onenotemui.msi.16.en-us.xml") returned -1
	[0061.628] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml") returned="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml"
	[0061.628] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.628] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.628] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.628] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.629] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.onenotemui.msi.16.en-us.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.onenotemui.msi.16.en-us.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.onenotemui.msi.16.en-us.xml"
	[0061.629] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd276bb03, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd276bb03, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd29a7ddb, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", cAlternateFileName="C24EFF~1.XML")) returned 1
	[0061.629] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.629] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml") returned 1
	[0061.629] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml") returned 1
	[0061.629] lstrcmpiA (lpString1="", lpString2="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml") returned -1
	[0061.629] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.onenotemui.msi.16.en-us.xml") returned="C2RManifest.onenotemui.msi.16.en-us.xml"
	[0061.629] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.629] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.629] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.629] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.629] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml"
	[0061.629] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd3593a88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd3593a88, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3678904, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2b28, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.osmmui.msi.16.en-us.xml", cAlternateFileName="C25F09~1.XML")) returned 1
	[0061.629] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.629] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.osmmui.msi.16.en-us.xml") returned 1
	[0061.629] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.osmmui.msi.16.en-us.xml") returned 1
	[0061.629] lstrcmpiA (lpString1="", lpString2="C2RManifest.osmmui.msi.16.en-us.xml") returned -1
	[0061.629] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml") returned="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml"
	[0061.629] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.629] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.629] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.629] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.629] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.osmmui.msi.16.en-us.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.osmmui.msi.16.en-us.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.osmmui.msi.16.en-us.xml"
	[0061.630] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd26acf16, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd26acf16, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd28c2fa3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x906, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", cAlternateFileName="C22C6F~1.XML")) returned 1
	[0061.630] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.630] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml") returned 1
	[0061.630] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml") returned 1
	[0061.630] lstrcmpiA (lpString1="", lpString2="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml") returned -1
	[0061.630] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.osmmui.msi.16.en-us.xml") returned="C2RManifest.osmmui.msi.16.en-us.xml"
	[0061.630] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.630] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.630] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.630] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.630] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml"
	[0061.630] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd356d87a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd356d87a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd362c40f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2b8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.osmuxmui.msi.16.en-us.xml", cAlternateFileName="C21C45~1.XML")) returned 1
	[0061.630] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.630] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.osmuxmui.msi.16.en-us.xml") returned 1
	[0061.630] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.osmuxmui.msi.16.en-us.xml") returned 1
	[0061.630] lstrcmpiA (lpString1="", lpString2="C2RManifest.osmuxmui.msi.16.en-us.xml") returned -1
	[0061.630] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml") returned="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml"
	[0061.630] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.630] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.630] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.630] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.631] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.osmuxmui.msi.16.en-us.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.osmuxmui.msi.16.en-us.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.osmuxmui.msi.16.en-us.xml"
	[0061.631] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd257bc65, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd257bc65, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd276bb03, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17194, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", cAlternateFileName="C29151~1.XML")) returned 1
	[0061.631] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.631] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml") returned 1
	[0061.631] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml") returned 1
	[0061.631] lstrcmpiA (lpString1="", lpString2="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml") returned -1
	[0061.631] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.osmuxmui.msi.16.en-us.xml") returned="C2RManifest.osmuxmui.msi.16.en-us.xml"
	[0061.631] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.631] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.631] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.631] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.631] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml"
	[0061.631] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd36c4db5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd36c4db5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3783951, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17984, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.outlookmui.msi.16.en-us.xml", cAlternateFileName="C2C4E2~1.XML")) returned 1
	[0061.631] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.631] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.outlookmui.msi.16.en-us.xml") returned 1
	[0061.631] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.outlookmui.msi.16.en-us.xml") returned 1
	[0061.631] lstrcmpiA (lpString1="", lpString2="C2RManifest.outlookmui.msi.16.en-us.xml") returned -1
	[0061.631] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml") returned="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml"
	[0061.631] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.631] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.631] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.631] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.631] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.outlookmui.msi.16.en-us.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.outlookmui.msi.16.en-us.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.outlookmui.msi.16.en-us.xml"
	[0061.632] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd257bc65, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd257bc65, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd27de170, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xafddc, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", cAlternateFileName="C280EB~1.XML")) returned 1
	[0061.632] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.632] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml") returned 1
	[0061.632] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml") returned 1
	[0061.632] lstrcmpiA (lpString1="", lpString2="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml") returned -1
	[0061.632] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.outlookmui.msi.16.en-us.xml") returned="C2RManifest.outlookmui.msi.16.en-us.xml"
	[0061.632] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.632] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.632] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.632] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.632] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml"
	[0061.632] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd26acf16, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd26acf16, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd290f4ec, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x195a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", cAlternateFileName="C222CA~1.XML")) returned 1
	[0061.632] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.632] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml") returned 1
	[0061.632] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml") returned 1
	[0061.632] lstrcmpiA (lpString1="", lpString2="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml") returned -1
	[0061.632] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml") returned="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml"
	[0061.632] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.633] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.633] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.633] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.633] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml"
	[0061.633] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd33f011b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd33f011b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd35dffce, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x689e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.powerpointmui.msi.16.en-us.xml", cAlternateFileName="C27FF4~1.XML")) returned 1
	[0061.633] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.633] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.powerpointmui.msi.16.en-us.xml") returned 1
	[0061.633] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.powerpointmui.msi.16.en-us.xml") returned 1
	[0061.633] lstrcmpiA (lpString1="", lpString2="C2RManifest.powerpointmui.msi.16.en-us.xml") returned -1
	[0061.633] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml") returned="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml"
	[0061.633] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.633] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.633] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.633] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.633] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.powerpointmui.msi.16.en-us.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.powerpointmui.msi.16.en-us.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.powerpointmui.msi.16.en-us.xml"
	[0061.634] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b17ac3e, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b17ac3e, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b1a0d3d, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x7446, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Project.Project.x-none.msi.16.x-none.xml", cAlternateFileName="C2E87B~1.XML")) returned 1
	[0061.634] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.634] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.Project.Project.x-none.msi.16.x-none.xml") returned 1
	[0061.634] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.Project.Project.x-none.msi.16.x-none.xml") returned 1
	[0061.634] lstrcmpiA (lpString1="", lpString2="C2RManifest.Project.Project.x-none.msi.16.x-none.xml") returned -1
	[0061.634] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.powerpointmui.msi.16.en-us.xml") returned="C2RManifest.powerpointmui.msi.16.en-us.xml"
	[0061.634] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.634] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.634] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.634] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.634] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.Project.Project.x-none.msi.16.x-none.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml"
	[0061.634] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b2abe77, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b2abe77, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2d20ad, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x809e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.projectmui.msi.16.en-us.xml", cAlternateFileName="C26005~1.XML")) returned 1
	[0061.634] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.634] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.projectmui.msi.16.en-us.xml") returned 1
	[0061.634] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.projectmui.msi.16.en-us.xml") returned 1
	[0061.634] lstrcmpiA (lpString1="", lpString2="C2RManifest.projectmui.msi.16.en-us.xml") returned -1
	[0061.634] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml") returned="C2RManifest.Project.Project.x-none.msi.16.x-none.xml"
	[0061.634] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.634] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.634] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.635] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.635] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.projectmui.msi.16.en-us.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.projectmui.msi.16.en-us.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.projectmui.msi.16.en-us.xml"
	[0061.635] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd375d6d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd375d6d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd397382c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x63ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Proof.Culture.msi.16.en-us.xml", cAlternateFileName="C2B3EB~1.XML")) returned 1
	[0061.635] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.635] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.Proof.Culture.msi.16.en-us.xml") returned 1
	[0061.635] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.Proof.Culture.msi.16.en-us.xml") returned 1
	[0061.635] lstrcmpiA (lpString1="", lpString2="C2RManifest.Proof.Culture.msi.16.en-us.xml") returned -1
	[0061.635] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.projectmui.msi.16.en-us.xml") returned="C2RManifest.projectmui.msi.16.en-us.xml"
	[0061.635] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.635] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.635] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.635] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.635] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.Proof.Culture.msi.16.en-us.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Proof.Culture.msi.16.en-us.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Proof.Culture.msi.16.en-us.xml"
	[0061.635] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd36eafd9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd36eafd9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37a9bb2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5fee, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Proof.Culture.msi.16.es-es.xml", cAlternateFileName="C23127~1.XML")) returned 1
	[0061.635] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.636] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.Proof.Culture.msi.16.es-es.xml") returned 1
	[0061.636] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.Proof.Culture.msi.16.es-es.xml") returned 1
	[0061.636] lstrcmpiA (lpString1="", lpString2="C2RManifest.Proof.Culture.msi.16.es-es.xml") returned -1
	[0061.636] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Proof.Culture.msi.16.en-us.xml") returned="C2RManifest.Proof.Culture.msi.16.en-us.xml"
	[0061.636] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.636] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.636] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.636] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.636] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.Proof.Culture.msi.16.es-es.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Proof.Culture.msi.16.es-es.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Proof.Culture.msi.16.es-es.xml"
	[0061.636] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd38424c0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd38424c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3999a72, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5fee, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Proof.Culture.msi.16.fr-fr.xml", cAlternateFileName="C2BAB3~1.XML")) returned 1
	[0061.636] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.636] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.Proof.Culture.msi.16.fr-fr.xml") returned 1
	[0061.636] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.Proof.Culture.msi.16.fr-fr.xml") returned 1
	[0061.636] lstrcmpiA (lpString1="", lpString2="C2RManifest.Proof.Culture.msi.16.fr-fr.xml") returned -1
	[0061.636] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Proof.Culture.msi.16.es-es.xml") returned="C2RManifest.Proof.Culture.msi.16.es-es.xml"
	[0061.636] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.636] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.636] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.636] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.637] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.Proof.Culture.msi.16.fr-fr.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml"
	[0061.637] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd36c4db5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd36c4db5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37f6035, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.proofing.msi.16.en-us.xml", cAlternateFileName="C24618~1.XML")) returned 1
	[0061.637] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.637] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.proofing.msi.16.en-us.xml") returned 1
	[0061.637] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.proofing.msi.16.en-us.xml") returned 1
	[0061.637] lstrcmpiA (lpString1="", lpString2="C2RManifest.proofing.msi.16.en-us.xml") returned -1
	[0061.637] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml") returned="C2RManifest.Proof.Culture.msi.16.fr-fr.xml"
	[0061.637] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.637] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.637] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.637] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.637] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.proofing.msi.16.en-us.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.proofing.msi.16.en-us.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.proofing.msi.16.en-us.xml"
	[0061.637] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd295b9b9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd295b9b9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2b97d2d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", cAlternateFileName="C2C6D1~1.XML")) returned 1
	[0061.637] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.663] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml") returned 1
	[0061.663] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml") returned 1
	[0061.663] lstrcmpiA (lpString1="", lpString2="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml") returned -1
	[0061.663] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.proofing.msi.16.en-us.xml") returned="C2RManifest.proofing.msi.16.en-us.xml"
	[0061.663] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.663] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.663] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.663] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.663] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml"
	[0061.664] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd362c40f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd362c40f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37374c5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.publishermui.msi.16.en-us.xml", cAlternateFileName="C26B0A~1.XML")) returned 1
	[0061.664] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.664] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.publishermui.msi.16.en-us.xml") returned 1
	[0061.664] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.publishermui.msi.16.en-us.xml") returned 1
	[0061.664] lstrcmpiA (lpString1="", lpString2="C2RManifest.publishermui.msi.16.en-us.xml") returned -1
	[0061.664] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml") returned="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml"
	[0061.664] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.664] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.664] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.664] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.664] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.publishermui.msi.16.en-us.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.publishermui.msi.16.en-us.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.publishermui.msi.16.en-us.xml"
	[0061.664] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd28c2fa3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd28c2fa3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd29ce0e8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb27ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.shared.Office.x-none.msi.16.x-none.xml", cAlternateFileName="C2A7B5~1.XML")) returned 1
	[0061.665] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.665] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.shared.Office.x-none.msi.16.x-none.xml") returned 1
	[0061.665] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.shared.Office.x-none.msi.16.x-none.xml") returned 1
	[0061.665] lstrcmpiA (lpString1="", lpString2="C2RManifest.shared.Office.x-none.msi.16.x-none.xml") returned -1
	[0061.665] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.publishermui.msi.16.en-us.xml") returned="C2RManifest.publishermui.msi.16.en-us.xml"
	[0061.665] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.665] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.665] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.665] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.665] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.shared.Office.x-none.msi.16.x-none.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml"
	[0061.665] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1159842, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1159842, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x11cbd0e, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x2aafe, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", cAlternateFileName="C2668D~1.XML")) returned 1
	[0061.665] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.665] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml") returned 1
	[0061.665] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml") returned 1
	[0061.665] lstrcmpiA (lpString1="", lpString2="C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml") returned -1
	[0061.665] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml") returned="C2RManifest.shared.Office.x-none.msi.16.x-none.xml"
	[0061.665] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.665] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.665] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.665] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.665] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml"
	[0061.665] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1159842, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1159842, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1218203, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xf0cb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.visiomui.msi.16.en-us.xml", cAlternateFileName="C2A712~1.XML")) returned 1
	[0061.665] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.666] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.visiomui.msi.16.en-us.xml") returned 1
	[0061.666] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.visiomui.msi.16.en-us.xml") returned 1
	[0061.666] lstrcmpiA (lpString1="", lpString2="C2RManifest.visiomui.msi.16.en-us.xml") returned -1
	[0061.666] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml") returned="C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml"
	[0061.666] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.666] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.666] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.666] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.666] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.visiomui.msi.16.en-us.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.visiomui.msi.16.en-us.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.visiomui.msi.16.en-us.xml"
	[0061.666] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd2c30669, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2c30669, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2dd401b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1536e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Word.Word.x-none.msi.16.x-none.xml", cAlternateFileName="C29B2F~1.XML")) returned 1
	[0061.666] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.666] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.Word.Word.x-none.msi.16.x-none.xml") returned 1
	[0061.666] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.Word.Word.x-none.msi.16.x-none.xml") returned 1
	[0061.666] lstrcmpiA (lpString1="", lpString2="C2RManifest.Word.Word.x-none.msi.16.x-none.xml") returned -1
	[0061.666] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.visiomui.msi.16.en-us.xml") returned="C2RManifest.visiomui.msi.16.en-us.xml"
	[0061.666] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.666] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.666] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.666] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.666] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.Word.Word.x-none.msi.16.x-none.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml"
	[0061.666] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd39e5e8b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd39e5e8b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3a7e818, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x130fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.wordmui.msi.16.en-us.xml", cAlternateFileName="C2EB7A~1.XML")) returned 1
	[0061.666] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.666] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="C2RManifest.wordmui.msi.16.en-us.xml") returned 1
	[0061.666] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="C2RManifest.wordmui.msi.16.en-us.xml") returned 1
	[0061.667] lstrcmpiA (lpString1="", lpString2="C2RManifest.wordmui.msi.16.en-us.xml") returned -1
	[0061.667] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml") returned="C2RManifest.Word.Word.x-none.msi.16.x-none.xml"
	[0061.667] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.667] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.667] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.667] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.667] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="C2RManifest.wordmui.msi.16.en-us.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.wordmui.msi.16.en-us.xml") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.wordmui.msi.16.en-us.xml"
	[0061.667] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46742519, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x75f1db39, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x46742519, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x39e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW-TO-DECRYPT-FILES.HTM", cAlternateFileName="HOW-TO~1.HTM")) returned 1
	[0061.667] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.667] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="HOW-TO-DECRYPT-FILES.HTM") returned -1
	[0061.667] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="HOW-TO-DECRYPT-FILES.HTM") returned 0
	[0061.667] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd2c30669, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2c30669, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2dfa2a2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12c470, dwReserved0=0x0, dwReserved1=0x0, cFileName="Integrator.exe", cAlternateFileName="INTEGR~1.EXE")) returned 1
	[0061.667] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.667] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Integrator.exe") returned -1
	[0061.667] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Integrator.exe") returned -1
	[0061.667] lstrcmpiA (lpString1="", lpString2="Integrator.exe") returned -1
	[0061.667] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.wordmui.msi.16.en-us.xml") returned="C2RManifest.wordmui.msi.16.en-us.xml"
	[0061.667] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.667] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.667] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.667] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.667] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="Integrator.exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe"
	[0061.667] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf073ddf4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1158e0a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x128ed2a1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6e22a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDriveSetup.exe", cAlternateFileName="ONEDRI~1.EXE")) returned 1
	[0061.667] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.667] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="OneDriveSetup.exe") returned -1
	[0061.667] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="OneDriveSetup.exe") returned -1
	[0061.667] lstrcmpiA (lpString1="", lpString2="OneDriveSetup.exe") returned -1
	[0061.668] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe") returned="Integrator.exe"
	[0061.668] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.668] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.668] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.668] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.668] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="OneDriveSetup.exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe"
	[0061.668] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xef3b8917, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xef3b8917, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xef4774a9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x18ad800, dwReserved0=0x0, dwReserved1=0x0, cFileName="QFE31927.msp", cAlternateFileName="")) returned 1
	[0061.668] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.668] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="QFE31927.msp") returned -1
	[0061.668] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="QFE31927.msp") returned -1
	[0061.668] lstrcmpiA (lpString1="", lpString2="QFE31927.msp") returned -1
	[0061.668] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned="OneDriveSetup.exe"
	[0061.668] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.668] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.668] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.668] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.668] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="QFE31927.msp" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp"
	[0061.668] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee75a612, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee75a612, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xef109ec5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x18ad800, dwReserved0=0x0, dwReserved1=0x0, cFileName="QFE31928.msp", cAlternateFileName="")) returned 1
	[0061.668] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.668] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="QFE31928.msp") returned -1
	[0061.668] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="QFE31928.msp") returned -1
	[0061.668] lstrcmpiA (lpString1="", lpString2="QFE31928.msp") returned -1
	[0061.668] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp") returned="QFE31927.msp"
	[0061.668] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.668] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.668] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.669] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.669] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="QFE31928.msp" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp"
	[0061.669] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd44a0845, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd44a0845, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd455f44d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xc0e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPPRedist.msi", cAlternateFileName="SPPRED~1.MSI")) returned 1
	[0061.669] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.669] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SPPRedist.msi") returned -1
	[0061.669] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SPPRedist.msi") returned -1
	[0061.669] lstrcmpiA (lpString1="", lpString2="SPPRedist.msi") returned -1
	[0061.669] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp") returned="QFE31928.msp"
	[0061.669] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.669] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.669] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.669] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.669] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="SPPRedist.msi" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi"
	[0061.669] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x51c07e2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x51c07e2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x51c07e2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xfa976, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1
	[0061.669] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.669] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Windows6.1-KB2999226-x64.msu") returned -1
	[0061.669] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Windows6.1-KB2999226-x64.msu") returned -1
	[0061.669] lstrcmpiA (lpString1="", lpString2="Windows6.1-KB2999226-x64.msu") returned -1
	[0061.669] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned="SPPRedist.msi"
	[0061.669] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.669] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.669] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.669] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.670] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="Windows6.1-KB2999226-x64.msu" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu"
	[0061.670] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6c46ba0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6c46ba0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c46ba0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x97da2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB2999226-x86.msu", cAlternateFileName="WI4D05~1.MSU")) returned 1
	[0061.670] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.670] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Windows6.1-KB2999226-x86.msu") returned -1
	[0061.670] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Windows6.1-KB2999226-x86.msu") returned -1
	[0061.670] lstrcmpiA (lpString1="", lpString2="Windows6.1-KB2999226-x86.msu") returned -1
	[0061.670] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned="Windows6.1-KB2999226-x64.msu"
	[0061.670] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.670] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.670] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.670] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.670] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="Windows6.1-KB2999226-x86.msu" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu"
	[0061.670] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x59b433, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x59b433, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5c164a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14902e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows8-RT-KB2999226-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1
	[0061.670] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.670] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Windows8-RT-KB2999226-x64.msu") returned -1
	[0061.670] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Windows8-RT-KB2999226-x64.msu") returned -1
	[0061.670] lstrcmpiA (lpString1="", lpString2="Windows8-RT-KB2999226-x64.msu") returned -1
	[0061.670] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned="Windows6.1-KB2999226-x86.msu"
	[0061.670] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.670] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.670] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.670] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.670] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="Windows8-RT-KB2999226-x64.msu" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu"
	[0061.670] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6d50bdc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6d50bdc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6d50bdc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x96388, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows8-RT-KB2999226-x86.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1
	[0061.671] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.671] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Windows8-RT-KB2999226-x86.msu") returned -1
	[0061.671] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Windows8-RT-KB2999226-x86.msu") returned -1
	[0061.671] lstrcmpiA (lpString1="", lpString2="Windows8-RT-KB2999226-x86.msu") returned -1
	[0061.671] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned="Windows8-RT-KB2999226-x64.msu"
	[0061.671] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.671] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.671] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.671] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.671] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="Windows8-RT-KB2999226-x86.msu" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu"
	[0061.671] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5f9c329, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5f9c329, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5fc257f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf2d1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows8.1-KB2999226-x64.msu", cAlternateFileName="WI2C39~1.MSU")) returned 1
	[0061.671] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.671] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Windows8.1-KB2999226-x64.msu") returned -1
	[0061.671] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Windows8.1-KB2999226-x64.msu") returned -1
	[0061.671] lstrcmpiA (lpString1="", lpString2="Windows8.1-KB2999226-x64.msu") returned -1
	[0061.671] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned="Windows8-RT-KB2999226-x86.msu"
	[0061.671] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.671] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.671] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.671] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.671] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="Windows8.1-KB2999226-x64.msu" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu"
	[0061.671] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf7c37773, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf7c37773, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7c37773, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x91809, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows8.1-KB2999226-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1
	[0061.671] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.671] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Windows8.1-KB2999226-x86.msu") returned -1
	[0061.671] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Windows8.1-KB2999226-x86.msu") returned -1
	[0061.671] lstrcmpiA (lpString1="", lpString2="Windows8.1-KB2999226-x86.msu") returned -1
	[0061.671] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned="Windows8.1-KB2999226-x64.msu"
	[0061.672] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\"
	[0061.672] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned=""
	[0061.672] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.672] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\integration\\how-to-decrypt-files.htm")) returned 0x20
	[0061.672] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\", lpString2="Windows8.1-KB2999226-x86.msu" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu"
	[0061.672] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf7c37773, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf7c37773, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7c37773, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x91809, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows8.1-KB2999226-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 0
	[0061.672] FindClose (in: hFindFile=0x7cb850 | out: hFindFile=0x7cb850) returned 1
	[0061.672] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2687c83, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee308135, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7bf178, dwReserved1=0x7d7d78, cFileName="Licenses16", cAlternateFileName="LICENS~1")) returned 1
	[0061.672] lstrcmpA (lpString1=".", lpString2="Licenses16") returned -1
	[0061.672] lstrcmpA (lpString1="..", lpString2="Licenses16") returned -1
	[0061.672] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\*.*") returned="*.*"
	[0061.672] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\", lpString2="Licenses16" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16"
	[0061.672] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2687c83, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee308135, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbc50
	[0061.674] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0061.674] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2687c83, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee308135, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.678] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0061.678] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0061.678] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe282b673, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe282b673, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe2910498, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5127, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessR_Grace-ppd.xrm-ms", cAlternateFileName="ACCESS~3.XRM")) returned 1
	[0061.678] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.678] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="AccessR_Grace-ppd.xrm-ms") returned 1
	[0061.678] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="AccessR_Grace-ppd.xrm-ms") returned 1
	[0061.678] lstrcmpiA (lpString1="", lpString2="AccessR_Grace-ppd.xrm-ms") returned -1
	[0061.678] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\*.*") returned="*.*"
	[0061.678] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0061.678] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0061.678] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.678] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0061.679] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0061.679] WriteFile (in: hFile=0x210, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0061.680] SetFileTime (hFile=0x210, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0061.680] CloseHandle (hObject=0x210) returned 1
	[0061.680] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="AccessR_Grace-ppd.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms"
	[0061.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.zip") returned 0
	[0061.680] lstrlenA (lpString="*.zip") returned 5
	[0061.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.rar") returned 0
	[0061.681] lstrlenA (lpString="*.rar") returned 5
	[0061.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.7z") returned 0
	[0061.681] lstrlenA (lpString="*.7z") returned 4
	[0061.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.tar") returned 0
	[0061.681] lstrlenA (lpString="*.tar") returned 5
	[0061.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.gzip") returned 0
	[0061.681] lstrlenA (lpString="*.gzip") returned 6
	[0061.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.jpg") returned 0
	[0061.681] lstrlenA (lpString="*.jpg") returned 5
	[0061.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.jpeg") returned 0
	[0061.681] lstrlenA (lpString="*.jpeg") returned 6
	[0061.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.bmp") returned 0
	[0061.681] lstrlenA (lpString="*.bmp") returned 5
	[0061.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.gif") returned 0
	[0061.681] lstrlenA (lpString="*.gif") returned 5
	[0061.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.png") returned 0
	[0061.681] lstrlenA (lpString="*.png") returned 5
	[0061.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.doc") returned 0
	[0061.681] lstrlenA (lpString="*.doc") returned 5
	[0061.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.docx") returned 0
	[0061.681] lstrlenA (lpString="*.docx") returned 6
	[0061.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.xls") returned 0
	[0061.681] lstrlenA (lpString="*.xls") returned 5
	[0061.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.xlsx") returned 0
	[0061.681] lstrlenA (lpString="*.xlsx") returned 6
	[0061.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.ppt") returned 0
	[0061.681] lstrlenA (lpString="*.ppt") returned 5
	[0061.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.pptx") returned 0
	[0061.681] lstrlenA (lpString="*.pptx") returned 6
	[0061.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.txt") returned 0
	[0061.681] lstrlenA (lpString="*.txt") returned 5
	[0061.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.pdf") returned 0
	[0061.681] lstrlenA (lpString="*.pdf") returned 5
	[0061.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.htm") returned 0
	[0061.681] lstrlenA (lpString="*.htm") returned 5
	[0061.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.html") returned 0
	[0061.682] lstrlenA (lpString="*.html") returned 6
	[0061.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.mdb") returned 0
	[0061.682] lstrlenA (lpString="*.mdb") returned 5
	[0061.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.pfx") returned 0
	[0061.682] lstrlenA (lpString="*.pfx") returned 5
	[0061.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.md") returned 0
	[0061.682] lstrlenA (lpString="*.md") returned 4
	[0061.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.lnk") returned 0
	[0061.682] lstrlenA (lpString="*.lnk") returned 5
	[0061.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.torrent") returned 0
	[0061.682] lstrlenA (lpString="*.torrent") returned 9
	[0061.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.mov") returned 0
	[0061.682] lstrlenA (lpString="*.mov") returned 5
	[0061.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.3gp") returned 0
	[0061.682] lstrlenA (lpString="*.3gp") returned 5
	[0061.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.mpeg") returned 0
	[0061.682] lstrlenA (lpString="*.mpeg") returned 6
	[0061.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.mpg") returned 0
	[0061.682] lstrlenA (lpString="*.mpg") returned 5
	[0061.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.flv") returned 0
	[0061.682] lstrlenA (lpString="*.flv") returned 5
	[0061.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.avi") returned 0
	[0061.682] lstrlenA (lpString="*.avi") returned 5
	[0061.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.mp4") returned 0
	[0061.682] lstrlenA (lpString="*.mp4") returned 5
	[0061.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.wmv") returned 0
	[0061.682] lstrlenA (lpString="*.wmv") returned 5
	[0061.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.mkv") returned 0
	[0061.682] lstrlenA (lpString="*.mkv") returned 5
	[0061.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.mp3") returned 0
	[0061.682] lstrlenA (lpString="*.mp3") returned 5
	[0061.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.wav") returned 0
	[0061.682] lstrlenA (lpString="*.wav") returned 5
	[0061.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.flac") returned 0
	[0061.682] lstrlenA (lpString="*.flac") returned 6
	[0061.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.wma") returned 0
	[0061.683] lstrlenA (lpString="*.wma") returned 5
	[0061.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.au3") returned 0
	[0061.683] lstrlenA (lpString="*.au3") returned 5
	[0061.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.ahk") returned 0
	[0061.683] lstrlenA (lpString="*.ahk") returned 5
	[0061.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.c") returned 0
	[0061.683] lstrlenA (lpString="*.c") returned 3
	[0061.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.cc") returned 0
	[0061.683] lstrlenA (lpString="*.cc") returned 4
	[0061.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.cpp") returned 0
	[0061.683] lstrlenA (lpString="*.cpp") returned 5
	[0061.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.cxx") returned 0
	[0061.683] lstrlenA (lpString="*.cxx") returned 5
	[0061.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.c++") returned 0
	[0061.683] lstrlenA (lpString="*.c++") returned 5
	[0061.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.cs") returned 0
	[0061.683] lstrlenA (lpString="*.cs") returned 4
	[0061.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.vb") returned 0
	[0061.683] lstrlenA (lpString="*.vb") returned 4
	[0061.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.bas") returned 0
	[0061.683] lstrlenA (lpString="*.bas") returned 5
	[0061.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.csproj") returned 0
	[0061.683] lstrlenA (lpString="*.csproj") returned 8
	[0061.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.vbproj") returned 0
	[0061.683] lstrlenA (lpString="*.vbproj") returned 8
	[0061.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.vcxproj") returned 0
	[0061.683] lstrlenA (lpString="*.vcxproj") returned 9
	[0061.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.manifest") returned 0
	[0061.683] lstrlenA (lpString="*.manifest") returned 10
	[0061.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.php") returned 0
	[0061.683] lstrlenA (lpString="*.php") returned 5
	[0061.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.vbe") returned 0
	[0061.683] lstrlenA (lpString="*.vbe") returned 5
	[0061.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.vba") returned 0
	[0061.683] lstrlenA (lpString="*.vba") returned 5
	[0061.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.vbs") returned 0
	[0061.684] lstrlenA (lpString="*.vbs") returned 5
	[0061.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.bat") returned 0
	[0061.684] lstrlenA (lpString="*.bat") returned 5
	[0061.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.cmd") returned 0
	[0061.684] lstrlenA (lpString="*.cmd") returned 5
	[0061.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.js") returned 0
	[0061.684] lstrlenA (lpString="*.js") returned 4
	[0061.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.jscript") returned 0
	[0061.684] lstrlenA (lpString="*.jscript") returned 9
	[0061.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.hta") returned 0
	[0061.684] lstrlenA (lpString="*.hta") returned 5
	[0061.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.php7") returned 0
	[0061.684] lstrlenA (lpString="*.php7") returned 6
	[0061.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.db") returned 0
	[0061.684] lstrlenA (lpString="*.db") returned 4
	[0061.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.swf") returned 0
	[0061.684] lstrlenA (lpString="*.swf") returned 5
	[0061.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.eml") returned 0
	[0061.684] lstrlenA (lpString="*.eml") returned 5
	[0061.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.part") returned 0
	[0061.684] lstrlenA (lpString="*.part") returned 6
	[0061.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.nfo") returned 0
	[0061.684] lstrlenA (lpString="*.nfo") returned 5
	[0061.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.rsa") returned 0
	[0061.684] lstrlenA (lpString="*.rsa") returned 5
	[0061.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.key") returned 0
	[0061.684] lstrlenA (lpString="*.key") returned 5
	[0061.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.aes") returned 0
	[0061.684] lstrlenA (lpString="*.aes") returned 5
	[0061.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.blob") returned 0
	[0061.684] lstrlenA (lpString="*.blob") returned 6
	[0061.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.btc") returned 0
	[0061.684] lstrlenA (lpString="*.btc") returned 5
	[0061.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms", pszSpec="*.wallet") returned 0
	[0061.684] lstrlenA (lpString="*.wallet") returned 8
	[0061.684] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe274684a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe274684a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe289dd92, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessR_Grace-ul-oob.xrm-ms", cAlternateFileName="ACCESS~2.XRM")) returned 1
	[0061.685] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.685] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="AccessR_Grace-ul-oob.xrm-ms") returned 1
	[0061.685] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="AccessR_Grace-ul-oob.xrm-ms") returned 1
	[0061.685] lstrcmpiA (lpString1="", lpString2="AccessR_Grace-ul-oob.xrm-ms") returned -1
	[0061.685] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned="AccessR_Grace-ppd.xrm-ms"
	[0061.685] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0061.685] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0061.685] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.685] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0061.685] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="AccessR_Grace-ul-oob.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms"
	[0061.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.zip") returned 0
	[0061.685] lstrlenA (lpString="*.zip") returned 5
	[0061.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.rar") returned 0
	[0061.685] lstrlenA (lpString="*.rar") returned 5
	[0061.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.7z") returned 0
	[0061.685] lstrlenA (lpString="*.7z") returned 4
	[0061.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.tar") returned 0
	[0061.685] lstrlenA (lpString="*.tar") returned 5
	[0061.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.gzip") returned 0
	[0061.685] lstrlenA (lpString="*.gzip") returned 6
	[0061.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.jpg") returned 0
	[0061.686] lstrlenA (lpString="*.jpg") returned 5
	[0061.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.jpeg") returned 0
	[0061.686] lstrlenA (lpString="*.jpeg") returned 6
	[0061.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.bmp") returned 0
	[0061.686] lstrlenA (lpString="*.bmp") returned 5
	[0061.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.gif") returned 0
	[0061.686] lstrlenA (lpString="*.gif") returned 5
	[0061.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.png") returned 0
	[0061.686] lstrlenA (lpString="*.png") returned 5
	[0061.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.doc") returned 0
	[0061.686] lstrlenA (lpString="*.doc") returned 5
	[0061.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.docx") returned 0
	[0061.686] lstrlenA (lpString="*.docx") returned 6
	[0061.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.xls") returned 0
	[0061.686] lstrlenA (lpString="*.xls") returned 5
	[0061.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.xlsx") returned 0
	[0061.686] lstrlenA (lpString="*.xlsx") returned 6
	[0061.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.ppt") returned 0
	[0061.686] lstrlenA (lpString="*.ppt") returned 5
	[0061.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.pptx") returned 0
	[0061.686] lstrlenA (lpString="*.pptx") returned 6
	[0061.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.txt") returned 0
	[0061.686] lstrlenA (lpString="*.txt") returned 5
	[0061.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.pdf") returned 0
	[0061.686] lstrlenA (lpString="*.pdf") returned 5
	[0061.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.htm") returned 0
	[0061.686] lstrlenA (lpString="*.htm") returned 5
	[0061.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.html") returned 0
	[0061.686] lstrlenA (lpString="*.html") returned 6
	[0061.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.mdb") returned 0
	[0061.686] lstrlenA (lpString="*.mdb") returned 5
	[0061.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.pfx") returned 0
	[0061.686] lstrlenA (lpString="*.pfx") returned 5
	[0061.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.md") returned 0
	[0061.686] lstrlenA (lpString="*.md") returned 4
	[0061.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.lnk") returned 0
	[0061.687] lstrlenA (lpString="*.lnk") returned 5
	[0061.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.torrent") returned 0
	[0061.687] lstrlenA (lpString="*.torrent") returned 9
	[0061.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.mov") returned 0
	[0061.687] lstrlenA (lpString="*.mov") returned 5
	[0061.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.3gp") returned 0
	[0061.687] lstrlenA (lpString="*.3gp") returned 5
	[0061.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.mpeg") returned 0
	[0061.687] lstrlenA (lpString="*.mpeg") returned 6
	[0061.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.mpg") returned 0
	[0061.687] lstrlenA (lpString="*.mpg") returned 5
	[0061.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.flv") returned 0
	[0061.687] lstrlenA (lpString="*.flv") returned 5
	[0061.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.avi") returned 0
	[0061.687] lstrlenA (lpString="*.avi") returned 5
	[0061.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.mp4") returned 0
	[0061.687] lstrlenA (lpString="*.mp4") returned 5
	[0061.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.wmv") returned 0
	[0061.687] lstrlenA (lpString="*.wmv") returned 5
	[0061.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.mkv") returned 0
	[0061.687] lstrlenA (lpString="*.mkv") returned 5
	[0061.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.mp3") returned 0
	[0061.687] lstrlenA (lpString="*.mp3") returned 5
	[0061.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.wav") returned 0
	[0061.687] lstrlenA (lpString="*.wav") returned 5
	[0061.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.flac") returned 0
	[0061.687] lstrlenA (lpString="*.flac") returned 6
	[0061.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.wma") returned 0
	[0061.687] lstrlenA (lpString="*.wma") returned 5
	[0061.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.au3") returned 0
	[0061.687] lstrlenA (lpString="*.au3") returned 5
	[0061.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.ahk") returned 0
	[0061.687] lstrlenA (lpString="*.ahk") returned 5
	[0061.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.c") returned 0
	[0061.687] lstrlenA (lpString="*.c") returned 3
	[0061.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.cc") returned 0
	[0061.688] lstrlenA (lpString="*.cc") returned 4
	[0061.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.cpp") returned 0
	[0061.688] lstrlenA (lpString="*.cpp") returned 5
	[0061.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.cxx") returned 0
	[0061.688] lstrlenA (lpString="*.cxx") returned 5
	[0061.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.c++") returned 0
	[0061.688] lstrlenA (lpString="*.c++") returned 5
	[0061.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.cs") returned 0
	[0061.688] lstrlenA (lpString="*.cs") returned 4
	[0061.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.vb") returned 0
	[0061.688] lstrlenA (lpString="*.vb") returned 4
	[0061.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.bas") returned 0
	[0061.688] lstrlenA (lpString="*.bas") returned 5
	[0061.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.csproj") returned 0
	[0061.688] lstrlenA (lpString="*.csproj") returned 8
	[0061.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.vbproj") returned 0
	[0061.688] lstrlenA (lpString="*.vbproj") returned 8
	[0061.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.vcxproj") returned 0
	[0061.688] lstrlenA (lpString="*.vcxproj") returned 9
	[0061.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.manifest") returned 0
	[0061.688] lstrlenA (lpString="*.manifest") returned 10
	[0061.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.php") returned 0
	[0061.688] lstrlenA (lpString="*.php") returned 5
	[0061.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.vbe") returned 0
	[0061.688] lstrlenA (lpString="*.vbe") returned 5
	[0061.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.vba") returned 0
	[0061.688] lstrlenA (lpString="*.vba") returned 5
	[0061.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.vbs") returned 0
	[0061.688] lstrlenA (lpString="*.vbs") returned 5
	[0061.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.bat") returned 0
	[0061.688] lstrlenA (lpString="*.bat") returned 5
	[0061.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.cmd") returned 0
	[0061.688] lstrlenA (lpString="*.cmd") returned 5
	[0061.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.js") returned 0
	[0061.688] lstrlenA (lpString="*.js") returned 4
	[0061.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.jscript") returned 0
	[0061.688] lstrlenA (lpString="*.jscript") returned 9
	[0061.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.hta") returned 0
	[0061.689] lstrlenA (lpString="*.hta") returned 5
	[0061.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.php7") returned 0
	[0061.689] lstrlenA (lpString="*.php7") returned 6
	[0061.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.db") returned 0
	[0061.689] lstrlenA (lpString="*.db") returned 4
	[0061.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.swf") returned 0
	[0061.689] lstrlenA (lpString="*.swf") returned 5
	[0061.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.eml") returned 0
	[0061.689] lstrlenA (lpString="*.eml") returned 5
	[0061.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.part") returned 0
	[0061.689] lstrlenA (lpString="*.part") returned 6
	[0061.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.nfo") returned 0
	[0061.689] lstrlenA (lpString="*.nfo") returned 5
	[0061.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.rsa") returned 0
	[0061.689] lstrlenA (lpString="*.rsa") returned 5
	[0061.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.key") returned 0
	[0061.689] lstrlenA (lpString="*.key") returned 5
	[0061.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.aes") returned 0
	[0061.689] lstrlenA (lpString="*.aes") returned 5
	[0061.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.blob") returned 0
	[0061.689] lstrlenA (lpString="*.blob") returned 6
	[0061.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.btc") returned 0
	[0061.689] lstrlenA (lpString="*.btc") returned 5
	[0061.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms", pszSpec="*.wallet") returned 0
	[0061.689] lstrlenA (lpString="*.wallet") returned 8
	[0061.689] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe274684a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe274684a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe28c3fe1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x298f, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessR_OEM_Perp-pl.xrm-ms", cAlternateFileName="ACCESS~1.XRM")) returned 1
	[0061.689] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.689] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="AccessR_OEM_Perp-pl.xrm-ms") returned 1
	[0061.689] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="AccessR_OEM_Perp-pl.xrm-ms") returned 1
	[0061.689] lstrcmpiA (lpString1="", lpString2="AccessR_OEM_Perp-pl.xrm-ms") returned -1
	[0061.689] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned="AccessR_Grace-ul-oob.xrm-ms"
	[0061.689] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0061.689] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0061.689] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.689] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0061.690] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="AccessR_OEM_Perp-pl.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms"
	[0061.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.zip") returned 0
	[0061.690] lstrlenA (lpString="*.zip") returned 5
	[0061.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.rar") returned 0
	[0061.690] lstrlenA (lpString="*.rar") returned 5
	[0061.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.7z") returned 0
	[0061.690] lstrlenA (lpString="*.7z") returned 4
	[0061.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.tar") returned 0
	[0061.690] lstrlenA (lpString="*.tar") returned 5
	[0061.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.gzip") returned 0
	[0061.690] lstrlenA (lpString="*.gzip") returned 6
	[0061.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.jpg") returned 0
	[0061.690] lstrlenA (lpString="*.jpg") returned 5
	[0061.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.jpeg") returned 0
	[0061.690] lstrlenA (lpString="*.jpeg") returned 6
	[0061.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.bmp") returned 0
	[0061.690] lstrlenA (lpString="*.bmp") returned 5
	[0061.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.gif") returned 0
	[0061.690] lstrlenA (lpString="*.gif") returned 5
	[0061.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.png") returned 0
	[0061.690] lstrlenA (lpString="*.png") returned 5
	[0061.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.doc") returned 0
	[0061.690] lstrlenA (lpString="*.doc") returned 5
	[0061.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.docx") returned 0
	[0061.690] lstrlenA (lpString="*.docx") returned 6
	[0061.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.xls") returned 0
	[0061.690] lstrlenA (lpString="*.xls") returned 5
	[0061.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.xlsx") returned 0
	[0061.690] lstrlenA (lpString="*.xlsx") returned 6
	[0061.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.ppt") returned 0
	[0061.690] lstrlenA (lpString="*.ppt") returned 5
	[0061.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.pptx") returned 0
	[0061.690] lstrlenA (lpString="*.pptx") returned 6
	[0061.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.txt") returned 0
	[0061.690] lstrlenA (lpString="*.txt") returned 5
	[0061.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.pdf") returned 0
	[0061.690] lstrlenA (lpString="*.pdf") returned 5
	[0061.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.htm") returned 0
	[0061.691] lstrlenA (lpString="*.htm") returned 5
	[0061.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.html") returned 0
	[0061.691] lstrlenA (lpString="*.html") returned 6
	[0061.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.mdb") returned 0
	[0061.691] lstrlenA (lpString="*.mdb") returned 5
	[0061.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.pfx") returned 0
	[0061.691] lstrlenA (lpString="*.pfx") returned 5
	[0061.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.md") returned 0
	[0061.691] lstrlenA (lpString="*.md") returned 4
	[0061.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.lnk") returned 0
	[0061.691] lstrlenA (lpString="*.lnk") returned 5
	[0061.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.torrent") returned 0
	[0061.691] lstrlenA (lpString="*.torrent") returned 9
	[0061.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.mov") returned 0
	[0061.691] lstrlenA (lpString="*.mov") returned 5
	[0061.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.3gp") returned 0
	[0061.691] lstrlenA (lpString="*.3gp") returned 5
	[0061.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.mpeg") returned 0
	[0061.691] lstrlenA (lpString="*.mpeg") returned 6
	[0061.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.mpg") returned 0
	[0061.691] lstrlenA (lpString="*.mpg") returned 5
	[0061.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.flv") returned 0
	[0061.691] lstrlenA (lpString="*.flv") returned 5
	[0061.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.avi") returned 0
	[0061.691] lstrlenA (lpString="*.avi") returned 5
	[0061.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.mp4") returned 0
	[0061.691] lstrlenA (lpString="*.mp4") returned 5
	[0061.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.wmv") returned 0
	[0061.691] lstrlenA (lpString="*.wmv") returned 5
	[0061.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.mkv") returned 0
	[0061.691] lstrlenA (lpString="*.mkv") returned 5
	[0061.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.mp3") returned 0
	[0061.691] lstrlenA (lpString="*.mp3") returned 5
	[0061.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.wav") returned 0
	[0061.691] lstrlenA (lpString="*.wav") returned 5
	[0061.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.flac") returned 0
	[0061.691] lstrlenA (lpString="*.flac") returned 6
	[0061.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.wma") returned 0
	[0061.692] lstrlenA (lpString="*.wma") returned 5
	[0061.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.au3") returned 0
	[0061.692] lstrlenA (lpString="*.au3") returned 5
	[0061.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.ahk") returned 0
	[0061.692] lstrlenA (lpString="*.ahk") returned 5
	[0061.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.c") returned 0
	[0061.692] lstrlenA (lpString="*.c") returned 3
	[0061.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.cc") returned 0
	[0061.692] lstrlenA (lpString="*.cc") returned 4
	[0061.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.cpp") returned 0
	[0061.692] lstrlenA (lpString="*.cpp") returned 5
	[0061.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.cxx") returned 0
	[0061.692] lstrlenA (lpString="*.cxx") returned 5
	[0061.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.c++") returned 0
	[0061.692] lstrlenA (lpString="*.c++") returned 5
	[0061.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.cs") returned 0
	[0061.692] lstrlenA (lpString="*.cs") returned 4
	[0061.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.vb") returned 0
	[0061.692] lstrlenA (lpString="*.vb") returned 4
	[0061.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.bas") returned 0
	[0061.692] lstrlenA (lpString="*.bas") returned 5
	[0061.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.csproj") returned 0
	[0061.692] lstrlenA (lpString="*.csproj") returned 8
	[0061.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.vbproj") returned 0
	[0061.692] lstrlenA (lpString="*.vbproj") returned 8
	[0061.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.vcxproj") returned 0
	[0061.692] lstrlenA (lpString="*.vcxproj") returned 9
	[0061.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.manifest") returned 0
	[0061.692] lstrlenA (lpString="*.manifest") returned 10
	[0061.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.php") returned 0
	[0061.692] lstrlenA (lpString="*.php") returned 5
	[0061.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.vbe") returned 0
	[0061.692] lstrlenA (lpString="*.vbe") returned 5
	[0061.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.vba") returned 0
	[0061.692] lstrlenA (lpString="*.vba") returned 5
	[0061.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.vbs") returned 0
	[0061.693] lstrlenA (lpString="*.vbs") returned 5
	[0061.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.bat") returned 0
	[0061.693] lstrlenA (lpString="*.bat") returned 5
	[0061.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.cmd") returned 0
	[0061.693] lstrlenA (lpString="*.cmd") returned 5
	[0061.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.js") returned 0
	[0061.693] lstrlenA (lpString="*.js") returned 4
	[0061.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.jscript") returned 0
	[0061.693] lstrlenA (lpString="*.jscript") returned 9
	[0061.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.hta") returned 0
	[0061.693] lstrlenA (lpString="*.hta") returned 5
	[0061.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.php7") returned 0
	[0061.693] lstrlenA (lpString="*.php7") returned 6
	[0061.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.db") returned 0
	[0061.693] lstrlenA (lpString="*.db") returned 4
	[0061.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.swf") returned 0
	[0061.693] lstrlenA (lpString="*.swf") returned 5
	[0061.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.eml") returned 0
	[0061.693] lstrlenA (lpString="*.eml") returned 5
	[0061.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.part") returned 0
	[0061.693] lstrlenA (lpString="*.part") returned 6
	[0061.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.nfo") returned 0
	[0061.693] lstrlenA (lpString="*.nfo") returned 5
	[0061.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.rsa") returned 0
	[0061.693] lstrlenA (lpString="*.rsa") returned 5
	[0061.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.key") returned 0
	[0061.693] lstrlenA (lpString="*.key") returned 5
	[0061.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.aes") returned 0
	[0061.693] lstrlenA (lpString="*.aes") returned 5
	[0061.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.blob") returned 0
	[0061.693] lstrlenA (lpString="*.blob") returned 6
	[0061.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.btc") returned 0
	[0061.693] lstrlenA (lpString="*.btc") returned 5
	[0061.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms", pszSpec="*.wallet") returned 0
	[0061.693] lstrlenA (lpString="*.wallet") returned 8
	[0061.693] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe2d3c6cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe2d3c6cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe2f5281c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x512c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessR_OEM_Perp-ppd.xrm-ms", cAlternateFileName="AC6D20~1.XRM")) returned 1
	[0061.694] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.694] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="AccessR_OEM_Perp-ppd.xrm-ms") returned 1
	[0061.694] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="AccessR_OEM_Perp-ppd.xrm-ms") returned 1
	[0061.694] lstrcmpiA (lpString1="", lpString2="AccessR_OEM_Perp-ppd.xrm-ms") returned -1
	[0061.694] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned="AccessR_OEM_Perp-pl.xrm-ms"
	[0061.694] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0061.694] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0061.694] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.694] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0061.694] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="AccessR_OEM_Perp-ppd.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms"
	[0061.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms", pszSpec="*.zip") returned 0
	[0061.694] lstrlenA (lpString="*.zip") returned 5
	[0061.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms", pszSpec="*.rar") returned 0
	[0061.694] lstrlenA (lpString="*.rar") returned 5
	[0061.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms", pszSpec="*.7z") returned 0
	[0061.694] lstrlenA (lpString="*.7z") returned 4
	[0061.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms", pszSpec="*.tar") returned 0
	[0061.694] lstrlenA (lpString="*.tar") returned 5
	[0061.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms", pszSpec="*.gzip") returned 0
	[0061.694] lstrlenA (lpString="*.gzip") returned 6
	[0061.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms", pszSpec="*.jpg") returned 0
	[0061.694] lstrlenA (lpString="*.jpg") returned 5
	[0061.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms", pszSpec="*.jpeg") returned 0
	[0061.694] lstrlenA (lpString="*.jpeg") returned 6
	[0061.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms", pszSpec="*.bmp") returned 0
	[0061.694] lstrlenA (lpString="*.bmp") returned 5
	[0061.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms", pszSpec="*.gif") returned 0
	[0061.694] lstrlenA (lpString="*.gif") returned 5
	[0061.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms", pszSpec="*.png") returned 0
	[0061.694] lstrlenA (lpString="*.png") returned 5
	[0061.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms", pszSpec="*.doc") returned 0
	[0061.694] lstrlenA (lpString="*.doc") returned 5
	[0061.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms", pszSpec="*.docx") returned 0
	[0061.694] lstrlenA (lpString="*.docx") returned 6
	[0061.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms", pszSpec="*.xls") returned 0
	[0061.695] lstrlenA (lpString="*.xls") returned 5
	[0061.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms", pszSpec="*.xlsx") returned 0
	[0061.695] lstrlenA (lpString="*.xlsx") returned 6
	[0061.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms", pszSpec="*.ppt") returned 0
	[0061.695] lstrlenA (lpString="*.ppt") returned 5
	[0061.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms", pszSpec="*.pptx") returned 0
	[0061.695] lstrlenA (lpString="*.pptx") returned 6
	[0061.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms", pszSpec="*.txt") returned 0
	[0061.695] lstrlenA (lpString="*.txt") returned 5
	[0061.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms", pszSpec="*.pdf") returned 0
	[0061.695] lstrlenA (lpString="*.pdf") returned 5
	[0061.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms", pszSpec="*.htm") returned 0
	[0061.695] lstrlenA (lpString="*.htm") returned 5
	[0061.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms", pszSpec="*.html") returned 0
	[0061.695] lstrlenA (lpString="*.html") returned 6
	[0061.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms", pszSpec="*.mdb") returned 0
	[0061.695] lstrlenA (lpString="*.mdb") returned 5
	[0061.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms", pszSpec="*.pfx") returned 0
	[0061.695] lstrlenA (lpString="*.pfx") returned 5
	[0061.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms", pszSpec="*.md") returned 0
	[0061.695] lstrlenA (lpString="*.md") returned 4
	[0061.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms", pszSpec="*.lnk") returned 0
	[0061.695] lstrlenA (lpString="*.lnk") returned 5
	[0061.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms", pszSpec="*.torrent") returned 0
	[0061.695] lstrlenA (lpString="*.torrent") returned 9
	[0061.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms", pszSpec="*.mov") returned 0
	[0061.695] lstrlenA (lpString="*.mov") returned 5
	[0061.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms", pszSpec="*.3gp") returned 0
	[0061.695] lstrlenA (lpString="*.3gp") returned 5
	[0061.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms", pszSpec="*.mpeg") returned 0
	[0061.695] lstrlenA (lpString="*.mpeg") returned 6
	[0061.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms", pszSpec="*.mpg") returned 0
	[0061.695] lstrlenA (lpString="*.mpg") returned 5
	[0061.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms", pszSpec="*.flv") returned 0
	[0061.695] lstrlenA (lpString="*.flv") returned 5
	[0061.696] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe2d16476, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe2d16476, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe2f06362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d43, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessR_OEM_Perp-ul-oob.xrm-ms", cAlternateFileName="AC1492~1.XRM")) returned 1
	[0061.696] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.696] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="AccessR_OEM_Perp-ul-oob.xrm-ms") returned 1
	[0061.696] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="AccessR_OEM_Perp-ul-oob.xrm-ms") returned 1
	[0061.696] lstrcmpiA (lpString1="", lpString2="AccessR_OEM_Perp-ul-oob.xrm-ms") returned -1
	[0061.696] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned="AccessR_OEM_Perp-ppd.xrm-ms"
	[0061.696] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0061.696] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0061.696] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.696] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0061.696] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="AccessR_OEM_Perp-ul-oob.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms"
	[0061.696] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe2d16476, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe2d16476, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe2f9ecf2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ddc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessR_OEM_Perp-ul-phn.xrm-ms", cAlternateFileName="ACAD72~1.XRM")) returned 1
	[0061.696] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.696] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="AccessR_OEM_Perp-ul-phn.xrm-ms") returned 1
	[0061.696] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="AccessR_OEM_Perp-ul-phn.xrm-ms") returned 1
	[0061.696] lstrcmpiA (lpString1="", lpString2="AccessR_OEM_Perp-ul-phn.xrm-ms") returned -1
	[0061.696] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned="AccessR_OEM_Perp-ul-oob.xrm-ms"
	[0061.696] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0061.696] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0061.696] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.696] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0061.696] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="AccessR_OEM_Perp-ul-phn.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms"
	[0061.697] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe2b4c7d1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe2b4c7d1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe2d88bc4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2987, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessR_Retail-pl.xrm-ms", cAlternateFileName="AC7E42~1.XRM")) returned 1
	[0061.697] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.697] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="AccessR_Retail-pl.xrm-ms") returned 1
	[0061.697] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="AccessR_Retail-pl.xrm-ms") returned 1
	[0061.697] lstrcmpiA (lpString1="", lpString2="AccessR_Retail-pl.xrm-ms") returned -1
	[0061.697] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned="AccessR_OEM_Perp-ul-phn.xrm-ms"
	[0061.697] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0061.697] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0061.697] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.697] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0061.697] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="AccessR_Retail-pl.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms"
	[0061.697] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe29cf0c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe29cf0c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe2d16476, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x512a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessR_Retail-ppd.xrm-ms", cAlternateFileName="AC6686~1.XRM")) returned 1
	[0061.697] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.697] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="AccessR_Retail-ppd.xrm-ms") returned 1
	[0061.697] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="AccessR_Retail-ppd.xrm-ms") returned 1
	[0061.697] lstrcmpiA (lpString1="", lpString2="AccessR_Retail-ppd.xrm-ms") returned -1
	[0061.697] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned="AccessR_Retail-pl.xrm-ms"
	[0061.697] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0061.697] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0061.697] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.697] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0061.697] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="AccessR_Retail-ppd.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms"
	[0061.697] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe29366eb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe29366eb, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe29cf0c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessR_Retail-ul-oob.xrm-ms", cAlternateFileName="ACCESS~4.XRM")) returned 1
	[0061.697] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.697] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="AccessR_Retail-ul-oob.xrm-ms") returned 1
	[0061.697] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="AccessR_Retail-ul-oob.xrm-ms") returned 1
	[0061.698] lstrcmpiA (lpString1="", lpString2="AccessR_Retail-ul-oob.xrm-ms") returned -1
	[0061.698] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned="AccessR_Retail-ppd.xrm-ms"
	[0061.698] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0061.698] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0061.698] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.698] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0061.698] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="AccessR_Retail-ul-oob.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms"
	[0061.698] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe2b4c7d1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe2b4c7d1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe2dd500f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4dd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessR_Retail-ul-phn.xrm-ms", cAlternateFileName="ACAF89~1.XRM")) returned 1
	[0061.698] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.698] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="AccessR_Retail-ul-phn.xrm-ms") returned 1
	[0061.698] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="AccessR_Retail-ul-phn.xrm-ms") returned 1
	[0061.698] lstrcmpiA (lpString1="", lpString2="AccessR_Retail-ul-phn.xrm-ms") returned -1
	[0061.698] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned="AccessR_Retail-ul-oob.xrm-ms"
	[0061.698] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0061.698] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0061.698] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.698] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0061.698] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="AccessR_Retail-ul-phn.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms"
	[0061.698] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe29a8e16, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe29a8e16, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe2cf0288, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2b87, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessR_Trial-pl.xrm-ms", cAlternateFileName="AC69E2~1.XRM")) returned 1
	[0061.698] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.698] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="AccessR_Trial-pl.xrm-ms") returned 1
	[0061.698] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="AccessR_Trial-pl.xrm-ms") returned 1
	[0061.698] lstrcmpiA (lpString1="", lpString2="AccessR_Trial-pl.xrm-ms") returned -1
	[0061.698] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned="AccessR_Retail-ul-phn.xrm-ms"
	[0061.698] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0061.698] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0061.698] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.699] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0061.699] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="AccessR_Trial-pl.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms"
	[0061.699] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe2982ba2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe2982ba2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe2b72a71, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x51a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessR_Trial-ppd.xrm-ms", cAlternateFileName="AC7797~1.XRM")) returned 1
	[0061.699] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.699] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="AccessR_Trial-ppd.xrm-ms") returned 1
	[0061.699] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="AccessR_Trial-ppd.xrm-ms") returned 1
	[0061.699] lstrcmpiA (lpString1="", lpString2="AccessR_Trial-ppd.xrm-ms") returned -1
	[0061.699] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned="AccessR_Trial-pl.xrm-ms"
	[0061.699] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0061.699] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0061.699] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.699] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0061.699] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="AccessR_Trial-ppd.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms"
	[0061.699] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe295c968, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe295c968, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe2a1b5af, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d47, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessR_Trial-ul-oob.xrm-ms", cAlternateFileName="AC031B~1.XRM")) returned 1
	[0061.699] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.699] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="AccessR_Trial-ul-oob.xrm-ms") returned 1
	[0061.699] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="AccessR_Trial-ul-oob.xrm-ms") returned 1
	[0061.699] lstrcmpiA (lpString1="", lpString2="AccessR_Trial-ul-oob.xrm-ms") returned -1
	[0061.699] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned="AccessR_Trial-ppd.xrm-ms"
	[0061.699] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0061.699] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0061.699] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.699] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0061.699] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="AccessR_Trial-ul-oob.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms"
	[0061.699] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe318eac3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe318eac3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe3299b47, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1a8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessVL_KMS_Client-ppd.xrm-ms", cAlternateFileName="AC225E~1.XRM")) returned 1
	[0061.700] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.700] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="AccessVL_KMS_Client-ppd.xrm-ms") returned 1
	[0061.700] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="AccessVL_KMS_Client-ppd.xrm-ms") returned 1
	[0061.700] lstrcmpiA (lpString1="", lpString2="AccessVL_KMS_Client-ppd.xrm-ms") returned -1
	[0061.700] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned="AccessR_Trial-ul-oob.xrm-ms"
	[0061.700] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0061.700] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0061.700] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.700] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0061.700] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="AccessVL_KMS_Client-ppd.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms"
	[0061.700] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe32738ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe32738ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe337e9fc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessVL_KMS_Client-ul-oob.xrm-ms", cAlternateFileName="AC86E0~1.XRM")) returned 1
	[0061.700] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.700] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="AccessVL_KMS_Client-ul-oob.xrm-ms") returned 1
	[0061.700] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="AccessVL_KMS_Client-ul-oob.xrm-ms") returned 1
	[0061.700] lstrcmpiA (lpString1="", lpString2="AccessVL_KMS_Client-ul-oob.xrm-ms") returned -1
	[0061.700] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned="AccessVL_KMS_Client-ppd.xrm-ms"
	[0061.700] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0061.700] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0061.700] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.700] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0061.752] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="AccessVL_KMS_Client-ul-oob.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms"
	[0061.753] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe303760d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe303760d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe3201264, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2586, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessVL_KMS_Client-ul.xrm-ms", cAlternateFileName="AC4FC4~1.XRM")) returned 1
	[0061.753] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.753] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="AccessVL_KMS_Client-ul.xrm-ms") returned 1
	[0061.753] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="AccessVL_KMS_Client-ul.xrm-ms") returned 1
	[0061.753] lstrcmpiA (lpString1="", lpString2="AccessVL_KMS_Client-ul.xrm-ms") returned -1
	[0061.753] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned="AccessVL_KMS_Client-ul-oob.xrm-ms"
	[0061.753] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0061.753] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0061.753] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.753] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0061.753] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="AccessVL_KMS_Client-ul.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms"
	[0061.753] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe318eac3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe318eac3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe3299b47, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x297f, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessVL_MAK-pl.xrm-ms", cAlternateFileName="AC3BFD~1.XRM")) returned 1
	[0061.753] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.753] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="AccessVL_MAK-pl.xrm-ms") returned 1
	[0061.753] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="AccessVL_MAK-pl.xrm-ms") returned 1
	[0061.753] lstrcmpiA (lpString1="", lpString2="AccessVL_MAK-pl.xrm-ms") returned -1
	[0061.753] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned="AccessVL_KMS_Client-ul.xrm-ms"
	[0061.753] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0061.753] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0061.753] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.753] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0061.753] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="AccessVL_MAK-pl.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms"
	[0061.754] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe30113f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe30113f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe31db01c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1a49, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessVL_MAK-ppd.xrm-ms", cAlternateFileName="ACF0DC~1.XRM")) returned 1
	[0061.754] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.754] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="AccessVL_MAK-ppd.xrm-ms") returned 1
	[0061.754] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="AccessVL_MAK-ppd.xrm-ms") returned 1
	[0061.754] lstrcmpiA (lpString1="", lpString2="AccessVL_MAK-ppd.xrm-ms") returned -1
	[0061.754] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned="AccessVL_MAK-pl.xrm-ms"
	[0061.754] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0061.754] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0061.754] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.754] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0061.754] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="AccessVL_MAK-ppd.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms"
	[0061.754] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe2daee42, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe2daee42, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe30113f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessVL_MAK-ul-oob.xrm-ms", cAlternateFileName="AC2E1B~1.XRM")) returned 1
	[0061.754] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.754] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="AccessVL_MAK-ul-oob.xrm-ms") returned 1
	[0061.754] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="AccessVL_MAK-ul-oob.xrm-ms") returned 1
	[0061.754] lstrcmpiA (lpString1="", lpString2="AccessVL_MAK-ul-oob.xrm-ms") returned -1
	[0061.754] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned="AccessVL_MAK-ppd.xrm-ms"
	[0061.754] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0061.754] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0061.754] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.754] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0061.754] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="AccessVL_MAK-ul-oob.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms"
	[0061.754] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe2fc4ef7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe2fc4ef7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe318eac3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4dd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessVL_MAK-ul-phn.xrm-ms", cAlternateFileName="ACEEE9~1.XRM")) returned 1
	[0061.754] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.754] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="AccessVL_MAK-ul-phn.xrm-ms") returned 1
	[0061.755] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="AccessVL_MAK-ul-phn.xrm-ms") returned 1
	[0061.755] lstrcmpiA (lpString1="", lpString2="AccessVL_MAK-ul-phn.xrm-ms") returned -1
	[0061.755] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned="AccessVL_MAK-ul-oob.xrm-ms"
	[0061.755] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0061.755] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0061.755] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.755] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0061.755] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="AccessVL_MAK-ul-phn.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms"
	[0061.755] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe2fc4ef7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe2fc4ef7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe324d6a5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xc8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="client-issuance-bridge-office.xrm-ms", cAlternateFileName="CL0848~1.XRM")) returned 1
	[0061.755] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.755] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="client-issuance-bridge-office.xrm-ms") returned 1
	[0061.755] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="client-issuance-bridge-office.xrm-ms") returned 1
	[0061.755] lstrcmpiA (lpString1="", lpString2="client-issuance-bridge-office.xrm-ms") returned -1
	[0061.755] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned="AccessVL_MAK-ul-phn.xrm-ms"
	[0061.755] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0061.755] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0061.755] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.755] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0061.755] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="client-issuance-bridge-office.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms"
	[0061.755] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe28ea227, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe28ea227, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe2982ba2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xc93, dwReserved0=0x0, dwReserved1=0x0, cFileName="client-issuance-root-bridge-test.xrm-ms", cAlternateFileName="CL284D~1.XRM")) returned 1
	[0061.755] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.755] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="client-issuance-root-bridge-test.xrm-ms") returned 1
	[0061.755] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="client-issuance-root-bridge-test.xrm-ms") returned 1
	[0061.755] lstrcmpiA (lpString1="", lpString2="client-issuance-root-bridge-test.xrm-ms") returned -1
	[0061.755] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned="client-issuance-bridge-office.xrm-ms"
	[0061.756] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0061.756] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0061.756] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.756] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0061.756] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="client-issuance-root-bridge-test.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms"
	[0061.756] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe28c3fe1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe28c3fe1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe295c968, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xc1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="client-issuance-root.xrm-ms", cAlternateFileName="CLIENT~4.XRM")) returned 1
	[0061.756] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.756] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="client-issuance-root.xrm-ms") returned 1
	[0061.756] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="client-issuance-root.xrm-ms") returned 1
	[0061.756] lstrcmpiA (lpString1="", lpString2="client-issuance-root.xrm-ms") returned -1
	[0061.756] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned="client-issuance-root-bridge-test.xrm-ms"
	[0061.756] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0061.756] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0061.756] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.756] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0061.756] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="client-issuance-root.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms"
	[0061.756] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe289dd92, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe289dd92, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe29366eb, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xd34, dwReserved0=0x0, dwReserved1=0x0, cFileName="client-issuance-stil.xrm-ms", cAlternateFileName="CLIENT~3.XRM")) returned 1
	[0061.756] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.756] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="client-issuance-stil.xrm-ms") returned 1
	[0061.756] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="client-issuance-stil.xrm-ms") returned 1
	[0061.756] lstrcmpiA (lpString1="", lpString2="client-issuance-stil.xrm-ms") returned -1
	[0061.756] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned="client-issuance-root.xrm-ms"
	[0061.756] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0061.756] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0061.756] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.756] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0061.757] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="client-issuance-stil.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms"
	[0061.757] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe282b673, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe282b673, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe28ea227, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1128, dwReserved0=0x0, dwReserved1=0x0, cFileName="client-issuance-ul-oob.xrm-ms", cAlternateFileName="CLIENT~2.XRM")) returned 1
	[0061.757] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.757] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="client-issuance-ul-oob.xrm-ms") returned 1
	[0061.757] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="client-issuance-ul-oob.xrm-ms") returned 1
	[0061.757] lstrcmpiA (lpString1="", lpString2="client-issuance-ul-oob.xrm-ms") returned -1
	[0061.757] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned="client-issuance-stil.xrm-ms"
	[0061.757] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0061.757] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0061.757] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.757] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0061.757] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="client-issuance-ul-oob.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms"
	[0061.757] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe2687c83, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe2687c83, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe282b673, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1070, dwReserved0=0x0, dwReserved1=0x0, cFileName="client-issuance-ul.xrm-ms", cAlternateFileName="CLIENT~1.XRM")) returned 1
	[0061.757] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0061.757] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="client-issuance-ul.xrm-ms") returned 1
	[0061.757] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="client-issuance-ul.xrm-ms") returned 1
	[0061.757] lstrcmpiA (lpString1="", lpString2="client-issuance-ul.xrm-ms") returned -1
	[0061.757] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned="client-issuance-ul-oob.xrm-ms"
	[0061.757] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0061.757] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0061.757] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0061.757] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0061.757] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="client-issuance-ul.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms"
	[0061.757] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe2f2c57f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe2f2c57f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe305d884, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5169, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelR_Grace-ppd.xrm-ms", cAlternateFileName="EXCELR~3.XRM")) returned 1
	[0062.019] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.019] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="ExcelR_Grace-ppd.xrm-ms") returned -1
	[0062.019] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="ExcelR_Grace-ppd.xrm-ms") returned 1
	[0062.019] lstrcmpiA (lpString1="", lpString2="ExcelR_Grace-ppd.xrm-ms") returned -1
	[0062.019] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned="client-issuance-ul.xrm-ms"
	[0062.019] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.019] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.019] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0062.019] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.019] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="ExcelR_Grace-ppd.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms"
	[0062.019] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe2f2c57f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe2f2c57f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe314269a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d45, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelR_Grace-ul-oob.xrm-ms", cAlternateFileName="EXCELR~2.XRM")) returned 1
	[0062.019] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.019] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="ExcelR_Grace-ul-oob.xrm-ms") returned -1
	[0062.019] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="ExcelR_Grace-ul-oob.xrm-ms") returned 1
	[0062.020] lstrcmpiA (lpString1="", lpString2="ExcelR_Grace-ul-oob.xrm-ms") returned -1
	[0062.020] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned="ExcelR_Grace-ppd.xrm-ms"
	[0062.020] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.020] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.020] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0062.020] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.020] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="ExcelR_Grace-ul-oob.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms"
	[0062.020] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe2dd500f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe2dd500f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe2feb0e6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x298b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelR_OEM_Perp-pl.xrm-ms", cAlternateFileName="EXCELR~1.XRM")) returned 1
	[0062.020] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.020] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="ExcelR_OEM_Perp-pl.xrm-ms") returned -1
	[0062.020] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="ExcelR_OEM_Perp-pl.xrm-ms") returned 1
	[0062.020] lstrcmpiA (lpString1="", lpString2="ExcelR_OEM_Perp-pl.xrm-ms") returned -1
	[0062.020] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned="ExcelR_Grace-ul-oob.xrm-ms"
	[0062.020] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.020] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.020] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0062.020] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.020] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="ExcelR_OEM_Perp-pl.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms"
	[0062.020] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe34fc158, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe34fc158, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe38697b8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x516e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelR_OEM_Perp-ppd.xrm-ms", cAlternateFileName="EX46CD~1.XRM")) returned 1
	[0062.020] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.020] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="ExcelR_OEM_Perp-ppd.xrm-ms") returned -1
	[0062.020] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="ExcelR_OEM_Perp-ppd.xrm-ms") returned 1
	[0062.020] lstrcmpiA (lpString1="", lpString2="ExcelR_OEM_Perp-ppd.xrm-ms") returned -1
	[0062.020] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned="ExcelR_OEM_Perp-pl.xrm-ms"
	[0062.020] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.020] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.020] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0062.020] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.021] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="ExcelR_OEM_Perp-ppd.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms"
	[0062.021] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3594a6c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3594a6c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe3a595e5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelR_OEM_Perp-ul-oob.xrm-ms", cAlternateFileName="EX3475~1.XRM")) returned 1
	[0062.021] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.021] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="ExcelR_OEM_Perp-ul-oob.xrm-ms") returned -1
	[0062.021] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned="ExcelR_OEM_Perp-ppd.xrm-ms"
	[0062.021] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.021] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.021] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0062.021] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.021] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="ExcelR_OEM_Perp-ul-oob.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms"
	[0062.021] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3332528, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3332528, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe34afc59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4dd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelR_OEM_Perp-ul-phn.xrm-ms", cAlternateFileName="EXD89F~1.XRM")) returned 1
	[0062.021] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.021] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned="ExcelR_OEM_Perp-ul-oob.xrm-ms"
	[0062.021] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.021] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.021] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0062.021] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.021] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="ExcelR_OEM_Perp-ul-phn.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms"
	[0062.021] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe330c311, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe330c311, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe34172f7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2983, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelR_Retail-pl.xrm-ms", cAlternateFileName="EX3998~1.XRM")) returned 1
	[0062.021] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.021] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned="ExcelR_OEM_Perp-ul-phn.xrm-ms"
	[0062.022] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.022] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.022] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0062.022] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.022] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="ExcelR_Retail-pl.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms"
	[0062.022] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe330c311, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe330c311, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe35223c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x516c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelR_Retail-ppd.xrm-ms", cAlternateFileName="EX788A~1.XRM")) returned 1
	[0062.022] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.022] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned="ExcelR_Retail-pl.xrm-ms"
	[0062.022] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.022] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.022] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0062.022] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.022] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="ExcelR_Retail-ppd.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms"
	[0062.022] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3299b47, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3299b47, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe3358711, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d36, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelR_Retail-ul-oob.xrm-ms", cAlternateFileName="EX9957~1.XRM")) returned 1
	[0062.022] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.022] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned="ExcelR_Retail-ppd.xrm-ms"
	[0062.022] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.022] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.022] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0062.022] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.022] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="ExcelR_Retail-ul-oob.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms"
	[0062.023] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3201264, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3201264, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe32e60a0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4dcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelR_Retail-ul-phn.xrm-ms", cAlternateFileName="EXCELR~4.XRM")) returned 1
	[0062.023] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.023] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned="ExcelR_Retail-ul-oob.xrm-ms"
	[0062.023] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.023] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.023] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0062.023] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.023] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="ExcelR_Retail-ul-phn.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms"
	[0062.023] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe330c311, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe330c311, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xec691f40, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2b83, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelR_Trial-pl.xrm-ms", cAlternateFileName="EXA577~1.XRM")) returned 1
	[0062.023] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.023] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned="ExcelR_Retail-ul-phn.xrm-ms"
	[0062.023] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.023] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.023] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0062.023] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.023] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="ExcelR_Trial-pl.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms"
	[0062.023] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3299b47, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3299b47, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe330c311, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x51e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelR_Trial-ppd.xrm-ms", cAlternateFileName="EX4CA4~1.XRM")) returned 1
	[0062.023] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.023] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned="ExcelR_Trial-pl.xrm-ms"
	[0062.023] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.023] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.023] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0062.023] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.023] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="ExcelR_Trial-ppd.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms"
	[0062.024] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe337e9fc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe337e9fc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe34d5ed4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d42, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelR_Trial-ul-oob.xrm-ms", cAlternateFileName="EXB3BA~1.XRM")) returned 1
	[0062.024] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.024] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned="ExcelR_Trial-ppd.xrm-ms"
	[0062.024] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.024] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.024] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0062.024] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.024] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="ExcelR_Trial-ul-oob.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms"
	[0062.024] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe34172f7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe34172f7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe35485e3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1acc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelVL_KMS_Client-ppd.xrm-ms", cAlternateFileName="EXCELV~1.XRM")) returned 1
	[0062.024] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.024] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned="ExcelR_Trial-ul-oob.xrm-ms"
	[0062.024] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.024] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.024] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0062.024] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.024] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="ExcelVL_KMS_Client-ppd.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms"
	[0062.024] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec750afb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xec750afb, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xec7e944d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d59, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelVL_KMS_Client-ul-oob.xrm-ms", cAlternateFileName="EX0778~1.XRM")) returned 1
	[0062.024] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.024] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned="ExcelVL_KMS_Client-ppd.xrm-ms"
	[0062.024] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.024] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.024] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0062.024] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.024] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="ExcelVL_KMS_Client-ul-oob.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms"
	[0062.025] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3af1fe3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3af1fe3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe3bd6df0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2581, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelVL_KMS_Client-ul.xrm-ms", cAlternateFileName="EXCDB8~1.XRM")) returned 1
	[0062.025] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.025] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned="ExcelVL_KMS_Client-ul-oob.xrm-ms"
	[0062.025] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.025] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.025] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0062.025] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.025] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="ExcelVL_KMS_Client-ul.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms"
	[0062.025] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3aa5b3e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3aa5b3e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe3b8a961, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x297b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelVL_MAK-pl.xrm-ms", cAlternateFileName="EXCELV~4.XRM")) returned 1
	[0062.025] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.025] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned="ExcelVL_KMS_Client-ul.xrm-ms"
	[0062.025] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.025] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.025] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0062.025] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.025] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="ExcelVL_MAK-pl.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms"
	[0062.025] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3aa5b3e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3aa5b3e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe3bb0ba1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1a8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelVL_MAK-ppd.xrm-ms", cAlternateFileName="EXCELV~3.XRM")) returned 1
	[0062.025] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.025] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned="ExcelVL_MAK-pl.xrm-ms"
	[0062.025] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.025] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.025] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0062.025] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.025] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="ExcelVL_MAK-ppd.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms"
	[0062.026] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3a0d1e6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3a0d1e6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe3b181c2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelVL_MAK-ul-oob.xrm-ms", cAlternateFileName="EXCELV~2.XRM")) returned 1
	[0062.026] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.026] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned="ExcelVL_MAK-ppd.xrm-ms"
	[0062.026] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.026] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.026] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0062.026] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.026] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="ExcelVL_MAK-ul-oob.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms"
	[0062.026] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3bb0ba1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3bb0ba1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe3c494f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4dd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelVL_MAK-ul-phn.xrm-ms", cAlternateFileName="EX3B3E~1.XRM")) returned 1
	[0062.026] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.026] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned="ExcelVL_MAK-ul-oob.xrm-ms"
	[0062.026] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.026] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.026] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0062.026] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.026] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="ExcelVL_MAK-ul-phn.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms"
	[0062.026] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3c9598b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3c9598b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe3d7a82a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2bd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessDemoR_BypassTrial180-pl.xrm-ms", cAlternateFileName="HOB5CE~1.XRM")) returned 1
	[0062.026] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.026] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned="ExcelVL_MAK-ul-phn.xrm-ms"
	[0062.026] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.026] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.026] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0062.026] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.027] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms"
	[0062.027] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3cbbc0c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3cbbc0c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe3da0a82, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x56d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms", cAlternateFileName="HO90F4~1.XRM")) returned 1
	[0062.027] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.027] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned="HomeBusinessDemoR_BypassTrial180-pl.xrm-ms"
	[0062.027] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.027] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.027] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0062.027] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.027] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms"
	[0062.027] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3c494f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3c494f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe3d080f5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms", cAlternateFileName="HODAE7~1.XRM")) returned 1
	[0062.027] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.027] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned="HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms"
	[0062.027] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.027] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.027] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0062.027] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.027] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms"
	[0062.027] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3a0d1e6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3a0d1e6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe3b646e3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x559d, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessPipcR_Grace-ppd.xrm-ms", cAlternateFileName="HOMEBU~1.XRM")) returned 1
	[0062.027] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.027] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned="HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms"
	[0062.027] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.027] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.027] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0062.027] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.028] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HomeBusinessPipcR_Grace-ppd.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms"
	[0062.028] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee308135, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee37a832, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessPipcR_Grace-ul-oob.xrm-ms", cAlternateFileName="HOC1AF~1.XRM")) returned 1
	[0062.028] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.028] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned="HomeBusinessPipcR_Grace-ppd.xrm-ms"
	[0062.028] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.028] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.028] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0062.028] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.028] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HomeBusinessPipcR_Grace-ul-oob.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms"
	[0062.028] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec691f40, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xec691f40, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xec750afb, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x29b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessPipcR_OEM_Perp-pl.xrm-ms", cAlternateFileName="HO4E4E~1.XRM")) returned 1
	[0062.028] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.028] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned="HomeBusinessPipcR_Grace-ul-oob.xrm-ms"
	[0062.028] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.028] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.028] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0062.028] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.028] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms"
	[0062.028] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee308135, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee4131cf, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x55d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms", cAlternateFileName="HOCD27~1.XRM")) returned 1
	[0062.037] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.037] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned="HomeBusinessPipcR_OEM_Perp-pl.xrm-ms"
	[0062.037] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.037] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.037] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0062.037] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.037] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms"
	[0062.037] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3ef7f7a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3ef7f7a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe3fdcd93, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d75, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms", cAlternateFileName="HO30DA~1.XRM")) returned 1
	[0062.037] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.037] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned="HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms"
	[0062.037] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.037] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.037] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0062.037] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.038] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms"
	[0062.038] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3dc6c97, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3dc6c97, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe3eaba33, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4e0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms", cAlternateFileName="HODC3A~1.XRM")) returned 1
	[0062.038] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.038] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned="HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms"
	[0062.038] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.038] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.038] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0062.038] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.038] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms"
	[0062.038] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3c6f733, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3c6f733, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe3d2e398, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5611, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessR_Grace-ppd.xrm-ms", cAlternateFileName="HOA2C7~1.XRM")) returned 1
	[0062.038] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.038] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned="HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms"
	[0062.038] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.038] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.038] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0062.038] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.038] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HomeBusinessR_Grace-ppd.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms"
	[0062.038] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3b8a961, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3b8a961, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe3c6f733, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessR_Grace-ul-oob.xrm-ms", cAlternateFileName="HOMEBU~2.XRM")) returned 1
	[0062.038] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.038] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned="HomeBusinessR_Grace-ppd.xrm-ms"
	[0062.038] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.038] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.039] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0062.039] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.039] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HomeBusinessR_Grace-ul-oob.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms"
	[0062.039] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3c494f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3c494f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe3dc6c97, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x29a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessR_OEM_Perp-pl.xrm-ms", cAlternateFileName="HO936B~1.XRM")) returned 1
	[0062.039] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.039] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned="HomeBusinessR_Grace-ul-oob.xrm-ms"
	[0062.039] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.039] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.039] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0062.039] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.039] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HomeBusinessR_OEM_Perp-pl.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms"
	[0062.039] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3bd6df0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3bd6df0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe3cbbc0c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x564d, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessR_OEM_Perp-ppd.xrm-ms", cAlternateFileName="HOMEBU~4.XRM")) returned 1
	[0062.039] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.039] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned="HomeBusinessR_OEM_Perp-pl.xrm-ms"
	[0062.039] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.039] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.039] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0062.039] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.039] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HomeBusinessR_OEM_Perp-ppd.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms"
	[0062.039] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3bd6df0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3bd6df0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe3c9598b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d61, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessR_OEM_Perp-ul-oob.xrm-ms", cAlternateFileName="HO620E~1.XRM")) returned 1
	[0062.039] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.039] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned="HomeBusinessR_OEM_Perp-ppd.xrm-ms"
	[0062.039] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.040] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.040] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0062.040] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.040] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms"
	[0062.040] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3b8a961, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3b8a961, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe3c232ad, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4dfa, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessR_OEM_Perp-ul-phn.xrm-ms", cAlternateFileName="HOMEBU~3.XRM")) returned 1
	[0062.040] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.040] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned="HomeBusinessR_OEM_Perp-ul-oob.xrm-ms"
	[0062.040] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.040] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.040] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0062.040] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.040] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms"
	[0062.040] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3ed1ce3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3ed1ce3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe3fb6b6c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x29ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessR_OEM_Perp2-pl.xrm-ms", cAlternateFileName="HO2C67~1.XRM")) returned 1
	[0062.040] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.040] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned="HomeBusinessR_OEM_Perp-ul-phn.xrm-ms"
	[0062.040] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.040] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.040] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0062.040] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.040] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HomeBusinessR_OEM_Perp2-pl.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms"
	[0062.040] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3eaba33, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3eaba33, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe3f6a648, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x564e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessR_OEM_Perp2-ppd.xrm-ms", cAlternateFileName="HO3D7E~1.XRM")) returned 1
	[0062.040] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.040] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned="HomeBusinessR_OEM_Perp2-pl.xrm-ms"
	[0062.041] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.041] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.041] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0062.041] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.041] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HomeBusinessR_OEM_Perp2-ppd.xrm-ms" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms"
	[0062.041] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3e5f5e0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3e5f5e0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe3f1e1f4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d65, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms", cAlternateFileName="HO4CF9~1.XRM")) returned 1
	[0062.041] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.041] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned="HomeBusinessR_OEM_Perp2-ppd.xrm-ms"
	[0062.041] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.041] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.041] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM"
	[0062.041] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.041] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe40756e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe40756e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe415a524, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4dfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms", cAlternateFileName="HOFD0F~1.XRM")) returned 1
	[0062.041] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.041] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned="HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms"
	[0062.041] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.041] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.041] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.041] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3e393c5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3e393c5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe3ef7f7a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x29ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessR_OEM_Perp3-pl.xrm-ms", cAlternateFileName="HO5093~1.XRM")) returned 1
	[0062.041] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.041] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned="HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms"
	[0062.041] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.042] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.042] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.042] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3d2e398, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3d2e398, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe3e393c5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x564e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessR_OEM_Perp3-ppd.xrm-ms", cAlternateFileName="HO0707~1.XRM")) returned 1
	[0062.042] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.042] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned="HomeBusinessR_OEM_Perp3-pl.xrm-ms"
	[0062.042] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.042] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.042] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.042] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3decec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3decec0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe3ed1ce3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d65, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms", cAlternateFileName="HO1457~1.XRM")) returned 1
	[0062.042] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.042] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned="HomeBusinessR_OEM_Perp3-ppd.xrm-ms"
	[0062.042] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.042] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.042] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.042] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3da0a82, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3da0a82, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe3e5f5e0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4dfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms", cAlternateFileName="HOD2EE~1.XRM")) returned 1
	[0062.042] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.042] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned="HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms"
	[0062.042] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.042] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.042] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.043] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3da0a82, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3da0a82, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe40756e2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x29ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessR_OEM_Perp4-pl.xrm-ms", cAlternateFileName="HO8B40~1.XRM")) returned 1
	[0062.043] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.043] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned="HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms"
	[0062.043] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.043] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.043] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.043] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3d2e398, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3d2e398, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe3decec0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x564e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessR_OEM_Perp4-ppd.xrm-ms", cAlternateFileName="HO13F0~1.XRM")) returned 1
	[0062.043] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.043] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned="HomeBusinessR_OEM_Perp4-pl.xrm-ms"
	[0062.043] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.043] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.043] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.043] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe5041085, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe5041085, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe52572ac, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d65, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms", cAlternateFileName="HO7938~1.XRM")) returned 1
	[0062.043] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.043] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned="HomeBusinessR_OEM_Perp4-ppd.xrm-ms"
	[0062.043] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.043] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.043] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.043] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe40e7dfb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe40e7dfb, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe41a69d5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4dfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms", cAlternateFileName="HO93DC~1.XRM")) returned 1
	[0062.043] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.044] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned="HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms"
	[0062.044] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.044] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.044] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.044] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe40e7dfb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe40e7dfb, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe41f2eb7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x299f, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessR_Retail-pl.xrm-ms", cAlternateFileName="HO6958~1.XRM")) returned 1
	[0062.044] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.044] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned="HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms"
	[0062.044] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.044] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.044] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.044] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4180773, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4180773, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe426559f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x564b, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessR_Retail-ppd.xrm-ms", cAlternateFileName="HOB1F6~1.XRM")) returned 1
	[0062.044] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.044] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned="HomeBusinessR_Retail-pl.xrm-ms"
	[0062.044] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.044] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.045] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.045] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe404f4c8, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe404f4c8, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4134233, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d59, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessR_Retail-ul-oob.xrm-ms", cAlternateFileName="HOD57C~1.XRM")) returned 1
	[0062.045] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.045] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned="HomeBusinessR_Retail-ppd.xrm-ms"
	[0062.045] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.045] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.045] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.045] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3fdcd93, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3fdcd93, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe40c1be1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4df2, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessR_Retail-ul-phn.xrm-ms", cAlternateFileName="HO7BFB~1.XRM")) returned 1
	[0062.101] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.101] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned="HomeBusinessR_Retail-ul-oob.xrm-ms"
	[0062.101] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.101] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.101] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.101] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3f1e1f4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3f1e1f4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe40291d7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x29a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessR_Retail2-pl.xrm-ms", cAlternateFileName="HO5279~1.XRM")) returned 1
	[0062.102] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.102] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned="HomeBusinessR_Retail-ul-phn.xrm-ms"
	[0062.102] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.102] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.102] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.102] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe40291d7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe40291d7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe40e7dfb, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x564c, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessR_Retail2-ppd.xrm-ms", cAlternateFileName="HO589B~1.XRM")) returned 1
	[0062.102] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.102] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned="HomeBusinessR_Retail2-pl.xrm-ms"
	[0062.102] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.102] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.102] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.102] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3fdcd93, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3fdcd93, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4180773, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessR_Retail2-ul-oob.xrm-ms", cAlternateFileName="HOBCC6~1.XRM")) returned 1
	[0062.102] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.102] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned="HomeBusinessR_Retail2-ppd.xrm-ms"
	[0062.102] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.102] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.102] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.102] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3f4440f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3f4440f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe404f4c8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4df6, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessR_Retail2-ul-phn.xrm-ms", cAlternateFileName="HO504E~1.XRM")) returned 1
	[0062.102] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.151] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned="HomeBusinessR_Retail2-ul-oob.xrm-ms"
	[0062.151] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.151] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.151] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.151] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe42fdf13, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe42fdf13, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe43967f6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x29a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessR_Retail3-pl.xrm-ms", cAlternateFileName="HO0179~1.XRM")) returned 1
	[0062.151] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.151] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned="HomeBusinessR_Retail2-ul-phn.xrm-ms"
	[0062.151] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.151] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.151] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.151] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe42d7c8c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe42d7c8c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe43967f6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x564c, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessR_Retail3-ppd.xrm-ms", cAlternateFileName="HO3209~1.XRM")) returned 1
	[0062.151] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.151] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned="HomeBusinessR_Retail3-pl.xrm-ms"
	[0062.151] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.151] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.151] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.152] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe42d7c8c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe42d7c8c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4408fb4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessR_Retail3-ul-oob.xrm-ms", cAlternateFileName="HOFBD8~1.XRM")) returned 1
	[0062.152] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.152] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned="HomeBusinessR_Retail3-ppd.xrm-ms"
	[0062.152] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.152] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.152] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.152] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe426559f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe426559f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe43241ad, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4df6, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessR_Retail3-ul-phn.xrm-ms", cAlternateFileName="HO113C~1.XRM")) returned 1
	[0062.152] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.152] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned="HomeBusinessR_Retail3-ul-oob.xrm-ms"
	[0062.152] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.152] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.152] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.152] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe451402c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe451402c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe485b385, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2b9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessR_Trial-pl.xrm-ms", cAlternateFileName="HODAC9~1.XRM")) returned 1
	[0062.152] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.152] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned="HomeBusinessR_Retail3-ul-phn.xrm-ms"
	[0062.152] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.152] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.152] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.152] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe415a524, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe415a524, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe42d7c8c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x56c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessR_Trial-ppd.xrm-ms", cAlternateFileName="HO3298~1.XRM")) returned 1
	[0062.152] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.153] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned="HomeBusinessR_Trial-pl.xrm-ms"
	[0062.153] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.153] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.153] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.153] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe423f37b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe423f37b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe42fdf13, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d65, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessR_Trial-ul-oob.xrm-ms", cAlternateFileName="HO6B26~1.XRM")) returned 1
	[0062.153] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.153] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned="HomeBusinessR_Trial-ppd.xrm-ms"
	[0062.153] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.153] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.153] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.153] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe41a69d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe41a69d5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe42b1a78, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2ba3, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessR_Trial2-pl.xrm-ms", cAlternateFileName="HO87DE~1.XRM")) returned 1
	[0062.153] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.153] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned="HomeBusinessR_Trial-ul-oob.xrm-ms"
	[0062.153] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.153] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.153] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.154] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe423f37b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe423f37b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4370671, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x56c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessR_Trial2-ppd.xrm-ms", cAlternateFileName="HOE683~1.XRM")) returned 1
	[0062.154] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.154] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned="HomeBusinessR_Trial2-pl.xrm-ms"
	[0062.154] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.154] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.154] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.154] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe415a524, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe415a524, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe423f37b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d69, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeBusinessR_Trial2-ul-oob.xrm-ms", cAlternateFileName="HO4037~1.XRM")) returned 1
	[0062.154] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.154] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned="HomeBusinessR_Trial2-ppd.xrm-ms"
	[0062.154] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.154] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.154] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.154] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe47e8ce2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe47e8ce2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4919fee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2bcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeStudentDemoR_BypassTrial180-pl.xrm-ms", cAlternateFileName="HO03E3~1.XRM")) returned 1
	[0062.154] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.154] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned="HomeBusinessR_Trial2-ul-oob.xrm-ms"
	[0062.154] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.154] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.154] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.154] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe46b79f0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe46b79f0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4881625, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x54e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeStudentDemoR_BypassTrial180-ppd.xrm-ms", cAlternateFileName="HO91BA~1.XRM")) returned 1
	[0062.155] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.155] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned="HomeStudentDemoR_BypassTrial180-pl.xrm-ms"
	[0062.155] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.155] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.155] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.155] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe46b79f0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe46b79f0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe48a788d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d95, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms", cAlternateFileName="HOA685~1.XRM")) returned 1
	[0062.155] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.155] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned="HomeStudentDemoR_BypassTrial180-ppd.xrm-ms"
	[0062.155] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.155] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.155] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.155] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe451402c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe451402c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe47e8ce2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x542a, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeStudentR_Grace-ppd.xrm-ms", cAlternateFileName="HOC53F~1.XRM")) returned 1
	[0062.155] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.155] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned="HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms"
	[0062.155] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.155] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.155] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.155] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe43bca74, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe43bca74, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe46ddba0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d63, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeStudentR_Grace-ul-oob.xrm-ms", cAlternateFileName="HO8736~1.XRM")) returned 1
	[0062.155] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.155] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned="HomeStudentR_Grace-ppd.xrm-ms"
	[0062.155] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.155] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.156] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.156] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe43241ad, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe43241ad, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe43bca74, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x29a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeStudentR_OEM_Perp-pl.xrm-ms", cAlternateFileName="HOMEST~1.XRM")) returned 1
	[0062.156] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.156] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned="HomeStudentR_Grace-ul-oob.xrm-ms"
	[0062.156] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.156] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.156] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.156] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe498c694, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe498c694, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4a4b257, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5466, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeStudentR_OEM_Perp-ppd.xrm-ms", cAlternateFileName="HO8BAE~1.XRM")) returned 1
	[0062.156] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.156] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned="HomeStudentR_OEM_Perp-pl.xrm-ms"
	[0062.156] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.156] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.156] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.156] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe43967f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe43967f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe45d2bff, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeStudentR_OEM_Perp-ul-oob.xrm-ms", cAlternateFileName="HOMEST~4.XRM")) returned 1
	[0062.156] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.156] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned="HomeStudentR_OEM_Perp-ppd.xrm-ms"
	[0062.156] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.156] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.156] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.157] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe43967f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe43967f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe451402c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4df5, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeStudentR_OEM_Perp-ul-phn.xrm-ms", cAlternateFileName="HOMEST~3.XRM")) returned 1
	[0062.157] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.157] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned="HomeStudentR_OEM_Perp-ul-oob.xrm-ms"
	[0062.157] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.157] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.157] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.157] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe43967f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe43967f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe472a134, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x299b, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeStudentR_Retail-pl.xrm-ms", cAlternateFileName="HOMEST~2.XRM")) returned 1
	[0062.166] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.166] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned="HomeStudentR_OEM_Perp-ul-phn.xrm-ms"
	[0062.166] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.166] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.166] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.166] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe49fedb3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe49fedb3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4c3b14f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5464, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeStudentR_Retail-ppd.xrm-ms", cAlternateFileName="HOBB18~1.XRM")) returned 1
	[0062.166] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.166] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned="HomeStudentR_Retail-pl.xrm-ms"
	[0062.166] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.166] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.166] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.166] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4a97702, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4a97702, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4b56390, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d54, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeStudentR_Retail-ul-oob.xrm-ms", cAlternateFileName="HO08B3~1.XRM")) returned 1
	[0062.166] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.166] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned="HomeStudentR_Retail-ppd.xrm-ms"
	[0062.166] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.166] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.166] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.166] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe49664a2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe49664a2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4a25005, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ded, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeStudentR_Retail-ul-phn.xrm-ms", cAlternateFileName="HO75FD~1.XRM")) returned 1
	[0062.167] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.167] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned="HomeStudentR_Retail-ul-oob.xrm-ms"
	[0062.167] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.167] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.167] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.167] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe49401ca, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe49401ca, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe49fedb3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2b9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeStudentR_Trial-pl.xrm-ms", cAlternateFileName="HOD8E4~1.XRM")) returned 1
	[0062.167] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.167] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned="HomeStudentR_Retail-ul-phn.xrm-ms"
	[0062.167] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.167] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.167] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.167] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4919fee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4919fee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4a97702, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x54df, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeStudentR_Trial-ppd.xrm-ms", cAlternateFileName="HOCCAE~1.XRM")) returned 1
	[0062.167] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.167] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned="HomeStudentR_Trial-pl.xrm-ms"
	[0062.167] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.167] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.167] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.167] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe47e8ce2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe47e8ce2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe48f3d44, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeStudentR_Trial-ul-oob.xrm-ms", cAlternateFileName="HO7EC9~1.XRM")) returned 1
	[0062.167] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.167] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned="HomeStudentR_Trial-ppd.xrm-ms"
	[0062.167] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.167] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.168] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.168] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4919fee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4919fee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe49d8b7d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2b9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeStudentR_Trial2-pl.xrm-ms", cAlternateFileName="HOFD0B~1.XRM")) returned 1
	[0062.168] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.168] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned="HomeStudentR_Trial-ul-oob.xrm-ms"
	[0062.168] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.168] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.168] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.168] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe48a788d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe48a788d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe49664a2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x54e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeStudentR_Trial2-ppd.xrm-ms", cAlternateFileName="HO2F4B~1.XRM")) returned 1
	[0062.168] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.168] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned="HomeStudentR_Trial2-pl.xrm-ms"
	[0062.168] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.168] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.168] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.168] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4881625, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4881625, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe49401ca, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d64, dwReserved0=0x0, dwReserved1=0x0, cFileName="HomeStudentR_Trial2-ul-oob.xrm-ms", cAlternateFileName="HO0E95~1.XRM")) returned 1
	[0062.168] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.168] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned="HomeStudentR_Trial2-ppd.xrm-ms"
	[0062.168] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.168] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.168] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.169] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46742519, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x75f1db39, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x46742519, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x39e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW-TO-DECRYPT-FILES.HTM", cAlternateFileName="HOW-TO~1.HTM")) returned 1
	[0062.169] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.169] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4881625, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4881625, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe498c694, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2ba7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_BypassTrial180-pl.xrm-ms", cAlternateFileName="MONDOR~1.XRM")) returned 1
	[0062.169] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.169] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned="HomeStudentR_Trial2-ul-oob.xrm-ms"
	[0062.169] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.169] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.169] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.169] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4bc8a97, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4bc8a97, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4cad862, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x67aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_BypassTrial180-ppd.xrm-ms", cAlternateFileName="MO0B6A~1.XRM")) returned 1
	[0062.169] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.169] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned="MondoR_BypassTrial180-pl.xrm-ms"
	[0062.170] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.170] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.170] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.170] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4b7c515, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4b7c515, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4c6135d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d67, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_BypassTrial180-ul-oob.xrm-ms", cAlternateFileName="MOAFA6~1.XRM")) returned 1
	[0062.170] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.170] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned="MondoR_BypassTrial180-ppd.xrm-ms"
	[0062.170] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.170] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.170] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.170] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4b7c515, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4b7c515, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4cd3aa8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x675b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_Grace-ppd.xrm-ms", cAlternateFileName="MO90E0~1.XRM")) returned 1
	[0062.171] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.171] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned="MondoR_BypassTrial180-ul-oob.xrm-ms"
	[0062.171] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.171] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.171] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.171] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4b09e82, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4b09e82, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4c14eea, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d45, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_Grace-ul-oob.xrm-ms", cAlternateFileName="MOFCF1~1.XRM")) returned 1
	[0062.171] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.171] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned="MondoR_Grace-ppd.xrm-ms"
	[0062.171] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.171] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.171] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.171] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4a97702, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4a97702, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4ba2739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3080, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_KMS_Automation-ppd.xrm-ms", cAlternateFileName="MO1A2F~1.XRM")) returned 1
	[0062.171] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.171] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned="MondoR_Grace-ul-oob.xrm-ms"
	[0062.171] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.171] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.171] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.171] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe49fedb3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe49fedb3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4a97702, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d65, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_KMS_Automation-ul-oob.xrm-ms", cAlternateFileName="MONDOR~2.XRM")) returned 1
	[0062.171] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.171] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned="MondoR_KMS_Automation-ppd.xrm-ms"
	[0062.171] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.172] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.172] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.172] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4ae3c90, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4ae3c90, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4bc8a97, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x258d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_KMS_Automation-ul.xrm-ms", cAlternateFileName="MOFD63~1.XRM")) returned 1
	[0062.172] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.172] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned="MondoR_KMS_Automation-ul-oob.xrm-ms"
	[0062.172] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.172] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.172] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.172] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4c3b14f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4c3b14f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4d1ff59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x298b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_OEM_Perp-pl.xrm-ms", cAlternateFileName="MO8523~1.XRM")) returned 1
	[0062.172] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.172] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned="MondoR_KMS_Automation-ul.xrm-ms"
	[0062.172] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.172] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.172] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.172] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4a4b257, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4a4b257, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4b09e82, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6760, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_OEM_Perp-ppd.xrm-ms", cAlternateFileName="MONDOR~4.XRM")) returned 1
	[0062.172] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.172] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned="MondoR_OEM_Perp-pl.xrm-ms"
	[0062.172] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.172] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.172] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.173] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4a25005, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4a25005, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4ae3c90, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_OEM_Perp-ul-oob.xrm-ms", cAlternateFileName="MONDOR~3.XRM")) returned 1
	[0062.173] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.173] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned="MondoR_OEM_Perp-ppd.xrm-ms"
	[0062.173] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.173] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.173] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.173] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4f82560, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4f82560, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe50672e1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4dd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_OEM_Perp-ul-phn.xrm-ms", cAlternateFileName="MO05DE~1.XRM")) returned 1
	[0062.173] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.173] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned="MondoR_OEM_Perp-ul-oob.xrm-ms"
	[0062.173] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.173] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.173] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.173] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4ddeb2f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4ddeb2f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4e9d706, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2983, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_Retail-pl.xrm-ms", cAlternateFileName="MO7B3F~1.XRM")) returned 1
	[0062.173] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.173] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned="MondoR_OEM_Perp-ul-phn.xrm-ms"
	[0062.173] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.173] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.173] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.173] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4e04d8b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4e04d8b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4ec3936, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x675e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_Retail-ppd.xrm-ms", cAlternateFileName="MO6A4E~1.XRM")) returned 1
	[0062.173] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.174] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned="MondoR_Retail-pl.xrm-ms"
	[0062.174] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.174] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.174] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.174] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4d461ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4d461ae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4e2afa8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d36, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_Retail-ul-oob.xrm-ms", cAlternateFileName="MOD324~1.XRM")) returned 1
	[0062.174] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.174] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned="MondoR_Retail-ppd.xrm-ms"
	[0062.174] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.174] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.174] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.174] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4ddeb2f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4ddeb2f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4f82560, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4dcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_Retail-ul-phn.xrm-ms", cAlternateFileName="MO39E0~1.XRM")) returned 1
	[0062.179] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.179] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned="MondoR_Retail-ul-oob.xrm-ms"
	[0062.179] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.179] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.179] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.179] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4c3b14f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4c3b14f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4d925e9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2b9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_Subscription-pl.xrm-ms", cAlternateFileName="MOE06D~1.XRM")) returned 1
	[0062.179] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.179] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned="MondoR_Retail-ul-phn.xrm-ms"
	[0062.179] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.179] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.179] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.180] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4d461ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4d461ae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4e511f7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7e69, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_Subscription-ppd.xrm-ms", cAlternateFileName="MO3CDC~1.XRM")) returned 1
	[0062.180] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.180] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned="MondoR_Subscription-pl.xrm-ms"
	[0062.180] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.180] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.180] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.180] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4cd3aa8, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4cd3aa8, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4e04d8b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_Subscription-ul-oob.xrm-ms", cAlternateFileName="MOD85A~1.XRM")) returned 1
	[0062.180] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.180] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned="MondoR_Subscription-ppd.xrm-ms"
	[0062.180] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.180] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.180] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.180] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4c6135d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4c6135d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4d461ae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2ba3, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_Subscription2-pl.xrm-ms", cAlternateFileName="MOE696~1.XRM")) returned 1
	[0062.180] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.180] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned="MondoR_Subscription-ul-oob.xrm-ms"
	[0062.180] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.180] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.180] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.180] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4cd3aa8, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4cd3aa8, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4ddeb2f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7e6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_Subscription2-ppd.xrm-ms", cAlternateFileName="MOD3B0~1.XRM")) returned 1
	[0062.180] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.181] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned="MondoR_Subscription2-pl.xrm-ms"
	[0062.181] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.181] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.181] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.181] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe53fab78, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe53fab78, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe54df9d2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_Subscription2-ul-oob.xrm-ms", cAlternateFileName="MO3A09~1.XRM")) returned 1
	[0062.181] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.181] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned="MondoR_Subscription2-ppd.xrm-ms"
	[0062.181] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.181] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.181] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.181] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4ff4c1f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4ff4c1f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe50d9a48, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2b8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_SubTest-pl.xrm-ms", cAlternateFileName="MO7C66~1.XRM")) returned 1
	[0062.181] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.181] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned="MondoR_Subscription2-ul-oob.xrm-ms"
	[0062.181] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.181] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.181] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.181] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4ff4c1f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4ff4c1f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe533c027, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x679c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_SubTest-ppd.xrm-ms", cAlternateFileName="MOCE88~1.XRM")) returned 1
	[0062.181] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.181] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned="MondoR_SubTest-pl.xrm-ms"
	[0062.181] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.181] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.181] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.182] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe501ae6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe501ae6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe5125e2f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d47, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_SubTest-ul-oob.xrm-ms", cAlternateFileName="MODB58~1.XRM")) returned 1
	[0062.182] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.182] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned="MondoR_SubTest-ppd.xrm-ms"
	[0062.182] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.182] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.182] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.182] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4f0fda9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4f0fda9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4ff4c1f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2b8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_SubTest2-pl.xrm-ms", cAlternateFileName="MO14DE~1.XRM")) returned 1
	[0062.182] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.182] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned="MondoR_SubTest-ul-oob.xrm-ms"
	[0062.182] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.182] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.182] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.182] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4e2afa8, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4e2afa8, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4ee9b60, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x679d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_SubTest2-ppd.xrm-ms", cAlternateFileName="MOE88F~1.XRM")) returned 1
	[0062.182] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.182] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned="MondoR_SubTest2-pl.xrm-ms"
	[0062.182] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.182] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.182] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.182] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4f82560, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4f82560, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe50b37dd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_SubTest2-ul-oob.xrm-ms", cAlternateFileName="MO9617~1.XRM")) returned 1
	[0062.182] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.183] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned="MondoR_SubTest2-ppd.xrm-ms"
	[0062.183] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.183] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.183] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.183] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4ec3936, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4ec3936, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4fce9ec, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2b8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_SubTrial-pl.xrm-ms", cAlternateFileName="MODE19~1.XRM")) returned 1
	[0062.183] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.183] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned="MondoR_SubTest2-ul-oob.xrm-ms"
	[0062.183] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.183] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.183] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.183] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4ec3936, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4ec3936, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe501ae6b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x679d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_SubTrial-ppd.xrm-ms", cAlternateFileName="MO11F9~1.XRM")) returned 1
	[0062.183] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.183] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned="MondoR_SubTrial-pl.xrm-ms"
	[0062.183] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.183] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.183] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.183] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4e511f7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4e511f7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4f5c29b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_SubTrial-ul-oob.xrm-ms", cAlternateFileName="MO9448~1.XRM")) returned 1
	[0062.183] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.183] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned="MondoR_SubTrial-ppd.xrm-ms"
	[0062.183] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.183] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.184] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.184] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe565d12b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe565d12b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe5741fb4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2b93, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_SubTrial2-pl.xrm-ms", cAlternateFileName="MOCBA3~1.XRM")) returned 1
	[0062.184] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.184] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned="MondoR_SubTrial-ul-oob.xrm-ms"
	[0062.184] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.184] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.184] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.184] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe5420d88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe5420d88, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe5505c31, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x679e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_SubTrial2-ppd.xrm-ms", cAlternateFileName="MO108C~1.XRM")) returned 1
	[0062.184] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.184] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned="MondoR_SubTrial2-pl.xrm-ms"
	[0062.184] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.184] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.184] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.184] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe54934e0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe54934e0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe559e56a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_SubTrial2-ul-oob.xrm-ms", cAlternateFileName="MOCCE8~1.XRM")) returned 1
	[0062.184] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.184] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned="MondoR_SubTrial2-ppd.xrm-ms"
	[0062.184] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.184] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.184] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.184] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe53d491f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe53d491f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe54934e0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2b83, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_Trial-pl.xrm-ms", cAlternateFileName="MOB483~1.XRM")) returned 1
	[0062.185] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.185] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned="MondoR_SubTrial2-ul-oob.xrm-ms"
	[0062.185] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.185] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.185] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.185] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe53d491f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe53d491f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe55520ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x67d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_Trial-ppd.xrm-ms", cAlternateFileName="MO25B8~1.XRM")) returned 1
	[0062.185] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.185] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned="MondoR_Trial-pl.xrm-ms"
	[0062.185] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.185] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.185] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.185] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe53ae71a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe53ae71a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe546d2b6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d42, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_Trial-ul-oob.xrm-ms", cAlternateFileName="MOE202~1.XRM")) returned 1
	[0062.185] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.185] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned="MondoR_Trial-ppd.xrm-ms"
	[0062.185] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.185] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.185] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.186] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe50d9a48, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe50d9a48, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe53884b9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x30bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoVL_KMS_Client-ppd.xrm-ms", cAlternateFileName="MONDOV~1.XRM")) returned 1
	[0062.186] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.186] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned="MondoR_Trial-ul-oob.xrm-ms"
	[0062.186] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.186] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.186] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.186] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe53ae71a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe53ae71a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe5420d88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d59, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoVL_KMS_Client-ul-oob.xrm-ms", cAlternateFileName="MO445C~1.XRM")) returned 1
	[0062.186] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.186] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned="MondoVL_KMS_Client-ppd.xrm-ms"
	[0062.186] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.186] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.186] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.186] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe533c027, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe533c027, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe53d491f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2581, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoVL_KMS_Client-ul.xrm-ms", cAlternateFileName="MONDOV~4.XRM")) returned 1
	[0062.186] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.186] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned="MondoVL_KMS_Client-ul-oob.xrm-ms"
	[0062.186] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.186] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.186] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.186] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe533c027, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe533c027, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe5420d88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x297b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoVL_MAK-pl.xrm-ms", cAlternateFileName="MONDOV~3.XRM")) returned 1
	[0062.186] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.186] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned="MondoVL_KMS_Client-ul.xrm-ms"
	[0062.186] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.186] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.187] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.187] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe5125e2f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe5125e2f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe53ae71a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x307e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoVL_MAK-ppd.xrm-ms", cAlternateFileName="MONDOV~2.XRM")) returned 1
	[0062.187] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.187] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned="MondoVL_MAK-pl.xrm-ms"
	[0062.187] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.187] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.187] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.187] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe565d12b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe565d12b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe57b4606, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d38, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoVL_MAK-ul-oob.xrm-ms", cAlternateFileName="MOA9D3~1.XRM")) returned 1
	[0062.191] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.191] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned="MondoVL_MAK-ppd.xrm-ms"
	[0062.191] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.191] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.191] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.191] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe56f5a42, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe56f5a42, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe57da862, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4dd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoVL_MAK-ul-phn.xrm-ms", cAlternateFileName="MOACCE~1.XRM")) returned 1
	[0062.191] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.191] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned="MondoVL_MAK-ul-oob.xrm-ms"
	[0062.191] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.191] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.192] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.192] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe55c47dc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe55c47dc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe568339c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5780, dwReserved0=0x0, dwReserved1=0x0, cFileName="O365BusinessR_Grace-ppd.xrm-ms", cAlternateFileName="O374C4~1.XRM")) returned 1
	[0062.192] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.192] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned="MondoVL_MAK-ul-phn.xrm-ms"
	[0062.192] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.192] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.192] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.192] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe55eaa21, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe55eaa21, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe56cf7ea, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="O365BusinessR_Grace-ul-oob.xrm-ms", cAlternateFileName="O346D5~1.XRM")) returned 1
	[0062.192] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.192] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned="O365BusinessR_Grace-ppd.xrm-ms"
	[0062.192] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.192] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.192] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.192] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe5578312, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe5578312, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe56f5a42, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2bbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="O365BusinessR_Subscription-pl.xrm-ms", cAlternateFileName="O365BU~4.XRM")) returned 1
	[0062.192] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.192] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned="O365BusinessR_Grace-ul-oob.xrm-ms"
	[0062.192] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.192] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.192] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.192] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe559e56a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe559e56a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe565d12b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x632a, dwReserved0=0x0, dwReserved1=0x0, cFileName="O365BusinessR_Subscription-ppd.xrm-ms", cAlternateFileName="O3F979~1.XRM")) returned 1
	[0062.193] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.193] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned="O365BusinessR_Subscription-pl.xrm-ms"
	[0062.193] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.193] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.193] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.193] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe5578312, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe5578312, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe5636f0a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="O365BusinessR_Subscription-ul-oob.xrm-ms", cAlternateFileName="O38A0E~1.XRM")) returned 1
	[0062.193] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.193] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned="O365BusinessR_Subscription-ppd.xrm-ms"
	[0062.193] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.193] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.193] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.193] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe5505c31, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe5505c31, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe55c47dc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2ba7, dwReserved0=0x0, dwReserved1=0x0, cFileName="O365BusinessR_SubTest-pl.xrm-ms", cAlternateFileName="O365BU~3.XRM")) returned 1
	[0062.193] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.193] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned="O365BusinessR_Subscription-ul-oob.xrm-ms"
	[0062.193] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.193] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.193] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.193] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe5505c31, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe5505c31, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe55eaa21, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x57c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="O365BusinessR_SubTest-ppd.xrm-ms", cAlternateFileName="O365BU~2.XRM")) returned 1
	[0062.193] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.193] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned="O365BusinessR_SubTest-pl.xrm-ms"
	[0062.193] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.194] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.194] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.194] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe54934e0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe54934e0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe5578312, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="O365BusinessR_SubTest-ul-oob.xrm-ms", cAlternateFileName="O365BU~1.XRM")) returned 1
	[0062.194] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.194] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned="O365BusinessR_SubTest-ppd.xrm-ms"
	[0062.194] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.194] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.194] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.194] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe58731f5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe58731f5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe595804a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2bab, dwReserved0=0x0, dwReserved1=0x0, cFileName="O365BusinessR_SubTrial-pl.xrm-ms", cAlternateFileName="O37A5D~1.XRM")) returned 1
	[0062.194] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.194] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned="O365BusinessR_SubTest-ul-oob.xrm-ms"
	[0062.194] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.194] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.194] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.194] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe5800a85, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe5800a85, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe5931e55, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x57c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="O365BusinessR_SubTrial-ppd.xrm-ms", cAlternateFileName="O3DA6A~1.XRM")) returned 1
	[0062.194] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.194] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned="O365BusinessR_SubTrial-pl.xrm-ms"
	[0062.194] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.194] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.194] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.195] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe5afba39, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe5afba39, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe5bba5ac, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="O365BusinessR_SubTrial-ul-oob.xrm-ms", cAlternateFileName="O369C1~1.XRM")) returned 1
	[0062.195] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.195] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned="O365BusinessR_SubTrial-ppd.xrm-ms"
	[0062.195] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.195] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.195] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.195] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe57da862, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe57da862, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe589944e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2bd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="O365HomePremDemoR_BypassTrial180-pl.xrm-ms", cAlternateFileName="O363C4~1.XRM")) returned 1
	[0062.195] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.195] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned="O365BusinessR_SubTrial-ul-oob.xrm-ms"
	[0062.195] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.195] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.195] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.195] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe5800a85, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe5800a85, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe58e5931, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5aa7, dwReserved0=0x0, dwReserved1=0x0, cFileName="O365HomePremDemoR_BypassTrial180-ppd.xrm-ms", cAlternateFileName="O3BF9B~1.XRM")) returned 1
	[0062.195] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.195] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned="O365HomePremDemoR_BypassTrial180-pl.xrm-ms"
	[0062.195] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.195] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.195] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.195] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe5768162, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe5768162, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe59a44ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms", cAlternateFileName="O365HO~3.XRM")) returned 1
	[0062.195] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.195] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned="O365HomePremDemoR_BypassTrial180-ppd.xrm-ms"
	[0062.196] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.196] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.196] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.196] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe568339c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe568339c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe5768162, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5a1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="O365HomePremR_Grace-ppd.xrm-ms", cAlternateFileName="O365HO~1.XRM")) returned 1
	[0062.196] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.196] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned="O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms"
	[0062.196] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.196] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.196] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.196] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe5768162, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe5768162, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe5800a85, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="O365HomePremR_Grace-ul-oob.xrm-ms", cAlternateFileName="O365HO~4.XRM")) returned 1
	[0062.196] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.196] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned="O365HomePremR_Grace-ppd.xrm-ms"
	[0062.196] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.196] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.196] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.196] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe578e40e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe578e40e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe58731f5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2bbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="O365HomePremR_Subscription1-pl.xrm-ms", cAlternateFileName="O3470D~1.XRM")) returned 1
	[0062.196] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.196] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned="O365HomePremR_Grace-ul-oob.xrm-ms"
	[0062.196] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.196] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.196] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.197] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe56f5a42, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe56f5a42, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe5800a85, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x67ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="O365HomePremR_Subscription1-ppd.xrm-ms", cAlternateFileName="O365HO~2.XRM")) returned 1
	[0062.197] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.197] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned="O365HomePremR_Subscription1-pl.xrm-ms"
	[0062.197] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.197] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.197] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.197] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe61d6728, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe61d6728, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe626f052, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d83, dwReserved0=0x0, dwReserved1=0x0, cFileName="O365HomePremR_Subscription1-ul-oob.xrm-ms", cAlternateFileName="O3EC08~1.XRM")) returned 1
	[0062.197] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.197] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned="O365HomePremR_Subscription1-ppd.xrm-ms"
	[0062.197] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.197] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.197] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.197] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe5a893f7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe5a893f7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe5b6e14c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2bbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="O365HomePremR_Subscription2-pl.xrm-ms", cAlternateFileName="O394D6~1.XRM")) returned 1
	[0062.197] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.197] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned="O365HomePremR_Subscription1-ul-oob.xrm-ms"
	[0062.197] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.197] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.197] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.197] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe5a631e9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe5a631e9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe5b47f19, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x67ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="O365HomePremR_Subscription2-ppd.xrm-ms", cAlternateFileName="O36B97~1.XRM")) returned 1
	[0062.197] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.197] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned="O365HomePremR_Subscription2-pl.xrm-ms"
	[0062.198] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.198] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.198] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.198] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe5a631e9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe5a631e9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe5b94335, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d83, dwReserved0=0x0, dwReserved1=0x0, cFileName="O365HomePremR_Subscription2-ul-oob.xrm-ms", cAlternateFileName="O381C0~1.XRM")) returned 1
	[0062.198] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.198] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned="O365HomePremR_Subscription2-ppd.xrm-ms"
	[0062.198] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.198] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.198] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.198] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe59a44ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe59a44ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe5ad5847, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2bbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="O365HomePremR_Subscription3-pl.xrm-ms", cAlternateFileName="O3FF0E~1.XRM")) returned 1
	[0062.237] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.237] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned="O365HomePremR_Subscription2-ul-oob.xrm-ms"
	[0062.237] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.237] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.237] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.237] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe595804a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe595804a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe5a631e9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x67ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="O365HomePremR_Subscription3-ppd.xrm-ms", cAlternateFileName="O32FFC~1.XRM")) returned 1
	[0062.237] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.237] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned="O365HomePremR_Subscription3-pl.xrm-ms"
	[0062.237] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.237] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.237] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.238] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe589944e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe589944e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe597e395, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d83, dwReserved0=0x0, dwReserved1=0x0, cFileName="O365HomePremR_Subscription3-ul-oob.xrm-ms", cAlternateFileName="O3C0D2~1.XRM")) returned 1
	[0062.238] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.238] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned="O365HomePremR_Subscription3-ppd.xrm-ms"
	[0062.238] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.238] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.238] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.238] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe597e395, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe597e395, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe5a893f7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2bbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="O365HomePremR_Subscription4-pl.xrm-ms", cAlternateFileName="O35B45~1.XRM")) returned 1
	[0062.238] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.294] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned="O365HomePremR_Subscription3-ul-oob.xrm-ms"
	[0062.294] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.294] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.294] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.295] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe5931e55, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe5931e55, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe5a3cfb3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x67ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="O365HomePremR_Subscription4-ppd.xrm-ms", cAlternateFileName="O3F5C1~1.XRM")) returned 1
	[0062.295] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.295] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned="O365HomePremR_Subscription4-pl.xrm-ms"
	[0062.295] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.295] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.295] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.295] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe5931e55, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe5931e55, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe5afba39, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d83, dwReserved0=0x0, dwReserved1=0x0, cFileName="O365HomePremR_Subscription4-ul-oob.xrm-ms", cAlternateFileName="O370C7~1.XRM")) returned 1
	[0062.295] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.295] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned="O365HomePremR_Subscription4-ppd.xrm-ms"
	[0062.295] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.295] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.295] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.295] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe5c9f573, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe5c9f573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe5d37d8b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2bbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="O365HomePremR_Subscription5-pl.xrm-ms", cAlternateFileName="O397F0~1.XRM")) returned 1
	[0062.295] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.295] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned="O365HomePremR_Subscription4-ul-oob.xrm-ms"
	[0062.295] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.295] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.295] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.296] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe5c791bb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe5c791bb, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe5d11b2f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x67ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="O365HomePremR_Subscription5-ppd.xrm-ms", cAlternateFileName="O3057F~1.XRM")) returned 1
	[0062.296] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.296] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned="O365HomePremR_Subscription5-pl.xrm-ms"
	[0062.296] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.296] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.296] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.296] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe5c52f59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe5c52f59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe5ceb8e3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d83, dwReserved0=0x0, dwReserved1=0x0, cFileName="O365HomePremR_Subscription5-ul-oob.xrm-ms", cAlternateFileName="O3FD01~1.XRM")) returned 1
	[0062.296] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.296] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned="O365HomePremR_Subscription5-ppd.xrm-ms"
	[0062.296] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.296] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.296] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.296] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe5c2ccf4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe5c2ccf4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe5cc5650, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2bab, dwReserved0=0x0, dwReserved1=0x0, cFileName="O365HomePremR_SubTest1-pl.xrm-ms", cAlternateFileName="O35B7D~1.XRM")) returned 1
	[0062.296] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.296] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned="O365HomePremR_Subscription5-ul-oob.xrm-ms"
	[0062.296] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.296] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.296] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.296] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe5fc05cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe5fc05cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe60f1896, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5a5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="O365HomePremR_SubTest1-ppd.xrm-ms", cAlternateFileName="O3955A~1.XRM")) returned 1
	[0062.296] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.297] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned="O365HomePremR_SubTest1-pl.xrm-ms"
	[0062.297] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.297] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.297] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.297] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe5afba39, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe5afba39, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe5f9a39c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="O365HomePremR_SubTest1-ul-oob.xrm-ms", cAlternateFileName="O353AD~1.XRM")) returned 1
	[0062.297] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.297] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned="O365HomePremR_SubTest1-ppd.xrm-ms"
	[0062.297] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.297] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.297] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.297] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe5bba5ac, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe5bba5ac, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe5c9f573, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2bab, dwReserved0=0x0, dwReserved1=0x0, cFileName="O365HomePremR_SubTest2-pl.xrm-ms", cAlternateFileName="O3B6B4~1.XRM")) returned 1
	[0062.297] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.297] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned="O365HomePremR_SubTest1-ul-oob.xrm-ms"
	[0062.297] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.297] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.297] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\how-to-decrypt-files.htm")) returned 0x20
	[0062.297] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.297] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned="O365HomePremR_SubTest2-pl.xrm-ms"
	[0062.297] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.297] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.299] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.299] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned="O365HomePremR_SubTest2-ppd.xrm-ms"
	[0062.299] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.299] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.300] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.300] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned="O365HomePremR_SubTest2-ul-oob.xrm-ms"
	[0062.300] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.300] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.300] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.300] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned="O365HomePremR_SubTest3-pl.xrm-ms"
	[0062.300] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.300] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.300] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.300] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned="O365HomePremR_SubTest3-ppd.xrm-ms"
	[0062.300] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.300] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.300] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0062.300] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned="O365HomePremR_SubTest3-ul-oob.xrm-ms"
	[0062.300] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.300] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.300] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned="O365HomePremR_SubTest4-pl.xrm-ms"
	[0062.300] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.300] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.301] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned="O365HomePremR_SubTest4-ppd.xrm-ms"
	[0062.301] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\"
	[0062.301] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned=""
	[0062.301] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned="O365HomePremR_SubTest4-ul-oob.xrm-ms"
	[0062.301] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned="O365HomePremR_SubTest5-pl.xrm-ms"
	[0062.301] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned="O365HomePremR_SubTest5-ppd.xrm-ms"
	[0062.306] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned="O365HomePremR_SubTest5-ul-oob.xrm-ms"
	[0062.306] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned="O365HomePremR_SubTrial1-pl.xrm-ms"
	[0062.306] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned="O365HomePremR_SubTrial1-ppd.xrm-ms"
	[0062.306] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned="O365HomePremR_SubTrial1-ul-oob.xrm-ms"
	[0062.306] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned="O365HomePremR_SubTrial2-pl.xrm-ms"
	[0062.306] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned="O365HomePremR_SubTrial2-ppd.xrm-ms"
	[0062.306] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned="O365HomePremR_SubTrial2-ul-oob.xrm-ms"
	[0062.306] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned="O365HomePremR_SubTrial3-pl.xrm-ms"
	[0062.307] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned="O365HomePremR_SubTrial3-ppd.xrm-ms"
	[0062.307] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned="O365HomePremR_SubTrial3-ul-oob.xrm-ms"
	[0062.307] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned="O365HomePremR_SubTrial4-pl.xrm-ms"
	[0062.307] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned="O365HomePremR_SubTrial4-ppd.xrm-ms"
	[0062.307] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned="O365HomePremR_SubTrial4-ul-oob.xrm-ms"
	[0062.307] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned="O365HomePremR_SubTrial5-pl.xrm-ms"
	[0062.307] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned="O365HomePremR_SubTrial5-ppd.xrm-ms"
	[0062.307] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned="O365HomePremR_SubTrial5-ul-oob.xrm-ms"
	[0062.307] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned="O365ProPlusDemoR_BypassTrial180-pl.xrm-ms"
	[0062.308] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned="O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms"
	[0062.308] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned="O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms"
	[0062.308] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned="O365ProPlusR_Grace-ppd.xrm-ms"
	[0062.308] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned="O365ProPlusR_Grace-ul-oob.xrm-ms"
	[0062.308] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned="O365ProPlusR_Subscription1-pl.xrm-ms"
	[0062.308] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned="O365ProPlusR_Subscription1-ppd.xrm-ms"
	[0062.308] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned="O365ProPlusR_Subscription1-ul-oob.xrm-ms"
	[0062.312] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned="O365ProPlusR_Subscription2-pl.xrm-ms"
	[0062.312] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned="O365ProPlusR_Subscription2-ppd.xrm-ms"
	[0062.312] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned="O365ProPlusR_Subscription2-ul-oob.xrm-ms"
	[0062.312] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms") returned="O365ProPlusR_Subscription3-pl.xrm-ms"
	[0062.313] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms") returned="O365ProPlusR_Subscription3-ppd.xrm-ms"
	[0062.313] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms") returned="O365ProPlusR_Subscription3-ul-oob.xrm-ms"
	[0062.313] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms") returned="O365ProPlusR_Subscription4-pl.xrm-ms"
	[0062.313] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms") returned="O365ProPlusR_Subscription4-ppd.xrm-ms"
	[0062.313] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms") returned="O365ProPlusR_Subscription4-ul-oob.xrm-ms"
	[0062.313] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms") returned="O365ProPlusR_Subscription5-pl.xrm-ms"
	[0062.313] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms") returned="O365ProPlusR_Subscription5-ppd.xrm-ms"
	[0062.313] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms") returned="O365ProPlusR_Subscription5-ul-oob.xrm-ms"
	[0062.314] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms") returned="O365ProPlusR_SubTrial1-pl.xrm-ms"
	[0062.314] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms") returned="O365ProPlusR_SubTrial1-ppd.xrm-ms"
	[0062.314] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms") returned="O365ProPlusR_SubTrial1-ul-oob.xrm-ms"
	[0062.314] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms") returned="O365ProPlusR_SubTrial2-pl.xrm-ms"
	[0062.314] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms") returned="O365ProPlusR_SubTrial2-ppd.xrm-ms"
	[0062.314] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms") returned="O365ProPlusR_SubTrial2-ul-oob.xrm-ms"
	[0062.314] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms") returned="O365ProPlusR_SubTrial3-pl.xrm-ms"
	[0062.314] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms") returned="O365ProPlusR_SubTrial3-ppd.xrm-ms"
	[0062.314] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms") returned="O365ProPlusR_SubTrial3-ul-oob.xrm-ms"
	[0062.315] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms") returned="O365ProPlusR_SubTrial4-pl.xrm-ms"
	[0062.315] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms") returned="O365ProPlusR_SubTrial4-ppd.xrm-ms"
	[0062.315] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms") returned="O365ProPlusR_SubTrial4-ul-oob.xrm-ms"
	[0062.320] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms") returned="O365ProPlusR_SubTrial5-pl.xrm-ms"
	[0062.320] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms") returned="O365ProPlusR_SubTrial5-ppd.xrm-ms"
	[0062.321] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms") returned="O365ProPlusR_SubTrial5-ul-oob.xrm-ms"
	[0062.321] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms") returned="O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms"
	[0062.321] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms") returned="O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms"
	[0062.321] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms") returned="O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms"
	[0062.321] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms") returned="O365SmallBusPremR_Grace-ppd.xrm-ms"
	[0062.321] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms") returned="O365SmallBusPremR_Grace-ul-oob.xrm-ms"
	[0062.321] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms") returned="O365SmallBusPremR_Subscription1-pl.xrm-ms"
	[0062.321] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms") returned="O365SmallBusPremR_Subscription1-ppd.xrm-ms"
	[0062.321] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms") returned="O365SmallBusPremR_Subscription1-ul-oob.xrm-ms"
	[0062.322] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms") returned="O365SmallBusPremR_Subscription2-pl.xrm-ms"
	[0062.322] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms") returned="O365SmallBusPremR_Subscription2-ppd.xrm-ms"
	[0062.322] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms") returned="O365SmallBusPremR_Subscription2-ul-oob.xrm-ms"
	[0062.322] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms") returned="O365SmallBusPremR_Subscription3-pl.xrm-ms"
	[0062.322] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms") returned="O365SmallBusPremR_Subscription3-ppd.xrm-ms"
	[0062.322] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms") returned="O365SmallBusPremR_Subscription3-ul-oob.xrm-ms"
	[0062.322] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms") returned="O365SmallBusPremR_Subscription4-pl.xrm-ms"
	[0062.322] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms") returned="O365SmallBusPremR_Subscription4-ppd.xrm-ms"
	[0062.323] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms") returned="O365SmallBusPremR_Subscription4-ul-oob.xrm-ms"
	[0062.323] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms") returned="O365SmallBusPremR_Subscription5-pl.xrm-ms"
	[0062.323] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms") returned="O365SmallBusPremR_Subscription5-ppd.xrm-ms"
	[0062.336] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms") returned="O365SmallBusPremR_Subscription5-ul-oob.xrm-ms"
	[0062.336] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-pl.xrm-ms") returned="O365SmallBusPremR_SubTrial1-pl.xrm-ms"
	[0062.336] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ppd.xrm-ms") returned="O365SmallBusPremR_SubTrial1-ppd.xrm-ms"
	[0062.336] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms") returned="O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms"
	[0062.336] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-pl.xrm-ms") returned="O365SmallBusPremR_SubTrial2-pl.xrm-ms"
	[0062.336] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ppd.xrm-ms") returned="O365SmallBusPremR_SubTrial2-ppd.xrm-ms"
	[0062.336] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms") returned="O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms"
	[0062.336] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-pl.xrm-ms") returned="O365SmallBusPremR_SubTrial3-pl.xrm-ms"
	[0062.337] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ppd.xrm-ms") returned="O365SmallBusPremR_SubTrial3-ppd.xrm-ms"
	[0062.418] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms") returned="O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms"
	[0062.418] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-pl.xrm-ms") returned="O365SmallBusPremR_SubTrial4-pl.xrm-ms"
	[0062.418] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ppd.xrm-ms") returned="O365SmallBusPremR_SubTrial4-ppd.xrm-ms"
	[0062.418] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms") returned="O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms"
	[0062.418] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-pl.xrm-ms") returned="O365SmallBusPremR_SubTrial5-pl.xrm-ms"
	[0062.418] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ppd.xrm-ms") returned="O365SmallBusPremR_SubTrial5-ppd.xrm-ms"
	[0062.419] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms") returned="O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms"
	[0062.419] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-pl.xrm-ms") returned="OneNoteFreeR_Bypass-pl.xrm-ms"
	[0062.419] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ppd.xrm-ms") returned="OneNoteFreeR_Bypass-ppd.xrm-ms"
	[0062.419] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ul-oob.xrm-ms") returned="OneNoteFreeR_Bypass-ul-oob.xrm-ms"
	[0062.419] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ppd.xrm-ms") returned="OneNoteR_Grace-ppd.xrm-ms"
	[0062.419] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ul-oob.xrm-ms") returned="OneNoteR_Grace-ul-oob.xrm-ms"
	[0062.419] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-pl.xrm-ms") returned="OneNoteR_OEM_Perp-pl.xrm-ms"
	[0062.419] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ppd.xrm-ms") returned="OneNoteR_OEM_Perp-ppd.xrm-ms"
	[0062.419] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-oob.xrm-ms") returned="OneNoteR_OEM_Perp-ul-oob.xrm-ms"
	[0062.459] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-phn.xrm-ms") returned="OneNoteR_OEM_Perp-ul-phn.xrm-ms"
	[0063.182] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\BASIC.HTM" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\basic.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\BASIC.HTM.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\basic.htm.exe")) returned 1
	[0063.250] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DBSAMPLE.MDB" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dbsample.mdb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DBSAMPLE.MDB.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dbsample.mdb.exe")) returned 1
	[0063.383] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.DOC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.doc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.DOC.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.doc.exe")) returned 1
	[0063.386] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.PPT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.ppt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.PPT.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.ppt.exe")) returned 1
	[0063.389] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.XLS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.XLS.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.xls.exe")) returned 1
	[0063.391] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.DOC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.doc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.DOC.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.doc.exe")) returned 1
	[0063.393] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.PPT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.ppt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.PPT.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.ppt.exe")) returned 1
	[0063.396] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.XLS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.XLS.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.xls.exe")) returned 1
	[0063.482] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR10F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir10f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR10F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir10f.gif.exe")) returned 1
	[0063.487] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR11F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir11f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR11F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir11f.gif.exe")) returned 1
	[0063.512] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR12F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir12f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR12F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir12f.gif.exe")) returned 1
	[0063.550] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR13F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir13f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR13F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir13f.gif.exe")) returned 1
	[0063.563] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR14F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir14f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR14F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir14f.gif.exe")) returned 1
	[0063.607] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR15F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir15f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR15F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir15f.gif.exe")) returned 1
	[0063.610] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR16F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir16f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR16F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir16f.gif.exe")) returned 1
	[0063.612] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR17F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir17f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR17F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir17f.gif.exe")) returned 1
	[0063.656] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR18F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir18f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR18F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir18f.gif.exe")) returned 1
	[0063.661] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR19F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir19f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR19F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir19f.gif.exe")) returned 1
	[0063.663] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR1B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir1b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR1B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir1b.gif.exe")) returned 1
	[0063.679] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR1F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir1f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR1F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir1f.gif.exe")) returned 1
	[0063.682] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR20F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir20f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR20F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir20f.gif.exe")) returned 1
	[0063.685] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR21F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir21f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR21F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir21f.gif.exe")) returned 1
	[0063.740] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR22F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir22f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR22F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir22f.gif.exe")) returned 1
	[0063.761] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR23F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir23f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR23F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir23f.gif.exe")) returned 1
	[0063.764] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR24F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir24f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR24F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir24f.gif.exe")) returned 1
	[0063.766] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR25F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir25f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR25F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir25f.gif.exe")) returned 1
	[0063.768] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR26F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir26f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR26F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir26f.gif.exe")) returned 1
	[0063.771] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR27F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir27f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR27F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir27f.gif.exe")) returned 1
	[0063.773] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR28B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir28b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR28B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir28b.gif.exe")) returned 1
	[0063.836] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR28F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir28f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR28F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir28f.gif.exe")) returned 1
	[0063.861] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR29B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir29b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR29B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir29b.gif.exe")) returned 1
	[0063.866] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR29F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir29f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR29F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir29f.gif.exe")) returned 1
	[0063.868] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR2B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir2b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR2B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir2b.gif.exe")) returned 1
	[0063.870] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR2F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir2f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR2F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir2f.gif.exe")) returned 1
	[0063.873] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR30B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir30b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR30B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir30b.gif.exe")) returned 1
	[0063.885] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR30F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir30f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR30F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir30f.gif.exe")) returned 1
	[0063.888] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR31B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir31b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR31B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir31b.gif.exe")) returned 1
	[0063.891] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR31F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir31f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR31F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir31f.gif.exe")) returned 1
	[0063.894] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR32B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir32b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR32B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir32b.gif.exe")) returned 1
	[0063.897] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR32F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir32f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR32F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir32f.gif.exe")) returned 1
	[0063.900] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR33B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir33b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR33B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir33b.gif.exe")) returned 1
	[0063.903] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR33F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir33f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR33F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir33f.gif.exe")) returned 1
	[0063.905] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR34B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir34b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR34B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir34b.gif.exe")) returned 1
	[0063.908] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR34F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir34f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR34F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir34f.gif.exe")) returned 1
	[0063.911] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR35B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir35b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR35B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir35b.gif.exe")) returned 1
	[0063.936] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR35F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir35f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR35F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir35f.gif.exe")) returned 1
	[0063.939] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR36B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir36b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR36B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir36b.gif.exe")) returned 1
	[0063.942] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR36F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir36f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR36F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir36f.gif.exe")) returned 1
	[0063.945] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR37F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir37f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR37F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir37f.gif.exe")) returned 1
	[0063.948] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR38F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir38f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR38F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir38f.gif.exe")) returned 1
	[0063.952] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR39F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir39f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR39F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir39f.gif.exe")) returned 1
	[0063.954] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR3B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir3b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR3B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir3b.gif.exe")) returned 1
	[0063.957] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR3F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir3f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR3F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir3f.gif.exe")) returned 1
	[0063.959] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR40F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir40f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR40F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir40f.gif.exe")) returned 1
	[0063.962] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR41F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir41f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR41F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir41f.gif.exe")) returned 1
	[0063.970] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR42F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir42f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR42F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir42f.gif.exe")) returned 1
	[0063.972] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR43B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir43b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR43B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir43b.gif.exe")) returned 1
	[0063.974] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR43F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir43f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR43F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir43f.gif.exe")) returned 1
	[0064.017] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR44B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir44b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR44B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir44b.gif.exe")) returned 1
	[0064.020] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR44F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir44f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR44F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir44f.gif.exe")) returned 1
	[0064.022] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR45B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir45b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR45B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir45b.gif.exe")) returned 1
	[0064.024] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR45F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir45f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR45F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir45f.gif.exe")) returned 1
	[0064.029] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR46B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir46b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR46B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir46b.gif.exe")) returned 1
	[0064.032] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR46F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir46f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR46F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir46f.gif.exe")) returned 1
	[0064.034] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR47B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir47b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR47B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir47b.gif.exe")) returned 1
	[0064.037] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR47F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir47f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR47F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir47f.gif.exe")) returned 1
	[0064.040] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR48B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir48b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR48B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir48b.gif.exe")) returned 1
	[0064.042] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR48F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir48f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR48F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir48f.gif.exe")) returned 1
	[0064.045] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR49B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir49b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR49B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir49b.gif.exe")) returned 1
	[0064.048] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR49F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir49f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR49F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir49f.gif.exe")) returned 1
	[0064.050] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR4B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir4b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR4B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir4b.gif.exe")) returned 1
	[0064.053] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR4F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir4f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR4F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir4f.gif.exe")) returned 1
	[0064.055] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR50B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir50b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR50B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir50b.gif.exe")) returned 1
	[0064.100] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR50F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir50f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR50F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir50f.gif.exe")) returned 1
	[0064.264] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR51B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir51b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR51B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir51b.gif.exe")) returned 1
	[0064.266] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR51F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir51f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR51F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir51f.gif.exe")) returned 1
	[0064.269] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR5B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir5b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR5B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir5b.gif.exe")) returned 1
	[0064.272] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR5F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir5f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR5F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir5f.gif.exe")) returned 1
	[0064.276] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR6B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir6b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR6B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir6b.gif.exe")) returned 1
	[0064.279] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR6F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir6f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR6F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir6f.gif.exe")) returned 1
	[0064.282] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR7B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir7b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR7B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir7b.gif.exe")) returned 1
	[0064.285] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR7F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir7f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR7F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir7f.gif.exe")) returned 1
	[0064.287] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR8B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir8b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR8B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir8b.gif.exe")) returned 1
	[0064.289] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR8F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir8f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR8F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir8f.gif.exe")) returned 1
	[0064.291] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR9B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir9b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR9B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir9b.gif.exe")) returned 1
	[0064.294] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR9F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir9f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR9F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir9f.gif.exe")) returned 1
	[0064.295] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR00.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir00.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR00.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir00.gif.exe")) returned 1
	[0064.297] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR10F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir10f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR10F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir10f.gif.exe")) returned 1
	[0064.507] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR11F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir11f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR11F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir11f.gif.exe")) returned 1
	[0064.524] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR12F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir12f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR12F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir12f.gif.exe")) returned 1
	[0064.527] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR13F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir13f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR13F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir13f.gif.exe")) returned 1
	[0064.529] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR14F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir14f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR14F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir14f.gif.exe")) returned 1
	[0064.534] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR15F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir15f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR15F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir15f.gif.exe")) returned 1
	[0064.536] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR16F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir16f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR16F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir16f.gif.exe")) returned 1
	[0064.641] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR17F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir17f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR17F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir17f.gif.exe")) returned 1
	[0064.651] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR18F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir18f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR18F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir18f.gif.exe")) returned 1
	[0064.654] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR19F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir19f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR19F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir19f.gif.exe")) returned 1
	[0064.656] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR1B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir1b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR1B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir1b.gif.exe")) returned 1
	[0064.659] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR1F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir1f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR1F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir1f.gif.exe")) returned 1
	[0064.664] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR20F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir20f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR20F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir20f.gif.exe")) returned 1
	[0064.667] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR21F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir21f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR21F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir21f.gif.exe")) returned 1
	[0064.670] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR22F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir22f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR22F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir22f.gif.exe")) returned 1
	[0064.672] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR23F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir23f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR23F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir23f.gif.exe")) returned 1
	[0064.675] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR24F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir24f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR24F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir24f.gif.exe")) returned 1
	[0064.677] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR25F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir25f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR25F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir25f.gif.exe")) returned 1
	[0064.679] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR26F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir26f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR26F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir26f.gif.exe")) returned 1
	[0064.681] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR27F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir27f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR27F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir27f.gif.exe")) returned 1
	[0064.744] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR28F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir28f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR28F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir28f.gif.exe")) returned 1
	[0064.747] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR29F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir29f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR29F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir29f.gif.exe")) returned 1
	[0064.749] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR2B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir2b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR2B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir2b.gif.exe")) returned 1
	[0064.752] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR2F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir2f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR2F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir2f.gif.exe")) returned 1
	[0064.755] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR30F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir30f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR30F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir30f.gif.exe")) returned 1
	[0064.757] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR31F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir31f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR31F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir31f.gif.exe")) returned 1
	[0064.760] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR32F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir32f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR32F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir32f.gif.exe")) returned 1
	[0064.763] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR33F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir33f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR33F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir33f.gif.exe")) returned 1
	[0064.765] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR34F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir34f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR34F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir34f.gif.exe")) returned 1
	[0064.768] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR35F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir35f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR35F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir35f.gif.exe")) returned 1
	[0064.771] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR36F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir36f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR36F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir36f.gif.exe")) returned 1
	[0064.774] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR37F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir37f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR37F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir37f.gif.exe")) returned 1
	[0064.777] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR38F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir38f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR38F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir38f.gif.exe")) returned 1
	[0064.783] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR39F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir39f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR39F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir39f.gif.exe")) returned 1
	[0064.785] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR3B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir3b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR3B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir3b.gif.exe")) returned 1
	[0064.885] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR3F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir3f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR3F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir3f.gif.exe")) returned 1
	[0064.889] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR40F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir40f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR40F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir40f.gif.exe")) returned 1
	[0064.891] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR41F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir41f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR41F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir41f.gif.exe")) returned 1
	[0064.894] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR42F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir42f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR42F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir42f.gif.exe")) returned 1
	[0064.896] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR43B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir43b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR43B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir43b.gif.exe")) returned 1
	[0064.901] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR43F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir43f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR43F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir43f.gif.exe")) returned 1
	[0064.904] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR44B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir44b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR44B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir44b.gif.exe")) returned 1
	[0064.907] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR44F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir44f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR44F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir44f.gif.exe")) returned 1
	[0064.909] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR45B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir45b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR45B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir45b.gif.exe")) returned 1
	[0064.911] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR45F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir45f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR45F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir45f.gif.exe")) returned 1
	[0064.914] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR46B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir46b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR46B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir46b.gif.exe")) returned 1
	[0064.916] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR46F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir46f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR46F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir46f.gif.exe")) returned 1
	[0064.919] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR47B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir47b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR47B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir47b.gif.exe")) returned 1
	[0064.921] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR47F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir47f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR47F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir47f.gif.exe")) returned 1
	[0064.965] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR48B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir48b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR48B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir48b.gif.exe")) returned 1
	[0064.969] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR48F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir48f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR48F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir48f.gif.exe")) returned 1
	[0064.972] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR49B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir49b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR49B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir49b.gif.exe")) returned 1
	[0064.975] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR49F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir49f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR49F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir49f.gif.exe")) returned 1
	[0064.977] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR4B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir4b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR4B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir4b.gif.exe")) returned 1
	[0064.980] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR4F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir4f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR4F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir4f.gif.exe")) returned 1
	[0064.983] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR50B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir50b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR50B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir50b.gif.exe")) returned 1
	[0064.985] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR50F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir50f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR50F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir50f.gif.exe")) returned 1
	[0064.988] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR51B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir51b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR51B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir51b.gif.exe")) returned 1
	[0064.992] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR51F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir51f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR51F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir51f.gif.exe")) returned 1
	[0064.995] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR5B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir5b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR5B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir5b.gif.exe")) returned 1
	[0064.998] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR5F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir5f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR5F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir5f.gif.exe")) returned 1
	[0065.001] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR6B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir6b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR6B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir6b.gif.exe")) returned 1
	[0065.005] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR6F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir6f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR6F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir6f.gif.exe")) returned 1
	[0065.011] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR7B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir7b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR7B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir7b.gif.exe")) returned 1
	[0065.029] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR7F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir7f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR7F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir7f.gif.exe")) returned 1
	[0065.031] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR8B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir8b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR8B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir8b.gif.exe")) returned 1
	[0065.034] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR8F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir8f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR8F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir8f.gif.exe")) returned 1
	[0065.036] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR9B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir9b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR9B.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir9b.gif.exe")) returned 1
	[0065.039] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR9F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir9f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR9F.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir9f.gif.exe")) returned 1
	[0065.113] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\AccessWeb\\CLNTWRAP.HTM" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accessweb\\clntwrap.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\AccessWeb\\CLNTWRAP.HTM.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accessweb\\clntwrap.htm.exe")) returned 1
	[0065.449] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\BI-Report.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\bi-report.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\BI-Report.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\bi-report.png.exe")) returned 1
	[0066.233] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Configuration\\card_expiration_terms_dict.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\configuration\\card_expiration_terms_dict.txt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Configuration\\card_expiration_terms_dict.txt.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\configuration\\card_expiration_terms_dict.txt.exe")) returned 1
	[0066.237] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Configuration\\card_security_terms_dict.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\configuration\\card_security_terms_dict.txt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Configuration\\card_security_terms_dict.txt.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\configuration\\card_security_terms_dict.txt.exe")) returned 1
	[0066.239] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Configuration\\card_terms_dict.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\configuration\\card_terms_dict.txt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Configuration\\card_terms_dict.txt.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\configuration\\card_terms_dict.txt.exe")) returned 1
	[0066.253] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Configuration\\ssn_high_group_info.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\configuration\\ssn_high_group_info.txt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Configuration\\ssn_high_group_info.txt.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\configuration\\ssn_high_group_info.txt.exe")) returned 1
	[0066.266] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\excel.exe.manifest" (normalized: "c:\\program files\\microsoft office\\root\\office16\\excel.exe.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\excel.exe.manifest.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\excel.exe.manifest.exe")) returned 1
	[0066.269] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\excelcnv.exe.manifest" (normalized: "c:\\program files\\microsoft office\\root\\office16\\excelcnv.exe.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\excelcnv.exe.manifest.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\excelcnv.exe.manifest.exe")) returned 1
	[0066.322] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Graph.exe.manifest" (normalized: "c:\\program files\\microsoft office\\root\\office16\\graph.exe.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Graph.exe.manifest.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\graph.exe.manifest.exe")) returned 1
	[0066.352] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\COUGH.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\people\\cough.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\COUGH.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\people\\cough.wav.exe")) returned 1
	[0066.355] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\GIGGLE.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\people\\giggle.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\GIGGLE.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\people\\giggle.wav.exe")) returned 1
	[0066.362] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\HICCUP.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\people\\hiccup.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\HICCUP.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\people\\hiccup.wav.exe")) returned 1
	[0066.365] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\MMHMM.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\people\\mmhmm.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\MMHMM.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\people\\mmhmm.wav.exe")) returned 1
	[0066.369] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\SNEEZE.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\people\\sneeze.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\SNEEZE.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\people\\sneeze.wav.exe")) returned 1
	[0066.373] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\THROAT.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\people\\throat.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\THROAT.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\people\\throat.wav.exe")) returned 1
	[0066.376] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\Whistling.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\people\\whistling.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\Whistling.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\people\\whistling.wav.exe")) returned 1
	[0066.381] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\ALARM.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\places\\alarm.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\ALARM.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\places\\alarm.wav.exe")) returned 1
	[0066.385] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\BUZZ.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\places\\buzz.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\BUZZ.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\places\\buzz.wav.exe")) returned 1
	[0066.389] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\LASER.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\places\\laser.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\LASER.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\places\\laser.wav.exe")) returned 1
	[0066.392] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\RADAR.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\places\\radar.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\RADAR.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\places\\radar.wav.exe")) returned 1
	[0066.395] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\TOOT.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\places\\toot.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\TOOT.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\places\\toot.wav.exe")) returned 1
	[0066.399] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\VIBE.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\places\\vibe.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\VIBE.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\places\\vibe.wav.exe")) returned 1
	[0066.409] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\WARN.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\places\\warn.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\WARN.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\places\\warn.wav.exe")) returned 1
	[0066.453] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\CAN.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\things\\can.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\CAN.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\things\\can.wav.exe")) returned 1
	[0066.456] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\COUPLER.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\things\\coupler.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\COUPLER.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\things\\coupler.wav.exe")) returned 1
	[0066.467] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\HORN.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\things\\horn.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\HORN.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\things\\horn.wav.exe")) returned 1
	[0066.470] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\SHOT.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\things\\shot.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\SHOT.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\things\\shot.wav.exe")) returned 1
	[0066.473] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\SHOVEL.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\things\\shovel.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\SHOVEL.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\things\\shovel.wav.exe")) returned 1
	[0066.477] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\SPLASH.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\things\\splash.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\SPLASH.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\things\\splash.wav.exe")) returned 1
	[0066.480] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\WHOOSH.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\things\\whoosh.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\WHOOSH.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\things\\whoosh.wav.exe")) returned 1
	[0066.489] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\DataListIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\datalisticonimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\DataListIconImages.jpg.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\datalisticonimages.jpg.exe")) returned 1
	[0066.493] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\datalisticonimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\datalisticonimagesmask.bmp.exe")) returned 1
	[0066.506] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\GRIP.JPG" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\grip.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\GRIP.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\grip.jpg.exe")) returned 1
	[0066.509] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\GRIPMASK.BMP" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\gripmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\GRIPMASK.BMP.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\gripmask.bmp.exe")) returned 1
	[0066.511] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\InformationIcon.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\informationicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\InformationIcon.jpg.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\informationicon.jpg.exe")) returned 1
	[0066.520] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\InformationIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\informationiconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\InformationIconMask.bmp.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\informationiconmask.bmp.exe")) returned 1
	[0066.522] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\logindialogbackground.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\LoginDialogBackground.jpg.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\logindialogbackground.jpg.exe")) returned 1
	[0066.525] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\logintool24x24images.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\logintool24x24images.jpg.exe")) returned 1
	[0066.528] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\logintool24x24imagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\logintool24x24imagesmask.bmp.exe")) returned 1
	[0066.534] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\messageattachmenticonimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\messageattachmenticonimages.jpg.exe")) returned 1
	[0066.537] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\messageattachmenticonimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\messageattachmenticonimagesmask.bmp.exe")) returned 1
	[0066.539] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\messagehistoryiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\messagehistoryiconimages.jpg.exe")) returned 1
	[0066.544] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\messagehistoryiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\messagehistoryiconimagesmask.bmp.exe")) returned 1
	[0066.547] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierBackground.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierbackground.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierBackground.jpg.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierbackground.jpg.exe")) returned 1
	[0066.550] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierbackgroundrtl.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierbackgroundrtl.jpg.exe")) returned 1
	[0066.552] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierclosebutton.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierCloseButton.jpg.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierclosebutton.jpg.exe")) returned 1
	[0066.555] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierdisabledownarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierdisabledownarrow.jpg.exe")) returned 1
	[0066.558] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierdisableuparrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierdisableuparrow.jpg.exe")) returned 1
	[0066.564] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierdownarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierDownArrow.jpg.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierdownarrow.jpg.exe")) returned 1
	[0066.567] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifieruparrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierUpArrow.jpg.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifieruparrow.jpg.exe")) returned 1
	[0066.570] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierWindowMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierwindowmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierWindowMask.bmp.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierwindowmask.bmp.exe")) returned 1
	[0066.572] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierwindowmaskrtl.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierwindowmaskrtl.bmp.exe")) returned 1
	[0066.575] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\outofsynciconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\outofsynciconimages.jpg.exe")) returned 1
	[0066.576] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\outofsynciconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\outofsynciconimagesmask.bmp.exe")) returned 1
	[0066.579] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\QuestionIcon.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\questionicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\QuestionIcon.jpg.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\questionicon.jpg.exe")) returned 1
	[0066.582] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\QuestionIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\questioniconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\QuestionIconMask.bmp.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\questioniconmask.bmp.exe")) returned 1
	[0066.585] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\Shared16x16Images.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\shared16x16images.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\Shared16x16Images.jpg.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\shared16x16images.jpg.exe")) returned 1
	[0066.587] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\shared16x16imagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\shared16x16imagesmask.bmp.exe")) returned 1
	[0066.589] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\Shared24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\shared24x24images.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\Shared24x24Images.jpg.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\shared24x24images.jpg.exe")) returned 1
	[0066.591] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\shared24x24imagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\shared24x24imagesmask.bmp.exe")) returned 1
	[0066.594] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\STOPICON.JPG" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\stopicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\STOPICON.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\stopicon.jpg.exe")) returned 1
	[0066.596] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\StopIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\stopiconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\StopIconMask.bmp.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\stopiconmask.bmp.exe")) returned 1
	[0066.599] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\taskbariconimages256colors.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\taskbariconimages256colors.bmp.exe")) returned 1
	[0066.601] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\taskbariconimagesmask256colors.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\taskbariconimagesmask256colors.bmp.exe")) returned 1
	[0066.603] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\TipsImage.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\tipsimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\TipsImage.jpg.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\tipsimage.jpg.exe")) returned 1
	[0066.608] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\TipsImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\tipsimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\TipsImageMask.bmp.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\tipsimagemask.bmp.exe")) returned 1
	[0066.610] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\VeriSignLogo.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\verisignlogo.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\VeriSignLogo.jpg.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\verisignlogo.jpg.exe")) returned 1
	[0066.616] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg.exe")) returned 1
	[0066.621] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_automask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_automask.bmp.exe")) returned 1
	[0066.624] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg.exe")) returned 1
	[0066.626] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthighmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthighmask.bmp.exe")) returned 1
	[0066.628] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg.exe")) returned 1
	[0066.631] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlowmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlowmask.bmp.exe")) returned 1
	[0066.633] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg.exe")) returned 1
	[0066.635] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehighmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehighmask.bmp.exe")) returned 1
	[0066.638] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg.exe")) returned 1
	[0066.640] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoffmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoffmask.bmp.exe")) returned 1
	[0066.646] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg.exe")) returned 1
	[0066.652] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_highmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_highmask.bmp.exe")) returned 1
	[0066.655] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg.exe")) returned 1
	[0066.657] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_mediummask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_mediummask.bmp.exe")) returned 1
	[0066.660] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg.exe")) returned 1
	[0066.662] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_offmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_offmask.bmp.exe")) returned 1
	[0066.665] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg.exe")) returned 1
	[0066.668] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemask.bmp.exe")) returned 1
	[0066.671] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemasksmall.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemasksmall.bmp.exe")) returned 1
	[0066.673] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg.exe")) returned 1
	[0066.675] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg.exe")) returned 1
	[0066.677] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemask.bmp.exe")) returned 1
	[0066.690] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemasksmall.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemasksmall.bmp.exe")) returned 1
	[0066.694] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg.exe")) returned 1
	[0066.696] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg.exe")) returned 1
	[0066.698] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimagesmask.bmp.exe")) returned 1
	[0066.700] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg.exe")) returned 1
	[0066.713] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg.exe")) returned 1
	[0066.717] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\unreadiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\unreadiconimagesmask.bmp.exe")) returned 1
	[0066.722] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\computers\\computericon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\computers\\computericon.jpg.exe")) returned 1
	[0066.725] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\computers\\computericonmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\computers\\computericonmask.bmp.exe")) returned 1
	[0066.755] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-black_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-black_scale-100.png.exe")) returned 1
	[0066.758] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-black_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-black_scale-140.png.exe")) returned 1
	[0066.760] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-black_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-black_scale-180.png.exe")) returned 1
	[0066.762] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-black_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-black_scale-80.png.exe")) returned 1
	[0066.767] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-white_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-white_scale-100.png.exe")) returned 1
	[0066.775] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-white_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-white_scale-140.png.exe")) returned 1
	[0066.778] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-white_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-white_scale-180.png.exe")) returned 1
	[0066.781] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-white_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-white_scale-80.png.exe")) returned 1
	[0066.786] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.scale-100.png.exe")) returned 1
	[0066.930] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.scale-140.png.exe")) returned 1
	[0067.000] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.scale-180.png.exe")) returned 1
	[0067.022] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.scale-80.png.exe")) returned 1
	[0067.025] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-black_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-black_scale-100.png.exe")) returned 1
	[0067.028] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-black_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-black_scale-140.png.exe")) returned 1
	[0067.030] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-black_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-black_scale-180.png.exe")) returned 1
	[0067.039] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-black_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-black_scale-80.png.exe")) returned 1
	[0067.041] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-white_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-white_scale-100.png.exe")) returned 1
	[0067.044] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-white_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-white_scale-140.png.exe")) returned 1
	[0067.046] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-white_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-white_scale-180.png.exe")) returned 1
	[0067.048] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-white_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-white_scale-80.png.exe")) returned 1
	[0067.051] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.scale-100.png.exe")) returned 1
	[0067.053] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.scale-140.png.exe")) returned 1
	[0067.055] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.scale-180.png.exe")) returned 1
	[0067.060] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.scale-80.png.exe")) returned 1
	[0067.081] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-black_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-black_scale-100.png.exe")) returned 1
	[0067.083] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-black_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-black_scale-140.png.exe")) returned 1
	[0067.087] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-black_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-black_scale-180.png.exe")) returned 1
	[0067.089] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-black_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-black_scale-80.png.exe")) returned 1
	[0067.092] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-white_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-white_scale-100.png.exe")) returned 1
	[0067.094] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-white_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-white_scale-140.png.exe")) returned 1
	[0067.097] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-white_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-white_scale-180.png.exe")) returned 1
	[0067.099] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-white_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-white_scale-80.png.exe")) returned 1
	[0067.101] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.scale-100.png.exe")) returned 1
	[0067.104] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.scale-140.png.exe")) returned 1
	[0067.107] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.scale-180.png.exe")) returned 1
	[0067.109] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.scale-80.png.exe")) returned 1
	[0067.112] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-black_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-black_scale-100.png.exe")) returned 1
	[0067.114] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-black_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-black_scale-140.png.exe")) returned 1
	[0067.117] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-black_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-black_scale-180.png.exe")) returned 1
	[0067.122] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-black_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-black_scale-80.png.exe")) returned 1
	[0067.129] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-white_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-white_scale-100.png.exe")) returned 1
	[0067.153] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-white_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-white_scale-140.png.exe")) returned 1
	[0067.156] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-white_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-white_scale-180.png.exe")) returned 1
	[0067.158] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-white_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-white_scale-80.png.exe")) returned 1
	[0067.160] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.scale-100.png.exe")) returned 1
	[0067.163] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.scale-140.png.exe")) returned 1
	[0067.168] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.scale-180.png.exe")) returned 1
	[0067.171] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.scale-80.png.exe")) returned 1
	[0067.173] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-black_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-black_scale-100.png.exe")) returned 1
	[0067.176] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-black_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-black_scale-140.png.exe")) returned 1
	[0067.178] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-black_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-black_scale-180.png.exe")) returned 1
	[0067.182] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-black_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-black_scale-80.png.exe")) returned 1
	[0067.187] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-white_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-white_scale-100.png.exe")) returned 1
	[0067.192] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-white_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-white_scale-140.png.exe")) returned 1
	[0067.195] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-white_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-white_scale-180.png.exe")) returned 1
	[0067.198] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-white_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-white_scale-80.png.exe")) returned 1
	[0067.200] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.scale-100.png.exe")) returned 1
	[0067.209] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.scale-140.png.exe")) returned 1
	[0067.211] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.scale-180.png.exe")) returned 1
	[0067.213] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.scale-80.png.exe")) returned 1
	[0067.217] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-black_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-black_scale-100.png.exe")) returned 1
	[0067.229] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-black_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-black_scale-140.png.exe")) returned 1
	[0067.231] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-black_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-black_scale-180.png.exe")) returned 1
	[0067.235] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-black_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-black_scale-80.png.exe")) returned 1
	[0067.238] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-white_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-white_scale-100.png.exe")) returned 1
	[0067.240] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-white_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-white_scale-140.png.exe")) returned 1
	[0067.243] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-white_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-white_scale-180.png.exe")) returned 1
	[0067.245] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-white_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-white_scale-80.png.exe")) returned 1
	[0067.249] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.scale-100.png.exe")) returned 1
	[0067.254] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.scale-140.png.exe")) returned 1
	[0067.320] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.scale-180.png.exe")) returned 1
	[0067.323] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.scale-80.png.exe")) returned 1
	[0067.325] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-black_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-black_scale-100.png.exe")) returned 1
	[0067.332] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-black_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-black_scale-140.png.exe")) returned 1
	[0067.334] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-black_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-black_scale-180.png.exe")) returned 1
	[0067.337] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-black_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-black_scale-80.png.exe")) returned 1
	[0067.339] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-white_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-white_scale-100.png.exe")) returned 1
	[0067.341] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-white_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-white_scale-140.png.exe")) returned 1
	[0067.344] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-white_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-white_scale-180.png.exe")) returned 1
	[0067.346] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-white_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-white_scale-80.png.exe")) returned 1
	[0067.348] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.scale-100.png.exe")) returned 1
	[0067.351] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.scale-140.png.exe")) returned 1
	[0067.356] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.scale-180.png.exe")) returned 1
	[0067.358] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.scale-80.png.exe")) returned 1
	[0067.361] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-black_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-black_scale-100.png.exe")) returned 1
	[0067.365] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-black_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-black_scale-140.png.exe")) returned 1
	[0067.367] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-black_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-black_scale-180.png.exe")) returned 1
	[0067.370] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-black_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-black_scale-80.png.exe")) returned 1
	[0067.373] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-white_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-white_scale-100.png.exe")) returned 1
	[0067.376] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-white_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-white_scale-140.png.exe")) returned 1
	[0067.378] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-white_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-white_scale-180.png.exe")) returned 1
	[0067.381] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-white_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-white_scale-80.png.exe")) returned 1
	[0067.390] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.scale-100.png.exe")) returned 1
	[0067.393] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.scale-140.png.exe")) returned 1
	[0067.395] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.scale-180.png.exe")) returned 1
	[0067.408] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.scale-80.png.exe")) returned 1
	[0067.412] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-black_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-black_scale-100.png.exe")) returned 1
	[0067.417] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-black_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-black_scale-140.png.exe")) returned 1
	[0067.421] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-black_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-black_scale-180.png.exe")) returned 1
	[0067.425] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-black_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-black_scale-80.png.exe")) returned 1
	[0067.431] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-white_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-white_scale-100.png.exe")) returned 1
	[0067.435] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-white_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-white_scale-140.png.exe")) returned 1
	[0067.441] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-white_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-white_scale-180.png.exe")) returned 1
	[0067.447] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-white_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-white_scale-80.png.exe")) returned 1
	[0067.452] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.scale-100.png.exe")) returned 1
	[0067.456] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.scale-140.png.exe")) returned 1
	[0067.459] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.scale-180.png.exe")) returned 1
	[0067.464] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.scale-80.png.exe")) returned 1
	[0067.466] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-black_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-black_scale-100.png.exe")) returned 1
	[0067.469] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-black_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-black_scale-140.png.exe")) returned 1
	[0067.472] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-black_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-black_scale-180.png.exe")) returned 1
	[0067.474] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-black_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-black_scale-80.png.exe")) returned 1
	[0067.491] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-white_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-white_scale-100.png.exe")) returned 1
	[0067.494] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-white_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-white_scale-140.png.exe")) returned 1
	[0067.498] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-white_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-white_scale-180.png.exe")) returned 1
	[0067.504] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-white_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-white_scale-80.png.exe")) returned 1
	[0067.510] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.scale-100.png.exe")) returned 1
	[0067.512] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.scale-140.png.exe")) returned 1
	[0067.514] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.scale-180.png.exe")) returned 1
	[0067.517] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.scale-80.png.exe")) returned 1
	[0067.519] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-black_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-black_scale-100.png.exe")) returned 1
	[0067.522] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-black_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-black_scale-140.png.exe")) returned 1
	[0067.524] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-black_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-black_scale-180.png.exe")) returned 1
	[0067.526] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-black_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-black_scale-80.png.exe")) returned 1
	[0067.529] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-white_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-white_scale-100.png.exe")) returned 1
	[0067.533] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-white_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-white_scale-140.png.exe")) returned 1
	[0067.535] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-white_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-white_scale-180.png.exe")) returned 1
	[0067.538] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-white_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-white_scale-80.png.exe")) returned 1
	[0067.544] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.scale-100.png.exe")) returned 1
	[0067.547] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.scale-140.png.exe")) returned 1
	[0067.550] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.scale-180.png.exe")) returned 1
	[0067.552] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.scale-80.png.exe")) returned 1
	[0067.554] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-black_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-black_scale-100.png.exe")) returned 1
	[0067.557] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-black_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-black_scale-140.png.exe")) returned 1
	[0067.560] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-black_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-black_scale-180.png.exe")) returned 1
	[0067.562] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-black_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-black_scale-80.png.exe")) returned 1
	[0067.565] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-white_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-white_scale-100.png.exe")) returned 1
	[0067.567] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-white_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-white_scale-140.png.exe")) returned 1
	[0067.570] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-white_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-white_scale-180.png.exe")) returned 1
	[0067.575] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-white_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-white_scale-80.png.exe")) returned 1
	[0067.581] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.scale-100.png.exe")) returned 1
	[0067.604] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.scale-140.png.exe")) returned 1
	[0067.607] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.scale-180.png.exe")) returned 1
	[0067.609] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.scale-80.png.exe")) returned 1
	[0067.612] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-black_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-black_scale-100.png.exe")) returned 1
	[0067.615] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-black_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-black_scale-140.png.exe")) returned 1
	[0067.618] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-black_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-black_scale-180.png.exe")) returned 1
	[0067.620] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-black_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-black_scale-80.png.exe")) returned 1
	[0067.622] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-white_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-white_scale-100.png.exe")) returned 1
	[0067.625] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-white_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-white_scale-140.png.exe")) returned 1
	[0067.628] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-white_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-white_scale-180.png.exe")) returned 1
	[0067.630] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-white_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-white_scale-80.png.exe")) returned 1
	[0067.634] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.scale-100.png.exe")) returned 1
	[0067.639] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.scale-140.png.exe")) returned 1
	[0067.645] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.scale-180.png.exe")) returned 1
	[0067.658] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.scale-80.png.exe")) returned 1
	[0067.669] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-black_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-black_scale-100.png.exe")) returned 1
	[0067.674] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-black_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-black_scale-140.png.exe")) returned 1
	[0067.677] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-black_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-black_scale-180.png.exe")) returned 1
	[0067.681] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-black_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-black_scale-80.png.exe")) returned 1
	[0067.684] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-white_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-white_scale-100.png.exe")) returned 1
	[0067.687] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-white_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-white_scale-140.png.exe")) returned 1
	[0067.690] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-white_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-white_scale-180.png.exe")) returned 1
	[0067.693] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-white_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-white_scale-80.png.exe")) returned 1
	[0067.703] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.scale-100.png.exe")) returned 1
	[0067.844] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.scale-140.png.exe")) returned 1
	[0067.850] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.scale-180.png.exe")) returned 1
	[0067.852] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.scale-80.png.exe")) returned 1
	[0067.867] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-black_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-black_scale-100.png.exe")) returned 1
	[0067.870] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-black_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-black_scale-140.png.exe")) returned 1
	[0067.873] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-black_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-black_scale-180.png.exe")) returned 1
	[0067.879] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-black_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-black_scale-80.png.exe")) returned 1
	[0067.881] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-white_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-white_scale-100.png.exe")) returned 1
	[0067.885] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-white_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-white_scale-140.png.exe")) returned 1
	[0067.890] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-white_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-white_scale-180.png.exe")) returned 1
	[0067.896] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-white_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-white_scale-80.png.exe")) returned 1
	[0067.901] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.scale-100.png.exe")) returned 1
	[0067.904] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.scale-140.png.exe")) returned 1
	[0067.906] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.scale-180.png.exe")) returned 1
	[0067.908] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.scale-80.png.exe")) returned 1
	[0067.911] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-black_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-black_scale-100.png.exe")) returned 1
	[0067.913] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-black_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-black_scale-140.png.exe")) returned 1
	[0067.920] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-black_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-black_scale-180.png.exe")) returned 1
	[0067.925] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-black_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-black_scale-80.png.exe")) returned 1
	[0067.930] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-white_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-white_scale-100.png.exe")) returned 1
	[0067.934] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-white_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-white_scale-140.png.exe")) returned 1
	[0067.937] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-white_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-white_scale-180.png.exe")) returned 1
	[0067.943] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-white_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-white_scale-80.png.exe")) returned 1
	[0067.947] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.scale-100.png.exe")) returned 1
	[0067.952] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.scale-140.png.exe")) returned 1
	[0067.956] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.scale-180.png.exe")) returned 1
	[0067.960] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.scale-80.png.exe")) returned 1
	[0067.963] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-black_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-black_scale-100.png.exe")) returned 1
	[0067.966] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-black_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-black_scale-140.png.exe")) returned 1
	[0067.968] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-black_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-black_scale-180.png.exe")) returned 1
	[0067.972] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-black_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-black_scale-80.png.exe")) returned 1
	[0067.977] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-white_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-white_scale-100.png.exe")) returned 1
	[0067.982] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-white_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-white_scale-140.png.exe")) returned 1
	[0067.987] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-white_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-white_scale-180.png.exe")) returned 1
	[0067.990] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-white_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-white_scale-80.png.exe")) returned 1
	[0067.993] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.scale-100.png.exe")) returned 1
	[0067.995] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.scale-140.png.exe")) returned 1
	[0067.997] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.scale-180.png.exe")) returned 1
	[0068.000] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.scale-80.png.exe")) returned 1
	[0068.004] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-black_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-black_scale-100.png.exe")) returned 1
	[0068.010] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-black_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-black_scale-140.png.exe")) returned 1
	[0068.013] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-black_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-black_scale-180.png.exe")) returned 1
	[0068.016] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-black_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-black_scale-80.png.exe")) returned 1
	[0068.020] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-white_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-white_scale-100.png.exe")) returned 1
	[0068.025] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-white_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-white_scale-140.png.exe")) returned 1
	[0068.030] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-white_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-white_scale-180.png.exe")) returned 1
	[0068.038] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-white_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-white_scale-80.png.exe")) returned 1
	[0068.043] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.scale-100.png.exe")) returned 1
	[0068.046] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.scale-140.png.exe")) returned 1
	[0068.048] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.scale-180.png.exe")) returned 1
	[0068.051] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.scale-80.png.exe")) returned 1
	[0068.054] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-black_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-black_scale-100.png.exe")) returned 1
	[0068.056] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-black_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-black_scale-140.png.exe")) returned 1
	[0068.059] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-black_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-black_scale-180.png.exe")) returned 1
	[0068.061] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-black_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-black_scale-80.png.exe")) returned 1
	[0068.064] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-white_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-white_scale-100.png.exe")) returned 1
	[0068.067] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-white_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-white_scale-140.png.exe")) returned 1
	[0068.070] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-white_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-white_scale-180.png.exe")) returned 1
	[0068.083] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-white_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-white_scale-80.png.exe")) returned 1
	[0068.088] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.scale-100.png.exe")) returned 1
	[0068.093] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.scale-140.png.exe")) returned 1
	[0068.096] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.scale-180.png.exe")) returned 1
	[0068.098] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.scale-80.png.exe")) returned 1
	[0068.105] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-black_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-black_scale-100.png.exe")) returned 1
	[0068.107] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-black_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-black_scale-140.png.exe")) returned 1
	[0068.110] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-black_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-black_scale-180.png.exe")) returned 1
	[0068.112] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-black_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-black_scale-80.png.exe")) returned 1
	[0068.115] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-white_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-white_scale-100.png.exe")) returned 1
	[0068.118] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-white_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-white_scale-140.png.exe")) returned 1
	[0068.120] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-white_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-white_scale-180.png.exe")) returned 1
	[0068.126] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-white_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-white_scale-80.png.exe")) returned 1
	[0068.130] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.scale-100.png.exe")) returned 1
	[0068.136] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.scale-140.png.exe")) returned 1
	[0068.141] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.scale-180.png.exe")) returned 1
	[0068.144] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.scale-80.png.exe")) returned 1
	[0068.147] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-black_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-black_scale-100.png.exe")) returned 1
	[0068.149] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-black_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-black_scale-140.png.exe")) returned 1
	[0068.152] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-black_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-black_scale-180.png.exe")) returned 1
	[0068.154] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-black_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-black_scale-80.png.exe")) returned 1
	[0068.159] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-white_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-white_scale-100.png.exe")) returned 1
	[0068.162] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-white_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-white_scale-140.png.exe")) returned 1
	[0068.166] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-white_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-white_scale-180.png.exe")) returned 1
	[0068.168] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-white_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-white_scale-80.png.exe")) returned 1
	[0068.171] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.scale-100.png.exe")) returned 1
	[0068.174] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.scale-140.png.exe")) returned 1
	[0068.179] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.scale-180.png.exe")) returned 1
	[0068.181] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.scale-80.png.exe")) returned 1
	[0068.185] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-black_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-black_scale-100.png.exe")) returned 1
	[0068.189] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-black_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-black_scale-140.png.exe")) returned 1
	[0068.192] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-black_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-black_scale-180.png.exe")) returned 1
	[0068.194] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-black_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-black_scale-80.png.exe")) returned 1
	[0068.197] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-white_scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-white_scale-100.png.exe")) returned 1
	[0068.200] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-white_scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-white_scale-140.png.exe")) returned 1
	[0068.202] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-white_scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-white_scale-180.png.exe")) returned 1
	[0068.206] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-white_scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-white_scale-80.png.exe")) returned 1
	[0068.209] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.scale-100.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.scale-100.png.exe")) returned 1
	[0068.212] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.scale-140.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.scale-140.png.exe")) returned 1
	[0068.214] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.scale-180.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.scale-180.png.exe")) returned 1
	[0068.216] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.scale-80.png.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.scale-80.png.exe")) returned 1
	[0068.219] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LYNC.EXE.MANIFEST" (normalized: "c:\\program files\\microsoft office\\root\\office16\\lync.exe.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LYNC.EXE.MANIFEST.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\lync.exe.manifest.exe")) returned 1
	[0068.267] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Lync2013_Third_Party_Notices.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\lync2013_third_party_notices.txt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Lync2013_Third_Party_Notices.txt.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\lync2013_third_party_notices.txt.exe")) returned 1
	[0068.275] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\APPLAUSE.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\applause.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\APPLAUSE.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\applause.wav.exe")) returned 1
	[0068.278] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\ARROW.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\arrow.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\ARROW.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\arrow.wav.exe")) returned 1
	[0068.736] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\BOMB.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\bomb.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\BOMB.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\bomb.wav.exe")) returned 1
	[0068.741] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\BREEZE.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\breeze.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\BREEZE.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\breeze.wav.exe")) returned 1
	[0068.743] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\CAMERA.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\camera.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\CAMERA.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\camera.wav.exe")) returned 1
	[0068.746] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\CASHREG.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\cashreg.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\CASHREG.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\cashreg.wav.exe")) returned 1
	[0068.750] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\CHIMES.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\chimes.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\CHIMES.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\chimes.wav.exe")) returned 1
	[0068.752] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\CLICK.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\click.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\CLICK.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\click.wav.exe")) returned 1
	[0068.755] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\COIN.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\coin.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\COIN.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\coin.wav.exe")) returned 1
	[0068.770] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\DefaultHold.wma" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\defaulthold.wma"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\DefaultHold.wma.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\defaulthold.wma.exe")) returned 1
	[0068.779] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\DRUMROLL.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\drumroll.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\DRUMROLL.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\drumroll.wav.exe")) returned 1
	[0068.783] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\EXPLODE.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\explode.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\EXPLODE.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\explode.wav.exe")) returned 1
	[0068.786] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\HAMMER.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\hammer.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\HAMMER.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\hammer.wav.exe")) returned 1
	[0068.836] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LASER.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\laser.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LASER.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\laser.wav.exe")) returned 1
	[0068.843] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_abbrdialtone.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_abbrdialtone.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_abbrdialtone.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_abbrdialtone.wav.exe")) returned 1
	[0068.849] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ActivePresenterChange.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_activepresenterchange.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ActivePresenterChange.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_activepresenterchange.wav.exe")) returned 1
	[0068.856] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_appinvite.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_appinvite.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_appinvite.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_appinvite.wav.exe")) returned 1
	[0068.859] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_busy.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_busy.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_busy.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_busy.wav.exe")) returned 1
	[0069.001] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_callended.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_callended.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_callended.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_callended.wav.exe")) returned 1
	[0069.015] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ChangeModality.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_changemodality.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ChangeModality.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_changemodality.wav.exe")) returned 1
	[0069.020] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_connecting.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_connecting.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_connecting.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_connecting.wav.exe")) returned 1
	[0069.023] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dialtone.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dialtone.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dialtone.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dialtone.wav.exe")) returned 1
	[0069.026] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf0.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf0.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf0.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf0.wav.exe")) returned 1
	[0069.028] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf1.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf1.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf1.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf1.wav.exe")) returned 1
	[0069.042] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf2.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf2.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf2.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf2.wav.exe")) returned 1
	[0069.045] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf3.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf3.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf3.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf3.wav.exe")) returned 1
	[0069.047] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf4.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf4.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf4.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf4.wav.exe")) returned 1
	[0069.050] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf5.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf5.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf5.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf5.wav.exe")) returned 1
	[0069.052] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf6.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf6.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf6.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf6.wav.exe")) returned 1
	[0069.055] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf7.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf7.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf7.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf7.wav.exe")) returned 1
	[0069.103] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf8.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf8.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf8.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf8.wav.exe")) returned 1
	[0069.107] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf9.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf9.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf9.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf9.wav.exe")) returned 1
	[0069.115] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmfpound.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmfpound.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmfpound.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmfpound.wav.exe")) returned 1
	[0069.118] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmfstar.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmfstar.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmfstar.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmfstar.wav.exe")) returned 1
	[0069.121] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_fastbusy.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_fastbusy.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_fastbusy.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_fastbusy.wav.exe")) returned 1
	[0069.133] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_fsringing.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_fsringing.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_fsringing.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_fsringing.wav.exe")) returned 1
	[0069.136] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_howler.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_howler.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_howler.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_howler.wav.exe")) returned 1
	[0069.143] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_iminvite.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_iminvite.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_iminvite.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_iminvite.wav.exe")) returned 1
	[0069.166] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_joinedconference.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_joinedconference.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_joinedconference.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_joinedconference.wav.exe")) returned 1
	[0069.171] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_muting.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_muting.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_muting.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_muting.wav.exe")) returned 1
	[0069.178] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_newim.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_newim.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_newim.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_newim.wav.exe")) returned 1
	[0069.194] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_onhold.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_onhold.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_onhold.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_onhold.wav.exe")) returned 1
	[0069.205] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_presence.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_presence.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_presence.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_presence.wav.exe")) returned 1
	[0069.215] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_redirect.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_redirect.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_redirect.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_redirect.wav.exe")) returned 1
	[0069.227] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringback.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringback.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringback.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringback.wav.exe")) returned 1
	[0069.240] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringing.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringing.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringing.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringing.wav.exe")) returned 1
	[0069.294] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringtone2.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringtone2.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringtone2.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringtone2.wav.exe")) returned 1
	[0069.354] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringtone3.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringtone3.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringtone3.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringtone3.wav.exe")) returned 1
	[0069.450] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringtone4.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringtone4.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringtone4.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringtone4.wav.exe")) returned 1
	[0069.471] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringtone5.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringtone5.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringtone5.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringtone5.wav.exe")) returned 1
	[0069.494] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringtone6.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringtone6.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringtone6.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringtone6.wav.exe")) returned 1
	[0069.530] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringtone7.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringtone7.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringtone7.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringtone7.wav.exe")) returned 1
	[0069.538] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_secondcall.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_secondcall.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_secondcall.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_secondcall.wav.exe")) returned 1
	[0069.545] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_untag.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_untag.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_untag.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_untag.wav.exe")) returned 1
	[0069.551] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_videoadded.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_videoadded.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_videoadded.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_videoadded.wav.exe")) returned 1
	[0069.563] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_videocall.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_videocall.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_videocall.wav.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_videocall.wav.exe")) returned 1
	[0069.566] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\PUSH.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\push.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\PUSH.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\push.wav.exe")) returned 1
	[0069.571] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\SUCTION.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\suction.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\SUCTION.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\suction.wav.exe")) returned 1
	[0069.574] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\TYPE.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\type.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\TYPE.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\type.wav.exe")) returned 1
	[0069.578] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\VOLTAGE.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\voltage.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\VOLTAGE.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\voltage.wav.exe")) returned 1
	[0069.584] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\WHOOSH.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\whoosh.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\WHOOSH.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\whoosh.wav.exe")) returned 1
	[0069.589] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\WIND.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\wind.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\WIND.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\wind.wav.exe")) returned 1
	[0069.597] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Microsoft.Lync.Model.zip" (normalized: "c:\\program files\\microsoft office\\root\\office16\\microsoft.lync.model.zip"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Microsoft.Lync.Model.zip.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\microsoft.lync.model.zip.exe")) returned 1
	[0069.603] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Microsoft.Lync.Utilities.Controls.zip" (normalized: "c:\\program files\\microsoft office\\root\\office16\\microsoft.lync.utilities.controls.zip"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Microsoft.Lync.Utilities.Controls.zip.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\microsoft.lync.utilities.controls.zip.exe")) returned 1
	[0069.610] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Microsoft.Lync.Utilities.zip" (normalized: "c:\\program files\\microsoft office\\root\\office16\\microsoft.lync.utilities.zip"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Microsoft.Lync.Utilities.zip.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\microsoft.lync.utilities.zip.exe")) returned 1
	[0069.615] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\msaccess.exe.manifest" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msaccess.exe.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\msaccess.exe.manifest.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msaccess.exe.manifest.exe")) returned 1
	[0069.991] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\mspub.exe.manifest" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mspub.exe.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\mspub.exe.manifest.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mspub.exe.manifest.exe")) returned 1
	[0070.002] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Ocomprivate.zip" (normalized: "c:\\program files\\microsoft office\\root\\office16\\ocomprivate.zip"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Ocomprivate.zip.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\ocomprivate.zip.exe")) returned 1
	[0070.012] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OUTLOOK.EXE.MANIFEST" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlook.exe.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OUTLOOK.EXE.MANIFEST.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlook.exe.manifest.exe")) returned 1
	[0070.049] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\powerpnt.exe.manifest" (normalized: "c:\\program files\\microsoft office\\root\\office16\\powerpnt.exe.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\powerpnt.exe.manifest.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\powerpnt.exe.manifest.exe")) returned 1
	[0070.156] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\REMINDER.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\reminder.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\REMINDER.WAV.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\reminder.wav.exe")) returned 1
	[0070.162] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\SAMPLES\\SOLVSAMP.XLS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\samples\\solvsamp.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\SAMPLES\\SOLVSAMP.XLS.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\samples\\solvsamp.xls.exe")) returned 1
	[0070.167] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\System.Windows.Controls.Theming.Toolkit.zip" (normalized: "c:\\program files\\microsoft office\\root\\office16\\system.windows.controls.theming.toolkit.zip"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\System.Windows.Controls.Theming.Toolkit.zip.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\system.windows.controls.theming.toolkit.zip.exe")) returned 1
	[0070.196] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLDGPLAN.JPG" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bldgplan.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLDGPLAN.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bldgplan.jpg.exe")) returned 1
	[0070.335] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ORGDATA.TXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\orgdata.txt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ORGDATA.TXT.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\orgdata.txt.exe")) returned 1
	[0070.345] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ORGDATA.XLS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\orgdata.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ORGDATA.XLS.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\orgdata.xls.exe")) returned 1
	[0070.426] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\visio.exe.manifest" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio.exe.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\visio.exe.manifest.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio.exe.manifest.exe")) returned 1
	[0070.436] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\winproj.exe.manifest" (normalized: "c:\\program files\\microsoft office\\root\\office16\\winproj.exe.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\winproj.exe.manifest.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\winproj.exe.manifest.exe")) returned 1
	[0070.462] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\CURRENCY.GIF" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\currency.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\CURRENCY.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\currency.gif.exe")) returned 1
	[0070.465] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\CURRENCY.HTM" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\currency.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\CURRENCY.HTM.exe" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\currency.htm.exe")) returned 1
	[0070.467] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\DADSHIRT.GIF" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\dadshirt.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\DADSHIRT.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\dadshirt.gif.exe")) returned 1
	[0070.469] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\DADSHIRT.HTM" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\dadshirt.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\DADSHIRT.HTM.exe" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\dadshirt.htm.exe")) returned 1
	[0070.471] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\JUDGESCH.GIF" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\judgesch.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\JUDGESCH.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\judgesch.gif.exe")) returned 1
	[0070.473] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\JUDGESCH.HTM" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\judgesch.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\JUDGESCH.HTM.exe" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\judgesch.htm.exe")) returned 1
	[0070.479] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\JUNGLE.GIF" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\jungle.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\JUNGLE.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\jungle.gif.exe")) returned 1
	[0070.481] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\JUNGLE.HTM" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\jungle.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\JUNGLE.HTM.exe" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\jungle.htm.exe")) returned 1
	[0070.482] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\NOTEBOOK.HTM" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\notebook.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\NOTEBOOK.HTM.exe" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\notebook.htm.exe")) returned 1
	[0070.485] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\NOTEBOOK.JPG" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\notebook.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\NOTEBOOK.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\notebook.jpg.exe")) returned 1
	[0070.494] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\OFFISUPP.GIF" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\offisupp.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\OFFISUPP.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\offisupp.gif.exe")) returned 1
	[0070.496] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\OFFISUPP.HTM" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\offisupp.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\OFFISUPP.HTM.exe" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\offisupp.htm.exe")) returned 1
	[0070.499] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\PAWPRINT.GIF" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\pawprint.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\PAWPRINT.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\pawprint.gif.exe")) returned 1
	[0070.502] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\PAWPRINT.HTM" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\pawprint.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\PAWPRINT.HTM.exe" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\pawprint.htm.exe")) returned 1
	[0070.504] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\PINELUMB.HTM" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\pinelumb.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\PINELUMB.HTM.exe" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\pinelumb.htm.exe")) returned 1
	[0070.506] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\PINELUMB.JPG" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\pinelumb.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\PINELUMB.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\pinelumb.jpg.exe")) returned 1
	[0070.508] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\SEAMARBL.HTM" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\seamarbl.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\SEAMARBL.HTM.exe" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\seamarbl.htm.exe")) returned 1
	[0070.510] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\SEAMARBL.JPG" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\seamarbl.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\SEAMARBL.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\seamarbl.jpg.exe")) returned 1
	[0070.512] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\TECHTOOL.GIF" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\techtool.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\TECHTOOL.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\techtool.gif.exe")) returned 1
	[0070.514] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\TECHTOOL.HTM" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\techtool.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\TECHTOOL.HTM.exe" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\techtool.htm.exe")) returned 1
	[0070.551] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\Presentation Designs\\Maple.gif" (normalized: "c:\\program files\\microsoft office\\root\\templates\\presentation designs\\maple.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\Presentation Designs\\Maple.gif.exe" (normalized: "c:\\program files\\microsoft office\\root\\templates\\presentation designs\\maple.gif.exe")) returned 1
	[0070.565] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Access 2016.lnk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\access 2016.lnk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Access 2016.lnk.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\access 2016.lnk.exe")) returned 1
	[0070.568] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Excel 2016.lnk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\excel 2016.lnk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Excel 2016.lnk.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\excel 2016.lnk.exe")) returned 1
	[0070.582] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\microsoft office 2016 tools\\database compare 2016.lnk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\microsoft office 2016 tools\\database compare 2016.lnk.exe")) returned 1
	[0070.592] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk.exe")) returned 1
	[0070.594] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\microsoft office 2016 tools\\office 2016 upload center.lnk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\microsoft office 2016 tools\\office 2016 upload center.lnk.exe")) returned 1
	[0070.598] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Microsoft Office 2016 Tools\\Project Server 2016 Accounts.lnk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\microsoft office 2016 tools\\project server 2016 accounts.lnk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Microsoft Office 2016 Tools\\Project Server 2016 Accounts.lnk.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\microsoft office 2016 tools\\project server 2016 accounts.lnk.exe")) returned 1
	[0070.601] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\microsoft office 2016 tools\\skype for business recording manager.lnk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\microsoft office 2016 tools\\skype for business recording manager.lnk.exe")) returned 1
	[0070.604] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk.exe")) returned 1
	[0070.606] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk.exe")) returned 1
	[0070.609] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk.exe")) returned 1
	[0070.611] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\OneDrive for Business.lnk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\onedrive for business.lnk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\OneDrive for Business.lnk.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\onedrive for business.lnk.exe")) returned 1
	[0070.614] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\OneNote 2016.lnk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\onenote 2016.lnk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\OneNote 2016.lnk.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\onenote 2016.lnk.exe")) returned 1
	[0070.620] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Outlook 2016.lnk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\outlook 2016.lnk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Outlook 2016.lnk.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\outlook 2016.lnk.exe")) returned 1
	[0070.623] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\PowerPoint 2016.lnk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\powerpoint 2016.lnk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\PowerPoint 2016.lnk.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\powerpoint 2016.lnk.exe")) returned 1
	[0070.625] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Project 2016.lnk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\project 2016.lnk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Project 2016.lnk.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\project 2016.lnk.exe")) returned 1
	[0070.629] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Publisher 2016.lnk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\publisher 2016.lnk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Publisher 2016.lnk.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\publisher 2016.lnk.exe")) returned 1
	[0070.632] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Skype for Business 2016.lnk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\skype for business 2016.lnk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Skype for Business 2016.lnk.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\skype for business 2016.lnk.exe")) returned 1
	[0070.636] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Visio 2016.lnk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\visio 2016.lnk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Visio 2016.lnk.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\visio 2016.lnk.exe")) returned 1
	[0070.639] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Word 2016.lnk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\word 2016.lnk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Word 2016.lnk.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\word 2016.lnk.exe")) returned 1
	[0070.692] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\equation\\eqnedt32.exe.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\equation\\eqnedt32.exe.manifest.exe")) returned 1
	[0070.704] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\ms.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\ms.gif.exe")) returned 1
	[0070.706] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\ms.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.JPG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\ms.jpg.exe")) returned 1
	[0070.710] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\ms.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\ms.png.exe")) returned 1
	[0070.731] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\README.HTM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\readme.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\README.HTM.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\readme.htm.exe")) returned 1
	[0070.774] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\1033\\mcabout.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\1033\\mcabout.htm.exe")) returned 1
	[0070.873] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\metconv.txt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\METCONV.TXT.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\metconv.txt.exe")) returned 1
	[0070.889] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\aftrnoon\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\aftrnoon\\preview.gif.exe")) returned 1
	[0070.892] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\aftrnoon\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\aftrnoon\\thmbnail.png.exe")) returned 1
	[0070.896] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\arctic\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\arctic\\preview.gif.exe")) returned 1
	[0070.919] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\arctic\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\arctic\\thmbnail.png.exe")) returned 1
	[0070.924] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\axis\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\axis\\preview.gif.exe")) returned 1
	[0070.928] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\axis\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\axis\\thmbnail.png.exe")) returned 1
	[0070.933] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blends\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blends\\preview.gif.exe")) returned 1
	[0070.937] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blends\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blends\\thmbnail.png.exe")) returned 1
	[0070.942] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\bluecalm\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\bluecalm\\preview.gif.exe")) returned 1
	[0070.945] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\bluecalm\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\bluecalm\\thmbnail.png.exe")) returned 1
	[0070.951] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blueprnt\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blueprnt\\preview.gif.exe")) returned 1
	[0070.953] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blueprnt\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blueprnt\\thmbnail.png.exe")) returned 1
	[0070.975] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\boldstri\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\boldstri\\preview.gif.exe")) returned 1
	[0070.979] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\boldstri\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\boldstri\\thmbnail.png.exe")) returned 1
	[0070.983] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\breeze\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\breeze\\preview.gif.exe")) returned 1
	[0070.987] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\breeze\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\breeze\\thmbnail.png.exe")) returned 1
	[0070.992] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\canyon\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\canyon\\preview.gif.exe")) returned 1
	[0070.996] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\canyon\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\canyon\\thmbnail.png.exe")) returned 1
	[0071.002] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\capsules\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\capsules\\preview.gif.exe")) returned 1
	[0071.005] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\capsules\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\capsules\\thmbnail.png.exe")) returned 1
	[0071.012] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\cascade\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\cascade\\preview.gif.exe")) returned 1
	[0071.131] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\cascade\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\cascade\\thmbnail.png.exe")) returned 1
	[0071.155] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\compass\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\compass\\preview.gif.exe")) returned 1
	[0071.160] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\compass\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\compass\\thmbnail.png.exe")) returned 1
	[0071.166] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\concrete\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\concrete\\preview.gif.exe")) returned 1
	[0071.169] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\concrete\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\concrete\\thmbnail.png.exe")) returned 1
	[0071.174] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\deepblue\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\deepblue\\preview.gif.exe")) returned 1
	[0071.177] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\deepblue\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\deepblue\\thmbnail.png.exe")) returned 1
	[0071.332] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\echo\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\echo\\preview.gif.exe")) returned 1
	[0071.338] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\echo\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\echo\\thmbnail.png.exe")) returned 1
	[0071.344] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\eclipse\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\eclipse\\preview.gif.exe")) returned 1
	[0071.348] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\eclipse\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\eclipse\\thmbnail.png.exe")) returned 1
	[0071.352] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\edge\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\edge\\preview.gif.exe")) returned 1
	[0071.356] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\edge\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\edge\\thmbnail.png.exe")) returned 1
	[0071.361] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\evrgreen\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\evrgreen\\preview.gif.exe")) returned 1
	[0071.364] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\evrgreen\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\evrgreen\\thmbnail.png.exe")) returned 1
	[0071.369] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\expeditn\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\expeditn\\preview.gif.exe")) returned 1
	[0071.420] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\expeditn\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\expeditn\\thmbnail.png.exe")) returned 1
	[0071.424] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ice\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ice\\preview.gif.exe")) returned 1
	[0071.428] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ice\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ice\\thmbnail.png.exe")) returned 1
	[0071.433] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\indust\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\indust\\preview.gif.exe")) returned 1
	[0071.437] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\indust\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\indust\\thmbnail.png.exe")) returned 1
	[0071.441] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\iris\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\iris\\preview.gif.exe")) returned 1
	[0071.445] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\iris\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\iris\\thmbnail.png.exe")) returned 1
	[0071.450] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\journal\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\journal\\preview.gif.exe")) returned 1
	[0071.454] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\journal\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\journal\\thmbnail.png.exe")) returned 1
	[0071.461] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\layers\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\layers\\preview.gif.exe")) returned 1
	[0071.506] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\layers\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\layers\\thmbnail.png.exe")) returned 1
	[0071.510] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\level\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\level\\preview.gif.exe")) returned 1
	[0071.514] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\level\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\level\\thmbnail.png.exe")) returned 1
	[0071.519] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\network\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\network\\preview.gif.exe")) returned 1
	[0071.523] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\network\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\network\\thmbnail.png.exe")) returned 1
	[0071.527] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\papyrus\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\papyrus\\preview.gif.exe")) returned 1
	[0071.531] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\papyrus\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\papyrus\\thmbnail.png.exe")) returned 1
	[0071.535] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\pixel\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\pixel\\preview.gif.exe")) returned 1
	[0071.539] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\pixel\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\pixel\\thmbnail.png.exe")) returned 1
	[0071.606] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\profile\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\profile\\preview.gif.exe")) returned 1
	[0071.636] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\profile\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\profile\\thmbnail.png.exe")) returned 1
	[0071.640] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\quad\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\quad\\preview.gif.exe")) returned 1
	[0071.644] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\quad\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\quad\\thmbnail.png.exe")) returned 1
	[0071.649] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\radial\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\radial\\preview.gif.exe")) returned 1
	[0071.653] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\radial\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\radial\\thmbnail.png.exe")) returned 1
	[0071.657] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\refined\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\refined\\preview.gif.exe")) returned 1
	[0071.661] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\refined\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\refined\\thmbnail.png.exe")) returned 1
	[0071.666] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ricepapr\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ricepapr\\preview.gif.exe")) returned 1
	[0071.669] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ricepapr\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ricepapr\\thmbnail.png.exe")) returned 1
	[0071.673] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ripple\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ripple\\preview.gif.exe")) returned 1
	[0071.697] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ripple\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ripple\\thmbnail.png.exe")) returned 1
	[0071.701] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\rmnsque\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\rmnsque\\preview.gif.exe")) returned 1
	[0071.705] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\rmnsque\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\rmnsque\\thmbnail.png.exe")) returned 1
	[0071.709] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\satin\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\satin\\preview.gif.exe")) returned 1
	[0071.876] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\satin\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\satin\\thmbnail.png.exe")) returned 1
	[0071.882] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sky\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sky\\preview.gif.exe")) returned 1
	[0071.919] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sky\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sky\\thmbnail.png.exe")) returned 1
	[0071.923] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\slate\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\slate\\preview.gif.exe")) returned 1
	[0071.928] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\slate\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\slate\\thmbnail.png.exe")) returned 1
	[0071.932] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sonora\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sonora\\preview.gif.exe")) returned 1
	[0071.936] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sonora\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sonora\\thmbnail.png.exe")) returned 1
	[0071.940] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\spring\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\spring\\preview.gif.exe")) returned 1
	[0071.944] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\spring\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\spring\\thmbnail.png.exe")) returned 1
	[0072.029] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\strtedge\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\strtedge\\preview.gif.exe")) returned 1
	[0072.034] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\strtedge\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\strtedge\\thmbnail.png.exe")) returned 1
	[0072.038] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\studio\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\studio\\preview.gif.exe")) returned 1
	[0072.043] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\studio\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\studio\\thmbnail.png.exe")) returned 1
	[0072.048] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sumipntg\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sumipntg\\preview.gif.exe")) returned 1
	[0072.052] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sumipntg\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sumipntg\\thmbnail.png.exe")) returned 1
	[0072.056] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\water\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\water\\preview.gif.exe")) returned 1
	[0072.061] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\water\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\water\\thmbnail.png.exe")) returned 1
	[0072.118] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\watermar\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\PREVIEW.GIF.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\watermar\\preview.gif.exe")) returned 1
	[0072.121] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\watermar\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\THMBNAIL.PNG.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\watermar\\thmbnail.png.exe")) returned 1
	[0073.027] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\AccessMessageDismissal.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\accessmessagedismissal.txt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\AccessMessageDismissal.txt.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\accessmessagedismissal.txt.exe")) returned 1
	[0073.037] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\ExcelMessageDismissal.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\excelmessagedismissal.txt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\ExcelMessageDismissal.txt.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\excelmessagedismissal.txt.exe")) returned 1
	[0073.419] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\SHELLNEW\\EXCEL12.XLSX" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\windows\\shellnew\\excel12.xlsx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\SHELLNEW\\EXCEL12.XLSX.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\windows\\shellnew\\excel12.xlsx.exe")) returned 1
	[0073.746] MoveFileA (lpExistingFileName="C:\\Program Files\\Mozilla Firefox\\browser\\VisualElements\\VisualElements_150.png" (normalized: "c:\\program files\\mozilla firefox\\browser\\visualelements\\visualelements_150.png"), lpNewFileName="C:\\Program Files\\Mozilla Firefox\\browser\\VisualElements\\VisualElements_150.png.exe" (normalized: "c:\\program files\\mozilla firefox\\browser\\visualelements\\visualelements_150.png.exe")) returned 1
	[0073.762] MoveFileA (lpExistingFileName="C:\\Program Files\\Mozilla Firefox\\browser\\VisualElements\\VisualElements_70.png" (normalized: "c:\\program files\\mozilla firefox\\browser\\visualelements\\visualelements_70.png"), lpNewFileName="C:\\Program Files\\Mozilla Firefox\\browser\\VisualElements\\VisualElements_70.png.exe" (normalized: "c:\\program files\\mozilla firefox\\browser\\visualelements\\visualelements_70.png.exe")) returned 1
	[0074.333] MoveFileA (lpExistingFileName="C:\\Program Files\\Mozilla Firefox\\defaults\\pref\\channel-prefs.js" (normalized: "c:\\program files\\mozilla firefox\\defaults\\pref\\channel-prefs.js"), lpNewFileName="C:\\Program Files\\Mozilla Firefox\\defaults\\pref\\channel-prefs.js.exe" (normalized: "c:\\program files\\mozilla firefox\\defaults\\pref\\channel-prefs.js.exe")) returned 1
	[0074.720] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ar-sa\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ar-sa\\index.html.exe")) returned 1
	[0074.726] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\bg-bg\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\bg-bg\\index.html.exe")) returned 1
	[0074.731] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es\\index.html.exe")) returned 1
	[0074.783] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es-valencia\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es-valencia\\index.html.exe")) returned 1
	[0074.789] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\cs-cz\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\cs-cz\\index.html.exe")) returned 1
	[0074.794] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\da-dk\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\da-dk\\index.html.exe")) returned 1
	[0074.948] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-at\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-at\\index.html.exe")) returned 1
	[0074.953] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-ch\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-ch\\index.html.exe")) returned 1
	[0074.958] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-de\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-de\\index.html.exe")) returned 1
	[0074.967] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\el-gr\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\el-gr\\index.html.exe")) returned 1
	[0075.033] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-au\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-au\\index.html.exe")) returned 1
	[0075.038] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ca\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ca\\index.html.exe")) returned 1
	[0075.043] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-gb\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-gb\\index.html.exe")) returned 1
	[0075.049] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-hk\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-hk\\index.html.exe")) returned 1
	[0075.053] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-id\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-id\\index.html.exe")) returned 1
	[0075.058] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ie\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ie\\index.html.exe")) returned 1
	[0075.097] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-in\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-in\\index.html.exe")) returned 1
	[0075.102] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-my\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-my\\index.html.exe")) returned 1
	[0075.106] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-nz\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-nz\\index.html.exe")) returned 1
	[0075.112] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ph\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ph\\index.html.exe")) returned 1
	[0075.116] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-us\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-us\\index.html.exe")) returned 1
	[0075.121] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-za\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-za\\index.html.exe")) returned 1
	[0075.129] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-ar\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-ar\\index.html.exe")) returned 1
	[0075.173] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-cl\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-cl\\index.html.exe")) returned 1
	[0075.179] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-co\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-co\\index.html.exe")) returned 1
	[0075.184] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-es\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-es\\index.html.exe")) returned 1
	[0075.191] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-mx\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-mx\\index.html.exe")) returned 1
	[0075.197] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-us\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-us\\index.html.exe")) returned 1
	[0075.202] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-xl\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-xl\\index.html.exe")) returned 1
	[0075.210] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\et-ee\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\et-ee\\index.html.exe")) returned 1
	[0075.274] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\eu-es\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\eu-es\\index.html.exe")) returned 1
	[0075.279] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fi-fi\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fi-fi\\index.html.exe")) returned 1
	[0075.284] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-be\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-be\\index.html.exe")) returned 1
	[0075.289] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ca\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ca\\index.html.exe")) returned 1
	[0075.294] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ch\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ch\\index.html.exe")) returned 1
	[0075.299] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-fr\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-fr\\index.html.exe")) returned 1
	[0075.304] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-xf\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-xf\\index.html.exe")) returned 1
	[0075.345] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\gl-es\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\gl-es\\index.html.exe")) returned 1
	[0075.350] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\he-il\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\he-il\\index.html.exe")) returned 1
	[0075.355] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hr-hr\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hr-hr\\index.html.exe")) returned 1
	[0075.360] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hu-hu\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hu-hu\\index.html.exe")) returned 1
	[0075.474] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\index.html.exe")) returned 1
	[0075.479] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\is-is\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\is-is\\index.html.exe")) returned 1
	[0075.484] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\it-it\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\it-it\\index.html.exe")) returned 1
	[0075.489] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ja-jp\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ja-jp\\index.html.exe")) returned 1
	[0075.494] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ko-kr\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ko-kr\\index.html.exe")) returned 1
	[0075.498] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\LanguageSelector.js" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\languageselector.js"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\LanguageSelector.js.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\languageselector.js.exe")) returned 1
	[0075.502] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lb-lu\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lb-lu\\index.html.exe")) returned 1
	[0075.555] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lt-lt\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lt-lt\\index.html.exe")) returned 1
	[0075.560] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lv-lv\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lv-lv\\index.html.exe")) returned 1
	[0075.566] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ms-my\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ms-my\\index.html.exe")) returned 1
	[0075.574] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nb-no\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nb-no\\index.html.exe")) returned 1
	[0075.578] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-be\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-be\\index.html.exe")) returned 1
	[0075.583] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-nl\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-nl\\index.html.exe")) returned 1
	[0075.588] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nn-no\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nn-no\\index.html.exe")) returned 1
	[0075.664] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pl-pl\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pl-pl\\index.html.exe")) returned 1
	[0075.669] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-br\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-br\\index.html.exe")) returned 1
	[0075.674] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-pt\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-pt\\index.html.exe")) returned 1
	[0075.684] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\20170517_Lock_200.gif" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\20170517_lock_200.gif"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\20170517_Lock_200.gif.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\20170517_lock_200.gif.exe")) returned 1
	[0075.687] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Back_0000_Hover.png" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\back_0000_hover.png"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Back_0000_Hover.png.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\back_0000_hover.png.exe")) returned 1
	[0075.689] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Back_0001_Static.png" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\back_0001_static.png"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Back_0001_Static.png.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\back_0001_static.png.exe")) returned 1
	[0075.692] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\jquery-3.1.1.min.js" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\jquery-3.1.1.min.js"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\jquery-3.1.1.min.js.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\jquery-3.1.1.min.js.exe")) returned 1
	[0075.695] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Lock-Confirmation-page-350.png" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\lock-confirmation-page-350.png"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Lock-Confirmation-page-350.png.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\lock-confirmation-page-350.png.exe")) returned 1
	[0075.699] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Picture2_80.jpg" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\picture2_80.jpg"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Picture2_80.jpg.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\picture2_80.jpg.exe")) returned 1
	[0075.736] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\PrivacyContentWrapper.min.js" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\privacycontentwrapper.min.js"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\PrivacyContentWrapper.min.js.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\privacycontentwrapper.min.js.exe")) returned 1
	[0075.739] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\script.min.js" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\script.min.js"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\script.min.js.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\script.min.js.exe")) returned 1
	[0075.742] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Win10_Brand.png" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\win10_brand.png"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Win10_Brand.png.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\win10_brand.png.exe")) returned 1
	[0075.781] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\WindowsUpdatePrivacySetting.scale-200.png" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\windowsupdateprivacysetting.scale-200.png"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\WindowsUpdatePrivacySetting.scale-200.png.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\windowsupdateprivacysetting.scale-200.png.exe")) returned 1
	[0075.786] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ro-ro\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ro-ro\\index.html.exe")) returned 1
	[0075.791] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ru-ru\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ru-ru\\index.html.exe")) returned 1
	[0075.885] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sk-sk\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sk-sk\\index.html.exe")) returned 1
	[0075.891] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sl-si\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sl-si\\index.html.exe")) returned 1
	[0075.896] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sr-latn-rs\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sr-latn-rs\\index.html.exe")) returned 1
	[0075.900] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sv-se\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sv-se\\index.html.exe")) returned 1
	[0075.941] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\th-th\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\th-th\\index.html.exe")) returned 1
	[0075.952] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\tr-tr\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\tr-tr\\index.html.exe")) returned 1
	[0075.957] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\uk-ua\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\uk-ua\\index.html.exe")) returned 1
	[0075.962] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\vi-vn\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\vi-vn\\index.html.exe")) returned 1
	[0075.966] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-cn\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-cn\\index.html.exe")) returned 1
	[0075.972] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-hk\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-hk\\index.html.exe")) returned 1
	[0076.019] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-tw\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\index.html.exe" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-tw\\index.html.exe")) returned 1
	[0091.384] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf.exe")) returned 1
	[0091.395] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\COPYING.LGPLv2.1.txt" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\acrocef\\copying.lgplv2.1.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\COPYING.LGPLv2.1.txt.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\acrocef\\copying.lgplv2.1.txt.exe")) returned 1
	[0091.398] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\LICENSE.txt" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\acrocef\\license.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\LICENSE.txt.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\acrocef\\license.txt.exe")) returned 1
	[0091.408] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Adobe.Reader.Dependencies.manifest" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\adobe.reader.dependencies.manifest"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Adobe.Reader.Dependencies.manifest.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\adobe.reader.dependencies.manifest.exe")) returned 1
	[0091.420] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Click on 'Change' to select default PDF handler.pdf" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\click on 'change' to select default pdf handler.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Click on 'Change' to select default PDF handler.pdf.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\click on 'change' to select default pdf handler.pdf.exe")) returned 1
	[0091.425] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\IDTemplates\\ENU\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\idtemplates\\enu\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\IDTemplates\\ENU\\AdobeID.pdf.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\idtemplates\\enu\\adobeid.pdf.exe")) returned 1
	[0091.431] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\IDTemplates\\ENU\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\idtemplates\\enu\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\IDTemplates\\ENU\\DefaultID.pdf.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\idtemplates\\enu\\defaultid.pdf.exe")) returned 1
	[0091.439] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Legal\\ENU\\license.html" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\legal\\enu\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Legal\\ENU\\license.html.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\legal\\enu\\license.html.exe")) returned 1
	[0091.448] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\PDFSigQFormalRep.pdf" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\pdfsigqformalrep.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\PDFSigQFormalRep.pdf.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\pdfsigqformalrep.pdf.exe")) returned 1
	[0091.493] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0091.494] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0091.494] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0091.511] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\plug_ins\\annotations\\stamps\\enu\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\Dynamic.pdf.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\plug_ins\\annotations\\stamps\\enu\\dynamic.pdf.exe")) returned 1
	[0091.530] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\plug_ins\\annotations\\stamps\\enu\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\SignHere.pdf.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\plug_ins\\annotations\\stamps\\enu\\signhere.pdf.exe")) returned 1
	[0091.534] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\plug_ins\\annotations\\stamps\\enu\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\StandardBusiness.pdf.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\plug_ins\\annotations\\stamps\\enu\\standardbusiness.pdf.exe")) returned 1
	[0091.540] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\plug_ins\\annotations\\stamps\\words.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\plug_ins\\annotations\\stamps\\words.pdf.exe")) returned 1
	[0091.560] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\add_reviewer.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\add_reviewer.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\add_reviewer.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\add_reviewer.gif.exe")) returned 1
	[0091.562] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\bl.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\bl.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\bl.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\bl.gif.exe")) returned 1
	[0091.606] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\br.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\br.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\br.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\br.gif.exe")) returned 1
	[0091.611] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\create_form.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\create_form.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\create_form.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\create_form.gif.exe")) returned 1
	[0091.613] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\distribute_form.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\distribute_form.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\distribute_form.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\distribute_form.gif.exe")) returned 1
	[0091.616] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\email_all.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\email_all.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\email_all.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\email_all.gif.exe")) returned 1
	[0091.619] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\email_initiator.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\email_initiator.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\email_initiator.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\email_initiator.gif.exe")) returned 1
	[0091.621] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\ended_review_or_form.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\ended_review_or_form.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\ended_review_or_form.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\ended_review_or_form.gif.exe")) returned 1
	[0091.623] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\end_review.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\end_review.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\end_review.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\end_review.gif.exe")) returned 1
	[0091.626] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\forms_distributed.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\forms_distributed.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\forms_distributed.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\forms_distributed.gif.exe")) returned 1
	[0091.629] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\forms_received.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\forms_received.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\forms_received.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\forms_received.gif.exe")) returned 1
	[0091.630] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\forms_super.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\forms_super.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\forms_super.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\forms_super.gif.exe")) returned 1
	[0091.633] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\form_responses.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\form_responses.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\form_responses.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\form_responses.gif.exe")) returned 1
	[0091.634] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\info.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\info.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\info.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\info.gif.exe")) returned 1
	[0091.637] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\open_original_form.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\open_original_form.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\open_original_form.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\open_original_form.gif.exe")) returned 1
	[0091.639] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\pdf.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\pdf.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\pdf.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\pdf.gif.exe")) returned 1
	[0091.642] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\reviewers.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\reviewers.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\reviewers.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\reviewers.gif.exe")) returned 1
	[0091.644] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\reviews_joined.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\reviews_joined.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\reviews_joined.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\reviews_joined.gif.exe")) returned 1
	[0091.677] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\reviews_sent.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\reviews_sent.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\reviews_sent.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\reviews_sent.gif.exe")) returned 1
	[0091.680] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\reviews_super.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\reviews_super.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\reviews_super.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\reviews_super.gif.exe")) returned 1
	[0091.682] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\review_browser.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\review_browser.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\review_browser.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\review_browser.gif.exe")) returned 1
	[0091.684] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\review_email.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\review_email.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\review_email.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\review_email.gif.exe")) returned 1
	[0091.687] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\review_same_reviewers.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\review_same_reviewers.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\review_same_reviewers.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\review_same_reviewers.gif.exe")) returned 1
	[0091.708] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\review_shared.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\review_shared.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\review_shared.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\review_shared.gif.exe")) returned 1
	[0091.710] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\rss.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\rss.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\rss.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\rss.gif.exe")) returned 1
	[0091.716] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\server_issue.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\server_issue.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\server_issue.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\server_issue.gif.exe")) returned 1
	[0091.721] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\server_lg.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\server_lg.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\server_lg.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\server_lg.gif.exe")) returned 1
	[0091.723] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\server_ok.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\server_ok.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\server_ok.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\server_ok.gif.exe")) returned 1
	[0091.727] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\stop_collection_data.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\stop_collection_data.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\stop_collection_data.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\stop_collection_data.gif.exe")) returned 1
	[0091.730] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\submission_history.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\submission_history.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\submission_history.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\submission_history.gif.exe")) returned 1
	[0091.732] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\tl.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\tl.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\tl.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\tl.gif.exe")) returned 1
	[0091.734] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\tr.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\tr.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\tr.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\tr.gif.exe")) returned 1
	[0091.745] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\trash.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\trash.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\trash.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\trash.gif.exe")) returned 1
	[0091.748] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\turnoffnotificationinacrobat.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\turnoffnotificationinacrobat.gif.exe")) returned 1
	[0091.751] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\turnOffNotificationInTray.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\turnoffnotificationintray.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\turnOffNotificationInTray.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\turnoffnotificationintray.gif.exe")) returned 1
	[0091.755] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\turnonnotificationinacrobat.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\turnonnotificationinacrobat.gif.exe")) returned 1
	[0091.759] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\turnOnNotificationInTray.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\turnonnotificationintray.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\turnOnNotificationInTray.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\turnonnotificationintray.gif.exe")) returned 1
	[0091.763] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\warning.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\warning.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\warning.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\warning.gif.exe")) returned 1
	[0091.773] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\base_uris.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\base_uris.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\base_uris.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\base_uris.js.exe")) returned 1
	[0091.776] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\index.html" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\index.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\index.html.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\index.html.exe")) returned 1
	[0091.779] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\init.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\init.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\init.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\init.js.exe")) returned 1
	[0091.795] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\plugins.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\plugins.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\plugins.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\plugins.js.exe")) returned 1
	[0091.812] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\A12_Spinner.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\a12_spinner.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\A12_Spinner.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\a12_spinner.gif.exe")) returned 1
	[0091.815] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\A12_Spinner_2x.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\a12_spinner_2x.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\A12_Spinner_2x.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\a12_spinner_2x.gif.exe")) returned 1
	[0091.818] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\A12_Spinner_int.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\a12_spinner_int.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\A12_Spinner_int.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\a12_spinner_int.gif.exe")) returned 1
	[0091.823] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\A12_Spinner_int_2x.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\a12_spinner_int_2x.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\A12_Spinner_int_2x.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\a12_spinner_int_2x.gif.exe")) returned 1
	[0091.882] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\adc_logo.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\adc_logo.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\adc_logo.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\adc_logo.png.exe")) returned 1
	[0091.885] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\adobe_spinner.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\adobe_spinner.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\adobe_spinner.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\adobe_spinner.gif.exe")) returned 1
	[0091.887] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\adobe_spinner_mini.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\adobe_spinner_mini.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\adobe_spinner_mini.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\adobe_spinner_mini.gif.exe")) returned 1
	[0091.890] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\apple-touch-icon-114x114-precomposed.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\apple-touch-icon-114x114-precomposed.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\apple-touch-icon-114x114-precomposed.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\apple-touch-icon-114x114-precomposed.png.exe")) returned 1
	[0091.893] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\apple-touch-icon-144x144-precomposed.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\apple-touch-icon-144x144-precomposed.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\apple-touch-icon-144x144-precomposed.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\apple-touch-icon-144x144-precomposed.png.exe")) returned 1
	[0091.896] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\apple-touch-icon-57x57-precomposed.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\apple-touch-icon-57x57-precomposed.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\apple-touch-icon-57x57-precomposed.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\apple-touch-icon-57x57-precomposed.png.exe")) returned 1
	[0091.898] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\apple-touch-icon-72x72-precomposed.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\apple-touch-icon-72x72-precomposed.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\apple-touch-icon-72x72-precomposed.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\apple-touch-icon-72x72-precomposed.png.exe")) returned 1
	[0091.902] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\ccloud.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\ccloud.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\ccloud.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\ccloud.png.exe")) returned 1
	[0091.904] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\ccloud_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\ccloud_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\ccloud_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\ccloud_retina.png.exe")) returned 1
	[0091.917] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\close_x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\close_x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\close_x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\close_x.png.exe")) returned 1
	[0091.921] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\core_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\core_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\core_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\core_icons.png.exe")) returned 1
	[0091.924] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\core_icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\core_icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\core_icons_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\core_icons_retina.png.exe")) returned 1
	[0091.927] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\dd_arrow_small.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\dd_arrow_small.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\dd_arrow_small.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\dd_arrow_small.png.exe")) returned 1
	[0091.933] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\aic_file_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\aic_file_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\aic_file_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\aic_file_icons.png.exe")) returned 1
	[0091.937] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\aic_file_icons_retina_thumb.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\aic_file_icons_retina_thumb.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\aic_file_icons_retina_thumb.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\aic_file_icons_retina_thumb.png.exe")) returned 1
	[0091.942] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\cloud_icon.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\cloud_icon.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\cloud_icon.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\cloud_icon.png.exe")) returned 1
	[0091.948] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_hiContrast_bow.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_hicontrast_bow.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_hiContrast_bow.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_hicontrast_bow.png.exe")) returned 1
	[0091.951] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_hiContrast_wob.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_hicontrast_wob.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_hiContrast_wob.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_hicontrast_wob.png.exe")) returned 1
	[0091.953] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_highcontrast.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_highcontrast.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_highcontrast.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_highcontrast.png.exe")) returned 1
	[0091.956] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_retina_thumb_highContrast_bow.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_retina_thumb_highcontrast_bow.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_retina_thumb_highContrast_bow.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_retina_thumb_highcontrast_bow.png.exe")) returned 1
	[0091.958] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_retina_thumb_highContrast_wob.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_retina_thumb_highcontrast_wob.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_retina_thumb_highContrast_wob.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_retina_thumb_highcontrast_wob.png.exe")) returned 1
	[0091.966] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\themes\\dark\\aic_file_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\themes\\dark\\aic_file_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\themes\\dark\\aic_file_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\themes\\dark\\aic_file_icons.png.exe")) returned 1
	[0091.970] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\themes\\dark\\aic_file_icons_retina_thumb.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\themes\\dark\\aic_file_icons_retina_thumb.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\themes\\dark\\aic_file_icons_retina_thumb.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\themes\\dark\\aic_file_icons_retina_thumb.png.exe")) returned 1
	[0091.974] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\themes\\dark\\cloud_icon.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\themes\\dark\\cloud_icon.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\themes\\dark\\cloud_icon.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\themes\\dark\\cloud_icon.png.exe")) returned 1
	[0091.981] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\hi_contrast\\core_icons_hiContrast_bow.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\hi_contrast\\core_icons_hicontrast_bow.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\hi_contrast\\core_icons_hiContrast_bow.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\hi_contrast\\core_icons_hicontrast_bow.png.exe")) returned 1
	[0091.984] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\hi_contrast\\core_icons_hiContrast_wob.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\hi_contrast\\core_icons_hicontrast_wob.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\hi_contrast\\core_icons_hiContrast_wob.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\hi_contrast\\core_icons_hicontrast_wob.png.exe")) returned 1
	[0091.987] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\hi_contrast\\core_icons_highcontrast.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\hi_contrast\\core_icons_highcontrast.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\hi_contrast\\core_icons_highcontrast.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\hi_contrast\\core_icons_highcontrast.png.exe")) returned 1
	[0091.990] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\hi_contrast\\core_icons_highcontrast_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\hi_contrast\\core_icons_highcontrast_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\hi_contrast\\core_icons_highcontrast_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\hi_contrast\\core_icons_highcontrast_retina.png.exe")) returned 1
	[0091.993] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\hi_contrast\\core_icons__retina_hiContrast_bow.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\hi_contrast\\core_icons__retina_hicontrast_bow.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\hi_contrast\\core_icons__retina_hiContrast_bow.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\hi_contrast\\core_icons__retina_hicontrast_bow.png.exe")) returned 1
	[0091.995] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\hi_contrast\\core_icons__retina_hiContrast_wob.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\hi_contrast\\core_icons__retina_hicontrast_wob.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\hi_contrast\\core_icons__retina_hiContrast_wob.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\hi_contrast\\core_icons__retina_hicontrast_wob.png.exe")) returned 1
	[0091.998] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\illustrations.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\illustrations.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\illustrations.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\illustrations.png.exe")) returned 1
	[0092.000] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\illustrations_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\illustrations_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\illustrations_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\illustrations_retina.png.exe")) returned 1
	[0092.003] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\ind_prog.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\ind_prog.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\ind_prog.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\ind_prog.gif.exe")) returned 1
	[0092.005] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\japanese_over.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\japanese_over.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\japanese_over.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\japanese_over.png.exe")) returned 1
	[0092.008] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\large_trefoil.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\large_trefoil.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\large_trefoil.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\large_trefoil.png.exe")) returned 1
	[0092.018] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\large_trefoil_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\large_trefoil_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\large_trefoil_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\large_trefoil_2x.png.exe")) returned 1
	[0092.020] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\logo_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\logo_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\logo_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\logo_retina.png.exe")) returned 1
	[0092.022] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\progress-indeterminate.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\progress-indeterminate.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\progress-indeterminate.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\progress-indeterminate.gif.exe")) returned 1
	[0092.025] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\progress_spinner.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\progress_spinner.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\progress_spinner.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\progress_spinner.gif.exe")) returned 1
	[0092.028] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\progress_spinner2x.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\progress_spinner2x.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\progress_spinner2x.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\progress_spinner2x.gif.exe")) returned 1
	[0092.030] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\progress_spinner_dark.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\progress_spinner_dark.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\progress_spinner_dark.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\progress_spinner_dark.gif.exe")) returned 1
	[0092.036] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\progress_spinner_dark2x.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\progress_spinner_dark2x.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\progress_spinner_dark2x.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\progress_spinner_dark2x.gif.exe")) returned 1
	[0092.038] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\RHP_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\rhp_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\RHP_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\rhp_icons.png.exe")) returned 1
	[0092.041] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\RHP_icons_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\rhp_icons_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\RHP_icons_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\rhp_icons_2x.png.exe")) returned 1
	[0092.043] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\selection-actions.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\selection-actions.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\selection-actions.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\selection-actions.png.exe")) returned 1
	[0092.046] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\selection-actions2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\selection-actions2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\selection-actions2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\selection-actions2x.png.exe")) returned 1
	[0092.053] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\A12_Spinner.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\a12_spinner.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\A12_Spinner.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\a12_spinner.gif.exe")) returned 1
	[0092.089] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\A12_Spinner_2x.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\a12_spinner_2x.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\A12_Spinner_2x.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\a12_spinner_2x.gif.exe")) returned 1
	[0092.092] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\A12_Spinner_int.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\a12_spinner_int.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\A12_Spinner_int.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\a12_spinner_int.gif.exe")) returned 1
	[0092.095] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\A12_Spinner_int_2x.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\a12_spinner_int_2x.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\A12_Spinner_int_2x.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\a12_spinner_int_2x.gif.exe")) returned 1
	[0092.098] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\adc_logo.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\adc_logo.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\adc_logo.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\adc_logo.png.exe")) returned 1
	[0092.100] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\adobe_spinner.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\adobe_spinner.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\adobe_spinner.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\adobe_spinner.gif.exe")) returned 1
	[0092.102] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\adobe_spinner_mini.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\adobe_spinner_mini.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\adobe_spinner_mini.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\adobe_spinner_mini.gif.exe")) returned 1
	[0092.104] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\apple-touch-icon-114x114-precomposed.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\apple-touch-icon-114x114-precomposed.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\apple-touch-icon-114x114-precomposed.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\apple-touch-icon-114x114-precomposed.png.exe")) returned 1
	[0092.107] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\apple-touch-icon-144x144-precomposed.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\apple-touch-icon-144x144-precomposed.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\apple-touch-icon-144x144-precomposed.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\apple-touch-icon-144x144-precomposed.png.exe")) returned 1
	[0092.109] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\apple-touch-icon-57x57-precomposed.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\apple-touch-icon-57x57-precomposed.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\apple-touch-icon-57x57-precomposed.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\apple-touch-icon-57x57-precomposed.png.exe")) returned 1
	[0092.112] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\apple-touch-icon-72x72-precomposed.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\apple-touch-icon-72x72-precomposed.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\apple-touch-icon-72x72-precomposed.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\apple-touch-icon-72x72-precomposed.png.exe")) returned 1
	[0092.114] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\ccloud.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\ccloud.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\ccloud.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\ccloud.png.exe")) returned 1
	[0092.117] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\ccloud_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\ccloud_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\ccloud_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\ccloud_retina.png.exe")) returned 1
	[0092.119] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\close_x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\close_x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\close_x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\close_x.png.exe")) returned 1
	[0092.122] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\core_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\core_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\core_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\core_icons.png.exe")) returned 1
	[0092.125] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\core_icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\core_icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\core_icons_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\core_icons_retina.png.exe")) returned 1
	[0092.151] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\dd_arrow_small.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\dd_arrow_small.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\dd_arrow_small.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\dd_arrow_small.png.exe")) returned 1
	[0092.155] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\illustrations.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\illustrations.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\illustrations.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\illustrations.png.exe")) returned 1
	[0092.158] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\illustrations_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\illustrations_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\illustrations_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\illustrations_retina.png.exe")) returned 1
	[0092.161] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\ind_prog.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\ind_prog.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\ind_prog.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\ind_prog.gif.exe")) returned 1
	[0092.163] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\japanese_over.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\japanese_over.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\japanese_over.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\japanese_over.png.exe")) returned 1
	[0092.165] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\large_trefoil.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\large_trefoil.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\large_trefoil.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\large_trefoil.png.exe")) returned 1
	[0092.168] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\large_trefoil_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\large_trefoil_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\large_trefoil_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\large_trefoil_2x.png.exe")) returned 1
	[0092.172] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\logo_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\logo_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\logo_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\logo_retina.png.exe")) returned 1
	[0092.174] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\progress-indeterminate.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\progress-indeterminate.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\progress-indeterminate.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\progress-indeterminate.gif.exe")) returned 1
	[0092.177] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\progress_spinner.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\progress_spinner.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\progress_spinner.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\progress_spinner.gif.exe")) returned 1
	[0092.180] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\progress_spinner2x.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\progress_spinner2x.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\progress_spinner2x.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\progress_spinner2x.gif.exe")) returned 1
	[0092.188] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\progress_spinner_dark.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\progress_spinner_dark.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\progress_spinner_dark.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\progress_spinner_dark.gif.exe")) returned 1
	[0092.235] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\progress_spinner_dark2x.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\progress_spinner_dark2x.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\progress_spinner_dark2x.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\progress_spinner_dark2x.gif.exe")) returned 1
	[0092.238] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\RHP_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\rhp_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\RHP_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\rhp_icons.png.exe")) returned 1
	[0092.240] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\RHP_icons_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\rhp_icons_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\RHP_icons_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\rhp_icons_2x.png.exe")) returned 1
	[0092.242] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\selection-actions.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\selection-actions.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\selection-actions.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\selection-actions.png.exe")) returned 1
	[0092.281] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\selection-actions2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\selection-actions2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\selection-actions2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\selection-actions2x.png.exe")) returned 1
	[0092.286] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\arrow-down.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\arrow-down.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\arrow-down.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\arrow-down.png.exe")) returned 1
	[0092.288] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\arrow-left.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\arrow-left.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\arrow-left.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\arrow-left.png.exe")) returned 1
	[0092.290] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\arrow-right.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\arrow-right.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\arrow-right.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\arrow-right.png.exe")) returned 1
	[0092.292] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\arrow-up.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\arrow-up.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\arrow-up.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\arrow-up.png.exe")) returned 1
	[0092.294] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\hscroll-thumb.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\hscroll-thumb.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\hscroll-thumb.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\hscroll-thumb.png.exe")) returned 1
	[0092.300] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-down.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-down.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-down.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-down.png.exe")) returned 1
	[0092.302] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-left.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-left.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-left.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-left.png.exe")) returned 1
	[0092.304] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-right.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-right.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-right.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-right.png.exe")) returned 1
	[0092.306] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-up.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-up.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-up.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-up.png.exe")) returned 1
	[0092.308] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\themes\\dark\\hscroll-thumb.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\themes\\dark\\hscroll-thumb.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\themes\\dark\\hscroll-thumb.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\themes\\dark\\hscroll-thumb.png.exe")) returned 1
	[0092.310] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\themes\\dark\\vscroll-thumb.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\themes\\dark\\vscroll-thumb.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\themes\\dark\\vscroll-thumb.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\themes\\dark\\vscroll-thumb.png.exe")) returned 1
	[0092.312] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\vscroll-thumb.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\vscroll-thumb.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\vscroll-thumb.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\vscroll-thumb.png.exe")) returned 1
	[0092.359] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-down-pressed.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-down-pressed.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-down-pressed.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-down-pressed.gif.exe")) returned 1
	[0092.361] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-down.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-down.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-down.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-down.gif.exe")) returned 1
	[0092.362] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-left-pressed.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-left-pressed.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-left-pressed.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-left-pressed.gif.exe")) returned 1
	[0092.363] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-left.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-left.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-left.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-left.gif.exe")) returned 1
	[0092.364] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-right-pressed.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-right-pressed.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-right-pressed.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-right-pressed.gif.exe")) returned 1
	[0092.365] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-right.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-right.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-right.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-right.gif.exe")) returned 1
	[0092.366] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-up-pressed.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-up-pressed.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-up-pressed.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-up-pressed.gif.exe")) returned 1
	[0092.367] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-up.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-up.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-up.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-up.gif.exe")) returned 1
	[0092.373] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-down-pressed.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-down-pressed.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-down-pressed.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-down-pressed.gif.exe")) returned 1
	[0092.374] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-down.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-down.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-down.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-down.gif.exe")) returned 1
	[0092.375] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-left-pressed.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-left-pressed.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-left-pressed.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-left-pressed.gif.exe")) returned 1
	[0092.376] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-left.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-left.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-left.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-left.gif.exe")) returned 1
	[0092.377] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-right-pressed.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-right-pressed.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-right-pressed.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-right-pressed.gif.exe")) returned 1
	[0092.378] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-right.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-right.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-right.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-right.gif.exe")) returned 1
	[0092.379] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-up-pressed.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-up-pressed.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-up-pressed.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-up-pressed.gif.exe")) returned 1
	[0092.380] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-up.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-up.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-up.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-up.gif.exe")) returned 1
	[0092.388] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ca-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\ca-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ca-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\ca-es\\ui-strings.js.exe")) returned 1
	[0092.392] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\cs-cz\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\cs-cz\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\cs-cz\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\cs-cz\\ui-strings.js.exe")) returned 1
	[0092.434] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\da-dk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\da-dk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\da-dk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\da-dk\\ui-strings.js.exe")) returned 1
	[0092.466] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\de-de\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\de-de\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\de-de\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\de-de\\ui-strings.js.exe")) returned 1
	[0092.471] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\en-ae\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\en-ae\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\en-ae\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\en-ae\\ui-strings.js.exe")) returned 1
	[0092.475] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\en-gb\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\en-gb\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\en-gb\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\en-gb\\ui-strings.js.exe")) returned 1
	[0092.480] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\en-il\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\en-il\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\en-il\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\en-il\\ui-strings.js.exe")) returned 1
	[0092.484] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\es-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\es-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\es-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\es-es\\ui-strings.js.exe")) returned 1
	[0092.488] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\eu-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\eu-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\eu-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\eu-es\\ui-strings.js.exe")) returned 1
	[0092.492] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\fi-fi\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\fi-fi\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\fi-fi\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\fi-fi\\ui-strings.js.exe")) returned 1
	[0092.499] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\fr-fr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\fr-fr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\fr-fr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\fr-fr\\ui-strings.js.exe")) returned 1
	[0092.572] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\fr-ma\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\fr-ma\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\fr-ma\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\fr-ma\\ui-strings.js.exe")) returned 1
	[0092.577] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\hr-hr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\hr-hr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\hr-hr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\hr-hr\\ui-strings.js.exe")) returned 1
	[0092.582] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\hu-hu\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\hu-hu\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\hu-hu\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\hu-hu\\ui-strings.js.exe")) returned 1
	[0092.586] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\it-it\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\it-it\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\it-it\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\it-it\\ui-strings.js.exe")) returned 1
	[0092.590] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ja-jp\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\ja-jp\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ja-jp\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\ja-jp\\ui-strings.js.exe")) returned 1
	[0092.594] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ko-kr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\ko-kr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ko-kr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\ko-kr\\ui-strings.js.exe")) returned 1
	[0092.597] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\nb-no\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\nb-no\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\nb-no\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\nb-no\\ui-strings.js.exe")) returned 1
	[0092.601] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\nl-nl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\nl-nl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\nl-nl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\nl-nl\\ui-strings.js.exe")) returned 1
	[0092.605] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\pl-pl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\pl-pl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\pl-pl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\pl-pl\\ui-strings.js.exe")) returned 1
	[0092.609] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\pt-br\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\pt-br\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\pt-br\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\pt-br\\ui-strings.js.exe")) returned 1
	[0092.725] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ro-ro\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\ro-ro\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ro-ro\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\ro-ro\\ui-strings.js.exe")) returned 1
	[0092.729] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\root\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\root\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\root\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\root\\ui-strings.js.exe")) returned 1
	[0092.741] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ru-ru\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\ru-ru\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ru-ru\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\ru-ru\\ui-strings.js.exe")) returned 1
	[0092.745] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\sk-sk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\sk-sk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\sk-sk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\sk-sk\\ui-strings.js.exe")) returned 1
	[0092.749] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\sl-si\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\sl-si\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\sl-si\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\sl-si\\ui-strings.js.exe")) returned 1
	[0092.756] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\sv-se\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\sv-se\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\sv-se\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\sv-se\\ui-strings.js.exe")) returned 1
	[0092.761] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\tr-tr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\tr-tr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\tr-tr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\tr-tr\\ui-strings.js.exe")) returned 1
	[0092.876] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\ui-strings.js.exe")) returned 1
	[0092.882] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\uk-ua\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\uk-ua\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\uk-ua\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\uk-ua\\ui-strings.js.exe")) returned 1
	[0092.886] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\zh-cn\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\zh-cn\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\zh-cn\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\zh-cn\\ui-strings.js.exe")) returned 1
	[0092.893] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\zh-tw\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\zh-tw\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\zh-tw\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app\\dev\\nls\\zh-tw\\ui-strings.js.exe")) returned 1
	[0092.901] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app-api\\dev\\app-api.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app-api\\dev\\app-api.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app-api\\dev\\app-api.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\app-api\\dev\\app-api.js.exe")) returned 1
	[0092.907] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\config.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\config.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\config.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\config.js.exe")) returned 1
	[0092.915] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ca-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\ca-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ca-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\ca-es\\ui-strings.js.exe")) returned 1
	[0092.919] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\cs-cz\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\cs-cz\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\cs-cz\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\cs-cz\\ui-strings.js.exe")) returned 1
	[0092.976] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\da-dk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\da-dk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\da-dk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\da-dk\\ui-strings.js.exe")) returned 1
	[0092.982] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\de-de\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\de-de\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\de-de\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\de-de\\ui-strings.js.exe")) returned 1
	[0092.986] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\en-ae\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\en-ae\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\en-ae\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\en-ae\\ui-strings.js.exe")) returned 1
	[0092.990] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\en-gb\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\en-gb\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\en-gb\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\en-gb\\ui-strings.js.exe")) returned 1
	[0092.995] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\en-il\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\en-il\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\en-il\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\en-il\\ui-strings.js.exe")) returned 1
	[0092.999] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\es-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\es-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\es-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\es-es\\ui-strings.js.exe")) returned 1
	[0093.005] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\eu-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\eu-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\eu-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\eu-es\\ui-strings.js.exe")) returned 1
	[0093.012] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\fi-fi\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\fi-fi\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\fi-fi\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\fi-fi\\ui-strings.js.exe")) returned 1
	[0093.042] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\fr-fr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\fr-fr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\fr-fr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\fr-fr\\ui-strings.js.exe")) returned 1
	[0093.047] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\fr-ma\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\fr-ma\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\fr-ma\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\fr-ma\\ui-strings.js.exe")) returned 1
	[0093.051] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\hr-hr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\hr-hr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\hr-hr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\hr-hr\\ui-strings.js.exe")) returned 1
	[0093.056] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\hu-hu\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\hu-hu\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\hu-hu\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\hu-hu\\ui-strings.js.exe")) returned 1
	[0093.060] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\it-it\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\it-it\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\it-it\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\it-it\\ui-strings.js.exe")) returned 1
	[0093.065] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ja-jp\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\ja-jp\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ja-jp\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\ja-jp\\ui-strings.js.exe")) returned 1
	[0093.069] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ko-kr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\ko-kr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ko-kr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\ko-kr\\ui-strings.js.exe")) returned 1
	[0093.073] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\nb-no\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\nb-no\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\nb-no\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\nb-no\\ui-strings.js.exe")) returned 1
	[0093.077] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\nl-nl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\nl-nl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\nl-nl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\nl-nl\\ui-strings.js.exe")) returned 1
	[0093.121] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\pl-pl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\pl-pl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\pl-pl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\pl-pl\\ui-strings.js.exe")) returned 1
	[0093.126] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\pt-br\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\pt-br\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\pt-br\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\pt-br\\ui-strings.js.exe")) returned 1
	[0093.132] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ro-ro\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\ro-ro\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ro-ro\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\ro-ro\\ui-strings.js.exe")) returned 1
	[0093.136] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\root\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\root\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\root\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\root\\ui-strings.js.exe")) returned 1
	[0093.141] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ru-ru\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\ru-ru\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ru-ru\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\ru-ru\\ui-strings.js.exe")) returned 1
	[0093.145] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sk-sk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\sk-sk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sk-sk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\sk-sk\\ui-strings.js.exe")) returned 1
	[0093.148] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sl-si\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\sl-si\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sl-si\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\sl-si\\ui-strings.js.exe")) returned 1
	[0093.152] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sv-se\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\sv-se\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sv-se\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\sv-se\\ui-strings.js.exe")) returned 1
	[0093.201] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\tr-tr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\tr-tr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\tr-tr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\tr-tr\\ui-strings.js.exe")) returned 1
	[0093.205] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\ui-strings.js.exe")) returned 1
	[0093.213] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\uk-ua\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\uk-ua\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\uk-ua\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\uk-ua\\ui-strings.js.exe")) returned 1
	[0093.218] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\zh-cn\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\zh-cn\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\zh-cn\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\zh-cn\\ui-strings.js.exe")) returned 1
	[0093.222] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\zh-tw\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\zh-tw\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\zh-tw\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\core\\dev\\nls\\zh-tw\\ui-strings.js.exe")) returned 1
	[0093.225] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\desktop.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\desktop.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\desktop.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\desktop.js.exe")) returned 1
	[0093.232] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ca-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\ca-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ca-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\ca-es\\ui-strings.js.exe")) returned 1
	[0093.275] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\cs-cz\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\cs-cz\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\cs-cz\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\cs-cz\\ui-strings.js.exe")) returned 1
	[0093.280] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\da-dk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\da-dk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\da-dk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\da-dk\\ui-strings.js.exe")) returned 1
	[0093.327] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\de-de\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\de-de\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\de-de\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\de-de\\ui-strings.js.exe")) returned 1
	[0093.333] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\en-ae\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\en-ae\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\en-ae\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\en-ae\\ui-strings.js.exe")) returned 1
	[0093.336] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\en-gb\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\en-gb\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\en-gb\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\en-gb\\ui-strings.js.exe")) returned 1
	[0093.341] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\en-il\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\en-il\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\en-il\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\en-il\\ui-strings.js.exe")) returned 1
	[0093.346] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\es-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\es-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\es-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\es-es\\ui-strings.js.exe")) returned 1
	[0093.350] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\eu-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\eu-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\eu-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\eu-es\\ui-strings.js.exe")) returned 1
	[0093.353] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\fi-fi\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\fi-fi\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\fi-fi\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\fi-fi\\ui-strings.js.exe")) returned 1
	[0093.357] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\fr-fr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\fr-fr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\fr-fr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\fr-fr\\ui-strings.js.exe")) returned 1
	[0093.361] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\fr-ma\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\fr-ma\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\fr-ma\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\fr-ma\\ui-strings.js.exe")) returned 1
	[0093.419] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\hr-hr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\hr-hr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\hr-hr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\hr-hr\\ui-strings.js.exe")) returned 1
	[0093.444] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\hu-hu\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\hu-hu\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\hu-hu\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\hu-hu\\ui-strings.js.exe")) returned 1
	[0093.479] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\it-it\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\it-it\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\it-it\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\it-it\\ui-strings.js.exe")) returned 1
	[0093.484] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ja-jp\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\ja-jp\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ja-jp\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\ja-jp\\ui-strings.js.exe")) returned 1
	[0093.488] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ko-kr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\ko-kr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ko-kr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\ko-kr\\ui-strings.js.exe")) returned 1
	[0093.495] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\nb-no\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\nb-no\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\nb-no\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\nb-no\\ui-strings.js.exe")) returned 1
	[0093.498] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\nl-nl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\nl-nl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\nl-nl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\nl-nl\\ui-strings.js.exe")) returned 1
	[0093.503] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\pl-pl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\pl-pl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\pl-pl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\pl-pl\\ui-strings.js.exe")) returned 1
	[0093.543] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\pt-br\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\pt-br\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\pt-br\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\pt-br\\ui-strings.js.exe")) returned 1
	[0093.547] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ro-ro\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\ro-ro\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ro-ro\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\ro-ro\\ui-strings.js.exe")) returned 1
	[0093.551] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\root\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\root\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\root\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\root\\ui-strings.js.exe")) returned 1
	[0093.556] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ru-ru\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\ru-ru\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ru-ru\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\ru-ru\\ui-strings.js.exe")) returned 1
	[0093.562] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sk-sk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\sk-sk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sk-sk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\sk-sk\\ui-strings.js.exe")) returned 1
	[0093.565] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sl-si\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\sl-si\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sl-si\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\sl-si\\ui-strings.js.exe")) returned 1
	[0093.569] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sv-se\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\sv-se\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sv-se\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\sv-se\\ui-strings.js.exe")) returned 1
	[0093.573] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\tr-tr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\tr-tr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\tr-tr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\tr-tr\\ui-strings.js.exe")) returned 1
	[0093.577] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\ui-strings.js.exe")) returned 1
	[0093.621] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\uk-ua\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\uk-ua\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\uk-ua\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\uk-ua\\ui-strings.js.exe")) returned 1
	[0093.625] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\zh-cn\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\zh-cn\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\zh-cn\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\zh-cn\\ui-strings.js.exe")) returned 1
	[0093.630] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\zh-tw\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\zh-tw\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\zh-tw\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\files\\dev\\nls\\zh-tw\\ui-strings.js.exe")) returned 1
	[0093.635] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\jquery.ui.touch-punch\\0.2.2\\jquery.ui.touch-punch.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\libs\\jquery.ui.touch-punch\\0.2.2\\jquery.ui.touch-punch.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\jquery.ui.touch-punch\\0.2.2\\jquery.ui.touch-punch.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\libs\\jquery.ui.touch-punch\\0.2.2\\jquery.ui.touch-punch.js.exe")) returned 1
	[0093.639] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\require\\2.1.15\\require.min.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\libs\\require\\2.1.15\\require.min.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\require\\2.1.15\\require.min.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\libs\\require\\2.1.15\\require.min.js.exe")) returned 1
	[0093.647] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\misc\\load-typekit.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\misc\\load-typekit.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\misc\\load-typekit.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\misc\\load-typekit.js.exe")) returned 1
	[0093.695] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\bg_patterns_header.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\bg_patterns_header.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\bg_patterns_header.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\bg_patterns_header.png.exe")) returned 1
	[0093.698] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\bg_pattern_RHP.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\bg_pattern_rhp.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\bg_pattern_RHP.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\bg_pattern_rhp.png.exe")) returned 1
	[0093.703] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\icons.png.exe")) returned 1
	[0093.709] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\icons_ie8.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\icons_ie8.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\icons_ie8.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\icons_ie8.gif.exe")) returned 1
	[0093.712] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\icons_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\icons_retina.png.exe")) returned 1
	[0093.715] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\illustrations.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\illustrations.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\illustrations.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\illustrations.png.exe")) returned 1
	[0093.717] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\illustrations_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\illustrations_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\illustrations_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\illustrations_retina.png.exe")) returned 1
	[0093.720] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\new_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\new_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\new_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\new_icons.png.exe")) returned 1
	[0093.723] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\new_icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\new_icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\new_icons_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\new_icons_retina.png.exe")) returned 1
	[0093.729] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\bg_patterns_header.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\bg_patterns_header.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\bg_patterns_header.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\bg_patterns_header.png.exe")) returned 1
	[0093.731] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\bg_pattern_RHP.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\bg_pattern_rhp.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\bg_pattern_RHP.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\bg_pattern_rhp.png.exe")) returned 1
	[0093.733] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\icons.png.exe")) returned 1
	[0093.749] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\icons_ie8.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\icons_ie8.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\icons_ie8.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\icons_ie8.gif.exe")) returned 1
	[0093.753] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\icons_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\icons_retina.png.exe")) returned 1
	[0093.756] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\illustrations.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\illustrations.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\illustrations.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\illustrations.png.exe")) returned 1
	[0093.758] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\illustrations_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\illustrations_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\illustrations_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\illustrations_retina.png.exe")) returned 1
	[0093.761] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\new_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\new_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\new_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\new_icons.png.exe")) returned 1
	[0093.764] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\new_icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\new_icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\new_icons_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\new_icons_retina.png.exe")) returned 1
	[0093.770] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ca-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\ca-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ca-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\ca-es\\ui-strings.js.exe")) returned 1
	[0093.775] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\cs-cz\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\cs-cz\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\cs-cz\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\cs-cz\\ui-strings.js.exe")) returned 1
	[0093.779] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\da-dk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\da-dk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\da-dk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\da-dk\\ui-strings.js.exe")) returned 1
	[0093.783] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\de-de\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\de-de\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\de-de\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\de-de\\ui-strings.js.exe")) returned 1
	[0093.795] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\en-ae\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\en-ae\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\en-ae\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\en-ae\\ui-strings.js.exe")) returned 1
	[0093.800] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\en-gb\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\en-gb\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\en-gb\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\en-gb\\ui-strings.js.exe")) returned 1
	[0093.815] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\en-il\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\en-il\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\en-il\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\en-il\\ui-strings.js.exe")) returned 1
	[0093.821] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\es-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\es-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\es-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\es-es\\ui-strings.js.exe")) returned 1
	[0093.893] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\eu-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\eu-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\eu-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\eu-es\\ui-strings.js.exe")) returned 1
	[0093.898] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\fi-fi\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\fi-fi\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\fi-fi\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\fi-fi\\ui-strings.js.exe")) returned 1
	[0093.902] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\fr-fr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\fr-fr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\fr-fr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\fr-fr\\ui-strings.js.exe")) returned 1
	[0093.910] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\fr-ma\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\fr-ma\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\fr-ma\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\fr-ma\\ui-strings.js.exe")) returned 1
	[0093.918] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\hr-hr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\hr-hr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\hr-hr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\hr-hr\\ui-strings.js.exe")) returned 1
	[0093.923] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\hu-hu\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\hu-hu\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\hu-hu\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\hu-hu\\ui-strings.js.exe")) returned 1
	[0093.928] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\it-it\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\it-it\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\it-it\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\it-it\\ui-strings.js.exe")) returned 1
	[0093.931] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ja-jp\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\ja-jp\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ja-jp\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\ja-jp\\ui-strings.js.exe")) returned 1
	[0093.935] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ko-kr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\ko-kr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ko-kr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\ko-kr\\ui-strings.js.exe")) returned 1
	[0093.941] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\nb-no\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\nb-no\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\nb-no\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\nb-no\\ui-strings.js.exe")) returned 1
	[0093.946] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\nl-nl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\nl-nl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\nl-nl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\nl-nl\\ui-strings.js.exe")) returned 1
	[0093.952] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\pl-pl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\pl-pl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\pl-pl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\pl-pl\\ui-strings.js.exe")) returned 1
	[0093.956] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\pt-br\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\pt-br\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\pt-br\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\pt-br\\ui-strings.js.exe")) returned 1
	[0093.962] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ro-ro\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\ro-ro\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ro-ro\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\ro-ro\\ui-strings.js.exe")) returned 1
	[0093.966] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\root\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\root\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\root\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\root\\ui-strings.js.exe")) returned 1
	[0093.971] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ru-ru\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\ru-ru\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ru-ru\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\ru-ru\\ui-strings.js.exe")) returned 1
	[0093.977] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\sk-sk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\sk-sk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\sk-sk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\sk-sk\\ui-strings.js.exe")) returned 1
	[0093.982] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\sl-si\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\sl-si\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\sl-si\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\sl-si\\ui-strings.js.exe")) returned 1
	[0093.985] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\sv-se\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\sv-se\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\sv-se\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\sv-se\\ui-strings.js.exe")) returned 1
	[0093.989] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\tr-tr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\tr-tr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\tr-tr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\tr-tr\\ui-strings.js.exe")) returned 1
	[0093.992] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\ui-strings.js.exe")) returned 1
	[0093.997] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\uk-ua\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\uk-ua\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\uk-ua\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\uk-ua\\ui-strings.js.exe")) returned 1
	[0094.001] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\zh-cn\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\zh-cn\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\zh-cn\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\zh-cn\\ui-strings.js.exe")) returned 1
	[0094.043] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\zh-tw\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\zh-tw\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\zh-tw\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\nls\\zh-tw\\ui-strings.js.exe")) returned 1
	[0094.047] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\plugin.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\plugin.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\plugin.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\plugin.js.exe")) returned 1
	[0094.050] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\selector.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\selector.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\selector.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\js\\selector.js.exe")) returned 1
	[0094.061] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account-select\\js\\plugin.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account-select\\js\\plugin.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account-select\\js\\plugin.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account-select\\js\\plugin.js.exe")) returned 1
	[0094.070] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon.png.exe")) returned 1
	[0094.074] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon_2x.png.exe")) returned 1
	[0094.076] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon_hover.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon_hover.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon_hover.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon_hover.png.exe")) returned 1
	[0094.079] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon_hover_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon_hover_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon_hover_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon_hover_2x.png.exe")) returned 1
	[0094.089] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon.png.exe")) returned 1
	[0094.091] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon_2x.png.exe")) returned 1
	[0094.093] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon_hover.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon_hover.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon_hover.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon_hover.png.exe")) returned 1
	[0094.095] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon_hover_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon_hover_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.exe")) returned 1
	[0094.097] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\warning.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\warning.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\warning.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\warning.png.exe")) returned 1
	[0094.103] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\warning_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\warning_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\warning_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\warning_2x.png.exe")) returned 1
	[0094.105] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\warning.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\warning.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\warning.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\warning.png.exe")) returned 1
	[0094.108] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\warning_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\warning_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\warning_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\warning_2x.png.exe")) returned 1
	[0094.115] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\da-dk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\nls\\da-dk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\da-dk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\nls\\da-dk\\ui-strings.js.exe")) returned 1
	[0094.123] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\de-de\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\nls\\de-de\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\de-de\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\nls\\de-de\\ui-strings.js.exe")) returned 1
	[0094.127] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\en-gb\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\nls\\en-gb\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\en-gb\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\nls\\en-gb\\ui-strings.js.exe")) returned 1
	[0094.132] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\es-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\nls\\es-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\es-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\nls\\es-es\\ui-strings.js.exe")) returned 1
	[0094.138] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\fi-fi\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\nls\\fi-fi\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\fi-fi\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\nls\\fi-fi\\ui-strings.js.exe")) returned 1
	[0094.143] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\fr-fr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\nls\\fr-fr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\fr-fr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\nls\\fr-fr\\ui-strings.js.exe")) returned 1
	[0094.152] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\it-it\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\nls\\it-it\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\it-it\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\nls\\it-it\\ui-strings.js.exe")) returned 1
	[0094.162] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\ja-jp\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\nls\\ja-jp\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\ja-jp\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\nls\\ja-jp\\ui-strings.js.exe")) returned 1
	[0094.169] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\nb-no\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\nls\\nb-no\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\nb-no\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\nls\\nb-no\\ui-strings.js.exe")) returned 1
	[0094.174] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\nl-nl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\nls\\nl-nl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\nl-nl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\nls\\nl-nl\\ui-strings.js.exe")) returned 1
	[0094.178] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\pt-br\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\nls\\pt-br\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\pt-br\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\nls\\pt-br\\ui-strings.js.exe")) returned 1
	[0094.182] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\root\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\nls\\root\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\root\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\nls\\root\\ui-strings.js.exe")) returned 1
	[0094.187] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\sv-se\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\nls\\sv-se\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\sv-se\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\nls\\sv-se\\ui-strings.js.exe")) returned 1
	[0094.191] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\nls\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\nls\\ui-strings.js.exe")) returned 1
	[0094.202] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\convertpdf-selector.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\convertpdf-selector.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\convertpdf-selector.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\convertpdf-selector.js.exe")) returned 1
	[0094.210] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\convertpdf-tool-view.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\convertpdf-tool-view.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\convertpdf-tool-view.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\convertpdf-tool-view.js.exe")) returned 1
	[0094.215] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\exportpdf-selector.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\exportpdf-selector.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\exportpdf-selector.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\exportpdf-selector.js.exe")) returned 1
	[0094.223] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\exportpdf-tool-view.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\exportpdf-tool-view.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\exportpdf-tool-view.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\exportpdf-tool-view.js.exe")) returned 1
	[0094.241] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\rhp\\convertpdf-rna-selector.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\rhp\\convertpdf-rna-selector.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\rhp\\convertpdf-rna-selector.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\rhp\\convertpdf-rna-selector.js.exe")) returned 1
	[0094.249] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\rhp\\convertpdf-rna-tool-view.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\rhp\\convertpdf-rna-tool-view.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\rhp\\convertpdf-rna-tool-view.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\rhp\\convertpdf-rna-tool-view.js.exe")) returned 1
	[0094.253] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\rhp\\exportpdf-rna-selector.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\rhp\\exportpdf-rna-selector.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\rhp\\exportpdf-rna-selector.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\rhp\\exportpdf-rna-selector.js.exe")) returned 1
	[0094.264] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\rhp\\exportpdf-rna-tool-view.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\rhp\\exportpdf-rna-tool-view.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\rhp\\exportpdf-rna-tool-view.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\rhp\\exportpdf-rna-tool-view.js.exe")) returned 1
	[0094.271] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\selection-action-plugins\\cpdf\\plugin.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\selection-action-plugins\\cpdf\\plugin.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\selection-action-plugins\\cpdf\\plugin.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\selection-action-plugins\\cpdf\\plugin.js.exe")) returned 1
	[0094.274] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\selection-action-plugins\\cpdf\\selector.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\selection-action-plugins\\cpdf\\selector.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\selection-action-plugins\\cpdf\\selector.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\selection-action-plugins\\cpdf\\selector.js.exe")) returned 1
	[0094.279] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\selection-action-plugins\\epdf\\plugin.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\selection-action-plugins\\epdf\\plugin.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\selection-action-plugins\\epdf\\plugin.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\selection-action-plugins\\epdf\\plugin.js.exe")) returned 1
	[0094.282] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\selection-action-plugins\\epdf\\selector.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\selection-action-plugins\\epdf\\selector.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\selection-action-plugins\\epdf\\selector.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\selection-action-plugins\\epdf\\selector.js.exe")) returned 1
	[0094.302] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\example_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\example_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\example_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\example_icons.png.exe")) returned 1
	[0094.304] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\example_icons2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\example_icons2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\example_icons2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\example_icons2x.png.exe")) returned 1
	[0094.306] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon.png.exe")) returned 1
	[0094.309] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon_2x.png.exe")) returned 1
	[0094.311] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon_hover.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon_hover.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon_hover.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon_hover.png.exe")) returned 1
	[0094.313] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon_hover_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon_hover_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon_hover_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon_hover_2x.png.exe")) returned 1
	[0094.323] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\example_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\example_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\example_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\example_icons.png.exe")) returned 1
	[0094.326] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\example_icons2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\example_icons2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\example_icons2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\example_icons2x.png.exe")) returned 1
	[0094.330] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon.png.exe")) returned 1
	[0094.332] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon_2x.png.exe")) returned 1
	[0094.335] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon_hover.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon_hover.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon_hover.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon_hover.png.exe")) returned 1
	[0094.337] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon_hover_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon_hover_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.exe")) returned 1
	[0094.343] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ca-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ca-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ca-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ca-es\\ui-strings.js.exe")) returned 1
	[0094.347] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\cs-cz\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\cs-cz\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\cs-cz\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\cs-cz\\ui-strings.js.exe")) returned 1
	[0094.352] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\da-dk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\da-dk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\da-dk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\da-dk\\ui-strings.js.exe")) returned 1
	[0094.358] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\de-de\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\de-de\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\de-de\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\de-de\\ui-strings.js.exe")) returned 1
	[0094.366] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\en-ae\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\en-ae\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\en-ae\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\en-ae\\ui-strings.js.exe")) returned 1
	[0094.371] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\en-il\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\en-il\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\en-il\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\en-il\\ui-strings.js.exe")) returned 1
	[0094.386] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\es-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\es-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\es-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\es-es\\ui-strings.js.exe")) returned 1
	[0094.391] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\eu-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\eu-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\eu-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\eu-es\\ui-strings.js.exe")) returned 1
	[0094.395] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\fi-fi\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\fi-fi\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\fi-fi\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\fi-fi\\ui-strings.js.exe")) returned 1
	[0094.399] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\fr-fr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\fr-fr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\fr-fr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\fr-fr\\ui-strings.js.exe")) returned 1
	[0094.404] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\fr-ma\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\fr-ma\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\fr-ma\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\fr-ma\\ui-strings.js.exe")) returned 1
	[0094.409] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\hr-hr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\hr-hr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\hr-hr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\hr-hr\\ui-strings.js.exe")) returned 1
	[0094.417] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\hu-hu\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\hu-hu\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\hu-hu\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\hu-hu\\ui-strings.js.exe")) returned 1
	[0094.421] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\it-it\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\it-it\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\it-it\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\it-it\\ui-strings.js.exe")) returned 1
	[0094.425] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ja-jp\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ja-jp\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ja-jp\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ja-jp\\ui-strings.js.exe")) returned 1
	[0094.433] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ko-kr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ko-kr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ko-kr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ko-kr\\ui-strings.js.exe")) returned 1
	[0094.437] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\nb-no\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\nb-no\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\nb-no\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\nb-no\\ui-strings.js.exe")) returned 1
	[0094.444] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\nl-nl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\nl-nl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\nl-nl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\nl-nl\\ui-strings.js.exe")) returned 1
	[0094.448] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\pl-pl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\pl-pl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\pl-pl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\pl-pl\\ui-strings.js.exe")) returned 1
	[0094.452] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\pt-br\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\pt-br\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\pt-br\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\pt-br\\ui-strings.js.exe")) returned 1
	[0094.457] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ro-ro\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ro-ro\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ro-ro\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ro-ro\\ui-strings.js.exe")) returned 1
	[0094.463] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\root\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\root\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\root\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\root\\ui-strings.js.exe")) returned 1
	[0094.468] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ru-ru\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ru-ru\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ru-ru\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ru-ru\\ui-strings.js.exe")) returned 1
	[0094.473] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\sk-sk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\sk-sk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\sk-sk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\sk-sk\\ui-strings.js.exe")) returned 1
	[0094.478] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\sl-si\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\sl-si\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\sl-si\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\sl-si\\ui-strings.js.exe")) returned 1
	[0094.482] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\sv-se\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\sv-se\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\sv-se\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\sv-se\\ui-strings.js.exe")) returned 1
	[0094.486] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\tr-tr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\tr-tr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\tr-tr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\tr-tr\\ui-strings.js.exe")) returned 1
	[0094.490] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ui-strings.js.exe")) returned 1
	[0094.498] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\uk-ua\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\uk-ua\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\uk-ua\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\uk-ua\\ui-strings.js.exe")) returned 1
	[0094.503] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\zh-cn\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\zh-cn\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\zh-cn\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\zh-cn\\ui-strings.js.exe")) returned 1
	[0094.507] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\zh-tw\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\zh-tw\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\zh-tw\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\zh-tw\\ui-strings.js.exe")) returned 1
	[0094.524] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\plugin.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\plugin.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\plugin.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\plugin.js.exe")) returned 1
	[0094.529] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\plugins\\rhp\\combinepdf-selector.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\plugins\\rhp\\combinepdf-selector.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\plugins\\rhp\\combinepdf-selector.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\plugins\\rhp\\combinepdf-selector.js.exe")) returned 1
	[0094.532] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\plugins\\rhp\\combinepdf-tool-view.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\plugins\\rhp\\combinepdf-tool-view.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\plugins\\rhp\\combinepdf-tool-view.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\js\\plugins\\rhp\\combinepdf-tool-view.js.exe")) returned 1
	[0094.540] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\example_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\example_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\example_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\example_icons.png.exe")) returned 1
	[0094.544] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\example_icons2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\example_icons2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\example_icons2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\example_icons2x.png.exe")) returned 1
	[0094.546] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon.png.exe")) returned 1
	[0094.549] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon_2x.png.exe")) returned 1
	[0094.554] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon_hover.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon_hover.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon_hover.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon_hover.png.exe")) returned 1
	[0094.560] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon_hover_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon_hover_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon_hover_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon_hover_2x.png.exe")) returned 1
	[0094.568] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\example_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\example_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\example_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\example_icons.png.exe")) returned 1
	[0094.571] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\example_icons2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\example_icons2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\example_icons2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\example_icons2x.png.exe")) returned 1
	[0094.574] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon.png.exe")) returned 1
	[0094.594] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_2x.png.exe")) returned 1
	[0094.663] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover.png.exe")) returned 1
	[0094.665] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.exe")) returned 1
	[0094.674] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\ca-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\ca-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\ca-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\ca-es\\ui-strings.js.exe")) returned 1
	[0094.682] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\cs-cz\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\cs-cz\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\cs-cz\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\cs-cz\\ui-strings.js.exe")) returned 1
	[0094.686] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\da-dk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\da-dk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\da-dk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\da-dk\\ui-strings.js.exe")) returned 1
	[0094.691] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\de-de\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\de-de\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\de-de\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\de-de\\ui-strings.js.exe")) returned 1
	[0094.695] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\en-ae\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\en-ae\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\en-ae\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\en-ae\\ui-strings.js.exe")) returned 1
	[0094.703] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\en-il\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\en-il\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\en-il\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\en-il\\ui-strings.js.exe")) returned 1
	[0094.724] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\es-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\es-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\es-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\es-es\\ui-strings.js.exe")) returned 1
	[0094.732] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\eu-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\eu-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\eu-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\eu-es\\ui-strings.js.exe")) returned 1
	[0094.744] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\fi-fi\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\fi-fi\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\fi-fi\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\fi-fi\\ui-strings.js.exe")) returned 1
	[0094.763] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\fr-fr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\fr-fr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\fr-fr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\fr-fr\\ui-strings.js.exe")) returned 1
	[0094.769] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\fr-ma\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\fr-ma\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\fr-ma\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\fr-ma\\ui-strings.js.exe")) returned 1
	[0094.774] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\hr-hr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\hr-hr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\hr-hr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\hr-hr\\ui-strings.js.exe")) returned 1
	[0094.779] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\hu-hu\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\hu-hu\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\hu-hu\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\hu-hu\\ui-strings.js.exe")) returned 1
	[0094.782] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\it-it\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\it-it\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\it-it\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\it-it\\ui-strings.js.exe")) returned 1
	[0094.786] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\ja-jp\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\ja-jp\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\ja-jp\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\ja-jp\\ui-strings.js.exe")) returned 1
	[0094.795] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\ko-kr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\ko-kr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\ko-kr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\ko-kr\\ui-strings.js.exe")) returned 1
	[0094.804] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\nb-no\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\nb-no\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\nb-no\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\nb-no\\ui-strings.js.exe")) returned 1
	[0094.808] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\nl-nl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\nl-nl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\nl-nl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\nl-nl\\ui-strings.js.exe")) returned 1
	[0094.812] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\pl-pl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\pl-pl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\pl-pl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\pl-pl\\ui-strings.js.exe")) returned 1
	[0094.817] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\pt-br\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\pt-br\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\pt-br\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\pt-br\\ui-strings.js.exe")) returned 1
	[0094.820] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\ro-ro\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\ro-ro\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\ro-ro\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\ro-ro\\ui-strings.js.exe")) returned 1
	[0094.877] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\root\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\root\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\root\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\root\\ui-strings.js.exe")) returned 1
	[0094.883] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\ru-ru\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\ru-ru\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\ru-ru\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\ru-ru\\ui-strings.js.exe")) returned 1
	[0094.887] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\sk-sk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\sk-sk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\sk-sk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\sk-sk\\ui-strings.js.exe")) returned 1
	[0095.120] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\sl-si\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\sl-si\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\sl-si\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\sl-si\\ui-strings.js.exe")) returned 1
	[0095.125] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\sv-se\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\sv-se\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\sv-se\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\sv-se\\ui-strings.js.exe")) returned 1
	[0095.136] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\tr-tr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\tr-tr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\tr-tr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\tr-tr\\ui-strings.js.exe")) returned 1
	[0095.139] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\ui-strings.js.exe")) returned 1
	[0095.143] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\uk-ua\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\uk-ua\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\uk-ua\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\uk-ua\\ui-strings.js.exe")) returned 1
	[0095.152] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\zh-cn\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\zh-cn\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\zh-cn\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\zh-cn\\ui-strings.js.exe")) returned 1
	[0095.158] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\zh-tw\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\zh-tw\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\zh-tw\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\zh-tw\\ui-strings.js.exe")) returned 1
	[0095.162] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\plugin.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\plugin.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\plugin.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\plugin.js.exe")) returned 1
	[0095.214] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\plugins\\rhp\\createpdfupsell-app-selector.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\plugins\\rhp\\createpdfupsell-app-selector.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\plugins\\rhp\\createpdfupsell-app-selector.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\plugins\\rhp\\createpdfupsell-app-selector.js.exe")) returned 1
	[0095.228] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\plugins\\rhp\\createpdfupsell-app-tool-view.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\plugins\\rhp\\createpdfupsell-app-tool-view.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\plugins\\rhp\\createpdfupsell-app-tool-view.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\plugins\\rhp\\createpdfupsell-app-tool-view.js.exe")) returned 1
	[0095.281] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\dc-annotations\\js\\plugin.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\dc-annotations\\js\\plugin.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\dc-annotations\\js\\plugin.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\dc-annotations\\js\\plugin.js.exe")) returned 1
	[0095.302] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\ca-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\ca-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\ca-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\ca-es\\ui-strings.js.exe")) returned 1
	[0095.313] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\cs-cz\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\cs-cz\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\cs-cz\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\cs-cz\\ui-strings.js.exe")) returned 1
	[0095.325] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\da-dk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\da-dk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\da-dk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\da-dk\\ui-strings.js.exe")) returned 1
	[0095.329] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\de-de\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\de-de\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\de-de\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\de-de\\ui-strings.js.exe")) returned 1
	[0095.341] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\en-ae\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\en-ae\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\en-ae\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\en-ae\\ui-strings.js.exe")) returned 1
	[0095.345] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\en-gb\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\en-gb\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\en-gb\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\en-gb\\ui-strings.js.exe")) returned 1
	[0095.385] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\en-il\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\en-il\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\en-il\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\en-il\\ui-strings.js.exe")) returned 1
	[0095.393] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\es-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\es-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\es-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\es-es\\ui-strings.js.exe")) returned 1
	[0095.407] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\eu-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\eu-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\eu-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\eu-es\\ui-strings.js.exe")) returned 1
	[0095.420] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\fi-fi\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\fi-fi\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\fi-fi\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\fi-fi\\ui-strings.js.exe")) returned 1
	[0095.436] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\fr-fr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\fr-fr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\fr-fr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\fr-fr\\ui-strings.js.exe")) returned 1
	[0095.451] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\fr-ma\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\fr-ma\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\fr-ma\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\fr-ma\\ui-strings.js.exe")) returned 1
	[0095.466] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\hr-hr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\hr-hr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\hr-hr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\hr-hr\\ui-strings.js.exe")) returned 1
	[0095.496] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\hu-hu\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\hu-hu\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\hu-hu\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\hu-hu\\ui-strings.js.exe")) returned 1
	[0095.501] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\it-it\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\it-it\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\it-it\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\it-it\\ui-strings.js.exe")) returned 1
	[0095.509] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\ja-jp\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\ja-jp\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\ja-jp\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\ja-jp\\ui-strings.js.exe")) returned 1
	[0095.513] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\ko-kr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\ko-kr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\ko-kr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\ko-kr\\ui-strings.js.exe")) returned 1
	[0095.518] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\nb-no\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\nb-no\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\nb-no\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\nb-no\\ui-strings.js.exe")) returned 1
	[0095.521] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\nl-nl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\nl-nl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\nl-nl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\nl-nl\\ui-strings.js.exe")) returned 1
	[0095.525] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\pl-pl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\pl-pl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\pl-pl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\pl-pl\\ui-strings.js.exe")) returned 1
	[0095.530] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\pt-br\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\pt-br\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\pt-br\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\pt-br\\ui-strings.js.exe")) returned 1
	[0095.589] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\ro-ro\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\ro-ro\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\ro-ro\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\ro-ro\\ui-strings.js.exe")) returned 1
	[0095.594] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\root\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\root\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\root\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\root\\ui-strings.js.exe")) returned 1
	[0095.600] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\ru-ru\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\ru-ru\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\ru-ru\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\ru-ru\\ui-strings.js.exe")) returned 1
	[0095.605] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\sk-sk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\sk-sk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\sk-sk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\sk-sk\\ui-strings.js.exe")) returned 1
	[0095.609] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\sl-si\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\sl-si\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\sl-si\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\sl-si\\ui-strings.js.exe")) returned 1
	[0095.622] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\sv-se\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\sv-se\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\sv-se\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\sv-se\\ui-strings.js.exe")) returned 1
	[0095.626] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\tr-tr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\tr-tr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\tr-tr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\tr-tr\\ui-strings.js.exe")) returned 1
	[0095.631] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\ui-strings.js.exe")) returned 1
	[0095.635] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\uk-ua\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\uk-ua\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\uk-ua\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\uk-ua\\ui-strings.js.exe")) returned 1
	[0095.684] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\zh-cn\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\zh-cn\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\zh-cn\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\zh-cn\\ui-strings.js.exe")) returned 1
	[0095.688] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\zh-tw\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\zh-tw\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\zh-tw\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\zh-tw\\ui-strings.js.exe")) returned 1
	[0095.693] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\plugin.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\plugin.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\plugin.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\plugin.js.exe")) returned 1
	[0095.696] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\selector.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\selector.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\selector.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\js\\selector.js.exe")) returned 1
	[0095.704] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\js\\plugin.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files-select\\js\\plugin.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\js\\plugin.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files-select\\js\\plugin.js.exe")) returned 1
	[0095.710] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\js\\selector.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files-select\\js\\selector.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\js\\selector.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files-select\\js\\selector.js.exe")) returned 1
	[0095.769] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\images\\digsig_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\images\\digsig_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\images\\digsig_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\images\\digsig_icons.png.exe")) returned 1
	[0095.772] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\images\\digsig_icons_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\images\\digsig_icons_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\images\\digsig_icons_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\images\\digsig_icons_2x.png.exe")) returned 1
	[0095.778] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\images\\themes\\dark\\digsig_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\images\\themes\\dark\\digsig_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\images\\themes\\dark\\digsig_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\images\\themes\\dark\\digsig_icons.png.exe")) returned 1
	[0095.781] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\images\\themes\\dark\\digsig_icons_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\images\\themes\\dark\\digsig_icons_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\images\\themes\\dark\\digsig_icons_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\images\\themes\\dark\\digsig_icons_2x.png.exe")) returned 1
	[0095.788] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\ca-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\ca-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\ca-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\ca-es\\ui-strings.js.exe")) returned 1
	[0095.792] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\cs-cz\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\cs-cz\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\cs-cz\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\cs-cz\\ui-strings.js.exe")) returned 1
	[0095.796] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\da-dk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\da-dk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\da-dk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\da-dk\\ui-strings.js.exe")) returned 1
	[0095.801] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\de-de\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\de-de\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\de-de\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\de-de\\ui-strings.js.exe")) returned 1
	[0095.895] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\en-ae\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\en-ae\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\en-ae\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\en-ae\\ui-strings.js.exe")) returned 1
	[0095.902] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\en-il\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\en-il\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\en-il\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\en-il\\ui-strings.js.exe")) returned 1
	[0095.906] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\es-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\es-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\es-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\es-es\\ui-strings.js.exe")) returned 1
	[0095.910] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\eu-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\eu-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\eu-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\eu-es\\ui-strings.js.exe")) returned 1
	[0095.915] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\fi-fi\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\fi-fi\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\fi-fi\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\fi-fi\\ui-strings.js.exe")) returned 1
	[0095.920] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\fr-fr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\fr-fr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\fr-fr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\fr-fr\\ui-strings.js.exe")) returned 1
	[0095.924] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\fr-ma\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\fr-ma\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\fr-ma\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\fr-ma\\ui-strings.js.exe")) returned 1
	[0095.929] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\hr-hr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\hr-hr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\hr-hr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\hr-hr\\ui-strings.js.exe")) returned 1
	[0095.983] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\hu-hu\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\hu-hu\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\hu-hu\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\hu-hu\\ui-strings.js.exe")) returned 1
	[0095.988] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\it-it\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\it-it\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\it-it\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\it-it\\ui-strings.js.exe")) returned 1
	[0095.992] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\ja-jp\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\ja-jp\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\ja-jp\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\ja-jp\\ui-strings.js.exe")) returned 1
	[0095.996] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\ko-kr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\ko-kr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\ko-kr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\ko-kr\\ui-strings.js.exe")) returned 1
	[0096.006] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\nb-no\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\nb-no\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\nb-no\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\nb-no\\ui-strings.js.exe")) returned 1
	[0096.010] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\nl-nl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\nl-nl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\nl-nl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\nl-nl\\ui-strings.js.exe")) returned 1
	[0096.014] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\pl-pl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\pl-pl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\pl-pl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\pl-pl\\ui-strings.js.exe")) returned 1
	[0096.018] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\pt-br\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\pt-br\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\pt-br\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\pt-br\\ui-strings.js.exe")) returned 1
	[0096.058] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\ro-ro\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\ro-ro\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\ro-ro\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\ro-ro\\ui-strings.js.exe")) returned 1
	[0096.063] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\root\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\root\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\root\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\root\\ui-strings.js.exe")) returned 1
	[0096.069] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\ru-ru\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\ru-ru\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\ru-ru\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\ru-ru\\ui-strings.js.exe")) returned 1
	[0096.074] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\sk-sk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\sk-sk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\sk-sk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\sk-sk\\ui-strings.js.exe")) returned 1
	[0096.078] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\sl-si\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\sl-si\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\sl-si\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\sl-si\\ui-strings.js.exe")) returned 1
	[0096.082] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\sv-se\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\sv-se\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\sv-se\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\sv-se\\ui-strings.js.exe")) returned 1
	[0096.087] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\tr-tr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\tr-tr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\tr-tr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\tr-tr\\ui-strings.js.exe")) returned 1
	[0096.091] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\ui-strings.js.exe")) returned 1
	[0096.177] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\uk-ua\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\uk-ua\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\uk-ua\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\uk-ua\\ui-strings.js.exe")) returned 1
	[0096.182] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\zh-cn\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\zh-cn\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\zh-cn\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\zh-cn\\ui-strings.js.exe")) returned 1
	[0096.186] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\zh-tw\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\zh-tw\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\zh-tw\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\nls\\zh-tw\\ui-strings.js.exe")) returned 1
	[0096.194] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\plugin.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\plugin.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\plugin.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\plugin.js.exe")) returned 1
	[0096.212] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\selector.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\selector.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\selector.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\js\\selector.js.exe")) returned 1
	[0096.257] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\example_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\example_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\example_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\example_icons.png.exe")) returned 1
	[0096.261] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\example_icons2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\example_icons2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\example_icons2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\example_icons2x.png.exe")) returned 1
	[0096.263] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon.png.exe")) returned 1
	[0096.266] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon_2x.png.exe")) returned 1
	[0096.268] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon_hover.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon_hover.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon_hover.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon_hover.png.exe")) returned 1
	[0096.273] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon_hover_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon_hover_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon_hover_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon_hover_2x.png.exe")) returned 1
	[0096.278] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\example_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\example_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\example_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\example_icons.png.exe")) returned 1
	[0096.281] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\example_icons2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\example_icons2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\example_icons2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\example_icons2x.png.exe")) returned 1
	[0096.283] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon.png.exe")) returned 1
	[0096.285] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon_2x.png.exe")) returned 1
	[0096.287] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon_hover.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon_hover.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon_hover.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon_hover.png.exe")) returned 1
	[0096.290] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon_hover_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon_hover_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.exe")) returned 1
	[0096.386] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\ca-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\ca-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\ca-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\ca-es\\ui-strings.js.exe")) returned 1
	[0096.390] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\cs-cz\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\cs-cz\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\cs-cz\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\cs-cz\\ui-strings.js.exe")) returned 1
	[0096.395] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\da-dk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\da-dk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\da-dk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\da-dk\\ui-strings.js.exe")) returned 1
	[0096.400] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\de-de\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\de-de\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\de-de\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\de-de\\ui-strings.js.exe")) returned 1
	[0096.405] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\en-ae\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\en-ae\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\en-ae\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\en-ae\\ui-strings.js.exe")) returned 1
	[0096.408] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\en-gb\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\en-gb\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\en-gb\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\en-gb\\ui-strings.js.exe")) returned 1
	[0096.412] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\en-il\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\en-il\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\en-il\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\en-il\\ui-strings.js.exe")) returned 1
	[0096.418] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\es-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\es-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\es-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\es-es\\ui-strings.js.exe")) returned 1
	[0096.467] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\eu-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\eu-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\eu-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\eu-es\\ui-strings.js.exe")) returned 1
	[0096.472] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\fi-fi\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\fi-fi\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\fi-fi\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\fi-fi\\ui-strings.js.exe")) returned 1
	[0096.477] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\fr-fr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\fr-fr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\fr-fr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\fr-fr\\ui-strings.js.exe")) returned 1
	[0096.481] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\fr-ma\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\fr-ma\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\fr-ma\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\fr-ma\\ui-strings.js.exe")) returned 1
	[0096.485] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\hr-hr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\hr-hr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\hr-hr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\hr-hr\\ui-strings.js.exe")) returned 1
	[0096.490] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\hu-hu\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\hu-hu\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\hu-hu\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\hu-hu\\ui-strings.js.exe")) returned 1
	[0096.494] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\it-it\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\it-it\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\it-it\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\it-it\\ui-strings.js.exe")) returned 1
	[0096.503] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\ja-jp\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\ja-jp\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\ja-jp\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\ja-jp\\ui-strings.js.exe")) returned 1
	[0096.524] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\ko-kr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\ko-kr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\ko-kr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\ko-kr\\ui-strings.js.exe")) returned 1
	[0096.529] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\nb-no\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\nb-no\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\nb-no\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\nb-no\\ui-strings.js.exe")) returned 1
	[0096.534] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\nl-nl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\nl-nl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\nl-nl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\nl-nl\\ui-strings.js.exe")) returned 1
	[0096.538] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\pl-pl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\pl-pl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\pl-pl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\pl-pl\\ui-strings.js.exe")) returned 1
	[0096.552] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\pt-br\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\pt-br\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\pt-br\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\pt-br\\ui-strings.js.exe")) returned 1
	[0096.557] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\ro-ro\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\ro-ro\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\ro-ro\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\ro-ro\\ui-strings.js.exe")) returned 1
	[0096.561] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\root\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\root\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\root\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\root\\ui-strings.js.exe")) returned 1
	[0096.565] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\ru-ru\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\ru-ru\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\ru-ru\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\ru-ru\\ui-strings.js.exe")) returned 1
	[0096.580] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\sk-sk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\sk-sk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\sk-sk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\sk-sk\\ui-strings.js.exe")) returned 1
	[0096.584] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\sl-si\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\sl-si\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\sl-si\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\sl-si\\ui-strings.js.exe")) returned 1
	[0096.590] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\sv-se\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\sv-se\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\sv-se\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\sv-se\\ui-strings.js.exe")) returned 1
	[0096.594] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\tr-tr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\tr-tr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\tr-tr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\tr-tr\\ui-strings.js.exe")) returned 1
	[0096.598] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\ui-strings.js.exe")) returned 1
	[0096.602] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\uk-ua\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\uk-ua\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\uk-ua\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\uk-ua\\ui-strings.js.exe")) returned 1
	[0096.607] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\zh-cn\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\zh-cn\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\zh-cn\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\zh-cn\\ui-strings.js.exe")) returned 1
	[0096.611] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\zh-tw\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\zh-tw\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\zh-tw\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\nls\\zh-tw\\ui-strings.js.exe")) returned 1
	[0096.624] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\plugin.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\plugin.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\plugin.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\plugin.js.exe")) returned 1
	[0096.651] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\plugins\\editpdf-selector.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\plugins\\editpdf-selector.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\plugins\\editpdf-selector.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\plugins\\editpdf-selector.js.exe")) returned 1
	[0096.655] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\plugins\\editpdf-tool-view.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\plugins\\editpdf-tool-view.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\plugins\\editpdf-tool-view.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\plugins\\editpdf-tool-view.js.exe")) returned 1
	[0096.664] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\plugins\\rhp\\editpdf-selector.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\plugins\\rhp\\editpdf-selector.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\plugins\\rhp\\editpdf-selector.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\plugins\\rhp\\editpdf-selector.js.exe")) returned 1
	[0096.668] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\plugins\\rhp\\editpdf-tool-view.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\plugins\\rhp\\editpdf-tool-view.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\plugins\\rhp\\editpdf-tool-view.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\js\\plugins\\rhp\\editpdf-tool-view.js.exe")) returned 1
	[0096.679] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\example_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\example_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\example_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\example_icons.png.exe")) returned 1
	[0096.684] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\example_icons2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\example_icons2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\example_icons2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\example_icons2x.png.exe")) returned 1
	[0096.686] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon.png.exe")) returned 1
	[0096.689] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon_2x.png.exe")) returned 1
	[0096.691] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon_hover.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon_hover.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon_hover.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon_hover.png.exe")) returned 1
	[0096.696] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon_hover_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon_hover_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon_hover_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon_hover_2x.png.exe")) returned 1
	[0096.703] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\example_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\example_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\example_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\example_icons.png.exe")) returned 1
	[0096.706] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\example_icons2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\example_icons2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\example_icons2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\example_icons2x.png.exe")) returned 1
	[0096.708] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon.png.exe")) returned 1
	[0096.710] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_2x.png.exe")) returned 1
	[0096.712] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover.png.exe")) returned 1
	[0096.715] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.exe")) returned 1
	[0096.723] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\ca-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\ca-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\ca-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\ca-es\\ui-strings.js.exe")) returned 1
	[0096.727] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\cs-cz\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\cs-cz\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\cs-cz\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\cs-cz\\ui-strings.js.exe")) returned 1
	[0096.731] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\da-dk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\da-dk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\da-dk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\da-dk\\ui-strings.js.exe")) returned 1
	[0096.760] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\de-de\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\de-de\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\de-de\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\de-de\\ui-strings.js.exe")) returned 1
	[0096.765] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\en-ae\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\en-ae\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\en-ae\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\en-ae\\ui-strings.js.exe")) returned 1
	[0096.770] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\en-il\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\en-il\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\en-il\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\en-il\\ui-strings.js.exe")) returned 1
	[0096.774] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\es-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\es-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\es-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\es-es\\ui-strings.js.exe")) returned 1
	[0096.779] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\eu-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\eu-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\eu-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\eu-es\\ui-strings.js.exe")) returned 1
	[0096.785] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\fi-fi\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\fi-fi\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\fi-fi\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\fi-fi\\ui-strings.js.exe")) returned 1
	[0096.792] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\fr-fr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\fr-fr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\fr-fr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\fr-fr\\ui-strings.js.exe")) returned 1
	[0096.798] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\fr-ma\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\fr-ma\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\fr-ma\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\fr-ma\\ui-strings.js.exe")) returned 1
	[0096.804] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\hr-hr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\hr-hr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\hr-hr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\hr-hr\\ui-strings.js.exe")) returned 1
	[0096.809] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\hu-hu\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\hu-hu\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\hu-hu\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\hu-hu\\ui-strings.js.exe")) returned 1
	[0096.813] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\it-it\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\it-it\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\it-it\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\it-it\\ui-strings.js.exe")) returned 1
	[0096.818] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\ja-jp\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\ja-jp\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\ja-jp\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\ja-jp\\ui-strings.js.exe")) returned 1
	[0096.855] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\ko-kr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\ko-kr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\ko-kr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\ko-kr\\ui-strings.js.exe")) returned 1
	[0096.861] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\nb-no\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\nb-no\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\nb-no\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\nb-no\\ui-strings.js.exe")) returned 1
	[0096.866] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\nl-nl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\nl-nl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\nl-nl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\nl-nl\\ui-strings.js.exe")) returned 1
	[0096.887] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\pl-pl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\pl-pl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\pl-pl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\pl-pl\\ui-strings.js.exe")) returned 1
	[0096.891] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\pt-br\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\pt-br\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\pt-br\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\pt-br\\ui-strings.js.exe")) returned 1
	[0096.895] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\ro-ro\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\ro-ro\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\ro-ro\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\ro-ro\\ui-strings.js.exe")) returned 1
	[0096.900] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\root\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\root\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\root\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\root\\ui-strings.js.exe")) returned 1
	[0096.904] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\ru-ru\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\ru-ru\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\ru-ru\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\ru-ru\\ui-strings.js.exe")) returned 1
	[0096.908] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\sk-sk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\sk-sk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\sk-sk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\sk-sk\\ui-strings.js.exe")) returned 1
	[0096.914] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\sl-si\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\sl-si\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\sl-si\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\sl-si\\ui-strings.js.exe")) returned 1
	[0096.919] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\sv-se\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\sv-se\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\sv-se\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\sv-se\\ui-strings.js.exe")) returned 1
	[0096.923] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\tr-tr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\tr-tr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\tr-tr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\tr-tr\\ui-strings.js.exe")) returned 1
	[0096.930] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\ui-strings.js.exe")) returned 1
	[0096.935] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\uk-ua\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\uk-ua\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\uk-ua\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\uk-ua\\ui-strings.js.exe")) returned 1
	[0096.943] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\zh-cn\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\zh-cn\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\zh-cn\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\zh-cn\\ui-strings.js.exe")) returned 1
	[0096.952] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\zh-tw\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\zh-tw\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\zh-tw\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\zh-tw\\ui-strings.js.exe")) returned 1
	[0096.956] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\plugin.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\plugin.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\plugin.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\plugin.js.exe")) returned 1
	[0096.962] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\plugins\\rhp\\exportpdfupsell-app-selector.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\plugins\\rhp\\exportpdfupsell-app-selector.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\plugins\\rhp\\exportpdfupsell-app-selector.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\plugins\\rhp\\exportpdfupsell-app-selector.js.exe")) returned 1
	[0096.964] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\plugins\\rhp\\exportpdfupsell-app-tool-view.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\plugins\\rhp\\exportpdfupsell-app-tool-view.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\plugins\\rhp\\exportpdfupsell-app-tool-view.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\plugins\\rhp\\exportpdfupsell-app-tool-view.js.exe")) returned 1
	[0096.974] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\adobe_sign_tag.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\adobe_sign_tag.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\adobe_sign_tag.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\adobe_sign_tag.png.exe")) returned 1
	[0096.980] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\adobe_sign_tag_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\adobe_sign_tag_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\adobe_sign_tag_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\adobe_sign_tag_retina.png.exe")) returned 1
	[0096.994] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\core_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\core_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\core_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\core_icons.png.exe")) returned 1
	[0096.998] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\core_icons_fw.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\core_icons_fw.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\core_icons_fw.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\core_icons_fw.png.exe")) returned 1
	[0097.001] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\core_icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\core_icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\core_icons_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\core_icons_retina.png.exe")) returned 1
	[0097.004] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\faf_field_grabber.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\faf_field_grabber.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\faf_field_grabber.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\faf_field_grabber.png.exe")) returned 1
	[0097.007] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\faf_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\faf_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\faf_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\faf_icons.png.exe")) returned 1
	[0097.014] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\faf_icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\faf_icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\faf_icons_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\faf_icons_retina.png.exe")) returned 1
	[0097.016] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\Handler@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\handler@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\Handler@1x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\handler@1x.png.exe")) returned 1
	[0097.019] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\sample-thumb.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\sample-thumb.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\sample-thumb.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\sample-thumb.png.exe")) returned 1
	[0097.026] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\adobe_sign_tag.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\adobe_sign_tag.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\adobe_sign_tag.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\adobe_sign_tag.png.exe")) returned 1
	[0097.028] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\adobe_sign_tag_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\adobe_sign_tag_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\adobe_sign_tag_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\adobe_sign_tag_retina.png.exe")) returned 1
	[0097.033] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\core_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\core_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\core_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\core_icons.png.exe")) returned 1
	[0097.037] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\core_icons_fw.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\core_icons_fw.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\core_icons_fw.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\core_icons_fw.png.exe")) returned 1
	[0097.043] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\core_icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\core_icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\core_icons_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\core_icons_retina.png.exe")) returned 1
	[0097.045] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\faf_field_grabber.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\faf_field_grabber.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\faf_field_grabber.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\faf_field_grabber.png.exe")) returned 1
	[0097.048] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\faf_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\faf_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\faf_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\faf_icons.png.exe")) returned 1
	[0097.051] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\faf_icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\faf_icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\faf_icons_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\faf_icons_retina.png.exe")) returned 1
	[0097.054] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\Handler@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\handler@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\Handler@1x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\handler@1x.png.exe")) returned 1
	[0097.057] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\sample-thumb.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\sample-thumb.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\sample-thumb.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\sample-thumb.png.exe")) returned 1
	[0097.064] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_AddBlue@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_addblue@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_AddBlue@1x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_addblue@1x.png.exe")) returned 1
	[0097.066] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Checkmark_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_checkmark_white@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Checkmark_White@1x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_checkmark_white@1x.png.exe")) returned 1
	[0097.069] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Crossmark_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_crossmark_white@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Crossmark_White@1x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_crossmark_white@1x.png.exe")) returned 1
	[0097.072] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_delete@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_delete@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_delete@1x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_delete@1x.png.exe")) returned 1
	[0097.074] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_FilledDot_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_filleddot_white@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_FilledDot_White@1x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_filleddot_white@1x.png.exe")) returned 1
	[0097.076] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Line_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_line_white@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Line_White@1x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_line_white@1x.png.exe")) returned 1
	[0097.088] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Roundrect_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_roundrect_white@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Roundrect_White@1x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_roundrect_white@1x.png.exe")) returned 1
	[0097.095] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Sign_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_sign_white@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Sign_White@1x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_sign_white@1x.png.exe")) returned 1
	[0097.097] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_TypeTextFields_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_typetextfields_white@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_TypeTextFields_White@1x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_typetextfields_white@1x.png.exe")) returned 1
	[0097.099] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\Comb_field_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\comb_field_white@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\Comb_field_White@1x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\comb_field_white@1x.png.exe")) returned 1
	[0097.105] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_AddBlue@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_addblue@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_AddBlue@1x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_addblue@1x.png.exe")) returned 1
	[0097.107] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_Checkmark_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_checkmark_white@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_Checkmark_White@1x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_checkmark_white@1x.png.exe")) returned 1
	[0097.109] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_Crossmark_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_crossmark_white@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_Crossmark_White@1x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_crossmark_white@1x.png.exe")) returned 1
	[0097.115] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_delete@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_delete@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_delete@1x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_delete@1x.png.exe")) returned 1
	[0097.117] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_FilledDot_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_filleddot_white@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_FilledDot_White@1x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_filleddot_white@1x.png.exe")) returned 1
	[0097.119] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_Line_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_line_white@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_Line_White@1x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_line_white@1x.png.exe")) returned 1
	[0097.121] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_Roundrect_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_roundrect_white@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_Roundrect_White@1x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_roundrect_white@1x.png.exe")) returned 1
	[0097.126] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_Sign_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_sign_white@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_Sign_White@1x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_sign_white@1x.png.exe")) returned 1
	[0097.128] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_TypeTextFields_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_typetextfields_white@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_TypeTextFields_White@1x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_typetextfields_white@1x.png.exe")) returned 1
	[0097.157] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\Comb_field_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\comb_field_white@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\Comb_field_White@1x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\comb_field_white@1x.png.exe")) returned 1
	[0097.162] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\check_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\check_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\check_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\check_2x.png.exe")) returned 1
	[0097.165] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\circle_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\circle_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\circle_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\circle_2x.png.exe")) returned 1
	[0097.168] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\dot_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\dot_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\dot_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\dot_2x.png.exe")) returned 1
	[0097.170] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\line_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\line_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\line_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\line_2x.png.exe")) returned 1
	[0097.174] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\text_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\text_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\text_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\text_2x.png.exe")) returned 1
	[0097.182] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\check_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\check_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\check_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\check_2x.png.exe")) returned 1
	[0097.185] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\circle_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\circle_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\circle_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\circle_2x.png.exe")) returned 1
	[0097.189] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\dot_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\dot_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\dot_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\dot_2x.png.exe")) returned 1
	[0097.192] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\line_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\line_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\line_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\line_2x.png.exe")) returned 1
	[0097.196] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\text_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\text_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\text_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\text_2x.png.exe")) returned 1
	[0097.201] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\x_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\x_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\x_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\x_2x.png.exe")) returned 1
	[0097.205] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\x_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\x_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\x_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\x_2x.png.exe")) returned 1
	[0097.215] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\faf-main.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\faf-main.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\faf-main.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\faf-main.js.exe")) returned 1
	[0097.223] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\ca-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\ca-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\ca-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\ca-es\\ui-strings.js.exe")) returned 1
	[0097.227] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\cs-cz\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\cs-cz\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\cs-cz\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\cs-cz\\ui-strings.js.exe")) returned 1
	[0097.235] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\da-dk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\da-dk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\da-dk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\da-dk\\ui-strings.js.exe")) returned 1
	[0097.249] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\de-de\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\de-de\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\de-de\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\de-de\\ui-strings.js.exe")) returned 1
	[0097.255] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\en-gb\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\en-gb\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\en-gb\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\en-gb\\ui-strings.js.exe")) returned 1
	[0097.260] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\es-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\es-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\es-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\es-es\\ui-strings.js.exe")) returned 1
	[0097.265] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\eu-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\eu-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\eu-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\eu-es\\ui-strings.js.exe")) returned 1
	[0097.269] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\fi-fi\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\fi-fi\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\fi-fi\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\fi-fi\\ui-strings.js.exe")) returned 1
	[0097.274] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\fr-fr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\fr-fr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\fr-fr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\fr-fr\\ui-strings.js.exe")) returned 1
	[0097.279] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\hr-hr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\hr-hr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\hr-hr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\hr-hr\\ui-strings.js.exe")) returned 1
	[0097.284] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\hu-hu\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\hu-hu\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\hu-hu\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\hu-hu\\ui-strings.js.exe")) returned 1
	[0097.288] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\it-it\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\it-it\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\it-it\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\it-it\\ui-strings.js.exe")) returned 1
	[0097.293] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\ja-jp\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\ja-jp\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\ja-jp\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\ja-jp\\ui-strings.js.exe")) returned 1
	[0097.299] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\ko-kr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\ko-kr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\ko-kr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\ko-kr\\ui-strings.js.exe")) returned 1
	[0097.309] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\nb-no\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\nb-no\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\nb-no\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\nb-no\\ui-strings.js.exe")) returned 1
	[0097.313] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\nl-nl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\nl-nl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\nl-nl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\nl-nl\\ui-strings.js.exe")) returned 1
	[0097.317] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\pl-pl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\pl-pl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\pl-pl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\pl-pl\\ui-strings.js.exe")) returned 1
	[0097.321] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\pt-br\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\pt-br\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\pt-br\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\pt-br\\ui-strings.js.exe")) returned 1
	[0097.327] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\ro-ro\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\ro-ro\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\ro-ro\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\ro-ro\\ui-strings.js.exe")) returned 1
	[0097.331] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\root\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\root\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\root\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\root\\ui-strings.js.exe")) returned 1
	[0097.337] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\ru-ru\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\ru-ru\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\ru-ru\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\ru-ru\\ui-strings.js.exe")) returned 1
	[0097.345] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\sk-sk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\sk-sk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\sk-sk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\sk-sk\\ui-strings.js.exe")) returned 1
	[0097.353] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\sl-si\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\sl-si\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\sl-si\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\sl-si\\ui-strings.js.exe")) returned 1
	[0097.357] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\sv-se\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\sv-se\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\sv-se\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\sv-se\\ui-strings.js.exe")) returned 1
	[0097.362] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\tr-tr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\tr-tr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\tr-tr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\tr-tr\\ui-strings.js.exe")) returned 1
	[0097.367] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\ui-strings.js.exe")) returned 1
	[0097.374] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\uk-ua\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\uk-ua\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\uk-ua\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\uk-ua\\ui-strings.js.exe")) returned 1
	[0097.439] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\zh-cn\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\zh-cn\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\zh-cn\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\zh-cn\\ui-strings.js.exe")) returned 1
	[0097.449] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\zh-tw\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\zh-tw\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\zh-tw\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\js\\nls\\zh-tw\\ui-strings.js.exe")) returned 1
	[0097.462] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\example_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\example_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\example_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\example_icons.png.exe")) returned 1
	[0097.465] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\example_icons2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\example_icons2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\example_icons2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\example_icons2x.png.exe")) returned 1
	[0097.468] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon.png.exe")) returned 1
	[0097.471] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon_2x.png.exe")) returned 1
	[0097.474] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon_hover.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon_hover.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon_hover.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon_hover.png.exe")) returned 1
	[0097.478] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon_hover_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon_hover_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon_hover_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon_hover_2x.png.exe")) returned 1
	[0097.485] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\example_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\example_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\example_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\example_icons.png.exe")) returned 1
	[0097.488] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\example_icons2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\example_icons2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\example_icons2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\example_icons2x.png.exe")) returned 1
	[0097.498] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon.png.exe")) returned 1
	[0097.500] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon_2x.png.exe")) returned 1
	[0097.503] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon_hover.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon_hover.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon_hover.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon_hover.png.exe")) returned 1
	[0097.505] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon_hover_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon_hover_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.exe")) returned 1
	[0097.514] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\js\\nls\\root\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\js\\nls\\root\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\js\\nls\\root\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\js\\nls\\root\\ui-strings.js.exe")) returned 1
	[0097.518] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\js\\nls\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\js\\nls\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\js\\nls\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\js\\nls\\ui-strings.js.exe")) returned 1
	[0097.523] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\js\\plugin.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\js\\plugin.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\js\\plugin.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\js\\plugin.js.exe")) returned 1
	[0097.530] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\js\\plugins\\rhp\\generic-rhp-app-selector.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\js\\plugins\\rhp\\generic-rhp-app-selector.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\js\\plugins\\rhp\\generic-rhp-app-selector.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\js\\plugins\\rhp\\generic-rhp-app-selector.js.exe")) returned 1
	[0097.533] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\js\\plugins\\rhp\\generic-rhp-app-tool-view.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\js\\plugins\\rhp\\generic-rhp-app-tool-view.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\js\\plugins\\rhp\\generic-rhp-app-tool-view.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\js\\plugins\\rhp\\generic-rhp-app-tool-view.js.exe")) returned 1
	[0097.564] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\files_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\files_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\files_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\files_icons.png.exe")) returned 1
	[0097.567] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\files_icons2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\files_icons2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\files_icons2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\files_icons2x.png.exe")) returned 1
	[0097.570] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\icons.png.exe")) returned 1
	[0097.574] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\icons_ie8.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\icons_ie8.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\icons_ie8.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\icons_ie8.gif.exe")) returned 1
	[0097.577] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\icons_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\icons_retina.png.exe")) returned 1
	[0097.579] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\new_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\new_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\new_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\new_icons.png.exe")) returned 1
	[0097.582] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\new_icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\new_icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\new_icons_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\new_icons_retina.png.exe")) returned 1
	[0097.591] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\files_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\files_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\files_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\files_icons.png.exe")) returned 1
	[0097.593] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\files_icons2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\files_icons2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\files_icons2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\files_icons2x.png.exe")) returned 1
	[0097.598] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\icons.png.exe")) returned 1
	[0097.603] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\icons_ie8.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\icons_ie8.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\icons_ie8.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\icons_ie8.gif.exe")) returned 1
	[0097.608] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\icons_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\icons_retina.png.exe")) returned 1
	[0097.612] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\new_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\new_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\new_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\new_icons.png.exe")) returned 1
	[0097.615] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\new_icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\new_icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\new_icons_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\new_icons_retina.png.exe")) returned 1
	[0097.632] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\da-dk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\js\\nls\\da-dk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\da-dk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\js\\nls\\da-dk\\ui-strings.js.exe")) returned 1
	[0097.638] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\de-de\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\js\\nls\\de-de\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\de-de\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\js\\nls\\de-de\\ui-strings.js.exe")) returned 1
	[0097.660] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\en-gb\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\js\\nls\\en-gb\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\en-gb\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\js\\nls\\en-gb\\ui-strings.js.exe")) returned 1
	[0097.666] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\es-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\js\\nls\\es-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\es-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\js\\nls\\es-es\\ui-strings.js.exe")) returned 1
	[0097.672] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\fi-fi\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\js\\nls\\fi-fi\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\fi-fi\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\js\\nls\\fi-fi\\ui-strings.js.exe")) returned 1
	[0097.677] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\fr-fr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\js\\nls\\fr-fr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\fr-fr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\js\\nls\\fr-fr\\ui-strings.js.exe")) returned 1
	[0097.682] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\it-it\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\js\\nls\\it-it\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\it-it\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\js\\nls\\it-it\\ui-strings.js.exe")) returned 1
	[0097.687] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\ja-jp\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\js\\nls\\ja-jp\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\ja-jp\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\js\\nls\\ja-jp\\ui-strings.js.exe")) returned 1
	[0097.691] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\nb-no\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\js\\nls\\nb-no\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\nb-no\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\js\\nls\\nb-no\\ui-strings.js.exe")) returned 1
	[0097.699] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\nl-nl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\js\\nls\\nl-nl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\nl-nl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\js\\nls\\nl-nl\\ui-strings.js.exe")) returned 1
	[0097.705] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\pt-br\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\js\\nls\\pt-br\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\pt-br\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\js\\nls\\pt-br\\ui-strings.js.exe")) returned 1
	[0097.710] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\root\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\js\\nls\\root\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\root\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\js\\nls\\root\\ui-strings.js.exe")) returned 1
	[0097.765] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\sv-se\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\js\\nls\\sv-se\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\sv-se\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\js\\nls\\sv-se\\ui-strings.js.exe")) returned 1
	[0097.770] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\js\\nls\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\js\\nls\\ui-strings.js.exe")) returned 1
	[0097.775] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\plugin.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\js\\plugin.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\plugin.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\js\\plugin.js.exe")) returned 1
	[0097.778] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\selector.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\js\\selector.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\selector.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\js\\selector.js.exe")) returned 1
	[0097.788] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\bg_patterns_header.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\bg_patterns_header.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\bg_patterns_header.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\bg_patterns_header.png.exe")) returned 1
	[0097.791] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\bg_pattern_RHP.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\bg_pattern_rhp.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\bg_pattern_RHP.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\bg_pattern_rhp.png.exe")) returned 1
	[0097.794] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\file_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\file_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\file_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\file_icons.png.exe")) returned 1
	[0097.797] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\icons.png.exe")) returned 1
	[0097.800] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\icons_ie8.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\icons_ie8.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\icons_ie8.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\icons_ie8.gif.exe")) returned 1
	[0097.803] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\icons_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\icons_retina.png.exe")) returned 1
	[0097.815] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\illustrations.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\illustrations.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\illustrations.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\illustrations.png.exe")) returned 1
	[0097.818] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\illustrations_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\illustrations_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\illustrations_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\illustrations_retina.png.exe")) returned 1
	[0097.821] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\new_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\new_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\new_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\new_icons.png.exe")) returned 1
	[0097.825] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\new_icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\new_icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\new_icons_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\new_icons_retina.png.exe")) returned 1
	[0097.834] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\bg_patterns_header.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\bg_patterns_header.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\bg_patterns_header.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\bg_patterns_header.png.exe")) returned 1
	[0097.854] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\bg_pattern_RHP.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\bg_pattern_rhp.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\bg_pattern_RHP.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\bg_pattern_rhp.png.exe")) returned 1
	[0097.858] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\file_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\file_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\file_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\file_icons.png.exe")) returned 1
	[0097.861] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\icons.png.exe")) returned 1
	[0097.864] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\icons_ie8.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\icons_ie8.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\icons_ie8.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\icons_ie8.gif.exe")) returned 1
	[0097.868] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\icons_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\icons_retina.png.exe")) returned 1
	[0097.886] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\illustrations.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\illustrations.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\illustrations.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\illustrations.png.exe")) returned 1
	[0097.890] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\illustrations_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\illustrations_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\illustrations_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\illustrations_retina.png.exe")) returned 1
	[0097.893] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\new_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\new_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\new_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\new_icons.png.exe")) returned 1
	[0097.896] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\new_icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\new_icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\new_icons_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\new_icons_retina.png.exe")) returned 1
	[0097.902] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\ar-ae\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\ar-ae\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\ar-ae\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\ar-ae\\ui-strings.js.exe")) returned 1
	[0097.908] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\ca-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\ca-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\ca-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\ca-es\\ui-strings.js.exe")) returned 1
	[0097.917] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\cs-cz\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\cs-cz\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\cs-cz\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\cs-cz\\ui-strings.js.exe")) returned 1
	[0097.921] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\da-dk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\da-dk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\da-dk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\da-dk\\ui-strings.js.exe")) returned 1
	[0097.933] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\de-de\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\de-de\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\de-de\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\de-de\\ui-strings.js.exe")) returned 1
	[0097.946] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\en-ae\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\en-ae\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\en-ae\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\en-ae\\ui-strings.js.exe")) returned 1
	[0097.972] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\en-gb\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\en-gb\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\en-gb\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\en-gb\\ui-strings.js.exe")) returned 1
	[0097.979] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\en-il\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\en-il\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\en-il\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\en-il\\ui-strings.js.exe")) returned 1
	[0097.984] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\es-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\es-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\es-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\es-es\\ui-strings.js.exe")) returned 1
	[0097.989] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\eu-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\eu-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\eu-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\eu-es\\ui-strings.js.exe")) returned 1
	[0097.993] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\fi-fi\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\fi-fi\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\fi-fi\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\fi-fi\\ui-strings.js.exe")) returned 1
	[0097.997] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\fr-fr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\fr-fr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\fr-fr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\fr-fr\\ui-strings.js.exe")) returned 1
	[0098.003] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\fr-ma\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\fr-ma\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\fr-ma\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\fr-ma\\ui-strings.js.exe")) returned 1
	[0098.008] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\he-il\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\he-il\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\he-il\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\he-il\\ui-strings.js.exe")) returned 1
	[0098.013] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\hr-hr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\hr-hr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\hr-hr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\hr-hr\\ui-strings.js.exe")) returned 1
	[0098.017] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\hu-hu\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\hu-hu\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\hu-hu\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\hu-hu\\ui-strings.js.exe")) returned 1
	[0098.021] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\it-it\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\it-it\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\it-it\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\it-it\\ui-strings.js.exe")) returned 1
	[0098.026] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\ja-jp\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\ja-jp\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\ja-jp\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\ja-jp\\ui-strings.js.exe")) returned 1
	[0098.030] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\ko-kr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\ko-kr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\ko-kr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\ko-kr\\ui-strings.js.exe")) returned 1
	[0098.034] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\nb-no\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\nb-no\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\nb-no\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\nb-no\\ui-strings.js.exe")) returned 1
	[0098.039] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\nl-nl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\nl-nl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\nl-nl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\nl-nl\\ui-strings.js.exe")) returned 1
	[0098.061] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\pl-pl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\pl-pl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\pl-pl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\pl-pl\\ui-strings.js.exe")) returned 1
	[0098.070] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\pt-br\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\pt-br\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\pt-br\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\pt-br\\ui-strings.js.exe")) returned 1
	[0098.075] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\ro-ro\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\ro-ro\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\ro-ro\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\ro-ro\\ui-strings.js.exe")) returned 1
	[0098.079] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\root\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\root\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\root\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\root\\ui-strings.js.exe")) returned 1
	[0098.085] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\ru-ru\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\ru-ru\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\ru-ru\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\ru-ru\\ui-strings.js.exe")) returned 1
	[0098.121] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\sk-sk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\sk-sk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\sk-sk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\sk-sk\\ui-strings.js.exe")) returned 1
	[0098.126] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\sl-si\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\sl-si\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\sl-si\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\sl-si\\ui-strings.js.exe")) returned 1
	[0098.130] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\sl-sl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\sl-sl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\sl-sl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\sl-sl\\ui-strings.js.exe")) returned 1
	[0098.134] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\sv-se\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\sv-se\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\sv-se\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\sv-se\\ui-strings.js.exe")) returned 1
	[0098.137] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\tr-tr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\tr-tr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\tr-tr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\tr-tr\\ui-strings.js.exe")) returned 1
	[0098.142] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\ui-strings.js.exe")) returned 1
	[0098.146] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\uk-ua\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\uk-ua\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\uk-ua\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\uk-ua\\ui-strings.js.exe")) returned 1
	[0098.150] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\zh-cn\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\zh-cn\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\zh-cn\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\zh-cn\\ui-strings.js.exe")) returned 1
	[0098.153] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\zh-tw\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\zh-tw\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\zh-tw\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\nls\\zh-tw\\ui-strings.js.exe")) returned 1
	[0098.198] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\plugin.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\plugin.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\plugin.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\plugin.js.exe")) returned 1
	[0098.202] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\selector.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\selector.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\selector.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\js\\selector.js.exe")) returned 1
	[0098.212] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\ca-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\ca-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\ca-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\ca-es\\ui-strings.js.exe")) returned 1
	[0098.217] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\cs-cz\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\cs-cz\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\cs-cz\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\cs-cz\\ui-strings.js.exe")) returned 1
	[0098.221] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\da-dk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\da-dk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\da-dk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\da-dk\\ui-strings.js.exe")) returned 1
	[0098.228] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\de-de\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\de-de\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\de-de\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\de-de\\ui-strings.js.exe")) returned 1
	[0098.274] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\en-ae\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\en-ae\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\en-ae\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\en-ae\\ui-strings.js.exe")) returned 1
	[0098.280] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\en-gb\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\en-gb\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\en-gb\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\en-gb\\ui-strings.js.exe")) returned 1
	[0098.285] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\en-il\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\en-il\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\en-il\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\en-il\\ui-strings.js.exe")) returned 1
	[0098.288] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\es-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\es-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\es-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\es-es\\ui-strings.js.exe")) returned 1
	[0098.293] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\eu-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\eu-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\eu-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\eu-es\\ui-strings.js.exe")) returned 1
	[0098.298] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\fi-fi\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\fi-fi\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\fi-fi\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\fi-fi\\ui-strings.js.exe")) returned 1
	[0098.302] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\fr-fr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\fr-fr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\fr-fr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\fr-fr\\ui-strings.js.exe")) returned 1
	[0098.307] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\fr-ma\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\fr-ma\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\fr-ma\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\fr-ma\\ui-strings.js.exe")) returned 1
	[0098.311] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\hr-hr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\hr-hr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\hr-hr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\hr-hr\\ui-strings.js.exe")) returned 1
	[0098.356] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\hu-hu\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\hu-hu\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\hu-hu\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\hu-hu\\ui-strings.js.exe")) returned 1
	[0098.361] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\it-it\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\it-it\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\it-it\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\it-it\\ui-strings.js.exe")) returned 1
	[0098.365] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\ja-jp\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\ja-jp\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\ja-jp\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\ja-jp\\ui-strings.js.exe")) returned 1
	[0098.370] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\ko-kr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\ko-kr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\ko-kr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\ko-kr\\ui-strings.js.exe")) returned 1
	[0098.374] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\nb-no\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\nb-no\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\nb-no\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\nb-no\\ui-strings.js.exe")) returned 1
	[0098.378] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\nl-nl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\nl-nl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\nl-nl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\nl-nl\\ui-strings.js.exe")) returned 1
	[0098.382] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\pl-pl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\pl-pl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\pl-pl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\pl-pl\\ui-strings.js.exe")) returned 1
	[0098.387] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\pt-br\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\pt-br\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\pt-br\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\pt-br\\ui-strings.js.exe")) returned 1
	[0098.426] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\ro-ro\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\ro-ro\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\ro-ro\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\ro-ro\\ui-strings.js.exe")) returned 1
	[0098.431] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\root\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\root\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\root\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\root\\ui-strings.js.exe")) returned 1
	[0098.435] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\ru-ru\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\ru-ru\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\ru-ru\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\ru-ru\\ui-strings.js.exe")) returned 1
	[0098.447] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\sk-sk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\sk-sk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\sk-sk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\sk-sk\\ui-strings.js.exe")) returned 1
	[0098.451] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\sl-si\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\sl-si\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\sl-si\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\sl-si\\ui-strings.js.exe")) returned 1
	[0098.456] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\sv-se\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\sv-se\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\sv-se\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\sv-se\\ui-strings.js.exe")) returned 1
	[0098.459] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\tr-tr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\tr-tr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\tr-tr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\tr-tr\\ui-strings.js.exe")) returned 1
	[0098.518] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\ui-strings.js.exe")) returned 1
	[0098.523] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\uk-ua\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\uk-ua\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\uk-ua\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\uk-ua\\ui-strings.js.exe")) returned 1
	[0098.527] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\zh-cn\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\zh-cn\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\zh-cn\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\zh-cn\\ui-strings.js.exe")) returned 1
	[0098.531] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\zh-tw\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\zh-tw\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\zh-tw\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\zh-tw\\ui-strings.js.exe")) returned 1
	[0098.535] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\plugin.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\plugin.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\plugin.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\plugin.js.exe")) returned 1
	[0098.538] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\selector.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\selector.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\selector.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\js\\selector.js.exe")) returned 1
	[0098.548] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\bg_patterns_header.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\bg_patterns_header.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\bg_patterns_header.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\bg_patterns_header.png.exe")) returned 1
	[0098.550] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\bg_pattern_RHP.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\bg_pattern_rhp.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\bg_pattern_RHP.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\bg_pattern_rhp.png.exe")) returned 1
	[0098.553] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\icons.png.exe")) returned 1
	[0098.632] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\icons_ie8.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\icons_ie8.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\icons_ie8.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\icons_ie8.gif.exe")) returned 1
	[0098.636] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\icons_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\icons_retina.png.exe")) returned 1
	[0098.638] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\illustrations.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\illustrations.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\illustrations.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\illustrations.png.exe")) returned 1
	[0098.641] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\illustrations_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\illustrations_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\illustrations_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\illustrations_retina.png.exe")) returned 1
	[0098.644] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\new_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\new_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\new_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\new_icons.png.exe")) returned 1
	[0098.647] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\new_icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\new_icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\new_icons_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\new_icons_retina.png.exe")) returned 1
	[0098.653] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\bg_patterns_header.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\bg_patterns_header.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\bg_patterns_header.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\bg_patterns_header.png.exe")) returned 1
	[0098.655] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\bg_pattern_RHP.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\bg_pattern_rhp.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\bg_pattern_RHP.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\bg_pattern_rhp.png.exe")) returned 1
	[0098.657] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\icons.png.exe")) returned 1
	[0098.660] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\icons_ie8.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\icons_ie8.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\icons_ie8.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\icons_ie8.gif.exe")) returned 1
	[0098.663] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\icons_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\icons_retina.png.exe")) returned 1
	[0098.666] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\illustrations.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\illustrations.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\illustrations.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\illustrations.png.exe")) returned 1
	[0098.710] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\illustrations_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\illustrations_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\illustrations_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\illustrations_retina.png.exe")) returned 1
	[0098.713] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\new_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\new_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\new_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\new_icons.png.exe")) returned 1
	[0098.720] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\new_icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\new_icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\new_icons_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\new_icons_retina.png.exe")) returned 1
	[0098.730] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\ca-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\ca-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\ca-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\ca-es\\ui-strings.js.exe")) returned 1
	[0098.736] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\cs-cz\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\cs-cz\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\cs-cz\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\cs-cz\\ui-strings.js.exe")) returned 1
	[0098.739] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\da-dk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\da-dk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\da-dk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\da-dk\\ui-strings.js.exe")) returned 1
	[0098.743] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\de-de\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\de-de\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\de-de\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\de-de\\ui-strings.js.exe")) returned 1
	[0098.789] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\en-ae\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\en-ae\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\en-ae\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\en-ae\\ui-strings.js.exe")) returned 1
	[0098.794] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\en-gb\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\en-gb\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\en-gb\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\en-gb\\ui-strings.js.exe")) returned 1
	[0098.799] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\en-il\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\en-il\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\en-il\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\en-il\\ui-strings.js.exe")) returned 1
	[0098.803] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\es-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\es-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\es-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\es-es\\ui-strings.js.exe")) returned 1
	[0098.807] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\eu-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\eu-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\eu-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\eu-es\\ui-strings.js.exe")) returned 1
	[0098.812] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\fi-fi\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\fi-fi\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\fi-fi\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\fi-fi\\ui-strings.js.exe")) returned 1
	[0098.817] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\fr-fr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\fr-fr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\fr-fr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\fr-fr\\ui-strings.js.exe")) returned 1
	[0098.821] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\fr-ma\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\fr-ma\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\fr-ma\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\fr-ma\\ui-strings.js.exe")) returned 1
	[0098.929] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\hr-hr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\hr-hr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\hr-hr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\hr-hr\\ui-strings.js.exe")) returned 1
	[0098.945] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\hu-hu\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\hu-hu\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\hu-hu\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\hu-hu\\ui-strings.js.exe")) returned 1
	[0098.950] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\it-it\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\it-it\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\it-it\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\it-it\\ui-strings.js.exe")) returned 1
	[0098.958] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\ja-jp\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\ja-jp\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\ja-jp\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\ja-jp\\ui-strings.js.exe")) returned 1
	[0098.963] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\ko-kr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\ko-kr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\ko-kr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\ko-kr\\ui-strings.js.exe")) returned 1
	[0098.968] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\nb-no\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\nb-no\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\nb-no\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\nb-no\\ui-strings.js.exe")) returned 1
	[0098.973] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\nl-nl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\nl-nl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\nl-nl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\nl-nl\\ui-strings.js.exe")) returned 1
	[0098.982] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\pl-pl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\pl-pl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\pl-pl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\pl-pl\\ui-strings.js.exe")) returned 1
	[0099.009] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\pt-br\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\pt-br\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\pt-br\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\pt-br\\ui-strings.js.exe")) returned 1
	[0099.013] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\ro-ro\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\ro-ro\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\ro-ro\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\ro-ro\\ui-strings.js.exe")) returned 1
	[0099.017] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\root\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\root\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\root\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\root\\ui-strings.js.exe")) returned 1
	[0099.059] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\ru-ru\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\ru-ru\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\ru-ru\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\ru-ru\\ui-strings.js.exe")) returned 1
	[0099.065] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\sk-sk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\sk-sk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\sk-sk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\sk-sk\\ui-strings.js.exe")) returned 1
	[0099.070] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\sl-si\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\sl-si\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\sl-si\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\sl-si\\ui-strings.js.exe")) returned 1
	[0099.074] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\sv-se\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\sv-se\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\sv-se\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\sv-se\\ui-strings.js.exe")) returned 1
	[0099.079] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\tr-tr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\tr-tr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\tr-tr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\tr-tr\\ui-strings.js.exe")) returned 1
	[0099.083] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\ui-strings.js.exe")) returned 1
	[0099.087] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\uk-ua\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\uk-ua\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\uk-ua\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\uk-ua\\ui-strings.js.exe")) returned 1
	[0099.092] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\zh-cn\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\zh-cn\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\zh-cn\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\zh-cn\\ui-strings.js.exe")) returned 1
	[0099.095] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\zh-tw\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\zh-tw\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\zh-tw\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\nls\\zh-tw\\ui-strings.js.exe")) returned 1
	[0099.111] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\plugin.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\plugin.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\plugin.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\plugin.js.exe")) returned 1
	[0099.115] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\selector.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\selector.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\selector.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\js\\selector.js.exe")) returned 1
	[0099.127] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files-select\\js\\plugin.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files-select\\js\\plugin.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files-select\\js\\plugin.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files-select\\js\\plugin.js.exe")) returned 1
	[0099.150] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\ca-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\ca-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\ca-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\ca-es\\ui-strings.js.exe")) returned 1
	[0099.155] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\cs-cz\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\cs-cz\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\cs-cz\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\cs-cz\\ui-strings.js.exe")) returned 1
	[0099.159] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\da-dk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\da-dk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\da-dk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\da-dk\\ui-strings.js.exe")) returned 1
	[0099.163] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\de-de\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\de-de\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\de-de\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\de-de\\ui-strings.js.exe")) returned 1
	[0099.213] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\en-gb\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\en-gb\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\en-gb\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\en-gb\\ui-strings.js.exe")) returned 1
	[0099.221] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\en-il\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\en-il\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\en-il\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\en-il\\ui-strings.js.exe")) returned 1
	[0099.226] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\es-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\es-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\es-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\es-es\\ui-strings.js.exe")) returned 1
	[0099.231] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\eu-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\eu-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\eu-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\eu-es\\ui-strings.js.exe")) returned 1
	[0099.236] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\fi-fi\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\fi-fi\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\fi-fi\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\fi-fi\\ui-strings.js.exe")) returned 1
	[0099.241] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\fr-fr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\fr-fr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\fr-fr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\fr-fr\\ui-strings.js.exe")) returned 1
	[0099.244] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\fr-ma\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\fr-ma\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\fr-ma\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\fr-ma\\ui-strings.js.exe")) returned 1
	[0099.280] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\hr-hr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\hr-hr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\hr-hr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\hr-hr\\ui-strings.js.exe")) returned 1
	[0099.286] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\hu-hu\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\hu-hu\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\hu-hu\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\hu-hu\\ui-strings.js.exe")) returned 1
	[0099.290] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\it-it\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\it-it\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\it-it\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\it-it\\ui-strings.js.exe")) returned 1
	[0099.295] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\ja-jp\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\ja-jp\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\ja-jp\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\ja-jp\\ui-strings.js.exe")) returned 1
	[0099.299] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\ko-kr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\ko-kr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\ko-kr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\ko-kr\\ui-strings.js.exe")) returned 1
	[0099.305] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\nb-no\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\nb-no\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\nb-no\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\nb-no\\ui-strings.js.exe")) returned 1
	[0099.313] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\nl-nl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\nl-nl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\nl-nl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\nl-nl\\ui-strings.js.exe")) returned 1
	[0099.318] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\pl-pl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\pl-pl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\pl-pl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\pl-pl\\ui-strings.js.exe")) returned 1
	[0099.325] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\pt-br\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\pt-br\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\pt-br\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\pt-br\\ui-strings.js.exe")) returned 1
	[0099.330] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\ro-ro\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\ro-ro\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\ro-ro\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\ro-ro\\ui-strings.js.exe")) returned 1
	[0099.334] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\root\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\root\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\root\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\root\\ui-strings.js.exe")) returned 1
	[0099.338] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\ru-ru\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\ru-ru\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\ru-ru\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\ru-ru\\ui-strings.js.exe")) returned 1
	[0099.342] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\sk-sk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\sk-sk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\sk-sk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\sk-sk\\ui-strings.js.exe")) returned 1
	[0099.347] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\sl-si\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\sl-si\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\sl-si\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\sl-si\\ui-strings.js.exe")) returned 1
	[0099.355] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\sv-se\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\sv-se\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\sv-se\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\sv-se\\ui-strings.js.exe")) returned 1
	[0099.362] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\tr-tr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\tr-tr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\tr-tr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\tr-tr\\ui-strings.js.exe")) returned 1
	[0099.373] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\ui-strings.js.exe")) returned 1
	[0099.378] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\uk-ua\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\uk-ua\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\uk-ua\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\uk-ua\\ui-strings.js.exe")) returned 1
	[0099.382] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\zh-cn\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\zh-cn\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\zh-cn\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\zh-cn\\ui-strings.js.exe")) returned 1
	[0099.386] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\zh-tw\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\zh-tw\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\zh-tw\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\zh-tw\\ui-strings.js.exe")) returned 1
	[0099.391] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\plugin.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\plugin.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\plugin.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\plugin.js.exe")) returned 1
	[0099.394] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\selector.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\selector.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\selector.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files\\js\\selector.js.exe")) returned 1
	[0099.406] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files-select\\js\\plugin.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files-select\\js\\plugin.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files-select\\js\\plugin.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-recent-files-select\\js\\plugin.js.exe")) returned 1
	[0099.417] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\combine_poster.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\combine_poster.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\combine_poster.jpg.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\combine_poster.jpg.exe")) returned 1
	[0099.420] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\combine_poster2x.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\combine_poster2x.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\combine_poster2x.jpg.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\combine_poster2x.jpg.exe")) returned 1
	[0099.424] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\compare_poster.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\compare_poster.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\compare_poster.jpg.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\compare_poster.jpg.exe")) returned 1
	[0099.427] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\compare_poster2x.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\compare_poster2x.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\compare_poster2x.jpg.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\compare_poster2x.jpg.exe")) returned 1
	[0099.430] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\edit_pdf_poster.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\edit_pdf_poster.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\edit_pdf_poster.jpg.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\edit_pdf_poster.jpg.exe")) returned 1
	[0099.434] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\edit_pdf_poster2x.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\edit_pdf_poster2x.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\edit_pdf_poster2x.jpg.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\edit_pdf_poster2x.jpg.exe")) returned 1
	[0099.438] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\example_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\example_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\example_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\example_icons.png.exe")) returned 1
	[0099.443] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\example_icons2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\example_icons2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\example_icons2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\example_icons2x.png.exe")) returned 1
	[0099.448] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\optimize_poster.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\optimize_poster.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\optimize_poster.jpg.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\optimize_poster.jpg.exe")) returned 1
	[0099.451] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\optimize_poster2x.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\optimize_poster2x.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\optimize_poster2x.jpg.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\optimize_poster2x.jpg.exe")) returned 1
	[0099.454] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\organize_poster.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\organize_poster.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\organize_poster.jpg.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\organize_poster.jpg.exe")) returned 1
	[0099.480] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\organize_poster2x-dark.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\organize_poster2x-dark.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\organize_poster2x-dark.jpg.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\organize_poster2x-dark.jpg.exe")) returned 1
	[0099.484] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\organize_poster2x.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\organize_poster2x.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\organize_poster2x.jpg.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\organize_poster2x.jpg.exe")) returned 1
	[0099.487] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\protect_poster.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\protect_poster.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\protect_poster.jpg.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\protect_poster.jpg.exe")) returned 1
	[0099.491] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\protect_poster2x.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\protect_poster2x.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\protect_poster2x.jpg.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\protect_poster2x.jpg.exe")) returned 1
	[0099.494] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\redact_poster.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\redact_poster.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\redact_poster.jpg.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\redact_poster.jpg.exe")) returned 1
	[0099.497] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\redact_poster2x.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\redact_poster2x.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\redact_poster2x.jpg.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\redact_poster2x.jpg.exe")) returned 1
	[0099.504] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\scan_poster.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\scan_poster.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\scan_poster.jpg.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\scan_poster.jpg.exe")) returned 1
	[0099.507] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\scan_poster2x.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\scan_poster2x.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\scan_poster2x.jpg.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\scan_poster2x.jpg.exe")) returned 1
	[0099.514] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\combine_poster.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\combine_poster.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\combine_poster.jpg.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\combine_poster.jpg.exe")) returned 1
	[0099.973] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\combine_poster2x.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\combine_poster2x.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\combine_poster2x.jpg.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\combine_poster2x.jpg.exe")) returned 1
	[0099.982] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\compare_poster.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\compare_poster.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\compare_poster.jpg.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\compare_poster.jpg.exe")) returned 1
	[0099.986] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\compare_poster2x.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\compare_poster2x.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\compare_poster2x.jpg.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\compare_poster2x.jpg.exe")) returned 1
	[0099.990] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\edit_pdf_poster.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\edit_pdf_poster.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\edit_pdf_poster.jpg.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\edit_pdf_poster.jpg.exe")) returned 1
	[0099.993] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\edit_pdf_poster2x.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\edit_pdf_poster2x.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\edit_pdf_poster2x.jpg.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\edit_pdf_poster2x.jpg.exe")) returned 1
	[0099.996] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\example_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\example_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\example_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\example_icons.png.exe")) returned 1
	[0099.999] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\example_icons2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\example_icons2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\example_icons2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\example_icons2x.png.exe")) returned 1
	[0100.002] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\optimize_poster.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\optimize_poster.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\optimize_poster.jpg.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\optimize_poster.jpg.exe")) returned 1
	[0100.006] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\optimize_poster2x.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\optimize_poster2x.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\optimize_poster2x.jpg.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\optimize_poster2x.jpg.exe")) returned 1
	[0100.008] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\organize_poster.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\organize_poster.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\organize_poster.jpg.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\organize_poster.jpg.exe")) returned 1
	[0100.012] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\organize_poster2x.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\organize_poster2x.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\organize_poster2x.jpg.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\organize_poster2x.jpg.exe")) returned 1
	[0100.019] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\protect_poster.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\protect_poster.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\protect_poster.jpg.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\protect_poster.jpg.exe")) returned 1
	[0100.022] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\protect_poster2x.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\protect_poster2x.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\protect_poster2x.jpg.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\protect_poster2x.jpg.exe")) returned 1
	[0100.025] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\redact_poster.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\redact_poster.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\redact_poster.jpg.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\redact_poster.jpg.exe")) returned 1
	[0100.028] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\redact_poster2x.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\redact_poster2x.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\redact_poster2x.jpg.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\redact_poster2x.jpg.exe")) returned 1
	[0100.031] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\scan_poster.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\scan_poster.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\scan_poster.jpg.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\scan_poster.jpg.exe")) returned 1
	[0100.035] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\scan_poster2x.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\scan_poster2x.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\scan_poster2x.jpg.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\scan_poster2x.jpg.exe")) returned 1
	[0100.043] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\ca-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\ca-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\ca-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\ca-es\\ui-strings.js.exe")) returned 1
	[0100.048] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\cs-cz\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\cs-cz\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\cs-cz\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\cs-cz\\ui-strings.js.exe")) returned 1
	[0100.065] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\da-dk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\da-dk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\da-dk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\da-dk\\ui-strings.js.exe")) returned 1
	[0100.086] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\de-de\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\de-de\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\de-de\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\de-de\\ui-strings.js.exe")) returned 1
	[0100.091] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\en-gb\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\en-gb\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\en-gb\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\en-gb\\ui-strings.js.exe")) returned 1
	[0100.096] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\es-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\es-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\es-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\es-es\\ui-strings.js.exe")) returned 1
	[0100.100] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\eu-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\eu-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\eu-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\eu-es\\ui-strings.js.exe")) returned 1
	[0100.105] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\fi-fi\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\fi-fi\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\fi-fi\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\fi-fi\\ui-strings.js.exe")) returned 1
	[0100.110] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\fr-fr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\fr-fr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\fr-fr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\fr-fr\\ui-strings.js.exe")) returned 1
	[0100.114] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\fr-ma\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\fr-ma\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\fr-ma\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\fr-ma\\ui-strings.js.exe")) returned 1
	[0100.120] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\hr-hr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\hr-hr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\hr-hr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\hr-hr\\ui-strings.js.exe")) returned 1
	[0100.133] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\hu-hu\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\hu-hu\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\hu-hu\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\hu-hu\\ui-strings.js.exe")) returned 1
	[0100.136] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\it-it\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\it-it\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\it-it\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\it-it\\ui-strings.js.exe")) returned 1
	[0100.141] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\ja-jp\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\ja-jp\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\ja-jp\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\ja-jp\\ui-strings.js.exe")) returned 1
	[0100.148] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\ko-kr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\ko-kr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\ko-kr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\ko-kr\\ui-strings.js.exe")) returned 1
	[0100.154] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\nb-no\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\nb-no\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\nb-no\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\nb-no\\ui-strings.js.exe")) returned 1
	[0100.158] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\nl-nl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\nl-nl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\nl-nl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\nl-nl\\ui-strings.js.exe")) returned 1
	[0100.162] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\pl-pl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\pl-pl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\pl-pl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\pl-pl\\ui-strings.js.exe")) returned 1
	[0100.607] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\pt-br\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\pt-br\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\pt-br\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\pt-br\\ui-strings.js.exe")) returned 1
	[0100.756] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\ro-ro\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\ro-ro\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\ro-ro\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\ro-ro\\ui-strings.js.exe")) returned 1
	[0100.761] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\root\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\root\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\root\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\root\\ui-strings.js.exe")) returned 1
	[0100.767] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\ru-ru\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\ru-ru\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\ru-ru\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\ru-ru\\ui-strings.js.exe")) returned 1
	[0100.808] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\sk-sk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\sk-sk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\sk-sk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\sk-sk\\ui-strings.js.exe")) returned 1
	[0100.813] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\sl-si\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\sl-si\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\sl-si\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\sl-si\\ui-strings.js.exe")) returned 1
	[0100.832] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\sv-se\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\sv-se\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\sv-se\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\sv-se\\ui-strings.js.exe")) returned 1
	[0100.837] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\tr-tr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\tr-tr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\tr-tr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\tr-tr\\ui-strings.js.exe")) returned 1
	[0100.842] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\ui-strings.js.exe")) returned 1
	[0100.846] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\uk-ua\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\uk-ua\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\uk-ua\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\uk-ua\\ui-strings.js.exe")) returned 1
	[0100.850] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\zh-cn\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\zh-cn\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\zh-cn\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\zh-cn\\ui-strings.js.exe")) returned 1
	[0100.855] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\zh-tw\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\zh-tw\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\zh-tw\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\zh-tw\\ui-strings.js.exe")) returned 1
	[0101.111] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\plugin.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\plugin.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\plugin.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\plugin.js.exe")) returned 1
	[0101.116] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\selector.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\selector.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\selector.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\js\\selector.js.exe")) returned 1
	[0101.129] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\activate-more-tools-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\activate-more-tools-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\activate-more-tools-2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\activate-more-tools-2x.png.exe")) returned 1
	[0101.133] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\activate-more-tools.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\activate-more-tools.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\activate-more-tools.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\activate-more-tools.png.exe")) returned 1
	[0101.137] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\add-comment-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\add-comment-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\add-comment-2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\add-comment-2x.png.exe")) returned 1
	[0101.141] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\add-comment.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\add-comment.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\add-comment.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\add-comment.png.exe")) returned 1
	[0101.144] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-dynamic-pdf-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-dynamic-pdf-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-dynamic-pdf-2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-dynamic-pdf-2x.png.exe")) returned 1
	[0101.148] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-dynamic-pdf.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-dynamic-pdf.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-dynamic-pdf.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-dynamic-pdf.png.exe")) returned 1
	[0101.151] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-feedback-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-feedback-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-feedback-2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-feedback-2x.png.exe")) returned 1
	[0101.212] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-feedback.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-feedback.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-feedback.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-feedback.png.exe")) returned 1
	[0101.218] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-getting-started-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-getting-started-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-getting-started-2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-getting-started-2x.png.exe")) returned 1
	[0101.222] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-getting-started.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-getting-started.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-getting-started.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-getting-started.png.exe")) returned 1
	[0101.229] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-mobile-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-mobile-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-mobile-2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-mobile-2x.png.exe")) returned 1
	[0101.232] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-mobile.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-mobile.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-mobile.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-mobile.png.exe")) returned 1
	[0101.237] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\BringContenttoLife-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\bringcontenttolife-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\BringContenttoLife-2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\bringcontenttolife-2x.png.exe")) returned 1
	[0101.245] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\BringContenttoLife.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\bringcontenttolife.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\BringContenttoLife.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\bringcontenttolife.png.exe")) returned 1
	[0101.249] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\chrome-ext-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\chrome-ext-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\chrome-ext-2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\chrome-ext-2x.png.exe")) returned 1
	[0101.253] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\chrome-ext.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\chrome-ext.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\chrome-ext.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\chrome-ext.png.exe")) returned 1
	[0101.330] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\close.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\close.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\close.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\close.png.exe")) returned 1
	[0101.335] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\combine-files-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\combine-files-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\combine-files-2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\combine-files-2x.png.exe")) returned 1
	[0101.339] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\combine-files.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\combine-files.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\combine-files.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\combine-files.png.exe")) returned 1
	[0101.343] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\compare-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\compare-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\compare-2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\compare-2x.png.exe")) returned 1
	[0101.346] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\compare.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\compare.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\compare.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\compare.png.exe")) returned 1
	[0101.351] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\digsig-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\digsig-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\digsig-2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\digsig-2x.png.exe")) returned 1
	[0101.354] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\digsig.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\digsig.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\digsig.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\digsig.png.exe")) returned 1
	[0101.358] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\edit-pdf-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\edit-pdf-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\edit-pdf-2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\edit-pdf-2x.png.exe")) returned 1
	[0101.361] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\edit-pdf.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\edit-pdf.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\edit-pdf.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\edit-pdf.png.exe")) returned 1
	[0101.462] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\editvideoimage.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\editvideoimage.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\editvideoimage.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\editvideoimage.png.exe")) returned 1
	[0101.468] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\error-icon.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\error-icon.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\error-icon.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\error-icon.png.exe")) returned 1
	[0101.472] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\fill-sign-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\fill-sign-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\fill-sign-2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\fill-sign-2x.png.exe")) returned 1
	[0101.475] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\fill-sign.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\fill-sign.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\fill-sign.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\fill-sign.png.exe")) returned 1
	[0101.507] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\find-text-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\find-text-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\find-text-2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\find-text-2x.png.exe")) returned 1
	[0101.511] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\find-text.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\find-text.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\find-text.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\find-text.png.exe")) returned 1
	[0101.515] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\flags.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\flags.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\flags.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\flags.png.exe")) returned 1
	[0101.521] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\flags@2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\flags@2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\flags@2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\flags@2x.png.exe")) returned 1
	[0101.526] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\get-e-signatures-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\get-e-signatures-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\get-e-signatures-2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\get-e-signatures-2x.png.exe")) returned 1
	[0101.529] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\get-e-signatures.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\get-e-signatures.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\get-e-signatures.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\get-e-signatures.png.exe")) returned 1
	[0101.532] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\Getmobile-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\getmobile-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\Getmobile-2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\getmobile-2x.png.exe")) returned 1
	[0101.535] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\GetMobile.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\getmobile.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\GetMobile.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\getmobile.png.exe")) returned 1
	[0101.540] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\go-mobile-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\go-mobile-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\go-mobile-2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\go-mobile-2x.png.exe")) returned 1
	[0101.543] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\go-mobile.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\go-mobile.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\go-mobile.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\go-mobile.png.exe")) returned 1
	[0101.596] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\improved-office-to-pdf-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\improved-office-to-pdf-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\improved-office-to-pdf-2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\improved-office-to-pdf-2x.png.exe")) returned 1
	[0101.600] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\improved-office-to-pdf.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\improved-office-to-pdf.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\improved-office-to-pdf.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\improved-office-to-pdf.png.exe")) returned 1
	[0101.604] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\lets-get-started-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\lets-get-started-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\lets-get-started-2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\lets-get-started-2x.png.exe")) returned 1
	[0101.607] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\lets-get-started.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\lets-get-started.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\lets-get-started.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\lets-get-started.png.exe")) returned 1
	[0101.732] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\multi-tab-file-view-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\multi-tab-file-view-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\multi-tab-file-view-2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\multi-tab-file-view-2x.png.exe")) returned 1
	[0101.736] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\multi-tab-file-view.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\multi-tab-file-view.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\multi-tab-file-view.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\multi-tab-file-view.png.exe")) returned 1
	[0101.740] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\organize-pages-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\organize-pages-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\organize-pages-2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\organize-pages-2x.png.exe")) returned 1
	[0101.743] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\organize-pages.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\organize-pages.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\organize-pages.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\organize-pages.png.exe")) returned 1
	[0101.750] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-no-text-2x.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-no-text-2x.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-no-text-2x.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-no-text-2x.gif.exe")) returned 1
	[0101.756] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-no-text.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-no-text.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-no-text.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-no-text.gif.exe")) returned 1
	[0101.763] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-de_de.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-de_de.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-de_de.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-de_de.gif.exe")) returned 1
	[0101.785] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-de_de_2x.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-de_de_2x.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-de_de_2x.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-de_de_2x.gif.exe")) returned 1
	[0101.793] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-en_us.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-en_us.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-en_us.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-en_us.gif.exe")) returned 1
	[0101.805] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-en_us_2x.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-en_us_2x.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-en_us_2x.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-en_us_2x.gif.exe")) returned 1
	[0101.813] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-es_es.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-es_es.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-es_es.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-es_es.gif.exe")) returned 1
	[0101.964] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-es_es_2x.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-es_es_2x.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-es_es_2x.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-es_es_2x.gif.exe")) returned 1
	[0101.976] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-fr_fr.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-fr_fr.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-fr_fr.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-fr_fr.gif.exe")) returned 1
	[0102.009] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-fr_fr_2x.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-fr_fr_2x.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-fr_fr_2x.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-fr_fr_2x.gif.exe")) returned 1
	[0102.017] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-ja_jp.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-ja_jp.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-ja_jp.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-ja_jp.gif.exe")) returned 1
	[0102.031] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-ja_jp_2x.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-ja_jp_2x.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-ja_jp_2x.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-ja_jp_2x.gif.exe")) returned 1
	[0102.117] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-variant2-2x.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-variant2-2x.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-variant2-2x.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-variant2-2x.gif.exe")) returned 1
	[0102.143] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-variant2.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-variant2.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-variant2.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-variant2.gif.exe")) returned 1
	[0102.238] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\PDFInWord-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdfinword-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\PDFInWord-2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdfinword-2x.png.exe")) returned 1
	[0102.277] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\PDFInWord.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdfinword.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\PDFInWord.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdfinword.png.exe")) returned 1
	[0102.280] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\reduced_mode-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\reduced_mode-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\reduced_mode-2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\reduced_mode-2x.png.exe")) returned 1
	[0102.283] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\reduced_mode.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\reduced_mode.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\reduced_mode.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\reduced_mode.png.exe")) returned 1
	[0102.288] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\scan-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\scan-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\scan-2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\scan-2x.png.exe")) returned 1
	[0102.292] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\scan.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\scan.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\scan.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\scan.png.exe")) returned 1
	[0102.295] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\ShareFeedback-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\sharefeedback-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\ShareFeedback-2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\sharefeedback-2x.png.exe")) returned 1
	[0102.300] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\ShareFeedback.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\sharefeedback.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\ShareFeedback.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\sharefeedback.png.exe")) returned 1
	[0102.304] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\sign-in-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\sign-in-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\sign-in-2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\sign-in-2x.png.exe")) returned 1
	[0102.307] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\sign-in.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\sign-in.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\sign-in.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\sign-in.png.exe")) returned 1
	[0102.310] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\theme-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\theme-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\theme-2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\theme-2x.png.exe")) returned 1
	[0102.316] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\theme.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\theme.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\theme.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\theme.png.exe")) returned 1
	[0102.548] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\tool-search-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\tool-search-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\tool-search-2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\tool-search-2x.png.exe")) returned 1
	[0102.552] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\tool-search.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\tool-search.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\tool-search.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\tool-search.png.exe")) returned 1
	[0102.558] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\upsell-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\upsell-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\upsell-2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\upsell-2x.png.exe")) returned 1
	[0102.564] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\upsell.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\upsell.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\upsell.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\upsell.png.exe")) returned 1
	[0102.571] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\welcome-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\welcome-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\welcome-2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\welcome-2x.png.exe")) returned 1
	[0102.574] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\welcome.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\welcome.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\welcome.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\welcome.png.exe")) returned 1
	[0102.579] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\WordContent-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\wordcontent-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\WordContent-2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\wordcontent-2x.png.exe")) returned 1
	[0102.582] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\WordContent.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\wordcontent.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\WordContent.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\wordcontent.png.exe")) returned 1
	[0102.589] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\WorkBetter-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\workbetter-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\WorkBetter-2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\workbetter-2x.png.exe")) returned 1
	[0102.592] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\WorkBetter.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\workbetter.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\WorkBetter.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\workbetter.png.exe")) returned 1
	[0102.649] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\ca-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\ca-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\ca-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\ca-es\\ui-strings.js.exe")) returned 1
	[0102.656] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\cs-cz\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\cs-cz\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\cs-cz\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\cs-cz\\ui-strings.js.exe")) returned 1
	[0102.661] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\da-dk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\da-dk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\da-dk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\da-dk\\ui-strings.js.exe")) returned 1
	[0102.670] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\de-de\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\de-de\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\de-de\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\de-de\\ui-strings.js.exe")) returned 1
	[0102.676] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\en-ae\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\en-ae\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\en-ae\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\en-ae\\ui-strings.js.exe")) returned 1
	[0102.681] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\en-gb\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\en-gb\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\en-gb\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\en-gb\\ui-strings.js.exe")) returned 1
	[0102.687] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\en-il\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\en-il\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\en-il\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\en-il\\ui-strings.js.exe")) returned 1
	[0102.694] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\es-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\es-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\es-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\es-es\\ui-strings.js.exe")) returned 1
	[0102.699] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\eu-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\eu-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\eu-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\eu-es\\ui-strings.js.exe")) returned 1
	[0102.704] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\fi-fi\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\fi-fi\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\fi-fi\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\fi-fi\\ui-strings.js.exe")) returned 1
	[0102.710] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\fr-fr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\fr-fr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\fr-fr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\fr-fr\\ui-strings.js.exe")) returned 1
	[0102.716] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\fr-ma\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\fr-ma\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\fr-ma\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\fr-ma\\ui-strings.js.exe")) returned 1
	[0102.723] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\hr-hr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\hr-hr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\hr-hr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\hr-hr\\ui-strings.js.exe")) returned 1
	[0102.728] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\hu-hu\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\hu-hu\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\hu-hu\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\hu-hu\\ui-strings.js.exe")) returned 1
	[0102.733] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\it-it\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\it-it\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\it-it\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\it-it\\ui-strings.js.exe")) returned 1
	[0102.743] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\ja-jp\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\ja-jp\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\ja-jp\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\ja-jp\\ui-strings.js.exe")) returned 1
	[0102.748] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\ko-kr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\ko-kr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\ko-kr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\ko-kr\\ui-strings.js.exe")) returned 1
	[0102.754] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\nb-no\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\nb-no\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\nb-no\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\nb-no\\ui-strings.js.exe")) returned 1
	[0102.759] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\nl-nl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\nl-nl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\nl-nl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\nl-nl\\ui-strings.js.exe")) returned 1
	[0102.763] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\pl-pl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\pl-pl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\pl-pl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\pl-pl\\ui-strings.js.exe")) returned 1
	[0102.768] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\pt-br\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\pt-br\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\pt-br\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\pt-br\\ui-strings.js.exe")) returned 1
	[0102.773] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\ro-ro\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\ro-ro\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\ro-ro\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\ro-ro\\ui-strings.js.exe")) returned 1
	[0102.777] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\root\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\root\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\root\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\root\\ui-strings.js.exe")) returned 1
	[0102.819] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\ru-ru\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\ru-ru\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\ru-ru\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\ru-ru\\ui-strings.js.exe")) returned 1
	[0102.824] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\sk-sk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\sk-sk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\sk-sk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\sk-sk\\ui-strings.js.exe")) returned 1
	[0102.830] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\sl-si\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\sl-si\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\sl-si\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\sl-si\\ui-strings.js.exe")) returned 1
	[0102.836] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\sv-se\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\sv-se\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\sv-se\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\sv-se\\ui-strings.js.exe")) returned 1
	[0102.841] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\tr-tr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\tr-tr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\tr-tr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\tr-tr\\ui-strings.js.exe")) returned 1
	[0102.845] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\ui-strings.js.exe")) returned 1
	[0102.849] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\uk-ua\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\uk-ua\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\uk-ua\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\uk-ua\\ui-strings.js.exe")) returned 1
	[0102.855] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\zh-cn\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\zh-cn\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\zh-cn\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\zh-cn\\ui-strings.js.exe")) returned 1
	[0102.861] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\zh-tw\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\zh-tw\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\zh-tw\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\zh-tw\\ui-strings.js.exe")) returned 1
	[0102.870] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\plugin.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\plugin.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\plugin.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\plugin.js.exe")) returned 1
	[0102.874] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\selector.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\selector.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\selector.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\js\\selector.js.exe")) returned 1
	[0102.913] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\example_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\example_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\example_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\example_icons.png.exe")) returned 1
	[0102.917] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\example_icons2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\example_icons2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\example_icons2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\example_icons2x.png.exe")) returned 1
	[0102.919] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\rhp_world_icon.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\rhp_world_icon.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\rhp_world_icon.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\rhp_world_icon.png.exe")) returned 1
	[0102.922] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\rhp_world_icon_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\rhp_world_icon_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\rhp_world_icon_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\rhp_world_icon_2x.png.exe")) returned 1
	[0102.925] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\rhp_world_icon_hover.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\rhp_world_icon_hover.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\rhp_world_icon_hover.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\rhp_world_icon_hover.png.exe")) returned 1
	[0102.936] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\rhp_world_icon_hover_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\rhp_world_icon_hover_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\rhp_world_icon_hover_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\rhp_world_icon_hover_2x.png.exe")) returned 1
	[0102.945] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\example_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\example_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\example_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\example_icons.png.exe")) returned 1
	[0102.948] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\example_icons2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\example_icons2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\example_icons2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\example_icons2x.png.exe")) returned 1
	[0102.951] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\rhp_world_icon.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\rhp_world_icon.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\rhp_world_icon.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\rhp_world_icon.png.exe")) returned 1
	[0102.953] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\rhp_world_icon_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\rhp_world_icon_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\rhp_world_icon_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\rhp_world_icon_2x.png.exe")) returned 1
	[0102.955] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\rhp_world_icon_hover.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\rhp_world_icon_hover.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\rhp_world_icon_hover.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\rhp_world_icon_hover.png.exe")) returned 1
	[0102.958] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\rhp_world_icon_hover_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\rhp_world_icon_hover_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.exe")) returned 1
	[0102.969] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\da-dk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\js\\nls\\da-dk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\da-dk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\js\\nls\\da-dk\\ui-strings.js.exe")) returned 1
	[0102.978] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\de-de\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\js\\nls\\de-de\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\de-de\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\js\\nls\\de-de\\ui-strings.js.exe")) returned 1
	[0102.983] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\es-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\js\\nls\\es-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\es-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\js\\nls\\es-es\\ui-strings.js.exe")) returned 1
	[0102.988] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\fi-fi\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\js\\nls\\fi-fi\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\fi-fi\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\js\\nls\\fi-fi\\ui-strings.js.exe")) returned 1
	[0102.993] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\fr-fr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\js\\nls\\fr-fr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\fr-fr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\js\\nls\\fr-fr\\ui-strings.js.exe")) returned 1
	[0103.007] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\it-it\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\js\\nls\\it-it\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\it-it\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\js\\nls\\it-it\\ui-strings.js.exe")) returned 1
	[0103.024] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\ja-jp\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\js\\nls\\ja-jp\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\ja-jp\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\js\\nls\\ja-jp\\ui-strings.js.exe")) returned 1
	[0103.029] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\nb-no\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\js\\nls\\nb-no\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\nb-no\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\js\\nls\\nb-no\\ui-strings.js.exe")) returned 1
	[0103.034] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\nl-nl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\js\\nls\\nl-nl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\nl-nl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\js\\nls\\nl-nl\\ui-strings.js.exe")) returned 1
	[0103.042] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\pt-br\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\js\\nls\\pt-br\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\pt-br\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\js\\nls\\pt-br\\ui-strings.js.exe")) returned 1
	[0103.046] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\root\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\js\\nls\\root\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\root\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\js\\nls\\root\\ui-strings.js.exe")) returned 1
	[0103.053] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\sv-se\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\js\\nls\\sv-se\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\sv-se\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\js\\nls\\sv-se\\ui-strings.js.exe")) returned 1
	[0103.057] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\js\\nls\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\js\\nls\\ui-strings.js.exe")) returned 1
	[0103.061] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\plugin.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\js\\plugin.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\plugin.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\js\\plugin.js.exe")) returned 1
	[0103.087] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\plugins\\rhp\\pages-app-selector.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\js\\plugins\\rhp\\pages-app-selector.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\plugins\\rhp\\pages-app-selector.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\js\\plugins\\rhp\\pages-app-selector.js.exe")) returned 1
	[0103.092] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\plugins\\rhp\\pages-app-tool-view.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\js\\plugins\\rhp\\pages-app-tool-view.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\plugins\\rhp\\pages-app-tool-view.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\js\\plugins\\rhp\\pages-app-tool-view.js.exe")) returned 1
	[0103.105] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\assets\\Sample Files\\Adobe Sign White Paper.pdf" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\assets\\sample files\\adobe sign white paper.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\assets\\Sample Files\\Adobe Sign White Paper.pdf.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\assets\\sample files\\adobe sign white paper.pdf.exe")) returned 1
	[0103.110] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\assets\\Sample Files\\Document Cloud for Government.pdf" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\assets\\sample files\\document cloud for government.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\assets\\Sample Files\\Document Cloud for Government.pdf.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\assets\\sample files\\document cloud for government.pdf.exe")) returned 1
	[0103.116] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\assets\\Sample Files\\Travelocity.pdf" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\assets\\sample files\\travelocity.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\assets\\Sample Files\\Travelocity.pdf.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\assets\\sample files\\travelocity.pdf.exe")) returned 1
	[0103.127] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\ca-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\ca-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\ca-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\ca-es\\ui-strings.js.exe")) returned 1
	[0103.175] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\cs-cz\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\cs-cz\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\cs-cz\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\cs-cz\\ui-strings.js.exe")) returned 1
	[0103.180] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\da-dk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\da-dk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\da-dk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\da-dk\\ui-strings.js.exe")) returned 1
	[0103.188] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\de-de\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\de-de\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\de-de\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\de-de\\ui-strings.js.exe")) returned 1
	[0103.196] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\en-ae\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\en-ae\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\en-ae\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\en-ae\\ui-strings.js.exe")) returned 1
	[0103.207] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\en-il\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\en-il\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\en-il\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\en-il\\ui-strings.js.exe")) returned 1
	[0103.212] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\es-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\es-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\es-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\es-es\\ui-strings.js.exe")) returned 1
	[0103.216] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\eu-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\eu-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\eu-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\eu-es\\ui-strings.js.exe")) returned 1
	[0103.223] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\fi-fi\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\fi-fi\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\fi-fi\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\fi-fi\\ui-strings.js.exe")) returned 1
	[0103.369] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\fr-fr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\fr-fr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\fr-fr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\fr-fr\\ui-strings.js.exe")) returned 1
	[0103.376] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\fr-ma\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\fr-ma\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\fr-ma\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\fr-ma\\ui-strings.js.exe")) returned 1
	[0103.381] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\hr-hr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\hr-hr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\hr-hr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\hr-hr\\ui-strings.js.exe")) returned 1
	[0103.390] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\hu-hu\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\hu-hu\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\hu-hu\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\hu-hu\\ui-strings.js.exe")) returned 1
	[0103.395] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\it-it\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\it-it\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\it-it\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\it-it\\ui-strings.js.exe")) returned 1
	[0103.399] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\ja-jp\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\ja-jp\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\ja-jp\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\ja-jp\\ui-strings.js.exe")) returned 1
	[0103.404] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\ko-kr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\ko-kr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\ko-kr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\ko-kr\\ui-strings.js.exe")) returned 1
	[0103.409] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\nb-no\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\nb-no\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\nb-no\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\nb-no\\ui-strings.js.exe")) returned 1
	[0103.462] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\nl-nl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\nl-nl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\nl-nl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\nl-nl\\ui-strings.js.exe")) returned 1
	[0103.468] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\pl-pl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\pl-pl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\pl-pl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\pl-pl\\ui-strings.js.exe")) returned 1
	[0103.495] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\pt-br\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\pt-br\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\pt-br\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\pt-br\\ui-strings.js.exe")) returned 1
	[0103.593] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\ro-ro\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\ro-ro\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\ro-ro\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\ro-ro\\ui-strings.js.exe")) returned 1
	[0103.599] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\root\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\root\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\root\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\root\\ui-strings.js.exe")) returned 1
	[0103.605] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\ru-ru\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\ru-ru\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\ru-ru\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\ru-ru\\ui-strings.js.exe")) returned 1
	[0103.610] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\sk-sk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\sk-sk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\sk-sk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\sk-sk\\ui-strings.js.exe")) returned 1
	[0103.616] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\sl-si\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\sl-si\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\sl-si\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\sl-si\\ui-strings.js.exe")) returned 1
	[0103.622] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\sv-se\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\sv-se\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\sv-se\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\sv-se\\ui-strings.js.exe")) returned 1
	[0103.627] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\tr-tr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\tr-tr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\tr-tr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\tr-tr\\ui-strings.js.exe")) returned 1
	[0103.631] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\ui-strings.js.exe")) returned 1
	[0103.653] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\uk-ua\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\uk-ua\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\uk-ua\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\uk-ua\\ui-strings.js.exe")) returned 1
	[0103.659] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\zh-cn\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\zh-cn\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\zh-cn\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\zh-cn\\ui-strings.js.exe")) returned 1
	[0103.665] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\zh-tw\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\zh-tw\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\zh-tw\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\nls\\zh-tw\\ui-strings.js.exe")) returned 1
	[0103.669] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\plugin.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\plugin.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\plugin.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\plugin.js.exe")) returned 1
	[0103.674] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\selector.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\selector.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\selector.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\js\\selector.js.exe")) returned 1
	[0103.982] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\appstore.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\appstore.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\appstore.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\appstore.png.exe")) returned 1
	[0103.987] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\flags.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\flags.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\flags.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\flags.png.exe")) returned 1
	[0103.996] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\flags@2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\flags@2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\flags@2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\flags@2x.png.exe")) returned 1
	[0104.193] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\playstore.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\playstore.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\playstore.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\playstore.png.exe")) returned 1
	[0104.197] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\scanAppLogo.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\scanapplogo.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\scanAppLogo.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\scanapplogo.png.exe")) returned 1
	[0104.201] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\scanAppLogo@2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\scanapplogo@2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\scanAppLogo@2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\scanapplogo@2x.png.exe")) returned 1
	[0104.208] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\ca-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\ca-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\ca-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\ca-es\\ui-strings.js.exe")) returned 1
	[0104.213] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\cs-cz\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\cs-cz\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\cs-cz\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\cs-cz\\ui-strings.js.exe")) returned 1
	[0104.217] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\da-dk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\da-dk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\da-dk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\da-dk\\ui-strings.js.exe")) returned 1
	[0104.221] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\de-de\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\de-de\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\de-de\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\de-de\\ui-strings.js.exe")) returned 1
	[0104.226] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\es-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\es-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\es-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\es-es\\ui-strings.js.exe")) returned 1
	[0104.265] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\eu-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\eu-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\eu-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\eu-es\\ui-strings.js.exe")) returned 1
	[0104.271] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\fi-fi\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\fi-fi\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\fi-fi\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\fi-fi\\ui-strings.js.exe")) returned 1
	[0104.280] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\fr-fr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\fr-fr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\fr-fr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\fr-fr\\ui-strings.js.exe")) returned 1
	[0104.285] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\fr-ma\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\fr-ma\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\fr-ma\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\fr-ma\\ui-strings.js.exe")) returned 1
	[0104.290] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\hr-hr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\hr-hr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\hr-hr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\hr-hr\\ui-strings.js.exe")) returned 1
	[0104.295] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\hu-hu\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\hu-hu\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\hu-hu\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\hu-hu\\ui-strings.js.exe")) returned 1
	[0104.299] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\it-it\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\it-it\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\it-it\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\it-it\\ui-strings.js.exe")) returned 1
	[0104.303] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\ja-jp\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\ja-jp\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\ja-jp\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\ja-jp\\ui-strings.js.exe")) returned 1
	[0104.313] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\ko-kr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\ko-kr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\ko-kr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\ko-kr\\ui-strings.js.exe")) returned 1
	[0104.318] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\nb-no\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\nb-no\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\nb-no\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\nb-no\\ui-strings.js.exe")) returned 1
	[0104.365] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\nl-nl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\nl-nl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\nl-nl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\nl-nl\\ui-strings.js.exe")) returned 1
	[0104.372] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\pl-pl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\pl-pl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\pl-pl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\pl-pl\\ui-strings.js.exe")) returned 1
	[0104.376] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\pt-br\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\pt-br\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\pt-br\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\pt-br\\ui-strings.js.exe")) returned 1
	[0104.380] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\ro-ro\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\ro-ro\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\ro-ro\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\ro-ro\\ui-strings.js.exe")) returned 1
	[0104.385] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\root\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\root\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\root\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\root\\ui-strings.js.exe")) returned 1
	[0104.457] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\ru-ru\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\ru-ru\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\ru-ru\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\ru-ru\\ui-strings.js.exe")) returned 1
	[0104.463] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\sk-sk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\sk-sk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\sk-sk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\sk-sk\\ui-strings.js.exe")) returned 1
	[0104.467] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\sl-si\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\sl-si\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\sl-si\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\sl-si\\ui-strings.js.exe")) returned 1
	[0104.472] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\sv-se\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\sv-se\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\sv-se\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\sv-se\\ui-strings.js.exe")) returned 1
	[0104.477] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\tr-tr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\tr-tr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\tr-tr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\tr-tr\\ui-strings.js.exe")) returned 1
	[0104.481] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\ui-strings.js.exe")) returned 1
	[0104.485] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\uk-ua\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\uk-ua\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\uk-ua\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\uk-ua\\ui-strings.js.exe")) returned 1
	[0104.490] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\zh-cn\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\zh-cn\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\zh-cn\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\zh-cn\\ui-strings.js.exe")) returned 1
	[0104.601] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\zh-tw\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\zh-tw\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\zh-tw\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\nls\\zh-tw\\ui-strings.js.exe")) returned 1
	[0104.612] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\plugin.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\plugin.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\plugin.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\plugin.js.exe")) returned 1
	[0104.615] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\selector.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\selector.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\selector.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\js\\selector.js.exe")) returned 1
	[0104.626] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\cloud_secured.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\cloud_secured.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\cloud_secured.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\cloud_secured.png.exe")) returned 1
	[0104.630] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\cloud_secured_lg.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\cloud_secured_lg.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\cloud_secured_lg.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\cloud_secured_lg.png.exe")) returned 1
	[0104.633] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\core_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\core_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\core_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\core_icons.png.exe")) returned 1
	[0104.636] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\faf_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\faf_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\faf_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\faf_icons.png.exe")) returned 1
	[0104.639] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\progress.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\progress.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\progress.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\progress.gif.exe")) returned 1
	[0104.667] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\cloud_secured.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\cloud_secured.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\cloud_secured.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\cloud_secured.png.exe")) returned 1
	[0104.670] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\cloud_secured_lg.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\cloud_secured_lg.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\cloud_secured_lg.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\cloud_secured_lg.png.exe")) returned 1
	[0104.673] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\core_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\core_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\core_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\core_icons.png.exe")) returned 1
	[0104.676] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\faf_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\faf_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\faf_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\faf_icons.png.exe")) returned 1
	[0104.679] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\progress.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\progress.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\progress.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\progress.gif.exe")) returned 1
	[0104.687] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\ar-ae\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\ar-ae\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\ar-ae\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\ar-ae\\ui-strings.js.exe")) returned 1
	[0104.693] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\ca-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\ca-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\ca-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\ca-es\\ui-strings.js.exe")) returned 1
	[0104.752] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\cs-cz\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\cs-cz\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\cs-cz\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\cs-cz\\ui-strings.js.exe")) returned 1
	[0104.758] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\da-dk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\da-dk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\da-dk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\da-dk\\ui-strings.js.exe")) returned 1
	[0104.762] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\de-de\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\de-de\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\de-de\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\de-de\\ui-strings.js.exe")) returned 1
	[0104.767] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\en-ae\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\en-ae\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\en-ae\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\en-ae\\ui-strings.js.exe")) returned 1
	[0104.775] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\en-gb\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\en-gb\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\en-gb\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\en-gb\\ui-strings.js.exe")) returned 1
	[0104.780] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\en-il\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\en-il\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\en-il\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\en-il\\ui-strings.js.exe")) returned 1
	[0104.785] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\es-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\es-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\es-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\es-es\\ui-strings.js.exe")) returned 1
	[0104.795] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\eu-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\eu-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\eu-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\eu-es\\ui-strings.js.exe")) returned 1
	[0104.803] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\fi-fi\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\fi-fi\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\fi-fi\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\fi-fi\\ui-strings.js.exe")) returned 1
	[0104.808] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\fr-fr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\fr-fr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\fr-fr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\fr-fr\\ui-strings.js.exe")) returned 1
	[0104.812] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\fr-ma\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\fr-ma\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\fr-ma\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\fr-ma\\ui-strings.js.exe")) returned 1
	[0104.819] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\he-il\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\he-il\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\he-il\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\he-il\\ui-strings.js.exe")) returned 1
	[0104.824] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\hr-hr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\hr-hr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\hr-hr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\hr-hr\\ui-strings.js.exe")) returned 1
	[0104.830] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\hu-hu\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\hu-hu\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\hu-hu\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\hu-hu\\ui-strings.js.exe")) returned 1
	[0104.834] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\it-it\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\it-it\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\it-it\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\it-it\\ui-strings.js.exe")) returned 1
	[0104.867] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\ja-jp\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\ja-jp\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\ja-jp\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\ja-jp\\ui-strings.js.exe")) returned 1
	[0104.874] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\ko-kr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\ko-kr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\ko-kr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\ko-kr\\ui-strings.js.exe")) returned 1
	[0104.879] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\nb-no\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\nb-no\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\nb-no\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\nb-no\\ui-strings.js.exe")) returned 1
	[0104.882] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\nl-nl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\nl-nl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\nl-nl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\nl-nl\\ui-strings.js.exe")) returned 1
	[0104.887] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\pl-pl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\pl-pl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\pl-pl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\pl-pl\\ui-strings.js.exe")) returned 1
	[0105.190] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\pt-br\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\pt-br\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\pt-br\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\pt-br\\ui-strings.js.exe")) returned 1
	[0105.343] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\ro-ro\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\ro-ro\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\ro-ro\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\ro-ro\\ui-strings.js.exe")) returned 1
	[0105.348] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\root\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\root\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\root\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\root\\ui-strings.js.exe")) returned 1
	[0105.373] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\ru-ru\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\ru-ru\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\ru-ru\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\ru-ru\\ui-strings.js.exe")) returned 1
	[0105.379] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\sk-sk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\sk-sk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\sk-sk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\sk-sk\\ui-strings.js.exe")) returned 1
	[0105.473] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\sl-si\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\sl-si\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\sl-si\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\sl-si\\ui-strings.js.exe")) returned 1
	[0105.508] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\sl-sl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\sl-sl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\sl-sl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\sl-sl\\ui-strings.js.exe")) returned 1
	[0105.525] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\sv-se\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\sv-se\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\sv-se\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\sv-se\\ui-strings.js.exe")) returned 1
	[0105.531] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\tr-tr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\tr-tr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\tr-tr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\tr-tr\\ui-strings.js.exe")) returned 1
	[0105.537] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\ui-strings.js.exe")) returned 1
	[0105.603] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\uk-ua\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\uk-ua\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\uk-ua\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\uk-ua\\ui-strings.js.exe")) returned 1
	[0105.630] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\zh-cn\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\zh-cn\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\zh-cn\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\zh-cn\\ui-strings.js.exe")) returned 1
	[0105.684] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\zh-tw\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\zh-tw\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\zh-tw\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\zh-tw\\ui-strings.js.exe")) returned 1
	[0105.691] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\plugin.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\plugin.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\plugin.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\plugin.js.exe")) returned 1
	[0105.694] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\selector.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\selector.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\selector.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\js\\selector.js.exe")) returned 1
	[0105.703] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\adc_logo.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\adc_logo.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\adc_logo.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\adc_logo.png.exe")) returned 1
	[0105.754] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\adobe_spinner.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\adobe_spinner.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\adobe_spinner.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\adobe_spinner.gif.exe")) returned 1
	[0105.759] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\core_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\core_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\core_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\core_icons.png.exe")) returned 1
	[0105.779] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\core_icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\core_icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\core_icons_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\core_icons_retina.png.exe")) returned 1
	[0105.783] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\download-btn.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\download-btn.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\download-btn.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\download-btn.png.exe")) returned 1
	[0105.789] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\email\\adc_logo.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\email\\adc_logo.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\email\\adc_logo.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\email\\adc_logo.png.exe")) returned 1
	[0105.795] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\email\\adobe_logo.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\email\\adobe_logo.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\email\\adobe_logo.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\email\\adobe_logo.png.exe")) returned 1
	[0105.798] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\email\\dc_logo.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\email\\dc_logo.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\email\\dc_logo.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\email\\dc_logo.png.exe")) returned 1
	[0105.803] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\email\\dummy\\adobe-old-logo.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\email\\dummy\\adobe-old-logo.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\email\\dummy\\adobe-old-logo.jpg.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\email\\dummy\\adobe-old-logo.jpg.exe")) returned 1
	[0105.807] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\email\\dummy\\fake_logo.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\email\\dummy\\fake_logo.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\email\\dummy\\fake_logo.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\email\\dummy\\fake_logo.png.exe")) returned 1
	[0105.809] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\email\\empty.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\email\\empty.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\email\\empty.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\email\\empty.png.exe")) returned 1
	[0105.813] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\email\\themes\\dark\\adc_logo.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\email\\themes\\dark\\adc_logo.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\email\\themes\\dark\\adc_logo.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\email\\themes\\dark\\adc_logo.png.exe")) returned 1
	[0105.824] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\email\\themes\\dark\\adobe_logo.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\email\\themes\\dark\\adobe_logo.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\email\\themes\\dark\\adobe_logo.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\email\\themes\\dark\\adobe_logo.png.exe")) returned 1
	[0105.826] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\file_info.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\file_info.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\file_info.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\file_info.png.exe")) returned 1
	[0105.830] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\file_info2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\file_info2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\file_info2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\file_info2x.png.exe")) returned 1
	[0105.833] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\illustrations.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\illustrations.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\illustrations.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\illustrations.png.exe")) returned 1
	[0105.836] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\illustrations_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\illustrations_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\illustrations_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\illustrations_retina.png.exe")) returned 1
	[0105.839] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\logo_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\logo_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\logo_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\logo_retina.png.exe")) returned 1
	[0105.842] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\new_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\new_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\new_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\new_icons.png.exe")) returned 1
	[0105.848] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\adc_logo.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\adc_logo.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\adc_logo.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\adc_logo.png.exe")) returned 1
	[0105.851] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\adobe_spinner.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\adobe_spinner.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\adobe_spinner.gif.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\adobe_spinner.gif.exe")) returned 1
	[0105.855] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\core_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\core_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\core_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\core_icons.png.exe")) returned 1
	[0105.929] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\core_icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\core_icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\core_icons_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\core_icons_retina.png.exe")) returned 1
	[0105.934] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\download-btn.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\download-btn.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\download-btn.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\download-btn.png.exe")) returned 1
	[0105.936] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\file_info.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\file_info.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\file_info.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\file_info.png.exe")) returned 1
	[0105.940] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\file_info2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\file_info2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\file_info2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\file_info2x.png.exe")) returned 1
	[0105.943] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\illustrations.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\illustrations.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\illustrations.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\illustrations.png.exe")) returned 1
	[0105.947] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\illustrations_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\illustrations_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\illustrations_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\illustrations_retina.png.exe")) returned 1
	[0105.950] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\logo_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\logo_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\logo_retina.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\logo_retina.png.exe")) returned 1
	[0105.964] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\new_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\new_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\new_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\new_icons.png.exe")) returned 1
	[0105.975] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\bun.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\bun.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\bun.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\bun.png.exe")) returned 1
	[0105.982] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\cstm_brand_preview.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\cstm_brand_preview.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\cstm_brand_preview.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\cstm_brand_preview.png.exe")) returned 1
	[0105.985] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\cstm_brand_preview2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\cstm_brand_preview2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\cstm_brand_preview2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\cstm_brand_preview2x.png.exe")) returned 1
	[0105.990] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\dd_arrow_small.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\dd_arrow_small.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\dd_arrow_small.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\dd_arrow_small.png.exe")) returned 1
	[0105.993] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\dd_arrow_small2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\dd_arrow_small2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\dd_arrow_small2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\dd_arrow_small2x.png.exe")) returned 1
	[0105.996] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\nub.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\nub.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\nub.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\nub.png.exe")) returned 1
	[0105.999] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\sat_logo.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\sat_logo.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\sat_logo.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\sat_logo.png.exe")) returned 1
	[0106.002] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\sat_logo_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\sat_logo_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\sat_logo_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\sat_logo_2x.png.exe")) returned 1
	[0106.005] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\share_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\share_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\share_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\share_icons.png.exe")) returned 1
	[0106.008] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\share_icons2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\share_icons2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\share_icons2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\share_icons2x.png.exe")) returned 1
	[0106.016] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\bun.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\bun.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\bun.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\bun.png.exe")) returned 1
	[0106.020] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\cstm_brand_preview.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\cstm_brand_preview.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\cstm_brand_preview.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\cstm_brand_preview.png.exe")) returned 1
	[0106.040] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\cstm_brand_preview2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\cstm_brand_preview2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\cstm_brand_preview2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\cstm_brand_preview2x.png.exe")) returned 1
	[0106.044] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\dd_arrow_small.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\dd_arrow_small.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\dd_arrow_small.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\dd_arrow_small.png.exe")) returned 1
	[0106.046] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\dd_arrow_small2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\dd_arrow_small2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\dd_arrow_small2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\dd_arrow_small2x.png.exe")) returned 1
	[0106.050] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\nub.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\nub.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\nub.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\nub.png.exe")) returned 1
	[0106.057] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\sat_logo.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\sat_logo.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\sat_logo.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\sat_logo.png.exe")) returned 1
	[0106.061] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\sat_logo_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\sat_logo_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\sat_logo_2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\sat_logo_2x.png.exe")) returned 1
	[0106.066] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\share_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\share_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\share_icons.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\share_icons.png.exe")) returned 1
	[0106.070] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\share_icons2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\share_icons2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\share_icons2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\share_icons2x.png.exe")) returned 1
	[0106.079] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\home-view\\plugin.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\home-view\\plugin.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\home-view\\plugin.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\home-view\\plugin.js.exe")) returned 1
	[0106.143] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\home-view\\selector.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\home-view\\selector.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\home-view\\selector.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\home-view\\selector.js.exe")) returned 1
	[0106.154] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\ca-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\ca-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\ca-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\ca-es\\ui-strings.js.exe")) returned 1
	[0106.159] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\cs-cz\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\cs-cz\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\cs-cz\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\cs-cz\\ui-strings.js.exe")) returned 1
	[0106.164] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\da-dk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\da-dk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\da-dk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\da-dk\\ui-strings.js.exe")) returned 1
	[0106.169] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\de-de\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\de-de\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\de-de\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\de-de\\ui-strings.js.exe")) returned 1
	[0106.179] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\en-ae\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\en-ae\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\en-ae\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\en-ae\\ui-strings.js.exe")) returned 1
	[0106.185] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\en-gb\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\en-gb\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\en-gb\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\en-gb\\ui-strings.js.exe")) returned 1
	[0106.191] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\en-il\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\en-il\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\en-il\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\en-il\\ui-strings.js.exe")) returned 1
	[0106.195] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\es-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\es-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\es-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\es-es\\ui-strings.js.exe")) returned 1
	[0106.200] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\eu-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\eu-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\eu-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\eu-es\\ui-strings.js.exe")) returned 1
	[0106.205] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\fi-fi\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\fi-fi\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\fi-fi\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\fi-fi\\ui-strings.js.exe")) returned 1
	[0106.209] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\fr-fr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\fr-fr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\fr-fr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\fr-fr\\ui-strings.js.exe")) returned 1
	[0106.214] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\fr-ma\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\fr-ma\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\fr-ma\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\fr-ma\\ui-strings.js.exe")) returned 1
	[0106.223] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\hr-hr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\hr-hr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\hr-hr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\hr-hr\\ui-strings.js.exe")) returned 1
	[0106.229] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\hu-hu\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\hu-hu\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\hu-hu\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\hu-hu\\ui-strings.js.exe")) returned 1
	[0106.233] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\it-it\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\it-it\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\it-it\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\it-it\\ui-strings.js.exe")) returned 1
	[0106.238] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\ja-jp\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\ja-jp\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\ja-jp\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\ja-jp\\ui-strings.js.exe")) returned 1
	[0106.243] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\ko-kr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\ko-kr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\ko-kr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\ko-kr\\ui-strings.js.exe")) returned 1
	[0106.252] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\nb-no\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\nb-no\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\nb-no\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\nb-no\\ui-strings.js.exe")) returned 1
	[0106.256] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\nl-nl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\nl-nl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\nl-nl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\nl-nl\\ui-strings.js.exe")) returned 1
	[0106.287] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\pl-pl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\pl-pl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\pl-pl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\pl-pl\\ui-strings.js.exe")) returned 1
	[0106.293] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\pt-br\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\pt-br\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\pt-br\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\pt-br\\ui-strings.js.exe")) returned 1
	[0106.311] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\ro-ro\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\ro-ro\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\ro-ro\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\ro-ro\\ui-strings.js.exe")) returned 1
	[0106.316] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\root\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\root\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\root\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\root\\ui-strings.js.exe")) returned 1
	[0106.320] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\ru-ru\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\ru-ru\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\ru-ru\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\ru-ru\\ui-strings.js.exe")) returned 1
	[0106.792] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\sk-sk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\sk-sk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\sk-sk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\sk-sk\\ui-strings.js.exe")) returned 1
	[0106.798] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\sl-si\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\sl-si\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\sl-si\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\sl-si\\ui-strings.js.exe")) returned 1
	[0106.802] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\sv-se\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\sv-se\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\sv-se\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\sv-se\\ui-strings.js.exe")) returned 1
	[0106.806] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\tr-tr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\tr-tr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\tr-tr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\tr-tr\\ui-strings.js.exe")) returned 1
	[0106.811] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\ui-strings.js.exe")) returned 1
	[0106.816] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\uk-ua\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\uk-ua\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\uk-ua\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\uk-ua\\ui-strings.js.exe")) returned 1
	[0106.820] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\zh-cn\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\zh-cn\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\zh-cn\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\zh-cn\\ui-strings.js.exe")) returned 1
	[0106.824] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\zh-tw\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\zh-tw\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\zh-tw\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\zh-tw\\ui-strings.js.exe")) returned 1
	[0106.857] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\tool\\plugin.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\tool\\plugin.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\tool\\plugin.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\tool\\plugin.js.exe")) returned 1
	[0106.861] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\tool\\selector.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\tool\\selector.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\tool\\selector.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\tool\\selector.js.exe")) returned 1
	[0106.872] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\da-dk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\da-dk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\da-dk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\da-dk\\ui-strings.js.exe")) returned 1
	[0106.878] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\de-de\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\de-de\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\de-de\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\de-de\\ui-strings.js.exe")) returned 1
	[0106.884] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\en-gb\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\en-gb\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\en-gb\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\en-gb\\ui-strings.js.exe")) returned 1
	[0107.043] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\es-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\es-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\es-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\es-es\\ui-strings.js.exe")) returned 1
	[0107.109] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\fi-fi\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\fi-fi\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\fi-fi\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\fi-fi\\ui-strings.js.exe")) returned 1
	[0107.114] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\fr-fr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\fr-fr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\fr-fr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\fr-fr\\ui-strings.js.exe")) returned 1
	[0107.120] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\it-it\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\it-it\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\it-it\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\it-it\\ui-strings.js.exe")) returned 1
	[0107.124] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\ja-jp\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\ja-jp\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\ja-jp\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\ja-jp\\ui-strings.js.exe")) returned 1
	[0107.129] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\nb-no\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\nb-no\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\nb-no\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\nb-no\\ui-strings.js.exe")) returned 1
	[0107.133] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\nl-nl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\nl-nl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\nl-nl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\nl-nl\\ui-strings.js.exe")) returned 1
	[0107.138] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\pt-br\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\pt-br\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\pt-br\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\pt-br\\ui-strings.js.exe")) returned 1
	[0107.150] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\root\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\root\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\root\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\root\\ui-strings.js.exe")) returned 1
	[0107.158] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\sv-se\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\sv-se\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\sv-se\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\sv-se\\ui-strings.js.exe")) returned 1
	[0107.163] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\ui-strings.js.exe")) returned 1
	[0107.173] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\images\\checkmark-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\images\\checkmark-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\images\\checkmark-2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\images\\checkmark-2x.png.exe")) returned 1
	[0107.176] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\images\\checkmark.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\images\\checkmark.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\images\\checkmark.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\images\\checkmark.png.exe")) returned 1
	[0107.184] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\images\\themes\\dark\\checkmark-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\images\\themes\\dark\\checkmark-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\images\\themes\\dark\\checkmark-2x.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\images\\themes\\dark\\checkmark-2x.png.exe")) returned 1
	[0107.186] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\images\\themes\\dark\\checkmark.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\images\\themes\\dark\\checkmark.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\images\\themes\\dark\\checkmark.png.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\images\\themes\\dark\\checkmark.png.exe")) returned 1
	[0107.228] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\da-dk\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\js\\nls\\da-dk\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\da-dk\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\js\\nls\\da-dk\\ui-strings.js.exe")) returned 1
	[0107.234] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\de-de\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\js\\nls\\de-de\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\de-de\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\js\\nls\\de-de\\ui-strings.js.exe")) returned 1
	[0107.238] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\en-gb\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\js\\nls\\en-gb\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\en-gb\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\js\\nls\\en-gb\\ui-strings.js.exe")) returned 1
	[0107.242] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\es-es\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\js\\nls\\es-es\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\es-es\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\js\\nls\\es-es\\ui-strings.js.exe")) returned 1
	[0107.250] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\fi-fi\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\js\\nls\\fi-fi\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\fi-fi\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\js\\nls\\fi-fi\\ui-strings.js.exe")) returned 1
	[0107.255] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\fr-fr\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\js\\nls\\fr-fr\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\fr-fr\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\js\\nls\\fr-fr\\ui-strings.js.exe")) returned 1
	[0107.259] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\it-it\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\js\\nls\\it-it\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\it-it\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\js\\nls\\it-it\\ui-strings.js.exe")) returned 1
	[0107.278] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\ja-jp\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\js\\nls\\ja-jp\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\ja-jp\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\js\\nls\\ja-jp\\ui-strings.js.exe")) returned 1
	[0107.282] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\nb-no\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\js\\nls\\nb-no\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\nb-no\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\js\\nls\\nb-no\\ui-strings.js.exe")) returned 1
	[0107.287] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\nl-nl\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\js\\nls\\nl-nl\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\nl-nl\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\js\\nls\\nl-nl\\ui-strings.js.exe")) returned 1
	[0107.293] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\pt-br\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\js\\nls\\pt-br\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\pt-br\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\js\\nls\\pt-br\\ui-strings.js.exe")) returned 1
	[0107.297] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\root\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\js\\nls\\root\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\root\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\js\\nls\\root\\ui-strings.js.exe")) returned 1
	[0107.302] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\sv-se\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\js\\nls\\sv-se\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\sv-se\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\js\\nls\\sv-se\\ui-strings.js.exe")) returned 1
	[0107.306] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\ui-strings.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\js\\nls\\ui-strings.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\ui-strings.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\js\\nls\\ui-strings.js.exe")) returned 1
	[0107.310] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\plugin.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\js\\plugin.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\plugin.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\js\\plugin.js.exe")) returned 1
	[0107.313] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\selector.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\js\\selector.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\selector.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\js\\selector.js.exe")) returned 1
	[0107.384] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\rna-main.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\rna-main.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\rna-main.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\rna-main.js.exe")) returned 1
	[0107.390] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\versions\\framework-dev.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\versions\\framework-dev.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\versions\\framework-dev.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\versions\\framework-dev.js.exe")) returned 1
	[0107.469] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\variant.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\variant.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\variant.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\variant.js.exe")) returned 1
	[0107.482] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\version.js" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\version.js"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\version.js.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\version.js.exe")) returned 1
	[0107.494] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Welcome.pdf" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\welcome.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Welcome.pdf.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\welcome.pdf.exe")) returned 1
	[0107.521] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\ReadMe.htm" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\readme.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\ReadMe.htm.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\readme.htm.exe")) returned 1
	[0107.531] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\ENUtxt.pdf" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\enutxt.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\ENUtxt.pdf.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\enutxt.pdf.exe")) returned 1
	[0107.544] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\symbol.txt" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\adobe\\symbol.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\symbol.txt.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\adobe\\symbol.txt.exe")) returned 1
	[0107.552] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\zdingbat.txt" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\adobe\\zdingbat.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\zdingbat.txt.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\adobe\\zdingbat.txt.exe")) returned 1
	[0107.561] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CENTEURO.TXT" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\centeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CENTEURO.TXT.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\centeuro.txt.exe")) returned 1
	[0107.566] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CORPCHAR.TXT" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\corpchar.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CORPCHAR.TXT.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\corpchar.txt.exe")) returned 1
	[0107.569] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CROATIAN.TXT" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\croatian.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CROATIAN.TXT.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\croatian.txt.exe")) returned 1
	[0107.574] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CYRILLIC.TXT" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\cyrillic.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CYRILLIC.TXT.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\cyrillic.txt.exe")) returned 1
	[0107.577] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\GREEK.TXT" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\greek.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\GREEK.TXT.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\greek.txt.exe")) returned 1
	[0107.581] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ICELAND.TXT" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\iceland.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ICELAND.TXT.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\iceland.txt.exe")) returned 1
	[0107.585] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ROMAN.TXT" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\roman.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ROMAN.TXT.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\roman.txt.exe")) returned 1
	[0107.588] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ROMANIAN.TXT" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\romanian.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ROMANIAN.TXT.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\romanian.txt.exe")) returned 1
	[0107.591] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\SYMBOL.TXT" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\symbol.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\SYMBOL.TXT.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\symbol.txt.exe")) returned 1
	[0107.594] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\TURKISH.TXT" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\turkish.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\TURKISH.TXT.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\turkish.txt.exe")) returned 1
	[0107.597] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\UKRAINE.TXT" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\ukraine.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\UKRAINE.TXT.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\ukraine.txt.exe")) returned 1
	[0107.602] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1250.TXT" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\win\\cp1250.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1250.TXT.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\win\\cp1250.txt.exe")) returned 1
	[0107.606] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1251.TXT" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\win\\cp1251.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1251.TXT.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\win\\cp1251.txt.exe")) returned 1
	[0107.612] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1252.TXT" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\win\\cp1252.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1252.TXT.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\win\\cp1252.txt.exe")) returned 1
	[0107.615] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1253.TXT" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\win\\cp1253.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1253.TXT.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\win\\cp1253.txt.exe")) returned 1
	[0107.619] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1254.TXT" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\win\\cp1254.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1254.TXT.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\win\\cp1254.txt.exe")) returned 1
	[0107.622] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1257.TXT" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\win\\cp1257.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1257.TXT.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\win\\cp1257.txt.exe")) returned 1
	[0107.625] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1258.TXT" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\win\\cp1258.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1258.TXT.exe" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\win\\cp1258.txt.exe")) returned 1
	[0107.644] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_CA.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\languagenames2\\displaylanguagenames.en_ca.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_CA.txt.exe" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\languagenames2\\displaylanguagenames.en_ca.txt.exe")) returned 1
	[0107.649] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\languagenames2\\displaylanguagenames.en_gb.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB.txt.exe" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\languagenames2\\displaylanguagenames.en_gb.txt.exe")) returned 1
	[0107.654] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB_EURO.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\languagenames2\\displaylanguagenames.en_gb_euro.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB_EURO.txt.exe" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\languagenames2\\displaylanguagenames.en_gb_euro.txt.exe")) returned 1
	[0107.657] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\languagenames2\\displaylanguagenames.en_us.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US.txt.exe" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\languagenames2\\displaylanguagenames.en_us.txt.exe")) returned 1
	[0107.660] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US_POSIX.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\languagenames2\\displaylanguagenames.en_us_posix.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US_POSIX.txt.exe" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\languagenames2\\displaylanguagenames.en_us_posix.txt.exe")) returned 1
	[0107.668] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Abbreviations\\en_CA\\List.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\abbreviations\\en_ca\\list.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Abbreviations\\en_CA\\List.txt.exe" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\abbreviations\\en_ca\\list.txt.exe")) returned 1
	[0107.672] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Abbreviations\\en_GB\\List.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\abbreviations\\en_gb\\list.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Abbreviations\\en_GB\\List.txt.exe" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\abbreviations\\en_gb\\list.txt.exe")) returned 1
	[0107.688] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Abbreviations\\en_US\\List.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\abbreviations\\en_us\\list.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Abbreviations\\en_US\\List.txt.exe" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\abbreviations\\en_us\\list.txt.exe")) returned 1
	[0107.692] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\comdll.X.manifest" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\comdll.x.manifest"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\comdll.X.manifest.exe" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\comdll.x.manifest.exe")) returned 1
	[0107.713] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_CA\\README_en_CA.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\dictionaries\\en_ca\\readme_en_ca.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_CA\\README_en_CA.txt.exe" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\dictionaries\\en_ca\\readme_en_ca.txt.exe")) returned 1
	[0107.717] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_CA\\README_th_en_CA_v2.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\dictionaries\\en_ca\\readme_th_en_ca_v2.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_CA\\README_th_en_CA_v2.txt.exe" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\dictionaries\\en_ca\\readme_th_en_ca_v2.txt.exe")) returned 1
	[0108.290] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_GB\\affDescription.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\dictionaries\\en_gb\\affdescription.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_GB\\affDescription.txt.exe" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\dictionaries\\en_gb\\affdescription.txt.exe")) returned 1
	[0108.293] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_GB\\changelog.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\dictionaries\\en_gb\\changelog.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_GB\\changelog.txt.exe" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\dictionaries\\en_gb\\changelog.txt.exe")) returned 1
	[0108.297] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_GB\\license.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\dictionaries\\en_gb\\license.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_GB\\license.txt.exe" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\dictionaries\\en_gb\\license.txt.exe")) returned 1
	[0108.313] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_GB\\README.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\dictionaries\\en_gb\\readme.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_GB\\README.txt.exe" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\dictionaries\\en_gb\\readme.txt.exe")) returned 1
	[0108.317] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_GB\\README_en_GB.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\dictionaries\\en_gb\\readme_en_gb.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_GB\\README_en_GB.txt.exe" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\dictionaries\\en_gb\\readme_en_gb.txt.exe")) returned 1
	[0108.321] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_GB\\WordNet_license.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\dictionaries\\en_gb\\wordnet_license.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_GB\\WordNet_license.txt.exe" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\dictionaries\\en_gb\\wordnet_license.txt.exe")) returned 1
	[0108.327] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_US\\README_en_US.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\dictionaries\\en_us\\readme_en_us.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_US\\README_en_US.txt.exe" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\dictionaries\\en_us\\readme_en_us.txt.exe")) returned 1
	[0108.329] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\plugin.X.manifest" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\plugin.x.manifest"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\plugin.X.manifest.exe" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\plugin.x.manifest.exe")) returned 1
	[0108.333] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\SupplementalDictionaries\\en_CA\\added.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\supplementaldictionaries\\en_ca\\added.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\SupplementalDictionaries\\en_CA\\added.txt.exe" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\supplementaldictionaries\\en_ca\\added.txt.exe")) returned 1
	[0108.336] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\SupplementalDictionaries\\en_CA\\excluded.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\supplementaldictionaries\\en_ca\\excluded.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\SupplementalDictionaries\\en_CA\\excluded.txt.exe" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\supplementaldictionaries\\en_ca\\excluded.txt.exe")) returned 1
	[0108.404] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\SupplementalDictionaries\\en_GB\\added.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\supplementaldictionaries\\en_gb\\added.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\SupplementalDictionaries\\en_GB\\added.txt.exe" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\supplementaldictionaries\\en_gb\\added.txt.exe")) returned 1
	[0108.407] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\SupplementalDictionaries\\en_GB\\excluded.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\supplementaldictionaries\\en_gb\\excluded.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\SupplementalDictionaries\\en_GB\\excluded.txt.exe" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\supplementaldictionaries\\en_gb\\excluded.txt.exe")) returned 1
	[0108.413] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\SupplementalDictionaries\\en_US\\Added.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\supplementaldictionaries\\en_us\\added.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\SupplementalDictionaries\\en_US\\Added.txt.exe" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\supplementaldictionaries\\en_us\\added.txt.exe")) returned 1
	[0108.415] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\SupplementalDictionaries\\en_US\\Excluded.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\supplementaldictionaries\\en_us\\excluded.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\SupplementalDictionaries\\en_US\\Excluded.txt.exe" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\supplementaldictionaries\\en_us\\excluded.txt.exe")) returned 1
	[0108.553] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\61.0.3163.79.manifest" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\61.0.3163.79\\61.0.3163.79.manifest"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\61.0.3163.79.manifest.exe" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\61.0.3163.79\\61.0.3163.79.manifest.exe")) returned 1
	[0108.627] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\Installer\\chrome.7z" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\61.0.3163.79\\installer\\chrome.7z"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\Installer\\chrome.7z.exe" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\61.0.3163.79\\installer\\chrome.7z.exe")) returned 1
	[0108.649] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\VisualElements\\logo.png" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\61.0.3163.79\\visualelements\\logo.png"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\VisualElements\\logo.png.exe" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\61.0.3163.79\\visualelements\\logo.png.exe")) returned 1
	[0108.655] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\VisualElements\\logobeta.png" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\61.0.3163.79\\visualelements\\logobeta.png"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\VisualElements\\logobeta.png.exe" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\61.0.3163.79\\visualelements\\logobeta.png.exe")) returned 1
	[0108.658] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\VisualElements\\logocanary.png" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\61.0.3163.79\\visualelements\\logocanary.png"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\VisualElements\\logocanary.png.exe" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\61.0.3163.79\\visualelements\\logocanary.png.exe")) returned 1
	[0108.695] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\VisualElements\\logodev.png" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\61.0.3163.79\\visualelements\\logodev.png"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\VisualElements\\logodev.png.exe" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\61.0.3163.79\\visualelements\\logodev.png.exe")) returned 1
	[0108.698] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\VisualElements\\smalllogo.png" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\61.0.3163.79\\visualelements\\smalllogo.png"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\VisualElements\\smalllogo.png.exe" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\61.0.3163.79\\visualelements\\smalllogo.png.exe")) returned 1
	[0108.701] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\VisualElements\\smalllogobeta.png" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\61.0.3163.79\\visualelements\\smalllogobeta.png"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\VisualElements\\smalllogobeta.png.exe" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\61.0.3163.79\\visualelements\\smalllogobeta.png.exe")) returned 1
	[0108.704] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\VisualElements\\smalllogocanary.png" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\61.0.3163.79\\visualelements\\smalllogocanary.png"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\VisualElements\\smalllogocanary.png.exe" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\61.0.3163.79\\visualelements\\smalllogocanary.png.exe")) returned 1
	[0108.707] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\VisualElements\\smalllogodev.png" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\61.0.3163.79\\visualelements\\smalllogodev.png"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\VisualElements\\smalllogodev.png.exe" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\61.0.3163.79\\visualelements\\smalllogodev.png.exe")) returned 1
	[0108.984] WriteFile (in: hFile=0x210, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0108.986] SetFileTime (hFile=0x210, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.993] CloseHandle (hObject=0x210) returned 1
	[0110.140] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp.exe" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp.exe")) returned 1
	[0110.149] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.png"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png.exe" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.png.exe")) returned 1
	[0110.153] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-192.png"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png.exe" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-192.png.exe")) returned 1
	[0110.156] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-32.png"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png.exe" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-32.png.exe")) returned 1
	[0110.158] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-40.png"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png.exe" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-40.png.exe")) returned 1
	[0110.160] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-48.png"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png.exe" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-48.png.exe")) returned 1
	[0110.197] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp.exe" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp.exe")) returned 1
	[0110.199] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.png"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png.exe" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.png.exe")) returned 1
	[0111.025] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.0.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.0.db"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.0.db.exe" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.0.db.exe")) returned 1
	[0111.029] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db.exe" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db.exe")) returned 1
	[0111.031] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{07CE7F5B-73F4-4BAD-B449-5B3E959DEF86}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{07ce7f5b-73f4-4bad-b449-5b3e959def86}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{07CE7F5B-73F4-4BAD-B449-5B3E959DEF86}.2.ver0x0000000000000001.db.exe" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{07ce7f5b-73f4-4bad-b449-5b3e959def86}.2.ver0x0000000000000001.db.exe")) returned 1
	[0111.034] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{2A2E4B23-55E7-4066-BF56-40A8C2ACF003}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{2a2e4b23-55e7-4066-bf56-40a8c2acf003}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{2A2E4B23-55E7-4066-BF56-40A8C2ACF003}.2.ver0x0000000000000001.db.exe" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{2a2e4b23-55e7-4066-bf56-40a8c2acf003}.2.ver0x0000000000000001.db.exe")) returned 1
	[0111.037] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{427A2095-CED1-467F-8647-D13F664E7313}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{427a2095-ced1-467f-8647-d13f664e7313}.2.ver0x0000000000000002.db"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{427A2095-CED1-467F-8647-D13F664E7313}.2.ver0x0000000000000002.db.exe" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{427a2095-ced1-467f-8647-d13f664e7313}.2.ver0x0000000000000002.db.exe")) returned 1
	[0111.039] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{427A2095-CED1-467F-8647-D13F664E7313}.2.ver0x0000000000000003.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{427a2095-ced1-467f-8647-d13f664e7313}.2.ver0x0000000000000003.db"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{427A2095-CED1-467F-8647-D13F664E7313}.2.ver0x0000000000000003.db.exe" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{427a2095-ced1-467f-8647-d13f664e7313}.2.ver0x0000000000000003.db.exe")) returned 1
	[0111.042] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{599D1469-EB61-443B-9556-EE3AA24908DA}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{599d1469-eb61-443b-9556-ee3aa24908da}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{599D1469-EB61-443B-9556-EE3AA24908DA}.2.ver0x0000000000000001.db.exe" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{599d1469-eb61-443b-9556-ee3aa24908da}.2.ver0x0000000000000001.db.exe")) returned 1
	[0111.045] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{5B6DB04B-B054-4120-9EE4-33A79FF53BC3}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{5b6db04b-b054-4120-9ee4-33a79ff53bc3}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{5B6DB04B-B054-4120-9EE4-33A79FF53BC3}.2.ver0x0000000000000001.db.exe" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{5b6db04b-b054-4120-9ee4-33a79ff53bc3}.2.ver0x0000000000000001.db.exe")) returned 1
	[0111.047] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{696521D6-0C3C-47A9-8A08-62A21834D2F0}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{696521d6-0c3c-47a9-8a08-62a21834d2f0}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{696521D6-0C3C-47A9-8A08-62A21834D2F0}.2.ver0x0000000000000001.db.exe" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{696521d6-0c3c-47a9-8a08-62a21834d2f0}.2.ver0x0000000000000001.db.exe")) returned 1
	[0111.090] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000014.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000014.db"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000014.db.exe" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000014.db.exe")) returned 1
	[0111.096] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000016.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000016.db"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000016.db.exe" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000016.db.exe")) returned 1
	[0111.099] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{7BF8DBD1-8EE0-446A-8D07-1D22E4418D9A}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{7bf8dbd1-8ee0-446a-8d07-1d22e4418d9a}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{7BF8DBD1-8EE0-446A-8D07-1D22E4418D9A}.2.ver0x0000000000000001.db.exe" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{7bf8dbd1-8ee0-446a-8d07-1d22e4418d9a}.2.ver0x0000000000000001.db.exe")) returned 1
	[0111.102] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{7BF8DBD1-8EE0-446A-8D07-1D22E4418D9A}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{7bf8dbd1-8ee0-446a-8d07-1d22e4418d9a}.2.ver0x0000000000000002.db"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{7BF8DBD1-8EE0-446A-8D07-1D22E4418D9A}.2.ver0x0000000000000002.db.exe" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{7bf8dbd1-8ee0-446a-8d07-1d22e4418d9a}.2.ver0x0000000000000002.db.exe")) returned 1
	[0111.104] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{9961E15C-3F61-4FA0-9F93-F635907C374B}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{9961e15c-3f61-4fa0-9f93-f635907c374b}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{9961E15C-3F61-4FA0-9F93-F635907C374B}.2.ver0x0000000000000001.db.exe" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{9961e15c-3f61-4fa0-9f93-f635907c374b}.2.ver0x0000000000000001.db.exe")) returned 1
	[0111.107] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{B8C80385-EAD5-4543-9080-86ADA8E81DD5}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{b8c80385-ead5-4543-9080-86ada8e81dd5}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{B8C80385-EAD5-4543-9080-86ADA8E81DD5}.2.ver0x0000000000000001.db.exe" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{b8c80385-ead5-4543-9080-86ada8e81dd5}.2.ver0x0000000000000001.db.exe")) returned 1
	[0111.149] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.exe" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db.exe")) returned 1
	[0111.152] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{E14796D4-F769-4AA4-85DC-E9FFE52AEEB4}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{e14796d4-f769-4aa4-85dc-e9ffe52aeeb4}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{E14796D4-F769-4AA4-85DC-E9FFE52AEEB4}.2.ver0x0000000000000001.db.exe" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{e14796d4-f769-4aa4-85dc-e9ffe52aeeb4}.2.ver0x0000000000000001.db.exe")) returned 1
	[0111.179] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html.exe" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html.exe")) returned 1
	[0111.187] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\access 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\access 2016.lnk.exe")) returned 1
	[0111.195] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Speech Recognition.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessibility\\speech recognition.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Speech Recognition.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessibility\\speech recognition.lnk.exe")) returned 1
	[0111.200] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk.exe")) returned 1
	[0111.203] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk.exe")) returned 1
	[0111.208] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Quick Assist.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\quick assist.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Quick Assist.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\quick assist.lnk.exe")) returned 1
	[0111.211] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk.exe")) returned 1
	[0111.214] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk.exe")) returned 1
	[0111.218] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Steps Recorder.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\steps recorder.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Steps Recorder.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\steps recorder.lnk.exe")) returned 1
	[0111.224] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk.exe")) returned 1
	[0111.227] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Fax and Scan.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows fax and scan.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Fax and Scan.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows fax and scan.lnk.exe")) returned 1
	[0111.230] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Media Player.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows media player.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Media Player.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows media player.lnk.exe")) returned 1
	[0111.235] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk.exe")) returned 1
	[0111.237] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\XPS Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\xps viewer.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\XPS Viewer.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\xps viewer.lnk.exe")) returned 1
	[0111.241] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Acrobat Reader DC.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\acrobat reader dc.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Acrobat Reader DC.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\acrobat reader dc.lnk.exe")) returned 1
	[0111.246] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk.exe")) returned 1
	[0111.253] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk.exe")) returned 1
	[0111.260] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\dfrgui.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\dfrgui.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\dfrgui.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\dfrgui.lnk.exe")) returned 1
	[0111.264] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Disk Cleanup.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\disk cleanup.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Disk Cleanup.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\disk cleanup.lnk.exe")) returned 1
	[0111.268] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk.exe")) returned 1
	[0111.271] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk.exe")) returned 1
	[0111.274] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk.exe")) returned 1
	[0111.277] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (32-bit).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (32-bit).lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (32-bit).lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (32-bit).lnk.exe")) returned 1
	[0111.281] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (64-bit).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (64-bit).lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (64-bit).lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (64-bit).lnk.exe")) returned 1
	[0111.284] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk.exe")) returned 1
	[0111.290] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk.exe")) returned 1
	[0111.294] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Resource Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\resource monitor.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Resource Monitor.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\resource monitor.lnk.exe")) returned 1
	[0111.297] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk.exe")) returned 1
	[0111.302] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk.exe")) returned 1
	[0111.306] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk.exe")) returned 1
	[0111.309] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system information.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system information.lnk.exe")) returned 1
	[0111.312] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk.exe")) returned 1
	[0111.314] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk.exe")) returned 1
	[0111.317] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\excel 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\excel 2016.lnk.exe")) returned 1
	[0111.320] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\google chrome.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\google chrome.lnk.exe")) returned 1
	[0111.328] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk.exe")) returned 1
	[0111.331] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk.exe")) returned 1
	[0111.334] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk.exe")) returned 1
	[0111.343] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\database compare 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\database compare 2016.lnk.exe")) returned 1
	[0111.349] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk.exe")) returned 1
	[0111.356] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 upload center.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 upload center.lnk.exe")) returned 1
	[0111.359] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Project Server 2016 Accounts.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\project server 2016 accounts.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Project Server 2016 Accounts.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\project server 2016 accounts.lnk.exe")) returned 1
	[0111.363] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\skype for business recording manager.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\skype for business recording manager.lnk.exe")) returned 1
	[0111.366] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk.exe")) returned 1
	[0111.370] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk.exe")) returned 1
	[0111.373] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk.exe")) returned 1
	[0111.380] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk.exe")) returned 1
	[0111.383] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\onedrive for business.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\onedrive for business.lnk.exe")) returned 1
	[0111.386] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\onenote 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\onenote 2016.lnk.exe")) returned 1
	[0111.389] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\outlook 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\outlook 2016.lnk.exe")) returned 1
	[0111.393] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\powerpoint 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\powerpoint 2016.lnk.exe")) returned 1
	[0111.399] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Project 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\project 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Project 2016.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\project 2016.lnk.exe")) returned 1
	[0111.402] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\publisher 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\publisher 2016.lnk.exe")) returned 1
	[0111.404] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\skype for business 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\skype for business 2016.lnk.exe")) returned 1
	[0111.410] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Task Manager.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\task manager.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Task Manager.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\task manager.lnk.exe")) returned 1
	[0111.414] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Windows Defender.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\windows defender.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Windows Defender.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\windows defender.lnk.exe")) returned 1
	[0111.416] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Visio 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\visio 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Visio 2016.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\visio 2016.lnk.exe")) returned 1
	[0111.419] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows 10 Update Assistant.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows 10 update assistant.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows 10 Update Assistant.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows 10 update assistant.lnk.exe")) returned 1
	[0111.425] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows media player.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows media player.lnk.exe")) returned 1
	[0111.427] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Word 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\word 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Word 2016.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\word 2016.lnk.exe")) returned 1
	[0111.431] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\01 - File Explorer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\01 - file explorer.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\01 - File Explorer.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\01 - file explorer.lnk.exe")) returned 1
	[0111.434] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\03 - Documents.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\03 - documents.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\03 - Documents.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\03 - documents.lnk.exe")) returned 1
	[0111.440] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\04 - Downloads.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\04 - downloads.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\04 - Downloads.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\04 - downloads.lnk.exe")) returned 1
	[0111.484] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\05 - Music.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\05 - music.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\05 - Music.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\05 - music.lnk.exe")) returned 1
	[0111.487] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\06 - Pictures.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\06 - pictures.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\06 - Pictures.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\06 - pictures.lnk.exe")) returned 1
	[0111.489] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\07 - Videos.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\07 - videos.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\07 - Videos.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\07 - videos.lnk.exe")) returned 1
	[0111.491] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\08 - Homegroup.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\08 - homegroup.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\08 - Homegroup.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\08 - homegroup.lnk.exe")) returned 1
	[0111.494] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\09 - Network.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\09 - network.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\09 - Network.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\09 - network.lnk.exe")) returned 1
	[0111.497] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\10 - UserProfile.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\10 - userprofile.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\10 - UserProfile.lnk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\10 - userprofile.lnk.exe")) returned 1
	[0111.509] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\network inspection system\\support\\nislog.txt"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt.exe" (normalized: "c:\\programdata\\microsoft\\windows defender\\network inspection system\\support\\nislog.txt.exe")) returned 1
	[0111.623] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CC" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.cc"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CC.exe" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.cc.exe")) returned 1
	[0111.751] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CC" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.cc"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CC.exe" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.cc.exe")) returned 1
	[0111.762] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Live\\WLive48x48.png" (normalized: "c:\\programdata\\microsoft\\windows live\\wlive48x48.png"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Live\\WLive48x48.png.exe" (normalized: "c:\\programdata\\microsoft\\windows live\\wlive48x48.png.exe")) returned 1
	[0114.111] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk.exe" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk.exe")) returned 1
	[0114.121] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk.exe" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk.exe")) returned 1
	[0114.124] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk.exe" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk.exe")) returned 1
	[0114.127] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk.exe" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk.exe")) returned 1
	[0114.130] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk.exe" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk.exe")) returned 1
	[0114.132] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk.exe" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk.exe")) returned 1
	[0114.140] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk.exe" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk.exe")) returned 1
	[0114.143] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk.exe" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk.exe")) returned 1
	[0114.145] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk.exe" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk.exe")) returned 1
	[0114.148] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk.exe" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk.exe")) returned 1
	[0114.150] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk.exe" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk.exe")) returned 1
	[0114.152] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk.exe" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk.exe")) returned 1
	[0114.155] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - NetworkStatus.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - networkstatus.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - NetworkStatus.lnk.exe" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - networkstatus.lnk.exe")) returned 1
	[0114.158] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk.exe" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk.exe")) returned 1
	[0114.160] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - SystemAbout.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - systemabout.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - SystemAbout.lnk.exe" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - systemabout.lnk.exe")) returned 1
	[0114.162] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk.exe" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk.exe")) returned 1
	[0114.165] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - PowerAndSleep.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - powerandsleep.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - PowerAndSleep.lnk.exe" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - powerandsleep.lnk.exe")) returned 1
	[0114.167] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk.exe" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk.exe")) returned 1
	[0114.172] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - AppsAndFeatures.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - appsandfeatures.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - AppsAndFeatures.lnk.exe" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - appsandfeatures.lnk.exe")) returned 1
	[0114.201] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.exe" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.exe")) returned 1
	[0114.244] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.exe" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.exe")) returned 1
	[0114.253] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.exe" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk.exe")) returned 1
	[0114.260] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk.exe" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk.exe")) returned 1
	[0114.265] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk.exe" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk.exe")) returned 1
	[0114.267] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk.exe" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk.exe")) returned 1
	[0114.323] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.exe" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk.exe")) returned 1
	[0114.331] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk.exe" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk.exe")) returned 1
	[0114.334] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk.exe" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk.exe")) returned 1
	[0114.336] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk.exe" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk.exe")) returned 1
	[0114.338] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk.exe" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk.exe")) returned 1
	[0114.340] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk.exe" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk.exe")) returned 1
	[0114.348] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk.exe" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk.exe")) returned 1
	[0114.350] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk.exe" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk.exe")) returned 1
	[0114.352] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk.exe" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk.exe")) returned 1
	[0114.355] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk.exe" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk.exe")) returned 1
	[0114.845] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.exe")) returned 1
	[0114.876] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.exe")) returned 1
	[0114.879] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.exe")) returned 1
	[0114.881] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.exe")) returned 1
	[0115.600] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.exe")) returned 1
	[0115.602] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.exe")) returned 1
	[0115.604] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.exe")) returned 1
	[0115.606] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.exe")) returned 1
	[0115.798] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.exe")) returned 1
	[0116.155] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.exe")) returned 1
	[0116.415] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png.exe")) returned 1
	[0116.418] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js.exe")) returned 1
	[0116.421] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js.exe")) returned 1
	[0116.423] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js.exe")) returned 1
	[0116.836] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\craw_background.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\craw_background.js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\craw_background.js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\craw_background.js.exe")) returned 1
	[0117.024] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\craw_window.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\craw_window.js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\craw_window.js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\craw_window.js.exe")) returned 1
	[0117.031] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\html\\craw_window.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\html\\craw_window.html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\html\\craw_window.html.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\html\\craw_window.html.exe")) returned 1
	[0117.215] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\flapper.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\flapper.gif"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\flapper.gif.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\flapper.gif.exe")) returned 1
	[0117.219] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_128.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_128.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_128.png.exe")) returned 1
	[0117.221] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_16.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_16.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_16.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_16.png.exe")) returned 1
	[0117.223] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button.png.exe")) returned 1
	[0117.225] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_close.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_close.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_close.png.exe")) returned 1
	[0117.227] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_hover.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_hover.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_hover.png.exe")) returned 1
	[0117.239] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_maximize.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_maximize.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_maximize.png.exe")) returned 1
	[0117.241] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_pressed.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_pressed.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_pressed.png.exe")) returned 1
	[0117.444] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.exe")) returned 1
	[0117.594] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\angular.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\angular.js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\angular.js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\angular.js.exe")) returned 1
	[0117.598] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\background_script.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\background_script.js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\background_script.js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\background_script.js.exe")) returned 1
	[0117.603] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_game_sender.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_game_sender.js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_game_sender.js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_game_sender.js.exe")) returned 1
	[0117.607] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_route_details.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_route_details.html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_route_details.html.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_route_details.html.exe")) returned 1
	[0117.612] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_route_details.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_route_details.js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_route_details.js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_route_details.js.exe")) returned 1
	[0117.617] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_sender.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_sender.js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_sender.js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_sender.js.exe")) returned 1
	[0117.624] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app.js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app.js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app.js.exe")) returned 1
	[0117.627] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app_redirect.js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app_redirect.js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\cast_app_redirect.js.exe")) returned 1
	[0117.664] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\chromecast_logo_grey.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\chromecast_logo_grey.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\chromecast_logo_grey.png.exe")) returned 1
	[0117.666] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\devices.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\devices.html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\devices.html.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\devices.html.exe")) returned 1
	[0117.668] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\index.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\index.html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\index.html.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\index.html.exe")) returned 1
	[0117.669] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\offers.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\offers.html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\offers.html.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\offers.html.exe")) returned 1
	[0117.671] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\setup.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\setup.html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\setup.html.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\setup.html.exe")) returned 1
	[0117.676] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cloud_route_details\\view.html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cloud_route_details\\view.html.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cloud_route_details\\view.html.exe")) returned 1
	[0117.679] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cloud_route_details\\view.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cloud_route_details\\view.js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cloud_route_details\\view.js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cloud_route_details\\view.js.exe")) returned 1
	[0117.683] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\common.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\common.js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\common.js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\common.js.exe")) returned 1
	[0117.686] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback.html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback.html.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback.html.exe")) returned 1
	[0117.689] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback_script.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback_script.js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback_script.js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback_script.js.exe")) returned 1
	[0117.692] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_cast_streaming.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_cast_streaming.js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_cast_streaming.js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_cast_streaming.js.exe")) returned 1
	[0117.698] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_common.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_common.js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_common.js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_common.js.exe")) returned 1
	[0117.747] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_hangouts.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_hangouts.js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_hangouts.js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_hangouts.js.exe")) returned 1
	[0117.766] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_webrtc.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_webrtc.js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_webrtc.js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\mirroring_webrtc.js.exe")) returned 1
	[0118.063] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db.exe")) returned 1
	[0118.088] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\iconcache.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\IconCache.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\iconcache.db.exe")) returned 1
	[0118.203] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.exe")) returned 1
	[0118.412] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AppBlue.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\appblue.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AppBlue.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\appblue.png.exe")) returned 1
	[0118.415] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AppWhite.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\appwhite.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AppWhite.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\appwhite.png.exe")) returned 1
	[0118.423] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AutoPlayOptIn.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\autoplayoptin.gif"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AutoPlayOptIn.gif.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\autoplayoptin.gif.exe")) returned 1
	[0118.456] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AutoPlayOptIn.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\autoplayoptin.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AutoPlayOptIn.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\autoplayoptin.png.exe")) returned 1
	[0118.459] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ElevatedAppBlue.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\elevatedappblue.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ElevatedAppBlue.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\elevatedappblue.png.exe")) returned 1
	[0118.462] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ElevatedAppWhite.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\elevatedappwhite.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ElevatedAppWhite.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\elevatedappwhite.png.exe")) returned 1
	[0118.465] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\Error.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\error.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\Error.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\error.png.exe")) returned 1
	[0118.590] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\OneDriveLogo.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\onedrivelogo.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\OneDriveLogo.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\onedrivelogo.png.exe")) returned 1
	[0118.593] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\OneDrivePersonal.cmd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\onedrivepersonal.cmd"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\OneDrivePersonal.cmd.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\onedrivepersonal.cmd.exe")) returned 1
	[0118.694] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\QuotaCritical.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\quotacritical.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\QuotaCritical.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\quotacritical.png.exe")) returned 1
	[0118.697] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\QuotaError.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\quotaerror.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\QuotaError.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\quotaerror.png.exe")) returned 1
	[0118.700] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\QuotaNearing.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\quotanearing.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\QuotaNearing.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\quotanearing.png.exe")) returned 1
	[0118.706] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ScreenshotOptIn.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\screenshotoptin.gif"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ScreenshotOptIn.gif.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\screenshotoptin.gif.exe")) returned 1
	[0118.711] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ThirdPartyNotices.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\thirdpartynotices.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ThirdPartyNotices.txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\thirdpartynotices.txt.exe")) returned 1
	[0118.715] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\Warning.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\warning.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\Warning.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\warning.png.exe")) returned 1
	[0118.819] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\alertIcon.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\alerticon.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\alertIcon.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\alerticon.png.exe")) returned 1
	[0118.827] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AppBlue.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\appblue.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AppBlue.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\appblue.png.exe")) returned 1
	[0118.830] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AppErrorBlue.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\apperrorblue.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AppErrorBlue.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\apperrorblue.png.exe")) returned 1
	[0118.834] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AppErrorWhite.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\apperrorwhite.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AppErrorWhite.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\apperrorwhite.png.exe")) returned 1
	[0118.836] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AppWhite.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\appwhite.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AppWhite.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\appwhite.png.exe")) returned 1
	[0118.845] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AutoPlayOptIn.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\autoplayoptin.gif"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AutoPlayOptIn.gif.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\autoplayoptin.gif.exe")) returned 1
	[0118.848] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AutoPlayOptIn.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\autoplayoptin.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AutoPlayOptIn.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\autoplayoptin.png.exe")) returned 1
	[0118.852] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\CollectSyncLogs.bat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\collectsynclogs.bat"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\CollectSyncLogs.bat.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\collectsynclogs.bat.exe")) returned 1
	[0118.855] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\ElevatedAppBlue.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\elevatedappblue.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\ElevatedAppBlue.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\elevatedappblue.png.exe")) returned 1
	[0118.929] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\ElevatedAppWhite.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\elevatedappwhite.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\ElevatedAppWhite.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\elevatedappwhite.png.exe")) returned 1
	[0118.965] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\Error.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\error.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\Error.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\error.png.exe")) returned 1
	[0118.968] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\ErrorPage.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\errorpage.html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\ErrorPage.html.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\errorpage.html.exe")) returned 1
	[0119.020] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\LoadingPage.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\loadingpage.html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\LoadingPage.html.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\loadingpage.html.exe")) returned 1
	[0119.023] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\OneDriveLogo.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\onedrivelogo.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\OneDriveLogo.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\onedrivelogo.png.exe")) returned 1
	[0119.041] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\alertIcon.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\alerticon.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\alertIcon.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\alerticon.png.exe")) returned 1
	[0119.095] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\AppBlue.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\appblue.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\AppBlue.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\appblue.png.exe")) returned 1
	[0119.099] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\AppErrorBlue.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\apperrorblue.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\AppErrorBlue.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\apperrorblue.png.exe")) returned 1
	[0119.103] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\AppErrorWhite.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\apperrorwhite.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\AppErrorWhite.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\apperrorwhite.png.exe")) returned 1
	[0119.105] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\AppWhite.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\appwhite.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\AppWhite.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\appwhite.png.exe")) returned 1
	[0119.121] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\AutoPlayOptIn.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\autoplayoptin.gif"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\AutoPlayOptIn.gif.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\autoplayoptin.gif.exe")) returned 1
	[0119.124] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\AutoPlayOptIn.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\autoplayoptin.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\AutoPlayOptIn.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\autoplayoptin.png.exe")) returned 1
	[0119.189] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ElevatedAppBlue.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\elevatedappblue.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ElevatedAppBlue.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\elevatedappblue.png.exe")) returned 1
	[0119.193] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ElevatedAppWhite.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\elevatedappwhite.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ElevatedAppWhite.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\elevatedappwhite.png.exe")) returned 1
	[0119.199] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\Error.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\error.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\Error.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\error.png.exe")) returned 1
	[0119.201] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ErrorPage.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\errorpage.html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ErrorPage.html.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\errorpage.html.exe")) returned 1
	[0119.340] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\images\\blurrect.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\images\\blurrect.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\images\\blurrect.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\images\\blurrect.png.exe")) returned 1
	[0119.438] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\LoadingPage.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\loadingpage.html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\LoadingPage.html.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\loadingpage.html.exe")) returned 1
	[0119.465] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\OneDriveLogo.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\onedrivelogo.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\OneDriveLogo.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\onedrivelogo.png.exe")) returned 1
	[0119.591] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\QuotaCritical.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\quotacritical.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\QuotaCritical.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\quotacritical.png.exe")) returned 1
	[0119.595] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\QuotaError.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\quotaerror.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\QuotaError.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\quotaerror.png.exe")) returned 1
	[0119.598] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\QuotaNearing.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\quotanearing.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\QuotaNearing.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\quotanearing.png.exe")) returned 1
	[0120.202] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ScreenshotOptIn.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\screenshotoptin.gif"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ScreenshotOptIn.gif.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\screenshotoptin.gif.exe")) returned 1
	[0120.229] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\TestSharePage.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\testsharepage.html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\TestSharePage.html.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\testsharepage.html.exe")) returned 1
	[0120.255] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ThirdPartyNotices.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\thirdpartynotices.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ThirdPartyNotices.txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\thirdpartynotices.txt.exe")) returned 1
	[0120.275] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\Warning.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\warning.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\Warning.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\warning.png.exe")) returned 1
	[0120.331] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\alertIcon.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\alerticon.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\alertIcon.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\alerticon.png.exe")) returned 1
	[0120.382] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\AppBlue.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\appblue.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\AppBlue.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\appblue.png.exe")) returned 1
	[0120.386] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\AppErrorBlue.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\apperrorblue.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\AppErrorBlue.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\apperrorblue.png.exe")) returned 1
	[0120.390] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\AppErrorWhite.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\apperrorwhite.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\AppErrorWhite.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\apperrorwhite.png.exe")) returned 1
	[0120.392] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\AppWhite.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\appwhite.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\AppWhite.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\appwhite.png.exe")) returned 1
	[0120.407] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\AutoPlayOptIn.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\autoplayoptin.gif"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\AutoPlayOptIn.gif.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\autoplayoptin.gif.exe")) returned 1
	[0120.411] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\AutoPlayOptIn.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\autoplayoptin.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\AutoPlayOptIn.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\autoplayoptin.png.exe")) returned 1
	[0120.455] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\CollectSyncLogs.bat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\collectsynclogs.bat"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\CollectSyncLogs.bat.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\collectsynclogs.bat.exe")) returned 1
	[0120.469] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ElevatedAppBlue.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\elevatedappblue.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ElevatedAppBlue.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\elevatedappblue.png.exe")) returned 1
	[0120.473] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ElevatedAppWhite.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\elevatedappwhite.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ElevatedAppWhite.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\elevatedappwhite.png.exe")) returned 1
	[0120.479] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\Error.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\error.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\Error.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\error.png.exe")) returned 1
	[0120.514] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ErrorPage.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\errorpage.html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ErrorPage.html.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\errorpage.html.exe")) returned 1
	[0120.644] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\images\\blurrect.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\images\\blurrect.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\images\\blurrect.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\images\\blurrect.png.exe")) returned 1
	[0120.695] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\LoadingPage.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\loadingpage.html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\LoadingPage.html.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\loadingpage.html.exe")) returned 1
	[0120.760] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\OneDriveLogo.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\onedrivelogo.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\OneDriveLogo.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\onedrivelogo.png.exe")) returned 1
	[0120.847] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\QuotaCritical.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\quotacritical.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\QuotaCritical.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\quotacritical.png.exe")) returned 1
	[0120.851] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\QuotaError.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\quotaerror.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\QuotaError.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\quotaerror.png.exe")) returned 1
	[0120.854] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\QuotaNearing.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\quotanearing.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\QuotaNearing.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\quotanearing.png.exe")) returned 1
	[0120.868] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ScreenshotOptIn.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\screenshotoptin.gif"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ScreenshotOptIn.gif.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\screenshotoptin.gif.exe")) returned 1
	[0120.968] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\TestSharePage.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\testsharepage.html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\TestSharePage.html.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\testsharepage.html.exe")) returned 1
	[0120.980] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ThirdPartyNotices.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\thirdpartynotices.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ThirdPartyNotices.txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\thirdpartynotices.txt.exe")) returned 1
	[0121.051] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\Warning.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\warning.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\Warning.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\warning.png.exe")) returned 1
	[0121.089] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\OneDrivePersonal.cmd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\onedrivepersonal.cmd"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\OneDrivePersonal.cmd.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\onedrivepersonal.cmd.exe")) returned 1
	[0121.306] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db.exe")) returned 1
	[0121.309] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.3.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\cversions.3.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.3.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\cversions.3.db.exe")) returned 1
	[0121.316] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{2B16BD47-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{2b16bd47-b905-4d30-88c9-b63c603da134}.3.ver0x0000000000000001.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{2B16BD47-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{2b16bd47-b905-4d30-88c9-b63c603da134}.3.ver0x0000000000000001.db.exe")) returned 1
	[0121.319] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000030.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.3.ver0x0000000000000030.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000030.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.3.ver0x0000000000000030.db.exe")) returned 1
	[0121.322] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000031.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.3.ver0x0000000000000031.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000031.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.3.ver0x0000000000000031.db.exe")) returned 1
	[0121.327] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001b.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001b.db.exe")) returned 1
	[0121.370] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001c.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001c.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db.exe")) returned 1
	[0121.373] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_1280.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_1280.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_1280.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_1280.db.exe")) returned 1
	[0121.396] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_16.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_16.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_16.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_16.db.exe")) returned 1
	[0121.398] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_1920.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_1920.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_1920.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_1920.db.exe")) returned 1
	[0121.460] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_256.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_256.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_256.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_256.db.exe")) returned 1
	[0121.462] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_2560.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_2560.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_2560.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_2560.db.exe")) returned 1
	[0121.543] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_32.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_32.db.exe")) returned 1
	[0121.620] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db.exe")) returned 1
	[0121.622] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_768.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_768.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_768.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_768.db.exe")) returned 1
	[0121.623] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_96.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_96.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_96.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_96.db.exe")) returned 1
	[0121.625] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_custom_stream.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_custom_stream.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_custom_stream.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_custom_stream.db.exe")) returned 1
	[0121.626] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_exif.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_exif.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_exif.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_exif.db.exe")) returned 1
	[0121.628] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db.exe")) returned 1
	[0121.629] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_sr.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_sr.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_sr.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_sr.db.exe")) returned 1
	[0121.630] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_wide.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_wide.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_wide.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_wide.db.exe")) returned 1
	[0121.632] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_wide_alternate.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_wide_alternate.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_wide_alternate.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_wide_alternate.db.exe")) returned 1
	[0121.634] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1280.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1280.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1280.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1280.db.exe")) returned 1
	[0121.694] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_16.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_16.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_16.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_16.db.exe")) returned 1
	[0121.696] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1920.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1920.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1920.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1920.db.exe")) returned 1
	[0121.759] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db.exe")) returned 1
	[0121.761] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_2560.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_2560.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_2560.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_2560.db.exe")) returned 1
	[0121.785] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db.exe")) returned 1
	[0121.849] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db.exe")) returned 1
	[0121.851] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_768.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_768.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_768.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_768.db.exe")) returned 1
	[0121.852] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db.exe")) returned 1
	[0121.854] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_custom_stream.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_custom_stream.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_custom_stream.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_custom_stream.db.exe")) returned 1
	[0121.855] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_exif.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_exif.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_exif.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_exif.db.exe")) returned 1
	[0121.857] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db.exe")) returned 1
	[0121.858] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db.exe")) returned 1
	[0121.859] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_wide.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_wide.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_wide.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_wide.db.exe")) returned 1
	[0121.860] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_wide_alternate.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_wide_alternate.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_wide_alternate.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_wide_alternate.db.exe")) returned 1
	[0122.022] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpndatabase.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\notifications\\wpndatabase.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpndatabase.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\notifications\\wpndatabase.db.exe")) returned 0
	[0122.027] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\353d8595.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\353d8595.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\353d8595.jpg.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\353d8595.jpg.exe")) returned 1
	[0122.034] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\ca910921.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\ca910921.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\ca910921.jpg.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\ca910921.jpg.exe")) returned 1
	[0122.191] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk.exe")) returned 1
	[0122.197] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk.exe")) returned 1
	[0122.199] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk.exe")) returned 1
	[0122.202] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk.exe")) returned 1
	[0122.204] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk.exe")) returned 1
	[0122.207] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk.exe")) returned 1
	[0122.213] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk.exe")) returned 1
	[0122.215] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk.exe")) returned 1
	[0122.218] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk.exe")) returned 1
	[0122.220] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk.exe")) returned 1
	[0122.259] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk.exe")) returned 1
	[0122.262] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk.exe")) returned 1
	[0122.265] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - Network Connections.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - network connections.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - Network Connections.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - network connections.lnk.exe")) returned 1
	[0122.267] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - NetworkStatus.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - networkstatus.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - NetworkStatus.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - networkstatus.lnk.exe")) returned 1
	[0122.269] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk.exe")) returned 1
	[0122.272] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - System.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - system.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - System.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - system.lnk.exe")) returned 1
	[0122.275] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - SystemAbout.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - systemabout.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - SystemAbout.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - systemabout.lnk.exe")) returned 1
	[0122.278] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk.exe")) returned 1
	[0122.280] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - Power Options.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - power options.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - Power Options.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - power options.lnk.exe")) returned 1
	[0122.282] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - PowerAndSleep.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - powerandsleep.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - PowerAndSleep.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - powerandsleep.lnk.exe")) returned 1
	[0122.285] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk.exe")) returned 1
	[0122.287] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - AppsAndFeatures.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - appsandfeatures.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - AppsAndFeatures.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - appsandfeatures.lnk.exe")) returned 1
	[0122.292] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - Programs and Features.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - programs and features.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - Programs and Features.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - programs and features.lnk.exe")) returned 1
	[0124.680] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\FE83WYZ0.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\fe83wyz0.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\FE83WYZ0.txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\fe83wyz0.txt.exe")) returned 1
	[0124.684] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\K7RPYYP8.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\k7rpyyp8.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\K7RPYYP8.txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\k7rpyyp8.txt.exe")) returned 1
	[0124.687] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\LA7BUP1E.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\la7bup1e.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\LA7BUP1E.txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\la7bup1e.txt.exe")) returned 1
	[0124.689] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\NBLJVIM8.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\nbljvim8.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\NBLJVIM8.txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\nbljvim8.txt.exe")) returned 1
	[0124.691] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\ODUED5IU.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\odued5iu.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\ODUED5IU.txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\odued5iu.txt.exe")) returned 1
	[0124.695] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\S7Q1EH8Y.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\s7q1eh8y.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\S7Q1EH8Y.txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\s7q1eh8y.txt.exe")) returned 1
	[0124.697] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\UZ3Q0402.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\uz3q0402.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\UZ3Q0402.txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\uz3q0402.txt.exe")) returned 1
	[0125.273] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\AFIOGFFU.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\afiogffu.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\AFIOGFFU.txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\afiogffu.txt.exe")) returned 1
	[0125.980] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\1\\1e1979ca[1].js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\1\\1e1979ca[1].js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\1\\1e1979ca[1].js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\1\\1e1979ca[1].js.exe")) returned 1
	[0125.985] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\1\\532febaf[1].js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\1\\532febaf[1].js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\1\\532febaf[1].js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\1\\532febaf[1].js.exe")) returned 1
	[0125.990] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\1\\5c10c077[1].js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\1\\5c10c077[1].js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\1\\5c10c077[1].js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\1\\5c10c077[1].js.exe")) returned 1
	[0125.996] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\1\\7023c300[1].js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\1\\7023c300[1].js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\1\\7023c300[1].js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\1\\7023c300[1].js.exe")) returned 1
	[0125.999] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\1\\9101d3f2[1].js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\1\\9101d3f2[1].js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\1\\9101d3f2[1].js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\1\\9101d3f2[1].js.exe")) returned 1
	[0126.002] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\1\\d11fd6a0[1].js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\1\\d11fd6a0[1].js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\1\\d11fd6a0[1].js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\1\\d11fd6a0[1].js.exe")) returned 1
	[0126.074] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\1\\d1fe715e[1].js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\1\\d1fe715e[1].js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\1\\d1fe715e[1].js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\1\\d1fe715e[1].js.exe")) returned 1
	[0126.077] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\1\\e7f9dc5e[1].js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\1\\e7f9dc5e[1].js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\1\\e7f9dc5e[1].js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\1\\e7f9dc5e[1].js.exe")) returned 1
	[0126.121] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\1\\Init[1].htm" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\1\\init[1].htm"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\1\\Init[1].htm.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\1\\init[1].htm.exe")) returned 1
	[0126.129] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\3\\143a16e0[1].js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\3\\143a16e0[1].js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\3\\143a16e0[1].js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\3\\143a16e0[1].js.exe")) returned 1
	[0126.133] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\3\\2d76cad7[1].js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\3\\2d76cad7[1].js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\3\\2d76cad7[1].js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\3\\2d76cad7[1].js.exe")) returned 1
	[0126.137] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\3\\532febaf[1].js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\3\\532febaf[1].js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\3\\532febaf[1].js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\3\\532febaf[1].js.exe")) returned 1
	[0126.141] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\3\\7023c300[1].js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\3\\7023c300[1].js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\3\\7023c300[1].js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\3\\7023c300[1].js.exe")) returned 1
	[0126.143] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\3\\7590ff4a[1].js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\3\\7590ff4a[1].js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\3\\7590ff4a[1].js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\3\\7590ff4a[1].js.exe")) returned 1
	[0126.146] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\3\\9101d3f2[1].js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\3\\9101d3f2[1].js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\3\\9101d3f2[1].js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\3\\9101d3f2[1].js.exe")) returned 1
	[0126.151] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\3\\cf4a24b4[1].js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\3\\cf4a24b4[1].js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\3\\cf4a24b4[1].js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\3\\cf4a24b4[1].js.exe")) returned 1
	[0126.154] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\3\\d1fe715e[1].js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\3\\d1fe715e[1].js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\3\\d1fe715e[1].js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\3\\d1fe715e[1].js.exe")) returned 1
	[0126.157] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\3\\e7f9dc5e[1].js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\3\\e7f9dc5e[1].js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\3\\e7f9dc5e[1].js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\3\\e7f9dc5e[1].js.exe")) returned 1
	[0126.200] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\3\\Init[1].htm" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\3\\init[1].htm"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\3\\Init[1].htm.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\3\\init[1].htm.exe")) returned 1
	[0127.096] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\2\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_COOBE_COOBE[1].html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\2\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_coobe_coobe[1].html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\2\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_COOBE_COOBE[1].html.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\2\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_coobe_coobe[1].html.exe")) returned 1
	[0127.100] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\2\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_COOBE_CortanaIcon[1].png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\2\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_coobe_cortanaicon[1].png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\2\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_COOBE_CortanaIcon[1].png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\2\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_coobe_cortanaicon[1].png.exe")) returned 1
	[0127.107] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_10[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_10[1].txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_10[1].txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_10[1].txt.exe")) returned 1
	[0127.110] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_11[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_11[1].txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_11[1].txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_11[1].txt.exe")) returned 1
	[0127.113] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_12[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_12[1].txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_12[1].txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_12[1].txt.exe")) returned 1
	[0127.116] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_13[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_13[1].txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_13[1].txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_13[1].txt.exe")) returned 1
	[0127.126] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_14[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_14[1].txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_14[1].txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_14[1].txt.exe")) returned 1
	[0127.169] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_15[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_15[1].txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_15[1].txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_15[1].txt.exe")) returned 1
	[0127.174] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_16[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_16[1].txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_16[1].txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_16[1].txt.exe")) returned 1
	[0127.178] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_17[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_17[1].txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_17[1].txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_17[1].txt.exe")) returned 1
	[0127.183] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_18[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_18[1].txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_18[1].txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_18[1].txt.exe")) returned 1
	[0127.235] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_19[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_19[1].txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_19[1].txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_19[1].txt.exe")) returned 1
	[0127.239] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_20[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_20[1].txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_20[1].txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_20[1].txt.exe")) returned 1
	[0127.244] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_2[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_2[1].txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_2[1].txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_2[1].txt.exe")) returned 1
	[0127.247] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_3[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_3[1].txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_3[1].txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_3[1].txt.exe")) returned 1
	[0127.290] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_4[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_4[1].txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_4[1].txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_4[1].txt.exe")) returned 1
	[0127.294] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_5[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_5[1].txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_5[1].txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_5[1].txt.exe")) returned 1
	[0127.300] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_6[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_6[1].txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_6[1].txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_6[1].txt.exe")) returned 1
	[0127.303] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_7[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_7[1].txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_7[1].txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_7[1].txt.exe")) returned 1
	[0127.307] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_8[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_8[1].txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_8[1].txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_8[1].txt.exe")) returned 1
	[0127.310] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_9[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_9[1].txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_9[1].txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_9[1].txt.exe")) returned 1
	[0127.445] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\0.0.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\0.0.filtertrie.intermediate.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\0.0.filtertrie.intermediate.txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\0.0.filtertrie.intermediate.txt.exe")) returned 1
	[0127.454] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\0.0.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\0.0.filtertrie.intermediate.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\0.0.filtertrie.intermediate.txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\0.0.filtertrie.intermediate.txt.exe")) returned 1
	[0127.461] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.0.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.0.filtertrie.intermediate.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.0.filtertrie.intermediate.txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.0.filtertrie.intermediate.txt.exe")) returned 1
	[0127.469] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsconversions.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsconversions.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsconversions.txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsconversions.txt.exe")) returned 1
	[0127.663] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsglobals.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsglobals.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsglobals.txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsglobals.txt.exe")) returned 1
	[0127.779] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appssynonyms.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appssynonyms.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appssynonyms.txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appssynonyms.txt.exe")) returned 1
	[0128.025] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsconversions.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsconversions.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsconversions.txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsconversions.txt.exe")) returned 1
	[0128.031] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsglobals.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsglobals.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsglobals.txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsglobals.txt.exe")) returned 1
	[0128.034] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingssynonyms.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingssynonyms.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingssynonyms.txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingssynonyms.txt.exe")) returned 1
	[0128.040] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.0.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.0.filtertrie.intermediate.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.0.filtertrie.intermediate.txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.0.filtertrie.intermediate.txt.exe")) returned 1
	[0128.047] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.0.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.0.filtertrie.intermediate.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.0.filtertrie.intermediate.txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.0.filtertrie.intermediate.txt.exe")) returned 1
	[0128.056] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache131509115860744759.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache131509115860744759.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache131509115860744759.txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache131509115860744759.txt.exe")) returned 1
	[0128.062] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\SettingsCache.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\settingscache.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\SettingsCache.txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\settingscache.txt.exe")) returned 1
	[0129.665] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\-_kcri.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\-_kcri.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\-_kcri.mp3.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\-_kcri.mp3.exe")) returned 1
	[0129.668] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1e5_OxjUXE_ea1.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\1e5_oxjuxe_ea1.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1e5_OxjUXE_ea1.mkv.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\1e5_oxjuxe_ea1.mkv.exe")) returned 1
	[0129.670] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\38p8I8zBS-.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\38p8i8zbs-.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\38p8I8zBS-.bmp.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\38p8i8zbs-.bmp.exe")) returned 1
	[0129.672] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\3KCMVy.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\3kcmvy.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\3KCMVy.mp4.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\3kcmvy.mp4.exe")) returned 1
	[0129.675] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\6k6kMlOo.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\6k6kmloo.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\6k6kMlOo.mp3.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\6k6kmloo.mp3.exe")) returned 1
	[0129.677] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\6Q71_lOyQr4k7_.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\6q71_loyqr4k7_.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\6Q71_lOyQr4k7_.jpg.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\6q71_loyqr4k7_.jpg.exe")) returned 1
	[0129.712] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\AFyFn_kJxuNWa3.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\afyfn_kjxunwa3.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\AFyFn_kJxuNWa3.mp3.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\afyfn_kjxunwa3.mp3.exe")) returned 1
	[0129.716] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\avwUix.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\avwuix.flv"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\avwUix.flv.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\avwuix.flv.exe")) returned 1
	[0129.719] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\C4kFxH.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\c4kfxh.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\C4kFxH.mp3.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\c4kfxh.mp3.exe")) returned 1
	[0129.721] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ClWwWAd1s24qm4.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\clwwwad1s24qm4.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ClWwWAd1s24qm4.jpg.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\clwwwad1s24qm4.jpg.exe")) returned 1
	[0129.724] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\d OxDuzU01L5a4SDT.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\d oxduzu01l5a4sdt.gif"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\d OxDuzU01L5a4SDT.gif.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\d oxduzu01l5a4sdt.gif.exe")) returned 1
	[0129.726] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\DiINYm-ij6gv.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\diinym-ij6gv.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\DiINYm-ij6gv.mp3.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\diinym-ij6gv.mp3.exe")) returned 1
	[0129.729] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ePTruH0YQkf.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\eptruh0yqkf.swf"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ePTruH0YQkf.swf.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\eptruh0yqkf.swf.exe")) returned 1
	[0129.731] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Gedk3UYgLax.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\gedk3uyglax.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Gedk3UYgLax.jpg.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\gedk3uyglax.jpg.exe")) returned 1
	[0129.733] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\GWL2cmKlw3.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\gwl2cmklw3.swf"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\GWL2cmKlw3.swf.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\gwl2cmklw3.swf.exe")) returned 1
	[0129.736] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ilID5R zOsDp3lHe.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\ilid5r zosdp3lhe.swf"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ilID5R zOsDp3lHe.swf.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\ilid5r zosdp3lhe.swf.exe")) returned 1
	[0129.738] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\J1fJes3g.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\j1fjes3g.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\J1fJes3g.bmp.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\j1fjes3g.bmp.exe")) returned 1
	[0129.740] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\MwqqL-PBDCvQ6-hLu_B.xlsx" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\mwqql-pbdcvq6-hlu_b.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\MwqqL-PBDCvQ6-hLu_B.xlsx.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\mwqql-pbdcvq6-hlu_b.xlsx.exe")) returned 1
	[0129.742] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Pb_7-6q0w.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\pb_7-6q0w.flv"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Pb_7-6q0w.flv.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\pb_7-6q0w.flv.exe")) returned 1
	[0129.744] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\PKEIbH.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\pkeibh.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\PKEIbH.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\pkeibh.png.exe")) returned 1
	[0129.747] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\r-tLRypLTzE6n  ObDRC.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\r-tlrypltze6n  obdrc.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\r-tLRypLTzE6n  ObDRC.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\r-tlrypltze6n  obdrc.png.exe")) returned 1
	[0129.749] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\sSYCu-EzTLi Vq7Nuv.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\ssycu-eztli vq7nuv.wav"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\sSYCu-EzTLi Vq7Nuv.wav.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\ssycu-eztli vq7nuv.wav.exe")) returned 1
	[0129.751] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\uoZ1M0mOE.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\uoz1m0moe.wav"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\uoZ1M0mOE.wav.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\uoz1m0moe.wav.exe")) returned 1
	[0129.753] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\XHoyL5C3cvsab_3QY.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\xhoyl5c3cvsab_3qy.swf"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\XHoyL5C3cvsab_3QY.swf.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\xhoyl5c3cvsab_3qy.swf.exe")) returned 1
	[0129.755] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\zLClpI1EcUMTu60DyK.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\zlclpi1ecumtu60dyk.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\zLClpI1EcUMTu60DyK.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\zlclpi1ecumtu60dyk.png.exe")) returned 1
	[0130.124] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ZwCshGkLwvyeq 8zt2.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\zwcshgklwvyeq 8zt2.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ZwCshGkLwvyeq 8zt2.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\zwcshgklwvyeq 8zt2.png.exe")) returned 1
	[0130.222] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\5Pf4TxahR9WsaTCzP.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\5pf4txahr9wsatczp.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\5Pf4TxahR9WsaTCzP.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\5pf4txahr9wsatczp.png.exe")) returned 1
	[0130.225] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\9uYV4Y.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\9uyv4y.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\9uYV4Y.mkv.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\9uyv4y.mkv.exe")) returned 1
	[0130.231] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\9xmS3i0qDrQ_ZlbJ0.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\9xms3i0qdrq_zlbj0.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\9xmS3i0qDrQ_ZlbJ0.mp4.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\9xms3i0qdrq_zlbj0.mp4.exe")) returned 1
	[0130.295] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ApmbpSTOTbb2z1Qn.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\apmbpstotbb2z1qn.wav"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ApmbpSTOTbb2z1Qn.wav.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\apmbpstotbb2z1qn.wav.exe")) returned 1
	[0130.298] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\aUOtqx7hzAwfKBhCG.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\auotqx7hzawfkbhcg.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\aUOtqx7hzAwfKBhCG.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\auotqx7hzawfkbhcg.png.exe")) returned 1
	[0130.301] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\eweJnzD.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ewejnzd.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\eweJnzD.mp3.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ewejnzd.mp3.exe")) returned 1
	[0130.303] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ewsELZc.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ewselzc.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ewsELZc.jpg.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ewselzc.jpg.exe")) returned 1
	[0130.305] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\HARhPro.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\harhpro.flv"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\HARhPro.flv.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\harhpro.flv.exe")) returned 1
	[0130.307] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\jUzjvbgRnRyNHliB6Kj0.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\juzjvbgrnrynhlib6kj0.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\jUzjvbgRnRyNHliB6Kj0.mp4.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\juzjvbgrnrynhlib6kj0.mp4.exe")) returned 1
	[0130.309] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\jzJTpHvC8SNZeOoEsMt.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\jzjtphvc8snzeooesmt.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\jzJTpHvC8SNZeOoEsMt.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\jzjtphvc8snzeooesmt.png.exe")) returned 1
	[0130.311] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\kDbRGf-kSEY.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\kdbrgf-ksey.swf"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\kDbRGf-kSEY.swf.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\kdbrgf-ksey.swf.exe")) returned 1
	[0130.314] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\KnU66e4Ps.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\knu66e4ps.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\KnU66e4Ps.mp4.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\knu66e4ps.mp4.exe")) returned 1
	[0130.316] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\L7WI.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\l7wi.swf"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\L7WI.swf.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\l7wi.swf.exe")) returned 1
	[0130.318] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\lVIopc6TrRy.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\lviopc6trry.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\lVIopc6TrRy.jpg.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\lviopc6trry.jpg.exe")) returned 1
	[0130.320] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\L_-n3eV.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\l_-n3ev.flv"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\L_-n3eV.flv.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\l_-n3ev.flv.exe")) returned 1
	[0130.322] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\M-_3LzfTzbFFZ_yM.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\m-_3lzftzbffz_ym.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\M-_3LzfTzbFFZ_yM.bmp.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\m-_3lzftzbffz_ym.bmp.exe")) returned 1
	[0130.387] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk.exe")) returned 1
	[0130.392] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\microsoft outlook.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\microsoft outlook.lnk.exe")) returned 1
	[0130.394] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.exe")) returned 1
	[0130.427] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\file explorer.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\file explorer.lnk.exe")) returned 1
	[0130.430] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.exe")) returned 1
	[0130.488] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\con2.LNK" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\con2.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\con2.LNK.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\con2.lnk.exe")) returned 1
	[0130.495] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Database1.LNK" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\database1.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Database1.LNK.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\database1.lnk.exe")) returned 1
	[0130.499] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Documents.LNK" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\documents.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Documents.LNK.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\documents.lnk.exe")) returned 1
	[0130.502] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\global.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\global.lnk.exe")) returned 1
	[0130.505] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\templates.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\templates.lnk.exe")) returned 1
	[0130.604] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline\\ConsoleHost_history.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\powershell\\psreadline\\consolehost_history.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline\\ConsoleHost_history.txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\powershell\\psreadline\\consolehost_history.txt.exe")) returned 1
	[0130.607] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0I6iV1JNRFTVkRb_P (2).lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\0i6iv1jnrftvkrb_p (2).lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0I6iV1JNRFTVkRb_P (2).lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\0i6iv1jnrftvkrb_p (2).lnk.exe")) returned 1
	[0130.609] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0I6iV1JNRFTVkRb_P.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\0i6iv1jnrftvkrb_p.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0I6iV1JNRFTVkRb_P.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\0i6iv1jnrftvkrb_p.lnk.exe")) returned 1
	[0130.611] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0ZtJsTkmMJ1t.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\0ztjstkmmj1t.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0ZtJsTkmMJ1t.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\0ztjstkmmj1t.lnk.exe")) returned 1
	[0130.612] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\17-4bow-5 tANaCT.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\17-4bow-5 tanact.flv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\17-4bow-5 tANaCT.flv.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\17-4bow-5 tanact.flv.lnk.exe")) returned 1
	[0130.614] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2y4nPoi3R.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\2y4npoi3r.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2y4nPoi3R.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\2y4npoi3r.lnk.exe")) returned 1
	[0130.616] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\38rwBzbr0qCk1.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\38rwbzbr0qck1.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\38rwBzbr0qCk1.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\38rwbzbr0qck1.lnk.exe")) returned 1
	[0130.618] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5fmstzDpGLAWOYy.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\5fmstzdpglawoyy.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5fmstzDpGLAWOYy.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\5fmstzdpglawoyy.lnk.exe")) returned 1
	[0130.619] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5v65dyXNB-dHFbYcIBoN.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\5v65dyxnb-dhfbycibon.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5v65dyXNB-dHFbYcIBoN.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\5v65dyxnb-dhfbycibon.lnk.exe")) returned 1
	[0130.621] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5xoCiSrZl8nw-zT.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\5xocisrzl8nw-zt.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5xoCiSrZl8nw-zT.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\5xocisrzl8nw-zt.lnk.exe")) returned 1
	[0130.623] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6jHmyJd7xe.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\6jhmyjd7xe.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6jHmyJd7xe.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\6jhmyjd7xe.lnk.exe")) returned 1
	[0130.624] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6rbIhn.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\6rbihn.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6rbIhn.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\6rbihn.lnk.exe")) returned 1
	[0130.626] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6rSn1iM NDaJk5HYEZ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\6rsn1im ndajk5hyez.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6rSn1iM NDaJk5HYEZ.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\6rsn1im ndajk5hyez.lnk.exe")) returned 1
	[0130.628] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8cFETdC_9V.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\8cfetdc_9v.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8cFETdC_9V.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\8cfetdc_9v.lnk.exe")) returned 1
	[0130.629] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8oHL_6.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\8ohl_6.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8oHL_6.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\8ohl_6.lnk.exe")) returned 1
	[0130.630] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8s0u2AZ3VngkS.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\8s0u2az3vngks.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8s0u2AZ3VngkS.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\8s0u2az3vngks.lnk.exe")) returned 1
	[0130.632] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8UFcG-haiTpskJzQ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\8ufcg-haitpskjzq.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8UFcG-haiTpskJzQ.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\8ufcg-haitpskjzq.lnk.exe")) returned 1
	[0130.641] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9uYV4Y.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\9uyv4y.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9uYV4Y.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\9uyv4y.lnk.exe")) returned 1
	[0130.643] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9xmS3i0qDrQ_ZlbJ0.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\9xms3i0qdrq_zlbj0.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9xmS3i0qDrQ_ZlbJ0.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\9xms3i0qdrq_zlbj0.lnk.exe")) returned 1
	[0130.645] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a5ZVQwSnbNnbraZsk7F.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\a5zvqwsnbnnbrazsk7f.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a5ZVQwSnbNnbraZsk7F.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\a5zvqwsnbnnbrazsk7f.lnk.exe")) returned 1
	[0132.027] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AcMmOUQFXz5DQzxJ-oW.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\acmmouqfxz5dqzxj-ow.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AcMmOUQFXz5DQzxJ-oW.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\acmmouqfxz5dqzxj-ow.lnk.exe")) returned 1
	[0132.029] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\atfjcCBXW9fwwxL.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\atfjccbxw9fwwxl.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\atfjcCBXW9fwwxL.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\atfjccbxw9fwwxl.lnk.exe")) returned 1
	[0132.031] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aUOtqx7hzAwfKBhCG.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\auotqx7hzawfkbhcg.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aUOtqx7hzAwfKBhCG.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\auotqx7hzawfkbhcg.lnk.exe")) returned 1
	[0132.036] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AYPQs.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\aypqs.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AYPQs.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\aypqs.lnk.exe")) returned 1
	[0132.042] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BJ5lap_JfLplCeloeBpz.lnk", pszSpec="*.zip") returned 0
	[0132.042] lstrlenA (lpString="*.zip") returned 5
	[0132.042] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BJ5lap_JfLplCeloeBpz.lnk", pszSpec="*.rar") returned 0
	[0132.042] lstrlenA (lpString="*.rar") returned 5
	[0132.042] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BJ5lap_JfLplCeloeBpz.lnk", pszSpec="*.7z") returned 0
	[0132.042] lstrlenA (lpString="*.7z") returned 4
	[0132.043] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BJ5lap_JfLplCeloeBpz.lnk", pszSpec="*.tar") returned 0
	[0132.043] lstrlenA (lpString="*.tar") returned 5
	[0132.043] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BJ5lap_JfLplCeloeBpz.lnk", pszSpec="*.gzip") returned 0
	[0132.043] lstrlenA (lpString="*.gzip") returned 6
	[0132.043] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BJ5lap_JfLplCeloeBpz.lnk", pszSpec="*.jpg") returned 0
	[0132.043] lstrlenA (lpString="*.jpg") returned 5
	[0132.043] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BJ5lap_JfLplCeloeBpz.lnk", pszSpec="*.jpeg") returned 0
	[0132.043] lstrlenA (lpString="*.jpeg") returned 6
	[0132.043] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BJ5lap_JfLplCeloeBpz.lnk", pszSpec="*.bmp") returned 0
	[0132.043] lstrlenA (lpString="*.bmp") returned 5
	[0132.043] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BJ5lap_JfLplCeloeBpz.lnk", pszSpec="*.gif") returned 0
	[0132.043] lstrlenA (lpString="*.gif") returned 5
	[0132.043] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BJ5lap_JfLplCeloeBpz.lnk", pszSpec="*.png") returned 0
	[0132.043] lstrlenA (lpString="*.png") returned 5
	[0132.043] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BJ5lap_JfLplCeloeBpz.lnk", pszSpec="*.doc") returned 0
	[0132.043] lstrlenA (lpString="*.doc") returned 5
	[0132.043] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BJ5lap_JfLplCeloeBpz.lnk", pszSpec="*.docx") returned 0
	[0132.043] lstrlenA (lpString="*.docx") returned 6
	[0132.043] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BJ5lap_JfLplCeloeBpz.lnk", pszSpec="*.xls") returned 0
	[0132.043] lstrlenA (lpString="*.xls") returned 5
	[0132.043] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BJ5lap_JfLplCeloeBpz.lnk", pszSpec="*.xlsx") returned 0
	[0132.043] lstrlenA (lpString="*.xlsx") returned 6
	[0132.043] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BJ5lap_JfLplCeloeBpz.lnk", pszSpec="*.ppt") returned 0
	[0132.043] lstrlenA (lpString="*.ppt") returned 5
	[0132.043] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BJ5lap_JfLplCeloeBpz.lnk", pszSpec="*.pptx") returned 0
	[0132.043] lstrlenA (lpString="*.pptx") returned 6
	[0132.043] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BJ5lap_JfLplCeloeBpz.lnk", pszSpec="*.txt") returned 0
	[0132.043] lstrlenA (lpString="*.txt") returned 5
	[0132.043] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BJ5lap_JfLplCeloeBpz.lnk", pszSpec="*.pdf") returned 0
	[0132.043] lstrlenA (lpString="*.pdf") returned 5
	[0132.043] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BJ5lap_JfLplCeloeBpz.lnk", pszSpec="*.htm") returned 0
	[0132.043] lstrlenA (lpString="*.htm") returned 5
	[0132.043] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BJ5lap_JfLplCeloeBpz.lnk", pszSpec="*.html") returned 0
	[0132.043] lstrlenA (lpString="*.html") returned 6
	[0132.043] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BJ5lap_JfLplCeloeBpz.lnk", pszSpec="*.mdb") returned 0
	[0132.043] lstrlenA (lpString="*.mdb") returned 5
	[0132.043] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BJ5lap_JfLplCeloeBpz.lnk", pszSpec="*.pfx") returned 0
	[0132.043] lstrlenA (lpString="*.pfx") returned 5
	[0132.044] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BJ5lap_JfLplCeloeBpz.lnk", pszSpec="*.md") returned 0
	[0132.044] lstrlenA (lpString="*.md") returned 4
	[0132.044] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BJ5lap_JfLplCeloeBpz.lnk", pszSpec="*.lnk") returned 1
	[0132.044] lstrlenA (lpString="*.lnk") returned 5
	[0132.045] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BJ5lap_JfLplCeloeBpz.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bj5lap_jflplceloebpz.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BJ5lap_JfLplCeloeBpz.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bj5lap_jflplceloebpz.lnk.exe")) returned 1
	[0132.046] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Btbl.lnk") returned 1
	[0132.046] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Btbl.lnk") returned 1
	[0132.046] lstrcmpiA (lpString1="", lpString2="Btbl.lnk") returned -1
	[0132.046] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Btbl.lnk", pszSpec="*.zip") returned 0
	[0132.046] lstrlenA (lpString="*.zip") returned 5
	[0132.046] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Btbl.lnk", pszSpec="*.rar") returned 0
	[0132.046] lstrlenA (lpString="*.rar") returned 5
	[0132.046] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Btbl.lnk", pszSpec="*.7z") returned 0
	[0132.046] lstrlenA (lpString="*.7z") returned 4
	[0132.046] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Btbl.lnk", pszSpec="*.tar") returned 0
	[0132.046] lstrlenA (lpString="*.tar") returned 5
	[0132.046] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Btbl.lnk", pszSpec="*.gzip") returned 0
	[0132.046] lstrlenA (lpString="*.gzip") returned 6
	[0132.046] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Btbl.lnk", pszSpec="*.jpg") returned 0
	[0132.046] lstrlenA (lpString="*.jpg") returned 5
	[0132.046] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Btbl.lnk", pszSpec="*.jpeg") returned 0
	[0132.046] lstrlenA (lpString="*.jpeg") returned 6
	[0132.046] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Btbl.lnk", pszSpec="*.bmp") returned 0
	[0132.046] lstrlenA (lpString="*.bmp") returned 5
	[0132.046] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Btbl.lnk", pszSpec="*.gif") returned 0
	[0132.046] lstrlenA (lpString="*.gif") returned 5
	[0132.046] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Btbl.lnk", pszSpec="*.png") returned 0
	[0132.046] lstrlenA (lpString="*.png") returned 5
	[0132.046] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Btbl.lnk", pszSpec="*.doc") returned 0
	[0132.046] lstrlenA (lpString="*.doc") returned 5
	[0132.046] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Btbl.lnk", pszSpec="*.docx") returned 0
	[0132.047] lstrlenA (lpString="*.docx") returned 6
	[0132.047] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Btbl.lnk", pszSpec="*.xls") returned 0
	[0132.047] lstrlenA (lpString="*.xls") returned 5
	[0132.047] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Btbl.lnk", pszSpec="*.xlsx") returned 0
	[0132.047] lstrlenA (lpString="*.xlsx") returned 6
	[0132.047] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Btbl.lnk", pszSpec="*.ppt") returned 0
	[0132.047] lstrlenA (lpString="*.ppt") returned 5
	[0132.047] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Btbl.lnk", pszSpec="*.pptx") returned 0
	[0132.047] lstrlenA (lpString="*.pptx") returned 6
	[0132.047] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Btbl.lnk", pszSpec="*.txt") returned 0
	[0132.047] lstrlenA (lpString="*.txt") returned 5
	[0132.047] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Btbl.lnk", pszSpec="*.pdf") returned 0
	[0132.047] lstrlenA (lpString="*.pdf") returned 5
	[0132.047] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Btbl.lnk", pszSpec="*.htm") returned 0
	[0132.047] lstrlenA (lpString="*.htm") returned 5
	[0132.047] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Btbl.lnk", pszSpec="*.html") returned 0
	[0132.047] lstrlenA (lpString="*.html") returned 6
	[0132.047] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Btbl.lnk", pszSpec="*.mdb") returned 0
	[0132.047] lstrlenA (lpString="*.mdb") returned 5
	[0132.047] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Btbl.lnk", pszSpec="*.pfx") returned 0
	[0132.047] lstrlenA (lpString="*.pfx") returned 5
	[0132.047] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Btbl.lnk", pszSpec="*.md") returned 0
	[0132.047] lstrlenA (lpString="*.md") returned 4
	[0132.047] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Btbl.lnk", pszSpec="*.lnk") returned 1
	[0132.047] lstrlenA (lpString="*.lnk") returned 5
	[0132.048] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Btbl.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\btbl.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Btbl.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\btbl.lnk.exe")) returned 1
	[0132.049] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="cLAZZ1.lnk") returned 1
	[0132.049] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="cLAZZ1.lnk") returned 1
	[0132.049] lstrcmpiA (lpString1="", lpString2="cLAZZ1.lnk") returned -1
	[0132.049] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cLAZZ1.lnk", pszSpec="*.zip") returned 0
	[0132.049] lstrlenA (lpString="*.zip") returned 5
	[0132.049] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cLAZZ1.lnk", pszSpec="*.rar") returned 0
	[0132.049] lstrlenA (lpString="*.rar") returned 5
	[0132.049] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cLAZZ1.lnk", pszSpec="*.7z") returned 0
	[0132.049] lstrlenA (lpString="*.7z") returned 4
	[0132.049] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cLAZZ1.lnk", pszSpec="*.tar") returned 0
	[0132.049] lstrlenA (lpString="*.tar") returned 5
	[0132.049] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cLAZZ1.lnk", pszSpec="*.gzip") returned 0
	[0132.049] lstrlenA (lpString="*.gzip") returned 6
	[0132.049] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cLAZZ1.lnk", pszSpec="*.jpg") returned 0
	[0132.049] lstrlenA (lpString="*.jpg") returned 5
	[0132.049] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cLAZZ1.lnk", pszSpec="*.jpeg") returned 0
	[0132.049] lstrlenA (lpString="*.jpeg") returned 6
	[0132.049] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cLAZZ1.lnk", pszSpec="*.bmp") returned 0
	[0132.049] lstrlenA (lpString="*.bmp") returned 5
	[0132.049] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cLAZZ1.lnk", pszSpec="*.gif") returned 0
	[0132.049] lstrlenA (lpString="*.gif") returned 5
	[0132.049] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cLAZZ1.lnk", pszSpec="*.png") returned 0
	[0132.050] lstrlenA (lpString="*.png") returned 5
	[0132.050] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cLAZZ1.lnk", pszSpec="*.doc") returned 0
	[0132.050] lstrlenA (lpString="*.doc") returned 5
	[0132.050] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cLAZZ1.lnk", pszSpec="*.docx") returned 0
	[0132.050] lstrlenA (lpString="*.docx") returned 6
	[0132.050] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cLAZZ1.lnk", pszSpec="*.xls") returned 0
	[0132.050] lstrlenA (lpString="*.xls") returned 5
	[0132.050] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cLAZZ1.lnk", pszSpec="*.xlsx") returned 0
	[0132.050] lstrlenA (lpString="*.xlsx") returned 6
	[0132.050] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cLAZZ1.lnk", pszSpec="*.ppt") returned 0
	[0132.050] lstrlenA (lpString="*.ppt") returned 5
	[0132.050] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cLAZZ1.lnk", pszSpec="*.pptx") returned 0
	[0132.050] lstrlenA (lpString="*.pptx") returned 6
	[0132.050] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cLAZZ1.lnk", pszSpec="*.txt") returned 0
	[0132.050] lstrlenA (lpString="*.txt") returned 5
	[0132.050] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cLAZZ1.lnk", pszSpec="*.pdf") returned 0
	[0132.050] lstrlenA (lpString="*.pdf") returned 5
	[0132.050] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cLAZZ1.lnk", pszSpec="*.htm") returned 0
	[0132.050] lstrlenA (lpString="*.htm") returned 5
	[0132.050] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cLAZZ1.lnk", pszSpec="*.html") returned 0
	[0132.050] lstrlenA (lpString="*.html") returned 6
	[0132.050] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cLAZZ1.lnk", pszSpec="*.mdb") returned 0
	[0132.050] lstrlenA (lpString="*.mdb") returned 5
	[0132.050] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cLAZZ1.lnk", pszSpec="*.pfx") returned 0
	[0132.050] lstrlenA (lpString="*.pfx") returned 5
	[0132.050] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cLAZZ1.lnk", pszSpec="*.md") returned 0
	[0132.050] lstrlenA (lpString="*.md") returned 4
	[0132.050] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cLAZZ1.lnk", pszSpec="*.lnk") returned 1
	[0132.050] lstrlenA (lpString="*.lnk") returned 5
	[0132.051] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cLAZZ1.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\clazz1.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cLAZZ1.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\clazz1.lnk.exe")) returned 1
	[0132.052] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="cOFMPoe6EpAuu.lnk") returned 1
	[0132.052] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="cOFMPoe6EpAuu.lnk") returned 1
	[0132.052] lstrcmpiA (lpString1="", lpString2="cOFMPoe6EpAuu.lnk") returned -1
	[0132.052] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cOFMPoe6EpAuu.lnk", pszSpec="*.zip") returned 0
	[0132.052] lstrlenA (lpString="*.zip") returned 5
	[0132.052] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cOFMPoe6EpAuu.lnk", pszSpec="*.rar") returned 0
	[0132.052] lstrlenA (lpString="*.rar") returned 5
	[0132.052] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cOFMPoe6EpAuu.lnk", pszSpec="*.7z") returned 0
	[0132.052] lstrlenA (lpString="*.7z") returned 4
	[0132.052] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cOFMPoe6EpAuu.lnk", pszSpec="*.tar") returned 0
	[0132.052] lstrlenA (lpString="*.tar") returned 5
	[0132.052] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cOFMPoe6EpAuu.lnk", pszSpec="*.gzip") returned 0
	[0132.052] lstrlenA (lpString="*.gzip") returned 6
	[0132.052] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cOFMPoe6EpAuu.lnk", pszSpec="*.jpg") returned 0
	[0132.052] lstrlenA (lpString="*.jpg") returned 5
	[0132.052] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cOFMPoe6EpAuu.lnk", pszSpec="*.jpeg") returned 0
	[0132.053] lstrlenA (lpString="*.jpeg") returned 6
	[0132.053] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cOFMPoe6EpAuu.lnk", pszSpec="*.bmp") returned 0
	[0132.053] lstrlenA (lpString="*.bmp") returned 5
	[0132.053] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cOFMPoe6EpAuu.lnk", pszSpec="*.gif") returned 0
	[0132.053] lstrlenA (lpString="*.gif") returned 5
	[0132.053] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cOFMPoe6EpAuu.lnk", pszSpec="*.png") returned 0
	[0132.053] lstrlenA (lpString="*.png") returned 5
	[0132.053] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cOFMPoe6EpAuu.lnk", pszSpec="*.doc") returned 0
	[0132.053] lstrlenA (lpString="*.doc") returned 5
	[0132.088] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cOFMPoe6EpAuu.lnk", pszSpec="*.docx") returned 0
	[0132.088] lstrlenA (lpString="*.docx") returned 6
	[0132.088] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cOFMPoe6EpAuu.lnk", pszSpec="*.xls") returned 0
	[0132.088] lstrlenA (lpString="*.xls") returned 5
	[0132.088] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cOFMPoe6EpAuu.lnk", pszSpec="*.xlsx") returned 0
	[0132.088] lstrlenA (lpString="*.xlsx") returned 6
	[0132.088] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cOFMPoe6EpAuu.lnk", pszSpec="*.ppt") returned 0
	[0132.088] lstrlenA (lpString="*.ppt") returned 5
	[0132.088] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cOFMPoe6EpAuu.lnk", pszSpec="*.pptx") returned 0
	[0132.088] lstrlenA (lpString="*.pptx") returned 6
	[0132.088] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cOFMPoe6EpAuu.lnk", pszSpec="*.txt") returned 0
	[0132.088] lstrlenA (lpString="*.txt") returned 5
	[0132.088] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cOFMPoe6EpAuu.lnk", pszSpec="*.pdf") returned 0
	[0132.088] lstrlenA (lpString="*.pdf") returned 5
	[0132.088] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cOFMPoe6EpAuu.lnk", pszSpec="*.htm") returned 0
	[0132.088] lstrlenA (lpString="*.htm") returned 5
	[0132.088] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cOFMPoe6EpAuu.lnk", pszSpec="*.html") returned 0
	[0132.088] lstrlenA (lpString="*.html") returned 6
	[0132.088] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cOFMPoe6EpAuu.lnk", pszSpec="*.mdb") returned 0
	[0132.088] lstrlenA (lpString="*.mdb") returned 5
	[0132.088] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cOFMPoe6EpAuu.lnk", pszSpec="*.pfx") returned 0
	[0132.088] lstrlenA (lpString="*.pfx") returned 5
	[0132.088] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cOFMPoe6EpAuu.lnk", pszSpec="*.md") returned 0
	[0132.088] lstrlenA (lpString="*.md") returned 4
	[0132.088] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cOFMPoe6EpAuu.lnk", pszSpec="*.lnk") returned 1
	[0132.088] lstrlenA (lpString="*.lnk") returned 5
	[0132.094] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cOFMPoe6EpAuu.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\cofmpoe6epauu.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cOFMPoe6EpAuu.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\cofmpoe6epauu.lnk.exe")) returned 1
	[0132.096] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="CRw40M8ClA9-zaHf4.lnk") returned 1
	[0132.096] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="CRw40M8ClA9-zaHf4.lnk") returned 1
	[0132.096] lstrcmpiA (lpString1="", lpString2="CRw40M8ClA9-zaHf4.lnk") returned -1
	[0132.096] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CRw40M8ClA9-zaHf4.lnk", pszSpec="*.zip") returned 0
	[0132.096] lstrlenA (lpString="*.zip") returned 5
	[0132.096] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CRw40M8ClA9-zaHf4.lnk", pszSpec="*.rar") returned 0
	[0132.096] lstrlenA (lpString="*.rar") returned 5
	[0132.096] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CRw40M8ClA9-zaHf4.lnk", pszSpec="*.7z") returned 0
	[0132.096] lstrlenA (lpString="*.7z") returned 4
	[0132.096] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CRw40M8ClA9-zaHf4.lnk", pszSpec="*.tar") returned 0
	[0132.096] lstrlenA (lpString="*.tar") returned 5
	[0132.096] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CRw40M8ClA9-zaHf4.lnk", pszSpec="*.gzip") returned 0
	[0132.096] lstrlenA (lpString="*.gzip") returned 6
	[0132.096] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CRw40M8ClA9-zaHf4.lnk", pszSpec="*.jpg") returned 0
	[0132.097] lstrlenA (lpString="*.jpg") returned 5
	[0132.097] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CRw40M8ClA9-zaHf4.lnk", pszSpec="*.jpeg") returned 0
	[0132.097] lstrlenA (lpString="*.jpeg") returned 6
	[0132.097] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CRw40M8ClA9-zaHf4.lnk", pszSpec="*.bmp") returned 0
	[0132.097] lstrlenA (lpString="*.bmp") returned 5
	[0132.097] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CRw40M8ClA9-zaHf4.lnk", pszSpec="*.gif") returned 0
	[0132.097] lstrlenA (lpString="*.gif") returned 5
	[0132.097] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CRw40M8ClA9-zaHf4.lnk", pszSpec="*.png") returned 0
	[0132.097] lstrlenA (lpString="*.png") returned 5
	[0132.097] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CRw40M8ClA9-zaHf4.lnk", pszSpec="*.doc") returned 0
	[0132.097] lstrlenA (lpString="*.doc") returned 5
	[0132.097] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CRw40M8ClA9-zaHf4.lnk", pszSpec="*.docx") returned 0
	[0132.097] lstrlenA (lpString="*.docx") returned 6
	[0132.097] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CRw40M8ClA9-zaHf4.lnk", pszSpec="*.xls") returned 0
	[0132.097] lstrlenA (lpString="*.xls") returned 5
	[0132.097] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CRw40M8ClA9-zaHf4.lnk", pszSpec="*.xlsx") returned 0
	[0132.097] lstrlenA (lpString="*.xlsx") returned 6
	[0132.097] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CRw40M8ClA9-zaHf4.lnk", pszSpec="*.ppt") returned 0
	[0132.097] lstrlenA (lpString="*.ppt") returned 5
	[0132.097] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CRw40M8ClA9-zaHf4.lnk", pszSpec="*.pptx") returned 0
	[0132.097] lstrlenA (lpString="*.pptx") returned 6
	[0132.097] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CRw40M8ClA9-zaHf4.lnk", pszSpec="*.txt") returned 0
	[0132.097] lstrlenA (lpString="*.txt") returned 5
	[0132.097] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CRw40M8ClA9-zaHf4.lnk", pszSpec="*.pdf") returned 0
	[0132.097] lstrlenA (lpString="*.pdf") returned 5
	[0132.097] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CRw40M8ClA9-zaHf4.lnk", pszSpec="*.htm") returned 0
	[0132.097] lstrlenA (lpString="*.htm") returned 5
	[0132.097] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CRw40M8ClA9-zaHf4.lnk", pszSpec="*.html") returned 0
	[0132.097] lstrlenA (lpString="*.html") returned 6
	[0132.097] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CRw40M8ClA9-zaHf4.lnk", pszSpec="*.mdb") returned 0
	[0132.097] lstrlenA (lpString="*.mdb") returned 5
	[0132.097] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CRw40M8ClA9-zaHf4.lnk", pszSpec="*.pfx") returned 0
	[0132.097] lstrlenA (lpString="*.pfx") returned 5
	[0132.097] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CRw40M8ClA9-zaHf4.lnk", pszSpec="*.md") returned 0
	[0132.097] lstrlenA (lpString="*.md") returned 4
	[0132.097] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CRw40M8ClA9-zaHf4.lnk", pszSpec="*.lnk") returned 1
	[0132.097] lstrlenA (lpString="*.lnk") returned 5
	[0132.098] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CRw40M8ClA9-zaHf4.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\crw40m8cla9-zahf4.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CRw40M8ClA9-zaHf4.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\crw40m8cla9-zahf4.lnk.exe")) returned 1
	[0132.099] lstrcmpA (lpString1=".", lpString2="CustomDestinations") returned -1
	[0132.099] lstrcmpA (lpString1="..", lpString2="CustomDestinations") returned -1
	[0132.099] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned 75
	[0132.100] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*.*", lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf9a81f7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x257b0071, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x257b0071, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName=".", cAlternateFileName="")) returned 0x7cb810
	[0132.128] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0132.128] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf9a81f7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x257b0071, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x257b0071, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="..", cAlternateFileName="")) returned 1
	[0132.128] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0132.128] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0132.128] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bfc86f, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xa5bfc86f, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0xa5bfc86f, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x142f, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="28c8b86deab549a1.customDestinations-ms", cAlternateFileName="28C8B8~1.CUS")) returned 1
	[0132.128] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0132.128] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="28c8b86deab549a1.customDestinations-ms") returned 1
	[0132.128] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="28c8b86deab549a1.customDestinations-ms") returned 1
	[0132.128] lstrcmpiA (lpString1="", lpString2="28c8b86deab549a1.customDestinations-ms") returned -1
	[0132.128] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\"
	[0132.128] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned=""
	[0132.129] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.129] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0132.129] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0132.129] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0132.129] WriteFile (in: hFile=0x220, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0132.130] SetFileTime (hFile=0x220, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0132.131] CloseHandle (hObject=0x220) returned 1
	[0132.131] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="28c8b86deab549a1.customDestinations-ms" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms"
	[0132.131] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.zip") returned 0
	[0132.131] lstrlenA (lpString="*.zip") returned 5
	[0132.131] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.rar") returned 0
	[0132.131] lstrlenA (lpString="*.rar") returned 5
	[0132.131] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.7z") returned 0
	[0132.131] lstrlenA (lpString="*.7z") returned 4
	[0132.131] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.tar") returned 0
	[0132.131] lstrlenA (lpString="*.tar") returned 5
	[0132.131] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.gzip") returned 0
	[0132.131] lstrlenA (lpString="*.gzip") returned 6
	[0132.131] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.jpg") returned 0
	[0132.131] lstrlenA (lpString="*.jpg") returned 5
	[0132.131] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.jpeg") returned 0
	[0132.131] lstrlenA (lpString="*.jpeg") returned 6
	[0132.131] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.bmp") returned 0
	[0132.131] lstrlenA (lpString="*.bmp") returned 5
	[0132.131] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.gif") returned 0
	[0132.131] lstrlenA (lpString="*.gif") returned 5
	[0132.131] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.png") returned 0
	[0132.131] lstrlenA (lpString="*.png") returned 5
	[0132.131] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.doc") returned 0
	[0132.131] lstrlenA (lpString="*.doc") returned 5
	[0132.131] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.docx") returned 0
	[0132.131] lstrlenA (lpString="*.docx") returned 6
	[0132.131] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.xls") returned 0
	[0132.131] lstrlenA (lpString="*.xls") returned 5
	[0132.131] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.xlsx") returned 0
	[0132.131] lstrlenA (lpString="*.xlsx") returned 6
	[0132.131] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.ppt") returned 0
	[0132.132] lstrlenA (lpString="*.ppt") returned 5
	[0132.132] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.pptx") returned 0
	[0132.132] lstrlenA (lpString="*.pptx") returned 6
	[0132.132] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.txt") returned 0
	[0132.132] lstrlenA (lpString="*.txt") returned 5
	[0132.132] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.pdf") returned 0
	[0132.132] lstrlenA (lpString="*.pdf") returned 5
	[0132.132] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.htm") returned 0
	[0132.132] lstrlenA (lpString="*.htm") returned 5
	[0132.132] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.html") returned 0
	[0132.132] lstrlenA (lpString="*.html") returned 6
	[0132.132] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.mdb") returned 0
	[0132.132] lstrlenA (lpString="*.mdb") returned 5
	[0132.132] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.pfx") returned 0
	[0132.132] lstrlenA (lpString="*.pfx") returned 5
	[0132.132] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.md") returned 0
	[0132.132] lstrlenA (lpString="*.md") returned 4
	[0132.132] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.lnk") returned 0
	[0132.132] lstrlenA (lpString="*.lnk") returned 5
	[0132.132] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.torrent") returned 0
	[0132.132] lstrlenA (lpString="*.torrent") returned 9
	[0132.132] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.mov") returned 0
	[0132.132] lstrlenA (lpString="*.mov") returned 5
	[0132.132] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.3gp") returned 0
	[0132.132] lstrlenA (lpString="*.3gp") returned 5
	[0132.132] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.mpeg") returned 0
	[0132.132] lstrlenA (lpString="*.mpeg") returned 6
	[0132.132] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.mpg") returned 0
	[0132.132] lstrlenA (lpString="*.mpg") returned 5
	[0132.132] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.flv") returned 0
	[0132.132] lstrlenA (lpString="*.flv") returned 5
	[0132.132] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.avi") returned 0
	[0132.132] lstrlenA (lpString="*.avi") returned 5
	[0132.132] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.mp4") returned 0
	[0132.132] lstrlenA (lpString="*.mp4") returned 5
	[0132.132] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.wmv") returned 0
	[0132.132] lstrlenA (lpString="*.wmv") returned 5
	[0132.133] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.mkv") returned 0
	[0132.133] lstrlenA (lpString="*.mkv") returned 5
	[0132.133] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.mp3") returned 0
	[0132.133] lstrlenA (lpString="*.mp3") returned 5
	[0132.133] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.wav") returned 0
	[0132.133] lstrlenA (lpString="*.wav") returned 5
	[0132.133] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.flac") returned 0
	[0132.133] lstrlenA (lpString="*.flac") returned 6
	[0132.133] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.wma") returned 0
	[0132.133] lstrlenA (lpString="*.wma") returned 5
	[0132.133] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.au3") returned 0
	[0132.133] lstrlenA (lpString="*.au3") returned 5
	[0132.133] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.ahk") returned 0
	[0132.133] lstrlenA (lpString="*.ahk") returned 5
	[0132.133] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.c") returned 0
	[0132.133] lstrlenA (lpString="*.c") returned 3
	[0132.133] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.cc") returned 0
	[0132.133] lstrlenA (lpString="*.cc") returned 4
	[0132.133] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.cpp") returned 0
	[0132.133] lstrlenA (lpString="*.cpp") returned 5
	[0132.133] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.cxx") returned 0
	[0132.133] lstrlenA (lpString="*.cxx") returned 5
	[0132.133] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.c++") returned 0
	[0132.133] lstrlenA (lpString="*.c++") returned 5
	[0132.133] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.cs") returned 0
	[0132.133] lstrlenA (lpString="*.cs") returned 4
	[0132.133] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.vb") returned 0
	[0132.133] lstrlenA (lpString="*.vb") returned 4
	[0132.133] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.bas") returned 0
	[0132.133] lstrlenA (lpString="*.bas") returned 5
	[0132.133] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.csproj") returned 0
	[0132.133] lstrlenA (lpString="*.csproj") returned 8
	[0132.133] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.vbproj") returned 0
	[0132.133] lstrlenA (lpString="*.vbproj") returned 8
	[0132.133] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.vcxproj") returned 0
	[0132.133] lstrlenA (lpString="*.vcxproj") returned 9
	[0132.133] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.manifest") returned 0
	[0132.134] lstrlenA (lpString="*.manifest") returned 10
	[0132.134] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.php") returned 0
	[0132.134] lstrlenA (lpString="*.php") returned 5
	[0132.134] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.vbe") returned 0
	[0132.134] lstrlenA (lpString="*.vbe") returned 5
	[0132.134] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.vba") returned 0
	[0132.134] lstrlenA (lpString="*.vba") returned 5
	[0132.134] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.vbs") returned 0
	[0132.134] lstrlenA (lpString="*.vbs") returned 5
	[0132.134] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.bat") returned 0
	[0132.134] lstrlenA (lpString="*.bat") returned 5
	[0132.134] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.cmd") returned 0
	[0132.134] lstrlenA (lpString="*.cmd") returned 5
	[0132.134] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.js") returned 0
	[0132.134] lstrlenA (lpString="*.js") returned 4
	[0132.134] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.jscript") returned 0
	[0132.134] lstrlenA (lpString="*.jscript") returned 9
	[0132.134] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.hta") returned 0
	[0132.134] lstrlenA (lpString="*.hta") returned 5
	[0132.134] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.php7") returned 0
	[0132.134] lstrlenA (lpString="*.php7") returned 6
	[0132.134] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.db") returned 0
	[0132.134] lstrlenA (lpString="*.db") returned 4
	[0132.134] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.swf") returned 0
	[0132.134] lstrlenA (lpString="*.swf") returned 5
	[0132.134] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.eml") returned 0
	[0132.134] lstrlenA (lpString="*.eml") returned 5
	[0132.134] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.part") returned 0
	[0132.134] lstrlenA (lpString="*.part") returned 6
	[0132.134] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.nfo") returned 0
	[0132.134] lstrlenA (lpString="*.nfo") returned 5
	[0132.134] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.rsa") returned 0
	[0132.134] lstrlenA (lpString="*.rsa") returned 5
	[0132.134] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.key") returned 0
	[0132.134] lstrlenA (lpString="*.key") returned 5
	[0132.135] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.aes") returned 0
	[0132.135] lstrlenA (lpString="*.aes") returned 5
	[0132.135] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.blob") returned 0
	[0132.135] lstrlenA (lpString="*.blob") returned 6
	[0132.135] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.btc") returned 0
	[0132.135] lstrlenA (lpString="*.btc") returned 5
	[0132.135] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms", pszSpec="*.wallet") returned 0
	[0132.135] lstrlenA (lpString="*.wallet") returned 8
	[0132.135] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3564a0f, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xd3564a0f, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xd3564a0f, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x1544, dwReserved0=0x0, dwReserved1=0x0, cFileName="590aee7bdd69b59b.customDestinations-ms", cAlternateFileName="590AEE~1.CUS")) returned 1
	[0132.135] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0132.135] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="590aee7bdd69b59b.customDestinations-ms") returned 1
	[0132.135] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="590aee7bdd69b59b.customDestinations-ms") returned 1
	[0132.135] lstrcmpiA (lpString1="", lpString2="590aee7bdd69b59b.customDestinations-ms") returned -1
	[0132.135] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms") returned="28c8b86deab549a1.customDestinations-ms"
	[0132.135] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\"
	[0132.135] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned=""
	[0132.135] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.135] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\how-to-decrypt-files.htm")) returned 0x20
	[0132.135] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="590aee7bdd69b59b.customDestinations-ms" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms"
	[0132.135] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.zip") returned 0
	[0132.135] lstrlenA (lpString="*.zip") returned 5
	[0132.135] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.rar") returned 0
	[0132.135] lstrlenA (lpString="*.rar") returned 5
	[0132.135] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.7z") returned 0
	[0132.135] lstrlenA (lpString="*.7z") returned 4
	[0132.135] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.tar") returned 0
	[0132.135] lstrlenA (lpString="*.tar") returned 5
	[0132.135] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.gzip") returned 0
	[0132.135] lstrlenA (lpString="*.gzip") returned 6
	[0132.135] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.jpg") returned 0
	[0132.135] lstrlenA (lpString="*.jpg") returned 5
	[0132.135] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.jpeg") returned 0
	[0132.136] lstrlenA (lpString="*.jpeg") returned 6
	[0132.136] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.bmp") returned 0
	[0132.136] lstrlenA (lpString="*.bmp") returned 5
	[0132.136] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.gif") returned 0
	[0132.136] lstrlenA (lpString="*.gif") returned 5
	[0132.136] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.png") returned 0
	[0132.136] lstrlenA (lpString="*.png") returned 5
	[0132.136] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.doc") returned 0
	[0132.136] lstrlenA (lpString="*.doc") returned 5
	[0132.136] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.docx") returned 0
	[0132.136] lstrlenA (lpString="*.docx") returned 6
	[0132.136] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.xls") returned 0
	[0132.136] lstrlenA (lpString="*.xls") returned 5
	[0132.136] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.xlsx") returned 0
	[0132.136] lstrlenA (lpString="*.xlsx") returned 6
	[0132.136] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.ppt") returned 0
	[0132.136] lstrlenA (lpString="*.ppt") returned 5
	[0132.136] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.pptx") returned 0
	[0132.136] lstrlenA (lpString="*.pptx") returned 6
	[0132.136] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.txt") returned 0
	[0132.136] lstrlenA (lpString="*.txt") returned 5
	[0132.136] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.pdf") returned 0
	[0132.136] lstrlenA (lpString="*.pdf") returned 5
	[0132.136] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.htm") returned 0
	[0132.136] lstrlenA (lpString="*.htm") returned 5
	[0132.136] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.html") returned 0
	[0132.136] lstrlenA (lpString="*.html") returned 6
	[0132.136] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.mdb") returned 0
	[0132.136] lstrlenA (lpString="*.mdb") returned 5
	[0132.136] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.pfx") returned 0
	[0132.136] lstrlenA (lpString="*.pfx") returned 5
	[0132.136] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.md") returned 0
	[0132.136] lstrlenA (lpString="*.md") returned 4
	[0132.136] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.lnk") returned 0
	[0132.136] lstrlenA (lpString="*.lnk") returned 5
	[0132.136] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.torrent") returned 0
	[0132.136] lstrlenA (lpString="*.torrent") returned 9
	[0132.137] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.mov") returned 0
	[0132.137] lstrlenA (lpString="*.mov") returned 5
	[0132.137] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.3gp") returned 0
	[0132.137] lstrlenA (lpString="*.3gp") returned 5
	[0132.137] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.mpeg") returned 0
	[0132.137] lstrlenA (lpString="*.mpeg") returned 6
	[0132.137] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.mpg") returned 0
	[0132.137] lstrlenA (lpString="*.mpg") returned 5
	[0132.137] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.flv") returned 0
	[0132.137] lstrlenA (lpString="*.flv") returned 5
	[0132.137] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.avi") returned 0
	[0132.137] lstrlenA (lpString="*.avi") returned 5
	[0132.137] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.mp4") returned 0
	[0132.137] lstrlenA (lpString="*.mp4") returned 5
	[0132.137] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.wmv") returned 0
	[0132.137] lstrlenA (lpString="*.wmv") returned 5
	[0132.137] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.mkv") returned 0
	[0132.137] lstrlenA (lpString="*.mkv") returned 5
	[0132.137] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.mp3") returned 0
	[0132.137] lstrlenA (lpString="*.mp3") returned 5
	[0132.137] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.wav") returned 0
	[0132.137] lstrlenA (lpString="*.wav") returned 5
	[0132.137] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.flac") returned 0
	[0132.137] lstrlenA (lpString="*.flac") returned 6
	[0132.137] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.wma") returned 0
	[0132.137] lstrlenA (lpString="*.wma") returned 5
	[0132.137] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.au3") returned 0
	[0132.137] lstrlenA (lpString="*.au3") returned 5
	[0132.137] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.ahk") returned 0
	[0132.137] lstrlenA (lpString="*.ahk") returned 5
	[0132.137] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.c") returned 0
	[0132.137] lstrlenA (lpString="*.c") returned 3
	[0132.137] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.cc") returned 0
	[0132.137] lstrlenA (lpString="*.cc") returned 4
	[0132.137] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.cpp") returned 0
	[0132.137] lstrlenA (lpString="*.cpp") returned 5
	[0132.137] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.cxx") returned 0
	[0132.137] lstrlenA (lpString="*.cxx") returned 5
	[0132.138] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.c++") returned 0
	[0132.138] lstrlenA (lpString="*.c++") returned 5
	[0132.138] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.cs") returned 0
	[0132.138] lstrlenA (lpString="*.cs") returned 4
	[0132.138] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.vb") returned 0
	[0132.138] lstrlenA (lpString="*.vb") returned 4
	[0132.138] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.bas") returned 0
	[0132.138] lstrlenA (lpString="*.bas") returned 5
	[0132.138] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.csproj") returned 0
	[0132.138] lstrlenA (lpString="*.csproj") returned 8
	[0132.138] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.vbproj") returned 0
	[0132.138] lstrlenA (lpString="*.vbproj") returned 8
	[0132.138] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.vcxproj") returned 0
	[0132.138] lstrlenA (lpString="*.vcxproj") returned 9
	[0132.138] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.manifest") returned 0
	[0132.138] lstrlenA (lpString="*.manifest") returned 10
	[0132.138] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.php") returned 0
	[0132.138] lstrlenA (lpString="*.php") returned 5
	[0132.138] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.vbe") returned 0
	[0132.138] lstrlenA (lpString="*.vbe") returned 5
	[0132.138] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.vba") returned 0
	[0132.138] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", pszSpec="*.vbs") returned 0
	[0132.138] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f404d4a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x96c71f96, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x96ce4639, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ef2, dwReserved0=0x44002d, dwReserved1=0x430045, cFileName="6824f4a902c78fbd.customDestinations-ms", cAlternateFileName="6824F4~1.CUS")) returned 1
	[0132.138] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0132.139] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="6824f4a902c78fbd.customDestinations-ms") returned 1
	[0132.139] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="6824f4a902c78fbd.customDestinations-ms") returned 1
	[0132.139] lstrcmpiA (lpString1="", lpString2="6824f4a902c78fbd.customDestinations-ms") returned -1
	[0132.139] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms") returned="590aee7bdd69b59b.customDestinations-ms"
	[0132.139] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\"
	[0132.139] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned=""
	[0132.139] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.139] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\how-to-decrypt-files.htm")) returned 0x20
	[0132.139] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="6824f4a902c78fbd.customDestinations-ms" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\6824f4a902c78fbd.customDestinations-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\6824f4a902c78fbd.customDestinations-ms"
	[0132.139] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfad9510, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe96819d1, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xe96819d1, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x44002d, dwReserved1=0x430045, cFileName="7e4dca80246863e3.customDestinations-ms", cAlternateFileName="7E4DCA~1.CUS")) returned 1
	[0132.139] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0132.139] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="7e4dca80246863e3.customDestinations-ms") returned 1
	[0132.139] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="7e4dca80246863e3.customDestinations-ms") returned 1
	[0132.139] lstrcmpiA (lpString1="", lpString2="7e4dca80246863e3.customDestinations-ms") returned -1
	[0132.139] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\6824f4a902c78fbd.customDestinations-ms") returned="6824f4a902c78fbd.customDestinations-ms"
	[0132.139] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\"
	[0132.139] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned=""
	[0132.139] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.139] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\how-to-decrypt-files.htm")) returned 0x20
	[0132.139] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="7e4dca80246863e3.customDestinations-ms" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms"
	[0132.139] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0effce, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x98e794b5, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x98f80fc0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0x44002d, dwReserved1=0x430045, cFileName="9d1f905ce5044aee.customDestinations-ms", cAlternateFileName="9D1F90~1.CUS")) returned 1
	[0132.139] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0132.139] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="9d1f905ce5044aee.customDestinations-ms") returned 1
	[0132.139] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="9d1f905ce5044aee.customDestinations-ms") returned 1
	[0132.139] lstrcmpiA (lpString1="", lpString2="9d1f905ce5044aee.customDestinations-ms") returned -1
	[0132.139] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms") returned="7e4dca80246863e3.customDestinations-ms"
	[0132.139] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\"
	[0132.140] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned=""
	[0132.140] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.140] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\how-to-decrypt-files.htm")) returned 0x20
	[0132.140] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="9d1f905ce5044aee.customDestinations-ms" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\9d1f905ce5044aee.customDestinations-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\9d1f905ce5044aee.customDestinations-ms"
	[0132.140] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf9a81f7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe959cb77, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xe959cb77, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x44002d, dwReserved1=0x430045, cFileName="f01b4d95cf55d32a.customDestinations-ms", cAlternateFileName="F01B4D~1.CUS")) returned 1
	[0132.140] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0132.140] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="f01b4d95cf55d32a.customDestinations-ms") returned -1
	[0132.140] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="f01b4d95cf55d32a.customDestinations-ms") returned 1
	[0132.140] lstrcmpiA (lpString1="", lpString2="f01b4d95cf55d32a.customDestinations-ms") returned -1
	[0132.140] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\9d1f905ce5044aee.customDestinations-ms") returned="9d1f905ce5044aee.customDestinations-ms"
	[0132.140] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\"
	[0132.140] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned=""
	[0132.140] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.140] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\how-to-decrypt-files.htm")) returned 0x20
	[0132.140] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="f01b4d95cf55d32a.customDestinations-ms" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\f01b4d95cf55d32a.customDestinations-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\f01b4d95cf55d32a.customDestinations-ms"
	[0132.140] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2b77e1, ftCreationTime.dwHighDateTime=0x1d327c7, ftLastAccessTime.dwLowDateTime=0x25632b00, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x25632b00, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x44002d, dwReserved1=0x430045, cFileName="f18460fded109990.customDestinations-ms", cAlternateFileName="F18460~1.CUS")) returned 1
	[0132.140] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0132.140] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="f18460fded109990.customDestinations-ms") returned -1
	[0132.140] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="f18460fded109990.customDestinations-ms") returned 1
	[0132.140] lstrcmpiA (lpString1="", lpString2="f18460fded109990.customDestinations-ms") returned -1
	[0132.140] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\f01b4d95cf55d32a.customDestinations-ms") returned="f01b4d95cf55d32a.customDestinations-ms"
	[0132.140] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\"
	[0132.140] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned=""
	[0132.140] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.140] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\how-to-decrypt-files.htm")) returned 0x20
	[0132.140] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="f18460fded109990.customDestinations-ms" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\f18460fded109990.customDestinations-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\f18460fded109990.customDestinations-ms"
	[0132.141] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2b77e1, ftCreationTime.dwHighDateTime=0x1d327c7, ftLastAccessTime.dwLowDateTime=0x25632b00, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x25632b00, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x44002d, dwReserved1=0x430045, cFileName="f18460fded109990.customDestinations-ms", cAlternateFileName="F18460~1.CUS")) returned 0
	[0132.141] FindClose (in: hFindFile=0x7cb810 | out: hFindFile=0x7cb810) returned 1
	[0132.141] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36dc87da, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x36dc87da, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x36dc87da, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x49d, dwReserved0=0x0, dwReserved1=0x0, cFileName="cuWRZheedprN2Bv_zUnM.lnk", cAlternateFileName="CUWRZH~1.LNK")) returned 1
	[0132.141] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.141] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="cuWRZheedprN2Bv_zUnM.lnk") returned 1
	[0132.141] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="cuWRZheedprN2Bv_zUnM.lnk") returned 1
	[0132.141] lstrcmpiA (lpString1="", lpString2="cuWRZheedprN2Bv_zUnM.lnk") returned -1
	[0132.141] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*.*") returned="*.*"
	[0132.141] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.141] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.141] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.141] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.141] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="cuWRZheedprN2Bv_zUnM.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cuWRZheedprN2Bv_zUnM.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cuWRZheedprN2Bv_zUnM.lnk"
	[0132.141] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cuWRZheedprN2Bv_zUnM.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cuWRZheedprN2Bv_zUnM.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cuWRZheedprN2Bv_zUnM.lnk"
	[0132.141] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cuWRZheedprN2Bv_zUnM.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cuWRZheedprN2Bv_zUnM.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cuWRZheedprN2Bv_zUnM.lnk"
	[0132.141] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cuWRZheedprN2Bv_zUnM.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cuWRZheedprN2Bv_zUnM.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cuWRZheedprN2Bv_zUnM.lnk."
	[0132.141] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cuWRZheedprN2Bv_zUnM.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cuWRZheedprN2Bv_zUnM.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cuWRZheedprN2Bv_zUnM.lnk.exe"
	[0132.141] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cuWRZheedprN2Bv_zUnM.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\cuwrzheedprn2bv_zunm.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.142] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x49d
	[0132.142] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x36dc87da, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x36dc87da, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x36dc87da, dwHighDateTime=0x1d543d9)) returned 1
	[0132.142] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.142] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x45b, lpOverlapped=0x0) returned 1
	[0132.143] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cuWRZheedprN2Bv_zUnM.lnk") returned="cuWRZheedprN2Bv_zUnM.lnk"
	[0132.143] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.143] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x45b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x45b, lpOverlapped=0x0) returned 1
	[0132.143] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.143] CloseHandle (hObject=0x21c) returned 1
	[0132.143] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cuWRZheedprN2Bv_zUnM.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\cuwrzheedprn2bv_zunm.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cuWRZheedprN2Bv_zUnM.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\cuwrzheedprn2bv_zunm.lnk.exe")) returned 1
	[0132.144] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44417e2a, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x44417e2a, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x444642b9, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x4db, dwReserved0=0x0, dwReserved1=0x0, cFileName="d63SZmwpp.flv.lnk", cAlternateFileName="D63SZM~1.LNK")) returned 1
	[0132.144] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.144] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="d63SZmwpp.flv.lnk") returned 1
	[0132.144] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="d63SZmwpp.flv.lnk") returned 1
	[0132.144] lstrcmpiA (lpString1="", lpString2="d63SZmwpp.flv.lnk") returned -1
	[0132.144] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cuWRZheedprN2Bv_zUnM.lnk") returned="cuWRZheedprN2Bv_zUnM.lnk"
	[0132.144] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.144] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.144] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.144] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.144] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="d63SZmwpp.flv.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk"
	[0132.144] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk", pszSpec="*.zip") returned 0
	[0132.144] lstrlenA (lpString="*.zip") returned 5
	[0132.144] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk", pszSpec="*.rar") returned 0
	[0132.144] lstrlenA (lpString="*.rar") returned 5
	[0132.144] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk", pszSpec="*.7z") returned 0
	[0132.144] lstrlenA (lpString="*.7z") returned 4
	[0132.144] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk", pszSpec="*.tar") returned 0
	[0132.144] lstrlenA (lpString="*.tar") returned 5
	[0132.144] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk", pszSpec="*.gzip") returned 0
	[0132.144] lstrlenA (lpString="*.gzip") returned 6
	[0132.144] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk", pszSpec="*.jpg") returned 0
	[0132.144] lstrlenA (lpString="*.jpg") returned 5
	[0132.144] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk", pszSpec="*.jpeg") returned 0
	[0132.145] lstrlenA (lpString="*.jpeg") returned 6
	[0132.145] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk", pszSpec="*.bmp") returned 0
	[0132.145] lstrlenA (lpString="*.bmp") returned 5
	[0132.145] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk", pszSpec="*.gif") returned 0
	[0132.145] lstrlenA (lpString="*.gif") returned 5
	[0132.145] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk", pszSpec="*.png") returned 0
	[0132.145] lstrlenA (lpString="*.png") returned 5
	[0132.145] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk", pszSpec="*.doc") returned 0
	[0132.145] lstrlenA (lpString="*.doc") returned 5
	[0132.145] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk", pszSpec="*.docx") returned 0
	[0132.145] lstrlenA (lpString="*.docx") returned 6
	[0132.145] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk", pszSpec="*.xls") returned 0
	[0132.145] lstrlenA (lpString="*.xls") returned 5
	[0132.145] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk", pszSpec="*.xlsx") returned 0
	[0132.145] lstrlenA (lpString="*.xlsx") returned 6
	[0132.145] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk", pszSpec="*.ppt") returned 0
	[0132.145] lstrlenA (lpString="*.ppt") returned 5
	[0132.145] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk", pszSpec="*.pptx") returned 0
	[0132.145] lstrlenA (lpString="*.pptx") returned 6
	[0132.145] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk", pszSpec="*.txt") returned 0
	[0132.145] lstrlenA (lpString="*.txt") returned 5
	[0132.145] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk", pszSpec="*.pdf") returned 0
	[0132.145] lstrlenA (lpString="*.pdf") returned 5
	[0132.145] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk", pszSpec="*.htm") returned 0
	[0132.145] lstrlenA (lpString="*.htm") returned 5
	[0132.145] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk", pszSpec="*.html") returned 0
	[0132.145] lstrlenA (lpString="*.html") returned 6
	[0132.145] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk", pszSpec="*.mdb") returned 0
	[0132.145] lstrlenA (lpString="*.mdb") returned 5
	[0132.145] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk", pszSpec="*.pfx") returned 0
	[0132.145] lstrlenA (lpString="*.pfx") returned 5
	[0132.145] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk", pszSpec="*.md") returned 0
	[0132.145] lstrlenA (lpString="*.md") returned 4
	[0132.145] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk", pszSpec="*.lnk") returned 1
	[0132.145] lstrlenA (lpString="*.lnk") returned 5
	[0132.145] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk"
	[0132.145] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk"
	[0132.145] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk."
	[0132.146] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk.exe"
	[0132.146] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\d63szmwpp.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.146] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4db
	[0132.146] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x44417e2a, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x44417e2a, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x444642b9, dwHighDateTime=0x1d543d9)) returned 1
	[0132.146] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.146] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x499, lpOverlapped=0x0) returned 1
	[0132.147] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk") returned="d63SZmwpp.flv.lnk"
	[0132.147] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.147] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x499, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x499, lpOverlapped=0x0) returned 1
	[0132.147] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.147] CloseHandle (hObject=0x21c) returned 1
	[0132.147] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\d63szmwpp.flv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\d63szmwpp.flv.lnk.exe")) returned 1
	[0132.148] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43046573, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x43046573, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x43046573, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dcy2YdaL.lnk", cAlternateFileName="")) returned 1
	[0132.148] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.148] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Dcy2YdaL.lnk") returned 1
	[0132.148] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Dcy2YdaL.lnk") returned 1
	[0132.148] lstrcmpiA (lpString1="", lpString2="Dcy2YdaL.lnk") returned -1
	[0132.148] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d63SZmwpp.flv.lnk") returned="d63SZmwpp.flv.lnk"
	[0132.148] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.148] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.148] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.148] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.148] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="Dcy2YdaL.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk"
	[0132.148] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk", pszSpec="*.zip") returned 0
	[0132.148] lstrlenA (lpString="*.zip") returned 5
	[0132.148] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk", pszSpec="*.rar") returned 0
	[0132.148] lstrlenA (lpString="*.rar") returned 5
	[0132.148] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk", pszSpec="*.7z") returned 0
	[0132.148] lstrlenA (lpString="*.7z") returned 4
	[0132.148] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk", pszSpec="*.tar") returned 0
	[0132.148] lstrlenA (lpString="*.tar") returned 5
	[0132.149] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk", pszSpec="*.gzip") returned 0
	[0132.149] lstrlenA (lpString="*.gzip") returned 6
	[0132.149] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk", pszSpec="*.jpg") returned 0
	[0132.149] lstrlenA (lpString="*.jpg") returned 5
	[0132.149] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk", pszSpec="*.jpeg") returned 0
	[0132.149] lstrlenA (lpString="*.jpeg") returned 6
	[0132.149] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk", pszSpec="*.bmp") returned 0
	[0132.149] lstrlenA (lpString="*.bmp") returned 5
	[0132.149] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk", pszSpec="*.gif") returned 0
	[0132.149] lstrlenA (lpString="*.gif") returned 5
	[0132.149] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk", pszSpec="*.png") returned 0
	[0132.149] lstrlenA (lpString="*.png") returned 5
	[0132.149] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk", pszSpec="*.doc") returned 0
	[0132.149] lstrlenA (lpString="*.doc") returned 5
	[0132.149] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk", pszSpec="*.docx") returned 0
	[0132.149] lstrlenA (lpString="*.docx") returned 6
	[0132.149] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk", pszSpec="*.xls") returned 0
	[0132.149] lstrlenA (lpString="*.xls") returned 5
	[0132.149] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk", pszSpec="*.xlsx") returned 0
	[0132.149] lstrlenA (lpString="*.xlsx") returned 6
	[0132.149] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk", pszSpec="*.ppt") returned 0
	[0132.149] lstrlenA (lpString="*.ppt") returned 5
	[0132.149] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk", pszSpec="*.pptx") returned 0
	[0132.149] lstrlenA (lpString="*.pptx") returned 6
	[0132.149] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk", pszSpec="*.txt") returned 0
	[0132.149] lstrlenA (lpString="*.txt") returned 5
	[0132.149] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk", pszSpec="*.pdf") returned 0
	[0132.149] lstrlenA (lpString="*.pdf") returned 5
	[0132.149] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk", pszSpec="*.htm") returned 0
	[0132.149] lstrlenA (lpString="*.htm") returned 5
	[0132.149] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk", pszSpec="*.html") returned 0
	[0132.149] lstrlenA (lpString="*.html") returned 6
	[0132.149] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk", pszSpec="*.mdb") returned 0
	[0132.149] lstrlenA (lpString="*.mdb") returned 5
	[0132.149] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk", pszSpec="*.pfx") returned 0
	[0132.149] lstrlenA (lpString="*.pfx") returned 5
	[0132.149] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk", pszSpec="*.md") returned 0
	[0132.150] lstrlenA (lpString="*.md") returned 4
	[0132.150] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk", pszSpec="*.lnk") returned 1
	[0132.150] lstrlenA (lpString="*.lnk") returned 5
	[0132.150] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk"
	[0132.150] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk"
	[0132.150] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk."
	[0132.150] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk.exe"
	[0132.150] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\dcy2ydal.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.150] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b0
	[0132.150] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x43046573, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x43046573, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x43046573, dwHighDateTime=0x1d543d9)) returned 1
	[0132.150] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.150] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x36e, lpOverlapped=0x0) returned 1
	[0132.151] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk") returned="Dcy2YdaL.lnk"
	[0132.151] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.151] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x36e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x36e, lpOverlapped=0x0) returned 1
	[0132.151] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.151] CloseHandle (hObject=0x21c) returned 1
	[0132.151] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\dcy2ydal.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\dcy2ydal.lnk.exe")) returned 1
	[0132.152] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x44111bf3, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44111bf3, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0132.152] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.152] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="desktop.ini") returned 1
	[0132.152] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="desktop.ini") returned 1
	[0132.152] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1
	[0132.152] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dcy2YdaL.lnk") returned="Dcy2YdaL.lnk"
	[0132.152] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.152] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.152] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.152] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.152] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini"
	[0132.152] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.zip") returned 0
	[0132.152] lstrlenA (lpString="*.zip") returned 5
	[0132.152] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.rar") returned 0
	[0132.152] lstrlenA (lpString="*.rar") returned 5
	[0132.152] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.7z") returned 0
	[0132.152] lstrlenA (lpString="*.7z") returned 4
	[0132.152] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.tar") returned 0
	[0132.152] lstrlenA (lpString="*.tar") returned 5
	[0132.152] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.gzip") returned 0
	[0132.152] lstrlenA (lpString="*.gzip") returned 6
	[0132.152] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.jpg") returned 0
	[0132.152] lstrlenA (lpString="*.jpg") returned 5
	[0132.153] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.jpeg") returned 0
	[0132.153] lstrlenA (lpString="*.jpeg") returned 6
	[0132.153] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.bmp") returned 0
	[0132.153] lstrlenA (lpString="*.bmp") returned 5
	[0132.153] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.gif") returned 0
	[0132.153] lstrlenA (lpString="*.gif") returned 5
	[0132.153] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.png") returned 0
	[0132.153] lstrlenA (lpString="*.png") returned 5
	[0132.153] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.doc") returned 0
	[0132.153] lstrlenA (lpString="*.doc") returned 5
	[0132.153] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.docx") returned 0
	[0132.153] lstrlenA (lpString="*.docx") returned 6
	[0132.153] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.xls") returned 0
	[0132.153] lstrlenA (lpString="*.xls") returned 5
	[0132.153] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.xlsx") returned 0
	[0132.153] lstrlenA (lpString="*.xlsx") returned 6
	[0132.153] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.ppt") returned 0
	[0132.153] lstrlenA (lpString="*.ppt") returned 5
	[0132.153] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.pptx") returned 0
	[0132.153] lstrlenA (lpString="*.pptx") returned 6
	[0132.153] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.txt") returned 0
	[0132.153] lstrlenA (lpString="*.txt") returned 5
	[0132.153] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.pdf") returned 0
	[0132.153] lstrlenA (lpString="*.pdf") returned 5
	[0132.153] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.htm") returned 0
	[0132.153] lstrlenA (lpString="*.htm") returned 5
	[0132.153] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.html") returned 0
	[0132.153] lstrlenA (lpString="*.html") returned 6
	[0132.153] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.mdb") returned 0
	[0132.153] lstrlenA (lpString="*.mdb") returned 5
	[0132.153] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.pfx") returned 0
	[0132.153] lstrlenA (lpString="*.pfx") returned 5
	[0132.153] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.md") returned 0
	[0132.153] lstrlenA (lpString="*.md") returned 4
	[0132.153] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.lnk") returned 0
	[0132.153] lstrlenA (lpString="*.lnk") returned 5
	[0132.153] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.torrent") returned 0
	[0132.153] lstrlenA (lpString="*.torrent") returned 9
	[0132.154] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.mov") returned 0
	[0132.154] lstrlenA (lpString="*.mov") returned 5
	[0132.154] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.3gp") returned 0
	[0132.154] lstrlenA (lpString="*.3gp") returned 5
	[0132.154] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.mpeg") returned 0
	[0132.154] lstrlenA (lpString="*.mpeg") returned 6
	[0132.154] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.mpg") returned 0
	[0132.154] lstrlenA (lpString="*.mpg") returned 5
	[0132.154] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.flv") returned 0
	[0132.154] lstrlenA (lpString="*.flv") returned 5
	[0132.154] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.avi") returned 0
	[0132.154] lstrlenA (lpString="*.avi") returned 5
	[0132.154] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.mp4") returned 0
	[0132.154] lstrlenA (lpString="*.mp4") returned 5
	[0132.154] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.wmv") returned 0
	[0132.154] lstrlenA (lpString="*.wmv") returned 5
	[0132.154] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.mkv") returned 0
	[0132.154] lstrlenA (lpString="*.mkv") returned 5
	[0132.154] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.mp3") returned 0
	[0132.154] lstrlenA (lpString="*.mp3") returned 5
	[0132.154] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.wav") returned 0
	[0132.154] lstrlenA (lpString="*.wav") returned 5
	[0132.154] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.flac") returned 0
	[0132.154] lstrlenA (lpString="*.flac") returned 6
	[0132.154] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.wma") returned 0
	[0132.154] lstrlenA (lpString="*.wma") returned 5
	[0132.154] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.au3") returned 0
	[0132.154] lstrlenA (lpString="*.au3") returned 5
	[0132.154] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.ahk") returned 0
	[0132.154] lstrlenA (lpString="*.ahk") returned 5
	[0132.154] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.c") returned 0
	[0132.154] lstrlenA (lpString="*.c") returned 3
	[0132.154] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.cc") returned 0
	[0132.154] lstrlenA (lpString="*.cc") returned 4
	[0132.154] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.cpp") returned 0
	[0132.154] lstrlenA (lpString="*.cpp") returned 5
	[0132.154] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.cxx") returned 0
	[0132.155] lstrlenA (lpString="*.cxx") returned 5
	[0132.155] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.c++") returned 0
	[0132.155] lstrlenA (lpString="*.c++") returned 5
	[0132.155] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.cs") returned 0
	[0132.155] lstrlenA (lpString="*.cs") returned 4
	[0132.155] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.vb") returned 0
	[0132.155] lstrlenA (lpString="*.vb") returned 4
	[0132.155] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.bas") returned 0
	[0132.155] lstrlenA (lpString="*.bas") returned 5
	[0132.155] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.csproj") returned 0
	[0132.155] lstrlenA (lpString="*.csproj") returned 8
	[0132.155] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.vbproj") returned 0
	[0132.155] lstrlenA (lpString="*.vbproj") returned 8
	[0132.155] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.vcxproj") returned 0
	[0132.155] lstrlenA (lpString="*.vcxproj") returned 9
	[0132.155] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.manifest") returned 0
	[0132.155] lstrlenA (lpString="*.manifest") returned 10
	[0132.155] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.php") returned 0
	[0132.155] lstrlenA (lpString="*.php") returned 5
	[0132.155] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.vbe") returned 0
	[0132.155] lstrlenA (lpString="*.vbe") returned 5
	[0132.155] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.vba") returned 0
	[0132.155] lstrlenA (lpString="*.vba") returned 5
	[0132.155] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.vbs") returned 0
	[0132.155] lstrlenA (lpString="*.vbs") returned 5
	[0132.155] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.bat") returned 0
	[0132.155] lstrlenA (lpString="*.bat") returned 5
	[0132.155] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.cmd") returned 0
	[0132.155] lstrlenA (lpString="*.cmd") returned 5
	[0132.155] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.js") returned 0
	[0132.155] lstrlenA (lpString="*.js") returned 4
	[0132.155] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.jscript") returned 0
	[0132.155] lstrlenA (lpString="*.jscript") returned 9
	[0132.155] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.hta") returned 0
	[0132.155] lstrlenA (lpString="*.hta") returned 5
	[0132.155] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.php7") returned 0
	[0132.155] lstrlenA (lpString="*.php7") returned 6
	[0132.155] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.db") returned 0
	[0132.156] lstrlenA (lpString="*.db") returned 4
	[0132.156] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.swf") returned 0
	[0132.156] lstrlenA (lpString="*.swf") returned 5
	[0132.156] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.eml") returned 0
	[0132.156] lstrlenA (lpString="*.eml") returned 5
	[0132.156] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.part") returned 0
	[0132.156] lstrlenA (lpString="*.part") returned 6
	[0132.156] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.nfo") returned 0
	[0132.156] lstrlenA (lpString="*.nfo") returned 5
	[0132.156] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.rsa") returned 0
	[0132.156] lstrlenA (lpString="*.rsa") returned 5
	[0132.156] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.key") returned 0
	[0132.156] lstrlenA (lpString="*.key") returned 5
	[0132.156] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.aes") returned 0
	[0132.156] lstrlenA (lpString="*.aes") returned 5
	[0132.156] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.blob") returned 0
	[0132.156] lstrlenA (lpString="*.blob") returned 6
	[0132.156] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.btc") returned 0
	[0132.156] lstrlenA (lpString="*.btc") returned 5
	[0132.156] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", pszSpec="*.wallet") returned 0
	[0132.156] lstrlenA (lpString="*.wallet") returned 8
	[0132.156] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48fb6d63, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x48fb6d63, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x48fb6d63, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x568, dwReserved0=0x0, dwReserved1=0x0, cFileName="diJNtxrlIvz.lnk", cAlternateFileName="DIJNTX~1.LNK")) returned 1
	[0132.156] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.156] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="diJNtxrlIvz.lnk") returned 1
	[0132.156] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="diJNtxrlIvz.lnk") returned 1
	[0132.156] lstrcmpiA (lpString1="", lpString2="diJNtxrlIvz.lnk") returned -1
	[0132.156] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini") returned="desktop.ini"
	[0132.156] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.156] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.156] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.156] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.156] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="diJNtxrlIvz.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk"
	[0132.156] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk", pszSpec="*.zip") returned 0
	[0132.156] lstrlenA (lpString="*.zip") returned 5
	[0132.156] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk", pszSpec="*.rar") returned 0
	[0132.157] lstrlenA (lpString="*.rar") returned 5
	[0132.157] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk", pszSpec="*.7z") returned 0
	[0132.157] lstrlenA (lpString="*.7z") returned 4
	[0132.157] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk", pszSpec="*.tar") returned 0
	[0132.157] lstrlenA (lpString="*.tar") returned 5
	[0132.157] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk", pszSpec="*.gzip") returned 0
	[0132.157] lstrlenA (lpString="*.gzip") returned 6
	[0132.157] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk", pszSpec="*.jpg") returned 0
	[0132.157] lstrlenA (lpString="*.jpg") returned 5
	[0132.157] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk", pszSpec="*.jpeg") returned 0
	[0132.157] lstrlenA (lpString="*.jpeg") returned 6
	[0132.157] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk", pszSpec="*.bmp") returned 0
	[0132.157] lstrlenA (lpString="*.bmp") returned 5
	[0132.157] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk", pszSpec="*.gif") returned 0
	[0132.157] lstrlenA (lpString="*.gif") returned 5
	[0132.157] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk", pszSpec="*.png") returned 0
	[0132.157] lstrlenA (lpString="*.png") returned 5
	[0132.157] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk", pszSpec="*.doc") returned 0
	[0132.157] lstrlenA (lpString="*.doc") returned 5
	[0132.157] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk", pszSpec="*.docx") returned 0
	[0132.157] lstrlenA (lpString="*.docx") returned 6
	[0132.157] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk", pszSpec="*.xls") returned 0
	[0132.157] lstrlenA (lpString="*.xls") returned 5
	[0132.157] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk", pszSpec="*.xlsx") returned 0
	[0132.157] lstrlenA (lpString="*.xlsx") returned 6
	[0132.157] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk", pszSpec="*.ppt") returned 0
	[0132.157] lstrlenA (lpString="*.ppt") returned 5
	[0132.157] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk", pszSpec="*.pptx") returned 0
	[0132.157] lstrlenA (lpString="*.pptx") returned 6
	[0132.157] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk", pszSpec="*.txt") returned 0
	[0132.157] lstrlenA (lpString="*.txt") returned 5
	[0132.157] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk", pszSpec="*.pdf") returned 0
	[0132.157] lstrlenA (lpString="*.pdf") returned 5
	[0132.157] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk", pszSpec="*.htm") returned 0
	[0132.157] lstrlenA (lpString="*.htm") returned 5
	[0132.157] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk", pszSpec="*.html") returned 0
	[0132.157] lstrlenA (lpString="*.html") returned 6
	[0132.157] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk", pszSpec="*.mdb") returned 0
	[0132.158] lstrlenA (lpString="*.mdb") returned 5
	[0132.158] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk", pszSpec="*.pfx") returned 0
	[0132.158] lstrlenA (lpString="*.pfx") returned 5
	[0132.158] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk", pszSpec="*.md") returned 0
	[0132.158] lstrlenA (lpString="*.md") returned 4
	[0132.158] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk", pszSpec="*.lnk") returned 1
	[0132.158] lstrlenA (lpString="*.lnk") returned 5
	[0132.158] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk"
	[0132.158] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk"
	[0132.158] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk."
	[0132.158] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk.exe"
	[0132.158] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\dijntxrlivz.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.158] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x568
	[0132.158] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x48fb6d63, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x48fb6d63, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x48fb6d63, dwHighDateTime=0x1d543d9)) returned 1
	[0132.158] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.158] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x526, lpOverlapped=0x0) returned 1
	[0132.159] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk") returned="diJNtxrlIvz.lnk"
	[0132.159] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.159] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x526, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x526, lpOverlapped=0x0) returned 1
	[0132.159] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.159] CloseHandle (hObject=0x21c) returned 1
	[0132.159] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\dijntxrlivz.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\dijntxrlivz.lnk.exe")) returned 1
	[0132.160] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52730762, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x52730762, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x52730762, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x636, dwReserved0=0x0, dwReserved1=0x0, cFileName="E6humPJEo2XHiUU.lnk", cAlternateFileName="E6HUMP~1.LNK")) returned 1
	[0132.160] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.160] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="E6humPJEo2XHiUU.lnk") returned 1
	[0132.160] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="E6humPJEo2XHiUU.lnk") returned 1
	[0132.160] lstrcmpiA (lpString1="", lpString2="E6humPJEo2XHiUU.lnk") returned -1
	[0132.160] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\diJNtxrlIvz.lnk") returned="diJNtxrlIvz.lnk"
	[0132.160] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.160] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.160] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.160] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.160] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="E6humPJEo2XHiUU.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk"
	[0132.160] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk", pszSpec="*.zip") returned 0
	[0132.160] lstrlenA (lpString="*.zip") returned 5
	[0132.160] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk", pszSpec="*.rar") returned 0
	[0132.160] lstrlenA (lpString="*.rar") returned 5
	[0132.160] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk", pszSpec="*.7z") returned 0
	[0132.160] lstrlenA (lpString="*.7z") returned 4
	[0132.160] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk", pszSpec="*.tar") returned 0
	[0132.160] lstrlenA (lpString="*.tar") returned 5
	[0132.161] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk", pszSpec="*.gzip") returned 0
	[0132.161] lstrlenA (lpString="*.gzip") returned 6
	[0132.161] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk", pszSpec="*.jpg") returned 0
	[0132.161] lstrlenA (lpString="*.jpg") returned 5
	[0132.161] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk", pszSpec="*.jpeg") returned 0
	[0132.161] lstrlenA (lpString="*.jpeg") returned 6
	[0132.161] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk", pszSpec="*.bmp") returned 0
	[0132.161] lstrlenA (lpString="*.bmp") returned 5
	[0132.161] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk", pszSpec="*.gif") returned 0
	[0132.161] lstrlenA (lpString="*.gif") returned 5
	[0132.161] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk", pszSpec="*.png") returned 0
	[0132.161] lstrlenA (lpString="*.png") returned 5
	[0132.161] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk", pszSpec="*.doc") returned 0
	[0132.161] lstrlenA (lpString="*.doc") returned 5
	[0132.161] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk", pszSpec="*.docx") returned 0
	[0132.161] lstrlenA (lpString="*.docx") returned 6
	[0132.161] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk", pszSpec="*.xls") returned 0
	[0132.161] lstrlenA (lpString="*.xls") returned 5
	[0132.161] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk", pszSpec="*.xlsx") returned 0
	[0132.161] lstrlenA (lpString="*.xlsx") returned 6
	[0132.161] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk", pszSpec="*.ppt") returned 0
	[0132.161] lstrlenA (lpString="*.ppt") returned 5
	[0132.161] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk", pszSpec="*.pptx") returned 0
	[0132.161] lstrlenA (lpString="*.pptx") returned 6
	[0132.161] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk", pszSpec="*.txt") returned 0
	[0132.161] lstrlenA (lpString="*.txt") returned 5
	[0132.161] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk", pszSpec="*.pdf") returned 0
	[0132.161] lstrlenA (lpString="*.pdf") returned 5
	[0132.161] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk", pszSpec="*.htm") returned 0
	[0132.161] lstrlenA (lpString="*.htm") returned 5
	[0132.161] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk", pszSpec="*.html") returned 0
	[0132.161] lstrlenA (lpString="*.html") returned 6
	[0132.161] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk", pszSpec="*.mdb") returned 0
	[0132.161] lstrlenA (lpString="*.mdb") returned 5
	[0132.161] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk", pszSpec="*.pfx") returned 0
	[0132.161] lstrlenA (lpString="*.pfx") returned 5
	[0132.161] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk", pszSpec="*.md") returned 0
	[0132.162] lstrlenA (lpString="*.md") returned 4
	[0132.162] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk", pszSpec="*.lnk") returned 1
	[0132.162] lstrlenA (lpString="*.lnk") returned 5
	[0132.162] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk"
	[0132.162] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk"
	[0132.162] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk."
	[0132.162] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk.exe"
	[0132.162] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\e6humpjeo2xhiuu.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.162] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x636
	[0132.162] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x52730762, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x52730762, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x52730762, dwHighDateTime=0x1d543d9)) returned 1
	[0132.169] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.169] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x5f4, lpOverlapped=0x0) returned 1
	[0132.170] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk") returned="E6humPJEo2XHiUU.lnk"
	[0132.170] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.170] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x5f4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x5f4, lpOverlapped=0x0) returned 1
	[0132.170] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.173] CloseHandle (hObject=0x21c) returned 1
	[0132.173] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\e6humpjeo2xhiuu.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\e6humpjeo2xhiuu.lnk.exe")) returned 1
	[0132.174] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5167fdb1, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x5167fdb1, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x516a5fb9, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x60c, dwReserved0=0x0, dwReserved1=0x0, cFileName="egzqLAl.lnk", cAlternateFileName="")) returned 1
	[0132.174] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.174] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="egzqLAl.lnk") returned -1
	[0132.174] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="egzqLAl.lnk") returned 1
	[0132.174] lstrcmpiA (lpString1="", lpString2="egzqLAl.lnk") returned -1
	[0132.174] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E6humPJEo2XHiUU.lnk") returned="E6humPJEo2XHiUU.lnk"
	[0132.174] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.174] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.174] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.174] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.174] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="egzqLAl.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk"
	[0132.174] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk", pszSpec="*.zip") returned 0
	[0132.174] lstrlenA (lpString="*.zip") returned 5
	[0132.174] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk", pszSpec="*.rar") returned 0
	[0132.174] lstrlenA (lpString="*.rar") returned 5
	[0132.174] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk", pszSpec="*.7z") returned 0
	[0132.174] lstrlenA (lpString="*.7z") returned 4
	[0132.174] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk", pszSpec="*.tar") returned 0
	[0132.174] lstrlenA (lpString="*.tar") returned 5
	[0132.174] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk", pszSpec="*.gzip") returned 0
	[0132.174] lstrlenA (lpString="*.gzip") returned 6
	[0132.174] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk", pszSpec="*.jpg") returned 0
	[0132.174] lstrlenA (lpString="*.jpg") returned 5
	[0132.174] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk", pszSpec="*.jpeg") returned 0
	[0132.174] lstrlenA (lpString="*.jpeg") returned 6
	[0132.174] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk", pszSpec="*.bmp") returned 0
	[0132.174] lstrlenA (lpString="*.bmp") returned 5
	[0132.174] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk", pszSpec="*.gif") returned 0
	[0132.174] lstrlenA (lpString="*.gif") returned 5
	[0132.175] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk", pszSpec="*.png") returned 0
	[0132.175] lstrlenA (lpString="*.png") returned 5
	[0132.175] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk", pszSpec="*.doc") returned 0
	[0132.175] lstrlenA (lpString="*.doc") returned 5
	[0132.175] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk", pszSpec="*.docx") returned 0
	[0132.175] lstrlenA (lpString="*.docx") returned 6
	[0132.175] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk", pszSpec="*.xls") returned 0
	[0132.175] lstrlenA (lpString="*.xls") returned 5
	[0132.175] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk", pszSpec="*.xlsx") returned 0
	[0132.175] lstrlenA (lpString="*.xlsx") returned 6
	[0132.175] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk", pszSpec="*.ppt") returned 0
	[0132.175] lstrlenA (lpString="*.ppt") returned 5
	[0132.175] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk", pszSpec="*.pptx") returned 0
	[0132.175] lstrlenA (lpString="*.pptx") returned 6
	[0132.175] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk", pszSpec="*.txt") returned 0
	[0132.175] lstrlenA (lpString="*.txt") returned 5
	[0132.175] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk", pszSpec="*.pdf") returned 0
	[0132.175] lstrlenA (lpString="*.pdf") returned 5
	[0132.175] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk", pszSpec="*.htm") returned 0
	[0132.175] lstrlenA (lpString="*.htm") returned 5
	[0132.175] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk", pszSpec="*.html") returned 0
	[0132.175] lstrlenA (lpString="*.html") returned 6
	[0132.175] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk", pszSpec="*.mdb") returned 0
	[0132.175] lstrlenA (lpString="*.mdb") returned 5
	[0132.175] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk", pszSpec="*.pfx") returned 0
	[0132.175] lstrlenA (lpString="*.pfx") returned 5
	[0132.175] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk", pszSpec="*.md") returned 0
	[0132.175] lstrlenA (lpString="*.md") returned 4
	[0132.175] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk", pszSpec="*.lnk") returned 1
	[0132.175] lstrlenA (lpString="*.lnk") returned 5
	[0132.175] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk"
	[0132.175] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk"
	[0132.175] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk."
	[0132.175] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk.exe"
	[0132.175] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\egzqlal.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.176] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x60c
	[0132.176] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5167fdb1, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x5167fdb1, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x516a5fb9, dwHighDateTime=0x1d543d9)) returned 1
	[0132.176] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.176] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x5ca, lpOverlapped=0x0) returned 1
	[0132.177] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk") returned="egzqLAl.lnk"
	[0132.177] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.177] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x5ca, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x5ca, lpOverlapped=0x0) returned 1
	[0132.177] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.177] CloseHandle (hObject=0x21c) returned 1
	[0132.177] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\egzqlal.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\egzqlal.lnk.exe")) returned 1
	[0132.177] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50403ba1, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x50403ba1, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x50534e78, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="eL3bJWxEYt.lnk", cAlternateFileName="EL3BJW~1.LNK")) returned 1
	[0132.178] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.178] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="eL3bJWxEYt.lnk") returned -1
	[0132.178] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="eL3bJWxEYt.lnk") returned 1
	[0132.178] lstrcmpiA (lpString1="", lpString2="eL3bJWxEYt.lnk") returned -1
	[0132.178] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\egzqLAl.lnk") returned="egzqLAl.lnk"
	[0132.178] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.178] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.178] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.178] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.178] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="eL3bJWxEYt.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk"
	[0132.178] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk", pszSpec="*.zip") returned 0
	[0132.178] lstrlenA (lpString="*.zip") returned 5
	[0132.178] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk", pszSpec="*.rar") returned 0
	[0132.178] lstrlenA (lpString="*.rar") returned 5
	[0132.178] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk", pszSpec="*.7z") returned 0
	[0132.178] lstrlenA (lpString="*.7z") returned 4
	[0132.178] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk", pszSpec="*.tar") returned 0
	[0132.178] lstrlenA (lpString="*.tar") returned 5
	[0132.178] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk", pszSpec="*.gzip") returned 0
	[0132.178] lstrlenA (lpString="*.gzip") returned 6
	[0132.178] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk", pszSpec="*.jpg") returned 0
	[0132.178] lstrlenA (lpString="*.jpg") returned 5
	[0132.178] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk", pszSpec="*.jpeg") returned 0
	[0132.178] lstrlenA (lpString="*.jpeg") returned 6
	[0132.179] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk", pszSpec="*.bmp") returned 0
	[0132.179] lstrlenA (lpString="*.bmp") returned 5
	[0132.179] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk", pszSpec="*.gif") returned 0
	[0132.179] lstrlenA (lpString="*.gif") returned 5
	[0132.179] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk", pszSpec="*.png") returned 0
	[0132.179] lstrlenA (lpString="*.png") returned 5
	[0132.179] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk", pszSpec="*.doc") returned 0
	[0132.179] lstrlenA (lpString="*.doc") returned 5
	[0132.179] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk", pszSpec="*.docx") returned 0
	[0132.179] lstrlenA (lpString="*.docx") returned 6
	[0132.179] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk", pszSpec="*.xls") returned 0
	[0132.179] lstrlenA (lpString="*.xls") returned 5
	[0132.179] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk", pszSpec="*.xlsx") returned 0
	[0132.179] lstrlenA (lpString="*.xlsx") returned 6
	[0132.179] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk", pszSpec="*.ppt") returned 0
	[0132.179] lstrlenA (lpString="*.ppt") returned 5
	[0132.179] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk", pszSpec="*.pptx") returned 0
	[0132.179] lstrlenA (lpString="*.pptx") returned 6
	[0132.179] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk", pszSpec="*.txt") returned 0
	[0132.179] lstrlenA (lpString="*.txt") returned 5
	[0132.179] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk", pszSpec="*.pdf") returned 0
	[0132.179] lstrlenA (lpString="*.pdf") returned 5
	[0132.179] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk", pszSpec="*.htm") returned 0
	[0132.179] lstrlenA (lpString="*.htm") returned 5
	[0132.179] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk", pszSpec="*.html") returned 0
	[0132.179] lstrlenA (lpString="*.html") returned 6
	[0132.179] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk", pszSpec="*.mdb") returned 0
	[0132.179] lstrlenA (lpString="*.mdb") returned 5
	[0132.179] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk", pszSpec="*.pfx") returned 0
	[0132.179] lstrlenA (lpString="*.pfx") returned 5
	[0132.179] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk", pszSpec="*.md") returned 0
	[0132.179] lstrlenA (lpString="*.md") returned 4
	[0132.179] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk", pszSpec="*.lnk") returned 1
	[0132.179] lstrlenA (lpString="*.lnk") returned 5
	[0132.179] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk"
	[0132.179] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk"
	[0132.179] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk."
	[0132.179] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk.exe"
	[0132.180] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\el3bjwxeyt.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.180] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ba
	[0132.180] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x50403ba1, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x50403ba1, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x50534e78, dwHighDateTime=0x1d543d9)) returned 1
	[0132.180] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.180] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x378, lpOverlapped=0x0) returned 1
	[0132.181] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk") returned="eL3bJWxEYt.lnk"
	[0132.181] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.181] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x378, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x378, lpOverlapped=0x0) returned 1
	[0132.181] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.181] CloseHandle (hObject=0x21c) returned 1
	[0132.181] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\el3bjwxeyt.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\el3bjwxeyt.lnk.exe")) returned 1
	[0132.182] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x518bc30d, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x518bc30d, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x518bc30d, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x292, dwReserved0=0x0, dwReserved1=0x0, cFileName="ElDHlj7 oWvp.lnk", cAlternateFileName="ELDHLJ~1.LNK")) returned 1
	[0132.182] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.182] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="ElDHlj7 oWvp.lnk") returned -1
	[0132.182] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="ElDHlj7 oWvp.lnk") returned 1
	[0132.182] lstrcmpiA (lpString1="", lpString2="ElDHlj7 oWvp.lnk") returned -1
	[0132.182] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eL3bJWxEYt.lnk") returned="eL3bJWxEYt.lnk"
	[0132.182] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.182] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.182] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.182] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.182] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ElDHlj7 oWvp.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk"
	[0132.182] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk", pszSpec="*.zip") returned 0
	[0132.182] lstrlenA (lpString="*.zip") returned 5
	[0132.182] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk", pszSpec="*.rar") returned 0
	[0132.182] lstrlenA (lpString="*.rar") returned 5
	[0132.182] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk", pszSpec="*.7z") returned 0
	[0132.182] lstrlenA (lpString="*.7z") returned 4
	[0132.182] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk", pszSpec="*.tar") returned 0
	[0132.182] lstrlenA (lpString="*.tar") returned 5
	[0132.182] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk", pszSpec="*.gzip") returned 0
	[0132.182] lstrlenA (lpString="*.gzip") returned 6
	[0132.182] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk", pszSpec="*.jpg") returned 0
	[0132.182] lstrlenA (lpString="*.jpg") returned 5
	[0132.182] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk", pszSpec="*.jpeg") returned 0
	[0132.182] lstrlenA (lpString="*.jpeg") returned 6
	[0132.182] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk", pszSpec="*.bmp") returned 0
	[0132.182] lstrlenA (lpString="*.bmp") returned 5
	[0132.182] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk", pszSpec="*.gif") returned 0
	[0132.182] lstrlenA (lpString="*.gif") returned 5
	[0132.182] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk", pszSpec="*.png") returned 0
	[0132.182] lstrlenA (lpString="*.png") returned 5
	[0132.182] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk", pszSpec="*.doc") returned 0
	[0132.183] lstrlenA (lpString="*.doc") returned 5
	[0132.183] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk", pszSpec="*.docx") returned 0
	[0132.183] lstrlenA (lpString="*.docx") returned 6
	[0132.183] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk", pszSpec="*.xls") returned 0
	[0132.183] lstrlenA (lpString="*.xls") returned 5
	[0132.183] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk", pszSpec="*.xlsx") returned 0
	[0132.183] lstrlenA (lpString="*.xlsx") returned 6
	[0132.183] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk", pszSpec="*.ppt") returned 0
	[0132.183] lstrlenA (lpString="*.ppt") returned 5
	[0132.183] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk", pszSpec="*.pptx") returned 0
	[0132.183] lstrlenA (lpString="*.pptx") returned 6
	[0132.183] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk", pszSpec="*.txt") returned 0
	[0132.183] lstrlenA (lpString="*.txt") returned 5
	[0132.183] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk", pszSpec="*.pdf") returned 0
	[0132.183] lstrlenA (lpString="*.pdf") returned 5
	[0132.183] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk", pszSpec="*.htm") returned 0
	[0132.183] lstrlenA (lpString="*.htm") returned 5
	[0132.183] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk", pszSpec="*.html") returned 0
	[0132.183] lstrlenA (lpString="*.html") returned 6
	[0132.183] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk", pszSpec="*.mdb") returned 0
	[0132.183] lstrlenA (lpString="*.mdb") returned 5
	[0132.183] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk", pszSpec="*.pfx") returned 0
	[0132.183] lstrlenA (lpString="*.pfx") returned 5
	[0132.183] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk", pszSpec="*.md") returned 0
	[0132.183] lstrlenA (lpString="*.md") returned 4
	[0132.183] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk", pszSpec="*.lnk") returned 1
	[0132.183] lstrlenA (lpString="*.lnk") returned 5
	[0132.183] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk"
	[0132.183] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk"
	[0132.183] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk."
	[0132.183] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk.exe"
	[0132.183] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\eldhlj7 owvp.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.184] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x292
	[0132.184] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x518bc30d, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x518bc30d, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x518bc30d, dwHighDateTime=0x1d543d9)) returned 1
	[0132.184] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.184] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x250, lpOverlapped=0x0) returned 1
	[0132.184] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk") returned="ElDHlj7 oWvp.lnk"
	[0132.184] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.185] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x250, lpOverlapped=0x0) returned 1
	[0132.185] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.185] CloseHandle (hObject=0x21c) returned 1
	[0132.185] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\eldhlj7 owvp.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\eldhlj7 owvp.lnk.exe")) returned 1
	[0132.186] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a363fd7, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x524f41f8, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x524f41f8, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x36e, dwReserved0=0x0, dwReserved1=0x0, cFileName="enLrXss Klpa.lnk", cAlternateFileName="ENLRXS~1.LNK")) returned 1
	[0132.186] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.186] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="enLrXss Klpa.lnk") returned -1
	[0132.186] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="enLrXss Klpa.lnk") returned 1
	[0132.186] lstrcmpiA (lpString1="", lpString2="enLrXss Klpa.lnk") returned -1
	[0132.186] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ElDHlj7 oWvp.lnk") returned="ElDHlj7 oWvp.lnk"
	[0132.186] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.186] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.186] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.186] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.186] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="enLrXss Klpa.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk"
	[0132.186] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk", pszSpec="*.zip") returned 0
	[0132.186] lstrlenA (lpString="*.zip") returned 5
	[0132.186] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk", pszSpec="*.rar") returned 0
	[0132.186] lstrlenA (lpString="*.rar") returned 5
	[0132.186] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk", pszSpec="*.7z") returned 0
	[0132.187] lstrlenA (lpString="*.7z") returned 4
	[0132.187] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk", pszSpec="*.tar") returned 0
	[0132.187] lstrlenA (lpString="*.tar") returned 5
	[0132.187] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk", pszSpec="*.gzip") returned 0
	[0132.187] lstrlenA (lpString="*.gzip") returned 6
	[0132.187] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk", pszSpec="*.jpg") returned 0
	[0132.187] lstrlenA (lpString="*.jpg") returned 5
	[0132.187] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk", pszSpec="*.jpeg") returned 0
	[0132.187] lstrlenA (lpString="*.jpeg") returned 6
	[0132.187] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk", pszSpec="*.bmp") returned 0
	[0132.187] lstrlenA (lpString="*.bmp") returned 5
	[0132.187] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk", pszSpec="*.gif") returned 0
	[0132.187] lstrlenA (lpString="*.gif") returned 5
	[0132.187] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk", pszSpec="*.png") returned 0
	[0132.187] lstrlenA (lpString="*.png") returned 5
	[0132.187] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk", pszSpec="*.doc") returned 0
	[0132.187] lstrlenA (lpString="*.doc") returned 5
	[0132.187] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk", pszSpec="*.docx") returned 0
	[0132.187] lstrlenA (lpString="*.docx") returned 6
	[0132.187] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk", pszSpec="*.xls") returned 0
	[0132.187] lstrlenA (lpString="*.xls") returned 5
	[0132.187] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk", pszSpec="*.xlsx") returned 0
	[0132.187] lstrlenA (lpString="*.xlsx") returned 6
	[0132.187] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk", pszSpec="*.ppt") returned 0
	[0132.187] lstrlenA (lpString="*.ppt") returned 5
	[0132.187] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk", pszSpec="*.pptx") returned 0
	[0132.187] lstrlenA (lpString="*.pptx") returned 6
	[0132.187] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk", pszSpec="*.txt") returned 0
	[0132.187] lstrlenA (lpString="*.txt") returned 5
	[0132.187] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk", pszSpec="*.pdf") returned 0
	[0132.187] lstrlenA (lpString="*.pdf") returned 5
	[0132.187] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk", pszSpec="*.htm") returned 0
	[0132.187] lstrlenA (lpString="*.htm") returned 5
	[0132.187] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk", pszSpec="*.html") returned 0
	[0132.187] lstrlenA (lpString="*.html") returned 6
	[0132.187] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk", pszSpec="*.mdb") returned 0
	[0132.188] lstrlenA (lpString="*.mdb") returned 5
	[0132.188] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk", pszSpec="*.pfx") returned 0
	[0132.188] lstrlenA (lpString="*.pfx") returned 5
	[0132.188] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk", pszSpec="*.md") returned 0
	[0132.188] lstrlenA (lpString="*.md") returned 4
	[0132.188] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk", pszSpec="*.lnk") returned 1
	[0132.188] lstrlenA (lpString="*.lnk") returned 5
	[0132.188] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk"
	[0132.188] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk"
	[0132.188] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk."
	[0132.188] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk.exe"
	[0132.188] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\enlrxss klpa.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.188] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x36e
	[0132.188] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x2a363fd7, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x524f41f8, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x524f41f8, dwHighDateTime=0x1d543d9)) returned 1
	[0132.188] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.188] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x32c, lpOverlapped=0x0) returned 1
	[0132.189] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk") returned="enLrXss Klpa.lnk"
	[0132.189] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.189] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x32c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x32c, lpOverlapped=0x0) returned 1
	[0132.189] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.190] CloseHandle (hObject=0x21c) returned 1
	[0132.190] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\enlrxss klpa.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\enlrxss klpa.lnk.exe")) returned 1
	[0132.190] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x526e41fc, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x526e41fc, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x526e41fc, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x4fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="EvOop_-rc IDVY.lnk", cAlternateFileName="EVOOP_~1.LNK")) returned 1
	[0132.191] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.191] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="EvOop_-rc IDVY.lnk") returned -1
	[0132.191] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="EvOop_-rc IDVY.lnk") returned 1
	[0132.191] lstrcmpiA (lpString1="", lpString2="EvOop_-rc IDVY.lnk") returned -1
	[0132.191] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enLrXss Klpa.lnk") returned="enLrXss Klpa.lnk"
	[0132.191] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.191] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.191] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.191] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.191] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="EvOop_-rc IDVY.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk"
	[0132.191] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk", pszSpec="*.zip") returned 0
	[0132.191] lstrlenA (lpString="*.zip") returned 5
	[0132.191] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk", pszSpec="*.rar") returned 0
	[0132.191] lstrlenA (lpString="*.rar") returned 5
	[0132.191] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk", pszSpec="*.7z") returned 0
	[0132.191] lstrlenA (lpString="*.7z") returned 4
	[0132.191] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk", pszSpec="*.tar") returned 0
	[0132.191] lstrlenA (lpString="*.tar") returned 5
	[0132.191] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk", pszSpec="*.gzip") returned 0
	[0132.191] lstrlenA (lpString="*.gzip") returned 6
	[0132.191] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk", pszSpec="*.jpg") returned 0
	[0132.191] lstrlenA (lpString="*.jpg") returned 5
	[0132.191] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk", pszSpec="*.jpeg") returned 0
	[0132.191] lstrlenA (lpString="*.jpeg") returned 6
	[0132.191] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk", pszSpec="*.bmp") returned 0
	[0132.191] lstrlenA (lpString="*.bmp") returned 5
	[0132.191] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk", pszSpec="*.gif") returned 0
	[0132.191] lstrlenA (lpString="*.gif") returned 5
	[0132.191] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk", pszSpec="*.png") returned 0
	[0132.191] lstrlenA (lpString="*.png") returned 5
	[0132.191] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk", pszSpec="*.doc") returned 0
	[0132.191] lstrlenA (lpString="*.doc") returned 5
	[0132.191] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk", pszSpec="*.docx") returned 0
	[0132.191] lstrlenA (lpString="*.docx") returned 6
	[0132.192] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk", pszSpec="*.xls") returned 0
	[0132.192] lstrlenA (lpString="*.xls") returned 5
	[0132.192] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk", pszSpec="*.xlsx") returned 0
	[0132.192] lstrlenA (lpString="*.xlsx") returned 6
	[0132.192] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk", pszSpec="*.ppt") returned 0
	[0132.192] lstrlenA (lpString="*.ppt") returned 5
	[0132.192] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk", pszSpec="*.pptx") returned 0
	[0132.192] lstrlenA (lpString="*.pptx") returned 6
	[0132.192] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk", pszSpec="*.txt") returned 0
	[0132.192] lstrlenA (lpString="*.txt") returned 5
	[0132.192] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk", pszSpec="*.pdf") returned 0
	[0132.192] lstrlenA (lpString="*.pdf") returned 5
	[0132.192] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk", pszSpec="*.htm") returned 0
	[0132.192] lstrlenA (lpString="*.htm") returned 5
	[0132.192] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk", pszSpec="*.html") returned 0
	[0132.192] lstrlenA (lpString="*.html") returned 6
	[0132.192] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk", pszSpec="*.mdb") returned 0
	[0132.192] lstrlenA (lpString="*.mdb") returned 5
	[0132.192] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk", pszSpec="*.pfx") returned 0
	[0132.192] lstrlenA (lpString="*.pfx") returned 5
	[0132.192] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk", pszSpec="*.md") returned 0
	[0132.192] lstrlenA (lpString="*.md") returned 4
	[0132.192] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk", pszSpec="*.lnk") returned 1
	[0132.192] lstrlenA (lpString="*.lnk") returned 5
	[0132.192] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk"
	[0132.192] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk"
	[0132.192] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk."
	[0132.192] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk.exe"
	[0132.192] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\evoop_-rc idvy.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.193] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4fd
	[0132.193] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x526e41fc, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x526e41fc, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x526e41fc, dwHighDateTime=0x1d543d9)) returned 1
	[0132.193] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.193] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x4bb, lpOverlapped=0x0) returned 1
	[0132.194] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk") returned="EvOop_-rc IDVY.lnk"
	[0132.194] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.194] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x4bb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x4bb, lpOverlapped=0x0) returned 1
	[0132.194] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.194] CloseHandle (hObject=0x21c) returned 1
	[0132.194] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\evoop_-rc idvy.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\evoop_-rc idvy.lnk.exe")) returned 1
	[0132.195] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fb38d8b, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x4fb38d8b, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x4fb8528d, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="eweJnzD.lnk", cAlternateFileName="")) returned 1
	[0132.195] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.195] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="eweJnzD.lnk") returned -1
	[0132.195] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="eweJnzD.lnk") returned 1
	[0132.195] lstrcmpiA (lpString1="", lpString2="eweJnzD.lnk") returned -1
	[0132.195] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvOop_-rc IDVY.lnk") returned="EvOop_-rc IDVY.lnk"
	[0132.195] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.195] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.195] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.195] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.195] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="eweJnzD.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk"
	[0132.195] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk", pszSpec="*.zip") returned 0
	[0132.195] lstrlenA (lpString="*.zip") returned 5
	[0132.195] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk", pszSpec="*.rar") returned 0
	[0132.195] lstrlenA (lpString="*.rar") returned 5
	[0132.195] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk", pszSpec="*.7z") returned 0
	[0132.195] lstrlenA (lpString="*.7z") returned 4
	[0132.195] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk", pszSpec="*.tar") returned 0
	[0132.195] lstrlenA (lpString="*.tar") returned 5
	[0132.195] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk", pszSpec="*.gzip") returned 0
	[0132.195] lstrlenA (lpString="*.gzip") returned 6
	[0132.195] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk", pszSpec="*.jpg") returned 0
	[0132.195] lstrlenA (lpString="*.jpg") returned 5
	[0132.195] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk", pszSpec="*.jpeg") returned 0
	[0132.195] lstrlenA (lpString="*.jpeg") returned 6
	[0132.195] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk", pszSpec="*.bmp") returned 0
	[0132.195] lstrlenA (lpString="*.bmp") returned 5
	[0132.195] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk", pszSpec="*.gif") returned 0
	[0132.195] lstrlenA (lpString="*.gif") returned 5
	[0132.195] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk", pszSpec="*.png") returned 0
	[0132.195] lstrlenA (lpString="*.png") returned 5
	[0132.195] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk", pszSpec="*.doc") returned 0
	[0132.195] lstrlenA (lpString="*.doc") returned 5
	[0132.196] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk", pszSpec="*.docx") returned 0
	[0132.196] lstrlenA (lpString="*.docx") returned 6
	[0132.196] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk", pszSpec="*.xls") returned 0
	[0132.196] lstrlenA (lpString="*.xls") returned 5
	[0132.196] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk", pszSpec="*.xlsx") returned 0
	[0132.196] lstrlenA (lpString="*.xlsx") returned 6
	[0132.196] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk", pszSpec="*.ppt") returned 0
	[0132.196] lstrlenA (lpString="*.ppt") returned 5
	[0132.196] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk", pszSpec="*.pptx") returned 0
	[0132.196] lstrlenA (lpString="*.pptx") returned 6
	[0132.196] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk", pszSpec="*.txt") returned 0
	[0132.196] lstrlenA (lpString="*.txt") returned 5
	[0132.196] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk", pszSpec="*.pdf") returned 0
	[0132.196] lstrlenA (lpString="*.pdf") returned 5
	[0132.196] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk", pszSpec="*.htm") returned 0
	[0132.196] lstrlenA (lpString="*.htm") returned 5
	[0132.196] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk", pszSpec="*.html") returned 0
	[0132.196] lstrlenA (lpString="*.html") returned 6
	[0132.196] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk", pszSpec="*.mdb") returned 0
	[0132.196] lstrlenA (lpString="*.mdb") returned 5
	[0132.196] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk", pszSpec="*.pfx") returned 0
	[0132.196] lstrlenA (lpString="*.pfx") returned 5
	[0132.196] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk", pszSpec="*.md") returned 0
	[0132.196] lstrlenA (lpString="*.md") returned 4
	[0132.196] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk", pszSpec="*.lnk") returned 1
	[0132.196] lstrlenA (lpString="*.lnk") returned 5
	[0132.196] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk"
	[0132.196] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk"
	[0132.196] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk."
	[0132.196] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk.exe"
	[0132.196] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ewejnzd.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.197] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ca
	[0132.197] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4fb38d8b, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x4fb38d8b, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4fb8528d, dwHighDateTime=0x1d543d9)) returned 1
	[0132.197] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.197] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x388, lpOverlapped=0x0) returned 1
	[0132.197] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk") returned="eweJnzD.lnk"
	[0132.197] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.198] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x388, lpOverlapped=0x0) returned 1
	[0132.198] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.198] CloseHandle (hObject=0x21c) returned 1
	[0132.198] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ewejnzd.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ewejnzd.lnk.exe")) returned 1
	[0132.198] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40d3a5d0, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x40d3a5d0, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x40d3a5d0, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="ewsELZc.lnk", cAlternateFileName="")) returned 1
	[0132.198] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.199] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="ewsELZc.lnk") returned -1
	[0132.199] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="ewsELZc.lnk") returned 1
	[0132.199] lstrcmpiA (lpString1="", lpString2="ewsELZc.lnk") returned -1
	[0132.199] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eweJnzD.lnk") returned="eweJnzD.lnk"
	[0132.199] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.199] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.199] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.199] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.199] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ewsELZc.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk"
	[0132.199] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk", pszSpec="*.zip") returned 0
	[0132.199] lstrlenA (lpString="*.zip") returned 5
	[0132.199] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk", pszSpec="*.rar") returned 0
	[0132.199] lstrlenA (lpString="*.rar") returned 5
	[0132.199] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk", pszSpec="*.7z") returned 0
	[0132.199] lstrlenA (lpString="*.7z") returned 4
	[0132.199] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk", pszSpec="*.tar") returned 0
	[0132.199] lstrlenA (lpString="*.tar") returned 5
	[0132.199] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk", pszSpec="*.gzip") returned 0
	[0132.199] lstrlenA (lpString="*.gzip") returned 6
	[0132.199] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk", pszSpec="*.jpg") returned 0
	[0132.199] lstrlenA (lpString="*.jpg") returned 5
	[0132.199] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk", pszSpec="*.jpeg") returned 0
	[0132.199] lstrlenA (lpString="*.jpeg") returned 6
	[0132.199] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk", pszSpec="*.bmp") returned 0
	[0132.199] lstrlenA (lpString="*.bmp") returned 5
	[0132.199] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk", pszSpec="*.gif") returned 0
	[0132.199] lstrlenA (lpString="*.gif") returned 5
	[0132.199] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk", pszSpec="*.png") returned 0
	[0132.199] lstrlenA (lpString="*.png") returned 5
	[0132.199] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk", pszSpec="*.doc") returned 0
	[0132.199] lstrlenA (lpString="*.doc") returned 5
	[0132.199] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk", pszSpec="*.docx") returned 0
	[0132.199] lstrlenA (lpString="*.docx") returned 6
	[0132.199] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk", pszSpec="*.xls") returned 0
	[0132.200] lstrlenA (lpString="*.xls") returned 5
	[0132.200] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk", pszSpec="*.xlsx") returned 0
	[0132.200] lstrlenA (lpString="*.xlsx") returned 6
	[0132.200] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk", pszSpec="*.ppt") returned 0
	[0132.200] lstrlenA (lpString="*.ppt") returned 5
	[0132.200] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk", pszSpec="*.pptx") returned 0
	[0132.200] lstrlenA (lpString="*.pptx") returned 6
	[0132.200] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk", pszSpec="*.txt") returned 0
	[0132.200] lstrlenA (lpString="*.txt") returned 5
	[0132.200] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk", pszSpec="*.pdf") returned 0
	[0132.200] lstrlenA (lpString="*.pdf") returned 5
	[0132.200] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk", pszSpec="*.htm") returned 0
	[0132.200] lstrlenA (lpString="*.htm") returned 5
	[0132.200] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk", pszSpec="*.html") returned 0
	[0132.200] lstrlenA (lpString="*.html") returned 6
	[0132.200] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk", pszSpec="*.mdb") returned 0
	[0132.200] lstrlenA (lpString="*.mdb") returned 5
	[0132.200] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk", pszSpec="*.pfx") returned 0
	[0132.200] lstrlenA (lpString="*.pfx") returned 5
	[0132.200] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk", pszSpec="*.md") returned 0
	[0132.200] lstrlenA (lpString="*.md") returned 4
	[0132.200] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk", pszSpec="*.lnk") returned 1
	[0132.200] lstrlenA (lpString="*.lnk") returned 5
	[0132.200] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk"
	[0132.200] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk"
	[0132.200] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk."
	[0132.200] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk.exe"
	[0132.200] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ewselzc.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.201] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ca
	[0132.201] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x40d3a5d0, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x40d3a5d0, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x40d3a5d0, dwHighDateTime=0x1d543d9)) returned 1
	[0132.201] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.201] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x388, lpOverlapped=0x0) returned 1
	[0132.201] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk") returned="ewsELZc.lnk"
	[0132.201] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.201] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x388, lpOverlapped=0x0) returned 1
	[0132.202] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.202] CloseHandle (hObject=0x21c) returned 1
	[0132.202] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ewselzc.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ewselzc.lnk.exe")) returned 1
	[0132.202] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4363c46a, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x4363c46a, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x4363c46a, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x4c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="F-DIy.lnk", cAlternateFileName="")) returned 1
	[0132.202] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.202] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="F-DIy.lnk") returned -1
	[0132.202] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="F-DIy.lnk") returned 1
	[0132.202] lstrcmpiA (lpString1="", lpString2="F-DIy.lnk") returned -1
	[0132.202] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewsELZc.lnk") returned="ewsELZc.lnk"
	[0132.202] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.202] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.203] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.203] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.203] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="F-DIy.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk"
	[0132.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk", pszSpec="*.zip") returned 0
	[0132.203] lstrlenA (lpString="*.zip") returned 5
	[0132.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk", pszSpec="*.rar") returned 0
	[0132.203] lstrlenA (lpString="*.rar") returned 5
	[0132.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk", pszSpec="*.7z") returned 0
	[0132.203] lstrlenA (lpString="*.7z") returned 4
	[0132.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk", pszSpec="*.tar") returned 0
	[0132.203] lstrlenA (lpString="*.tar") returned 5
	[0132.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk", pszSpec="*.gzip") returned 0
	[0132.203] lstrlenA (lpString="*.gzip") returned 6
	[0132.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk", pszSpec="*.jpg") returned 0
	[0132.203] lstrlenA (lpString="*.jpg") returned 5
	[0132.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk", pszSpec="*.jpeg") returned 0
	[0132.203] lstrlenA (lpString="*.jpeg") returned 6
	[0132.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk", pszSpec="*.bmp") returned 0
	[0132.203] lstrlenA (lpString="*.bmp") returned 5
	[0132.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk", pszSpec="*.gif") returned 0
	[0132.203] lstrlenA (lpString="*.gif") returned 5
	[0132.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk", pszSpec="*.png") returned 0
	[0132.203] lstrlenA (lpString="*.png") returned 5
	[0132.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk", pszSpec="*.doc") returned 0
	[0132.203] lstrlenA (lpString="*.doc") returned 5
	[0132.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk", pszSpec="*.docx") returned 0
	[0132.203] lstrlenA (lpString="*.docx") returned 6
	[0132.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk", pszSpec="*.xls") returned 0
	[0132.203] lstrlenA (lpString="*.xls") returned 5
	[0132.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk", pszSpec="*.xlsx") returned 0
	[0132.203] lstrlenA (lpString="*.xlsx") returned 6
	[0132.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk", pszSpec="*.ppt") returned 0
	[0132.203] lstrlenA (lpString="*.ppt") returned 5
	[0132.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk", pszSpec="*.pptx") returned 0
	[0132.204] lstrlenA (lpString="*.pptx") returned 6
	[0132.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk", pszSpec="*.txt") returned 0
	[0132.204] lstrlenA (lpString="*.txt") returned 5
	[0132.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk", pszSpec="*.pdf") returned 0
	[0132.204] lstrlenA (lpString="*.pdf") returned 5
	[0132.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk", pszSpec="*.htm") returned 0
	[0132.204] lstrlenA (lpString="*.htm") returned 5
	[0132.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk", pszSpec="*.html") returned 0
	[0132.204] lstrlenA (lpString="*.html") returned 6
	[0132.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk", pszSpec="*.mdb") returned 0
	[0132.204] lstrlenA (lpString="*.mdb") returned 5
	[0132.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk", pszSpec="*.pfx") returned 0
	[0132.204] lstrlenA (lpString="*.pfx") returned 5
	[0132.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk", pszSpec="*.md") returned 0
	[0132.204] lstrlenA (lpString="*.md") returned 4
	[0132.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk", pszSpec="*.lnk") returned 1
	[0132.204] lstrlenA (lpString="*.lnk") returned 5
	[0132.204] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk"
	[0132.204] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk"
	[0132.204] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk."
	[0132.204] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk.exe"
	[0132.204] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\f-diy.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.204] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4c3
	[0132.204] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4363c46a, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x4363c46a, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4363c46a, dwHighDateTime=0x1d543d9)) returned 1
	[0132.204] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.205] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x481, lpOverlapped=0x0) returned 1
	[0132.205] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk") returned="F-DIy.lnk"
	[0132.205] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.205] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x481, lpOverlapped=0x0) returned 1
	[0132.205] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.206] CloseHandle (hObject=0x21c) returned 1
	[0132.206] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\f-diy.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\f-diy.lnk.exe")) returned 1
	[0132.206] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20fc1657, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x20fc1657, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x20fc1657, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="fs2Ls1jsGfCkztgeA.lnk", cAlternateFileName="FS2LS1~1.LNK")) returned 1
	[0132.206] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.206] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="fs2Ls1jsGfCkztgeA.lnk") returned -1
	[0132.206] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="fs2Ls1jsGfCkztgeA.lnk") returned 1
	[0132.206] lstrcmpiA (lpString1="", lpString2="fs2Ls1jsGfCkztgeA.lnk") returned -1
	[0132.206] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F-DIy.lnk") returned="F-DIy.lnk"
	[0132.206] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.206] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.206] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.206] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.207] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="fs2Ls1jsGfCkztgeA.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk"
	[0132.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk", pszSpec="*.zip") returned 0
	[0132.207] lstrlenA (lpString="*.zip") returned 5
	[0132.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk", pszSpec="*.rar") returned 0
	[0132.207] lstrlenA (lpString="*.rar") returned 5
	[0132.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk", pszSpec="*.7z") returned 0
	[0132.207] lstrlenA (lpString="*.7z") returned 4
	[0132.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk", pszSpec="*.tar") returned 0
	[0132.207] lstrlenA (lpString="*.tar") returned 5
	[0132.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk", pszSpec="*.gzip") returned 0
	[0132.207] lstrlenA (lpString="*.gzip") returned 6
	[0132.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk", pszSpec="*.jpg") returned 0
	[0132.207] lstrlenA (lpString="*.jpg") returned 5
	[0132.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk", pszSpec="*.jpeg") returned 0
	[0132.207] lstrlenA (lpString="*.jpeg") returned 6
	[0132.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk", pszSpec="*.bmp") returned 0
	[0132.207] lstrlenA (lpString="*.bmp") returned 5
	[0132.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk", pszSpec="*.gif") returned 0
	[0132.207] lstrlenA (lpString="*.gif") returned 5
	[0132.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk", pszSpec="*.png") returned 0
	[0132.207] lstrlenA (lpString="*.png") returned 5
	[0132.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk", pszSpec="*.doc") returned 0
	[0132.207] lstrlenA (lpString="*.doc") returned 5
	[0132.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk", pszSpec="*.docx") returned 0
	[0132.207] lstrlenA (lpString="*.docx") returned 6
	[0132.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk", pszSpec="*.xls") returned 0
	[0132.207] lstrlenA (lpString="*.xls") returned 5
	[0132.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk", pszSpec="*.xlsx") returned 0
	[0132.207] lstrlenA (lpString="*.xlsx") returned 6
	[0132.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk", pszSpec="*.ppt") returned 0
	[0132.207] lstrlenA (lpString="*.ppt") returned 5
	[0132.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk", pszSpec="*.pptx") returned 0
	[0132.207] lstrlenA (lpString="*.pptx") returned 6
	[0132.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk", pszSpec="*.txt") returned 0
	[0132.207] lstrlenA (lpString="*.txt") returned 5
	[0132.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk", pszSpec="*.pdf") returned 0
	[0132.208] lstrlenA (lpString="*.pdf") returned 5
	[0132.208] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk", pszSpec="*.htm") returned 0
	[0132.208] lstrlenA (lpString="*.htm") returned 5
	[0132.208] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk", pszSpec="*.html") returned 0
	[0132.208] lstrlenA (lpString="*.html") returned 6
	[0132.208] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk", pszSpec="*.mdb") returned 0
	[0132.208] lstrlenA (lpString="*.mdb") returned 5
	[0132.208] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk", pszSpec="*.pfx") returned 0
	[0132.208] lstrlenA (lpString="*.pfx") returned 5
	[0132.208] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk", pszSpec="*.md") returned 0
	[0132.208] lstrlenA (lpString="*.md") returned 4
	[0132.208] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk", pszSpec="*.lnk") returned 1
	[0132.208] lstrlenA (lpString="*.lnk") returned 5
	[0132.208] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk"
	[0132.208] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk"
	[0132.208] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk."
	[0132.208] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk.exe"
	[0132.208] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fs2ls1jsgfckztgea.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.208] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ab
	[0132.208] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x20fc1657, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x20fc1657, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x20fc1657, dwHighDateTime=0x1d543d9)) returned 1
	[0132.208] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.208] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x269, lpOverlapped=0x0) returned 1
	[0132.214] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk") returned="fs2Ls1jsGfCkztgeA.lnk"
	[0132.214] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.214] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x269, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x269, lpOverlapped=0x0) returned 1
	[0132.215] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.215] CloseHandle (hObject=0x21c) returned 1
	[0132.215] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fs2ls1jsgfckztgea.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fs2ls1jsgfckztgea.lnk.exe")) returned 1
	[0132.215] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50771159, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x50771159, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x50771159, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="fWOIT ZVW.lnk", cAlternateFileName="FWOITZ~1.LNK")) returned 1
	[0132.215] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.215] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="fWOIT ZVW.lnk") returned -1
	[0132.215] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="fWOIT ZVW.lnk") returned 1
	[0132.215] lstrcmpiA (lpString1="", lpString2="fWOIT ZVW.lnk") returned -1
	[0132.215] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fs2Ls1jsGfCkztgeA.lnk") returned="fs2Ls1jsGfCkztgeA.lnk"
	[0132.215] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.216] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.216] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.216] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.216] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="fWOIT ZVW.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk"
	[0132.216] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk", pszSpec="*.zip") returned 0
	[0132.216] lstrlenA (lpString="*.zip") returned 5
	[0132.216] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk", pszSpec="*.rar") returned 0
	[0132.216] lstrlenA (lpString="*.rar") returned 5
	[0132.216] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk", pszSpec="*.7z") returned 0
	[0132.216] lstrlenA (lpString="*.7z") returned 4
	[0132.216] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk", pszSpec="*.tar") returned 0
	[0132.216] lstrlenA (lpString="*.tar") returned 5
	[0132.216] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk", pszSpec="*.gzip") returned 0
	[0132.216] lstrlenA (lpString="*.gzip") returned 6
	[0132.216] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk", pszSpec="*.jpg") returned 0
	[0132.216] lstrlenA (lpString="*.jpg") returned 5
	[0132.216] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk", pszSpec="*.jpeg") returned 0
	[0132.216] lstrlenA (lpString="*.jpeg") returned 6
	[0132.216] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk", pszSpec="*.bmp") returned 0
	[0132.216] lstrlenA (lpString="*.bmp") returned 5
	[0132.216] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk", pszSpec="*.gif") returned 0
	[0132.216] lstrlenA (lpString="*.gif") returned 5
	[0132.216] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk", pszSpec="*.png") returned 0
	[0132.216] lstrlenA (lpString="*.png") returned 5
	[0132.216] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk", pszSpec="*.doc") returned 0
	[0132.216] lstrlenA (lpString="*.doc") returned 5
	[0132.216] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk", pszSpec="*.docx") returned 0
	[0132.216] lstrlenA (lpString="*.docx") returned 6
	[0132.216] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk", pszSpec="*.xls") returned 0
	[0132.216] lstrlenA (lpString="*.xls") returned 5
	[0132.216] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk", pszSpec="*.xlsx") returned 0
	[0132.216] lstrlenA (lpString="*.xlsx") returned 6
	[0132.216] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk", pszSpec="*.ppt") returned 0
	[0132.216] lstrlenA (lpString="*.ppt") returned 5
	[0132.217] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk", pszSpec="*.pptx") returned 0
	[0132.217] lstrlenA (lpString="*.pptx") returned 6
	[0132.217] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk", pszSpec="*.txt") returned 0
	[0132.217] lstrlenA (lpString="*.txt") returned 5
	[0132.217] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk", pszSpec="*.pdf") returned 0
	[0132.217] lstrlenA (lpString="*.pdf") returned 5
	[0132.217] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk", pszSpec="*.htm") returned 0
	[0132.217] lstrlenA (lpString="*.htm") returned 5
	[0132.217] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk", pszSpec="*.html") returned 0
	[0132.217] lstrlenA (lpString="*.html") returned 6
	[0132.217] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk", pszSpec="*.mdb") returned 0
	[0132.217] lstrlenA (lpString="*.mdb") returned 5
	[0132.217] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk", pszSpec="*.pfx") returned 0
	[0132.217] lstrlenA (lpString="*.pfx") returned 5
	[0132.217] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk", pszSpec="*.md") returned 0
	[0132.217] lstrlenA (lpString="*.md") returned 4
	[0132.217] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk", pszSpec="*.lnk") returned 1
	[0132.217] lstrlenA (lpString="*.lnk") returned 5
	[0132.217] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk"
	[0132.217] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk"
	[0132.217] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk."
	[0132.217] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk.exe"
	[0132.217] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fwoit zvw.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.217] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b5
	[0132.217] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x50771159, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x50771159, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x50771159, dwHighDateTime=0x1d543d9)) returned 1
	[0132.218] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.218] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x373, lpOverlapped=0x0) returned 1
	[0132.218] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk") returned="fWOIT ZVW.lnk"
	[0132.218] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.218] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x373, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x373, lpOverlapped=0x0) returned 1
	[0132.218] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.219] CloseHandle (hObject=0x21c) returned 1
	[0132.219] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fwoit zvw.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fwoit zvw.lnk.exe")) returned 1
	[0132.219] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x506feadb, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x506feadb, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x506feadb, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FWr 8BKK.lnk", cAlternateFileName="FWR8BK~1.LNK")) returned 1
	[0132.219] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.219] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="FWr 8BKK.lnk") returned -1
	[0132.219] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="FWr 8BKK.lnk") returned 1
	[0132.219] lstrcmpiA (lpString1="", lpString2="FWr 8BKK.lnk") returned -1
	[0132.219] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fWOIT ZVW.lnk") returned="fWOIT ZVW.lnk"
	[0132.219] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.219] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.219] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.219] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.220] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="FWr 8BKK.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk"
	[0132.220] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk", pszSpec="*.zip") returned 0
	[0132.220] lstrlenA (lpString="*.zip") returned 5
	[0132.220] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk", pszSpec="*.rar") returned 0
	[0132.220] lstrlenA (lpString="*.rar") returned 5
	[0132.220] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk", pszSpec="*.7z") returned 0
	[0132.220] lstrlenA (lpString="*.7z") returned 4
	[0132.220] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk", pszSpec="*.tar") returned 0
	[0132.220] lstrlenA (lpString="*.tar") returned 5
	[0132.220] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk", pszSpec="*.gzip") returned 0
	[0132.220] lstrlenA (lpString="*.gzip") returned 6
	[0132.220] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk", pszSpec="*.jpg") returned 0
	[0132.220] lstrlenA (lpString="*.jpg") returned 5
	[0132.220] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk", pszSpec="*.jpeg") returned 0
	[0132.220] lstrlenA (lpString="*.jpeg") returned 6
	[0132.220] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk", pszSpec="*.bmp") returned 0
	[0132.220] lstrlenA (lpString="*.bmp") returned 5
	[0132.220] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk", pszSpec="*.gif") returned 0
	[0132.220] lstrlenA (lpString="*.gif") returned 5
	[0132.220] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk", pszSpec="*.png") returned 0
	[0132.220] lstrlenA (lpString="*.png") returned 5
	[0132.220] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk", pszSpec="*.doc") returned 0
	[0132.220] lstrlenA (lpString="*.doc") returned 5
	[0132.220] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk", pszSpec="*.docx") returned 0
	[0132.220] lstrlenA (lpString="*.docx") returned 6
	[0132.220] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk", pszSpec="*.xls") returned 0
	[0132.220] lstrlenA (lpString="*.xls") returned 5
	[0132.220] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk", pszSpec="*.xlsx") returned 0
	[0132.220] lstrlenA (lpString="*.xlsx") returned 6
	[0132.220] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk", pszSpec="*.ppt") returned 0
	[0132.220] lstrlenA (lpString="*.ppt") returned 5
	[0132.220] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk", pszSpec="*.pptx") returned 0
	[0132.220] lstrlenA (lpString="*.pptx") returned 6
	[0132.220] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk", pszSpec="*.txt") returned 0
	[0132.220] lstrlenA (lpString="*.txt") returned 5
	[0132.220] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk", pszSpec="*.pdf") returned 0
	[0132.221] lstrlenA (lpString="*.pdf") returned 5
	[0132.221] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk", pszSpec="*.htm") returned 0
	[0132.221] lstrlenA (lpString="*.htm") returned 5
	[0132.221] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk", pszSpec="*.html") returned 0
	[0132.221] lstrlenA (lpString="*.html") returned 6
	[0132.221] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk", pszSpec="*.mdb") returned 0
	[0132.221] lstrlenA (lpString="*.mdb") returned 5
	[0132.221] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk", pszSpec="*.pfx") returned 0
	[0132.221] lstrlenA (lpString="*.pfx") returned 5
	[0132.221] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk", pszSpec="*.md") returned 0
	[0132.221] lstrlenA (lpString="*.md") returned 4
	[0132.221] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk", pszSpec="*.lnk") returned 1
	[0132.221] lstrlenA (lpString="*.lnk") returned 5
	[0132.221] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk"
	[0132.221] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk"
	[0132.221] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk."
	[0132.221] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk.exe"
	[0132.221] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fwr 8bkk.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.221] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3bc
	[0132.221] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x506feadb, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x506feadb, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x506feadb, dwHighDateTime=0x1d543d9)) returned 1
	[0132.221] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.221] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x37a, lpOverlapped=0x0) returned 1
	[0132.222] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk") returned="FWr 8BKK.lnk"
	[0132.222] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.222] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x37a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x37a, lpOverlapped=0x0) returned 1
	[0132.222] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.222] CloseHandle (hObject=0x21c) returned 1
	[0132.222] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fwr 8bkk.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fwr 8bkk.lnk.exe")) returned 1
	[0132.223] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x347a8d5c, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x526bdf64, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x526bdf64, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x415, dwReserved0=0x0, dwReserved1=0x0, cFileName="GDjs6TVN1VcFEQ.lnk", cAlternateFileName="GDJS6T~1.LNK")) returned 1
	[0132.223] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.223] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="GDjs6TVN1VcFEQ.lnk") returned -1
	[0132.223] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="GDjs6TVN1VcFEQ.lnk") returned 1
	[0132.223] lstrcmpiA (lpString1="", lpString2="GDjs6TVN1VcFEQ.lnk") returned -1
	[0132.223] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWr 8BKK.lnk") returned="FWr 8BKK.lnk"
	[0132.223] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.223] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.223] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.223] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.223] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="GDjs6TVN1VcFEQ.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk"
	[0132.223] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk", pszSpec="*.zip") returned 0
	[0132.223] lstrlenA (lpString="*.zip") returned 5
	[0132.224] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk", pszSpec="*.rar") returned 0
	[0132.224] lstrlenA (lpString="*.rar") returned 5
	[0132.224] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk", pszSpec="*.7z") returned 0
	[0132.224] lstrlenA (lpString="*.7z") returned 4
	[0132.224] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk", pszSpec="*.tar") returned 0
	[0132.224] lstrlenA (lpString="*.tar") returned 5
	[0132.224] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk", pszSpec="*.gzip") returned 0
	[0132.224] lstrlenA (lpString="*.gzip") returned 6
	[0132.224] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk", pszSpec="*.jpg") returned 0
	[0132.224] lstrlenA (lpString="*.jpg") returned 5
	[0132.224] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk", pszSpec="*.jpeg") returned 0
	[0132.224] lstrlenA (lpString="*.jpeg") returned 6
	[0132.224] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk", pszSpec="*.bmp") returned 0
	[0132.224] lstrlenA (lpString="*.bmp") returned 5
	[0132.224] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk", pszSpec="*.gif") returned 0
	[0132.224] lstrlenA (lpString="*.gif") returned 5
	[0132.224] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk", pszSpec="*.png") returned 0
	[0132.224] lstrlenA (lpString="*.png") returned 5
	[0132.224] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk", pszSpec="*.doc") returned 0
	[0132.224] lstrlenA (lpString="*.doc") returned 5
	[0132.224] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk", pszSpec="*.docx") returned 0
	[0132.224] lstrlenA (lpString="*.docx") returned 6
	[0132.224] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk", pszSpec="*.xls") returned 0
	[0132.224] lstrlenA (lpString="*.xls") returned 5
	[0132.224] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk", pszSpec="*.xlsx") returned 0
	[0132.224] lstrlenA (lpString="*.xlsx") returned 6
	[0132.224] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk", pszSpec="*.ppt") returned 0
	[0132.224] lstrlenA (lpString="*.ppt") returned 5
	[0132.224] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk", pszSpec="*.pptx") returned 0
	[0132.224] lstrlenA (lpString="*.pptx") returned 6
	[0132.224] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk", pszSpec="*.txt") returned 0
	[0132.224] lstrlenA (lpString="*.txt") returned 5
	[0132.224] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk", pszSpec="*.pdf") returned 0
	[0132.224] lstrlenA (lpString="*.pdf") returned 5
	[0132.224] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk", pszSpec="*.htm") returned 0
	[0132.224] lstrlenA (lpString="*.htm") returned 5
	[0132.224] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk", pszSpec="*.html") returned 0
	[0132.224] lstrlenA (lpString="*.html") returned 6
	[0132.225] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk", pszSpec="*.mdb") returned 0
	[0132.225] lstrlenA (lpString="*.mdb") returned 5
	[0132.225] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk", pszSpec="*.pfx") returned 0
	[0132.225] lstrlenA (lpString="*.pfx") returned 5
	[0132.225] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk", pszSpec="*.md") returned 0
	[0132.225] lstrlenA (lpString="*.md") returned 4
	[0132.226] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk", pszSpec="*.lnk") returned 1
	[0132.226] lstrlenA (lpString="*.lnk") returned 5
	[0132.226] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk"
	[0132.226] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk"
	[0132.226] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk."
	[0132.226] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk.exe"
	[0132.226] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gdjs6tvn1vcfeq.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.226] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x415
	[0132.226] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x347a8d5c, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x526bdf64, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x526bdf64, dwHighDateTime=0x1d543d9)) returned 1
	[0132.226] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.226] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x3d3, lpOverlapped=0x0) returned 1
	[0132.227] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk") returned="GDjs6TVN1VcFEQ.lnk"
	[0132.227] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.227] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x3d3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x3d3, lpOverlapped=0x0) returned 1
	[0132.227] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.227] CloseHandle (hObject=0x21c) returned 1
	[0132.227] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gdjs6tvn1vcfeq.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gdjs6tvn1vcfeq.lnk.exe")) returned 1
	[0132.228] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x206c159e, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x44928ea7, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x44928ea7, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x46c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GHi4txwrX.lnk", cAlternateFileName="GHI4TX~1.LNK")) returned 1
	[0132.228] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.228] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="GHi4txwrX.lnk") returned -1
	[0132.228] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="GHi4txwrX.lnk") returned 1
	[0132.228] lstrcmpiA (lpString1="", lpString2="GHi4txwrX.lnk") returned -1
	[0132.228] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDjs6TVN1VcFEQ.lnk") returned="GDjs6TVN1VcFEQ.lnk"
	[0132.228] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.228] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.228] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.228] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.228] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="GHi4txwrX.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk"
	[0132.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk", pszSpec="*.zip") returned 0
	[0132.228] lstrlenA (lpString="*.zip") returned 5
	[0132.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk", pszSpec="*.rar") returned 0
	[0132.228] lstrlenA (lpString="*.rar") returned 5
	[0132.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk", pszSpec="*.7z") returned 0
	[0132.228] lstrlenA (lpString="*.7z") returned 4
	[0132.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk", pszSpec="*.tar") returned 0
	[0132.228] lstrlenA (lpString="*.tar") returned 5
	[0132.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk", pszSpec="*.gzip") returned 0
	[0132.228] lstrlenA (lpString="*.gzip") returned 6
	[0132.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk", pszSpec="*.jpg") returned 0
	[0132.228] lstrlenA (lpString="*.jpg") returned 5
	[0132.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk", pszSpec="*.jpeg") returned 0
	[0132.228] lstrlenA (lpString="*.jpeg") returned 6
	[0132.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk", pszSpec="*.bmp") returned 0
	[0132.229] lstrlenA (lpString="*.bmp") returned 5
	[0132.229] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk", pszSpec="*.gif") returned 0
	[0132.229] lstrlenA (lpString="*.gif") returned 5
	[0132.229] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk", pszSpec="*.png") returned 0
	[0132.229] lstrlenA (lpString="*.png") returned 5
	[0132.229] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk", pszSpec="*.doc") returned 0
	[0132.229] lstrlenA (lpString="*.doc") returned 5
	[0132.229] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk", pszSpec="*.docx") returned 0
	[0132.229] lstrlenA (lpString="*.docx") returned 6
	[0132.229] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk", pszSpec="*.xls") returned 0
	[0132.229] lstrlenA (lpString="*.xls") returned 5
	[0132.229] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk", pszSpec="*.xlsx") returned 0
	[0132.229] lstrlenA (lpString="*.xlsx") returned 6
	[0132.229] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk", pszSpec="*.ppt") returned 0
	[0132.229] lstrlenA (lpString="*.ppt") returned 5
	[0132.229] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk", pszSpec="*.pptx") returned 0
	[0132.229] lstrlenA (lpString="*.pptx") returned 6
	[0132.229] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk", pszSpec="*.txt") returned 0
	[0132.229] lstrlenA (lpString="*.txt") returned 5
	[0132.229] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk", pszSpec="*.pdf") returned 0
	[0132.229] lstrlenA (lpString="*.pdf") returned 5
	[0132.229] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk", pszSpec="*.htm") returned 0
	[0132.229] lstrlenA (lpString="*.htm") returned 5
	[0132.229] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk", pszSpec="*.html") returned 0
	[0132.229] lstrlenA (lpString="*.html") returned 6
	[0132.229] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk", pszSpec="*.mdb") returned 0
	[0132.229] lstrlenA (lpString="*.mdb") returned 5
	[0132.229] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk", pszSpec="*.pfx") returned 0
	[0132.229] lstrlenA (lpString="*.pfx") returned 5
	[0132.229] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk", pszSpec="*.md") returned 0
	[0132.229] lstrlenA (lpString="*.md") returned 4
	[0132.229] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk", pszSpec="*.lnk") returned 1
	[0132.229] lstrlenA (lpString="*.lnk") returned 5
	[0132.229] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk"
	[0132.229] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk"
	[0132.229] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk."
	[0132.229] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk.exe"
	[0132.230] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ghi4txwrx.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.230] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46c
	[0132.230] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x206c159e, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x44928ea7, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x44928ea7, dwHighDateTime=0x1d543d9)) returned 1
	[0132.230] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.230] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x42a, lpOverlapped=0x0) returned 1
	[0132.231] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk") returned="GHi4txwrX.lnk"
	[0132.231] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.231] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x42a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x42a, lpOverlapped=0x0) returned 1
	[0132.231] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.231] CloseHandle (hObject=0x21c) returned 1
	[0132.231] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ghi4txwrx.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ghi4txwrx.lnk.exe")) returned 1
	[0132.232] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cca1b86, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x4cca1b86, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x4ccc7e16, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="gkxAkZA.lnk", cAlternateFileName="")) returned 1
	[0132.232] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.232] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="gkxAkZA.lnk") returned -1
	[0132.232] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="gkxAkZA.lnk") returned 1
	[0132.232] lstrcmpiA (lpString1="", lpString2="gkxAkZA.lnk") returned -1
	[0132.232] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GHi4txwrX.lnk") returned="GHi4txwrX.lnk"
	[0132.232] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.232] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.232] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.232] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.232] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="gkxAkZA.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk"
	[0132.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk", pszSpec="*.zip") returned 0
	[0132.232] lstrlenA (lpString="*.zip") returned 5
	[0132.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk", pszSpec="*.rar") returned 0
	[0132.232] lstrlenA (lpString="*.rar") returned 5
	[0132.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk", pszSpec="*.7z") returned 0
	[0132.232] lstrlenA (lpString="*.7z") returned 4
	[0132.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk", pszSpec="*.tar") returned 0
	[0132.232] lstrlenA (lpString="*.tar") returned 5
	[0132.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk", pszSpec="*.gzip") returned 0
	[0132.232] lstrlenA (lpString="*.gzip") returned 6
	[0132.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk", pszSpec="*.jpg") returned 0
	[0132.232] lstrlenA (lpString="*.jpg") returned 5
	[0132.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk", pszSpec="*.jpeg") returned 0
	[0132.232] lstrlenA (lpString="*.jpeg") returned 6
	[0132.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk", pszSpec="*.bmp") returned 0
	[0132.232] lstrlenA (lpString="*.bmp") returned 5
	[0132.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk", pszSpec="*.gif") returned 0
	[0132.232] lstrlenA (lpString="*.gif") returned 5
	[0132.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk", pszSpec="*.png") returned 0
	[0132.232] lstrlenA (lpString="*.png") returned 5
	[0132.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk", pszSpec="*.doc") returned 0
	[0132.232] lstrlenA (lpString="*.doc") returned 5
	[0132.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk", pszSpec="*.docx") returned 0
	[0132.233] lstrlenA (lpString="*.docx") returned 6
	[0132.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk", pszSpec="*.xls") returned 0
	[0132.233] lstrlenA (lpString="*.xls") returned 5
	[0132.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk", pszSpec="*.xlsx") returned 0
	[0132.233] lstrlenA (lpString="*.xlsx") returned 6
	[0132.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk", pszSpec="*.ppt") returned 0
	[0132.233] lstrlenA (lpString="*.ppt") returned 5
	[0132.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk", pszSpec="*.pptx") returned 0
	[0132.233] lstrlenA (lpString="*.pptx") returned 6
	[0132.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk", pszSpec="*.txt") returned 0
	[0132.233] lstrlenA (lpString="*.txt") returned 5
	[0132.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk", pszSpec="*.pdf") returned 0
	[0132.233] lstrlenA (lpString="*.pdf") returned 5
	[0132.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk", pszSpec="*.htm") returned 0
	[0132.233] lstrlenA (lpString="*.htm") returned 5
	[0132.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk", pszSpec="*.html") returned 0
	[0132.233] lstrlenA (lpString="*.html") returned 6
	[0132.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk", pszSpec="*.mdb") returned 0
	[0132.233] lstrlenA (lpString="*.mdb") returned 5
	[0132.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk", pszSpec="*.pfx") returned 0
	[0132.233] lstrlenA (lpString="*.pfx") returned 5
	[0132.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk", pszSpec="*.md") returned 0
	[0132.233] lstrlenA (lpString="*.md") returned 4
	[0132.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk", pszSpec="*.lnk") returned 1
	[0132.233] lstrlenA (lpString="*.lnk") returned 5
	[0132.233] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk"
	[0132.233] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk"
	[0132.233] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk."
	[0132.233] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk.exe"
	[0132.233] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gkxakza.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.234] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a9
	[0132.234] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4cca1b86, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x4cca1b86, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4ccc7e16, dwHighDateTime=0x1d543d9)) returned 1
	[0132.234] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.234] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x367, lpOverlapped=0x0) returned 1
	[0132.234] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk") returned="gkxAkZA.lnk"
	[0132.234] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.235] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x367, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x367, lpOverlapped=0x0) returned 1
	[0132.235] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.235] CloseHandle (hObject=0x21c) returned 1
	[0132.235] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gkxakza.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gkxakza.lnk.exe")) returned 1
	[0132.238] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3549f977, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x3549f977, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x3549f977, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x0, dwReserved1=0x0, cFileName="gLdU8NFrnsI2x.flv.lnk", cAlternateFileName="GLDU8N~1.LNK")) returned 1
	[0132.238] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.238] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="gLdU8NFrnsI2x.flv.lnk") returned -1
	[0132.238] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="gLdU8NFrnsI2x.flv.lnk") returned 1
	[0132.238] lstrcmpiA (lpString1="", lpString2="gLdU8NFrnsI2x.flv.lnk") returned -1
	[0132.238] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkxAkZA.lnk") returned="gkxAkZA.lnk"
	[0132.238] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.238] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.238] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.239] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.239] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="gLdU8NFrnsI2x.flv.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk"
	[0132.239] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk", pszSpec="*.zip") returned 0
	[0132.239] lstrlenA (lpString="*.zip") returned 5
	[0132.239] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk", pszSpec="*.rar") returned 0
	[0132.239] lstrlenA (lpString="*.rar") returned 5
	[0132.239] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk", pszSpec="*.7z") returned 0
	[0132.239] lstrlenA (lpString="*.7z") returned 4
	[0132.239] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk", pszSpec="*.tar") returned 0
	[0132.239] lstrlenA (lpString="*.tar") returned 5
	[0132.239] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk", pszSpec="*.gzip") returned 0
	[0132.239] lstrlenA (lpString="*.gzip") returned 6
	[0132.239] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk", pszSpec="*.jpg") returned 0
	[0132.239] lstrlenA (lpString="*.jpg") returned 5
	[0132.239] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk", pszSpec="*.jpeg") returned 0
	[0132.239] lstrlenA (lpString="*.jpeg") returned 6
	[0132.239] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk", pszSpec="*.bmp") returned 0
	[0132.239] lstrlenA (lpString="*.bmp") returned 5
	[0132.239] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk", pszSpec="*.gif") returned 0
	[0132.239] lstrlenA (lpString="*.gif") returned 5
	[0132.239] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk", pszSpec="*.png") returned 0
	[0132.239] lstrlenA (lpString="*.png") returned 5
	[0132.239] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk", pszSpec="*.doc") returned 0
	[0132.239] lstrlenA (lpString="*.doc") returned 5
	[0132.239] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk", pszSpec="*.docx") returned 0
	[0132.239] lstrlenA (lpString="*.docx") returned 6
	[0132.239] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk", pszSpec="*.xls") returned 0
	[0132.239] lstrlenA (lpString="*.xls") returned 5
	[0132.239] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk", pszSpec="*.xlsx") returned 0
	[0132.239] lstrlenA (lpString="*.xlsx") returned 6
	[0132.239] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk", pszSpec="*.ppt") returned 0
	[0132.239] lstrlenA (lpString="*.ppt") returned 5
	[0132.239] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk", pszSpec="*.pptx") returned 0
	[0132.239] lstrlenA (lpString="*.pptx") returned 6
	[0132.240] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk", pszSpec="*.txt") returned 0
	[0132.240] lstrlenA (lpString="*.txt") returned 5
	[0132.240] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk", pszSpec="*.pdf") returned 0
	[0132.240] lstrlenA (lpString="*.pdf") returned 5
	[0132.240] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk", pszSpec="*.htm") returned 0
	[0132.240] lstrlenA (lpString="*.htm") returned 5
	[0132.240] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk", pszSpec="*.html") returned 0
	[0132.240] lstrlenA (lpString="*.html") returned 6
	[0132.240] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk", pszSpec="*.mdb") returned 0
	[0132.240] lstrlenA (lpString="*.mdb") returned 5
	[0132.240] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk", pszSpec="*.pfx") returned 0
	[0132.240] lstrlenA (lpString="*.pfx") returned 5
	[0132.240] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk", pszSpec="*.md") returned 0
	[0132.240] lstrlenA (lpString="*.md") returned 4
	[0132.240] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk", pszSpec="*.lnk") returned 1
	[0132.240] lstrlenA (lpString="*.lnk") returned 5
	[0132.240] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk"
	[0132.240] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk"
	[0132.240] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk."
	[0132.240] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk.exe"
	[0132.240] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gldu8nfrnsi2x.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.241] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x297
	[0132.241] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3549f977, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x3549f977, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3549f977, dwHighDateTime=0x1d543d9)) returned 1
	[0132.241] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.241] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x255, lpOverlapped=0x0) returned 1
	[0132.241] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk") returned="gLdU8NFrnsI2x.flv.lnk"
	[0132.241] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.242] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x255, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x255, lpOverlapped=0x0) returned 1
	[0132.242] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.242] CloseHandle (hObject=0x21c) returned 1
	[0132.242] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gldu8nfrnsi2x.flv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gldu8nfrnsi2x.flv.lnk.exe")) returned 1
	[0132.242] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d17f60f, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x3d17f60f, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x3d17f60f, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x0, dwReserved1=0x0, cFileName="gWki.lnk", cAlternateFileName="")) returned 1
	[0132.243] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.243] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="gWki.lnk") returned -1
	[0132.243] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="gWki.lnk") returned 1
	[0132.243] lstrcmpiA (lpString1="", lpString2="gWki.lnk") returned -1
	[0132.243] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLdU8NFrnsI2x.flv.lnk") returned="gLdU8NFrnsI2x.flv.lnk"
	[0132.243] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.243] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.243] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.243] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.243] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="gWki.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk"
	[0132.243] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk", pszSpec="*.zip") returned 0
	[0132.243] lstrlenA (lpString="*.zip") returned 5
	[0132.243] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk", pszSpec="*.rar") returned 0
	[0132.243] lstrlenA (lpString="*.rar") returned 5
	[0132.243] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk", pszSpec="*.7z") returned 0
	[0132.243] lstrlenA (lpString="*.7z") returned 4
	[0132.243] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk", pszSpec="*.tar") returned 0
	[0132.243] lstrlenA (lpString="*.tar") returned 5
	[0132.243] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk", pszSpec="*.gzip") returned 0
	[0132.243] lstrlenA (lpString="*.gzip") returned 6
	[0132.243] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk", pszSpec="*.jpg") returned 0
	[0132.243] lstrlenA (lpString="*.jpg") returned 5
	[0132.243] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk", pszSpec="*.jpeg") returned 0
	[0132.243] lstrlenA (lpString="*.jpeg") returned 6
	[0132.243] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk", pszSpec="*.bmp") returned 0
	[0132.243] lstrlenA (lpString="*.bmp") returned 5
	[0132.243] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk", pszSpec="*.gif") returned 0
	[0132.243] lstrlenA (lpString="*.gif") returned 5
	[0132.243] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk", pszSpec="*.png") returned 0
	[0132.243] lstrlenA (lpString="*.png") returned 5
	[0132.243] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk", pszSpec="*.doc") returned 0
	[0132.243] lstrlenA (lpString="*.doc") returned 5
	[0132.243] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk", pszSpec="*.docx") returned 0
	[0132.243] lstrlenA (lpString="*.docx") returned 6
	[0132.244] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk", pszSpec="*.xls") returned 0
	[0132.244] lstrlenA (lpString="*.xls") returned 5
	[0132.244] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk", pszSpec="*.xlsx") returned 0
	[0132.244] lstrlenA (lpString="*.xlsx") returned 6
	[0132.244] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk", pszSpec="*.ppt") returned 0
	[0132.244] lstrlenA (lpString="*.ppt") returned 5
	[0132.244] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk", pszSpec="*.pptx") returned 0
	[0132.244] lstrlenA (lpString="*.pptx") returned 6
	[0132.244] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk", pszSpec="*.txt") returned 0
	[0132.244] lstrlenA (lpString="*.txt") returned 5
	[0132.244] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk", pszSpec="*.pdf") returned 0
	[0132.244] lstrlenA (lpString="*.pdf") returned 5
	[0132.244] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk", pszSpec="*.htm") returned 0
	[0132.244] lstrlenA (lpString="*.htm") returned 5
	[0132.244] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk", pszSpec="*.html") returned 0
	[0132.244] lstrlenA (lpString="*.html") returned 6
	[0132.244] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk", pszSpec="*.mdb") returned 0
	[0132.244] lstrlenA (lpString="*.mdb") returned 5
	[0132.244] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk", pszSpec="*.pfx") returned 0
	[0132.244] lstrlenA (lpString="*.pfx") returned 5
	[0132.244] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk", pszSpec="*.md") returned 0
	[0132.244] lstrlenA (lpString="*.md") returned 4
	[0132.244] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk", pszSpec="*.lnk") returned 1
	[0132.244] lstrlenA (lpString="*.lnk") returned 5
	[0132.244] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk"
	[0132.244] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk"
	[0132.244] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk."
	[0132.244] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk.exe"
	[0132.244] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gwki.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.245] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x266
	[0132.245] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3d17f60f, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x3d17f60f, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3d17f60f, dwHighDateTime=0x1d543d9)) returned 1
	[0132.245] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.245] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x224, lpOverlapped=0x0) returned 1
	[0132.245] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk") returned="gWki.lnk"
	[0132.245] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.245] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x224, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x224, lpOverlapped=0x0) returned 1
	[0132.246] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.246] CloseHandle (hObject=0x21c) returned 1
	[0132.246] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gwki.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gwki.lnk.exe")) returned 1
	[0132.248] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40f9cd91, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x52697b0d, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x52697b0d, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x412, dwReserved0=0x0, dwReserved1=0x0, cFileName="H64l1QH5QcmfR.lnk", cAlternateFileName="H64L1Q~1.LNK")) returned 1
	[0132.248] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.248] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="H64l1QH5QcmfR.lnk") returned -1
	[0132.248] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="H64l1QH5QcmfR.lnk") returned 1
	[0132.248] lstrcmpiA (lpString1="", lpString2="H64l1QH5QcmfR.lnk") returned -1
	[0132.248] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWki.lnk") returned="gWki.lnk"
	[0132.248] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.248] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.248] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.248] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.248] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="H64l1QH5QcmfR.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk"
	[0132.248] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk", pszSpec="*.zip") returned 0
	[0132.248] lstrlenA (lpString="*.zip") returned 5
	[0132.248] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk", pszSpec="*.rar") returned 0
	[0132.248] lstrlenA (lpString="*.rar") returned 5
	[0132.248] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk", pszSpec="*.7z") returned 0
	[0132.248] lstrlenA (lpString="*.7z") returned 4
	[0132.248] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk", pszSpec="*.tar") returned 0
	[0132.248] lstrlenA (lpString="*.tar") returned 5
	[0132.248] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk", pszSpec="*.gzip") returned 0
	[0132.248] lstrlenA (lpString="*.gzip") returned 6
	[0132.248] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk", pszSpec="*.jpg") returned 0
	[0132.248] lstrlenA (lpString="*.jpg") returned 5
	[0132.248] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk", pszSpec="*.jpeg") returned 0
	[0132.248] lstrlenA (lpString="*.jpeg") returned 6
	[0132.248] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk", pszSpec="*.bmp") returned 0
	[0132.248] lstrlenA (lpString="*.bmp") returned 5
	[0132.248] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk", pszSpec="*.gif") returned 0
	[0132.248] lstrlenA (lpString="*.gif") returned 5
	[0132.249] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk", pszSpec="*.png") returned 0
	[0132.249] lstrlenA (lpString="*.png") returned 5
	[0132.249] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk", pszSpec="*.doc") returned 0
	[0132.249] lstrlenA (lpString="*.doc") returned 5
	[0132.249] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk", pszSpec="*.docx") returned 0
	[0132.249] lstrlenA (lpString="*.docx") returned 6
	[0132.249] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk", pszSpec="*.xls") returned 0
	[0132.249] lstrlenA (lpString="*.xls") returned 5
	[0132.249] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk", pszSpec="*.xlsx") returned 0
	[0132.249] lstrlenA (lpString="*.xlsx") returned 6
	[0132.249] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk", pszSpec="*.ppt") returned 0
	[0132.249] lstrlenA (lpString="*.ppt") returned 5
	[0132.249] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk", pszSpec="*.pptx") returned 0
	[0132.249] lstrlenA (lpString="*.pptx") returned 6
	[0132.249] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk", pszSpec="*.txt") returned 0
	[0132.249] lstrlenA (lpString="*.txt") returned 5
	[0132.249] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk", pszSpec="*.pdf") returned 0
	[0132.249] lstrlenA (lpString="*.pdf") returned 5
	[0132.249] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk", pszSpec="*.htm") returned 0
	[0132.249] lstrlenA (lpString="*.htm") returned 5
	[0132.249] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk", pszSpec="*.html") returned 0
	[0132.249] lstrlenA (lpString="*.html") returned 6
	[0132.249] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk", pszSpec="*.mdb") returned 0
	[0132.249] lstrlenA (lpString="*.mdb") returned 5
	[0132.249] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk", pszSpec="*.pfx") returned 0
	[0132.249] lstrlenA (lpString="*.pfx") returned 5
	[0132.249] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk", pszSpec="*.md") returned 0
	[0132.249] lstrlenA (lpString="*.md") returned 4
	[0132.249] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk", pszSpec="*.lnk") returned 1
	[0132.249] lstrlenA (lpString="*.lnk") returned 5
	[0132.249] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk"
	[0132.249] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk"
	[0132.249] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk."
	[0132.249] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk.exe"
	[0132.249] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\h64l1qh5qcmfr.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.250] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x412
	[0132.250] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x40f9cd91, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x52697b0d, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x52697b0d, dwHighDateTime=0x1d543d9)) returned 1
	[0132.250] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.250] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x3d0, lpOverlapped=0x0) returned 1
	[0132.251] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk") returned="H64l1QH5QcmfR.lnk"
	[0132.251] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.251] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x3d0, lpOverlapped=0x0) returned 1
	[0132.251] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.251] CloseHandle (hObject=0x21c) returned 1
	[0132.251] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\h64l1qh5qcmfr.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\h64l1qh5qcmfr.lnk.exe")) returned 1
	[0132.252] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44902bd8, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x44902bd8, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x44902bd8, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x58b, dwReserved0=0x0, dwReserved1=0x0, cFileName="h7KLxcZmWOI8p8.ots.lnk", cAlternateFileName="H7KLXC~1.LNK")) returned 1
	[0132.252] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.252] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="h7KLxcZmWOI8p8.ots.lnk") returned -1
	[0132.252] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="h7KLxcZmWOI8p8.ots.lnk") returned 1
	[0132.252] lstrcmpiA (lpString1="", lpString2="h7KLxcZmWOI8p8.ots.lnk") returned -1
	[0132.252] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H64l1QH5QcmfR.lnk") returned="H64l1QH5QcmfR.lnk"
	[0132.252] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.252] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.252] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.252] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.252] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="h7KLxcZmWOI8p8.ots.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk"
	[0132.252] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk", pszSpec="*.zip") returned 0
	[0132.252] lstrlenA (lpString="*.zip") returned 5
	[0132.252] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk", pszSpec="*.rar") returned 0
	[0132.252] lstrlenA (lpString="*.rar") returned 5
	[0132.252] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk", pszSpec="*.7z") returned 0
	[0132.252] lstrlenA (lpString="*.7z") returned 4
	[0132.252] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk", pszSpec="*.tar") returned 0
	[0132.252] lstrlenA (lpString="*.tar") returned 5
	[0132.252] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk", pszSpec="*.gzip") returned 0
	[0132.252] lstrlenA (lpString="*.gzip") returned 6
	[0132.252] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk", pszSpec="*.jpg") returned 0
	[0132.252] lstrlenA (lpString="*.jpg") returned 5
	[0132.252] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk", pszSpec="*.jpeg") returned 0
	[0132.252] lstrlenA (lpString="*.jpeg") returned 6
	[0132.252] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk", pszSpec="*.bmp") returned 0
	[0132.252] lstrlenA (lpString="*.bmp") returned 5
	[0132.252] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk", pszSpec="*.gif") returned 0
	[0132.252] lstrlenA (lpString="*.gif") returned 5
	[0132.252] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk", pszSpec="*.png") returned 0
	[0132.252] lstrlenA (lpString="*.png") returned 5
	[0132.252] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk", pszSpec="*.doc") returned 0
	[0132.252] lstrlenA (lpString="*.doc") returned 5
	[0132.253] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk", pszSpec="*.docx") returned 0
	[0132.253] lstrlenA (lpString="*.docx") returned 6
	[0132.253] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk", pszSpec="*.xls") returned 0
	[0132.253] lstrlenA (lpString="*.xls") returned 5
	[0132.253] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk", pszSpec="*.xlsx") returned 0
	[0132.253] lstrlenA (lpString="*.xlsx") returned 6
	[0132.253] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk", pszSpec="*.ppt") returned 0
	[0132.253] lstrlenA (lpString="*.ppt") returned 5
	[0132.253] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk", pszSpec="*.pptx") returned 0
	[0132.253] lstrlenA (lpString="*.pptx") returned 6
	[0132.253] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk", pszSpec="*.txt") returned 0
	[0132.253] lstrlenA (lpString="*.txt") returned 5
	[0132.253] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk", pszSpec="*.pdf") returned 0
	[0132.253] lstrlenA (lpString="*.pdf") returned 5
	[0132.253] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk", pszSpec="*.htm") returned 0
	[0132.253] lstrlenA (lpString="*.htm") returned 5
	[0132.253] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk", pszSpec="*.html") returned 0
	[0132.253] lstrlenA (lpString="*.html") returned 6
	[0132.253] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk", pszSpec="*.mdb") returned 0
	[0132.253] lstrlenA (lpString="*.mdb") returned 5
	[0132.253] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk", pszSpec="*.pfx") returned 0
	[0132.253] lstrlenA (lpString="*.pfx") returned 5
	[0132.253] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk", pszSpec="*.md") returned 0
	[0132.253] lstrlenA (lpString="*.md") returned 4
	[0132.253] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk", pszSpec="*.lnk") returned 1
	[0132.253] lstrlenA (lpString="*.lnk") returned 5
	[0132.253] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk"
	[0132.253] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk"
	[0132.253] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk."
	[0132.253] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk.exe"
	[0132.253] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\h7klxczmwoi8p8.ots.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.254] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x58b
	[0132.254] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x44902bd8, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x44902bd8, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x44902bd8, dwHighDateTime=0x1d543d9)) returned 1
	[0132.254] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.254] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x549, lpOverlapped=0x0) returned 1
	[0132.255] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk") returned="h7KLxcZmWOI8p8.ots.lnk"
	[0132.255] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.255] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x549, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x549, lpOverlapped=0x0) returned 1
	[0132.255] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.255] CloseHandle (hObject=0x21c) returned 1
	[0132.256] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\h7klxczmwoi8p8.ots.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\h7klxczmwoi8p8.ots.lnk.exe")) returned 1
	[0132.302] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505a7594, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x5082fcef, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x5082fcef, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x376, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hi_G UBIbBkjtun (2).lnk", cAlternateFileName="HI_GUB~2.LNK")) returned 1
	[0132.302] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.303] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Hi_G UBIbBkjtun (2).lnk") returned -1
	[0132.303] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Hi_G UBIbBkjtun (2).lnk") returned 1
	[0132.303] lstrcmpiA (lpString1="", lpString2="Hi_G UBIbBkjtun (2).lnk") returned -1
	[0132.303] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7KLxcZmWOI8p8.ots.lnk") returned="h7KLxcZmWOI8p8.ots.lnk"
	[0132.303] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.303] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.303] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.303] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.303] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="Hi_G UBIbBkjtun (2).lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk"
	[0132.303] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk", pszSpec="*.zip") returned 0
	[0132.303] lstrlenA (lpString="*.zip") returned 5
	[0132.303] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk", pszSpec="*.rar") returned 0
	[0132.303] lstrlenA (lpString="*.rar") returned 5
	[0132.303] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk", pszSpec="*.7z") returned 0
	[0132.303] lstrlenA (lpString="*.7z") returned 4
	[0132.303] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk", pszSpec="*.tar") returned 0
	[0132.303] lstrlenA (lpString="*.tar") returned 5
	[0132.303] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk", pszSpec="*.gzip") returned 0
	[0132.303] lstrlenA (lpString="*.gzip") returned 6
	[0132.303] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk", pszSpec="*.jpg") returned 0
	[0132.303] lstrlenA (lpString="*.jpg") returned 5
	[0132.303] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk", pszSpec="*.jpeg") returned 0
	[0132.303] lstrlenA (lpString="*.jpeg") returned 6
	[0132.304] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk", pszSpec="*.bmp") returned 0
	[0132.304] lstrlenA (lpString="*.bmp") returned 5
	[0132.304] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk", pszSpec="*.gif") returned 0
	[0132.304] lstrlenA (lpString="*.gif") returned 5
	[0132.304] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk", pszSpec="*.png") returned 0
	[0132.304] lstrlenA (lpString="*.png") returned 5
	[0132.304] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk", pszSpec="*.doc") returned 0
	[0132.304] lstrlenA (lpString="*.doc") returned 5
	[0132.304] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk", pszSpec="*.docx") returned 0
	[0132.304] lstrlenA (lpString="*.docx") returned 6
	[0132.304] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk", pszSpec="*.xls") returned 0
	[0132.304] lstrlenA (lpString="*.xls") returned 5
	[0132.304] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk", pszSpec="*.xlsx") returned 0
	[0132.304] lstrlenA (lpString="*.xlsx") returned 6
	[0132.304] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk", pszSpec="*.ppt") returned 0
	[0132.304] lstrlenA (lpString="*.ppt") returned 5
	[0132.304] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk", pszSpec="*.pptx") returned 0
	[0132.304] lstrlenA (lpString="*.pptx") returned 6
	[0132.304] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk", pszSpec="*.txt") returned 0
	[0132.304] lstrlenA (lpString="*.txt") returned 5
	[0132.304] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk", pszSpec="*.pdf") returned 0
	[0132.304] lstrlenA (lpString="*.pdf") returned 5
	[0132.304] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk", pszSpec="*.htm") returned 0
	[0132.304] lstrlenA (lpString="*.htm") returned 5
	[0132.304] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk", pszSpec="*.html") returned 0
	[0132.304] lstrlenA (lpString="*.html") returned 6
	[0132.304] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk", pszSpec="*.mdb") returned 0
	[0132.304] lstrlenA (lpString="*.mdb") returned 5
	[0132.304] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk", pszSpec="*.pfx") returned 0
	[0132.304] lstrlenA (lpString="*.pfx") returned 5
	[0132.304] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk", pszSpec="*.md") returned 0
	[0132.304] lstrlenA (lpString="*.md") returned 4
	[0132.304] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk", pszSpec="*.lnk") returned 1
	[0132.304] lstrlenA (lpString="*.lnk") returned 5
	[0132.304] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk"
	[0132.304] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk"
	[0132.304] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk."
	[0132.305] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk.exe"
	[0132.305] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hi_g ubibbkjtun (2).lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.305] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x376
	[0132.305] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x505a7594, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x5082fcef, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5082fcef, dwHighDateTime=0x1d543d9)) returned 1
	[0132.305] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.305] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x334, lpOverlapped=0x0) returned 1
	[0132.306] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk") returned="Hi_G UBIbBkjtun (2).lnk"
	[0132.306] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.306] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x334, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x334, lpOverlapped=0x0) returned 1
	[0132.306] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.306] CloseHandle (hObject=0x21c) returned 1
	[0132.307] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hi_g ubibbkjtun (2).lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hi_g ubibbkjtun (2).lnk.exe")) returned 1
	[0132.307] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1664bef0, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x4af6cf0d, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x4af6cf0d, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x376, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hi_G UBIbBkjtun.lnk", cAlternateFileName="HI_GUB~1.LNK")) returned 1
	[0132.307] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.307] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Hi_G UBIbBkjtun.lnk") returned -1
	[0132.308] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Hi_G UBIbBkjtun.lnk") returned 1
	[0132.308] lstrcmpiA (lpString1="", lpString2="Hi_G UBIbBkjtun.lnk") returned -1
	[0132.308] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun (2).lnk") returned="Hi_G UBIbBkjtun (2).lnk"
	[0132.308] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.308] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.308] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.308] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.308] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="Hi_G UBIbBkjtun.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk"
	[0132.308] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk", pszSpec="*.zip") returned 0
	[0132.308] lstrlenA (lpString="*.zip") returned 5
	[0132.308] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk", pszSpec="*.rar") returned 0
	[0132.308] lstrlenA (lpString="*.rar") returned 5
	[0132.308] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk", pszSpec="*.7z") returned 0
	[0132.308] lstrlenA (lpString="*.7z") returned 4
	[0132.308] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk", pszSpec="*.tar") returned 0
	[0132.308] lstrlenA (lpString="*.tar") returned 5
	[0132.308] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk", pszSpec="*.gzip") returned 0
	[0132.308] lstrlenA (lpString="*.gzip") returned 6
	[0132.308] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk", pszSpec="*.jpg") returned 0
	[0132.308] lstrlenA (lpString="*.jpg") returned 5
	[0132.308] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk", pszSpec="*.jpeg") returned 0
	[0132.308] lstrlenA (lpString="*.jpeg") returned 6
	[0132.308] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk", pszSpec="*.bmp") returned 0
	[0132.308] lstrlenA (lpString="*.bmp") returned 5
	[0132.308] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk", pszSpec="*.gif") returned 0
	[0132.308] lstrlenA (lpString="*.gif") returned 5
	[0132.308] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk", pszSpec="*.png") returned 0
	[0132.308] lstrlenA (lpString="*.png") returned 5
	[0132.308] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk", pszSpec="*.doc") returned 0
	[0132.308] lstrlenA (lpString="*.doc") returned 5
	[0132.308] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk", pszSpec="*.docx") returned 0
	[0132.308] lstrlenA (lpString="*.docx") returned 6
	[0132.308] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk", pszSpec="*.xls") returned 0
	[0132.308] lstrlenA (lpString="*.xls") returned 5
	[0132.309] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk", pszSpec="*.xlsx") returned 0
	[0132.309] lstrlenA (lpString="*.xlsx") returned 6
	[0132.309] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk", pszSpec="*.ppt") returned 0
	[0132.309] lstrlenA (lpString="*.ppt") returned 5
	[0132.309] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk", pszSpec="*.pptx") returned 0
	[0132.309] lstrlenA (lpString="*.pptx") returned 6
	[0132.309] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk", pszSpec="*.txt") returned 0
	[0132.309] lstrlenA (lpString="*.txt") returned 5
	[0132.309] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk", pszSpec="*.pdf") returned 0
	[0132.309] lstrlenA (lpString="*.pdf") returned 5
	[0132.309] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk", pszSpec="*.htm") returned 0
	[0132.309] lstrlenA (lpString="*.htm") returned 5
	[0132.309] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk", pszSpec="*.html") returned 0
	[0132.309] lstrlenA (lpString="*.html") returned 6
	[0132.309] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk", pszSpec="*.mdb") returned 0
	[0132.309] lstrlenA (lpString="*.mdb") returned 5
	[0132.309] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk", pszSpec="*.pfx") returned 0
	[0132.309] lstrlenA (lpString="*.pfx") returned 5
	[0132.309] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk", pszSpec="*.md") returned 0
	[0132.309] lstrlenA (lpString="*.md") returned 4
	[0132.309] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk", pszSpec="*.lnk") returned 1
	[0132.309] lstrlenA (lpString="*.lnk") returned 5
	[0132.309] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk"
	[0132.309] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk"
	[0132.309] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk."
	[0132.309] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk.exe"
	[0132.309] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hi_g ubibbkjtun.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.310] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x376
	[0132.310] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1664bef0, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x4af6cf0d, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4af6cf0d, dwHighDateTime=0x1d543d9)) returned 1
	[0132.310] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.310] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x334, lpOverlapped=0x0) returned 1
	[0132.310] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk") returned="Hi_G UBIbBkjtun.lnk"
	[0132.310] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.311] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x334, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x334, lpOverlapped=0x0) returned 1
	[0132.311] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.311] CloseHandle (hObject=0x21c) returned 1
	[0132.311] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hi_g ubibbkjtun.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hi_g ubibbkjtun.lnk.exe")) returned 1
	[0132.311] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46742519, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x75f1db39, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x46742519, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x39e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW-TO-DECRYPT-FILES.HTM", cAlternateFileName="HOW-TO~1.HTM")) returned 1
	[0132.311] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.311] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="HOW-TO-DECRYPT-FILES.HTM") returned -1
	[0132.311] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="HOW-TO-DECRYPT-FILES.HTM") returned 0
	[0132.312] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x523c480f, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x523c480f, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x523c480f, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0x0, dwReserved1=0x0, cFileName="hY2xZ39.lnk", cAlternateFileName="")) returned 1
	[0132.312] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.312] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="hY2xZ39.lnk") returned -1
	[0132.312] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="hY2xZ39.lnk") returned -1
	[0132.312] lstrcmpiA (lpString1="", lpString2="hY2xZ39.lnk") returned -1
	[0132.312] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hi_G UBIbBkjtun.lnk") returned="Hi_G UBIbBkjtun.lnk"
	[0132.312] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.312] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.312] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.312] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.312] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="hY2xZ39.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk"
	[0132.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk", pszSpec="*.zip") returned 0
	[0132.312] lstrlenA (lpString="*.zip") returned 5
	[0132.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk", pszSpec="*.rar") returned 0
	[0132.312] lstrlenA (lpString="*.rar") returned 5
	[0132.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk", pszSpec="*.7z") returned 0
	[0132.312] lstrlenA (lpString="*.7z") returned 4
	[0132.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk", pszSpec="*.tar") returned 0
	[0132.312] lstrlenA (lpString="*.tar") returned 5
	[0132.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk", pszSpec="*.gzip") returned 0
	[0132.312] lstrlenA (lpString="*.gzip") returned 6
	[0132.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk", pszSpec="*.jpg") returned 0
	[0132.312] lstrlenA (lpString="*.jpg") returned 5
	[0132.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk", pszSpec="*.jpeg") returned 0
	[0132.312] lstrlenA (lpString="*.jpeg") returned 6
	[0132.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk", pszSpec="*.bmp") returned 0
	[0132.312] lstrlenA (lpString="*.bmp") returned 5
	[0132.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk", pszSpec="*.gif") returned 0
	[0132.312] lstrlenA (lpString="*.gif") returned 5
	[0132.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk", pszSpec="*.png") returned 0
	[0132.312] lstrlenA (lpString="*.png") returned 5
	[0132.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk", pszSpec="*.doc") returned 0
	[0132.312] lstrlenA (lpString="*.doc") returned 5
	[0132.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk", pszSpec="*.docx") returned 0
	[0132.312] lstrlenA (lpString="*.docx") returned 6
	[0132.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk", pszSpec="*.xls") returned 0
	[0132.313] lstrlenA (lpString="*.xls") returned 5
	[0132.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk", pszSpec="*.xlsx") returned 0
	[0132.313] lstrlenA (lpString="*.xlsx") returned 6
	[0132.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk", pszSpec="*.ppt") returned 0
	[0132.313] lstrlenA (lpString="*.ppt") returned 5
	[0132.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk", pszSpec="*.pptx") returned 0
	[0132.313] lstrlenA (lpString="*.pptx") returned 6
	[0132.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk", pszSpec="*.txt") returned 0
	[0132.313] lstrlenA (lpString="*.txt") returned 5
	[0132.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk", pszSpec="*.pdf") returned 0
	[0132.313] lstrlenA (lpString="*.pdf") returned 5
	[0132.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk", pszSpec="*.htm") returned 0
	[0132.313] lstrlenA (lpString="*.htm") returned 5
	[0132.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk", pszSpec="*.html") returned 0
	[0132.313] lstrlenA (lpString="*.html") returned 6
	[0132.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk", pszSpec="*.mdb") returned 0
	[0132.313] lstrlenA (lpString="*.mdb") returned 5
	[0132.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk", pszSpec="*.pfx") returned 0
	[0132.313] lstrlenA (lpString="*.pfx") returned 5
	[0132.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk", pszSpec="*.md") returned 0
	[0132.313] lstrlenA (lpString="*.md") returned 4
	[0132.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk", pszSpec="*.lnk") returned 1
	[0132.313] lstrlenA (lpString="*.lnk") returned 5
	[0132.313] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk"
	[0132.313] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk"
	[0132.313] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk."
	[0132.313] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk.exe"
	[0132.313] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hy2xz39.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.314] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x277
	[0132.314] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x523c480f, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x523c480f, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x523c480f, dwHighDateTime=0x1d543d9)) returned 1
	[0132.314] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.314] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x235, lpOverlapped=0x0) returned 1
	[0132.314] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk") returned="hY2xZ39.lnk"
	[0132.314] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.314] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x235, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x235, lpOverlapped=0x0) returned 1
	[0132.315] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.315] CloseHandle (hObject=0x21c) returned 1
	[0132.315] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hy2xz39.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hy2xz39.lnk.exe")) returned 1
	[0132.316] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x352fc27a, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x352fc27a, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x352fc27a, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="I1ZlcoCjIWQKak0-9FL.lnk", cAlternateFileName="I1ZLCO~1.LNK")) returned 1
	[0132.316] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.316] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="I1ZlcoCjIWQKak0-9FL.lnk") returned -1
	[0132.316] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="I1ZlcoCjIWQKak0-9FL.lnk") returned -1
	[0132.317] lstrcmpiA (lpString1="", lpString2="I1ZlcoCjIWQKak0-9FL.lnk") returned -1
	[0132.317] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hY2xZ39.lnk") returned="hY2xZ39.lnk"
	[0132.317] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.317] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.317] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.317] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.317] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="I1ZlcoCjIWQKak0-9FL.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk"
	[0132.317] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk", pszSpec="*.zip") returned 0
	[0132.317] lstrlenA (lpString="*.zip") returned 5
	[0132.317] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk", pszSpec="*.rar") returned 0
	[0132.317] lstrlenA (lpString="*.rar") returned 5
	[0132.317] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk", pszSpec="*.7z") returned 0
	[0132.317] lstrlenA (lpString="*.7z") returned 4
	[0132.317] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk", pszSpec="*.tar") returned 0
	[0132.317] lstrlenA (lpString="*.tar") returned 5
	[0132.317] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk", pszSpec="*.gzip") returned 0
	[0132.317] lstrlenA (lpString="*.gzip") returned 6
	[0132.317] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk", pszSpec="*.jpg") returned 0
	[0132.317] lstrlenA (lpString="*.jpg") returned 5
	[0132.317] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk", pszSpec="*.jpeg") returned 0
	[0132.317] lstrlenA (lpString="*.jpeg") returned 6
	[0132.317] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk", pszSpec="*.bmp") returned 0
	[0132.317] lstrlenA (lpString="*.bmp") returned 5
	[0132.317] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk", pszSpec="*.gif") returned 0
	[0132.317] lstrlenA (lpString="*.gif") returned 5
	[0132.317] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk", pszSpec="*.png") returned 0
	[0132.317] lstrlenA (lpString="*.png") returned 5
	[0132.317] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk", pszSpec="*.doc") returned 0
	[0132.317] lstrlenA (lpString="*.doc") returned 5
	[0132.317] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk", pszSpec="*.docx") returned 0
	[0132.317] lstrlenA (lpString="*.docx") returned 6
	[0132.317] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk", pszSpec="*.xls") returned 0
	[0132.317] lstrlenA (lpString="*.xls") returned 5
	[0132.317] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk", pszSpec="*.xlsx") returned 0
	[0132.318] lstrlenA (lpString="*.xlsx") returned 6
	[0132.318] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk", pszSpec="*.ppt") returned 0
	[0132.318] lstrlenA (lpString="*.ppt") returned 5
	[0132.318] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk", pszSpec="*.pptx") returned 0
	[0132.318] lstrlenA (lpString="*.pptx") returned 6
	[0132.318] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk", pszSpec="*.txt") returned 0
	[0132.318] lstrlenA (lpString="*.txt") returned 5
	[0132.318] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk", pszSpec="*.pdf") returned 0
	[0132.318] lstrlenA (lpString="*.pdf") returned 5
	[0132.318] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk", pszSpec="*.htm") returned 0
	[0132.318] lstrlenA (lpString="*.htm") returned 5
	[0132.318] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk", pszSpec="*.html") returned 0
	[0132.318] lstrlenA (lpString="*.html") returned 6
	[0132.318] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk", pszSpec="*.mdb") returned 0
	[0132.318] lstrlenA (lpString="*.mdb") returned 5
	[0132.318] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk", pszSpec="*.pfx") returned 0
	[0132.318] lstrlenA (lpString="*.pfx") returned 5
	[0132.318] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk", pszSpec="*.md") returned 0
	[0132.318] lstrlenA (lpString="*.md") returned 4
	[0132.318] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk", pszSpec="*.lnk") returned 1
	[0132.318] lstrlenA (lpString="*.lnk") returned 5
	[0132.318] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk"
	[0132.318] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk"
	[0132.318] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk."
	[0132.318] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk.exe"
	[0132.318] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\i1zlcocjiwqkak0-9fl.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.319] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ce
	[0132.319] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x352fc27a, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x352fc27a, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x352fc27a, dwHighDateTime=0x1d543d9)) returned 1
	[0132.319] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.319] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x38c, lpOverlapped=0x0) returned 1
	[0132.319] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk") returned="I1ZlcoCjIWQKak0-9FL.lnk"
	[0132.319] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.320] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x38c, lpOverlapped=0x0) returned 1
	[0132.320] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.320] CloseHandle (hObject=0x21c) returned 1
	[0132.320] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\i1zlcocjiwqkak0-9fl.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\i1zlcocjiwqkak0-9fl.lnk.exe")) returned 1
	[0132.320] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x473e5b0f, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x473e5b0f, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x473e5b0f, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ihFeRsxVwI9oz.lnk", cAlternateFileName="IHFERS~1.LNK")) returned 1
	[0132.320] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.320] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="ihFeRsxVwI9oz.lnk") returned -1
	[0132.321] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="ihFeRsxVwI9oz.lnk") returned -1
	[0132.321] lstrcmpiA (lpString1="", lpString2="ihFeRsxVwI9oz.lnk") returned -1
	[0132.321] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1ZlcoCjIWQKak0-9FL.lnk") returned="I1ZlcoCjIWQKak0-9FL.lnk"
	[0132.321] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.321] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.321] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.321] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.321] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ihFeRsxVwI9oz.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk"
	[0132.321] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk", pszSpec="*.zip") returned 0
	[0132.321] lstrlenA (lpString="*.zip") returned 5
	[0132.321] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk", pszSpec="*.rar") returned 0
	[0132.321] lstrlenA (lpString="*.rar") returned 5
	[0132.321] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk", pszSpec="*.7z") returned 0
	[0132.321] lstrlenA (lpString="*.7z") returned 4
	[0132.321] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk", pszSpec="*.tar") returned 0
	[0132.321] lstrlenA (lpString="*.tar") returned 5
	[0132.321] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk", pszSpec="*.gzip") returned 0
	[0132.321] lstrlenA (lpString="*.gzip") returned 6
	[0132.321] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk", pszSpec="*.jpg") returned 0
	[0132.321] lstrlenA (lpString="*.jpg") returned 5
	[0132.321] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk", pszSpec="*.jpeg") returned 0
	[0132.321] lstrlenA (lpString="*.jpeg") returned 6
	[0132.321] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk", pszSpec="*.bmp") returned 0
	[0132.321] lstrlenA (lpString="*.bmp") returned 5
	[0132.321] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk", pszSpec="*.gif") returned 0
	[0132.321] lstrlenA (lpString="*.gif") returned 5
	[0132.321] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk", pszSpec="*.png") returned 0
	[0132.321] lstrlenA (lpString="*.png") returned 5
	[0132.321] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk", pszSpec="*.doc") returned 0
	[0132.321] lstrlenA (lpString="*.doc") returned 5
	[0132.321] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk", pszSpec="*.docx") returned 0
	[0132.321] lstrlenA (lpString="*.docx") returned 6
	[0132.321] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk", pszSpec="*.xls") returned 0
	[0132.321] lstrlenA (lpString="*.xls") returned 5
	[0132.322] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk", pszSpec="*.xlsx") returned 0
	[0132.322] lstrlenA (lpString="*.xlsx") returned 6
	[0132.322] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk", pszSpec="*.ppt") returned 0
	[0132.322] lstrlenA (lpString="*.ppt") returned 5
	[0132.322] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk", pszSpec="*.pptx") returned 0
	[0132.322] lstrlenA (lpString="*.pptx") returned 6
	[0132.322] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk", pszSpec="*.txt") returned 0
	[0132.322] lstrlenA (lpString="*.txt") returned 5
	[0132.322] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk", pszSpec="*.pdf") returned 0
	[0132.322] lstrlenA (lpString="*.pdf") returned 5
	[0132.322] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk", pszSpec="*.htm") returned 0
	[0132.322] lstrlenA (lpString="*.htm") returned 5
	[0132.322] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk", pszSpec="*.html") returned 0
	[0132.322] lstrlenA (lpString="*.html") returned 6
	[0132.322] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk", pszSpec="*.mdb") returned 0
	[0132.322] lstrlenA (lpString="*.mdb") returned 5
	[0132.322] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk", pszSpec="*.pfx") returned 0
	[0132.322] lstrlenA (lpString="*.pfx") returned 5
	[0132.322] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk", pszSpec="*.md") returned 0
	[0132.322] lstrlenA (lpString="*.md") returned 4
	[0132.322] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk", pszSpec="*.lnk") returned 1
	[0132.322] lstrlenA (lpString="*.lnk") returned 5
	[0132.322] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk"
	[0132.322] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk"
	[0132.322] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk."
	[0132.322] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk.exe"
	[0132.322] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ihfersxvwi9oz.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.323] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d5
	[0132.323] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x473e5b0f, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x473e5b0f, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x473e5b0f, dwHighDateTime=0x1d543d9)) returned 1
	[0132.323] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.323] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x393, lpOverlapped=0x0) returned 1
	[0132.323] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk") returned="ihFeRsxVwI9oz.lnk"
	[0132.323] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.323] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x393, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x393, lpOverlapped=0x0) returned 1
	[0132.324] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.324] CloseHandle (hObject=0x21c) returned 1
	[0132.324] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ihfersxvwi9oz.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ihfersxvwi9oz.lnk.exe")) returned 1
	[0132.324] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c1a2c06, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x5270a4bb, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x5270a4bb, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Iht5qWf.lnk", cAlternateFileName="")) returned 1
	[0132.324] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.324] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Iht5qWf.lnk") returned -1
	[0132.324] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Iht5qWf.lnk") returned -1
	[0132.324] lstrcmpiA (lpString1="", lpString2="Iht5qWf.lnk") returned -1
	[0132.325] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihFeRsxVwI9oz.lnk") returned="ihFeRsxVwI9oz.lnk"
	[0132.325] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.325] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.325] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.325] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.325] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="Iht5qWf.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk"
	[0132.325] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk", pszSpec="*.zip") returned 0
	[0132.325] lstrlenA (lpString="*.zip") returned 5
	[0132.325] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk", pszSpec="*.rar") returned 0
	[0132.325] lstrlenA (lpString="*.rar") returned 5
	[0132.325] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk", pszSpec="*.7z") returned 0
	[0132.325] lstrlenA (lpString="*.7z") returned 4
	[0132.325] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk", pszSpec="*.tar") returned 0
	[0132.325] lstrlenA (lpString="*.tar") returned 5
	[0132.325] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk", pszSpec="*.gzip") returned 0
	[0132.325] lstrlenA (lpString="*.gzip") returned 6
	[0132.325] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk", pszSpec="*.jpg") returned 0
	[0132.325] lstrlenA (lpString="*.jpg") returned 5
	[0132.325] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk", pszSpec="*.jpeg") returned 0
	[0132.325] lstrlenA (lpString="*.jpeg") returned 6
	[0132.325] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk", pszSpec="*.bmp") returned 0
	[0132.325] lstrlenA (lpString="*.bmp") returned 5
	[0132.325] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk", pszSpec="*.gif") returned 0
	[0132.325] lstrlenA (lpString="*.gif") returned 5
	[0132.325] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk", pszSpec="*.png") returned 0
	[0132.325] lstrlenA (lpString="*.png") returned 5
	[0132.325] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk", pszSpec="*.doc") returned 0
	[0132.325] lstrlenA (lpString="*.doc") returned 5
	[0132.325] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk", pszSpec="*.docx") returned 0
	[0132.325] lstrlenA (lpString="*.docx") returned 6
	[0132.325] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk", pszSpec="*.xls") returned 0
	[0132.325] lstrlenA (lpString="*.xls") returned 5
	[0132.325] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk", pszSpec="*.xlsx") returned 0
	[0132.325] lstrlenA (lpString="*.xlsx") returned 6
	[0132.326] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk", pszSpec="*.ppt") returned 0
	[0132.326] lstrlenA (lpString="*.ppt") returned 5
	[0132.326] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk", pszSpec="*.pptx") returned 0
	[0132.326] lstrlenA (lpString="*.pptx") returned 6
	[0132.326] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk", pszSpec="*.txt") returned 0
	[0132.326] lstrlenA (lpString="*.txt") returned 5
	[0132.326] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk", pszSpec="*.pdf") returned 0
	[0132.326] lstrlenA (lpString="*.pdf") returned 5
	[0132.326] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk", pszSpec="*.htm") returned 0
	[0132.326] lstrlenA (lpString="*.htm") returned 5
	[0132.326] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk", pszSpec="*.html") returned 0
	[0132.326] lstrlenA (lpString="*.html") returned 6
	[0132.326] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk", pszSpec="*.mdb") returned 0
	[0132.326] lstrlenA (lpString="*.mdb") returned 5
	[0132.326] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk", pszSpec="*.pfx") returned 0
	[0132.326] lstrlenA (lpString="*.pfx") returned 5
	[0132.326] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk", pszSpec="*.md") returned 0
	[0132.326] lstrlenA (lpString="*.md") returned 4
	[0132.326] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk", pszSpec="*.lnk") returned 1
	[0132.326] lstrlenA (lpString="*.lnk") returned 5
	[0132.326] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk"
	[0132.326] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk"
	[0132.326] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk."
	[0132.326] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk.exe"
	[0132.326] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\iht5qwf.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.326] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f2
	[0132.327] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x2c1a2c06, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x5270a4bb, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5270a4bb, dwHighDateTime=0x1d543d9)) returned 1
	[0132.327] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.327] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x3b0, lpOverlapped=0x0) returned 1
	[0132.327] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk") returned="Iht5qWf.lnk"
	[0132.327] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.327] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x3b0, lpOverlapped=0x0) returned 1
	[0132.328] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.328] CloseHandle (hObject=0x21c) returned 1
	[0132.328] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\iht5qwf.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\iht5qwf.lnk.exe")) returned 1
	[0132.328] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x414d3d94, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x414d3d94, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x414d3d94, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKI1H4n.lnk", cAlternateFileName="")) returned 1
	[0132.328] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.328] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="iKI1H4n.lnk") returned -1
	[0132.328] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="iKI1H4n.lnk") returned -1
	[0132.328] lstrcmpiA (lpString1="", lpString2="iKI1H4n.lnk") returned -1
	[0132.328] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iht5qWf.lnk") returned="Iht5qWf.lnk"
	[0132.328] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.328] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.328] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.329] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.329] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="iKI1H4n.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk"
	[0132.329] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk", pszSpec="*.zip") returned 0
	[0132.329] lstrlenA (lpString="*.zip") returned 5
	[0132.329] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk", pszSpec="*.rar") returned 0
	[0132.329] lstrlenA (lpString="*.rar") returned 5
	[0132.329] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk", pszSpec="*.7z") returned 0
	[0132.329] lstrlenA (lpString="*.7z") returned 4
	[0132.329] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk", pszSpec="*.tar") returned 0
	[0132.329] lstrlenA (lpString="*.tar") returned 5
	[0132.329] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk", pszSpec="*.gzip") returned 0
	[0132.329] lstrlenA (lpString="*.gzip") returned 6
	[0132.329] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk", pszSpec="*.jpg") returned 0
	[0132.329] lstrlenA (lpString="*.jpg") returned 5
	[0132.329] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk", pszSpec="*.jpeg") returned 0
	[0132.329] lstrlenA (lpString="*.jpeg") returned 6
	[0132.329] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk", pszSpec="*.bmp") returned 0
	[0132.329] lstrlenA (lpString="*.bmp") returned 5
	[0132.329] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk", pszSpec="*.gif") returned 0
	[0132.329] lstrlenA (lpString="*.gif") returned 5
	[0132.329] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk", pszSpec="*.png") returned 0
	[0132.329] lstrlenA (lpString="*.png") returned 5
	[0132.329] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk", pszSpec="*.doc") returned 0
	[0132.329] lstrlenA (lpString="*.doc") returned 5
	[0132.329] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk", pszSpec="*.docx") returned 0
	[0132.329] lstrlenA (lpString="*.docx") returned 6
	[0132.329] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk", pszSpec="*.xls") returned 0
	[0132.329] lstrlenA (lpString="*.xls") returned 5
	[0132.329] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk", pszSpec="*.xlsx") returned 0
	[0132.329] lstrlenA (lpString="*.xlsx") returned 6
	[0132.329] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk", pszSpec="*.ppt") returned 0
	[0132.329] lstrlenA (lpString="*.ppt") returned 5
	[0132.329] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk", pszSpec="*.pptx") returned 0
	[0132.329] lstrlenA (lpString="*.pptx") returned 6
	[0132.330] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk", pszSpec="*.txt") returned 0
	[0132.330] lstrlenA (lpString="*.txt") returned 5
	[0132.330] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk", pszSpec="*.pdf") returned 0
	[0132.330] lstrlenA (lpString="*.pdf") returned 5
	[0132.330] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk", pszSpec="*.htm") returned 0
	[0132.330] lstrlenA (lpString="*.htm") returned 5
	[0132.330] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk", pszSpec="*.html") returned 0
	[0132.330] lstrlenA (lpString="*.html") returned 6
	[0132.330] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk", pszSpec="*.mdb") returned 0
	[0132.330] lstrlenA (lpString="*.mdb") returned 5
	[0132.330] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk", pszSpec="*.pfx") returned 0
	[0132.330] lstrlenA (lpString="*.pfx") returned 5
	[0132.330] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk", pszSpec="*.md") returned 0
	[0132.330] lstrlenA (lpString="*.md") returned 4
	[0132.330] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk", pszSpec="*.lnk") returned 1
	[0132.330] lstrlenA (lpString="*.lnk") returned 5
	[0132.330] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk"
	[0132.330] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk"
	[0132.330] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk."
	[0132.330] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk.exe"
	[0132.330] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\iki1h4n.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.330] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4bf
	[0132.330] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x414d3d94, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x414d3d94, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x414d3d94, dwHighDateTime=0x1d543d9)) returned 1
	[0132.330] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.331] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x47d, lpOverlapped=0x0) returned 1
	[0132.331] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk") returned="iKI1H4n.lnk"
	[0132.331] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.331] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x47d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x47d, lpOverlapped=0x0) returned 1
	[0132.331] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.332] CloseHandle (hObject=0x21c) returned 1
	[0132.332] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\iki1h4n.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\iki1h4n.lnk.exe")) returned 1
	[0132.332] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4beec440, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x4beec440, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x4beec440, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ikoDoXQeZ.flv.lnk", cAlternateFileName="IKODOX~1.LNK")) returned 1
	[0132.332] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.332] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="ikoDoXQeZ.flv.lnk") returned -1
	[0132.332] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="ikoDoXQeZ.flv.lnk") returned -1
	[0132.332] lstrcmpiA (lpString1="", lpString2="ikoDoXQeZ.flv.lnk") returned -1
	[0132.332] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iKI1H4n.lnk") returned="iKI1H4n.lnk"
	[0132.332] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.332] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.332] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.332] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.333] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ikoDoXQeZ.flv.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk"
	[0132.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk", pszSpec="*.zip") returned 0
	[0132.333] lstrlenA (lpString="*.zip") returned 5
	[0132.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk", pszSpec="*.rar") returned 0
	[0132.333] lstrlenA (lpString="*.rar") returned 5
	[0132.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk", pszSpec="*.7z") returned 0
	[0132.333] lstrlenA (lpString="*.7z") returned 4
	[0132.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk", pszSpec="*.tar") returned 0
	[0132.333] lstrlenA (lpString="*.tar") returned 5
	[0132.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk", pszSpec="*.gzip") returned 0
	[0132.333] lstrlenA (lpString="*.gzip") returned 6
	[0132.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk", pszSpec="*.jpg") returned 0
	[0132.333] lstrlenA (lpString="*.jpg") returned 5
	[0132.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk", pszSpec="*.jpeg") returned 0
	[0132.333] lstrlenA (lpString="*.jpeg") returned 6
	[0132.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk", pszSpec="*.bmp") returned 0
	[0132.333] lstrlenA (lpString="*.bmp") returned 5
	[0132.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk", pszSpec="*.gif") returned 0
	[0132.333] lstrlenA (lpString="*.gif") returned 5
	[0132.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk", pszSpec="*.png") returned 0
	[0132.333] lstrlenA (lpString="*.png") returned 5
	[0132.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk", pszSpec="*.doc") returned 0
	[0132.333] lstrlenA (lpString="*.doc") returned 5
	[0132.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk", pszSpec="*.docx") returned 0
	[0132.333] lstrlenA (lpString="*.docx") returned 6
	[0132.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk", pszSpec="*.xls") returned 0
	[0132.333] lstrlenA (lpString="*.xls") returned 5
	[0132.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk", pszSpec="*.xlsx") returned 0
	[0132.333] lstrlenA (lpString="*.xlsx") returned 6
	[0132.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk", pszSpec="*.ppt") returned 0
	[0132.333] lstrlenA (lpString="*.ppt") returned 5
	[0132.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk", pszSpec="*.pptx") returned 0
	[0132.333] lstrlenA (lpString="*.pptx") returned 6
	[0132.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk", pszSpec="*.txt") returned 0
	[0132.333] lstrlenA (lpString="*.txt") returned 5
	[0132.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk", pszSpec="*.pdf") returned 0
	[0132.334] lstrlenA (lpString="*.pdf") returned 5
	[0132.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk", pszSpec="*.htm") returned 0
	[0132.334] lstrlenA (lpString="*.htm") returned 5
	[0132.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk", pszSpec="*.html") returned 0
	[0132.334] lstrlenA (lpString="*.html") returned 6
	[0132.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk", pszSpec="*.mdb") returned 0
	[0132.334] lstrlenA (lpString="*.mdb") returned 5
	[0132.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk", pszSpec="*.pfx") returned 0
	[0132.334] lstrlenA (lpString="*.pfx") returned 5
	[0132.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk", pszSpec="*.md") returned 0
	[0132.334] lstrlenA (lpString="*.md") returned 4
	[0132.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk", pszSpec="*.lnk") returned 1
	[0132.334] lstrlenA (lpString="*.lnk") returned 5
	[0132.334] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk"
	[0132.334] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk"
	[0132.334] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk."
	[0132.334] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk.exe"
	[0132.334] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ikodoxqez.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.335] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a5
	[0132.335] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4beec440, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x4beec440, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4beec440, dwHighDateTime=0x1d543d9)) returned 1
	[0132.335] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.335] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x363, lpOverlapped=0x0) returned 1
	[0132.336] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk") returned="ikoDoXQeZ.flv.lnk"
	[0132.336] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.336] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x363, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x363, lpOverlapped=0x0) returned 1
	[0132.336] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.336] CloseHandle (hObject=0x21c) returned 1
	[0132.336] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ikodoxqez.flv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ikodoxqez.flv.lnk.exe")) returned 1
	[0132.337] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1acb2454, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x3ceaa72c, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x3ceaa72c, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x489, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ipn0jJ9XLJBf-VqE4-MT.lnk", cAlternateFileName="IPN0JJ~1.LNK")) returned 1
	[0132.337] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.337] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Ipn0jJ9XLJBf-VqE4-MT.lnk") returned -1
	[0132.337] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Ipn0jJ9XLJBf-VqE4-MT.lnk") returned -1
	[0132.337] lstrcmpiA (lpString1="", lpString2="Ipn0jJ9XLJBf-VqE4-MT.lnk") returned -1
	[0132.337] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ikoDoXQeZ.flv.lnk") returned="ikoDoXQeZ.flv.lnk"
	[0132.337] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.337] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.337] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.337] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.337] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="Ipn0jJ9XLJBf-VqE4-MT.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk"
	[0132.337] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk", pszSpec="*.zip") returned 0
	[0132.337] lstrlenA (lpString="*.zip") returned 5
	[0132.337] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk", pszSpec="*.rar") returned 0
	[0132.337] lstrlenA (lpString="*.rar") returned 5
	[0132.337] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk", pszSpec="*.7z") returned 0
	[0132.337] lstrlenA (lpString="*.7z") returned 4
	[0132.337] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk", pszSpec="*.tar") returned 0
	[0132.337] lstrlenA (lpString="*.tar") returned 5
	[0132.337] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk", pszSpec="*.gzip") returned 0
	[0132.337] lstrlenA (lpString="*.gzip") returned 6
	[0132.337] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk", pszSpec="*.jpg") returned 0
	[0132.337] lstrlenA (lpString="*.jpg") returned 5
	[0132.337] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk", pszSpec="*.jpeg") returned 0
	[0132.337] lstrlenA (lpString="*.jpeg") returned 6
	[0132.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk", pszSpec="*.bmp") returned 0
	[0132.338] lstrlenA (lpString="*.bmp") returned 5
	[0132.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk", pszSpec="*.gif") returned 0
	[0132.338] lstrlenA (lpString="*.gif") returned 5
	[0132.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk", pszSpec="*.png") returned 0
	[0132.338] lstrlenA (lpString="*.png") returned 5
	[0132.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk", pszSpec="*.doc") returned 0
	[0132.338] lstrlenA (lpString="*.doc") returned 5
	[0132.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk", pszSpec="*.docx") returned 0
	[0132.338] lstrlenA (lpString="*.docx") returned 6
	[0132.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk", pszSpec="*.xls") returned 0
	[0132.338] lstrlenA (lpString="*.xls") returned 5
	[0132.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk", pszSpec="*.xlsx") returned 0
	[0132.338] lstrlenA (lpString="*.xlsx") returned 6
	[0132.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk", pszSpec="*.ppt") returned 0
	[0132.338] lstrlenA (lpString="*.ppt") returned 5
	[0132.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk", pszSpec="*.pptx") returned 0
	[0132.338] lstrlenA (lpString="*.pptx") returned 6
	[0132.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk", pszSpec="*.txt") returned 0
	[0132.338] lstrlenA (lpString="*.txt") returned 5
	[0132.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk", pszSpec="*.pdf") returned 0
	[0132.338] lstrlenA (lpString="*.pdf") returned 5
	[0132.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk", pszSpec="*.htm") returned 0
	[0132.338] lstrlenA (lpString="*.htm") returned 5
	[0132.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk", pszSpec="*.html") returned 0
	[0132.338] lstrlenA (lpString="*.html") returned 6
	[0132.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk", pszSpec="*.mdb") returned 0
	[0132.338] lstrlenA (lpString="*.mdb") returned 5
	[0132.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk", pszSpec="*.pfx") returned 0
	[0132.338] lstrlenA (lpString="*.pfx") returned 5
	[0132.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk", pszSpec="*.md") returned 0
	[0132.338] lstrlenA (lpString="*.md") returned 4
	[0132.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk", pszSpec="*.lnk") returned 1
	[0132.338] lstrlenA (lpString="*.lnk") returned 5
	[0132.338] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk"
	[0132.338] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk"
	[0132.339] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk."
	[0132.339] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk.exe"
	[0132.339] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ipn0jj9xljbf-vqe4-mt.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.339] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x489
	[0132.339] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1acb2454, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x3ceaa72c, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3ceaa72c, dwHighDateTime=0x1d543d9)) returned 1
	[0132.339] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.339] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x447, lpOverlapped=0x0) returned 1
	[0132.340] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk") returned="Ipn0jJ9XLJBf-VqE4-MT.lnk"
	[0132.340] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.340] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x447, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x447, lpOverlapped=0x0) returned 1
	[0132.340] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.340] CloseHandle (hObject=0x21c) returned 1
	[0132.340] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ipn0jj9xljbf-vqe4-mt.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ipn0jj9xljbf-vqe4-mt.lnk.exe")) returned 1
	[0132.341] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d3bb630, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x3d3bb630, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x3d4c6787, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x458, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpTn1Je.flv.lnk", cAlternateFileName="IPTN1J~1.LNK")) returned 1
	[0132.341] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.341] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="IpTn1Je.flv.lnk") returned -1
	[0132.341] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="IpTn1Je.flv.lnk") returned -1
	[0132.341] lstrcmpiA (lpString1="", lpString2="IpTn1Je.flv.lnk") returned -1
	[0132.341] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ipn0jJ9XLJBf-VqE4-MT.lnk") returned="Ipn0jJ9XLJBf-VqE4-MT.lnk"
	[0132.341] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.341] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.341] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.341] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.341] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="IpTn1Je.flv.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk"
	[0132.341] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk", pszSpec="*.zip") returned 0
	[0132.341] lstrlenA (lpString="*.zip") returned 5
	[0132.341] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk", pszSpec="*.rar") returned 0
	[0132.341] lstrlenA (lpString="*.rar") returned 5
	[0132.341] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk", pszSpec="*.7z") returned 0
	[0132.341] lstrlenA (lpString="*.7z") returned 4
	[0132.341] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk", pszSpec="*.tar") returned 0
	[0132.341] lstrlenA (lpString="*.tar") returned 5
	[0132.341] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk", pszSpec="*.gzip") returned 0
	[0132.341] lstrlenA (lpString="*.gzip") returned 6
	[0132.341] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk", pszSpec="*.jpg") returned 0
	[0132.341] lstrlenA (lpString="*.jpg") returned 5
	[0132.341] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk", pszSpec="*.jpeg") returned 0
	[0132.341] lstrlenA (lpString="*.jpeg") returned 6
	[0132.341] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk", pszSpec="*.bmp") returned 0
	[0132.341] lstrlenA (lpString="*.bmp") returned 5
	[0132.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk", pszSpec="*.gif") returned 0
	[0132.342] lstrlenA (lpString="*.gif") returned 5
	[0132.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk", pszSpec="*.png") returned 0
	[0132.342] lstrlenA (lpString="*.png") returned 5
	[0132.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk", pszSpec="*.doc") returned 0
	[0132.342] lstrlenA (lpString="*.doc") returned 5
	[0132.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk", pszSpec="*.docx") returned 0
	[0132.342] lstrlenA (lpString="*.docx") returned 6
	[0132.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk", pszSpec="*.xls") returned 0
	[0132.342] lstrlenA (lpString="*.xls") returned 5
	[0132.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk", pszSpec="*.xlsx") returned 0
	[0132.342] lstrlenA (lpString="*.xlsx") returned 6
	[0132.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk", pszSpec="*.ppt") returned 0
	[0132.342] lstrlenA (lpString="*.ppt") returned 5
	[0132.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk", pszSpec="*.pptx") returned 0
	[0132.342] lstrlenA (lpString="*.pptx") returned 6
	[0132.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk", pszSpec="*.txt") returned 0
	[0132.342] lstrlenA (lpString="*.txt") returned 5
	[0132.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk", pszSpec="*.pdf") returned 0
	[0132.342] lstrlenA (lpString="*.pdf") returned 5
	[0132.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk", pszSpec="*.htm") returned 0
	[0132.342] lstrlenA (lpString="*.htm") returned 5
	[0132.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk", pszSpec="*.html") returned 0
	[0132.342] lstrlenA (lpString="*.html") returned 6
	[0132.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk", pszSpec="*.mdb") returned 0
	[0132.342] lstrlenA (lpString="*.mdb") returned 5
	[0132.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk", pszSpec="*.pfx") returned 0
	[0132.342] lstrlenA (lpString="*.pfx") returned 5
	[0132.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk", pszSpec="*.md") returned 0
	[0132.342] lstrlenA (lpString="*.md") returned 4
	[0132.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk", pszSpec="*.lnk") returned 1
	[0132.342] lstrlenA (lpString="*.lnk") returned 5
	[0132.342] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk"
	[0132.342] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk"
	[0132.342] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk."
	[0132.342] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk.exe"
	[0132.343] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\iptn1je.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.343] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x458
	[0132.343] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3d3bb630, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x3d3bb630, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3d4c6787, dwHighDateTime=0x1d543d9)) returned 1
	[0132.343] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.343] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x416, lpOverlapped=0x0) returned 1
	[0132.344] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk") returned="IpTn1Je.flv.lnk"
	[0132.344] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.344] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x416, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x416, lpOverlapped=0x0) returned 1
	[0132.344] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.344] CloseHandle (hObject=0x21c) returned 1
	[0132.344] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\iptn1je.flv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\iptn1je.flv.lnk.exe")) returned 1
	[0132.345] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c8578ae, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x2c8578ae, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x2c8578ae, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITVh9Fmpp8JFx.lnk", cAlternateFileName="ITVH9F~1.LNK")) returned 1
	[0132.345] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.345] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="ITVh9Fmpp8JFx.lnk") returned -1
	[0132.345] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="ITVh9Fmpp8JFx.lnk") returned -1
	[0132.345] lstrcmpiA (lpString1="", lpString2="ITVh9Fmpp8JFx.lnk") returned -1
	[0132.345] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IpTn1Je.flv.lnk") returned="IpTn1Je.flv.lnk"
	[0132.345] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.345] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.345] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.345] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.345] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ITVh9Fmpp8JFx.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk"
	[0132.345] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk", pszSpec="*.zip") returned 0
	[0132.345] lstrlenA (lpString="*.zip") returned 5
	[0132.345] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk", pszSpec="*.rar") returned 0
	[0132.345] lstrlenA (lpString="*.rar") returned 5
	[0132.345] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk", pszSpec="*.7z") returned 0
	[0132.345] lstrlenA (lpString="*.7z") returned 4
	[0132.345] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk", pszSpec="*.tar") returned 0
	[0132.345] lstrlenA (lpString="*.tar") returned 5
	[0132.345] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk", pszSpec="*.gzip") returned 0
	[0132.345] lstrlenA (lpString="*.gzip") returned 6
	[0132.345] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk", pszSpec="*.jpg") returned 0
	[0132.345] lstrlenA (lpString="*.jpg") returned 5
	[0132.345] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk", pszSpec="*.jpeg") returned 0
	[0132.345] lstrlenA (lpString="*.jpeg") returned 6
	[0132.345] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk", pszSpec="*.bmp") returned 0
	[0132.345] lstrlenA (lpString="*.bmp") returned 5
	[0132.345] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk", pszSpec="*.gif") returned 0
	[0132.345] lstrlenA (lpString="*.gif") returned 5
	[0132.346] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk", pszSpec="*.png") returned 0
	[0132.346] lstrlenA (lpString="*.png") returned 5
	[0132.346] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk", pszSpec="*.doc") returned 0
	[0132.346] lstrlenA (lpString="*.doc") returned 5
	[0132.346] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk", pszSpec="*.docx") returned 0
	[0132.346] lstrlenA (lpString="*.docx") returned 6
	[0132.346] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk", pszSpec="*.xls") returned 0
	[0132.346] lstrlenA (lpString="*.xls") returned 5
	[0132.346] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk", pszSpec="*.xlsx") returned 0
	[0132.346] lstrlenA (lpString="*.xlsx") returned 6
	[0132.346] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk", pszSpec="*.ppt") returned 0
	[0132.346] lstrlenA (lpString="*.ppt") returned 5
	[0132.346] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk", pszSpec="*.pptx") returned 0
	[0132.346] lstrlenA (lpString="*.pptx") returned 6
	[0132.346] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk", pszSpec="*.txt") returned 0
	[0132.346] lstrlenA (lpString="*.txt") returned 5
	[0132.346] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk", pszSpec="*.pdf") returned 0
	[0132.346] lstrlenA (lpString="*.pdf") returned 5
	[0132.346] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk", pszSpec="*.htm") returned 0
	[0132.346] lstrlenA (lpString="*.htm") returned 5
	[0132.346] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk", pszSpec="*.html") returned 0
	[0132.346] lstrlenA (lpString="*.html") returned 6
	[0132.346] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk", pszSpec="*.mdb") returned 0
	[0132.346] lstrlenA (lpString="*.mdb") returned 5
	[0132.346] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk", pszSpec="*.pfx") returned 0
	[0132.346] lstrlenA (lpString="*.pfx") returned 5
	[0132.346] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk", pszSpec="*.md") returned 0
	[0132.346] lstrlenA (lpString="*.md") returned 4
	[0132.346] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk", pszSpec="*.lnk") returned 1
	[0132.346] lstrlenA (lpString="*.lnk") returned 5
	[0132.346] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk"
	[0132.346] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk"
	[0132.346] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk."
	[0132.346] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk.exe"
	[0132.346] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\itvh9fmpp8jfx.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.347] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3c9
	[0132.347] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x2c8578ae, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x2c8578ae, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x2c8578ae, dwHighDateTime=0x1d543d9)) returned 1
	[0132.347] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.347] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x387, lpOverlapped=0x0) returned 1
	[0132.348] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk") returned="ITVh9Fmpp8JFx.lnk"
	[0132.348] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.348] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x387, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x387, lpOverlapped=0x0) returned 1
	[0132.348] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.349] CloseHandle (hObject=0x21c) returned 1
	[0132.349] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\itvh9fmpp8jfx.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\itvh9fmpp8jfx.lnk.exe")) returned 1
	[0132.349] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f7cb749, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x4f7cb749, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x4f7cb749, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x0, dwReserved1=0x0, cFileName="iuSWIxWkYm2X.lnk", cAlternateFileName="IUSWIX~1.LNK")) returned 1
	[0132.349] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.367] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="iuSWIxWkYm2X.lnk") returned -1
	[0132.367] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="iuSWIxWkYm2X.lnk") returned -1
	[0132.367] lstrcmpiA (lpString1="", lpString2="iuSWIxWkYm2X.lnk") returned -1
	[0132.367] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITVh9Fmpp8JFx.lnk") returned="ITVh9Fmpp8JFx.lnk"
	[0132.367] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.367] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.367] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.367] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.367] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="iuSWIxWkYm2X.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk"
	[0132.367] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk", pszSpec="*.zip") returned 0
	[0132.367] lstrlenA (lpString="*.zip") returned 5
	[0132.367] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk", pszSpec="*.rar") returned 0
	[0132.367] lstrlenA (lpString="*.rar") returned 5
	[0132.367] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk", pszSpec="*.7z") returned 0
	[0132.367] lstrlenA (lpString="*.7z") returned 4
	[0132.367] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk", pszSpec="*.tar") returned 0
	[0132.367] lstrlenA (lpString="*.tar") returned 5
	[0132.367] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk", pszSpec="*.gzip") returned 0
	[0132.367] lstrlenA (lpString="*.gzip") returned 6
	[0132.367] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk", pszSpec="*.jpg") returned 0
	[0132.367] lstrlenA (lpString="*.jpg") returned 5
	[0132.367] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk", pszSpec="*.jpeg") returned 0
	[0132.367] lstrlenA (lpString="*.jpeg") returned 6
	[0132.367] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk", pszSpec="*.bmp") returned 0
	[0132.367] lstrlenA (lpString="*.bmp") returned 5
	[0132.368] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk", pszSpec="*.gif") returned 0
	[0132.368] lstrlenA (lpString="*.gif") returned 5
	[0132.368] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk", pszSpec="*.png") returned 0
	[0132.368] lstrlenA (lpString="*.png") returned 5
	[0132.368] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk", pszSpec="*.doc") returned 0
	[0132.368] lstrlenA (lpString="*.doc") returned 5
	[0132.368] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk", pszSpec="*.docx") returned 0
	[0132.368] lstrlenA (lpString="*.docx") returned 6
	[0132.368] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk", pszSpec="*.xls") returned 0
	[0132.368] lstrlenA (lpString="*.xls") returned 5
	[0132.368] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk", pszSpec="*.xlsx") returned 0
	[0132.368] lstrlenA (lpString="*.xlsx") returned 6
	[0132.368] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk", pszSpec="*.ppt") returned 0
	[0132.368] lstrlenA (lpString="*.ppt") returned 5
	[0132.368] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk", pszSpec="*.pptx") returned 0
	[0132.368] lstrlenA (lpString="*.pptx") returned 6
	[0132.368] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk", pszSpec="*.txt") returned 0
	[0132.368] lstrlenA (lpString="*.txt") returned 5
	[0132.368] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk", pszSpec="*.pdf") returned 0
	[0132.368] lstrlenA (lpString="*.pdf") returned 5
	[0132.368] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk", pszSpec="*.htm") returned 0
	[0132.368] lstrlenA (lpString="*.htm") returned 5
	[0132.368] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk", pszSpec="*.html") returned 0
	[0132.368] lstrlenA (lpString="*.html") returned 6
	[0132.368] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk", pszSpec="*.mdb") returned 0
	[0132.368] lstrlenA (lpString="*.mdb") returned 5
	[0132.368] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk", pszSpec="*.pfx") returned 0
	[0132.368] lstrlenA (lpString="*.pfx") returned 5
	[0132.368] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk", pszSpec="*.md") returned 0
	[0132.368] lstrlenA (lpString="*.md") returned 4
	[0132.368] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk", pszSpec="*.lnk") returned 1
	[0132.368] lstrlenA (lpString="*.lnk") returned 5
	[0132.368] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk"
	[0132.368] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk"
	[0132.368] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk."
	[0132.368] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk.exe"
	[0132.369] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\iuswixwkym2x.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.369] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x297
	[0132.369] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4f7cb749, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x4f7cb749, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4f7cb749, dwHighDateTime=0x1d543d9)) returned 1
	[0132.369] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.369] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x255, lpOverlapped=0x0) returned 1
	[0132.369] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk") returned="iuSWIxWkYm2X.lnk"
	[0132.369] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.369] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x255, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x255, lpOverlapped=0x0) returned 1
	[0132.369] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.369] CloseHandle (hObject=0x21c) returned 1
	[0132.370] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\iuswixwkym2x.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\iuswixwkym2x.lnk.exe")) returned 1
	[0132.370] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ce8440e, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x3ce8440e, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x3ce8440e, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="IZKvCHuPXNSG.lnk", cAlternateFileName="IZKVCH~1.LNK")) returned 1
	[0132.370] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.370] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="IZKvCHuPXNSG.lnk") returned -1
	[0132.370] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="IZKvCHuPXNSG.lnk") returned -1
	[0132.370] lstrcmpiA (lpString1="", lpString2="IZKvCHuPXNSG.lnk") returned -1
	[0132.370] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iuSWIxWkYm2X.lnk") returned="iuSWIxWkYm2X.lnk"
	[0132.370] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.370] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.371] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.371] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.371] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="IZKvCHuPXNSG.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk"
	[0132.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk", pszSpec="*.zip") returned 0
	[0132.371] lstrlenA (lpString="*.zip") returned 5
	[0132.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk", pszSpec="*.rar") returned 0
	[0132.371] lstrlenA (lpString="*.rar") returned 5
	[0132.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk", pszSpec="*.7z") returned 0
	[0132.371] lstrlenA (lpString="*.7z") returned 4
	[0132.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk", pszSpec="*.tar") returned 0
	[0132.371] lstrlenA (lpString="*.tar") returned 5
	[0132.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk", pszSpec="*.gzip") returned 0
	[0132.371] lstrlenA (lpString="*.gzip") returned 6
	[0132.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk", pszSpec="*.jpg") returned 0
	[0132.371] lstrlenA (lpString="*.jpg") returned 5
	[0132.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk", pszSpec="*.jpeg") returned 0
	[0132.371] lstrlenA (lpString="*.jpeg") returned 6
	[0132.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk", pszSpec="*.bmp") returned 0
	[0132.371] lstrlenA (lpString="*.bmp") returned 5
	[0132.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk", pszSpec="*.gif") returned 0
	[0132.371] lstrlenA (lpString="*.gif") returned 5
	[0132.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk", pszSpec="*.png") returned 0
	[0132.371] lstrlenA (lpString="*.png") returned 5
	[0132.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk", pszSpec="*.doc") returned 0
	[0132.371] lstrlenA (lpString="*.doc") returned 5
	[0132.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk", pszSpec="*.docx") returned 0
	[0132.371] lstrlenA (lpString="*.docx") returned 6
	[0132.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk", pszSpec="*.xls") returned 0
	[0132.371] lstrlenA (lpString="*.xls") returned 5
	[0132.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk", pszSpec="*.xlsx") returned 0
	[0132.371] lstrlenA (lpString="*.xlsx") returned 6
	[0132.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk", pszSpec="*.ppt") returned 0
	[0132.371] lstrlenA (lpString="*.ppt") returned 5
	[0132.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk", pszSpec="*.pptx") returned 0
	[0132.372] lstrlenA (lpString="*.pptx") returned 6
	[0132.372] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk", pszSpec="*.txt") returned 0
	[0132.372] lstrlenA (lpString="*.txt") returned 5
	[0132.372] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk", pszSpec="*.pdf") returned 0
	[0132.372] lstrlenA (lpString="*.pdf") returned 5
	[0132.372] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk", pszSpec="*.htm") returned 0
	[0132.372] lstrlenA (lpString="*.htm") returned 5
	[0132.372] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk", pszSpec="*.html") returned 0
	[0132.372] lstrlenA (lpString="*.html") returned 6
	[0132.372] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk", pszSpec="*.mdb") returned 0
	[0132.372] lstrlenA (lpString="*.mdb") returned 5
	[0132.372] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk", pszSpec="*.pfx") returned 0
	[0132.372] lstrlenA (lpString="*.pfx") returned 5
	[0132.372] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk", pszSpec="*.md") returned 0
	[0132.372] lstrlenA (lpString="*.md") returned 4
	[0132.372] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk", pszSpec="*.lnk") returned 1
	[0132.372] lstrlenA (lpString="*.lnk") returned 5
	[0132.372] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk"
	[0132.372] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk"
	[0132.372] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk."
	[0132.372] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk.exe"
	[0132.372] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\izkvchupxnsg.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.372] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5ac
	[0132.372] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3ce8440e, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x3ce8440e, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3ce8440e, dwHighDateTime=0x1d543d9)) returned 1
	[0132.373] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.373] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x56a, lpOverlapped=0x0) returned 1
	[0132.373] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk") returned="IZKvCHuPXNSG.lnk"
	[0132.373] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.373] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x56a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x56a, lpOverlapped=0x0) returned 1
	[0132.373] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.374] CloseHandle (hObject=0x21c) returned 1
	[0132.374] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\izkvchupxnsg.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\izkvchupxnsg.lnk.exe")) returned 1
	[0132.374] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51fe3458, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x51fe3458, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x51fe3458, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J-smxptjhdz3.lnk", cAlternateFileName="J-SMXP~1.LNK")) returned 1
	[0132.374] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.374] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J-smxptjhdz3.lnk") returned -1
	[0132.374] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J-smxptjhdz3.lnk") returned -1
	[0132.374] lstrcmpiA (lpString1="", lpString2="J-smxptjhdz3.lnk") returned -1
	[0132.374] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IZKvCHuPXNSG.lnk") returned="IZKvCHuPXNSG.lnk"
	[0132.374] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.374] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.375] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.375] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.375] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="J-smxptjhdz3.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk"
	[0132.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk", pszSpec="*.zip") returned 0
	[0132.375] lstrlenA (lpString="*.zip") returned 5
	[0132.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk", pszSpec="*.rar") returned 0
	[0132.375] lstrlenA (lpString="*.rar") returned 5
	[0132.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk", pszSpec="*.7z") returned 0
	[0132.375] lstrlenA (lpString="*.7z") returned 4
	[0132.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk", pszSpec="*.tar") returned 0
	[0132.375] lstrlenA (lpString="*.tar") returned 5
	[0132.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk", pszSpec="*.gzip") returned 0
	[0132.375] lstrlenA (lpString="*.gzip") returned 6
	[0132.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk", pszSpec="*.jpg") returned 0
	[0132.375] lstrlenA (lpString="*.jpg") returned 5
	[0132.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk", pszSpec="*.jpeg") returned 0
	[0132.375] lstrlenA (lpString="*.jpeg") returned 6
	[0132.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk", pszSpec="*.bmp") returned 0
	[0132.375] lstrlenA (lpString="*.bmp") returned 5
	[0132.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk", pszSpec="*.gif") returned 0
	[0132.375] lstrlenA (lpString="*.gif") returned 5
	[0132.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk", pszSpec="*.png") returned 0
	[0132.375] lstrlenA (lpString="*.png") returned 5
	[0132.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk", pszSpec="*.doc") returned 0
	[0132.375] lstrlenA (lpString="*.doc") returned 5
	[0132.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk", pszSpec="*.docx") returned 0
	[0132.375] lstrlenA (lpString="*.docx") returned 6
	[0132.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk", pszSpec="*.xls") returned 0
	[0132.375] lstrlenA (lpString="*.xls") returned 5
	[0132.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk", pszSpec="*.xlsx") returned 0
	[0132.375] lstrlenA (lpString="*.xlsx") returned 6
	[0132.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk", pszSpec="*.ppt") returned 0
	[0132.375] lstrlenA (lpString="*.ppt") returned 5
	[0132.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk", pszSpec="*.pptx") returned 0
	[0132.376] lstrlenA (lpString="*.pptx") returned 6
	[0132.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk", pszSpec="*.txt") returned 0
	[0132.376] lstrlenA (lpString="*.txt") returned 5
	[0132.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk", pszSpec="*.pdf") returned 0
	[0132.376] lstrlenA (lpString="*.pdf") returned 5
	[0132.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk", pszSpec="*.htm") returned 0
	[0132.376] lstrlenA (lpString="*.htm") returned 5
	[0132.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk", pszSpec="*.html") returned 0
	[0132.376] lstrlenA (lpString="*.html") returned 6
	[0132.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk", pszSpec="*.mdb") returned 0
	[0132.376] lstrlenA (lpString="*.mdb") returned 5
	[0132.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk", pszSpec="*.pfx") returned 0
	[0132.376] lstrlenA (lpString="*.pfx") returned 5
	[0132.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk", pszSpec="*.md") returned 0
	[0132.376] lstrlenA (lpString="*.md") returned 4
	[0132.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk", pszSpec="*.lnk") returned 1
	[0132.376] lstrlenA (lpString="*.lnk") returned 5
	[0132.376] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk"
	[0132.376] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk"
	[0132.376] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk."
	[0132.376] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk.exe"
	[0132.376] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\j-smxptjhdz3.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.376] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3c4
	[0132.376] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x51fe3458, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x51fe3458, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x51fe3458, dwHighDateTime=0x1d543d9)) returned 1
	[0132.376] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.377] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x382, lpOverlapped=0x0) returned 1
	[0132.377] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk") returned="J-smxptjhdz3.lnk"
	[0132.377] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.377] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x382, lpOverlapped=0x0) returned 1
	[0132.377] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.377] CloseHandle (hObject=0x21c) returned 1
	[0132.378] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\j-smxptjhdz3.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\j-smxptjhdz3.lnk.exe")) returned 1
	[0132.378] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51da6e1a, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x51da6e1a, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x51dcd082, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x430, dwReserved0=0x0, dwReserved1=0x0, cFileName="J1EN0.flv.lnk", cAlternateFileName="J1EN0F~1.LNK")) returned 1
	[0132.378] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.378] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J1EN0.flv.lnk") returned -1
	[0132.378] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J1EN0.flv.lnk") returned -1
	[0132.378] lstrcmpiA (lpString1="", lpString2="J1EN0.flv.lnk") returned -1
	[0132.378] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-smxptjhdz3.lnk") returned="J-smxptjhdz3.lnk"
	[0132.378] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.378] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.378] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.378] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.379] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="J1EN0.flv.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk"
	[0132.379] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk", pszSpec="*.zip") returned 0
	[0132.379] lstrlenA (lpString="*.zip") returned 5
	[0132.379] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk", pszSpec="*.rar") returned 0
	[0132.379] lstrlenA (lpString="*.rar") returned 5
	[0132.379] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk", pszSpec="*.7z") returned 0
	[0132.379] lstrlenA (lpString="*.7z") returned 4
	[0132.379] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk", pszSpec="*.tar") returned 0
	[0132.379] lstrlenA (lpString="*.tar") returned 5
	[0132.379] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk", pszSpec="*.gzip") returned 0
	[0132.379] lstrlenA (lpString="*.gzip") returned 6
	[0132.379] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk", pszSpec="*.jpg") returned 0
	[0132.379] lstrlenA (lpString="*.jpg") returned 5
	[0132.379] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk", pszSpec="*.jpeg") returned 0
	[0132.379] lstrlenA (lpString="*.jpeg") returned 6
	[0132.379] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk", pszSpec="*.bmp") returned 0
	[0132.379] lstrlenA (lpString="*.bmp") returned 5
	[0132.379] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk", pszSpec="*.gif") returned 0
	[0132.379] lstrlenA (lpString="*.gif") returned 5
	[0132.379] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk", pszSpec="*.png") returned 0
	[0132.379] lstrlenA (lpString="*.png") returned 5
	[0132.379] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk", pszSpec="*.doc") returned 0
	[0132.379] lstrlenA (lpString="*.doc") returned 5
	[0132.379] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk", pszSpec="*.docx") returned 0
	[0132.379] lstrlenA (lpString="*.docx") returned 6
	[0132.379] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk", pszSpec="*.xls") returned 0
	[0132.379] lstrlenA (lpString="*.xls") returned 5
	[0132.379] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk", pszSpec="*.xlsx") returned 0
	[0132.379] lstrlenA (lpString="*.xlsx") returned 6
	[0132.379] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk", pszSpec="*.ppt") returned 0
	[0132.379] lstrlenA (lpString="*.ppt") returned 5
	[0132.379] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk", pszSpec="*.pptx") returned 0
	[0132.379] lstrlenA (lpString="*.pptx") returned 6
	[0132.379] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk", pszSpec="*.txt") returned 0
	[0132.379] lstrlenA (lpString="*.txt") returned 5
	[0132.379] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk", pszSpec="*.pdf") returned 0
	[0132.379] lstrlenA (lpString="*.pdf") returned 5
	[0132.380] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk", pszSpec="*.htm") returned 0
	[0132.380] lstrlenA (lpString="*.htm") returned 5
	[0132.380] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk", pszSpec="*.html") returned 0
	[0132.380] lstrlenA (lpString="*.html") returned 6
	[0132.380] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk", pszSpec="*.mdb") returned 0
	[0132.380] lstrlenA (lpString="*.mdb") returned 5
	[0132.380] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk", pszSpec="*.pfx") returned 0
	[0132.380] lstrlenA (lpString="*.pfx") returned 5
	[0132.380] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk", pszSpec="*.md") returned 0
	[0132.380] lstrlenA (lpString="*.md") returned 4
	[0132.380] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk", pszSpec="*.lnk") returned 1
	[0132.380] lstrlenA (lpString="*.lnk") returned 5
	[0132.380] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk"
	[0132.380] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk"
	[0132.380] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk."
	[0132.380] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk.exe"
	[0132.380] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\j1en0.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.380] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x430
	[0132.380] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x51da6e1a, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x51da6e1a, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x51dcd082, dwHighDateTime=0x1d543d9)) returned 1
	[0132.380] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.380] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x3ee, lpOverlapped=0x0) returned 1
	[0132.381] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk") returned="J1EN0.flv.lnk"
	[0132.381] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.381] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x3ee, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x3ee, lpOverlapped=0x0) returned 1
	[0132.381] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.382] CloseHandle (hObject=0x21c) returned 1
	[0132.382] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\j1en0.flv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\j1en0.flv.lnk.exe")) returned 1
	[0132.382] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x148de1ac, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x148de1ac, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x148de1ac, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x40d, dwReserved0=0x0, dwReserved1=0x0, cFileName="jUzjvbgRnRyNHliB6Kj0.lnk", cAlternateFileName="JUZJVB~1.LNK")) returned 1
	[0132.382] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.382] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="jUzjvbgRnRyNHliB6Kj0.lnk") returned -1
	[0132.382] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="jUzjvbgRnRyNHliB6Kj0.lnk") returned -1
	[0132.382] lstrcmpiA (lpString1="", lpString2="jUzjvbgRnRyNHliB6Kj0.lnk") returned -1
	[0132.382] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J1EN0.flv.lnk") returned="J1EN0.flv.lnk"
	[0132.382] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.383] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.383] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.383] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.383] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="jUzjvbgRnRyNHliB6Kj0.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk"
	[0132.383] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk", pszSpec="*.zip") returned 0
	[0132.383] lstrlenA (lpString="*.zip") returned 5
	[0132.383] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk", pszSpec="*.rar") returned 0
	[0132.383] lstrlenA (lpString="*.rar") returned 5
	[0132.383] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk", pszSpec="*.7z") returned 0
	[0132.383] lstrlenA (lpString="*.7z") returned 4
	[0132.383] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk", pszSpec="*.tar") returned 0
	[0132.383] lstrlenA (lpString="*.tar") returned 5
	[0132.383] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk", pszSpec="*.gzip") returned 0
	[0132.383] lstrlenA (lpString="*.gzip") returned 6
	[0132.383] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk", pszSpec="*.jpg") returned 0
	[0132.383] lstrlenA (lpString="*.jpg") returned 5
	[0132.383] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk", pszSpec="*.jpeg") returned 0
	[0132.383] lstrlenA (lpString="*.jpeg") returned 6
	[0132.383] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk", pszSpec="*.bmp") returned 0
	[0132.383] lstrlenA (lpString="*.bmp") returned 5
	[0132.383] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk", pszSpec="*.gif") returned 0
	[0132.383] lstrlenA (lpString="*.gif") returned 5
	[0132.383] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk", pszSpec="*.png") returned 0
	[0132.383] lstrlenA (lpString="*.png") returned 5
	[0132.383] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk", pszSpec="*.doc") returned 0
	[0132.383] lstrlenA (lpString="*.doc") returned 5
	[0132.383] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk", pszSpec="*.docx") returned 0
	[0132.383] lstrlenA (lpString="*.docx") returned 6
	[0132.383] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk", pszSpec="*.xls") returned 0
	[0132.383] lstrlenA (lpString="*.xls") returned 5
	[0132.383] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk", pszSpec="*.xlsx") returned 0
	[0132.383] lstrlenA (lpString="*.xlsx") returned 6
	[0132.383] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk", pszSpec="*.ppt") returned 0
	[0132.383] lstrlenA (lpString="*.ppt") returned 5
	[0132.384] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk", pszSpec="*.pptx") returned 0
	[0132.384] lstrlenA (lpString="*.pptx") returned 6
	[0132.384] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk", pszSpec="*.txt") returned 0
	[0132.384] lstrlenA (lpString="*.txt") returned 5
	[0132.384] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk", pszSpec="*.pdf") returned 0
	[0132.384] lstrlenA (lpString="*.pdf") returned 5
	[0132.384] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk", pszSpec="*.htm") returned 0
	[0132.384] lstrlenA (lpString="*.htm") returned 5
	[0132.384] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk", pszSpec="*.html") returned 0
	[0132.384] lstrlenA (lpString="*.html") returned 6
	[0132.384] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk", pszSpec="*.mdb") returned 0
	[0132.384] lstrlenA (lpString="*.mdb") returned 5
	[0132.384] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk", pszSpec="*.pfx") returned 0
	[0132.384] lstrlenA (lpString="*.pfx") returned 5
	[0132.384] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk", pszSpec="*.md") returned 0
	[0132.384] lstrlenA (lpString="*.md") returned 4
	[0132.384] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk", pszSpec="*.lnk") returned 1
	[0132.384] lstrlenA (lpString="*.lnk") returned 5
	[0132.384] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk"
	[0132.384] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk"
	[0132.384] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk."
	[0132.384] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk.exe"
	[0132.384] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\juzjvbgrnrynhlib6kj0.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.384] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40d
	[0132.384] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x148de1ac, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x148de1ac, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x148de1ac, dwHighDateTime=0x1d543d9)) returned 1
	[0132.385] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.385] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x3cb, lpOverlapped=0x0) returned 1
	[0132.385] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk") returned="jUzjvbgRnRyNHliB6Kj0.lnk"
	[0132.385] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.385] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x3cb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x3cb, lpOverlapped=0x0) returned 1
	[0132.385] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.386] CloseHandle (hObject=0x21c) returned 1
	[0132.386] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\juzjvbgrnrynhlib6kj0.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\juzjvbgrnrynhlib6kj0.lnk.exe")) returned 1
	[0132.386] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d74f13a, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x3d74f13a, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x3d74f13a, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x408, dwReserved0=0x0, dwReserved1=0x0, cFileName="jzJTpHvC8SNZeOoEsMt.lnk", cAlternateFileName="JZJTPH~1.LNK")) returned 1
	[0132.386] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.386] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="jzJTpHvC8SNZeOoEsMt.lnk") returned -1
	[0132.386] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="jzJTpHvC8SNZeOoEsMt.lnk") returned -1
	[0132.386] lstrcmpiA (lpString1="", lpString2="jzJTpHvC8SNZeOoEsMt.lnk") returned -1
	[0132.386] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jUzjvbgRnRyNHliB6Kj0.lnk") returned="jUzjvbgRnRyNHliB6Kj0.lnk"
	[0132.386] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.386] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.387] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.387] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.387] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="jzJTpHvC8SNZeOoEsMt.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk"
	[0132.387] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk", pszSpec="*.zip") returned 0
	[0132.387] lstrlenA (lpString="*.zip") returned 5
	[0132.387] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk", pszSpec="*.rar") returned 0
	[0132.387] lstrlenA (lpString="*.rar") returned 5
	[0132.387] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk", pszSpec="*.7z") returned 0
	[0132.387] lstrlenA (lpString="*.7z") returned 4
	[0132.387] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk", pszSpec="*.tar") returned 0
	[0132.387] lstrlenA (lpString="*.tar") returned 5
	[0132.387] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk", pszSpec="*.gzip") returned 0
	[0132.387] lstrlenA (lpString="*.gzip") returned 6
	[0132.387] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk", pszSpec="*.jpg") returned 0
	[0132.387] lstrlenA (lpString="*.jpg") returned 5
	[0132.387] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk", pszSpec="*.jpeg") returned 0
	[0132.387] lstrlenA (lpString="*.jpeg") returned 6
	[0132.387] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk", pszSpec="*.bmp") returned 0
	[0132.387] lstrlenA (lpString="*.bmp") returned 5
	[0132.387] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk", pszSpec="*.gif") returned 0
	[0132.387] lstrlenA (lpString="*.gif") returned 5
	[0132.387] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk", pszSpec="*.png") returned 0
	[0132.387] lstrlenA (lpString="*.png") returned 5
	[0132.387] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk", pszSpec="*.doc") returned 0
	[0132.387] lstrlenA (lpString="*.doc") returned 5
	[0132.387] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk", pszSpec="*.docx") returned 0
	[0132.387] lstrlenA (lpString="*.docx") returned 6
	[0132.387] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk", pszSpec="*.xls") returned 0
	[0132.387] lstrlenA (lpString="*.xls") returned 5
	[0132.387] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk", pszSpec="*.xlsx") returned 0
	[0132.387] lstrlenA (lpString="*.xlsx") returned 6
	[0132.387] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk", pszSpec="*.ppt") returned 0
	[0132.387] lstrlenA (lpString="*.ppt") returned 5
	[0132.387] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk", pszSpec="*.pptx") returned 0
	[0132.388] lstrlenA (lpString="*.pptx") returned 6
	[0132.388] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk", pszSpec="*.txt") returned 0
	[0132.388] lstrlenA (lpString="*.txt") returned 5
	[0132.388] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk", pszSpec="*.pdf") returned 0
	[0132.388] lstrlenA (lpString="*.pdf") returned 5
	[0132.388] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk", pszSpec="*.htm") returned 0
	[0132.388] lstrlenA (lpString="*.htm") returned 5
	[0132.388] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk", pszSpec="*.html") returned 0
	[0132.388] lstrlenA (lpString="*.html") returned 6
	[0132.388] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk", pszSpec="*.mdb") returned 0
	[0132.388] lstrlenA (lpString="*.mdb") returned 5
	[0132.388] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk", pszSpec="*.pfx") returned 0
	[0132.388] lstrlenA (lpString="*.pfx") returned 5
	[0132.388] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk", pszSpec="*.md") returned 0
	[0132.388] lstrlenA (lpString="*.md") returned 4
	[0132.388] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk", pszSpec="*.lnk") returned 1
	[0132.388] lstrlenA (lpString="*.lnk") returned 5
	[0132.388] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk"
	[0132.388] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk"
	[0132.388] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk."
	[0132.388] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk.exe"
	[0132.388] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jzjtphvc8snzeooesmt.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.388] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x408
	[0132.388] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3d74f13a, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x3d74f13a, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3d74f13a, dwHighDateTime=0x1d543d9)) returned 1
	[0132.389] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.389] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x3c6, lpOverlapped=0x0) returned 1
	[0132.389] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk") returned="jzJTpHvC8SNZeOoEsMt.lnk"
	[0132.389] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.389] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x3c6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x3c6, lpOverlapped=0x0) returned 1
	[0132.389] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.390] CloseHandle (hObject=0x21c) returned 1
	[0132.390] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jzjtphvc8snzeooesmt.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jzjtphvc8snzeooesmt.lnk.exe")) returned 1
	[0132.390] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51e659e7, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x51e659e7, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x51e659e7, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x597, dwReserved0=0x0, dwReserved1=0x0, cFileName="k6qoquI u4IJ gCZpdK.lnk", cAlternateFileName="K6QOQU~1.LNK")) returned 1
	[0132.390] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.390] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="k6qoquI u4IJ gCZpdK.lnk") returned -1
	[0132.390] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="k6qoquI u4IJ gCZpdK.lnk") returned -1
	[0132.390] lstrcmpiA (lpString1="", lpString2="k6qoquI u4IJ gCZpdK.lnk") returned -1
	[0132.390] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzJTpHvC8SNZeOoEsMt.lnk") returned="jzJTpHvC8SNZeOoEsMt.lnk"
	[0132.390] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.390] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.390] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.391] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.391] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="k6qoquI u4IJ gCZpdK.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk"
	[0132.391] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk", pszSpec="*.zip") returned 0
	[0132.391] lstrlenA (lpString="*.zip") returned 5
	[0132.391] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk", pszSpec="*.rar") returned 0
	[0132.391] lstrlenA (lpString="*.rar") returned 5
	[0132.391] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk", pszSpec="*.7z") returned 0
	[0132.391] lstrlenA (lpString="*.7z") returned 4
	[0132.391] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk", pszSpec="*.tar") returned 0
	[0132.391] lstrlenA (lpString="*.tar") returned 5
	[0132.391] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk", pszSpec="*.gzip") returned 0
	[0132.391] lstrlenA (lpString="*.gzip") returned 6
	[0132.391] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk", pszSpec="*.jpg") returned 0
	[0132.391] lstrlenA (lpString="*.jpg") returned 5
	[0132.391] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk", pszSpec="*.jpeg") returned 0
	[0132.391] lstrlenA (lpString="*.jpeg") returned 6
	[0132.391] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk", pszSpec="*.bmp") returned 0
	[0132.391] lstrlenA (lpString="*.bmp") returned 5
	[0132.391] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk", pszSpec="*.gif") returned 0
	[0132.391] lstrlenA (lpString="*.gif") returned 5
	[0132.391] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk", pszSpec="*.png") returned 0
	[0132.391] lstrlenA (lpString="*.png") returned 5
	[0132.391] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk", pszSpec="*.doc") returned 0
	[0132.391] lstrlenA (lpString="*.doc") returned 5
	[0132.391] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk", pszSpec="*.docx") returned 0
	[0132.391] lstrlenA (lpString="*.docx") returned 6
	[0132.391] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk", pszSpec="*.xls") returned 0
	[0132.391] lstrlenA (lpString="*.xls") returned 5
	[0132.391] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk", pszSpec="*.xlsx") returned 0
	[0132.391] lstrlenA (lpString="*.xlsx") returned 6
	[0132.391] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk", pszSpec="*.ppt") returned 0
	[0132.391] lstrlenA (lpString="*.ppt") returned 5
	[0132.391] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk", pszSpec="*.pptx") returned 0
	[0132.391] lstrlenA (lpString="*.pptx") returned 6
	[0132.391] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk", pszSpec="*.txt") returned 0
	[0132.392] lstrlenA (lpString="*.txt") returned 5
	[0132.392] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk", pszSpec="*.pdf") returned 0
	[0132.392] lstrlenA (lpString="*.pdf") returned 5
	[0132.392] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk", pszSpec="*.htm") returned 0
	[0132.392] lstrlenA (lpString="*.htm") returned 5
	[0132.392] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk", pszSpec="*.html") returned 0
	[0132.392] lstrlenA (lpString="*.html") returned 6
	[0132.392] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk", pszSpec="*.mdb") returned 0
	[0132.392] lstrlenA (lpString="*.mdb") returned 5
	[0132.392] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk", pszSpec="*.pfx") returned 0
	[0132.392] lstrlenA (lpString="*.pfx") returned 5
	[0132.392] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk", pszSpec="*.md") returned 0
	[0132.392] lstrlenA (lpString="*.md") returned 4
	[0132.392] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk", pszSpec="*.lnk") returned 1
	[0132.392] lstrlenA (lpString="*.lnk") returned 5
	[0132.392] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk"
	[0132.392] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk"
	[0132.392] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk."
	[0132.392] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk.exe"
	[0132.392] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\k6qoqui u4ij gczpdk.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.392] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x597
	[0132.392] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x51e659e7, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x51e659e7, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x51e659e7, dwHighDateTime=0x1d543d9)) returned 1
	[0132.392] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.392] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x555, lpOverlapped=0x0) returned 1
	[0132.393] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk") returned="k6qoquI u4IJ gCZpdK.lnk"
	[0132.393] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.393] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x555, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x555, lpOverlapped=0x0) returned 1
	[0132.393] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.393] CloseHandle (hObject=0x21c) returned 1
	[0132.394] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\k6qoqui u4ij gczpdk.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\k6qoqui u4ij gczpdk.lnk.exe")) returned 1
	[0132.394] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40b96bb1, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x51f4aa8f, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x51f4aa8f, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="kPFqZ (2).lnk", cAlternateFileName="KPFQZ(~1.LNK")) returned 1
	[0132.394] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.394] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="kPFqZ (2).lnk") returned -1
	[0132.394] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="kPFqZ (2).lnk") returned -1
	[0132.394] lstrcmpiA (lpString1="", lpString2="kPFqZ (2).lnk") returned -1
	[0132.394] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k6qoquI u4IJ gCZpdK.lnk") returned="k6qoquI u4IJ gCZpdK.lnk"
	[0132.394] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.394] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.394] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.394] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.394] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="kPFqZ (2).lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk"
	[0132.395] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk", pszSpec="*.zip") returned 0
	[0132.395] lstrlenA (lpString="*.zip") returned 5
	[0132.395] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk", pszSpec="*.rar") returned 0
	[0132.395] lstrlenA (lpString="*.rar") returned 5
	[0132.395] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk", pszSpec="*.7z") returned 0
	[0132.395] lstrlenA (lpString="*.7z") returned 4
	[0132.395] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk", pszSpec="*.tar") returned 0
	[0132.395] lstrlenA (lpString="*.tar") returned 5
	[0132.395] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk", pszSpec="*.gzip") returned 0
	[0132.395] lstrlenA (lpString="*.gzip") returned 6
	[0132.395] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk", pszSpec="*.jpg") returned 0
	[0132.395] lstrlenA (lpString="*.jpg") returned 5
	[0132.395] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk", pszSpec="*.jpeg") returned 0
	[0132.395] lstrlenA (lpString="*.jpeg") returned 6
	[0132.395] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk", pszSpec="*.bmp") returned 0
	[0132.395] lstrlenA (lpString="*.bmp") returned 5
	[0132.395] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk", pszSpec="*.gif") returned 0
	[0132.395] lstrlenA (lpString="*.gif") returned 5
	[0132.395] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk", pszSpec="*.png") returned 0
	[0132.395] lstrlenA (lpString="*.png") returned 5
	[0132.395] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk", pszSpec="*.doc") returned 0
	[0132.395] lstrlenA (lpString="*.doc") returned 5
	[0132.395] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk", pszSpec="*.docx") returned 0
	[0132.395] lstrlenA (lpString="*.docx") returned 6
	[0132.395] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk", pszSpec="*.xls") returned 0
	[0132.395] lstrlenA (lpString="*.xls") returned 5
	[0132.395] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk", pszSpec="*.xlsx") returned 0
	[0132.395] lstrlenA (lpString="*.xlsx") returned 6
	[0132.395] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk", pszSpec="*.ppt") returned 0
	[0132.395] lstrlenA (lpString="*.ppt") returned 5
	[0132.395] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk", pszSpec="*.pptx") returned 0
	[0132.395] lstrlenA (lpString="*.pptx") returned 6
	[0132.395] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk", pszSpec="*.txt") returned 0
	[0132.395] lstrlenA (lpString="*.txt") returned 5
	[0132.395] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk", pszSpec="*.pdf") returned 0
	[0132.395] lstrlenA (lpString="*.pdf") returned 5
	[0132.396] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk", pszSpec="*.htm") returned 0
	[0132.396] lstrlenA (lpString="*.htm") returned 5
	[0132.396] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk", pszSpec="*.html") returned 0
	[0132.396] lstrlenA (lpString="*.html") returned 6
	[0132.396] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk", pszSpec="*.mdb") returned 0
	[0132.396] lstrlenA (lpString="*.mdb") returned 5
	[0132.396] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk", pszSpec="*.pfx") returned 0
	[0132.396] lstrlenA (lpString="*.pfx") returned 5
	[0132.396] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk", pszSpec="*.md") returned 0
	[0132.396] lstrlenA (lpString="*.md") returned 4
	[0132.396] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk", pszSpec="*.lnk") returned 1
	[0132.396] lstrlenA (lpString="*.lnk") returned 5
	[0132.396] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk"
	[0132.396] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk"
	[0132.396] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk."
	[0132.396] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk.exe"
	[0132.396] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kpfqz (2).lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.396] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d8
	[0132.396] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x40b96bb1, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x51f4aa8f, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x51f4aa8f, dwHighDateTime=0x1d543d9)) returned 1
	[0132.396] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.396] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x396, lpOverlapped=0x0) returned 1
	[0132.397] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk") returned="kPFqZ (2).lnk"
	[0132.397] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.397] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x396, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x396, lpOverlapped=0x0) returned 1
	[0132.398] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.398] CloseHandle (hObject=0x21c) returned 1
	[0132.398] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kpfqz (2).lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kpfqz (2).lnk.exe")) returned 1
	[0132.398] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1613ae2f, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x3cc9483c, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x3cc9483c, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="kPFqZ.lnk", cAlternateFileName="")) returned 1
	[0132.398] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.398] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="kPFqZ.lnk") returned -1
	[0132.398] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="kPFqZ.lnk") returned -1
	[0132.398] lstrcmpiA (lpString1="", lpString2="kPFqZ.lnk") returned -1
	[0132.398] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ (2).lnk") returned="kPFqZ (2).lnk"
	[0132.398] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.398] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.398] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.399] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.399] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="kPFqZ.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk"
	[0132.399] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk", pszSpec="*.zip") returned 0
	[0132.399] lstrlenA (lpString="*.zip") returned 5
	[0132.399] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk", pszSpec="*.rar") returned 0
	[0132.399] lstrlenA (lpString="*.rar") returned 5
	[0132.399] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk", pszSpec="*.7z") returned 0
	[0132.399] lstrlenA (lpString="*.7z") returned 4
	[0132.399] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk", pszSpec="*.tar") returned 0
	[0132.399] lstrlenA (lpString="*.tar") returned 5
	[0132.399] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk", pszSpec="*.gzip") returned 0
	[0132.399] lstrlenA (lpString="*.gzip") returned 6
	[0132.399] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk", pszSpec="*.jpg") returned 0
	[0132.399] lstrlenA (lpString="*.jpg") returned 5
	[0132.399] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk", pszSpec="*.jpeg") returned 0
	[0132.399] lstrlenA (lpString="*.jpeg") returned 6
	[0132.399] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk", pszSpec="*.bmp") returned 0
	[0132.399] lstrlenA (lpString="*.bmp") returned 5
	[0132.399] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk", pszSpec="*.gif") returned 0
	[0132.399] lstrlenA (lpString="*.gif") returned 5
	[0132.399] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk", pszSpec="*.png") returned 0
	[0132.399] lstrlenA (lpString="*.png") returned 5
	[0132.399] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk", pszSpec="*.doc") returned 0
	[0132.399] lstrlenA (lpString="*.doc") returned 5
	[0132.399] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk", pszSpec="*.docx") returned 0
	[0132.399] lstrlenA (lpString="*.docx") returned 6
	[0132.399] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk", pszSpec="*.xls") returned 0
	[0132.399] lstrlenA (lpString="*.xls") returned 5
	[0132.399] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk", pszSpec="*.xlsx") returned 0
	[0132.399] lstrlenA (lpString="*.xlsx") returned 6
	[0132.399] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk", pszSpec="*.ppt") returned 0
	[0132.399] lstrlenA (lpString="*.ppt") returned 5
	[0132.399] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk", pszSpec="*.pptx") returned 0
	[0132.399] lstrlenA (lpString="*.pptx") returned 6
	[0132.399] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk", pszSpec="*.txt") returned 0
	[0132.400] lstrlenA (lpString="*.txt") returned 5
	[0132.400] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk", pszSpec="*.pdf") returned 0
	[0132.400] lstrlenA (lpString="*.pdf") returned 5
	[0132.400] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk", pszSpec="*.htm") returned 0
	[0132.400] lstrlenA (lpString="*.htm") returned 5
	[0132.400] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk", pszSpec="*.html") returned 0
	[0132.400] lstrlenA (lpString="*.html") returned 6
	[0132.400] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk", pszSpec="*.mdb") returned 0
	[0132.400] lstrlenA (lpString="*.mdb") returned 5
	[0132.400] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk", pszSpec="*.pfx") returned 0
	[0132.400] lstrlenA (lpString="*.pfx") returned 5
	[0132.400] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk", pszSpec="*.md") returned 0
	[0132.400] lstrlenA (lpString="*.md") returned 4
	[0132.400] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk", pszSpec="*.lnk") returned 1
	[0132.400] lstrlenA (lpString="*.lnk") returned 5
	[0132.400] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk"
	[0132.400] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk"
	[0132.400] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk."
	[0132.400] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk.exe"
	[0132.400] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kpfqz.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.400] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d8
	[0132.400] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1613ae2f, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x3cc9483c, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3cc9483c, dwHighDateTime=0x1d543d9)) returned 1
	[0132.400] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.400] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x396, lpOverlapped=0x0) returned 1
	[0132.401] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk") returned="kPFqZ.lnk"
	[0132.401] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.401] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x396, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x396, lpOverlapped=0x0) returned 1
	[0132.401] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.402] CloseHandle (hObject=0x21c) returned 1
	[0132.402] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kpfqz.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kpfqz.lnk.exe")) returned 1
	[0132.402] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5277d970, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x5277d970, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x5277d970, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="KwaAVgn.lnk", cAlternateFileName="")) returned 1
	[0132.402] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.402] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="KwaAVgn.lnk") returned -1
	[0132.402] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="KwaAVgn.lnk") returned -1
	[0132.402] lstrcmpiA (lpString1="", lpString2="KwaAVgn.lnk") returned -1
	[0132.402] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kPFqZ.lnk") returned="kPFqZ.lnk"
	[0132.402] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.402] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.402] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.402] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.403] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="KwaAVgn.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk"
	[0132.403] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk", pszSpec="*.zip") returned 0
	[0132.403] lstrlenA (lpString="*.zip") returned 5
	[0132.403] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk", pszSpec="*.rar") returned 0
	[0132.403] lstrlenA (lpString="*.rar") returned 5
	[0132.403] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk", pszSpec="*.7z") returned 0
	[0132.403] lstrlenA (lpString="*.7z") returned 4
	[0132.403] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk", pszSpec="*.tar") returned 0
	[0132.403] lstrlenA (lpString="*.tar") returned 5
	[0132.403] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk", pszSpec="*.gzip") returned 0
	[0132.403] lstrlenA (lpString="*.gzip") returned 6
	[0132.403] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk", pszSpec="*.jpg") returned 0
	[0132.403] lstrlenA (lpString="*.jpg") returned 5
	[0132.403] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk", pszSpec="*.jpeg") returned 0
	[0132.403] lstrlenA (lpString="*.jpeg") returned 6
	[0132.403] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk", pszSpec="*.bmp") returned 0
	[0132.403] lstrlenA (lpString="*.bmp") returned 5
	[0132.403] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk", pszSpec="*.gif") returned 0
	[0132.403] lstrlenA (lpString="*.gif") returned 5
	[0132.403] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk", pszSpec="*.png") returned 0
	[0132.403] lstrlenA (lpString="*.png") returned 5
	[0132.403] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk", pszSpec="*.doc") returned 0
	[0132.403] lstrlenA (lpString="*.doc") returned 5
	[0132.403] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk", pszSpec="*.docx") returned 0
	[0132.403] lstrlenA (lpString="*.docx") returned 6
	[0132.403] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk", pszSpec="*.xls") returned 0
	[0132.403] lstrlenA (lpString="*.xls") returned 5
	[0132.403] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk", pszSpec="*.xlsx") returned 0
	[0132.403] lstrlenA (lpString="*.xlsx") returned 6
	[0132.403] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk", pszSpec="*.ppt") returned 0
	[0132.403] lstrlenA (lpString="*.ppt") returned 5
	[0132.403] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk", pszSpec="*.pptx") returned 0
	[0132.403] lstrlenA (lpString="*.pptx") returned 6
	[0132.403] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk", pszSpec="*.txt") returned 0
	[0132.403] lstrlenA (lpString="*.txt") returned 5
	[0132.403] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk", pszSpec="*.pdf") returned 0
	[0132.404] lstrlenA (lpString="*.pdf") returned 5
	[0132.404] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk", pszSpec="*.htm") returned 0
	[0132.404] lstrlenA (lpString="*.htm") returned 5
	[0132.404] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk", pszSpec="*.html") returned 0
	[0132.404] lstrlenA (lpString="*.html") returned 6
	[0132.404] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk", pszSpec="*.mdb") returned 0
	[0132.404] lstrlenA (lpString="*.mdb") returned 5
	[0132.404] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk", pszSpec="*.pfx") returned 0
	[0132.404] lstrlenA (lpString="*.pfx") returned 5
	[0132.404] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk", pszSpec="*.md") returned 0
	[0132.404] lstrlenA (lpString="*.md") returned 4
	[0132.404] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk", pszSpec="*.lnk") returned 1
	[0132.404] lstrlenA (lpString="*.lnk") returned 5
	[0132.404] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk"
	[0132.404] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk"
	[0132.404] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk."
	[0132.404] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk.exe"
	[0132.404] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kwaavgn.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.404] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b7
	[0132.404] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5277d970, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x5277d970, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5277d970, dwHighDateTime=0x1d543d9)) returned 1
	[0132.404] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.404] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x375, lpOverlapped=0x0) returned 1
	[0132.405] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk") returned="KwaAVgn.lnk"
	[0132.405] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.405] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x375, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x375, lpOverlapped=0x0) returned 1
	[0132.405] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.405] CloseHandle (hObject=0x21c) returned 1
	[0132.406] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kwaavgn.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kwaavgn.lnk.exe")) returned 1
	[0132.406] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40b96bb1, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x40b96bb1, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x40b96bb1, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LFIKzkxmMrJEN2Bw8k7.lnk", cAlternateFileName="LFIKZK~1.LNK")) returned 1
	[0132.406] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.406] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="LFIKzkxmMrJEN2Bw8k7.lnk") returned -1
	[0132.406] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="LFIKzkxmMrJEN2Bw8k7.lnk") returned -1
	[0132.406] lstrcmpiA (lpString1="", lpString2="LFIKzkxmMrJEN2Bw8k7.lnk") returned -1
	[0132.406] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KwaAVgn.lnk") returned="KwaAVgn.lnk"
	[0132.406] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.406] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.406] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.406] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.406] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="LFIKzkxmMrJEN2Bw8k7.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk"
	[0132.406] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk", pszSpec="*.zip") returned 0
	[0132.407] lstrlenA (lpString="*.zip") returned 5
	[0132.407] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk", pszSpec="*.rar") returned 0
	[0132.407] lstrlenA (lpString="*.rar") returned 5
	[0132.407] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk", pszSpec="*.7z") returned 0
	[0132.407] lstrlenA (lpString="*.7z") returned 4
	[0132.407] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk", pszSpec="*.tar") returned 0
	[0132.407] lstrlenA (lpString="*.tar") returned 5
	[0132.407] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk", pszSpec="*.gzip") returned 0
	[0132.407] lstrlenA (lpString="*.gzip") returned 6
	[0132.407] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk", pszSpec="*.jpg") returned 0
	[0132.407] lstrlenA (lpString="*.jpg") returned 5
	[0132.407] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk", pszSpec="*.jpeg") returned 0
	[0132.407] lstrlenA (lpString="*.jpeg") returned 6
	[0132.407] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk", pszSpec="*.bmp") returned 0
	[0132.407] lstrlenA (lpString="*.bmp") returned 5
	[0132.407] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk", pszSpec="*.gif") returned 0
	[0132.407] lstrlenA (lpString="*.gif") returned 5
	[0132.407] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk", pszSpec="*.png") returned 0
	[0132.407] lstrlenA (lpString="*.png") returned 5
	[0132.407] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk", pszSpec="*.doc") returned 0
	[0132.407] lstrlenA (lpString="*.doc") returned 5
	[0132.407] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk", pszSpec="*.docx") returned 0
	[0132.407] lstrlenA (lpString="*.docx") returned 6
	[0132.407] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk", pszSpec="*.xls") returned 0
	[0132.407] lstrlenA (lpString="*.xls") returned 5
	[0132.407] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk", pszSpec="*.xlsx") returned 0
	[0132.407] lstrlenA (lpString="*.xlsx") returned 6
	[0132.407] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk", pszSpec="*.ppt") returned 0
	[0132.407] lstrlenA (lpString="*.ppt") returned 5
	[0132.407] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk", pszSpec="*.pptx") returned 0
	[0132.407] lstrlenA (lpString="*.pptx") returned 6
	[0132.407] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk", pszSpec="*.txt") returned 0
	[0132.408] lstrlenA (lpString="*.txt") returned 5
	[0132.408] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk", pszSpec="*.pdf") returned 0
	[0132.408] lstrlenA (lpString="*.pdf") returned 5
	[0132.408] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk", pszSpec="*.htm") returned 0
	[0132.408] lstrlenA (lpString="*.htm") returned 5
	[0132.408] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk", pszSpec="*.html") returned 0
	[0132.408] lstrlenA (lpString="*.html") returned 6
	[0132.408] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk", pszSpec="*.mdb") returned 0
	[0132.408] lstrlenA (lpString="*.mdb") returned 5
	[0132.408] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk", pszSpec="*.pfx") returned 0
	[0132.408] lstrlenA (lpString="*.pfx") returned 5
	[0132.408] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk", pszSpec="*.md") returned 0
	[0132.408] lstrlenA (lpString="*.md") returned 4
	[0132.408] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk", pszSpec="*.lnk") returned 1
	[0132.408] lstrlenA (lpString="*.lnk") returned 5
	[0132.408] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk"
	[0132.408] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk"
	[0132.408] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk."
	[0132.408] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk.exe"
	[0132.408] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lfikzkxmmrjen2bw8k7.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.408] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4f4
	[0132.408] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x40b96bb1, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x40b96bb1, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x40b96bb1, dwHighDateTime=0x1d543d9)) returned 1
	[0132.409] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.409] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x4b2, lpOverlapped=0x0) returned 1
	[0132.409] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk") returned="LFIKzkxmMrJEN2Bw8k7.lnk"
	[0132.409] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.409] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x4b2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x4b2, lpOverlapped=0x0) returned 1
	[0132.410] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.410] CloseHandle (hObject=0x21c) returned 1
	[0132.410] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lfikzkxmmrjen2bw8k7.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lfikzkxmmrjen2bw8k7.lnk.exe")) returned 1
	[0132.410] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37f5dbf1, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x37f5dbf1, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x37f5dbf1, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x38d, dwReserved0=0x0, dwReserved1=0x0, cFileName="LjBiz.lnk", cAlternateFileName="")) returned 1
	[0132.410] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.410] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="LjBiz.lnk") returned -1
	[0132.411] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="LjBiz.lnk") returned -1
	[0132.411] lstrcmpiA (lpString1="", lpString2="LjBiz.lnk") returned -1
	[0132.411] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFIKzkxmMrJEN2Bw8k7.lnk") returned="LFIKzkxmMrJEN2Bw8k7.lnk"
	[0132.411] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.411] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.411] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.411] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.411] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="LjBiz.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk"
	[0132.411] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk", pszSpec="*.zip") returned 0
	[0132.411] lstrlenA (lpString="*.zip") returned 5
	[0132.411] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk", pszSpec="*.rar") returned 0
	[0132.411] lstrlenA (lpString="*.rar") returned 5
	[0132.411] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk", pszSpec="*.7z") returned 0
	[0132.411] lstrlenA (lpString="*.7z") returned 4
	[0132.411] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk", pszSpec="*.tar") returned 0
	[0132.411] lstrlenA (lpString="*.tar") returned 5
	[0132.411] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk", pszSpec="*.gzip") returned 0
	[0132.411] lstrlenA (lpString="*.gzip") returned 6
	[0132.411] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk", pszSpec="*.jpg") returned 0
	[0132.411] lstrlenA (lpString="*.jpg") returned 5
	[0132.411] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk", pszSpec="*.jpeg") returned 0
	[0132.411] lstrlenA (lpString="*.jpeg") returned 6
	[0132.411] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk", pszSpec="*.bmp") returned 0
	[0132.411] lstrlenA (lpString="*.bmp") returned 5
	[0132.411] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk", pszSpec="*.gif") returned 0
	[0132.411] lstrlenA (lpString="*.gif") returned 5
	[0132.411] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk", pszSpec="*.png") returned 0
	[0132.411] lstrlenA (lpString="*.png") returned 5
	[0132.411] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk", pszSpec="*.doc") returned 0
	[0132.411] lstrlenA (lpString="*.doc") returned 5
	[0132.411] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk", pszSpec="*.docx") returned 0
	[0132.411] lstrlenA (lpString="*.docx") returned 6
	[0132.412] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk", pszSpec="*.xls") returned 0
	[0132.412] lstrlenA (lpString="*.xls") returned 5
	[0132.412] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk", pszSpec="*.xlsx") returned 0
	[0132.412] lstrlenA (lpString="*.xlsx") returned 6
	[0132.412] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk", pszSpec="*.ppt") returned 0
	[0132.412] lstrlenA (lpString="*.ppt") returned 5
	[0132.412] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk", pszSpec="*.pptx") returned 0
	[0132.412] lstrlenA (lpString="*.pptx") returned 6
	[0132.412] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk", pszSpec="*.txt") returned 0
	[0132.412] lstrlenA (lpString="*.txt") returned 5
	[0132.412] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk", pszSpec="*.pdf") returned 0
	[0132.412] lstrlenA (lpString="*.pdf") returned 5
	[0132.412] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk", pszSpec="*.htm") returned 0
	[0132.412] lstrlenA (lpString="*.htm") returned 5
	[0132.412] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk", pszSpec="*.html") returned 0
	[0132.412] lstrlenA (lpString="*.html") returned 6
	[0132.412] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk", pszSpec="*.mdb") returned 0
	[0132.412] lstrlenA (lpString="*.mdb") returned 5
	[0132.412] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk", pszSpec="*.pfx") returned 0
	[0132.412] lstrlenA (lpString="*.pfx") returned 5
	[0132.412] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk", pszSpec="*.md") returned 0
	[0132.412] lstrlenA (lpString="*.md") returned 4
	[0132.418] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk", pszSpec="*.lnk") returned 1
	[0132.418] lstrlenA (lpString="*.lnk") returned 5
	[0132.418] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk"
	[0132.418] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk"
	[0132.418] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk."
	[0132.418] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk.exe"
	[0132.418] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ljbiz.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.418] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x38d
	[0132.418] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x37f5dbf1, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x37f5dbf1, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x37f5dbf1, dwHighDateTime=0x1d543d9)) returned 1
	[0132.418] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.418] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x34b, lpOverlapped=0x0) returned 1
	[0132.419] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk") returned="LjBiz.lnk"
	[0132.419] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.419] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x34b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x34b, lpOverlapped=0x0) returned 1
	[0132.419] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.419] CloseHandle (hObject=0x21c) returned 1
	[0132.419] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ljbiz.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ljbiz.lnk.exe")) returned 1
	[0132.420] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31a38be0, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x31a38be0, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x31a38be0, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x0, dwReserved1=0x0, cFileName="LUcHz7.flv.lnk", cAlternateFileName="LUCHZ7~1.LNK")) returned 1
	[0132.420] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.420] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="LUcHz7.flv.lnk") returned -1
	[0132.420] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="LUcHz7.flv.lnk") returned -1
	[0132.420] lstrcmpiA (lpString1="", lpString2="LUcHz7.flv.lnk") returned -1
	[0132.420] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LjBiz.lnk") returned="LjBiz.lnk"
	[0132.420] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.420] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.420] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.420] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.420] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="LUcHz7.flv.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk"
	[0132.420] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk", pszSpec="*.zip") returned 0
	[0132.421] lstrlenA (lpString="*.zip") returned 5
	[0132.421] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk", pszSpec="*.rar") returned 0
	[0132.421] lstrlenA (lpString="*.rar") returned 5
	[0132.421] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk", pszSpec="*.7z") returned 0
	[0132.421] lstrlenA (lpString="*.7z") returned 4
	[0132.421] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk", pszSpec="*.tar") returned 0
	[0132.421] lstrlenA (lpString="*.tar") returned 5
	[0132.421] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk", pszSpec="*.gzip") returned 0
	[0132.421] lstrlenA (lpString="*.gzip") returned 6
	[0132.421] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk", pszSpec="*.jpg") returned 0
	[0132.421] lstrlenA (lpString="*.jpg") returned 5
	[0132.421] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk", pszSpec="*.jpeg") returned 0
	[0132.421] lstrlenA (lpString="*.jpeg") returned 6
	[0132.421] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk", pszSpec="*.bmp") returned 0
	[0132.421] lstrlenA (lpString="*.bmp") returned 5
	[0132.421] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk", pszSpec="*.gif") returned 0
	[0132.421] lstrlenA (lpString="*.gif") returned 5
	[0132.421] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk", pszSpec="*.png") returned 0
	[0132.421] lstrlenA (lpString="*.png") returned 5
	[0132.421] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk", pszSpec="*.doc") returned 0
	[0132.421] lstrlenA (lpString="*.doc") returned 5
	[0132.421] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk", pszSpec="*.docx") returned 0
	[0132.421] lstrlenA (lpString="*.docx") returned 6
	[0132.421] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk", pszSpec="*.xls") returned 0
	[0132.421] lstrlenA (lpString="*.xls") returned 5
	[0132.421] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk", pszSpec="*.xlsx") returned 0
	[0132.421] lstrlenA (lpString="*.xlsx") returned 6
	[0132.421] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk", pszSpec="*.ppt") returned 0
	[0132.421] lstrlenA (lpString="*.ppt") returned 5
	[0132.421] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk", pszSpec="*.pptx") returned 0
	[0132.421] lstrlenA (lpString="*.pptx") returned 6
	[0132.421] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk", pszSpec="*.txt") returned 0
	[0132.421] lstrlenA (lpString="*.txt") returned 5
	[0132.421] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk", pszSpec="*.pdf") returned 0
	[0132.421] lstrlenA (lpString="*.pdf") returned 5
	[0132.421] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk", pszSpec="*.htm") returned 0
	[0132.422] lstrlenA (lpString="*.htm") returned 5
	[0132.422] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk", pszSpec="*.html") returned 0
	[0132.422] lstrlenA (lpString="*.html") returned 6
	[0132.422] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk", pszSpec="*.mdb") returned 0
	[0132.422] lstrlenA (lpString="*.mdb") returned 5
	[0132.422] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk", pszSpec="*.pfx") returned 0
	[0132.422] lstrlenA (lpString="*.pfx") returned 5
	[0132.422] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk", pszSpec="*.md") returned 0
	[0132.422] lstrlenA (lpString="*.md") returned 4
	[0132.422] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk", pszSpec="*.lnk") returned 1
	[0132.422] lstrlenA (lpString="*.lnk") returned 5
	[0132.422] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk"
	[0132.422] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk"
	[0132.422] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk."
	[0132.422] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk.exe"
	[0132.422] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\luchz7.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.422] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x272
	[0132.422] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x31a38be0, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x31a38be0, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x31a38be0, dwHighDateTime=0x1d543d9)) returned 1
	[0132.422] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.422] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x230, lpOverlapped=0x0) returned 1
	[0132.423] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk") returned="LUcHz7.flv.lnk"
	[0132.423] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.423] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x230, lpOverlapped=0x0) returned 1
	[0132.423] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.423] CloseHandle (hObject=0x21c) returned 1
	[0132.424] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\luchz7.flv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\luchz7.flv.lnk.exe")) returned 1
	[0132.424] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52566ad3, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x52566ad3, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x52566ad3, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lVIopc6TrRy.lnk", cAlternateFileName="LVIOPC~1.LNK")) returned 1
	[0132.424] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.424] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="lVIopc6TrRy.lnk") returned -1
	[0132.424] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="lVIopc6TrRy.lnk") returned -1
	[0132.424] lstrcmpiA (lpString1="", lpString2="lVIopc6TrRy.lnk") returned -1
	[0132.424] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LUcHz7.flv.lnk") returned="LUcHz7.flv.lnk"
	[0132.424] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.424] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.424] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.424] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.424] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="lVIopc6TrRy.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk"
	[0132.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk", pszSpec="*.zip") returned 0
	[0132.425] lstrlenA (lpString="*.zip") returned 5
	[0132.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk", pszSpec="*.rar") returned 0
	[0132.425] lstrlenA (lpString="*.rar") returned 5
	[0132.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk", pszSpec="*.7z") returned 0
	[0132.425] lstrlenA (lpString="*.7z") returned 4
	[0132.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk", pszSpec="*.tar") returned 0
	[0132.425] lstrlenA (lpString="*.tar") returned 5
	[0132.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk", pszSpec="*.gzip") returned 0
	[0132.425] lstrlenA (lpString="*.gzip") returned 6
	[0132.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk", pszSpec="*.jpg") returned 0
	[0132.425] lstrlenA (lpString="*.jpg") returned 5
	[0132.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk", pszSpec="*.jpeg") returned 0
	[0132.425] lstrlenA (lpString="*.jpeg") returned 6
	[0132.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk", pszSpec="*.bmp") returned 0
	[0132.425] lstrlenA (lpString="*.bmp") returned 5
	[0132.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk", pszSpec="*.gif") returned 0
	[0132.425] lstrlenA (lpString="*.gif") returned 5
	[0132.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk", pszSpec="*.png") returned 0
	[0132.425] lstrlenA (lpString="*.png") returned 5
	[0132.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk", pszSpec="*.doc") returned 0
	[0132.425] lstrlenA (lpString="*.doc") returned 5
	[0132.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk", pszSpec="*.docx") returned 0
	[0132.425] lstrlenA (lpString="*.docx") returned 6
	[0132.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk", pszSpec="*.xls") returned 0
	[0132.425] lstrlenA (lpString="*.xls") returned 5
	[0132.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk", pszSpec="*.xlsx") returned 0
	[0132.425] lstrlenA (lpString="*.xlsx") returned 6
	[0132.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk", pszSpec="*.ppt") returned 0
	[0132.425] lstrlenA (lpString="*.ppt") returned 5
	[0132.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk", pszSpec="*.pptx") returned 0
	[0132.425] lstrlenA (lpString="*.pptx") returned 6
	[0132.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk", pszSpec="*.txt") returned 0
	[0132.425] lstrlenA (lpString="*.txt") returned 5
	[0132.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk", pszSpec="*.pdf") returned 0
	[0132.425] lstrlenA (lpString="*.pdf") returned 5
	[0132.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk", pszSpec="*.htm") returned 0
	[0132.426] lstrlenA (lpString="*.htm") returned 5
	[0132.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk", pszSpec="*.html") returned 0
	[0132.426] lstrlenA (lpString="*.html") returned 6
	[0132.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk", pszSpec="*.mdb") returned 0
	[0132.426] lstrlenA (lpString="*.mdb") returned 5
	[0132.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk", pszSpec="*.pfx") returned 0
	[0132.426] lstrlenA (lpString="*.pfx") returned 5
	[0132.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk", pszSpec="*.md") returned 0
	[0132.426] lstrlenA (lpString="*.md") returned 4
	[0132.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk", pszSpec="*.lnk") returned 1
	[0132.426] lstrlenA (lpString="*.lnk") returned 5
	[0132.426] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk"
	[0132.426] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk"
	[0132.426] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk."
	[0132.426] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk.exe"
	[0132.426] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lviopc6trry.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.426] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e0
	[0132.426] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x52566ad3, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x52566ad3, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x52566ad3, dwHighDateTime=0x1d543d9)) returned 1
	[0132.426] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.426] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x39e, lpOverlapped=0x0) returned 1
	[0132.427] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk") returned="lVIopc6TrRy.lnk"
	[0132.427] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.427] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0132.427] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.427] CloseHandle (hObject=0x21c) returned 1
	[0132.427] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lviopc6trry.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lviopc6trry.lnk.exe")) returned 1
	[0132.428] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20b441e8, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x48fb6d63, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x48fb6d63, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0x0, dwReserved1=0x0, cFileName="l_y2Qnb bnu.lnk", cAlternateFileName="L_Y2QN~1.LNK")) returned 1
	[0132.428] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.428] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="l_y2Qnb bnu.lnk") returned -1
	[0132.428] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="l_y2Qnb bnu.lnk") returned -1
	[0132.428] lstrcmpiA (lpString1="", lpString2="l_y2Qnb bnu.lnk") returned -1
	[0132.428] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lVIopc6TrRy.lnk") returned="lVIopc6TrRy.lnk"
	[0132.429] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.429] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.429] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.429] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.429] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="l_y2Qnb bnu.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk"
	[0132.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk", pszSpec="*.zip") returned 0
	[0132.429] lstrlenA (lpString="*.zip") returned 5
	[0132.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk", pszSpec="*.rar") returned 0
	[0132.429] lstrlenA (lpString="*.rar") returned 5
	[0132.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk", pszSpec="*.7z") returned 0
	[0132.429] lstrlenA (lpString="*.7z") returned 4
	[0132.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk", pszSpec="*.tar") returned 0
	[0132.429] lstrlenA (lpString="*.tar") returned 5
	[0132.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk", pszSpec="*.gzip") returned 0
	[0132.429] lstrlenA (lpString="*.gzip") returned 6
	[0132.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk", pszSpec="*.jpg") returned 0
	[0132.429] lstrlenA (lpString="*.jpg") returned 5
	[0132.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk", pszSpec="*.jpeg") returned 0
	[0132.429] lstrlenA (lpString="*.jpeg") returned 6
	[0132.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk", pszSpec="*.bmp") returned 0
	[0132.429] lstrlenA (lpString="*.bmp") returned 5
	[0132.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk", pszSpec="*.gif") returned 0
	[0132.429] lstrlenA (lpString="*.gif") returned 5
	[0132.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk", pszSpec="*.png") returned 0
	[0132.429] lstrlenA (lpString="*.png") returned 5
	[0132.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk", pszSpec="*.doc") returned 0
	[0132.429] lstrlenA (lpString="*.doc") returned 5
	[0132.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk", pszSpec="*.docx") returned 0
	[0132.429] lstrlenA (lpString="*.docx") returned 6
	[0132.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk", pszSpec="*.xls") returned 0
	[0132.429] lstrlenA (lpString="*.xls") returned 5
	[0132.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk", pszSpec="*.xlsx") returned 0
	[0132.429] lstrlenA (lpString="*.xlsx") returned 6
	[0132.430] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk", pszSpec="*.ppt") returned 0
	[0132.430] lstrlenA (lpString="*.ppt") returned 5
	[0132.430] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk", pszSpec="*.pptx") returned 0
	[0132.430] lstrlenA (lpString="*.pptx") returned 6
	[0132.430] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk", pszSpec="*.txt") returned 0
	[0132.430] lstrlenA (lpString="*.txt") returned 5
	[0132.430] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk", pszSpec="*.pdf") returned 0
	[0132.430] lstrlenA (lpString="*.pdf") returned 5
	[0132.430] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk", pszSpec="*.htm") returned 0
	[0132.430] lstrlenA (lpString="*.htm") returned 5
	[0132.430] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk", pszSpec="*.html") returned 0
	[0132.430] lstrlenA (lpString="*.html") returned 6
	[0132.430] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk", pszSpec="*.mdb") returned 0
	[0132.430] lstrlenA (lpString="*.mdb") returned 5
	[0132.430] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk", pszSpec="*.pfx") returned 0
	[0132.430] lstrlenA (lpString="*.pfx") returned 5
	[0132.430] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk", pszSpec="*.md") returned 0
	[0132.430] lstrlenA (lpString="*.md") returned 4
	[0132.430] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk", pszSpec="*.lnk") returned 1
	[0132.430] lstrlenA (lpString="*.lnk") returned 5
	[0132.430] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk"
	[0132.430] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk"
	[0132.430] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk."
	[0132.430] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk.exe"
	[0132.430] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\l_y2qnb bnu.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.430] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x45c
	[0132.431] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x20b441e8, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x48fb6d63, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x48fb6d63, dwHighDateTime=0x1d543d9)) returned 1
	[0132.431] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.431] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x41a, lpOverlapped=0x0) returned 1
	[0132.431] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk") returned="l_y2Qnb bnu.lnk"
	[0132.431] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.431] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x41a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x41a, lpOverlapped=0x0) returned 1
	[0132.432] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.432] CloseHandle (hObject=0x21c) returned 1
	[0132.432] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\l_y2qnb bnu.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\l_y2qnb bnu.lnk.exe")) returned 1
	[0132.432] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x523e93bd, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x523e93bd, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x523e93bd, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="M-_3LzfTzbFFZ_yM.lnk", cAlternateFileName="M-_3LZ~1.LNK")) returned 1
	[0132.432] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.432] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="M-_3LzfTzbFFZ_yM.lnk") returned -1
	[0132.432] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="M-_3LzfTzbFFZ_yM.lnk") returned -1
	[0132.432] lstrcmpiA (lpString1="", lpString2="M-_3LzfTzbFFZ_yM.lnk") returned -1
	[0132.432] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_y2Qnb bnu.lnk") returned="l_y2Qnb bnu.lnk"
	[0132.433] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.433] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.433] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.433] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.433] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="M-_3LzfTzbFFZ_yM.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk"
	[0132.433] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk", pszSpec="*.zip") returned 0
	[0132.433] lstrlenA (lpString="*.zip") returned 5
	[0132.433] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk", pszSpec="*.rar") returned 0
	[0132.433] lstrlenA (lpString="*.rar") returned 5
	[0132.433] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk", pszSpec="*.7z") returned 0
	[0132.433] lstrlenA (lpString="*.7z") returned 4
	[0132.433] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk", pszSpec="*.tar") returned 0
	[0132.433] lstrlenA (lpString="*.tar") returned 5
	[0132.433] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk", pszSpec="*.gzip") returned 0
	[0132.433] lstrlenA (lpString="*.gzip") returned 6
	[0132.433] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk", pszSpec="*.jpg") returned 0
	[0132.433] lstrlenA (lpString="*.jpg") returned 5
	[0132.433] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk", pszSpec="*.jpeg") returned 0
	[0132.433] lstrlenA (lpString="*.jpeg") returned 6
	[0132.433] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk", pszSpec="*.bmp") returned 0
	[0132.433] lstrlenA (lpString="*.bmp") returned 5
	[0132.433] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk", pszSpec="*.gif") returned 0
	[0132.433] lstrlenA (lpString="*.gif") returned 5
	[0132.433] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk", pszSpec="*.png") returned 0
	[0132.433] lstrlenA (lpString="*.png") returned 5
	[0132.433] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk", pszSpec="*.doc") returned 0
	[0132.433] lstrlenA (lpString="*.doc") returned 5
	[0132.433] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk", pszSpec="*.docx") returned 0
	[0132.433] lstrlenA (lpString="*.docx") returned 6
	[0132.433] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk", pszSpec="*.xls") returned 0
	[0132.433] lstrlenA (lpString="*.xls") returned 5
	[0132.433] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk", pszSpec="*.xlsx") returned 0
	[0132.433] lstrlenA (lpString="*.xlsx") returned 6
	[0132.433] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk", pszSpec="*.ppt") returned 0
	[0132.434] lstrlenA (lpString="*.ppt") returned 5
	[0132.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk", pszSpec="*.pptx") returned 0
	[0132.434] lstrlenA (lpString="*.pptx") returned 6
	[0132.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk", pszSpec="*.txt") returned 0
	[0132.434] lstrlenA (lpString="*.txt") returned 5
	[0132.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk", pszSpec="*.pdf") returned 0
	[0132.434] lstrlenA (lpString="*.pdf") returned 5
	[0132.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk", pszSpec="*.htm") returned 0
	[0132.434] lstrlenA (lpString="*.htm") returned 5
	[0132.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk", pszSpec="*.html") returned 0
	[0132.434] lstrlenA (lpString="*.html") returned 6
	[0132.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk", pszSpec="*.mdb") returned 0
	[0132.434] lstrlenA (lpString="*.mdb") returned 5
	[0132.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk", pszSpec="*.pfx") returned 0
	[0132.434] lstrlenA (lpString="*.pfx") returned 5
	[0132.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk", pszSpec="*.md") returned 0
	[0132.434] lstrlenA (lpString="*.md") returned 4
	[0132.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk", pszSpec="*.lnk") returned 1
	[0132.434] lstrlenA (lpString="*.lnk") returned 5
	[0132.434] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk"
	[0132.434] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk"
	[0132.434] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk."
	[0132.434] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk.exe"
	[0132.434] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\m-_3lzftzbffz_ym.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.434] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f9
	[0132.435] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x523e93bd, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x523e93bd, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x523e93bd, dwHighDateTime=0x1d543d9)) returned 1
	[0132.435] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.435] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x3b7, lpOverlapped=0x0) returned 1
	[0132.435] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk") returned="M-_3LzfTzbFFZ_yM.lnk"
	[0132.435] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.435] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x3b7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x3b7, lpOverlapped=0x0) returned 1
	[0132.436] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.436] CloseHandle (hObject=0x21c) returned 1
	[0132.436] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\m-_3lzftzbffz_ym.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\m-_3lzftzbffz_ym.lnk.exe")) returned 1
	[0132.436] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3574e450, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x3574e450, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x3574e450, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="M4jUJc NoID.lnk", cAlternateFileName="M4JUJC~1.LNK")) returned 1
	[0132.436] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.436] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="M4jUJc NoID.lnk") returned -1
	[0132.436] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="M4jUJc NoID.lnk") returned -1
	[0132.436] lstrcmpiA (lpString1="", lpString2="M4jUJc NoID.lnk") returned -1
	[0132.436] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M-_3LzfTzbFFZ_yM.lnk") returned="M-_3LzfTzbFFZ_yM.lnk"
	[0132.436] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.436] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.437] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.437] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.437] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="M4jUJc NoID.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk"
	[0132.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk", pszSpec="*.zip") returned 0
	[0132.437] lstrlenA (lpString="*.zip") returned 5
	[0132.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk", pszSpec="*.rar") returned 0
	[0132.437] lstrlenA (lpString="*.rar") returned 5
	[0132.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk", pszSpec="*.7z") returned 0
	[0132.437] lstrlenA (lpString="*.7z") returned 4
	[0132.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk", pszSpec="*.tar") returned 0
	[0132.437] lstrlenA (lpString="*.tar") returned 5
	[0132.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk", pszSpec="*.gzip") returned 0
	[0132.437] lstrlenA (lpString="*.gzip") returned 6
	[0132.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk", pszSpec="*.jpg") returned 0
	[0132.437] lstrlenA (lpString="*.jpg") returned 5
	[0132.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk", pszSpec="*.jpeg") returned 0
	[0132.437] lstrlenA (lpString="*.jpeg") returned 6
	[0132.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk", pszSpec="*.bmp") returned 0
	[0132.437] lstrlenA (lpString="*.bmp") returned 5
	[0132.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk", pszSpec="*.gif") returned 0
	[0132.437] lstrlenA (lpString="*.gif") returned 5
	[0132.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk", pszSpec="*.png") returned 0
	[0132.437] lstrlenA (lpString="*.png") returned 5
	[0132.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk", pszSpec="*.doc") returned 0
	[0132.437] lstrlenA (lpString="*.doc") returned 5
	[0132.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk", pszSpec="*.docx") returned 0
	[0132.437] lstrlenA (lpString="*.docx") returned 6
	[0132.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk", pszSpec="*.xls") returned 0
	[0132.437] lstrlenA (lpString="*.xls") returned 5
	[0132.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk", pszSpec="*.xlsx") returned 0
	[0132.437] lstrlenA (lpString="*.xlsx") returned 6
	[0132.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk", pszSpec="*.ppt") returned 0
	[0132.437] lstrlenA (lpString="*.ppt") returned 5
	[0132.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk", pszSpec="*.pptx") returned 0
	[0132.438] lstrlenA (lpString="*.pptx") returned 6
	[0132.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk", pszSpec="*.txt") returned 0
	[0132.438] lstrlenA (lpString="*.txt") returned 5
	[0132.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk", pszSpec="*.pdf") returned 0
	[0132.438] lstrlenA (lpString="*.pdf") returned 5
	[0132.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk", pszSpec="*.htm") returned 0
	[0132.438] lstrlenA (lpString="*.htm") returned 5
	[0132.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk", pszSpec="*.html") returned 0
	[0132.438] lstrlenA (lpString="*.html") returned 6
	[0132.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk", pszSpec="*.mdb") returned 0
	[0132.438] lstrlenA (lpString="*.mdb") returned 5
	[0132.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk", pszSpec="*.pfx") returned 0
	[0132.438] lstrlenA (lpString="*.pfx") returned 5
	[0132.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk", pszSpec="*.md") returned 0
	[0132.438] lstrlenA (lpString="*.md") returned 4
	[0132.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk", pszSpec="*.lnk") returned 1
	[0132.438] lstrlenA (lpString="*.lnk") returned 5
	[0132.438] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk"
	[0132.438] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk"
	[0132.438] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk."
	[0132.438] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk.exe"
	[0132.438] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\m4jujc noid.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.438] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3c6
	[0132.438] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3574e450, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x3574e450, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3574e450, dwHighDateTime=0x1d543d9)) returned 1
	[0132.438] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.439] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x384, lpOverlapped=0x0) returned 1
	[0132.439] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk") returned="M4jUJc NoID.lnk"
	[0132.439] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.439] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x384, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x384, lpOverlapped=0x0) returned 1
	[0132.439] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.440] CloseHandle (hObject=0x21c) returned 1
	[0132.440] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\m4jujc noid.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\m4jujc noid.lnk.exe")) returned 1
	[0132.440] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x436fafca, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x436fafca, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x436fafca, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x4f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="M9t7cimcHHASa1dI7GWr.lnk", cAlternateFileName="M9T7CI~1.LNK")) returned 1
	[0132.440] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.440] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="M9t7cimcHHASa1dI7GWr.lnk") returned -1
	[0132.440] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="M9t7cimcHHASa1dI7GWr.lnk") returned -1
	[0132.440] lstrcmpiA (lpString1="", lpString2="M9t7cimcHHASa1dI7GWr.lnk") returned -1
	[0132.441] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M4jUJc NoID.lnk") returned="M4jUJc NoID.lnk"
	[0132.441] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.441] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.441] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.441] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.441] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="M9t7cimcHHASa1dI7GWr.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk"
	[0132.441] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk", pszSpec="*.zip") returned 0
	[0132.441] lstrlenA (lpString="*.zip") returned 5
	[0132.441] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk", pszSpec="*.rar") returned 0
	[0132.441] lstrlenA (lpString="*.rar") returned 5
	[0132.441] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk", pszSpec="*.7z") returned 0
	[0132.441] lstrlenA (lpString="*.7z") returned 4
	[0132.441] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk", pszSpec="*.tar") returned 0
	[0132.441] lstrlenA (lpString="*.tar") returned 5
	[0132.441] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk", pszSpec="*.gzip") returned 0
	[0132.441] lstrlenA (lpString="*.gzip") returned 6
	[0132.441] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk", pszSpec="*.jpg") returned 0
	[0132.441] lstrlenA (lpString="*.jpg") returned 5
	[0132.441] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk", pszSpec="*.jpeg") returned 0
	[0132.441] lstrlenA (lpString="*.jpeg") returned 6
	[0132.441] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk", pszSpec="*.bmp") returned 0
	[0132.441] lstrlenA (lpString="*.bmp") returned 5
	[0132.441] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk", pszSpec="*.gif") returned 0
	[0132.441] lstrlenA (lpString="*.gif") returned 5
	[0132.441] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk", pszSpec="*.png") returned 0
	[0132.441] lstrlenA (lpString="*.png") returned 5
	[0132.441] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk", pszSpec="*.doc") returned 0
	[0132.441] lstrlenA (lpString="*.doc") returned 5
	[0132.441] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk", pszSpec="*.docx") returned 0
	[0132.441] lstrlenA (lpString="*.docx") returned 6
	[0132.441] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk", pszSpec="*.xls") returned 0
	[0132.441] lstrlenA (lpString="*.xls") returned 5
	[0132.441] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk", pszSpec="*.xlsx") returned 0
	[0132.441] lstrlenA (lpString="*.xlsx") returned 6
	[0132.442] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk", pszSpec="*.ppt") returned 0
	[0132.442] lstrlenA (lpString="*.ppt") returned 5
	[0132.442] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk", pszSpec="*.pptx") returned 0
	[0132.442] lstrlenA (lpString="*.pptx") returned 6
	[0132.442] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk", pszSpec="*.txt") returned 0
	[0132.442] lstrlenA (lpString="*.txt") returned 5
	[0132.442] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk", pszSpec="*.pdf") returned 0
	[0132.442] lstrlenA (lpString="*.pdf") returned 5
	[0132.442] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk", pszSpec="*.htm") returned 0
	[0132.442] lstrlenA (lpString="*.htm") returned 5
	[0132.442] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk", pszSpec="*.html") returned 0
	[0132.442] lstrlenA (lpString="*.html") returned 6
	[0132.442] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk", pszSpec="*.mdb") returned 0
	[0132.442] lstrlenA (lpString="*.mdb") returned 5
	[0132.442] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk", pszSpec="*.pfx") returned 0
	[0132.442] lstrlenA (lpString="*.pfx") returned 5
	[0132.442] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk", pszSpec="*.md") returned 0
	[0132.442] lstrlenA (lpString="*.md") returned 4
	[0132.442] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk", pszSpec="*.lnk") returned 1
	[0132.442] lstrlenA (lpString="*.lnk") returned 5
	[0132.442] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk"
	[0132.442] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk"
	[0132.442] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk."
	[0132.442] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk.exe"
	[0132.442] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\m9t7cimchhasa1di7gwr.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.443] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4f9
	[0132.443] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x436fafca, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x436fafca, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x436fafca, dwHighDateTime=0x1d543d9)) returned 1
	[0132.443] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.443] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x4b7, lpOverlapped=0x0) returned 1
	[0132.443] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk") returned="M9t7cimcHHASa1dI7GWr.lnk"
	[0132.443] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.444] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x4b7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x4b7, lpOverlapped=0x0) returned 1
	[0132.444] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.444] CloseHandle (hObject=0x21c) returned 1
	[0132.444] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\m9t7cimchhasa1di7gwr.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\m9t7cimchhasa1di7gwr.lnk.exe")) returned 1
	[0132.444] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51469e7f, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x51469e7f, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x51469e7f, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x53d, dwReserved0=0x0, dwReserved1=0x0, cFileName="mCVLcsCYyu5DoWanp.flv.lnk", cAlternateFileName="MCVLCS~1.LNK")) returned 1
	[0132.444] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.444] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="mCVLcsCYyu5DoWanp.flv.lnk") returned -1
	[0132.444] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="mCVLcsCYyu5DoWanp.flv.lnk") returned -1
	[0132.444] lstrcmpiA (lpString1="", lpString2="mCVLcsCYyu5DoWanp.flv.lnk") returned -1
	[0132.444] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M9t7cimcHHASa1dI7GWr.lnk") returned="M9t7cimcHHASa1dI7GWr.lnk"
	[0132.445] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.445] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.445] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.445] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.445] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="mCVLcsCYyu5DoWanp.flv.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk"
	[0132.445] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk", pszSpec="*.zip") returned 0
	[0132.445] lstrlenA (lpString="*.zip") returned 5
	[0132.445] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk", pszSpec="*.rar") returned 0
	[0132.445] lstrlenA (lpString="*.rar") returned 5
	[0132.445] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk", pszSpec="*.7z") returned 0
	[0132.445] lstrlenA (lpString="*.7z") returned 4
	[0132.445] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk", pszSpec="*.tar") returned 0
	[0132.445] lstrlenA (lpString="*.tar") returned 5
	[0132.445] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk", pszSpec="*.gzip") returned 0
	[0132.445] lstrlenA (lpString="*.gzip") returned 6
	[0132.445] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk", pszSpec="*.jpg") returned 0
	[0132.445] lstrlenA (lpString="*.jpg") returned 5
	[0132.445] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk", pszSpec="*.jpeg") returned 0
	[0132.445] lstrlenA (lpString="*.jpeg") returned 6
	[0132.445] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk", pszSpec="*.bmp") returned 0
	[0132.445] lstrlenA (lpString="*.bmp") returned 5
	[0132.445] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk", pszSpec="*.gif") returned 0
	[0132.445] lstrlenA (lpString="*.gif") returned 5
	[0132.445] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk", pszSpec="*.png") returned 0
	[0132.445] lstrlenA (lpString="*.png") returned 5
	[0132.445] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk", pszSpec="*.doc") returned 0
	[0132.445] lstrlenA (lpString="*.doc") returned 5
	[0132.445] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk", pszSpec="*.docx") returned 0
	[0132.445] lstrlenA (lpString="*.docx") returned 6
	[0132.445] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk", pszSpec="*.xls") returned 0
	[0132.445] lstrlenA (lpString="*.xls") returned 5
	[0132.445] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk", pszSpec="*.xlsx") returned 0
	[0132.445] lstrlenA (lpString="*.xlsx") returned 6
	[0132.445] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk", pszSpec="*.ppt") returned 0
	[0132.446] lstrlenA (lpString="*.ppt") returned 5
	[0132.446] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk", pszSpec="*.pptx") returned 0
	[0132.446] lstrlenA (lpString="*.pptx") returned 6
	[0132.446] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk", pszSpec="*.txt") returned 0
	[0132.446] lstrlenA (lpString="*.txt") returned 5
	[0132.446] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk", pszSpec="*.pdf") returned 0
	[0132.446] lstrlenA (lpString="*.pdf") returned 5
	[0132.446] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk", pszSpec="*.htm") returned 0
	[0132.446] lstrlenA (lpString="*.htm") returned 5
	[0132.446] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk", pszSpec="*.html") returned 0
	[0132.446] lstrlenA (lpString="*.html") returned 6
	[0132.446] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk", pszSpec="*.mdb") returned 0
	[0132.446] lstrlenA (lpString="*.mdb") returned 5
	[0132.446] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk", pszSpec="*.pfx") returned 0
	[0132.446] lstrlenA (lpString="*.pfx") returned 5
	[0132.446] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk", pszSpec="*.md") returned 0
	[0132.446] lstrlenA (lpString="*.md") returned 4
	[0132.446] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk", pszSpec="*.lnk") returned 1
	[0132.446] lstrlenA (lpString="*.lnk") returned 5
	[0132.446] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk"
	[0132.446] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk"
	[0132.446] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk."
	[0132.446] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk.exe"
	[0132.446] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mcvlcscyyu5dowanp.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.446] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x53d
	[0132.447] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x51469e7f, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x51469e7f, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x51469e7f, dwHighDateTime=0x1d543d9)) returned 1
	[0132.447] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.447] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x4fb, lpOverlapped=0x0) returned 1
	[0132.447] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk") returned="mCVLcsCYyu5DoWanp.flv.lnk"
	[0132.447] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.447] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x4fb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x4fb, lpOverlapped=0x0) returned 1
	[0132.448] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.448] CloseHandle (hObject=0x21c) returned 1
	[0132.448] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mcvlcscyyu5dowanp.flv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mcvlcscyyu5dowanp.flv.lnk.exe")) returned 1
	[0132.448] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43498ab7, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x43498ab7, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x43498ab7, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x64f, dwReserved0=0x0, dwReserved1=0x0, cFileName="mdyXjTm2WryfCsZWNR2a.lnk", cAlternateFileName="MDYXJT~1.LNK")) returned 1
	[0132.448] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.448] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="mdyXjTm2WryfCsZWNR2a.lnk") returned -1
	[0132.448] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="mdyXjTm2WryfCsZWNR2a.lnk") returned -1
	[0132.448] lstrcmpiA (lpString1="", lpString2="mdyXjTm2WryfCsZWNR2a.lnk") returned -1
	[0132.448] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mCVLcsCYyu5DoWanp.flv.lnk") returned="mCVLcsCYyu5DoWanp.flv.lnk"
	[0132.448] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.448] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.449] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.449] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.449] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="mdyXjTm2WryfCsZWNR2a.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk"
	[0132.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk", pszSpec="*.zip") returned 0
	[0132.449] lstrlenA (lpString="*.zip") returned 5
	[0132.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk", pszSpec="*.rar") returned 0
	[0132.449] lstrlenA (lpString="*.rar") returned 5
	[0132.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk", pszSpec="*.7z") returned 0
	[0132.449] lstrlenA (lpString="*.7z") returned 4
	[0132.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk", pszSpec="*.tar") returned 0
	[0132.449] lstrlenA (lpString="*.tar") returned 5
	[0132.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk", pszSpec="*.gzip") returned 0
	[0132.449] lstrlenA (lpString="*.gzip") returned 6
	[0132.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk", pszSpec="*.jpg") returned 0
	[0132.449] lstrlenA (lpString="*.jpg") returned 5
	[0132.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk", pszSpec="*.jpeg") returned 0
	[0132.449] lstrlenA (lpString="*.jpeg") returned 6
	[0132.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk", pszSpec="*.bmp") returned 0
	[0132.449] lstrlenA (lpString="*.bmp") returned 5
	[0132.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk", pszSpec="*.gif") returned 0
	[0132.449] lstrlenA (lpString="*.gif") returned 5
	[0132.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk", pszSpec="*.png") returned 0
	[0132.449] lstrlenA (lpString="*.png") returned 5
	[0132.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk", pszSpec="*.doc") returned 0
	[0132.449] lstrlenA (lpString="*.doc") returned 5
	[0132.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk", pszSpec="*.docx") returned 0
	[0132.449] lstrlenA (lpString="*.docx") returned 6
	[0132.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk", pszSpec="*.xls") returned 0
	[0132.449] lstrlenA (lpString="*.xls") returned 5
	[0132.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk", pszSpec="*.xlsx") returned 0
	[0132.449] lstrlenA (lpString="*.xlsx") returned 6
	[0132.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk", pszSpec="*.ppt") returned 0
	[0132.449] lstrlenA (lpString="*.ppt") returned 5
	[0132.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk", pszSpec="*.pptx") returned 0
	[0132.449] lstrlenA (lpString="*.pptx") returned 6
	[0132.450] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk", pszSpec="*.txt") returned 0
	[0132.450] lstrlenA (lpString="*.txt") returned 5
	[0132.450] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk", pszSpec="*.pdf") returned 0
	[0132.450] lstrlenA (lpString="*.pdf") returned 5
	[0132.450] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk", pszSpec="*.htm") returned 0
	[0132.450] lstrlenA (lpString="*.htm") returned 5
	[0132.450] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk", pszSpec="*.html") returned 0
	[0132.450] lstrlenA (lpString="*.html") returned 6
	[0132.450] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk", pszSpec="*.mdb") returned 0
	[0132.450] lstrlenA (lpString="*.mdb") returned 5
	[0132.450] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk", pszSpec="*.pfx") returned 0
	[0132.450] lstrlenA (lpString="*.pfx") returned 5
	[0132.450] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk", pszSpec="*.md") returned 0
	[0132.450] lstrlenA (lpString="*.md") returned 4
	[0132.450] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk", pszSpec="*.lnk") returned 1
	[0132.450] lstrlenA (lpString="*.lnk") returned 5
	[0132.450] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk"
	[0132.450] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk"
	[0132.450] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk."
	[0132.450] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk.exe"
	[0132.450] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mdyxjtm2wryfcszwnr2a.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.450] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x64f
	[0132.450] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x43498ab7, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x43498ab7, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x43498ab7, dwHighDateTime=0x1d543d9)) returned 1
	[0132.450] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.451] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x60d, lpOverlapped=0x0) returned 1
	[0132.451] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk") returned="mdyXjTm2WryfCsZWNR2a.lnk"
	[0132.451] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.451] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x60d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x60d, lpOverlapped=0x0) returned 1
	[0132.451] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.452] CloseHandle (hObject=0x21c) returned 1
	[0132.452] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mdyxjtm2wryfcszwnr2a.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mdyxjtm2wryfcszwnr2a.lnk.exe")) returned 1
	[0132.469] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x353484a6, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x517186f1, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x517186f1, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x2de, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music.lnk", cAlternateFileName="")) returned 1
	[0132.469] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.469] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Music.lnk") returned -1
	[0132.469] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Music.lnk") returned -1
	[0132.469] lstrcmpiA (lpString1="", lpString2="Music.lnk") returned -1
	[0132.469] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdyXjTm2WryfCsZWNR2a.lnk") returned="mdyXjTm2WryfCsZWNR2a.lnk"
	[0132.469] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.469] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.469] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.469] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.469] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="Music.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk"
	[0132.469] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk", pszSpec="*.zip") returned 0
	[0132.469] lstrlenA (lpString="*.zip") returned 5
	[0132.469] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk", pszSpec="*.rar") returned 0
	[0132.469] lstrlenA (lpString="*.rar") returned 5
	[0132.469] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk", pszSpec="*.7z") returned 0
	[0132.469] lstrlenA (lpString="*.7z") returned 4
	[0132.469] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk", pszSpec="*.tar") returned 0
	[0132.469] lstrlenA (lpString="*.tar") returned 5
	[0132.469] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk", pszSpec="*.gzip") returned 0
	[0132.469] lstrlenA (lpString="*.gzip") returned 6
	[0132.469] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk", pszSpec="*.jpg") returned 0
	[0132.469] lstrlenA (lpString="*.jpg") returned 5
	[0132.469] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk", pszSpec="*.jpeg") returned 0
	[0132.469] lstrlenA (lpString="*.jpeg") returned 6
	[0132.469] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk", pszSpec="*.bmp") returned 0
	[0132.470] lstrlenA (lpString="*.bmp") returned 5
	[0132.470] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk", pszSpec="*.gif") returned 0
	[0132.470] lstrlenA (lpString="*.gif") returned 5
	[0132.470] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk", pszSpec="*.png") returned 0
	[0132.470] lstrlenA (lpString="*.png") returned 5
	[0132.470] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk", pszSpec="*.doc") returned 0
	[0132.470] lstrlenA (lpString="*.doc") returned 5
	[0132.470] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk", pszSpec="*.docx") returned 0
	[0132.470] lstrlenA (lpString="*.docx") returned 6
	[0132.470] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk", pszSpec="*.xls") returned 0
	[0132.470] lstrlenA (lpString="*.xls") returned 5
	[0132.470] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk", pszSpec="*.xlsx") returned 0
	[0132.470] lstrlenA (lpString="*.xlsx") returned 6
	[0132.470] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk", pszSpec="*.ppt") returned 0
	[0132.470] lstrlenA (lpString="*.ppt") returned 5
	[0132.470] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk", pszSpec="*.pptx") returned 0
	[0132.470] lstrlenA (lpString="*.pptx") returned 6
	[0132.470] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk", pszSpec="*.txt") returned 0
	[0132.470] lstrlenA (lpString="*.txt") returned 5
	[0132.470] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk", pszSpec="*.pdf") returned 0
	[0132.470] lstrlenA (lpString="*.pdf") returned 5
	[0132.470] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk", pszSpec="*.htm") returned 0
	[0132.470] lstrlenA (lpString="*.htm") returned 5
	[0132.470] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk", pszSpec="*.html") returned 0
	[0132.470] lstrlenA (lpString="*.html") returned 6
	[0132.470] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk", pszSpec="*.mdb") returned 0
	[0132.470] lstrlenA (lpString="*.mdb") returned 5
	[0132.470] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk", pszSpec="*.pfx") returned 0
	[0132.470] lstrlenA (lpString="*.pfx") returned 5
	[0132.470] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk", pszSpec="*.md") returned 0
	[0132.470] lstrlenA (lpString="*.md") returned 4
	[0132.470] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk", pszSpec="*.lnk") returned 1
	[0132.470] lstrlenA (lpString="*.lnk") returned 5
	[0132.470] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk"
	[0132.470] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk"
	[0132.470] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk."
	[0132.470] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk.exe"
	[0132.471] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\music.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.471] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2de
	[0132.471] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x353484a6, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x517186f1, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x517186f1, dwHighDateTime=0x1d543d9)) returned 1
	[0132.471] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.471] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x29c, lpOverlapped=0x0) returned 1
	[0132.472] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk") returned="Music.lnk"
	[0132.472] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.472] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x29c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x29c, lpOverlapped=0x0) returned 1
	[0132.472] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.472] CloseHandle (hObject=0x21c) returned 1
	[0132.472] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\music.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\music.lnk.exe")) returned 1
	[0132.473] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51f71632, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x51f71632, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x51f71632, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="mUWQNXrPrLQPE6ziJ17.lnk", cAlternateFileName="MUWQNX~1.LNK")) returned 1
	[0132.473] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.473] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="mUWQNXrPrLQPE6ziJ17.lnk") returned -1
	[0132.473] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="mUWQNXrPrLQPE6ziJ17.lnk") returned -1
	[0132.473] lstrcmpiA (lpString1="", lpString2="mUWQNXrPrLQPE6ziJ17.lnk") returned -1
	[0132.473] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk") returned="Music.lnk"
	[0132.473] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.473] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.473] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.473] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.473] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="mUWQNXrPrLQPE6ziJ17.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk"
	[0132.473] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk", pszSpec="*.zip") returned 0
	[0132.473] lstrlenA (lpString="*.zip") returned 5
	[0132.473] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk", pszSpec="*.rar") returned 0
	[0132.473] lstrlenA (lpString="*.rar") returned 5
	[0132.473] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk", pszSpec="*.7z") returned 0
	[0132.473] lstrlenA (lpString="*.7z") returned 4
	[0132.473] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk", pszSpec="*.tar") returned 0
	[0132.473] lstrlenA (lpString="*.tar") returned 5
	[0132.473] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk", pszSpec="*.gzip") returned 0
	[0132.473] lstrlenA (lpString="*.gzip") returned 6
	[0132.473] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk", pszSpec="*.jpg") returned 0
	[0132.473] lstrlenA (lpString="*.jpg") returned 5
	[0132.473] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk", pszSpec="*.jpeg") returned 0
	[0132.473] lstrlenA (lpString="*.jpeg") returned 6
	[0132.473] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk", pszSpec="*.bmp") returned 0
	[0132.473] lstrlenA (lpString="*.bmp") returned 5
	[0132.473] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk", pszSpec="*.gif") returned 0
	[0132.473] lstrlenA (lpString="*.gif") returned 5
	[0132.474] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk", pszSpec="*.png") returned 0
	[0132.474] lstrlenA (lpString="*.png") returned 5
	[0132.474] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk", pszSpec="*.doc") returned 0
	[0132.474] lstrlenA (lpString="*.doc") returned 5
	[0132.474] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk", pszSpec="*.docx") returned 0
	[0132.474] lstrlenA (lpString="*.docx") returned 6
	[0132.474] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk", pszSpec="*.xls") returned 0
	[0132.474] lstrlenA (lpString="*.xls") returned 5
	[0132.474] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk", pszSpec="*.xlsx") returned 0
	[0132.474] lstrlenA (lpString="*.xlsx") returned 6
	[0132.474] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk", pszSpec="*.ppt") returned 0
	[0132.474] lstrlenA (lpString="*.ppt") returned 5
	[0132.474] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk", pszSpec="*.pptx") returned 0
	[0132.474] lstrlenA (lpString="*.pptx") returned 6
	[0132.474] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk", pszSpec="*.txt") returned 0
	[0132.474] lstrlenA (lpString="*.txt") returned 5
	[0132.474] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk", pszSpec="*.pdf") returned 0
	[0132.474] lstrlenA (lpString="*.pdf") returned 5
	[0132.474] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk", pszSpec="*.htm") returned 0
	[0132.474] lstrlenA (lpString="*.htm") returned 5
	[0132.474] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk", pszSpec="*.html") returned 0
	[0132.474] lstrlenA (lpString="*.html") returned 6
	[0132.474] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk", pszSpec="*.mdb") returned 0
	[0132.474] lstrlenA (lpString="*.mdb") returned 5
	[0132.474] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk", pszSpec="*.pfx") returned 0
	[0132.474] lstrlenA (lpString="*.pfx") returned 5
	[0132.474] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk", pszSpec="*.md") returned 0
	[0132.474] lstrlenA (lpString="*.md") returned 4
	[0132.474] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk", pszSpec="*.lnk") returned 1
	[0132.474] lstrlenA (lpString="*.lnk") returned 5
	[0132.474] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk"
	[0132.474] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk"
	[0132.474] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk."
	[0132.474] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk.exe"
	[0132.474] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\muwqnxrprlqpe6zij17.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.475] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b5
	[0132.475] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x51f71632, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x51f71632, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x51f71632, dwHighDateTime=0x1d543d9)) returned 1
	[0132.475] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.475] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x273, lpOverlapped=0x0) returned 1
	[0132.476] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk") returned="mUWQNXrPrLQPE6ziJ17.lnk"
	[0132.476] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.476] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x273, lpOverlapped=0x0) returned 1
	[0132.476] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.476] CloseHandle (hObject=0x21c) returned 1
	[0132.476] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\muwqnxrprlqpe6zij17.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\muwqnxrprlqpe6zij17.lnk.exe")) returned 1
	[0132.477] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b38f0ab, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x3b38f0ab, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x3b38f0ab, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x45f, dwReserved0=0x0, dwReserved1=0x0, cFileName="n6ckkX7d.lnk", cAlternateFileName="")) returned 1
	[0132.477] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.477] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="n6ckkX7d.lnk") returned -1
	[0132.477] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="n6ckkX7d.lnk") returned -1
	[0132.477] lstrcmpiA (lpString1="", lpString2="n6ckkX7d.lnk") returned -1
	[0132.477] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mUWQNXrPrLQPE6ziJ17.lnk") returned="mUWQNXrPrLQPE6ziJ17.lnk"
	[0132.477] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.477] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.477] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.477] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.477] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="n6ckkX7d.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk"
	[0132.477] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk", pszSpec="*.zip") returned 0
	[0132.477] lstrlenA (lpString="*.zip") returned 5
	[0132.477] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk", pszSpec="*.rar") returned 0
	[0132.477] lstrlenA (lpString="*.rar") returned 5
	[0132.477] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk", pszSpec="*.7z") returned 0
	[0132.477] lstrlenA (lpString="*.7z") returned 4
	[0132.477] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk", pszSpec="*.tar") returned 0
	[0132.477] lstrlenA (lpString="*.tar") returned 5
	[0132.477] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk", pszSpec="*.gzip") returned 0
	[0132.477] lstrlenA (lpString="*.gzip") returned 6
	[0132.477] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk", pszSpec="*.jpg") returned 0
	[0132.477] lstrlenA (lpString="*.jpg") returned 5
	[0132.477] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk", pszSpec="*.jpeg") returned 0
	[0132.477] lstrlenA (lpString="*.jpeg") returned 6
	[0132.477] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk", pszSpec="*.bmp") returned 0
	[0132.477] lstrlenA (lpString="*.bmp") returned 5
	[0132.478] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk", pszSpec="*.gif") returned 0
	[0132.478] lstrlenA (lpString="*.gif") returned 5
	[0132.478] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk", pszSpec="*.png") returned 0
	[0132.478] lstrlenA (lpString="*.png") returned 5
	[0132.478] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk", pszSpec="*.doc") returned 0
	[0132.478] lstrlenA (lpString="*.doc") returned 5
	[0132.478] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk", pszSpec="*.docx") returned 0
	[0132.478] lstrlenA (lpString="*.docx") returned 6
	[0132.478] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk", pszSpec="*.xls") returned 0
	[0132.478] lstrlenA (lpString="*.xls") returned 5
	[0132.478] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk", pszSpec="*.xlsx") returned 0
	[0132.478] lstrlenA (lpString="*.xlsx") returned 6
	[0132.478] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk", pszSpec="*.ppt") returned 0
	[0132.478] lstrlenA (lpString="*.ppt") returned 5
	[0132.478] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk", pszSpec="*.pptx") returned 0
	[0132.478] lstrlenA (lpString="*.pptx") returned 6
	[0132.478] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk", pszSpec="*.txt") returned 0
	[0132.478] lstrlenA (lpString="*.txt") returned 5
	[0132.478] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk", pszSpec="*.pdf") returned 0
	[0132.478] lstrlenA (lpString="*.pdf") returned 5
	[0132.478] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk", pszSpec="*.htm") returned 0
	[0132.478] lstrlenA (lpString="*.htm") returned 5
	[0132.478] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk", pszSpec="*.html") returned 0
	[0132.478] lstrlenA (lpString="*.html") returned 6
	[0132.478] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk", pszSpec="*.mdb") returned 0
	[0132.478] lstrlenA (lpString="*.mdb") returned 5
	[0132.478] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk", pszSpec="*.pfx") returned 0
	[0132.478] lstrlenA (lpString="*.pfx") returned 5
	[0132.478] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk", pszSpec="*.md") returned 0
	[0132.478] lstrlenA (lpString="*.md") returned 4
	[0132.478] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk", pszSpec="*.lnk") returned 1
	[0132.478] lstrlenA (lpString="*.lnk") returned 5
	[0132.478] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk"
	[0132.478] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk"
	[0132.478] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk."
	[0132.478] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk.exe"
	[0132.479] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\n6ckkx7d.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.479] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x45f
	[0132.479] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3b38f0ab, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x3b38f0ab, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3b38f0ab, dwHighDateTime=0x1d543d9)) returned 1
	[0132.479] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.479] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x41d, lpOverlapped=0x0) returned 1
	[0132.480] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk") returned="n6ckkX7d.lnk"
	[0132.480] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.480] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x41d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x41d, lpOverlapped=0x0) returned 1
	[0132.480] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.480] CloseHandle (hObject=0x21c) returned 1
	[0132.480] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\n6ckkx7d.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\n6ckkx7d.lnk.exe")) returned 1
	[0132.481] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c17ca65, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x2c17ca65, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x2c17ca65, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x4df, dwReserved0=0x0, dwReserved1=0x0, cFileName="n8qoRgZJ.lnk", cAlternateFileName="")) returned 1
	[0132.481] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.481] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="n8qoRgZJ.lnk") returned -1
	[0132.481] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="n8qoRgZJ.lnk") returned -1
	[0132.481] lstrcmpiA (lpString1="", lpString2="n8qoRgZJ.lnk") returned -1
	[0132.481] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n6ckkX7d.lnk") returned="n6ckkX7d.lnk"
	[0132.481] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.481] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.481] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.481] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.481] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="n8qoRgZJ.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk"
	[0132.481] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk", pszSpec="*.zip") returned 0
	[0132.481] lstrlenA (lpString="*.zip") returned 5
	[0132.481] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk", pszSpec="*.rar") returned 0
	[0132.481] lstrlenA (lpString="*.rar") returned 5
	[0132.481] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk", pszSpec="*.7z") returned 0
	[0132.481] lstrlenA (lpString="*.7z") returned 4
	[0132.481] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk", pszSpec="*.tar") returned 0
	[0132.481] lstrlenA (lpString="*.tar") returned 5
	[0132.481] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk", pszSpec="*.gzip") returned 0
	[0132.481] lstrlenA (lpString="*.gzip") returned 6
	[0132.481] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk", pszSpec="*.jpg") returned 0
	[0132.481] lstrlenA (lpString="*.jpg") returned 5
	[0132.481] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk", pszSpec="*.jpeg") returned 0
	[0132.481] lstrlenA (lpString="*.jpeg") returned 6
	[0132.481] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk", pszSpec="*.bmp") returned 0
	[0132.481] lstrlenA (lpString="*.bmp") returned 5
	[0132.481] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk", pszSpec="*.gif") returned 0
	[0132.481] lstrlenA (lpString="*.gif") returned 5
	[0132.482] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk", pszSpec="*.png") returned 0
	[0132.482] lstrlenA (lpString="*.png") returned 5
	[0132.482] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk", pszSpec="*.doc") returned 0
	[0132.482] lstrlenA (lpString="*.doc") returned 5
	[0132.482] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk", pszSpec="*.docx") returned 0
	[0132.482] lstrlenA (lpString="*.docx") returned 6
	[0132.482] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk", pszSpec="*.xls") returned 0
	[0132.482] lstrlenA (lpString="*.xls") returned 5
	[0132.482] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk", pszSpec="*.xlsx") returned 0
	[0132.482] lstrlenA (lpString="*.xlsx") returned 6
	[0132.482] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk", pszSpec="*.ppt") returned 0
	[0132.482] lstrlenA (lpString="*.ppt") returned 5
	[0132.482] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk", pszSpec="*.pptx") returned 0
	[0132.482] lstrlenA (lpString="*.pptx") returned 6
	[0132.482] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk", pszSpec="*.txt") returned 0
	[0132.482] lstrlenA (lpString="*.txt") returned 5
	[0132.482] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk", pszSpec="*.pdf") returned 0
	[0132.482] lstrlenA (lpString="*.pdf") returned 5
	[0132.482] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk", pszSpec="*.htm") returned 0
	[0132.482] lstrlenA (lpString="*.htm") returned 5
	[0132.482] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk", pszSpec="*.html") returned 0
	[0132.482] lstrlenA (lpString="*.html") returned 6
	[0132.482] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk", pszSpec="*.mdb") returned 0
	[0132.482] lstrlenA (lpString="*.mdb") returned 5
	[0132.482] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk", pszSpec="*.pfx") returned 0
	[0132.482] lstrlenA (lpString="*.pfx") returned 5
	[0132.482] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk", pszSpec="*.md") returned 0
	[0132.482] lstrlenA (lpString="*.md") returned 4
	[0132.482] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk", pszSpec="*.lnk") returned 1
	[0132.482] lstrlenA (lpString="*.lnk") returned 5
	[0132.482] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk"
	[0132.482] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk"
	[0132.482] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk."
	[0132.482] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk.exe"
	[0132.482] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\n8qorgzj.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.483] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4df
	[0132.483] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x2c17ca65, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x2c17ca65, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x2c17ca65, dwHighDateTime=0x1d543d9)) returned 1
	[0132.483] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.483] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x49d, lpOverlapped=0x0) returned 1
	[0132.484] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk") returned="n8qoRgZJ.lnk"
	[0132.484] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.484] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x49d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x49d, lpOverlapped=0x0) returned 1
	[0132.484] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.484] CloseHandle (hObject=0x21c) returned 1
	[0132.484] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\n8qorgzj.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\n8qorgzj.lnk.exe")) returned 1
	[0132.485] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51764bd5, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x51764bd5, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x51895d9b, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3da, dwReserved0=0x0, dwReserved1=0x0, cFileName="nJAwaxOmRmde_9.lnk", cAlternateFileName="NJAWAX~1.LNK")) returned 1
	[0132.485] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.485] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="nJAwaxOmRmde_9.lnk") returned -1
	[0132.485] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="nJAwaxOmRmde_9.lnk") returned -1
	[0132.485] lstrcmpiA (lpString1="", lpString2="nJAwaxOmRmde_9.lnk") returned -1
	[0132.485] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8qoRgZJ.lnk") returned="n8qoRgZJ.lnk"
	[0132.485] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.485] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.485] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.485] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.485] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="nJAwaxOmRmde_9.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk"
	[0132.485] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk", pszSpec="*.zip") returned 0
	[0132.485] lstrlenA (lpString="*.zip") returned 5
	[0132.485] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk", pszSpec="*.rar") returned 0
	[0132.485] lstrlenA (lpString="*.rar") returned 5
	[0132.485] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk", pszSpec="*.7z") returned 0
	[0132.485] lstrlenA (lpString="*.7z") returned 4
	[0132.485] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk", pszSpec="*.tar") returned 0
	[0132.485] lstrlenA (lpString="*.tar") returned 5
	[0132.485] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk", pszSpec="*.gzip") returned 0
	[0132.485] lstrlenA (lpString="*.gzip") returned 6
	[0132.485] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk", pszSpec="*.jpg") returned 0
	[0132.485] lstrlenA (lpString="*.jpg") returned 5
	[0132.485] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk", pszSpec="*.jpeg") returned 0
	[0132.485] lstrlenA (lpString="*.jpeg") returned 6
	[0132.485] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk", pszSpec="*.bmp") returned 0
	[0132.485] lstrlenA (lpString="*.bmp") returned 5
	[0132.486] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk", pszSpec="*.gif") returned 0
	[0132.486] lstrlenA (lpString="*.gif") returned 5
	[0132.486] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk", pszSpec="*.png") returned 0
	[0132.486] lstrlenA (lpString="*.png") returned 5
	[0132.486] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk", pszSpec="*.doc") returned 0
	[0132.486] lstrlenA (lpString="*.doc") returned 5
	[0132.486] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk", pszSpec="*.docx") returned 0
	[0132.486] lstrlenA (lpString="*.docx") returned 6
	[0132.486] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk", pszSpec="*.xls") returned 0
	[0132.486] lstrlenA (lpString="*.xls") returned 5
	[0132.486] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk", pszSpec="*.xlsx") returned 0
	[0132.486] lstrlenA (lpString="*.xlsx") returned 6
	[0132.486] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk", pszSpec="*.ppt") returned 0
	[0132.486] lstrlenA (lpString="*.ppt") returned 5
	[0132.486] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk", pszSpec="*.pptx") returned 0
	[0132.486] lstrlenA (lpString="*.pptx") returned 6
	[0132.486] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk", pszSpec="*.txt") returned 0
	[0132.486] lstrlenA (lpString="*.txt") returned 5
	[0132.486] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk", pszSpec="*.pdf") returned 0
	[0132.486] lstrlenA (lpString="*.pdf") returned 5
	[0132.486] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk", pszSpec="*.htm") returned 0
	[0132.486] lstrlenA (lpString="*.htm") returned 5
	[0132.486] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk", pszSpec="*.html") returned 0
	[0132.486] lstrlenA (lpString="*.html") returned 6
	[0132.486] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk", pszSpec="*.mdb") returned 0
	[0132.486] lstrlenA (lpString="*.mdb") returned 5
	[0132.486] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk", pszSpec="*.pfx") returned 0
	[0132.486] lstrlenA (lpString="*.pfx") returned 5
	[0132.486] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk", pszSpec="*.md") returned 0
	[0132.486] lstrlenA (lpString="*.md") returned 4
	[0132.486] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk", pszSpec="*.lnk") returned 1
	[0132.486] lstrlenA (lpString="*.lnk") returned 5
	[0132.486] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk"
	[0132.486] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk"
	[0132.486] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk."
	[0132.486] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk.exe"
	[0132.487] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\njawaxomrmde_9.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.487] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3da
	[0132.487] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x51764bd5, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x51764bd5, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x51895d9b, dwHighDateTime=0x1d543d9)) returned 1
	[0132.487] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.487] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x398, lpOverlapped=0x0) returned 1
	[0132.488] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk") returned="nJAwaxOmRmde_9.lnk"
	[0132.488] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.488] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x398, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x398, lpOverlapped=0x0) returned 1
	[0132.488] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.488] CloseHandle (hObject=0x21c) returned 1
	[0132.488] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\njawaxomrmde_9.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\njawaxomrmde_9.lnk.exe")) returned 1
	[0132.489] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e5c3322, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x3e5c3322, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x3e5c3322, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="NRn-GWg -L94.lnk", cAlternateFileName="NRN-GW~1.LNK")) returned 1
	[0132.489] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.489] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NRn-GWg -L94.lnk") returned -1
	[0132.489] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NRn-GWg -L94.lnk") returned -1
	[0132.489] lstrcmpiA (lpString1="", lpString2="NRn-GWg -L94.lnk") returned -1
	[0132.489] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJAwaxOmRmde_9.lnk") returned="nJAwaxOmRmde_9.lnk"
	[0132.489] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.489] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.489] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.489] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.489] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="NRn-GWg -L94.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk"
	[0132.489] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk", pszSpec="*.zip") returned 0
	[0132.489] lstrlenA (lpString="*.zip") returned 5
	[0132.489] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk", pszSpec="*.rar") returned 0
	[0132.489] lstrlenA (lpString="*.rar") returned 5
	[0132.489] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk", pszSpec="*.7z") returned 0
	[0132.489] lstrlenA (lpString="*.7z") returned 4
	[0132.489] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk", pszSpec="*.tar") returned 0
	[0132.489] lstrlenA (lpString="*.tar") returned 5
	[0132.489] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk", pszSpec="*.gzip") returned 0
	[0132.489] lstrlenA (lpString="*.gzip") returned 6
	[0132.489] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk", pszSpec="*.jpg") returned 0
	[0132.489] lstrlenA (lpString="*.jpg") returned 5
	[0132.489] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk", pszSpec="*.jpeg") returned 0
	[0132.489] lstrlenA (lpString="*.jpeg") returned 6
	[0132.489] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk", pszSpec="*.bmp") returned 0
	[0132.489] lstrlenA (lpString="*.bmp") returned 5
	[0132.489] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk", pszSpec="*.gif") returned 0
	[0132.489] lstrlenA (lpString="*.gif") returned 5
	[0132.489] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk", pszSpec="*.png") returned 0
	[0132.490] lstrlenA (lpString="*.png") returned 5
	[0132.490] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk", pszSpec="*.doc") returned 0
	[0132.490] lstrlenA (lpString="*.doc") returned 5
	[0132.490] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk", pszSpec="*.docx") returned 0
	[0132.490] lstrlenA (lpString="*.docx") returned 6
	[0132.490] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk", pszSpec="*.xls") returned 0
	[0132.490] lstrlenA (lpString="*.xls") returned 5
	[0132.490] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk", pszSpec="*.xlsx") returned 0
	[0132.490] lstrlenA (lpString="*.xlsx") returned 6
	[0132.490] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk", pszSpec="*.ppt") returned 0
	[0132.490] lstrlenA (lpString="*.ppt") returned 5
	[0132.490] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk", pszSpec="*.pptx") returned 0
	[0132.490] lstrlenA (lpString="*.pptx") returned 6
	[0132.490] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk", pszSpec="*.txt") returned 0
	[0132.490] lstrlenA (lpString="*.txt") returned 5
	[0132.490] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk", pszSpec="*.pdf") returned 0
	[0132.490] lstrlenA (lpString="*.pdf") returned 5
	[0132.490] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk", pszSpec="*.htm") returned 0
	[0132.490] lstrlenA (lpString="*.htm") returned 5
	[0132.490] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk", pszSpec="*.html") returned 0
	[0132.490] lstrlenA (lpString="*.html") returned 6
	[0132.490] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk", pszSpec="*.mdb") returned 0
	[0132.490] lstrlenA (lpString="*.mdb") returned 5
	[0132.490] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk", pszSpec="*.pfx") returned 0
	[0132.490] lstrlenA (lpString="*.pfx") returned 5
	[0132.490] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk", pszSpec="*.md") returned 0
	[0132.490] lstrlenA (lpString="*.md") returned 4
	[0132.490] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk", pszSpec="*.lnk") returned 1
	[0132.490] lstrlenA (lpString="*.lnk") returned 5
	[0132.491] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk"
	[0132.491] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk"
	[0132.491] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk."
	[0132.491] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk.exe"
	[0132.491] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\nrn-gwg -l94.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.491] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x524
	[0132.491] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3e5c3322, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x3e5c3322, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3e5c3322, dwHighDateTime=0x1d543d9)) returned 1
	[0132.491] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.491] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x4e2, lpOverlapped=0x0) returned 1
	[0132.492] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk") returned="NRn-GWg -L94.lnk"
	[0132.492] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.492] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x4e2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x4e2, lpOverlapped=0x0) returned 1
	[0132.492] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.492] CloseHandle (hObject=0x21c) returned 1
	[0132.492] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\nrn-gwg -l94.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\nrn-gwg -l94.lnk.exe")) returned 1
	[0132.493] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8ca273, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x527a2e4c, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x527a2e4c, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="o7e663sUPh6nPDOiLiB.lnk", cAlternateFileName="O7E663~1.LNK")) returned 1
	[0132.493] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.493] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="o7e663sUPh6nPDOiLiB.lnk") returned -1
	[0132.493] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="o7e663sUPh6nPDOiLiB.lnk") returned -1
	[0132.493] lstrcmpiA (lpString1="", lpString2="o7e663sUPh6nPDOiLiB.lnk") returned -1
	[0132.493] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NRn-GWg -L94.lnk") returned="NRn-GWg -L94.lnk"
	[0132.493] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.493] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.493] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.493] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.493] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="o7e663sUPh6nPDOiLiB.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk"
	[0132.493] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk", pszSpec="*.zip") returned 0
	[0132.493] lstrlenA (lpString="*.zip") returned 5
	[0132.493] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk", pszSpec="*.rar") returned 0
	[0132.493] lstrlenA (lpString="*.rar") returned 5
	[0132.493] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk", pszSpec="*.7z") returned 0
	[0132.493] lstrlenA (lpString="*.7z") returned 4
	[0132.493] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk", pszSpec="*.tar") returned 0
	[0132.493] lstrlenA (lpString="*.tar") returned 5
	[0132.493] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk", pszSpec="*.gzip") returned 0
	[0132.493] lstrlenA (lpString="*.gzip") returned 6
	[0132.493] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk", pszSpec="*.jpg") returned 0
	[0132.493] lstrlenA (lpString="*.jpg") returned 5
	[0132.493] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk", pszSpec="*.jpeg") returned 0
	[0132.493] lstrlenA (lpString="*.jpeg") returned 6
	[0132.493] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk", pszSpec="*.bmp") returned 0
	[0132.493] lstrlenA (lpString="*.bmp") returned 5
	[0132.494] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk", pszSpec="*.gif") returned 0
	[0132.494] lstrlenA (lpString="*.gif") returned 5
	[0132.494] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk", pszSpec="*.png") returned 0
	[0132.494] lstrlenA (lpString="*.png") returned 5
	[0132.494] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk", pszSpec="*.doc") returned 0
	[0132.494] lstrlenA (lpString="*.doc") returned 5
	[0132.494] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk", pszSpec="*.docx") returned 0
	[0132.494] lstrlenA (lpString="*.docx") returned 6
	[0132.494] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk", pszSpec="*.xls") returned 0
	[0132.494] lstrlenA (lpString="*.xls") returned 5
	[0132.494] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk", pszSpec="*.xlsx") returned 0
	[0132.494] lstrlenA (lpString="*.xlsx") returned 6
	[0132.494] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk", pszSpec="*.ppt") returned 0
	[0132.494] lstrlenA (lpString="*.ppt") returned 5
	[0132.494] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk", pszSpec="*.pptx") returned 0
	[0132.494] lstrlenA (lpString="*.pptx") returned 6
	[0132.494] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk", pszSpec="*.txt") returned 0
	[0132.494] lstrlenA (lpString="*.txt") returned 5
	[0132.494] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk", pszSpec="*.pdf") returned 0
	[0132.494] lstrlenA (lpString="*.pdf") returned 5
	[0132.494] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk", pszSpec="*.htm") returned 0
	[0132.494] lstrlenA (lpString="*.htm") returned 5
	[0132.494] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk", pszSpec="*.html") returned 0
	[0132.494] lstrlenA (lpString="*.html") returned 6
	[0132.494] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk", pszSpec="*.mdb") returned 0
	[0132.494] lstrlenA (lpString="*.mdb") returned 5
	[0132.494] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk", pszSpec="*.pfx") returned 0
	[0132.494] lstrlenA (lpString="*.pfx") returned 5
	[0132.494] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk", pszSpec="*.md") returned 0
	[0132.494] lstrlenA (lpString="*.md") returned 4
	[0132.494] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk", pszSpec="*.lnk") returned 1
	[0132.494] lstrlenA (lpString="*.lnk") returned 5
	[0132.494] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk"
	[0132.494] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk"
	[0132.494] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk."
	[0132.494] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk.exe"
	[0132.495] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\o7e663suph6npdoilib.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.495] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ec
	[0132.495] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1c8ca273, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x527a2e4c, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x527a2e4c, dwHighDateTime=0x1d543d9)) returned 1
	[0132.495] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.495] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x3aa, lpOverlapped=0x0) returned 1
	[0132.496] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk") returned="o7e663sUPh6nPDOiLiB.lnk"
	[0132.496] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.496] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x3aa, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x3aa, lpOverlapped=0x0) returned 1
	[0132.496] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.496] CloseHandle (hObject=0x21c) returned 1
	[0132.496] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\o7e663suph6npdoilib.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\o7e663suph6npdoilib.lnk.exe")) returned 1
	[0132.497] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505a7594, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x505a7594, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x505a7594, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="o9AIEJfO6WjHyD3.lnk", cAlternateFileName="O9AIEJ~1.LNK")) returned 1
	[0132.497] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.497] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="o9AIEJfO6WjHyD3.lnk") returned -1
	[0132.497] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="o9AIEJfO6WjHyD3.lnk") returned -1
	[0132.497] lstrcmpiA (lpString1="", lpString2="o9AIEJfO6WjHyD3.lnk") returned -1
	[0132.497] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o7e663sUPh6nPDOiLiB.lnk") returned="o7e663sUPh6nPDOiLiB.lnk"
	[0132.497] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.497] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.497] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.497] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.497] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="o9AIEJfO6WjHyD3.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk"
	[0132.497] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk", pszSpec="*.zip") returned 0
	[0132.497] lstrlenA (lpString="*.zip") returned 5
	[0132.497] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk", pszSpec="*.rar") returned 0
	[0132.497] lstrlenA (lpString="*.rar") returned 5
	[0132.497] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk", pszSpec="*.7z") returned 0
	[0132.497] lstrlenA (lpString="*.7z") returned 4
	[0132.497] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk", pszSpec="*.tar") returned 0
	[0132.497] lstrlenA (lpString="*.tar") returned 5
	[0132.497] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk", pszSpec="*.gzip") returned 0
	[0132.497] lstrlenA (lpString="*.gzip") returned 6
	[0132.497] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk", pszSpec="*.jpg") returned 0
	[0132.497] lstrlenA (lpString="*.jpg") returned 5
	[0132.497] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk", pszSpec="*.jpeg") returned 0
	[0132.497] lstrlenA (lpString="*.jpeg") returned 6
	[0132.497] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk", pszSpec="*.bmp") returned 0
	[0132.497] lstrlenA (lpString="*.bmp") returned 5
	[0132.497] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk", pszSpec="*.gif") returned 0
	[0132.497] lstrlenA (lpString="*.gif") returned 5
	[0132.497] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk", pszSpec="*.png") returned 0
	[0132.498] lstrlenA (lpString="*.png") returned 5
	[0132.498] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk", pszSpec="*.doc") returned 0
	[0132.498] lstrlenA (lpString="*.doc") returned 5
	[0132.498] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk", pszSpec="*.docx") returned 0
	[0132.498] lstrlenA (lpString="*.docx") returned 6
	[0132.498] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk", pszSpec="*.xls") returned 0
	[0132.498] lstrlenA (lpString="*.xls") returned 5
	[0132.498] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk", pszSpec="*.xlsx") returned 0
	[0132.498] lstrlenA (lpString="*.xlsx") returned 6
	[0132.498] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk", pszSpec="*.ppt") returned 0
	[0132.498] lstrlenA (lpString="*.ppt") returned 5
	[0132.498] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk", pszSpec="*.pptx") returned 0
	[0132.498] lstrlenA (lpString="*.pptx") returned 6
	[0132.498] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk", pszSpec="*.txt") returned 0
	[0132.498] lstrlenA (lpString="*.txt") returned 5
	[0132.498] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk", pszSpec="*.pdf") returned 0
	[0132.498] lstrlenA (lpString="*.pdf") returned 5
	[0132.498] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk", pszSpec="*.htm") returned 0
	[0132.498] lstrlenA (lpString="*.htm") returned 5
	[0132.498] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk", pszSpec="*.html") returned 0
	[0132.498] lstrlenA (lpString="*.html") returned 6
	[0132.498] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk", pszSpec="*.mdb") returned 0
	[0132.498] lstrlenA (lpString="*.mdb") returned 5
	[0132.498] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk", pszSpec="*.pfx") returned 0
	[0132.498] lstrlenA (lpString="*.pfx") returned 5
	[0132.498] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk", pszSpec="*.md") returned 0
	[0132.498] lstrlenA (lpString="*.md") returned 4
	[0132.498] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk", pszSpec="*.lnk") returned 1
	[0132.498] lstrlenA (lpString="*.lnk") returned 5
	[0132.498] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk"
	[0132.498] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk"
	[0132.498] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk."
	[0132.498] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk.exe"
	[0132.498] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\o9aiejfo6wjhyd3.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.499] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x472
	[0132.499] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x505a7594, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x505a7594, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x505a7594, dwHighDateTime=0x1d543d9)) returned 1
	[0132.499] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.499] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x430, lpOverlapped=0x0) returned 1
	[0132.500] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk") returned="o9AIEJfO6WjHyD3.lnk"
	[0132.500] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.500] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x430, lpOverlapped=0x0) returned 1
	[0132.500] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.500] CloseHandle (hObject=0x21c) returned 1
	[0132.500] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\o9aiejfo6wjhyd3.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\o9aiejfo6wjhyd3.lnk.exe")) returned 1
	[0132.501] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d61dc80, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x3d61dc80, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x3d61dc80, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x403, dwReserved0=0x0, dwReserved1=0x0, cFileName="OIm3hzhAajZucOojXs.lnk", cAlternateFileName="OIM3HZ~1.LNK")) returned 1
	[0132.501] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.501] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="OIm3hzhAajZucOojXs.lnk") returned -1
	[0132.501] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="OIm3hzhAajZucOojXs.lnk") returned -1
	[0132.501] lstrcmpiA (lpString1="", lpString2="OIm3hzhAajZucOojXs.lnk") returned -1
	[0132.501] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o9AIEJfO6WjHyD3.lnk") returned="o9AIEJfO6WjHyD3.lnk"
	[0132.501] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.501] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.501] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.501] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.501] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="OIm3hzhAajZucOojXs.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk"
	[0132.501] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk", pszSpec="*.zip") returned 0
	[0132.501] lstrlenA (lpString="*.zip") returned 5
	[0132.501] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk", pszSpec="*.rar") returned 0
	[0132.501] lstrlenA (lpString="*.rar") returned 5
	[0132.501] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk", pszSpec="*.7z") returned 0
	[0132.501] lstrlenA (lpString="*.7z") returned 4
	[0132.501] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk", pszSpec="*.tar") returned 0
	[0132.501] lstrlenA (lpString="*.tar") returned 5
	[0132.501] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk", pszSpec="*.gzip") returned 0
	[0132.501] lstrlenA (lpString="*.gzip") returned 6
	[0132.501] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk", pszSpec="*.jpg") returned 0
	[0132.501] lstrlenA (lpString="*.jpg") returned 5
	[0132.501] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk", pszSpec="*.jpeg") returned 0
	[0132.501] lstrlenA (lpString="*.jpeg") returned 6
	[0132.501] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk", pszSpec="*.bmp") returned 0
	[0132.501] lstrlenA (lpString="*.bmp") returned 5
	[0132.501] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk", pszSpec="*.gif") returned 0
	[0132.501] lstrlenA (lpString="*.gif") returned 5
	[0132.501] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk", pszSpec="*.png") returned 0
	[0132.501] lstrlenA (lpString="*.png") returned 5
	[0132.502] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk", pszSpec="*.doc") returned 0
	[0132.502] lstrlenA (lpString="*.doc") returned 5
	[0132.502] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk", pszSpec="*.docx") returned 0
	[0132.502] lstrlenA (lpString="*.docx") returned 6
	[0132.502] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk", pszSpec="*.xls") returned 0
	[0132.502] lstrlenA (lpString="*.xls") returned 5
	[0132.502] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk", pszSpec="*.xlsx") returned 0
	[0132.502] lstrlenA (lpString="*.xlsx") returned 6
	[0132.502] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk", pszSpec="*.ppt") returned 0
	[0132.502] lstrlenA (lpString="*.ppt") returned 5
	[0132.502] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk", pszSpec="*.pptx") returned 0
	[0132.502] lstrlenA (lpString="*.pptx") returned 6
	[0132.502] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk", pszSpec="*.txt") returned 0
	[0132.502] lstrlenA (lpString="*.txt") returned 5
	[0132.502] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk", pszSpec="*.pdf") returned 0
	[0132.502] lstrlenA (lpString="*.pdf") returned 5
	[0132.502] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk", pszSpec="*.htm") returned 0
	[0132.502] lstrlenA (lpString="*.htm") returned 5
	[0132.502] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk", pszSpec="*.html") returned 0
	[0132.502] lstrlenA (lpString="*.html") returned 6
	[0132.502] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk", pszSpec="*.mdb") returned 0
	[0132.502] lstrlenA (lpString="*.mdb") returned 5
	[0132.502] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk", pszSpec="*.pfx") returned 0
	[0132.502] lstrlenA (lpString="*.pfx") returned 5
	[0132.502] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk", pszSpec="*.md") returned 0
	[0132.502] lstrlenA (lpString="*.md") returned 4
	[0132.502] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk", pszSpec="*.lnk") returned 1
	[0132.502] lstrlenA (lpString="*.lnk") returned 5
	[0132.502] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk"
	[0132.502] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk"
	[0132.502] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk."
	[0132.502] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk.exe"
	[0132.502] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oim3hzhaajzucoojxs.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.503] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x403
	[0132.503] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3d61dc80, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x3d61dc80, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3d61dc80, dwHighDateTime=0x1d543d9)) returned 1
	[0132.503] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.503] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x3c1, lpOverlapped=0x0) returned 1
	[0132.504] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk") returned="OIm3hzhAajZucOojXs.lnk"
	[0132.504] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.504] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x3c1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x3c1, lpOverlapped=0x0) returned 1
	[0132.504] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.504] CloseHandle (hObject=0x21c) returned 1
	[0132.504] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oim3hzhaajzucoojxs.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oim3hzhaajzucoojxs.lnk.exe")) returned 1
	[0132.505] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52540687, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x52540687, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x52540687, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="OQNITW9zaCCsfR.lnk", cAlternateFileName="OQNITW~1.LNK")) returned 1
	[0132.505] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.505] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="OQNITW9zaCCsfR.lnk") returned -1
	[0132.505] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="OQNITW9zaCCsfR.lnk") returned -1
	[0132.505] lstrcmpiA (lpString1="", lpString2="OQNITW9zaCCsfR.lnk") returned -1
	[0132.505] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OIm3hzhAajZucOojXs.lnk") returned="OIm3hzhAajZucOojXs.lnk"
	[0132.505] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.505] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.505] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.505] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.505] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="OQNITW9zaCCsfR.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk"
	[0132.505] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk", pszSpec="*.zip") returned 0
	[0132.505] lstrlenA (lpString="*.zip") returned 5
	[0132.505] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk", pszSpec="*.rar") returned 0
	[0132.505] lstrlenA (lpString="*.rar") returned 5
	[0132.505] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk", pszSpec="*.7z") returned 0
	[0132.505] lstrlenA (lpString="*.7z") returned 4
	[0132.505] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk", pszSpec="*.tar") returned 0
	[0132.505] lstrlenA (lpString="*.tar") returned 5
	[0132.505] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk", pszSpec="*.gzip") returned 0
	[0132.505] lstrlenA (lpString="*.gzip") returned 6
	[0132.505] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk", pszSpec="*.jpg") returned 0
	[0132.505] lstrlenA (lpString="*.jpg") returned 5
	[0132.505] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk", pszSpec="*.jpeg") returned 0
	[0132.505] lstrlenA (lpString="*.jpeg") returned 6
	[0132.505] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk", pszSpec="*.bmp") returned 0
	[0132.505] lstrlenA (lpString="*.bmp") returned 5
	[0132.505] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk", pszSpec="*.gif") returned 0
	[0132.505] lstrlenA (lpString="*.gif") returned 5
	[0132.505] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk", pszSpec="*.png") returned 0
	[0132.505] lstrlenA (lpString="*.png") returned 5
	[0132.505] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk", pszSpec="*.doc") returned 0
	[0132.505] lstrlenA (lpString="*.doc") returned 5
	[0132.506] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk", pszSpec="*.docx") returned 0
	[0132.506] lstrlenA (lpString="*.docx") returned 6
	[0132.506] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk", pszSpec="*.xls") returned 0
	[0132.506] lstrlenA (lpString="*.xls") returned 5
	[0132.506] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk", pszSpec="*.xlsx") returned 0
	[0132.506] lstrlenA (lpString="*.xlsx") returned 6
	[0132.506] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk", pszSpec="*.ppt") returned 0
	[0132.506] lstrlenA (lpString="*.ppt") returned 5
	[0132.506] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk", pszSpec="*.pptx") returned 0
	[0132.506] lstrlenA (lpString="*.pptx") returned 6
	[0132.506] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk", pszSpec="*.txt") returned 0
	[0132.506] lstrlenA (lpString="*.txt") returned 5
	[0132.516] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk", pszSpec="*.pdf") returned 0
	[0132.516] lstrlenA (lpString="*.pdf") returned 5
	[0132.516] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk", pszSpec="*.htm") returned 0
	[0132.516] lstrlenA (lpString="*.htm") returned 5
	[0132.516] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk", pszSpec="*.html") returned 0
	[0132.516] lstrlenA (lpString="*.html") returned 6
	[0132.516] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk", pszSpec="*.mdb") returned 0
	[0132.516] lstrlenA (lpString="*.mdb") returned 5
	[0132.516] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk", pszSpec="*.pfx") returned 0
	[0132.516] lstrlenA (lpString="*.pfx") returned 5
	[0132.516] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk", pszSpec="*.md") returned 0
	[0132.516] lstrlenA (lpString="*.md") returned 4
	[0132.516] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk", pszSpec="*.lnk") returned 1
	[0132.516] lstrlenA (lpString="*.lnk") returned 5
	[0132.516] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk"
	[0132.516] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk"
	[0132.516] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk."
	[0132.516] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk.exe"
	[0132.516] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oqnitw9zaccsfr.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.517] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ce
	[0132.517] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x52540687, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x52540687, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x52540687, dwHighDateTime=0x1d543d9)) returned 1
	[0132.517] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.517] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x38c, lpOverlapped=0x0) returned 1
	[0132.518] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk") returned="OQNITW9zaCCsfR.lnk"
	[0132.518] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.518] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x38c, lpOverlapped=0x0) returned 1
	[0132.518] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.518] CloseHandle (hObject=0x21c) returned 1
	[0132.518] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oqnitw9zaccsfr.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oqnitw9zaccsfr.lnk.exe")) returned 1
	[0132.519] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20e6b99e, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x20e6b99e, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x20e6cd1d, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="OV9RpW8ry.lnk", cAlternateFileName="OV9RPW~1.LNK")) returned 1
	[0132.519] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.519] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="OV9RpW8ry.lnk") returned -1
	[0132.519] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="OV9RpW8ry.lnk") returned -1
	[0132.519] lstrcmpiA (lpString1="", lpString2="OV9RpW8ry.lnk") returned -1
	[0132.519] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OQNITW9zaCCsfR.lnk") returned="OQNITW9zaCCsfR.lnk"
	[0132.519] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.519] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.519] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.519] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.519] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="OV9RpW8ry.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk"
	[0132.519] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk", pszSpec="*.zip") returned 0
	[0132.519] lstrlenA (lpString="*.zip") returned 5
	[0132.519] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk", pszSpec="*.rar") returned 0
	[0132.519] lstrlenA (lpString="*.rar") returned 5
	[0132.519] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk", pszSpec="*.7z") returned 0
	[0132.519] lstrlenA (lpString="*.7z") returned 4
	[0132.519] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk", pszSpec="*.tar") returned 0
	[0132.519] lstrlenA (lpString="*.tar") returned 5
	[0132.519] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk", pszSpec="*.gzip") returned 0
	[0132.519] lstrlenA (lpString="*.gzip") returned 6
	[0132.519] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk", pszSpec="*.jpg") returned 0
	[0132.519] lstrlenA (lpString="*.jpg") returned 5
	[0132.519] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk", pszSpec="*.jpeg") returned 0
	[0132.519] lstrlenA (lpString="*.jpeg") returned 6
	[0132.519] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk", pszSpec="*.bmp") returned 0
	[0132.520] lstrlenA (lpString="*.bmp") returned 5
	[0132.520] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk", pszSpec="*.gif") returned 0
	[0132.520] lstrlenA (lpString="*.gif") returned 5
	[0132.520] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk", pszSpec="*.png") returned 0
	[0132.520] lstrlenA (lpString="*.png") returned 5
	[0132.520] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk", pszSpec="*.doc") returned 0
	[0132.520] lstrlenA (lpString="*.doc") returned 5
	[0132.520] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk", pszSpec="*.docx") returned 0
	[0132.520] lstrlenA (lpString="*.docx") returned 6
	[0132.520] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk", pszSpec="*.xls") returned 0
	[0132.520] lstrlenA (lpString="*.xls") returned 5
	[0132.520] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk", pszSpec="*.xlsx") returned 0
	[0132.520] lstrlenA (lpString="*.xlsx") returned 6
	[0132.520] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk", pszSpec="*.ppt") returned 0
	[0132.520] lstrlenA (lpString="*.ppt") returned 5
	[0132.520] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk", pszSpec="*.pptx") returned 0
	[0132.520] lstrlenA (lpString="*.pptx") returned 6
	[0132.520] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk", pszSpec="*.txt") returned 0
	[0132.520] lstrlenA (lpString="*.txt") returned 5
	[0132.520] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk", pszSpec="*.pdf") returned 0
	[0132.520] lstrlenA (lpString="*.pdf") returned 5
	[0132.520] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk", pszSpec="*.htm") returned 0
	[0132.520] lstrlenA (lpString="*.htm") returned 5
	[0132.520] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk", pszSpec="*.html") returned 0
	[0132.520] lstrlenA (lpString="*.html") returned 6
	[0132.520] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk", pszSpec="*.mdb") returned 0
	[0132.520] lstrlenA (lpString="*.mdb") returned 5
	[0132.520] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk", pszSpec="*.pfx") returned 0
	[0132.520] lstrlenA (lpString="*.pfx") returned 5
	[0132.520] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk", pszSpec="*.md") returned 0
	[0132.520] lstrlenA (lpString="*.md") returned 4
	[0132.520] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk", pszSpec="*.lnk") returned 1
	[0132.520] lstrlenA (lpString="*.lnk") returned 5
	[0132.520] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk"
	[0132.520] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk"
	[0132.520] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk."
	[0132.521] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk.exe"
	[0132.521] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ov9rpw8ry.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.521] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d6
	[0132.521] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x20e6b99e, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x20e6b99e, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x20e6cd1d, dwHighDateTime=0x1d543d9)) returned 1
	[0132.521] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.521] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x394, lpOverlapped=0x0) returned 1
	[0132.522] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk") returned="OV9RpW8ry.lnk"
	[0132.522] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.522] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x394, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x394, lpOverlapped=0x0) returned 1
	[0132.522] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.522] CloseHandle (hObject=0x21c) returned 1
	[0132.522] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ov9rpw8ry.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ov9rpw8ry.lnk.exe")) returned 1
	[0132.523] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x330dc61e, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x330dc61e, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x330dc61e, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="p6OSEX0QDXu0.lnk", cAlternateFileName="P6OSEX~1.LNK")) returned 1
	[0132.523] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.523] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="p6OSEX0QDXu0.lnk") returned -1
	[0132.523] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="p6OSEX0QDXu0.lnk") returned -1
	[0132.523] lstrcmpiA (lpString1="", lpString2="p6OSEX0QDXu0.lnk") returned -1
	[0132.523] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OV9RpW8ry.lnk") returned="OV9RpW8ry.lnk"
	[0132.523] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.523] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.523] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.523] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.523] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="p6OSEX0QDXu0.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk"
	[0132.523] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk", pszSpec="*.zip") returned 0
	[0132.523] lstrlenA (lpString="*.zip") returned 5
	[0132.523] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk", pszSpec="*.rar") returned 0
	[0132.523] lstrlenA (lpString="*.rar") returned 5
	[0132.523] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk", pszSpec="*.7z") returned 0
	[0132.523] lstrlenA (lpString="*.7z") returned 4
	[0132.523] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk", pszSpec="*.tar") returned 0
	[0132.524] lstrlenA (lpString="*.tar") returned 5
	[0132.524] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk", pszSpec="*.gzip") returned 0
	[0132.524] lstrlenA (lpString="*.gzip") returned 6
	[0132.524] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk", pszSpec="*.jpg") returned 0
	[0132.524] lstrlenA (lpString="*.jpg") returned 5
	[0132.524] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk", pszSpec="*.jpeg") returned 0
	[0132.524] lstrlenA (lpString="*.jpeg") returned 6
	[0132.524] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk", pszSpec="*.bmp") returned 0
	[0132.524] lstrlenA (lpString="*.bmp") returned 5
	[0132.524] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk", pszSpec="*.gif") returned 0
	[0132.524] lstrlenA (lpString="*.gif") returned 5
	[0132.524] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk", pszSpec="*.png") returned 0
	[0132.524] lstrlenA (lpString="*.png") returned 5
	[0132.524] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk", pszSpec="*.doc") returned 0
	[0132.524] lstrlenA (lpString="*.doc") returned 5
	[0132.524] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk", pszSpec="*.docx") returned 0
	[0132.524] lstrlenA (lpString="*.docx") returned 6
	[0132.524] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk", pszSpec="*.xls") returned 0
	[0132.524] lstrlenA (lpString="*.xls") returned 5
	[0132.524] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk", pszSpec="*.xlsx") returned 0
	[0132.524] lstrlenA (lpString="*.xlsx") returned 6
	[0132.524] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk", pszSpec="*.ppt") returned 0
	[0132.524] lstrlenA (lpString="*.ppt") returned 5
	[0132.524] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk", pszSpec="*.pptx") returned 0
	[0132.524] lstrlenA (lpString="*.pptx") returned 6
	[0132.524] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk", pszSpec="*.txt") returned 0
	[0132.524] lstrlenA (lpString="*.txt") returned 5
	[0132.524] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk", pszSpec="*.pdf") returned 0
	[0132.524] lstrlenA (lpString="*.pdf") returned 5
	[0132.524] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk", pszSpec="*.htm") returned 0
	[0132.524] lstrlenA (lpString="*.htm") returned 5
	[0132.524] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk", pszSpec="*.html") returned 0
	[0132.524] lstrlenA (lpString="*.html") returned 6
	[0132.524] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk", pszSpec="*.mdb") returned 0
	[0132.524] lstrlenA (lpString="*.mdb") returned 5
	[0132.524] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk", pszSpec="*.pfx") returned 0
	[0132.525] lstrlenA (lpString="*.pfx") returned 5
	[0132.525] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk", pszSpec="*.md") returned 0
	[0132.525] lstrlenA (lpString="*.md") returned 4
	[0132.525] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk", pszSpec="*.lnk") returned 1
	[0132.525] lstrlenA (lpString="*.lnk") returned 5
	[0132.525] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk"
	[0132.525] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk"
	[0132.525] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk."
	[0132.525] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk.exe"
	[0132.525] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\p6osex0qdxu0.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.525] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3c4
	[0132.525] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x330dc61e, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x330dc61e, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x330dc61e, dwHighDateTime=0x1d543d9)) returned 1
	[0132.525] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.525] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x382, lpOverlapped=0x0) returned 1
	[0132.526] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk") returned="p6OSEX0QDXu0.lnk"
	[0132.526] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.526] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x382, lpOverlapped=0x0) returned 1
	[0132.526] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.526] CloseHandle (hObject=0x21c) returned 1
	[0132.526] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\p6osex0qdxu0.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\p6osex0qdxu0.lnk.exe")) returned 1
	[0132.527] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52481b4f, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x52481b4f, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x52481b4f, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGomyT8T.lnk", cAlternateFileName="")) returned 1
	[0132.527] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.527] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PGomyT8T.lnk") returned -1
	[0132.527] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PGomyT8T.lnk") returned -1
	[0132.527] lstrcmpiA (lpString1="", lpString2="PGomyT8T.lnk") returned -1
	[0132.527] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p6OSEX0QDXu0.lnk") returned="p6OSEX0QDXu0.lnk"
	[0132.527] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.527] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.527] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.527] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.527] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="PGomyT8T.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk"
	[0132.527] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk", pszSpec="*.zip") returned 0
	[0132.527] lstrlenA (lpString="*.zip") returned 5
	[0132.527] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk", pszSpec="*.rar") returned 0
	[0132.527] lstrlenA (lpString="*.rar") returned 5
	[0132.527] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk", pszSpec="*.7z") returned 0
	[0132.527] lstrlenA (lpString="*.7z") returned 4
	[0132.527] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk", pszSpec="*.tar") returned 0
	[0132.528] lstrlenA (lpString="*.tar") returned 5
	[0132.528] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk", pszSpec="*.gzip") returned 0
	[0132.528] lstrlenA (lpString="*.gzip") returned 6
	[0132.528] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk", pszSpec="*.jpg") returned 0
	[0132.528] lstrlenA (lpString="*.jpg") returned 5
	[0132.528] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk", pszSpec="*.jpeg") returned 0
	[0132.528] lstrlenA (lpString="*.jpeg") returned 6
	[0132.528] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk", pszSpec="*.bmp") returned 0
	[0132.528] lstrlenA (lpString="*.bmp") returned 5
	[0132.528] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk", pszSpec="*.gif") returned 0
	[0132.528] lstrlenA (lpString="*.gif") returned 5
	[0132.528] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk", pszSpec="*.png") returned 0
	[0132.528] lstrlenA (lpString="*.png") returned 5
	[0132.528] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk", pszSpec="*.doc") returned 0
	[0132.528] lstrlenA (lpString="*.doc") returned 5
	[0132.528] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk", pszSpec="*.docx") returned 0
	[0132.528] lstrlenA (lpString="*.docx") returned 6
	[0132.528] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk", pszSpec="*.xls") returned 0
	[0132.528] lstrlenA (lpString="*.xls") returned 5
	[0132.528] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk", pszSpec="*.xlsx") returned 0
	[0132.528] lstrlenA (lpString="*.xlsx") returned 6
	[0132.528] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk", pszSpec="*.ppt") returned 0
	[0132.528] lstrlenA (lpString="*.ppt") returned 5
	[0132.528] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk", pszSpec="*.pptx") returned 0
	[0132.528] lstrlenA (lpString="*.pptx") returned 6
	[0132.528] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk", pszSpec="*.txt") returned 0
	[0132.528] lstrlenA (lpString="*.txt") returned 5
	[0132.528] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk", pszSpec="*.pdf") returned 0
	[0132.528] lstrlenA (lpString="*.pdf") returned 5
	[0132.528] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk", pszSpec="*.htm") returned 0
	[0132.528] lstrlenA (lpString="*.htm") returned 5
	[0132.528] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk", pszSpec="*.html") returned 0
	[0132.528] lstrlenA (lpString="*.html") returned 6
	[0132.528] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk", pszSpec="*.mdb") returned 0
	[0132.528] lstrlenA (lpString="*.mdb") returned 5
	[0132.528] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk", pszSpec="*.pfx") returned 0
	[0132.529] lstrlenA (lpString="*.pfx") returned 5
	[0132.529] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk", pszSpec="*.md") returned 0
	[0132.529] lstrlenA (lpString="*.md") returned 4
	[0132.529] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk", pszSpec="*.lnk") returned 1
	[0132.529] lstrlenA (lpString="*.lnk") returned 5
	[0132.529] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk"
	[0132.529] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk"
	[0132.529] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk."
	[0132.529] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk.exe"
	[0132.529] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pgomyt8t.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.529] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3bc
	[0132.529] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x52481b4f, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x52481b4f, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x52481b4f, dwHighDateTime=0x1d543d9)) returned 1
	[0132.529] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.529] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x37a, lpOverlapped=0x0) returned 1
	[0132.530] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk") returned="PGomyT8T.lnk"
	[0132.530] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.530] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x37a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x37a, lpOverlapped=0x0) returned 1
	[0132.530] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.530] CloseHandle (hObject=0x21c) returned 1
	[0132.530] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pgomyt8t.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pgomyt8t.lnk.exe")) returned 1
	[0132.531] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15b10294, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x52566ad3, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x52566ad3, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x2f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures.lnk", cAlternateFileName="")) returned 1
	[0132.531] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.531] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Pictures.lnk") returned -1
	[0132.531] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Pictures.lnk") returned -1
	[0132.531] lstrcmpiA (lpString1="", lpString2="Pictures.lnk") returned -1
	[0132.531] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PGomyT8T.lnk") returned="PGomyT8T.lnk"
	[0132.531] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.531] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.531] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.531] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.531] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="Pictures.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk"
	[0132.531] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk", pszSpec="*.zip") returned 0
	[0132.531] lstrlenA (lpString="*.zip") returned 5
	[0132.531] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk", pszSpec="*.rar") returned 0
	[0132.531] lstrlenA (lpString="*.rar") returned 5
	[0132.531] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk", pszSpec="*.7z") returned 0
	[0132.531] lstrlenA (lpString="*.7z") returned 4
	[0132.531] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk", pszSpec="*.tar") returned 0
	[0132.531] lstrlenA (lpString="*.tar") returned 5
	[0132.531] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk", pszSpec="*.gzip") returned 0
	[0132.532] lstrlenA (lpString="*.gzip") returned 6
	[0132.532] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk", pszSpec="*.jpg") returned 0
	[0132.532] lstrlenA (lpString="*.jpg") returned 5
	[0132.532] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk", pszSpec="*.jpeg") returned 0
	[0132.532] lstrlenA (lpString="*.jpeg") returned 6
	[0132.532] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk", pszSpec="*.bmp") returned 0
	[0132.532] lstrlenA (lpString="*.bmp") returned 5
	[0132.532] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk", pszSpec="*.gif") returned 0
	[0132.532] lstrlenA (lpString="*.gif") returned 5
	[0132.532] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk", pszSpec="*.png") returned 0
	[0132.532] lstrlenA (lpString="*.png") returned 5
	[0132.532] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk", pszSpec="*.doc") returned 0
	[0132.532] lstrlenA (lpString="*.doc") returned 5
	[0132.532] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk", pszSpec="*.docx") returned 0
	[0132.532] lstrlenA (lpString="*.docx") returned 6
	[0132.532] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk", pszSpec="*.xls") returned 0
	[0132.532] lstrlenA (lpString="*.xls") returned 5
	[0132.532] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk", pszSpec="*.xlsx") returned 0
	[0132.532] lstrlenA (lpString="*.xlsx") returned 6
	[0132.532] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk", pszSpec="*.ppt") returned 0
	[0132.532] lstrlenA (lpString="*.ppt") returned 5
	[0132.532] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk", pszSpec="*.pptx") returned 0
	[0132.532] lstrlenA (lpString="*.pptx") returned 6
	[0132.532] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk", pszSpec="*.txt") returned 0
	[0132.532] lstrlenA (lpString="*.txt") returned 5
	[0132.532] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk", pszSpec="*.pdf") returned 0
	[0132.532] lstrlenA (lpString="*.pdf") returned 5
	[0132.532] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk", pszSpec="*.htm") returned 0
	[0132.532] lstrlenA (lpString="*.htm") returned 5
	[0132.532] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk", pszSpec="*.html") returned 0
	[0132.532] lstrlenA (lpString="*.html") returned 6
	[0132.532] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk", pszSpec="*.mdb") returned 0
	[0132.532] lstrlenA (lpString="*.mdb") returned 5
	[0132.532] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk", pszSpec="*.pfx") returned 0
	[0132.532] lstrlenA (lpString="*.pfx") returned 5
	[0132.532] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk", pszSpec="*.md") returned 0
	[0132.532] lstrlenA (lpString="*.md") returned 4
	[0132.533] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk", pszSpec="*.lnk") returned 1
	[0132.533] lstrlenA (lpString="*.lnk") returned 5
	[0132.533] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk"
	[0132.533] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk"
	[0132.533] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk."
	[0132.533] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk.exe"
	[0132.533] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pictures.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.533] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2f1
	[0132.533] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x15b10294, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x52566ad3, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x52566ad3, dwHighDateTime=0x1d543d9)) returned 1
	[0132.533] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.533] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x2af, lpOverlapped=0x0) returned 1
	[0132.534] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk") returned="Pictures.lnk"
	[0132.534] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.534] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x2af, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x2af, lpOverlapped=0x0) returned 1
	[0132.534] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.534] CloseHandle (hObject=0x21c) returned 1
	[0132.534] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pictures.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pictures.lnk.exe")) returned 1
	[0132.535] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a2b86bd, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x3a2b86bd, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x3a2b86bd, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x5bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="PKtdnEbLfIRVXjWA.lnk", cAlternateFileName="PKTDNE~1.LNK")) returned 1
	[0132.535] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.535] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PKtdnEbLfIRVXjWA.lnk") returned -1
	[0132.535] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PKtdnEbLfIRVXjWA.lnk") returned -1
	[0132.535] lstrcmpiA (lpString1="", lpString2="PKtdnEbLfIRVXjWA.lnk") returned -1
	[0132.535] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk") returned="Pictures.lnk"
	[0132.535] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.535] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.535] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.535] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.535] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="PKtdnEbLfIRVXjWA.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk"
	[0132.535] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk", pszSpec="*.zip") returned 0
	[0132.535] lstrlenA (lpString="*.zip") returned 5
	[0132.535] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk", pszSpec="*.rar") returned 0
	[0132.535] lstrlenA (lpString="*.rar") returned 5
	[0132.535] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk", pszSpec="*.7z") returned 0
	[0132.535] lstrlenA (lpString="*.7z") returned 4
	[0132.535] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk", pszSpec="*.tar") returned 0
	[0132.535] lstrlenA (lpString="*.tar") returned 5
	[0132.535] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk", pszSpec="*.gzip") returned 0
	[0132.535] lstrlenA (lpString="*.gzip") returned 6
	[0132.535] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk", pszSpec="*.jpg") returned 0
	[0132.535] lstrlenA (lpString="*.jpg") returned 5
	[0132.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk", pszSpec="*.jpeg") returned 0
	[0132.536] lstrlenA (lpString="*.jpeg") returned 6
	[0132.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk", pszSpec="*.bmp") returned 0
	[0132.536] lstrlenA (lpString="*.bmp") returned 5
	[0132.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk", pszSpec="*.gif") returned 0
	[0132.536] lstrlenA (lpString="*.gif") returned 5
	[0132.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk", pszSpec="*.png") returned 0
	[0132.536] lstrlenA (lpString="*.png") returned 5
	[0132.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk", pszSpec="*.doc") returned 0
	[0132.536] lstrlenA (lpString="*.doc") returned 5
	[0132.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk", pszSpec="*.docx") returned 0
	[0132.536] lstrlenA (lpString="*.docx") returned 6
	[0132.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk", pszSpec="*.xls") returned 0
	[0132.536] lstrlenA (lpString="*.xls") returned 5
	[0132.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk", pszSpec="*.xlsx") returned 0
	[0132.536] lstrlenA (lpString="*.xlsx") returned 6
	[0132.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk", pszSpec="*.ppt") returned 0
	[0132.536] lstrlenA (lpString="*.ppt") returned 5
	[0132.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk", pszSpec="*.pptx") returned 0
	[0132.536] lstrlenA (lpString="*.pptx") returned 6
	[0132.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk", pszSpec="*.txt") returned 0
	[0132.536] lstrlenA (lpString="*.txt") returned 5
	[0132.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk", pszSpec="*.pdf") returned 0
	[0132.536] lstrlenA (lpString="*.pdf") returned 5
	[0132.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk", pszSpec="*.htm") returned 0
	[0132.536] lstrlenA (lpString="*.htm") returned 5
	[0132.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk", pszSpec="*.html") returned 0
	[0132.536] lstrlenA (lpString="*.html") returned 6
	[0132.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk", pszSpec="*.mdb") returned 0
	[0132.536] lstrlenA (lpString="*.mdb") returned 5
	[0132.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk", pszSpec="*.pfx") returned 0
	[0132.536] lstrlenA (lpString="*.pfx") returned 5
	[0132.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk", pszSpec="*.md") returned 0
	[0132.536] lstrlenA (lpString="*.md") returned 4
	[0132.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk", pszSpec="*.lnk") returned 1
	[0132.536] lstrlenA (lpString="*.lnk") returned 5
	[0132.536] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk"
	[0132.537] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk"
	[0132.537] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk."
	[0132.537] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk.exe"
	[0132.537] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pktdneblfirvxjwa.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.537] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5bf
	[0132.537] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3a2b86bd, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x3a2b86bd, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3a2b86bd, dwHighDateTime=0x1d543d9)) returned 1
	[0132.537] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.537] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x57d, lpOverlapped=0x0) returned 1
	[0132.556] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk") returned="PKtdnEbLfIRVXjWA.lnk"
	[0132.556] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.556] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x57d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x57d, lpOverlapped=0x0) returned 1
	[0132.561] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.561] CloseHandle (hObject=0x21c) returned 1
	[0132.561] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pktdneblfirvxjwa.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pktdneblfirvxjwa.lnk.exe")) returned 1
	[0132.561] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4678780b, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x4678780b, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x4678780b, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x39d, dwReserved0=0x0, dwReserved1=0x0, cFileName="PMUpJ.lnk", cAlternateFileName="")) returned 1
	[0132.561] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.562] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PMUpJ.lnk") returned -1
	[0132.562] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PMUpJ.lnk") returned -1
	[0132.562] lstrcmpiA (lpString1="", lpString2="PMUpJ.lnk") returned -1
	[0132.562] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PKtdnEbLfIRVXjWA.lnk") returned="PKtdnEbLfIRVXjWA.lnk"
	[0132.562] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.562] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.562] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.562] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.562] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="PMUpJ.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk"
	[0132.562] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk", pszSpec="*.zip") returned 0
	[0132.562] lstrlenA (lpString="*.zip") returned 5
	[0132.562] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk", pszSpec="*.rar") returned 0
	[0132.562] lstrlenA (lpString="*.rar") returned 5
	[0132.562] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk", pszSpec="*.7z") returned 0
	[0132.562] lstrlenA (lpString="*.7z") returned 4
	[0132.562] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk", pszSpec="*.tar") returned 0
	[0132.562] lstrlenA (lpString="*.tar") returned 5
	[0132.562] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk", pszSpec="*.gzip") returned 0
	[0132.562] lstrlenA (lpString="*.gzip") returned 6
	[0132.562] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk", pszSpec="*.jpg") returned 0
	[0132.562] lstrlenA (lpString="*.jpg") returned 5
	[0132.562] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk", pszSpec="*.jpeg") returned 0
	[0132.562] lstrlenA (lpString="*.jpeg") returned 6
	[0132.562] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk", pszSpec="*.bmp") returned 0
	[0132.562] lstrlenA (lpString="*.bmp") returned 5
	[0132.562] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk", pszSpec="*.gif") returned 0
	[0132.562] lstrlenA (lpString="*.gif") returned 5
	[0132.562] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk", pszSpec="*.png") returned 0
	[0132.562] lstrlenA (lpString="*.png") returned 5
	[0132.562] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk", pszSpec="*.doc") returned 0
	[0132.562] lstrlenA (lpString="*.doc") returned 5
	[0132.562] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk", pszSpec="*.docx") returned 0
	[0132.562] lstrlenA (lpString="*.docx") returned 6
	[0132.563] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk", pszSpec="*.xls") returned 0
	[0132.563] lstrlenA (lpString="*.xls") returned 5
	[0132.563] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk", pszSpec="*.xlsx") returned 0
	[0132.563] lstrlenA (lpString="*.xlsx") returned 6
	[0132.563] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk", pszSpec="*.ppt") returned 0
	[0132.563] lstrlenA (lpString="*.ppt") returned 5
	[0132.563] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk", pszSpec="*.pptx") returned 0
	[0132.563] lstrlenA (lpString="*.pptx") returned 6
	[0132.563] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk", pszSpec="*.txt") returned 0
	[0132.563] lstrlenA (lpString="*.txt") returned 5
	[0132.563] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk", pszSpec="*.pdf") returned 0
	[0132.563] lstrlenA (lpString="*.pdf") returned 5
	[0132.563] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk", pszSpec="*.htm") returned 0
	[0132.563] lstrlenA (lpString="*.htm") returned 5
	[0132.563] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk", pszSpec="*.html") returned 0
	[0132.563] lstrlenA (lpString="*.html") returned 6
	[0132.563] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk", pszSpec="*.mdb") returned 0
	[0132.563] lstrlenA (lpString="*.mdb") returned 5
	[0132.563] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk", pszSpec="*.pfx") returned 0
	[0132.563] lstrlenA (lpString="*.pfx") returned 5
	[0132.563] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk", pszSpec="*.md") returned 0
	[0132.563] lstrlenA (lpString="*.md") returned 4
	[0132.563] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk", pszSpec="*.lnk") returned 1
	[0132.563] lstrlenA (lpString="*.lnk") returned 5
	[0132.563] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk"
	[0132.563] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk"
	[0132.563] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk."
	[0132.563] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk.exe"
	[0132.563] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pmupj.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.564] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x39d
	[0132.564] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4678780b, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x4678780b, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4678780b, dwHighDateTime=0x1d543d9)) returned 1
	[0132.564] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.564] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x35b, lpOverlapped=0x0) returned 1
	[0132.565] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk") returned="PMUpJ.lnk"
	[0132.565] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.565] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x35b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x35b, lpOverlapped=0x0) returned 1
	[0132.565] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.565] CloseHandle (hObject=0x21c) returned 1
	[0132.565] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pmupj.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pmupj.lnk.exe")) returned 1
	[0132.565] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x524ce18a, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x524ce18a, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x524ce18a, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x42b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pz7N.lnk", cAlternateFileName="")) returned 1
	[0132.566] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.566] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Pz7N.lnk") returned -1
	[0132.566] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Pz7N.lnk") returned -1
	[0132.566] lstrcmpiA (lpString1="", lpString2="Pz7N.lnk") returned -1
	[0132.566] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PMUpJ.lnk") returned="PMUpJ.lnk"
	[0132.566] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.566] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.566] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.566] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.566] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="Pz7N.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk"
	[0132.566] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk", pszSpec="*.zip") returned 0
	[0132.566] lstrlenA (lpString="*.zip") returned 5
	[0132.566] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk", pszSpec="*.rar") returned 0
	[0132.566] lstrlenA (lpString="*.rar") returned 5
	[0132.566] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk", pszSpec="*.7z") returned 0
	[0132.566] lstrlenA (lpString="*.7z") returned 4
	[0132.566] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk", pszSpec="*.tar") returned 0
	[0132.566] lstrlenA (lpString="*.tar") returned 5
	[0132.566] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk", pszSpec="*.gzip") returned 0
	[0132.566] lstrlenA (lpString="*.gzip") returned 6
	[0132.566] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk", pszSpec="*.jpg") returned 0
	[0132.566] lstrlenA (lpString="*.jpg") returned 5
	[0132.566] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk", pszSpec="*.jpeg") returned 0
	[0132.566] lstrlenA (lpString="*.jpeg") returned 6
	[0132.566] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk", pszSpec="*.bmp") returned 0
	[0132.566] lstrlenA (lpString="*.bmp") returned 5
	[0132.566] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk", pszSpec="*.gif") returned 0
	[0132.566] lstrlenA (lpString="*.gif") returned 5
	[0132.566] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk", pszSpec="*.png") returned 0
	[0132.566] lstrlenA (lpString="*.png") returned 5
	[0132.566] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk", pszSpec="*.doc") returned 0
	[0132.566] lstrlenA (lpString="*.doc") returned 5
	[0132.566] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk", pszSpec="*.docx") returned 0
	[0132.567] lstrlenA (lpString="*.docx") returned 6
	[0132.567] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk", pszSpec="*.xls") returned 0
	[0132.567] lstrlenA (lpString="*.xls") returned 5
	[0132.567] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk", pszSpec="*.xlsx") returned 0
	[0132.567] lstrlenA (lpString="*.xlsx") returned 6
	[0132.567] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk", pszSpec="*.ppt") returned 0
	[0132.567] lstrlenA (lpString="*.ppt") returned 5
	[0132.567] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk", pszSpec="*.pptx") returned 0
	[0132.567] lstrlenA (lpString="*.pptx") returned 6
	[0132.567] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk", pszSpec="*.txt") returned 0
	[0132.567] lstrlenA (lpString="*.txt") returned 5
	[0132.567] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk", pszSpec="*.pdf") returned 0
	[0132.567] lstrlenA (lpString="*.pdf") returned 5
	[0132.567] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk", pszSpec="*.htm") returned 0
	[0132.567] lstrlenA (lpString="*.htm") returned 5
	[0132.567] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk", pszSpec="*.html") returned 0
	[0132.567] lstrlenA (lpString="*.html") returned 6
	[0132.567] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk", pszSpec="*.mdb") returned 0
	[0132.567] lstrlenA (lpString="*.mdb") returned 5
	[0132.567] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk", pszSpec="*.pfx") returned 0
	[0132.567] lstrlenA (lpString="*.pfx") returned 5
	[0132.567] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk", pszSpec="*.md") returned 0
	[0132.567] lstrlenA (lpString="*.md") returned 4
	[0132.567] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk", pszSpec="*.lnk") returned 1
	[0132.567] lstrlenA (lpString="*.lnk") returned 5
	[0132.567] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk"
	[0132.567] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk"
	[0132.567] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk."
	[0132.567] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk.exe"
	[0132.567] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pz7n.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.568] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x42b
	[0132.568] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x524ce18a, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x524ce18a, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x524ce18a, dwHighDateTime=0x1d543d9)) returned 1
	[0132.568] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.568] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x3e9, lpOverlapped=0x0) returned 1
	[0132.571] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk") returned="Pz7N.lnk"
	[0132.571] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.571] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x3e9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x3e9, lpOverlapped=0x0) returned 1
	[0132.571] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.571] CloseHandle (hObject=0x21c) returned 1
	[0132.571] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pz7n.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pz7n.lnk.exe")) returned 1
	[0132.572] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x208e7da3, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x331028d2, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x331028d2, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x340, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q1uIW.lnk", cAlternateFileName="")) returned 1
	[0132.572] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.572] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Q1uIW.lnk") returned -1
	[0132.572] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Q1uIW.lnk") returned -1
	[0132.572] lstrcmpiA (lpString1="", lpString2="Q1uIW.lnk") returned -1
	[0132.572] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pz7N.lnk") returned="Pz7N.lnk"
	[0132.572] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.572] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.572] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.572] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.572] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="Q1uIW.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk"
	[0132.572] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk", pszSpec="*.zip") returned 0
	[0132.572] lstrlenA (lpString="*.zip") returned 5
	[0132.572] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk", pszSpec="*.rar") returned 0
	[0132.572] lstrlenA (lpString="*.rar") returned 5
	[0132.572] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk", pszSpec="*.7z") returned 0
	[0132.572] lstrlenA (lpString="*.7z") returned 4
	[0132.572] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk", pszSpec="*.tar") returned 0
	[0132.572] lstrlenA (lpString="*.tar") returned 5
	[0132.572] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk", pszSpec="*.gzip") returned 0
	[0132.572] lstrlenA (lpString="*.gzip") returned 6
	[0132.572] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk", pszSpec="*.jpg") returned 0
	[0132.572] lstrlenA (lpString="*.jpg") returned 5
	[0132.573] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk", pszSpec="*.jpeg") returned 0
	[0132.573] lstrlenA (lpString="*.jpeg") returned 6
	[0132.573] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk", pszSpec="*.bmp") returned 0
	[0132.573] lstrlenA (lpString="*.bmp") returned 5
	[0132.573] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk", pszSpec="*.gif") returned 0
	[0132.573] lstrlenA (lpString="*.gif") returned 5
	[0132.573] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk", pszSpec="*.png") returned 0
	[0132.573] lstrlenA (lpString="*.png") returned 5
	[0132.573] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk", pszSpec="*.doc") returned 0
	[0132.573] lstrlenA (lpString="*.doc") returned 5
	[0132.573] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk", pszSpec="*.docx") returned 0
	[0132.573] lstrlenA (lpString="*.docx") returned 6
	[0132.573] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk", pszSpec="*.xls") returned 0
	[0132.573] lstrlenA (lpString="*.xls") returned 5
	[0132.573] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk", pszSpec="*.xlsx") returned 0
	[0132.573] lstrlenA (lpString="*.xlsx") returned 6
	[0132.573] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk", pszSpec="*.ppt") returned 0
	[0132.573] lstrlenA (lpString="*.ppt") returned 5
	[0132.573] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk", pszSpec="*.pptx") returned 0
	[0132.573] lstrlenA (lpString="*.pptx") returned 6
	[0132.573] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk", pszSpec="*.txt") returned 0
	[0132.573] lstrlenA (lpString="*.txt") returned 5
	[0132.573] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk", pszSpec="*.pdf") returned 0
	[0132.573] lstrlenA (lpString="*.pdf") returned 5
	[0132.573] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk", pszSpec="*.htm") returned 0
	[0132.573] lstrlenA (lpString="*.htm") returned 5
	[0132.573] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk", pszSpec="*.html") returned 0
	[0132.573] lstrlenA (lpString="*.html") returned 6
	[0132.573] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk", pszSpec="*.mdb") returned 0
	[0132.573] lstrlenA (lpString="*.mdb") returned 5
	[0132.573] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk", pszSpec="*.pfx") returned 0
	[0132.573] lstrlenA (lpString="*.pfx") returned 5
	[0132.573] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk", pszSpec="*.md") returned 0
	[0132.573] lstrlenA (lpString="*.md") returned 4
	[0132.573] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk", pszSpec="*.lnk") returned 1
	[0132.573] lstrlenA (lpString="*.lnk") returned 5
	[0132.573] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk"
	[0132.574] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk"
	[0132.574] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk."
	[0132.574] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk.exe"
	[0132.574] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\q1uiw.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.574] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x340
	[0132.574] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x208e7da3, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x331028d2, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x331028d2, dwHighDateTime=0x1d543d9)) returned 1
	[0132.574] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.574] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x2fe, lpOverlapped=0x0) returned 1
	[0132.575] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk") returned="Q1uIW.lnk"
	[0132.575] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.575] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x2fe, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x2fe, lpOverlapped=0x0) returned 1
	[0132.575] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.575] CloseHandle (hObject=0x21c) returned 1
	[0132.575] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\q1uiw.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\q1uiw.lnk.exe")) returned 1
	[0132.576] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5079726c, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x5079726c, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x5079726c, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x4c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="QI2uz.lnk", cAlternateFileName="")) returned 1
	[0132.576] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.576] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="QI2uz.lnk") returned -1
	[0132.576] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="QI2uz.lnk") returned -1
	[0132.576] lstrcmpiA (lpString1="", lpString2="QI2uz.lnk") returned -1
	[0132.576] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q1uIW.lnk") returned="Q1uIW.lnk"
	[0132.576] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.576] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.576] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.576] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.576] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="QI2uz.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk"
	[0132.576] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk", pszSpec="*.zip") returned 0
	[0132.576] lstrlenA (lpString="*.zip") returned 5
	[0132.576] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk", pszSpec="*.rar") returned 0
	[0132.576] lstrlenA (lpString="*.rar") returned 5
	[0132.576] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk", pszSpec="*.7z") returned 0
	[0132.576] lstrlenA (lpString="*.7z") returned 4
	[0132.576] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk", pszSpec="*.tar") returned 0
	[0132.576] lstrlenA (lpString="*.tar") returned 5
	[0132.576] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk", pszSpec="*.gzip") returned 0
	[0132.576] lstrlenA (lpString="*.gzip") returned 6
	[0132.576] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk", pszSpec="*.jpg") returned 0
	[0132.577] lstrlenA (lpString="*.jpg") returned 5
	[0132.577] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk", pszSpec="*.jpeg") returned 0
	[0132.577] lstrlenA (lpString="*.jpeg") returned 6
	[0132.577] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk", pszSpec="*.bmp") returned 0
	[0132.577] lstrlenA (lpString="*.bmp") returned 5
	[0132.577] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk", pszSpec="*.gif") returned 0
	[0132.577] lstrlenA (lpString="*.gif") returned 5
	[0132.577] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk", pszSpec="*.png") returned 0
	[0132.577] lstrlenA (lpString="*.png") returned 5
	[0132.577] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk", pszSpec="*.doc") returned 0
	[0132.577] lstrlenA (lpString="*.doc") returned 5
	[0132.577] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk", pszSpec="*.docx") returned 0
	[0132.577] lstrlenA (lpString="*.docx") returned 6
	[0132.577] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk", pszSpec="*.xls") returned 0
	[0132.577] lstrlenA (lpString="*.xls") returned 5
	[0132.577] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk", pszSpec="*.xlsx") returned 0
	[0132.577] lstrlenA (lpString="*.xlsx") returned 6
	[0132.577] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk", pszSpec="*.ppt") returned 0
	[0132.577] lstrlenA (lpString="*.ppt") returned 5
	[0132.577] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk", pszSpec="*.pptx") returned 0
	[0132.577] lstrlenA (lpString="*.pptx") returned 6
	[0132.577] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk", pszSpec="*.txt") returned 0
	[0132.577] lstrlenA (lpString="*.txt") returned 5
	[0132.577] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk", pszSpec="*.pdf") returned 0
	[0132.577] lstrlenA (lpString="*.pdf") returned 5
	[0132.577] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk", pszSpec="*.htm") returned 0
	[0132.577] lstrlenA (lpString="*.htm") returned 5
	[0132.577] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk", pszSpec="*.html") returned 0
	[0132.577] lstrlenA (lpString="*.html") returned 6
	[0132.577] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk", pszSpec="*.mdb") returned 0
	[0132.577] lstrlenA (lpString="*.mdb") returned 5
	[0132.577] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk", pszSpec="*.pfx") returned 0
	[0132.577] lstrlenA (lpString="*.pfx") returned 5
	[0132.577] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk", pszSpec="*.md") returned 0
	[0132.577] lstrlenA (lpString="*.md") returned 4
	[0132.577] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk", pszSpec="*.lnk") returned 1
	[0132.577] lstrlenA (lpString="*.lnk") returned 5
	[0132.578] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk"
	[0132.578] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk"
	[0132.578] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk."
	[0132.578] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk.exe"
	[0132.578] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qi2uz.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.578] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4c6
	[0132.578] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5079726c, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x5079726c, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5079726c, dwHighDateTime=0x1d543d9)) returned 1
	[0132.578] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.578] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x484, lpOverlapped=0x0) returned 1
	[0132.581] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk") returned="QI2uz.lnk"
	[0132.581] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.581] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x484, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x484, lpOverlapped=0x0) returned 1
	[0132.581] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.582] CloseHandle (hObject=0x21c) returned 1
	[0132.582] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qi2uz.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qi2uz.lnk.exe")) returned 1
	[0132.582] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e9b895a, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x5245b858, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x5245b858, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x461, dwReserved0=0x0, dwReserved1=0x0, cFileName="QnRzP0VE.lnk", cAlternateFileName="")) returned 1
	[0132.582] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.582] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="QnRzP0VE.lnk") returned -1
	[0132.582] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="QnRzP0VE.lnk") returned -1
	[0132.582] lstrcmpiA (lpString1="", lpString2="QnRzP0VE.lnk") returned -1
	[0132.582] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QI2uz.lnk") returned="QI2uz.lnk"
	[0132.582] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.582] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.582] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.582] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.583] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="QnRzP0VE.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk"
	[0132.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk", pszSpec="*.zip") returned 0
	[0132.583] lstrlenA (lpString="*.zip") returned 5
	[0132.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk", pszSpec="*.rar") returned 0
	[0132.583] lstrlenA (lpString="*.rar") returned 5
	[0132.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk", pszSpec="*.7z") returned 0
	[0132.583] lstrlenA (lpString="*.7z") returned 4
	[0132.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk", pszSpec="*.tar") returned 0
	[0132.583] lstrlenA (lpString="*.tar") returned 5
	[0132.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk", pszSpec="*.gzip") returned 0
	[0132.583] lstrlenA (lpString="*.gzip") returned 6
	[0132.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk", pszSpec="*.jpg") returned 0
	[0132.583] lstrlenA (lpString="*.jpg") returned 5
	[0132.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk", pszSpec="*.jpeg") returned 0
	[0132.583] lstrlenA (lpString="*.jpeg") returned 6
	[0132.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk", pszSpec="*.bmp") returned 0
	[0132.583] lstrlenA (lpString="*.bmp") returned 5
	[0132.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk", pszSpec="*.gif") returned 0
	[0132.583] lstrlenA (lpString="*.gif") returned 5
	[0132.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk", pszSpec="*.png") returned 0
	[0132.583] lstrlenA (lpString="*.png") returned 5
	[0132.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk", pszSpec="*.doc") returned 0
	[0132.583] lstrlenA (lpString="*.doc") returned 5
	[0132.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk", pszSpec="*.docx") returned 0
	[0132.583] lstrlenA (lpString="*.docx") returned 6
	[0132.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk", pszSpec="*.xls") returned 0
	[0132.583] lstrlenA (lpString="*.xls") returned 5
	[0132.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk", pszSpec="*.xlsx") returned 0
	[0132.583] lstrlenA (lpString="*.xlsx") returned 6
	[0132.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk", pszSpec="*.ppt") returned 0
	[0132.583] lstrlenA (lpString="*.ppt") returned 5
	[0132.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk", pszSpec="*.pptx") returned 0
	[0132.583] lstrlenA (lpString="*.pptx") returned 6
	[0132.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk", pszSpec="*.txt") returned 0
	[0132.583] lstrlenA (lpString="*.txt") returned 5
	[0132.584] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk", pszSpec="*.pdf") returned 0
	[0132.584] lstrlenA (lpString="*.pdf") returned 5
	[0132.584] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk", pszSpec="*.htm") returned 0
	[0132.584] lstrlenA (lpString="*.htm") returned 5
	[0132.584] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk", pszSpec="*.html") returned 0
	[0132.584] lstrlenA (lpString="*.html") returned 6
	[0132.584] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk", pszSpec="*.mdb") returned 0
	[0132.584] lstrlenA (lpString="*.mdb") returned 5
	[0132.584] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk", pszSpec="*.pfx") returned 0
	[0132.584] lstrlenA (lpString="*.pfx") returned 5
	[0132.584] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk", pszSpec="*.md") returned 0
	[0132.584] lstrlenA (lpString="*.md") returned 4
	[0132.584] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk", pszSpec="*.lnk") returned 1
	[0132.584] lstrlenA (lpString="*.lnk") returned 5
	[0132.584] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk"
	[0132.584] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk"
	[0132.584] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk."
	[0132.584] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk.exe"
	[0132.586] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qnrzp0ve.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.586] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x461
	[0132.586] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1e9b895a, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x5245b858, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5245b858, dwHighDateTime=0x1d543d9)) returned 1
	[0132.586] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.586] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x41f, lpOverlapped=0x0) returned 1
	[0132.587] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk") returned="QnRzP0VE.lnk"
	[0132.587] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.587] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x41f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x41f, lpOverlapped=0x0) returned 1
	[0132.587] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.587] CloseHandle (hObject=0x21c) returned 1
	[0132.587] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qnrzp0ve.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qnrzp0ve.lnk.exe")) returned 1
	[0132.588] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x439f5ee6, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x439f5ee6, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x439f5ee6, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="QpiZcMo4JW5wvjMvbpXM.lnk", cAlternateFileName="QPIZCM~1.LNK")) returned 1
	[0132.588] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.588] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="QpiZcMo4JW5wvjMvbpXM.lnk") returned -1
	[0132.588] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="QpiZcMo4JW5wvjMvbpXM.lnk") returned -1
	[0132.588] lstrcmpiA (lpString1="", lpString2="QpiZcMo4JW5wvjMvbpXM.lnk") returned -1
	[0132.588] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QnRzP0VE.lnk") returned="QnRzP0VE.lnk"
	[0132.588] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.588] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.588] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.588] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.588] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="QpiZcMo4JW5wvjMvbpXM.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk"
	[0132.588] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk", pszSpec="*.zip") returned 0
	[0132.588] lstrlenA (lpString="*.zip") returned 5
	[0132.588] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk", pszSpec="*.rar") returned 0
	[0132.588] lstrlenA (lpString="*.rar") returned 5
	[0132.588] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk", pszSpec="*.7z") returned 0
	[0132.588] lstrlenA (lpString="*.7z") returned 4
	[0132.588] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk", pszSpec="*.tar") returned 0
	[0132.588] lstrlenA (lpString="*.tar") returned 5
	[0132.588] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk", pszSpec="*.gzip") returned 0
	[0132.589] lstrlenA (lpString="*.gzip") returned 6
	[0132.589] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk", pszSpec="*.jpg") returned 0
	[0132.589] lstrlenA (lpString="*.jpg") returned 5
	[0132.589] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk", pszSpec="*.jpeg") returned 0
	[0132.589] lstrlenA (lpString="*.jpeg") returned 6
	[0132.589] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk", pszSpec="*.bmp") returned 0
	[0132.589] lstrlenA (lpString="*.bmp") returned 5
	[0132.589] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk", pszSpec="*.gif") returned 0
	[0132.589] lstrlenA (lpString="*.gif") returned 5
	[0132.589] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk", pszSpec="*.png") returned 0
	[0132.589] lstrlenA (lpString="*.png") returned 5
	[0132.589] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk", pszSpec="*.doc") returned 0
	[0132.589] lstrlenA (lpString="*.doc") returned 5
	[0132.589] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk", pszSpec="*.docx") returned 0
	[0132.589] lstrlenA (lpString="*.docx") returned 6
	[0132.589] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk", pszSpec="*.xls") returned 0
	[0132.589] lstrlenA (lpString="*.xls") returned 5
	[0132.589] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk", pszSpec="*.xlsx") returned 0
	[0132.589] lstrlenA (lpString="*.xlsx") returned 6
	[0132.589] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk", pszSpec="*.ppt") returned 0
	[0132.589] lstrlenA (lpString="*.ppt") returned 5
	[0132.589] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk", pszSpec="*.pptx") returned 0
	[0132.589] lstrlenA (lpString="*.pptx") returned 6
	[0132.589] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk", pszSpec="*.txt") returned 0
	[0132.589] lstrlenA (lpString="*.txt") returned 5
	[0132.589] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk", pszSpec="*.pdf") returned 0
	[0132.589] lstrlenA (lpString="*.pdf") returned 5
	[0132.589] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk", pszSpec="*.htm") returned 0
	[0132.589] lstrlenA (lpString="*.htm") returned 5
	[0132.589] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk", pszSpec="*.html") returned 0
	[0132.589] lstrlenA (lpString="*.html") returned 6
	[0132.589] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk", pszSpec="*.mdb") returned 0
	[0132.589] lstrlenA (lpString="*.mdb") returned 5
	[0132.589] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk", pszSpec="*.pfx") returned 0
	[0132.589] lstrlenA (lpString="*.pfx") returned 5
	[0132.589] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk", pszSpec="*.md") returned 0
	[0132.590] lstrlenA (lpString="*.md") returned 4
	[0132.590] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk", pszSpec="*.lnk") returned 1
	[0132.590] lstrlenA (lpString="*.lnk") returned 5
	[0132.590] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk"
	[0132.590] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk"
	[0132.590] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk."
	[0132.590] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk.exe"
	[0132.590] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qpizcmo4jw5wvjmvbpxm.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.590] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f8
	[0132.590] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x439f5ee6, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x439f5ee6, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x439f5ee6, dwHighDateTime=0x1d543d9)) returned 1
	[0132.590] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.590] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x3b6, lpOverlapped=0x0) returned 1
	[0132.591] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk") returned="QpiZcMo4JW5wvjMvbpXM.lnk"
	[0132.591] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.591] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x3b6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x3b6, lpOverlapped=0x0) returned 1
	[0132.591] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.591] CloseHandle (hObject=0x21c) returned 1
	[0132.591] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qpizcmo4jw5wvjmvbpxm.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qpizcmo4jw5wvjmvbpxm.lnk.exe")) returned 1
	[0132.592] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x517186f1, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x517186f1, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x517186f1, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x397, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qwy-XTTO.lnk", cAlternateFileName="")) returned 1
	[0132.592] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.592] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Qwy-XTTO.lnk") returned -1
	[0132.592] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Qwy-XTTO.lnk") returned -1
	[0132.592] lstrcmpiA (lpString1="", lpString2="Qwy-XTTO.lnk") returned -1
	[0132.592] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QpiZcMo4JW5wvjMvbpXM.lnk") returned="QpiZcMo4JW5wvjMvbpXM.lnk"
	[0132.592] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.592] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.592] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.592] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.592] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="Qwy-XTTO.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk"
	[0132.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk", pszSpec="*.zip") returned 0
	[0132.592] lstrlenA (lpString="*.zip") returned 5
	[0132.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk", pszSpec="*.rar") returned 0
	[0132.592] lstrlenA (lpString="*.rar") returned 5
	[0132.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk", pszSpec="*.7z") returned 0
	[0132.592] lstrlenA (lpString="*.7z") returned 4
	[0132.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk", pszSpec="*.tar") returned 0
	[0132.592] lstrlenA (lpString="*.tar") returned 5
	[0132.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk", pszSpec="*.gzip") returned 0
	[0132.592] lstrlenA (lpString="*.gzip") returned 6
	[0132.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk", pszSpec="*.jpg") returned 0
	[0132.593] lstrlenA (lpString="*.jpg") returned 5
	[0132.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk", pszSpec="*.jpeg") returned 0
	[0132.593] lstrlenA (lpString="*.jpeg") returned 6
	[0132.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk", pszSpec="*.bmp") returned 0
	[0132.593] lstrlenA (lpString="*.bmp") returned 5
	[0132.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk", pszSpec="*.gif") returned 0
	[0132.593] lstrlenA (lpString="*.gif") returned 5
	[0132.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk", pszSpec="*.png") returned 0
	[0132.593] lstrlenA (lpString="*.png") returned 5
	[0132.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk", pszSpec="*.doc") returned 0
	[0132.593] lstrlenA (lpString="*.doc") returned 5
	[0132.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk", pszSpec="*.docx") returned 0
	[0132.593] lstrlenA (lpString="*.docx") returned 6
	[0132.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk", pszSpec="*.xls") returned 0
	[0132.593] lstrlenA (lpString="*.xls") returned 5
	[0132.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk", pszSpec="*.xlsx") returned 0
	[0132.593] lstrlenA (lpString="*.xlsx") returned 6
	[0132.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk", pszSpec="*.ppt") returned 0
	[0132.593] lstrlenA (lpString="*.ppt") returned 5
	[0132.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk", pszSpec="*.pptx") returned 0
	[0132.593] lstrlenA (lpString="*.pptx") returned 6
	[0132.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk", pszSpec="*.txt") returned 0
	[0132.593] lstrlenA (lpString="*.txt") returned 5
	[0132.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk", pszSpec="*.pdf") returned 0
	[0132.593] lstrlenA (lpString="*.pdf") returned 5
	[0132.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk", pszSpec="*.htm") returned 0
	[0132.593] lstrlenA (lpString="*.htm") returned 5
	[0132.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk", pszSpec="*.html") returned 0
	[0132.593] lstrlenA (lpString="*.html") returned 6
	[0132.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk", pszSpec="*.mdb") returned 0
	[0132.593] lstrlenA (lpString="*.mdb") returned 5
	[0132.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk", pszSpec="*.pfx") returned 0
	[0132.593] lstrlenA (lpString="*.pfx") returned 5
	[0132.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk", pszSpec="*.md") returned 0
	[0132.593] lstrlenA (lpString="*.md") returned 4
	[0132.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk", pszSpec="*.lnk") returned 1
	[0132.593] lstrlenA (lpString="*.lnk") returned 5
	[0132.594] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk"
	[0132.594] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk"
	[0132.594] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk."
	[0132.594] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk.exe"
	[0132.594] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qwy-xtto.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.594] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x397
	[0132.594] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x517186f1, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x517186f1, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x517186f1, dwHighDateTime=0x1d543d9)) returned 1
	[0132.594] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.594] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x355, lpOverlapped=0x0) returned 1
	[0132.595] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk") returned="Qwy-XTTO.lnk"
	[0132.595] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.595] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x355, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x355, lpOverlapped=0x0) returned 1
	[0132.595] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.595] CloseHandle (hObject=0x21c) returned 1
	[0132.595] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qwy-xtto.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qwy-xtto.lnk.exe")) returned 1
	[0132.596] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463a7b4a, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x463a7b4a, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x463a7b4a, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="r-mDosQlW1S2JDE4H7G7.lnk", cAlternateFileName="R-MDOS~1.LNK")) returned 1
	[0132.596] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.596] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="r-mDosQlW1S2JDE4H7G7.lnk") returned -1
	[0132.596] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="r-mDosQlW1S2JDE4H7G7.lnk") returned -1
	[0132.596] lstrcmpiA (lpString1="", lpString2="r-mDosQlW1S2JDE4H7G7.lnk") returned -1
	[0132.596] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qwy-XTTO.lnk") returned="Qwy-XTTO.lnk"
	[0132.596] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.596] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.596] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.596] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.596] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="r-mDosQlW1S2JDE4H7G7.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk"
	[0132.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk", pszSpec="*.zip") returned 0
	[0132.596] lstrlenA (lpString="*.zip") returned 5
	[0132.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk", pszSpec="*.rar") returned 0
	[0132.596] lstrlenA (lpString="*.rar") returned 5
	[0132.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk", pszSpec="*.7z") returned 0
	[0132.596] lstrlenA (lpString="*.7z") returned 4
	[0132.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk", pszSpec="*.tar") returned 0
	[0132.596] lstrlenA (lpString="*.tar") returned 5
	[0132.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk", pszSpec="*.gzip") returned 0
	[0132.596] lstrlenA (lpString="*.gzip") returned 6
	[0132.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk", pszSpec="*.jpg") returned 0
	[0132.596] lstrlenA (lpString="*.jpg") returned 5
	[0132.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk", pszSpec="*.jpeg") returned 0
	[0132.596] lstrlenA (lpString="*.jpeg") returned 6
	[0132.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk", pszSpec="*.bmp") returned 0
	[0132.597] lstrlenA (lpString="*.bmp") returned 5
	[0132.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk", pszSpec="*.gif") returned 0
	[0132.597] lstrlenA (lpString="*.gif") returned 5
	[0132.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk", pszSpec="*.png") returned 0
	[0132.597] lstrlenA (lpString="*.png") returned 5
	[0132.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk", pszSpec="*.doc") returned 0
	[0132.597] lstrlenA (lpString="*.doc") returned 5
	[0132.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk", pszSpec="*.docx") returned 0
	[0132.597] lstrlenA (lpString="*.docx") returned 6
	[0132.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk", pszSpec="*.xls") returned 0
	[0132.597] lstrlenA (lpString="*.xls") returned 5
	[0132.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk", pszSpec="*.xlsx") returned 0
	[0132.597] lstrlenA (lpString="*.xlsx") returned 6
	[0132.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk", pszSpec="*.ppt") returned 0
	[0132.597] lstrlenA (lpString="*.ppt") returned 5
	[0132.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk", pszSpec="*.pptx") returned 0
	[0132.597] lstrlenA (lpString="*.pptx") returned 6
	[0132.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk", pszSpec="*.txt") returned 0
	[0132.597] lstrlenA (lpString="*.txt") returned 5
	[0132.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk", pszSpec="*.pdf") returned 0
	[0132.597] lstrlenA (lpString="*.pdf") returned 5
	[0132.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk", pszSpec="*.htm") returned 0
	[0132.597] lstrlenA (lpString="*.htm") returned 5
	[0132.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk", pszSpec="*.html") returned 0
	[0132.597] lstrlenA (lpString="*.html") returned 6
	[0132.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk", pszSpec="*.mdb") returned 0
	[0132.597] lstrlenA (lpString="*.mdb") returned 5
	[0132.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk", pszSpec="*.pfx") returned 0
	[0132.597] lstrlenA (lpString="*.pfx") returned 5
	[0132.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk", pszSpec="*.md") returned 0
	[0132.597] lstrlenA (lpString="*.md") returned 4
	[0132.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk", pszSpec="*.lnk") returned 1
	[0132.597] lstrlenA (lpString="*.lnk") returned 5
	[0132.597] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk"
	[0132.597] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk"
	[0132.597] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk."
	[0132.598] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk.exe"
	[0132.598] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\r-mdosqlw1s2jde4h7g7.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.598] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ec
	[0132.598] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x463a7b4a, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x463a7b4a, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x463a7b4a, dwHighDateTime=0x1d543d9)) returned 1
	[0132.598] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.598] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x3aa, lpOverlapped=0x0) returned 1
	[0132.599] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk") returned="r-mDosQlW1S2JDE4H7G7.lnk"
	[0132.599] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.599] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x3aa, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x3aa, lpOverlapped=0x0) returned 1
	[0132.599] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.599] CloseHandle (hObject=0x21c) returned 1
	[0132.599] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\r-mdosqlw1s2jde4h7g7.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\r-mdosqlw1s2jde4h7g7.lnk.exe")) returned 1
	[0132.600] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x506660ef, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x506660ef, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x506660ef, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x56a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReREFaTpiB.lnk", cAlternateFileName="REREFA~1.LNK")) returned 1
	[0132.600] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.600] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="ReREFaTpiB.lnk") returned -1
	[0132.600] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="ReREFaTpiB.lnk") returned -1
	[0132.600] lstrcmpiA (lpString1="", lpString2="ReREFaTpiB.lnk") returned -1
	[0132.600] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r-mDosQlW1S2JDE4H7G7.lnk") returned="r-mDosQlW1S2JDE4H7G7.lnk"
	[0132.600] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.600] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.600] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.600] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.600] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ReREFaTpiB.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk"
	[0132.600] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk", pszSpec="*.zip") returned 0
	[0132.600] lstrlenA (lpString="*.zip") returned 5
	[0132.600] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk", pszSpec="*.rar") returned 0
	[0132.600] lstrlenA (lpString="*.rar") returned 5
	[0132.600] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk", pszSpec="*.7z") returned 0
	[0132.600] lstrlenA (lpString="*.7z") returned 4
	[0132.600] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk", pszSpec="*.tar") returned 0
	[0132.600] lstrlenA (lpString="*.tar") returned 5
	[0132.600] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk", pszSpec="*.gzip") returned 0
	[0132.600] lstrlenA (lpString="*.gzip") returned 6
	[0132.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk", pszSpec="*.jpg") returned 0
	[0132.601] lstrlenA (lpString="*.jpg") returned 5
	[0132.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk", pszSpec="*.jpeg") returned 0
	[0132.601] lstrlenA (lpString="*.jpeg") returned 6
	[0132.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk", pszSpec="*.bmp") returned 0
	[0132.601] lstrlenA (lpString="*.bmp") returned 5
	[0132.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk", pszSpec="*.gif") returned 0
	[0132.601] lstrlenA (lpString="*.gif") returned 5
	[0132.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk", pszSpec="*.png") returned 0
	[0132.601] lstrlenA (lpString="*.png") returned 5
	[0132.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk", pszSpec="*.doc") returned 0
	[0132.601] lstrlenA (lpString="*.doc") returned 5
	[0132.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk", pszSpec="*.docx") returned 0
	[0132.601] lstrlenA (lpString="*.docx") returned 6
	[0132.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk", pszSpec="*.xls") returned 0
	[0132.601] lstrlenA (lpString="*.xls") returned 5
	[0132.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk", pszSpec="*.xlsx") returned 0
	[0132.601] lstrlenA (lpString="*.xlsx") returned 6
	[0132.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk", pszSpec="*.ppt") returned 0
	[0132.601] lstrlenA (lpString="*.ppt") returned 5
	[0132.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk", pszSpec="*.pptx") returned 0
	[0132.601] lstrlenA (lpString="*.pptx") returned 6
	[0132.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk", pszSpec="*.txt") returned 0
	[0132.601] lstrlenA (lpString="*.txt") returned 5
	[0132.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk", pszSpec="*.pdf") returned 0
	[0132.601] lstrlenA (lpString="*.pdf") returned 5
	[0132.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk", pszSpec="*.htm") returned 0
	[0132.601] lstrlenA (lpString="*.htm") returned 5
	[0132.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk", pszSpec="*.html") returned 0
	[0132.601] lstrlenA (lpString="*.html") returned 6
	[0132.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk", pszSpec="*.mdb") returned 0
	[0132.601] lstrlenA (lpString="*.mdb") returned 5
	[0132.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk", pszSpec="*.pfx") returned 0
	[0132.601] lstrlenA (lpString="*.pfx") returned 5
	[0132.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk", pszSpec="*.md") returned 0
	[0132.601] lstrlenA (lpString="*.md") returned 4
	[0132.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk", pszSpec="*.lnk") returned 1
	[0132.602] lstrlenA (lpString="*.lnk") returned 5
	[0132.602] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk"
	[0132.602] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk"
	[0132.602] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk."
	[0132.602] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk.exe"
	[0132.602] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rerefatpib.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.602] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x56a
	[0132.602] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x506660ef, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x506660ef, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x506660ef, dwHighDateTime=0x1d543d9)) returned 1
	[0132.602] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.602] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x528, lpOverlapped=0x0) returned 1
	[0132.603] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk") returned="ReREFaTpiB.lnk"
	[0132.603] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.603] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x528, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x528, lpOverlapped=0x0) returned 1
	[0132.603] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.603] CloseHandle (hObject=0x21c) returned 1
	[0132.603] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rerefatpib.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rerefatpib.lnk.exe")) returned 1
	[0132.604] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f5b50b5, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x2f5b50b5, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x2f5b50b5, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="rEUxuVQBw-mt.lnk", cAlternateFileName="REUXUV~1.LNK")) returned 1
	[0132.604] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.604] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="rEUxuVQBw-mt.lnk") returned -1
	[0132.604] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="rEUxuVQBw-mt.lnk") returned -1
	[0132.604] lstrcmpiA (lpString1="", lpString2="rEUxuVQBw-mt.lnk") returned -1
	[0132.604] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ReREFaTpiB.lnk") returned="ReREFaTpiB.lnk"
	[0132.604] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.604] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.604] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.604] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.604] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="rEUxuVQBw-mt.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk"
	[0132.604] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk", pszSpec="*.zip") returned 0
	[0132.604] lstrlenA (lpString="*.zip") returned 5
	[0132.604] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk", pszSpec="*.rar") returned 0
	[0132.604] lstrlenA (lpString="*.rar") returned 5
	[0132.604] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk", pszSpec="*.7z") returned 0
	[0132.604] lstrlenA (lpString="*.7z") returned 4
	[0132.604] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk", pszSpec="*.tar") returned 0
	[0132.604] lstrlenA (lpString="*.tar") returned 5
	[0132.604] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk", pszSpec="*.gzip") returned 0
	[0132.604] lstrlenA (lpString="*.gzip") returned 6
	[0132.604] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk", pszSpec="*.jpg") returned 0
	[0132.605] lstrlenA (lpString="*.jpg") returned 5
	[0132.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk", pszSpec="*.jpeg") returned 0
	[0132.605] lstrlenA (lpString="*.jpeg") returned 6
	[0132.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk", pszSpec="*.bmp") returned 0
	[0132.605] lstrlenA (lpString="*.bmp") returned 5
	[0132.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk", pszSpec="*.gif") returned 0
	[0132.605] lstrlenA (lpString="*.gif") returned 5
	[0132.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk", pszSpec="*.png") returned 0
	[0132.605] lstrlenA (lpString="*.png") returned 5
	[0132.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk", pszSpec="*.doc") returned 0
	[0132.605] lstrlenA (lpString="*.doc") returned 5
	[0132.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk", pszSpec="*.docx") returned 0
	[0132.605] lstrlenA (lpString="*.docx") returned 6
	[0132.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk", pszSpec="*.xls") returned 0
	[0132.605] lstrlenA (lpString="*.xls") returned 5
	[0132.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk", pszSpec="*.xlsx") returned 0
	[0132.605] lstrlenA (lpString="*.xlsx") returned 6
	[0132.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk", pszSpec="*.ppt") returned 0
	[0132.605] lstrlenA (lpString="*.ppt") returned 5
	[0132.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk", pszSpec="*.pptx") returned 0
	[0132.605] lstrlenA (lpString="*.pptx") returned 6
	[0132.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk", pszSpec="*.txt") returned 0
	[0132.605] lstrlenA (lpString="*.txt") returned 5
	[0132.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk", pszSpec="*.pdf") returned 0
	[0132.605] lstrlenA (lpString="*.pdf") returned 5
	[0132.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk", pszSpec="*.htm") returned 0
	[0132.605] lstrlenA (lpString="*.htm") returned 5
	[0132.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk", pszSpec="*.html") returned 0
	[0132.605] lstrlenA (lpString="*.html") returned 6
	[0132.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk", pszSpec="*.mdb") returned 0
	[0132.605] lstrlenA (lpString="*.mdb") returned 5
	[0132.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk", pszSpec="*.pfx") returned 0
	[0132.605] lstrlenA (lpString="*.pfx") returned 5
	[0132.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk", pszSpec="*.md") returned 0
	[0132.605] lstrlenA (lpString="*.md") returned 4
	[0132.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk", pszSpec="*.lnk") returned 1
	[0132.605] lstrlenA (lpString="*.lnk") returned 5
	[0132.606] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk"
	[0132.606] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk"
	[0132.606] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk."
	[0132.606] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk.exe"
	[0132.606] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\reuxuvqbw-mt.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.606] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e5
	[0132.606] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x2f5b50b5, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x2f5b50b5, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x2f5b50b5, dwHighDateTime=0x1d543d9)) returned 1
	[0132.606] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.606] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x3a3, lpOverlapped=0x0) returned 1
	[0132.607] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk") returned="rEUxuVQBw-mt.lnk"
	[0132.607] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.607] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x3a3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x3a3, lpOverlapped=0x0) returned 1
	[0132.607] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.607] CloseHandle (hObject=0x21c) returned 1
	[0132.607] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\reuxuvqbw-mt.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\reuxuvqbw-mt.lnk.exe")) returned 1
	[0132.608] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40e6baca, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x40e6baca, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x40e6baca, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="rIXFL TdixDzTGvn_jNO.lnk", cAlternateFileName="RIXFLT~1.LNK")) returned 1
	[0132.608] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.608] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="rIXFL TdixDzTGvn_jNO.lnk") returned -1
	[0132.608] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="rIXFL TdixDzTGvn_jNO.lnk") returned -1
	[0132.608] lstrcmpiA (lpString1="", lpString2="rIXFL TdixDzTGvn_jNO.lnk") returned -1
	[0132.608] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rEUxuVQBw-mt.lnk") returned="rEUxuVQBw-mt.lnk"
	[0132.608] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.608] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.608] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.608] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.608] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="rIXFL TdixDzTGvn_jNO.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk"
	[0132.608] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk", pszSpec="*.zip") returned 0
	[0132.608] lstrlenA (lpString="*.zip") returned 5
	[0132.608] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk", pszSpec="*.rar") returned 0
	[0132.608] lstrlenA (lpString="*.rar") returned 5
	[0132.608] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk", pszSpec="*.7z") returned 0
	[0132.608] lstrlenA (lpString="*.7z") returned 4
	[0132.608] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk", pszSpec="*.tar") returned 0
	[0132.608] lstrlenA (lpString="*.tar") returned 5
	[0132.608] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk", pszSpec="*.gzip") returned 0
	[0132.609] lstrlenA (lpString="*.gzip") returned 6
	[0132.609] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk", pszSpec="*.jpg") returned 0
	[0132.609] lstrlenA (lpString="*.jpg") returned 5
	[0132.609] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk", pszSpec="*.jpeg") returned 0
	[0132.609] lstrlenA (lpString="*.jpeg") returned 6
	[0132.609] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk", pszSpec="*.bmp") returned 0
	[0132.609] lstrlenA (lpString="*.bmp") returned 5
	[0132.609] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk", pszSpec="*.gif") returned 0
	[0132.609] lstrlenA (lpString="*.gif") returned 5
	[0132.609] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk", pszSpec="*.png") returned 0
	[0132.609] lstrlenA (lpString="*.png") returned 5
	[0132.609] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk", pszSpec="*.doc") returned 0
	[0132.609] lstrlenA (lpString="*.doc") returned 5
	[0132.609] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk", pszSpec="*.docx") returned 0
	[0132.609] lstrlenA (lpString="*.docx") returned 6
	[0132.609] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk", pszSpec="*.xls") returned 0
	[0132.609] lstrlenA (lpString="*.xls") returned 5
	[0132.609] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk", pszSpec="*.xlsx") returned 0
	[0132.609] lstrlenA (lpString="*.xlsx") returned 6
	[0132.609] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk", pszSpec="*.ppt") returned 0
	[0132.609] lstrlenA (lpString="*.ppt") returned 5
	[0132.609] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk", pszSpec="*.pptx") returned 0
	[0132.609] lstrlenA (lpString="*.pptx") returned 6
	[0132.609] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk", pszSpec="*.txt") returned 0
	[0132.609] lstrlenA (lpString="*.txt") returned 5
	[0132.609] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk", pszSpec="*.pdf") returned 0
	[0132.609] lstrlenA (lpString="*.pdf") returned 5
	[0132.609] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk", pszSpec="*.htm") returned 0
	[0132.609] lstrlenA (lpString="*.htm") returned 5
	[0132.609] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk", pszSpec="*.html") returned 0
	[0132.609] lstrlenA (lpString="*.html") returned 6
	[0132.609] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk", pszSpec="*.mdb") returned 0
	[0132.609] lstrlenA (lpString="*.mdb") returned 5
	[0132.609] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk", pszSpec="*.pfx") returned 0
	[0132.609] lstrlenA (lpString="*.pfx") returned 5
	[0132.609] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk", pszSpec="*.md") returned 0
	[0132.609] lstrlenA (lpString="*.md") returned 4
	[0132.609] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk", pszSpec="*.lnk") returned 1
	[0132.610] lstrlenA (lpString="*.lnk") returned 5
	[0132.610] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk"
	[0132.610] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk"
	[0132.610] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk."
	[0132.610] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk.exe"
	[0132.610] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rixfl tdixdztgvn_jno.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.610] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ba
	[0132.610] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x40e6baca, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x40e6baca, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x40e6baca, dwHighDateTime=0x1d543d9)) returned 1
	[0132.610] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.610] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x278, lpOverlapped=0x0) returned 1
	[0132.611] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk") returned="rIXFL TdixDzTGvn_jNO.lnk"
	[0132.611] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.611] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x278, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x278, lpOverlapped=0x0) returned 1
	[0132.611] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.611] CloseHandle (hObject=0x21c) returned 1
	[0132.611] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rixfl tdixdztgvn_jno.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rixfl tdixdztgvn_jno.lnk.exe")) returned 1
	[0132.612] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4829f23b, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x4829f23b, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x4829f23b, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="rJwvSJl.lnk", cAlternateFileName="")) returned 1
	[0132.612] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.612] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="rJwvSJl.lnk") returned -1
	[0132.612] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="rJwvSJl.lnk") returned -1
	[0132.612] lstrcmpiA (lpString1="", lpString2="rJwvSJl.lnk") returned -1
	[0132.612] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIXFL TdixDzTGvn_jNO.lnk") returned="rIXFL TdixDzTGvn_jNO.lnk"
	[0132.612] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.612] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.612] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.612] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.612] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="rJwvSJl.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rJwvSJl.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rJwvSJl.lnk"
	[0132.612] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rJwvSJl.lnk", pszSpec="*.zip") returned 0
	[0132.612] lstrlenA (lpString="*.zip") returned 5
	[0132.612] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rJwvSJl.lnk", pszSpec="*.rar") returned 0
	[0132.612] lstrlenA (lpString="*.rar") returned 5
	[0132.612] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rJwvSJl.lnk", pszSpec="*.7z") returned 0
	[0132.612] lstrlenA (lpString="*.7z") returned 4
	[0132.612] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rJwvSJl.lnk", pszSpec="*.tar") returned 0
	[0132.612] lstrlenA (lpString="*.tar") returned 5
	[0132.612] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rJwvSJl.lnk", pszSpec="*.gzip") returned 0
	[0132.612] lstrlenA (lpString="*.gzip") returned 6
	[0132.612] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rJwvSJl.lnk", pszSpec="*.jpg") returned 0
	[0132.612] lstrlenA (lpString="*.jpg") returned 5
	[0132.612] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rJwvSJl.lnk", pszSpec="*.jpeg") returned 0
	[0132.613] lstrlenA (lpString="*.jpeg") returned 6
	[0132.613] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rJwvSJl.lnk", pszSpec="*.bmp") returned 0
	[0132.613] lstrlenA (lpString="*.bmp") returned 5
	[0132.613] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rJwvSJl.lnk", pszSpec="*.gif") returned 0
	[0132.613] lstrlenA (lpString="*.gif") returned 5
	[0132.613] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rJwvSJl.lnk", pszSpec="*.png") returned 0
	[0132.613] lstrlenA (lpString="*.png") returned 5
	[0132.613] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rJwvSJl.lnk", pszSpec="*.doc") returned 0
	[0132.613] lstrlenA (lpString="*.doc") returned 5
	[0132.613] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rJwvSJl.lnk", pszSpec="*.docx") returned 0
	[0132.613] lstrlenA (lpString="*.docx") returned 6
	[0132.613] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rJwvSJl.lnk", pszSpec="*.xls") returned 0
	[0132.613] lstrlenA (lpString="*.xls") returned 5
	[0132.613] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rJwvSJl.lnk", pszSpec="*.xlsx") returned 0
	[0132.613] lstrlenA (lpString="*.xlsx") returned 6
	[0132.613] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rJwvSJl.lnk", pszSpec="*.ppt") returned 0
	[0132.613] lstrlenA (lpString="*.ppt") returned 5
	[0132.613] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rJwvSJl.lnk", pszSpec="*.pptx") returned 0
	[0132.613] lstrlenA (lpString="*.pptx") returned 6
	[0132.613] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rJwvSJl.lnk", pszSpec="*.txt") returned 0
	[0132.613] lstrlenA (lpString="*.txt") returned 5
	[0132.613] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rJwvSJl.lnk", pszSpec="*.pdf") returned 0
	[0132.613] lstrlenA (lpString="*.pdf") returned 5
	[0132.613] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rJwvSJl.lnk", pszSpec="*.htm") returned 0
	[0132.613] lstrlenA (lpString="*.htm") returned 5
	[0132.613] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rJwvSJl.lnk", pszSpec="*.html") returned 0
	[0132.613] lstrlenA (lpString="*.html") returned 6
	[0132.613] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rJwvSJl.lnk", pszSpec="*.mdb") returned 0
	[0132.613] lstrlenA (lpString="*.mdb") returned 5
	[0132.613] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rJwvSJl.lnk", pszSpec="*.pfx") returned 0
	[0132.613] lstrlenA (lpString="*.pfx") returned 5
	[0132.613] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rJwvSJl.lnk", pszSpec="*.md") returned 0
	[0132.613] lstrlenA (lpString="*.md") returned 4
	[0132.613] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rJwvSJl.lnk", pszSpec="*.lnk") returned 1
	[0132.613] lstrlenA (lpString="*.lnk") returned 5
	[0132.614] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rJwvSJl.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rjwvsjl.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.614] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x566
	[0132.614] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4829f23b, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x4829f23b, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4829f23b, dwHighDateTime=0x1d543d9)) returned 1
	[0132.614] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.614] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x524, lpOverlapped=0x0) returned 1
	[0132.615] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rJwvSJl.lnk") returned="rJwvSJl.lnk"
	[0132.615] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.615] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x524, lpOverlapped=0x0) returned 1
	[0132.615] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.615] CloseHandle (hObject=0x21c) returned 1
	[0132.615] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rJwvSJl.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rjwvsjl.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rJwvSJl.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rjwvsjl.lnk.exe")) returned 1
	[0132.626] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14acde20, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x5258cd73, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x5258cd73, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x304, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming.lnk", cAlternateFileName="")) returned 1
	[0132.626] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.626] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Roaming.lnk") returned -1
	[0132.626] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Roaming.lnk") returned -1
	[0132.626] lstrcmpiA (lpString1="", lpString2="Roaming.lnk") returned -1
	[0132.626] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rJwvSJl.lnk") returned="rJwvSJl.lnk"
	[0132.626] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.626] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.626] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.626] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="Roaming.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk"
	[0132.626] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk", pszSpec="*.zip") returned 0
	[0132.626] lstrlenA (lpString="*.zip") returned 5
	[0132.626] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk", pszSpec="*.rar") returned 0
	[0132.626] lstrlenA (lpString="*.rar") returned 5
	[0132.626] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk", pszSpec="*.7z") returned 0
	[0132.626] lstrlenA (lpString="*.7z") returned 4
	[0132.626] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk", pszSpec="*.tar") returned 0
	[0132.626] lstrlenA (lpString="*.tar") returned 5
	[0132.626] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk", pszSpec="*.gzip") returned 0
	[0132.626] lstrlenA (lpString="*.gzip") returned 6
	[0132.626] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk", pszSpec="*.jpg") returned 0
	[0132.627] lstrlenA (lpString="*.jpg") returned 5
	[0132.627] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk", pszSpec="*.jpeg") returned 0
	[0132.627] lstrlenA (lpString="*.jpeg") returned 6
	[0132.627] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk", pszSpec="*.bmp") returned 0
	[0132.627] lstrlenA (lpString="*.bmp") returned 5
	[0132.627] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk", pszSpec="*.gif") returned 0
	[0132.627] lstrlenA (lpString="*.gif") returned 5
	[0132.627] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk", pszSpec="*.png") returned 0
	[0132.627] lstrlenA (lpString="*.png") returned 5
	[0132.627] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk", pszSpec="*.doc") returned 0
	[0132.627] lstrlenA (lpString="*.doc") returned 5
	[0132.627] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk", pszSpec="*.docx") returned 0
	[0132.627] lstrlenA (lpString="*.docx") returned 6
	[0132.627] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk", pszSpec="*.xls") returned 0
	[0132.627] lstrlenA (lpString="*.xls") returned 5
	[0132.627] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk", pszSpec="*.xlsx") returned 0
	[0132.627] lstrlenA (lpString="*.xlsx") returned 6
	[0132.627] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk", pszSpec="*.ppt") returned 0
	[0132.627] lstrlenA (lpString="*.ppt") returned 5
	[0132.627] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk", pszSpec="*.pptx") returned 0
	[0132.627] lstrlenA (lpString="*.pptx") returned 6
	[0132.627] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk", pszSpec="*.txt") returned 0
	[0132.627] lstrlenA (lpString="*.txt") returned 5
	[0132.627] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk", pszSpec="*.pdf") returned 0
	[0132.627] lstrlenA (lpString="*.pdf") returned 5
	[0132.627] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk", pszSpec="*.htm") returned 0
	[0132.627] lstrlenA (lpString="*.htm") returned 5
	[0132.627] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk", pszSpec="*.html") returned 0
	[0132.627] lstrlenA (lpString="*.html") returned 6
	[0132.627] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk", pszSpec="*.mdb") returned 0
	[0132.627] lstrlenA (lpString="*.mdb") returned 5
	[0132.627] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk", pszSpec="*.pfx") returned 0
	[0132.627] lstrlenA (lpString="*.pfx") returned 5
	[0132.627] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk", pszSpec="*.md") returned 0
	[0132.627] lstrlenA (lpString="*.md") returned 4
	[0132.628] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk", pszSpec="*.lnk") returned 1
	[0132.628] lstrlenA (lpString="*.lnk") returned 5
	[0132.628] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk"
	[0132.628] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk"
	[0132.628] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk."
	[0132.628] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk.exe"
	[0132.628] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.628] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x304
	[0132.628] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x14acde20, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x5258cd73, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5258cd73, dwHighDateTime=0x1d543d9)) returned 1
	[0132.628] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.628] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x2c2, lpOverlapped=0x0) returned 1
	[0132.629] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk") returned="Roaming.lnk"
	[0132.629] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.629] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x2c2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x2c2, lpOverlapped=0x0) returned 1
	[0132.629] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.629] CloseHandle (hObject=0x21c) returned 1
	[0132.629] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk.exe")) returned 1
	[0132.630] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51eb21ab, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x51eb21ab, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x51eb21ab, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="rOWLU7ipLB1OvGHuTP-Y.lnk", cAlternateFileName="ROWLU7~1.LNK")) returned 1
	[0132.630] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.630] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="rOWLU7ipLB1OvGHuTP-Y.lnk") returned -1
	[0132.630] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="rOWLU7ipLB1OvGHuTP-Y.lnk") returned -1
	[0132.630] lstrcmpiA (lpString1="", lpString2="rOWLU7ipLB1OvGHuTP-Y.lnk") returned -1
	[0132.630] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk") returned="Roaming.lnk"
	[0132.630] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.630] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.630] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.630] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.630] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="rOWLU7ipLB1OvGHuTP-Y.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk"
	[0132.630] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk", pszSpec="*.zip") returned 0
	[0132.630] lstrlenA (lpString="*.zip") returned 5
	[0132.630] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk", pszSpec="*.rar") returned 0
	[0132.630] lstrlenA (lpString="*.rar") returned 5
	[0132.630] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk", pszSpec="*.7z") returned 0
	[0132.630] lstrlenA (lpString="*.7z") returned 4
	[0132.630] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk", pszSpec="*.tar") returned 0
	[0132.630] lstrlenA (lpString="*.tar") returned 5
	[0132.630] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk", pszSpec="*.gzip") returned 0
	[0132.630] lstrlenA (lpString="*.gzip") returned 6
	[0132.631] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk", pszSpec="*.jpg") returned 0
	[0132.631] lstrlenA (lpString="*.jpg") returned 5
	[0132.631] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk", pszSpec="*.jpeg") returned 0
	[0132.631] lstrlenA (lpString="*.jpeg") returned 6
	[0132.631] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk", pszSpec="*.bmp") returned 0
	[0132.631] lstrlenA (lpString="*.bmp") returned 5
	[0132.631] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk", pszSpec="*.gif") returned 0
	[0132.631] lstrlenA (lpString="*.gif") returned 5
	[0132.631] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk", pszSpec="*.png") returned 0
	[0132.631] lstrlenA (lpString="*.png") returned 5
	[0132.631] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk", pszSpec="*.doc") returned 0
	[0132.631] lstrlenA (lpString="*.doc") returned 5
	[0132.631] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk", pszSpec="*.docx") returned 0
	[0132.631] lstrlenA (lpString="*.docx") returned 6
	[0132.631] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk", pszSpec="*.xls") returned 0
	[0132.631] lstrlenA (lpString="*.xls") returned 5
	[0132.631] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk", pszSpec="*.xlsx") returned 0
	[0132.631] lstrlenA (lpString="*.xlsx") returned 6
	[0132.631] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk", pszSpec="*.ppt") returned 0
	[0132.631] lstrlenA (lpString="*.ppt") returned 5
	[0132.631] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk", pszSpec="*.pptx") returned 0
	[0132.631] lstrlenA (lpString="*.pptx") returned 6
	[0132.631] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk", pszSpec="*.txt") returned 0
	[0132.631] lstrlenA (lpString="*.txt") returned 5
	[0132.631] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk", pszSpec="*.pdf") returned 0
	[0132.631] lstrlenA (lpString="*.pdf") returned 5
	[0132.632] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk", pszSpec="*.htm") returned 0
	[0132.632] lstrlenA (lpString="*.htm") returned 5
	[0132.632] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk", pszSpec="*.html") returned 0
	[0132.632] lstrlenA (lpString="*.html") returned 6
	[0132.632] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk", pszSpec="*.mdb") returned 0
	[0132.632] lstrlenA (lpString="*.mdb") returned 5
	[0132.632] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk", pszSpec="*.pfx") returned 0
	[0132.632] lstrlenA (lpString="*.pfx") returned 5
	[0132.632] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk", pszSpec="*.md") returned 0
	[0132.632] lstrlenA (lpString="*.md") returned 4
	[0132.632] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk", pszSpec="*.lnk") returned 1
	[0132.632] lstrlenA (lpString="*.lnk") returned 5
	[0132.632] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk"
	[0132.632] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk"
	[0132.632] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk."
	[0132.632] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk.exe"
	[0132.632] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rowlu7iplb1ovghutp-y.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.632] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ba
	[0132.632] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x51eb21ab, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x51eb21ab, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x51eb21ab, dwHighDateTime=0x1d543d9)) returned 1
	[0132.632] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.633] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x278, lpOverlapped=0x0) returned 1
	[0132.633] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk") returned="rOWLU7ipLB1OvGHuTP-Y.lnk"
	[0132.633] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.633] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x278, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x278, lpOverlapped=0x0) returned 1
	[0132.634] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.634] CloseHandle (hObject=0x21c) returned 1
	[0132.634] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rowlu7iplb1ovghutp-y.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rowlu7iplb1ovghutp-y.lnk.exe")) returned 1
	[0132.634] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f62811b, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x4f62811b, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x4f62811b, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3be, dwReserved0=0x0, dwReserved1=0x0, cFileName="RrDfrHCvzDii-X.flv.lnk", cAlternateFileName="RRDFRH~1.LNK")) returned 1
	[0132.634] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.634] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="RrDfrHCvzDii-X.flv.lnk") returned -1
	[0132.634] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="RrDfrHCvzDii-X.flv.lnk") returned -1
	[0132.635] lstrcmpiA (lpString1="", lpString2="RrDfrHCvzDii-X.flv.lnk") returned -1
	[0132.635] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rOWLU7ipLB1OvGHuTP-Y.lnk") returned="rOWLU7ipLB1OvGHuTP-Y.lnk"
	[0132.635] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.635] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.635] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.635] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.635] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="RrDfrHCvzDii-X.flv.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk"
	[0132.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk", pszSpec="*.zip") returned 0
	[0132.635] lstrlenA (lpString="*.zip") returned 5
	[0132.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk", pszSpec="*.rar") returned 0
	[0132.635] lstrlenA (lpString="*.rar") returned 5
	[0132.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk", pszSpec="*.7z") returned 0
	[0132.635] lstrlenA (lpString="*.7z") returned 4
	[0132.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk", pszSpec="*.tar") returned 0
	[0132.635] lstrlenA (lpString="*.tar") returned 5
	[0132.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk", pszSpec="*.gzip") returned 0
	[0132.635] lstrlenA (lpString="*.gzip") returned 6
	[0132.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk", pszSpec="*.jpg") returned 0
	[0132.635] lstrlenA (lpString="*.jpg") returned 5
	[0132.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk", pszSpec="*.jpeg") returned 0
	[0132.635] lstrlenA (lpString="*.jpeg") returned 6
	[0132.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk", pszSpec="*.bmp") returned 0
	[0132.635] lstrlenA (lpString="*.bmp") returned 5
	[0132.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk", pszSpec="*.gif") returned 0
	[0132.635] lstrlenA (lpString="*.gif") returned 5
	[0132.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk", pszSpec="*.png") returned 0
	[0132.635] lstrlenA (lpString="*.png") returned 5
	[0132.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk", pszSpec="*.doc") returned 0
	[0132.635] lstrlenA (lpString="*.doc") returned 5
	[0132.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk", pszSpec="*.docx") returned 0
	[0132.635] lstrlenA (lpString="*.docx") returned 6
	[0132.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk", pszSpec="*.xls") returned 0
	[0132.636] lstrlenA (lpString="*.xls") returned 5
	[0132.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk", pszSpec="*.xlsx") returned 0
	[0132.636] lstrlenA (lpString="*.xlsx") returned 6
	[0132.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk", pszSpec="*.ppt") returned 0
	[0132.636] lstrlenA (lpString="*.ppt") returned 5
	[0132.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk", pszSpec="*.pptx") returned 0
	[0132.636] lstrlenA (lpString="*.pptx") returned 6
	[0132.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk", pszSpec="*.txt") returned 0
	[0132.636] lstrlenA (lpString="*.txt") returned 5
	[0132.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk", pszSpec="*.pdf") returned 0
	[0132.636] lstrlenA (lpString="*.pdf") returned 5
	[0132.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk", pszSpec="*.htm") returned 0
	[0132.636] lstrlenA (lpString="*.htm") returned 5
	[0132.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk", pszSpec="*.html") returned 0
	[0132.637] lstrlenA (lpString="*.html") returned 6
	[0132.637] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk", pszSpec="*.mdb") returned 0
	[0132.637] lstrlenA (lpString="*.mdb") returned 5
	[0132.637] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk", pszSpec="*.pfx") returned 0
	[0132.637] lstrlenA (lpString="*.pfx") returned 5
	[0132.637] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk", pszSpec="*.md") returned 0
	[0132.637] lstrlenA (lpString="*.md") returned 4
	[0132.637] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk", pszSpec="*.lnk") returned 1
	[0132.637] lstrlenA (lpString="*.lnk") returned 5
	[0132.637] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk"
	[0132.637] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk"
	[0132.637] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk."
	[0132.638] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk.exe"
	[0132.638] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rrdfrhcvzdii-x.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.638] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3be
	[0132.638] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4f62811b, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x4f62811b, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4f62811b, dwHighDateTime=0x1d543d9)) returned 1
	[0132.638] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.638] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x37c, lpOverlapped=0x0) returned 1
	[0132.638] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk") returned="RrDfrHCvzDii-X.flv.lnk"
	[0132.638] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.638] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x37c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x37c, lpOverlapped=0x0) returned 1
	[0132.638] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.639] CloseHandle (hObject=0x21c) returned 1
	[0132.639] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rrdfrhcvzdii-x.flv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rrdfrhcvzdii-x.flv.lnk.exe")) returned 1
	[0132.639] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x522b80bc, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x522b80bc, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x522de046, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtiDr1nEn64E_ktx8_Y.lnk", cAlternateFileName="RTIDR1~1.LNK")) returned 1
	[0132.639] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.639] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="rtiDr1nEn64E_ktx8_Y.lnk") returned -1
	[0132.639] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="rtiDr1nEn64E_ktx8_Y.lnk") returned -1
	[0132.639] lstrcmpiA (lpString1="", lpString2="rtiDr1nEn64E_ktx8_Y.lnk") returned -1
	[0132.639] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrDfrHCvzDii-X.flv.lnk") returned="RrDfrHCvzDii-X.flv.lnk"
	[0132.639] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.639] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.640] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.640] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.640] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="rtiDr1nEn64E_ktx8_Y.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk"
	[0132.640] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk", pszSpec="*.zip") returned 0
	[0132.640] lstrlenA (lpString="*.zip") returned 5
	[0132.640] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk", pszSpec="*.rar") returned 0
	[0132.640] lstrlenA (lpString="*.rar") returned 5
	[0132.640] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk", pszSpec="*.7z") returned 0
	[0132.640] lstrlenA (lpString="*.7z") returned 4
	[0132.640] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk", pszSpec="*.tar") returned 0
	[0132.640] lstrlenA (lpString="*.tar") returned 5
	[0132.640] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk", pszSpec="*.gzip") returned 0
	[0132.640] lstrlenA (lpString="*.gzip") returned 6
	[0132.640] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk", pszSpec="*.jpg") returned 0
	[0132.640] lstrlenA (lpString="*.jpg") returned 5
	[0132.640] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk", pszSpec="*.jpeg") returned 0
	[0132.640] lstrlenA (lpString="*.jpeg") returned 6
	[0132.640] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk", pszSpec="*.bmp") returned 0
	[0132.640] lstrlenA (lpString="*.bmp") returned 5
	[0132.640] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk", pszSpec="*.gif") returned 0
	[0132.640] lstrlenA (lpString="*.gif") returned 5
	[0132.640] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk", pszSpec="*.png") returned 0
	[0132.640] lstrlenA (lpString="*.png") returned 5
	[0132.640] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk", pszSpec="*.doc") returned 0
	[0132.640] lstrlenA (lpString="*.doc") returned 5
	[0132.640] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk", pszSpec="*.docx") returned 0
	[0132.640] lstrlenA (lpString="*.docx") returned 6
	[0132.640] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk", pszSpec="*.xls") returned 0
	[0132.640] lstrlenA (lpString="*.xls") returned 5
	[0132.641] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk", pszSpec="*.xlsx") returned 0
	[0132.641] lstrlenA (lpString="*.xlsx") returned 6
	[0132.641] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk", pszSpec="*.ppt") returned 0
	[0132.641] lstrlenA (lpString="*.ppt") returned 5
	[0132.641] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk", pszSpec="*.pptx") returned 0
	[0132.641] lstrlenA (lpString="*.pptx") returned 6
	[0132.641] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk", pszSpec="*.txt") returned 0
	[0132.641] lstrlenA (lpString="*.txt") returned 5
	[0132.641] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk", pszSpec="*.pdf") returned 0
	[0132.641] lstrlenA (lpString="*.pdf") returned 5
	[0132.641] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk", pszSpec="*.htm") returned 0
	[0132.641] lstrlenA (lpString="*.htm") returned 5
	[0132.641] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk", pszSpec="*.html") returned 0
	[0132.641] lstrlenA (lpString="*.html") returned 6
	[0132.641] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk", pszSpec="*.mdb") returned 0
	[0132.641] lstrlenA (lpString="*.mdb") returned 5
	[0132.641] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk", pszSpec="*.pfx") returned 0
	[0132.641] lstrlenA (lpString="*.pfx") returned 5
	[0132.641] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk", pszSpec="*.md") returned 0
	[0132.641] lstrlenA (lpString="*.md") returned 4
	[0132.641] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk", pszSpec="*.lnk") returned 1
	[0132.641] lstrlenA (lpString="*.lnk") returned 5
	[0132.641] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk"
	[0132.641] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk"
	[0132.641] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk."
	[0132.641] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk.exe"
	[0132.641] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rtidr1nen64e_ktx8_y.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.642] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e7
	[0132.642] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x522b80bc, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x522b80bc, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x522de046, dwHighDateTime=0x1d543d9)) returned 1
	[0132.642] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.642] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x3a5, lpOverlapped=0x0) returned 1
	[0132.643] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk") returned="rtiDr1nEn64E_ktx8_Y.lnk"
	[0132.643] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.643] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x3a5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x3a5, lpOverlapped=0x0) returned 1
	[0132.643] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.643] CloseHandle (hObject=0x21c) returned 1
	[0132.643] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rtidr1nen64e_ktx8_y.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rtidr1nen64e_ktx8_y.lnk.exe")) returned 1
	[0132.644] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d538e97, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x3d538e97, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x3d538e97, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rx0C_.lnk", cAlternateFileName="")) returned 1
	[0132.644] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.644] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Rx0C_.lnk") returned -1
	[0132.644] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Rx0C_.lnk") returned -1
	[0132.644] lstrcmpiA (lpString1="", lpString2="Rx0C_.lnk") returned -1
	[0132.644] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rtiDr1nEn64E_ktx8_Y.lnk") returned="rtiDr1nEn64E_ktx8_Y.lnk"
	[0132.644] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.645] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.645] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.645] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.645] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="Rx0C_.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk"
	[0132.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk", pszSpec="*.zip") returned 0
	[0132.645] lstrlenA (lpString="*.zip") returned 5
	[0132.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk", pszSpec="*.rar") returned 0
	[0132.645] lstrlenA (lpString="*.rar") returned 5
	[0132.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk", pszSpec="*.7z") returned 0
	[0132.645] lstrlenA (lpString="*.7z") returned 4
	[0132.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk", pszSpec="*.tar") returned 0
	[0132.645] lstrlenA (lpString="*.tar") returned 5
	[0132.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk", pszSpec="*.gzip") returned 0
	[0132.645] lstrlenA (lpString="*.gzip") returned 6
	[0132.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk", pszSpec="*.jpg") returned 0
	[0132.645] lstrlenA (lpString="*.jpg") returned 5
	[0132.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk", pszSpec="*.jpeg") returned 0
	[0132.645] lstrlenA (lpString="*.jpeg") returned 6
	[0132.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk", pszSpec="*.bmp") returned 0
	[0132.645] lstrlenA (lpString="*.bmp") returned 5
	[0132.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk", pszSpec="*.gif") returned 0
	[0132.645] lstrlenA (lpString="*.gif") returned 5
	[0132.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk", pszSpec="*.png") returned 0
	[0132.645] lstrlenA (lpString="*.png") returned 5
	[0132.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk", pszSpec="*.doc") returned 0
	[0132.645] lstrlenA (lpString="*.doc") returned 5
	[0132.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk", pszSpec="*.docx") returned 0
	[0132.645] lstrlenA (lpString="*.docx") returned 6
	[0132.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk", pszSpec="*.xls") returned 0
	[0132.646] lstrlenA (lpString="*.xls") returned 5
	[0132.646] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk", pszSpec="*.xlsx") returned 0
	[0132.646] lstrlenA (lpString="*.xlsx") returned 6
	[0132.646] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk", pszSpec="*.ppt") returned 0
	[0132.646] lstrlenA (lpString="*.ppt") returned 5
	[0132.646] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk", pszSpec="*.pptx") returned 0
	[0132.646] lstrlenA (lpString="*.pptx") returned 6
	[0132.646] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk", pszSpec="*.txt") returned 0
	[0132.646] lstrlenA (lpString="*.txt") returned 5
	[0132.646] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk", pszSpec="*.pdf") returned 0
	[0132.646] lstrlenA (lpString="*.pdf") returned 5
	[0132.646] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk", pszSpec="*.htm") returned 0
	[0132.646] lstrlenA (lpString="*.htm") returned 5
	[0132.646] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk", pszSpec="*.html") returned 0
	[0132.646] lstrlenA (lpString="*.html") returned 6
	[0132.646] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk", pszSpec="*.mdb") returned 0
	[0132.646] lstrlenA (lpString="*.mdb") returned 5
	[0132.646] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk", pszSpec="*.pfx") returned 0
	[0132.646] lstrlenA (lpString="*.pfx") returned 5
	[0132.646] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk", pszSpec="*.md") returned 0
	[0132.646] lstrlenA (lpString="*.md") returned 4
	[0132.646] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk", pszSpec="*.lnk") returned 1
	[0132.646] lstrlenA (lpString="*.lnk") returned 5
	[0132.646] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk"
	[0132.646] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk"
	[0132.646] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk."
	[0132.646] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk.exe"
	[0132.646] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rx0c_.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.647] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4cc
	[0132.647] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3d538e97, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x3d538e97, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3d538e97, dwHighDateTime=0x1d543d9)) returned 1
	[0132.647] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.647] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x48a, lpOverlapped=0x0) returned 1
	[0132.649] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk") returned="Rx0C_.lnk"
	[0132.649] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.649] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x48a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x48a, lpOverlapped=0x0) returned 1
	[0132.649] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.649] CloseHandle (hObject=0x21c) returned 1
	[0132.649] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rx0c_.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rx0c_.lnk.exe")) returned 1
	[0132.650] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4264aa9f, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x4264aa9f, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x4264aa9f, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="srVI38zQLI.lnk", cAlternateFileName="SRVI38~1.LNK")) returned 1
	[0132.650] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.651] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="srVI38zQLI.lnk") returned -1
	[0132.651] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="srVI38zQLI.lnk") returned -1
	[0132.651] lstrcmpiA (lpString1="", lpString2="srVI38zQLI.lnk") returned -1
	[0132.651] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rx0C_.lnk") returned="Rx0C_.lnk"
	[0132.651] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.651] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.651] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.651] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.651] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="srVI38zQLI.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk"
	[0132.651] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk", pszSpec="*.zip") returned 0
	[0132.651] lstrlenA (lpString="*.zip") returned 5
	[0132.651] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk", pszSpec="*.rar") returned 0
	[0132.651] lstrlenA (lpString="*.rar") returned 5
	[0132.651] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk", pszSpec="*.7z") returned 0
	[0132.651] lstrlenA (lpString="*.7z") returned 4
	[0132.651] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk", pszSpec="*.tar") returned 0
	[0132.651] lstrlenA (lpString="*.tar") returned 5
	[0132.651] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk", pszSpec="*.gzip") returned 0
	[0132.651] lstrlenA (lpString="*.gzip") returned 6
	[0132.651] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk", pszSpec="*.jpg") returned 0
	[0132.651] lstrlenA (lpString="*.jpg") returned 5
	[0132.651] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk", pszSpec="*.jpeg") returned 0
	[0132.651] lstrlenA (lpString="*.jpeg") returned 6
	[0132.651] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk", pszSpec="*.bmp") returned 0
	[0132.651] lstrlenA (lpString="*.bmp") returned 5
	[0132.651] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk", pszSpec="*.gif") returned 0
	[0132.651] lstrlenA (lpString="*.gif") returned 5
	[0132.651] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk", pszSpec="*.png") returned 0
	[0132.652] lstrlenA (lpString="*.png") returned 5
	[0132.652] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk", pszSpec="*.doc") returned 0
	[0132.652] lstrlenA (lpString="*.doc") returned 5
	[0132.652] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk", pszSpec="*.docx") returned 0
	[0132.652] lstrlenA (lpString="*.docx") returned 6
	[0132.652] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk", pszSpec="*.xls") returned 0
	[0132.652] lstrlenA (lpString="*.xls") returned 5
	[0132.652] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk", pszSpec="*.xlsx") returned 0
	[0132.652] lstrlenA (lpString="*.xlsx") returned 6
	[0132.652] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk", pszSpec="*.ppt") returned 0
	[0132.652] lstrlenA (lpString="*.ppt") returned 5
	[0132.652] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk", pszSpec="*.pptx") returned 0
	[0132.652] lstrlenA (lpString="*.pptx") returned 6
	[0132.652] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk", pszSpec="*.txt") returned 0
	[0132.652] lstrlenA (lpString="*.txt") returned 5
	[0132.652] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk", pszSpec="*.pdf") returned 0
	[0132.652] lstrlenA (lpString="*.pdf") returned 5
	[0132.652] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk", pszSpec="*.htm") returned 0
	[0132.652] lstrlenA (lpString="*.htm") returned 5
	[0132.652] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk", pszSpec="*.html") returned 0
	[0132.652] lstrlenA (lpString="*.html") returned 6
	[0132.652] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk", pszSpec="*.mdb") returned 0
	[0132.652] lstrlenA (lpString="*.mdb") returned 5
	[0132.652] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk", pszSpec="*.pfx") returned 0
	[0132.652] lstrlenA (lpString="*.pfx") returned 5
	[0132.652] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk", pszSpec="*.md") returned 0
	[0132.652] lstrlenA (lpString="*.md") returned 4
	[0132.652] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk", pszSpec="*.lnk") returned 1
	[0132.652] lstrlenA (lpString="*.lnk") returned 5
	[0132.652] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk"
	[0132.652] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk"
	[0132.652] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk."
	[0132.652] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk.exe"
	[0132.652] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\srvi38zqli.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.654] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ba
	[0132.654] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4264aa9f, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x4264aa9f, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4264aa9f, dwHighDateTime=0x1d543d9)) returned 1
	[0132.654] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.654] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x378, lpOverlapped=0x0) returned 1
	[0132.655] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk") returned="srVI38zQLI.lnk"
	[0132.655] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.655] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x378, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x378, lpOverlapped=0x0) returned 1
	[0132.655] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.655] CloseHandle (hObject=0x21c) returned 1
	[0132.655] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\srvi38zqli.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\srvi38zqli.lnk.exe")) returned 1
	[0132.656] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50724e0a, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x50724e0a, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x50724e0a, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tgYZ7_ukrYj.lnk", cAlternateFileName="TGYZ7_~1.LNK")) returned 1
	[0132.656] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.656] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="tgYZ7_ukrYj.lnk") returned -1
	[0132.656] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="tgYZ7_ukrYj.lnk") returned -1
	[0132.656] lstrcmpiA (lpString1="", lpString2="tgYZ7_ukrYj.lnk") returned -1
	[0132.661] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srVI38zQLI.lnk") returned="srVI38zQLI.lnk"
	[0132.661] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.661] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.661] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.661] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.661] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="tgYZ7_ukrYj.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk"
	[0132.662] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk", pszSpec="*.zip") returned 0
	[0132.662] lstrlenA (lpString="*.zip") returned 5
	[0132.662] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk", pszSpec="*.rar") returned 0
	[0132.662] lstrlenA (lpString="*.rar") returned 5
	[0132.662] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk", pszSpec="*.7z") returned 0
	[0132.662] lstrlenA (lpString="*.7z") returned 4
	[0132.662] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk", pszSpec="*.tar") returned 0
	[0132.662] lstrlenA (lpString="*.tar") returned 5
	[0132.662] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk", pszSpec="*.gzip") returned 0
	[0132.662] lstrlenA (lpString="*.gzip") returned 6
	[0132.662] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk", pszSpec="*.jpg") returned 0
	[0132.662] lstrlenA (lpString="*.jpg") returned 5
	[0132.662] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk", pszSpec="*.jpeg") returned 0
	[0132.662] lstrlenA (lpString="*.jpeg") returned 6
	[0132.662] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk", pszSpec="*.bmp") returned 0
	[0132.662] lstrlenA (lpString="*.bmp") returned 5
	[0132.662] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk", pszSpec="*.gif") returned 0
	[0132.662] lstrlenA (lpString="*.gif") returned 5
	[0132.662] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk", pszSpec="*.png") returned 0
	[0132.662] lstrlenA (lpString="*.png") returned 5
	[0132.662] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk", pszSpec="*.doc") returned 0
	[0132.662] lstrlenA (lpString="*.doc") returned 5
	[0132.662] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk", pszSpec="*.docx") returned 0
	[0132.662] lstrlenA (lpString="*.docx") returned 6
	[0132.662] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk", pszSpec="*.xls") returned 0
	[0132.662] lstrlenA (lpString="*.xls") returned 5
	[0132.662] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk", pszSpec="*.xlsx") returned 0
	[0132.662] lstrlenA (lpString="*.xlsx") returned 6
	[0132.662] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk", pszSpec="*.ppt") returned 0
	[0132.662] lstrlenA (lpString="*.ppt") returned 5
	[0132.662] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk", pszSpec="*.pptx") returned 0
	[0132.662] lstrlenA (lpString="*.pptx") returned 6
	[0132.662] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk", pszSpec="*.txt") returned 0
	[0132.662] lstrlenA (lpString="*.txt") returned 5
	[0132.662] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk", pszSpec="*.pdf") returned 0
	[0132.663] lstrlenA (lpString="*.pdf") returned 5
	[0132.663] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk", pszSpec="*.htm") returned 0
	[0132.663] lstrlenA (lpString="*.htm") returned 5
	[0132.663] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk", pszSpec="*.html") returned 0
	[0132.663] lstrlenA (lpString="*.html") returned 6
	[0132.663] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk", pszSpec="*.mdb") returned 0
	[0132.663] lstrlenA (lpString="*.mdb") returned 5
	[0132.663] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk", pszSpec="*.pfx") returned 0
	[0132.663] lstrlenA (lpString="*.pfx") returned 5
	[0132.663] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk", pszSpec="*.md") returned 0
	[0132.663] lstrlenA (lpString="*.md") returned 4
	[0132.663] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk", pszSpec="*.lnk") returned 1
	[0132.663] lstrlenA (lpString="*.lnk") returned 5
	[0132.663] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk"
	[0132.663] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk"
	[0132.663] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk."
	[0132.663] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk.exe"
	[0132.663] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\tgyz7_ukryj.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.663] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e0
	[0132.663] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x50724e0a, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x50724e0a, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x50724e0a, dwHighDateTime=0x1d543d9)) returned 1
	[0132.663] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.663] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x39e, lpOverlapped=0x0) returned 1
	[0132.664] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk") returned="tgYZ7_ukrYj.lnk"
	[0132.664] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.664] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0132.664] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.665] CloseHandle (hObject=0x21c) returned 1
	[0132.665] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\tgyz7_ukryj.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\tgyz7_ukryj.lnk.exe")) returned 1
	[0132.665] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31af76d4, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x31af76d4, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x31af76d4, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="ThfkqOaJnX.lnk", cAlternateFileName="THFKQO~1.LNK")) returned 1
	[0132.665] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.665] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="ThfkqOaJnX.lnk") returned -1
	[0132.665] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="ThfkqOaJnX.lnk") returned -1
	[0132.665] lstrcmpiA (lpString1="", lpString2="ThfkqOaJnX.lnk") returned -1
	[0132.665] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgYZ7_ukrYj.lnk") returned="tgYZ7_ukrYj.lnk"
	[0132.665] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.665] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.665] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.665] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.666] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ThfkqOaJnX.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk"
	[0132.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk", pszSpec="*.zip") returned 0
	[0132.666] lstrlenA (lpString="*.zip") returned 5
	[0132.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk", pszSpec="*.rar") returned 0
	[0132.666] lstrlenA (lpString="*.rar") returned 5
	[0132.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk", pszSpec="*.7z") returned 0
	[0132.666] lstrlenA (lpString="*.7z") returned 4
	[0132.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk", pszSpec="*.tar") returned 0
	[0132.666] lstrlenA (lpString="*.tar") returned 5
	[0132.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk", pszSpec="*.gzip") returned 0
	[0132.666] lstrlenA (lpString="*.gzip") returned 6
	[0132.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk", pszSpec="*.jpg") returned 0
	[0132.666] lstrlenA (lpString="*.jpg") returned 5
	[0132.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk", pszSpec="*.jpeg") returned 0
	[0132.666] lstrlenA (lpString="*.jpeg") returned 6
	[0132.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk", pszSpec="*.bmp") returned 0
	[0132.666] lstrlenA (lpString="*.bmp") returned 5
	[0132.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk", pszSpec="*.gif") returned 0
	[0132.666] lstrlenA (lpString="*.gif") returned 5
	[0132.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk", pszSpec="*.png") returned 0
	[0132.666] lstrlenA (lpString="*.png") returned 5
	[0132.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk", pszSpec="*.doc") returned 0
	[0132.666] lstrlenA (lpString="*.doc") returned 5
	[0132.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk", pszSpec="*.docx") returned 0
	[0132.666] lstrlenA (lpString="*.docx") returned 6
	[0132.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk", pszSpec="*.xls") returned 0
	[0132.666] lstrlenA (lpString="*.xls") returned 5
	[0132.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk", pszSpec="*.xlsx") returned 0
	[0132.666] lstrlenA (lpString="*.xlsx") returned 6
	[0132.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk", pszSpec="*.ppt") returned 0
	[0132.666] lstrlenA (lpString="*.ppt") returned 5
	[0132.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk", pszSpec="*.pptx") returned 0
	[0132.666] lstrlenA (lpString="*.pptx") returned 6
	[0132.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk", pszSpec="*.txt") returned 0
	[0132.667] lstrlenA (lpString="*.txt") returned 5
	[0132.667] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk", pszSpec="*.pdf") returned 0
	[0132.667] lstrlenA (lpString="*.pdf") returned 5
	[0132.667] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk", pszSpec="*.htm") returned 0
	[0132.667] lstrlenA (lpString="*.htm") returned 5
	[0132.667] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk", pszSpec="*.html") returned 0
	[0132.667] lstrlenA (lpString="*.html") returned 6
	[0132.667] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk", pszSpec="*.mdb") returned 0
	[0132.667] lstrlenA (lpString="*.mdb") returned 5
	[0132.667] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk", pszSpec="*.pfx") returned 0
	[0132.667] lstrlenA (lpString="*.pfx") returned 5
	[0132.667] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk", pszSpec="*.md") returned 0
	[0132.667] lstrlenA (lpString="*.md") returned 4
	[0132.667] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk", pszSpec="*.lnk") returned 1
	[0132.667] lstrlenA (lpString="*.lnk") returned 5
	[0132.667] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk"
	[0132.667] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk"
	[0132.667] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk."
	[0132.667] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk.exe"
	[0132.667] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\thfkqoajnx.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.667] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ba
	[0132.667] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x31af76d4, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x31af76d4, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x31af76d4, dwHighDateTime=0x1d543d9)) returned 1
	[0132.667] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.667] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x378, lpOverlapped=0x0) returned 1
	[0132.668] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk") returned="ThfkqOaJnX.lnk"
	[0132.668] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.668] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x378, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x378, lpOverlapped=0x0) returned 1
	[0132.668] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.668] CloseHandle (hObject=0x21c) returned 1
	[0132.669] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\thfkqoajnx.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\thfkqoajnx.lnk.exe")) returned 1
	[0132.669] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4137cb00, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x4137cb00, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x4137cb00, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x0, dwReserved1=0x0, cFileName="tIoUtMo.lnk", cAlternateFileName="")) returned 1
	[0132.669] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.669] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="tIoUtMo.lnk") returned -1
	[0132.669] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="tIoUtMo.lnk") returned -1
	[0132.669] lstrcmpiA (lpString1="", lpString2="tIoUtMo.lnk") returned -1
	[0132.669] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ThfkqOaJnX.lnk") returned="ThfkqOaJnX.lnk"
	[0132.669] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.669] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.669] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.669] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.670] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="tIoUtMo.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk"
	[0132.670] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk", pszSpec="*.zip") returned 0
	[0132.670] lstrlenA (lpString="*.zip") returned 5
	[0132.670] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk", pszSpec="*.rar") returned 0
	[0132.670] lstrlenA (lpString="*.rar") returned 5
	[0132.670] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk", pszSpec="*.7z") returned 0
	[0132.670] lstrlenA (lpString="*.7z") returned 4
	[0132.670] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk", pszSpec="*.tar") returned 0
	[0132.670] lstrlenA (lpString="*.tar") returned 5
	[0132.670] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk", pszSpec="*.gzip") returned 0
	[0132.670] lstrlenA (lpString="*.gzip") returned 6
	[0132.670] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk", pszSpec="*.jpg") returned 0
	[0132.670] lstrlenA (lpString="*.jpg") returned 5
	[0132.670] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk", pszSpec="*.jpeg") returned 0
	[0132.670] lstrlenA (lpString="*.jpeg") returned 6
	[0132.670] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk", pszSpec="*.bmp") returned 0
	[0132.670] lstrlenA (lpString="*.bmp") returned 5
	[0132.670] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk", pszSpec="*.gif") returned 0
	[0132.670] lstrlenA (lpString="*.gif") returned 5
	[0132.670] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk", pszSpec="*.png") returned 0
	[0132.670] lstrlenA (lpString="*.png") returned 5
	[0132.670] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk", pszSpec="*.doc") returned 0
	[0132.670] lstrlenA (lpString="*.doc") returned 5
	[0132.670] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk", pszSpec="*.docx") returned 0
	[0132.670] lstrlenA (lpString="*.docx") returned 6
	[0132.670] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk", pszSpec="*.xls") returned 0
	[0132.670] lstrlenA (lpString="*.xls") returned 5
	[0132.670] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk", pszSpec="*.xlsx") returned 0
	[0132.670] lstrlenA (lpString="*.xlsx") returned 6
	[0132.670] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk", pszSpec="*.ppt") returned 0
	[0132.670] lstrlenA (lpString="*.ppt") returned 5
	[0132.670] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk", pszSpec="*.pptx") returned 0
	[0132.670] lstrlenA (lpString="*.pptx") returned 6
	[0132.670] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk", pszSpec="*.txt") returned 0
	[0132.670] lstrlenA (lpString="*.txt") returned 5
	[0132.670] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk", pszSpec="*.pdf") returned 0
	[0132.671] lstrlenA (lpString="*.pdf") returned 5
	[0132.671] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk", pszSpec="*.htm") returned 0
	[0132.671] lstrlenA (lpString="*.htm") returned 5
	[0132.671] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk", pszSpec="*.html") returned 0
	[0132.671] lstrlenA (lpString="*.html") returned 6
	[0132.671] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk", pszSpec="*.mdb") returned 0
	[0132.671] lstrlenA (lpString="*.mdb") returned 5
	[0132.671] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk", pszSpec="*.pfx") returned 0
	[0132.671] lstrlenA (lpString="*.pfx") returned 5
	[0132.671] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk", pszSpec="*.md") returned 0
	[0132.671] lstrlenA (lpString="*.md") returned 4
	[0132.671] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk", pszSpec="*.lnk") returned 1
	[0132.671] lstrlenA (lpString="*.lnk") returned 5
	[0132.671] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk"
	[0132.671] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk"
	[0132.671] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk."
	[0132.671] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk.exe"
	[0132.671] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\tioutmo.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.671] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x45a
	[0132.671] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4137cb00, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x4137cb00, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4137cb00, dwHighDateTime=0x1d543d9)) returned 1
	[0132.671] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.671] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x418, lpOverlapped=0x0) returned 1
	[0132.672] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk") returned="tIoUtMo.lnk"
	[0132.672] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.672] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x418, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x418, lpOverlapped=0x0) returned 1
	[0132.672] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.672] CloseHandle (hObject=0x21c) returned 1
	[0132.673] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\tioutmo.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\tioutmo.lnk.exe")) returned 1
	[0132.673] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x525b2f74, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x525b2f74, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x525b2f74, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x0, dwReserved1=0x0, cFileName="tLZq.lnk", cAlternateFileName="")) returned 1
	[0132.673] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.673] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="tLZq.lnk") returned -1
	[0132.673] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="tLZq.lnk") returned -1
	[0132.673] lstrcmpiA (lpString1="", lpString2="tLZq.lnk") returned -1
	[0132.673] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIoUtMo.lnk") returned="tIoUtMo.lnk"
	[0132.673] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.673] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.673] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.673] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.673] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="tLZq.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk"
	[0132.673] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk", pszSpec="*.zip") returned 0
	[0132.674] lstrlenA (lpString="*.zip") returned 5
	[0132.674] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk", pszSpec="*.rar") returned 0
	[0132.674] lstrlenA (lpString="*.rar") returned 5
	[0132.674] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk", pszSpec="*.7z") returned 0
	[0132.674] lstrlenA (lpString="*.7z") returned 4
	[0132.674] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk", pszSpec="*.tar") returned 0
	[0132.674] lstrlenA (lpString="*.tar") returned 5
	[0132.674] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk", pszSpec="*.gzip") returned 0
	[0132.674] lstrlenA (lpString="*.gzip") returned 6
	[0132.674] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk", pszSpec="*.jpg") returned 0
	[0132.674] lstrlenA (lpString="*.jpg") returned 5
	[0132.674] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk", pszSpec="*.jpeg") returned 0
	[0132.674] lstrlenA (lpString="*.jpeg") returned 6
	[0132.674] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk", pszSpec="*.bmp") returned 0
	[0132.674] lstrlenA (lpString="*.bmp") returned 5
	[0132.674] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk", pszSpec="*.gif") returned 0
	[0132.674] lstrlenA (lpString="*.gif") returned 5
	[0132.674] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk", pszSpec="*.png") returned 0
	[0132.674] lstrlenA (lpString="*.png") returned 5
	[0132.674] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk", pszSpec="*.doc") returned 0
	[0132.674] lstrlenA (lpString="*.doc") returned 5
	[0132.674] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk", pszSpec="*.docx") returned 0
	[0132.674] lstrlenA (lpString="*.docx") returned 6
	[0132.674] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk", pszSpec="*.xls") returned 0
	[0132.674] lstrlenA (lpString="*.xls") returned 5
	[0132.674] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk", pszSpec="*.xlsx") returned 0
	[0132.674] lstrlenA (lpString="*.xlsx") returned 6
	[0132.674] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk", pszSpec="*.ppt") returned 0
	[0132.674] lstrlenA (lpString="*.ppt") returned 5
	[0132.674] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk", pszSpec="*.pptx") returned 0
	[0132.674] lstrlenA (lpString="*.pptx") returned 6
	[0132.674] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk", pszSpec="*.txt") returned 0
	[0132.674] lstrlenA (lpString="*.txt") returned 5
	[0132.674] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk", pszSpec="*.pdf") returned 0
	[0132.674] lstrlenA (lpString="*.pdf") returned 5
	[0132.674] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk", pszSpec="*.htm") returned 0
	[0132.675] lstrlenA (lpString="*.htm") returned 5
	[0132.675] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk", pszSpec="*.html") returned 0
	[0132.675] lstrlenA (lpString="*.html") returned 6
	[0132.675] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk", pszSpec="*.mdb") returned 0
	[0132.675] lstrlenA (lpString="*.mdb") returned 5
	[0132.675] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk", pszSpec="*.pfx") returned 0
	[0132.675] lstrlenA (lpString="*.pfx") returned 5
	[0132.675] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk", pszSpec="*.md") returned 0
	[0132.675] lstrlenA (lpString="*.md") returned 4
	[0132.675] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk", pszSpec="*.lnk") returned 1
	[0132.675] lstrlenA (lpString="*.lnk") returned 5
	[0132.675] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk"
	[0132.675] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk"
	[0132.675] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk."
	[0132.675] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk.exe"
	[0132.675] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\tlzq.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.675] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x266
	[0132.675] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x525b2f74, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x525b2f74, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x525b2f74, dwHighDateTime=0x1d543d9)) returned 1
	[0132.675] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.675] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x224, lpOverlapped=0x0) returned 1
	[0132.676] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk") returned="tLZq.lnk"
	[0132.676] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.676] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x224, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x224, lpOverlapped=0x0) returned 1
	[0132.676] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.676] CloseHandle (hObject=0x21c) returned 1
	[0132.676] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\tlzq.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\tlzq.lnk.exe")) returned 1
	[0132.683] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35f4af7b, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x35f4af7b, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x35f4af7b, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tm7X0ZWsRnwHit.lnk", cAlternateFileName="TM7X0Z~1.LNK")) returned 1
	[0132.683] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.683] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Tm7X0ZWsRnwHit.lnk") returned -1
	[0132.683] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Tm7X0ZWsRnwHit.lnk") returned -1
	[0132.683] lstrcmpiA (lpString1="", lpString2="Tm7X0ZWsRnwHit.lnk") returned -1
	[0132.683] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLZq.lnk") returned="tLZq.lnk"
	[0132.683] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.683] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.683] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.683] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.683] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="Tm7X0ZWsRnwHit.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk"
	[0132.683] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk", pszSpec="*.zip") returned 0
	[0132.683] lstrlenA (lpString="*.zip") returned 5
	[0132.684] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk", pszSpec="*.rar") returned 0
	[0132.684] lstrlenA (lpString="*.rar") returned 5
	[0132.684] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk", pszSpec="*.7z") returned 0
	[0132.684] lstrlenA (lpString="*.7z") returned 4
	[0132.684] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk", pszSpec="*.tar") returned 0
	[0132.684] lstrlenA (lpString="*.tar") returned 5
	[0132.684] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk", pszSpec="*.gzip") returned 0
	[0132.684] lstrlenA (lpString="*.gzip") returned 6
	[0132.684] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk", pszSpec="*.jpg") returned 0
	[0132.684] lstrlenA (lpString="*.jpg") returned 5
	[0132.684] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk", pszSpec="*.jpeg") returned 0
	[0132.684] lstrlenA (lpString="*.jpeg") returned 6
	[0132.684] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk", pszSpec="*.bmp") returned 0
	[0132.684] lstrlenA (lpString="*.bmp") returned 5
	[0132.684] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk", pszSpec="*.gif") returned 0
	[0132.684] lstrlenA (lpString="*.gif") returned 5
	[0132.684] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk", pszSpec="*.png") returned 0
	[0132.684] lstrlenA (lpString="*.png") returned 5
	[0132.684] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk", pszSpec="*.doc") returned 0
	[0132.684] lstrlenA (lpString="*.doc") returned 5
	[0132.684] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk", pszSpec="*.docx") returned 0
	[0132.684] lstrlenA (lpString="*.docx") returned 6
	[0132.684] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk", pszSpec="*.xls") returned 0
	[0132.684] lstrlenA (lpString="*.xls") returned 5
	[0132.684] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk", pszSpec="*.xlsx") returned 0
	[0132.684] lstrlenA (lpString="*.xlsx") returned 6
	[0132.684] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk", pszSpec="*.ppt") returned 0
	[0132.684] lstrlenA (lpString="*.ppt") returned 5
	[0132.684] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk", pszSpec="*.pptx") returned 0
	[0132.684] lstrlenA (lpString="*.pptx") returned 6
	[0132.684] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk", pszSpec="*.txt") returned 0
	[0132.684] lstrlenA (lpString="*.txt") returned 5
	[0132.684] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk", pszSpec="*.pdf") returned 0
	[0132.684] lstrlenA (lpString="*.pdf") returned 5
	[0132.684] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk", pszSpec="*.htm") returned 0
	[0132.684] lstrlenA (lpString="*.htm") returned 5
	[0132.684] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk", pszSpec="*.html") returned 0
	[0132.685] lstrlenA (lpString="*.html") returned 6
	[0132.685] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk", pszSpec="*.mdb") returned 0
	[0132.685] lstrlenA (lpString="*.mdb") returned 5
	[0132.685] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk", pszSpec="*.pfx") returned 0
	[0132.685] lstrlenA (lpString="*.pfx") returned 5
	[0132.685] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk", pszSpec="*.md") returned 0
	[0132.685] lstrlenA (lpString="*.md") returned 4
	[0132.685] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk", pszSpec="*.lnk") returned 1
	[0132.685] lstrlenA (lpString="*.lnk") returned 5
	[0132.685] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk"
	[0132.685] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk"
	[0132.685] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk."
	[0132.685] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk.exe"
	[0132.685] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\tm7x0zwsrnwhit.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.685] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ce
	[0132.685] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x35f4af7b, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x35f4af7b, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x35f4af7b, dwHighDateTime=0x1d543d9)) returned 1
	[0132.685] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.685] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x38c, lpOverlapped=0x0) returned 1
	[0132.686] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk") returned="Tm7X0ZWsRnwHit.lnk"
	[0132.686] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.686] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x38c, lpOverlapped=0x0) returned 1
	[0132.686] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.686] CloseHandle (hObject=0x21c) returned 1
	[0132.686] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\tm7x0zwsrnwhit.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\tm7x0zwsrnwhit.lnk.exe")) returned 1
	[0132.687] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43557797, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x482c5813, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x482c5813, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x46c, dwReserved0=0x0, dwReserved1=0x0, cFileName="UA7FxMqGv.lnk", cAlternateFileName="UA7FXM~1.LNK")) returned 1
	[0132.687] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.687] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="UA7FxMqGv.lnk") returned -1
	[0132.687] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="UA7FxMqGv.lnk") returned -1
	[0132.687] lstrcmpiA (lpString1="", lpString2="UA7FxMqGv.lnk") returned -1
	[0132.687] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tm7X0ZWsRnwHit.lnk") returned="Tm7X0ZWsRnwHit.lnk"
	[0132.687] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.687] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.687] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.687] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.687] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="UA7FxMqGv.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk"
	[0132.688] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk", pszSpec="*.zip") returned 0
	[0132.688] lstrlenA (lpString="*.zip") returned 5
	[0132.688] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk", pszSpec="*.rar") returned 0
	[0132.688] lstrlenA (lpString="*.rar") returned 5
	[0132.688] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk", pszSpec="*.7z") returned 0
	[0132.688] lstrlenA (lpString="*.7z") returned 4
	[0132.688] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk", pszSpec="*.tar") returned 0
	[0132.688] lstrlenA (lpString="*.tar") returned 5
	[0132.688] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk", pszSpec="*.gzip") returned 0
	[0132.688] lstrlenA (lpString="*.gzip") returned 6
	[0132.688] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk", pszSpec="*.jpg") returned 0
	[0132.688] lstrlenA (lpString="*.jpg") returned 5
	[0132.688] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk", pszSpec="*.jpeg") returned 0
	[0132.688] lstrlenA (lpString="*.jpeg") returned 6
	[0132.688] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk", pszSpec="*.bmp") returned 0
	[0132.688] lstrlenA (lpString="*.bmp") returned 5
	[0132.688] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk", pszSpec="*.gif") returned 0
	[0132.688] lstrlenA (lpString="*.gif") returned 5
	[0132.688] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk", pszSpec="*.png") returned 0
	[0132.688] lstrlenA (lpString="*.png") returned 5
	[0132.688] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk", pszSpec="*.doc") returned 0
	[0132.688] lstrlenA (lpString="*.doc") returned 5
	[0132.688] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk", pszSpec="*.docx") returned 0
	[0132.688] lstrlenA (lpString="*.docx") returned 6
	[0132.688] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk", pszSpec="*.xls") returned 0
	[0132.688] lstrlenA (lpString="*.xls") returned 5
	[0132.688] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk", pszSpec="*.xlsx") returned 0
	[0132.688] lstrlenA (lpString="*.xlsx") returned 6
	[0132.688] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk", pszSpec="*.ppt") returned 0
	[0132.688] lstrlenA (lpString="*.ppt") returned 5
	[0132.688] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk", pszSpec="*.pptx") returned 0
	[0132.688] lstrlenA (lpString="*.pptx") returned 6
	[0132.688] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk", pszSpec="*.txt") returned 0
	[0132.688] lstrlenA (lpString="*.txt") returned 5
	[0132.688] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk", pszSpec="*.pdf") returned 0
	[0132.688] lstrlenA (lpString="*.pdf") returned 5
	[0132.689] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk", pszSpec="*.htm") returned 0
	[0132.689] lstrlenA (lpString="*.htm") returned 5
	[0132.689] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk", pszSpec="*.html") returned 0
	[0132.689] lstrlenA (lpString="*.html") returned 6
	[0132.689] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk", pszSpec="*.mdb") returned 0
	[0132.689] lstrlenA (lpString="*.mdb") returned 5
	[0132.689] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk", pszSpec="*.pfx") returned 0
	[0132.689] lstrlenA (lpString="*.pfx") returned 5
	[0132.689] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk", pszSpec="*.md") returned 0
	[0132.689] lstrlenA (lpString="*.md") returned 4
	[0132.689] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk", pszSpec="*.lnk") returned 1
	[0132.689] lstrlenA (lpString="*.lnk") returned 5
	[0132.689] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk"
	[0132.689] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk"
	[0132.689] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk."
	[0132.689] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk.exe"
	[0132.689] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ua7fxmqgv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.689] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46c
	[0132.689] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x43557797, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x482c5813, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x482c5813, dwHighDateTime=0x1d543d9)) returned 1
	[0132.689] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.689] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x42a, lpOverlapped=0x0) returned 1
	[0132.690] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk") returned="UA7FxMqGv.lnk"
	[0132.690] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.690] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x42a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x42a, lpOverlapped=0x0) returned 1
	[0132.690] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.691] CloseHandle (hObject=0x21c) returned 1
	[0132.691] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ua7fxmqgv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ua7fxmqgv.lnk.exe")) returned 1
	[0132.691] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e97cd61, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x2e97cd61, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x2e97cd61, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uk9k.lnk", cAlternateFileName="")) returned 1
	[0132.691] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.691] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Uk9k.lnk") returned -1
	[0132.691] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Uk9k.lnk") returned -1
	[0132.691] lstrcmpiA (lpString1="", lpString2="Uk9k.lnk") returned -1
	[0132.691] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UA7FxMqGv.lnk") returned="UA7FxMqGv.lnk"
	[0132.691] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.691] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.692] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.692] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.692] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="Uk9k.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk"
	[0132.692] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk", pszSpec="*.zip") returned 0
	[0132.692] lstrlenA (lpString="*.zip") returned 5
	[0132.692] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk", pszSpec="*.rar") returned 0
	[0132.692] lstrlenA (lpString="*.rar") returned 5
	[0132.692] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk", pszSpec="*.7z") returned 0
	[0132.692] lstrlenA (lpString="*.7z") returned 4
	[0132.692] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk", pszSpec="*.tar") returned 0
	[0132.692] lstrlenA (lpString="*.tar") returned 5
	[0132.692] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk", pszSpec="*.gzip") returned 0
	[0132.692] lstrlenA (lpString="*.gzip") returned 6
	[0132.692] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk", pszSpec="*.jpg") returned 0
	[0132.692] lstrlenA (lpString="*.jpg") returned 5
	[0132.692] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk", pszSpec="*.jpeg") returned 0
	[0132.692] lstrlenA (lpString="*.jpeg") returned 6
	[0132.692] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk", pszSpec="*.bmp") returned 0
	[0132.692] lstrlenA (lpString="*.bmp") returned 5
	[0132.692] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk", pszSpec="*.gif") returned 0
	[0132.692] lstrlenA (lpString="*.gif") returned 5
	[0132.692] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk", pszSpec="*.png") returned 0
	[0132.692] lstrlenA (lpString="*.png") returned 5
	[0132.692] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk", pszSpec="*.doc") returned 0
	[0132.692] lstrlenA (lpString="*.doc") returned 5
	[0132.692] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk", pszSpec="*.docx") returned 0
	[0132.692] lstrlenA (lpString="*.docx") returned 6
	[0132.692] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk", pszSpec="*.xls") returned 0
	[0132.692] lstrlenA (lpString="*.xls") returned 5
	[0132.692] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk", pszSpec="*.xlsx") returned 0
	[0132.692] lstrlenA (lpString="*.xlsx") returned 6
	[0132.692] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk", pszSpec="*.ppt") returned 0
	[0132.692] lstrlenA (lpString="*.ppt") returned 5
	[0132.692] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk", pszSpec="*.pptx") returned 0
	[0132.692] lstrlenA (lpString="*.pptx") returned 6
	[0132.693] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk", pszSpec="*.txt") returned 0
	[0132.693] lstrlenA (lpString="*.txt") returned 5
	[0132.693] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk", pszSpec="*.pdf") returned 0
	[0132.693] lstrlenA (lpString="*.pdf") returned 5
	[0132.693] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk", pszSpec="*.htm") returned 0
	[0132.693] lstrlenA (lpString="*.htm") returned 5
	[0132.693] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk", pszSpec="*.html") returned 0
	[0132.693] lstrlenA (lpString="*.html") returned 6
	[0132.693] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk", pszSpec="*.mdb") returned 0
	[0132.693] lstrlenA (lpString="*.mdb") returned 5
	[0132.693] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk", pszSpec="*.pfx") returned 0
	[0132.693] lstrlenA (lpString="*.pfx") returned 5
	[0132.693] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk", pszSpec="*.md") returned 0
	[0132.693] lstrlenA (lpString="*.md") returned 4
	[0132.693] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk", pszSpec="*.lnk") returned 1
	[0132.693] lstrlenA (lpString="*.lnk") returned 5
	[0132.693] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk"
	[0132.693] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk"
	[0132.693] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk."
	[0132.693] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk.exe"
	[0132.693] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\uk9k.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.693] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b9
	[0132.693] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x2e97cd61, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x2e97cd61, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x2e97cd61, dwHighDateTime=0x1d543d9)) returned 1
	[0132.693] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.694] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x377, lpOverlapped=0x0) returned 1
	[0132.694] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk") returned="Uk9k.lnk"
	[0132.694] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.694] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x377, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x377, lpOverlapped=0x0) returned 1
	[0132.694] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.695] CloseHandle (hObject=0x21c) returned 1
	[0132.695] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\uk9k.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\uk9k.lnk.exe")) returned 1
	[0132.695] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fde7a15, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x4fde7a15, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x4fde7a15, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uMCVkil7.lnk", cAlternateFileName="")) returned 1
	[0132.695] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.695] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="uMCVkil7.lnk") returned -1
	[0132.695] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="uMCVkil7.lnk") returned -1
	[0132.695] lstrcmpiA (lpString1="", lpString2="uMCVkil7.lnk") returned -1
	[0132.695] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uk9k.lnk") returned="Uk9k.lnk"
	[0132.695] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.695] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.695] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.696] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.696] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="uMCVkil7.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk"
	[0132.696] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk", pszSpec="*.zip") returned 0
	[0132.696] lstrlenA (lpString="*.zip") returned 5
	[0132.696] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk", pszSpec="*.rar") returned 0
	[0132.696] lstrlenA (lpString="*.rar") returned 5
	[0132.696] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk", pszSpec="*.7z") returned 0
	[0132.696] lstrlenA (lpString="*.7z") returned 4
	[0132.696] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk", pszSpec="*.tar") returned 0
	[0132.696] lstrlenA (lpString="*.tar") returned 5
	[0132.696] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk", pszSpec="*.gzip") returned 0
	[0132.696] lstrlenA (lpString="*.gzip") returned 6
	[0132.696] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk", pszSpec="*.jpg") returned 0
	[0132.696] lstrlenA (lpString="*.jpg") returned 5
	[0132.696] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk", pszSpec="*.jpeg") returned 0
	[0132.696] lstrlenA (lpString="*.jpeg") returned 6
	[0132.696] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk", pszSpec="*.bmp") returned 0
	[0132.696] lstrlenA (lpString="*.bmp") returned 5
	[0132.696] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk", pszSpec="*.gif") returned 0
	[0132.696] lstrlenA (lpString="*.gif") returned 5
	[0132.696] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk", pszSpec="*.png") returned 0
	[0132.696] lstrlenA (lpString="*.png") returned 5
	[0132.696] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk", pszSpec="*.doc") returned 0
	[0132.696] lstrlenA (lpString="*.doc") returned 5
	[0132.696] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk", pszSpec="*.docx") returned 0
	[0132.696] lstrlenA (lpString="*.docx") returned 6
	[0132.696] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk", pszSpec="*.xls") returned 0
	[0132.696] lstrlenA (lpString="*.xls") returned 5
	[0132.696] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk", pszSpec="*.xlsx") returned 0
	[0132.696] lstrlenA (lpString="*.xlsx") returned 6
	[0132.696] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk", pszSpec="*.ppt") returned 0
	[0132.696] lstrlenA (lpString="*.ppt") returned 5
	[0132.696] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk", pszSpec="*.pptx") returned 0
	[0132.696] lstrlenA (lpString="*.pptx") returned 6
	[0132.696] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk", pszSpec="*.txt") returned 0
	[0132.697] lstrlenA (lpString="*.txt") returned 5
	[0132.697] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk", pszSpec="*.pdf") returned 0
	[0132.697] lstrlenA (lpString="*.pdf") returned 5
	[0132.697] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk", pszSpec="*.htm") returned 0
	[0132.697] lstrlenA (lpString="*.htm") returned 5
	[0132.697] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk", pszSpec="*.html") returned 0
	[0132.697] lstrlenA (lpString="*.html") returned 6
	[0132.697] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk", pszSpec="*.mdb") returned 0
	[0132.697] lstrlenA (lpString="*.mdb") returned 5
	[0132.697] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk", pszSpec="*.pfx") returned 0
	[0132.697] lstrlenA (lpString="*.pfx") returned 5
	[0132.697] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk", pszSpec="*.md") returned 0
	[0132.697] lstrlenA (lpString="*.md") returned 4
	[0132.697] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk", pszSpec="*.lnk") returned 1
	[0132.697] lstrlenA (lpString="*.lnk") returned 5
	[0132.697] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk"
	[0132.697] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk"
	[0132.697] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk."
	[0132.697] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk.exe"
	[0132.697] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\umcvkil7.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.697] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b0
	[0132.697] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4fde7a15, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x4fde7a15, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4fde7a15, dwHighDateTime=0x1d543d9)) returned 1
	[0132.697] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.697] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x36e, lpOverlapped=0x0) returned 1
	[0132.698] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk") returned="uMCVkil7.lnk"
	[0132.698] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.698] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x36e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x36e, lpOverlapped=0x0) returned 1
	[0132.698] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.698] CloseHandle (hObject=0x21c) returned 1
	[0132.699] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\umcvkil7.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\umcvkil7.lnk.exe")) returned 1
	[0132.699] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a2dea02, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x51ed9925, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x51ed9925, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x48a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UZNM2XfEt IgoSe.lnk", cAlternateFileName="UZNM2X~1.LNK")) returned 1
	[0132.699] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.699] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="UZNM2XfEt IgoSe.lnk") returned -1
	[0132.699] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="UZNM2XfEt IgoSe.lnk") returned -1
	[0132.699] lstrcmpiA (lpString1="", lpString2="UZNM2XfEt IgoSe.lnk") returned -1
	[0132.699] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uMCVkil7.lnk") returned="uMCVkil7.lnk"
	[0132.699] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.699] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.699] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.699] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.699] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="UZNM2XfEt IgoSe.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk"
	[0132.700] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk", pszSpec="*.zip") returned 0
	[0132.700] lstrlenA (lpString="*.zip") returned 5
	[0132.700] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk", pszSpec="*.rar") returned 0
	[0132.700] lstrlenA (lpString="*.rar") returned 5
	[0132.700] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk", pszSpec="*.7z") returned 0
	[0132.700] lstrlenA (lpString="*.7z") returned 4
	[0132.700] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk", pszSpec="*.tar") returned 0
	[0132.700] lstrlenA (lpString="*.tar") returned 5
	[0132.700] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk", pszSpec="*.gzip") returned 0
	[0132.700] lstrlenA (lpString="*.gzip") returned 6
	[0132.700] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk", pszSpec="*.jpg") returned 0
	[0132.700] lstrlenA (lpString="*.jpg") returned 5
	[0132.700] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk", pszSpec="*.jpeg") returned 0
	[0132.700] lstrlenA (lpString="*.jpeg") returned 6
	[0132.700] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk", pszSpec="*.bmp") returned 0
	[0132.700] lstrlenA (lpString="*.bmp") returned 5
	[0132.700] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk", pszSpec="*.gif") returned 0
	[0132.700] lstrlenA (lpString="*.gif") returned 5
	[0132.700] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk", pszSpec="*.png") returned 0
	[0132.700] lstrlenA (lpString="*.png") returned 5
	[0132.700] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk", pszSpec="*.doc") returned 0
	[0132.700] lstrlenA (lpString="*.doc") returned 5
	[0132.700] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk", pszSpec="*.docx") returned 0
	[0132.700] lstrlenA (lpString="*.docx") returned 6
	[0132.700] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk", pszSpec="*.xls") returned 0
	[0132.700] lstrlenA (lpString="*.xls") returned 5
	[0132.700] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk", pszSpec="*.xlsx") returned 0
	[0132.700] lstrlenA (lpString="*.xlsx") returned 6
	[0132.700] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk", pszSpec="*.ppt") returned 0
	[0132.700] lstrlenA (lpString="*.ppt") returned 5
	[0132.700] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk", pszSpec="*.pptx") returned 0
	[0132.700] lstrlenA (lpString="*.pptx") returned 6
	[0132.700] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk", pszSpec="*.txt") returned 0
	[0132.700] lstrlenA (lpString="*.txt") returned 5
	[0132.700] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk", pszSpec="*.pdf") returned 0
	[0132.700] lstrlenA (lpString="*.pdf") returned 5
	[0132.701] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk", pszSpec="*.htm") returned 0
	[0132.701] lstrlenA (lpString="*.htm") returned 5
	[0132.701] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk", pszSpec="*.html") returned 0
	[0132.701] lstrlenA (lpString="*.html") returned 6
	[0132.701] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk", pszSpec="*.mdb") returned 0
	[0132.701] lstrlenA (lpString="*.mdb") returned 5
	[0132.701] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk", pszSpec="*.pfx") returned 0
	[0132.701] lstrlenA (lpString="*.pfx") returned 5
	[0132.701] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk", pszSpec="*.md") returned 0
	[0132.701] lstrlenA (lpString="*.md") returned 4
	[0132.701] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk", pszSpec="*.lnk") returned 1
	[0132.701] lstrlenA (lpString="*.lnk") returned 5
	[0132.701] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk"
	[0132.701] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk"
	[0132.701] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk."
	[0132.701] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk.exe"
	[0132.701] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\uznm2xfet igose.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.701] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x48a
	[0132.701] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3a2dea02, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x51ed9925, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x51ed9925, dwHighDateTime=0x1d543d9)) returned 1
	[0132.701] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.701] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x448, lpOverlapped=0x0) returned 1
	[0132.702] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk") returned="UZNM2XfEt IgoSe.lnk"
	[0132.702] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.702] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x448, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x448, lpOverlapped=0x0) returned 1
	[0132.702] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.702] CloseHandle (hObject=0x21c) returned 1
	[0132.703] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\uznm2xfet igose.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\uznm2xfet igose.lnk.exe")) returned 1
	[0132.703] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4648c715, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x4648c715, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x4648c715, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x496, dwReserved0=0x0, dwReserved1=0x0, cFileName="V-aPrqMkIyoz77F2xkD.lnk", cAlternateFileName="V-APRQ~1.LNK")) returned 1
	[0132.703] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.703] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="V-aPrqMkIyoz77F2xkD.lnk") returned -1
	[0132.703] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="V-aPrqMkIyoz77F2xkD.lnk") returned -1
	[0132.703] lstrcmpiA (lpString1="", lpString2="V-aPrqMkIyoz77F2xkD.lnk") returned -1
	[0132.703] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UZNM2XfEt IgoSe.lnk") returned="UZNM2XfEt IgoSe.lnk"
	[0132.703] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.703] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.703] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.703] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.703] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="V-aPrqMkIyoz77F2xkD.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk"
	[0132.703] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk", pszSpec="*.zip") returned 0
	[0132.703] lstrlenA (lpString="*.zip") returned 5
	[0132.704] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk", pszSpec="*.rar") returned 0
	[0132.704] lstrlenA (lpString="*.rar") returned 5
	[0132.704] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk", pszSpec="*.7z") returned 0
	[0132.704] lstrlenA (lpString="*.7z") returned 4
	[0132.704] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk", pszSpec="*.tar") returned 0
	[0132.704] lstrlenA (lpString="*.tar") returned 5
	[0132.704] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk", pszSpec="*.gzip") returned 0
	[0132.704] lstrlenA (lpString="*.gzip") returned 6
	[0132.704] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk", pszSpec="*.jpg") returned 0
	[0132.704] lstrlenA (lpString="*.jpg") returned 5
	[0132.704] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk", pszSpec="*.jpeg") returned 0
	[0132.704] lstrlenA (lpString="*.jpeg") returned 6
	[0132.704] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk", pszSpec="*.bmp") returned 0
	[0132.704] lstrlenA (lpString="*.bmp") returned 5
	[0132.704] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk", pszSpec="*.gif") returned 0
	[0132.704] lstrlenA (lpString="*.gif") returned 5
	[0132.704] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk", pszSpec="*.png") returned 0
	[0132.704] lstrlenA (lpString="*.png") returned 5
	[0132.704] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk", pszSpec="*.doc") returned 0
	[0132.704] lstrlenA (lpString="*.doc") returned 5
	[0132.704] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk", pszSpec="*.docx") returned 0
	[0132.704] lstrlenA (lpString="*.docx") returned 6
	[0132.704] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk", pszSpec="*.xls") returned 0
	[0132.704] lstrlenA (lpString="*.xls") returned 5
	[0132.704] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk", pszSpec="*.xlsx") returned 0
	[0132.704] lstrlenA (lpString="*.xlsx") returned 6
	[0132.704] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk", pszSpec="*.ppt") returned 0
	[0132.704] lstrlenA (lpString="*.ppt") returned 5
	[0132.704] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk", pszSpec="*.pptx") returned 0
	[0132.704] lstrlenA (lpString="*.pptx") returned 6
	[0132.704] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk", pszSpec="*.txt") returned 0
	[0132.704] lstrlenA (lpString="*.txt") returned 5
	[0132.704] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk", pszSpec="*.pdf") returned 0
	[0132.704] lstrlenA (lpString="*.pdf") returned 5
	[0132.704] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk", pszSpec="*.htm") returned 0
	[0132.704] lstrlenA (lpString="*.htm") returned 5
	[0132.705] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk", pszSpec="*.html") returned 0
	[0132.705] lstrlenA (lpString="*.html") returned 6
	[0132.705] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk", pszSpec="*.mdb") returned 0
	[0132.705] lstrlenA (lpString="*.mdb") returned 5
	[0132.705] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk", pszSpec="*.pfx") returned 0
	[0132.705] lstrlenA (lpString="*.pfx") returned 5
	[0132.706] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk", pszSpec="*.md") returned 0
	[0132.706] lstrlenA (lpString="*.md") returned 4
	[0132.706] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk", pszSpec="*.lnk") returned 1
	[0132.706] lstrlenA (lpString="*.lnk") returned 5
	[0132.706] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk"
	[0132.706] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk"
	[0132.706] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk."
	[0132.706] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk.exe"
	[0132.706] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\v-aprqmkiyoz77f2xkd.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.706] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x496
	[0132.707] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4648c715, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x4648c715, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4648c715, dwHighDateTime=0x1d543d9)) returned 1
	[0132.707] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.707] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x454, lpOverlapped=0x0) returned 1
	[0132.707] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk") returned="V-aPrqMkIyoz77F2xkD.lnk"
	[0132.707] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.707] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x454, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x454, lpOverlapped=0x0) returned 1
	[0132.708] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.708] CloseHandle (hObject=0x21c) returned 1
	[0132.708] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\v-aprqmkiyoz77f2xkd.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\v-aprqmkiyoz77f2xkd.lnk.exe")) returned 1
	[0132.708] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36566d4d, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x36566d4d, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x36566d4d, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="vbub.lnk", cAlternateFileName="")) returned 1
	[0132.708] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.708] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="vbub.lnk") returned -1
	[0132.708] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="vbub.lnk") returned -1
	[0132.708] lstrcmpiA (lpString1="", lpString2="vbub.lnk") returned -1
	[0132.708] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V-aPrqMkIyoz77F2xkD.lnk") returned="V-aPrqMkIyoz77F2xkD.lnk"
	[0132.708] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.708] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.709] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.709] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.709] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="vbub.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk"
	[0132.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk", pszSpec="*.zip") returned 0
	[0132.709] lstrlenA (lpString="*.zip") returned 5
	[0132.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk", pszSpec="*.rar") returned 0
	[0132.709] lstrlenA (lpString="*.rar") returned 5
	[0132.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk", pszSpec="*.7z") returned 0
	[0132.709] lstrlenA (lpString="*.7z") returned 4
	[0132.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk", pszSpec="*.tar") returned 0
	[0132.709] lstrlenA (lpString="*.tar") returned 5
	[0132.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk", pszSpec="*.gzip") returned 0
	[0132.709] lstrlenA (lpString="*.gzip") returned 6
	[0132.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk", pszSpec="*.jpg") returned 0
	[0132.709] lstrlenA (lpString="*.jpg") returned 5
	[0132.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk", pszSpec="*.jpeg") returned 0
	[0132.709] lstrlenA (lpString="*.jpeg") returned 6
	[0132.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk", pszSpec="*.bmp") returned 0
	[0132.709] lstrlenA (lpString="*.bmp") returned 5
	[0132.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk", pszSpec="*.gif") returned 0
	[0132.709] lstrlenA (lpString="*.gif") returned 5
	[0132.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk", pszSpec="*.png") returned 0
	[0132.709] lstrlenA (lpString="*.png") returned 5
	[0132.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk", pszSpec="*.doc") returned 0
	[0132.709] lstrlenA (lpString="*.doc") returned 5
	[0132.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk", pszSpec="*.docx") returned 0
	[0132.709] lstrlenA (lpString="*.docx") returned 6
	[0132.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk", pszSpec="*.xls") returned 0
	[0132.709] lstrlenA (lpString="*.xls") returned 5
	[0132.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk", pszSpec="*.xlsx") returned 0
	[0132.709] lstrlenA (lpString="*.xlsx") returned 6
	[0132.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk", pszSpec="*.ppt") returned 0
	[0132.709] lstrlenA (lpString="*.ppt") returned 5
	[0132.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk", pszSpec="*.pptx") returned 0
	[0132.710] lstrlenA (lpString="*.pptx") returned 6
	[0132.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk", pszSpec="*.txt") returned 0
	[0132.710] lstrlenA (lpString="*.txt") returned 5
	[0132.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk", pszSpec="*.pdf") returned 0
	[0132.710] lstrlenA (lpString="*.pdf") returned 5
	[0132.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk", pszSpec="*.htm") returned 0
	[0132.710] lstrlenA (lpString="*.htm") returned 5
	[0132.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk", pszSpec="*.html") returned 0
	[0132.710] lstrlenA (lpString="*.html") returned 6
	[0132.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk", pszSpec="*.mdb") returned 0
	[0132.710] lstrlenA (lpString="*.mdb") returned 5
	[0132.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk", pszSpec="*.pfx") returned 0
	[0132.710] lstrlenA (lpString="*.pfx") returned 5
	[0132.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk", pszSpec="*.md") returned 0
	[0132.710] lstrlenA (lpString="*.md") returned 4
	[0132.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk", pszSpec="*.lnk") returned 1
	[0132.710] lstrlenA (lpString="*.lnk") returned 5
	[0132.710] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk"
	[0132.710] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk"
	[0132.710] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk."
	[0132.710] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk.exe"
	[0132.710] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vbub.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.710] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b9
	[0132.711] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x36566d4d, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x36566d4d, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x36566d4d, dwHighDateTime=0x1d543d9)) returned 1
	[0132.711] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.711] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x377, lpOverlapped=0x0) returned 1
	[0132.712] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk") returned="vbub.lnk"
	[0132.712] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.712] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x377, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x377, lpOverlapped=0x0) returned 1
	[0132.712] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.712] CloseHandle (hObject=0x21c) returned 1
	[0132.712] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vbub.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vbub.lnk.exe")) returned 1
	[0132.713] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37f5dbf1, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x505f3729, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x505f3729, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x2e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos.lnk", cAlternateFileName="")) returned 1
	[0132.713] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.713] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Videos.lnk") returned -1
	[0132.713] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Videos.lnk") returned -1
	[0132.713] lstrcmpiA (lpString1="", lpString2="Videos.lnk") returned -1
	[0132.713] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vbub.lnk") returned="vbub.lnk"
	[0132.713] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.713] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.713] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.713] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.713] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="Videos.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk"
	[0132.713] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk", pszSpec="*.zip") returned 0
	[0132.713] lstrlenA (lpString="*.zip") returned 5
	[0132.713] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk", pszSpec="*.rar") returned 0
	[0132.713] lstrlenA (lpString="*.rar") returned 5
	[0132.713] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk", pszSpec="*.7z") returned 0
	[0132.713] lstrlenA (lpString="*.7z") returned 4
	[0132.713] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk", pszSpec="*.tar") returned 0
	[0132.713] lstrlenA (lpString="*.tar") returned 5
	[0132.713] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk", pszSpec="*.gzip") returned 0
	[0132.713] lstrlenA (lpString="*.gzip") returned 6
	[0132.713] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk", pszSpec="*.jpg") returned 0
	[0132.713] lstrlenA (lpString="*.jpg") returned 5
	[0132.713] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk", pszSpec="*.jpeg") returned 0
	[0132.713] lstrlenA (lpString="*.jpeg") returned 6
	[0132.713] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk", pszSpec="*.bmp") returned 0
	[0132.713] lstrlenA (lpString="*.bmp") returned 5
	[0132.713] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk", pszSpec="*.gif") returned 0
	[0132.713] lstrlenA (lpString="*.gif") returned 5
	[0132.713] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk", pszSpec="*.png") returned 0
	[0132.713] lstrlenA (lpString="*.png") returned 5
	[0132.714] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk", pszSpec="*.doc") returned 0
	[0132.714] lstrlenA (lpString="*.doc") returned 5
	[0132.714] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk", pszSpec="*.docx") returned 0
	[0132.714] lstrlenA (lpString="*.docx") returned 6
	[0132.714] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk", pszSpec="*.xls") returned 0
	[0132.714] lstrlenA (lpString="*.xls") returned 5
	[0132.714] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk", pszSpec="*.xlsx") returned 0
	[0132.714] lstrlenA (lpString="*.xlsx") returned 6
	[0132.714] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk", pszSpec="*.ppt") returned 0
	[0132.714] lstrlenA (lpString="*.ppt") returned 5
	[0132.714] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk", pszSpec="*.pptx") returned 0
	[0132.714] lstrlenA (lpString="*.pptx") returned 6
	[0132.714] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk", pszSpec="*.txt") returned 0
	[0132.714] lstrlenA (lpString="*.txt") returned 5
	[0132.714] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk", pszSpec="*.pdf") returned 0
	[0132.714] lstrlenA (lpString="*.pdf") returned 5
	[0132.714] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk", pszSpec="*.htm") returned 0
	[0132.714] lstrlenA (lpString="*.htm") returned 5
	[0132.714] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk", pszSpec="*.html") returned 0
	[0132.714] lstrlenA (lpString="*.html") returned 6
	[0132.714] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk", pszSpec="*.mdb") returned 0
	[0132.714] lstrlenA (lpString="*.mdb") returned 5
	[0132.714] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk", pszSpec="*.pfx") returned 0
	[0132.714] lstrlenA (lpString="*.pfx") returned 5
	[0132.714] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk", pszSpec="*.md") returned 0
	[0132.714] lstrlenA (lpString="*.md") returned 4
	[0132.714] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk", pszSpec="*.lnk") returned 1
	[0132.714] lstrlenA (lpString="*.lnk") returned 5
	[0132.714] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk"
	[0132.714] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk"
	[0132.714] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk."
	[0132.714] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk.exe"
	[0132.714] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\videos.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.715] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2e5
	[0132.715] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x37f5dbf1, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x505f3729, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x505f3729, dwHighDateTime=0x1d543d9)) returned 1
	[0132.715] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.715] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x2a3, lpOverlapped=0x0) returned 1
	[0132.716] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk") returned="Videos.lnk"
	[0132.716] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.716] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x2a3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x2a3, lpOverlapped=0x0) returned 1
	[0132.716] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.716] CloseHandle (hObject=0x21c) returned 1
	[0132.716] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\videos.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\videos.lnk.exe")) returned 1
	[0132.716] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a4dfb1f, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x4a4dfb1f, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x4a4dfb1f, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x40d, dwReserved0=0x0, dwReserved1=0x0, cFileName="vRnOCwc0byMIsUzh3P6P.lnk", cAlternateFileName="VRNOCW~1.LNK")) returned 1
	[0132.716] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.717] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="vRnOCwc0byMIsUzh3P6P.lnk") returned -1
	[0132.717] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="vRnOCwc0byMIsUzh3P6P.lnk") returned -1
	[0132.717] lstrcmpiA (lpString1="", lpString2="vRnOCwc0byMIsUzh3P6P.lnk") returned -1
	[0132.717] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk") returned="Videos.lnk"
	[0132.717] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.717] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.717] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.717] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.717] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="vRnOCwc0byMIsUzh3P6P.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk"
	[0132.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk", pszSpec="*.zip") returned 0
	[0132.717] lstrlenA (lpString="*.zip") returned 5
	[0132.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk", pszSpec="*.rar") returned 0
	[0132.717] lstrlenA (lpString="*.rar") returned 5
	[0132.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk", pszSpec="*.7z") returned 0
	[0132.717] lstrlenA (lpString="*.7z") returned 4
	[0132.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk", pszSpec="*.tar") returned 0
	[0132.717] lstrlenA (lpString="*.tar") returned 5
	[0132.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk", pszSpec="*.gzip") returned 0
	[0132.717] lstrlenA (lpString="*.gzip") returned 6
	[0132.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk", pszSpec="*.jpg") returned 0
	[0132.717] lstrlenA (lpString="*.jpg") returned 5
	[0132.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk", pszSpec="*.jpeg") returned 0
	[0132.717] lstrlenA (lpString="*.jpeg") returned 6
	[0132.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk", pszSpec="*.bmp") returned 0
	[0132.717] lstrlenA (lpString="*.bmp") returned 5
	[0132.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk", pszSpec="*.gif") returned 0
	[0132.717] lstrlenA (lpString="*.gif") returned 5
	[0132.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk", pszSpec="*.png") returned 0
	[0132.717] lstrlenA (lpString="*.png") returned 5
	[0132.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk", pszSpec="*.doc") returned 0
	[0132.717] lstrlenA (lpString="*.doc") returned 5
	[0132.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk", pszSpec="*.docx") returned 0
	[0132.717] lstrlenA (lpString="*.docx") returned 6
	[0132.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk", pszSpec="*.xls") returned 0
	[0132.718] lstrlenA (lpString="*.xls") returned 5
	[0132.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk", pszSpec="*.xlsx") returned 0
	[0132.718] lstrlenA (lpString="*.xlsx") returned 6
	[0132.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk", pszSpec="*.ppt") returned 0
	[0132.718] lstrlenA (lpString="*.ppt") returned 5
	[0132.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk", pszSpec="*.pptx") returned 0
	[0132.718] lstrlenA (lpString="*.pptx") returned 6
	[0132.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk", pszSpec="*.txt") returned 0
	[0132.718] lstrlenA (lpString="*.txt") returned 5
	[0132.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk", pszSpec="*.pdf") returned 0
	[0132.718] lstrlenA (lpString="*.pdf") returned 5
	[0132.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk", pszSpec="*.htm") returned 0
	[0132.718] lstrlenA (lpString="*.htm") returned 5
	[0132.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk", pszSpec="*.html") returned 0
	[0132.718] lstrlenA (lpString="*.html") returned 6
	[0132.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk", pszSpec="*.mdb") returned 0
	[0132.718] lstrlenA (lpString="*.mdb") returned 5
	[0132.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk", pszSpec="*.pfx") returned 0
	[0132.718] lstrlenA (lpString="*.pfx") returned 5
	[0132.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk", pszSpec="*.md") returned 0
	[0132.718] lstrlenA (lpString="*.md") returned 4
	[0132.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk", pszSpec="*.lnk") returned 1
	[0132.718] lstrlenA (lpString="*.lnk") returned 5
	[0132.718] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk"
	[0132.718] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk"
	[0132.718] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk."
	[0132.718] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk.exe"
	[0132.718] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vrnocwc0bymisuzh3p6p.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.719] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40d
	[0132.719] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4a4dfb1f, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x4a4dfb1f, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4a4dfb1f, dwHighDateTime=0x1d543d9)) returned 1
	[0132.719] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.719] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x3cb, lpOverlapped=0x0) returned 1
	[0132.719] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk") returned="vRnOCwc0byMIsUzh3P6P.lnk"
	[0132.719] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.720] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x3cb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x3cb, lpOverlapped=0x0) returned 1
	[0132.720] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.720] CloseHandle (hObject=0x21c) returned 1
	[0132.720] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vrnocwc0bymisuzh3p6p.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vrnocwc0bymisuzh3p6p.lnk.exe")) returned 1
	[0132.721] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505cd819, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x505cd819, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x505cd819, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="vwE7_oUr07lTo8dTGjIH.lnk", cAlternateFileName="VWE7_O~1.LNK")) returned 1
	[0132.721] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.721] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="vwE7_oUr07lTo8dTGjIH.lnk") returned -1
	[0132.721] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="vwE7_oUr07lTo8dTGjIH.lnk") returned -1
	[0132.721] lstrcmpiA (lpString1="", lpString2="vwE7_oUr07lTo8dTGjIH.lnk") returned -1
	[0132.721] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vRnOCwc0byMIsUzh3P6P.lnk") returned="vRnOCwc0byMIsUzh3P6P.lnk"
	[0132.721] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.721] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.721] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.721] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.721] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="vwE7_oUr07lTo8dTGjIH.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk"
	[0132.721] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk", pszSpec="*.zip") returned 0
	[0132.721] lstrlenA (lpString="*.zip") returned 5
	[0132.721] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk", pszSpec="*.rar") returned 0
	[0132.721] lstrlenA (lpString="*.rar") returned 5
	[0132.721] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk", pszSpec="*.7z") returned 0
	[0132.721] lstrlenA (lpString="*.7z") returned 4
	[0132.721] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk", pszSpec="*.tar") returned 0
	[0132.721] lstrlenA (lpString="*.tar") returned 5
	[0132.721] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk", pszSpec="*.gzip") returned 0
	[0132.721] lstrlenA (lpString="*.gzip") returned 6
	[0132.721] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk", pszSpec="*.jpg") returned 0
	[0132.721] lstrlenA (lpString="*.jpg") returned 5
	[0132.721] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk", pszSpec="*.jpeg") returned 0
	[0132.721] lstrlenA (lpString="*.jpeg") returned 6
	[0132.721] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk", pszSpec="*.bmp") returned 0
	[0132.721] lstrlenA (lpString="*.bmp") returned 5
	[0132.721] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk", pszSpec="*.gif") returned 0
	[0132.721] lstrlenA (lpString="*.gif") returned 5
	[0132.721] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk", pszSpec="*.png") returned 0
	[0132.721] lstrlenA (lpString="*.png") returned 5
	[0132.721] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk", pszSpec="*.doc") returned 0
	[0132.721] lstrlenA (lpString="*.doc") returned 5
	[0132.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk", pszSpec="*.docx") returned 0
	[0132.722] lstrlenA (lpString="*.docx") returned 6
	[0132.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk", pszSpec="*.xls") returned 0
	[0132.722] lstrlenA (lpString="*.xls") returned 5
	[0132.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk", pszSpec="*.xlsx") returned 0
	[0132.722] lstrlenA (lpString="*.xlsx") returned 6
	[0132.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk", pszSpec="*.ppt") returned 0
	[0132.722] lstrlenA (lpString="*.ppt") returned 5
	[0132.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk", pszSpec="*.pptx") returned 0
	[0132.722] lstrlenA (lpString="*.pptx") returned 6
	[0132.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk", pszSpec="*.txt") returned 0
	[0132.722] lstrlenA (lpString="*.txt") returned 5
	[0132.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk", pszSpec="*.pdf") returned 0
	[0132.722] lstrlenA (lpString="*.pdf") returned 5
	[0132.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk", pszSpec="*.htm") returned 0
	[0132.722] lstrlenA (lpString="*.htm") returned 5
	[0132.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk", pszSpec="*.html") returned 0
	[0132.722] lstrlenA (lpString="*.html") returned 6
	[0132.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk", pszSpec="*.mdb") returned 0
	[0132.722] lstrlenA (lpString="*.mdb") returned 5
	[0132.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk", pszSpec="*.pfx") returned 0
	[0132.722] lstrlenA (lpString="*.pfx") returned 5
	[0132.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk", pszSpec="*.md") returned 0
	[0132.722] lstrlenA (lpString="*.md") returned 4
	[0132.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk", pszSpec="*.lnk") returned 1
	[0132.722] lstrlenA (lpString="*.lnk") returned 5
	[0132.722] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk"
	[0132.722] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk"
	[0132.722] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk."
	[0132.722] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk.exe"
	[0132.722] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vwe7_our07lto8dtgjih.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.723] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3dc
	[0132.723] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x505cd819, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x505cd819, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x505cd819, dwHighDateTime=0x1d543d9)) returned 1
	[0132.723] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.723] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x39a, lpOverlapped=0x0) returned 1
	[0132.724] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk") returned="vwE7_oUr07lTo8dTGjIH.lnk"
	[0132.724] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.724] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x39a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x39a, lpOverlapped=0x0) returned 1
	[0132.724] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.724] CloseHandle (hObject=0x21c) returned 1
	[0132.724] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vwe7_our07lto8dtgjih.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vwe7_our07lto8dtgjih.lnk.exe")) returned 1
	[0132.724] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x206b6555, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x523c480f, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x523c480f, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="vxBXX0.lnk", cAlternateFileName="")) returned 1
	[0132.724] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.725] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="vxBXX0.lnk") returned -1
	[0132.725] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="vxBXX0.lnk") returned -1
	[0132.725] lstrcmpiA (lpString1="", lpString2="vxBXX0.lnk") returned -1
	[0132.725] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vwE7_oUr07lTo8dTGjIH.lnk") returned="vwE7_oUr07lTo8dTGjIH.lnk"
	[0132.725] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.725] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.725] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.725] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.725] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="vxBXX0.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk"
	[0132.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk", pszSpec="*.zip") returned 0
	[0132.725] lstrlenA (lpString="*.zip") returned 5
	[0132.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk", pszSpec="*.rar") returned 0
	[0132.725] lstrlenA (lpString="*.rar") returned 5
	[0132.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk", pszSpec="*.7z") returned 0
	[0132.725] lstrlenA (lpString="*.7z") returned 4
	[0132.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk", pszSpec="*.tar") returned 0
	[0132.725] lstrlenA (lpString="*.tar") returned 5
	[0132.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk", pszSpec="*.gzip") returned 0
	[0132.725] lstrlenA (lpString="*.gzip") returned 6
	[0132.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk", pszSpec="*.jpg") returned 0
	[0132.725] lstrlenA (lpString="*.jpg") returned 5
	[0132.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk", pszSpec="*.jpeg") returned 0
	[0132.725] lstrlenA (lpString="*.jpeg") returned 6
	[0132.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk", pszSpec="*.bmp") returned 0
	[0132.725] lstrlenA (lpString="*.bmp") returned 5
	[0132.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk", pszSpec="*.gif") returned 0
	[0132.725] lstrlenA (lpString="*.gif") returned 5
	[0132.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk", pszSpec="*.png") returned 0
	[0132.725] lstrlenA (lpString="*.png") returned 5
	[0132.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk", pszSpec="*.doc") returned 0
	[0132.725] lstrlenA (lpString="*.doc") returned 5
	[0132.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk", pszSpec="*.docx") returned 0
	[0132.725] lstrlenA (lpString="*.docx") returned 6
	[0132.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk", pszSpec="*.xls") returned 0
	[0132.726] lstrlenA (lpString="*.xls") returned 5
	[0132.726] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk", pszSpec="*.xlsx") returned 0
	[0132.726] lstrlenA (lpString="*.xlsx") returned 6
	[0132.726] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk", pszSpec="*.ppt") returned 0
	[0132.726] lstrlenA (lpString="*.ppt") returned 5
	[0132.726] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk", pszSpec="*.pptx") returned 0
	[0132.726] lstrlenA (lpString="*.pptx") returned 6
	[0132.726] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk", pszSpec="*.txt") returned 0
	[0132.726] lstrlenA (lpString="*.txt") returned 5
	[0132.726] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk", pszSpec="*.pdf") returned 0
	[0132.726] lstrlenA (lpString="*.pdf") returned 5
	[0132.726] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk", pszSpec="*.htm") returned 0
	[0132.726] lstrlenA (lpString="*.htm") returned 5
	[0132.726] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk", pszSpec="*.html") returned 0
	[0132.726] lstrlenA (lpString="*.html") returned 6
	[0132.726] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk", pszSpec="*.mdb") returned 0
	[0132.726] lstrlenA (lpString="*.mdb") returned 5
	[0132.726] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk", pszSpec="*.pfx") returned 0
	[0132.726] lstrlenA (lpString="*.pfx") returned 5
	[0132.726] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk", pszSpec="*.md") returned 0
	[0132.726] lstrlenA (lpString="*.md") returned 4
	[0132.726] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk", pszSpec="*.lnk") returned 1
	[0132.736] lstrlenA (lpString="*.lnk") returned 5
	[0132.736] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk"
	[0132.736] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk"
	[0132.736] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk."
	[0132.736] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk.exe"
	[0132.736] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vxbxx0.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.737] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3eb
	[0132.737] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x206b6555, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x523c480f, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x523c480f, dwHighDateTime=0x1d543d9)) returned 1
	[0132.737] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.737] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x3a9, lpOverlapped=0x0) returned 1
	[0132.737] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk") returned="vxBXX0.lnk"
	[0132.737] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.738] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x3a9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x3a9, lpOverlapped=0x0) returned 1
	[0132.738] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.738] CloseHandle (hObject=0x21c) returned 1
	[0132.738] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vxbxx0.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vxbxx0.lnk.exe")) returned 1
	[0132.738] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14e1550d, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x413c8cf7, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x413c8cf7, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x0, dwReserved1=0x0, cFileName="VyPXfmV5YHIXX.lnk", cAlternateFileName="VYPXFM~1.LNK")) returned 1
	[0132.738] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.738] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="VyPXfmV5YHIXX.lnk") returned -1
	[0132.739] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="VyPXfmV5YHIXX.lnk") returned -1
	[0132.739] lstrcmpiA (lpString1="", lpString2="VyPXfmV5YHIXX.lnk") returned -1
	[0132.739] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vxBXX0.lnk") returned="vxBXX0.lnk"
	[0132.739] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.739] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.739] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.739] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.739] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="VyPXfmV5YHIXX.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk"
	[0132.739] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk", pszSpec="*.zip") returned 0
	[0132.739] lstrlenA (lpString="*.zip") returned 5
	[0132.739] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk", pszSpec="*.rar") returned 0
	[0132.739] lstrlenA (lpString="*.rar") returned 5
	[0132.739] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk", pszSpec="*.7z") returned 0
	[0132.739] lstrlenA (lpString="*.7z") returned 4
	[0132.739] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk", pszSpec="*.tar") returned 0
	[0132.739] lstrlenA (lpString="*.tar") returned 5
	[0132.739] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk", pszSpec="*.gzip") returned 0
	[0132.739] lstrlenA (lpString="*.gzip") returned 6
	[0132.739] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk", pszSpec="*.jpg") returned 0
	[0132.739] lstrlenA (lpString="*.jpg") returned 5
	[0132.739] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk", pszSpec="*.jpeg") returned 0
	[0132.739] lstrlenA (lpString="*.jpeg") returned 6
	[0132.739] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk", pszSpec="*.bmp") returned 0
	[0132.739] lstrlenA (lpString="*.bmp") returned 5
	[0132.739] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk", pszSpec="*.gif") returned 0
	[0132.739] lstrlenA (lpString="*.gif") returned 5
	[0132.739] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk", pszSpec="*.png") returned 0
	[0132.739] lstrlenA (lpString="*.png") returned 5
	[0132.739] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk", pszSpec="*.doc") returned 0
	[0132.739] lstrlenA (lpString="*.doc") returned 5
	[0132.739] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk", pszSpec="*.docx") returned 0
	[0132.739] lstrlenA (lpString="*.docx") returned 6
	[0132.739] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk", pszSpec="*.xls") returned 0
	[0132.739] lstrlenA (lpString="*.xls") returned 5
	[0132.740] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk", pszSpec="*.xlsx") returned 0
	[0132.740] lstrlenA (lpString="*.xlsx") returned 6
	[0132.740] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk", pszSpec="*.ppt") returned 0
	[0132.740] lstrlenA (lpString="*.ppt") returned 5
	[0132.740] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk", pszSpec="*.pptx") returned 0
	[0132.740] lstrlenA (lpString="*.pptx") returned 6
	[0132.740] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk", pszSpec="*.txt") returned 0
	[0132.740] lstrlenA (lpString="*.txt") returned 5
	[0132.740] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk", pszSpec="*.pdf") returned 0
	[0132.740] lstrlenA (lpString="*.pdf") returned 5
	[0132.740] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk", pszSpec="*.htm") returned 0
	[0132.740] lstrlenA (lpString="*.htm") returned 5
	[0132.740] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk", pszSpec="*.html") returned 0
	[0132.740] lstrlenA (lpString="*.html") returned 6
	[0132.740] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk", pszSpec="*.mdb") returned 0
	[0132.740] lstrlenA (lpString="*.mdb") returned 5
	[0132.740] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk", pszSpec="*.pfx") returned 0
	[0132.740] lstrlenA (lpString="*.pfx") returned 5
	[0132.740] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk", pszSpec="*.md") returned 0
	[0132.740] lstrlenA (lpString="*.md") returned 4
	[0132.740] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk", pszSpec="*.lnk") returned 1
	[0132.740] lstrlenA (lpString="*.lnk") returned 5
	[0132.740] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk"
	[0132.740] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk"
	[0132.740] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk."
	[0132.740] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk.exe"
	[0132.740] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vypxfmv5yhixx.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.741] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x384
	[0132.741] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x14e1550d, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x413c8cf7, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x413c8cf7, dwHighDateTime=0x1d543d9)) returned 1
	[0132.741] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.741] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x342, lpOverlapped=0x0) returned 1
	[0132.741] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk") returned="VyPXfmV5YHIXX.lnk"
	[0132.741] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.741] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x342, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x342, lpOverlapped=0x0) returned 1
	[0132.742] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.742] CloseHandle (hObject=0x21c) returned 1
	[0132.742] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vypxfmv5yhixx.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vypxfmv5yhixx.lnk.exe")) returned 1
	[0132.743] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f29450c, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x4f29450c, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x4f29450c, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="w sqIsm1.lnk", cAlternateFileName="WSQISM~1.LNK")) returned 1
	[0132.743] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.743] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="w sqIsm1.lnk") returned -1
	[0132.743] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="w sqIsm1.lnk") returned -1
	[0132.743] lstrcmpiA (lpString1="", lpString2="w sqIsm1.lnk") returned -1
	[0132.743] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyPXfmV5YHIXX.lnk") returned="VyPXfmV5YHIXX.lnk"
	[0132.743] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.743] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.743] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.743] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.743] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="w sqIsm1.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk"
	[0132.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk", pszSpec="*.zip") returned 0
	[0132.743] lstrlenA (lpString="*.zip") returned 5
	[0132.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk", pszSpec="*.rar") returned 0
	[0132.743] lstrlenA (lpString="*.rar") returned 5
	[0132.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk", pszSpec="*.7z") returned 0
	[0132.743] lstrlenA (lpString="*.7z") returned 4
	[0132.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk", pszSpec="*.tar") returned 0
	[0132.743] lstrlenA (lpString="*.tar") returned 5
	[0132.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk", pszSpec="*.gzip") returned 0
	[0132.743] lstrlenA (lpString="*.gzip") returned 6
	[0132.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk", pszSpec="*.jpg") returned 0
	[0132.743] lstrlenA (lpString="*.jpg") returned 5
	[0132.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk", pszSpec="*.jpeg") returned 0
	[0132.743] lstrlenA (lpString="*.jpeg") returned 6
	[0132.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk", pszSpec="*.bmp") returned 0
	[0132.743] lstrlenA (lpString="*.bmp") returned 5
	[0132.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk", pszSpec="*.gif") returned 0
	[0132.743] lstrlenA (lpString="*.gif") returned 5
	[0132.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk", pszSpec="*.png") returned 0
	[0132.744] lstrlenA (lpString="*.png") returned 5
	[0132.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk", pszSpec="*.doc") returned 0
	[0132.744] lstrlenA (lpString="*.doc") returned 5
	[0132.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk", pszSpec="*.docx") returned 0
	[0132.744] lstrlenA (lpString="*.docx") returned 6
	[0132.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk", pszSpec="*.xls") returned 0
	[0132.744] lstrlenA (lpString="*.xls") returned 5
	[0132.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk", pszSpec="*.xlsx") returned 0
	[0132.744] lstrlenA (lpString="*.xlsx") returned 6
	[0132.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk", pszSpec="*.ppt") returned 0
	[0132.744] lstrlenA (lpString="*.ppt") returned 5
	[0132.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk", pszSpec="*.pptx") returned 0
	[0132.744] lstrlenA (lpString="*.pptx") returned 6
	[0132.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk", pszSpec="*.txt") returned 0
	[0132.744] lstrlenA (lpString="*.txt") returned 5
	[0132.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk", pszSpec="*.pdf") returned 0
	[0132.744] lstrlenA (lpString="*.pdf") returned 5
	[0132.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk", pszSpec="*.htm") returned 0
	[0132.744] lstrlenA (lpString="*.htm") returned 5
	[0132.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk", pszSpec="*.html") returned 0
	[0132.744] lstrlenA (lpString="*.html") returned 6
	[0132.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk", pszSpec="*.mdb") returned 0
	[0132.744] lstrlenA (lpString="*.mdb") returned 5
	[0132.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk", pszSpec="*.pfx") returned 0
	[0132.744] lstrlenA (lpString="*.pfx") returned 5
	[0132.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk", pszSpec="*.md") returned 0
	[0132.744] lstrlenA (lpString="*.md") returned 4
	[0132.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk", pszSpec="*.lnk") returned 1
	[0132.744] lstrlenA (lpString="*.lnk") returned 5
	[0132.744] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk"
	[0132.744] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk"
	[0132.744] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk."
	[0132.744] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk.exe"
	[0132.744] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\w sqism1.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.745] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b0
	[0132.745] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4f29450c, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x4f29450c, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4f29450c, dwHighDateTime=0x1d543d9)) returned 1
	[0132.745] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.745] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x36e, lpOverlapped=0x0) returned 1
	[0132.746] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk") returned="w sqIsm1.lnk"
	[0132.746] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.746] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x36e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x36e, lpOverlapped=0x0) returned 1
	[0132.746] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.746] CloseHandle (hObject=0x21c) returned 1
	[0132.746] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\w sqism1.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\w sqism1.lnk.exe")) returned 1
	[0132.747] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52435687, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x52435687, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x52435687, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x592, dwReserved0=0x0, dwReserved1=0x0, cFileName="wlsxrEbr Tx0fO4non.lnk", cAlternateFileName="WLSXRE~1.LNK")) returned 1
	[0132.747] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.747] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="wlsxrEbr Tx0fO4non.lnk") returned -1
	[0132.747] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="wlsxrEbr Tx0fO4non.lnk") returned -1
	[0132.747] lstrcmpiA (lpString1="", lpString2="wlsxrEbr Tx0fO4non.lnk") returned -1
	[0132.747] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w sqIsm1.lnk") returned="w sqIsm1.lnk"
	[0132.747] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.747] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.747] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.747] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.747] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="wlsxrEbr Tx0fO4non.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk"
	[0132.747] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk", pszSpec="*.zip") returned 0
	[0132.747] lstrlenA (lpString="*.zip") returned 5
	[0132.747] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk", pszSpec="*.rar") returned 0
	[0132.747] lstrlenA (lpString="*.rar") returned 5
	[0132.747] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk", pszSpec="*.7z") returned 0
	[0132.747] lstrlenA (lpString="*.7z") returned 4
	[0132.747] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk", pszSpec="*.tar") returned 0
	[0132.747] lstrlenA (lpString="*.tar") returned 5
	[0132.747] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk", pszSpec="*.gzip") returned 0
	[0132.747] lstrlenA (lpString="*.gzip") returned 6
	[0132.747] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk", pszSpec="*.jpg") returned 0
	[0132.747] lstrlenA (lpString="*.jpg") returned 5
	[0132.747] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk", pszSpec="*.jpeg") returned 0
	[0132.747] lstrlenA (lpString="*.jpeg") returned 6
	[0132.747] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk", pszSpec="*.bmp") returned 0
	[0132.747] lstrlenA (lpString="*.bmp") returned 5
	[0132.747] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk", pszSpec="*.gif") returned 0
	[0132.747] lstrlenA (lpString="*.gif") returned 5
	[0132.747] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk", pszSpec="*.png") returned 0
	[0132.747] lstrlenA (lpString="*.png") returned 5
	[0132.747] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk", pszSpec="*.doc") returned 0
	[0132.747] lstrlenA (lpString="*.doc") returned 5
	[0132.748] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk", pszSpec="*.docx") returned 0
	[0132.748] lstrlenA (lpString="*.docx") returned 6
	[0132.748] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk", pszSpec="*.xls") returned 0
	[0132.748] lstrlenA (lpString="*.xls") returned 5
	[0132.748] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk", pszSpec="*.xlsx") returned 0
	[0132.748] lstrlenA (lpString="*.xlsx") returned 6
	[0132.748] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk", pszSpec="*.ppt") returned 0
	[0132.748] lstrlenA (lpString="*.ppt") returned 5
	[0132.748] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk", pszSpec="*.pptx") returned 0
	[0132.748] lstrlenA (lpString="*.pptx") returned 6
	[0132.748] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk", pszSpec="*.txt") returned 0
	[0132.748] lstrlenA (lpString="*.txt") returned 5
	[0132.748] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk", pszSpec="*.pdf") returned 0
	[0132.748] lstrlenA (lpString="*.pdf") returned 5
	[0132.748] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk", pszSpec="*.htm") returned 0
	[0132.748] lstrlenA (lpString="*.htm") returned 5
	[0132.748] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk", pszSpec="*.html") returned 0
	[0132.748] lstrlenA (lpString="*.html") returned 6
	[0132.748] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk", pszSpec="*.mdb") returned 0
	[0132.748] lstrlenA (lpString="*.mdb") returned 5
	[0132.748] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk", pszSpec="*.pfx") returned 0
	[0132.748] lstrlenA (lpString="*.pfx") returned 5
	[0132.748] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk", pszSpec="*.md") returned 0
	[0132.748] lstrlenA (lpString="*.md") returned 4
	[0132.748] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk", pszSpec="*.lnk") returned 1
	[0132.748] lstrlenA (lpString="*.lnk") returned 5
	[0132.748] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk"
	[0132.748] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk"
	[0132.748] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk."
	[0132.748] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk.exe"
	[0132.748] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wlsxrebr tx0fo4non.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.749] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x592
	[0132.749] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x52435687, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x52435687, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x52435687, dwHighDateTime=0x1d543d9)) returned 1
	[0132.749] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.749] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x550, lpOverlapped=0x0) returned 1
	[0132.750] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk") returned="wlsxrEbr Tx0fO4non.lnk"
	[0132.750] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.750] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x550, lpOverlapped=0x0) returned 1
	[0132.750] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.750] CloseHandle (hObject=0x21c) returned 1
	[0132.750] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wlsxrebr tx0fo4non.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wlsxrebr tx0fo4non.lnk.exe")) returned 1
	[0132.750] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x309fab39, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x309fab39, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x30d8e501, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x29c, dwReserved0=0x0, dwReserved1=0x0, cFileName="WTb_gtMorp6JLi.lnk", cAlternateFileName="WTB_GT~1.LNK")) returned 1
	[0132.750] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.751] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WTb_gtMorp6JLi.lnk") returned -1
	[0132.751] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WTb_gtMorp6JLi.lnk") returned -1
	[0132.751] lstrcmpiA (lpString1="", lpString2="WTb_gtMorp6JLi.lnk") returned -1
	[0132.751] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wlsxrEbr Tx0fO4non.lnk") returned="wlsxrEbr Tx0fO4non.lnk"
	[0132.751] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.751] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.751] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.751] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.751] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="WTb_gtMorp6JLi.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk"
	[0132.751] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk", pszSpec="*.zip") returned 0
	[0132.751] lstrlenA (lpString="*.zip") returned 5
	[0132.751] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk", pszSpec="*.rar") returned 0
	[0132.751] lstrlenA (lpString="*.rar") returned 5
	[0132.751] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk", pszSpec="*.7z") returned 0
	[0132.751] lstrlenA (lpString="*.7z") returned 4
	[0132.751] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk", pszSpec="*.tar") returned 0
	[0132.751] lstrlenA (lpString="*.tar") returned 5
	[0132.751] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk", pszSpec="*.gzip") returned 0
	[0132.751] lstrlenA (lpString="*.gzip") returned 6
	[0132.751] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk", pszSpec="*.jpg") returned 0
	[0132.751] lstrlenA (lpString="*.jpg") returned 5
	[0132.751] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk", pszSpec="*.jpeg") returned 0
	[0132.751] lstrlenA (lpString="*.jpeg") returned 6
	[0132.751] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk", pszSpec="*.bmp") returned 0
	[0132.751] lstrlenA (lpString="*.bmp") returned 5
	[0132.751] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk", pszSpec="*.gif") returned 0
	[0132.751] lstrlenA (lpString="*.gif") returned 5
	[0132.751] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk", pszSpec="*.png") returned 0
	[0132.751] lstrlenA (lpString="*.png") returned 5
	[0132.751] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk", pszSpec="*.doc") returned 0
	[0132.751] lstrlenA (lpString="*.doc") returned 5
	[0132.751] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk", pszSpec="*.docx") returned 0
	[0132.751] lstrlenA (lpString="*.docx") returned 6
	[0132.751] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk", pszSpec="*.xls") returned 0
	[0132.752] lstrlenA (lpString="*.xls") returned 5
	[0132.752] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk", pszSpec="*.xlsx") returned 0
	[0132.752] lstrlenA (lpString="*.xlsx") returned 6
	[0132.752] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk", pszSpec="*.ppt") returned 0
	[0132.752] lstrlenA (lpString="*.ppt") returned 5
	[0132.752] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk", pszSpec="*.pptx") returned 0
	[0132.752] lstrlenA (lpString="*.pptx") returned 6
	[0132.752] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk", pszSpec="*.txt") returned 0
	[0132.752] lstrlenA (lpString="*.txt") returned 5
	[0132.752] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk", pszSpec="*.pdf") returned 0
	[0132.752] lstrlenA (lpString="*.pdf") returned 5
	[0132.752] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk", pszSpec="*.htm") returned 0
	[0132.752] lstrlenA (lpString="*.htm") returned 5
	[0132.752] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk", pszSpec="*.html") returned 0
	[0132.752] lstrlenA (lpString="*.html") returned 6
	[0132.752] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk", pszSpec="*.mdb") returned 0
	[0132.752] lstrlenA (lpString="*.mdb") returned 5
	[0132.752] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk", pszSpec="*.pfx") returned 0
	[0132.752] lstrlenA (lpString="*.pfx") returned 5
	[0132.752] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk", pszSpec="*.md") returned 0
	[0132.752] lstrlenA (lpString="*.md") returned 4
	[0132.752] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk", pszSpec="*.lnk") returned 1
	[0132.752] lstrlenA (lpString="*.lnk") returned 5
	[0132.752] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk"
	[0132.752] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk"
	[0132.752] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk."
	[0132.752] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk.exe"
	[0132.752] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wtb_gtmorp6jli.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.753] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29c
	[0132.753] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x309fab39, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x309fab39, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x30d8e501, dwHighDateTime=0x1d543d9)) returned 1
	[0132.753] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.753] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x25a, lpOverlapped=0x0) returned 1
	[0132.753] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk") returned="WTb_gtMorp6JLi.lnk"
	[0132.754] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.754] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x25a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x25a, lpOverlapped=0x0) returned 1
	[0132.754] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.754] CloseHandle (hObject=0x21c) returned 1
	[0132.754] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wtb_gtmorp6jli.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wtb_gtmorp6jli.lnk.exe")) returned 1
	[0132.755] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x406397fb, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x406397fb, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x406397fb, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x533, dwReserved0=0x0, dwReserved1=0x0, cFileName="x6ZLFcxo6NGe6PP.lnk", cAlternateFileName="X6ZLFC~1.LNK")) returned 1
	[0132.755] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.755] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="x6ZLFcxo6NGe6PP.lnk") returned -1
	[0132.755] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="x6ZLFcxo6NGe6PP.lnk") returned -1
	[0132.755] lstrcmpiA (lpString1="", lpString2="x6ZLFcxo6NGe6PP.lnk") returned -1
	[0132.755] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WTb_gtMorp6JLi.lnk") returned="WTb_gtMorp6JLi.lnk"
	[0132.755] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.755] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.755] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.755] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.755] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="x6ZLFcxo6NGe6PP.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk"
	[0132.755] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk", pszSpec="*.zip") returned 0
	[0132.755] lstrlenA (lpString="*.zip") returned 5
	[0132.755] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk", pszSpec="*.rar") returned 0
	[0132.755] lstrlenA (lpString="*.rar") returned 5
	[0132.755] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk", pszSpec="*.7z") returned 0
	[0132.755] lstrlenA (lpString="*.7z") returned 4
	[0132.755] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk", pszSpec="*.tar") returned 0
	[0132.755] lstrlenA (lpString="*.tar") returned 5
	[0132.755] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk", pszSpec="*.gzip") returned 0
	[0132.755] lstrlenA (lpString="*.gzip") returned 6
	[0132.755] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk", pszSpec="*.jpg") returned 0
	[0132.755] lstrlenA (lpString="*.jpg") returned 5
	[0132.755] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk", pszSpec="*.jpeg") returned 0
	[0132.755] lstrlenA (lpString="*.jpeg") returned 6
	[0132.755] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk", pszSpec="*.bmp") returned 0
	[0132.755] lstrlenA (lpString="*.bmp") returned 5
	[0132.755] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk", pszSpec="*.gif") returned 0
	[0132.755] lstrlenA (lpString="*.gif") returned 5
	[0132.755] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk", pszSpec="*.png") returned 0
	[0132.755] lstrlenA (lpString="*.png") returned 5
	[0132.755] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk", pszSpec="*.doc") returned 0
	[0132.755] lstrlenA (lpString="*.doc") returned 5
	[0132.756] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk", pszSpec="*.docx") returned 0
	[0132.756] lstrlenA (lpString="*.docx") returned 6
	[0132.756] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk", pszSpec="*.xls") returned 0
	[0132.756] lstrlenA (lpString="*.xls") returned 5
	[0132.756] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk", pszSpec="*.xlsx") returned 0
	[0132.756] lstrlenA (lpString="*.xlsx") returned 6
	[0132.756] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk", pszSpec="*.ppt") returned 0
	[0132.756] lstrlenA (lpString="*.ppt") returned 5
	[0132.756] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk", pszSpec="*.pptx") returned 0
	[0132.756] lstrlenA (lpString="*.pptx") returned 6
	[0132.756] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk", pszSpec="*.txt") returned 0
	[0132.756] lstrlenA (lpString="*.txt") returned 5
	[0132.756] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk", pszSpec="*.pdf") returned 0
	[0132.756] lstrlenA (lpString="*.pdf") returned 5
	[0132.756] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk", pszSpec="*.htm") returned 0
	[0132.756] lstrlenA (lpString="*.htm") returned 5
	[0132.756] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk", pszSpec="*.html") returned 0
	[0132.756] lstrlenA (lpString="*.html") returned 6
	[0132.756] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk", pszSpec="*.mdb") returned 0
	[0132.756] lstrlenA (lpString="*.mdb") returned 5
	[0132.756] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk", pszSpec="*.pfx") returned 0
	[0132.756] lstrlenA (lpString="*.pfx") returned 5
	[0132.756] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk", pszSpec="*.md") returned 0
	[0132.756] lstrlenA (lpString="*.md") returned 4
	[0132.756] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk", pszSpec="*.lnk") returned 1
	[0132.756] lstrlenA (lpString="*.lnk") returned 5
	[0132.756] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk"
	[0132.756] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk"
	[0132.756] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk."
	[0132.756] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk.exe"
	[0132.756] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\x6zlfcxo6nge6pp.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.757] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x533
	[0132.757] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x406397fb, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x406397fb, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x406397fb, dwHighDateTime=0x1d543d9)) returned 1
	[0132.757] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.757] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x4f1, lpOverlapped=0x0) returned 1
	[0132.758] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk") returned="x6ZLFcxo6NGe6PP.lnk"
	[0132.758] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.758] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x4f1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x4f1, lpOverlapped=0x0) returned 1
	[0132.758] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.758] CloseHandle (hObject=0x21c) returned 1
	[0132.758] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\x6zlfcxo6nge6pp.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\x6zlfcxo6nge6pp.lnk.exe")) returned 1
	[0132.759] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5239cd66, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x5239cd66, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x5239cd66, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x50d, dwReserved0=0x0, dwReserved1=0x0, cFileName="xbXb56EultqBsTq0Dq8.lnk", cAlternateFileName="XBXB56~1.LNK")) returned 1
	[0132.759] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.759] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="xbXb56EultqBsTq0Dq8.lnk") returned -1
	[0132.759] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="xbXb56EultqBsTq0Dq8.lnk") returned -1
	[0132.759] lstrcmpiA (lpString1="", lpString2="xbXb56EultqBsTq0Dq8.lnk") returned -1
	[0132.759] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x6ZLFcxo6NGe6PP.lnk") returned="x6ZLFcxo6NGe6PP.lnk"
	[0132.759] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.759] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.759] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.759] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.759] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="xbXb56EultqBsTq0Dq8.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk"
	[0132.759] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk", pszSpec="*.zip") returned 0
	[0132.759] lstrlenA (lpString="*.zip") returned 5
	[0132.759] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk", pszSpec="*.rar") returned 0
	[0132.759] lstrlenA (lpString="*.rar") returned 5
	[0132.759] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk", pszSpec="*.7z") returned 0
	[0132.759] lstrlenA (lpString="*.7z") returned 4
	[0132.759] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk", pszSpec="*.tar") returned 0
	[0132.759] lstrlenA (lpString="*.tar") returned 5
	[0132.759] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk", pszSpec="*.gzip") returned 0
	[0132.759] lstrlenA (lpString="*.gzip") returned 6
	[0132.759] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk", pszSpec="*.jpg") returned 0
	[0132.759] lstrlenA (lpString="*.jpg") returned 5
	[0132.759] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk", pszSpec="*.jpeg") returned 0
	[0132.759] lstrlenA (lpString="*.jpeg") returned 6
	[0132.759] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk", pszSpec="*.bmp") returned 0
	[0132.759] lstrlenA (lpString="*.bmp") returned 5
	[0132.759] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk", pszSpec="*.gif") returned 0
	[0132.759] lstrlenA (lpString="*.gif") returned 5
	[0132.759] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk", pszSpec="*.png") returned 0
	[0132.759] lstrlenA (lpString="*.png") returned 5
	[0132.759] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk", pszSpec="*.doc") returned 0
	[0132.760] lstrlenA (lpString="*.doc") returned 5
	[0132.760] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk", pszSpec="*.docx") returned 0
	[0132.760] lstrlenA (lpString="*.docx") returned 6
	[0132.760] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk", pszSpec="*.xls") returned 0
	[0132.760] lstrlenA (lpString="*.xls") returned 5
	[0132.760] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk", pszSpec="*.xlsx") returned 0
	[0132.760] lstrlenA (lpString="*.xlsx") returned 6
	[0132.760] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk", pszSpec="*.ppt") returned 0
	[0132.760] lstrlenA (lpString="*.ppt") returned 5
	[0132.760] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk", pszSpec="*.pptx") returned 0
	[0132.760] lstrlenA (lpString="*.pptx") returned 6
	[0132.760] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk", pszSpec="*.txt") returned 0
	[0132.760] lstrlenA (lpString="*.txt") returned 5
	[0132.760] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk", pszSpec="*.pdf") returned 0
	[0132.760] lstrlenA (lpString="*.pdf") returned 5
	[0132.760] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk", pszSpec="*.htm") returned 0
	[0132.760] lstrlenA (lpString="*.htm") returned 5
	[0132.760] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk", pszSpec="*.html") returned 0
	[0132.760] lstrlenA (lpString="*.html") returned 6
	[0132.760] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk", pszSpec="*.mdb") returned 0
	[0132.760] lstrlenA (lpString="*.mdb") returned 5
	[0132.760] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk", pszSpec="*.pfx") returned 0
	[0132.760] lstrlenA (lpString="*.pfx") returned 5
	[0132.760] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk", pszSpec="*.md") returned 0
	[0132.760] lstrlenA (lpString="*.md") returned 4
	[0132.760] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk", pszSpec="*.lnk") returned 1
	[0132.760] lstrlenA (lpString="*.lnk") returned 5
	[0132.760] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk"
	[0132.760] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk"
	[0132.760] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk."
	[0132.760] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk.exe"
	[0132.760] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xbxb56eultqbstq0dq8.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.761] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x50d
	[0132.761] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5239cd66, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x5239cd66, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5239cd66, dwHighDateTime=0x1d543d9)) returned 1
	[0132.761] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.761] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x4cb, lpOverlapped=0x0) returned 1
	[0132.762] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk") returned="xbXb56EultqBsTq0Dq8.lnk"
	[0132.762] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.762] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x4cb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x4cb, lpOverlapped=0x0) returned 1
	[0132.762] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.762] CloseHandle (hObject=0x21c) returned 1
	[0132.762] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xbxb56eultqbstq0dq8.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xbxb56eultqbstq0dq8.lnk.exe")) returned 1
	[0132.763] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51df3360, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x51df3360, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x51df3360, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x51f, dwReserved0=0x0, dwReserved1=0x0, cFileName="XgfX9ymIajHX.lnk", cAlternateFileName="XGFX9Y~1.LNK")) returned 1
	[0132.763] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.763] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="XgfX9ymIajHX.lnk") returned -1
	[0132.763] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="XgfX9ymIajHX.lnk") returned -1
	[0132.763] lstrcmpiA (lpString1="", lpString2="XgfX9ymIajHX.lnk") returned -1
	[0132.763] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbXb56EultqBsTq0Dq8.lnk") returned="xbXb56EultqBsTq0Dq8.lnk"
	[0132.763] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.763] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.763] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.763] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.763] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="XgfX9ymIajHX.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk"
	[0132.763] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk", pszSpec="*.zip") returned 0
	[0132.763] lstrlenA (lpString="*.zip") returned 5
	[0132.763] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk", pszSpec="*.rar") returned 0
	[0132.763] lstrlenA (lpString="*.rar") returned 5
	[0132.763] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk", pszSpec="*.7z") returned 0
	[0132.763] lstrlenA (lpString="*.7z") returned 4
	[0132.763] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk", pszSpec="*.tar") returned 0
	[0132.763] lstrlenA (lpString="*.tar") returned 5
	[0132.763] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk", pszSpec="*.gzip") returned 0
	[0132.763] lstrlenA (lpString="*.gzip") returned 6
	[0132.763] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk", pszSpec="*.jpg") returned 0
	[0132.763] lstrlenA (lpString="*.jpg") returned 5
	[0132.763] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk", pszSpec="*.jpeg") returned 0
	[0132.763] lstrlenA (lpString="*.jpeg") returned 6
	[0132.763] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk", pszSpec="*.bmp") returned 0
	[0132.763] lstrlenA (lpString="*.bmp") returned 5
	[0132.763] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk", pszSpec="*.gif") returned 0
	[0132.763] lstrlenA (lpString="*.gif") returned 5
	[0132.763] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk", pszSpec="*.png") returned 0
	[0132.763] lstrlenA (lpString="*.png") returned 5
	[0132.763] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk", pszSpec="*.doc") returned 0
	[0132.763] lstrlenA (lpString="*.doc") returned 5
	[0132.764] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk", pszSpec="*.docx") returned 0
	[0132.764] lstrlenA (lpString="*.docx") returned 6
	[0132.764] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk", pszSpec="*.xls") returned 0
	[0132.764] lstrlenA (lpString="*.xls") returned 5
	[0132.764] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk", pszSpec="*.xlsx") returned 0
	[0132.764] lstrlenA (lpString="*.xlsx") returned 6
	[0132.764] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk", pszSpec="*.ppt") returned 0
	[0132.764] lstrlenA (lpString="*.ppt") returned 5
	[0132.764] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk", pszSpec="*.pptx") returned 0
	[0132.764] lstrlenA (lpString="*.pptx") returned 6
	[0132.764] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk", pszSpec="*.txt") returned 0
	[0132.764] lstrlenA (lpString="*.txt") returned 5
	[0132.764] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk", pszSpec="*.pdf") returned 0
	[0132.764] lstrlenA (lpString="*.pdf") returned 5
	[0132.764] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk", pszSpec="*.htm") returned 0
	[0132.764] lstrlenA (lpString="*.htm") returned 5
	[0132.764] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk", pszSpec="*.html") returned 0
	[0132.764] lstrlenA (lpString="*.html") returned 6
	[0132.764] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk", pszSpec="*.mdb") returned 0
	[0132.764] lstrlenA (lpString="*.mdb") returned 5
	[0132.764] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk", pszSpec="*.pfx") returned 0
	[0132.764] lstrlenA (lpString="*.pfx") returned 5
	[0132.764] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk", pszSpec="*.md") returned 0
	[0132.764] lstrlenA (lpString="*.md") returned 4
	[0132.764] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk", pszSpec="*.lnk") returned 1
	[0132.764] lstrlenA (lpString="*.lnk") returned 5
	[0132.764] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk"
	[0132.764] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk"
	[0132.764] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk."
	[0132.764] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk.exe"
	[0132.764] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xgfx9ymiajhx.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.765] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x51f
	[0132.765] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x51df3360, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x51df3360, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x51df3360, dwHighDateTime=0x1d543d9)) returned 1
	[0132.765] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.765] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x4dd, lpOverlapped=0x0) returned 1
	[0132.766] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk") returned="XgfX9ymIajHX.lnk"
	[0132.766] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.766] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x4dd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x4dd, lpOverlapped=0x0) returned 1
	[0132.766] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.766] CloseHandle (hObject=0x21c) returned 1
	[0132.766] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xgfx9ymiajhx.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xgfx9ymiajhx.lnk.exe")) returned 1
	[0132.766] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x411ff12a, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x411ff12a, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x4122534d, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x0, dwReserved1=0x0, cFileName="XMn YR.lnk", cAlternateFileName="XMNYR~1.LNK")) returned 1
	[0132.766] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.767] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="XMn YR.lnk") returned -1
	[0132.767] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="XMn YR.lnk") returned -1
	[0132.767] lstrcmpiA (lpString1="", lpString2="XMn YR.lnk") returned -1
	[0132.767] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XgfX9ymIajHX.lnk") returned="XgfX9ymIajHX.lnk"
	[0132.767] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.767] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.767] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.767] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.767] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="XMn YR.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk"
	[0132.767] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk", pszSpec="*.zip") returned 0
	[0132.767] lstrlenA (lpString="*.zip") returned 5
	[0132.767] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk", pszSpec="*.rar") returned 0
	[0132.767] lstrlenA (lpString="*.rar") returned 5
	[0132.767] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk", pszSpec="*.7z") returned 0
	[0132.767] lstrlenA (lpString="*.7z") returned 4
	[0132.767] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk", pszSpec="*.tar") returned 0
	[0132.767] lstrlenA (lpString="*.tar") returned 5
	[0132.767] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk", pszSpec="*.gzip") returned 0
	[0132.767] lstrlenA (lpString="*.gzip") returned 6
	[0132.767] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk", pszSpec="*.jpg") returned 0
	[0132.767] lstrlenA (lpString="*.jpg") returned 5
	[0132.767] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk", pszSpec="*.jpeg") returned 0
	[0132.767] lstrlenA (lpString="*.jpeg") returned 6
	[0132.767] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk", pszSpec="*.bmp") returned 0
	[0132.767] lstrlenA (lpString="*.bmp") returned 5
	[0132.767] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk", pszSpec="*.gif") returned 0
	[0132.767] lstrlenA (lpString="*.gif") returned 5
	[0132.767] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk", pszSpec="*.png") returned 0
	[0132.767] lstrlenA (lpString="*.png") returned 5
	[0132.767] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk", pszSpec="*.doc") returned 0
	[0132.767] lstrlenA (lpString="*.doc") returned 5
	[0132.767] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk", pszSpec="*.docx") returned 0
	[0132.767] lstrlenA (lpString="*.docx") returned 6
	[0132.768] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk", pszSpec="*.xls") returned 0
	[0132.768] lstrlenA (lpString="*.xls") returned 5
	[0132.768] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk", pszSpec="*.xlsx") returned 0
	[0132.768] lstrlenA (lpString="*.xlsx") returned 6
	[0132.768] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk", pszSpec="*.ppt") returned 0
	[0132.768] lstrlenA (lpString="*.ppt") returned 5
	[0132.768] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk", pszSpec="*.pptx") returned 0
	[0132.768] lstrlenA (lpString="*.pptx") returned 6
	[0132.768] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk", pszSpec="*.txt") returned 0
	[0132.768] lstrlenA (lpString="*.txt") returned 5
	[0132.768] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk", pszSpec="*.pdf") returned 0
	[0132.768] lstrlenA (lpString="*.pdf") returned 5
	[0132.768] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk", pszSpec="*.htm") returned 0
	[0132.768] lstrlenA (lpString="*.htm") returned 5
	[0132.768] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk", pszSpec="*.html") returned 0
	[0132.768] lstrlenA (lpString="*.html") returned 6
	[0132.768] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk", pszSpec="*.mdb") returned 0
	[0132.768] lstrlenA (lpString="*.mdb") returned 5
	[0132.768] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk", pszSpec="*.pfx") returned 0
	[0132.768] lstrlenA (lpString="*.pfx") returned 5
	[0132.768] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk", pszSpec="*.md") returned 0
	[0132.768] lstrlenA (lpString="*.md") returned 4
	[0132.768] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk", pszSpec="*.lnk") returned 1
	[0132.768] lstrlenA (lpString="*.lnk") returned 5
	[0132.768] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk"
	[0132.768] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk"
	[0132.768] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk."
	[0132.768] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk.exe"
	[0132.768] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xmn yr.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.769] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x554
	[0132.769] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x411ff12a, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x411ff12a, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4122534d, dwHighDateTime=0x1d543d9)) returned 1
	[0132.769] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.769] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x512, lpOverlapped=0x0) returned 1
	[0132.769] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk") returned="XMn YR.lnk"
	[0132.769] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.770] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x512, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x512, lpOverlapped=0x0) returned 1
	[0132.770] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.770] CloseHandle (hObject=0x21c) returned 1
	[0132.770] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xmn yr.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xmn yr.lnk.exe")) returned 1
	[0132.770] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aefaa16, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x4aefaa16, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x4aefaa16, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="xnEChqbXwen0MJA7OL.lnk", cAlternateFileName="XNECHQ~1.LNK")) returned 1
	[0132.770] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.770] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="xnEChqbXwen0MJA7OL.lnk") returned -1
	[0132.770] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="xnEChqbXwen0MJA7OL.lnk") returned -1
	[0132.771] lstrcmpiA (lpString1="", lpString2="xnEChqbXwen0MJA7OL.lnk") returned -1
	[0132.771] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XMn YR.lnk") returned="XMn YR.lnk"
	[0132.771] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.771] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.771] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.771] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.771] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="xnEChqbXwen0MJA7OL.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk"
	[0132.771] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk", pszSpec="*.zip") returned 0
	[0132.771] lstrlenA (lpString="*.zip") returned 5
	[0132.771] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk", pszSpec="*.rar") returned 0
	[0132.771] lstrlenA (lpString="*.rar") returned 5
	[0132.771] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk", pszSpec="*.7z") returned 0
	[0132.771] lstrlenA (lpString="*.7z") returned 4
	[0132.771] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk", pszSpec="*.tar") returned 0
	[0132.771] lstrlenA (lpString="*.tar") returned 5
	[0132.771] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk", pszSpec="*.gzip") returned 0
	[0132.771] lstrlenA (lpString="*.gzip") returned 6
	[0132.771] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk", pszSpec="*.jpg") returned 0
	[0132.771] lstrlenA (lpString="*.jpg") returned 5
	[0132.771] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk", pszSpec="*.jpeg") returned 0
	[0132.771] lstrlenA (lpString="*.jpeg") returned 6
	[0132.771] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk", pszSpec="*.bmp") returned 0
	[0132.771] lstrlenA (lpString="*.bmp") returned 5
	[0132.771] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk", pszSpec="*.gif") returned 0
	[0132.771] lstrlenA (lpString="*.gif") returned 5
	[0132.771] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk", pszSpec="*.png") returned 0
	[0132.771] lstrlenA (lpString="*.png") returned 5
	[0132.771] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk", pszSpec="*.doc") returned 0
	[0132.771] lstrlenA (lpString="*.doc") returned 5
	[0132.771] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk", pszSpec="*.docx") returned 0
	[0132.771] lstrlenA (lpString="*.docx") returned 6
	[0132.771] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk", pszSpec="*.xls") returned 0
	[0132.771] lstrlenA (lpString="*.xls") returned 5
	[0132.772] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk", pszSpec="*.xlsx") returned 0
	[0132.772] lstrlenA (lpString="*.xlsx") returned 6
	[0132.772] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk", pszSpec="*.ppt") returned 0
	[0132.772] lstrlenA (lpString="*.ppt") returned 5
	[0132.772] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk", pszSpec="*.pptx") returned 0
	[0132.772] lstrlenA (lpString="*.pptx") returned 6
	[0132.772] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk", pszSpec="*.txt") returned 0
	[0132.772] lstrlenA (lpString="*.txt") returned 5
	[0132.772] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk", pszSpec="*.pdf") returned 0
	[0132.772] lstrlenA (lpString="*.pdf") returned 5
	[0132.772] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk", pszSpec="*.htm") returned 0
	[0132.772] lstrlenA (lpString="*.htm") returned 5
	[0132.772] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk", pszSpec="*.html") returned 0
	[0132.772] lstrlenA (lpString="*.html") returned 6
	[0132.772] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk", pszSpec="*.mdb") returned 0
	[0132.772] lstrlenA (lpString="*.mdb") returned 5
	[0132.772] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk", pszSpec="*.pfx") returned 0
	[0132.772] lstrlenA (lpString="*.pfx") returned 5
	[0132.772] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk", pszSpec="*.md") returned 0
	[0132.772] lstrlenA (lpString="*.md") returned 4
	[0132.772] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk", pszSpec="*.lnk") returned 1
	[0132.772] lstrlenA (lpString="*.lnk") returned 5
	[0132.772] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk"
	[0132.772] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk"
	[0132.772] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk."
	[0132.772] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk.exe"
	[0132.772] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xnechqbxwen0mja7ol.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.773] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x481
	[0132.773] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4aefaa16, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x4aefaa16, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4aefaa16, dwHighDateTime=0x1d543d9)) returned 1
	[0132.773] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.773] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x43f, lpOverlapped=0x0) returned 1
	[0132.779] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk") returned="xnEChqbXwen0MJA7OL.lnk"
	[0132.779] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.779] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x43f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x43f, lpOverlapped=0x0) returned 1
	[0132.780] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.780] CloseHandle (hObject=0x21c) returned 1
	[0132.780] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xnechqbxwen0mja7ol.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xnechqbxwen0mja7ol.lnk.exe")) returned 1
	[0132.780] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d2fcab4, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x3d2fcab4, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x3d2fcab4, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x292, dwReserved0=0x0, dwReserved1=0x0, cFileName="xuwVMALaiz6G.lnk", cAlternateFileName="XUWVMA~1.LNK")) returned 1
	[0132.780] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.780] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="xuwVMALaiz6G.lnk") returned -1
	[0132.780] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="xuwVMALaiz6G.lnk") returned -1
	[0132.780] lstrcmpiA (lpString1="", lpString2="xuwVMALaiz6G.lnk") returned -1
	[0132.780] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnEChqbXwen0MJA7OL.lnk") returned="xnEChqbXwen0MJA7OL.lnk"
	[0132.781] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.781] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.781] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.781] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.781] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="xuwVMALaiz6G.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk"
	[0132.781] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk", pszSpec="*.zip") returned 0
	[0132.781] lstrlenA (lpString="*.zip") returned 5
	[0132.781] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk", pszSpec="*.rar") returned 0
	[0132.781] lstrlenA (lpString="*.rar") returned 5
	[0132.781] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk", pszSpec="*.7z") returned 0
	[0132.781] lstrlenA (lpString="*.7z") returned 4
	[0132.781] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk", pszSpec="*.tar") returned 0
	[0132.781] lstrlenA (lpString="*.tar") returned 5
	[0132.781] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk", pszSpec="*.gzip") returned 0
	[0132.781] lstrlenA (lpString="*.gzip") returned 6
	[0132.781] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk", pszSpec="*.jpg") returned 0
	[0132.781] lstrlenA (lpString="*.jpg") returned 5
	[0132.781] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk", pszSpec="*.jpeg") returned 0
	[0132.781] lstrlenA (lpString="*.jpeg") returned 6
	[0132.781] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk", pszSpec="*.bmp") returned 0
	[0132.781] lstrlenA (lpString="*.bmp") returned 5
	[0132.781] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk", pszSpec="*.gif") returned 0
	[0132.781] lstrlenA (lpString="*.gif") returned 5
	[0132.781] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk", pszSpec="*.png") returned 0
	[0132.781] lstrlenA (lpString="*.png") returned 5
	[0132.781] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk", pszSpec="*.doc") returned 0
	[0132.781] lstrlenA (lpString="*.doc") returned 5
	[0132.781] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk", pszSpec="*.docx") returned 0
	[0132.781] lstrlenA (lpString="*.docx") returned 6
	[0132.781] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk", pszSpec="*.xls") returned 0
	[0132.781] lstrlenA (lpString="*.xls") returned 5
	[0132.781] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk", pszSpec="*.xlsx") returned 0
	[0132.781] lstrlenA (lpString="*.xlsx") returned 6
	[0132.782] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk", pszSpec="*.ppt") returned 0
	[0132.782] lstrlenA (lpString="*.ppt") returned 5
	[0132.782] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk", pszSpec="*.pptx") returned 0
	[0132.782] lstrlenA (lpString="*.pptx") returned 6
	[0132.782] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk", pszSpec="*.txt") returned 0
	[0132.782] lstrlenA (lpString="*.txt") returned 5
	[0132.782] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk", pszSpec="*.pdf") returned 0
	[0132.782] lstrlenA (lpString="*.pdf") returned 5
	[0132.782] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk", pszSpec="*.htm") returned 0
	[0132.782] lstrlenA (lpString="*.htm") returned 5
	[0132.782] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk", pszSpec="*.html") returned 0
	[0132.782] lstrlenA (lpString="*.html") returned 6
	[0132.782] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk", pszSpec="*.mdb") returned 0
	[0132.782] lstrlenA (lpString="*.mdb") returned 5
	[0132.782] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk", pszSpec="*.pfx") returned 0
	[0132.782] lstrlenA (lpString="*.pfx") returned 5
	[0132.782] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk", pszSpec="*.md") returned 0
	[0132.782] lstrlenA (lpString="*.md") returned 4
	[0132.782] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk", pszSpec="*.lnk") returned 1
	[0132.782] lstrlenA (lpString="*.lnk") returned 5
	[0132.782] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk"
	[0132.782] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk"
	[0132.782] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk."
	[0132.782] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk.exe"
	[0132.782] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xuwvmalaiz6g.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.783] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x292
	[0132.783] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3d2fcab4, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x3d2fcab4, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3d2fcab4, dwHighDateTime=0x1d543d9)) returned 1
	[0132.783] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.783] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x250, lpOverlapped=0x0) returned 1
	[0132.783] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk") returned="xuwVMALaiz6G.lnk"
	[0132.783] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.783] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x250, lpOverlapped=0x0) returned 1
	[0132.784] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.784] CloseHandle (hObject=0x21c) returned 1
	[0132.784] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xuwvmalaiz6g.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xuwvmalaiz6g.lnk.exe")) returned 1
	[0132.784] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d90018a, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x4d90018a, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x4d90018a, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="XZyKloOSGV-s.lnk", cAlternateFileName="XZYKLO~1.LNK")) returned 1
	[0132.784] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.784] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="XZyKloOSGV-s.lnk") returned -1
	[0132.784] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="XZyKloOSGV-s.lnk") returned -1
	[0132.784] lstrcmpiA (lpString1="", lpString2="XZyKloOSGV-s.lnk") returned -1
	[0132.785] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuwVMALaiz6G.lnk") returned="xuwVMALaiz6G.lnk"
	[0132.785] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.785] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.785] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.785] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.785] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="XZyKloOSGV-s.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk"
	[0132.785] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk", pszSpec="*.zip") returned 0
	[0132.785] lstrlenA (lpString="*.zip") returned 5
	[0132.785] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk", pszSpec="*.rar") returned 0
	[0132.785] lstrlenA (lpString="*.rar") returned 5
	[0132.785] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk", pszSpec="*.7z") returned 0
	[0132.785] lstrlenA (lpString="*.7z") returned 4
	[0132.785] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk", pszSpec="*.tar") returned 0
	[0132.785] lstrlenA (lpString="*.tar") returned 5
	[0132.785] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk", pszSpec="*.gzip") returned 0
	[0132.785] lstrlenA (lpString="*.gzip") returned 6
	[0132.785] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk", pszSpec="*.jpg") returned 0
	[0132.785] lstrlenA (lpString="*.jpg") returned 5
	[0132.785] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk", pszSpec="*.jpeg") returned 0
	[0132.785] lstrlenA (lpString="*.jpeg") returned 6
	[0132.785] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk", pszSpec="*.bmp") returned 0
	[0132.785] lstrlenA (lpString="*.bmp") returned 5
	[0132.785] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk", pszSpec="*.gif") returned 0
	[0132.785] lstrlenA (lpString="*.gif") returned 5
	[0132.785] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk", pszSpec="*.png") returned 0
	[0132.785] lstrlenA (lpString="*.png") returned 5
	[0132.785] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk", pszSpec="*.doc") returned 0
	[0132.785] lstrlenA (lpString="*.doc") returned 5
	[0132.785] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk", pszSpec="*.docx") returned 0
	[0132.785] lstrlenA (lpString="*.docx") returned 6
	[0132.785] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk", pszSpec="*.xls") returned 0
	[0132.785] lstrlenA (lpString="*.xls") returned 5
	[0132.785] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk", pszSpec="*.xlsx") returned 0
	[0132.786] lstrlenA (lpString="*.xlsx") returned 6
	[0132.786] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk", pszSpec="*.ppt") returned 0
	[0132.786] lstrlenA (lpString="*.ppt") returned 5
	[0132.786] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk", pszSpec="*.pptx") returned 0
	[0132.786] lstrlenA (lpString="*.pptx") returned 6
	[0132.786] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk", pszSpec="*.txt") returned 0
	[0132.786] lstrlenA (lpString="*.txt") returned 5
	[0132.786] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk", pszSpec="*.pdf") returned 0
	[0132.786] lstrlenA (lpString="*.pdf") returned 5
	[0132.786] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk", pszSpec="*.htm") returned 0
	[0132.786] lstrlenA (lpString="*.htm") returned 5
	[0132.786] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk", pszSpec="*.html") returned 0
	[0132.786] lstrlenA (lpString="*.html") returned 6
	[0132.786] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk", pszSpec="*.mdb") returned 0
	[0132.786] lstrlenA (lpString="*.mdb") returned 5
	[0132.786] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk", pszSpec="*.pfx") returned 0
	[0132.786] lstrlenA (lpString="*.pfx") returned 5
	[0132.786] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk", pszSpec="*.md") returned 0
	[0132.786] lstrlenA (lpString="*.md") returned 4
	[0132.786] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk", pszSpec="*.lnk") returned 1
	[0132.786] lstrlenA (lpString="*.lnk") returned 5
	[0132.786] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk"
	[0132.786] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk"
	[0132.786] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk."
	[0132.786] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk.exe"
	[0132.786] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xzykloosgv-s.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.787] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3c4
	[0132.787] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4d90018a, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x4d90018a, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4d90018a, dwHighDateTime=0x1d543d9)) returned 1
	[0132.787] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.787] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x382, lpOverlapped=0x0) returned 1
	[0132.787] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk") returned="XZyKloOSGV-s.lnk"
	[0132.787] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.787] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x382, lpOverlapped=0x0) returned 1
	[0132.788] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.788] CloseHandle (hObject=0x21c) returned 1
	[0132.788] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xzykloosgv-s.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xzykloosgv-s.lnk.exe")) returned 1
	[0132.788] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a97c79, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x49a97c79, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x49a97c79, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x3e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y47wkBjpf pm.lnk", cAlternateFileName="Y47WKB~1.LNK")) returned 1
	[0132.789] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.789] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Y47wkBjpf pm.lnk") returned -1
	[0132.789] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Y47wkBjpf pm.lnk") returned -1
	[0132.789] lstrcmpiA (lpString1="", lpString2="Y47wkBjpf pm.lnk") returned -1
	[0132.789] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZyKloOSGV-s.lnk") returned="XZyKloOSGV-s.lnk"
	[0132.789] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.789] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.789] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.789] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.789] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="Y47wkBjpf pm.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk"
	[0132.789] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk", pszSpec="*.zip") returned 0
	[0132.789] lstrlenA (lpString="*.zip") returned 5
	[0132.789] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk", pszSpec="*.rar") returned 0
	[0132.789] lstrlenA (lpString="*.rar") returned 5
	[0132.789] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk", pszSpec="*.7z") returned 0
	[0132.789] lstrlenA (lpString="*.7z") returned 4
	[0132.789] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk", pszSpec="*.tar") returned 0
	[0132.789] lstrlenA (lpString="*.tar") returned 5
	[0132.789] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk", pszSpec="*.gzip") returned 0
	[0132.789] lstrlenA (lpString="*.gzip") returned 6
	[0132.789] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk", pszSpec="*.jpg") returned 0
	[0132.789] lstrlenA (lpString="*.jpg") returned 5
	[0132.789] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk", pszSpec="*.jpeg") returned 0
	[0132.789] lstrlenA (lpString="*.jpeg") returned 6
	[0132.789] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk", pszSpec="*.bmp") returned 0
	[0132.789] lstrlenA (lpString="*.bmp") returned 5
	[0132.789] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk", pszSpec="*.gif") returned 0
	[0132.789] lstrlenA (lpString="*.gif") returned 5
	[0132.789] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk", pszSpec="*.png") returned 0
	[0132.789] lstrlenA (lpString="*.png") returned 5
	[0132.789] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk", pszSpec="*.doc") returned 0
	[0132.790] lstrlenA (lpString="*.doc") returned 5
	[0132.790] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk", pszSpec="*.docx") returned 0
	[0132.790] lstrlenA (lpString="*.docx") returned 6
	[0132.790] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk", pszSpec="*.xls") returned 0
	[0132.790] lstrlenA (lpString="*.xls") returned 5
	[0132.790] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk", pszSpec="*.xlsx") returned 0
	[0132.790] lstrlenA (lpString="*.xlsx") returned 6
	[0132.790] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk", pszSpec="*.ppt") returned 0
	[0132.790] lstrlenA (lpString="*.ppt") returned 5
	[0132.790] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk", pszSpec="*.pptx") returned 0
	[0132.790] lstrlenA (lpString="*.pptx") returned 6
	[0132.790] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk", pszSpec="*.txt") returned 0
	[0132.790] lstrlenA (lpString="*.txt") returned 5
	[0132.790] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk", pszSpec="*.pdf") returned 0
	[0132.790] lstrlenA (lpString="*.pdf") returned 5
	[0132.790] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk", pszSpec="*.htm") returned 0
	[0132.790] lstrlenA (lpString="*.htm") returned 5
	[0132.790] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk", pszSpec="*.html") returned 0
	[0132.790] lstrlenA (lpString="*.html") returned 6
	[0132.790] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk", pszSpec="*.mdb") returned 0
	[0132.790] lstrlenA (lpString="*.mdb") returned 5
	[0132.790] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk", pszSpec="*.pfx") returned 0
	[0132.790] lstrlenA (lpString="*.pfx") returned 5
	[0132.790] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk", pszSpec="*.md") returned 0
	[0132.790] lstrlenA (lpString="*.md") returned 4
	[0132.790] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk", pszSpec="*.lnk") returned 1
	[0132.790] lstrlenA (lpString="*.lnk") returned 5
	[0132.790] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk"
	[0132.790] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk"
	[0132.790] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk."
	[0132.790] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk.exe"
	[0132.790] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\y47wkbjpf pm.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.791] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e5
	[0132.791] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x49a97c79, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x49a97c79, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x49a97c79, dwHighDateTime=0x1d543d9)) returned 1
	[0132.791] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.791] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x3a3, lpOverlapped=0x0) returned 1
	[0132.792] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk") returned="Y47wkBjpf pm.lnk"
	[0132.792] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.792] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x3a3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x3a3, lpOverlapped=0x0) returned 1
	[0132.792] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.792] CloseHandle (hObject=0x21c) returned 1
	[0132.792] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\y47wkbjpf pm.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\y47wkbjpf pm.lnk.exe")) returned 1
	[0132.792] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x318e15d0, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x318e15d0, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x318e15d0, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x0, dwReserved1=0x0, cFileName="yRCKRx.lnk", cAlternateFileName="")) returned 1
	[0132.793] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.793] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="yRCKRx.lnk") returned -1
	[0132.793] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="yRCKRx.lnk") returned -1
	[0132.793] lstrcmpiA (lpString1="", lpString2="yRCKRx.lnk") returned -1
	[0132.793] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y47wkBjpf pm.lnk") returned="Y47wkBjpf pm.lnk"
	[0132.793] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.793] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.793] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.793] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.793] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="yRCKRx.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk"
	[0132.793] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk", pszSpec="*.zip") returned 0
	[0132.793] lstrlenA (lpString="*.zip") returned 5
	[0132.793] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk", pszSpec="*.rar") returned 0
	[0132.793] lstrlenA (lpString="*.rar") returned 5
	[0132.793] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk", pszSpec="*.7z") returned 0
	[0132.793] lstrlenA (lpString="*.7z") returned 4
	[0132.793] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk", pszSpec="*.tar") returned 0
	[0132.793] lstrlenA (lpString="*.tar") returned 5
	[0132.793] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk", pszSpec="*.gzip") returned 0
	[0132.793] lstrlenA (lpString="*.gzip") returned 6
	[0132.793] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk", pszSpec="*.jpg") returned 0
	[0132.793] lstrlenA (lpString="*.jpg") returned 5
	[0132.793] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk", pszSpec="*.jpeg") returned 0
	[0132.793] lstrlenA (lpString="*.jpeg") returned 6
	[0132.793] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk", pszSpec="*.bmp") returned 0
	[0132.793] lstrlenA (lpString="*.bmp") returned 5
	[0132.793] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk", pszSpec="*.gif") returned 0
	[0132.793] lstrlenA (lpString="*.gif") returned 5
	[0132.793] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk", pszSpec="*.png") returned 0
	[0132.793] lstrlenA (lpString="*.png") returned 5
	[0132.793] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk", pszSpec="*.doc") returned 0
	[0132.793] lstrlenA (lpString="*.doc") returned 5
	[0132.793] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk", pszSpec="*.docx") returned 0
	[0132.794] lstrlenA (lpString="*.docx") returned 6
	[0132.794] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk", pszSpec="*.xls") returned 0
	[0132.794] lstrlenA (lpString="*.xls") returned 5
	[0132.794] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk", pszSpec="*.xlsx") returned 0
	[0132.794] lstrlenA (lpString="*.xlsx") returned 6
	[0132.794] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk", pszSpec="*.ppt") returned 0
	[0132.794] lstrlenA (lpString="*.ppt") returned 5
	[0132.794] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk", pszSpec="*.pptx") returned 0
	[0132.794] lstrlenA (lpString="*.pptx") returned 6
	[0132.794] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk", pszSpec="*.txt") returned 0
	[0132.794] lstrlenA (lpString="*.txt") returned 5
	[0132.794] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk", pszSpec="*.pdf") returned 0
	[0132.794] lstrlenA (lpString="*.pdf") returned 5
	[0132.794] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk", pszSpec="*.htm") returned 0
	[0132.794] lstrlenA (lpString="*.htm") returned 5
	[0132.794] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk", pszSpec="*.html") returned 0
	[0132.794] lstrlenA (lpString="*.html") returned 6
	[0132.794] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk", pszSpec="*.mdb") returned 0
	[0132.794] lstrlenA (lpString="*.mdb") returned 5
	[0132.794] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk", pszSpec="*.pfx") returned 0
	[0132.794] lstrlenA (lpString="*.pfx") returned 5
	[0132.794] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk", pszSpec="*.md") returned 0
	[0132.794] lstrlenA (lpString="*.md") returned 4
	[0132.794] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk", pszSpec="*.lnk") returned 1
	[0132.794] lstrlenA (lpString="*.lnk") returned 5
	[0132.794] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk"
	[0132.794] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk"
	[0132.794] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk."
	[0132.794] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk.exe"
	[0132.794] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\yrckrx.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.795] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x272
	[0132.795] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x318e15d0, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x318e15d0, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x318e15d0, dwHighDateTime=0x1d543d9)) returned 1
	[0132.795] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.795] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x230, lpOverlapped=0x0) returned 1
	[0132.796] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk") returned="yRCKRx.lnk"
	[0132.796] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.796] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x230, lpOverlapped=0x0) returned 1
	[0132.796] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.796] CloseHandle (hObject=0x21c) returned 1
	[0132.796] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\yrckrx.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\yrckrx.lnk.exe")) returned 1
	[0132.797] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43ca48c4, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x43ca48c4, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x43ca48c4, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x292, dwReserved0=0x0, dwReserved1=0x0, cFileName="YUGJRIP95N2T.flv.lnk", cAlternateFileName="YUGJRI~1.LNK")) returned 1
	[0132.797] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.797] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="YUGJRIP95N2T.flv.lnk") returned -1
	[0132.797] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="YUGJRIP95N2T.flv.lnk") returned -1
	[0132.797] lstrcmpiA (lpString1="", lpString2="YUGJRIP95N2T.flv.lnk") returned -1
	[0132.797] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yRCKRx.lnk") returned="yRCKRx.lnk"
	[0132.797] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.797] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.797] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.797] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.797] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="YUGJRIP95N2T.flv.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk"
	[0132.797] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk", pszSpec="*.zip") returned 0
	[0132.797] lstrlenA (lpString="*.zip") returned 5
	[0132.797] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk", pszSpec="*.rar") returned 0
	[0132.798] lstrlenA (lpString="*.rar") returned 5
	[0132.798] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk", pszSpec="*.7z") returned 0
	[0132.798] lstrlenA (lpString="*.7z") returned 4
	[0132.798] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk", pszSpec="*.tar") returned 0
	[0132.798] lstrlenA (lpString="*.tar") returned 5
	[0132.798] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk", pszSpec="*.gzip") returned 0
	[0132.798] lstrlenA (lpString="*.gzip") returned 6
	[0132.798] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk", pszSpec="*.jpg") returned 0
	[0132.798] lstrlenA (lpString="*.jpg") returned 5
	[0132.798] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk", pszSpec="*.jpeg") returned 0
	[0132.798] lstrlenA (lpString="*.jpeg") returned 6
	[0132.798] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk", pszSpec="*.bmp") returned 0
	[0132.798] lstrlenA (lpString="*.bmp") returned 5
	[0132.798] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk", pszSpec="*.gif") returned 0
	[0132.798] lstrlenA (lpString="*.gif") returned 5
	[0132.798] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk", pszSpec="*.png") returned 0
	[0132.798] lstrlenA (lpString="*.png") returned 5
	[0132.798] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk", pszSpec="*.doc") returned 0
	[0132.798] lstrlenA (lpString="*.doc") returned 5
	[0132.798] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk", pszSpec="*.docx") returned 0
	[0132.798] lstrlenA (lpString="*.docx") returned 6
	[0132.798] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk", pszSpec="*.xls") returned 0
	[0132.798] lstrlenA (lpString="*.xls") returned 5
	[0132.798] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk", pszSpec="*.xlsx") returned 0
	[0132.798] lstrlenA (lpString="*.xlsx") returned 6
	[0132.798] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk", pszSpec="*.ppt") returned 0
	[0132.798] lstrlenA (lpString="*.ppt") returned 5
	[0132.798] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk", pszSpec="*.pptx") returned 0
	[0132.798] lstrlenA (lpString="*.pptx") returned 6
	[0132.798] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk", pszSpec="*.txt") returned 0
	[0132.798] lstrlenA (lpString="*.txt") returned 5
	[0132.798] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk", pszSpec="*.pdf") returned 0
	[0132.798] lstrlenA (lpString="*.pdf") returned 5
	[0132.798] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk", pszSpec="*.htm") returned 0
	[0132.798] lstrlenA (lpString="*.htm") returned 5
	[0132.799] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk", pszSpec="*.html") returned 0
	[0132.799] lstrlenA (lpString="*.html") returned 6
	[0132.799] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk", pszSpec="*.mdb") returned 0
	[0132.799] lstrlenA (lpString="*.mdb") returned 5
	[0132.799] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk", pszSpec="*.pfx") returned 0
	[0132.799] lstrlenA (lpString="*.pfx") returned 5
	[0132.799] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk", pszSpec="*.md") returned 0
	[0132.799] lstrlenA (lpString="*.md") returned 4
	[0132.799] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk", pszSpec="*.lnk") returned 1
	[0132.799] lstrlenA (lpString="*.lnk") returned 5
	[0132.799] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk"
	[0132.799] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk"
	[0132.799] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk."
	[0132.799] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk.exe"
	[0132.799] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\yugjrip95n2t.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.799] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x292
	[0132.799] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x43ca48c4, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x43ca48c4, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x43ca48c4, dwHighDateTime=0x1d543d9)) returned 1
	[0132.799] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.799] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x250, lpOverlapped=0x0) returned 1
	[0132.800] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk") returned="YUGJRIP95N2T.flv.lnk"
	[0132.800] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.800] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x250, lpOverlapped=0x0) returned 1
	[0132.800] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.800] CloseHandle (hObject=0x21c) returned 1
	[0132.800] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\yugjrip95n2t.flv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\yugjrip95n2t.flv.lnk.exe")) returned 1
	[0132.801] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cdebda7, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x3cdebda7, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x3cdebda7, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x26b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zDx2P.lnk", cAlternateFileName="")) returned 1
	[0132.801] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.801] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="zDx2P.lnk") returned -1
	[0132.801] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="zDx2P.lnk") returned -1
	[0132.801] lstrcmpiA (lpString1="", lpString2="zDx2P.lnk") returned -1
	[0132.801] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YUGJRIP95N2T.flv.lnk") returned="YUGJRIP95N2T.flv.lnk"
	[0132.801] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.801] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.801] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.801] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.801] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="zDx2P.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk"
	[0132.801] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk", pszSpec="*.zip") returned 0
	[0132.801] lstrlenA (lpString="*.zip") returned 5
	[0132.802] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk", pszSpec="*.rar") returned 0
	[0132.802] lstrlenA (lpString="*.rar") returned 5
	[0132.802] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk", pszSpec="*.7z") returned 0
	[0132.802] lstrlenA (lpString="*.7z") returned 4
	[0132.802] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk", pszSpec="*.tar") returned 0
	[0132.802] lstrlenA (lpString="*.tar") returned 5
	[0132.802] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk", pszSpec="*.gzip") returned 0
	[0132.802] lstrlenA (lpString="*.gzip") returned 6
	[0132.802] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk", pszSpec="*.jpg") returned 0
	[0132.802] lstrlenA (lpString="*.jpg") returned 5
	[0132.802] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk", pszSpec="*.jpeg") returned 0
	[0132.802] lstrlenA (lpString="*.jpeg") returned 6
	[0132.802] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk", pszSpec="*.bmp") returned 0
	[0132.802] lstrlenA (lpString="*.bmp") returned 5
	[0132.802] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk", pszSpec="*.gif") returned 0
	[0132.802] lstrlenA (lpString="*.gif") returned 5
	[0132.802] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk", pszSpec="*.png") returned 0
	[0132.803] lstrlenA (lpString="*.png") returned 5
	[0132.803] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk", pszSpec="*.doc") returned 0
	[0132.803] lstrlenA (lpString="*.doc") returned 5
	[0132.803] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk", pszSpec="*.docx") returned 0
	[0132.803] lstrlenA (lpString="*.docx") returned 6
	[0132.803] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk", pszSpec="*.xls") returned 0
	[0132.803] lstrlenA (lpString="*.xls") returned 5
	[0132.803] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk", pszSpec="*.xlsx") returned 0
	[0132.803] lstrlenA (lpString="*.xlsx") returned 6
	[0132.803] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk", pszSpec="*.ppt") returned 0
	[0132.803] lstrlenA (lpString="*.ppt") returned 5
	[0132.803] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk", pszSpec="*.pptx") returned 0
	[0132.803] lstrlenA (lpString="*.pptx") returned 6
	[0132.803] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk", pszSpec="*.txt") returned 0
	[0132.803] lstrlenA (lpString="*.txt") returned 5
	[0132.803] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk", pszSpec="*.pdf") returned 0
	[0132.803] lstrlenA (lpString="*.pdf") returned 5
	[0132.803] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk", pszSpec="*.htm") returned 0
	[0132.803] lstrlenA (lpString="*.htm") returned 5
	[0132.803] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk", pszSpec="*.html") returned 0
	[0132.803] lstrlenA (lpString="*.html") returned 6
	[0132.803] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk", pszSpec="*.mdb") returned 0
	[0132.803] lstrlenA (lpString="*.mdb") returned 5
	[0132.803] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk", pszSpec="*.pfx") returned 0
	[0132.803] lstrlenA (lpString="*.pfx") returned 5
	[0132.803] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk", pszSpec="*.md") returned 0
	[0132.803] lstrlenA (lpString="*.md") returned 4
	[0132.803] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk", pszSpec="*.lnk") returned 1
	[0132.803] lstrlenA (lpString="*.lnk") returned 5
	[0132.803] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk"
	[0132.803] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk"
	[0132.803] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk."
	[0132.803] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk.exe"
	[0132.803] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zdx2p.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.804] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x26b
	[0132.804] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3cdebda7, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x3cdebda7, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3cdebda7, dwHighDateTime=0x1d543d9)) returned 1
	[0132.804] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.804] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x229, lpOverlapped=0x0) returned 1
	[0132.805] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk") returned="zDx2P.lnk"
	[0132.805] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.805] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x229, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x229, lpOverlapped=0x0) returned 1
	[0132.805] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.805] CloseHandle (hObject=0x21c) returned 1
	[0132.805] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zdx2p.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zdx2p.lnk.exe")) returned 1
	[0132.806] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52055927, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x52055927, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x5207bd84, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x2ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="zGbyLnnoR.lnk", cAlternateFileName="ZGBYLN~1.LNK")) returned 1
	[0132.806] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.806] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="zGbyLnnoR.lnk") returned -1
	[0132.806] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="zGbyLnnoR.lnk") returned -1
	[0132.806] lstrcmpiA (lpString1="", lpString2="zGbyLnnoR.lnk") returned -1
	[0132.806] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zDx2P.lnk") returned="zDx2P.lnk"
	[0132.806] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.807] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.807] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.807] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.807] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="zGbyLnnoR.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk"
	[0132.807] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk", pszSpec="*.zip") returned 0
	[0132.807] lstrlenA (lpString="*.zip") returned 5
	[0132.807] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk", pszSpec="*.rar") returned 0
	[0132.807] lstrlenA (lpString="*.rar") returned 5
	[0132.807] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk", pszSpec="*.7z") returned 0
	[0132.807] lstrlenA (lpString="*.7z") returned 4
	[0132.807] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk", pszSpec="*.tar") returned 0
	[0132.807] lstrlenA (lpString="*.tar") returned 5
	[0132.807] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk", pszSpec="*.gzip") returned 0
	[0132.807] lstrlenA (lpString="*.gzip") returned 6
	[0132.807] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk", pszSpec="*.jpg") returned 0
	[0132.807] lstrlenA (lpString="*.jpg") returned 5
	[0132.807] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk", pszSpec="*.jpeg") returned 0
	[0132.807] lstrlenA (lpString="*.jpeg") returned 6
	[0132.807] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk", pszSpec="*.bmp") returned 0
	[0132.807] lstrlenA (lpString="*.bmp") returned 5
	[0132.807] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk", pszSpec="*.gif") returned 0
	[0132.807] lstrlenA (lpString="*.gif") returned 5
	[0132.807] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk", pszSpec="*.png") returned 0
	[0132.807] lstrlenA (lpString="*.png") returned 5
	[0132.807] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk", pszSpec="*.doc") returned 0
	[0132.807] lstrlenA (lpString="*.doc") returned 5
	[0132.807] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk", pszSpec="*.docx") returned 0
	[0132.807] lstrlenA (lpString="*.docx") returned 6
	[0132.807] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk", pszSpec="*.xls") returned 0
	[0132.807] lstrlenA (lpString="*.xls") returned 5
	[0132.807] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk", pszSpec="*.xlsx") returned 0
	[0132.807] lstrlenA (lpString="*.xlsx") returned 6
	[0132.807] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk", pszSpec="*.ppt") returned 0
	[0132.808] lstrlenA (lpString="*.ppt") returned 5
	[0132.808] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk", pszSpec="*.pptx") returned 0
	[0132.808] lstrlenA (lpString="*.pptx") returned 6
	[0132.808] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk", pszSpec="*.txt") returned 0
	[0132.808] lstrlenA (lpString="*.txt") returned 5
	[0132.808] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk", pszSpec="*.pdf") returned 0
	[0132.808] lstrlenA (lpString="*.pdf") returned 5
	[0132.808] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk", pszSpec="*.htm") returned 0
	[0132.808] lstrlenA (lpString="*.htm") returned 5
	[0132.808] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk", pszSpec="*.html") returned 0
	[0132.808] lstrlenA (lpString="*.html") returned 6
	[0132.808] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk", pszSpec="*.mdb") returned 0
	[0132.808] lstrlenA (lpString="*.mdb") returned 5
	[0132.808] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk", pszSpec="*.pfx") returned 0
	[0132.808] lstrlenA (lpString="*.pfx") returned 5
	[0132.808] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk", pszSpec="*.md") returned 0
	[0132.808] lstrlenA (lpString="*.md") returned 4
	[0132.808] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk", pszSpec="*.lnk") returned 1
	[0132.808] lstrlenA (lpString="*.lnk") returned 5
	[0132.808] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk"
	[0132.808] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk"
	[0132.808] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk."
	[0132.808] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk.exe"
	[0132.808] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zgbylnnor.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.808] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ea
	[0132.809] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x52055927, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x52055927, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5207bd84, dwHighDateTime=0x1d543d9)) returned 1
	[0132.809] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.809] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x2a8, lpOverlapped=0x0) returned 1
	[0132.809] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk") returned="zGbyLnnoR.lnk"
	[0132.809] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.809] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x2a8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x2a8, lpOverlapped=0x0) returned 1
	[0132.810] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.810] CloseHandle (hObject=0x21c) returned 1
	[0132.810] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zgbylnnor.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zgbylnnor.lnk.exe")) returned 1
	[0132.810] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21228040, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x21228040, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x21228040, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x560, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZVeQCbG3.lnk", cAlternateFileName="")) returned 1
	[0132.810] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.810] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="ZVeQCbG3.lnk") returned -1
	[0132.810] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="ZVeQCbG3.lnk") returned -1
	[0132.810] lstrcmpiA (lpString1="", lpString2="ZVeQCbG3.lnk") returned -1
	[0132.810] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGbyLnnoR.lnk") returned="zGbyLnnoR.lnk"
	[0132.810] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.810] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.811] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.811] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.811] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ZVeQCbG3.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk"
	[0132.811] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk", pszSpec="*.zip") returned 0
	[0132.811] lstrlenA (lpString="*.zip") returned 5
	[0132.811] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk", pszSpec="*.rar") returned 0
	[0132.811] lstrlenA (lpString="*.rar") returned 5
	[0132.811] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk", pszSpec="*.7z") returned 0
	[0132.811] lstrlenA (lpString="*.7z") returned 4
	[0132.811] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk", pszSpec="*.tar") returned 0
	[0132.811] lstrlenA (lpString="*.tar") returned 5
	[0132.811] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk", pszSpec="*.gzip") returned 0
	[0132.811] lstrlenA (lpString="*.gzip") returned 6
	[0132.811] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk", pszSpec="*.jpg") returned 0
	[0132.811] lstrlenA (lpString="*.jpg") returned 5
	[0132.811] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk", pszSpec="*.jpeg") returned 0
	[0132.811] lstrlenA (lpString="*.jpeg") returned 6
	[0132.811] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk", pszSpec="*.bmp") returned 0
	[0132.811] lstrlenA (lpString="*.bmp") returned 5
	[0132.811] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk", pszSpec="*.gif") returned 0
	[0132.811] lstrlenA (lpString="*.gif") returned 5
	[0132.811] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk", pszSpec="*.png") returned 0
	[0132.811] lstrlenA (lpString="*.png") returned 5
	[0132.811] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk", pszSpec="*.doc") returned 0
	[0132.811] lstrlenA (lpString="*.doc") returned 5
	[0132.811] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk", pszSpec="*.docx") returned 0
	[0132.811] lstrlenA (lpString="*.docx") returned 6
	[0132.811] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk", pszSpec="*.xls") returned 0
	[0132.811] lstrlenA (lpString="*.xls") returned 5
	[0132.811] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk", pszSpec="*.xlsx") returned 0
	[0132.811] lstrlenA (lpString="*.xlsx") returned 6
	[0132.811] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk", pszSpec="*.ppt") returned 0
	[0132.811] lstrlenA (lpString="*.ppt") returned 5
	[0132.811] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk", pszSpec="*.pptx") returned 0
	[0132.812] lstrlenA (lpString="*.pptx") returned 6
	[0132.812] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk", pszSpec="*.txt") returned 0
	[0132.812] lstrlenA (lpString="*.txt") returned 5
	[0132.812] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk", pszSpec="*.pdf") returned 0
	[0132.812] lstrlenA (lpString="*.pdf") returned 5
	[0132.812] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk", pszSpec="*.htm") returned 0
	[0132.812] lstrlenA (lpString="*.htm") returned 5
	[0132.812] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk", pszSpec="*.html") returned 0
	[0132.812] lstrlenA (lpString="*.html") returned 6
	[0132.812] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk", pszSpec="*.mdb") returned 0
	[0132.812] lstrlenA (lpString="*.mdb") returned 5
	[0132.812] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk", pszSpec="*.pfx") returned 0
	[0132.812] lstrlenA (lpString="*.pfx") returned 5
	[0132.812] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk", pszSpec="*.md") returned 0
	[0132.812] lstrlenA (lpString="*.md") returned 4
	[0132.812] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk", pszSpec="*.lnk") returned 1
	[0132.812] lstrlenA (lpString="*.lnk") returned 5
	[0132.812] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk"
	[0132.812] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk"
	[0132.812] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk."
	[0132.812] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk.exe"
	[0132.812] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zveqcbg3.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.812] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x560
	[0132.812] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x21228040, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x21228040, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x21228040, dwHighDateTime=0x1d543d9)) returned 1
	[0132.813] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.813] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x51e, lpOverlapped=0x0) returned 1
	[0132.813] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk") returned="ZVeQCbG3.lnk"
	[0132.813] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.813] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x51e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x51e, lpOverlapped=0x0) returned 1
	[0132.813] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.814] CloseHandle (hObject=0x21c) returned 1
	[0132.814] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zveqcbg3.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zveqcbg3.lnk.exe")) returned 1
	[0132.814] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34782b44, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x34782b44, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x34782b44, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x542, dwReserved0=0x0, dwReserved1=0x0, cFileName="zXTCHEoyb4wNbApqXI.lnk", cAlternateFileName="ZXTCHE~1.LNK")) returned 1
	[0132.814] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.814] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="zXTCHEoyb4wNbApqXI.lnk") returned -1
	[0132.814] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="zXTCHEoyb4wNbApqXI.lnk") returned -1
	[0132.814] lstrcmpiA (lpString1="", lpString2="zXTCHEoyb4wNbApqXI.lnk") returned -1
	[0132.814] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZVeQCbG3.lnk") returned="ZVeQCbG3.lnk"
	[0132.814] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.814] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.814] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.814] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.815] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="zXTCHEoyb4wNbApqXI.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk"
	[0132.815] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk", pszSpec="*.zip") returned 0
	[0132.815] lstrlenA (lpString="*.zip") returned 5
	[0132.815] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk", pszSpec="*.rar") returned 0
	[0132.815] lstrlenA (lpString="*.rar") returned 5
	[0132.815] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk", pszSpec="*.7z") returned 0
	[0132.815] lstrlenA (lpString="*.7z") returned 4
	[0132.815] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk", pszSpec="*.tar") returned 0
	[0132.815] lstrlenA (lpString="*.tar") returned 5
	[0132.815] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk", pszSpec="*.gzip") returned 0
	[0132.815] lstrlenA (lpString="*.gzip") returned 6
	[0132.815] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk", pszSpec="*.jpg") returned 0
	[0132.815] lstrlenA (lpString="*.jpg") returned 5
	[0132.815] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk", pszSpec="*.jpeg") returned 0
	[0132.815] lstrlenA (lpString="*.jpeg") returned 6
	[0132.815] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk", pszSpec="*.bmp") returned 0
	[0132.815] lstrlenA (lpString="*.bmp") returned 5
	[0132.815] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk", pszSpec="*.gif") returned 0
	[0132.815] lstrlenA (lpString="*.gif") returned 5
	[0132.815] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk", pszSpec="*.png") returned 0
	[0132.815] lstrlenA (lpString="*.png") returned 5
	[0132.815] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk", pszSpec="*.doc") returned 0
	[0132.815] lstrlenA (lpString="*.doc") returned 5
	[0132.815] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk", pszSpec="*.docx") returned 0
	[0132.815] lstrlenA (lpString="*.docx") returned 6
	[0132.815] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk", pszSpec="*.xls") returned 0
	[0132.815] lstrlenA (lpString="*.xls") returned 5
	[0132.815] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk", pszSpec="*.xlsx") returned 0
	[0132.815] lstrlenA (lpString="*.xlsx") returned 6
	[0132.815] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk", pszSpec="*.ppt") returned 0
	[0132.815] lstrlenA (lpString="*.ppt") returned 5
	[0132.815] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk", pszSpec="*.pptx") returned 0
	[0132.815] lstrlenA (lpString="*.pptx") returned 6
	[0132.815] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk", pszSpec="*.txt") returned 0
	[0132.816] lstrlenA (lpString="*.txt") returned 5
	[0132.816] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk", pszSpec="*.pdf") returned 0
	[0132.816] lstrlenA (lpString="*.pdf") returned 5
	[0132.816] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk", pszSpec="*.htm") returned 0
	[0132.816] lstrlenA (lpString="*.htm") returned 5
	[0132.816] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk", pszSpec="*.html") returned 0
	[0132.816] lstrlenA (lpString="*.html") returned 6
	[0132.816] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk", pszSpec="*.mdb") returned 0
	[0132.816] lstrlenA (lpString="*.mdb") returned 5
	[0132.816] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk", pszSpec="*.pfx") returned 0
	[0132.816] lstrlenA (lpString="*.pfx") returned 5
	[0132.816] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk", pszSpec="*.md") returned 0
	[0132.816] lstrlenA (lpString="*.md") returned 4
	[0132.816] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk", pszSpec="*.lnk") returned 1
	[0132.816] lstrlenA (lpString="*.lnk") returned 5
	[0132.816] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk"
	[0132.816] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk"
	[0132.816] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk."
	[0132.816] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk.exe"
	[0132.816] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zxtcheoyb4wnbapqxi.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.816] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x542
	[0132.816] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x34782b44, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x34782b44, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x34782b44, dwHighDateTime=0x1d543d9)) returned 1
	[0132.816] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.817] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x500, lpOverlapped=0x0) returned 1
	[0132.817] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk") returned="zXTCHEoyb4wNbApqXI.lnk"
	[0132.817] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.817] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x500, lpOverlapped=0x0) returned 1
	[0132.817] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.818] CloseHandle (hObject=0x21c) returned 1
	[0132.818] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zxtcheoyb4wnbapqxi.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zxtcheoyb4wnbapqxi.lnk.exe")) returned 1
	[0132.818] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d81173, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x5173e962, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x5173e962, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x37f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZYtNaTjD-bN8.lnk", cAlternateFileName="ZYTNAT~1.LNK")) returned 1
	[0132.818] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.818] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="ZYtNaTjD-bN8.lnk") returned -1
	[0132.818] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="ZYtNaTjD-bN8.lnk") returned -1
	[0132.818] lstrcmpiA (lpString1="", lpString2="ZYtNaTjD-bN8.lnk") returned -1
	[0132.818] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXTCHEoyb4wNbApqXI.lnk") returned="zXTCHEoyb4wNbApqXI.lnk"
	[0132.818] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.819] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.819] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.819] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.819] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ZYtNaTjD-bN8.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk"
	[0132.819] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk", pszSpec="*.zip") returned 0
	[0132.819] lstrlenA (lpString="*.zip") returned 5
	[0132.819] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk", pszSpec="*.rar") returned 0
	[0132.819] lstrlenA (lpString="*.rar") returned 5
	[0132.819] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk", pszSpec="*.7z") returned 0
	[0132.819] lstrlenA (lpString="*.7z") returned 4
	[0132.819] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk", pszSpec="*.tar") returned 0
	[0132.819] lstrlenA (lpString="*.tar") returned 5
	[0132.819] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk", pszSpec="*.gzip") returned 0
	[0132.819] lstrlenA (lpString="*.gzip") returned 6
	[0132.819] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk", pszSpec="*.jpg") returned 0
	[0132.819] lstrlenA (lpString="*.jpg") returned 5
	[0132.819] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk", pszSpec="*.jpeg") returned 0
	[0132.819] lstrlenA (lpString="*.jpeg") returned 6
	[0132.819] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk", pszSpec="*.bmp") returned 0
	[0132.819] lstrlenA (lpString="*.bmp") returned 5
	[0132.819] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk", pszSpec="*.gif") returned 0
	[0132.819] lstrlenA (lpString="*.gif") returned 5
	[0132.819] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk", pszSpec="*.png") returned 0
	[0132.819] lstrlenA (lpString="*.png") returned 5
	[0132.819] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk", pszSpec="*.doc") returned 0
	[0132.819] lstrlenA (lpString="*.doc") returned 5
	[0132.819] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk", pszSpec="*.docx") returned 0
	[0132.819] lstrlenA (lpString="*.docx") returned 6
	[0132.819] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk", pszSpec="*.xls") returned 0
	[0132.819] lstrlenA (lpString="*.xls") returned 5
	[0132.819] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk", pszSpec="*.xlsx") returned 0
	[0132.819] lstrlenA (lpString="*.xlsx") returned 6
	[0132.819] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk", pszSpec="*.ppt") returned 0
	[0132.819] lstrlenA (lpString="*.ppt") returned 5
	[0132.820] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk", pszSpec="*.pptx") returned 0
	[0132.820] lstrlenA (lpString="*.pptx") returned 6
	[0132.820] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk", pszSpec="*.txt") returned 0
	[0132.820] lstrlenA (lpString="*.txt") returned 5
	[0132.820] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk", pszSpec="*.pdf") returned 0
	[0132.820] lstrlenA (lpString="*.pdf") returned 5
	[0132.820] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk", pszSpec="*.htm") returned 0
	[0132.820] lstrlenA (lpString="*.htm") returned 5
	[0132.820] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk", pszSpec="*.html") returned 0
	[0132.820] lstrlenA (lpString="*.html") returned 6
	[0132.820] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk", pszSpec="*.mdb") returned 0
	[0132.820] lstrlenA (lpString="*.mdb") returned 5
	[0132.820] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk", pszSpec="*.pfx") returned 0
	[0132.820] lstrlenA (lpString="*.pfx") returned 5
	[0132.820] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk", pszSpec="*.md") returned 0
	[0132.821] lstrlenA (lpString="*.md") returned 4
	[0132.821] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk", pszSpec="*.lnk") returned 1
	[0132.821] lstrlenA (lpString="*.lnk") returned 5
	[0132.821] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk"
	[0132.821] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk"
	[0132.821] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk."
	[0132.821] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk.exe"
	[0132.821] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zytnatjd-bn8.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.822] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x37f
	[0132.822] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x15d81173, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x5173e962, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5173e962, dwHighDateTime=0x1d543d9)) returned 1
	[0132.822] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.822] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x33d, lpOverlapped=0x0) returned 1
	[0132.823] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk") returned="ZYtNaTjD-bN8.lnk"
	[0132.823] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.823] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x33d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x33d, lpOverlapped=0x0) returned 1
	[0132.823] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.823] CloseHandle (hObject=0x21c) returned 1
	[0132.823] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zytnatjd-bn8.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYtNaTjD-bN8.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zytnatjd-bn8.lnk.exe")) returned 1
	[0132.824] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x431515cd, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x431515cd, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x431515cd, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x27e, dwReserved0=0x0, dwReserved1=0x0, cFileName="zz_ENPhE.flv.lnk", cAlternateFileName="ZZ_ENP~1.LNK")) returned 1
	[0132.824] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.824] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="zz_ENPhE.flv.lnk") returned -1
	[0132.824] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="zz_ENPhE.flv.lnk") returned -1
	[0132.824] lstrcmpiA (lpString1="", lpString2="zz_ENPhE.flv.lnk") returned -1
	[0132.824] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.824] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.824] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.824] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.824] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="zz_ENPhE.flv.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk"
	[0132.824] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk", pszSpec="*.zip") returned 0
	[0132.824] lstrlenA (lpString="*.zip") returned 5
	[0132.824] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk", pszSpec="*.rar") returned 0
	[0132.824] lstrlenA (lpString="*.rar") returned 5
	[0132.824] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk", pszSpec="*.7z") returned 0
	[0132.824] lstrlenA (lpString="*.7z") returned 4
	[0132.824] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk", pszSpec="*.tar") returned 0
	[0132.824] lstrlenA (lpString="*.tar") returned 5
	[0132.824] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk", pszSpec="*.gzip") returned 0
	[0132.824] lstrlenA (lpString="*.gzip") returned 6
	[0132.824] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk", pszSpec="*.jpg") returned 0
	[0132.824] lstrlenA (lpString="*.jpg") returned 5
	[0132.824] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk", pszSpec="*.jpeg") returned 0
	[0132.824] lstrlenA (lpString="*.jpeg") returned 6
	[0132.824] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk", pszSpec="*.bmp") returned 0
	[0132.824] lstrlenA (lpString="*.bmp") returned 5
	[0132.824] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk", pszSpec="*.gif") returned 0
	[0132.824] lstrlenA (lpString="*.gif") returned 5
	[0132.824] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk", pszSpec="*.png") returned 0
	[0132.825] lstrlenA (lpString="*.png") returned 5
	[0132.825] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk", pszSpec="*.doc") returned 0
	[0132.825] lstrlenA (lpString="*.doc") returned 5
	[0132.825] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk", pszSpec="*.docx") returned 0
	[0132.825] lstrlenA (lpString="*.docx") returned 6
	[0132.825] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk", pszSpec="*.xls") returned 0
	[0132.825] lstrlenA (lpString="*.xls") returned 5
	[0132.825] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk", pszSpec="*.xlsx") returned 0
	[0132.825] lstrlenA (lpString="*.xlsx") returned 6
	[0132.825] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk", pszSpec="*.ppt") returned 0
	[0132.825] lstrlenA (lpString="*.ppt") returned 5
	[0132.825] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk", pszSpec="*.pptx") returned 0
	[0132.825] lstrlenA (lpString="*.pptx") returned 6
	[0132.825] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk", pszSpec="*.txt") returned 0
	[0132.825] lstrlenA (lpString="*.txt") returned 5
	[0132.825] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk", pszSpec="*.pdf") returned 0
	[0132.825] lstrlenA (lpString="*.pdf") returned 5
	[0132.825] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk", pszSpec="*.htm") returned 0
	[0132.825] lstrlenA (lpString="*.htm") returned 5
	[0132.825] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk", pszSpec="*.html") returned 0
	[0132.825] lstrlenA (lpString="*.html") returned 6
	[0132.825] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk", pszSpec="*.mdb") returned 0
	[0132.825] lstrlenA (lpString="*.mdb") returned 5
	[0132.825] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk", pszSpec="*.pfx") returned 0
	[0132.825] lstrlenA (lpString="*.pfx") returned 5
	[0132.825] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk", pszSpec="*.md") returned 0
	[0132.825] lstrlenA (lpString="*.md") returned 4
	[0132.825] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk", pszSpec="*.lnk") returned 1
	[0132.825] lstrlenA (lpString="*.lnk") returned 5
	[0132.825] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk"
	[0132.825] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk"
	[0132.825] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk."
	[0132.825] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk.exe"
	[0132.825] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zz_enphe.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.826] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x27e
	[0132.826] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x431515cd, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x431515cd, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x431515cd, dwHighDateTime=0x1d543d9)) returned 1
	[0132.826] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.826] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x23c, lpOverlapped=0x0) returned 1
	[0132.827] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.827] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x23c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x23c, lpOverlapped=0x0) returned 1
	[0132.827] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.827] CloseHandle (hObject=0x21c) returned 1
	[0132.827] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zz_enphe.flv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zz_enphe.flv.lnk.exe")) returned 1
	[0132.828] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24b1cd26, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x24b1cd26, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x24b69225, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x288, dwReserved0=0x0, dwReserved1=0x0, cFileName="_ccVRvpY_v.lnk", cAlternateFileName="_CCVRV~1.LNK")) returned 1
	[0132.828] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.828] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="_ccVRvpY_v.lnk") returned 1
	[0132.828] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="_ccVRvpY_v.lnk") returned 1
	[0132.828] lstrcmpiA (lpString1="", lpString2="_ccVRvpY_v.lnk") returned -1
	[0132.828] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zz_ENPhE.flv.lnk") returned="zz_ENPhE.flv.lnk"
	[0132.828] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.828] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.828] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.828] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.828] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="_ccVRvpY_v.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk"
	[0132.828] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk", pszSpec="*.zip") returned 0
	[0132.828] lstrlenA (lpString="*.zip") returned 5
	[0132.828] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk", pszSpec="*.rar") returned 0
	[0132.828] lstrlenA (lpString="*.rar") returned 5
	[0132.828] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk", pszSpec="*.7z") returned 0
	[0132.828] lstrlenA (lpString="*.7z") returned 4
	[0132.828] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk", pszSpec="*.tar") returned 0
	[0132.828] lstrlenA (lpString="*.tar") returned 5
	[0132.828] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk", pszSpec="*.gzip") returned 0
	[0132.828] lstrlenA (lpString="*.gzip") returned 6
	[0132.828] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk", pszSpec="*.jpg") returned 0
	[0132.828] lstrlenA (lpString="*.jpg") returned 5
	[0132.828] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk", pszSpec="*.jpeg") returned 0
	[0132.828] lstrlenA (lpString="*.jpeg") returned 6
	[0132.828] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk", pszSpec="*.bmp") returned 0
	[0132.828] lstrlenA (lpString="*.bmp") returned 5
	[0132.828] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk", pszSpec="*.gif") returned 0
	[0132.828] lstrlenA (lpString="*.gif") returned 5
	[0132.828] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk", pszSpec="*.png") returned 0
	[0132.828] lstrlenA (lpString="*.png") returned 5
	[0132.828] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk", pszSpec="*.doc") returned 0
	[0132.829] lstrlenA (lpString="*.doc") returned 5
	[0132.829] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk", pszSpec="*.docx") returned 0
	[0132.829] lstrlenA (lpString="*.docx") returned 6
	[0132.829] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk", pszSpec="*.xls") returned 0
	[0132.829] lstrlenA (lpString="*.xls") returned 5
	[0132.829] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk", pszSpec="*.xlsx") returned 0
	[0132.829] lstrlenA (lpString="*.xlsx") returned 6
	[0132.829] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk", pszSpec="*.ppt") returned 0
	[0132.829] lstrlenA (lpString="*.ppt") returned 5
	[0132.829] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk", pszSpec="*.pptx") returned 0
	[0132.829] lstrlenA (lpString="*.pptx") returned 6
	[0132.829] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk", pszSpec="*.txt") returned 0
	[0132.829] lstrlenA (lpString="*.txt") returned 5
	[0132.829] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk", pszSpec="*.pdf") returned 0
	[0132.829] lstrlenA (lpString="*.pdf") returned 5
	[0132.829] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk", pszSpec="*.htm") returned 0
	[0132.829] lstrlenA (lpString="*.htm") returned 5
	[0132.829] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk", pszSpec="*.html") returned 0
	[0132.829] lstrlenA (lpString="*.html") returned 6
	[0132.829] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk", pszSpec="*.mdb") returned 0
	[0132.829] lstrlenA (lpString="*.mdb") returned 5
	[0132.829] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk", pszSpec="*.pfx") returned 0
	[0132.829] lstrlenA (lpString="*.pfx") returned 5
	[0132.829] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk", pszSpec="*.md") returned 0
	[0132.829] lstrlenA (lpString="*.md") returned 4
	[0132.829] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk", pszSpec="*.lnk") returned 1
	[0132.829] lstrlenA (lpString="*.lnk") returned 5
	[0132.829] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk"
	[0132.829] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk"
	[0132.829] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk."
	[0132.829] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk.exe"
	[0132.829] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\_ccvrvpy_v.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.830] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x288
	[0132.830] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x24b1cd26, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x24b1cd26, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x24b69225, dwHighDateTime=0x1d543d9)) returned 1
	[0132.830] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.830] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x246, lpOverlapped=0x0) returned 1
	[0132.831] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk") returned="_ccVRvpY_v.lnk"
	[0132.831] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.831] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x246, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x246, lpOverlapped=0x0) returned 1
	[0132.831] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.831] CloseHandle (hObject=0x21c) returned 1
	[0132.831] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\_ccvrvpy_v.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\_ccvrvpy_v.lnk.exe")) returned 1
	[0132.831] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x507bd4aa, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x507bd4aa, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x507bd4aa, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x412, dwReserved0=0x0, dwReserved1=0x0, cFileName="_cJdisVTcJibh-qJG0V6.lnk", cAlternateFileName="_CJDIS~1.LNK")) returned 1
	[0132.832] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.832] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="_cJdisVTcJibh-qJG0V6.lnk") returned 1
	[0132.832] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="_cJdisVTcJibh-qJG0V6.lnk") returned 1
	[0132.832] lstrcmpiA (lpString1="", lpString2="_cJdisVTcJibh-qJG0V6.lnk") returned -1
	[0132.832] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ccVRvpY_v.lnk") returned="_ccVRvpY_v.lnk"
	[0132.832] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.832] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.832] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.832] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.832] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="_cJdisVTcJibh-qJG0V6.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk"
	[0132.832] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk", pszSpec="*.zip") returned 0
	[0132.832] lstrlenA (lpString="*.zip") returned 5
	[0132.832] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk", pszSpec="*.rar") returned 0
	[0132.832] lstrlenA (lpString="*.rar") returned 5
	[0132.832] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk", pszSpec="*.7z") returned 0
	[0132.832] lstrlenA (lpString="*.7z") returned 4
	[0132.832] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk", pszSpec="*.tar") returned 0
	[0132.832] lstrlenA (lpString="*.tar") returned 5
	[0132.832] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk", pszSpec="*.gzip") returned 0
	[0132.832] lstrlenA (lpString="*.gzip") returned 6
	[0132.832] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk", pszSpec="*.jpg") returned 0
	[0132.832] lstrlenA (lpString="*.jpg") returned 5
	[0132.832] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk", pszSpec="*.jpeg") returned 0
	[0132.832] lstrlenA (lpString="*.jpeg") returned 6
	[0132.832] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk", pszSpec="*.bmp") returned 0
	[0132.832] lstrlenA (lpString="*.bmp") returned 5
	[0132.832] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk", pszSpec="*.gif") returned 0
	[0132.832] lstrlenA (lpString="*.gif") returned 5
	[0132.832] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk", pszSpec="*.png") returned 0
	[0132.832] lstrlenA (lpString="*.png") returned 5
	[0132.832] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk", pszSpec="*.doc") returned 0
	[0132.832] lstrlenA (lpString="*.doc") returned 5
	[0132.832] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk", pszSpec="*.docx") returned 0
	[0132.833] lstrlenA (lpString="*.docx") returned 6
	[0132.833] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk", pszSpec="*.xls") returned 0
	[0132.833] lstrlenA (lpString="*.xls") returned 5
	[0132.833] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk", pszSpec="*.xlsx") returned 0
	[0132.833] lstrlenA (lpString="*.xlsx") returned 6
	[0132.833] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk", pszSpec="*.ppt") returned 0
	[0132.833] lstrlenA (lpString="*.ppt") returned 5
	[0132.833] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk", pszSpec="*.pptx") returned 0
	[0132.833] lstrlenA (lpString="*.pptx") returned 6
	[0132.833] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk", pszSpec="*.txt") returned 0
	[0132.833] lstrlenA (lpString="*.txt") returned 5
	[0132.833] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk", pszSpec="*.pdf") returned 0
	[0132.833] lstrlenA (lpString="*.pdf") returned 5
	[0132.833] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk", pszSpec="*.htm") returned 0
	[0132.833] lstrlenA (lpString="*.htm") returned 5
	[0132.833] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk", pszSpec="*.html") returned 0
	[0132.833] lstrlenA (lpString="*.html") returned 6
	[0132.833] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk", pszSpec="*.mdb") returned 0
	[0132.833] lstrlenA (lpString="*.mdb") returned 5
	[0132.833] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk", pszSpec="*.pfx") returned 0
	[0132.833] lstrlenA (lpString="*.pfx") returned 5
	[0132.833] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk", pszSpec="*.md") returned 0
	[0132.833] lstrlenA (lpString="*.md") returned 4
	[0132.833] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk", pszSpec="*.lnk") returned 1
	[0132.833] lstrlenA (lpString="*.lnk") returned 5
	[0132.833] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk"
	[0132.833] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk"
	[0132.833] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk."
	[0132.833] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk.exe"
	[0132.833] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\_cjdisvtcjibh-qjg0v6.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.834] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x412
	[0132.834] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x507bd4aa, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x507bd4aa, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x507bd4aa, dwHighDateTime=0x1d543d9)) returned 1
	[0132.834] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.834] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x3d0, lpOverlapped=0x0) returned 1
	[0132.834] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk") returned="_cJdisVTcJibh-qJG0V6.lnk"
	[0132.834] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.835] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x3d0, lpOverlapped=0x0) returned 1
	[0132.835] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.835] CloseHandle (hObject=0x21c) returned 1
	[0132.835] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\_cjdisvtcjibh-qjg0v6.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\_cjdisvtcjibh-qjg0v6.lnk.exe")) returned 1
	[0132.835] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50619a8c, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x50619a8c, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x50619a8c, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x4df, dwReserved0=0x0, dwReserved1=0x0, cFileName="_tY8c49u.lnk", cAlternateFileName="")) returned 1
	[0132.835] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.836] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="_tY8c49u.lnk") returned 1
	[0132.836] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="_tY8c49u.lnk") returned 1
	[0132.836] lstrcmpiA (lpString1="", lpString2="_tY8c49u.lnk") returned -1
	[0132.836] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cJdisVTcJibh-qJG0V6.lnk") returned="_cJdisVTcJibh-qJG0V6.lnk"
	[0132.836] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
	[0132.836] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned=""
	[0132.836] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.836] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how-to-decrypt-files.htm")) returned 0x20
	[0132.836] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="_tY8c49u.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk"
	[0132.836] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk", pszSpec="*.zip") returned 0
	[0132.836] lstrlenA (lpString="*.zip") returned 5
	[0132.836] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk", pszSpec="*.rar") returned 0
	[0132.836] lstrlenA (lpString="*.rar") returned 5
	[0132.836] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk", pszSpec="*.7z") returned 0
	[0132.836] lstrlenA (lpString="*.7z") returned 4
	[0132.836] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk", pszSpec="*.tar") returned 0
	[0132.836] lstrlenA (lpString="*.tar") returned 5
	[0132.836] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk", pszSpec="*.gzip") returned 0
	[0132.836] lstrlenA (lpString="*.gzip") returned 6
	[0132.836] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk", pszSpec="*.jpg") returned 0
	[0132.836] lstrlenA (lpString="*.jpg") returned 5
	[0132.836] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk", pszSpec="*.jpeg") returned 0
	[0132.836] lstrlenA (lpString="*.jpeg") returned 6
	[0132.836] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk", pszSpec="*.bmp") returned 0
	[0132.836] lstrlenA (lpString="*.bmp") returned 5
	[0132.837] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk", pszSpec="*.gif") returned 0
	[0132.837] lstrlenA (lpString="*.gif") returned 5
	[0132.837] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk", pszSpec="*.png") returned 0
	[0132.837] lstrlenA (lpString="*.png") returned 5
	[0132.837] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk", pszSpec="*.doc") returned 0
	[0132.837] lstrlenA (lpString="*.doc") returned 5
	[0132.837] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk", pszSpec="*.docx") returned 0
	[0132.837] lstrlenA (lpString="*.docx") returned 6
	[0132.837] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk", pszSpec="*.xls") returned 0
	[0132.837] lstrlenA (lpString="*.xls") returned 5
	[0132.837] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk", pszSpec="*.xlsx") returned 0
	[0132.837] lstrlenA (lpString="*.xlsx") returned 6
	[0132.837] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk", pszSpec="*.ppt") returned 0
	[0132.837] lstrlenA (lpString="*.ppt") returned 5
	[0132.837] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk", pszSpec="*.pptx") returned 0
	[0132.837] lstrlenA (lpString="*.pptx") returned 6
	[0132.837] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk", pszSpec="*.txt") returned 0
	[0132.837] lstrlenA (lpString="*.txt") returned 5
	[0132.837] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk", pszSpec="*.pdf") returned 0
	[0132.837] lstrlenA (lpString="*.pdf") returned 5
	[0132.837] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk", pszSpec="*.htm") returned 0
	[0132.837] lstrlenA (lpString="*.htm") returned 5
	[0132.837] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk", pszSpec="*.html") returned 0
	[0132.837] lstrlenA (lpString="*.html") returned 6
	[0132.837] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk", pszSpec="*.mdb") returned 0
	[0132.837] lstrlenA (lpString="*.mdb") returned 5
	[0132.837] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk", pszSpec="*.pfx") returned 0
	[0132.837] lstrlenA (lpString="*.pfx") returned 5
	[0132.837] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk", pszSpec="*.md") returned 0
	[0132.837] lstrlenA (lpString="*.md") returned 4
	[0132.837] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk", pszSpec="*.lnk") returned 1
	[0132.837] lstrlenA (lpString="*.lnk") returned 5
	[0132.837] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk"
	[0132.837] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk"
	[0132.837] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk."
	[0132.837] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk.exe"
	[0132.838] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\_ty8c49u.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.838] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4df
	[0132.838] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x50619a8c, dwHighDateTime=0x1d543d9), lpLastAccessTime=0x407536*(dwLowDateTime=0x50619a8c, dwHighDateTime=0x1d543d9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x50619a8c, dwHighDateTime=0x1d543d9)) returned 1
	[0132.838] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.838] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x49d, lpOverlapped=0x0) returned 1
	[0132.839] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk") returned="_tY8c49u.lnk"
	[0132.839] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.839] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x49d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x49d, lpOverlapped=0x0) returned 1
	[0132.839] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.839] CloseHandle (hObject=0x21c) returned 1
	[0132.839] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\_ty8c49u.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_tY8c49u.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\_ty8c49u.lnk.exe")) returned 1
	[0132.840] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50619a8c, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0x50619a8c, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x50619a8c, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x4df, dwReserved0=0x0, dwReserved1=0x0, cFileName="_tY8c49u.lnk", cAlternateFileName="")) returned 0
	[0132.840] FindClose (in: hFindFile=0x7cbb90 | out: hFindFile=0x7cbb90) returned 1
	[0132.840] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e2133a4, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xd3dfad38, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x391b18ef, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1
	[0132.840] lstrcmpA (lpString1=".", lpString2="SendTo") returned -1
	[0132.840] lstrcmpA (lpString1="..", lpString2="SendTo") returned -1
	[0132.840] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\*.*") returned="*.*"
	[0132.840] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="SendTo" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo"
	[0132.840] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo") returned 56
	[0132.840] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*.*", lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e2133a4, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xd3dfad38, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x391b18ef, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb650
	[0132.841] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0132.841] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e2133a4, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xd3dfad38, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x391b18ef, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0132.841] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0132.841] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0132.841] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd69e8a1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3918b623, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3918b623, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x41b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bluetooth File Transfer.LNK", cAlternateFileName="BLUETO~1.LNK")) returned 1
	[0132.841] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.842] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Bluetooth File Transfer.LNK") returned 1
	[0132.842] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Bluetooth File Transfer.LNK") returned 1
	[0132.842] lstrcmpiA (lpString1="", lpString2="Bluetooth File Transfer.LNK") returned -1
	[0132.842] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*.*") returned="*.*"
	[0132.842] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\"
	[0132.842] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\") returned=""
	[0132.842] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.842] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0132.842] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.842] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0132.842] WriteFile (in: hFile=0x21c, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0132.843] SetFileTime (hFile=0x21c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0132.843] CloseHandle (hObject=0x21c) returned 1
	[0132.843] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", lpString2="Bluetooth File Transfer.LNK" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK"
	[0132.843] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK", pszSpec="*.zip") returned 0
	[0132.843] lstrlenA (lpString="*.zip") returned 5
	[0132.843] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK", pszSpec="*.rar") returned 0
	[0132.843] lstrlenA (lpString="*.rar") returned 5
	[0132.843] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK", pszSpec="*.7z") returned 0
	[0132.843] lstrlenA (lpString="*.7z") returned 4
	[0132.843] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK", pszSpec="*.tar") returned 0
	[0132.844] lstrlenA (lpString="*.tar") returned 5
	[0132.844] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK", pszSpec="*.gzip") returned 0
	[0132.844] lstrlenA (lpString="*.gzip") returned 6
	[0132.844] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK", pszSpec="*.jpg") returned 0
	[0132.844] lstrlenA (lpString="*.jpg") returned 5
	[0132.844] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK", pszSpec="*.jpeg") returned 0
	[0132.844] lstrlenA (lpString="*.jpeg") returned 6
	[0132.844] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK", pszSpec="*.bmp") returned 0
	[0132.844] lstrlenA (lpString="*.bmp") returned 5
	[0132.844] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK", pszSpec="*.gif") returned 0
	[0132.844] lstrlenA (lpString="*.gif") returned 5
	[0132.844] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK", pszSpec="*.png") returned 0
	[0132.844] lstrlenA (lpString="*.png") returned 5
	[0132.844] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK", pszSpec="*.doc") returned 0
	[0132.844] lstrlenA (lpString="*.doc") returned 5
	[0132.844] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK", pszSpec="*.docx") returned 0
	[0132.844] lstrlenA (lpString="*.docx") returned 6
	[0132.844] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK", pszSpec="*.xls") returned 0
	[0132.844] lstrlenA (lpString="*.xls") returned 5
	[0132.844] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK", pszSpec="*.xlsx") returned 0
	[0132.844] lstrlenA (lpString="*.xlsx") returned 6
	[0132.844] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK", pszSpec="*.ppt") returned 0
	[0132.844] lstrlenA (lpString="*.ppt") returned 5
	[0132.844] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK", pszSpec="*.pptx") returned 0
	[0132.844] lstrlenA (lpString="*.pptx") returned 6
	[0132.844] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK", pszSpec="*.txt") returned 0
	[0132.844] lstrlenA (lpString="*.txt") returned 5
	[0132.844] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK", pszSpec="*.pdf") returned 0
	[0132.844] lstrlenA (lpString="*.pdf") returned 5
	[0132.844] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK", pszSpec="*.htm") returned 0
	[0132.844] lstrlenA (lpString="*.htm") returned 5
	[0132.844] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK", pszSpec="*.html") returned 0
	[0132.844] lstrlenA (lpString="*.html") returned 6
	[0132.844] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK", pszSpec="*.mdb") returned 0
	[0132.844] lstrlenA (lpString="*.mdb") returned 5
	[0132.844] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK", pszSpec="*.pfx") returned 0
	[0132.844] lstrlenA (lpString="*.pfx") returned 5
	[0132.845] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK", pszSpec="*.md") returned 0
	[0132.845] lstrlenA (lpString="*.md") returned 4
	[0132.845] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK", pszSpec="*.lnk") returned 1
	[0132.845] lstrlenA (lpString="*.lnk") returned 5
	[0132.845] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK"
	[0132.845] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK"
	[0132.845] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK."
	[0132.845] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK.exe"
	[0132.845] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\bluetooth file transfer.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.845] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x41b
	[0132.845] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcd69e8a1, dwHighDateTime=0x1d32714), lpLastAccessTime=0x407536*(dwLowDateTime=0x3918b623, dwHighDateTime=0x1d32744), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3918b623, dwHighDateTime=0x1d32744)) returned 1
	[0132.845] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.845] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x3d9, lpOverlapped=0x0) returned 1
	[0132.847] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK") returned="Bluetooth File Transfer.LNK"
	[0132.847] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.847] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x3d9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x3d9, lpOverlapped=0x0) returned 1
	[0132.847] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.847] CloseHandle (hObject=0x21c) returned 1
	[0132.847] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\bluetooth file transfer.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\bluetooth file transfer.lnk.exe")) returned 1
	[0132.848] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2111f8cb, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2111f8cb, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc5f90064, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Compressed (zipped) Folder.ZFSendToTarget", cAlternateFileName="COMPRE~1.ZFS")) returned 1
	[0132.848] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.848] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Compressed (zipped) Folder.ZFSendToTarget") returned 1
	[0132.848] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Compressed (zipped) Folder.ZFSendToTarget") returned 1
	[0132.848] lstrcmpiA (lpString1="", lpString2="Compressed (zipped) Folder.ZFSendToTarget") returned -1
	[0132.848] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK") returned="Bluetooth File Transfer.LNK"
	[0132.848] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\"
	[0132.848] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\") returned=""
	[0132.848] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.848] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\how-to-decrypt-files.htm")) returned 0x20
	[0132.848] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", lpString2="Compressed (zipped) Folder.ZFSendToTarget" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget"
	[0132.848] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.zip") returned 0
	[0132.848] lstrlenA (lpString="*.zip") returned 5
	[0132.848] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.rar") returned 0
	[0132.848] lstrlenA (lpString="*.rar") returned 5
	[0132.848] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.7z") returned 0
	[0132.848] lstrlenA (lpString="*.7z") returned 4
	[0132.848] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.tar") returned 0
	[0132.848] lstrlenA (lpString="*.tar") returned 5
	[0132.848] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.gzip") returned 0
	[0132.849] lstrlenA (lpString="*.gzip") returned 6
	[0132.849] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.jpg") returned 0
	[0132.849] lstrlenA (lpString="*.jpg") returned 5
	[0132.849] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.jpeg") returned 0
	[0132.849] lstrlenA (lpString="*.jpeg") returned 6
	[0132.849] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.bmp") returned 0
	[0132.849] lstrlenA (lpString="*.bmp") returned 5
	[0132.849] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.gif") returned 0
	[0132.849] lstrlenA (lpString="*.gif") returned 5
	[0132.849] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.png") returned 0
	[0132.849] lstrlenA (lpString="*.png") returned 5
	[0132.849] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.doc") returned 0
	[0132.849] lstrlenA (lpString="*.doc") returned 5
	[0132.849] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.docx") returned 0
	[0132.849] lstrlenA (lpString="*.docx") returned 6
	[0132.849] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.xls") returned 0
	[0132.849] lstrlenA (lpString="*.xls") returned 5
	[0132.849] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.xlsx") returned 0
	[0132.849] lstrlenA (lpString="*.xlsx") returned 6
	[0132.849] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.ppt") returned 0
	[0132.849] lstrlenA (lpString="*.ppt") returned 5
	[0132.849] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.pptx") returned 0
	[0132.849] lstrlenA (lpString="*.pptx") returned 6
	[0132.849] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.txt") returned 0
	[0132.849] lstrlenA (lpString="*.txt") returned 5
	[0132.849] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.pdf") returned 0
	[0132.849] lstrlenA (lpString="*.pdf") returned 5
	[0132.849] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.htm") returned 0
	[0132.849] lstrlenA (lpString="*.htm") returned 5
	[0132.849] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.html") returned 0
	[0132.849] lstrlenA (lpString="*.html") returned 6
	[0132.849] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.mdb") returned 0
	[0132.849] lstrlenA (lpString="*.mdb") returned 5
	[0132.849] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.pfx") returned 0
	[0132.849] lstrlenA (lpString="*.pfx") returned 5
	[0132.849] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.md") returned 0
	[0132.850] lstrlenA (lpString="*.md") returned 4
	[0132.850] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.lnk") returned 0
	[0132.850] lstrlenA (lpString="*.lnk") returned 5
	[0132.850] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.torrent") returned 0
	[0132.850] lstrlenA (lpString="*.torrent") returned 9
	[0132.850] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.mov") returned 0
	[0132.850] lstrlenA (lpString="*.mov") returned 5
	[0132.850] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.3gp") returned 0
	[0132.850] lstrlenA (lpString="*.3gp") returned 5
	[0132.850] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.mpeg") returned 0
	[0132.850] lstrlenA (lpString="*.mpeg") returned 6
	[0132.850] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.mpg") returned 0
	[0132.850] lstrlenA (lpString="*.mpg") returned 5
	[0132.850] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.flv") returned 0
	[0132.850] lstrlenA (lpString="*.flv") returned 5
	[0132.850] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.avi") returned 0
	[0132.850] lstrlenA (lpString="*.avi") returned 5
	[0132.850] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.mp4") returned 0
	[0132.850] lstrlenA (lpString="*.mp4") returned 5
	[0132.850] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.wmv") returned 0
	[0132.850] lstrlenA (lpString="*.wmv") returned 5
	[0132.850] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.mkv") returned 0
	[0132.850] lstrlenA (lpString="*.mkv") returned 5
	[0132.850] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.mp3") returned 0
	[0132.850] lstrlenA (lpString="*.mp3") returned 5
	[0132.850] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.wav") returned 0
	[0132.850] lstrlenA (lpString="*.wav") returned 5
	[0132.850] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.flac") returned 0
	[0132.850] lstrlenA (lpString="*.flac") returned 6
	[0132.850] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.wma") returned 0
	[0132.850] lstrlenA (lpString="*.wma") returned 5
	[0132.850] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.au3") returned 0
	[0132.850] lstrlenA (lpString="*.au3") returned 5
	[0132.850] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.ahk") returned 0
	[0132.850] lstrlenA (lpString="*.ahk") returned 5
	[0132.850] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.c") returned 0
	[0132.851] lstrlenA (lpString="*.c") returned 3
	[0132.851] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.cc") returned 0
	[0132.851] lstrlenA (lpString="*.cc") returned 4
	[0132.851] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.cpp") returned 0
	[0132.851] lstrlenA (lpString="*.cpp") returned 5
	[0132.851] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.cxx") returned 0
	[0132.851] lstrlenA (lpString="*.cxx") returned 5
	[0132.851] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.c++") returned 0
	[0132.851] lstrlenA (lpString="*.c++") returned 5
	[0132.851] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.cs") returned 0
	[0132.851] lstrlenA (lpString="*.cs") returned 4
	[0132.851] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.vb") returned 0
	[0132.851] lstrlenA (lpString="*.vb") returned 4
	[0132.851] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.bas") returned 0
	[0132.851] lstrlenA (lpString="*.bas") returned 5
	[0132.851] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.csproj") returned 0
	[0132.851] lstrlenA (lpString="*.csproj") returned 8
	[0132.851] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.vbproj") returned 0
	[0132.851] lstrlenA (lpString="*.vbproj") returned 8
	[0132.851] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.vcxproj") returned 0
	[0132.851] lstrlenA (lpString="*.vcxproj") returned 9
	[0132.851] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.manifest") returned 0
	[0132.851] lstrlenA (lpString="*.manifest") returned 10
	[0132.851] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.php") returned 0
	[0132.852] lstrlenA (lpString="*.php") returned 5
	[0132.852] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.vbe") returned 0
	[0132.852] lstrlenA (lpString="*.vbe") returned 5
	[0132.852] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.vba") returned 0
	[0132.852] lstrlenA (lpString="*.vba") returned 5
	[0132.852] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.vbs") returned 0
	[0132.852] lstrlenA (lpString="*.vbs") returned 5
	[0132.852] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.bat") returned 0
	[0132.852] lstrlenA (lpString="*.bat") returned 5
	[0132.852] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.cmd") returned 0
	[0132.852] lstrlenA (lpString="*.cmd") returned 5
	[0132.852] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.js") returned 0
	[0132.852] lstrlenA (lpString="*.js") returned 4
	[0132.852] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.jscript") returned 0
	[0132.852] lstrlenA (lpString="*.jscript") returned 9
	[0132.852] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.hta") returned 0
	[0132.852] lstrlenA (lpString="*.hta") returned 5
	[0132.852] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.php7") returned 0
	[0132.852] lstrlenA (lpString="*.php7") returned 6
	[0132.852] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.db") returned 0
	[0132.852] lstrlenA (lpString="*.db") returned 4
	[0132.852] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.swf") returned 0
	[0132.852] lstrlenA (lpString="*.swf") returned 5
	[0132.852] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.eml") returned 0
	[0132.852] lstrlenA (lpString="*.eml") returned 5
	[0132.852] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.part") returned 0
	[0132.852] lstrlenA (lpString="*.part") returned 6
	[0132.852] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.nfo") returned 0
	[0132.852] lstrlenA (lpString="*.nfo") returned 5
	[0132.852] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.rsa") returned 0
	[0132.852] lstrlenA (lpString="*.rsa") returned 5
	[0132.852] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.key") returned 0
	[0132.852] lstrlenA (lpString="*.key") returned 5
	[0132.852] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.aes") returned 0
	[0132.852] lstrlenA (lpString="*.aes") returned 5
	[0132.852] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.blob") returned 0
	[0132.853] lstrlenA (lpString="*.blob") returned 6
	[0132.853] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.btc") returned 0
	[0132.853] lstrlenA (lpString="*.btc") returned 5
	[0132.853] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", pszSpec="*.wallet") returned 0
	[0132.853] lstrlenA (lpString="*.wallet") returned 8
	[0132.853] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2111f8cb, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2111f8cb, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc5f90064, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop (create shortcut).DeskLink", cAlternateFileName="DESKTO~1.DES")) returned 1
	[0132.853] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.853] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Desktop (create shortcut).DeskLink") returned 1
	[0132.853] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Desktop (create shortcut).DeskLink") returned 1
	[0132.853] lstrcmpiA (lpString1="", lpString2="Desktop (create shortcut).DeskLink") returned -1
	[0132.853] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget") returned="Compressed (zipped) Folder.ZFSendToTarget"
	[0132.853] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\"
	[0132.853] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\") returned=""
	[0132.853] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.853] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\how-to-decrypt-files.htm")) returned 0x20
	[0132.853] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", lpString2="Desktop (create shortcut).DeskLink" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink"
	[0132.853] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.zip") returned 0
	[0132.853] lstrlenA (lpString="*.zip") returned 5
	[0132.853] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.rar") returned 0
	[0132.853] lstrlenA (lpString="*.rar") returned 5
	[0132.853] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.7z") returned 0
	[0132.853] lstrlenA (lpString="*.7z") returned 4
	[0132.853] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.tar") returned 0
	[0132.853] lstrlenA (lpString="*.tar") returned 5
	[0132.853] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.gzip") returned 0
	[0132.853] lstrlenA (lpString="*.gzip") returned 6
	[0132.853] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.jpg") returned 0
	[0132.853] lstrlenA (lpString="*.jpg") returned 5
	[0132.853] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.jpeg") returned 0
	[0132.853] lstrlenA (lpString="*.jpeg") returned 6
	[0132.853] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.bmp") returned 0
	[0132.853] lstrlenA (lpString="*.bmp") returned 5
	[0132.854] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.gif") returned 0
	[0132.854] lstrlenA (lpString="*.gif") returned 5
	[0132.854] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.png") returned 0
	[0132.854] lstrlenA (lpString="*.png") returned 5
	[0132.854] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.doc") returned 0
	[0132.854] lstrlenA (lpString="*.doc") returned 5
	[0132.854] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.docx") returned 0
	[0132.854] lstrlenA (lpString="*.docx") returned 6
	[0132.854] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.xls") returned 0
	[0132.854] lstrlenA (lpString="*.xls") returned 5
	[0132.854] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.xlsx") returned 0
	[0132.854] lstrlenA (lpString="*.xlsx") returned 6
	[0132.854] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.ppt") returned 0
	[0132.854] lstrlenA (lpString="*.ppt") returned 5
	[0132.854] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.pptx") returned 0
	[0132.854] lstrlenA (lpString="*.pptx") returned 6
	[0132.854] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.txt") returned 0
	[0132.854] lstrlenA (lpString="*.txt") returned 5
	[0132.854] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.pdf") returned 0
	[0132.854] lstrlenA (lpString="*.pdf") returned 5
	[0132.854] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.htm") returned 0
	[0132.854] lstrlenA (lpString="*.htm") returned 5
	[0132.854] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.html") returned 0
	[0132.854] lstrlenA (lpString="*.html") returned 6
	[0132.854] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.mdb") returned 0
	[0132.854] lstrlenA (lpString="*.mdb") returned 5
	[0132.854] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.pfx") returned 0
	[0132.854] lstrlenA (lpString="*.pfx") returned 5
	[0132.854] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.md") returned 0
	[0132.854] lstrlenA (lpString="*.md") returned 4
	[0132.854] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.lnk") returned 0
	[0132.854] lstrlenA (lpString="*.lnk") returned 5
	[0132.854] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.torrent") returned 0
	[0132.854] lstrlenA (lpString="*.torrent") returned 9
	[0132.854] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.mov") returned 0
	[0132.854] lstrlenA (lpString="*.mov") returned 5
	[0132.855] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.3gp") returned 0
	[0132.855] lstrlenA (lpString="*.3gp") returned 5
	[0132.855] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.mpeg") returned 0
	[0132.855] lstrlenA (lpString="*.mpeg") returned 6
	[0132.855] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.mpg") returned 0
	[0132.855] lstrlenA (lpString="*.mpg") returned 5
	[0132.855] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.flv") returned 0
	[0132.855] lstrlenA (lpString="*.flv") returned 5
	[0132.855] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.avi") returned 0
	[0132.855] lstrlenA (lpString="*.avi") returned 5
	[0132.855] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.mp4") returned 0
	[0132.855] lstrlenA (lpString="*.mp4") returned 5
	[0132.855] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.wmv") returned 0
	[0132.855] lstrlenA (lpString="*.wmv") returned 5
	[0132.855] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.mkv") returned 0
	[0132.855] lstrlenA (lpString="*.mkv") returned 5
	[0132.855] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.mp3") returned 0
	[0132.855] lstrlenA (lpString="*.mp3") returned 5
	[0132.855] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.wav") returned 0
	[0132.855] lstrlenA (lpString="*.wav") returned 5
	[0132.855] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.flac") returned 0
	[0132.855] lstrlenA (lpString="*.flac") returned 6
	[0132.855] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.wma") returned 0
	[0132.855] lstrlenA (lpString="*.wma") returned 5
	[0132.855] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.au3") returned 0
	[0132.855] lstrlenA (lpString="*.au3") returned 5
	[0132.855] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.ahk") returned 0
	[0132.855] lstrlenA (lpString="*.ahk") returned 5
	[0132.855] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.c") returned 0
	[0132.855] lstrlenA (lpString="*.c") returned 3
	[0132.855] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.cc") returned 0
	[0132.855] lstrlenA (lpString="*.cc") returned 4
	[0132.855] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.cpp") returned 0
	[0132.855] lstrlenA (lpString="*.cpp") returned 5
	[0132.855] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.cxx") returned 0
	[0132.855] lstrlenA (lpString="*.cxx") returned 5
	[0132.855] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.c++") returned 0
	[0132.855] lstrlenA (lpString="*.c++") returned 5
	[0132.856] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.cs") returned 0
	[0132.856] lstrlenA (lpString="*.cs") returned 4
	[0132.856] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.vb") returned 0
	[0132.856] lstrlenA (lpString="*.vb") returned 4
	[0132.856] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.bas") returned 0
	[0132.856] lstrlenA (lpString="*.bas") returned 5
	[0132.856] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.csproj") returned 0
	[0132.856] lstrlenA (lpString="*.csproj") returned 8
	[0132.856] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.vbproj") returned 0
	[0132.856] lstrlenA (lpString="*.vbproj") returned 8
	[0132.856] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.vcxproj") returned 0
	[0132.856] lstrlenA (lpString="*.vcxproj") returned 9
	[0132.856] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.manifest") returned 0
	[0132.856] lstrlenA (lpString="*.manifest") returned 10
	[0132.856] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.php") returned 0
	[0132.856] lstrlenA (lpString="*.php") returned 5
	[0132.856] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.vbe") returned 0
	[0132.856] lstrlenA (lpString="*.vbe") returned 5
	[0132.856] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.vba") returned 0
	[0132.856] lstrlenA (lpString="*.vba") returned 5
	[0132.856] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.vbs") returned 0
	[0132.856] lstrlenA (lpString="*.vbs") returned 5
	[0132.856] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.bat") returned 0
	[0132.856] lstrlenA (lpString="*.bat") returned 5
	[0132.856] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.cmd") returned 0
	[0132.856] lstrlenA (lpString="*.cmd") returned 5
	[0132.856] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.js") returned 0
	[0132.856] lstrlenA (lpString="*.js") returned 4
	[0132.856] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.jscript") returned 0
	[0132.856] lstrlenA (lpString="*.jscript") returned 9
	[0132.856] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.hta") returned 0
	[0132.856] lstrlenA (lpString="*.hta") returned 5
	[0132.856] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.php7") returned 0
	[0132.856] lstrlenA (lpString="*.php7") returned 6
	[0132.856] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.db") returned 0
	[0132.856] lstrlenA (lpString="*.db") returned 4
	[0132.856] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.swf") returned 0
	[0132.856] lstrlenA (lpString="*.swf") returned 5
	[0132.857] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.eml") returned 0
	[0132.857] lstrlenA (lpString="*.eml") returned 5
	[0132.857] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.part") returned 0
	[0132.857] lstrlenA (lpString="*.part") returned 6
	[0132.857] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.nfo") returned 0
	[0132.857] lstrlenA (lpString="*.nfo") returned 5
	[0132.857] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.rsa") returned 0
	[0132.857] lstrlenA (lpString="*.rsa") returned 5
	[0132.857] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.key") returned 0
	[0132.857] lstrlenA (lpString="*.key") returned 5
	[0132.857] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.aes") returned 0
	[0132.857] lstrlenA (lpString="*.aes") returned 5
	[0132.857] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.blob") returned 0
	[0132.857] lstrlenA (lpString="*.blob") returned 6
	[0132.857] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.btc") returned 0
	[0132.857] lstrlenA (lpString="*.btc") returned 5
	[0132.857] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", pszSpec="*.wallet") returned 0
	[0132.857] lstrlenA (lpString="*.wallet") returned 8
	[0132.857] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x2111f8cb, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2111f8cb, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x391b18ef, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x2b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0132.857] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.857] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Desktop.ini") returned 1
	[0132.857] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Desktop.ini") returned 1
	[0132.857] lstrcmpiA (lpString1="", lpString2="Desktop.ini") returned -1
	[0132.857] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink") returned="Desktop (create shortcut).DeskLink"
	[0132.857] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\"
	[0132.857] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\") returned=""
	[0132.857] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.857] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\how-to-decrypt-files.htm")) returned 0x20
	[0132.857] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", lpString2="Desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini"
	[0132.857] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.zip") returned 0
	[0132.857] lstrlenA (lpString="*.zip") returned 5
	[0132.857] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.rar") returned 0
	[0132.857] lstrlenA (lpString="*.rar") returned 5
	[0132.857] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.7z") returned 0
	[0132.857] lstrlenA (lpString="*.7z") returned 4
	[0132.858] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.tar") returned 0
	[0132.858] lstrlenA (lpString="*.tar") returned 5
	[0132.858] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.gzip") returned 0
	[0132.858] lstrlenA (lpString="*.gzip") returned 6
	[0132.858] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.jpg") returned 0
	[0132.858] lstrlenA (lpString="*.jpg") returned 5
	[0132.858] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.jpeg") returned 0
	[0132.858] lstrlenA (lpString="*.jpeg") returned 6
	[0132.858] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.bmp") returned 0
	[0132.858] lstrlenA (lpString="*.bmp") returned 5
	[0132.858] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.gif") returned 0
	[0132.858] lstrlenA (lpString="*.gif") returned 5
	[0132.858] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.png") returned 0
	[0132.858] lstrlenA (lpString="*.png") returned 5
	[0132.858] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.doc") returned 0
	[0132.858] lstrlenA (lpString="*.doc") returned 5
	[0132.858] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.docx") returned 0
	[0132.858] lstrlenA (lpString="*.docx") returned 6
	[0132.858] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.xls") returned 0
	[0132.858] lstrlenA (lpString="*.xls") returned 5
	[0132.858] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.xlsx") returned 0
	[0132.858] lstrlenA (lpString="*.xlsx") returned 6
	[0132.858] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.ppt") returned 0
	[0132.858] lstrlenA (lpString="*.ppt") returned 5
	[0132.858] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.pptx") returned 0
	[0132.858] lstrlenA (lpString="*.pptx") returned 6
	[0132.858] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.txt") returned 0
	[0132.858] lstrlenA (lpString="*.txt") returned 5
	[0132.858] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.pdf") returned 0
	[0132.858] lstrlenA (lpString="*.pdf") returned 5
	[0132.858] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.htm") returned 0
	[0132.858] lstrlenA (lpString="*.htm") returned 5
	[0132.858] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.html") returned 0
	[0132.858] lstrlenA (lpString="*.html") returned 6
	[0132.858] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.mdb") returned 0
	[0132.858] lstrlenA (lpString="*.mdb") returned 5
	[0132.858] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.pfx") returned 0
	[0132.858] lstrlenA (lpString="*.pfx") returned 5
	[0132.858] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.md") returned 0
	[0132.858] lstrlenA (lpString="*.md") returned 4
	[0132.859] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.lnk") returned 0
	[0132.859] lstrlenA (lpString="*.lnk") returned 5
	[0132.859] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.torrent") returned 0
	[0132.859] lstrlenA (lpString="*.torrent") returned 9
	[0132.859] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.mov") returned 0
	[0132.859] lstrlenA (lpString="*.mov") returned 5
	[0132.859] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.3gp") returned 0
	[0132.859] lstrlenA (lpString="*.3gp") returned 5
	[0132.859] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.mpeg") returned 0
	[0132.859] lstrlenA (lpString="*.mpeg") returned 6
	[0132.859] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.mpg") returned 0
	[0132.859] lstrlenA (lpString="*.mpg") returned 5
	[0132.859] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.flv") returned 0
	[0132.859] lstrlenA (lpString="*.flv") returned 5
	[0132.859] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.avi") returned 0
	[0132.859] lstrlenA (lpString="*.avi") returned 5
	[0132.859] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.mp4") returned 0
	[0132.859] lstrlenA (lpString="*.mp4") returned 5
	[0132.859] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.wmv") returned 0
	[0132.859] lstrlenA (lpString="*.wmv") returned 5
	[0132.859] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.mkv") returned 0
	[0132.859] lstrlenA (lpString="*.mkv") returned 5
	[0132.859] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.mp3") returned 0
	[0132.859] lstrlenA (lpString="*.mp3") returned 5
	[0132.859] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.wav") returned 0
	[0132.859] lstrlenA (lpString="*.wav") returned 5
	[0132.859] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.flac") returned 0
	[0132.859] lstrlenA (lpString="*.flac") returned 6
	[0132.859] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.wma") returned 0
	[0132.859] lstrlenA (lpString="*.wma") returned 5
	[0132.859] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.au3") returned 0
	[0132.859] lstrlenA (lpString="*.au3") returned 5
	[0132.859] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.ahk") returned 0
	[0132.859] lstrlenA (lpString="*.ahk") returned 5
	[0132.859] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.c") returned 0
	[0132.859] lstrlenA (lpString="*.c") returned 3
	[0132.859] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.cc") returned 0
	[0132.859] lstrlenA (lpString="*.cc") returned 4
	[0132.859] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.cpp") returned 0
	[0132.859] lstrlenA (lpString="*.cpp") returned 5
	[0132.860] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.cxx") returned 0
	[0132.860] lstrlenA (lpString="*.cxx") returned 5
	[0132.860] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.c++") returned 0
	[0132.860] lstrlenA (lpString="*.c++") returned 5
	[0132.860] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.cs") returned 0
	[0132.860] lstrlenA (lpString="*.cs") returned 4
	[0132.860] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.vb") returned 0
	[0132.860] lstrlenA (lpString="*.vb") returned 4
	[0132.860] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.bas") returned 0
	[0132.860] lstrlenA (lpString="*.bas") returned 5
	[0132.860] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.csproj") returned 0
	[0132.860] lstrlenA (lpString="*.csproj") returned 8
	[0132.860] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.vbproj") returned 0
	[0132.860] lstrlenA (lpString="*.vbproj") returned 8
	[0132.860] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.vcxproj") returned 0
	[0132.860] lstrlenA (lpString="*.vcxproj") returned 9
	[0132.860] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.manifest") returned 0
	[0132.860] lstrlenA (lpString="*.manifest") returned 10
	[0132.860] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.php") returned 0
	[0132.860] lstrlenA (lpString="*.php") returned 5
	[0132.860] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.vbe") returned 0
	[0132.860] lstrlenA (lpString="*.vbe") returned 5
	[0132.860] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.vba") returned 0
	[0132.860] lstrlenA (lpString="*.vba") returned 5
	[0132.860] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.vbs") returned 0
	[0132.860] lstrlenA (lpString="*.vbs") returned 5
	[0132.860] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.bat") returned 0
	[0132.860] lstrlenA (lpString="*.bat") returned 5
	[0132.860] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.cmd") returned 0
	[0132.860] lstrlenA (lpString="*.cmd") returned 5
	[0132.860] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.js") returned 0
	[0132.860] lstrlenA (lpString="*.js") returned 4
	[0132.860] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.jscript") returned 0
	[0132.860] lstrlenA (lpString="*.jscript") returned 9
	[0132.860] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.hta") returned 0
	[0132.860] lstrlenA (lpString="*.hta") returned 5
	[0132.860] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.php7") returned 0
	[0132.860] lstrlenA (lpString="*.php7") returned 6
	[0132.860] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.db") returned 0
	[0132.860] lstrlenA (lpString="*.db") returned 4
	[0132.860] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.swf") returned 0
	[0132.861] lstrlenA (lpString="*.swf") returned 5
	[0132.861] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.eml") returned 0
	[0132.861] lstrlenA (lpString="*.eml") returned 5
	[0132.861] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.part") returned 0
	[0132.861] lstrlenA (lpString="*.part") returned 6
	[0132.861] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.nfo") returned 0
	[0132.861] lstrlenA (lpString="*.nfo") returned 5
	[0132.861] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.rsa") returned 0
	[0132.861] lstrlenA (lpString="*.rsa") returned 5
	[0132.861] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.key") returned 0
	[0132.861] lstrlenA (lpString="*.key") returned 5
	[0132.861] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.aes") returned 0
	[0132.861] lstrlenA (lpString="*.aes") returned 5
	[0132.861] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.blob") returned 0
	[0132.861] lstrlenA (lpString="*.blob") returned 6
	[0132.861] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.btc") returned 0
	[0132.861] lstrlenA (lpString="*.btc") returned 5
	[0132.861] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", pszSpec="*.wallet") returned 0
	[0132.861] lstrlenA (lpString="*.wallet") returned 8
	[0132.861] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x442db745, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x442db745, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x442db745, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents.mydocs", cAlternateFileName="DOCUME~1.MYD")) returned 1
	[0132.861] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.861] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Documents.mydocs") returned 1
	[0132.861] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Documents.mydocs") returned 1
	[0132.861] lstrcmpiA (lpString1="", lpString2="Documents.mydocs") returned -1
	[0132.861] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini") returned="Desktop.ini"
	[0132.861] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\"
	[0132.861] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\") returned=""
	[0132.861] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.861] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\how-to-decrypt-files.htm")) returned 0x20
	[0132.861] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", lpString2="Documents.mydocs" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs"
	[0132.861] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs", pszSpec="*.zip") returned 0
	[0132.861] lstrlenA (lpString="*.zip") returned 5
	[0132.861] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs", pszSpec="*.rar") returned 0
	[0132.861] lstrlenA (lpString="*.rar") returned 5
	[0132.861] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs", pszSpec="*.7z") returned 0
	[0132.861] lstrlenA (lpString="*.7z") returned 4
	[0132.861] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs", pszSpec="*.tar") returned 0
	[0132.862] lstrlenA (lpString="*.tar") returned 5
	[0132.862] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs", pszSpec="*.gzip") returned 0
	[0132.862] lstrlenA (lpString="*.gzip") returned 6
	[0132.862] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs", pszSpec="*.jpg") returned 0
	[0132.862] lstrlenA (lpString="*.jpg") returned 5
	[0132.862] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs", pszSpec="*.jpeg") returned 0
	[0132.862] lstrlenA (lpString="*.jpeg") returned 6
	[0132.862] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs", pszSpec="*.bmp") returned 0
	[0132.862] lstrlenA (lpString="*.bmp") returned 5
	[0132.862] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs", pszSpec="*.gif") returned 0
	[0132.862] lstrlenA (lpString="*.gif") returned 5
	[0132.862] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs", pszSpec="*.png") returned 0
	[0132.862] lstrlenA (lpString="*.png") returned 5
	[0132.862] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs", pszSpec="*.doc") returned 0
	[0132.862] lstrlenA (lpString="*.doc") returned 5
	[0132.862] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs", pszSpec="*.docx") returned 0
	[0132.862] lstrlenA (lpString="*.docx") returned 6
	[0132.862] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs", pszSpec="*.xls") returned 0
	[0132.862] lstrlenA (lpString="*.xls") returned 5
	[0132.862] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs", pszSpec="*.xlsx") returned 0
	[0132.862] lstrlenA (lpString="*.xlsx") returned 6
	[0132.862] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs", pszSpec="*.ppt") returned 0
	[0132.862] lstrlenA (lpString="*.ppt") returned 5
	[0132.862] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs", pszSpec="*.pptx") returned 0
	[0132.862] lstrlenA (lpString="*.pptx") returned 6
	[0132.862] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs", pszSpec="*.txt") returned 0
	[0132.862] lstrlenA (lpString="*.txt") returned 5
	[0132.862] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs", pszSpec="*.pdf") returned 0
	[0132.862] lstrlenA (lpString="*.pdf") returned 5
	[0132.862] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs", pszSpec="*.htm") returned 0
	[0132.862] lstrlenA (lpString="*.htm") returned 5
	[0132.862] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs", pszSpec="*.html") returned 0
	[0132.862] lstrlenA (lpString="*.html") returned 6
	[0132.862] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs", pszSpec="*.mdb") returned 0
	[0132.862] lstrlenA (lpString="*.mdb") returned 5
	[0132.862] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs", pszSpec="*.pfx") returned 0
	[0132.862] lstrlenA (lpString="*.pfx") returned 5
	[0132.862] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs", pszSpec="*.md") returned 0
	[0132.862] lstrlenA (lpString="*.md") returned 4
	[0132.862] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs", pszSpec="*.lnk") returned 0
	[0132.863] lstrlenA (lpString="*.lnk") returned 5
	[0132.863] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs", pszSpec="*.torrent") returned 0
	[0132.863] lstrlenA (lpString="*.torrent") returned 9
	[0132.863] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs", pszSpec="*.mov") returned 0
	[0132.863] lstrlenA (lpString="*.mov") returned 5
	[0132.863] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs", pszSpec="*.3gp") returned 0
	[0132.863] lstrlenA (lpString="*.3gp") returned 5
	[0132.863] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs", pszSpec="*.mpeg") returned 0
	[0132.863] lstrlenA (lpString="*.mpeg") returned 6
	[0132.863] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs", pszSpec="*.mpg") returned 0
	[0132.863] lstrlenA (lpString="*.mpg") returned 5
	[0132.863] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs", pszSpec="*.flv") returned 0
	[0132.863] lstrlenA (lpString="*.flv") returned 5
	[0132.863] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xadbd28c, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xa13, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fax Recipient.lnk", cAlternateFileName="FAXREC~1.LNK")) returned 1
	[0132.863] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.863] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Fax Recipient.lnk") returned -1
	[0132.863] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Fax Recipient.lnk") returned 1
	[0132.863] lstrcmpiA (lpString1="", lpString2="Fax Recipient.lnk") returned -1
	[0132.863] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs") returned="Documents.mydocs"
	[0132.863] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\"
	[0132.863] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\") returned=""
	[0132.863] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.863] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\how-to-decrypt-files.htm")) returned 0x20
	[0132.863] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", lpString2="Fax Recipient.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk"
	[0132.863] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk"
	[0132.864] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk"
	[0132.864] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk."
	[0132.864] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.exe"
	[0132.864] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.864] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa13
	[0132.864] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x210f9687, dwHighDateTime=0x1d32742), lpLastAccessTime=0x407536*(dwLowDateTime=0x210f9687, dwHighDateTime=0x1d32742), lpLastWriteTime=0x40753e*(dwLowDateTime=0xadbd28c, dwHighDateTime=0x1d32743)) returned 1
	[0132.865] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.865] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x9d1, lpOverlapped=0x0) returned 1
	[0132.869] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk") returned="Fax Recipient.lnk"
	[0132.869] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.869] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x9d1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x9d1, lpOverlapped=0x0) returned 1
	[0132.869] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.869] CloseHandle (hObject=0x21c) returned 1
	[0132.869] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk.exe")) returned 1
	[0132.873] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc5f90064, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 1
	[0132.873] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.873] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Mail Recipient.MAPIMail") returned -1
	[0132.873] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Mail Recipient.MAPIMail") returned -1
	[0132.873] lstrcmpiA (lpString1="", lpString2="Mail Recipient.MAPIMail") returned -1
	[0132.873] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk") returned="Fax Recipient.lnk"
	[0132.873] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\"
	[0132.873] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\") returned=""
	[0132.873] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.873] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\how-to-decrypt-files.htm")) returned 0x20
	[0132.873] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", lpString2="Mail Recipient.MAPIMail" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail"
	[0132.873] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.zip") returned 0
	[0132.873] lstrlenA (lpString="*.zip") returned 5
	[0132.873] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.rar") returned 0
	[0132.873] lstrlenA (lpString="*.rar") returned 5
	[0132.873] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.7z") returned 0
	[0132.874] lstrlenA (lpString="*.7z") returned 4
	[0132.874] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.tar") returned 0
	[0132.874] lstrlenA (lpString="*.tar") returned 5
	[0132.874] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.gzip") returned 0
	[0132.874] lstrlenA (lpString="*.gzip") returned 6
	[0132.874] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.jpg") returned 0
	[0132.874] lstrlenA (lpString="*.jpg") returned 5
	[0132.874] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.jpeg") returned 0
	[0132.874] lstrlenA (lpString="*.jpeg") returned 6
	[0132.874] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.bmp") returned 0
	[0132.874] lstrlenA (lpString="*.bmp") returned 5
	[0132.874] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.gif") returned 0
	[0132.874] lstrlenA (lpString="*.gif") returned 5
	[0132.874] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.png") returned 0
	[0132.874] lstrlenA (lpString="*.png") returned 5
	[0132.874] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.doc") returned 0
	[0132.874] lstrlenA (lpString="*.doc") returned 5
	[0132.874] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.docx") returned 0
	[0132.874] lstrlenA (lpString="*.docx") returned 6
	[0132.874] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.xls") returned 0
	[0132.874] lstrlenA (lpString="*.xls") returned 5
	[0132.874] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.xlsx") returned 0
	[0132.874] lstrlenA (lpString="*.xlsx") returned 6
	[0132.874] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.ppt") returned 0
	[0132.874] lstrlenA (lpString="*.ppt") returned 5
	[0132.874] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.pptx") returned 0
	[0132.874] lstrlenA (lpString="*.pptx") returned 6
	[0132.874] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.txt") returned 0
	[0132.874] lstrlenA (lpString="*.txt") returned 5
	[0132.874] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.pdf") returned 0
	[0132.874] lstrlenA (lpString="*.pdf") returned 5
	[0132.874] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.htm") returned 0
	[0132.874] lstrlenA (lpString="*.htm") returned 5
	[0132.874] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.html") returned 0
	[0132.874] lstrlenA (lpString="*.html") returned 6
	[0132.874] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.mdb") returned 0
	[0132.874] lstrlenA (lpString="*.mdb") returned 5
	[0132.874] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.pfx") returned 0
	[0132.874] lstrlenA (lpString="*.pfx") returned 5
	[0132.875] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.md") returned 0
	[0132.875] lstrlenA (lpString="*.md") returned 4
	[0132.875] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.lnk") returned 0
	[0132.875] lstrlenA (lpString="*.lnk") returned 5
	[0132.875] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.torrent") returned 0
	[0132.875] lstrlenA (lpString="*.torrent") returned 9
	[0132.875] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.mov") returned 0
	[0132.875] lstrlenA (lpString="*.mov") returned 5
	[0132.875] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.3gp") returned 0
	[0132.875] lstrlenA (lpString="*.3gp") returned 5
	[0132.875] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.mpeg") returned 0
	[0132.875] lstrlenA (lpString="*.mpeg") returned 6
	[0132.875] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.mpg") returned 0
	[0132.875] lstrlenA (lpString="*.mpg") returned 5
	[0132.875] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.flv") returned 0
	[0132.875] lstrlenA (lpString="*.flv") returned 5
	[0132.875] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.avi") returned 0
	[0132.875] lstrlenA (lpString="*.avi") returned 5
	[0132.875] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.mp4") returned 0
	[0132.875] lstrlenA (lpString="*.mp4") returned 5
	[0132.875] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.wmv") returned 0
	[0132.875] lstrlenA (lpString="*.wmv") returned 5
	[0132.875] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.mkv") returned 0
	[0132.875] lstrlenA (lpString="*.mkv") returned 5
	[0132.875] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.mp3") returned 0
	[0132.875] lstrlenA (lpString="*.mp3") returned 5
	[0132.875] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.wav") returned 0
	[0132.875] lstrlenA (lpString="*.wav") returned 5
	[0132.875] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.flac") returned 0
	[0132.875] lstrlenA (lpString="*.flac") returned 6
	[0132.875] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.wma") returned 0
	[0132.875] lstrlenA (lpString="*.wma") returned 5
	[0132.875] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.au3") returned 0
	[0132.875] lstrlenA (lpString="*.au3") returned 5
	[0132.875] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.ahk") returned 0
	[0132.875] lstrlenA (lpString="*.ahk") returned 5
	[0132.875] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.c") returned 0
	[0132.875] lstrlenA (lpString="*.c") returned 3
	[0132.875] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.cc") returned 0
	[0132.875] lstrlenA (lpString="*.cc") returned 4
	[0132.876] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.cpp") returned 0
	[0132.876] lstrlenA (lpString="*.cpp") returned 5
	[0132.876] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.cxx") returned 0
	[0132.876] lstrlenA (lpString="*.cxx") returned 5
	[0132.876] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.c++") returned 0
	[0132.876] lstrlenA (lpString="*.c++") returned 5
	[0132.876] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.cs") returned 0
	[0132.876] lstrlenA (lpString="*.cs") returned 4
	[0132.876] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.vb") returned 0
	[0132.876] lstrlenA (lpString="*.vb") returned 4
	[0132.876] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.bas") returned 0
	[0132.876] lstrlenA (lpString="*.bas") returned 5
	[0132.876] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.csproj") returned 0
	[0132.876] lstrlenA (lpString="*.csproj") returned 8
	[0132.876] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.vbproj") returned 0
	[0132.876] lstrlenA (lpString="*.vbproj") returned 8
	[0132.876] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.vcxproj") returned 0
	[0132.876] lstrlenA (lpString="*.vcxproj") returned 9
	[0132.876] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.manifest") returned 0
	[0132.876] lstrlenA (lpString="*.manifest") returned 10
	[0132.876] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.php") returned 0
	[0132.876] lstrlenA (lpString="*.php") returned 5
	[0132.876] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.vbe") returned 0
	[0132.876] lstrlenA (lpString="*.vbe") returned 5
	[0132.876] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.vba") returned 0
	[0132.876] lstrlenA (lpString="*.vba") returned 5
	[0132.876] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.vbs") returned 0
	[0132.876] lstrlenA (lpString="*.vbs") returned 5
	[0132.876] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.bat") returned 0
	[0132.876] lstrlenA (lpString="*.bat") returned 5
	[0132.876] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.cmd") returned 0
	[0132.876] lstrlenA (lpString="*.cmd") returned 5
	[0132.876] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.js") returned 0
	[0132.876] lstrlenA (lpString="*.js") returned 4
	[0132.876] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.jscript") returned 0
	[0132.876] lstrlenA (lpString="*.jscript") returned 9
	[0132.876] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.hta") returned 0
	[0132.876] lstrlenA (lpString="*.hta") returned 5
	[0132.876] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.php7") returned 0
	[0132.876] lstrlenA (lpString="*.php7") returned 6
	[0132.876] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.db") returned 0
	[0132.876] lstrlenA (lpString="*.db") returned 4
	[0132.877] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.swf") returned 0
	[0132.877] lstrlenA (lpString="*.swf") returned 5
	[0132.877] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.eml") returned 0
	[0132.877] lstrlenA (lpString="*.eml") returned 5
	[0132.877] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.part") returned 0
	[0132.877] lstrlenA (lpString="*.part") returned 6
	[0132.877] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.nfo") returned 0
	[0132.877] lstrlenA (lpString="*.nfo") returned 5
	[0132.877] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.rsa") returned 0
	[0132.877] lstrlenA (lpString="*.rsa") returned 5
	[0132.877] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.key") returned 0
	[0132.877] lstrlenA (lpString="*.key") returned 5
	[0132.877] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.aes") returned 0
	[0132.877] lstrlenA (lpString="*.aes") returned 5
	[0132.877] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.blob") returned 0
	[0132.877] lstrlenA (lpString="*.blob") returned 6
	[0132.877] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.btc") returned 0
	[0132.877] lstrlenA (lpString="*.btc") returned 5
	[0132.877] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", pszSpec="*.wallet") returned 0
	[0132.877] lstrlenA (lpString="*.wallet") returned 8
	[0132.877] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc5f90064, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 0
	[0132.877] FindClose (in: hFindFile=0x7cb650 | out: hFindFile=0x7cb650) returned 1
	[0132.877] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e1ed17a, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xd3e46430, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1
	[0132.877] lstrcmpA (lpString1=".", lpString2="Start Menu") returned -1
	[0132.877] lstrcmpA (lpString1="..", lpString2="Start Menu") returned -1
	[0132.877] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\*.*") returned="*.*"
	[0132.877] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="Start Menu" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu"
	[0132.877] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 60
	[0132.877] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*.*", lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e1ed17a, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xd3e46430, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb990
	[0132.877] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0132.877] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e1ed17a, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xd3e46430, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0132.878] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0132.878] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0132.878] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x4409f518, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4409f518, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0132.878] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0132.878] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="desktop.ini") returned 1
	[0132.878] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="desktop.ini") returned 1
	[0132.878] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1
	[0132.878] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*.*") returned="*.*"
	[0132.878] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\"
	[0132.878] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\") returned=""
	[0132.878] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.878] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0132.878] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0132.879] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0132.879] WriteFile (in: hFile=0x21c, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0132.880] SetFileTime (hFile=0x21c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0132.880] CloseHandle (hObject=0x21c) returned 1
	[0132.880] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini"
	[0132.880] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.zip") returned 0
	[0132.880] lstrlenA (lpString="*.zip") returned 5
	[0132.880] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.rar") returned 0
	[0132.880] lstrlenA (lpString="*.rar") returned 5
	[0132.880] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.7z") returned 0
	[0132.880] lstrlenA (lpString="*.7z") returned 4
	[0132.880] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.tar") returned 0
	[0132.880] lstrlenA (lpString="*.tar") returned 5
	[0132.880] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.gzip") returned 0
	[0132.880] lstrlenA (lpString="*.gzip") returned 6
	[0132.880] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.jpg") returned 0
	[0132.880] lstrlenA (lpString="*.jpg") returned 5
	[0132.880] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.jpeg") returned 0
	[0132.880] lstrlenA (lpString="*.jpeg") returned 6
	[0132.880] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.bmp") returned 0
	[0132.880] lstrlenA (lpString="*.bmp") returned 5
	[0132.880] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.gif") returned 0
	[0132.880] lstrlenA (lpString="*.gif") returned 5
	[0132.880] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.png") returned 0
	[0132.880] lstrlenA (lpString="*.png") returned 5
	[0132.880] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.doc") returned 0
	[0132.880] lstrlenA (lpString="*.doc") returned 5
	[0132.880] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.docx") returned 0
	[0132.880] lstrlenA (lpString="*.docx") returned 6
	[0132.880] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.xls") returned 0
	[0132.880] lstrlenA (lpString="*.xls") returned 5
	[0132.880] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.xlsx") returned 0
	[0132.881] lstrlenA (lpString="*.xlsx") returned 6
	[0132.881] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.ppt") returned 0
	[0132.881] lstrlenA (lpString="*.ppt") returned 5
	[0132.881] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.pptx") returned 0
	[0132.881] lstrlenA (lpString="*.pptx") returned 6
	[0132.881] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.txt") returned 0
	[0132.881] lstrlenA (lpString="*.txt") returned 5
	[0132.881] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.pdf") returned 0
	[0132.881] lstrlenA (lpString="*.pdf") returned 5
	[0132.881] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.htm") returned 0
	[0132.881] lstrlenA (lpString="*.htm") returned 5
	[0132.881] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.html") returned 0
	[0132.881] lstrlenA (lpString="*.html") returned 6
	[0132.881] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.mdb") returned 0
	[0132.881] lstrlenA (lpString="*.mdb") returned 5
	[0132.881] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.pfx") returned 0
	[0132.881] lstrlenA (lpString="*.pfx") returned 5
	[0132.881] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.md") returned 0
	[0132.881] lstrlenA (lpString="*.md") returned 4
	[0132.881] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.lnk") returned 0
	[0132.881] lstrlenA (lpString="*.lnk") returned 5
	[0132.881] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.torrent") returned 0
	[0132.881] lstrlenA (lpString="*.torrent") returned 9
	[0132.881] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.mov") returned 0
	[0132.881] lstrlenA (lpString="*.mov") returned 5
	[0132.881] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.3gp") returned 0
	[0132.881] lstrlenA (lpString="*.3gp") returned 5
	[0132.881] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.mpeg") returned 0
	[0132.881] lstrlenA (lpString="*.mpeg") returned 6
	[0132.881] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.mpg") returned 0
	[0132.881] lstrlenA (lpString="*.mpg") returned 5
	[0132.881] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.flv") returned 0
	[0132.881] lstrlenA (lpString="*.flv") returned 5
	[0132.881] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.avi") returned 0
	[0132.881] lstrlenA (lpString="*.avi") returned 5
	[0132.881] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.mp4") returned 0
	[0132.881] lstrlenA (lpString="*.mp4") returned 5
	[0132.881] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.wmv") returned 0
	[0132.881] lstrlenA (lpString="*.wmv") returned 5
	[0132.881] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.mkv") returned 0
	[0132.881] lstrlenA (lpString="*.mkv") returned 5
	[0132.882] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.mp3") returned 0
	[0132.882] lstrlenA (lpString="*.mp3") returned 5
	[0132.882] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.wav") returned 0
	[0132.882] lstrlenA (lpString="*.wav") returned 5
	[0132.882] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.flac") returned 0
	[0132.882] lstrlenA (lpString="*.flac") returned 6
	[0132.882] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.wma") returned 0
	[0132.882] lstrlenA (lpString="*.wma") returned 5
	[0132.882] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.au3") returned 0
	[0132.882] lstrlenA (lpString="*.au3") returned 5
	[0132.882] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.ahk") returned 0
	[0132.882] lstrlenA (lpString="*.ahk") returned 5
	[0132.882] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.c") returned 0
	[0132.882] lstrlenA (lpString="*.c") returned 3
	[0132.882] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.cc") returned 0
	[0132.882] lstrlenA (lpString="*.cc") returned 4
	[0132.882] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.cpp") returned 0
	[0132.882] lstrlenA (lpString="*.cpp") returned 5
	[0132.882] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.cxx") returned 0
	[0132.882] lstrlenA (lpString="*.cxx") returned 5
	[0132.882] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.c++") returned 0
	[0132.882] lstrlenA (lpString="*.c++") returned 5
	[0132.882] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.cs") returned 0
	[0132.882] lstrlenA (lpString="*.cs") returned 4
	[0132.882] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.vb") returned 0
	[0132.882] lstrlenA (lpString="*.vb") returned 4
	[0132.882] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.bas") returned 0
	[0132.882] lstrlenA (lpString="*.bas") returned 5
	[0132.882] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.csproj") returned 0
	[0132.882] lstrlenA (lpString="*.csproj") returned 8
	[0132.882] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.vbproj") returned 0
	[0132.882] lstrlenA (lpString="*.vbproj") returned 8
	[0132.882] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.vcxproj") returned 0
	[0132.882] lstrlenA (lpString="*.vcxproj") returned 9
	[0132.883] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.manifest") returned 0
	[0132.883] lstrlenA (lpString="*.manifest") returned 10
	[0132.883] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.php") returned 0
	[0132.883] lstrlenA (lpString="*.php") returned 5
	[0132.883] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.vbe") returned 0
	[0132.883] lstrlenA (lpString="*.vbe") returned 5
	[0132.883] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.vba") returned 0
	[0132.883] lstrlenA (lpString="*.vba") returned 5
	[0132.883] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.vbs") returned 0
	[0132.883] lstrlenA (lpString="*.vbs") returned 5
	[0132.883] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.bat") returned 0
	[0132.883] lstrlenA (lpString="*.bat") returned 5
	[0132.883] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.cmd") returned 0
	[0132.883] lstrlenA (lpString="*.cmd") returned 5
	[0132.883] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.js") returned 0
	[0132.883] lstrlenA (lpString="*.js") returned 4
	[0132.883] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.jscript") returned 0
	[0132.883] lstrlenA (lpString="*.jscript") returned 9
	[0132.883] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.hta") returned 0
	[0132.883] lstrlenA (lpString="*.hta") returned 5
	[0132.883] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.php7") returned 0
	[0132.883] lstrlenA (lpString="*.php7") returned 6
	[0132.883] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.db") returned 0
	[0132.883] lstrlenA (lpString="*.db") returned 4
	[0132.883] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.swf") returned 0
	[0132.883] lstrlenA (lpString="*.swf") returned 5
	[0132.883] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.eml") returned 0
	[0132.883] lstrlenA (lpString="*.eml") returned 5
	[0132.883] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.part") returned 0
	[0132.883] lstrlenA (lpString="*.part") returned 6
	[0132.883] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.nfo") returned 0
	[0132.883] lstrlenA (lpString="*.nfo") returned 5
	[0132.883] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.rsa") returned 0
	[0132.883] lstrlenA (lpString="*.rsa") returned 5
	[0132.883] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.key") returned 0
	[0132.883] lstrlenA (lpString="*.key") returned 5
	[0132.883] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.aes") returned 0
	[0132.883] lstrlenA (lpString="*.aes") returned 5
	[0132.883] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.blob") returned 0
	[0132.884] lstrlenA (lpString="*.blob") returned 6
	[0132.884] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.btc") returned 0
	[0132.884] lstrlenA (lpString="*.btc") returned 5
	[0132.884] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", pszSpec="*.wallet") returned 0
	[0132.884] lstrlenA (lpString="*.wallet") returned 8
	[0132.884] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e1ed17a, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x92576074, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x92576074, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 1
	[0132.884] lstrcmpA (lpString1=".", lpString2="Programs") returned -1
	[0132.884] lstrcmpA (lpString1="..", lpString2="Programs") returned -1
	[0132.884] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini") returned="desktop.ini"
	[0132.884] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\", lpString2="Programs" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs"
	[0132.884] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs") returned 69
	[0132.884] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*.*", lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e1ed17a, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x92576074, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x92576074, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d9bf0, dwReserved1=0xc0, cFileName=".", cAlternateFileName="")) returned 0x7cb950
	[0132.884] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0132.884] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e1ed17a, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x92576074, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x92576074, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d9bf0, dwReserved1=0xc0, cFileName="..", cAlternateFileName="")) returned 1
	[0132.884] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0132.884] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0132.884] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3e9d102, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7977a532, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d9bf0, dwReserved1=0xc0, cFileName="Accessibility", cAlternateFileName="ACCESS~2")) returned 1
	[0132.884] lstrcmpA (lpString1=".", lpString2="Accessibility") returned -1
	[0132.884] lstrcmpA (lpString1="..", lpString2="Accessibility") returned -1
	[0132.884] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*.*") returned="*.*"
	[0132.884] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpString2="Accessibility" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility"
	[0132.884] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility") returned 83
	[0132.884] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\*.*", lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3e9d102, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7977a532, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cbb90
	[0132.884] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0132.884] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3e9d102, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7977a532, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0132.884] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0132.884] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0132.884] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x69cb7dde, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0132.885] PeekMessageA (in: lpMsg=0x19f23c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f23c) returned 0
	[0132.885] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="desktop.ini") returned 1
	[0132.885] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="desktop.ini") returned 1
	[0132.885] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1
	[0132.885] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\*.*") returned="*.*"
	[0132.885] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\"
	[0132.885] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\") returned=""
	[0132.885] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.885] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0132.885] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224
	[0132.886] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0132.886] WriteFile (in: hFile=0x224, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0132.887] SetFileTime (hFile=0x224, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0132.887] CloseHandle (hObject=0x224) returned 1
	[0132.887] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini"
	[0132.887] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.zip") returned 0
	[0132.887] lstrlenA (lpString="*.zip") returned 5
	[0132.887] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.rar") returned 0
	[0132.887] lstrlenA (lpString="*.rar") returned 5
	[0132.887] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.7z") returned 0
	[0132.887] lstrlenA (lpString="*.7z") returned 4
	[0132.887] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.tar") returned 0
	[0132.887] lstrlenA (lpString="*.tar") returned 5
	[0132.887] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.gzip") returned 0
	[0132.887] lstrlenA (lpString="*.gzip") returned 6
	[0132.887] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.jpg") returned 0
	[0132.887] lstrlenA (lpString="*.jpg") returned 5
	[0132.887] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.jpeg") returned 0
	[0132.887] lstrlenA (lpString="*.jpeg") returned 6
	[0132.887] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.bmp") returned 0
	[0132.887] lstrlenA (lpString="*.bmp") returned 5
	[0132.887] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.gif") returned 0
	[0132.887] lstrlenA (lpString="*.gif") returned 5
	[0132.887] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.png") returned 0
	[0132.887] lstrlenA (lpString="*.png") returned 5
	[0132.887] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.doc") returned 0
	[0132.887] lstrlenA (lpString="*.doc") returned 5
	[0132.887] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.docx") returned 0
	[0132.887] lstrlenA (lpString="*.docx") returned 6
	[0132.887] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.xls") returned 0
	[0132.888] lstrlenA (lpString="*.xls") returned 5
	[0132.888] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.xlsx") returned 0
	[0132.888] lstrlenA (lpString="*.xlsx") returned 6
	[0132.888] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.ppt") returned 0
	[0132.888] lstrlenA (lpString="*.ppt") returned 5
	[0132.888] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.pptx") returned 0
	[0132.888] lstrlenA (lpString="*.pptx") returned 6
	[0132.888] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.txt") returned 0
	[0132.888] lstrlenA (lpString="*.txt") returned 5
	[0132.888] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.pdf") returned 0
	[0132.888] lstrlenA (lpString="*.pdf") returned 5
	[0132.888] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.htm") returned 0
	[0132.888] lstrlenA (lpString="*.htm") returned 5
	[0132.888] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.html") returned 0
	[0132.888] lstrlenA (lpString="*.html") returned 6
	[0132.888] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.mdb") returned 0
	[0132.888] lstrlenA (lpString="*.mdb") returned 5
	[0132.888] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.pfx") returned 0
	[0132.888] lstrlenA (lpString="*.pfx") returned 5
	[0132.888] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.md") returned 0
	[0132.888] lstrlenA (lpString="*.md") returned 4
	[0132.888] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.lnk") returned 0
	[0132.888] lstrlenA (lpString="*.lnk") returned 5
	[0132.888] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.torrent") returned 0
	[0132.888] lstrlenA (lpString="*.torrent") returned 9
	[0132.888] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.mov") returned 0
	[0132.888] lstrlenA (lpString="*.mov") returned 5
	[0132.888] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.3gp") returned 0
	[0132.888] lstrlenA (lpString="*.3gp") returned 5
	[0132.888] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.mpeg") returned 0
	[0132.888] lstrlenA (lpString="*.mpeg") returned 6
	[0132.888] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.mpg") returned 0
	[0132.888] lstrlenA (lpString="*.mpg") returned 5
	[0132.888] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.flv") returned 0
	[0132.888] lstrlenA (lpString="*.flv") returned 5
	[0132.888] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.avi") returned 0
	[0132.888] lstrlenA (lpString="*.avi") returned 5
	[0132.888] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.mp4") returned 0
	[0132.888] lstrlenA (lpString="*.mp4") returned 5
	[0132.888] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.wmv") returned 0
	[0132.888] lstrlenA (lpString="*.wmv") returned 5
	[0132.888] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.mkv") returned 0
	[0132.889] lstrlenA (lpString="*.mkv") returned 5
	[0132.889] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.mp3") returned 0
	[0132.889] lstrlenA (lpString="*.mp3") returned 5
	[0132.889] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.wav") returned 0
	[0132.889] lstrlenA (lpString="*.wav") returned 5
	[0132.889] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.flac") returned 0
	[0132.889] lstrlenA (lpString="*.flac") returned 6
	[0132.889] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.wma") returned 0
	[0132.889] lstrlenA (lpString="*.wma") returned 5
	[0132.889] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.au3") returned 0
	[0132.889] lstrlenA (lpString="*.au3") returned 5
	[0132.889] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.ahk") returned 0
	[0132.889] lstrlenA (lpString="*.ahk") returned 5
	[0132.889] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.c") returned 0
	[0132.889] lstrlenA (lpString="*.c") returned 3
	[0132.889] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.cc") returned 0
	[0132.889] lstrlenA (lpString="*.cc") returned 4
	[0132.889] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.cpp") returned 0
	[0132.889] lstrlenA (lpString="*.cpp") returned 5
	[0132.889] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.cxx") returned 0
	[0132.889] lstrlenA (lpString="*.cxx") returned 5
	[0132.889] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.c++") returned 0
	[0132.889] lstrlenA (lpString="*.c++") returned 5
	[0132.889] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.cs") returned 0
	[0132.889] lstrlenA (lpString="*.cs") returned 4
	[0132.889] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.vb") returned 0
	[0132.889] lstrlenA (lpString="*.vb") returned 4
	[0132.889] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.bas") returned 0
	[0132.889] lstrlenA (lpString="*.bas") returned 5
	[0132.889] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.csproj") returned 0
	[0132.889] lstrlenA (lpString="*.csproj") returned 8
	[0132.889] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.vbproj") returned 0
	[0132.889] lstrlenA (lpString="*.vbproj") returned 8
	[0132.889] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.vcxproj") returned 0
	[0132.889] lstrlenA (lpString="*.vcxproj") returned 9
	[0132.889] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.manifest") returned 0
	[0132.889] lstrlenA (lpString="*.manifest") returned 10
	[0132.889] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.php") returned 0
	[0132.889] lstrlenA (lpString="*.php") returned 5
	[0132.889] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.vbe") returned 0
	[0132.889] lstrlenA (lpString="*.vbe") returned 5
	[0132.889] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.vba") returned 0
	[0132.890] lstrlenA (lpString="*.vba") returned 5
	[0132.890] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.vbs") returned 0
	[0132.890] lstrlenA (lpString="*.vbs") returned 5
	[0132.890] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.bat") returned 0
	[0132.890] lstrlenA (lpString="*.bat") returned 5
	[0132.890] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.cmd") returned 0
	[0132.890] lstrlenA (lpString="*.cmd") returned 5
	[0132.890] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.js") returned 0
	[0132.890] lstrlenA (lpString="*.js") returned 4
	[0132.890] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.jscript") returned 0
	[0132.890] lstrlenA (lpString="*.jscript") returned 9
	[0132.890] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.hta") returned 0
	[0132.890] lstrlenA (lpString="*.hta") returned 5
	[0132.890] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.php7") returned 0
	[0132.890] lstrlenA (lpString="*.php7") returned 6
	[0132.890] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.db") returned 0
	[0132.890] lstrlenA (lpString="*.db") returned 4
	[0132.890] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.swf") returned 0
	[0132.890] lstrlenA (lpString="*.swf") returned 5
	[0132.890] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.eml") returned 0
	[0132.890] lstrlenA (lpString="*.eml") returned 5
	[0132.890] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.part") returned 0
	[0132.890] lstrlenA (lpString="*.part") returned 6
	[0132.890] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.nfo") returned 0
	[0132.890] lstrlenA (lpString="*.nfo") returned 5
	[0132.890] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.rsa") returned 0
	[0132.890] lstrlenA (lpString="*.rsa") returned 5
	[0132.890] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.key") returned 0
	[0132.890] lstrlenA (lpString="*.key") returned 5
	[0132.890] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.aes") returned 0
	[0132.890] lstrlenA (lpString="*.aes") returned 5
	[0132.890] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.blob") returned 0
	[0132.890] lstrlenA (lpString="*.blob") returned 6
	[0132.890] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.btc") returned 0
	[0132.890] lstrlenA (lpString="*.btc") returned 5
	[0132.890] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", pszSpec="*.wallet") returned 0
	[0132.890] lstrlenA (lpString="*.wallet") returned 8
	[0132.890] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x440149b1, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x0, dwReserved1=0x0, cFileName="Magnify.lnk", cAlternateFileName="")) returned 1
	[0132.890] PeekMessageA (in: lpMsg=0x19f23c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f23c) returned 0
	[0132.891] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Magnify.lnk") returned -1
	[0132.891] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Magnify.lnk") returned -1
	[0132.891] lstrcmpiA (lpString1="", lpString2="Magnify.lnk") returned -1
	[0132.891] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini") returned="desktop.ini"
	[0132.891] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\"
	[0132.891] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\") returned=""
	[0132.891] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.891] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\how-to-decrypt-files.htm")) returned 0x20
	[0132.892] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\", lpString2="Magnify.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk"
	[0132.892] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk", pszSpec="*.zip") returned 0
	[0132.892] lstrlenA (lpString="*.zip") returned 5
	[0132.892] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk", pszSpec="*.rar") returned 0
	[0132.892] lstrlenA (lpString="*.rar") returned 5
	[0132.892] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk", pszSpec="*.7z") returned 0
	[0132.892] lstrlenA (lpString="*.7z") returned 4
	[0132.892] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk", pszSpec="*.tar") returned 0
	[0132.892] lstrlenA (lpString="*.tar") returned 5
	[0132.892] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk", pszSpec="*.gzip") returned 0
	[0132.892] lstrlenA (lpString="*.gzip") returned 6
	[0132.892] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk", pszSpec="*.jpg") returned 0
	[0132.892] lstrlenA (lpString="*.jpg") returned 5
	[0132.892] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk", pszSpec="*.jpeg") returned 0
	[0132.892] lstrlenA (lpString="*.jpeg") returned 6
	[0132.892] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk", pszSpec="*.bmp") returned 0
	[0132.892] lstrlenA (lpString="*.bmp") returned 5
	[0132.892] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk", pszSpec="*.gif") returned 0
	[0132.892] lstrlenA (lpString="*.gif") returned 5
	[0132.892] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk", pszSpec="*.png") returned 0
	[0132.892] lstrlenA (lpString="*.png") returned 5
	[0132.892] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk", pszSpec="*.doc") returned 0
	[0132.892] lstrlenA (lpString="*.doc") returned 5
	[0132.892] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk", pszSpec="*.docx") returned 0
	[0132.892] lstrlenA (lpString="*.docx") returned 6
	[0132.892] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk", pszSpec="*.xls") returned 0
	[0132.892] lstrlenA (lpString="*.xls") returned 5
	[0132.892] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk", pszSpec="*.xlsx") returned 0
	[0132.892] lstrlenA (lpString="*.xlsx") returned 6
	[0132.892] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk", pszSpec="*.ppt") returned 0
	[0132.892] lstrlenA (lpString="*.ppt") returned 5
	[0132.892] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk", pszSpec="*.pptx") returned 0
	[0132.892] lstrlenA (lpString="*.pptx") returned 6
	[0132.892] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk", pszSpec="*.txt") returned 0
	[0132.892] lstrlenA (lpString="*.txt") returned 5
	[0132.892] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk", pszSpec="*.pdf") returned 0
	[0132.892] lstrlenA (lpString="*.pdf") returned 5
	[0132.892] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk", pszSpec="*.htm") returned 0
	[0132.892] lstrlenA (lpString="*.htm") returned 5
	[0132.892] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk", pszSpec="*.html") returned 0
	[0132.892] lstrlenA (lpString="*.html") returned 6
	[0132.892] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk", pszSpec="*.mdb") returned 0
	[0132.893] lstrlenA (lpString="*.mdb") returned 5
	[0132.893] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk", pszSpec="*.pfx") returned 0
	[0132.893] lstrlenA (lpString="*.pfx") returned 5
	[0132.893] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk", pszSpec="*.md") returned 0
	[0132.893] lstrlenA (lpString="*.md") returned 4
	[0132.893] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk", pszSpec="*.lnk") returned 1
	[0132.893] lstrlenA (lpString="*.lnk") returned 5
	[0132.893] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk"
	[0132.893] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk"
	[0132.893] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk."
	[0132.893] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk.exe"
	[0132.893] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224
	[0132.893] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x452
	[0132.893] GetFileTime (in: hFile=0x224, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x210f9687, dwHighDateTime=0x1d32742), lpLastAccessTime=0x407536*(dwLowDateTime=0x210f9687, dwHighDateTime=0x1d32742), lpLastWriteTime=0x40753e*(dwLowDateTime=0x440149b1, dwHighDateTime=0x1d2a02a)) returned 1
	[0132.893] SetFilePointer (in: hFile=0x224, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.893] ReadFile (in: hFile=0x224, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x410, lpOverlapped=0x0) returned 1
	[0132.895] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk") returned="Magnify.lnk"
	[0132.895] SetFilePointer (in: hFile=0x224, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.895] WriteFile (in: hFile=0x224, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x410, lpOverlapped=0x0) returned 1
	[0132.895] SetFileTime (hFile=0x224, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.895] CloseHandle (hObject=0x224) returned 1
	[0132.895] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk.exe")) returned 1
	[0132.896] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x44060e78, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x454, dwReserved0=0x0, dwReserved1=0x0, cFileName="Narrator.lnk", cAlternateFileName="")) returned 1
	[0132.896] PeekMessageA (in: lpMsg=0x19f23c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f23c) returned 0
	[0132.896] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Narrator.lnk") returned -1
	[0132.896] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Narrator.lnk") returned -1
	[0132.896] lstrcmpiA (lpString1="", lpString2="Narrator.lnk") returned -1
	[0132.896] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk") returned="Magnify.lnk"
	[0132.896] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\"
	[0132.896] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\") returned=""
	[0132.896] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.896] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\how-to-decrypt-files.htm")) returned 0x20
	[0132.896] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\", lpString2="Narrator.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk"
	[0132.896] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk", pszSpec="*.zip") returned 0
	[0132.896] lstrlenA (lpString="*.zip") returned 5
	[0132.896] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk", pszSpec="*.rar") returned 0
	[0132.896] lstrlenA (lpString="*.rar") returned 5
	[0132.896] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk", pszSpec="*.7z") returned 0
	[0132.896] lstrlenA (lpString="*.7z") returned 4
	[0132.896] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk", pszSpec="*.tar") returned 0
	[0132.896] lstrlenA (lpString="*.tar") returned 5
	[0132.896] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk", pszSpec="*.gzip") returned 0
	[0132.896] lstrlenA (lpString="*.gzip") returned 6
	[0132.896] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk", pszSpec="*.jpg") returned 0
	[0132.896] lstrlenA (lpString="*.jpg") returned 5
	[0132.896] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk", pszSpec="*.jpeg") returned 0
	[0132.896] lstrlenA (lpString="*.jpeg") returned 6
	[0132.896] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk", pszSpec="*.bmp") returned 0
	[0132.896] lstrlenA (lpString="*.bmp") returned 5
	[0132.896] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk", pszSpec="*.gif") returned 0
	[0132.897] lstrlenA (lpString="*.gif") returned 5
	[0132.897] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk", pszSpec="*.png") returned 0
	[0132.897] lstrlenA (lpString="*.png") returned 5
	[0132.897] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk", pszSpec="*.doc") returned 0
	[0132.897] lstrlenA (lpString="*.doc") returned 5
	[0132.897] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk", pszSpec="*.docx") returned 0
	[0132.897] lstrlenA (lpString="*.docx") returned 6
	[0132.897] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk", pszSpec="*.xls") returned 0
	[0132.897] lstrlenA (lpString="*.xls") returned 5
	[0132.897] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk", pszSpec="*.xlsx") returned 0
	[0132.897] lstrlenA (lpString="*.xlsx") returned 6
	[0132.897] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk", pszSpec="*.ppt") returned 0
	[0132.897] lstrlenA (lpString="*.ppt") returned 5
	[0132.897] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk", pszSpec="*.pptx") returned 0
	[0132.897] lstrlenA (lpString="*.pptx") returned 6
	[0132.897] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk", pszSpec="*.txt") returned 0
	[0132.897] lstrlenA (lpString="*.txt") returned 5
	[0132.897] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk", pszSpec="*.pdf") returned 0
	[0132.897] lstrlenA (lpString="*.pdf") returned 5
	[0132.897] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk", pszSpec="*.htm") returned 0
	[0132.897] lstrlenA (lpString="*.htm") returned 5
	[0132.897] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk", pszSpec="*.html") returned 0
	[0132.897] lstrlenA (lpString="*.html") returned 6
	[0132.897] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk", pszSpec="*.mdb") returned 0
	[0132.897] lstrlenA (lpString="*.mdb") returned 5
	[0132.897] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk", pszSpec="*.pfx") returned 0
	[0132.897] lstrlenA (lpString="*.pfx") returned 5
	[0132.897] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk", pszSpec="*.md") returned 0
	[0132.897] lstrlenA (lpString="*.md") returned 4
	[0132.897] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk", pszSpec="*.lnk") returned 1
	[0132.897] lstrlenA (lpString="*.lnk") returned 5
	[0132.897] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk"
	[0132.897] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk"
	[0132.897] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk."
	[0132.897] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk.exe"
	[0132.897] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224
	[0132.898] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x454
	[0132.898] GetFileTime (in: hFile=0x224, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x210f9687, dwHighDateTime=0x1d32742), lpLastAccessTime=0x407536*(dwLowDateTime=0x210f9687, dwHighDateTime=0x1d32742), lpLastWriteTime=0x40753e*(dwLowDateTime=0x44060e78, dwHighDateTime=0x1d2a02a)) returned 1
	[0132.898] SetFilePointer (in: hFile=0x224, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.898] ReadFile (in: hFile=0x224, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x412, lpOverlapped=0x0) returned 1
	[0132.899] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk") returned="Narrator.lnk"
	[0132.899] SetFilePointer (in: hFile=0x224, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.899] WriteFile (in: hFile=0x224, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x412, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x412, lpOverlapped=0x0) returned 1
	[0132.900] SetFileTime (hFile=0x224, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.900] CloseHandle (hObject=0x224) returned 1
	[0132.900] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk.exe")) returned 1
	[0132.900] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4382ea4e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x0, dwReserved1=0x0, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="ON-SCR~1.LNK")) returned 1
	[0132.900] PeekMessageA (in: lpMsg=0x19f23c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f23c) returned 0
	[0132.900] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="On-Screen Keyboard.lnk") returned -1
	[0132.900] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="On-Screen Keyboard.lnk") returned -1
	[0132.900] lstrcmpiA (lpString1="", lpString2="On-Screen Keyboard.lnk") returned -1
	[0132.900] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk") returned="Narrator.lnk"
	[0132.901] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\"
	[0132.901] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\") returned=""
	[0132.901] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.901] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\how-to-decrypt-files.htm")) returned 0x20
	[0132.901] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\", lpString2="On-Screen Keyboard.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk"
	[0132.901] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk", pszSpec="*.zip") returned 0
	[0132.901] lstrlenA (lpString="*.zip") returned 5
	[0132.901] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk", pszSpec="*.rar") returned 0
	[0132.901] lstrlenA (lpString="*.rar") returned 5
	[0132.901] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk", pszSpec="*.7z") returned 0
	[0132.901] lstrlenA (lpString="*.7z") returned 4
	[0132.901] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk", pszSpec="*.tar") returned 0
	[0132.901] lstrlenA (lpString="*.tar") returned 5
	[0132.901] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk", pszSpec="*.gzip") returned 0
	[0132.901] lstrlenA (lpString="*.gzip") returned 6
	[0132.901] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk", pszSpec="*.jpg") returned 0
	[0132.901] lstrlenA (lpString="*.jpg") returned 5
	[0132.901] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk", pszSpec="*.jpeg") returned 0
	[0132.901] lstrlenA (lpString="*.jpeg") returned 6
	[0132.901] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk", pszSpec="*.bmp") returned 0
	[0132.901] lstrlenA (lpString="*.bmp") returned 5
	[0132.901] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk", pszSpec="*.gif") returned 0
	[0132.901] lstrlenA (lpString="*.gif") returned 5
	[0132.901] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk", pszSpec="*.png") returned 0
	[0132.901] lstrlenA (lpString="*.png") returned 5
	[0132.901] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk", pszSpec="*.doc") returned 0
	[0132.901] lstrlenA (lpString="*.doc") returned 5
	[0132.901] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk", pszSpec="*.docx") returned 0
	[0132.901] lstrlenA (lpString="*.docx") returned 6
	[0132.901] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk", pszSpec="*.xls") returned 0
	[0132.901] lstrlenA (lpString="*.xls") returned 5
	[0132.901] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk", pszSpec="*.xlsx") returned 0
	[0132.901] lstrlenA (lpString="*.xlsx") returned 6
	[0132.901] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk", pszSpec="*.ppt") returned 0
	[0132.901] lstrlenA (lpString="*.ppt") returned 5
	[0132.901] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk", pszSpec="*.pptx") returned 0
	[0132.902] lstrlenA (lpString="*.pptx") returned 6
	[0132.902] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk", pszSpec="*.txt") returned 0
	[0132.902] lstrlenA (lpString="*.txt") returned 5
	[0132.902] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk", pszSpec="*.pdf") returned 0
	[0132.902] lstrlenA (lpString="*.pdf") returned 5
	[0132.902] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk", pszSpec="*.htm") returned 0
	[0132.902] lstrlenA (lpString="*.htm") returned 5
	[0132.902] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk", pszSpec="*.html") returned 0
	[0132.902] lstrlenA (lpString="*.html") returned 6
	[0132.902] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk", pszSpec="*.mdb") returned 0
	[0132.902] lstrlenA (lpString="*.mdb") returned 5
	[0132.902] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk", pszSpec="*.pfx") returned 0
	[0132.902] lstrlenA (lpString="*.pfx") returned 5
	[0132.902] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk", pszSpec="*.md") returned 0
	[0132.902] lstrlenA (lpString="*.md") returned 4
	[0132.902] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk", pszSpec="*.lnk") returned 1
	[0132.902] lstrlenA (lpString="*.lnk") returned 5
	[0132.902] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk"
	[0132.902] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk"
	[0132.902] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk."
	[0132.902] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk.exe"
	[0132.902] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224
	[0132.902] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x452
	[0132.902] GetFileTime (in: hFile=0x224, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x210f9687, dwHighDateTime=0x1d32742), lpLastAccessTime=0x407536*(dwLowDateTime=0x210f9687, dwHighDateTime=0x1d32742), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4382ea4e, dwHighDateTime=0x1d2a02a)) returned 1
	[0132.903] SetFilePointer (in: hFile=0x224, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.903] ReadFile (in: hFile=0x224, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x410, lpOverlapped=0x0) returned 1
	[0132.904] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk") returned="On-Screen Keyboard.lnk"
	[0132.904] SetFilePointer (in: hFile=0x224, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.904] WriteFile (in: hFile=0x224, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x410, lpOverlapped=0x0) returned 1
	[0132.904] SetFileTime (hFile=0x224, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.904] CloseHandle (hObject=0x224) returned 1
	[0132.904] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk.exe")) returned 1
	[0132.905] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4382ea4e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x0, dwReserved1=0x0, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="ON-SCR~1.LNK")) returned 0
	[0132.905] FindClose (in: hFindFile=0x7cbb90 | out: hFindFile=0x7cbb90) returned 1
	[0132.905] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xccacd784, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccacd784, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1
	[0132.905] lstrcmpA (lpString1=".", lpString2="Accessories") returned -1
	[0132.905] lstrcmpA (lpString1="..", lpString2="Accessories") returned -1
	[0132.905] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*.*") returned="*.*"
	[0132.905] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpString2="Accessories" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories"
	[0132.905] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories") returned 81
	[0132.905] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*", lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xccacd784, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccacd784, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbad0
	[0132.905] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0132.905] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xccacd784, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccacd784, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0132.905] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0132.905] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0132.905] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xccacd784, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0132.906] PeekMessageA (in: lpMsg=0x19f23c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f23c) returned 0
	[0132.906] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Desktop.ini") returned 1
	[0132.906] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Desktop.ini") returned 1
	[0132.906] lstrcmpiA (lpString1="", lpString2="Desktop.ini") returned -1
	[0132.906] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*") returned="*.*"
	[0132.906] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\"
	[0132.906] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned=""
	[0132.906] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.906] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0132.906] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224
	[0132.907] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0132.907] WriteFile (in: hFile=0x224, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0132.908] SetFileTime (hFile=0x224, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0132.908] CloseHandle (hObject=0x224) returned 1
	[0132.908] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", lpString2="Desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini"
	[0132.908] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.zip") returned 0
	[0132.909] lstrlenA (lpString="*.zip") returned 5
	[0132.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.rar") returned 0
	[0132.909] lstrlenA (lpString="*.rar") returned 5
	[0132.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.7z") returned 0
	[0132.909] lstrlenA (lpString="*.7z") returned 4
	[0132.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.tar") returned 0
	[0132.909] lstrlenA (lpString="*.tar") returned 5
	[0132.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.gzip") returned 0
	[0132.909] lstrlenA (lpString="*.gzip") returned 6
	[0132.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.jpg") returned 0
	[0132.909] lstrlenA (lpString="*.jpg") returned 5
	[0132.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.jpeg") returned 0
	[0132.909] lstrlenA (lpString="*.jpeg") returned 6
	[0132.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.bmp") returned 0
	[0132.909] lstrlenA (lpString="*.bmp") returned 5
	[0132.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.gif") returned 0
	[0132.909] lstrlenA (lpString="*.gif") returned 5
	[0132.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.png") returned 0
	[0132.909] lstrlenA (lpString="*.png") returned 5
	[0132.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.doc") returned 0
	[0132.909] lstrlenA (lpString="*.doc") returned 5
	[0132.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.docx") returned 0
	[0132.909] lstrlenA (lpString="*.docx") returned 6
	[0132.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.xls") returned 0
	[0132.909] lstrlenA (lpString="*.xls") returned 5
	[0132.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.xlsx") returned 0
	[0132.909] lstrlenA (lpString="*.xlsx") returned 6
	[0132.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.ppt") returned 0
	[0132.909] lstrlenA (lpString="*.ppt") returned 5
	[0132.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.pptx") returned 0
	[0132.909] lstrlenA (lpString="*.pptx") returned 6
	[0132.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.txt") returned 0
	[0132.909] lstrlenA (lpString="*.txt") returned 5
	[0132.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.pdf") returned 0
	[0132.909] lstrlenA (lpString="*.pdf") returned 5
	[0132.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.htm") returned 0
	[0132.909] lstrlenA (lpString="*.htm") returned 5
	[0132.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.html") returned 0
	[0132.909] lstrlenA (lpString="*.html") returned 6
	[0132.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.mdb") returned 0
	[0132.910] lstrlenA (lpString="*.mdb") returned 5
	[0132.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.pfx") returned 0
	[0132.910] lstrlenA (lpString="*.pfx") returned 5
	[0132.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.md") returned 0
	[0132.910] lstrlenA (lpString="*.md") returned 4
	[0132.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.lnk") returned 0
	[0132.910] lstrlenA (lpString="*.lnk") returned 5
	[0132.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.torrent") returned 0
	[0132.910] lstrlenA (lpString="*.torrent") returned 9
	[0132.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.mov") returned 0
	[0132.910] lstrlenA (lpString="*.mov") returned 5
	[0132.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.3gp") returned 0
	[0132.910] lstrlenA (lpString="*.3gp") returned 5
	[0132.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.mpeg") returned 0
	[0132.910] lstrlenA (lpString="*.mpeg") returned 6
	[0132.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.mpg") returned 0
	[0132.910] lstrlenA (lpString="*.mpg") returned 5
	[0132.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.flv") returned 0
	[0132.910] lstrlenA (lpString="*.flv") returned 5
	[0132.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.avi") returned 0
	[0132.910] lstrlenA (lpString="*.avi") returned 5
	[0132.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.mp4") returned 0
	[0132.910] lstrlenA (lpString="*.mp4") returned 5
	[0132.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.wmv") returned 0
	[0132.910] lstrlenA (lpString="*.wmv") returned 5
	[0132.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.mkv") returned 0
	[0132.910] lstrlenA (lpString="*.mkv") returned 5
	[0132.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.mp3") returned 0
	[0132.910] lstrlenA (lpString="*.mp3") returned 5
	[0132.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.wav") returned 0
	[0132.910] lstrlenA (lpString="*.wav") returned 5
	[0132.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.flac") returned 0
	[0132.910] lstrlenA (lpString="*.flac") returned 6
	[0132.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.wma") returned 0
	[0132.910] lstrlenA (lpString="*.wma") returned 5
	[0132.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.au3") returned 0
	[0132.910] lstrlenA (lpString="*.au3") returned 5
	[0132.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.ahk") returned 0
	[0132.910] lstrlenA (lpString="*.ahk") returned 5
	[0132.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.c") returned 0
	[0132.911] lstrlenA (lpString="*.c") returned 3
	[0132.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.cc") returned 0
	[0132.911] lstrlenA (lpString="*.cc") returned 4
	[0132.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.cpp") returned 0
	[0132.911] lstrlenA (lpString="*.cpp") returned 5
	[0132.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.cxx") returned 0
	[0132.911] lstrlenA (lpString="*.cxx") returned 5
	[0132.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.c++") returned 0
	[0132.911] lstrlenA (lpString="*.c++") returned 5
	[0132.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.cs") returned 0
	[0132.911] lstrlenA (lpString="*.cs") returned 4
	[0132.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.vb") returned 0
	[0132.911] lstrlenA (lpString="*.vb") returned 4
	[0132.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.bas") returned 0
	[0132.911] lstrlenA (lpString="*.bas") returned 5
	[0132.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.csproj") returned 0
	[0132.911] lstrlenA (lpString="*.csproj") returned 8
	[0132.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.vbproj") returned 0
	[0132.911] lstrlenA (lpString="*.vbproj") returned 8
	[0132.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.vcxproj") returned 0
	[0132.911] lstrlenA (lpString="*.vcxproj") returned 9
	[0132.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.manifest") returned 0
	[0132.911] lstrlenA (lpString="*.manifest") returned 10
	[0132.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.php") returned 0
	[0132.911] lstrlenA (lpString="*.php") returned 5
	[0132.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.vbe") returned 0
	[0132.911] lstrlenA (lpString="*.vbe") returned 5
	[0132.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.vba") returned 0
	[0132.911] lstrlenA (lpString="*.vba") returned 5
	[0132.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.vbs") returned 0
	[0132.911] lstrlenA (lpString="*.vbs") returned 5
	[0132.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.bat") returned 0
	[0132.911] lstrlenA (lpString="*.bat") returned 5
	[0132.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.cmd") returned 0
	[0132.911] lstrlenA (lpString="*.cmd") returned 5
	[0132.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.js") returned 0
	[0132.911] lstrlenA (lpString="*.js") returned 4
	[0132.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.jscript") returned 0
	[0132.911] lstrlenA (lpString="*.jscript") returned 9
	[0132.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.hta") returned 0
	[0132.911] lstrlenA (lpString="*.hta") returned 5
	[0132.912] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.php7") returned 0
	[0132.912] lstrlenA (lpString="*.php7") returned 6
	[0132.912] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.db") returned 0
	[0132.912] lstrlenA (lpString="*.db") returned 4
	[0132.912] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.swf") returned 0
	[0132.912] lstrlenA (lpString="*.swf") returned 5
	[0132.912] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.eml") returned 0
	[0132.912] lstrlenA (lpString="*.eml") returned 5
	[0132.912] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.part") returned 0
	[0132.912] lstrlenA (lpString="*.part") returned 6
	[0132.912] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.nfo") returned 0
	[0132.912] lstrlenA (lpString="*.nfo") returned 5
	[0132.912] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.rsa") returned 0
	[0132.912] lstrlenA (lpString="*.rsa") returned 5
	[0132.912] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.key") returned 0
	[0132.912] lstrlenA (lpString="*.key") returned 5
	[0132.912] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.aes") returned 0
	[0132.912] lstrlenA (lpString="*.aes") returned 5
	[0132.912] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.blob") returned 0
	[0132.912] lstrlenA (lpString="*.blob") returned 6
	[0132.912] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.btc") returned 0
	[0132.912] lstrlenA (lpString="*.btc") returned 5
	[0132.912] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", pszSpec="*.wallet") returned 0
	[0132.912] lstrlenA (lpString="*.wallet") returned 8
	[0132.912] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccacd784, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xccacd784, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccacd784, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x52d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 1
	[0132.912] PeekMessageA (in: lpMsg=0x19f23c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f23c) returned 0
	[0132.912] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Internet Explorer.lnk") returned -1
	[0132.912] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Internet Explorer.lnk") returned -1
	[0132.912] lstrcmpiA (lpString1="", lpString2="Internet Explorer.lnk") returned -1
	[0132.912] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini") returned="Desktop.ini"
	[0132.912] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\"
	[0132.912] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned=""
	[0132.912] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.912] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\how-to-decrypt-files.htm")) returned 0x20
	[0132.912] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", lpString2="Internet Explorer.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk"
	[0132.912] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk", pszSpec="*.zip") returned 0
	[0132.913] lstrlenA (lpString="*.zip") returned 5
	[0132.913] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk", pszSpec="*.rar") returned 0
	[0132.913] lstrlenA (lpString="*.rar") returned 5
	[0132.913] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk", pszSpec="*.7z") returned 0
	[0132.913] lstrlenA (lpString="*.7z") returned 4
	[0132.913] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk", pszSpec="*.tar") returned 0
	[0132.913] lstrlenA (lpString="*.tar") returned 5
	[0132.913] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk", pszSpec="*.gzip") returned 0
	[0132.913] lstrlenA (lpString="*.gzip") returned 6
	[0132.913] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk", pszSpec="*.jpg") returned 0
	[0132.913] lstrlenA (lpString="*.jpg") returned 5
	[0132.913] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk", pszSpec="*.jpeg") returned 0
	[0132.913] lstrlenA (lpString="*.jpeg") returned 6
	[0132.913] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk", pszSpec="*.bmp") returned 0
	[0132.913] lstrlenA (lpString="*.bmp") returned 5
	[0132.913] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk", pszSpec="*.gif") returned 0
	[0132.913] lstrlenA (lpString="*.gif") returned 5
	[0132.913] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk", pszSpec="*.png") returned 0
	[0132.913] lstrlenA (lpString="*.png") returned 5
	[0132.913] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk", pszSpec="*.doc") returned 0
	[0132.913] lstrlenA (lpString="*.doc") returned 5
	[0132.913] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk", pszSpec="*.docx") returned 0
	[0132.913] lstrlenA (lpString="*.docx") returned 6
	[0132.913] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk", pszSpec="*.xls") returned 0
	[0132.913] lstrlenA (lpString="*.xls") returned 5
	[0132.913] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk", pszSpec="*.xlsx") returned 0
	[0132.913] lstrlenA (lpString="*.xlsx") returned 6
	[0132.913] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk", pszSpec="*.ppt") returned 0
	[0132.913] lstrlenA (lpString="*.ppt") returned 5
	[0132.913] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk", pszSpec="*.pptx") returned 0
	[0132.913] lstrlenA (lpString="*.pptx") returned 6
	[0132.913] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk", pszSpec="*.txt") returned 0
	[0132.913] lstrlenA (lpString="*.txt") returned 5
	[0132.913] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk", pszSpec="*.pdf") returned 0
	[0132.913] lstrlenA (lpString="*.pdf") returned 5
	[0132.913] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk", pszSpec="*.htm") returned 0
	[0132.913] lstrlenA (lpString="*.htm") returned 5
	[0132.913] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk", pszSpec="*.html") returned 0
	[0132.913] lstrlenA (lpString="*.html") returned 6
	[0132.913] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk", pszSpec="*.mdb") returned 0
	[0132.914] lstrlenA (lpString="*.mdb") returned 5
	[0132.914] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk", pszSpec="*.pfx") returned 0
	[0132.914] lstrlenA (lpString="*.pfx") returned 5
	[0132.914] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk", pszSpec="*.md") returned 0
	[0132.914] lstrlenA (lpString="*.md") returned 4
	[0132.914] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk", pszSpec="*.lnk") returned 1
	[0132.914] lstrlenA (lpString="*.lnk") returned 5
	[0132.914] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk"
	[0132.914] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk"
	[0132.914] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk."
	[0132.914] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk.exe"
	[0132.914] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\internet explorer.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224
	[0132.914] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x52d
	[0132.914] GetFileTime (in: hFile=0x224, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xccacd784, dwHighDateTime=0x1d32743), lpLastAccessTime=0x407536*(dwLowDateTime=0xccacd784, dwHighDateTime=0x1d32743), lpLastWriteTime=0x40753e*(dwLowDateTime=0xccacd784, dwHighDateTime=0x1d32743)) returned 1
	[0132.914] SetFilePointer (in: hFile=0x224, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.914] ReadFile (in: hFile=0x224, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x4eb, lpOverlapped=0x0) returned 1
	[0132.916] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk") returned="Internet Explorer.lnk"
	[0132.916] SetFilePointer (in: hFile=0x224, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.916] WriteFile (in: hFile=0x224, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x4eb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x4eb, lpOverlapped=0x0) returned 1
	[0132.916] SetFileTime (hFile=0x224, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.916] CloseHandle (hObject=0x224) returned 1
	[0132.916] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\internet explorer.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\internet explorer.lnk.exe")) returned 1
	[0132.917] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6543ef5f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notepad.lnk", cAlternateFileName="")) returned 1
	[0132.917] PeekMessageA (in: lpMsg=0x19f23c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f23c) returned 0
	[0132.917] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Notepad.lnk") returned -1
	[0132.917] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Notepad.lnk") returned -1
	[0132.917] lstrcmpiA (lpString1="", lpString2="Notepad.lnk") returned -1
	[0132.917] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk") returned="Internet Explorer.lnk"
	[0132.917] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\"
	[0132.917] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned=""
	[0132.917] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.917] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\how-to-decrypt-files.htm")) returned 0x20
	[0132.917] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", lpString2="Notepad.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk"
	[0132.917] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", pszSpec="*.zip") returned 0
	[0132.917] lstrlenA (lpString="*.zip") returned 5
	[0132.917] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", pszSpec="*.rar") returned 0
	[0132.917] lstrlenA (lpString="*.rar") returned 5
	[0132.917] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", pszSpec="*.7z") returned 0
	[0132.917] lstrlenA (lpString="*.7z") returned 4
	[0132.917] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", pszSpec="*.tar") returned 0
	[0132.917] lstrlenA (lpString="*.tar") returned 5
	[0132.917] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", pszSpec="*.gzip") returned 0
	[0132.917] lstrlenA (lpString="*.gzip") returned 6
	[0132.917] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", pszSpec="*.jpg") returned 0
	[0132.917] lstrlenA (lpString="*.jpg") returned 5
	[0132.917] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", pszSpec="*.jpeg") returned 0
	[0132.918] lstrlenA (lpString="*.jpeg") returned 6
	[0132.918] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", pszSpec="*.bmp") returned 0
	[0132.918] lstrlenA (lpString="*.bmp") returned 5
	[0132.918] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", pszSpec="*.gif") returned 0
	[0132.918] lstrlenA (lpString="*.gif") returned 5
	[0132.918] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", pszSpec="*.png") returned 0
	[0132.918] lstrlenA (lpString="*.png") returned 5
	[0132.918] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", pszSpec="*.doc") returned 0
	[0132.918] lstrlenA (lpString="*.doc") returned 5
	[0132.918] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", pszSpec="*.docx") returned 0
	[0132.918] lstrlenA (lpString="*.docx") returned 6
	[0132.918] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", pszSpec="*.xls") returned 0
	[0132.918] lstrlenA (lpString="*.xls") returned 5
	[0132.918] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", pszSpec="*.xlsx") returned 0
	[0132.918] lstrlenA (lpString="*.xlsx") returned 6
	[0132.918] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", pszSpec="*.ppt") returned 0
	[0132.918] lstrlenA (lpString="*.ppt") returned 5
	[0132.918] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", pszSpec="*.pptx") returned 0
	[0132.918] lstrlenA (lpString="*.pptx") returned 6
	[0132.918] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", pszSpec="*.txt") returned 0
	[0132.918] lstrlenA (lpString="*.txt") returned 5
	[0132.918] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", pszSpec="*.pdf") returned 0
	[0132.918] lstrlenA (lpString="*.pdf") returned 5
	[0132.918] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", pszSpec="*.htm") returned 0
	[0132.918] lstrlenA (lpString="*.htm") returned 5
	[0132.918] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", pszSpec="*.html") returned 0
	[0132.918] lstrlenA (lpString="*.html") returned 6
	[0132.918] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", pszSpec="*.mdb") returned 0
	[0132.918] lstrlenA (lpString="*.mdb") returned 5
	[0132.918] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", pszSpec="*.pfx") returned 0
	[0132.918] lstrlenA (lpString="*.pfx") returned 5
	[0132.918] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", pszSpec="*.md") returned 0
	[0132.918] lstrlenA (lpString="*.md") returned 4
	[0132.918] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", pszSpec="*.lnk") returned 1
	[0132.918] lstrlenA (lpString="*.lnk") returned 5
	[0132.918] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk"
	[0132.918] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk"
	[0132.918] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk."
	[0132.918] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.exe"
	[0132.919] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224
	[0132.919] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x486
	[0132.919] GetFileTime (in: hFile=0x224, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x210d33f6, dwHighDateTime=0x1d32742), lpLastAccessTime=0x407536*(dwLowDateTime=0x210d33f6, dwHighDateTime=0x1d32742), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6543ef5f, dwHighDateTime=0x1d2a02a)) returned 1
	[0132.919] SetFilePointer (in: hFile=0x224, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.919] ReadFile (in: hFile=0x224, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x444, lpOverlapped=0x0) returned 1
	[0132.921] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk") returned="Notepad.lnk"
	[0132.921] SetFilePointer (in: hFile=0x224, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.921] WriteFile (in: hFile=0x224, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x444, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x444, lpOverlapped=0x0) returned 1
	[0132.921] SetFileTime (hFile=0x224, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.921] CloseHandle (hObject=0x224) returned 1
	[0132.921] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk.exe")) returned 1
	[0132.922] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6543ef5f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notepad.lnk", cAlternateFileName="")) returned 0
	[0132.922] FindClose (in: hFindFile=0x7cbad0 | out: hFindFile=0x7cbad0) returned 1
	[0132.922] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3eed247, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20, dwReserved1=0x0, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1
	[0132.922] lstrcmpA (lpString1=".", lpString2="Administrative Tools") returned -1
	[0132.922] lstrcmpA (lpString1="..", lpString2="Administrative Tools") returned -1
	[0132.922] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*.*") returned="*.*"
	[0132.922] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpString2="Administrative Tools" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools"
	[0132.922] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools") returned 90
	[0132.922] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*.*", lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3eed247, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb790
	[0132.922] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0132.922] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3eed247, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0132.922] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0132.922] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0132.922] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441842cf, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0132.922] PeekMessageA (in: lpMsg=0x19f23c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f23c) returned 0
	[0132.922] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="desktop.ini") returned 1
	[0132.922] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="desktop.ini") returned 1
	[0132.922] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1
	[0132.922] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*.*") returned="*.*"
	[0132.922] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\"
	[0132.923] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\") returned=""
	[0132.923] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.923] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0132.923] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224
	[0132.923] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0132.923] WriteFile (in: hFile=0x224, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0132.924] SetFileTime (hFile=0x224, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0132.924] CloseHandle (hObject=0x224) returned 1
	[0132.924] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini"
	[0132.924] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.zip") returned 0
	[0132.924] lstrlenA (lpString="*.zip") returned 5
	[0132.924] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.rar") returned 0
	[0132.924] lstrlenA (lpString="*.rar") returned 5
	[0132.924] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.7z") returned 0
	[0132.924] lstrlenA (lpString="*.7z") returned 4
	[0132.924] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.tar") returned 0
	[0132.924] lstrlenA (lpString="*.tar") returned 5
	[0132.924] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.gzip") returned 0
	[0132.924] lstrlenA (lpString="*.gzip") returned 6
	[0132.924] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.jpg") returned 0
	[0132.924] lstrlenA (lpString="*.jpg") returned 5
	[0132.924] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.jpeg") returned 0
	[0132.924] lstrlenA (lpString="*.jpeg") returned 6
	[0132.924] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.bmp") returned 0
	[0132.924] lstrlenA (lpString="*.bmp") returned 5
	[0132.925] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.gif") returned 0
	[0132.925] lstrlenA (lpString="*.gif") returned 5
	[0132.925] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.png") returned 0
	[0132.925] lstrlenA (lpString="*.png") returned 5
	[0132.925] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.doc") returned 0
	[0132.925] lstrlenA (lpString="*.doc") returned 5
	[0132.925] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.docx") returned 0
	[0132.925] lstrlenA (lpString="*.docx") returned 6
	[0132.925] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.xls") returned 0
	[0132.925] lstrlenA (lpString="*.xls") returned 5
	[0132.925] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.xlsx") returned 0
	[0132.925] lstrlenA (lpString="*.xlsx") returned 6
	[0132.925] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.ppt") returned 0
	[0132.925] lstrlenA (lpString="*.ppt") returned 5
	[0132.925] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.pptx") returned 0
	[0132.925] lstrlenA (lpString="*.pptx") returned 6
	[0132.925] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.txt") returned 0
	[0132.925] lstrlenA (lpString="*.txt") returned 5
	[0132.925] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.pdf") returned 0
	[0132.925] lstrlenA (lpString="*.pdf") returned 5
	[0132.925] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.htm") returned 0
	[0132.925] lstrlenA (lpString="*.htm") returned 5
	[0132.925] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.html") returned 0
	[0132.925] lstrlenA (lpString="*.html") returned 6
	[0132.925] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.mdb") returned 0
	[0132.925] lstrlenA (lpString="*.mdb") returned 5
	[0132.925] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.pfx") returned 0
	[0132.925] lstrlenA (lpString="*.pfx") returned 5
	[0132.925] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.md") returned 0
	[0132.925] lstrlenA (lpString="*.md") returned 4
	[0132.925] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.lnk") returned 0
	[0132.925] lstrlenA (lpString="*.lnk") returned 5
	[0132.925] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.torrent") returned 0
	[0132.925] lstrlenA (lpString="*.torrent") returned 9
	[0132.925] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.mov") returned 0
	[0132.925] lstrlenA (lpString="*.mov") returned 5
	[0132.925] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.3gp") returned 0
	[0132.925] lstrlenA (lpString="*.3gp") returned 5
	[0132.925] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.mpeg") returned 0
	[0132.925] lstrlenA (lpString="*.mpeg") returned 6
	[0132.926] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.mpg") returned 0
	[0132.926] lstrlenA (lpString="*.mpg") returned 5
	[0132.926] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.flv") returned 0
	[0132.926] lstrlenA (lpString="*.flv") returned 5
	[0132.926] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.avi") returned 0
	[0132.926] lstrlenA (lpString="*.avi") returned 5
	[0132.926] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.mp4") returned 0
	[0132.926] lstrlenA (lpString="*.mp4") returned 5
	[0132.926] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.wmv") returned 0
	[0132.926] lstrlenA (lpString="*.wmv") returned 5
	[0132.926] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.mkv") returned 0
	[0132.926] lstrlenA (lpString="*.mkv") returned 5
	[0132.926] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.mp3") returned 0
	[0132.926] lstrlenA (lpString="*.mp3") returned 5
	[0132.926] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.wav") returned 0
	[0132.926] lstrlenA (lpString="*.wav") returned 5
	[0132.926] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.flac") returned 0
	[0132.926] lstrlenA (lpString="*.flac") returned 6
	[0132.926] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.wma") returned 0
	[0132.926] lstrlenA (lpString="*.wma") returned 5
	[0132.926] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.au3") returned 0
	[0132.926] lstrlenA (lpString="*.au3") returned 5
	[0132.926] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.ahk") returned 0
	[0132.926] lstrlenA (lpString="*.ahk") returned 5
	[0132.926] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.c") returned 0
	[0132.926] lstrlenA (lpString="*.c") returned 3
	[0132.926] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.cc") returned 0
	[0132.926] lstrlenA (lpString="*.cc") returned 4
	[0132.926] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.cpp") returned 0
	[0132.926] lstrlenA (lpString="*.cpp") returned 5
	[0132.926] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.cxx") returned 0
	[0132.926] lstrlenA (lpString="*.cxx") returned 5
	[0132.926] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.c++") returned 0
	[0132.926] lstrlenA (lpString="*.c++") returned 5
	[0132.926] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.cs") returned 0
	[0132.926] lstrlenA (lpString="*.cs") returned 4
	[0132.926] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.vb") returned 0
	[0132.927] lstrlenA (lpString="*.vb") returned 4
	[0132.927] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.bas") returned 0
	[0132.927] lstrlenA (lpString="*.bas") returned 5
	[0132.927] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.csproj") returned 0
	[0132.927] lstrlenA (lpString="*.csproj") returned 8
	[0132.927] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.vbproj") returned 0
	[0132.927] lstrlenA (lpString="*.vbproj") returned 8
	[0132.927] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.vcxproj") returned 0
	[0132.927] lstrlenA (lpString="*.vcxproj") returned 9
	[0132.927] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.manifest") returned 0
	[0132.927] lstrlenA (lpString="*.manifest") returned 10
	[0132.927] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.php") returned 0
	[0132.927] lstrlenA (lpString="*.php") returned 5
	[0132.927] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.vbe") returned 0
	[0132.927] lstrlenA (lpString="*.vbe") returned 5
	[0132.927] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.vba") returned 0
	[0132.927] lstrlenA (lpString="*.vba") returned 5
	[0132.927] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.vbs") returned 0
	[0132.927] lstrlenA (lpString="*.vbs") returned 5
	[0132.927] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.bat") returned 0
	[0132.927] lstrlenA (lpString="*.bat") returned 5
	[0132.927] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.cmd") returned 0
	[0132.927] lstrlenA (lpString="*.cmd") returned 5
	[0132.927] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.js") returned 0
	[0132.927] lstrlenA (lpString="*.js") returned 4
	[0132.927] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.jscript") returned 0
	[0132.927] lstrlenA (lpString="*.jscript") returned 9
	[0132.927] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.hta") returned 0
	[0132.927] lstrlenA (lpString="*.hta") returned 5
	[0132.927] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.php7") returned 0
	[0132.927] lstrlenA (lpString="*.php7") returned 6
	[0132.927] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.db") returned 0
	[0132.927] lstrlenA (lpString="*.db") returned 4
	[0132.927] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.swf") returned 0
	[0132.927] lstrlenA (lpString="*.swf") returned 5
	[0132.927] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.eml") returned 0
	[0132.927] lstrlenA (lpString="*.eml") returned 5
	[0132.927] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.part") returned 0
	[0132.927] lstrlenA (lpString="*.part") returned 6
	[0132.928] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.nfo") returned 0
	[0132.928] lstrlenA (lpString="*.nfo") returned 5
	[0132.928] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.rsa") returned 0
	[0132.928] lstrlenA (lpString="*.rsa") returned 5
	[0132.928] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.key") returned 0
	[0132.928] lstrlenA (lpString="*.key") returned 5
	[0132.928] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.aes") returned 0
	[0132.928] lstrlenA (lpString="*.aes") returned 5
	[0132.928] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.blob") returned 0
	[0132.928] lstrlenA (lpString="*.blob") returned 6
	[0132.928] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.btc") returned 0
	[0132.928] lstrlenA (lpString="*.btc") returned 5
	[0132.928] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", pszSpec="*.wallet") returned 0
	[0132.928] lstrlenA (lpString="*.wallet") returned 8
	[0132.928] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441842cf, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0132.928] FindClose (in: hFindFile=0x7cb790 | out: hFindFile=0x7cb790) returned 1
	[0132.928] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xce317778, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0132.928] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0132.928] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="desktop.ini") returned 1
	[0132.928] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="desktop.ini") returned 1
	[0132.928] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1
	[0132.928] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*.*") returned="*.*"
	[0132.928] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\"
	[0132.928] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\") returned=""
	[0132.928] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.928] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0132.928] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0132.935] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0132.935] WriteFile (in: hFile=0x220, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0132.936] SetFileTime (hFile=0x220, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0132.936] CloseHandle (hObject=0x220) returned 1
	[0132.936] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini"
	[0132.936] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.zip") returned 0
	[0132.936] lstrlenA (lpString="*.zip") returned 5
	[0132.936] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.rar") returned 0
	[0132.936] lstrlenA (lpString="*.rar") returned 5
	[0132.936] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.7z") returned 0
	[0132.936] lstrlenA (lpString="*.7z") returned 4
	[0132.936] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.tar") returned 0
	[0132.937] lstrlenA (lpString="*.tar") returned 5
	[0132.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.gzip") returned 0
	[0132.937] lstrlenA (lpString="*.gzip") returned 6
	[0132.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.jpg") returned 0
	[0132.937] lstrlenA (lpString="*.jpg") returned 5
	[0132.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.jpeg") returned 0
	[0132.937] lstrlenA (lpString="*.jpeg") returned 6
	[0132.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.bmp") returned 0
	[0132.937] lstrlenA (lpString="*.bmp") returned 5
	[0132.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.gif") returned 0
	[0132.937] lstrlenA (lpString="*.gif") returned 5
	[0132.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.png") returned 0
	[0132.937] lstrlenA (lpString="*.png") returned 5
	[0132.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.doc") returned 0
	[0132.937] lstrlenA (lpString="*.doc") returned 5
	[0132.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.docx") returned 0
	[0132.937] lstrlenA (lpString="*.docx") returned 6
	[0132.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.xls") returned 0
	[0132.937] lstrlenA (lpString="*.xls") returned 5
	[0132.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.xlsx") returned 0
	[0132.937] lstrlenA (lpString="*.xlsx") returned 6
	[0132.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.ppt") returned 0
	[0132.937] lstrlenA (lpString="*.ppt") returned 5
	[0132.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.pptx") returned 0
	[0132.937] lstrlenA (lpString="*.pptx") returned 6
	[0132.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.txt") returned 0
	[0132.937] lstrlenA (lpString="*.txt") returned 5
	[0132.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.pdf") returned 0
	[0132.937] lstrlenA (lpString="*.pdf") returned 5
	[0132.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.htm") returned 0
	[0132.937] lstrlenA (lpString="*.htm") returned 5
	[0132.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.html") returned 0
	[0132.937] lstrlenA (lpString="*.html") returned 6
	[0132.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.mdb") returned 0
	[0132.937] lstrlenA (lpString="*.mdb") returned 5
	[0132.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.pfx") returned 0
	[0132.937] lstrlenA (lpString="*.pfx") returned 5
	[0132.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.md") returned 0
	[0132.937] lstrlenA (lpString="*.md") returned 4
	[0132.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.lnk") returned 0
	[0132.937] lstrlenA (lpString="*.lnk") returned 5
	[0132.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.torrent") returned 0
	[0132.938] lstrlenA (lpString="*.torrent") returned 9
	[0132.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.mov") returned 0
	[0132.938] lstrlenA (lpString="*.mov") returned 5
	[0132.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.3gp") returned 0
	[0132.938] lstrlenA (lpString="*.3gp") returned 5
	[0132.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.mpeg") returned 0
	[0132.938] lstrlenA (lpString="*.mpeg") returned 6
	[0132.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.mpg") returned 0
	[0132.938] lstrlenA (lpString="*.mpg") returned 5
	[0132.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.flv") returned 0
	[0132.938] lstrlenA (lpString="*.flv") returned 5
	[0132.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.avi") returned 0
	[0132.938] lstrlenA (lpString="*.avi") returned 5
	[0132.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.mp4") returned 0
	[0132.938] lstrlenA (lpString="*.mp4") returned 5
	[0132.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.wmv") returned 0
	[0132.938] lstrlenA (lpString="*.wmv") returned 5
	[0132.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.mkv") returned 0
	[0132.938] lstrlenA (lpString="*.mkv") returned 5
	[0132.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.mp3") returned 0
	[0132.938] lstrlenA (lpString="*.mp3") returned 5
	[0132.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.wav") returned 0
	[0132.938] lstrlenA (lpString="*.wav") returned 5
	[0132.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.flac") returned 0
	[0132.938] lstrlenA (lpString="*.flac") returned 6
	[0132.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.wma") returned 0
	[0132.938] lstrlenA (lpString="*.wma") returned 5
	[0132.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.au3") returned 0
	[0132.938] lstrlenA (lpString="*.au3") returned 5
	[0132.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.ahk") returned 0
	[0132.938] lstrlenA (lpString="*.ahk") returned 5
	[0132.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.c") returned 0
	[0132.938] lstrlenA (lpString="*.c") returned 3
	[0132.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.cc") returned 0
	[0132.938] lstrlenA (lpString="*.cc") returned 4
	[0132.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.cpp") returned 0
	[0132.938] lstrlenA (lpString="*.cpp") returned 5
	[0132.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.cxx") returned 0
	[0132.938] lstrlenA (lpString="*.cxx") returned 5
	[0132.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.c++") returned 0
	[0132.939] lstrlenA (lpString="*.c++") returned 5
	[0132.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.cs") returned 0
	[0132.939] lstrlenA (lpString="*.cs") returned 4
	[0132.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.vb") returned 0
	[0132.939] lstrlenA (lpString="*.vb") returned 4
	[0132.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.bas") returned 0
	[0132.939] lstrlenA (lpString="*.bas") returned 5
	[0132.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.csproj") returned 0
	[0132.939] lstrlenA (lpString="*.csproj") returned 8
	[0132.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.vbproj") returned 0
	[0132.939] lstrlenA (lpString="*.vbproj") returned 8
	[0132.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.vcxproj") returned 0
	[0132.939] lstrlenA (lpString="*.vcxproj") returned 9
	[0132.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.manifest") returned 0
	[0132.939] lstrlenA (lpString="*.manifest") returned 10
	[0132.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.php") returned 0
	[0132.939] lstrlenA (lpString="*.php") returned 5
	[0132.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.vbe") returned 0
	[0132.939] lstrlenA (lpString="*.vbe") returned 5
	[0132.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.vba") returned 0
	[0132.939] lstrlenA (lpString="*.vba") returned 5
	[0132.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.vbs") returned 0
	[0132.939] lstrlenA (lpString="*.vbs") returned 5
	[0132.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.bat") returned 0
	[0132.939] lstrlenA (lpString="*.bat") returned 5
	[0132.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.cmd") returned 0
	[0132.939] lstrlenA (lpString="*.cmd") returned 5
	[0132.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.js") returned 0
	[0132.939] lstrlenA (lpString="*.js") returned 4
	[0132.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.jscript") returned 0
	[0132.939] lstrlenA (lpString="*.jscript") returned 9
	[0132.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.hta") returned 0
	[0132.939] lstrlenA (lpString="*.hta") returned 5
	[0132.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.php7") returned 0
	[0132.939] lstrlenA (lpString="*.php7") returned 6
	[0132.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.db") returned 0
	[0132.939] lstrlenA (lpString="*.db") returned 4
	[0132.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.swf") returned 0
	[0132.939] lstrlenA (lpString="*.swf") returned 5
	[0132.940] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.eml") returned 0
	[0132.940] lstrlenA (lpString="*.eml") returned 5
	[0132.940] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.part") returned 0
	[0132.940] lstrlenA (lpString="*.part") returned 6
	[0132.940] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.nfo") returned 0
	[0132.940] lstrlenA (lpString="*.nfo") returned 5
	[0132.940] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.rsa") returned 0
	[0132.940] lstrlenA (lpString="*.rsa") returned 5
	[0132.940] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.key") returned 0
	[0132.940] lstrlenA (lpString="*.key") returned 5
	[0132.940] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.aes") returned 0
	[0132.940] lstrlenA (lpString="*.aes") returned 5
	[0132.940] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.blob") returned 0
	[0132.940] lstrlenA (lpString="*.blob") returned 6
	[0132.940] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.btc") returned 0
	[0132.940] lstrlenA (lpString="*.btc") returned 5
	[0132.940] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", pszSpec="*.wallet") returned 0
	[0132.940] lstrlenA (lpString="*.wallet") returned 8
	[0132.940] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3eedf4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1
	[0132.940] lstrcmpA (lpString1=".", lpString2="Maintenance") returned -1
	[0132.940] lstrcmpA (lpString1="..", lpString2="Maintenance") returned -1
	[0132.940] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini") returned="desktop.ini"
	[0132.940] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpString2="Maintenance" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance"
	[0132.940] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance") returned 81
	[0132.940] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*.*", lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3eedf4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7de518, dwReserved1=0xd0, cFileName=".", cAlternateFileName="")) returned 0x7cb890
	[0132.940] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0132.940] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3eedf4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7de518, dwReserved1=0xd0, cFileName="..", cAlternateFileName="")) returned 1
	[0132.940] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0132.940] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0132.940] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x7de518, dwReserved1=0xd0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0132.940] PeekMessageA (in: lpMsg=0x19f23c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f23c) returned 0
	[0132.940] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Desktop.ini") returned 1
	[0132.941] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Desktop.ini") returned 1
	[0132.941] lstrcmpiA (lpString1="", lpString2="Desktop.ini") returned -1
	[0132.941] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*.*") returned="*.*"
	[0132.941] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\"
	[0132.941] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\") returned=""
	[0132.941] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.941] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0132.941] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224
	[0132.941] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0132.941] WriteFile (in: hFile=0x224, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0132.942] SetFileTime (hFile=0x224, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0132.942] CloseHandle (hObject=0x224) returned 1
	[0132.942] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\", lpString2="Desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini"
	[0132.942] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.zip") returned 0
	[0132.942] lstrlenA (lpString="*.zip") returned 5
	[0132.942] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.rar") returned 0
	[0132.942] lstrlenA (lpString="*.rar") returned 5
	[0132.942] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.7z") returned 0
	[0132.942] lstrlenA (lpString="*.7z") returned 4
	[0132.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.tar") returned 0
	[0132.943] lstrlenA (lpString="*.tar") returned 5
	[0132.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.gzip") returned 0
	[0132.943] lstrlenA (lpString="*.gzip") returned 6
	[0132.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.jpg") returned 0
	[0132.943] lstrlenA (lpString="*.jpg") returned 5
	[0132.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.jpeg") returned 0
	[0132.943] lstrlenA (lpString="*.jpeg") returned 6
	[0132.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.bmp") returned 0
	[0132.943] lstrlenA (lpString="*.bmp") returned 5
	[0132.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.gif") returned 0
	[0132.943] lstrlenA (lpString="*.gif") returned 5
	[0132.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.png") returned 0
	[0132.943] lstrlenA (lpString="*.png") returned 5
	[0132.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.doc") returned 0
	[0132.943] lstrlenA (lpString="*.doc") returned 5
	[0132.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.docx") returned 0
	[0132.943] lstrlenA (lpString="*.docx") returned 6
	[0132.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.xls") returned 0
	[0132.943] lstrlenA (lpString="*.xls") returned 5
	[0132.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.xlsx") returned 0
	[0132.943] lstrlenA (lpString="*.xlsx") returned 6
	[0132.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.ppt") returned 0
	[0132.943] lstrlenA (lpString="*.ppt") returned 5
	[0132.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.pptx") returned 0
	[0132.943] lstrlenA (lpString="*.pptx") returned 6
	[0132.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.txt") returned 0
	[0132.943] lstrlenA (lpString="*.txt") returned 5
	[0132.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.pdf") returned 0
	[0132.943] lstrlenA (lpString="*.pdf") returned 5
	[0132.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.htm") returned 0
	[0132.943] lstrlenA (lpString="*.htm") returned 5
	[0132.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.html") returned 0
	[0132.943] lstrlenA (lpString="*.html") returned 6
	[0132.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.mdb") returned 0
	[0132.943] lstrlenA (lpString="*.mdb") returned 5
	[0132.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.pfx") returned 0
	[0132.943] lstrlenA (lpString="*.pfx") returned 5
	[0132.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.md") returned 0
	[0132.943] lstrlenA (lpString="*.md") returned 4
	[0132.944] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.lnk") returned 0
	[0132.944] lstrlenA (lpString="*.lnk") returned 5
	[0132.944] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.torrent") returned 0
	[0132.944] lstrlenA (lpString="*.torrent") returned 9
	[0132.944] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.mov") returned 0
	[0132.944] lstrlenA (lpString="*.mov") returned 5
	[0132.944] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.3gp") returned 0
	[0132.944] lstrlenA (lpString="*.3gp") returned 5
	[0132.944] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.mpeg") returned 0
	[0132.944] lstrlenA (lpString="*.mpeg") returned 6
	[0132.944] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.mpg") returned 0
	[0132.944] lstrlenA (lpString="*.mpg") returned 5
	[0132.944] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.flv") returned 0
	[0132.944] lstrlenA (lpString="*.flv") returned 5
	[0132.944] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.avi") returned 0
	[0132.944] lstrlenA (lpString="*.avi") returned 5
	[0132.944] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.mp4") returned 0
	[0132.944] lstrlenA (lpString="*.mp4") returned 5
	[0132.944] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.wmv") returned 0
	[0132.944] lstrlenA (lpString="*.wmv") returned 5
	[0132.944] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.mkv") returned 0
	[0132.944] lstrlenA (lpString="*.mkv") returned 5
	[0132.944] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.mp3") returned 0
	[0132.944] lstrlenA (lpString="*.mp3") returned 5
	[0132.944] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.wav") returned 0
	[0132.944] lstrlenA (lpString="*.wav") returned 5
	[0132.944] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.flac") returned 0
	[0132.944] lstrlenA (lpString="*.flac") returned 6
	[0132.944] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.wma") returned 0
	[0132.944] lstrlenA (lpString="*.wma") returned 5
	[0132.944] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.au3") returned 0
	[0132.944] lstrlenA (lpString="*.au3") returned 5
	[0132.944] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.ahk") returned 0
	[0132.944] lstrlenA (lpString="*.ahk") returned 5
	[0132.944] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.c") returned 0
	[0132.944] lstrlenA (lpString="*.c") returned 3
	[0132.944] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.cc") returned 0
	[0132.944] lstrlenA (lpString="*.cc") returned 4
	[0132.944] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.cpp") returned 0
	[0132.944] lstrlenA (lpString="*.cpp") returned 5
	[0132.944] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.cxx") returned 0
	[0132.944] lstrlenA (lpString="*.cxx") returned 5
	[0132.945] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.c++") returned 0
	[0132.945] lstrlenA (lpString="*.c++") returned 5
	[0132.945] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.cs") returned 0
	[0132.945] lstrlenA (lpString="*.cs") returned 4
	[0132.945] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.vb") returned 0
	[0132.945] lstrlenA (lpString="*.vb") returned 4
	[0132.945] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.bas") returned 0
	[0132.945] lstrlenA (lpString="*.bas") returned 5
	[0132.945] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.csproj") returned 0
	[0132.945] lstrlenA (lpString="*.csproj") returned 8
	[0132.945] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.vbproj") returned 0
	[0132.945] lstrlenA (lpString="*.vbproj") returned 8
	[0132.945] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.vcxproj") returned 0
	[0132.945] lstrlenA (lpString="*.vcxproj") returned 9
	[0132.945] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.manifest") returned 0
	[0132.945] lstrlenA (lpString="*.manifest") returned 10
	[0132.952] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.php") returned 0
	[0132.952] lstrlenA (lpString="*.php") returned 5
	[0132.952] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.vbe") returned 0
	[0132.953] lstrlenA (lpString="*.vbe") returned 5
	[0132.953] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.vba") returned 0
	[0132.953] lstrlenA (lpString="*.vba") returned 5
	[0132.953] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.vbs") returned 0
	[0132.953] lstrlenA (lpString="*.vbs") returned 5
	[0132.953] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.bat") returned 0
	[0132.953] lstrlenA (lpString="*.bat") returned 5
	[0132.953] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.cmd") returned 0
	[0132.953] lstrlenA (lpString="*.cmd") returned 5
	[0132.953] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.js") returned 0
	[0132.953] lstrlenA (lpString="*.js") returned 4
	[0132.953] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.jscript") returned 0
	[0132.953] lstrlenA (lpString="*.jscript") returned 9
	[0132.953] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.hta") returned 0
	[0132.953] lstrlenA (lpString="*.hta") returned 5
	[0132.953] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.php7") returned 0
	[0132.953] lstrlenA (lpString="*.php7") returned 6
	[0132.953] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.db") returned 0
	[0132.953] lstrlenA (lpString="*.db") returned 4
	[0132.953] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.swf") returned 0
	[0132.953] lstrlenA (lpString="*.swf") returned 5
	[0132.953] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.eml") returned 0
	[0132.953] lstrlenA (lpString="*.eml") returned 5
	[0132.953] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.part") returned 0
	[0132.953] lstrlenA (lpString="*.part") returned 6
	[0132.953] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.nfo") returned 0
	[0132.953] lstrlenA (lpString="*.nfo") returned 5
	[0132.953] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.rsa") returned 0
	[0132.953] lstrlenA (lpString="*.rsa") returned 5
	[0132.953] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.key") returned 0
	[0132.953] lstrlenA (lpString="*.key") returned 5
	[0132.953] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.aes") returned 0
	[0132.953] lstrlenA (lpString="*.aes") returned 5
	[0132.953] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.blob") returned 0
	[0132.953] lstrlenA (lpString="*.blob") returned 6
	[0132.953] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.btc") returned 0
	[0132.953] lstrlenA (lpString="*.btc") returned 5
	[0132.953] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", pszSpec="*.wallet") returned 0
	[0132.953] lstrlenA (lpString="*.wallet") returned 8
	[0132.953] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x7de518, dwReserved1=0xd0, cFileName="Desktop.ini", cAlternateFileName="")) returned 0
	[0132.954] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1
	[0132.954] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f13cff3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x92576074, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x92aad258, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x944, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive.lnk", cAlternateFileName="")) returned 1
	[0132.954] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0132.954] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="OneDrive.lnk") returned -1
	[0132.954] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="OneDrive.lnk") returned -1
	[0132.954] lstrcmpiA (lpString1="", lpString2="OneDrive.lnk") returned -1
	[0132.954] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*.*") returned="*.*"
	[0132.954] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\"
	[0132.954] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\") returned=""
	[0132.954] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.954] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\how-to-decrypt-files.htm")) returned 0x20
	[0132.954] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpString2="OneDrive.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk"
	[0132.954] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk", pszSpec="*.zip") returned 0
	[0132.954] lstrlenA (lpString="*.zip") returned 5
	[0132.954] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk", pszSpec="*.rar") returned 0
	[0132.954] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk", pszSpec="*.7z") returned 0
	[0132.954] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk", pszSpec="*.tar") returned 0
	[0132.954] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk", pszSpec="*.gzip") returned 0
	[0132.954] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk", pszSpec="*.jpg") returned 0
	[0132.954] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk", pszSpec="*.jpeg") returned 0
	[0132.954] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk", pszSpec="*.bmp") returned 0
	[0132.954] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk", pszSpec="*.gif") returned 0
	[0132.954] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk", pszSpec="*.png") returned 0
	[0132.954] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk", pszSpec="*.doc") returned 0
	[0132.955] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk", pszSpec="*.docx") returned 0
	[0132.955] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk", pszSpec="*.xls") returned 0
	[0132.955] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk", pszSpec="*.xlsx") returned 0
	[0132.955] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk", pszSpec="*.ppt") returned 0
	[0132.955] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk", pszSpec="*.pptx") returned 0
	[0132.955] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk", pszSpec="*.txt") returned 0
	[0132.955] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk", pszSpec="*.pdf") returned 0
	[0132.955] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk", pszSpec="*.htm") returned 0
	[0132.955] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk", pszSpec="*.html") returned 0
	[0132.955] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk", pszSpec="*.mdb") returned 0
	[0132.955] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk", pszSpec="*.pfx") returned 0
	[0132.955] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk", pszSpec="*.md") returned 0
	[0132.955] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk", pszSpec="*.lnk") returned 1
	[0132.955] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk"
	[0132.955] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk"
	[0132.955] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk."
	[0132.955] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk.exe"
	[0132.955] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\onedrive.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0132.956] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x944
	[0132.956] GetFileTime (in: hFile=0x220, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3f13cff3, dwHighDateTime=0x1d32715), lpLastAccessTime=0x407536*(dwLowDateTime=0x92576074, dwHighDateTime=0x1d39f5d), lpLastWriteTime=0x40753e*(dwLowDateTime=0x92aad258, dwHighDateTime=0x1d39f5d)) returned 1
	[0132.956] SetFilePointer (in: hFile=0x220, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.956] ReadFile (in: hFile=0x220, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x902, lpOverlapped=0x0) returned 1
	[0132.957] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk") returned="OneDrive.lnk"
	[0132.957] SetFilePointer (in: hFile=0x220, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0132.957] WriteFile (in: hFile=0x220, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x902, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x902, lpOverlapped=0x0) returned 1
	[0132.958] SetFileTime (hFile=0x220, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0132.958] CloseHandle (hObject=0x220) returned 1
	[0132.958] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\onedrive.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\onedrive.lnk.exe")) returned 1
	[0132.959] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3eef18c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Startup", cAlternateFileName="")) returned 1
	[0132.959] lstrcmpA (lpString1=".", lpString2="Startup") returned -1
	[0132.959] lstrcmpA (lpString1="..", lpString2="Startup") returned -1
	[0132.959] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk") returned="OneDrive.lnk"
	[0132.959] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpString2="Startup" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"
	[0132.959] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.*", lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3eef18c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName=".", cAlternateFileName="")) returned 0x7cb790
	[0132.959] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0132.959] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3eef18c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="..", cAlternateFileName="")) returned 1
	[0132.959] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0132.959] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0132.959] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441842cf, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0132.959] PeekMessageA (in: lpMsg=0x19f23c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f23c) returned 0
	[0132.959] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="desktop.ini") returned 1
	[0132.959] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="desktop.ini") returned 1
	[0132.959] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1
	[0132.959] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.*") returned="*.*"
	[0132.959] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\"
	[0132.959] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\") returned=""
	[0132.959] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HOW-TO-DECRYPT-FILES.HTM"
	[0132.959] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0132.959] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224
	[0132.960] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0132.960] WriteFile (in: hFile=0x224, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0133.002] SetFileTime (hFile=0x224, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0133.002] CloseHandle (hObject=0x224) returned 1
	[0133.002] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini"
	[0133.002] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.zip") returned 0
	[0133.002] lstrlenA (lpString="*.zip") returned 5
	[0133.002] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.rar") returned 0
	[0133.002] lstrlenA (lpString="*.rar") returned 5
	[0133.002] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.7z") returned 0
	[0133.002] lstrlenA (lpString="*.7z") returned 4
	[0133.002] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.tar") returned 0
	[0133.002] lstrlenA (lpString="*.tar") returned 5
	[0133.002] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.gzip") returned 0
	[0133.002] lstrlenA (lpString="*.gzip") returned 6
	[0133.002] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.jpg") returned 0
	[0133.002] lstrlenA (lpString="*.jpg") returned 5
	[0133.002] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.jpeg") returned 0
	[0133.002] lstrlenA (lpString="*.jpeg") returned 6
	[0133.002] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.bmp") returned 0
	[0133.002] lstrlenA (lpString="*.bmp") returned 5
	[0133.002] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.gif") returned 0
	[0133.002] lstrlenA (lpString="*.gif") returned 5
	[0133.002] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.png") returned 0
	[0133.002] lstrlenA (lpString="*.png") returned 5
	[0133.002] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.doc") returned 0
	[0133.002] lstrlenA (lpString="*.doc") returned 5
	[0133.002] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.docx") returned 0
	[0133.003] lstrlenA (lpString="*.docx") returned 6
	[0133.003] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.xls") returned 0
	[0133.003] lstrlenA (lpString="*.xls") returned 5
	[0133.003] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.xlsx") returned 0
	[0133.003] lstrlenA (lpString="*.xlsx") returned 6
	[0133.003] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.ppt") returned 0
	[0133.003] lstrlenA (lpString="*.ppt") returned 5
	[0133.003] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.pptx") returned 0
	[0133.003] lstrlenA (lpString="*.pptx") returned 6
	[0133.003] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.txt") returned 0
	[0133.003] lstrlenA (lpString="*.txt") returned 5
	[0133.003] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.pdf") returned 0
	[0133.003] lstrlenA (lpString="*.pdf") returned 5
	[0133.003] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.htm") returned 0
	[0133.003] lstrlenA (lpString="*.htm") returned 5
	[0133.003] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.html") returned 0
	[0133.003] lstrlenA (lpString="*.html") returned 6
	[0133.003] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.mdb") returned 0
	[0133.003] lstrlenA (lpString="*.mdb") returned 5
	[0133.003] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.pfx") returned 0
	[0133.003] lstrlenA (lpString="*.pfx") returned 5
	[0133.003] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.md") returned 0
	[0133.003] lstrlenA (lpString="*.md") returned 4
	[0133.003] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.lnk") returned 0
	[0133.003] lstrlenA (lpString="*.lnk") returned 5
	[0133.003] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.torrent") returned 0
	[0133.003] lstrlenA (lpString="*.torrent") returned 9
	[0133.003] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.mov") returned 0
	[0133.003] lstrlenA (lpString="*.mov") returned 5
	[0133.003] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.3gp") returned 0
	[0133.003] lstrlenA (lpString="*.3gp") returned 5
	[0133.003] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.mpeg") returned 0
	[0133.003] lstrlenA (lpString="*.mpeg") returned 6
	[0133.003] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.mpg") returned 0
	[0133.003] lstrlenA (lpString="*.mpg") returned 5
	[0133.003] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.flv") returned 0
	[0133.003] lstrlenA (lpString="*.flv") returned 5
	[0133.003] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.avi") returned 0
	[0133.003] lstrlenA (lpString="*.avi") returned 5
	[0133.003] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.mp4") returned 0
	[0133.004] lstrlenA (lpString="*.mp4") returned 5
	[0133.004] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.wmv") returned 0
	[0133.004] lstrlenA (lpString="*.wmv") returned 5
	[0133.004] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.mkv") returned 0
	[0133.004] lstrlenA (lpString="*.mkv") returned 5
	[0133.004] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.mp3") returned 0
	[0133.004] lstrlenA (lpString="*.mp3") returned 5
	[0133.004] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.wav") returned 0
	[0133.004] lstrlenA (lpString="*.wav") returned 5
	[0133.004] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.flac") returned 0
	[0133.004] lstrlenA (lpString="*.flac") returned 6
	[0133.004] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.wma") returned 0
	[0133.004] lstrlenA (lpString="*.wma") returned 5
	[0133.004] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.au3") returned 0
	[0133.004] lstrlenA (lpString="*.au3") returned 5
	[0133.004] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.ahk") returned 0
	[0133.004] lstrlenA (lpString="*.ahk") returned 5
	[0133.004] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.c") returned 0
	[0133.004] lstrlenA (lpString="*.c") returned 3
	[0133.004] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.cc") returned 0
	[0133.004] lstrlenA (lpString="*.cc") returned 4
	[0133.004] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.cpp") returned 0
	[0133.004] lstrlenA (lpString="*.cpp") returned 5
	[0133.004] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.cxx") returned 0
	[0133.004] lstrlenA (lpString="*.cxx") returned 5
	[0133.004] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.c++") returned 0
	[0133.004] lstrlenA (lpString="*.c++") returned 5
	[0133.004] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.cs") returned 0
	[0133.004] lstrlenA (lpString="*.cs") returned 4
	[0133.004] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.vb") returned 0
	[0133.004] lstrlenA (lpString="*.vb") returned 4
	[0133.004] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.bas") returned 0
	[0133.004] lstrlenA (lpString="*.bas") returned 5
	[0133.004] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.csproj") returned 0
	[0133.004] lstrlenA (lpString="*.csproj") returned 8
	[0133.004] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.vbproj") returned 0
	[0133.004] lstrlenA (lpString="*.vbproj") returned 8
	[0133.004] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.vcxproj") returned 0
	[0133.004] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.004] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.manifest") returned 0
	[0133.005] lstrlenA (lpString="*.manifest") returned 10
	[0133.005] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.php") returned 0
	[0133.005] lstrlenA (lpString="*.php") returned 5
	[0133.005] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.vbe") returned 0
	[0133.005] lstrlenA (lpString="*.vbe") returned 5
	[0133.005] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.vba") returned 0
	[0133.005] lstrlenA (lpString="*.vba") returned 5
	[0133.005] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.vbs") returned 0
	[0133.005] lstrlenA (lpString="*.vbs") returned 5
	[0133.005] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.bat") returned 0
	[0133.005] lstrlenA (lpString="*.bat") returned 5
	[0133.005] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.cmd") returned 0
	[0133.005] lstrlenA (lpString="*.cmd") returned 5
	[0133.005] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.js") returned 0
	[0133.005] lstrlenA (lpString="*.js") returned 4
	[0133.005] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.jscript") returned 0
	[0133.005] lstrlenA (lpString="*.jscript") returned 9
	[0133.005] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.hta") returned 0
	[0133.005] lstrlenA (lpString="*.hta") returned 5
	[0133.005] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.php7") returned 0
	[0133.005] lstrlenA (lpString="*.php7") returned 6
	[0133.005] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.db") returned 0
	[0133.005] lstrlenA (lpString="*.db") returned 4
	[0133.005] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.swf") returned 0
	[0133.005] lstrlenA (lpString="*.swf") returned 5
	[0133.005] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.eml") returned 0
	[0133.005] lstrlenA (lpString="*.eml") returned 5
	[0133.005] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.part") returned 0
	[0133.005] lstrlenA (lpString="*.part") returned 6
	[0133.005] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.nfo") returned 0
	[0133.005] lstrlenA (lpString="*.nfo") returned 5
	[0133.005] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.rsa") returned 0
	[0133.005] lstrlenA (lpString="*.rsa") returned 5
	[0133.005] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.key") returned 0
	[0133.005] lstrlenA (lpString="*.key") returned 5
	[0133.005] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.aes") returned 0
	[0133.005] lstrlenA (lpString="*.aes") returned 5
	[0133.005] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.blob") returned 0
	[0133.005] lstrlenA (lpString="*.blob") returned 6
	[0133.005] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.btc") returned 0
	[0133.005] lstrlenA (lpString="*.btc") returned 5
	[0133.005] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", pszSpec="*.wallet") returned 0
	[0133.006] lstrlenA (lpString="*.wallet") returned 8
	[0133.006] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441842cf, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0133.006] FindClose (in: hFindFile=0x7cb790 | out: hFindFile=0x7cb790) returned 1
	[0133.006] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f411db, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1
	[0133.006] lstrcmpA (lpString1=".", lpString2="System Tools") returned -1
	[0133.006] lstrcmpA (lpString1="..", lpString2="System Tools") returned -1
	[0133.006] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*.*") returned="*.*"
	[0133.006] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpString2="System Tools" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools"
	[0133.006] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools") returned 82
	[0133.006] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\*.*", lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f411db, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbb90
	[0133.006] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.006] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f411db, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.006] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.006] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.006] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4c08a146, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x476, dwReserved0=0x0, dwReserved1=0x0, cFileName="Command Prompt.lnk", cAlternateFileName="COMMAN~1.LNK")) returned 1
	[0133.006] PeekMessageA (in: lpMsg=0x19f23c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f23c) returned 0
	[0133.006] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Command Prompt.lnk") returned 1
	[0133.006] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Command Prompt.lnk") returned 1
	[0133.006] lstrcmpiA (lpString1="", lpString2="Command Prompt.lnk") returned -1
	[0133.006] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\*.*") returned="*.*"
	[0133.006] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\"
	[0133.006] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\") returned=""
	[0133.006] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.006] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0133.006] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224
	[0133.054] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0133.055] WriteFile (in: hFile=0x224, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0133.055] SetFileTime (hFile=0x224, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0133.056] CloseHandle (hObject=0x224) returned 1
	[0133.056] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\", lpString2="Command Prompt.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk"
	[0133.056] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk", pszSpec="*.zip") returned 0
	[0133.056] lstrlenA (lpString="*.zip") returned 5
	[0133.056] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk", pszSpec="*.rar") returned 0
	[0133.056] lstrlenA (lpString="*.rar") returned 5
	[0133.056] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk", pszSpec="*.7z") returned 0
	[0133.056] lstrlenA (lpString="*.7z") returned 4
	[0133.056] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk", pszSpec="*.tar") returned 0
	[0133.056] lstrlenA (lpString="*.tar") returned 5
	[0133.056] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk", pszSpec="*.gzip") returned 0
	[0133.056] lstrlenA (lpString="*.gzip") returned 6
	[0133.056] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk", pszSpec="*.jpg") returned 0
	[0133.056] lstrlenA (lpString="*.jpg") returned 5
	[0133.056] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk", pszSpec="*.jpeg") returned 0
	[0133.056] lstrlenA (lpString="*.jpeg") returned 6
	[0133.056] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk", pszSpec="*.bmp") returned 0
	[0133.056] lstrlenA (lpString="*.bmp") returned 5
	[0133.056] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk", pszSpec="*.gif") returned 0
	[0133.056] lstrlenA (lpString="*.gif") returned 5
	[0133.056] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk", pszSpec="*.png") returned 0
	[0133.056] lstrlenA (lpString="*.png") returned 5
	[0133.056] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk", pszSpec="*.doc") returned 0
	[0133.056] lstrlenA (lpString="*.doc") returned 5
	[0133.056] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk", pszSpec="*.docx") returned 0
	[0133.056] lstrlenA (lpString="*.docx") returned 6
	[0133.056] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk", pszSpec="*.xls") returned 0
	[0133.056] lstrlenA (lpString="*.xls") returned 5
	[0133.056] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk", pszSpec="*.xlsx") returned 0
	[0133.056] lstrlenA (lpString="*.xlsx") returned 6
	[0133.056] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk", pszSpec="*.ppt") returned 0
	[0133.056] lstrlenA (lpString="*.ppt") returned 5
	[0133.056] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk", pszSpec="*.pptx") returned 0
	[0133.056] lstrlenA (lpString="*.pptx") returned 6
	[0133.056] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk", pszSpec="*.txt") returned 0
	[0133.056] lstrlenA (lpString="*.txt") returned 5
	[0133.056] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk", pszSpec="*.pdf") returned 0
	[0133.056] lstrlenA (lpString="*.pdf") returned 5
	[0133.057] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk", pszSpec="*.htm") returned 0
	[0133.057] lstrlenA (lpString="*.htm") returned 5
	[0133.057] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk", pszSpec="*.html") returned 0
	[0133.057] lstrlenA (lpString="*.html") returned 6
	[0133.057] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk", pszSpec="*.mdb") returned 0
	[0133.057] lstrlenA (lpString="*.mdb") returned 5
	[0133.057] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk", pszSpec="*.pfx") returned 0
	[0133.057] lstrlenA (lpString="*.pfx") returned 5
	[0133.057] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk", pszSpec="*.md") returned 0
	[0133.057] lstrlenA (lpString="*.md") returned 4
	[0133.057] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk", pszSpec="*.lnk") returned 1
	[0133.057] lstrlenA (lpString="*.lnk") returned 5
	[0133.057] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk"
	[0133.057] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk"
	[0133.057] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk."
	[0133.057] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk.exe"
	[0133.057] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224
	[0133.058] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x476
	[0133.058] GetFileTime (in: hFile=0x224, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x210d33f6, dwHighDateTime=0x1d32742), lpLastAccessTime=0x407536*(dwLowDateTime=0x210d33f6, dwHighDateTime=0x1d32742), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4c08a146, dwHighDateTime=0x1d2a02a)) returned 1
	[0133.058] SetFilePointer (in: hFile=0x224, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.058] ReadFile (in: hFile=0x224, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x434, lpOverlapped=0x0) returned 1
	[0133.059] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk") returned="Command Prompt.lnk"
	[0133.059] SetFilePointer (in: hFile=0x224, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.059] WriteFile (in: hFile=0x224, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x434, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x434, lpOverlapped=0x0) returned 1
	[0133.059] SetFileTime (hFile=0x224, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.060] CloseHandle (hObject=0x224) returned 1
	[0133.060] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk.exe")) returned 1
	[0133.061] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14f, dwReserved0=0x0, dwReserved1=0x0, cFileName="computer.lnk", cAlternateFileName="")) returned 1
	[0133.061] PeekMessageA (in: lpMsg=0x19f23c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f23c) returned 0
	[0133.061] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="computer.lnk") returned 1
	[0133.061] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="computer.lnk") returned 1
	[0133.061] lstrcmpiA (lpString1="", lpString2="computer.lnk") returned -1
	[0133.061] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk") returned="Command Prompt.lnk"
	[0133.061] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\"
	[0133.061] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\") returned=""
	[0133.061] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.061] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\how-to-decrypt-files.htm")) returned 0x20
	[0133.061] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\", lpString2="computer.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk"
	[0133.061] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk", pszSpec="*.zip") returned 0
	[0133.061] lstrlenA (lpString="*.zip") returned 5
	[0133.061] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk", pszSpec="*.rar") returned 0
	[0133.061] lstrlenA (lpString="*.rar") returned 5
	[0133.061] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk", pszSpec="*.7z") returned 0
	[0133.061] lstrlenA (lpString="*.7z") returned 4
	[0133.061] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk", pszSpec="*.tar") returned 0
	[0133.061] lstrlenA (lpString="*.tar") returned 5
	[0133.061] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk", pszSpec="*.gzip") returned 0
	[0133.061] lstrlenA (lpString="*.gzip") returned 6
	[0133.061] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk", pszSpec="*.jpg") returned 0
	[0133.061] lstrlenA (lpString="*.jpg") returned 5
	[0133.061] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk", pszSpec="*.jpeg") returned 0
	[0133.061] lstrlenA (lpString="*.jpeg") returned 6
	[0133.061] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk", pszSpec="*.bmp") returned 0
	[0133.061] lstrlenA (lpString="*.bmp") returned 5
	[0133.061] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk", pszSpec="*.gif") returned 0
	[0133.061] lstrlenA (lpString="*.gif") returned 5
	[0133.061] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk", pszSpec="*.png") returned 0
	[0133.062] lstrlenA (lpString="*.png") returned 5
	[0133.062] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk", pszSpec="*.doc") returned 0
	[0133.062] lstrlenA (lpString="*.doc") returned 5
	[0133.062] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk", pszSpec="*.docx") returned 0
	[0133.062] lstrlenA (lpString="*.docx") returned 6
	[0133.062] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk", pszSpec="*.xls") returned 0
	[0133.062] lstrlenA (lpString="*.xls") returned 5
	[0133.062] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk", pszSpec="*.xlsx") returned 0
	[0133.062] lstrlenA (lpString="*.xlsx") returned 6
	[0133.062] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk", pszSpec="*.ppt") returned 0
	[0133.062] lstrlenA (lpString="*.ppt") returned 5
	[0133.062] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk", pszSpec="*.pptx") returned 0
	[0133.062] lstrlenA (lpString="*.pptx") returned 6
	[0133.062] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk", pszSpec="*.txt") returned 0
	[0133.062] lstrlenA (lpString="*.txt") returned 5
	[0133.062] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk", pszSpec="*.pdf") returned 0
	[0133.062] lstrlenA (lpString="*.pdf") returned 5
	[0133.062] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk", pszSpec="*.htm") returned 0
	[0133.062] lstrlenA (lpString="*.htm") returned 5
	[0133.062] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk", pszSpec="*.html") returned 0
	[0133.062] lstrlenA (lpString="*.html") returned 6
	[0133.062] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk", pszSpec="*.mdb") returned 0
	[0133.062] lstrlenA (lpString="*.mdb") returned 5
	[0133.062] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk", pszSpec="*.pfx") returned 0
	[0133.062] lstrlenA (lpString="*.pfx") returned 5
	[0133.062] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk", pszSpec="*.md") returned 0
	[0133.062] lstrlenA (lpString="*.md") returned 4
	[0133.062] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk", pszSpec="*.lnk") returned 1
	[0133.062] lstrlenA (lpString="*.lnk") returned 5
	[0133.062] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk"
	[0133.062] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk"
	[0133.062] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk."
	[0133.062] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk.exe"
	[0133.062] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224
	[0133.063] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14f
	[0133.063] GetFileTime (in: hFile=0x224, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x210d33f6, dwHighDateTime=0x1d32742), lpLastAccessTime=0x407536*(dwLowDateTime=0x210d33f6, dwHighDateTime=0x1d32742), lpLastWriteTime=0x40753e*(dwLowDateTime=0x61d8dd66, dwHighDateTime=0x1d2a02a)) returned 1
	[0133.063] SetFilePointer (in: hFile=0x224, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.063] ReadFile (in: hFile=0x224, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x10d, lpOverlapped=0x0) returned 1
	[0133.065] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk") returned="computer.lnk"
	[0133.065] SetFilePointer (in: hFile=0x224, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.065] WriteFile (in: hFile=0x224, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x10d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x10d, lpOverlapped=0x0) returned 1
	[0133.065] SetFileTime (hFile=0x224, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.065] CloseHandle (hObject=0x224) returned 1
	[0133.065] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk.exe")) returned 1
	[0133.066] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x195, dwReserved0=0x0, dwReserved1=0x0, cFileName="Control Panel.lnk", cAlternateFileName="CONTRO~1.LNK")) returned 1
	[0133.066] PeekMessageA (in: lpMsg=0x19f23c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f23c) returned 0
	[0133.066] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Control Panel.lnk") returned 1
	[0133.066] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Control Panel.lnk") returned 1
	[0133.066] lstrcmpiA (lpString1="", lpString2="Control Panel.lnk") returned -1
	[0133.066] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk") returned="computer.lnk"
	[0133.066] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\"
	[0133.066] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\") returned=""
	[0133.066] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.066] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\how-to-decrypt-files.htm")) returned 0x20
	[0133.066] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\", lpString2="Control Panel.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk"
	[0133.066] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk", pszSpec="*.zip") returned 0
	[0133.066] lstrlenA (lpString="*.zip") returned 5
	[0133.066] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk", pszSpec="*.rar") returned 0
	[0133.066] lstrlenA (lpString="*.rar") returned 5
	[0133.066] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk", pszSpec="*.7z") returned 0
	[0133.066] lstrlenA (lpString="*.7z") returned 4
	[0133.066] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk", pszSpec="*.tar") returned 0
	[0133.066] lstrlenA (lpString="*.tar") returned 5
	[0133.066] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk", pszSpec="*.gzip") returned 0
	[0133.066] lstrlenA (lpString="*.gzip") returned 6
	[0133.066] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk", pszSpec="*.jpg") returned 0
	[0133.066] lstrlenA (lpString="*.jpg") returned 5
	[0133.066] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk", pszSpec="*.jpeg") returned 0
	[0133.066] lstrlenA (lpString="*.jpeg") returned 6
	[0133.067] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk", pszSpec="*.bmp") returned 0
	[0133.067] lstrlenA (lpString="*.bmp") returned 5
	[0133.067] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk", pszSpec="*.gif") returned 0
	[0133.067] lstrlenA (lpString="*.gif") returned 5
	[0133.067] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk", pszSpec="*.png") returned 0
	[0133.067] lstrlenA (lpString="*.png") returned 5
	[0133.067] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk", pszSpec="*.doc") returned 0
	[0133.067] lstrlenA (lpString="*.doc") returned 5
	[0133.067] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk", pszSpec="*.docx") returned 0
	[0133.067] lstrlenA (lpString="*.docx") returned 6
	[0133.067] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk", pszSpec="*.xls") returned 0
	[0133.067] lstrlenA (lpString="*.xls") returned 5
	[0133.067] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk", pszSpec="*.xlsx") returned 0
	[0133.067] lstrlenA (lpString="*.xlsx") returned 6
	[0133.067] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk", pszSpec="*.ppt") returned 0
	[0133.067] lstrlenA (lpString="*.ppt") returned 5
	[0133.067] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk", pszSpec="*.pptx") returned 0
	[0133.067] lstrlenA (lpString="*.pptx") returned 6
	[0133.067] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk", pszSpec="*.txt") returned 0
	[0133.067] lstrlenA (lpString="*.txt") returned 5
	[0133.067] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk", pszSpec="*.pdf") returned 0
	[0133.067] lstrlenA (lpString="*.pdf") returned 5
	[0133.067] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk", pszSpec="*.htm") returned 0
	[0133.067] lstrlenA (lpString="*.htm") returned 5
	[0133.067] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk", pszSpec="*.html") returned 0
	[0133.067] lstrlenA (lpString="*.html") returned 6
	[0133.067] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk", pszSpec="*.mdb") returned 0
	[0133.067] lstrlenA (lpString="*.mdb") returned 5
	[0133.067] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk", pszSpec="*.pfx") returned 0
	[0133.067] lstrlenA (lpString="*.pfx") returned 5
	[0133.067] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk", pszSpec="*.md") returned 0
	[0133.067] lstrlenA (lpString="*.md") returned 4
	[0133.067] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk", pszSpec="*.lnk") returned 1
	[0133.067] lstrlenA (lpString="*.lnk") returned 5
	[0133.067] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk"
	[0133.067] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk"
	[0133.067] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk."
	[0133.067] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk.exe"
	[0133.067] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224
	[0133.068] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x195
	[0133.068] GetFileTime (in: hFile=0x224, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x210d33f6, dwHighDateTime=0x1d32742), lpLastAccessTime=0x407536*(dwLowDateTime=0x210d33f6, dwHighDateTime=0x1d32742), lpLastWriteTime=0x40753e*(dwLowDateTime=0x61db3fcd, dwHighDateTime=0x1d2a02a)) returned 1
	[0133.068] SetFilePointer (in: hFile=0x224, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.068] ReadFile (in: hFile=0x224, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x153, lpOverlapped=0x0) returned 1
	[0133.069] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk") returned="Control Panel.lnk"
	[0133.069] SetFilePointer (in: hFile=0x224, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.069] WriteFile (in: hFile=0x224, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x153, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x153, lpOverlapped=0x0) returned 1
	[0133.069] SetFileTime (hFile=0x224, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.069] CloseHandle (hObject=0x224) returned 1
	[0133.069] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk.exe")) returned 1
	[0133.070] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc8ea7682, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x31e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0133.070] PeekMessageA (in: lpMsg=0x19f23c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f23c) returned 0
	[0133.070] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Desktop.ini") returned 1
	[0133.070] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Desktop.ini") returned 1
	[0133.070] lstrcmpiA (lpString1="", lpString2="Desktop.ini") returned -1
	[0133.070] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk") returned="Control Panel.lnk"
	[0133.070] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\"
	[0133.070] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\") returned=""
	[0133.070] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.070] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\how-to-decrypt-files.htm")) returned 0x20
	[0133.070] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\", lpString2="Desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini"
	[0133.070] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.zip") returned 0
	[0133.070] lstrlenA (lpString="*.zip") returned 5
	[0133.070] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.rar") returned 0
	[0133.070] lstrlenA (lpString="*.rar") returned 5
	[0133.070] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.7z") returned 0
	[0133.070] lstrlenA (lpString="*.7z") returned 4
	[0133.070] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.tar") returned 0
	[0133.070] lstrlenA (lpString="*.tar") returned 5
	[0133.070] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.gzip") returned 0
	[0133.070] lstrlenA (lpString="*.gzip") returned 6
	[0133.070] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.jpg") returned 0
	[0133.070] lstrlenA (lpString="*.jpg") returned 5
	[0133.070] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.jpeg") returned 0
	[0133.070] lstrlenA (lpString="*.jpeg") returned 6
	[0133.070] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.bmp") returned 0
	[0133.070] lstrlenA (lpString="*.bmp") returned 5
	[0133.071] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.gif") returned 0
	[0133.071] lstrlenA (lpString="*.gif") returned 5
	[0133.071] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.png") returned 0
	[0133.071] lstrlenA (lpString="*.png") returned 5
	[0133.071] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.doc") returned 0
	[0133.071] lstrlenA (lpString="*.doc") returned 5
	[0133.071] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.docx") returned 0
	[0133.071] lstrlenA (lpString="*.docx") returned 6
	[0133.071] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.xls") returned 0
	[0133.071] lstrlenA (lpString="*.xls") returned 5
	[0133.071] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.xlsx") returned 0
	[0133.071] lstrlenA (lpString="*.xlsx") returned 6
	[0133.071] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.ppt") returned 0
	[0133.071] lstrlenA (lpString="*.ppt") returned 5
	[0133.071] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.pptx") returned 0
	[0133.071] lstrlenA (lpString="*.pptx") returned 6
	[0133.071] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.txt") returned 0
	[0133.071] lstrlenA (lpString="*.txt") returned 5
	[0133.071] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.pdf") returned 0
	[0133.071] lstrlenA (lpString="*.pdf") returned 5
	[0133.071] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.htm") returned 0
	[0133.071] lstrlenA (lpString="*.htm") returned 5
	[0133.071] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.html") returned 0
	[0133.071] lstrlenA (lpString="*.html") returned 6
	[0133.071] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.mdb") returned 0
	[0133.071] lstrlenA (lpString="*.mdb") returned 5
	[0133.071] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.pfx") returned 0
	[0133.071] lstrlenA (lpString="*.pfx") returned 5
	[0133.071] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.md") returned 0
	[0133.071] lstrlenA (lpString="*.md") returned 4
	[0133.071] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.lnk") returned 0
	[0133.071] lstrlenA (lpString="*.lnk") returned 5
	[0133.071] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.torrent") returned 0
	[0133.071] lstrlenA (lpString="*.torrent") returned 9
	[0133.071] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.mov") returned 0
	[0133.071] lstrlenA (lpString="*.mov") returned 5
	[0133.071] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.3gp") returned 0
	[0133.071] lstrlenA (lpString="*.3gp") returned 5
	[0133.072] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.mpeg") returned 0
	[0133.072] lstrlenA (lpString="*.mpeg") returned 6
	[0133.072] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.mpg") returned 0
	[0133.072] lstrlenA (lpString="*.mpg") returned 5
	[0133.072] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.flv") returned 0
	[0133.072] lstrlenA (lpString="*.flv") returned 5
	[0133.072] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.avi") returned 0
	[0133.072] lstrlenA (lpString="*.avi") returned 5
	[0133.072] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.mp4") returned 0
	[0133.072] lstrlenA (lpString="*.mp4") returned 5
	[0133.072] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.wmv") returned 0
	[0133.072] lstrlenA (lpString="*.wmv") returned 5
	[0133.072] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.mkv") returned 0
	[0133.072] lstrlenA (lpString="*.mkv") returned 5
	[0133.072] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.mp3") returned 0
	[0133.072] lstrlenA (lpString="*.mp3") returned 5
	[0133.072] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.wav") returned 0
	[0133.072] lstrlenA (lpString="*.wav") returned 5
	[0133.072] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.flac") returned 0
	[0133.072] lstrlenA (lpString="*.flac") returned 6
	[0133.072] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.wma") returned 0
	[0133.072] lstrlenA (lpString="*.wma") returned 5
	[0133.072] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.au3") returned 0
	[0133.072] lstrlenA (lpString="*.au3") returned 5
	[0133.072] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.ahk") returned 0
	[0133.072] lstrlenA (lpString="*.ahk") returned 5
	[0133.072] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.c") returned 0
	[0133.072] lstrlenA (lpString="*.c") returned 3
	[0133.072] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.cc") returned 0
	[0133.072] lstrlenA (lpString="*.cc") returned 4
	[0133.072] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.cpp") returned 0
	[0133.072] lstrlenA (lpString="*.cpp") returned 5
	[0133.072] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.cxx") returned 0
	[0133.072] lstrlenA (lpString="*.cxx") returned 5
	[0133.072] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.c++") returned 0
	[0133.072] lstrlenA (lpString="*.c++") returned 5
	[0133.072] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.cs") returned 0
	[0133.072] lstrlenA (lpString="*.cs") returned 4
	[0133.072] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.vb") returned 0
	[0133.072] lstrlenA (lpString="*.vb") returned 4
	[0133.072] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.bas") returned 0
	[0133.072] lstrlenA (lpString="*.bas") returned 5
	[0133.073] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.csproj") returned 0
	[0133.073] lstrlenA (lpString="*.csproj") returned 8
	[0133.073] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.vbproj") returned 0
	[0133.073] lstrlenA (lpString="*.vbproj") returned 8
	[0133.073] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.vcxproj") returned 0
	[0133.073] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.073] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.manifest") returned 0
	[0133.073] lstrlenA (lpString="*.manifest") returned 10
	[0133.073] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.php") returned 0
	[0133.073] lstrlenA (lpString="*.php") returned 5
	[0133.073] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.vbe") returned 0
	[0133.073] lstrlenA (lpString="*.vbe") returned 5
	[0133.073] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.vba") returned 0
	[0133.073] lstrlenA (lpString="*.vba") returned 5
	[0133.073] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.vbs") returned 0
	[0133.073] lstrlenA (lpString="*.vbs") returned 5
	[0133.073] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.bat") returned 0
	[0133.073] lstrlenA (lpString="*.bat") returned 5
	[0133.073] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.cmd") returned 0
	[0133.073] lstrlenA (lpString="*.cmd") returned 5
	[0133.073] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.js") returned 0
	[0133.073] lstrlenA (lpString="*.js") returned 4
	[0133.073] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.jscript") returned 0
	[0133.073] lstrlenA (lpString="*.jscript") returned 9
	[0133.073] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.hta") returned 0
	[0133.073] lstrlenA (lpString="*.hta") returned 5
	[0133.073] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.php7") returned 0
	[0133.073] lstrlenA (lpString="*.php7") returned 6
	[0133.073] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.db") returned 0
	[0133.073] lstrlenA (lpString="*.db") returned 4
	[0133.073] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.swf") returned 0
	[0133.073] lstrlenA (lpString="*.swf") returned 5
	[0133.073] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.eml") returned 0
	[0133.073] lstrlenA (lpString="*.eml") returned 5
	[0133.073] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.part") returned 0
	[0133.073] lstrlenA (lpString="*.part") returned 6
	[0133.073] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.nfo") returned 0
	[0133.073] lstrlenA (lpString="*.nfo") returned 5
	[0133.073] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.rsa") returned 0
	[0133.073] lstrlenA (lpString="*.rsa") returned 5
	[0133.073] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.key") returned 0
	[0133.073] lstrlenA (lpString="*.key") returned 5
	[0133.073] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.aes") returned 0
	[0133.074] lstrlenA (lpString="*.aes") returned 5
	[0133.074] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.blob") returned 0
	[0133.074] lstrlenA (lpString="*.blob") returned 6
	[0133.074] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.btc") returned 0
	[0133.074] lstrlenA (lpString="*.btc") returned 5
	[0133.074] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", pszSpec="*.wallet") returned 0
	[0133.074] lstrlenA (lpString="*.wallet") returned 8
	[0133.074] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x48005c, dwReserved1=0x57004f, cFileName="File Explorer.lnk", cAlternateFileName="FILEEX~1.LNK")) returned 1
	[0133.074] PeekMessageA (in: lpMsg=0x19f23c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f23c) returned 0
	[0133.074] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="File Explorer.lnk") returned -1
	[0133.074] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="File Explorer.lnk") returned 1
	[0133.074] lstrcmpiA (lpString1="", lpString2="File Explorer.lnk") returned -1
	[0133.074] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini") returned="Desktop.ini"
	[0133.074] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\"
	[0133.074] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\") returned=""
	[0133.074] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.074] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\how-to-decrypt-files.htm")) returned 0x20
	[0133.074] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\", lpString2="File Explorer.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk"
	[0133.074] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk", pszSpec="*.zip") returned 0
	[0133.074] lstrlenA (lpString="*.zip") returned 5
	[0133.074] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk", pszSpec="*.rar") returned 0
	[0133.074] lstrlenA (lpString="*.rar") returned 5
	[0133.074] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk", pszSpec="*.7z") returned 0
	[0133.074] lstrlenA (lpString="*.7z") returned 4
	[0133.074] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk", pszSpec="*.tar") returned 0
	[0133.074] lstrlenA (lpString="*.tar") returned 5
	[0133.074] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk", pszSpec="*.gzip") returned 0
	[0133.074] lstrlenA (lpString="*.gzip") returned 6
	[0133.074] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk", pszSpec="*.jpg") returned 0
	[0133.074] lstrlenA (lpString="*.jpg") returned 5
	[0133.074] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk", pszSpec="*.jpeg") returned 0
	[0133.074] lstrlenA (lpString="*.jpeg") returned 6
	[0133.074] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk", pszSpec="*.bmp") returned 0
	[0133.074] lstrlenA (lpString="*.bmp") returned 5
	[0133.074] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk", pszSpec="*.gif") returned 0
	[0133.074] lstrlenA (lpString="*.gif") returned 5
	[0133.074] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk", pszSpec="*.png") returned 0
	[0133.074] lstrlenA (lpString="*.png") returned 5
	[0133.074] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk", pszSpec="*.doc") returned 0
	[0133.075] lstrlenA (lpString="*.doc") returned 5
	[0133.075] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk", pszSpec="*.docx") returned 0
	[0133.075] lstrlenA (lpString="*.docx") returned 6
	[0133.075] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk", pszSpec="*.xls") returned 0
	[0133.075] lstrlenA (lpString="*.xls") returned 5
	[0133.075] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk", pszSpec="*.xlsx") returned 0
	[0133.075] lstrlenA (lpString="*.xlsx") returned 6
	[0133.075] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk", pszSpec="*.ppt") returned 0
	[0133.075] lstrlenA (lpString="*.ppt") returned 5
	[0133.075] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk", pszSpec="*.pptx") returned 0
	[0133.075] lstrlenA (lpString="*.pptx") returned 6
	[0133.075] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk", pszSpec="*.txt") returned 0
	[0133.075] lstrlenA (lpString="*.txt") returned 5
	[0133.075] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk", pszSpec="*.pdf") returned 0
	[0133.075] lstrlenA (lpString="*.pdf") returned 5
	[0133.075] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk", pszSpec="*.htm") returned 0
	[0133.075] lstrlenA (lpString="*.htm") returned 5
	[0133.075] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk", pszSpec="*.html") returned 0
	[0133.075] lstrlenA (lpString="*.html") returned 6
	[0133.075] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk", pszSpec="*.mdb") returned 0
	[0133.075] lstrlenA (lpString="*.mdb") returned 5
	[0133.075] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk", pszSpec="*.pfx") returned 0
	[0133.075] lstrlenA (lpString="*.pfx") returned 5
	[0133.075] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk", pszSpec="*.md") returned 0
	[0133.075] lstrlenA (lpString="*.md") returned 4
	[0133.075] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk", pszSpec="*.lnk") returned 1
	[0133.075] lstrlenA (lpString="*.lnk") returned 5
	[0133.075] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk"
	[0133.075] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk"
	[0133.075] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk."
	[0133.075] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk.exe"
	[0133.075] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224
	[0133.076] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x197
	[0133.076] GetFileTime (in: hFile=0x224, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x210d33f6, dwHighDateTime=0x1d32742), lpLastAccessTime=0x407536*(dwLowDateTime=0x210d33f6, dwHighDateTime=0x1d32742), lpLastWriteTime=0x40753e*(dwLowDateTime=0x61db3fcd, dwHighDateTime=0x1d2a02a)) returned 1
	[0133.076] SetFilePointer (in: hFile=0x224, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.076] ReadFile (in: hFile=0x224, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x155, lpOverlapped=0x0) returned 1
	[0133.076] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk") returned="File Explorer.lnk"
	[0133.076] SetFilePointer (in: hFile=0x224, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.076] WriteFile (in: hFile=0x224, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x155, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x155, lpOverlapped=0x0) returned 1
	[0133.077] SetFileTime (hFile=0x224, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.077] CloseHandle (hObject=0x224) returned 1
	[0133.077] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk.exe")) returned 1
	[0133.077] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x199, dwReserved0=0x0, dwReserved1=0x0, cFileName="Run.lnk", cAlternateFileName="")) returned 1
	[0133.077] PeekMessageA (in: lpMsg=0x19f23c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f23c) returned 0
	[0133.077] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Run.lnk") returned -1
	[0133.077] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Run.lnk") returned -1
	[0133.077] lstrcmpiA (lpString1="", lpString2="Run.lnk") returned -1
	[0133.077] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk") returned="File Explorer.lnk"
	[0133.077] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\"
	[0133.078] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\") returned=""
	[0133.078] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.078] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\how-to-decrypt-files.htm")) returned 0x20
	[0133.078] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\", lpString2="Run.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk"
	[0133.078] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk", pszSpec="*.zip") returned 0
	[0133.078] lstrlenA (lpString="*.zip") returned 5
	[0133.078] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk", pszSpec="*.rar") returned 0
	[0133.078] lstrlenA (lpString="*.rar") returned 5
	[0133.078] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk", pszSpec="*.7z") returned 0
	[0133.078] lstrlenA (lpString="*.7z") returned 4
	[0133.078] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk", pszSpec="*.tar") returned 0
	[0133.078] lstrlenA (lpString="*.tar") returned 5
	[0133.078] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk", pszSpec="*.gzip") returned 0
	[0133.078] lstrlenA (lpString="*.gzip") returned 6
	[0133.078] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk", pszSpec="*.jpg") returned 0
	[0133.078] lstrlenA (lpString="*.jpg") returned 5
	[0133.078] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk", pszSpec="*.jpeg") returned 0
	[0133.078] lstrlenA (lpString="*.jpeg") returned 6
	[0133.078] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk", pszSpec="*.bmp") returned 0
	[0133.078] lstrlenA (lpString="*.bmp") returned 5
	[0133.078] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk", pszSpec="*.gif") returned 0
	[0133.078] lstrlenA (lpString="*.gif") returned 5
	[0133.078] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk", pszSpec="*.png") returned 0
	[0133.078] lstrlenA (lpString="*.png") returned 5
	[0133.078] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk", pszSpec="*.doc") returned 0
	[0133.078] lstrlenA (lpString="*.doc") returned 5
	[0133.078] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk", pszSpec="*.docx") returned 0
	[0133.078] lstrlenA (lpString="*.docx") returned 6
	[0133.078] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk", pszSpec="*.xls") returned 0
	[0133.078] lstrlenA (lpString="*.xls") returned 5
	[0133.078] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk", pszSpec="*.xlsx") returned 0
	[0133.078] lstrlenA (lpString="*.xlsx") returned 6
	[0133.078] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk", pszSpec="*.ppt") returned 0
	[0133.078] lstrlenA (lpString="*.ppt") returned 5
	[0133.078] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk", pszSpec="*.pptx") returned 0
	[0133.078] lstrlenA (lpString="*.pptx") returned 6
	[0133.078] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk", pszSpec="*.txt") returned 0
	[0133.078] lstrlenA (lpString="*.txt") returned 5
	[0133.078] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk", pszSpec="*.pdf") returned 0
	[0133.078] lstrlenA (lpString="*.pdf") returned 5
	[0133.079] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk", pszSpec="*.htm") returned 0
	[0133.079] lstrlenA (lpString="*.htm") returned 5
	[0133.079] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk", pszSpec="*.html") returned 0
	[0133.079] lstrlenA (lpString="*.html") returned 6
	[0133.079] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk", pszSpec="*.mdb") returned 0
	[0133.079] lstrlenA (lpString="*.mdb") returned 5
	[0133.079] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk", pszSpec="*.pfx") returned 0
	[0133.079] lstrlenA (lpString="*.pfx") returned 5
	[0133.079] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk", pszSpec="*.md") returned 0
	[0133.079] lstrlenA (lpString="*.md") returned 4
	[0133.079] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk", pszSpec="*.lnk") returned 1
	[0133.079] lstrlenA (lpString="*.lnk") returned 5
	[0133.079] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk"
	[0133.079] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk"
	[0133.079] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk."
	[0133.079] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk.exe"
	[0133.079] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224
	[0133.079] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x199
	[0133.079] GetFileTime (in: hFile=0x224, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x210d33f6, dwHighDateTime=0x1d32742), lpLastAccessTime=0x407536*(dwLowDateTime=0x210d33f6, dwHighDateTime=0x1d32742), lpLastWriteTime=0x40753e*(dwLowDateTime=0x61db3fcd, dwHighDateTime=0x1d2a02a)) returned 1
	[0133.079] SetFilePointer (in: hFile=0x224, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.079] ReadFile (in: hFile=0x224, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x157, lpOverlapped=0x0) returned 1
	[0133.080] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk") returned="Run.lnk"
	[0133.080] SetFilePointer (in: hFile=0x224, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.080] WriteFile (in: hFile=0x224, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x157, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x157, lpOverlapped=0x0) returned 1
	[0133.080] SetFileTime (hFile=0x224, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.080] CloseHandle (hObject=0x224) returned 1
	[0133.081] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk.exe")) returned 1
	[0133.081] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x199, dwReserved0=0x0, dwReserved1=0x0, cFileName="Run.lnk", cAlternateFileName="")) returned 0
	[0133.081] FindClose (in: hFindFile=0x7cbb90 | out: hFindFile=0x7cbb90) returned 1
	[0133.081] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc861bda7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc861bda7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc8667e79, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x20, dwReserved1=0x0, cFileName="Update and Privacy Settings.lnk", cAlternateFileName="UPDATE~1.LNK")) returned 1
	[0133.081] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0133.081] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Update and Privacy Settings.lnk") returned -1
	[0133.081] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Update and Privacy Settings.lnk") returned -1
	[0133.081] lstrcmpiA (lpString1="", lpString2="Update and Privacy Settings.lnk") returned -1
	[0133.081] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*.*") returned="*.*"
	[0133.081] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\"
	[0133.081] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\") returned=""
	[0133.081] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.081] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\how-to-decrypt-files.htm")) returned 0x20
	[0133.082] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpString2="Update and Privacy Settings.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk"
	[0133.082] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk", pszSpec="*.zip") returned 0
	[0133.082] lstrlenA (lpString="*.zip") returned 5
	[0133.082] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk", pszSpec="*.rar") returned 0
	[0133.082] lstrlenA (lpString="*.rar") returned 5
	[0133.082] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk", pszSpec="*.7z") returned 0
	[0133.082] lstrlenA (lpString="*.7z") returned 4
	[0133.082] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk", pszSpec="*.tar") returned 0
	[0133.082] lstrlenA (lpString="*.tar") returned 5
	[0133.082] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk", pszSpec="*.gzip") returned 0
	[0133.082] lstrlenA (lpString="*.gzip") returned 6
	[0133.082] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk", pszSpec="*.jpg") returned 0
	[0133.082] lstrlenA (lpString="*.jpg") returned 5
	[0133.082] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk", pszSpec="*.jpeg") returned 0
	[0133.082] lstrlenA (lpString="*.jpeg") returned 6
	[0133.082] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk", pszSpec="*.bmp") returned 0
	[0133.082] lstrlenA (lpString="*.bmp") returned 5
	[0133.082] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk", pszSpec="*.gif") returned 0
	[0133.082] lstrlenA (lpString="*.gif") returned 5
	[0133.082] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk", pszSpec="*.png") returned 0
	[0133.082] lstrlenA (lpString="*.png") returned 5
	[0133.082] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk", pszSpec="*.doc") returned 0
	[0133.082] lstrlenA (lpString="*.doc") returned 5
	[0133.082] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk", pszSpec="*.docx") returned 0
	[0133.082] lstrlenA (lpString="*.docx") returned 6
	[0133.082] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk", pszSpec="*.xls") returned 0
	[0133.082] lstrlenA (lpString="*.xls") returned 5
	[0133.082] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk", pszSpec="*.xlsx") returned 0
	[0133.082] lstrlenA (lpString="*.xlsx") returned 6
	[0133.082] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk", pszSpec="*.ppt") returned 0
	[0133.082] lstrlenA (lpString="*.ppt") returned 5
	[0133.082] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk", pszSpec="*.pptx") returned 0
	[0133.082] lstrlenA (lpString="*.pptx") returned 6
	[0133.082] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk", pszSpec="*.txt") returned 0
	[0133.082] lstrlenA (lpString="*.txt") returned 5
	[0133.082] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk", pszSpec="*.pdf") returned 0
	[0133.082] lstrlenA (lpString="*.pdf") returned 5
	[0133.082] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk", pszSpec="*.htm") returned 0
	[0133.082] lstrlenA (lpString="*.htm") returned 5
	[0133.082] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk", pszSpec="*.html") returned 0
	[0133.083] lstrlenA (lpString="*.html") returned 6
	[0133.083] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk", pszSpec="*.mdb") returned 0
	[0133.083] lstrlenA (lpString="*.mdb") returned 5
	[0133.083] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk", pszSpec="*.pfx") returned 0
	[0133.083] lstrlenA (lpString="*.pfx") returned 5
	[0133.083] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk", pszSpec="*.md") returned 0
	[0133.083] lstrlenA (lpString="*.md") returned 4
	[0133.083] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk", pszSpec="*.lnk") returned 1
	[0133.083] lstrlenA (lpString="*.lnk") returned 5
	[0133.083] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk"
	[0133.083] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk"
	[0133.083] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk."
	[0133.083] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk.exe"
	[0133.083] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\update and privacy settings.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0133.083] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x588
	[0133.083] GetFileTime (in: hFile=0x220, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc861bda7, dwHighDateTime=0x1d32743), lpLastAccessTime=0x407536*(dwLowDateTime=0xc861bda7, dwHighDateTime=0x1d32743), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc8667e79, dwHighDateTime=0x1d32743)) returned 1
	[0133.083] SetFilePointer (in: hFile=0x220, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.083] ReadFile (in: hFile=0x220, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x546, lpOverlapped=0x0) returned 1
	[0133.124] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk") returned="Update and Privacy Settings.lnk"
	[0133.124] SetFilePointer (in: hFile=0x220, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.124] WriteFile (in: hFile=0x220, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x546, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x546, lpOverlapped=0x0) returned 1
	[0133.124] SetFileTime (hFile=0x220, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.125] CloseHandle (hObject=0x220) returned 1
	[0133.125] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\update and privacy settings.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\update and privacy settings.lnk.exe")) returned 1
	[0133.126] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f428c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell", cAlternateFileName="WINDOW~1")) returned 1
	[0133.126] lstrcmpA (lpString1=".", lpString2="Windows PowerShell") returned -1
	[0133.126] lstrcmpA (lpString1="..", lpString2="Windows PowerShell") returned -1
	[0133.126] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk") returned="Update and Privacy Settings.lnk"
	[0133.126] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpString2="Windows PowerShell" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell"
	[0133.127] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell") returned 88
	[0133.127] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\*.*", lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f428c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName=".", cAlternateFileName="")) returned 0x7cb650
	[0133.127] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.127] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f428c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="..", cAlternateFileName="")) returned 1
	[0133.127] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.127] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.127] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc8e8141c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0133.127] PeekMessageA (in: lpMsg=0x19f23c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f23c) returned 0
	[0133.127] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="desktop.ini") returned 1
	[0133.127] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="desktop.ini") returned 1
	[0133.127] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1
	[0133.127] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\*.*") returned="*.*"
	[0133.127] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\"
	[0133.127] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\") returned=""
	[0133.127] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.127] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0133.127] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224
	[0133.129] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0133.129] WriteFile (in: hFile=0x224, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0133.129] SetFileTime (hFile=0x224, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0133.130] CloseHandle (hObject=0x224) returned 1
	[0133.130] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini"
	[0133.130] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.zip") returned 0
	[0133.130] lstrlenA (lpString="*.zip") returned 5
	[0133.130] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.rar") returned 0
	[0133.130] lstrlenA (lpString="*.rar") returned 5
	[0133.130] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.7z") returned 0
	[0133.130] lstrlenA (lpString="*.7z") returned 4
	[0133.130] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.tar") returned 0
	[0133.130] lstrlenA (lpString="*.tar") returned 5
	[0133.130] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.gzip") returned 0
	[0133.130] lstrlenA (lpString="*.gzip") returned 6
	[0133.130] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.jpg") returned 0
	[0133.130] lstrlenA (lpString="*.jpg") returned 5
	[0133.130] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.jpeg") returned 0
	[0133.130] lstrlenA (lpString="*.jpeg") returned 6
	[0133.130] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.bmp") returned 0
	[0133.130] lstrlenA (lpString="*.bmp") returned 5
	[0133.130] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.gif") returned 0
	[0133.130] lstrlenA (lpString="*.gif") returned 5
	[0133.130] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.png") returned 0
	[0133.130] lstrlenA (lpString="*.png") returned 5
	[0133.130] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.doc") returned 0
	[0133.130] lstrlenA (lpString="*.doc") returned 5
	[0133.130] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.docx") returned 0
	[0133.130] lstrlenA (lpString="*.docx") returned 6
	[0133.130] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.xls") returned 0
	[0133.131] lstrlenA (lpString="*.xls") returned 5
	[0133.131] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.xlsx") returned 0
	[0133.131] lstrlenA (lpString="*.xlsx") returned 6
	[0133.131] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.ppt") returned 0
	[0133.131] lstrlenA (lpString="*.ppt") returned 5
	[0133.131] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.pptx") returned 0
	[0133.131] lstrlenA (lpString="*.pptx") returned 6
	[0133.131] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.txt") returned 0
	[0133.131] lstrlenA (lpString="*.txt") returned 5
	[0133.131] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.pdf") returned 0
	[0133.131] lstrlenA (lpString="*.pdf") returned 5
	[0133.131] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.htm") returned 0
	[0133.131] lstrlenA (lpString="*.htm") returned 5
	[0133.131] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.html") returned 0
	[0133.131] lstrlenA (lpString="*.html") returned 6
	[0133.131] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.mdb") returned 0
	[0133.131] lstrlenA (lpString="*.mdb") returned 5
	[0133.131] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.pfx") returned 0
	[0133.131] lstrlenA (lpString="*.pfx") returned 5
	[0133.131] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.md") returned 0
	[0133.131] lstrlenA (lpString="*.md") returned 4
	[0133.131] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.lnk") returned 0
	[0133.131] lstrlenA (lpString="*.lnk") returned 5
	[0133.131] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.torrent") returned 0
	[0133.131] lstrlenA (lpString="*.torrent") returned 9
	[0133.131] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.mov") returned 0
	[0133.131] lstrlenA (lpString="*.mov") returned 5
	[0133.131] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.3gp") returned 0
	[0133.131] lstrlenA (lpString="*.3gp") returned 5
	[0133.131] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.mpeg") returned 0
	[0133.131] lstrlenA (lpString="*.mpeg") returned 6
	[0133.131] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.mpg") returned 0
	[0133.131] lstrlenA (lpString="*.mpg") returned 5
	[0133.131] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.flv") returned 0
	[0133.132] lstrlenA (lpString="*.flv") returned 5
	[0133.132] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.avi") returned 0
	[0133.132] lstrlenA (lpString="*.avi") returned 5
	[0133.132] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.mp4") returned 0
	[0133.132] lstrlenA (lpString="*.mp4") returned 5
	[0133.132] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.wmv") returned 0
	[0133.132] lstrlenA (lpString="*.wmv") returned 5
	[0133.132] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.mkv") returned 0
	[0133.132] lstrlenA (lpString="*.mkv") returned 5
	[0133.132] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.mp3") returned 0
	[0133.132] lstrlenA (lpString="*.mp3") returned 5
	[0133.132] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.wav") returned 0
	[0133.132] lstrlenA (lpString="*.wav") returned 5
	[0133.132] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.flac") returned 0
	[0133.132] lstrlenA (lpString="*.flac") returned 6
	[0133.132] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.wma") returned 0
	[0133.132] lstrlenA (lpString="*.wma") returned 5
	[0133.132] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.au3") returned 0
	[0133.132] lstrlenA (lpString="*.au3") returned 5
	[0133.132] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.ahk") returned 0
	[0133.132] lstrlenA (lpString="*.ahk") returned 5
	[0133.132] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.c") returned 0
	[0133.132] lstrlenA (lpString="*.c") returned 3
	[0133.132] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.cc") returned 0
	[0133.132] lstrlenA (lpString="*.cc") returned 4
	[0133.132] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.cpp") returned 0
	[0133.132] lstrlenA (lpString="*.cpp") returned 5
	[0133.132] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.cxx") returned 0
	[0133.132] lstrlenA (lpString="*.cxx") returned 5
	[0133.132] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.c++") returned 0
	[0133.132] lstrlenA (lpString="*.c++") returned 5
	[0133.133] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.cs") returned 0
	[0133.133] lstrlenA (lpString="*.cs") returned 4
	[0133.133] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.vb") returned 0
	[0133.133] lstrlenA (lpString="*.vb") returned 4
	[0133.133] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.bas") returned 0
	[0133.133] lstrlenA (lpString="*.bas") returned 5
	[0133.133] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.csproj") returned 0
	[0133.133] lstrlenA (lpString="*.csproj") returned 8
	[0133.133] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.vbproj") returned 0
	[0133.133] lstrlenA (lpString="*.vbproj") returned 8
	[0133.133] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.vcxproj") returned 0
	[0133.133] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.133] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.manifest") returned 0
	[0133.133] lstrlenA (lpString="*.manifest") returned 10
	[0133.133] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.php") returned 0
	[0133.133] lstrlenA (lpString="*.php") returned 5
	[0133.133] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.vbe") returned 0
	[0133.133] lstrlenA (lpString="*.vbe") returned 5
	[0133.133] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.vba") returned 0
	[0133.133] lstrlenA (lpString="*.vba") returned 5
	[0133.133] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.vbs") returned 0
	[0133.133] lstrlenA (lpString="*.vbs") returned 5
	[0133.133] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.bat") returned 0
	[0133.133] lstrlenA (lpString="*.bat") returned 5
	[0133.133] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.cmd") returned 0
	[0133.133] lstrlenA (lpString="*.cmd") returned 5
	[0133.133] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.js") returned 0
	[0133.133] lstrlenA (lpString="*.js") returned 4
	[0133.133] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.jscript") returned 0
	[0133.133] lstrlenA (lpString="*.jscript") returned 9
	[0133.133] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.hta") returned 0
	[0133.133] lstrlenA (lpString="*.hta") returned 5
	[0133.133] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.php7") returned 0
	[0133.133] lstrlenA (lpString="*.php7") returned 6
	[0133.133] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.db") returned 0
	[0133.134] lstrlenA (lpString="*.db") returned 4
	[0133.134] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.swf") returned 0
	[0133.134] lstrlenA (lpString="*.swf") returned 5
	[0133.134] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.eml") returned 0
	[0133.134] lstrlenA (lpString="*.eml") returned 5
	[0133.134] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.part") returned 0
	[0133.134] lstrlenA (lpString="*.part") returned 6
	[0133.134] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.nfo") returned 0
	[0133.134] lstrlenA (lpString="*.nfo") returned 5
	[0133.134] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.rsa") returned 0
	[0133.134] lstrlenA (lpString="*.rsa") returned 5
	[0133.134] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.key") returned 0
	[0133.134] lstrlenA (lpString="*.key") returned 5
	[0133.134] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.aes") returned 0
	[0133.134] lstrlenA (lpString="*.aes") returned 5
	[0133.134] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.blob") returned 0
	[0133.134] lstrlenA (lpString="*.blob") returned 6
	[0133.134] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.btc") returned 0
	[0133.134] lstrlenA (lpString="*.btc") returned 5
	[0133.134] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", pszSpec="*.wallet") returned 0
	[0133.134] lstrlenA (lpString="*.wallet") returned 8
	[0133.134] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210ad1cc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell (x86).lnk", cAlternateFileName="WINDOW~4.LNK")) returned 1
	[0133.134] PeekMessageA (in: lpMsg=0x19f23c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f23c) returned 0
	[0133.134] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Windows PowerShell (x86).lnk") returned -1
	[0133.134] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Windows PowerShell (x86).lnk") returned -1
	[0133.134] lstrcmpiA (lpString1="", lpString2="Windows PowerShell (x86).lnk") returned -1
	[0133.134] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini") returned="desktop.ini"
	[0133.134] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\"
	[0133.134] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\") returned=""
	[0133.134] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.134] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\how-to-decrypt-files.htm")) returned 0x20
	[0133.135] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\", lpString2="Windows PowerShell (x86).lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk"
	[0133.135] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk", pszSpec="*.zip") returned 0
	[0133.135] lstrlenA (lpString="*.zip") returned 5
	[0133.135] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk", pszSpec="*.rar") returned 0
	[0133.135] lstrlenA (lpString="*.rar") returned 5
	[0133.135] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk", pszSpec="*.7z") returned 0
	[0133.135] lstrlenA (lpString="*.7z") returned 4
	[0133.135] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk", pszSpec="*.tar") returned 0
	[0133.135] lstrlenA (lpString="*.tar") returned 5
	[0133.135] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk", pszSpec="*.gzip") returned 0
	[0133.135] lstrlenA (lpString="*.gzip") returned 6
	[0133.135] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk", pszSpec="*.jpg") returned 0
	[0133.135] lstrlenA (lpString="*.jpg") returned 5
	[0133.135] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk", pszSpec="*.jpeg") returned 0
	[0133.135] lstrlenA (lpString="*.jpeg") returned 6
	[0133.135] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk", pszSpec="*.bmp") returned 0
	[0133.135] lstrlenA (lpString="*.bmp") returned 5
	[0133.135] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk", pszSpec="*.gif") returned 0
	[0133.135] lstrlenA (lpString="*.gif") returned 5
	[0133.135] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk", pszSpec="*.png") returned 0
	[0133.135] lstrlenA (lpString="*.png") returned 5
	[0133.135] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk", pszSpec="*.doc") returned 0
	[0133.135] lstrlenA (lpString="*.doc") returned 5
	[0133.135] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk", pszSpec="*.docx") returned 0
	[0133.135] lstrlenA (lpString="*.docx") returned 6
	[0133.135] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk", pszSpec="*.xls") returned 0
	[0133.135] lstrlenA (lpString="*.xls") returned 5
	[0133.135] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk", pszSpec="*.xlsx") returned 0
	[0133.135] lstrlenA (lpString="*.xlsx") returned 6
	[0133.135] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk", pszSpec="*.ppt") returned 0
	[0133.135] lstrlenA (lpString="*.ppt") returned 5
	[0133.135] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk", pszSpec="*.pptx") returned 0
	[0133.136] lstrlenA (lpString="*.pptx") returned 6
	[0133.136] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk", pszSpec="*.txt") returned 0
	[0133.136] lstrlenA (lpString="*.txt") returned 5
	[0133.136] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk", pszSpec="*.pdf") returned 0
	[0133.136] lstrlenA (lpString="*.pdf") returned 5
	[0133.136] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk", pszSpec="*.htm") returned 0
	[0133.136] lstrlenA (lpString="*.htm") returned 5
	[0133.136] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk", pszSpec="*.html") returned 0
	[0133.136] lstrlenA (lpString="*.html") returned 6
	[0133.136] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk", pszSpec="*.mdb") returned 0
	[0133.136] lstrlenA (lpString="*.mdb") returned 5
	[0133.136] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk", pszSpec="*.pfx") returned 0
	[0133.136] lstrlenA (lpString="*.pfx") returned 5
	[0133.136] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk", pszSpec="*.md") returned 0
	[0133.136] lstrlenA (lpString="*.md") returned 4
	[0133.136] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk", pszSpec="*.lnk") returned 1
	[0133.136] lstrlenA (lpString="*.lnk") returned 5
	[0133.136] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk"
	[0133.136] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk"
	[0133.136] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk."
	[0133.136] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk.exe"
	[0133.136] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224
	[0133.137] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8bc
	[0133.137] GetFileTime (in: hFile=0x224, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x210ad1cc, dwHighDateTime=0x1d32742), lpLastAccessTime=0x407536*(dwLowDateTime=0x210ad1cc, dwHighDateTime=0x1d32742), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc5fb62ca, dwHighDateTime=0x1d2a02a)) returned 1
	[0133.137] SetFilePointer (in: hFile=0x224, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.137] ReadFile (in: hFile=0x224, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x87a, lpOverlapped=0x0) returned 1
	[0133.139] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk") returned="Windows PowerShell (x86).lnk"
	[0133.139] SetFilePointer (in: hFile=0x224, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.139] WriteFile (in: hFile=0x224, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x87a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x87a, lpOverlapped=0x0) returned 1
	[0133.139] SetFileTime (hFile=0x224, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.139] CloseHandle (hObject=0x224) returned 1
	[0133.139] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk.exe")) returned 1
	[0133.140] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210ad1cc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x96df2ecc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell ISE (x86).lnk", cAlternateFileName="WINDOW~3.LNK")) returned 1
	[0133.140] PeekMessageA (in: lpMsg=0x19f23c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f23c) returned 0
	[0133.140] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Windows PowerShell ISE (x86).lnk") returned -1
	[0133.140] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Windows PowerShell ISE (x86).lnk") returned -1
	[0133.140] lstrcmpiA (lpString1="", lpString2="Windows PowerShell ISE (x86).lnk") returned -1
	[0133.140] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk") returned="Windows PowerShell (x86).lnk"
	[0133.140] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\"
	[0133.140] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\") returned=""
	[0133.141] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.141] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\how-to-decrypt-files.htm")) returned 0x20
	[0133.141] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\", lpString2="Windows PowerShell ISE (x86).lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk"
	[0133.141] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk", pszSpec="*.zip") returned 0
	[0133.141] lstrlenA (lpString="*.zip") returned 5
	[0133.141] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk", pszSpec="*.rar") returned 0
	[0133.141] lstrlenA (lpString="*.rar") returned 5
	[0133.141] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk", pszSpec="*.7z") returned 0
	[0133.141] lstrlenA (lpString="*.7z") returned 4
	[0133.141] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk", pszSpec="*.tar") returned 0
	[0133.141] lstrlenA (lpString="*.tar") returned 5
	[0133.141] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk", pszSpec="*.gzip") returned 0
	[0133.141] lstrlenA (lpString="*.gzip") returned 6
	[0133.141] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk", pszSpec="*.jpg") returned 0
	[0133.141] lstrlenA (lpString="*.jpg") returned 5
	[0133.141] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk", pszSpec="*.jpeg") returned 0
	[0133.141] lstrlenA (lpString="*.jpeg") returned 6
	[0133.141] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk", pszSpec="*.bmp") returned 0
	[0133.141] lstrlenA (lpString="*.bmp") returned 5
	[0133.141] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk", pszSpec="*.gif") returned 0
	[0133.141] lstrlenA (lpString="*.gif") returned 5
	[0133.141] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk", pszSpec="*.png") returned 0
	[0133.141] lstrlenA (lpString="*.png") returned 5
	[0133.141] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk", pszSpec="*.doc") returned 0
	[0133.141] lstrlenA (lpString="*.doc") returned 5
	[0133.141] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk", pszSpec="*.docx") returned 0
	[0133.141] lstrlenA (lpString="*.docx") returned 6
	[0133.141] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk", pszSpec="*.xls") returned 0
	[0133.141] lstrlenA (lpString="*.xls") returned 5
	[0133.141] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk", pszSpec="*.xlsx") returned 0
	[0133.141] lstrlenA (lpString="*.xlsx") returned 6
	[0133.142] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk", pszSpec="*.ppt") returned 0
	[0133.142] lstrlenA (lpString="*.ppt") returned 5
	[0133.142] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk", pszSpec="*.pptx") returned 0
	[0133.142] lstrlenA (lpString="*.pptx") returned 6
	[0133.142] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk", pszSpec="*.txt") returned 0
	[0133.142] lstrlenA (lpString="*.txt") returned 5
	[0133.142] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk", pszSpec="*.pdf") returned 0
	[0133.142] lstrlenA (lpString="*.pdf") returned 5
	[0133.142] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk", pszSpec="*.htm") returned 0
	[0133.142] lstrlenA (lpString="*.htm") returned 5
	[0133.142] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk", pszSpec="*.html") returned 0
	[0133.142] lstrlenA (lpString="*.html") returned 6
	[0133.142] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk", pszSpec="*.mdb") returned 0
	[0133.142] lstrlenA (lpString="*.mdb") returned 5
	[0133.142] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk", pszSpec="*.pfx") returned 0
	[0133.142] lstrlenA (lpString="*.pfx") returned 5
	[0133.142] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk", pszSpec="*.md") returned 0
	[0133.142] lstrlenA (lpString="*.md") returned 4
	[0133.142] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk", pszSpec="*.lnk") returned 1
	[0133.142] lstrlenA (lpString="*.lnk") returned 5
	[0133.142] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk"
	[0133.142] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk"
	[0133.142] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk."
	[0133.142] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk.exe"
	[0133.142] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224
	[0133.143] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4fa
	[0133.143] GetFileTime (in: hFile=0x224, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x210ad1cc, dwHighDateTime=0x1d32742), lpLastAccessTime=0x407536*(dwLowDateTime=0x210ad1cc, dwHighDateTime=0x1d32742), lpLastWriteTime=0x40753e*(dwLowDateTime=0x96df2ecc, dwHighDateTime=0x1d2a02a)) returned 1
	[0133.143] SetFilePointer (in: hFile=0x224, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.143] ReadFile (in: hFile=0x224, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x4b8, lpOverlapped=0x0) returned 1
	[0133.144] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk") returned="Windows PowerShell ISE (x86).lnk"
	[0133.144] SetFilePointer (in: hFile=0x224, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.144] WriteFile (in: hFile=0x224, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x4b8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x4b8, lpOverlapped=0x0) returned 1
	[0133.145] SetFileTime (hFile=0x224, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.145] CloseHandle (hObject=0x224) returned 1
	[0133.145] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk.exe")) returned 1
	[0133.146] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210ad1cc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x96df2ecc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell ISE.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1
	[0133.146] PeekMessageA (in: lpMsg=0x19f23c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f23c) returned 0
	[0133.146] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Windows PowerShell ISE.lnk") returned -1
	[0133.146] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Windows PowerShell ISE.lnk") returned -1
	[0133.146] lstrcmpiA (lpString1="", lpString2="Windows PowerShell ISE.lnk") returned -1
	[0133.146] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk") returned="Windows PowerShell ISE (x86).lnk"
	[0133.146] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\"
	[0133.146] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\") returned=""
	[0133.146] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.146] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\how-to-decrypt-files.htm")) returned 0x20
	[0133.146] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\", lpString2="Windows PowerShell ISE.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk"
	[0133.146] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk", pszSpec="*.zip") returned 0
	[0133.146] lstrlenA (lpString="*.zip") returned 5
	[0133.146] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk", pszSpec="*.rar") returned 0
	[0133.146] lstrlenA (lpString="*.rar") returned 5
	[0133.146] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk", pszSpec="*.7z") returned 0
	[0133.146] lstrlenA (lpString="*.7z") returned 4
	[0133.146] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk", pszSpec="*.tar") returned 0
	[0133.146] lstrlenA (lpString="*.tar") returned 5
	[0133.146] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk", pszSpec="*.gzip") returned 0
	[0133.146] lstrlenA (lpString="*.gzip") returned 6
	[0133.146] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk", pszSpec="*.jpg") returned 0
	[0133.146] lstrlenA (lpString="*.jpg") returned 5
	[0133.146] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk", pszSpec="*.jpeg") returned 0
	[0133.146] lstrlenA (lpString="*.jpeg") returned 6
	[0133.146] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk", pszSpec="*.bmp") returned 0
	[0133.146] lstrlenA (lpString="*.bmp") returned 5
	[0133.147] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk", pszSpec="*.gif") returned 0
	[0133.147] lstrlenA (lpString="*.gif") returned 5
	[0133.147] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk", pszSpec="*.png") returned 0
	[0133.147] lstrlenA (lpString="*.png") returned 5
	[0133.147] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk", pszSpec="*.doc") returned 0
	[0133.147] lstrlenA (lpString="*.doc") returned 5
	[0133.147] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk", pszSpec="*.docx") returned 0
	[0133.147] lstrlenA (lpString="*.docx") returned 6
	[0133.147] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk", pszSpec="*.xls") returned 0
	[0133.147] lstrlenA (lpString="*.xls") returned 5
	[0133.147] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk", pszSpec="*.xlsx") returned 0
	[0133.147] lstrlenA (lpString="*.xlsx") returned 6
	[0133.147] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk", pszSpec="*.ppt") returned 0
	[0133.147] lstrlenA (lpString="*.ppt") returned 5
	[0133.147] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk", pszSpec="*.pptx") returned 0
	[0133.147] lstrlenA (lpString="*.pptx") returned 6
	[0133.147] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk", pszSpec="*.txt") returned 0
	[0133.147] lstrlenA (lpString="*.txt") returned 5
	[0133.147] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk", pszSpec="*.pdf") returned 0
	[0133.147] lstrlenA (lpString="*.pdf") returned 5
	[0133.147] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk", pszSpec="*.htm") returned 0
	[0133.147] lstrlenA (lpString="*.htm") returned 5
	[0133.147] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk", pszSpec="*.html") returned 0
	[0133.147] lstrlenA (lpString="*.html") returned 6
	[0133.147] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk", pszSpec="*.mdb") returned 0
	[0133.147] lstrlenA (lpString="*.mdb") returned 5
	[0133.147] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk", pszSpec="*.pfx") returned 0
	[0133.147] lstrlenA (lpString="*.pfx") returned 5
	[0133.147] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk", pszSpec="*.md") returned 0
	[0133.147] lstrlenA (lpString="*.md") returned 4
	[0133.147] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk", pszSpec="*.lnk") returned 1
	[0133.147] lstrlenA (lpString="*.lnk") returned 5
	[0133.147] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk"
	[0133.148] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk"
	[0133.148] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk."
	[0133.148] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk.exe"
	[0133.148] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224
	[0133.148] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4fa
	[0133.148] GetFileTime (in: hFile=0x224, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x210ad1cc, dwHighDateTime=0x1d32742), lpLastAccessTime=0x407536*(dwLowDateTime=0x210ad1cc, dwHighDateTime=0x1d32742), lpLastWriteTime=0x40753e*(dwLowDateTime=0x96df2ecc, dwHighDateTime=0x1d2a02a)) returned 1
	[0133.148] SetFilePointer (in: hFile=0x224, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.148] ReadFile (in: hFile=0x224, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x4b8, lpOverlapped=0x0) returned 1
	[0133.149] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk") returned="Windows PowerShell ISE.lnk"
	[0133.150] SetFilePointer (in: hFile=0x224, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.150] WriteFile (in: hFile=0x224, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x4b8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x4b8, lpOverlapped=0x0) returned 1
	[0133.150] SetFileTime (hFile=0x224, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.150] CloseHandle (hObject=0x224) returned 1
	[0133.150] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk.exe")) returned 1
	[0133.151] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210ad1cc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1
	[0133.151] PeekMessageA (in: lpMsg=0x19f23c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f23c) returned 0
	[0133.151] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Windows PowerShell.lnk") returned -1
	[0133.151] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Windows PowerShell.lnk") returned -1
	[0133.151] lstrcmpiA (lpString1="", lpString2="Windows PowerShell.lnk") returned -1
	[0133.151] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk") returned="Windows PowerShell ISE.lnk"
	[0133.151] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\"
	[0133.151] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\") returned=""
	[0133.151] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.151] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\how-to-decrypt-files.htm")) returned 0x20
	[0133.151] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\", lpString2="Windows PowerShell.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk"
	[0133.151] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk", pszSpec="*.zip") returned 0
	[0133.151] lstrlenA (lpString="*.zip") returned 5
	[0133.151] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk", pszSpec="*.rar") returned 0
	[0133.151] lstrlenA (lpString="*.rar") returned 5
	[0133.151] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk", pszSpec="*.7z") returned 0
	[0133.151] lstrlenA (lpString="*.7z") returned 4
	[0133.151] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk", pszSpec="*.tar") returned 0
	[0133.151] lstrlenA (lpString="*.tar") returned 5
	[0133.151] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk", pszSpec="*.gzip") returned 0
	[0133.151] lstrlenA (lpString="*.gzip") returned 6
	[0133.151] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk", pszSpec="*.jpg") returned 0
	[0133.151] lstrlenA (lpString="*.jpg") returned 5
	[0133.151] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk", pszSpec="*.jpeg") returned 0
	[0133.151] lstrlenA (lpString="*.jpeg") returned 6
	[0133.151] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk", pszSpec="*.bmp") returned 0
	[0133.151] lstrlenA (lpString="*.bmp") returned 5
	[0133.151] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk", pszSpec="*.gif") returned 0
	[0133.151] lstrlenA (lpString="*.gif") returned 5
	[0133.151] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk", pszSpec="*.png") returned 0
	[0133.152] lstrlenA (lpString="*.png") returned 5
	[0133.152] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk", pszSpec="*.doc") returned 0
	[0133.152] lstrlenA (lpString="*.doc") returned 5
	[0133.152] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk", pszSpec="*.docx") returned 0
	[0133.152] lstrlenA (lpString="*.docx") returned 6
	[0133.152] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk", pszSpec="*.xls") returned 0
	[0133.152] lstrlenA (lpString="*.xls") returned 5
	[0133.152] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk", pszSpec="*.xlsx") returned 0
	[0133.152] lstrlenA (lpString="*.xlsx") returned 6
	[0133.152] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk", pszSpec="*.ppt") returned 0
	[0133.152] lstrlenA (lpString="*.ppt") returned 5
	[0133.152] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk", pszSpec="*.pptx") returned 0
	[0133.152] lstrlenA (lpString="*.pptx") returned 6
	[0133.152] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk", pszSpec="*.txt") returned 0
	[0133.152] lstrlenA (lpString="*.txt") returned 5
	[0133.152] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk", pszSpec="*.pdf") returned 0
	[0133.152] lstrlenA (lpString="*.pdf") returned 5
	[0133.152] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk", pszSpec="*.htm") returned 0
	[0133.152] lstrlenA (lpString="*.htm") returned 5
	[0133.152] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk", pszSpec="*.html") returned 0
	[0133.152] lstrlenA (lpString="*.html") returned 6
	[0133.152] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk", pszSpec="*.mdb") returned 0
	[0133.152] lstrlenA (lpString="*.mdb") returned 5
	[0133.152] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk", pszSpec="*.pfx") returned 0
	[0133.152] lstrlenA (lpString="*.pfx") returned 5
	[0133.152] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk", pszSpec="*.md") returned 0
	[0133.152] lstrlenA (lpString="*.md") returned 4
	[0133.152] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk", pszSpec="*.lnk") returned 1
	[0133.152] lstrlenA (lpString="*.lnk") returned 5
	[0133.152] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk"
	[0133.152] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk"
	[0133.152] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk."
	[0133.152] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk.exe"
	[0133.152] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224
	[0133.153] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8bc
	[0133.153] GetFileTime (in: hFile=0x224, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x210ad1cc, dwHighDateTime=0x1d32742), lpLastAccessTime=0x407536*(dwLowDateTime=0x210ad1cc, dwHighDateTime=0x1d32742), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc5fb62ca, dwHighDateTime=0x1d2a02a)) returned 1
	[0133.153] SetFilePointer (in: hFile=0x224, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.153] ReadFile (in: hFile=0x224, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x87a, lpOverlapped=0x0) returned 1
	[0133.154] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk") returned="Windows PowerShell.lnk"
	[0133.154] SetFilePointer (in: hFile=0x224, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.155] WriteFile (in: hFile=0x224, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x87a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x87a, lpOverlapped=0x0) returned 1
	[0133.155] SetFileTime (hFile=0x224, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.155] CloseHandle (hObject=0x224) returned 1
	[0133.155] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk.exe")) returned 1
	[0133.155] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210ad1cc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0
	[0133.156] FindClose (in: hFindFile=0x7cb650 | out: hFindFile=0x7cb650) returned 1
	[0133.156] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f428c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell", cAlternateFileName="WINDOW~1")) returned 0
	[0133.156] FindClose (in: hFindFile=0x7cb950 | out: hFindFile=0x7cb950) returned 1
	[0133.156] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e1ed17a, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x92576074, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x92576074, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 0
	[0133.156] FindClose (in: hFindFile=0x7cb990 | out: hFindFile=0x7cb990) returned 1
	[0133.156] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f43b6f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d53e9c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0133.156] lstrcmpA (lpString1=".", lpString2="Templates") returned -1
	[0133.156] lstrcmpA (lpString1="..", lpString2="Templates") returned -1
	[0133.156] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\*.*") returned="*.*"
	[0133.156] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="Templates" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Templates") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Templates"
	[0133.156] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Templates") returned 59
	[0133.156] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*.*", lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f43b6f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d53e9c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb910
	[0133.156] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.156] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f43b6f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d53e9c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.156] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.156] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.156] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f43b6f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d53e9c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0133.156] FindClose (in: hFindFile=0x7cb910 | out: hFindFile=0x7cb910) returned 1
	[0133.156] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed47ed46, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xed5176e5, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xed5176e5, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1
	[0133.156] lstrcmpA (lpString1=".", lpString2="Themes") returned -1
	[0133.157] lstrcmpA (lpString1="..", lpString2="Themes") returned -1
	[0133.157] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\*.*") returned="*.*"
	[0133.157] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="Themes" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes"
	[0133.157] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes") returned 56
	[0133.157] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*.*", lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed47ed46, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xed5176e5, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xed5176e5, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb850
	[0133.157] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.157] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed47ed46, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xed5176e5, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xed5176e5, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.157] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.157] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.157] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed5176e5, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xeeeb8bd4, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xeeeb8bd4, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20, dwReserved1=0x0, cFileName="CachedFiles", cAlternateFileName="CACHED~1")) returned 1
	[0133.157] lstrcmpA (lpString1=".", lpString2="CachedFiles") returned -1
	[0133.157] lstrcmpA (lpString1="..", lpString2="CachedFiles") returned -1
	[0133.157] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*.*") returned="*.*"
	[0133.157] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\", lpString2="CachedFiles" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles"
	[0133.157] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles") returned 68
	[0133.157] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\*.*", lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed5176e5, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xeeeb8bd4, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xeeeb8bd4, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cbb90
	[0133.157] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.157] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed5176e5, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xeeeb8bd4, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xeeeb8bd4, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0133.157] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.157] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.157] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeeb8bd4, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xeeeb8bd4, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xeeeb8bd4, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1268b, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="CachedImage_1440_900_POS4.jpg", cAlternateFileName="CACHED~1.JPG")) returned 1
	[0133.157] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0133.157] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="CachedImage_1440_900_POS4.jpg") returned 1
	[0133.157] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="CachedImage_1440_900_POS4.jpg") returned 1
	[0133.157] lstrcmpiA (lpString1="", lpString2="CachedImage_1440_900_POS4.jpg") returned -1
	[0133.158] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\*.*") returned="*.*"
	[0133.158] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\"
	[0133.158] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\") returned=""
	[0133.158] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.158] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\themes\\cachedfiles\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0133.158] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\themes\\cachedfiles\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0133.158] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0133.158] WriteFile (in: hFile=0x220, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0133.159] SetFileTime (hFile=0x220, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0133.159] CloseHandle (hObject=0x220) returned 1
	[0133.159] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\", lpString2="CachedImage_1440_900_POS4.jpg" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg"
	[0133.159] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg", pszSpec="*.zip") returned 0
	[0133.159] lstrlenA (lpString="*.zip") returned 5
	[0133.159] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg", pszSpec="*.rar") returned 0
	[0133.159] lstrlenA (lpString="*.rar") returned 5
	[0133.159] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg", pszSpec="*.7z") returned 0
	[0133.159] lstrlenA (lpString="*.7z") returned 4
	[0133.159] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg", pszSpec="*.tar") returned 0
	[0133.160] lstrlenA (lpString="*.tar") returned 5
	[0133.160] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg", pszSpec="*.gzip") returned 0
	[0133.160] lstrlenA (lpString="*.gzip") returned 6
	[0133.160] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg", pszSpec="*.jpg") returned 1
	[0133.160] lstrlenA (lpString="*.jpg") returned 5
	[0133.160] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg"
	[0133.160] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg"
	[0133.160] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg."
	[0133.160] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg.exe"
	[0133.160] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\themes\\cachedfiles\\cachedimage_1440_900_pos4.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0133.160] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1268b
	[0133.160] GetFileTime (in: hFile=0x220, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xeeeb8bd4, dwHighDateTime=0x1d32743), lpLastAccessTime=0x407536*(dwLowDateTime=0xeeeb8bd4, dwHighDateTime=0x1d32743), lpLastWriteTime=0x40753e*(dwLowDateTime=0xeeeb8bd4, dwHighDateTime=0x1d32743)) returned 1
	[0133.160] SetFilePointer (in: hFile=0x220, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.160] ReadFile (in: hFile=0x220, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x12649, lpOverlapped=0x0) returned 1
	[0133.161] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg") returned="CachedImage_1440_900_POS4.jpg"
	[0133.162] SetFilePointer (in: hFile=0x220, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.162] WriteFile (in: hFile=0x220, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x12649, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x12649, lpOverlapped=0x0) returned 1
	[0133.162] SetFileTime (hFile=0x220, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.162] CloseHandle (hObject=0x220) returned 1
	[0133.162] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\themes\\cachedfiles\\cachedimage_1440_900_pos4.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\themes\\cachedfiles\\cachedimage_1440_900_pos4.jpg.exe")) returned 1
	[0133.163] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeeb8bd4, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xeeeb8bd4, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xeeeb8bd4, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1268b, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="CachedImage_1440_900_POS4.jpg", cAlternateFileName="CACHED~1.JPG")) returned 0
	[0133.163] FindClose (in: hFindFile=0x7cbb90 | out: hFindFile=0x7cbb90) returned 1
	[0133.163] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed4a4fa5, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xed4a4fa5, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xeee6c718, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1200e, dwReserved0=0x20, dwReserved1=0x0, cFileName="TranscodedWallpaper", cAlternateFileName="TRANSC~1")) returned 1
	[0133.163] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0133.163] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="TranscodedWallpaper") returned -1
	[0133.163] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="TranscodedWallpaper") returned -1
	[0133.163] lstrcmpiA (lpString1="", lpString2="TranscodedWallpaper") returned -1
	[0133.163] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*.*") returned="*.*"
	[0133.163] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\"
	[0133.163] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\") returned=""
	[0133.163] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.163] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\themes\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0133.163] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\themes\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0133.169] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0133.169] WriteFile (in: hFile=0x21c, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0133.170] SetFileTime (hFile=0x21c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0133.170] CloseHandle (hObject=0x21c) returned 1
	[0133.170] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\", lpString2="TranscodedWallpaper" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper"
	[0133.170] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.zip") returned 0
	[0133.170] lstrlenA (lpString="*.zip") returned 5
	[0133.170] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.rar") returned 0
	[0133.170] lstrlenA (lpString="*.rar") returned 5
	[0133.170] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.7z") returned 0
	[0133.170] lstrlenA (lpString="*.7z") returned 4
	[0133.170] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.tar") returned 0
	[0133.170] lstrlenA (lpString="*.tar") returned 5
	[0133.170] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.gzip") returned 0
	[0133.170] lstrlenA (lpString="*.gzip") returned 6
	[0133.171] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.jpg") returned 0
	[0133.171] lstrlenA (lpString="*.jpg") returned 5
	[0133.171] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.jpeg") returned 0
	[0133.171] lstrlenA (lpString="*.jpeg") returned 6
	[0133.171] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.bmp") returned 0
	[0133.171] lstrlenA (lpString="*.bmp") returned 5
	[0133.171] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.gif") returned 0
	[0133.171] lstrlenA (lpString="*.gif") returned 5
	[0133.171] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.png") returned 0
	[0133.171] lstrlenA (lpString="*.png") returned 5
	[0133.171] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.doc") returned 0
	[0133.171] lstrlenA (lpString="*.doc") returned 5
	[0133.171] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.docx") returned 0
	[0133.171] lstrlenA (lpString="*.docx") returned 6
	[0133.171] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.xls") returned 0
	[0133.171] lstrlenA (lpString="*.xls") returned 5
	[0133.171] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.xlsx") returned 0
	[0133.171] lstrlenA (lpString="*.xlsx") returned 6
	[0133.171] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.ppt") returned 0
	[0133.171] lstrlenA (lpString="*.ppt") returned 5
	[0133.171] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.pptx") returned 0
	[0133.171] lstrlenA (lpString="*.pptx") returned 6
	[0133.171] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.txt") returned 0
	[0133.171] lstrlenA (lpString="*.txt") returned 5
	[0133.171] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.pdf") returned 0
	[0133.171] lstrlenA (lpString="*.pdf") returned 5
	[0133.171] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.htm") returned 0
	[0133.171] lstrlenA (lpString="*.htm") returned 5
	[0133.171] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.html") returned 0
	[0133.171] lstrlenA (lpString="*.html") returned 6
	[0133.171] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.mdb") returned 0
	[0133.171] lstrlenA (lpString="*.mdb") returned 5
	[0133.171] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.pfx") returned 0
	[0133.171] lstrlenA (lpString="*.pfx") returned 5
	[0133.172] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.md") returned 0
	[0133.172] lstrlenA (lpString="*.md") returned 4
	[0133.172] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.lnk") returned 0
	[0133.172] lstrlenA (lpString="*.lnk") returned 5
	[0133.172] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.torrent") returned 0
	[0133.172] lstrlenA (lpString="*.torrent") returned 9
	[0133.172] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.mov") returned 0
	[0133.172] lstrlenA (lpString="*.mov") returned 5
	[0133.172] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.3gp") returned 0
	[0133.172] lstrlenA (lpString="*.3gp") returned 5
	[0133.172] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.mpeg") returned 0
	[0133.172] lstrlenA (lpString="*.mpeg") returned 6
	[0133.172] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.mpg") returned 0
	[0133.172] lstrlenA (lpString="*.mpg") returned 5
	[0133.172] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.flv") returned 0
	[0133.172] lstrlenA (lpString="*.flv") returned 5
	[0133.172] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.avi") returned 0
	[0133.172] lstrlenA (lpString="*.avi") returned 5
	[0133.172] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.mp4") returned 0
	[0133.172] lstrlenA (lpString="*.mp4") returned 5
	[0133.172] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.wmv") returned 0
	[0133.172] lstrlenA (lpString="*.wmv") returned 5
	[0133.172] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.mkv") returned 0
	[0133.172] lstrlenA (lpString="*.mkv") returned 5
	[0133.172] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.mp3") returned 0
	[0133.172] lstrlenA (lpString="*.mp3") returned 5
	[0133.172] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.wav") returned 0
	[0133.172] lstrlenA (lpString="*.wav") returned 5
	[0133.172] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.flac") returned 0
	[0133.172] lstrlenA (lpString="*.flac") returned 6
	[0133.172] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.wma") returned 0
	[0133.172] lstrlenA (lpString="*.wma") returned 5
	[0133.172] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.au3") returned 0
	[0133.172] lstrlenA (lpString="*.au3") returned 5
	[0133.172] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.ahk") returned 0
	[0133.172] lstrlenA (lpString="*.ahk") returned 5
	[0133.173] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.c") returned 0
	[0133.173] lstrlenA (lpString="*.c") returned 3
	[0133.173] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.cc") returned 0
	[0133.173] lstrlenA (lpString="*.cc") returned 4
	[0133.173] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.cpp") returned 0
	[0133.173] lstrlenA (lpString="*.cpp") returned 5
	[0133.173] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.cxx") returned 0
	[0133.173] lstrlenA (lpString="*.cxx") returned 5
	[0133.173] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.c++") returned 0
	[0133.173] lstrlenA (lpString="*.c++") returned 5
	[0133.173] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.cs") returned 0
	[0133.173] lstrlenA (lpString="*.cs") returned 4
	[0133.173] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.vb") returned 0
	[0133.173] lstrlenA (lpString="*.vb") returned 4
	[0133.173] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.bas") returned 0
	[0133.173] lstrlenA (lpString="*.bas") returned 5
	[0133.173] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.csproj") returned 0
	[0133.173] lstrlenA (lpString="*.csproj") returned 8
	[0133.173] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.vbproj") returned 0
	[0133.173] lstrlenA (lpString="*.vbproj") returned 8
	[0133.173] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.vcxproj") returned 0
	[0133.173] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.173] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.manifest") returned 0
	[0133.173] lstrlenA (lpString="*.manifest") returned 10
	[0133.173] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.php") returned 0
	[0133.173] lstrlenA (lpString="*.php") returned 5
	[0133.173] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.vbe") returned 0
	[0133.173] lstrlenA (lpString="*.vbe") returned 5
	[0133.173] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.vba") returned 0
	[0133.173] lstrlenA (lpString="*.vba") returned 5
	[0133.173] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.vbs") returned 0
	[0133.173] lstrlenA (lpString="*.vbs") returned 5
	[0133.173] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.bat") returned 0
	[0133.173] lstrlenA (lpString="*.bat") returned 5
	[0133.173] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.cmd") returned 0
	[0133.174] lstrlenA (lpString="*.cmd") returned 5
	[0133.174] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.js") returned 0
	[0133.174] lstrlenA (lpString="*.js") returned 4
	[0133.174] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.jscript") returned 0
	[0133.174] lstrlenA (lpString="*.jscript") returned 9
	[0133.174] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.hta") returned 0
	[0133.174] lstrlenA (lpString="*.hta") returned 5
	[0133.174] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.php7") returned 0
	[0133.174] lstrlenA (lpString="*.php7") returned 6
	[0133.174] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.db") returned 0
	[0133.174] lstrlenA (lpString="*.db") returned 4
	[0133.174] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.swf") returned 0
	[0133.174] lstrlenA (lpString="*.swf") returned 5
	[0133.174] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.eml") returned 0
	[0133.174] lstrlenA (lpString="*.eml") returned 5
	[0133.174] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.part") returned 0
	[0133.174] lstrlenA (lpString="*.part") returned 6
	[0133.174] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.nfo") returned 0
	[0133.174] lstrlenA (lpString="*.nfo") returned 5
	[0133.174] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.rsa") returned 0
	[0133.174] lstrlenA (lpString="*.rsa") returned 5
	[0133.174] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.key") returned 0
	[0133.174] lstrlenA (lpString="*.key") returned 5
	[0133.174] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.aes") returned 0
	[0133.174] lstrlenA (lpString="*.aes") returned 5
	[0133.174] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.blob") returned 0
	[0133.174] lstrlenA (lpString="*.blob") returned 6
	[0133.174] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.btc") returned 0
	[0133.174] lstrlenA (lpString="*.btc") returned 5
	[0133.176] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper", pszSpec="*.wallet") returned 0
	[0133.176] lstrlenA (lpString="*.wallet") returned 8
	[0133.176] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed4a4fa5, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xed4a4fa5, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xeee6c718, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1200e, dwReserved0=0x20, dwReserved1=0x0, cFileName="TranscodedWallpaper", cAlternateFileName="TRANSC~1")) returned 0
	[0133.176] FindClose (in: hFindFile=0x7cb850 | out: hFindFile=0x7cb850) returned 1
	[0133.176] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed47ed46, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xed5176e5, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xed5176e5, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 0
	[0133.176] FindClose (in: hFindFile=0x7cb9d0 | out: hFindFile=0x7cb9d0) returned 1
	[0133.176] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x300a046, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x300a046, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x300a046, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word", cAlternateFileName="")) returned 1
	[0133.176] lstrcmpA (lpString1=".", lpString2="Word") returned -1
	[0133.176] lstrcmpA (lpString1="..", lpString2="Word") returned -1
	[0133.176] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*"
	[0133.176] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\", lpString2="Word" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Word") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Word"
	[0133.176] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Word") returned 46
	[0133.176] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Word\\*.*", lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x300a046, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x300a046, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x300a046, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bf2eea, dwReserved1=0x9, cFileName=".", cAlternateFileName="")) returned 0x7cb990
	[0133.176] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.176] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x300a046, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x300a046, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x300a046, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bf2eea, dwReserved1=0x9, cFileName="..", cAlternateFileName="")) returned 1
	[0133.176] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.176] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.176] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x300a046, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x300a046, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x300a046, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bf2eea, dwReserved1=0x9, cFileName="STARTUP", cAlternateFileName="")) returned 1
	[0133.176] lstrcmpA (lpString1=".", lpString2="STARTUP") returned -1
	[0133.176] lstrcmpA (lpString1="..", lpString2="STARTUP") returned -1
	[0133.177] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Word\\*.*") returned="*.*"
	[0133.177] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Word\\", lpString2="STARTUP" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Word\\STARTUP") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Word\\STARTUP"
	[0133.177] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Word\\STARTUP") returned 54
	[0133.177] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\*.*", lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x300a046, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x300a046, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x300a046, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb910
	[0133.177] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.177] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x300a046, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x300a046, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x300a046, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.177] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.177] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.177] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x300a046, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x300a046, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x300a046, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0133.177] FindClose (in: hFindFile=0x7cb910 | out: hFindFile=0x7cb910) returned 1
	[0133.177] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x300a046, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x300a046, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x300a046, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bf2eea, dwReserved1=0x9, cFileName="STARTUP", cAlternateFileName="")) returned 0
	[0133.177] FindClose (in: hFindFile=0x7cb990 | out: hFindFile=0x7cb990) returned 1
	[0133.177] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x300a046, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x300a046, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x300a046, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word", cAlternateFileName="")) returned 0
	[0133.177] FindClose (in: hFindFile=0x7cb750 | out: hFindFile=0x7cb750) returned 1
	[0133.177] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd8b64ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd8b64ce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c, dwReserved1=0x1, cFileName="Mozilla", cAlternateFileName="")) returned 1
	[0133.177] lstrcmpA (lpString1=".", lpString2="Mozilla") returned -1
	[0133.177] lstrcmpA (lpString1="..", lpString2="Mozilla") returned -1
	[0133.177] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\*.*") returned="*.*"
	[0133.177] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Mozilla" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla"
	[0133.177] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla") returned 39
	[0133.177] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd8b64ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd8b64ce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb650
	[0133.178] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.178] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd8b64ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd8b64ce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.178] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.178] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.178] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8b64ce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd8b64ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd8b64ce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Extensions", cAlternateFileName="EXTENS~1")) returned 1
	[0133.178] lstrcmpA (lpString1=".", lpString2="Extensions") returned -1
	[0133.178] lstrcmpA (lpString1="..", lpString2="Extensions") returned -1
	[0133.178] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\*.*") returned="*.*"
	[0133.178] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\", lpString2="Extensions" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Extensions") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Extensions"
	[0133.178] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Extensions") returned 50
	[0133.178] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Extensions\\*.*", lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8b64ce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd8b64ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd8b64ce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cb690
	[0133.178] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.178] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8b64ce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd8b64ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd8b64ce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0133.178] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.178] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.178] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8b64ce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd8b64ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd8b64ce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 0
	[0133.178] FindClose (in: hFindFile=0x7cb690 | out: hFindFile=0x7cb690) returned 1
	[0133.178] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Firefox", cAlternateFileName="")) returned 1
	[0133.178] lstrcmpA (lpString1=".", lpString2="Firefox") returned -1
	[0133.178] lstrcmpA (lpString1="..", lpString2="Firefox") returned -1
	[0133.178] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\*.*") returned="*.*"
	[0133.178] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\", lpString2="Firefox" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox"
	[0133.178] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox") returned 47
	[0133.178] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\*.*", lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cb690
	[0133.179] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.179] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0133.179] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.179] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.179] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Crash Reports", cAlternateFileName="CRASHR~1")) returned 1
	[0133.179] lstrcmpA (lpString1=".", lpString2="Crash Reports") returned -1
	[0133.179] lstrcmpA (lpString1="..", lpString2="Crash Reports") returned -1
	[0133.180] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\*.*") returned="*.*"
	[0133.180] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="Crash Reports" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports"
	[0133.180] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports") returned 61
	[0133.180] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*.*", lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb990
	[0133.180] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.180] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.180] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.180] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.180] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4, dwReserved1=0x0, cFileName="events", cAlternateFileName="")) returned 1
	[0133.180] lstrcmpA (lpString1=".", lpString2="events") returned -1
	[0133.180] lstrcmpA (lpString1="..", lpString2="events") returned -1
	[0133.180] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*.*") returned="*.*"
	[0133.180] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\", lpString2="events" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events"
	[0133.180] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events") returned 68
	[0133.180] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events\\*.*", lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x12, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb750
	[0133.181] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.181] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x12, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.181] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.181] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.181] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x12, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0133.181] FindClose (in: hFindFile=0x7cb750 | out: hFindFile=0x7cb750) returned 1
	[0133.185] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x4, dwReserved1=0x0, cFileName="InstallTime20170824053622", cAlternateFileName="INSTAL~1")) returned 1
	[0133.185] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0133.185] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="InstallTime20170824053622") returned -1
	[0133.185] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="InstallTime20170824053622") returned -1
	[0133.185] lstrcmpiA (lpString1="", lpString2="InstallTime20170824053622") returned -1
	[0133.185] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*.*") returned="*.*"
	[0133.185] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\"
	[0133.185] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\") returned=""
	[0133.185] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.185] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\crash reports\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0133.185] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\crash reports\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0133.188] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0133.188] WriteFile (in: hFile=0x21c, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0133.188] SetFileTime (hFile=0x21c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0133.189] CloseHandle (hObject=0x21c) returned 1
	[0133.189] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\", lpString2="InstallTime20170824053622" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622"
	[0133.189] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.zip") returned 0
	[0133.189] lstrlenA (lpString="*.zip") returned 5
	[0133.189] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.rar") returned 0
	[0133.189] lstrlenA (lpString="*.rar") returned 5
	[0133.189] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.7z") returned 0
	[0133.189] lstrlenA (lpString="*.7z") returned 4
	[0133.189] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.tar") returned 0
	[0133.189] lstrlenA (lpString="*.tar") returned 5
	[0133.189] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.gzip") returned 0
	[0133.189] lstrlenA (lpString="*.gzip") returned 6
	[0133.189] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.jpg") returned 0
	[0133.189] lstrlenA (lpString="*.jpg") returned 5
	[0133.189] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.jpeg") returned 0
	[0133.189] lstrlenA (lpString="*.jpeg") returned 6
	[0133.189] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.bmp") returned 0
	[0133.189] lstrlenA (lpString="*.bmp") returned 5
	[0133.189] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.gif") returned 0
	[0133.189] lstrlenA (lpString="*.gif") returned 5
	[0133.189] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.png") returned 0
	[0133.189] lstrlenA (lpString="*.png") returned 5
	[0133.189] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.doc") returned 0
	[0133.189] lstrlenA (lpString="*.doc") returned 5
	[0133.189] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.docx") returned 0
	[0133.189] lstrlenA (lpString="*.docx") returned 6
	[0133.189] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.xls") returned 0
	[0133.189] lstrlenA (lpString="*.xls") returned 5
	[0133.189] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.xlsx") returned 0
	[0133.189] lstrlenA (lpString="*.xlsx") returned 6
	[0133.189] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.ppt") returned 0
	[0133.189] lstrlenA (lpString="*.ppt") returned 5
	[0133.190] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.pptx") returned 0
	[0133.190] lstrlenA (lpString="*.pptx") returned 6
	[0133.190] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.txt") returned 0
	[0133.190] lstrlenA (lpString="*.txt") returned 5
	[0133.190] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.pdf") returned 0
	[0133.190] lstrlenA (lpString="*.pdf") returned 5
	[0133.190] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.htm") returned 0
	[0133.190] lstrlenA (lpString="*.htm") returned 5
	[0133.190] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.html") returned 0
	[0133.190] lstrlenA (lpString="*.html") returned 6
	[0133.190] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.mdb") returned 0
	[0133.190] lstrlenA (lpString="*.mdb") returned 5
	[0133.190] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.pfx") returned 0
	[0133.190] lstrlenA (lpString="*.pfx") returned 5
	[0133.190] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.md") returned 0
	[0133.190] lstrlenA (lpString="*.md") returned 4
	[0133.190] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.lnk") returned 0
	[0133.190] lstrlenA (lpString="*.lnk") returned 5
	[0133.190] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.torrent") returned 0
	[0133.190] lstrlenA (lpString="*.torrent") returned 9
	[0133.190] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.mov") returned 0
	[0133.190] lstrlenA (lpString="*.mov") returned 5
	[0133.190] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.3gp") returned 0
	[0133.190] lstrlenA (lpString="*.3gp") returned 5
	[0133.190] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.mpeg") returned 0
	[0133.190] lstrlenA (lpString="*.mpeg") returned 6
	[0133.190] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.mpg") returned 0
	[0133.190] lstrlenA (lpString="*.mpg") returned 5
	[0133.190] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.flv") returned 0
	[0133.190] lstrlenA (lpString="*.flv") returned 5
	[0133.190] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.avi") returned 0
	[0133.190] lstrlenA (lpString="*.avi") returned 5
	[0133.190] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.mp4") returned 0
	[0133.190] lstrlenA (lpString="*.mp4") returned 5
	[0133.190] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.wmv") returned 0
	[0133.191] lstrlenA (lpString="*.wmv") returned 5
	[0133.191] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.mkv") returned 0
	[0133.191] lstrlenA (lpString="*.mkv") returned 5
	[0133.191] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.mp3") returned 0
	[0133.191] lstrlenA (lpString="*.mp3") returned 5
	[0133.191] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.wav") returned 0
	[0133.191] lstrlenA (lpString="*.wav") returned 5
	[0133.191] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.flac") returned 0
	[0133.191] lstrlenA (lpString="*.flac") returned 6
	[0133.191] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.wma") returned 0
	[0133.191] lstrlenA (lpString="*.wma") returned 5
	[0133.191] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.au3") returned 0
	[0133.191] lstrlenA (lpString="*.au3") returned 5
	[0133.191] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.ahk") returned 0
	[0133.191] lstrlenA (lpString="*.ahk") returned 5
	[0133.191] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.c") returned 0
	[0133.191] lstrlenA (lpString="*.c") returned 3
	[0133.191] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.cc") returned 0
	[0133.191] lstrlenA (lpString="*.cc") returned 4
	[0133.191] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.cpp") returned 0
	[0133.191] lstrlenA (lpString="*.cpp") returned 5
	[0133.191] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.cxx") returned 0
	[0133.191] lstrlenA (lpString="*.cxx") returned 5
	[0133.191] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.c++") returned 0
	[0133.191] lstrlenA (lpString="*.c++") returned 5
	[0133.191] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.cs") returned 0
	[0133.191] lstrlenA (lpString="*.cs") returned 4
	[0133.191] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.vb") returned 0
	[0133.191] lstrlenA (lpString="*.vb") returned 4
	[0133.191] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.bas") returned 0
	[0133.191] lstrlenA (lpString="*.bas") returned 5
	[0133.191] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.csproj") returned 0
	[0133.191] lstrlenA (lpString="*.csproj") returned 8
	[0133.192] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.vbproj") returned 0
	[0133.192] lstrlenA (lpString="*.vbproj") returned 8
	[0133.192] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.vcxproj") returned 0
	[0133.192] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.192] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.manifest") returned 0
	[0133.192] lstrlenA (lpString="*.manifest") returned 10
	[0133.192] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.php") returned 0
	[0133.192] lstrlenA (lpString="*.php") returned 5
	[0133.192] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.vbe") returned 0
	[0133.192] lstrlenA (lpString="*.vbe") returned 5
	[0133.192] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.vba") returned 0
	[0133.192] lstrlenA (lpString="*.vba") returned 5
	[0133.192] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.vbs") returned 0
	[0133.192] lstrlenA (lpString="*.vbs") returned 5
	[0133.192] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.bat") returned 0
	[0133.192] lstrlenA (lpString="*.bat") returned 5
	[0133.192] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.cmd") returned 0
	[0133.192] lstrlenA (lpString="*.cmd") returned 5
	[0133.192] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.js") returned 0
	[0133.192] lstrlenA (lpString="*.js") returned 4
	[0133.192] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.jscript") returned 0
	[0133.192] lstrlenA (lpString="*.jscript") returned 9
	[0133.192] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.hta") returned 0
	[0133.192] lstrlenA (lpString="*.hta") returned 5
	[0133.192] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.php7") returned 0
	[0133.192] lstrlenA (lpString="*.php7") returned 6
	[0133.192] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.db") returned 0
	[0133.192] lstrlenA (lpString="*.db") returned 4
	[0133.192] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.swf") returned 0
	[0133.192] lstrlenA (lpString="*.swf") returned 5
	[0133.192] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.eml") returned 0
	[0133.193] lstrlenA (lpString="*.eml") returned 5
	[0133.193] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.part") returned 0
	[0133.193] lstrlenA (lpString="*.part") returned 6
	[0133.193] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.nfo") returned 0
	[0133.193] lstrlenA (lpString="*.nfo") returned 5
	[0133.193] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.rsa") returned 0
	[0133.193] lstrlenA (lpString="*.rsa") returned 5
	[0133.193] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.key") returned 0
	[0133.193] lstrlenA (lpString="*.key") returned 5
	[0133.193] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.aes") returned 0
	[0133.193] lstrlenA (lpString="*.aes") returned 5
	[0133.193] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.blob") returned 0
	[0133.193] lstrlenA (lpString="*.blob") returned 6
	[0133.193] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.btc") returned 0
	[0133.193] lstrlenA (lpString="*.btc") returned 5
	[0133.193] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", pszSpec="*.wallet") returned 0
	[0133.193] lstrlenA (lpString="*.wallet") returned 8
	[0133.193] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x4, dwReserved1=0x0, cFileName="InstallTime20170824053622", cAlternateFileName="INSTAL~1")) returned 0
	[0133.193] FindClose (in: hFindFile=0x7cb990 | out: hFindFile=0x7cb990) returned 1
	[0133.193] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bf2eea, dwReserved1=0x9, cFileName="Pending Pings", cAlternateFileName="PENDIN~1")) returned 1
	[0133.193] lstrcmpA (lpString1=".", lpString2="Pending Pings") returned -1
	[0133.193] lstrcmpA (lpString1="..", lpString2="Pending Pings") returned -1
	[0133.193] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\*.*") returned="*.*"
	[0133.193] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="Pending Pings" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Pending Pings") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Pending Pings"
	[0133.193] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Pending Pings") returned 61
	[0133.193] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Pending Pings\\*.*", lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb790
	[0133.194] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.194] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.194] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.194] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.194] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0133.195] FindClose (in: hFindFile=0x7cb790 | out: hFindFile=0x7cb790) returned 1
	[0133.195] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bf2eea, dwReserved1=0x9, cFileName="Profiles", cAlternateFileName="")) returned 1
	[0133.195] lstrcmpA (lpString1=".", lpString2="Profiles") returned -1
	[0133.195] lstrcmpA (lpString1="..", lpString2="Profiles") returned -1
	[0133.195] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\*.*") returned="*.*"
	[0133.195] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="Profiles" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles"
	[0133.195] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned 56
	[0133.195] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*.*", lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb850
	[0133.196] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.196] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.196] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.196] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.196] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb83449e5, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb83449e5, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="w7cr0hor.default", cAlternateFileName="W7CR0H~1.DEF")) returned 1
	[0133.196] lstrcmpA (lpString1=".", lpString2="w7cr0hor.default") returned -1
	[0133.196] lstrcmpA (lpString1="..", lpString2="w7cr0hor.default") returned -1
	[0133.196] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*.*") returned="*.*"
	[0133.196] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\", lpString2="w7cr0hor.default" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default"
	[0133.196] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 73
	[0133.196] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\*.*", lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb83449e5, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb83449e5, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cb950
	[0133.197] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.197] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb83449e5, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb83449e5, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0133.198] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.198] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.198] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a3ab44, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a3ab44, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8a3ab44, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="addons.json", cAlternateFileName="ADDONS~1.JSO")) returned 1
	[0133.198] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0133.198] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="addons.json") returned 1
	[0133.198] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="addons.json") returned 1
	[0133.198] lstrcmpiA (lpString1="", lpString2="addons.json") returned -1
	[0133.198] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\*.*") returned="*.*"
	[0133.198] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\"
	[0133.198] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned=""
	[0133.198] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.198] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0133.199] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0133.200] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0133.200] WriteFile (in: hFile=0x220, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0133.201] SetFileTime (hFile=0x220, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0133.201] CloseHandle (hObject=0x220) returned 1
	[0133.201] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="addons.json" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json"
	[0133.201] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.zip") returned 0
	[0133.201] lstrlenA (lpString="*.zip") returned 5
	[0133.201] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.rar") returned 0
	[0133.201] lstrlenA (lpString="*.rar") returned 5
	[0133.201] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.7z") returned 0
	[0133.201] lstrlenA (lpString="*.7z") returned 4
	[0133.201] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.tar") returned 0
	[0133.201] lstrlenA (lpString="*.tar") returned 5
	[0133.201] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.gzip") returned 0
	[0133.201] lstrlenA (lpString="*.gzip") returned 6
	[0133.201] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.jpg") returned 0
	[0133.201] lstrlenA (lpString="*.jpg") returned 5
	[0133.201] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.jpeg") returned 0
	[0133.201] lstrlenA (lpString="*.jpeg") returned 6
	[0133.201] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.bmp") returned 0
	[0133.201] lstrlenA (lpString="*.bmp") returned 5
	[0133.201] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.gif") returned 0
	[0133.201] lstrlenA (lpString="*.gif") returned 5
	[0133.201] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.png") returned 0
	[0133.202] lstrlenA (lpString="*.png") returned 5
	[0133.202] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.doc") returned 0
	[0133.202] lstrlenA (lpString="*.doc") returned 5
	[0133.202] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.docx") returned 0
	[0133.202] lstrlenA (lpString="*.docx") returned 6
	[0133.202] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.xls") returned 0
	[0133.202] lstrlenA (lpString="*.xls") returned 5
	[0133.202] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.xlsx") returned 0
	[0133.202] lstrlenA (lpString="*.xlsx") returned 6
	[0133.202] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.ppt") returned 0
	[0133.202] lstrlenA (lpString="*.ppt") returned 5
	[0133.202] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.pptx") returned 0
	[0133.202] lstrlenA (lpString="*.pptx") returned 6
	[0133.202] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.txt") returned 0
	[0133.202] lstrlenA (lpString="*.txt") returned 5
	[0133.202] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.pdf") returned 0
	[0133.202] lstrlenA (lpString="*.pdf") returned 5
	[0133.202] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.htm") returned 0
	[0133.202] lstrlenA (lpString="*.htm") returned 5
	[0133.202] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.html") returned 0
	[0133.202] lstrlenA (lpString="*.html") returned 6
	[0133.202] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.mdb") returned 0
	[0133.202] lstrlenA (lpString="*.mdb") returned 5
	[0133.202] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.pfx") returned 0
	[0133.202] lstrlenA (lpString="*.pfx") returned 5
	[0133.202] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.md") returned 0
	[0133.202] lstrlenA (lpString="*.md") returned 4
	[0133.202] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.lnk") returned 0
	[0133.202] lstrlenA (lpString="*.lnk") returned 5
	[0133.202] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.torrent") returned 0
	[0133.202] lstrlenA (lpString="*.torrent") returned 9
	[0133.202] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.mov") returned 0
	[0133.202] lstrlenA (lpString="*.mov") returned 5
	[0133.202] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.3gp") returned 0
	[0133.202] lstrlenA (lpString="*.3gp") returned 5
	[0133.202] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.mpeg") returned 0
	[0133.202] lstrlenA (lpString="*.mpeg") returned 6
	[0133.202] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.mpg") returned 0
	[0133.203] lstrlenA (lpString="*.mpg") returned 5
	[0133.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.flv") returned 0
	[0133.203] lstrlenA (lpString="*.flv") returned 5
	[0133.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.avi") returned 0
	[0133.203] lstrlenA (lpString="*.avi") returned 5
	[0133.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.mp4") returned 0
	[0133.203] lstrlenA (lpString="*.mp4") returned 5
	[0133.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.wmv") returned 0
	[0133.203] lstrlenA (lpString="*.wmv") returned 5
	[0133.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.mkv") returned 0
	[0133.203] lstrlenA (lpString="*.mkv") returned 5
	[0133.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.mp3") returned 0
	[0133.203] lstrlenA (lpString="*.mp3") returned 5
	[0133.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.wav") returned 0
	[0133.203] lstrlenA (lpString="*.wav") returned 5
	[0133.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.flac") returned 0
	[0133.203] lstrlenA (lpString="*.flac") returned 6
	[0133.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.wma") returned 0
	[0133.203] lstrlenA (lpString="*.wma") returned 5
	[0133.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.au3") returned 0
	[0133.203] lstrlenA (lpString="*.au3") returned 5
	[0133.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.ahk") returned 0
	[0133.203] lstrlenA (lpString="*.ahk") returned 5
	[0133.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.c") returned 0
	[0133.203] lstrlenA (lpString="*.c") returned 3
	[0133.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.cc") returned 0
	[0133.203] lstrlenA (lpString="*.cc") returned 4
	[0133.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.cpp") returned 0
	[0133.203] lstrlenA (lpString="*.cpp") returned 5
	[0133.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.cxx") returned 0
	[0133.203] lstrlenA (lpString="*.cxx") returned 5
	[0133.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.c++") returned 0
	[0133.203] lstrlenA (lpString="*.c++") returned 5
	[0133.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.cs") returned 0
	[0133.203] lstrlenA (lpString="*.cs") returned 4
	[0133.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.vb") returned 0
	[0133.203] lstrlenA (lpString="*.vb") returned 4
	[0133.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.bas") returned 0
	[0133.204] lstrlenA (lpString="*.bas") returned 5
	[0133.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.csproj") returned 0
	[0133.204] lstrlenA (lpString="*.csproj") returned 8
	[0133.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.vbproj") returned 0
	[0133.204] lstrlenA (lpString="*.vbproj") returned 8
	[0133.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.vcxproj") returned 0
	[0133.204] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.manifest") returned 0
	[0133.204] lstrlenA (lpString="*.manifest") returned 10
	[0133.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.php") returned 0
	[0133.204] lstrlenA (lpString="*.php") returned 5
	[0133.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.vbe") returned 0
	[0133.204] lstrlenA (lpString="*.vbe") returned 5
	[0133.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.vba") returned 0
	[0133.204] lstrlenA (lpString="*.vba") returned 5
	[0133.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.vbs") returned 0
	[0133.204] lstrlenA (lpString="*.vbs") returned 5
	[0133.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.bat") returned 0
	[0133.204] lstrlenA (lpString="*.bat") returned 5
	[0133.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.cmd") returned 0
	[0133.204] lstrlenA (lpString="*.cmd") returned 5
	[0133.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.js") returned 0
	[0133.204] lstrlenA (lpString="*.js") returned 4
	[0133.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.jscript") returned 0
	[0133.204] lstrlenA (lpString="*.jscript") returned 9
	[0133.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.hta") returned 0
	[0133.204] lstrlenA (lpString="*.hta") returned 5
	[0133.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.php7") returned 0
	[0133.204] lstrlenA (lpString="*.php7") returned 6
	[0133.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.db") returned 0
	[0133.204] lstrlenA (lpString="*.db") returned 4
	[0133.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.swf") returned 0
	[0133.204] lstrlenA (lpString="*.swf") returned 5
	[0133.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.eml") returned 0
	[0133.204] lstrlenA (lpString="*.eml") returned 5
	[0133.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.part") returned 0
	[0133.204] lstrlenA (lpString="*.part") returned 6
	[0133.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.nfo") returned 0
	[0133.204] lstrlenA (lpString="*.nfo") returned 5
	[0133.205] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.rsa") returned 0
	[0133.205] lstrlenA (lpString="*.rsa") returned 5
	[0133.205] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.key") returned 0
	[0133.205] lstrlenA (lpString="*.key") returned 5
	[0133.205] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.aes") returned 0
	[0133.205] lstrlenA (lpString="*.aes") returned 5
	[0133.205] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.blob") returned 0
	[0133.205] lstrlenA (lpString="*.blob") returned 6
	[0133.205] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.btc") returned 0
	[0133.205] lstrlenA (lpString="*.btc") returned 5
	[0133.205] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", pszSpec="*.wallet") returned 0
	[0133.205] lstrlenA (lpString="*.wallet") returned 8
	[0133.205] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfea98376, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfea98376, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfea98376, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x291, dwReserved0=0x0, dwReserved1=0x0, cFileName="addonStartup.json.lz4", cAlternateFileName="ADDONS~1.LZ4")) returned 1
	[0133.205] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0133.205] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="addonStartup.json.lz4") returned 1
	[0133.205] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="addonStartup.json.lz4") returned 1
	[0133.205] lstrcmpiA (lpString1="", lpString2="addonStartup.json.lz4") returned -1
	[0133.205] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json") returned="addons.json"
	[0133.205] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\"
	[0133.205] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned=""
	[0133.205] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.205] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\how-to-decrypt-files.htm")) returned 0x20
	[0133.205] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="addonStartup.json.lz4" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4"
	[0133.205] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.zip") returned 0
	[0133.205] lstrlenA (lpString="*.zip") returned 5
	[0133.205] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.rar") returned 0
	[0133.205] lstrlenA (lpString="*.rar") returned 5
	[0133.205] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.7z") returned 0
	[0133.205] lstrlenA (lpString="*.7z") returned 4
	[0133.205] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.tar") returned 0
	[0133.205] lstrlenA (lpString="*.tar") returned 5
	[0133.205] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.gzip") returned 0
	[0133.205] lstrlenA (lpString="*.gzip") returned 6
	[0133.205] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.jpg") returned 0
	[0133.206] lstrlenA (lpString="*.jpg") returned 5
	[0133.206] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.jpeg") returned 0
	[0133.206] lstrlenA (lpString="*.jpeg") returned 6
	[0133.206] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.bmp") returned 0
	[0133.206] lstrlenA (lpString="*.bmp") returned 5
	[0133.206] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.gif") returned 0
	[0133.206] lstrlenA (lpString="*.gif") returned 5
	[0133.206] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.png") returned 0
	[0133.206] lstrlenA (lpString="*.png") returned 5
	[0133.206] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.doc") returned 0
	[0133.206] lstrlenA (lpString="*.doc") returned 5
	[0133.206] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.docx") returned 0
	[0133.206] lstrlenA (lpString="*.docx") returned 6
	[0133.206] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.xls") returned 0
	[0133.206] lstrlenA (lpString="*.xls") returned 5
	[0133.206] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.xlsx") returned 0
	[0133.206] lstrlenA (lpString="*.xlsx") returned 6
	[0133.206] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.ppt") returned 0
	[0133.206] lstrlenA (lpString="*.ppt") returned 5
	[0133.206] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.pptx") returned 0
	[0133.206] lstrlenA (lpString="*.pptx") returned 6
	[0133.206] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.txt") returned 0
	[0133.206] lstrlenA (lpString="*.txt") returned 5
	[0133.206] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.pdf") returned 0
	[0133.206] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.htm") returned 0
	[0133.206] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.html") returned 0
	[0133.206] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.mdb") returned 0
	[0133.206] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.pfx") returned 0
	[0133.206] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.md") returned 0
	[0133.206] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.lnk") returned 0
	[0133.206] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.torrent") returned 0
	[0133.206] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.mov") returned 0
	[0133.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.3gp") returned 0
	[0133.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.mpeg") returned 0
	[0133.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.mpg") returned 0
	[0133.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.flv") returned 0
	[0133.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.avi") returned 0
	[0133.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.mp4") returned 0
	[0133.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.wmv") returned 0
	[0133.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.mkv") returned 0
	[0133.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.mp3") returned 0
	[0133.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.wav") returned 0
	[0133.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.flac") returned 0
	[0133.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.wma") returned 0
	[0133.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.au3") returned 0
	[0133.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.ahk") returned 0
	[0133.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.c") returned 0
	[0133.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.cc") returned 0
	[0133.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.cpp") returned 0
	[0133.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.cxx") returned 0
	[0133.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.c++") returned 0
	[0133.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.cs") returned 0
	[0133.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.vb") returned 0
	[0133.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.bas") returned 0
	[0133.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.csproj") returned 0
	[0133.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.vbproj") returned 0
	[0133.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.vcxproj") returned 0
	[0133.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.manifest") returned 0
	[0133.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.php") returned 0
	[0133.208] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.vbe") returned 0
	[0133.208] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.vba") returned 0
	[0133.208] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.vbs") returned 0
	[0133.208] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.bat") returned 0
	[0133.208] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.cmd") returned 0
	[0133.208] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.js") returned 0
	[0133.208] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.jscript") returned 0
	[0133.208] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.hta") returned 0
	[0133.208] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.php7") returned 0
	[0133.208] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.db") returned 0
	[0133.208] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.swf") returned 0
	[0133.208] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.eml") returned 0
	[0133.208] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.part") returned 0
	[0133.208] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.nfo") returned 0
	[0133.208] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.rsa") returned 0
	[0133.208] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.key") returned 0
	[0133.208] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.aes") returned 0
	[0133.208] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.blob") returned 0
	[0133.208] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.btc") returned 0
	[0133.208] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", pszSpec="*.wallet") returned 0
	[0133.208] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x143f0f49, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x143f0f49, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xb81085d6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="AlternateServices.txt", cAlternateFileName="ALTERN~1.TXT")) returned 1
	[0133.208] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0133.208] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="AlternateServices.txt") returned 1
	[0133.208] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="AlternateServices.txt") returned 1
	[0133.208] lstrcmpiA (lpString1="", lpString2="AlternateServices.txt") returned -1
	[0133.208] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4") returned="addonStartup.json.lz4"
	[0133.208] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\"
	[0133.208] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned=""
	[0133.209] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.209] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\how-to-decrypt-files.htm")) returned 0x20
	[0133.209] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="AlternateServices.txt" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt"
	[0133.209] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt", pszSpec="*.zip") returned 0
	[0133.209] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt", pszSpec="*.rar") returned 0
	[0133.209] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt", pszSpec="*.7z") returned 0
	[0133.209] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt", pszSpec="*.tar") returned 0
	[0133.209] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt", pszSpec="*.gzip") returned 0
	[0133.209] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt", pszSpec="*.jpg") returned 0
	[0133.209] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt", pszSpec="*.jpeg") returned 0
	[0133.209] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt", pszSpec="*.bmp") returned 0
	[0133.209] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt", pszSpec="*.gif") returned 0
	[0133.209] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt", pszSpec="*.png") returned 0
	[0133.209] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt", pszSpec="*.doc") returned 0
	[0133.209] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt", pszSpec="*.docx") returned 0
	[0133.209] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt", pszSpec="*.xls") returned 0
	[0133.209] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt", pszSpec="*.xlsx") returned 0
	[0133.209] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt", pszSpec="*.ppt") returned 0
	[0133.209] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt", pszSpec="*.pptx") returned 0
	[0133.209] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt", pszSpec="*.txt") returned 1
	[0133.209] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt"
	[0133.209] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt"
	[0133.209] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt."
	[0133.209] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt.exe"
	[0133.209] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\alternateservices.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0133.210] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0
	[0133.210] CloseHandle (hObject=0x220) returned 1
	[0133.210] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd843d8c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd843d8c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x200a4780, ftLastWriteTime.dwHighDateTime=0x1d31cd6, nFileSizeHigh=0x0, nFileSizeLow=0x44669, dwReserved0=0x0, dwReserved1=0x0, cFileName="blocklist.xml", cAlternateFileName="BLOCKL~1.XML")) returned 1
	[0133.210] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0133.210] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="blocklist.xml") returned 1
	[0133.210] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="blocklist.xml") returned 1
	[0133.210] lstrcmpiA (lpString1="", lpString2="blocklist.xml") returned -1
	[0133.210] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt") returned="AlternateServices.txt"
	[0133.210] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\"
	[0133.211] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned=""
	[0133.211] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.211] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\how-to-decrypt-files.htm")) returned 0x20
	[0133.212] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="blocklist.xml" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml"
	[0133.212] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.zip") returned 0
	[0133.212] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.rar") returned 0
	[0133.212] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.7z") returned 0
	[0133.212] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.tar") returned 0
	[0133.212] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.gzip") returned 0
	[0133.212] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.jpg") returned 0
	[0133.212] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.jpeg") returned 0
	[0133.212] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.bmp") returned 0
	[0133.212] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.gif") returned 0
	[0133.212] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.png") returned 0
	[0133.212] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.doc") returned 0
	[0133.212] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.docx") returned 0
	[0133.212] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.xls") returned 0
	[0133.212] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.xlsx") returned 0
	[0133.212] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.ppt") returned 0
	[0133.212] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.pptx") returned 0
	[0133.212] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.txt") returned 0
	[0133.212] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.pdf") returned 0
	[0133.212] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.htm") returned 0
	[0133.212] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.html") returned 0
	[0133.212] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.mdb") returned 0
	[0133.212] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.pfx") returned 0
	[0133.212] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.md") returned 0
	[0133.212] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.lnk") returned 0
	[0133.212] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.torrent") returned 0
	[0133.212] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.mov") returned 0
	[0133.213] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.3gp") returned 0
	[0133.213] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.mpeg") returned 0
	[0133.213] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.mpg") returned 0
	[0133.213] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.flv") returned 0
	[0133.213] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.avi") returned 0
	[0133.213] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.mp4") returned 0
	[0133.213] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.wmv") returned 0
	[0133.213] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.mkv") returned 0
	[0133.213] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.mp3") returned 0
	[0133.213] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.wav") returned 0
	[0133.213] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.flac") returned 0
	[0133.213] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.wma") returned 0
	[0133.213] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.au3") returned 0
	[0133.213] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.ahk") returned 0
	[0133.213] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.c") returned 0
	[0133.213] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.cc") returned 0
	[0133.213] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.cpp") returned 0
	[0133.213] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.cxx") returned 0
	[0133.213] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.c++") returned 0
	[0133.213] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.cs") returned 0
	[0133.213] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.vb") returned 0
	[0133.213] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.bas") returned 0
	[0133.213] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.csproj") returned 0
	[0133.213] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.vbproj") returned 0
	[0133.213] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.vcxproj") returned 0
	[0133.213] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.manifest") returned 0
	[0133.213] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.php") returned 0
	[0133.213] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.vbe") returned 0
	[0133.214] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.vba") returned 0
	[0133.214] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.vbs") returned 0
	[0133.214] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.bat") returned 0
	[0133.214] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.cmd") returned 0
	[0133.214] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.js") returned 0
	[0133.214] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.jscript") returned 0
	[0133.214] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.hta") returned 0
	[0133.214] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.php7") returned 0
	[0133.214] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.db") returned 0
	[0133.214] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.swf") returned 0
	[0133.214] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.eml") returned 0
	[0133.214] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.part") returned 0
	[0133.214] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.nfo") returned 0
	[0133.214] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.rsa") returned 0
	[0133.214] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.key") returned 0
	[0133.214] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.aes") returned 0
	[0133.214] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.blob") returned 0
	[0133.214] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.btc") returned 0
	[0133.214] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", pszSpec="*.wallet") returned 0
	[0133.214] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe9b352a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe9b352a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfe9b352a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="bookmarkbackups", cAlternateFileName="BOOKMA~1")) returned 1
	[0133.214] lstrcmpA (lpString1=".", lpString2="bookmarkbackups") returned -1
	[0133.214] lstrcmpA (lpString1="..", lpString2="bookmarkbackups") returned -1
	[0133.214] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml") returned="blocklist.xml"
	[0133.214] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="bookmarkbackups" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\bookmarkbackups") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\bookmarkbackups"
	[0133.214] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\bookmarkbackups\\*.*", lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe9b352a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe9b352a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfe9b352a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0xd8, cFileName=".", cAlternateFileName="")) returned 0x7cb890
	[0133.215] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.215] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe9b352a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe9b352a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfe9b352a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0xd8, cFileName="..", cAlternateFileName="")) returned 1
	[0133.215] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.215] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.215] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe9b352a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe9b352a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfe9b352a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0xd8, cFileName="..", cAlternateFileName="")) returned 0
	[0133.215] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1
	[0133.215] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe645e15, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe645e15, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb81085d6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="cert8.db", cAlternateFileName="")) returned 1
	[0133.215] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0133.215] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="cert8.db") returned 1
	[0133.215] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="cert8.db") returned 1
	[0133.215] lstrcmpiA (lpString1="", lpString2="cert8.db") returned -1
	[0133.215] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\*.*") returned="*.*"
	[0133.215] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\"
	[0133.215] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned=""
	[0133.216] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.216] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\how-to-decrypt-files.htm")) returned 0x20
	[0133.216] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="cert8.db" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db"
	[0133.216] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db", pszSpec="*.zip") returned 0
	[0133.216] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db", pszSpec="*.rar") returned 0
	[0133.216] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db", pszSpec="*.7z") returned 0
	[0133.216] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db", pszSpec="*.tar") returned 0
	[0133.216] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db", pszSpec="*.gzip") returned 0
	[0133.216] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db", pszSpec="*.jpg") returned 0
	[0133.216] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db", pszSpec="*.jpeg") returned 0
	[0133.216] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db", pszSpec="*.bmp") returned 0
	[0133.216] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db", pszSpec="*.gif") returned 0
	[0133.216] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db", pszSpec="*.png") returned 0
	[0133.216] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db", pszSpec="*.doc") returned 0
	[0133.216] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db", pszSpec="*.docx") returned 0
	[0133.216] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db", pszSpec="*.xls") returned 0
	[0133.216] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db"
	[0133.216] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db"
	[0133.216] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db."
	[0133.217] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db.exe"
	[0133.217] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cert8.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0133.217] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10000
	[0133.217] GetFileTime (in: hFile=0x220, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xfe645e15, dwHighDateTime=0x1d327c9), lpLastAccessTime=0x407536*(dwLowDateTime=0xfe645e15, dwHighDateTime=0x1d327c9), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb81085d6, dwHighDateTime=0x1d327cc)) returned 1
	[0133.217] SetFilePointer (in: hFile=0x220, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.217] ReadFile (in: hFile=0x220, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xffbe, lpOverlapped=0x0) returned 1
	[0133.219] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db") returned="cert8.db"
	[0133.219] SetFilePointer (in: hFile=0x220, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.219] WriteFile (in: hFile=0x220, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xffbe, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xffbe, lpOverlapped=0x0) returned 1
	[0133.220] SetFileTime (hFile=0x220, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.220] CloseHandle (hObject=0x220) returned 1
	[0133.220] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cert8.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cert8.db.exe")) returned 1
	[0133.221] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x400ce751, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="compatibility.ini", cAlternateFileName="COMPAT~1.INI")) returned 1
	[0133.221] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0133.221] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="compatibility.ini") returned 1
	[0133.221] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="compatibility.ini") returned 1
	[0133.221] lstrcmpiA (lpString1="", lpString2="compatibility.ini") returned -1
	[0133.221] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db") returned="cert8.db"
	[0133.221] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\"
	[0133.221] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned=""
	[0133.221] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.221] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\how-to-decrypt-files.htm")) returned 0x20
	[0133.221] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="compatibility.ini" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini"
	[0133.221] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.zip") returned 0
	[0133.221] lstrlenA (lpString="*.zip") returned 5
	[0133.221] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.rar") returned 0
	[0133.221] lstrlenA (lpString="*.rar") returned 5
	[0133.221] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.7z") returned 0
	[0133.221] lstrlenA (lpString="*.7z") returned 4
	[0133.221] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.tar") returned 0
	[0133.221] lstrlenA (lpString="*.tar") returned 5
	[0133.221] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.gzip") returned 0
	[0133.221] lstrlenA (lpString="*.gzip") returned 6
	[0133.221] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.jpg") returned 0
	[0133.221] lstrlenA (lpString="*.jpg") returned 5
	[0133.221] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.jpeg") returned 0
	[0133.221] lstrlenA (lpString="*.jpeg") returned 6
	[0133.221] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.bmp") returned 0
	[0133.221] lstrlenA (lpString="*.bmp") returned 5
	[0133.221] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.gif") returned 0
	[0133.221] lstrlenA (lpString="*.gif") returned 5
	[0133.221] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.png") returned 0
	[0133.221] lstrlenA (lpString="*.png") returned 5
	[0133.221] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.doc") returned 0
	[0133.222] lstrlenA (lpString="*.doc") returned 5
	[0133.222] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.docx") returned 0
	[0133.222] lstrlenA (lpString="*.docx") returned 6
	[0133.222] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.xls") returned 0
	[0133.222] lstrlenA (lpString="*.xls") returned 5
	[0133.222] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.xlsx") returned 0
	[0133.222] lstrlenA (lpString="*.xlsx") returned 6
	[0133.222] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.ppt") returned 0
	[0133.222] lstrlenA (lpString="*.ppt") returned 5
	[0133.222] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.pptx") returned 0
	[0133.222] lstrlenA (lpString="*.pptx") returned 6
	[0133.222] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.txt") returned 0
	[0133.222] lstrlenA (lpString="*.txt") returned 5
	[0133.222] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.pdf") returned 0
	[0133.222] lstrlenA (lpString="*.pdf") returned 5
	[0133.222] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.htm") returned 0
	[0133.222] lstrlenA (lpString="*.htm") returned 5
	[0133.222] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.html") returned 0
	[0133.222] lstrlenA (lpString="*.html") returned 6
	[0133.222] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.mdb") returned 0
	[0133.222] lstrlenA (lpString="*.mdb") returned 5
	[0133.222] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.pfx") returned 0
	[0133.222] lstrlenA (lpString="*.pfx") returned 5
	[0133.222] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.md") returned 0
	[0133.222] lstrlenA (lpString="*.md") returned 4
	[0133.222] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.lnk") returned 0
	[0133.222] lstrlenA (lpString="*.lnk") returned 5
	[0133.222] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.torrent") returned 0
	[0133.222] lstrlenA (lpString="*.torrent") returned 9
	[0133.222] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.mov") returned 0
	[0133.222] lstrlenA (lpString="*.mov") returned 5
	[0133.222] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.3gp") returned 0
	[0133.222] lstrlenA (lpString="*.3gp") returned 5
	[0133.222] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.mpeg") returned 0
	[0133.222] lstrlenA (lpString="*.mpeg") returned 6
	[0133.222] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.mpg") returned 0
	[0133.222] lstrlenA (lpString="*.mpg") returned 5
	[0133.223] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.flv") returned 0
	[0133.223] lstrlenA (lpString="*.flv") returned 5
	[0133.223] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.avi") returned 0
	[0133.223] lstrlenA (lpString="*.avi") returned 5
	[0133.223] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.mp4") returned 0
	[0133.223] lstrlenA (lpString="*.mp4") returned 5
	[0133.223] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.wmv") returned 0
	[0133.223] lstrlenA (lpString="*.wmv") returned 5
	[0133.223] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.mkv") returned 0
	[0133.223] lstrlenA (lpString="*.mkv") returned 5
	[0133.223] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.mp3") returned 0
	[0133.223] lstrlenA (lpString="*.mp3") returned 5
	[0133.223] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.wav") returned 0
	[0133.223] lstrlenA (lpString="*.wav") returned 5
	[0133.223] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.flac") returned 0
	[0133.223] lstrlenA (lpString="*.flac") returned 6
	[0133.223] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.wma") returned 0
	[0133.223] lstrlenA (lpString="*.wma") returned 5
	[0133.223] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.au3") returned 0
	[0133.223] lstrlenA (lpString="*.au3") returned 5
	[0133.223] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.ahk") returned 0
	[0133.223] lstrlenA (lpString="*.ahk") returned 5
	[0133.223] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.c") returned 0
	[0133.223] lstrlenA (lpString="*.c") returned 3
	[0133.223] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.cc") returned 0
	[0133.223] lstrlenA (lpString="*.cc") returned 4
	[0133.223] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.cpp") returned 0
	[0133.223] lstrlenA (lpString="*.cpp") returned 5
	[0133.223] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.cxx") returned 0
	[0133.223] lstrlenA (lpString="*.cxx") returned 5
	[0133.223] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.c++") returned 0
	[0133.223] lstrlenA (lpString="*.c++") returned 5
	[0133.223] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.cs") returned 0
	[0133.223] lstrlenA (lpString="*.cs") returned 4
	[0133.224] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.vb") returned 0
	[0133.224] lstrlenA (lpString="*.vb") returned 4
	[0133.224] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.bas") returned 0
	[0133.224] lstrlenA (lpString="*.bas") returned 5
	[0133.224] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.csproj") returned 0
	[0133.224] lstrlenA (lpString="*.csproj") returned 8
	[0133.224] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.vbproj") returned 0
	[0133.224] lstrlenA (lpString="*.vbproj") returned 8
	[0133.224] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.vcxproj") returned 0
	[0133.224] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.224] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.manifest") returned 0
	[0133.224] lstrlenA (lpString="*.manifest") returned 10
	[0133.224] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.php") returned 0
	[0133.224] lstrlenA (lpString="*.php") returned 5
	[0133.224] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.vbe") returned 0
	[0133.224] lstrlenA (lpString="*.vbe") returned 5
	[0133.224] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.vba") returned 0
	[0133.224] lstrlenA (lpString="*.vba") returned 5
	[0133.224] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.vbs") returned 0
	[0133.224] lstrlenA (lpString="*.vbs") returned 5
	[0133.224] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.bat") returned 0
	[0133.224] lstrlenA (lpString="*.bat") returned 5
	[0133.224] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.cmd") returned 0
	[0133.224] lstrlenA (lpString="*.cmd") returned 5
	[0133.224] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.js") returned 0
	[0133.224] lstrlenA (lpString="*.js") returned 4
	[0133.224] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.jscript") returned 0
	[0133.224] lstrlenA (lpString="*.jscript") returned 9
	[0133.224] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.hta") returned 0
	[0133.224] lstrlenA (lpString="*.hta") returned 5
	[0133.224] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.php7") returned 0
	[0133.224] lstrlenA (lpString="*.php7") returned 6
	[0133.224] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.db") returned 0
	[0133.224] lstrlenA (lpString="*.db") returned 4
	[0133.224] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.swf") returned 0
	[0133.225] lstrlenA (lpString="*.swf") returned 5
	[0133.225] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.eml") returned 0
	[0133.225] lstrlenA (lpString="*.eml") returned 5
	[0133.225] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.part") returned 0
	[0133.225] lstrlenA (lpString="*.part") returned 6
	[0133.225] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.nfo") returned 0
	[0133.225] lstrlenA (lpString="*.nfo") returned 5
	[0133.225] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.rsa") returned 0
	[0133.225] lstrlenA (lpString="*.rsa") returned 5
	[0133.225] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.key") returned 0
	[0133.225] lstrlenA (lpString="*.key") returned 5
	[0133.225] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.aes") returned 0
	[0133.225] lstrlenA (lpString="*.aes") returned 5
	[0133.225] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.blob") returned 0
	[0133.225] lstrlenA (lpString="*.blob") returned 6
	[0133.225] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.btc") returned 0
	[0133.225] lstrlenA (lpString="*.btc") returned 5
	[0133.225] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", pszSpec="*.wallet") returned 0
	[0133.225] lstrlenA (lpString="*.wallet") returned 8
	[0133.225] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9a54e3, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xff9a54e3, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xff9a54e3, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x329, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="containers.json", cAlternateFileName="CONTAI~1.JSO")) returned 1
	[0133.225] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0133.225] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="containers.json") returned 1
	[0133.225] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="containers.json") returned 1
	[0133.225] lstrcmpiA (lpString1="", lpString2="containers.json") returned -1
	[0133.225] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini") returned="compatibility.ini"
	[0133.225] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\"
	[0133.225] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned=""
	[0133.225] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.225] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\how-to-decrypt-files.htm")) returned 0x20
	[0133.225] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="containers.json" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json"
	[0133.225] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.zip") returned 0
	[0133.226] lstrlenA (lpString="*.zip") returned 5
	[0133.226] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.rar") returned 0
	[0133.226] lstrlenA (lpString="*.rar") returned 5
	[0133.226] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.7z") returned 0
	[0133.226] lstrlenA (lpString="*.7z") returned 4
	[0133.226] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.tar") returned 0
	[0133.226] lstrlenA (lpString="*.tar") returned 5
	[0133.226] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.gzip") returned 0
	[0133.226] lstrlenA (lpString="*.gzip") returned 6
	[0133.226] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.jpg") returned 0
	[0133.226] lstrlenA (lpString="*.jpg") returned 5
	[0133.226] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.jpeg") returned 0
	[0133.226] lstrlenA (lpString="*.jpeg") returned 6
	[0133.226] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.bmp") returned 0
	[0133.226] lstrlenA (lpString="*.bmp") returned 5
	[0133.226] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.gif") returned 0
	[0133.226] lstrlenA (lpString="*.gif") returned 5
	[0133.226] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.png") returned 0
	[0133.226] lstrlenA (lpString="*.png") returned 5
	[0133.226] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.doc") returned 0
	[0133.226] lstrlenA (lpString="*.doc") returned 5
	[0133.226] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.docx") returned 0
	[0133.226] lstrlenA (lpString="*.docx") returned 6
	[0133.227] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.xls") returned 0
	[0133.227] lstrlenA (lpString="*.xls") returned 5
	[0133.227] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.xlsx") returned 0
	[0133.227] lstrlenA (lpString="*.xlsx") returned 6
	[0133.227] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.ppt") returned 0
	[0133.227] lstrlenA (lpString="*.ppt") returned 5
	[0133.227] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.pptx") returned 0
	[0133.227] lstrlenA (lpString="*.pptx") returned 6
	[0133.227] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.txt") returned 0
	[0133.227] lstrlenA (lpString="*.txt") returned 5
	[0133.227] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.pdf") returned 0
	[0133.227] lstrlenA (lpString="*.pdf") returned 5
	[0133.227] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.htm") returned 0
	[0133.227] lstrlenA (lpString="*.htm") returned 5
	[0133.227] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.html") returned 0
	[0133.227] lstrlenA (lpString="*.html") returned 6
	[0133.227] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.mdb") returned 0
	[0133.227] lstrlenA (lpString="*.mdb") returned 5
	[0133.227] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.pfx") returned 0
	[0133.227] lstrlenA (lpString="*.pfx") returned 5
	[0133.227] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.md") returned 0
	[0133.227] lstrlenA (lpString="*.md") returned 4
	[0133.227] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.lnk") returned 0
	[0133.227] lstrlenA (lpString="*.lnk") returned 5
	[0133.227] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.torrent") returned 0
	[0133.227] lstrlenA (lpString="*.torrent") returned 9
	[0133.227] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.mov") returned 0
	[0133.227] lstrlenA (lpString="*.mov") returned 5
	[0133.227] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.3gp") returned 0
	[0133.228] lstrlenA (lpString="*.3gp") returned 5
	[0133.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.mpeg") returned 0
	[0133.228] lstrlenA (lpString="*.mpeg") returned 6
	[0133.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.mpg") returned 0
	[0133.228] lstrlenA (lpString="*.mpg") returned 5
	[0133.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.flv") returned 0
	[0133.228] lstrlenA (lpString="*.flv") returned 5
	[0133.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.avi") returned 0
	[0133.228] lstrlenA (lpString="*.avi") returned 5
	[0133.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.mp4") returned 0
	[0133.228] lstrlenA (lpString="*.mp4") returned 5
	[0133.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.wmv") returned 0
	[0133.228] lstrlenA (lpString="*.wmv") returned 5
	[0133.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.mkv") returned 0
	[0133.228] lstrlenA (lpString="*.mkv") returned 5
	[0133.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.mp3") returned 0
	[0133.228] lstrlenA (lpString="*.mp3") returned 5
	[0133.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.wav") returned 0
	[0133.228] lstrlenA (lpString="*.wav") returned 5
	[0133.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.flac") returned 0
	[0133.228] lstrlenA (lpString="*.flac") returned 6
	[0133.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.wma") returned 0
	[0133.228] lstrlenA (lpString="*.wma") returned 5
	[0133.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.au3") returned 0
	[0133.228] lstrlenA (lpString="*.au3") returned 5
	[0133.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.ahk") returned 0
	[0133.228] lstrlenA (lpString="*.ahk") returned 5
	[0133.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.c") returned 0
	[0133.228] lstrlenA (lpString="*.c") returned 3
	[0133.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.cc") returned 0
	[0133.228] lstrlenA (lpString="*.cc") returned 4
	[0133.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.cpp") returned 0
	[0133.228] lstrlenA (lpString="*.cpp") returned 5
	[0133.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.cxx") returned 0
	[0133.228] lstrlenA (lpString="*.cxx") returned 5
	[0133.229] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.c++") returned 0
	[0133.229] lstrlenA (lpString="*.c++") returned 5
	[0133.229] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.cs") returned 0
	[0133.229] lstrlenA (lpString="*.cs") returned 4
	[0133.229] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.vb") returned 0
	[0133.229] lstrlenA (lpString="*.vb") returned 4
	[0133.229] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.bas") returned 0
	[0133.229] lstrlenA (lpString="*.bas") returned 5
	[0133.229] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.csproj") returned 0
	[0133.229] lstrlenA (lpString="*.csproj") returned 8
	[0133.229] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.vbproj") returned 0
	[0133.229] lstrlenA (lpString="*.vbproj") returned 8
	[0133.229] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.vcxproj") returned 0
	[0133.229] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.229] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.manifest") returned 0
	[0133.229] lstrlenA (lpString="*.manifest") returned 10
	[0133.229] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.php") returned 0
	[0133.229] lstrlenA (lpString="*.php") returned 5
	[0133.229] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.vbe") returned 0
	[0133.229] lstrlenA (lpString="*.vbe") returned 5
	[0133.229] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.vba") returned 0
	[0133.229] lstrlenA (lpString="*.vba") returned 5
	[0133.229] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.vbs") returned 0
	[0133.229] lstrlenA (lpString="*.vbs") returned 5
	[0133.229] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.bat") returned 0
	[0133.229] lstrlenA (lpString="*.bat") returned 5
	[0133.229] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.cmd") returned 0
	[0133.229] lstrlenA (lpString="*.cmd") returned 5
	[0133.229] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.js") returned 0
	[0133.229] lstrlenA (lpString="*.js") returned 4
	[0133.229] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.jscript") returned 0
	[0133.229] lstrlenA (lpString="*.jscript") returned 9
	[0133.229] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.hta") returned 0
	[0133.229] lstrlenA (lpString="*.hta") returned 5
	[0133.229] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.php7") returned 0
	[0133.230] lstrlenA (lpString="*.php7") returned 6
	[0133.230] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.db") returned 0
	[0133.230] lstrlenA (lpString="*.db") returned 4
	[0133.230] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.swf") returned 0
	[0133.230] lstrlenA (lpString="*.swf") returned 5
	[0133.230] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.eml") returned 0
	[0133.230] lstrlenA (lpString="*.eml") returned 5
	[0133.230] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.part") returned 0
	[0133.230] lstrlenA (lpString="*.part") returned 6
	[0133.230] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.nfo") returned 0
	[0133.230] lstrlenA (lpString="*.nfo") returned 5
	[0133.230] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.rsa") returned 0
	[0133.230] lstrlenA (lpString="*.rsa") returned 5
	[0133.230] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.key") returned 0
	[0133.230] lstrlenA (lpString="*.key") returned 5
	[0133.230] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.aes") returned 0
	[0133.230] lstrlenA (lpString="*.aes") returned 5
	[0133.230] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.blob") returned 0
	[0133.230] lstrlenA (lpString="*.blob") returned 6
	[0133.230] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.btc") returned 0
	[0133.230] lstrlenA (lpString="*.btc") returned 5
	[0133.230] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", pszSpec="*.wallet") returned 0
	[0133.230] lstrlenA (lpString="*.wallet") returned 8
	[0133.230] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff97f27a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xff97f27a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x439749, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x38000, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="content-prefs.sqlite", cAlternateFileName="CONTEN~1.SQL")) returned 1
	[0133.230] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0133.230] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="content-prefs.sqlite") returned 1
	[0133.230] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="content-prefs.sqlite") returned 1
	[0133.230] lstrcmpiA (lpString1="", lpString2="content-prefs.sqlite") returned -1
	[0133.230] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json") returned="containers.json"
	[0133.230] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\"
	[0133.230] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned=""
	[0133.230] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.231] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\how-to-decrypt-files.htm")) returned 0x20
	[0133.231] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="content-prefs.sqlite" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite"
	[0133.231] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.zip") returned 0
	[0133.231] lstrlenA (lpString="*.zip") returned 5
	[0133.231] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.rar") returned 0
	[0133.231] lstrlenA (lpString="*.rar") returned 5
	[0133.231] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.7z") returned 0
	[0133.231] lstrlenA (lpString="*.7z") returned 4
	[0133.231] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.tar") returned 0
	[0133.231] lstrlenA (lpString="*.tar") returned 5
	[0133.231] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.gzip") returned 0
	[0133.231] lstrlenA (lpString="*.gzip") returned 6
	[0133.231] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.jpg") returned 0
	[0133.231] lstrlenA (lpString="*.jpg") returned 5
	[0133.231] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.jpeg") returned 0
	[0133.231] lstrlenA (lpString="*.jpeg") returned 6
	[0133.231] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.bmp") returned 0
	[0133.231] lstrlenA (lpString="*.bmp") returned 5
	[0133.231] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.gif") returned 0
	[0133.231] lstrlenA (lpString="*.gif") returned 5
	[0133.231] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.png") returned 0
	[0133.231] lstrlenA (lpString="*.png") returned 5
	[0133.231] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.doc") returned 0
	[0133.231] lstrlenA (lpString="*.doc") returned 5
	[0133.231] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.docx") returned 0
	[0133.231] lstrlenA (lpString="*.docx") returned 6
	[0133.231] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.xls") returned 0
	[0133.231] lstrlenA (lpString="*.xls") returned 5
	[0133.231] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.xlsx") returned 0
	[0133.231] lstrlenA (lpString="*.xlsx") returned 6
	[0133.231] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.ppt") returned 0
	[0133.231] lstrlenA (lpString="*.ppt") returned 5
	[0133.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.pptx") returned 0
	[0133.232] lstrlenA (lpString="*.pptx") returned 6
	[0133.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.txt") returned 0
	[0133.232] lstrlenA (lpString="*.txt") returned 5
	[0133.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.pdf") returned 0
	[0133.232] lstrlenA (lpString="*.pdf") returned 5
	[0133.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.htm") returned 0
	[0133.232] lstrlenA (lpString="*.htm") returned 5
	[0133.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.html") returned 0
	[0133.232] lstrlenA (lpString="*.html") returned 6
	[0133.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.mdb") returned 0
	[0133.232] lstrlenA (lpString="*.mdb") returned 5
	[0133.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.pfx") returned 0
	[0133.232] lstrlenA (lpString="*.pfx") returned 5
	[0133.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.md") returned 0
	[0133.232] lstrlenA (lpString="*.md") returned 4
	[0133.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.lnk") returned 0
	[0133.232] lstrlenA (lpString="*.lnk") returned 5
	[0133.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.torrent") returned 0
	[0133.232] lstrlenA (lpString="*.torrent") returned 9
	[0133.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.mov") returned 0
	[0133.232] lstrlenA (lpString="*.mov") returned 5
	[0133.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.3gp") returned 0
	[0133.232] lstrlenA (lpString="*.3gp") returned 5
	[0133.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.mpeg") returned 0
	[0133.232] lstrlenA (lpString="*.mpeg") returned 6
	[0133.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.mpg") returned 0
	[0133.232] lstrlenA (lpString="*.mpg") returned 5
	[0133.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.flv") returned 0
	[0133.232] lstrlenA (lpString="*.flv") returned 5
	[0133.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.avi") returned 0
	[0133.232] lstrlenA (lpString="*.avi") returned 5
	[0133.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.mp4") returned 0
	[0133.232] lstrlenA (lpString="*.mp4") returned 5
	[0133.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.wmv") returned 0
	[0133.233] lstrlenA (lpString="*.wmv") returned 5
	[0133.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.mkv") returned 0
	[0133.233] lstrlenA (lpString="*.mkv") returned 5
	[0133.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.mp3") returned 0
	[0133.233] lstrlenA (lpString="*.mp3") returned 5
	[0133.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.wav") returned 0
	[0133.233] lstrlenA (lpString="*.wav") returned 5
	[0133.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.flac") returned 0
	[0133.233] lstrlenA (lpString="*.flac") returned 6
	[0133.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.wma") returned 0
	[0133.233] lstrlenA (lpString="*.wma") returned 5
	[0133.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.au3") returned 0
	[0133.233] lstrlenA (lpString="*.au3") returned 5
	[0133.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.ahk") returned 0
	[0133.233] lstrlenA (lpString="*.ahk") returned 5
	[0133.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.c") returned 0
	[0133.233] lstrlenA (lpString="*.c") returned 3
	[0133.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.cc") returned 0
	[0133.233] lstrlenA (lpString="*.cc") returned 4
	[0133.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.cpp") returned 0
	[0133.233] lstrlenA (lpString="*.cpp") returned 5
	[0133.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.cxx") returned 0
	[0133.233] lstrlenA (lpString="*.cxx") returned 5
	[0133.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.c++") returned 0
	[0133.233] lstrlenA (lpString="*.c++") returned 5
	[0133.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.cs") returned 0
	[0133.233] lstrlenA (lpString="*.cs") returned 4
	[0133.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.vb") returned 0
	[0133.233] lstrlenA (lpString="*.vb") returned 4
	[0133.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.bas") returned 0
	[0133.233] lstrlenA (lpString="*.bas") returned 5
	[0133.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.csproj") returned 0
	[0133.233] lstrlenA (lpString="*.csproj") returned 8
	[0133.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.vbproj") returned 0
	[0133.233] lstrlenA (lpString="*.vbproj") returned 8
	[0133.234] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.vcxproj") returned 0
	[0133.234] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.234] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.manifest") returned 0
	[0133.234] lstrlenA (lpString="*.manifest") returned 10
	[0133.234] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.php") returned 0
	[0133.234] lstrlenA (lpString="*.php") returned 5
	[0133.234] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.vbe") returned 0
	[0133.234] lstrlenA (lpString="*.vbe") returned 5
	[0133.234] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.vba") returned 0
	[0133.234] lstrlenA (lpString="*.vba") returned 5
	[0133.234] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.vbs") returned 0
	[0133.234] lstrlenA (lpString="*.vbs") returned 5
	[0133.234] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.bat") returned 0
	[0133.234] lstrlenA (lpString="*.bat") returned 5
	[0133.234] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.cmd") returned 0
	[0133.234] lstrlenA (lpString="*.cmd") returned 5
	[0133.234] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.js") returned 0
	[0133.234] lstrlenA (lpString="*.js") returned 4
	[0133.234] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.jscript") returned 0
	[0133.234] lstrlenA (lpString="*.jscript") returned 9
	[0133.234] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.hta") returned 0
	[0133.234] lstrlenA (lpString="*.hta") returned 5
	[0133.234] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.php7") returned 0
	[0133.234] lstrlenA (lpString="*.php7") returned 6
	[0133.234] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.db") returned 0
	[0133.234] lstrlenA (lpString="*.db") returned 4
	[0133.234] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.swf") returned 0
	[0133.234] lstrlenA (lpString="*.swf") returned 5
	[0133.234] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.eml") returned 0
	[0133.234] lstrlenA (lpString="*.eml") returned 5
	[0133.234] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.part") returned 0
	[0133.234] lstrlenA (lpString="*.part") returned 6
	[0133.234] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.nfo") returned 0
	[0133.234] lstrlenA (lpString="*.nfo") returned 5
	[0133.235] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.rsa") returned 0
	[0133.235] lstrlenA (lpString="*.rsa") returned 5
	[0133.235] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.key") returned 0
	[0133.235] lstrlenA (lpString="*.key") returned 5
	[0133.235] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.aes") returned 0
	[0133.235] lstrlenA (lpString="*.aes") returned 5
	[0133.235] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.blob") returned 0
	[0133.235] lstrlenA (lpString="*.blob") returned 6
	[0133.235] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.btc") returned 0
	[0133.235] lstrlenA (lpString="*.btc") returned 5
	[0133.235] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", pszSpec="*.wallet") returned 0
	[0133.235] lstrlenA (lpString="*.wallet") returned 8
	[0133.235] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ef1bce, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x1ef1bce, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xb81085d6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="cookies.sqlite", cAlternateFileName="COOKIE~1.SQL")) returned 1
	[0133.235] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0133.235] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="cookies.sqlite") returned 1
	[0133.235] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="cookies.sqlite") returned 1
	[0133.235] lstrcmpiA (lpString1="", lpString2="cookies.sqlite") returned -1
	[0133.235] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite") returned="content-prefs.sqlite"
	[0133.235] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\"
	[0133.235] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned=""
	[0133.235] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.235] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\how-to-decrypt-files.htm")) returned 0x20
	[0133.235] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="cookies.sqlite" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite"
	[0133.235] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite", pszSpec="*.zip") returned 0
	[0133.235] lstrlenA (lpString="*.zip") returned 5
	[0133.235] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite", pszSpec="*.rar") returned 0
	[0133.235] lstrlenA (lpString="*.rar") returned 5
	[0133.235] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite", pszSpec="*.7z") returned 0
	[0133.235] lstrlenA (lpString="*.7z") returned 4
	[0133.235] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite", pszSpec="*.tar") returned 0
	[0133.235] lstrlenA (lpString="*.tar") returned 5
	[0133.236] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite", pszSpec="*.gzip") returned 0
	[0133.236] lstrlenA (lpString="*.gzip") returned 6
	[0133.236] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite", pszSpec="*.jpg") returned 0
	[0133.236] lstrlenA (lpString="*.jpg") returned 5
	[0133.236] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite", pszSpec="*.jpeg") returned 0
	[0133.236] lstrlenA (lpString="*.jpeg") returned 6
	[0133.236] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite", pszSpec="*.bmp") returned 0
	[0133.236] lstrlenA (lpString="*.bmp") returned 5
	[0133.236] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite", pszSpec="*.gif") returned 0
	[0133.236] lstrlenA (lpString="*.gif") returned 5
	[0133.236] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite", pszSpec="*.png") returned 0
	[0133.236] lstrlenA (lpString="*.png") returned 5
	[0133.236] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite", pszSpec="*.doc") returned 0
	[0133.236] lstrlenA (lpString="*.doc") returned 5
	[0133.236] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite", pszSpec="*.docx") returned 0
	[0133.236] lstrlenA (lpString="*.docx") returned 6
	[0133.236] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite", pszSpec="*.xls") returned 0
	[0133.236] lstrlenA (lpString="*.xls") returned 5
	[0133.236] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite", pszSpec="*.xlsx") returned 0
	[0133.236] lstrlenA (lpString="*.xlsx") returned 6
	[0133.236] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite", pszSpec="*.ppt") returned 0
	[0133.236] lstrlenA (lpString="*.ppt") returned 5
	[0133.236] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite", pszSpec="*.pptx") returned 0
	[0133.236] lstrlenA (lpString="*.pptx") returned 6
	[0133.236] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite", pszSpec="*.txt") returned 0
	[0133.236] lstrlenA (lpString="*.txt") returned 5
	[0133.236] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite", pszSpec="*.pdf") returned 0
	[0133.236] lstrlenA (lpString="*.pdf") returned 5
	[0133.236] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite", pszSpec="*.htm") returned 0
	[0133.236] lstrlenA (lpString="*.htm") returned 5
	[0133.236] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite", pszSpec="*.html") returned 0
	[0133.236] lstrlenA (lpString="*.html") returned 6
	[0133.236] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite", pszSpec="*.mdb") returned 0
	[0133.236] lstrlenA (lpString="*.mdb") returned 5
	[0133.236] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite", pszSpec="*.pfx") returned 0
	[0133.237] lstrlenA (lpString="*.pfx") returned 5
	[0133.237] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite", pszSpec="*.md") returned 0
	[0133.237] lstrlenA (lpString="*.md") returned 4
	[0133.237] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite", pszSpec="*.lnk") returned 0
	[0133.237] lstrlenA (lpString="*.lnk") returned 5
	[0133.237] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite", pszSpec="*.torrent") returned 0
	[0133.237] lstrlenA (lpString="*.torrent") returned 9
	[0133.237] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite", pszSpec="*.mov") returned 0
	[0133.237] lstrlenA (lpString="*.mov") returned 5
	[0133.237] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite", pszSpec="*.3gp") returned 0
	[0133.237] lstrlenA (lpString="*.3gp") returned 5
	[0133.237] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite", pszSpec="*.mpeg") returned 0
	[0133.237] lstrlenA (lpString="*.mpeg") returned 6
	[0133.237] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite", pszSpec="*.mpg") returned 0
	[0133.237] lstrlenA (lpString="*.mpg") returned 5
	[0133.237] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite", pszSpec="*.flv") returned 0
	[0133.237] lstrlenA (lpString="*.flv") returned 5
	[0133.237] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x2923a75e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x2923a75e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="crashes", cAlternateFileName="")) returned 1
	[0133.237] lstrcmpA (lpString1=".", lpString2="crashes") returned -1
	[0133.237] lstrcmpA (lpString1="..", lpString2="crashes") returned -1
	[0133.237] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite") returned="cookies.sqlite"
	[0133.237] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="crashes" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes"
	[0133.237] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\*.*", lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x2923a75e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x2923a75e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0xd8, cFileName=".", cAlternateFileName="")) returned 0x7cb910
	[0133.239] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.239] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x2923a75e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x2923a75e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0xd8, cFileName="..", cAlternateFileName="")) returned 1
	[0133.239] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.239] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.239] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0xd8, cFileName="events", cAlternateFileName="")) returned 1
	[0133.240] lstrcmpA (lpString1=".", lpString2="events") returned -1
	[0133.240] lstrcmpA (lpString1="..", lpString2="events") returned -1
	[0133.240] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\*.*") returned="*.*"
	[0133.240] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\", lpString2="events" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\events") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\events"
	[0133.240] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\events\\*.*", lpFindFileData=0x19f110 | out: lpFindFileData=0x19f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cb990
	[0133.240] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.240] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f110 | out: lpFindFileData=0x19f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0133.240] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.240] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.240] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f110 | out: lpFindFileData=0x19f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 0
	[0133.240] FindClose (in: hFindFile=0x7cb990 | out: hFindFile=0x7cb990) returned 1
	[0133.240] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2923a75e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x2923a75e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x2923a75e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x42, dwReserved0=0x7b0000, dwReserved1=0xd8, cFileName="store.json.mozlz4", cAlternateFileName="STOREJ~1.MOZ")) returned 1
	[0133.240] PeekMessageA (in: lpMsg=0x19f23c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f23c) returned 0
	[0133.240] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="store.json.mozlz4") returned -1
	[0133.240] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="store.json.mozlz4") returned -1
	[0133.240] lstrcmpiA (lpString1="", lpString2="store.json.mozlz4") returned -1
	[0133.240] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\*.*") returned="*.*"
	[0133.240] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\"
	[0133.240] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\") returned=""
	[0133.240] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.240] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\crashes\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0133.241] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\crashes\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224
	[0133.241] WriteFile (in: hFile=0x224, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0133.242] SetFileTime (hFile=0x224, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0133.242] CloseHandle (hObject=0x224) returned 1
	[0133.242] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\", lpString2="store.json.mozlz4" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4"
	[0133.242] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.zip") returned 0
	[0133.242] lstrlenA (lpString="*.zip") returned 5
	[0133.242] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.rar") returned 0
	[0133.242] lstrlenA (lpString="*.rar") returned 5
	[0133.242] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.7z") returned 0
	[0133.243] lstrlenA (lpString="*.7z") returned 4
	[0133.243] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.tar") returned 0
	[0133.243] lstrlenA (lpString="*.tar") returned 5
	[0133.243] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.gzip") returned 0
	[0133.243] lstrlenA (lpString="*.gzip") returned 6
	[0133.243] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.jpg") returned 0
	[0133.243] lstrlenA (lpString="*.jpg") returned 5
	[0133.243] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.jpeg") returned 0
	[0133.243] lstrlenA (lpString="*.jpeg") returned 6
	[0133.243] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.bmp") returned 0
	[0133.243] lstrlenA (lpString="*.bmp") returned 5
	[0133.243] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.gif") returned 0
	[0133.243] lstrlenA (lpString="*.gif") returned 5
	[0133.243] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.png") returned 0
	[0133.243] lstrlenA (lpString="*.png") returned 5
	[0133.243] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.doc") returned 0
	[0133.243] lstrlenA (lpString="*.doc") returned 5
	[0133.243] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.docx") returned 0
	[0133.243] lstrlenA (lpString="*.docx") returned 6
	[0133.243] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.xls") returned 0
	[0133.243] lstrlenA (lpString="*.xls") returned 5
	[0133.243] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.xlsx") returned 0
	[0133.243] lstrlenA (lpString="*.xlsx") returned 6
	[0133.243] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.ppt") returned 0
	[0133.243] lstrlenA (lpString="*.ppt") returned 5
	[0133.243] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.pptx") returned 0
	[0133.243] lstrlenA (lpString="*.pptx") returned 6
	[0133.243] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.txt") returned 0
	[0133.243] lstrlenA (lpString="*.txt") returned 5
	[0133.243] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.pdf") returned 0
	[0133.243] lstrlenA (lpString="*.pdf") returned 5
	[0133.243] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.htm") returned 0
	[0133.243] lstrlenA (lpString="*.htm") returned 5
	[0133.243] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.html") returned 0
	[0133.244] lstrlenA (lpString="*.html") returned 6
	[0133.244] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.mdb") returned 0
	[0133.244] lstrlenA (lpString="*.mdb") returned 5
	[0133.244] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.pfx") returned 0
	[0133.244] lstrlenA (lpString="*.pfx") returned 5
	[0133.244] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.md") returned 0
	[0133.244] lstrlenA (lpString="*.md") returned 4
	[0133.244] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.lnk") returned 0
	[0133.244] lstrlenA (lpString="*.lnk") returned 5
	[0133.244] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.torrent") returned 0
	[0133.244] lstrlenA (lpString="*.torrent") returned 9
	[0133.244] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.mov") returned 0
	[0133.244] lstrlenA (lpString="*.mov") returned 5
	[0133.244] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.3gp") returned 0
	[0133.244] lstrlenA (lpString="*.3gp") returned 5
	[0133.244] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.mpeg") returned 0
	[0133.244] lstrlenA (lpString="*.mpeg") returned 6
	[0133.244] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.mpg") returned 0
	[0133.244] lstrlenA (lpString="*.mpg") returned 5
	[0133.244] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.flv") returned 0
	[0133.244] lstrlenA (lpString="*.flv") returned 5
	[0133.244] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.avi") returned 0
	[0133.244] lstrlenA (lpString="*.avi") returned 5
	[0133.244] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.mp4") returned 0
	[0133.244] lstrlenA (lpString="*.mp4") returned 5
	[0133.244] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.wmv") returned 0
	[0133.244] lstrlenA (lpString="*.wmv") returned 5
	[0133.244] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.mkv") returned 0
	[0133.244] lstrlenA (lpString="*.mkv") returned 5
	[0133.244] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.mp3") returned 0
	[0133.244] lstrlenA (lpString="*.mp3") returned 5
	[0133.244] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.wav") returned 0
	[0133.244] lstrlenA (lpString="*.wav") returned 5
	[0133.244] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.flac") returned 0
	[0133.245] lstrlenA (lpString="*.flac") returned 6
	[0133.245] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.wma") returned 0
	[0133.245] lstrlenA (lpString="*.wma") returned 5
	[0133.245] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.au3") returned 0
	[0133.245] lstrlenA (lpString="*.au3") returned 5
	[0133.245] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.ahk") returned 0
	[0133.245] lstrlenA (lpString="*.ahk") returned 5
	[0133.245] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.c") returned 0
	[0133.245] lstrlenA (lpString="*.c") returned 3
	[0133.245] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.cc") returned 0
	[0133.245] lstrlenA (lpString="*.cc") returned 4
	[0133.245] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.cpp") returned 0
	[0133.245] lstrlenA (lpString="*.cpp") returned 5
	[0133.245] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.cxx") returned 0
	[0133.245] lstrlenA (lpString="*.cxx") returned 5
	[0133.245] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.c++") returned 0
	[0133.245] lstrlenA (lpString="*.c++") returned 5
	[0133.245] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.cs") returned 0
	[0133.245] lstrlenA (lpString="*.cs") returned 4
	[0133.245] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.vb") returned 0
	[0133.245] lstrlenA (lpString="*.vb") returned 4
	[0133.245] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.bas") returned 0
	[0133.245] lstrlenA (lpString="*.bas") returned 5
	[0133.245] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.csproj") returned 0
	[0133.245] lstrlenA (lpString="*.csproj") returned 8
	[0133.245] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.vbproj") returned 0
	[0133.245] lstrlenA (lpString="*.vbproj") returned 8
	[0133.245] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.vcxproj") returned 0
	[0133.245] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.245] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.manifest") returned 0
	[0133.245] lstrlenA (lpString="*.manifest") returned 10
	[0133.245] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.php") returned 0
	[0133.245] lstrlenA (lpString="*.php") returned 5
	[0133.245] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.vbe") returned 0
	[0133.245] lstrlenA (lpString="*.vbe") returned 5
	[0133.246] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.vba") returned 0
	[0133.246] lstrlenA (lpString="*.vba") returned 5
	[0133.246] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.vbs") returned 0
	[0133.246] lstrlenA (lpString="*.vbs") returned 5
	[0133.246] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.bat") returned 0
	[0133.246] lstrlenA (lpString="*.bat") returned 5
	[0133.246] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.cmd") returned 0
	[0133.246] lstrlenA (lpString="*.cmd") returned 5
	[0133.246] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.js") returned 0
	[0133.246] lstrlenA (lpString="*.js") returned 4
	[0133.246] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.jscript") returned 0
	[0133.246] lstrlenA (lpString="*.jscript") returned 9
	[0133.246] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.hta") returned 0
	[0133.246] lstrlenA (lpString="*.hta") returned 5
	[0133.246] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.php7") returned 0
	[0133.246] lstrlenA (lpString="*.php7") returned 6
	[0133.246] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.db") returned 0
	[0133.246] lstrlenA (lpString="*.db") returned 4
	[0133.246] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.swf") returned 0
	[0133.246] lstrlenA (lpString="*.swf") returned 5
	[0133.246] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.eml") returned 0
	[0133.246] lstrlenA (lpString="*.eml") returned 5
	[0133.246] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.part") returned 0
	[0133.246] lstrlenA (lpString="*.part") returned 6
	[0133.246] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.nfo") returned 0
	[0133.246] lstrlenA (lpString="*.nfo") returned 5
	[0133.246] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.rsa") returned 0
	[0133.246] lstrlenA (lpString="*.rsa") returned 5
	[0133.246] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.key") returned 0
	[0133.246] lstrlenA (lpString="*.key") returned 5
	[0133.246] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.aes") returned 0
	[0133.246] lstrlenA (lpString="*.aes") returned 5
	[0133.246] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.blob") returned 0
	[0133.246] lstrlenA (lpString="*.blob") returned 6
	[0133.247] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.btc") returned 0
	[0133.247] lstrlenA (lpString="*.btc") returned 5
	[0133.247] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", pszSpec="*.wallet") returned 0
	[0133.247] lstrlenA (lpString="*.wallet") returned 8
	[0133.247] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2923a75e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x2923a75e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x2923a75e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x42, dwReserved0=0x7b0000, dwReserved1=0xd8, cFileName="store.json.mozlz4", cAlternateFileName="STOREJ~1.MOZ")) returned 0
	[0133.247] FindClose (in: hFindFile=0x7cb910 | out: hFindFile=0x7cb910) returned 1
	[0133.247] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x145d99f2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x2d6a08c7, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb844f993, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="datareporting", cAlternateFileName="DATARE~1")) returned 1
	[0133.247] lstrcmpA (lpString1=".", lpString2="datareporting") returned -1
	[0133.247] lstrcmpA (lpString1="..", lpString2="datareporting") returned -1
	[0133.247] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\*.*") returned="*.*"
	[0133.247] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="datareporting" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting"
	[0133.247] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting") returned 87
	[0133.247] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\*.*", lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x145d99f2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x2d6a08c7, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb844f993, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb750
	[0133.256] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.256] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x145d99f2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x2d6a08c7, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb844f993, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.256] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.256] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.256] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x147168f2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x14717c78, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x14717c78, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="archived", cAlternateFileName="")) returned 1
	[0133.256] lstrcmpA (lpString1=".", lpString2="archived") returned -1
	[0133.256] lstrcmpA (lpString1="..", lpString2="archived") returned -1
	[0133.256] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\*.*") returned="*.*"
	[0133.256] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\", lpString2="archived" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived"
	[0133.256] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived") returned 96
	[0133.256] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\*.*", lpFindFileData=0x19f110 | out: lpFindFileData=0x19f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x147168f2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x14717c78, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x14717c78, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cb790
	[0133.256] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.256] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19f110 | out: lpFindFileData=0x19f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x147168f2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x14717c78, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x14717c78, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0133.257] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.257] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.257] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19f110 | out: lpFindFileData=0x19f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14717c78, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb8403501, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb8403501, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="2017-09", cAlternateFileName="")) returned 1
	[0133.257] lstrcmpA (lpString1=".", lpString2="2017-09") returned -1
	[0133.257] lstrcmpA (lpString1="..", lpString2="2017-09") returned -1
	[0133.257] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\*.*") returned="*.*"
	[0133.257] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\", lpString2="2017-09" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09"
	[0133.257] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09") returned 104
	[0133.257] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\*.*", lpFindFileData=0x19efc0 | out: lpFindFileData=0x19efc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14717c78, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb8403501, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb8403501, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cb7d0
	[0133.259] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.259] FindNextFileA (in: hFindFile=0x7cb7d0, lpFindFileData=0x19efc0 | out: lpFindFileData=0x19efc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14717c78, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb8403501, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb8403501, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0133.259] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.259] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.259] FindNextFileA (in: hFindFile=0x7cb7d0, lpFindFileData=0x19efc0 | out: lpFindFileData=0x19efc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14723fca, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x14723fca, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x14728de9, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xbdc, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", cAlternateFileName="150478~1.JSO")) returned 1
	[0133.259] PeekMessageA (in: lpMsg=0x19ef9c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19ef9c) returned 0
	[0133.259] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4") returned 1
	[0133.259] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4") returned 1
	[0133.259] lstrcmpiA (lpString1="", lpString2="1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4") returned -1
	[0133.259] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\*.*") returned="*.*"
	[0133.259] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\"
	[0133.259] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\") returned=""
	[0133.259] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.259] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0133.260] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c
	[0133.261] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0133.261] WriteFile (in: hFile=0x22c, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0133.262] SetFileTime (hFile=0x22c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0133.262] CloseHandle (hObject=0x22c) returned 1
	[0133.262] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\", lpString2="1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4"
	[0133.262] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.zip") returned 0
	[0133.262] lstrlenA (lpString="*.zip") returned 5
	[0133.262] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.rar") returned 0
	[0133.262] lstrlenA (lpString="*.rar") returned 5
	[0133.262] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.7z") returned 0
	[0133.262] lstrlenA (lpString="*.7z") returned 4
	[0133.262] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.tar") returned 0
	[0133.262] lstrlenA (lpString="*.tar") returned 5
	[0133.262] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.gzip") returned 0
	[0133.262] lstrlenA (lpString="*.gzip") returned 6
	[0133.262] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.jpg") returned 0
	[0133.262] lstrlenA (lpString="*.jpg") returned 5
	[0133.262] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.jpeg") returned 0
	[0133.262] lstrlenA (lpString="*.jpeg") returned 6
	[0133.262] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.bmp") returned 0
	[0133.262] lstrlenA (lpString="*.bmp") returned 5
	[0133.262] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.gif") returned 0
	[0133.262] lstrlenA (lpString="*.gif") returned 5
	[0133.262] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.png") returned 0
	[0133.263] lstrlenA (lpString="*.png") returned 5
	[0133.263] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.doc") returned 0
	[0133.263] lstrlenA (lpString="*.doc") returned 5
	[0133.263] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.docx") returned 0
	[0133.263] lstrlenA (lpString="*.docx") returned 6
	[0133.263] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.xls") returned 0
	[0133.263] lstrlenA (lpString="*.xls") returned 5
	[0133.263] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.xlsx") returned 0
	[0133.263] lstrlenA (lpString="*.xlsx") returned 6
	[0133.263] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.ppt") returned 0
	[0133.263] lstrlenA (lpString="*.ppt") returned 5
	[0133.263] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.pptx") returned 0
	[0133.263] lstrlenA (lpString="*.pptx") returned 6
	[0133.263] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.txt") returned 0
	[0133.263] lstrlenA (lpString="*.txt") returned 5
	[0133.263] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.pdf") returned 0
	[0133.263] lstrlenA (lpString="*.pdf") returned 5
	[0133.263] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.htm") returned 0
	[0133.263] lstrlenA (lpString="*.htm") returned 5
	[0133.263] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.html") returned 0
	[0133.263] lstrlenA (lpString="*.html") returned 6
	[0133.263] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.mdb") returned 0
	[0133.263] lstrlenA (lpString="*.mdb") returned 5
	[0133.263] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.pfx") returned 0
	[0133.263] lstrlenA (lpString="*.pfx") returned 5
	[0133.263] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.md") returned 0
	[0133.263] lstrlenA (lpString="*.md") returned 4
	[0133.263] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.lnk") returned 0
	[0133.263] lstrlenA (lpString="*.lnk") returned 5
	[0133.263] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.torrent") returned 0
	[0133.263] lstrlenA (lpString="*.torrent") returned 9
	[0133.263] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.mov") returned 0
	[0133.263] lstrlenA (lpString="*.mov") returned 5
	[0133.263] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.3gp") returned 0
	[0133.263] lstrlenA (lpString="*.3gp") returned 5
	[0133.264] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.mpeg") returned 0
	[0133.264] lstrlenA (lpString="*.mpeg") returned 6
	[0133.264] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.mpg") returned 0
	[0133.264] lstrlenA (lpString="*.mpg") returned 5
	[0133.264] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.flv") returned 0
	[0133.264] lstrlenA (lpString="*.flv") returned 5
	[0133.264] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.avi") returned 0
	[0133.264] lstrlenA (lpString="*.avi") returned 5
	[0133.264] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.mp4") returned 0
	[0133.264] lstrlenA (lpString="*.mp4") returned 5
	[0133.264] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.wmv") returned 0
	[0133.264] lstrlenA (lpString="*.wmv") returned 5
	[0133.264] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.mkv") returned 0
	[0133.264] lstrlenA (lpString="*.mkv") returned 5
	[0133.264] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.mp3") returned 0
	[0133.264] lstrlenA (lpString="*.mp3") returned 5
	[0133.264] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.wav") returned 0
	[0133.264] lstrlenA (lpString="*.wav") returned 5
	[0133.264] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.flac") returned 0
	[0133.264] lstrlenA (lpString="*.flac") returned 6
	[0133.264] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.wma") returned 0
	[0133.264] lstrlenA (lpString="*.wma") returned 5
	[0133.264] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.au3") returned 0
	[0133.264] lstrlenA (lpString="*.au3") returned 5
	[0133.264] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.ahk") returned 0
	[0133.264] lstrlenA (lpString="*.ahk") returned 5
	[0133.264] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.c") returned 0
	[0133.264] lstrlenA (lpString="*.c") returned 3
	[0133.264] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.cc") returned 0
	[0133.264] lstrlenA (lpString="*.cc") returned 4
	[0133.264] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.cpp") returned 0
	[0133.264] lstrlenA (lpString="*.cpp") returned 5
	[0133.264] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.cxx") returned 0
	[0133.264] lstrlenA (lpString="*.cxx") returned 5
	[0133.264] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.c++") returned 0
	[0133.265] lstrlenA (lpString="*.c++") returned 5
	[0133.265] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.cs") returned 0
	[0133.265] lstrlenA (lpString="*.cs") returned 4
	[0133.265] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.vb") returned 0
	[0133.265] lstrlenA (lpString="*.vb") returned 4
	[0133.265] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.bas") returned 0
	[0133.265] lstrlenA (lpString="*.bas") returned 5
	[0133.265] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.csproj") returned 0
	[0133.265] lstrlenA (lpString="*.csproj") returned 8
	[0133.265] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.vbproj") returned 0
	[0133.265] lstrlenA (lpString="*.vbproj") returned 8
	[0133.265] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.vcxproj") returned 0
	[0133.265] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.265] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.manifest") returned 0
	[0133.265] lstrlenA (lpString="*.manifest") returned 10
	[0133.265] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.php") returned 0
	[0133.265] lstrlenA (lpString="*.php") returned 5
	[0133.265] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.vbe") returned 0
	[0133.265] lstrlenA (lpString="*.vbe") returned 5
	[0133.265] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.vba") returned 0
	[0133.265] lstrlenA (lpString="*.vba") returned 5
	[0133.265] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.vbs") returned 0
	[0133.265] lstrlenA (lpString="*.vbs") returned 5
	[0133.265] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.bat") returned 0
	[0133.265] lstrlenA (lpString="*.bat") returned 5
	[0133.265] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.cmd") returned 0
	[0133.265] lstrlenA (lpString="*.cmd") returned 5
	[0133.265] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.js") returned 0
	[0133.265] lstrlenA (lpString="*.js") returned 4
	[0133.265] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.jscript") returned 0
	[0133.265] lstrlenA (lpString="*.jscript") returned 9
	[0133.265] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.hta") returned 0
	[0133.265] lstrlenA (lpString="*.hta") returned 5
	[0133.265] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.php7") returned 0
	[0133.265] lstrlenA (lpString="*.php7") returned 6
	[0133.266] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.db") returned 0
	[0133.266] lstrlenA (lpString="*.db") returned 4
	[0133.266] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.swf") returned 0
	[0133.266] lstrlenA (lpString="*.swf") returned 5
	[0133.266] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.eml") returned 0
	[0133.266] lstrlenA (lpString="*.eml") returned 5
	[0133.266] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.part") returned 0
	[0133.266] lstrlenA (lpString="*.part") returned 6
	[0133.266] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.nfo") returned 0
	[0133.266] lstrlenA (lpString="*.nfo") returned 5
	[0133.266] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.rsa") returned 0
	[0133.266] lstrlenA (lpString="*.rsa") returned 5
	[0133.266] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.key") returned 0
	[0133.266] lstrlenA (lpString="*.key") returned 5
	[0133.266] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.aes") returned 0
	[0133.266] lstrlenA (lpString="*.aes") returned 5
	[0133.266] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.blob") returned 0
	[0133.266] lstrlenA (lpString="*.blob") returned 6
	[0133.266] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.btc") returned 0
	[0133.266] lstrlenA (lpString="*.btc") returned 5
	[0133.266] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", pszSpec="*.wallet") returned 0
	[0133.266] lstrlenA (lpString="*.wallet") returned 8
	[0133.266] FindNextFileA (in: hFindFile=0x7cb7d0, lpFindFileData=0x19efc0 | out: lpFindFileData=0x19efc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x147ab83f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x147ab83f, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x147acbbc, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x1959, dwReserved0=0x0, dwReserved1=0x0, cFileName="1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", cAlternateFileName="150478~2.JSO")) returned 1
	[0133.266] PeekMessageA (in: lpMsg=0x19ef9c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19ef9c) returned 0
	[0133.266] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4") returned 1
	[0133.266] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4") returned 1
	[0133.266] lstrcmpiA (lpString1="", lpString2="1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4") returned -1
	[0133.266] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4") returned="1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4"
	[0133.266] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\"
	[0133.266] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\") returned=""
	[0133.266] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.266] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\how-to-decrypt-files.htm")) returned 0x20
	[0133.267] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\", lpString2="1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4"
	[0133.267] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.zip") returned 0
	[0133.267] lstrlenA (lpString="*.zip") returned 5
	[0133.267] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.rar") returned 0
	[0133.267] lstrlenA (lpString="*.rar") returned 5
	[0133.267] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.7z") returned 0
	[0133.267] lstrlenA (lpString="*.7z") returned 4
	[0133.267] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.tar") returned 0
	[0133.267] lstrlenA (lpString="*.tar") returned 5
	[0133.267] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.gzip") returned 0
	[0133.267] lstrlenA (lpString="*.gzip") returned 6
	[0133.267] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.jpg") returned 0
	[0133.267] lstrlenA (lpString="*.jpg") returned 5
	[0133.267] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.jpeg") returned 0
	[0133.267] lstrlenA (lpString="*.jpeg") returned 6
	[0133.267] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.bmp") returned 0
	[0133.267] lstrlenA (lpString="*.bmp") returned 5
	[0133.267] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.gif") returned 0
	[0133.267] lstrlenA (lpString="*.gif") returned 5
	[0133.267] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.png") returned 0
	[0133.267] lstrlenA (lpString="*.png") returned 5
	[0133.267] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.doc") returned 0
	[0133.267] lstrlenA (lpString="*.doc") returned 5
	[0133.267] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.docx") returned 0
	[0133.267] lstrlenA (lpString="*.docx") returned 6
	[0133.267] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.xls") returned 0
	[0133.267] lstrlenA (lpString="*.xls") returned 5
	[0133.267] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.xlsx") returned 0
	[0133.267] lstrlenA (lpString="*.xlsx") returned 6
	[0133.267] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.ppt") returned 0
	[0133.267] lstrlenA (lpString="*.ppt") returned 5
	[0133.267] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.pptx") returned 0
	[0133.267] lstrlenA (lpString="*.pptx") returned 6
	[0133.268] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.txt") returned 0
	[0133.268] lstrlenA (lpString="*.txt") returned 5
	[0133.268] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.pdf") returned 0
	[0133.268] lstrlenA (lpString="*.pdf") returned 5
	[0133.268] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.htm") returned 0
	[0133.268] lstrlenA (lpString="*.htm") returned 5
	[0133.268] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.html") returned 0
	[0133.268] lstrlenA (lpString="*.html") returned 6
	[0133.268] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.mdb") returned 0
	[0133.268] lstrlenA (lpString="*.mdb") returned 5
	[0133.268] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.pfx") returned 0
	[0133.268] lstrlenA (lpString="*.pfx") returned 5
	[0133.268] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.md") returned 0
	[0133.268] lstrlenA (lpString="*.md") returned 4
	[0133.268] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.lnk") returned 0
	[0133.268] lstrlenA (lpString="*.lnk") returned 5
	[0133.268] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.torrent") returned 0
	[0133.268] lstrlenA (lpString="*.torrent") returned 9
	[0133.268] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.mov") returned 0
	[0133.268] lstrlenA (lpString="*.mov") returned 5
	[0133.268] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.3gp") returned 0
	[0133.268] lstrlenA (lpString="*.3gp") returned 5
	[0133.268] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.mpeg") returned 0
	[0133.268] lstrlenA (lpString="*.mpeg") returned 6
	[0133.268] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.mpg") returned 0
	[0133.268] lstrlenA (lpString="*.mpg") returned 5
	[0133.268] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.flv") returned 0
	[0133.268] lstrlenA (lpString="*.flv") returned 5
	[0133.268] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.avi") returned 0
	[0133.268] lstrlenA (lpString="*.avi") returned 5
	[0133.268] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.mp4") returned 0
	[0133.268] lstrlenA (lpString="*.mp4") returned 5
	[0133.268] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.wmv") returned 0
	[0133.268] lstrlenA (lpString="*.wmv") returned 5
	[0133.269] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.mkv") returned 0
	[0133.269] lstrlenA (lpString="*.mkv") returned 5
	[0133.269] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.mp3") returned 0
	[0133.269] lstrlenA (lpString="*.mp3") returned 5
	[0133.269] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.wav") returned 0
	[0133.269] lstrlenA (lpString="*.wav") returned 5
	[0133.269] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.flac") returned 0
	[0133.269] lstrlenA (lpString="*.flac") returned 6
	[0133.269] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.wma") returned 0
	[0133.269] lstrlenA (lpString="*.wma") returned 5
	[0133.269] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.au3") returned 0
	[0133.269] lstrlenA (lpString="*.au3") returned 5
	[0133.269] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.ahk") returned 0
	[0133.269] lstrlenA (lpString="*.ahk") returned 5
	[0133.269] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.c") returned 0
	[0133.269] lstrlenA (lpString="*.c") returned 3
	[0133.269] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.cc") returned 0
	[0133.269] lstrlenA (lpString="*.cc") returned 4
	[0133.269] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.cpp") returned 0
	[0133.269] lstrlenA (lpString="*.cpp") returned 5
	[0133.269] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.cxx") returned 0
	[0133.269] lstrlenA (lpString="*.cxx") returned 5
	[0133.269] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.c++") returned 0
	[0133.269] lstrlenA (lpString="*.c++") returned 5
	[0133.269] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.cs") returned 0
	[0133.269] lstrlenA (lpString="*.cs") returned 4
	[0133.269] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.vb") returned 0
	[0133.269] lstrlenA (lpString="*.vb") returned 4
	[0133.269] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.bas") returned 0
	[0133.269] lstrlenA (lpString="*.bas") returned 5
	[0133.269] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.csproj") returned 0
	[0133.269] lstrlenA (lpString="*.csproj") returned 8
	[0133.269] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.vbproj") returned 0
	[0133.269] lstrlenA (lpString="*.vbproj") returned 8
	[0133.269] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.vcxproj") returned 0
	[0133.270] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.270] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.manifest") returned 0
	[0133.270] lstrlenA (lpString="*.manifest") returned 10
	[0133.270] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.php") returned 0
	[0133.270] lstrlenA (lpString="*.php") returned 5
	[0133.270] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.vbe") returned 0
	[0133.270] lstrlenA (lpString="*.vbe") returned 5
	[0133.270] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.vba") returned 0
	[0133.270] lstrlenA (lpString="*.vba") returned 5
	[0133.270] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.vbs") returned 0
	[0133.270] lstrlenA (lpString="*.vbs") returned 5
	[0133.270] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.bat") returned 0
	[0133.270] lstrlenA (lpString="*.bat") returned 5
	[0133.270] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.cmd") returned 0
	[0133.270] lstrlenA (lpString="*.cmd") returned 5
	[0133.270] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.js") returned 0
	[0133.270] lstrlenA (lpString="*.js") returned 4
	[0133.270] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.jscript") returned 0
	[0133.270] lstrlenA (lpString="*.jscript") returned 9
	[0133.270] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.hta") returned 0
	[0133.270] lstrlenA (lpString="*.hta") returned 5
	[0133.270] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.php7") returned 0
	[0133.270] lstrlenA (lpString="*.php7") returned 6
	[0133.270] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.db") returned 0
	[0133.270] lstrlenA (lpString="*.db") returned 4
	[0133.270] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.swf") returned 0
	[0133.270] lstrlenA (lpString="*.swf") returned 5
	[0133.270] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.eml") returned 0
	[0133.270] lstrlenA (lpString="*.eml") returned 5
	[0133.270] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.part") returned 0
	[0133.270] lstrlenA (lpString="*.part") returned 6
	[0133.270] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.nfo") returned 0
	[0133.270] lstrlenA (lpString="*.nfo") returned 5
	[0133.271] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.rsa") returned 0
	[0133.271] lstrlenA (lpString="*.rsa") returned 5
	[0133.271] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.key") returned 0
	[0133.271] lstrlenA (lpString="*.key") returned 5
	[0133.271] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.aes") returned 0
	[0133.271] lstrlenA (lpString="*.aes") returned 5
	[0133.271] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.blob") returned 0
	[0133.271] lstrlenA (lpString="*.blob") returned 6
	[0133.271] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.btc") returned 0
	[0133.271] lstrlenA (lpString="*.btc") returned 5
	[0133.271] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", pszSpec="*.wallet") returned 0
	[0133.271] lstrlenA (lpString="*.wallet") returned 8
	[0133.271] FindNextFileA (in: hFindFile=0x7cb7d0, lpFindFileData=0x19efc0 | out: lpFindFileData=0x19efc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4853f871, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4853f871, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x48566a5e, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x173b, dwReserved0=0x740072, dwReserved1=0x6e0069, cFileName="1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", cAlternateFileName="150478~3.JSO")) returned 1
	[0133.271] PeekMessageA (in: lpMsg=0x19ef9c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19ef9c) returned 0
	[0133.271] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4") returned 1
	[0133.271] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4") returned 1
	[0133.271] lstrcmpiA (lpString1="", lpString2="1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4") returned -1
	[0133.271] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4") returned="1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4"
	[0133.271] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\"
	[0133.271] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\") returned=""
	[0133.271] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.271] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\how-to-decrypt-files.htm")) returned 0x20
	[0133.271] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\", lpString2="1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4"
	[0133.271] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.zip") returned 0
	[0133.271] lstrlenA (lpString="*.zip") returned 5
	[0133.271] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.rar") returned 0
	[0133.271] lstrlenA (lpString="*.rar") returned 5
	[0133.271] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.7z") returned 0
	[0133.271] lstrlenA (lpString="*.7z") returned 4
	[0133.271] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.tar") returned 0
	[0133.271] lstrlenA (lpString="*.tar") returned 5
	[0133.271] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.gzip") returned 0
	[0133.272] lstrlenA (lpString="*.gzip") returned 6
	[0133.272] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.jpg") returned 0
	[0133.272] lstrlenA (lpString="*.jpg") returned 5
	[0133.272] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.jpeg") returned 0
	[0133.272] lstrlenA (lpString="*.jpeg") returned 6
	[0133.272] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.bmp") returned 0
	[0133.272] lstrlenA (lpString="*.bmp") returned 5
	[0133.272] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.gif") returned 0
	[0133.272] lstrlenA (lpString="*.gif") returned 5
	[0133.272] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.png") returned 0
	[0133.272] lstrlenA (lpString="*.png") returned 5
	[0133.272] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.doc") returned 0
	[0133.272] lstrlenA (lpString="*.doc") returned 5
	[0133.272] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.docx") returned 0
	[0133.272] lstrlenA (lpString="*.docx") returned 6
	[0133.272] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.xls") returned 0
	[0133.272] lstrlenA (lpString="*.xls") returned 5
	[0133.272] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.xlsx") returned 0
	[0133.272] lstrlenA (lpString="*.xlsx") returned 6
	[0133.272] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.ppt") returned 0
	[0133.272] lstrlenA (lpString="*.ppt") returned 5
	[0133.272] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.pptx") returned 0
	[0133.272] lstrlenA (lpString="*.pptx") returned 6
	[0133.272] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.txt") returned 0
	[0133.272] lstrlenA (lpString="*.txt") returned 5
	[0133.272] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.pdf") returned 0
	[0133.272] lstrlenA (lpString="*.pdf") returned 5
	[0133.272] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.htm") returned 0
	[0133.272] lstrlenA (lpString="*.htm") returned 5
	[0133.272] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.html") returned 0
	[0133.272] lstrlenA (lpString="*.html") returned 6
	[0133.272] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.mdb") returned 0
	[0133.272] lstrlenA (lpString="*.mdb") returned 5
	[0133.272] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.pfx") returned 0
	[0133.272] lstrlenA (lpString="*.pfx") returned 5
	[0133.273] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.md") returned 0
	[0133.273] lstrlenA (lpString="*.md") returned 4
	[0133.273] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.lnk") returned 0
	[0133.273] lstrlenA (lpString="*.lnk") returned 5
	[0133.273] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.torrent") returned 0
	[0133.273] lstrlenA (lpString="*.torrent") returned 9
	[0133.273] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.mov") returned 0
	[0133.273] lstrlenA (lpString="*.mov") returned 5
	[0133.273] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.3gp") returned 0
	[0133.273] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.mpeg") returned 0
	[0133.273] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.mpg") returned 0
	[0133.273] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.flv") returned 0
	[0133.273] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.avi") returned 0
	[0133.273] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.mp4") returned 0
	[0133.273] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.wmv") returned 0
	[0133.273] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.mkv") returned 0
	[0133.273] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.mp3") returned 0
	[0133.273] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.wav") returned 0
	[0133.273] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.flac") returned 0
	[0133.273] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.wma") returned 0
	[0133.273] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.au3") returned 0
	[0133.273] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.ahk") returned 0
	[0133.274] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.c") returned 0
	[0133.274] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.cc") returned 0
	[0133.274] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.cpp") returned 0
	[0133.274] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.cxx") returned 0
	[0133.274] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.c++") returned 0
	[0133.274] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.cs") returned 0
	[0133.274] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.vb") returned 0
	[0133.274] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.bas") returned 0
	[0133.274] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.csproj") returned 0
	[0133.274] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.vbproj") returned 0
	[0133.274] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.vcxproj") returned 0
	[0133.274] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.manifest") returned 0
	[0133.274] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.php") returned 0
	[0133.274] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.vbe") returned 0
	[0133.274] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.vba") returned 0
	[0133.274] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.vbs") returned 0
	[0133.274] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.bat") returned 0
	[0133.274] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.cmd") returned 0
	[0133.274] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.js") returned 0
	[0133.274] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.jscript") returned 0
	[0133.274] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.hta") returned 0
	[0133.274] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.php7") returned 0
	[0133.274] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.db") returned 0
	[0133.274] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.swf") returned 0
	[0133.274] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.eml") returned 0
	[0133.275] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.part") returned 0
	[0133.275] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.nfo") returned 0
	[0133.275] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.rsa") returned 0
	[0133.275] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.key") returned 0
	[0133.275] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.aes") returned 0
	[0133.275] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.blob") returned 0
	[0133.275] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.btc") returned 0
	[0133.275] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", pszSpec="*.wallet") returned 0
	[0133.275] FindNextFileA (in: hFindFile=0x7cb7d0, lpFindFileData=0x19efc0 | out: lpFindFileData=0x19efc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdd249bf, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcdd249bf, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcdd249bf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x198a, dwReserved0=0x740072, dwReserved1=0x6e0069, cFileName="1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4", cAlternateFileName="150478~4.JSO")) returned 1
	[0133.275] PeekMessageA (in: lpMsg=0x19ef9c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19ef9c) returned 0
	[0133.275] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4") returned 1
	[0133.275] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4") returned 1
	[0133.275] lstrcmpiA (lpString1="", lpString2="1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4") returned -1
	[0133.275] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4") returned="1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4"
	[0133.275] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\"
	[0133.275] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\") returned=""
	[0133.275] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.275] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\how-to-decrypt-files.htm")) returned 0x20
	[0133.275] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\", lpString2="1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4"
	[0133.275] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4", pszSpec="*.zip") returned 0
	[0133.275] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4", pszSpec="*.rar") returned 0
	[0133.275] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4", pszSpec="*.7z") returned 0
	[0133.275] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4", pszSpec="*.tar") returned 0
	[0133.275] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4", pszSpec="*.gzip") returned 0
	[0133.275] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4", pszSpec="*.jpg") returned 0
	[0133.276] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4", pszSpec="*.jpeg") returned 0
	[0133.276] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4", pszSpec="*.bmp") returned 0
	[0133.276] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4", pszSpec="*.gif") returned 0
	[0133.276] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4", pszSpec="*.png") returned 0
	[0133.276] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4", pszSpec="*.doc") returned 0
	[0133.276] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4", pszSpec="*.docx") returned 0
	[0133.276] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4", pszSpec="*.xls") returned 0
	[0133.276] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4", pszSpec="*.xlsx") returned 0
	[0133.276] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4", pszSpec="*.ppt") returned 0
	[0133.276] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4", pszSpec="*.pptx") returned 0
	[0133.276] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4", pszSpec="*.txt") returned 0
	[0133.276] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4", pszSpec="*.pdf") returned 0
	[0133.276] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4", pszSpec="*.htm") returned 0
	[0133.276] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4", pszSpec="*.html") returned 0
	[0133.276] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4", pszSpec="*.mdb") returned 0
	[0133.276] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4", pszSpec="*.pfx") returned 0
	[0133.276] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4", pszSpec="*.md") returned 0
	[0133.276] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4", pszSpec="*.lnk") returned 0
	[0133.276] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4", pszSpec="*.torrent") returned 0
	[0133.276] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4", pszSpec="*.mov") returned 0
	[0133.276] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4", pszSpec="*.3gp") returned 0
	[0133.276] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4", pszSpec="*.mpeg") returned 0
	[0133.276] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4", pszSpec="*.mpg") returned 0
	[0133.276] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4", pszSpec="*.flv") returned 0
	[0133.277] FindNextFileA (in: hFindFile=0x7cb7d0, lpFindFileData=0x19efc0 | out: lpFindFileData=0x19efc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8403501, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb8403501, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb8403501, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1a68, dwReserved0=0x740072, dwReserved1=0x6e0069, cFileName="1504783834184.9f6a97f1-211a-4a0b-bad3-33fe96259e66.main.jsonlz4", cAlternateFileName="15CA1A~1.JSO")) returned 1
	[0133.277] PeekMessageA (in: lpMsg=0x19ef9c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19ef9c) returned 0
	[0133.277] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="1504783834184.9f6a97f1-211a-4a0b-bad3-33fe96259e66.main.jsonlz4") returned 1
	[0133.277] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="1504783834184.9f6a97f1-211a-4a0b-bad3-33fe96259e66.main.jsonlz4") returned 1
	[0133.277] lstrcmpiA (lpString1="", lpString2="1504783834184.9f6a97f1-211a-4a0b-bad3-33fe96259e66.main.jsonlz4") returned -1
	[0133.277] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4") returned="1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4"
	[0133.277] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\"
	[0133.277] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\") returned=""
	[0133.277] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.277] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\how-to-decrypt-files.htm")) returned 0x20
	[0133.277] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\", lpString2="1504783834184.9f6a97f1-211a-4a0b-bad3-33fe96259e66.main.jsonlz4" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783834184.9f6a97f1-211a-4a0b-bad3-33fe96259e66.main.jsonlz4") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783834184.9f6a97f1-211a-4a0b-bad3-33fe96259e66.main.jsonlz4"
	[0133.277] FindNextFileA (in: hFindFile=0x7cb7d0, lpFindFileData=0x19efc0 | out: lpFindFileData=0x19efc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8403501, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb8403501, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb8403501, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1a68, dwReserved0=0x740072, dwReserved1=0x6e0069, cFileName="1504783834184.9f6a97f1-211a-4a0b-bad3-33fe96259e66.main.jsonlz4", cAlternateFileName="15CA1A~1.JSO")) returned 0
	[0133.277] FindClose (in: hFindFile=0x7cb7d0 | out: hFindFile=0x7cb7d0) returned 1
	[0133.277] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19f110 | out: lpFindFileData=0x19f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14717c78, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb8403501, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb8403501, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="2017-09", cAlternateFileName="")) returned 0
	[0133.277] FindClose (in: hFindFile=0x7cb790 | out: hFindFile=0x7cb790) returned 1
	[0133.277] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d5bba89, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x2d5bba89, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x2d5bba89, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xa1, dwReserved0=0x6d2e3636, dwReserved1=0x2e6e6961, cFileName="session-state.json", cAlternateFileName="SESSIO~1.JSO")) returned 1
	[0133.278] PeekMessageA (in: lpMsg=0x19f23c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f23c) returned 0
	[0133.278] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="session-state.json") returned -1
	[0133.278] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="session-state.json") returned -1
	[0133.278] lstrcmpiA (lpString1="", lpString2="session-state.json") returned -1
	[0133.278] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\*.*") returned="*.*"
	[0133.278] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\"
	[0133.278] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\") returned=""
	[0133.278] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.278] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0133.278] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224
	[0133.279] WriteFile (in: hFile=0x224, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0133.279] SetFileTime (hFile=0x224, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0133.280] CloseHandle (hObject=0x224) returned 1
	[0133.280] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\", lpString2="session-state.json" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\session-state.json") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\session-state.json"
	[0133.280] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x145d99f2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x145d99f2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x145d99f2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x33, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.json", cAlternateFileName="STATE~1.JSO")) returned 1
	[0133.280] PeekMessageA (in: lpMsg=0x19f23c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f23c) returned 0
	[0133.280] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="state.json") returned -1
	[0133.280] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="state.json") returned -1
	[0133.280] lstrcmpiA (lpString1="", lpString2="state.json") returned -1
	[0133.280] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\session-state.json") returned="session-state.json"
	[0133.280] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\"
	[0133.280] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\") returned=""
	[0133.280] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.280] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\how-to-decrypt-files.htm")) returned 0x20
	[0133.280] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\", lpString2="state.json" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\state.json") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\state.json"
	[0133.280] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x145d99f2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x145d99f2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x145d99f2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x33, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.json", cAlternateFileName="STATE~1.JSO")) returned 0
	[0133.280] FindClose (in: hFindFile=0x7cb750 | out: hFindFile=0x7cb750) returned 1
	[0133.280] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe967070, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe967070, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfe967070, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x292e, dwReserved0=0x0, dwReserved1=0x0, cFileName="extensions.json", cAlternateFileName="EXTENS~1.JSO")) returned 1
	[0133.280] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0133.280] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="extensions.json") returned -1
	[0133.280] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="extensions.json") returned 1
	[0133.280] lstrcmpiA (lpString1="", lpString2="extensions.json") returned -1
	[0133.280] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\*.*") returned="*.*"
	[0133.281] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\"
	[0133.281] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned=""
	[0133.281] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.281] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\how-to-decrypt-files.htm")) returned 0x20
	[0133.281] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="extensions.json" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\extensions.json") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\extensions.json"
	[0133.281] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdd54ecc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfdd54ecc, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x145311ab, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x500000, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="favicons.sqlite", cAlternateFileName="FAVICO~1.SQL")) returned 1
	[0133.281] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0133.281] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="favicons.sqlite") returned -1
	[0133.281] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="favicons.sqlite") returned 1
	[0133.281] lstrcmpiA (lpString1="", lpString2="favicons.sqlite") returned -1
	[0133.281] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\extensions.json") returned="extensions.json"
	[0133.281] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\"
	[0133.281] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned=""
	[0133.281] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.281] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\how-to-decrypt-files.htm")) returned 0x20
	[0133.281] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="favicons.sqlite" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite"
	[0133.281] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba329010, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xba329010, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x72e7b76, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="favicons.sqlite-shm", cAlternateFileName="FAVICO~3.SQL")) returned 1
	[0133.281] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0133.281] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="favicons.sqlite-shm") returned -1
	[0133.281] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="favicons.sqlite-shm") returned 1
	[0133.281] lstrcmpiA (lpString1="", lpString2="favicons.sqlite-shm") returned -1
	[0133.281] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite") returned="favicons.sqlite"
	[0133.281] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\"
	[0133.281] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned=""
	[0133.281] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.282] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\how-to-decrypt-files.htm")) returned 0x20
	[0133.282] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="favicons.sqlite-shm" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-shm") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-shm"
	[0133.282] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba329010, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xba329010, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x45aebce0, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x901d0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="favicons.sqlite-wal", cAlternateFileName="FAVICO~2.SQL")) returned 1
	[0133.282] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0133.282] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="favicons.sqlite-wal") returned -1
	[0133.282] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="favicons.sqlite-wal") returned 1
	[0133.282] lstrcmpiA (lpString1="", lpString2="favicons.sqlite-wal") returned -1
	[0133.282] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-shm") returned="favicons.sqlite-shm"
	[0133.282] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\"
	[0133.282] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned=""
	[0133.282] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.282] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\how-to-decrypt-files.htm")) returned 0x20
	[0133.282] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="favicons.sqlite-wal" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-wal") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-wal"
	[0133.282] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdbd76e4, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfdbd76e4, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x4079e226, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="gmp", cAlternateFileName="")) returned 1
	[0133.282] lstrcmpA (lpString1=".", lpString2="gmp") returned -1
	[0133.282] lstrcmpA (lpString1="..", lpString2="gmp") returned -1
	[0133.282] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-wal") returned="favicons.sqlite-wal"
	[0133.282] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="gmp" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp"
	[0133.282] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp") returned 77
	[0133.282] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp\\*.*", lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdbd76e4, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfdbd76e4, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x4079e226, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0xd8, cFileName=".", cAlternateFileName="")) returned 0x7cb890
	[0133.282] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.283] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdbd76e4, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfdbd76e4, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x4079e226, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0xd8, cFileName="..", cAlternateFileName="")) returned 1
	[0133.283] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.283] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.283] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4079e226, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4079e226, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4079e226, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0xd8, cFileName="WINNT_x86_64-msvc", cAlternateFileName="WINNT_~1")) returned 1
	[0133.283] lstrcmpA (lpString1=".", lpString2="WINNT_x86_64-msvc") returned -1
	[0133.283] lstrcmpA (lpString1="..", lpString2="WINNT_x86_64-msvc") returned -1
	[0133.283] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp\\*.*") returned="*.*"
	[0133.283] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp\\", lpString2="WINNT_x86_64-msvc" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp\\WINNT_x86_64-msvc") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp\\WINNT_x86_64-msvc"
	[0133.283] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp\\WINNT_x86_64-msvc") returned 95
	[0133.283] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp\\WINNT_x86_64-msvc\\*.*", lpFindFileData=0x19f110 | out: lpFindFileData=0x19f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4079e226, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4079e226, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4079e226, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cb750
	[0133.283] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.283] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f110 | out: lpFindFileData=0x19f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4079e226, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4079e226, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4079e226, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0133.283] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.283] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.283] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f110 | out: lpFindFileData=0x19f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4079e226, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4079e226, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4079e226, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 0
	[0133.283] FindClose (in: hFindFile=0x7cb750 | out: hFindFile=0x7cb750) returned 1
	[0133.283] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4079e226, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4079e226, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4079e226, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0xd8, cFileName="WINNT_x86_64-msvc", cAlternateFileName="WINNT_~1")) returned 0
	[0133.283] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1
	[0133.283] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40c4b15, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x40c4b15, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x40c5e7c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="gmp-gmpopenh264", cAlternateFileName="GMP-GM~1")) returned 1
	[0133.283] lstrcmpA (lpString1=".", lpString2="gmp-gmpopenh264") returned -1
	[0133.283] lstrcmpA (lpString1="..", lpString2="gmp-gmpopenh264") returned -1
	[0133.283] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\*.*") returned="*.*"
	[0133.283] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="gmp-gmpopenh264" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264"
	[0133.283] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264") returned 89
	[0133.283] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\*.*", lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40c4b15, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x40c4b15, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x40c5e7c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0xd8, cFileName=".", cAlternateFileName="")) returned 0x7cb750
	[0133.284] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.284] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40c4b15, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x40c4b15, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x40c5e7c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0xd8, cFileName="..", cAlternateFileName="")) returned 1
	[0133.284] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.284] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.284] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40c5e7c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x40c5e7c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x40e6e0c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0xd8, cFileName="1.6", cAlternateFileName="")) returned 1
	[0133.284] lstrcmpA (lpString1=".", lpString2="1.6") returned -1
	[0133.284] lstrcmpA (lpString1="..", lpString2="1.6") returned -1
	[0133.284] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\*.*") returned="*.*"
	[0133.284] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\", lpString2="1.6" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6"
	[0133.284] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6") returned 93
	[0133.285] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\*.*", lpFindFileData=0x19f110 | out: lpFindFileData=0x19f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40c5e7c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x40c5e7c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x40e6e0c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cbbd0
	[0133.285] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.285] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19f110 | out: lpFindFileData=0x19f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40c5e7c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x40c5e7c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x40e6e0c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0133.285] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.285] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.285] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19f110 | out: lpFindFileData=0x19f110*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40c7227, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xcdbd0100, ftLastAccessTime.dwHighDateTime=0x1d1e9c5, ftLastWriteTime.dwLowDateTime=0xcdbd0100, ftLastWriteTime.dwHighDateTime=0x1d1e9c5, nFileSizeHigh=0x0, nFileSizeLow=0xd81c8, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="gmpopenh264.dll", cAlternateFileName="GMPOPE~1.DLL")) returned 1
	[0133.285] PeekMessageA (in: lpMsg=0x19f0ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f0ec) returned 0
	[0133.285] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="gmpopenh264.dll") returned -1
	[0133.285] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="gmpopenh264.dll") returned 1
	[0133.285] lstrcmpiA (lpString1="", lpString2="gmpopenh264.dll") returned -1
	[0133.285] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\*.*") returned="*.*"
	[0133.285] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\"
	[0133.285] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\") returned=""
	[0133.285] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.285] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0133.285] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228
	[0133.287] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0133.287] WriteFile (in: hFile=0x228, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0133.288] SetFileTime (hFile=0x228, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0133.288] CloseHandle (hObject=0x228) returned 1
	[0133.288] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\", lpString2="gmpopenh264.dll" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll"
	[0133.288] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.zip") returned 0
	[0133.288] lstrlenA (lpString="*.zip") returned 5
	[0133.288] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.rar") returned 0
	[0133.288] lstrlenA (lpString="*.rar") returned 5
	[0133.288] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.7z") returned 0
	[0133.288] lstrlenA (lpString="*.7z") returned 4
	[0133.288] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.tar") returned 0
	[0133.288] lstrlenA (lpString="*.tar") returned 5
	[0133.288] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.gzip") returned 0
	[0133.288] lstrlenA (lpString="*.gzip") returned 6
	[0133.288] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.jpg") returned 0
	[0133.288] lstrlenA (lpString="*.jpg") returned 5
	[0133.288] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.jpeg") returned 0
	[0133.288] lstrlenA (lpString="*.jpeg") returned 6
	[0133.288] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.bmp") returned 0
	[0133.289] lstrlenA (lpString="*.bmp") returned 5
	[0133.289] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.gif") returned 0
	[0133.289] lstrlenA (lpString="*.gif") returned 5
	[0133.289] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.png") returned 0
	[0133.289] lstrlenA (lpString="*.png") returned 5
	[0133.291] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.doc") returned 0
	[0133.291] lstrlenA (lpString="*.doc") returned 5
	[0133.291] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.docx") returned 0
	[0133.291] lstrlenA (lpString="*.docx") returned 6
	[0133.291] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.xls") returned 0
	[0133.291] lstrlenA (lpString="*.xls") returned 5
	[0133.292] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.xlsx") returned 0
	[0133.292] lstrlenA (lpString="*.xlsx") returned 6
	[0133.292] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.ppt") returned 0
	[0133.292] lstrlenA (lpString="*.ppt") returned 5
	[0133.292] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.pptx") returned 0
	[0133.292] lstrlenA (lpString="*.pptx") returned 6
	[0133.292] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.txt") returned 0
	[0133.292] lstrlenA (lpString="*.txt") returned 5
	[0133.292] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.pdf") returned 0
	[0133.292] lstrlenA (lpString="*.pdf") returned 5
	[0133.292] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.htm") returned 0
	[0133.292] lstrlenA (lpString="*.htm") returned 5
	[0133.292] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.html") returned 0
	[0133.292] lstrlenA (lpString="*.html") returned 6
	[0133.292] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.mdb") returned 0
	[0133.292] lstrlenA (lpString="*.mdb") returned 5
	[0133.292] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.pfx") returned 0
	[0133.292] lstrlenA (lpString="*.pfx") returned 5
	[0133.292] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.md") returned 0
	[0133.292] lstrlenA (lpString="*.md") returned 4
	[0133.292] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.lnk") returned 0
	[0133.292] lstrlenA (lpString="*.lnk") returned 5
	[0133.292] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.torrent") returned 0
	[0133.292] lstrlenA (lpString="*.torrent") returned 9
	[0133.292] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.mov") returned 0
	[0133.292] lstrlenA (lpString="*.mov") returned 5
	[0133.292] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.3gp") returned 0
	[0133.292] lstrlenA (lpString="*.3gp") returned 5
	[0133.292] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.mpeg") returned 0
	[0133.292] lstrlenA (lpString="*.mpeg") returned 6
	[0133.292] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.mpg") returned 0
	[0133.292] lstrlenA (lpString="*.mpg") returned 5
	[0133.292] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.flv") returned 0
	[0133.292] lstrlenA (lpString="*.flv") returned 5
	[0133.293] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.avi") returned 0
	[0133.293] lstrlenA (lpString="*.avi") returned 5
	[0133.293] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.mp4") returned 0
	[0133.293] lstrlenA (lpString="*.mp4") returned 5
	[0133.293] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.wmv") returned 0
	[0133.293] lstrlenA (lpString="*.wmv") returned 5
	[0133.293] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.mkv") returned 0
	[0133.293] lstrlenA (lpString="*.mkv") returned 5
	[0133.293] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.mp3") returned 0
	[0133.293] lstrlenA (lpString="*.mp3") returned 5
	[0133.293] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.wav") returned 0
	[0133.293] lstrlenA (lpString="*.wav") returned 5
	[0133.293] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.flac") returned 0
	[0133.293] lstrlenA (lpString="*.flac") returned 6
	[0133.293] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.wma") returned 0
	[0133.293] lstrlenA (lpString="*.wma") returned 5
	[0133.293] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.au3") returned 0
	[0133.293] lstrlenA (lpString="*.au3") returned 5
	[0133.293] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.ahk") returned 0
	[0133.293] lstrlenA (lpString="*.ahk") returned 5
	[0133.293] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.c") returned 0
	[0133.293] lstrlenA (lpString="*.c") returned 3
	[0133.293] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.cc") returned 0
	[0133.293] lstrlenA (lpString="*.cc") returned 4
	[0133.293] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.cpp") returned 0
	[0133.293] lstrlenA (lpString="*.cpp") returned 5
	[0133.293] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.cxx") returned 0
	[0133.293] lstrlenA (lpString="*.cxx") returned 5
	[0133.293] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.c++") returned 0
	[0133.293] lstrlenA (lpString="*.c++") returned 5
	[0133.293] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.cs") returned 0
	[0133.293] lstrlenA (lpString="*.cs") returned 4
	[0133.293] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.vb") returned 0
	[0133.293] lstrlenA (lpString="*.vb") returned 4
	[0133.293] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.bas") returned 0
	[0133.294] lstrlenA (lpString="*.bas") returned 5
	[0133.294] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.csproj") returned 0
	[0133.294] lstrlenA (lpString="*.csproj") returned 8
	[0133.294] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.vbproj") returned 0
	[0133.294] lstrlenA (lpString="*.vbproj") returned 8
	[0133.294] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.vcxproj") returned 0
	[0133.294] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.294] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.manifest") returned 0
	[0133.294] lstrlenA (lpString="*.manifest") returned 10
	[0133.294] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.php") returned 0
	[0133.294] lstrlenA (lpString="*.php") returned 5
	[0133.294] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.vbe") returned 0
	[0133.294] lstrlenA (lpString="*.vbe") returned 5
	[0133.294] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.vba") returned 0
	[0133.294] lstrlenA (lpString="*.vba") returned 5
	[0133.294] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.vbs") returned 0
	[0133.294] lstrlenA (lpString="*.vbs") returned 5
	[0133.294] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.bat") returned 0
	[0133.294] lstrlenA (lpString="*.bat") returned 5
	[0133.294] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.cmd") returned 0
	[0133.294] lstrlenA (lpString="*.cmd") returned 5
	[0133.294] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.js") returned 0
	[0133.294] lstrlenA (lpString="*.js") returned 4
	[0133.294] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.jscript") returned 0
	[0133.294] lstrlenA (lpString="*.jscript") returned 9
	[0133.294] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.hta") returned 0
	[0133.294] lstrlenA (lpString="*.hta") returned 5
	[0133.294] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.php7") returned 0
	[0133.294] lstrlenA (lpString="*.php7") returned 6
	[0133.294] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.db") returned 0
	[0133.294] lstrlenA (lpString="*.db") returned 4
	[0133.294] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.swf") returned 0
	[0133.294] lstrlenA (lpString="*.swf") returned 5
	[0133.294] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.eml") returned 0
	[0133.295] lstrlenA (lpString="*.eml") returned 5
	[0133.295] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.part") returned 0
	[0133.295] lstrlenA (lpString="*.part") returned 6
	[0133.295] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.nfo") returned 0
	[0133.295] lstrlenA (lpString="*.nfo") returned 5
	[0133.295] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.rsa") returned 0
	[0133.295] lstrlenA (lpString="*.rsa") returned 5
	[0133.295] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.key") returned 0
	[0133.295] lstrlenA (lpString="*.key") returned 5
	[0133.295] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.aes") returned 0
	[0133.295] lstrlenA (lpString="*.aes") returned 5
	[0133.295] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.blob") returned 0
	[0133.295] lstrlenA (lpString="*.blob") returned 6
	[0133.295] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.btc") returned 0
	[0133.295] lstrlenA (lpString="*.btc") returned 5
	[0133.295] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", pszSpec="*.wallet") returned 0
	[0133.295] lstrlenA (lpString="*.wallet") returned 8
	[0133.295] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19f110 | out: lpFindFileData=0x19f110*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40e6e0c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xc7554a80, ftLastAccessTime.dwHighDateTime=0x1d1e848, ftLastWriteTime.dwLowDateTime=0xc7554a80, ftLastWriteTime.dwHighDateTime=0x1d1e848, nFileSizeHigh=0x0, nFileSizeLow=0x74, dwReserved0=0x0, dwReserved1=0x0, cFileName="gmpopenh264.info", cAlternateFileName="GMPOPE~1.INF")) returned 1
	[0133.295] PeekMessageA (in: lpMsg=0x19f0ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f0ec) returned 0
	[0133.295] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="gmpopenh264.info") returned -1
	[0133.295] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="gmpopenh264.info") returned 1
	[0133.295] lstrcmpiA (lpString1="", lpString2="gmpopenh264.info") returned -1
	[0133.295] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll") returned="gmpopenh264.dll"
	[0133.295] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\"
	[0133.295] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\") returned=""
	[0133.295] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.295] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\how-to-decrypt-files.htm")) returned 0x20
	[0133.295] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\", lpString2="gmpopenh264.info" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info"
	[0133.295] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.zip") returned 0
	[0133.295] lstrlenA (lpString="*.zip") returned 5
	[0133.296] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.rar") returned 0
	[0133.296] lstrlenA (lpString="*.rar") returned 5
	[0133.296] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.7z") returned 0
	[0133.296] lstrlenA (lpString="*.7z") returned 4
	[0133.296] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.tar") returned 0
	[0133.296] lstrlenA (lpString="*.tar") returned 5
	[0133.296] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.gzip") returned 0
	[0133.296] lstrlenA (lpString="*.gzip") returned 6
	[0133.296] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.jpg") returned 0
	[0133.296] lstrlenA (lpString="*.jpg") returned 5
	[0133.296] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.jpeg") returned 0
	[0133.296] lstrlenA (lpString="*.jpeg") returned 6
	[0133.296] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.bmp") returned 0
	[0133.296] lstrlenA (lpString="*.bmp") returned 5
	[0133.296] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.gif") returned 0
	[0133.296] lstrlenA (lpString="*.gif") returned 5
	[0133.296] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.png") returned 0
	[0133.296] lstrlenA (lpString="*.png") returned 5
	[0133.296] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.doc") returned 0
	[0133.296] lstrlenA (lpString="*.doc") returned 5
	[0133.296] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.docx") returned 0
	[0133.296] lstrlenA (lpString="*.docx") returned 6
	[0133.296] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.xls") returned 0
	[0133.296] lstrlenA (lpString="*.xls") returned 5
	[0133.296] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.xlsx") returned 0
	[0133.296] lstrlenA (lpString="*.xlsx") returned 6
	[0133.296] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.ppt") returned 0
	[0133.296] lstrlenA (lpString="*.ppt") returned 5
	[0133.296] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.pptx") returned 0
	[0133.296] lstrlenA (lpString="*.pptx") returned 6
	[0133.296] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.txt") returned 0
	[0133.296] lstrlenA (lpString="*.txt") returned 5
	[0133.296] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.pdf") returned 0
	[0133.296] lstrlenA (lpString="*.pdf") returned 5
	[0133.296] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.htm") returned 0
	[0133.297] lstrlenA (lpString="*.htm") returned 5
	[0133.297] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.html") returned 0
	[0133.297] lstrlenA (lpString="*.html") returned 6
	[0133.297] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.mdb") returned 0
	[0133.297] lstrlenA (lpString="*.mdb") returned 5
	[0133.297] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.pfx") returned 0
	[0133.297] lstrlenA (lpString="*.pfx") returned 5
	[0133.297] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.md") returned 0
	[0133.297] lstrlenA (lpString="*.md") returned 4
	[0133.297] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.lnk") returned 0
	[0133.297] lstrlenA (lpString="*.lnk") returned 5
	[0133.297] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.torrent") returned 0
	[0133.297] lstrlenA (lpString="*.torrent") returned 9
	[0133.297] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.mov") returned 0
	[0133.297] lstrlenA (lpString="*.mov") returned 5
	[0133.297] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.3gp") returned 0
	[0133.297] lstrlenA (lpString="*.3gp") returned 5
	[0133.297] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.mpeg") returned 0
	[0133.297] lstrlenA (lpString="*.mpeg") returned 6
	[0133.297] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.mpg") returned 0
	[0133.297] lstrlenA (lpString="*.mpg") returned 5
	[0133.297] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.flv") returned 0
	[0133.297] lstrlenA (lpString="*.flv") returned 5
	[0133.297] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.avi") returned 0
	[0133.297] lstrlenA (lpString="*.avi") returned 5
	[0133.297] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.mp4") returned 0
	[0133.297] lstrlenA (lpString="*.mp4") returned 5
	[0133.297] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.wmv") returned 0
	[0133.297] lstrlenA (lpString="*.wmv") returned 5
	[0133.297] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.mkv") returned 0
	[0133.297] lstrlenA (lpString="*.mkv") returned 5
	[0133.297] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.mp3") returned 0
	[0133.297] lstrlenA (lpString="*.mp3") returned 5
	[0133.297] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.wav") returned 0
	[0133.298] lstrlenA (lpString="*.wav") returned 5
	[0133.298] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.flac") returned 0
	[0133.298] lstrlenA (lpString="*.flac") returned 6
	[0133.298] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.wma") returned 0
	[0133.298] lstrlenA (lpString="*.wma") returned 5
	[0133.298] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.au3") returned 0
	[0133.298] lstrlenA (lpString="*.au3") returned 5
	[0133.298] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.ahk") returned 0
	[0133.298] lstrlenA (lpString="*.ahk") returned 5
	[0133.298] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.c") returned 0
	[0133.298] lstrlenA (lpString="*.c") returned 3
	[0133.298] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.cc") returned 0
	[0133.298] lstrlenA (lpString="*.cc") returned 4
	[0133.298] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.cpp") returned 0
	[0133.298] lstrlenA (lpString="*.cpp") returned 5
	[0133.298] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.cxx") returned 0
	[0133.298] lstrlenA (lpString="*.cxx") returned 5
	[0133.298] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.c++") returned 0
	[0133.298] lstrlenA (lpString="*.c++") returned 5
	[0133.298] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.cs") returned 0
	[0133.298] lstrlenA (lpString="*.cs") returned 4
	[0133.298] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.vb") returned 0
	[0133.298] lstrlenA (lpString="*.vb") returned 4
	[0133.298] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.bas") returned 0
	[0133.298] lstrlenA (lpString="*.bas") returned 5
	[0133.298] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.csproj") returned 0
	[0133.298] lstrlenA (lpString="*.csproj") returned 8
	[0133.298] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.vbproj") returned 0
	[0133.298] lstrlenA (lpString="*.vbproj") returned 8
	[0133.298] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.vcxproj") returned 0
	[0133.298] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.298] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.manifest") returned 0
	[0133.298] lstrlenA (lpString="*.manifest") returned 10
	[0133.298] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.php") returned 0
	[0133.299] lstrlenA (lpString="*.php") returned 5
	[0133.299] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.vbe") returned 0
	[0133.299] lstrlenA (lpString="*.vbe") returned 5
	[0133.299] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.vba") returned 0
	[0133.299] lstrlenA (lpString="*.vba") returned 5
	[0133.299] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.vbs") returned 0
	[0133.299] lstrlenA (lpString="*.vbs") returned 5
	[0133.299] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.bat") returned 0
	[0133.299] lstrlenA (lpString="*.bat") returned 5
	[0133.299] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.cmd") returned 0
	[0133.299] lstrlenA (lpString="*.cmd") returned 5
	[0133.299] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.js") returned 0
	[0133.299] lstrlenA (lpString="*.js") returned 4
	[0133.299] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.jscript") returned 0
	[0133.299] lstrlenA (lpString="*.jscript") returned 9
	[0133.299] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.hta") returned 0
	[0133.299] lstrlenA (lpString="*.hta") returned 5
	[0133.299] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.php7") returned 0
	[0133.299] lstrlenA (lpString="*.php7") returned 6
	[0133.299] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.db") returned 0
	[0133.299] lstrlenA (lpString="*.db") returned 4
	[0133.299] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.swf") returned 0
	[0133.299] lstrlenA (lpString="*.swf") returned 5
	[0133.299] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.eml") returned 0
	[0133.299] lstrlenA (lpString="*.eml") returned 5
	[0133.299] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.part") returned 0
	[0133.299] lstrlenA (lpString="*.part") returned 6
	[0133.299] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.nfo") returned 0
	[0133.299] lstrlenA (lpString="*.nfo") returned 5
	[0133.299] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.rsa") returned 0
	[0133.299] lstrlenA (lpString="*.rsa") returned 5
	[0133.299] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.key") returned 0
	[0133.299] lstrlenA (lpString="*.key") returned 5
	[0133.299] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.aes") returned 0
	[0133.300] lstrlenA (lpString="*.aes") returned 5
	[0133.300] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.blob") returned 0
	[0133.300] lstrlenA (lpString="*.blob") returned 6
	[0133.300] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.btc") returned 0
	[0133.300] lstrlenA (lpString="*.btc") returned 5
	[0133.300] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", pszSpec="*.wallet") returned 0
	[0133.300] lstrlenA (lpString="*.wallet") returned 8
	[0133.300] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19f110 | out: lpFindFileData=0x19f110*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40e6e0c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xc7554a80, ftLastAccessTime.dwHighDateTime=0x1d1e848, ftLastWriteTime.dwLowDateTime=0xc7554a80, ftLastWriteTime.dwHighDateTime=0x1d1e848, nFileSizeHigh=0x0, nFileSizeLow=0x74, dwReserved0=0x0, dwReserved1=0x0, cFileName="gmpopenh264.info", cAlternateFileName="GMPOPE~1.INF")) returned 0
	[0133.300] FindClose (in: hFindFile=0x7cbbd0 | out: hFindFile=0x7cbbd0) returned 1
	[0133.300] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40c5e7c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x40c5e7c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x40e6e0c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0xd8, cFileName="1.6", cAlternateFileName="")) returned 0
	[0133.300] FindClose (in: hFindFile=0x7cb750 | out: hFindFile=0x7cb750) returned 1
	[0133.300] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5af7cc2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5af7cc2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5af7cc2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="gmp-widevinecdm", cAlternateFileName="GMP-WI~1")) returned 1
	[0133.300] lstrcmpA (lpString1=".", lpString2="gmp-widevinecdm") returned -1
	[0133.300] lstrcmpA (lpString1="..", lpString2="gmp-widevinecdm") returned -1
	[0133.300] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\*.*") returned="*.*"
	[0133.300] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="gmp-widevinecdm" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm"
	[0133.300] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm") returned 89
	[0133.300] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\*.*", lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5af7cc2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5af7cc2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5af7cc2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbad0
	[0133.301] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.301] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5af7cc2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5af7cc2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5af7cc2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.301] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.301] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.301] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5af7cc2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5af7cc2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5b71e56, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.4.8.903", cAlternateFileName="148~1.903")) returned 1
	[0133.301] lstrcmpA (lpString1=".", lpString2="1.4.8.903") returned -1
	[0133.301] lstrcmpA (lpString1="..", lpString2="1.4.8.903") returned -1
	[0133.301] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\*.*") returned="*.*"
	[0133.301] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\", lpString2="1.4.8.903" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903"
	[0133.301] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903") returned 99
	[0133.301] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\*.*", lpFindFileData=0x19f110 | out: lpFindFileData=0x19f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5af7cc2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5af7cc2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5b71e56, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cb750
	[0133.303] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.303] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f110 | out: lpFindFileData=0x19f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5af7cc2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5af7cc2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5b71e56, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0133.303] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.303] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.303] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f110 | out: lpFindFileData=0x19f110*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5afa3b9, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7c375100, ftLastAccessTime.dwHighDateTime=0x1d1deb2, ftLastWriteTime.dwLowDateTime=0x7c375100, ftLastWriteTime.dwHighDateTime=0x1d1deb2, nFileSizeHigh=0x0, nFileSizeLow=0x1df, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="LICENSE.txt", cAlternateFileName="")) returned 1
	[0133.303] PeekMessageA (in: lpMsg=0x19f0ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f0ec) returned 0
	[0133.303] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="LICENSE.txt") returned -1
	[0133.303] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="LICENSE.txt") returned -1
	[0133.303] lstrcmpiA (lpString1="", lpString2="LICENSE.txt") returned -1
	[0133.303] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\*.*") returned="*.*"
	[0133.303] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\"
	[0133.303] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\") returned=""
	[0133.303] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.303] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0133.303] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228
	[0133.304] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0133.304] WriteFile (in: hFile=0x228, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0133.305] SetFileTime (hFile=0x228, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0133.305] CloseHandle (hObject=0x228) returned 1
	[0133.305] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\", lpString2="LICENSE.txt" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt"
	[0133.305] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt", pszSpec="*.zip") returned 0
	[0133.306] lstrlenA (lpString="*.zip") returned 5
	[0133.306] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt", pszSpec="*.rar") returned 0
	[0133.306] lstrlenA (lpString="*.rar") returned 5
	[0133.306] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt", pszSpec="*.7z") returned 0
	[0133.306] lstrlenA (lpString="*.7z") returned 4
	[0133.306] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt", pszSpec="*.tar") returned 0
	[0133.306] lstrlenA (lpString="*.tar") returned 5
	[0133.306] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt", pszSpec="*.gzip") returned 0
	[0133.306] lstrlenA (lpString="*.gzip") returned 6
	[0133.306] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt", pszSpec="*.jpg") returned 0
	[0133.306] lstrlenA (lpString="*.jpg") returned 5
	[0133.306] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt", pszSpec="*.jpeg") returned 0
	[0133.306] lstrlenA (lpString="*.jpeg") returned 6
	[0133.306] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt", pszSpec="*.bmp") returned 0
	[0133.306] lstrlenA (lpString="*.bmp") returned 5
	[0133.306] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt", pszSpec="*.gif") returned 0
	[0133.306] lstrlenA (lpString="*.gif") returned 5
	[0133.306] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt", pszSpec="*.png") returned 0
	[0133.306] lstrlenA (lpString="*.png") returned 5
	[0133.306] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt", pszSpec="*.doc") returned 0
	[0133.306] lstrlenA (lpString="*.doc") returned 5
	[0133.306] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt", pszSpec="*.docx") returned 0
	[0133.306] lstrlenA (lpString="*.docx") returned 6
	[0133.306] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt", pszSpec="*.xls") returned 0
	[0133.306] lstrlenA (lpString="*.xls") returned 5
	[0133.306] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt", pszSpec="*.xlsx") returned 0
	[0133.306] lstrlenA (lpString="*.xlsx") returned 6
	[0133.306] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt", pszSpec="*.ppt") returned 0
	[0133.306] lstrlenA (lpString="*.ppt") returned 5
	[0133.306] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt", pszSpec="*.pptx") returned 0
	[0133.306] lstrlenA (lpString="*.pptx") returned 6
	[0133.306] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt", pszSpec="*.txt") returned 1
	[0133.306] lstrlenA (lpString="*.txt") returned 5
	[0133.306] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt"
	[0133.307] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt"
	[0133.307] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt."
	[0133.307] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt.exe"
	[0133.307] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\license.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228
	[0133.307] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1df
	[0133.307] GetFileTime (in: hFile=0x228, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5afa3b9, dwHighDateTime=0x1d327ca), lpLastAccessTime=0x407536*(dwLowDateTime=0x7c375100, dwHighDateTime=0x1d1deb2), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7c375100, dwHighDateTime=0x1d1deb2)) returned 1
	[0133.307] SetFilePointer (in: hFile=0x228, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.307] ReadFile (in: hFile=0x228, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x19d, lpOverlapped=0x0) returned 1
	[0133.308] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt") returned="LICENSE.txt"
	[0133.308] SetFilePointer (in: hFile=0x228, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.308] WriteFile (in: hFile=0x228, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x19d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x19d, lpOverlapped=0x0) returned 1
	[0133.309] SetFileTime (hFile=0x228, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.309] CloseHandle (hObject=0x228) returned 1
	[0133.309] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\license.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\license.txt.exe")) returned 1
	[0133.310] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f110 | out: lpFindFileData=0x19f110*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b6f737, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7c375100, ftLastAccessTime.dwHighDateTime=0x1d1deb2, ftLastWriteTime.dwLowDateTime=0x7c375100, ftLastWriteTime.dwHighDateTime=0x1d1deb2, nFileSizeHigh=0x0, nFileSizeLow=0x15c, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1
	[0133.310] PeekMessageA (in: lpMsg=0x19f0ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f0ec) returned 0
	[0133.310] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="manifest.json") returned -1
	[0133.310] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="manifest.json") returned -1
	[0133.310] lstrcmpiA (lpString1="", lpString2="manifest.json") returned -1
	[0133.310] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt") returned="LICENSE.txt"
	[0133.310] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\"
	[0133.310] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\") returned=""
	[0133.310] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.310] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\how-to-decrypt-files.htm")) returned 0x20
	[0133.310] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\", lpString2="manifest.json" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json"
	[0133.310] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.zip") returned 0
	[0133.310] lstrlenA (lpString="*.zip") returned 5
	[0133.310] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.rar") returned 0
	[0133.310] lstrlenA (lpString="*.rar") returned 5
	[0133.310] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.7z") returned 0
	[0133.310] lstrlenA (lpString="*.7z") returned 4
	[0133.310] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.tar") returned 0
	[0133.310] lstrlenA (lpString="*.tar") returned 5
	[0133.310] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.gzip") returned 0
	[0133.310] lstrlenA (lpString="*.gzip") returned 6
	[0133.310] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.jpg") returned 0
	[0133.310] lstrlenA (lpString="*.jpg") returned 5
	[0133.310] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.jpeg") returned 0
	[0133.310] lstrlenA (lpString="*.jpeg") returned 6
	[0133.310] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.bmp") returned 0
	[0133.310] lstrlenA (lpString="*.bmp") returned 5
	[0133.311] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.gif") returned 0
	[0133.311] lstrlenA (lpString="*.gif") returned 5
	[0133.311] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.png") returned 0
	[0133.311] lstrlenA (lpString="*.png") returned 5
	[0133.311] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.doc") returned 0
	[0133.311] lstrlenA (lpString="*.doc") returned 5
	[0133.311] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.docx") returned 0
	[0133.311] lstrlenA (lpString="*.docx") returned 6
	[0133.311] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.xls") returned 0
	[0133.311] lstrlenA (lpString="*.xls") returned 5
	[0133.311] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.xlsx") returned 0
	[0133.311] lstrlenA (lpString="*.xlsx") returned 6
	[0133.311] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.ppt") returned 0
	[0133.311] lstrlenA (lpString="*.ppt") returned 5
	[0133.311] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.pptx") returned 0
	[0133.311] lstrlenA (lpString="*.pptx") returned 6
	[0133.311] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.txt") returned 0
	[0133.311] lstrlenA (lpString="*.txt") returned 5
	[0133.311] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.pdf") returned 0
	[0133.311] lstrlenA (lpString="*.pdf") returned 5
	[0133.311] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.htm") returned 0
	[0133.311] lstrlenA (lpString="*.htm") returned 5
	[0133.311] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.html") returned 0
	[0133.311] lstrlenA (lpString="*.html") returned 6
	[0133.311] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.mdb") returned 0
	[0133.311] lstrlenA (lpString="*.mdb") returned 5
	[0133.311] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.pfx") returned 0
	[0133.311] lstrlenA (lpString="*.pfx") returned 5
	[0133.311] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.md") returned 0
	[0133.311] lstrlenA (lpString="*.md") returned 4
	[0133.311] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.lnk") returned 0
	[0133.311] lstrlenA (lpString="*.lnk") returned 5
	[0133.311] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.torrent") returned 0
	[0133.311] lstrlenA (lpString="*.torrent") returned 9
	[0133.311] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.mov") returned 0
	[0133.312] lstrlenA (lpString="*.mov") returned 5
	[0133.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.3gp") returned 0
	[0133.312] lstrlenA (lpString="*.3gp") returned 5
	[0133.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.mpeg") returned 0
	[0133.312] lstrlenA (lpString="*.mpeg") returned 6
	[0133.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.mpg") returned 0
	[0133.312] lstrlenA (lpString="*.mpg") returned 5
	[0133.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.flv") returned 0
	[0133.312] lstrlenA (lpString="*.flv") returned 5
	[0133.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.avi") returned 0
	[0133.312] lstrlenA (lpString="*.avi") returned 5
	[0133.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.mp4") returned 0
	[0133.312] lstrlenA (lpString="*.mp4") returned 5
	[0133.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.wmv") returned 0
	[0133.312] lstrlenA (lpString="*.wmv") returned 5
	[0133.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.mkv") returned 0
	[0133.312] lstrlenA (lpString="*.mkv") returned 5
	[0133.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.mp3") returned 0
	[0133.312] lstrlenA (lpString="*.mp3") returned 5
	[0133.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.wav") returned 0
	[0133.312] lstrlenA (lpString="*.wav") returned 5
	[0133.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.flac") returned 0
	[0133.312] lstrlenA (lpString="*.flac") returned 6
	[0133.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.wma") returned 0
	[0133.312] lstrlenA (lpString="*.wma") returned 5
	[0133.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.au3") returned 0
	[0133.312] lstrlenA (lpString="*.au3") returned 5
	[0133.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.ahk") returned 0
	[0133.312] lstrlenA (lpString="*.ahk") returned 5
	[0133.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.c") returned 0
	[0133.312] lstrlenA (lpString="*.c") returned 3
	[0133.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.cc") returned 0
	[0133.312] lstrlenA (lpString="*.cc") returned 4
	[0133.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.cpp") returned 0
	[0133.312] lstrlenA (lpString="*.cpp") returned 5
	[0133.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.cxx") returned 0
	[0133.313] lstrlenA (lpString="*.cxx") returned 5
	[0133.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.c++") returned 0
	[0133.313] lstrlenA (lpString="*.c++") returned 5
	[0133.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.cs") returned 0
	[0133.313] lstrlenA (lpString="*.cs") returned 4
	[0133.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.vb") returned 0
	[0133.313] lstrlenA (lpString="*.vb") returned 4
	[0133.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.bas") returned 0
	[0133.313] lstrlenA (lpString="*.bas") returned 5
	[0133.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.csproj") returned 0
	[0133.313] lstrlenA (lpString="*.csproj") returned 8
	[0133.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.vbproj") returned 0
	[0133.313] lstrlenA (lpString="*.vbproj") returned 8
	[0133.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.vcxproj") returned 0
	[0133.313] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.manifest") returned 0
	[0133.313] lstrlenA (lpString="*.manifest") returned 10
	[0133.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.php") returned 0
	[0133.313] lstrlenA (lpString="*.php") returned 5
	[0133.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.vbe") returned 0
	[0133.313] lstrlenA (lpString="*.vbe") returned 5
	[0133.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.vba") returned 0
	[0133.313] lstrlenA (lpString="*.vba") returned 5
	[0133.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.vbs") returned 0
	[0133.313] lstrlenA (lpString="*.vbs") returned 5
	[0133.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.bat") returned 0
	[0133.313] lstrlenA (lpString="*.bat") returned 5
	[0133.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.cmd") returned 0
	[0133.313] lstrlenA (lpString="*.cmd") returned 5
	[0133.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.js") returned 0
	[0133.313] lstrlenA (lpString="*.js") returned 4
	[0133.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.jscript") returned 0
	[0133.313] lstrlenA (lpString="*.jscript") returned 9
	[0133.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.hta") returned 0
	[0133.314] lstrlenA (lpString="*.hta") returned 5
	[0133.314] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.php7") returned 0
	[0133.314] lstrlenA (lpString="*.php7") returned 6
	[0133.314] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.db") returned 0
	[0133.314] lstrlenA (lpString="*.db") returned 4
	[0133.314] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.swf") returned 0
	[0133.314] lstrlenA (lpString="*.swf") returned 5
	[0133.314] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.eml") returned 0
	[0133.314] lstrlenA (lpString="*.eml") returned 5
	[0133.314] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.part") returned 0
	[0133.314] lstrlenA (lpString="*.part") returned 6
	[0133.314] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.nfo") returned 0
	[0133.314] lstrlenA (lpString="*.nfo") returned 5
	[0133.314] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.rsa") returned 0
	[0133.314] lstrlenA (lpString="*.rsa") returned 5
	[0133.314] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.key") returned 0
	[0133.314] lstrlenA (lpString="*.key") returned 5
	[0133.314] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.aes") returned 0
	[0133.314] lstrlenA (lpString="*.aes") returned 5
	[0133.314] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.blob") returned 0
	[0133.314] lstrlenA (lpString="*.blob") returned 6
	[0133.314] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.btc") returned 0
	[0133.314] lstrlenA (lpString="*.btc") returned 5
	[0133.314] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", pszSpec="*.wallet") returned 0
	[0133.314] lstrlenA (lpString="*.wallet") returned 8
	[0133.314] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f110 | out: lpFindFileData=0x19f110*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5afcaea, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7c375100, ftLastAccessTime.dwHighDateTime=0x1d1deb2, ftLastWriteTime.dwLowDateTime=0x7c375100, ftLastWriteTime.dwHighDateTime=0x1d1deb2, nFileSizeHigh=0x0, nFileSizeLow=0x58adf8, dwReserved0=0x690076, dwReserved1=0x65006e, cFileName="widevinecdm.dll", cAlternateFileName="WIDEVI~1.DLL")) returned 1
	[0133.314] PeekMessageA (in: lpMsg=0x19f0ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f0ec) returned 0
	[0133.314] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="widevinecdm.dll") returned -1
	[0133.314] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="widevinecdm.dll") returned -1
	[0133.314] lstrcmpiA (lpString1="", lpString2="widevinecdm.dll") returned -1
	[0133.314] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json") returned="manifest.json"
	[0133.314] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\"
	[0133.314] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\") returned=""
	[0133.314] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.315] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\how-to-decrypt-files.htm")) returned 0x20
	[0133.315] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\", lpString2="widevinecdm.dll" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll"
	[0133.315] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.zip") returned 0
	[0133.315] lstrlenA (lpString="*.zip") returned 5
	[0133.315] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.rar") returned 0
	[0133.315] lstrlenA (lpString="*.rar") returned 5
	[0133.315] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.7z") returned 0
	[0133.315] lstrlenA (lpString="*.7z") returned 4
	[0133.315] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.tar") returned 0
	[0133.315] lstrlenA (lpString="*.tar") returned 5
	[0133.315] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.gzip") returned 0
	[0133.315] lstrlenA (lpString="*.gzip") returned 6
	[0133.315] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.jpg") returned 0
	[0133.315] lstrlenA (lpString="*.jpg") returned 5
	[0133.315] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.jpeg") returned 0
	[0133.315] lstrlenA (lpString="*.jpeg") returned 6
	[0133.315] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.bmp") returned 0
	[0133.315] lstrlenA (lpString="*.bmp") returned 5
	[0133.315] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.gif") returned 0
	[0133.315] lstrlenA (lpString="*.gif") returned 5
	[0133.315] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.png") returned 0
	[0133.315] lstrlenA (lpString="*.png") returned 5
	[0133.315] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.doc") returned 0
	[0133.315] lstrlenA (lpString="*.doc") returned 5
	[0133.315] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.docx") returned 0
	[0133.315] lstrlenA (lpString="*.docx") returned 6
	[0133.315] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.xls") returned 0
	[0133.315] lstrlenA (lpString="*.xls") returned 5
	[0133.315] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.xlsx") returned 0
	[0133.315] lstrlenA (lpString="*.xlsx") returned 6
	[0133.315] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.ppt") returned 0
	[0133.315] lstrlenA (lpString="*.ppt") returned 5
	[0133.315] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.pptx") returned 0
	[0133.316] lstrlenA (lpString="*.pptx") returned 6
	[0133.316] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.txt") returned 0
	[0133.316] lstrlenA (lpString="*.txt") returned 5
	[0133.316] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.pdf") returned 0
	[0133.316] lstrlenA (lpString="*.pdf") returned 5
	[0133.316] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.htm") returned 0
	[0133.316] lstrlenA (lpString="*.htm") returned 5
	[0133.316] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.html") returned 0
	[0133.316] lstrlenA (lpString="*.html") returned 6
	[0133.316] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.mdb") returned 0
	[0133.316] lstrlenA (lpString="*.mdb") returned 5
	[0133.316] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.pfx") returned 0
	[0133.316] lstrlenA (lpString="*.pfx") returned 5
	[0133.316] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.md") returned 0
	[0133.316] lstrlenA (lpString="*.md") returned 4
	[0133.316] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.lnk") returned 0
	[0133.316] lstrlenA (lpString="*.lnk") returned 5
	[0133.316] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.torrent") returned 0
	[0133.316] lstrlenA (lpString="*.torrent") returned 9
	[0133.316] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.mov") returned 0
	[0133.316] lstrlenA (lpString="*.mov") returned 5
	[0133.316] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.3gp") returned 0
	[0133.316] lstrlenA (lpString="*.3gp") returned 5
	[0133.316] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.mpeg") returned 0
	[0133.316] lstrlenA (lpString="*.mpeg") returned 6
	[0133.316] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.mpg") returned 0
	[0133.316] lstrlenA (lpString="*.mpg") returned 5
	[0133.316] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.flv") returned 0
	[0133.316] lstrlenA (lpString="*.flv") returned 5
	[0133.316] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.avi") returned 0
	[0133.316] lstrlenA (lpString="*.avi") returned 5
	[0133.316] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.mp4") returned 0
	[0133.316] lstrlenA (lpString="*.mp4") returned 5
	[0133.316] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.wmv") returned 0
	[0133.317] lstrlenA (lpString="*.wmv") returned 5
	[0133.317] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.mkv") returned 0
	[0133.317] lstrlenA (lpString="*.mkv") returned 5
	[0133.317] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.mp3") returned 0
	[0133.317] lstrlenA (lpString="*.mp3") returned 5
	[0133.317] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.wav") returned 0
	[0133.317] lstrlenA (lpString="*.wav") returned 5
	[0133.317] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.flac") returned 0
	[0133.317] lstrlenA (lpString="*.flac") returned 6
	[0133.317] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.wma") returned 0
	[0133.317] lstrlenA (lpString="*.wma") returned 5
	[0133.317] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.au3") returned 0
	[0133.317] lstrlenA (lpString="*.au3") returned 5
	[0133.317] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.ahk") returned 0
	[0133.317] lstrlenA (lpString="*.ahk") returned 5
	[0133.317] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.c") returned 0
	[0133.317] lstrlenA (lpString="*.c") returned 3
	[0133.317] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.cc") returned 0
	[0133.317] lstrlenA (lpString="*.cc") returned 4
	[0133.317] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.cpp") returned 0
	[0133.317] lstrlenA (lpString="*.cpp") returned 5
	[0133.317] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.cxx") returned 0
	[0133.317] lstrlenA (lpString="*.cxx") returned 5
	[0133.317] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.c++") returned 0
	[0133.317] lstrlenA (lpString="*.c++") returned 5
	[0133.317] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.cs") returned 0
	[0133.317] lstrlenA (lpString="*.cs") returned 4
	[0133.317] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.vb") returned 0
	[0133.317] lstrlenA (lpString="*.vb") returned 4
	[0133.317] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.bas") returned 0
	[0133.317] lstrlenA (lpString="*.bas") returned 5
	[0133.317] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.csproj") returned 0
	[0133.317] lstrlenA (lpString="*.csproj") returned 8
	[0133.317] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.vbproj") returned 0
	[0133.318] lstrlenA (lpString="*.vbproj") returned 8
	[0133.318] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.vcxproj") returned 0
	[0133.318] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.318] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.manifest") returned 0
	[0133.318] lstrlenA (lpString="*.manifest") returned 10
	[0133.318] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.php") returned 0
	[0133.318] lstrlenA (lpString="*.php") returned 5
	[0133.318] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.vbe") returned 0
	[0133.318] lstrlenA (lpString="*.vbe") returned 5
	[0133.318] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.vba") returned 0
	[0133.318] lstrlenA (lpString="*.vba") returned 5
	[0133.318] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.vbs") returned 0
	[0133.318] lstrlenA (lpString="*.vbs") returned 5
	[0133.318] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.bat") returned 0
	[0133.318] lstrlenA (lpString="*.bat") returned 5
	[0133.318] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.cmd") returned 0
	[0133.318] lstrlenA (lpString="*.cmd") returned 5
	[0133.318] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.js") returned 0
	[0133.318] lstrlenA (lpString="*.js") returned 4
	[0133.318] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.jscript") returned 0
	[0133.318] lstrlenA (lpString="*.jscript") returned 9
	[0133.318] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.hta") returned 0
	[0133.318] lstrlenA (lpString="*.hta") returned 5
	[0133.318] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.php7") returned 0
	[0133.318] lstrlenA (lpString="*.php7") returned 6
	[0133.318] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.db") returned 0
	[0133.318] lstrlenA (lpString="*.db") returned 4
	[0133.318] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.swf") returned 0
	[0133.318] lstrlenA (lpString="*.swf") returned 5
	[0133.318] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.eml") returned 0
	[0133.318] lstrlenA (lpString="*.eml") returned 5
	[0133.318] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.part") returned 0
	[0133.318] lstrlenA (lpString="*.part") returned 6
	[0133.318] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.nfo") returned 0
	[0133.319] lstrlenA (lpString="*.nfo") returned 5
	[0133.319] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.rsa") returned 0
	[0133.319] lstrlenA (lpString="*.rsa") returned 5
	[0133.319] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.key") returned 0
	[0133.319] lstrlenA (lpString="*.key") returned 5
	[0133.319] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.aes") returned 0
	[0133.319] lstrlenA (lpString="*.aes") returned 5
	[0133.319] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.blob") returned 0
	[0133.319] lstrlenA (lpString="*.blob") returned 6
	[0133.319] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.btc") returned 0
	[0133.319] lstrlenA (lpString="*.btc") returned 5
	[0133.319] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", pszSpec="*.wallet") returned 0
	[0133.319] lstrlenA (lpString="*.wallet") returned 8
	[0133.319] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f110 | out: lpFindFileData=0x19f110*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5afb75b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7c375100, ftLastAccessTime.dwHighDateTime=0x1d1deb2, ftLastWriteTime.dwLowDateTime=0x7c375100, ftLastWriteTime.dwHighDateTime=0x1d1deb2, nFileSizeHigh=0x0, nFileSizeLow=0x998, dwReserved0=0x690076, dwReserved1=0x65006e, cFileName="widevinecdm.dll.lib", cAlternateFileName="WIDEVI~1.LIB")) returned 1
	[0133.319] PeekMessageA (in: lpMsg=0x19f0ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f0ec) returned 0
	[0133.319] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="widevinecdm.dll.lib") returned -1
	[0133.319] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="widevinecdm.dll.lib") returned -1
	[0133.319] lstrcmpiA (lpString1="", lpString2="widevinecdm.dll.lib") returned -1
	[0133.319] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll") returned="widevinecdm.dll"
	[0133.319] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\"
	[0133.319] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\") returned=""
	[0133.319] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.319] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\how-to-decrypt-files.htm")) returned 0x20
	[0133.319] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\", lpString2="widevinecdm.dll.lib" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib"
	[0133.319] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.zip") returned 0
	[0133.319] lstrlenA (lpString="*.zip") returned 5
	[0133.319] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.rar") returned 0
	[0133.319] lstrlenA (lpString="*.rar") returned 5
	[0133.319] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.7z") returned 0
	[0133.319] lstrlenA (lpString="*.7z") returned 4
	[0133.319] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.tar") returned 0
	[0133.319] lstrlenA (lpString="*.tar") returned 5
	[0133.320] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.gzip") returned 0
	[0133.320] lstrlenA (lpString="*.gzip") returned 6
	[0133.320] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.jpg") returned 0
	[0133.320] lstrlenA (lpString="*.jpg") returned 5
	[0133.320] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.jpeg") returned 0
	[0133.320] lstrlenA (lpString="*.jpeg") returned 6
	[0133.320] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.bmp") returned 0
	[0133.320] lstrlenA (lpString="*.bmp") returned 5
	[0133.320] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.gif") returned 0
	[0133.320] lstrlenA (lpString="*.gif") returned 5
	[0133.320] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.png") returned 0
	[0133.320] lstrlenA (lpString="*.png") returned 5
	[0133.320] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.doc") returned 0
	[0133.320] lstrlenA (lpString="*.doc") returned 5
	[0133.320] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.docx") returned 0
	[0133.320] lstrlenA (lpString="*.docx") returned 6
	[0133.320] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.xls") returned 0
	[0133.320] lstrlenA (lpString="*.xls") returned 5
	[0133.320] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.xlsx") returned 0
	[0133.320] lstrlenA (lpString="*.xlsx") returned 6
	[0133.320] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.ppt") returned 0
	[0133.320] lstrlenA (lpString="*.ppt") returned 5
	[0133.320] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.pptx") returned 0
	[0133.320] lstrlenA (lpString="*.pptx") returned 6
	[0133.320] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.txt") returned 0
	[0133.320] lstrlenA (lpString="*.txt") returned 5
	[0133.320] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.pdf") returned 0
	[0133.321] lstrlenA (lpString="*.pdf") returned 5
	[0133.321] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.htm") returned 0
	[0133.321] lstrlenA (lpString="*.htm") returned 5
	[0133.321] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.html") returned 0
	[0133.321] lstrlenA (lpString="*.html") returned 6
	[0133.321] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.mdb") returned 0
	[0133.321] lstrlenA (lpString="*.mdb") returned 5
	[0133.321] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.pfx") returned 0
	[0133.321] lstrlenA (lpString="*.pfx") returned 5
	[0133.321] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.md") returned 0
	[0133.321] lstrlenA (lpString="*.md") returned 4
	[0133.321] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.lnk") returned 0
	[0133.321] lstrlenA (lpString="*.lnk") returned 5
	[0133.321] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.torrent") returned 0
	[0133.321] lstrlenA (lpString="*.torrent") returned 9
	[0133.321] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.mov") returned 0
	[0133.321] lstrlenA (lpString="*.mov") returned 5
	[0133.321] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.3gp") returned 0
	[0133.321] lstrlenA (lpString="*.3gp") returned 5
	[0133.321] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.mpeg") returned 0
	[0133.321] lstrlenA (lpString="*.mpeg") returned 6
	[0133.321] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.mpg") returned 0
	[0133.321] lstrlenA (lpString="*.mpg") returned 5
	[0133.321] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.flv") returned 0
	[0133.321] lstrlenA (lpString="*.flv") returned 5
	[0133.321] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.avi") returned 0
	[0133.321] lstrlenA (lpString="*.avi") returned 5
	[0133.321] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.mp4") returned 0
	[0133.321] lstrlenA (lpString="*.mp4") returned 5
	[0133.321] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.wmv") returned 0
	[0133.321] lstrlenA (lpString="*.wmv") returned 5
	[0133.321] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.mkv") returned 0
	[0133.321] lstrlenA (lpString="*.mkv") returned 5
	[0133.321] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.mp3") returned 0
	[0133.321] lstrlenA (lpString="*.mp3") returned 5
	[0133.322] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.wav") returned 0
	[0133.322] lstrlenA (lpString="*.wav") returned 5
	[0133.322] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.flac") returned 0
	[0133.322] lstrlenA (lpString="*.flac") returned 6
	[0133.322] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.wma") returned 0
	[0133.322] lstrlenA (lpString="*.wma") returned 5
	[0133.322] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.au3") returned 0
	[0133.322] lstrlenA (lpString="*.au3") returned 5
	[0133.322] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.ahk") returned 0
	[0133.322] lstrlenA (lpString="*.ahk") returned 5
	[0133.322] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.c") returned 0
	[0133.322] lstrlenA (lpString="*.c") returned 3
	[0133.322] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.cc") returned 0
	[0133.322] lstrlenA (lpString="*.cc") returned 4
	[0133.322] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.cpp") returned 0
	[0133.322] lstrlenA (lpString="*.cpp") returned 5
	[0133.322] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.cxx") returned 0
	[0133.322] lstrlenA (lpString="*.cxx") returned 5
	[0133.322] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.c++") returned 0
	[0133.322] lstrlenA (lpString="*.c++") returned 5
	[0133.322] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.cs") returned 0
	[0133.322] lstrlenA (lpString="*.cs") returned 4
	[0133.322] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.vb") returned 0
	[0133.322] lstrlenA (lpString="*.vb") returned 4
	[0133.322] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.bas") returned 0
	[0133.322] lstrlenA (lpString="*.bas") returned 5
	[0133.322] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.csproj") returned 0
	[0133.322] lstrlenA (lpString="*.csproj") returned 8
	[0133.322] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.vbproj") returned 0
	[0133.322] lstrlenA (lpString="*.vbproj") returned 8
	[0133.322] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.vcxproj") returned 0
	[0133.322] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.322] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.manifest") returned 0
	[0133.323] lstrlenA (lpString="*.manifest") returned 10
	[0133.323] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.php") returned 0
	[0133.323] lstrlenA (lpString="*.php") returned 5
	[0133.323] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.vbe") returned 0
	[0133.323] lstrlenA (lpString="*.vbe") returned 5
	[0133.323] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.vba") returned 0
	[0133.323] lstrlenA (lpString="*.vba") returned 5
	[0133.323] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.vbs") returned 0
	[0133.323] lstrlenA (lpString="*.vbs") returned 5
	[0133.323] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.bat") returned 0
	[0133.323] lstrlenA (lpString="*.bat") returned 5
	[0133.323] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.cmd") returned 0
	[0133.323] lstrlenA (lpString="*.cmd") returned 5
	[0133.323] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.js") returned 0
	[0133.323] lstrlenA (lpString="*.js") returned 4
	[0133.323] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.jscript") returned 0
	[0133.323] lstrlenA (lpString="*.jscript") returned 9
	[0133.323] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.hta") returned 0
	[0133.323] lstrlenA (lpString="*.hta") returned 5
	[0133.323] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.php7") returned 0
	[0133.323] lstrlenA (lpString="*.php7") returned 6
	[0133.323] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.db") returned 0
	[0133.323] lstrlenA (lpString="*.db") returned 4
	[0133.323] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.swf") returned 0
	[0133.323] lstrlenA (lpString="*.swf") returned 5
	[0133.323] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.eml") returned 0
	[0133.323] lstrlenA (lpString="*.eml") returned 5
	[0133.323] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.part") returned 0
	[0133.323] lstrlenA (lpString="*.part") returned 6
	[0133.323] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.nfo") returned 0
	[0133.323] lstrlenA (lpString="*.nfo") returned 5
	[0133.323] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.rsa") returned 0
	[0133.323] lstrlenA (lpString="*.rsa") returned 5
	[0133.323] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.key") returned 0
	[0133.323] lstrlenA (lpString="*.key") returned 5
	[0133.324] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.aes") returned 0
	[0133.324] lstrlenA (lpString="*.aes") returned 5
	[0133.324] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.blob") returned 0
	[0133.324] lstrlenA (lpString="*.blob") returned 6
	[0133.324] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.btc") returned 0
	[0133.324] lstrlenA (lpString="*.btc") returned 5
	[0133.324] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", pszSpec="*.wallet") returned 0
	[0133.324] lstrlenA (lpString="*.wallet") returned 8
	[0133.324] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f110 | out: lpFindFileData=0x19f110*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5afb75b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7c375100, ftLastAccessTime.dwHighDateTime=0x1d1deb2, ftLastWriteTime.dwLowDateTime=0x7c375100, ftLastWriteTime.dwHighDateTime=0x1d1deb2, nFileSizeHigh=0x0, nFileSizeLow=0x998, dwReserved0=0x690076, dwReserved1=0x65006e, cFileName="widevinecdm.dll.lib", cAlternateFileName="WIDEVI~1.LIB")) returned 0
	[0133.324] FindClose (in: hFindFile=0x7cb750 | out: hFindFile=0x7cb750) returned 1
	[0133.324] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5af7cc2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5af7cc2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5b71e56, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.4.8.903", cAlternateFileName="148~1.903")) returned 0
	[0133.324] FindClose (in: hFindFile=0x7cbad0 | out: hFindFile=0x7cbad0) returned 1
	[0133.324] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2edfb3e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x2edfb3e, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x2ee0ebb, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="handlers.json", cAlternateFileName="HANDLE~1.JSO")) returned 1
	[0133.324] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0133.324] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="handlers.json") returned -1
	[0133.324] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="handlers.json") returned 1
	[0133.324] lstrcmpiA (lpString1="", lpString2="handlers.json") returned -1
	[0133.324] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\*.*") returned="*.*"
	[0133.324] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\"
	[0133.324] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned=""
	[0133.324] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.324] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\how-to-decrypt-files.htm")) returned 0x20
	[0133.324] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="handlers.json" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json"
	[0133.324] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json", pszSpec="*.zip") returned 0
	[0133.324] lstrlenA (lpString="*.zip") returned 5
	[0133.324] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json", pszSpec="*.rar") returned 0
	[0133.324] lstrlenA (lpString="*.rar") returned 5
	[0133.324] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json", pszSpec="*.7z") returned 0
	[0133.325] lstrlenA (lpString="*.7z") returned 4
	[0133.325] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json", pszSpec="*.tar") returned 0
	[0133.325] lstrlenA (lpString="*.tar") returned 5
	[0133.325] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json", pszSpec="*.gzip") returned 0
	[0133.325] lstrlenA (lpString="*.gzip") returned 6
	[0133.325] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json", pszSpec="*.jpg") returned 0
	[0133.325] lstrlenA (lpString="*.jpg") returned 5
	[0133.325] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json", pszSpec="*.jpeg") returned 0
	[0133.325] lstrlenA (lpString="*.jpeg") returned 6
	[0133.325] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json", pszSpec="*.bmp") returned 0
	[0133.325] lstrlenA (lpString="*.bmp") returned 5
	[0133.325] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json", pszSpec="*.gif") returned 0
	[0133.325] lstrlenA (lpString="*.gif") returned 5
	[0133.325] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json", pszSpec="*.png") returned 0
	[0133.325] lstrlenA (lpString="*.png") returned 5
	[0133.325] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json", pszSpec="*.doc") returned 0
	[0133.325] lstrlenA (lpString="*.doc") returned 5
	[0133.325] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json", pszSpec="*.docx") returned 0
	[0133.325] lstrlenA (lpString="*.docx") returned 6
	[0133.325] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json", pszSpec="*.xls") returned 0
	[0133.325] lstrlenA (lpString="*.xls") returned 5
	[0133.325] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json", pszSpec="*.xlsx") returned 0
	[0133.325] lstrlenA (lpString="*.xlsx") returned 6
	[0133.325] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json", pszSpec="*.ppt") returned 0
	[0133.325] lstrlenA (lpString="*.ppt") returned 5
	[0133.325] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json", pszSpec="*.pptx") returned 0
	[0133.325] lstrlenA (lpString="*.pptx") returned 6
	[0133.325] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json", pszSpec="*.txt") returned 0
	[0133.325] lstrlenA (lpString="*.txt") returned 5
	[0133.325] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json", pszSpec="*.pdf") returned 0
	[0133.325] lstrlenA (lpString="*.pdf") returned 5
	[0133.325] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json", pszSpec="*.htm") returned 0
	[0133.325] lstrlenA (lpString="*.htm") returned 5
	[0133.325] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json", pszSpec="*.html") returned 0
	[0133.325] lstrlenA (lpString="*.html") returned 6
	[0133.326] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json", pszSpec="*.mdb") returned 0
	[0133.326] lstrlenA (lpString="*.mdb") returned 5
	[0133.326] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json", pszSpec="*.pfx") returned 0
	[0133.326] lstrlenA (lpString="*.pfx") returned 5
	[0133.326] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json", pszSpec="*.md") returned 0
	[0133.326] lstrlenA (lpString="*.md") returned 4
	[0133.326] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json", pszSpec="*.lnk") returned 0
	[0133.326] lstrlenA (lpString="*.lnk") returned 5
	[0133.326] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json", pszSpec="*.torrent") returned 0
	[0133.326] lstrlenA (lpString="*.torrent") returned 9
	[0133.326] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json", pszSpec="*.mov") returned 0
	[0133.326] lstrlenA (lpString="*.mov") returned 5
	[0133.326] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json", pszSpec="*.3gp") returned 0
	[0133.326] lstrlenA (lpString="*.3gp") returned 5
	[0133.326] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json", pszSpec="*.mpeg") returned 0
	[0133.326] lstrlenA (lpString="*.mpeg") returned 6
	[0133.326] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json", pszSpec="*.mpg") returned 0
	[0133.326] lstrlenA (lpString="*.mpg") returned 5
	[0133.326] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json", pszSpec="*.flv") returned 0
	[0133.326] lstrlenA (lpString="*.flv") returned 5
	[0133.326] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe6922fa, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe6922fa, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb81085d6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="key3.db", cAlternateFileName="")) returned 1
	[0133.326] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0133.326] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="key3.db") returned -1
	[0133.326] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="key3.db") returned -1
	[0133.327] lstrcmpiA (lpString1="", lpString2="key3.db") returned -1
	[0133.327] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json") returned="handlers.json"
	[0133.327] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\"
	[0133.327] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned=""
	[0133.327] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.327] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\how-to-decrypt-files.htm")) returned 0x20
	[0133.327] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="key3.db" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db"
	[0133.327] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db"
	[0133.327] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db"
	[0133.327] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db."
	[0133.327] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db.exe"
	[0133.327] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\key3.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0133.327] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4000
	[0133.328] GetFileTime (in: hFile=0x220, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xfe6922fa, dwHighDateTime=0x1d327c9), lpLastAccessTime=0x407536*(dwLowDateTime=0xfe6922fa, dwHighDateTime=0x1d327c9), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb81085d6, dwHighDateTime=0x1d327cc)) returned 1
	[0133.328] SetFilePointer (in: hFile=0x220, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.328] ReadFile (in: hFile=0x220, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x3fbe, lpOverlapped=0x0) returned 1
	[0133.330] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db") returned="key3.db"
	[0133.330] SetFilePointer (in: hFile=0x220, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.330] WriteFile (in: hFile=0x220, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x3fbe, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x3fbe, lpOverlapped=0x0) returned 1
	[0133.330] SetFileTime (hFile=0x220, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.330] CloseHandle (hObject=0x220) returned 1
	[0133.330] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\key3.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\key3.db.exe")) returned 1
	[0133.331] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="minidumps", cAlternateFileName="MINIDU~1")) returned 1
	[0133.331] lstrcmpA (lpString1=".", lpString2="minidumps") returned -1
	[0133.331] lstrcmpA (lpString1="..", lpString2="minidumps") returned -1
	[0133.331] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db") returned="key3.db"
	[0133.331] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="minidumps" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\minidumps") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\minidumps"
	[0133.331] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\minidumps") returned 83
	[0133.331] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\minidumps\\*.*", lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName=".", cAlternateFileName="")) returned 0x7cb750
	[0133.331] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.331] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="..", cAlternateFileName="")) returned 1
	[0133.331] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.331] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.331] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="..", cAlternateFileName="")) returned 0
	[0133.331] FindClose (in: hFindFile=0x7cb750 | out: hFindFile=0x7cb750) returned 1
	[0133.332] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x6f2e0a0, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="parent.lock", cAlternateFileName="PARENT~1.LOC")) returned 1
	[0133.332] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0133.332] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="parent.lock") returned -1
	[0133.332] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="parent.lock") returned -1
	[0133.332] lstrcmpiA (lpString1="", lpString2="parent.lock") returned -1
	[0133.332] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\*.*") returned="*.*"
	[0133.332] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\"
	[0133.332] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned=""
	[0133.332] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.332] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\how-to-decrypt-files.htm")) returned 0x20
	[0133.332] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="parent.lock" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock"
	[0133.332] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.zip") returned 0
	[0133.332] lstrlenA (lpString="*.zip") returned 5
	[0133.332] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.rar") returned 0
	[0133.332] lstrlenA (lpString="*.rar") returned 5
	[0133.332] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.7z") returned 0
	[0133.332] lstrlenA (lpString="*.7z") returned 4
	[0133.332] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.tar") returned 0
	[0133.332] lstrlenA (lpString="*.tar") returned 5
	[0133.332] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.gzip") returned 0
	[0133.332] lstrlenA (lpString="*.gzip") returned 6
	[0133.332] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.jpg") returned 0
	[0133.332] lstrlenA (lpString="*.jpg") returned 5
	[0133.332] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.jpeg") returned 0
	[0133.332] lstrlenA (lpString="*.jpeg") returned 6
	[0133.332] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.bmp") returned 0
	[0133.332] lstrlenA (lpString="*.bmp") returned 5
	[0133.332] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.gif") returned 0
	[0133.332] lstrlenA (lpString="*.gif") returned 5
	[0133.332] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.png") returned 0
	[0133.333] lstrlenA (lpString="*.png") returned 5
	[0133.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.doc") returned 0
	[0133.333] lstrlenA (lpString="*.doc") returned 5
	[0133.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.docx") returned 0
	[0133.333] lstrlenA (lpString="*.docx") returned 6
	[0133.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.xls") returned 0
	[0133.333] lstrlenA (lpString="*.xls") returned 5
	[0133.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.xlsx") returned 0
	[0133.333] lstrlenA (lpString="*.xlsx") returned 6
	[0133.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.ppt") returned 0
	[0133.333] lstrlenA (lpString="*.ppt") returned 5
	[0133.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.pptx") returned 0
	[0133.333] lstrlenA (lpString="*.pptx") returned 6
	[0133.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.txt") returned 0
	[0133.333] lstrlenA (lpString="*.txt") returned 5
	[0133.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.pdf") returned 0
	[0133.333] lstrlenA (lpString="*.pdf") returned 5
	[0133.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.htm") returned 0
	[0133.333] lstrlenA (lpString="*.htm") returned 5
	[0133.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.html") returned 0
	[0133.333] lstrlenA (lpString="*.html") returned 6
	[0133.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.mdb") returned 0
	[0133.333] lstrlenA (lpString="*.mdb") returned 5
	[0133.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.pfx") returned 0
	[0133.333] lstrlenA (lpString="*.pfx") returned 5
	[0133.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.md") returned 0
	[0133.333] lstrlenA (lpString="*.md") returned 4
	[0133.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.lnk") returned 0
	[0133.333] lstrlenA (lpString="*.lnk") returned 5
	[0133.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.torrent") returned 0
	[0133.333] lstrlenA (lpString="*.torrent") returned 9
	[0133.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.mov") returned 0
	[0133.333] lstrlenA (lpString="*.mov") returned 5
	[0133.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.3gp") returned 0
	[0133.333] lstrlenA (lpString="*.3gp") returned 5
	[0133.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.mpeg") returned 0
	[0133.334] lstrlenA (lpString="*.mpeg") returned 6
	[0133.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.mpg") returned 0
	[0133.334] lstrlenA (lpString="*.mpg") returned 5
	[0133.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.flv") returned 0
	[0133.334] lstrlenA (lpString="*.flv") returned 5
	[0133.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.avi") returned 0
	[0133.334] lstrlenA (lpString="*.avi") returned 5
	[0133.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.mp4") returned 0
	[0133.334] lstrlenA (lpString="*.mp4") returned 5
	[0133.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.wmv") returned 0
	[0133.334] lstrlenA (lpString="*.wmv") returned 5
	[0133.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.mkv") returned 0
	[0133.334] lstrlenA (lpString="*.mkv") returned 5
	[0133.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.mp3") returned 0
	[0133.334] lstrlenA (lpString="*.mp3") returned 5
	[0133.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.wav") returned 0
	[0133.334] lstrlenA (lpString="*.wav") returned 5
	[0133.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.flac") returned 0
	[0133.334] lstrlenA (lpString="*.flac") returned 6
	[0133.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.wma") returned 0
	[0133.334] lstrlenA (lpString="*.wma") returned 5
	[0133.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.au3") returned 0
	[0133.334] lstrlenA (lpString="*.au3") returned 5
	[0133.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.ahk") returned 0
	[0133.334] lstrlenA (lpString="*.ahk") returned 5
	[0133.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.c") returned 0
	[0133.334] lstrlenA (lpString="*.c") returned 3
	[0133.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.cc") returned 0
	[0133.334] lstrlenA (lpString="*.cc") returned 4
	[0133.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.cpp") returned 0
	[0133.334] lstrlenA (lpString="*.cpp") returned 5
	[0133.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.cxx") returned 0
	[0133.334] lstrlenA (lpString="*.cxx") returned 5
	[0133.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.c++") returned 0
	[0133.335] lstrlenA (lpString="*.c++") returned 5
	[0133.335] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.cs") returned 0
	[0133.335] lstrlenA (lpString="*.cs") returned 4
	[0133.335] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.vb") returned 0
	[0133.335] lstrlenA (lpString="*.vb") returned 4
	[0133.335] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.bas") returned 0
	[0133.335] lstrlenA (lpString="*.bas") returned 5
	[0133.335] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.csproj") returned 0
	[0133.335] lstrlenA (lpString="*.csproj") returned 8
	[0133.335] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.vbproj") returned 0
	[0133.335] lstrlenA (lpString="*.vbproj") returned 8
	[0133.335] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.vcxproj") returned 0
	[0133.335] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.335] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.manifest") returned 0
	[0133.335] lstrlenA (lpString="*.manifest") returned 10
	[0133.335] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.php") returned 0
	[0133.335] lstrlenA (lpString="*.php") returned 5
	[0133.335] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.vbe") returned 0
	[0133.335] lstrlenA (lpString="*.vbe") returned 5
	[0133.335] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.vba") returned 0
	[0133.335] lstrlenA (lpString="*.vba") returned 5
	[0133.335] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.vbs") returned 0
	[0133.335] lstrlenA (lpString="*.vbs") returned 5
	[0133.335] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.bat") returned 0
	[0133.335] lstrlenA (lpString="*.bat") returned 5
	[0133.335] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.cmd") returned 0
	[0133.335] lstrlenA (lpString="*.cmd") returned 5
	[0133.335] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.js") returned 0
	[0133.335] lstrlenA (lpString="*.js") returned 4
	[0133.335] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.jscript") returned 0
	[0133.335] lstrlenA (lpString="*.jscript") returned 9
	[0133.335] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.hta") returned 0
	[0133.335] lstrlenA (lpString="*.hta") returned 5
	[0133.335] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.php7") returned 0
	[0133.336] lstrlenA (lpString="*.php7") returned 6
	[0133.336] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.db") returned 0
	[0133.336] lstrlenA (lpString="*.db") returned 4
	[0133.336] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.swf") returned 0
	[0133.336] lstrlenA (lpString="*.swf") returned 5
	[0133.336] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.eml") returned 0
	[0133.336] lstrlenA (lpString="*.eml") returned 5
	[0133.336] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.part") returned 0
	[0133.336] lstrlenA (lpString="*.part") returned 6
	[0133.336] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.nfo") returned 0
	[0133.336] lstrlenA (lpString="*.nfo") returned 5
	[0133.336] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.rsa") returned 0
	[0133.336] lstrlenA (lpString="*.rsa") returned 5
	[0133.336] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.key") returned 0
	[0133.336] lstrlenA (lpString="*.key") returned 5
	[0133.336] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.aes") returned 0
	[0133.336] lstrlenA (lpString="*.aes") returned 5
	[0133.336] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.blob") returned 0
	[0133.336] lstrlenA (lpString="*.blob") returned 6
	[0133.336] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.btc") returned 0
	[0133.336] lstrlenA (lpString="*.btc") returned 5
	[0133.336] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", pszSpec="*.wallet") returned 0
	[0133.336] lstrlenA (lpString="*.wallet") returned 8
	[0133.336] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd67a0d8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd67a0d8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd7d1832, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="permissions.sqlite", cAlternateFileName="PERMIS~1.SQL")) returned 1
	[0133.336] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0133.336] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="permissions.sqlite") returned -1
	[0133.336] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="permissions.sqlite") returned -1
	[0133.336] lstrcmpiA (lpString1="", lpString2="permissions.sqlite") returned -1
	[0133.336] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock") returned="parent.lock"
	[0133.336] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\"
	[0133.336] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned=""
	[0133.337] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.337] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\how-to-decrypt-files.htm")) returned 0x20
	[0133.337] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="permissions.sqlite" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite"
	[0133.337] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.zip") returned 0
	[0133.337] lstrlenA (lpString="*.zip") returned 5
	[0133.337] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.rar") returned 0
	[0133.337] lstrlenA (lpString="*.rar") returned 5
	[0133.337] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.7z") returned 0
	[0133.337] lstrlenA (lpString="*.7z") returned 4
	[0133.337] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.tar") returned 0
	[0133.337] lstrlenA (lpString="*.tar") returned 5
	[0133.337] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.gzip") returned 0
	[0133.337] lstrlenA (lpString="*.gzip") returned 6
	[0133.337] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.jpg") returned 0
	[0133.337] lstrlenA (lpString="*.jpg") returned 5
	[0133.337] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.jpeg") returned 0
	[0133.337] lstrlenA (lpString="*.jpeg") returned 6
	[0133.337] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.bmp") returned 0
	[0133.337] lstrlenA (lpString="*.bmp") returned 5
	[0133.337] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.gif") returned 0
	[0133.337] lstrlenA (lpString="*.gif") returned 5
	[0133.337] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.png") returned 0
	[0133.337] lstrlenA (lpString="*.png") returned 5
	[0133.337] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.doc") returned 0
	[0133.337] lstrlenA (lpString="*.doc") returned 5
	[0133.337] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.docx") returned 0
	[0133.337] lstrlenA (lpString="*.docx") returned 6
	[0133.337] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.xls") returned 0
	[0133.337] lstrlenA (lpString="*.xls") returned 5
	[0133.337] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.xlsx") returned 0
	[0133.337] lstrlenA (lpString="*.xlsx") returned 6
	[0133.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.ppt") returned 0
	[0133.338] lstrlenA (lpString="*.ppt") returned 5
	[0133.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.pptx") returned 0
	[0133.338] lstrlenA (lpString="*.pptx") returned 6
	[0133.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.txt") returned 0
	[0133.338] lstrlenA (lpString="*.txt") returned 5
	[0133.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.pdf") returned 0
	[0133.338] lstrlenA (lpString="*.pdf") returned 5
	[0133.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.htm") returned 0
	[0133.338] lstrlenA (lpString="*.htm") returned 5
	[0133.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.html") returned 0
	[0133.338] lstrlenA (lpString="*.html") returned 6
	[0133.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.mdb") returned 0
	[0133.338] lstrlenA (lpString="*.mdb") returned 5
	[0133.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.pfx") returned 0
	[0133.338] lstrlenA (lpString="*.pfx") returned 5
	[0133.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.md") returned 0
	[0133.338] lstrlenA (lpString="*.md") returned 4
	[0133.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.lnk") returned 0
	[0133.338] lstrlenA (lpString="*.lnk") returned 5
	[0133.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.torrent") returned 0
	[0133.338] lstrlenA (lpString="*.torrent") returned 9
	[0133.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.mov") returned 0
	[0133.338] lstrlenA (lpString="*.mov") returned 5
	[0133.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.3gp") returned 0
	[0133.338] lstrlenA (lpString="*.3gp") returned 5
	[0133.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.mpeg") returned 0
	[0133.338] lstrlenA (lpString="*.mpeg") returned 6
	[0133.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.mpg") returned 0
	[0133.338] lstrlenA (lpString="*.mpg") returned 5
	[0133.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.flv") returned 0
	[0133.338] lstrlenA (lpString="*.flv") returned 5
	[0133.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.avi") returned 0
	[0133.338] lstrlenA (lpString="*.avi") returned 5
	[0133.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.mp4") returned 0
	[0133.339] lstrlenA (lpString="*.mp4") returned 5
	[0133.339] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.wmv") returned 0
	[0133.339] lstrlenA (lpString="*.wmv") returned 5
	[0133.339] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.mkv") returned 0
	[0133.339] lstrlenA (lpString="*.mkv") returned 5
	[0133.339] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.mp3") returned 0
	[0133.339] lstrlenA (lpString="*.mp3") returned 5
	[0133.339] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.wav") returned 0
	[0133.339] lstrlenA (lpString="*.wav") returned 5
	[0133.339] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.flac") returned 0
	[0133.339] lstrlenA (lpString="*.flac") returned 6
	[0133.339] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.wma") returned 0
	[0133.339] lstrlenA (lpString="*.wma") returned 5
	[0133.339] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.au3") returned 0
	[0133.339] lstrlenA (lpString="*.au3") returned 5
	[0133.339] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.ahk") returned 0
	[0133.339] lstrlenA (lpString="*.ahk") returned 5
	[0133.339] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.c") returned 0
	[0133.339] lstrlenA (lpString="*.c") returned 3
	[0133.339] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.cc") returned 0
	[0133.339] lstrlenA (lpString="*.cc") returned 4
	[0133.339] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.cpp") returned 0
	[0133.339] lstrlenA (lpString="*.cpp") returned 5
	[0133.339] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.cxx") returned 0
	[0133.339] lstrlenA (lpString="*.cxx") returned 5
	[0133.339] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.c++") returned 0
	[0133.339] lstrlenA (lpString="*.c++") returned 5
	[0133.339] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.cs") returned 0
	[0133.339] lstrlenA (lpString="*.cs") returned 4
	[0133.339] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.vb") returned 0
	[0133.339] lstrlenA (lpString="*.vb") returned 4
	[0133.339] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.bas") returned 0
	[0133.339] lstrlenA (lpString="*.bas") returned 5
	[0133.339] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.csproj") returned 0
	[0133.339] lstrlenA (lpString="*.csproj") returned 8
	[0133.340] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.vbproj") returned 0
	[0133.340] lstrlenA (lpString="*.vbproj") returned 8
	[0133.340] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.vcxproj") returned 0
	[0133.340] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.340] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.manifest") returned 0
	[0133.340] lstrlenA (lpString="*.manifest") returned 10
	[0133.340] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.php") returned 0
	[0133.340] lstrlenA (lpString="*.php") returned 5
	[0133.340] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.vbe") returned 0
	[0133.340] lstrlenA (lpString="*.vbe") returned 5
	[0133.340] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.vba") returned 0
	[0133.340] lstrlenA (lpString="*.vba") returned 5
	[0133.340] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.vbs") returned 0
	[0133.340] lstrlenA (lpString="*.vbs") returned 5
	[0133.340] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.bat") returned 0
	[0133.340] lstrlenA (lpString="*.bat") returned 5
	[0133.340] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.cmd") returned 0
	[0133.340] lstrlenA (lpString="*.cmd") returned 5
	[0133.340] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.js") returned 0
	[0133.340] lstrlenA (lpString="*.js") returned 4
	[0133.340] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.jscript") returned 0
	[0133.340] lstrlenA (lpString="*.jscript") returned 9
	[0133.340] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.hta") returned 0
	[0133.340] lstrlenA (lpString="*.hta") returned 5
	[0133.340] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.php7") returned 0
	[0133.340] lstrlenA (lpString="*.php7") returned 6
	[0133.340] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.db") returned 0
	[0133.340] lstrlenA (lpString="*.db") returned 4
	[0133.340] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.swf") returned 0
	[0133.340] lstrlenA (lpString="*.swf") returned 5
	[0133.340] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.eml") returned 0
	[0133.340] lstrlenA (lpString="*.eml") returned 5
	[0133.340] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.part") returned 0
	[0133.340] lstrlenA (lpString="*.part") returned 6
	[0133.341] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.nfo") returned 0
	[0133.341] lstrlenA (lpString="*.nfo") returned 5
	[0133.341] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.rsa") returned 0
	[0133.341] lstrlenA (lpString="*.rsa") returned 5
	[0133.341] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.key") returned 0
	[0133.341] lstrlenA (lpString="*.key") returned 5
	[0133.341] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.aes") returned 0
	[0133.341] lstrlenA (lpString="*.aes") returned 5
	[0133.341] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.blob") returned 0
	[0133.341] lstrlenA (lpString="*.blob") returned 6
	[0133.341] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.btc") returned 0
	[0133.341] lstrlenA (lpString="*.btc") returned 5
	[0133.341] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", pszSpec="*.wallet") returned 0
	[0133.341] lstrlenA (lpString="*.wallet") returned 8
	[0133.341] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdd54ecc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfdd54ecc, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x42fefdeb, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x500000, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="places.sqlite", cAlternateFileName="PLACES~1.SQL")) returned 1
	[0133.341] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0133.341] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="places.sqlite") returned -1
	[0133.341] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="places.sqlite") returned -1
	[0133.341] lstrcmpiA (lpString1="", lpString2="places.sqlite") returned -1
	[0133.341] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite") returned="permissions.sqlite"
	[0133.341] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\"
	[0133.341] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned=""
	[0133.341] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.341] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\how-to-decrypt-files.htm")) returned 0x20
	[0133.341] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="places.sqlite" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite"
	[0133.341] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.zip") returned 0
	[0133.341] lstrlenA (lpString="*.zip") returned 5
	[0133.341] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.rar") returned 0
	[0133.341] lstrlenA (lpString="*.rar") returned 5
	[0133.341] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.7z") returned 0
	[0133.341] lstrlenA (lpString="*.7z") returned 4
	[0133.341] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.tar") returned 0
	[0133.342] lstrlenA (lpString="*.tar") returned 5
	[0133.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.gzip") returned 0
	[0133.342] lstrlenA (lpString="*.gzip") returned 6
	[0133.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.jpg") returned 0
	[0133.342] lstrlenA (lpString="*.jpg") returned 5
	[0133.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.jpeg") returned 0
	[0133.342] lstrlenA (lpString="*.jpeg") returned 6
	[0133.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.bmp") returned 0
	[0133.342] lstrlenA (lpString="*.bmp") returned 5
	[0133.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.gif") returned 0
	[0133.342] lstrlenA (lpString="*.gif") returned 5
	[0133.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.png") returned 0
	[0133.342] lstrlenA (lpString="*.png") returned 5
	[0133.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.doc") returned 0
	[0133.342] lstrlenA (lpString="*.doc") returned 5
	[0133.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.docx") returned 0
	[0133.342] lstrlenA (lpString="*.docx") returned 6
	[0133.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.xls") returned 0
	[0133.342] lstrlenA (lpString="*.xls") returned 5
	[0133.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.xlsx") returned 0
	[0133.342] lstrlenA (lpString="*.xlsx") returned 6
	[0133.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.ppt") returned 0
	[0133.342] lstrlenA (lpString="*.ppt") returned 5
	[0133.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.pptx") returned 0
	[0133.342] lstrlenA (lpString="*.pptx") returned 6
	[0133.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.txt") returned 0
	[0133.342] lstrlenA (lpString="*.txt") returned 5
	[0133.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.pdf") returned 0
	[0133.342] lstrlenA (lpString="*.pdf") returned 5
	[0133.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.htm") returned 0
	[0133.342] lstrlenA (lpString="*.htm") returned 5
	[0133.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.html") returned 0
	[0133.342] lstrlenA (lpString="*.html") returned 6
	[0133.343] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.mdb") returned 0
	[0133.343] lstrlenA (lpString="*.mdb") returned 5
	[0133.343] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.pfx") returned 0
	[0133.343] lstrlenA (lpString="*.pfx") returned 5
	[0133.343] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.md") returned 0
	[0133.343] lstrlenA (lpString="*.md") returned 4
	[0133.343] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.lnk") returned 0
	[0133.343] lstrlenA (lpString="*.lnk") returned 5
	[0133.343] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.torrent") returned 0
	[0133.343] lstrlenA (lpString="*.torrent") returned 9
	[0133.343] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.mov") returned 0
	[0133.343] lstrlenA (lpString="*.mov") returned 5
	[0133.343] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.3gp") returned 0
	[0133.343] lstrlenA (lpString="*.3gp") returned 5
	[0133.343] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.mpeg") returned 0
	[0133.343] lstrlenA (lpString="*.mpeg") returned 6
	[0133.343] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.mpg") returned 0
	[0133.343] lstrlenA (lpString="*.mpg") returned 5
	[0133.343] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.flv") returned 0
	[0133.343] lstrlenA (lpString="*.flv") returned 5
	[0133.343] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.avi") returned 0
	[0133.343] lstrlenA (lpString="*.avi") returned 5
	[0133.343] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.mp4") returned 0
	[0133.343] lstrlenA (lpString="*.mp4") returned 5
	[0133.343] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.wmv") returned 0
	[0133.343] lstrlenA (lpString="*.wmv") returned 5
	[0133.343] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.mkv") returned 0
	[0133.343] lstrlenA (lpString="*.mkv") returned 5
	[0133.343] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.mp3") returned 0
	[0133.343] lstrlenA (lpString="*.mp3") returned 5
	[0133.343] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.wav") returned 0
	[0133.343] lstrlenA (lpString="*.wav") returned 5
	[0133.343] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.flac") returned 0
	[0133.343] lstrlenA (lpString="*.flac") returned 6
	[0133.344] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.wma") returned 0
	[0133.344] lstrlenA (lpString="*.wma") returned 5
	[0133.344] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.au3") returned 0
	[0133.344] lstrlenA (lpString="*.au3") returned 5
	[0133.344] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.ahk") returned 0
	[0133.344] lstrlenA (lpString="*.ahk") returned 5
	[0133.344] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.c") returned 0
	[0133.344] lstrlenA (lpString="*.c") returned 3
	[0133.344] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.cc") returned 0
	[0133.344] lstrlenA (lpString="*.cc") returned 4
	[0133.344] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.cpp") returned 0
	[0133.344] lstrlenA (lpString="*.cpp") returned 5
	[0133.344] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.cxx") returned 0
	[0133.344] lstrlenA (lpString="*.cxx") returned 5
	[0133.344] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.c++") returned 0
	[0133.344] lstrlenA (lpString="*.c++") returned 5
	[0133.344] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.cs") returned 0
	[0133.344] lstrlenA (lpString="*.cs") returned 4
	[0133.344] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.vb") returned 0
	[0133.344] lstrlenA (lpString="*.vb") returned 4
	[0133.344] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.bas") returned 0
	[0133.344] lstrlenA (lpString="*.bas") returned 5
	[0133.344] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.csproj") returned 0
	[0133.344] lstrlenA (lpString="*.csproj") returned 8
	[0133.344] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.vbproj") returned 0
	[0133.344] lstrlenA (lpString="*.vbproj") returned 8
	[0133.344] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.vcxproj") returned 0
	[0133.344] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.344] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.manifest") returned 0
	[0133.344] lstrlenA (lpString="*.manifest") returned 10
	[0133.344] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.php") returned 0
	[0133.344] lstrlenA (lpString="*.php") returned 5
	[0133.344] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.vbe") returned 0
	[0133.344] lstrlenA (lpString="*.vbe") returned 5
	[0133.344] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.vba") returned 0
	[0133.345] lstrlenA (lpString="*.vba") returned 5
	[0133.345] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.vbs") returned 0
	[0133.345] lstrlenA (lpString="*.vbs") returned 5
	[0133.345] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.bat") returned 0
	[0133.345] lstrlenA (lpString="*.bat") returned 5
	[0133.345] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.cmd") returned 0
	[0133.345] lstrlenA (lpString="*.cmd") returned 5
	[0133.345] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.js") returned 0
	[0133.345] lstrlenA (lpString="*.js") returned 4
	[0133.345] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.jscript") returned 0
	[0133.345] lstrlenA (lpString="*.jscript") returned 9
	[0133.345] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.hta") returned 0
	[0133.345] lstrlenA (lpString="*.hta") returned 5
	[0133.345] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.php7") returned 0
	[0133.345] lstrlenA (lpString="*.php7") returned 6
	[0133.345] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.db") returned 0
	[0133.345] lstrlenA (lpString="*.db") returned 4
	[0133.345] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.swf") returned 0
	[0133.345] lstrlenA (lpString="*.swf") returned 5
	[0133.345] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.eml") returned 0
	[0133.345] lstrlenA (lpString="*.eml") returned 5
	[0133.345] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.part") returned 0
	[0133.345] lstrlenA (lpString="*.part") returned 6
	[0133.345] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.nfo") returned 0
	[0133.345] lstrlenA (lpString="*.nfo") returned 5
	[0133.345] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.rsa") returned 0
	[0133.345] lstrlenA (lpString="*.rsa") returned 5
	[0133.345] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.key") returned 0
	[0133.345] lstrlenA (lpString="*.key") returned 5
	[0133.345] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.aes") returned 0
	[0133.345] lstrlenA (lpString="*.aes") returned 5
	[0133.345] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.blob") returned 0
	[0133.345] lstrlenA (lpString="*.blob") returned 6
	[0133.345] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.btc") returned 0
	[0133.345] lstrlenA (lpString="*.btc") returned 5
	[0133.346] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", pszSpec="*.wallet") returned 0
	[0133.346] lstrlenA (lpString="*.wallet") returned 8
	[0133.346] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba329010, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xba329010, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x72e7b76, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="places.sqlite-shm", cAlternateFileName="PLACES~3.SQL")) returned 1
	[0133.346] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0133.346] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="places.sqlite-shm") returned -1
	[0133.346] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="places.sqlite-shm") returned -1
	[0133.346] lstrcmpiA (lpString1="", lpString2="places.sqlite-shm") returned -1
	[0133.346] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite") returned="places.sqlite"
	[0133.346] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\"
	[0133.346] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned=""
	[0133.346] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.346] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\how-to-decrypt-files.htm")) returned 0x20
	[0133.346] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="places.sqlite-shm" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm"
	[0133.346] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm", pszSpec="*.zip") returned 0
	[0133.346] lstrlenA (lpString="*.zip") returned 5
	[0133.346] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm", pszSpec="*.rar") returned 0
	[0133.346] lstrlenA (lpString="*.rar") returned 5
	[0133.346] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm", pszSpec="*.7z") returned 0
	[0133.346] lstrlenA (lpString="*.7z") returned 4
	[0133.346] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm", pszSpec="*.tar") returned 0
	[0133.346] lstrlenA (lpString="*.tar") returned 5
	[0133.346] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm", pszSpec="*.gzip") returned 0
	[0133.346] lstrlenA (lpString="*.gzip") returned 6
	[0133.346] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm", pszSpec="*.jpg") returned 0
	[0133.346] lstrlenA (lpString="*.jpg") returned 5
	[0133.346] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm", pszSpec="*.jpeg") returned 0
	[0133.346] lstrlenA (lpString="*.jpeg") returned 6
	[0133.346] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm", pszSpec="*.bmp") returned 0
	[0133.346] lstrlenA (lpString="*.bmp") returned 5
	[0133.346] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm", pszSpec="*.gif") returned 0
	[0133.346] lstrlenA (lpString="*.gif") returned 5
	[0133.347] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm", pszSpec="*.png") returned 0
	[0133.347] lstrlenA (lpString="*.png") returned 5
	[0133.347] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm", pszSpec="*.doc") returned 0
	[0133.347] lstrlenA (lpString="*.doc") returned 5
	[0133.347] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm", pszSpec="*.docx") returned 0
	[0133.347] lstrlenA (lpString="*.docx") returned 6
	[0133.347] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm", pszSpec="*.xls") returned 0
	[0133.347] lstrlenA (lpString="*.xls") returned 5
	[0133.347] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm", pszSpec="*.xlsx") returned 0
	[0133.347] lstrlenA (lpString="*.xlsx") returned 6
	[0133.347] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm", pszSpec="*.ppt") returned 0
	[0133.347] lstrlenA (lpString="*.ppt") returned 5
	[0133.347] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm", pszSpec="*.pptx") returned 0
	[0133.347] lstrlenA (lpString="*.pptx") returned 6
	[0133.347] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm", pszSpec="*.txt") returned 0
	[0133.347] lstrlenA (lpString="*.txt") returned 5
	[0133.347] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm", pszSpec="*.pdf") returned 0
	[0133.347] lstrlenA (lpString="*.pdf") returned 5
	[0133.347] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm", pszSpec="*.htm") returned 0
	[0133.347] lstrlenA (lpString="*.htm") returned 5
	[0133.347] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm", pszSpec="*.html") returned 0
	[0133.347] lstrlenA (lpString="*.html") returned 6
	[0133.347] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm", pszSpec="*.mdb") returned 0
	[0133.347] lstrlenA (lpString="*.mdb") returned 5
	[0133.347] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm", pszSpec="*.pfx") returned 0
	[0133.347] lstrlenA (lpString="*.pfx") returned 5
	[0133.347] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm", pszSpec="*.md") returned 0
	[0133.347] lstrlenA (lpString="*.md") returned 4
	[0133.347] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm", pszSpec="*.lnk") returned 0
	[0133.347] lstrlenA (lpString="*.lnk") returned 5
	[0133.347] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm", pszSpec="*.torrent") returned 0
	[0133.347] lstrlenA (lpString="*.torrent") returned 9
	[0133.347] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm", pszSpec="*.mov") returned 0
	[0133.347] lstrlenA (lpString="*.mov") returned 5
	[0133.348] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm", pszSpec="*.3gp") returned 0
	[0133.348] lstrlenA (lpString="*.3gp") returned 5
	[0133.348] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm", pszSpec="*.mpeg") returned 0
	[0133.348] lstrlenA (lpString="*.mpeg") returned 6
	[0133.348] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm", pszSpec="*.mpg") returned 0
	[0133.348] lstrlenA (lpString="*.mpg") returned 5
	[0133.348] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm", pszSpec="*.flv") returned 0
	[0133.348] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba329010, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xba329010, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xb8154a58, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x208638, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="places.sqlite-wal", cAlternateFileName="PLACES~2.SQL")) returned 1
	[0133.348] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0133.348] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="places.sqlite-wal") returned -1
	[0133.348] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="places.sqlite-wal") returned -1
	[0133.348] lstrcmpiA (lpString1="", lpString2="places.sqlite-wal") returned -1
	[0133.348] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm") returned="places.sqlite-shm"
	[0133.348] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\"
	[0133.348] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned=""
	[0133.348] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.348] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\how-to-decrypt-files.htm")) returned 0x20
	[0133.348] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="places.sqlite-wal" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-wal") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-wal"
	[0133.348] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40cce7aa, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x40cce7aa, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x40ccfb2d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x1cd, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="pluginreg.dat", cAlternateFileName="PLUGIN~1.DAT")) returned 1
	[0133.349] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0133.349] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="pluginreg.dat") returned -1
	[0133.349] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="pluginreg.dat") returned -1
	[0133.349] lstrcmpiA (lpString1="", lpString2="pluginreg.dat") returned -1
	[0133.349] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-wal") returned="places.sqlite-wal"
	[0133.349] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\"
	[0133.349] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned=""
	[0133.349] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.349] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\how-to-decrypt-files.htm")) returned 0x20
	[0133.349] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="pluginreg.dat" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\pluginreg.dat") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\pluginreg.dat"
	[0133.349] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8285d1c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb8285d1c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x93d01742, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x1fcd, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="prefs.js", cAlternateFileName="")) returned 1
	[0133.349] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0133.349] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="prefs.js") returned -1
	[0133.349] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="prefs.js") returned -1
	[0133.349] lstrcmpiA (lpString1="", lpString2="prefs.js") returned -1
	[0133.349] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\pluginreg.dat") returned="pluginreg.dat"
	[0133.349] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\"
	[0133.349] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned=""
	[0133.349] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.349] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\how-to-decrypt-files.htm")) returned 0x20
	[0133.349] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="prefs.js" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\prefs.js") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\prefs.js"
	[0133.349] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\prefs.js" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\prefs.js") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\prefs.js"
	[0133.349] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\prefs.js" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\prefs.js") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\prefs.js"
	[0133.349] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\prefs.js", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\prefs.js.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\prefs.js."
	[0133.349] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\prefs.js.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\prefs.js.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\prefs.js.exe"
	[0133.350] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\prefs.js" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\prefs.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0133.350] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1fcd
	[0133.350] GetFileTime (in: hFile=0x220, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb8285d1c, dwHighDateTime=0x1d327cc), lpLastAccessTime=0x407536*(dwLowDateTime=0xb8285d1c, dwHighDateTime=0x1d327cc), lpLastWriteTime=0x40753e*(dwLowDateTime=0x93d01742, dwHighDateTime=0x1d4d5d3)) returned 1
	[0133.350] SetFilePointer (in: hFile=0x220, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.350] ReadFile (in: hFile=0x220, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1f8b, lpOverlapped=0x0) returned 1
	[0133.352] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\prefs.js") returned="prefs.js"
	[0133.352] SetFilePointer (in: hFile=0x220, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.352] WriteFile (in: hFile=0x220, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1f8b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1f8b, lpOverlapped=0x0) returned 1
	[0133.352] SetFileTime (hFile=0x220, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.352] CloseHandle (hObject=0x220) returned 1
	[0133.352] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\prefs.js" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\prefs.js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\prefs.js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\prefs.js.exe")) returned 1
	[0133.356] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1472dc0f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb8403501, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb8d8cb9a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="saved-telemetry-pings", cAlternateFileName="SAVED-~1")) returned 1
	[0133.356] lstrcmpA (lpString1=".", lpString2="saved-telemetry-pings") returned -1
	[0133.356] lstrcmpA (lpString1="..", lpString2="saved-telemetry-pings") returned -1
	[0133.356] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\prefs.js") returned="prefs.js"
	[0133.356] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="saved-telemetry-pings" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\saved-telemetry-pings") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\saved-telemetry-pings"
	[0133.356] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\saved-telemetry-pings") returned 95
	[0133.356] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\saved-telemetry-pings\\*.*", lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1472dc0f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb8403501, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb8d8cb9a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName=".", cAlternateFileName="")) returned 0x7cb750
	[0133.356] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.356] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1472dc0f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb8403501, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb8d8cb9a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="..", cAlternateFileName="")) returned 1
	[0133.356] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.356] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.356] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1472dc0f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb8403501, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb8d8cb9a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="..", cAlternateFileName="")) returned 0
	[0133.356] FindClose (in: hFindFile=0x7cb750 | out: hFindFile=0x7cb750) returned 1
	[0133.356] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4731d65, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4731d65, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x47330f8, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x36e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="search.json.mozlz4", cAlternateFileName="SEARCH~1.MOZ")) returned 1
	[0133.356] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0133.356] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="search.json.mozlz4") returned -1
	[0133.356] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="search.json.mozlz4") returned -1
	[0133.356] lstrcmpiA (lpString1="", lpString2="search.json.mozlz4") returned -1
	[0133.356] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\*.*") returned="*.*"
	[0133.356] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\"
	[0133.356] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned=""
	[0133.356] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.356] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\how-to-decrypt-files.htm")) returned 0x20
	[0133.357] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="search.json.mozlz4" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4"
	[0133.357] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.zip") returned 0
	[0133.357] lstrlenA (lpString="*.zip") returned 5
	[0133.357] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.rar") returned 0
	[0133.357] lstrlenA (lpString="*.rar") returned 5
	[0133.357] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.7z") returned 0
	[0133.357] lstrlenA (lpString="*.7z") returned 4
	[0133.357] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.tar") returned 0
	[0133.357] lstrlenA (lpString="*.tar") returned 5
	[0133.357] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.gzip") returned 0
	[0133.357] lstrlenA (lpString="*.gzip") returned 6
	[0133.357] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.jpg") returned 0
	[0133.357] lstrlenA (lpString="*.jpg") returned 5
	[0133.357] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.jpeg") returned 0
	[0133.357] lstrlenA (lpString="*.jpeg") returned 6
	[0133.357] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.bmp") returned 0
	[0133.357] lstrlenA (lpString="*.bmp") returned 5
	[0133.357] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.gif") returned 0
	[0133.357] lstrlenA (lpString="*.gif") returned 5
	[0133.357] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.png") returned 0
	[0133.357] lstrlenA (lpString="*.png") returned 5
	[0133.357] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.doc") returned 0
	[0133.357] lstrlenA (lpString="*.doc") returned 5
	[0133.357] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.docx") returned 0
	[0133.357] lstrlenA (lpString="*.docx") returned 6
	[0133.357] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.xls") returned 0
	[0133.357] lstrlenA (lpString="*.xls") returned 5
	[0133.357] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.xlsx") returned 0
	[0133.357] lstrlenA (lpString="*.xlsx") returned 6
	[0133.357] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.ppt") returned 0
	[0133.357] lstrlenA (lpString="*.ppt") returned 5
	[0133.357] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.pptx") returned 0
	[0133.357] lstrlenA (lpString="*.pptx") returned 6
	[0133.358] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.txt") returned 0
	[0133.358] lstrlenA (lpString="*.txt") returned 5
	[0133.358] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.pdf") returned 0
	[0133.358] lstrlenA (lpString="*.pdf") returned 5
	[0133.358] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.htm") returned 0
	[0133.358] lstrlenA (lpString="*.htm") returned 5
	[0133.358] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.html") returned 0
	[0133.358] lstrlenA (lpString="*.html") returned 6
	[0133.358] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.mdb") returned 0
	[0133.358] lstrlenA (lpString="*.mdb") returned 5
	[0133.358] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.pfx") returned 0
	[0133.358] lstrlenA (lpString="*.pfx") returned 5
	[0133.358] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.md") returned 0
	[0133.358] lstrlenA (lpString="*.md") returned 4
	[0133.358] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.lnk") returned 0
	[0133.358] lstrlenA (lpString="*.lnk") returned 5
	[0133.358] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.torrent") returned 0
	[0133.358] lstrlenA (lpString="*.torrent") returned 9
	[0133.358] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.mov") returned 0
	[0133.358] lstrlenA (lpString="*.mov") returned 5
	[0133.358] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.3gp") returned 0
	[0133.358] lstrlenA (lpString="*.3gp") returned 5
	[0133.358] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.mpeg") returned 0
	[0133.358] lstrlenA (lpString="*.mpeg") returned 6
	[0133.358] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.mpg") returned 0
	[0133.358] lstrlenA (lpString="*.mpg") returned 5
	[0133.358] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.flv") returned 0
	[0133.358] lstrlenA (lpString="*.flv") returned 5
	[0133.358] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.avi") returned 0
	[0133.358] lstrlenA (lpString="*.avi") returned 5
	[0133.358] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.mp4") returned 0
	[0133.358] lstrlenA (lpString="*.mp4") returned 5
	[0133.358] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.wmv") returned 0
	[0133.359] lstrlenA (lpString="*.wmv") returned 5
	[0133.359] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.mkv") returned 0
	[0133.359] lstrlenA (lpString="*.mkv") returned 5
	[0133.359] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.mp3") returned 0
	[0133.359] lstrlenA (lpString="*.mp3") returned 5
	[0133.359] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.wav") returned 0
	[0133.359] lstrlenA (lpString="*.wav") returned 5
	[0133.359] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.flac") returned 0
	[0133.359] lstrlenA (lpString="*.flac") returned 6
	[0133.359] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.wma") returned 0
	[0133.359] lstrlenA (lpString="*.wma") returned 5
	[0133.359] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.au3") returned 0
	[0133.359] lstrlenA (lpString="*.au3") returned 5
	[0133.359] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.ahk") returned 0
	[0133.359] lstrlenA (lpString="*.ahk") returned 5
	[0133.359] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.c") returned 0
	[0133.359] lstrlenA (lpString="*.c") returned 3
	[0133.359] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.cc") returned 0
	[0133.359] lstrlenA (lpString="*.cc") returned 4
	[0133.359] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.cpp") returned 0
	[0133.359] lstrlenA (lpString="*.cpp") returned 5
	[0133.359] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.cxx") returned 0
	[0133.359] lstrlenA (lpString="*.cxx") returned 5
	[0133.359] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.c++") returned 0
	[0133.359] lstrlenA (lpString="*.c++") returned 5
	[0133.359] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.cs") returned 0
	[0133.359] lstrlenA (lpString="*.cs") returned 4
	[0133.359] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.vb") returned 0
	[0133.359] lstrlenA (lpString="*.vb") returned 4
	[0133.359] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.bas") returned 0
	[0133.359] lstrlenA (lpString="*.bas") returned 5
	[0133.359] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.csproj") returned 0
	[0133.359] lstrlenA (lpString="*.csproj") returned 8
	[0133.359] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.vbproj") returned 0
	[0133.359] lstrlenA (lpString="*.vbproj") returned 8
	[0133.360] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.vcxproj") returned 0
	[0133.360] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.360] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.manifest") returned 0
	[0133.360] lstrlenA (lpString="*.manifest") returned 10
	[0133.360] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.php") returned 0
	[0133.360] lstrlenA (lpString="*.php") returned 5
	[0133.360] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.vbe") returned 0
	[0133.360] lstrlenA (lpString="*.vbe") returned 5
	[0133.360] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.vba") returned 0
	[0133.360] lstrlenA (lpString="*.vba") returned 5
	[0133.360] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.vbs") returned 0
	[0133.360] lstrlenA (lpString="*.vbs") returned 5
	[0133.360] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.bat") returned 0
	[0133.360] lstrlenA (lpString="*.bat") returned 5
	[0133.360] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.cmd") returned 0
	[0133.360] lstrlenA (lpString="*.cmd") returned 5
	[0133.360] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.js") returned 0
	[0133.360] lstrlenA (lpString="*.js") returned 4
	[0133.360] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.jscript") returned 0
	[0133.360] lstrlenA (lpString="*.jscript") returned 9
	[0133.360] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.hta") returned 0
	[0133.360] lstrlenA (lpString="*.hta") returned 5
	[0133.360] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.php7") returned 0
	[0133.360] lstrlenA (lpString="*.php7") returned 6
	[0133.360] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.db") returned 0
	[0133.360] lstrlenA (lpString="*.db") returned 4
	[0133.360] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.swf") returned 0
	[0133.360] lstrlenA (lpString="*.swf") returned 5
	[0133.360] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.eml") returned 0
	[0133.360] lstrlenA (lpString="*.eml") returned 5
	[0133.360] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.part") returned 0
	[0133.360] lstrlenA (lpString="*.part") returned 6
	[0133.360] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.nfo") returned 0
	[0133.360] lstrlenA (lpString="*.nfo") returned 5
	[0133.360] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.rsa") returned 0
	[0133.361] lstrlenA (lpString="*.rsa") returned 5
	[0133.361] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.key") returned 0
	[0133.361] lstrlenA (lpString="*.key") returned 5
	[0133.361] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.aes") returned 0
	[0133.361] lstrlenA (lpString="*.aes") returned 5
	[0133.361] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.blob") returned 0
	[0133.361] lstrlenA (lpString="*.blob") returned 6
	[0133.361] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.btc") returned 0
	[0133.361] lstrlenA (lpString="*.btc") returned 5
	[0133.361] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", pszSpec="*.wallet") returned 0
	[0133.361] lstrlenA (lpString="*.wallet") returned 8
	[0133.361] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe5f9955, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe5f9955, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfe645e15, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="secmod.db", cAlternateFileName="")) returned 1
	[0133.361] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0133.361] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="secmod.db") returned -1
	[0133.361] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="secmod.db") returned -1
	[0133.361] lstrcmpiA (lpString1="", lpString2="secmod.db") returned -1
	[0133.361] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4") returned="search.json.mozlz4"
	[0133.361] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\"
	[0133.361] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned=""
	[0133.361] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.361] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\how-to-decrypt-files.htm")) returned 0x20
	[0133.361] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="secmod.db" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db"
	[0133.361] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.zip") returned 0
	[0133.361] lstrlenA (lpString="*.zip") returned 5
	[0133.361] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.rar") returned 0
	[0133.361] lstrlenA (lpString="*.rar") returned 5
	[0133.361] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.7z") returned 0
	[0133.361] lstrlenA (lpString="*.7z") returned 4
	[0133.361] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.tar") returned 0
	[0133.361] lstrlenA (lpString="*.tar") returned 5
	[0133.361] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.gzip") returned 0
	[0133.362] lstrlenA (lpString="*.gzip") returned 6
	[0133.362] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.jpg") returned 0
	[0133.362] lstrlenA (lpString="*.jpg") returned 5
	[0133.362] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.jpeg") returned 0
	[0133.362] lstrlenA (lpString="*.jpeg") returned 6
	[0133.362] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.bmp") returned 0
	[0133.362] lstrlenA (lpString="*.bmp") returned 5
	[0133.362] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.gif") returned 0
	[0133.362] lstrlenA (lpString="*.gif") returned 5
	[0133.362] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.png") returned 0
	[0133.362] lstrlenA (lpString="*.png") returned 5
	[0133.362] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.doc") returned 0
	[0133.362] lstrlenA (lpString="*.doc") returned 5
	[0133.362] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.docx") returned 0
	[0133.362] lstrlenA (lpString="*.docx") returned 6
	[0133.362] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.xls") returned 0
	[0133.362] lstrlenA (lpString="*.xls") returned 5
	[0133.362] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.xlsx") returned 0
	[0133.362] lstrlenA (lpString="*.xlsx") returned 6
	[0133.362] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.ppt") returned 0
	[0133.362] lstrlenA (lpString="*.ppt") returned 5
	[0133.362] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.pptx") returned 0
	[0133.362] lstrlenA (lpString="*.pptx") returned 6
	[0133.362] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.txt") returned 0
	[0133.362] lstrlenA (lpString="*.txt") returned 5
	[0133.362] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.pdf") returned 0
	[0133.362] lstrlenA (lpString="*.pdf") returned 5
	[0133.362] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.htm") returned 0
	[0133.362] lstrlenA (lpString="*.htm") returned 5
	[0133.362] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.html") returned 0
	[0133.362] lstrlenA (lpString="*.html") returned 6
	[0133.362] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.mdb") returned 0
	[0133.362] lstrlenA (lpString="*.mdb") returned 5
	[0133.362] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.pfx") returned 0
	[0133.362] lstrlenA (lpString="*.pfx") returned 5
	[0133.363] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.md") returned 0
	[0133.363] lstrlenA (lpString="*.md") returned 4
	[0133.363] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.lnk") returned 0
	[0133.363] lstrlenA (lpString="*.lnk") returned 5
	[0133.363] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.torrent") returned 0
	[0133.363] lstrlenA (lpString="*.torrent") returned 9
	[0133.363] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.mov") returned 0
	[0133.363] lstrlenA (lpString="*.mov") returned 5
	[0133.363] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.3gp") returned 0
	[0133.363] lstrlenA (lpString="*.3gp") returned 5
	[0133.363] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.mpeg") returned 0
	[0133.363] lstrlenA (lpString="*.mpeg") returned 6
	[0133.363] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.mpg") returned 0
	[0133.363] lstrlenA (lpString="*.mpg") returned 5
	[0133.363] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.flv") returned 0
	[0133.363] lstrlenA (lpString="*.flv") returned 5
	[0133.363] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.avi") returned 0
	[0133.363] lstrlenA (lpString="*.avi") returned 5
	[0133.363] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.mp4") returned 0
	[0133.363] lstrlenA (lpString="*.mp4") returned 5
	[0133.363] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.wmv") returned 0
	[0133.363] lstrlenA (lpString="*.wmv") returned 5
	[0133.363] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.mkv") returned 0
	[0133.363] lstrlenA (lpString="*.mkv") returned 5
	[0133.363] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.mp3") returned 0
	[0133.363] lstrlenA (lpString="*.mp3") returned 5
	[0133.363] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.wav") returned 0
	[0133.363] lstrlenA (lpString="*.wav") returned 5
	[0133.363] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.flac") returned 0
	[0133.363] lstrlenA (lpString="*.flac") returned 6
	[0133.363] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.wma") returned 0
	[0133.363] lstrlenA (lpString="*.wma") returned 5
	[0133.363] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.au3") returned 0
	[0133.364] lstrlenA (lpString="*.au3") returned 5
	[0133.364] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.ahk") returned 0
	[0133.364] lstrlenA (lpString="*.ahk") returned 5
	[0133.364] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.c") returned 0
	[0133.364] lstrlenA (lpString="*.c") returned 3
	[0133.364] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.cc") returned 0
	[0133.364] lstrlenA (lpString="*.cc") returned 4
	[0133.364] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.cpp") returned 0
	[0133.364] lstrlenA (lpString="*.cpp") returned 5
	[0133.364] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.cxx") returned 0
	[0133.364] lstrlenA (lpString="*.cxx") returned 5
	[0133.364] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.c++") returned 0
	[0133.364] lstrlenA (lpString="*.c++") returned 5
	[0133.364] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.cs") returned 0
	[0133.364] lstrlenA (lpString="*.cs") returned 4
	[0133.364] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.vb") returned 0
	[0133.364] lstrlenA (lpString="*.vb") returned 4
	[0133.364] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.bas") returned 0
	[0133.364] lstrlenA (lpString="*.bas") returned 5
	[0133.364] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.csproj") returned 0
	[0133.364] lstrlenA (lpString="*.csproj") returned 8
	[0133.364] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.vbproj") returned 0
	[0133.364] lstrlenA (lpString="*.vbproj") returned 8
	[0133.364] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.vcxproj") returned 0
	[0133.364] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.364] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.manifest") returned 0
	[0133.364] lstrlenA (lpString="*.manifest") returned 10
	[0133.364] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.php") returned 0
	[0133.364] lstrlenA (lpString="*.php") returned 5
	[0133.364] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.vbe") returned 0
	[0133.364] lstrlenA (lpString="*.vbe") returned 5
	[0133.364] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.vba") returned 0
	[0133.364] lstrlenA (lpString="*.vba") returned 5
	[0133.364] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.vbs") returned 0
	[0133.365] lstrlenA (lpString="*.vbs") returned 5
	[0133.365] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.bat") returned 0
	[0133.365] lstrlenA (lpString="*.bat") returned 5
	[0133.365] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.cmd") returned 0
	[0133.365] lstrlenA (lpString="*.cmd") returned 5
	[0133.365] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.js") returned 0
	[0133.365] lstrlenA (lpString="*.js") returned 4
	[0133.365] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.jscript") returned 0
	[0133.365] lstrlenA (lpString="*.jscript") returned 9
	[0133.365] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.hta") returned 0
	[0133.365] lstrlenA (lpString="*.hta") returned 5
	[0133.365] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.php7") returned 0
	[0133.365] lstrlenA (lpString="*.php7") returned 6
	[0133.365] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", pszSpec="*.db") returned 1
	[0133.365] lstrlenA (lpString="*.db") returned 4
	[0133.365] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db"
	[0133.365] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db"
	[0133.365] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db."
	[0133.365] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db.exe"
	[0133.365] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\secmod.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0133.366] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4000
	[0133.366] GetFileTime (in: hFile=0x220, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xfe5f9955, dwHighDateTime=0x1d327c9), lpLastAccessTime=0x407536*(dwLowDateTime=0xfe5f9955, dwHighDateTime=0x1d327c9), lpLastWriteTime=0x40753e*(dwLowDateTime=0xfe645e15, dwHighDateTime=0x1d327c9)) returned 1
	[0133.366] SetFilePointer (in: hFile=0x220, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.366] ReadFile (in: hFile=0x220, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x3fbe, lpOverlapped=0x0) returned 1
	[0133.368] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db") returned="secmod.db"
	[0133.368] SetFilePointer (in: hFile=0x220, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.368] WriteFile (in: hFile=0x220, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x3fbe, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x3fbe, lpOverlapped=0x0) returned 1
	[0133.369] SetFileTime (hFile=0x220, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.369] CloseHandle (hObject=0x220) returned 1
	[0133.369] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\secmod.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\secmod.db.exe")) returned 1
	[0133.369] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x143f0f49, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x143f0f49, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xb81085d6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SecurityPreloadState.txt", cAlternateFileName="SECURI~1.TXT")) returned 1
	[0133.370] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0133.370] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SecurityPreloadState.txt") returned -1
	[0133.370] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SecurityPreloadState.txt") returned -1
	[0133.370] lstrcmpiA (lpString1="", lpString2="SecurityPreloadState.txt") returned -1
	[0133.370] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db") returned="secmod.db"
	[0133.370] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\"
	[0133.370] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned=""
	[0133.370] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.370] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\how-to-decrypt-files.htm")) returned 0x20
	[0133.370] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="SecurityPreloadState.txt" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SecurityPreloadState.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SecurityPreloadState.txt"
	[0133.370] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SecurityPreloadState.txt", pszSpec="*.zip") returned 0
	[0133.370] lstrlenA (lpString="*.zip") returned 5
	[0133.370] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SecurityPreloadState.txt", pszSpec="*.rar") returned 0
	[0133.370] lstrlenA (lpString="*.rar") returned 5
	[0133.370] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SecurityPreloadState.txt", pszSpec="*.7z") returned 0
	[0133.371] lstrlenA (lpString="*.7z") returned 4
	[0133.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SecurityPreloadState.txt", pszSpec="*.tar") returned 0
	[0133.371] lstrlenA (lpString="*.tar") returned 5
	[0133.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SecurityPreloadState.txt", pszSpec="*.gzip") returned 0
	[0133.371] lstrlenA (lpString="*.gzip") returned 6
	[0133.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SecurityPreloadState.txt", pszSpec="*.jpg") returned 0
	[0133.371] lstrlenA (lpString="*.jpg") returned 5
	[0133.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SecurityPreloadState.txt", pszSpec="*.jpeg") returned 0
	[0133.371] lstrlenA (lpString="*.jpeg") returned 6
	[0133.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SecurityPreloadState.txt", pszSpec="*.bmp") returned 0
	[0133.371] lstrlenA (lpString="*.bmp") returned 5
	[0133.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SecurityPreloadState.txt", pszSpec="*.gif") returned 0
	[0133.371] lstrlenA (lpString="*.gif") returned 5
	[0133.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SecurityPreloadState.txt", pszSpec="*.png") returned 0
	[0133.371] lstrlenA (lpString="*.png") returned 5
	[0133.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SecurityPreloadState.txt", pszSpec="*.doc") returned 0
	[0133.371] lstrlenA (lpString="*.doc") returned 5
	[0133.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SecurityPreloadState.txt", pszSpec="*.docx") returned 0
	[0133.371] lstrlenA (lpString="*.docx") returned 6
	[0133.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SecurityPreloadState.txt", pszSpec="*.xls") returned 0
	[0133.371] lstrlenA (lpString="*.xls") returned 5
	[0133.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SecurityPreloadState.txt", pszSpec="*.xlsx") returned 0
	[0133.371] lstrlenA (lpString="*.xlsx") returned 6
	[0133.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SecurityPreloadState.txt", pszSpec="*.ppt") returned 0
	[0133.371] lstrlenA (lpString="*.ppt") returned 5
	[0133.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SecurityPreloadState.txt", pszSpec="*.pptx") returned 0
	[0133.371] lstrlenA (lpString="*.pptx") returned 6
	[0133.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SecurityPreloadState.txt", pszSpec="*.txt") returned 1
	[0133.371] lstrlenA (lpString="*.txt") returned 5
	[0133.371] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SecurityPreloadState.txt" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SecurityPreloadState.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SecurityPreloadState.txt"
	[0133.371] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SecurityPreloadState.txt" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SecurityPreloadState.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SecurityPreloadState.txt"
	[0133.371] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SecurityPreloadState.txt", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SecurityPreloadState.txt.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SecurityPreloadState.txt."
	[0133.371] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SecurityPreloadState.txt.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SecurityPreloadState.txt.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SecurityPreloadState.txt.exe"
	[0133.372] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SecurityPreloadState.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\securitypreloadstate.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0133.372] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0
	[0133.372] CloseHandle (hObject=0x220) returned 1
	[0133.372] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7e0d6ab, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb8154a58, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb8154a58, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x120, dwReserved0=0x0, dwReserved1=0x0, cFileName="sessionCheckpoints.json", cAlternateFileName="SESSIO~1.JSO")) returned 1
	[0133.372] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0133.372] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="sessionCheckpoints.json") returned -1
	[0133.372] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="sessionCheckpoints.json") returned -1
	[0133.372] lstrcmpiA (lpString1="", lpString2="sessionCheckpoints.json") returned -1
	[0133.372] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SecurityPreloadState.txt") returned="SecurityPreloadState.txt"
	[0133.372] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\"
	[0133.372] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned=""
	[0133.372] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.372] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\how-to-decrypt-files.htm")) returned 0x20
	[0133.372] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="sessionCheckpoints.json" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json"
	[0133.372] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.zip") returned 0
	[0133.373] lstrlenA (lpString="*.zip") returned 5
	[0133.373] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.rar") returned 0
	[0133.373] lstrlenA (lpString="*.rar") returned 5
	[0133.373] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.7z") returned 0
	[0133.373] lstrlenA (lpString="*.7z") returned 4
	[0133.373] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.tar") returned 0
	[0133.373] lstrlenA (lpString="*.tar") returned 5
	[0133.373] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.gzip") returned 0
	[0133.373] lstrlenA (lpString="*.gzip") returned 6
	[0133.373] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.jpg") returned 0
	[0133.373] lstrlenA (lpString="*.jpg") returned 5
	[0133.373] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.jpeg") returned 0
	[0133.373] lstrlenA (lpString="*.jpeg") returned 6
	[0133.373] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.bmp") returned 0
	[0133.373] lstrlenA (lpString="*.bmp") returned 5
	[0133.373] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.gif") returned 0
	[0133.373] lstrlenA (lpString="*.gif") returned 5
	[0133.373] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.png") returned 0
	[0133.373] lstrlenA (lpString="*.png") returned 5
	[0133.373] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.doc") returned 0
	[0133.373] lstrlenA (lpString="*.doc") returned 5
	[0133.373] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.docx") returned 0
	[0133.373] lstrlenA (lpString="*.docx") returned 6
	[0133.373] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.xls") returned 0
	[0133.373] lstrlenA (lpString="*.xls") returned 5
	[0133.373] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.xlsx") returned 0
	[0133.373] lstrlenA (lpString="*.xlsx") returned 6
	[0133.373] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.ppt") returned 0
	[0133.373] lstrlenA (lpString="*.ppt") returned 5
	[0133.373] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.pptx") returned 0
	[0133.373] lstrlenA (lpString="*.pptx") returned 6
	[0133.373] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.txt") returned 0
	[0133.373] lstrlenA (lpString="*.txt") returned 5
	[0133.373] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.pdf") returned 0
	[0133.373] lstrlenA (lpString="*.pdf") returned 5
	[0133.374] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.htm") returned 0
	[0133.374] lstrlenA (lpString="*.htm") returned 5
	[0133.374] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.html") returned 0
	[0133.374] lstrlenA (lpString="*.html") returned 6
	[0133.374] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.mdb") returned 0
	[0133.374] lstrlenA (lpString="*.mdb") returned 5
	[0133.374] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.pfx") returned 0
	[0133.374] lstrlenA (lpString="*.pfx") returned 5
	[0133.374] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.md") returned 0
	[0133.374] lstrlenA (lpString="*.md") returned 4
	[0133.374] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.lnk") returned 0
	[0133.374] lstrlenA (lpString="*.lnk") returned 5
	[0133.374] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.torrent") returned 0
	[0133.374] lstrlenA (lpString="*.torrent") returned 9
	[0133.374] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.mov") returned 0
	[0133.374] lstrlenA (lpString="*.mov") returned 5
	[0133.374] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.3gp") returned 0
	[0133.374] lstrlenA (lpString="*.3gp") returned 5
	[0133.374] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.mpeg") returned 0
	[0133.374] lstrlenA (lpString="*.mpeg") returned 6
	[0133.374] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.mpg") returned 0
	[0133.374] lstrlenA (lpString="*.mpg") returned 5
	[0133.374] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.flv") returned 0
	[0133.374] lstrlenA (lpString="*.flv") returned 5
	[0133.374] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.avi") returned 0
	[0133.374] lstrlenA (lpString="*.avi") returned 5
	[0133.374] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.mp4") returned 0
	[0133.374] lstrlenA (lpString="*.mp4") returned 5
	[0133.374] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.wmv") returned 0
	[0133.374] lstrlenA (lpString="*.wmv") returned 5
	[0133.374] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.mkv") returned 0
	[0133.374] lstrlenA (lpString="*.mkv") returned 5
	[0133.374] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.mp3") returned 0
	[0133.374] lstrlenA (lpString="*.mp3") returned 5
	[0133.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.wav") returned 0
	[0133.375] lstrlenA (lpString="*.wav") returned 5
	[0133.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.flac") returned 0
	[0133.375] lstrlenA (lpString="*.flac") returned 6
	[0133.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.wma") returned 0
	[0133.375] lstrlenA (lpString="*.wma") returned 5
	[0133.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.au3") returned 0
	[0133.375] lstrlenA (lpString="*.au3") returned 5
	[0133.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.ahk") returned 0
	[0133.375] lstrlenA (lpString="*.ahk") returned 5
	[0133.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.c") returned 0
	[0133.375] lstrlenA (lpString="*.c") returned 3
	[0133.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.cc") returned 0
	[0133.375] lstrlenA (lpString="*.cc") returned 4
	[0133.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.cpp") returned 0
	[0133.375] lstrlenA (lpString="*.cpp") returned 5
	[0133.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.cxx") returned 0
	[0133.375] lstrlenA (lpString="*.cxx") returned 5
	[0133.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.c++") returned 0
	[0133.375] lstrlenA (lpString="*.c++") returned 5
	[0133.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.cs") returned 0
	[0133.375] lstrlenA (lpString="*.cs") returned 4
	[0133.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.vb") returned 0
	[0133.375] lstrlenA (lpString="*.vb") returned 4
	[0133.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.bas") returned 0
	[0133.375] lstrlenA (lpString="*.bas") returned 5
	[0133.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.csproj") returned 0
	[0133.375] lstrlenA (lpString="*.csproj") returned 8
	[0133.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.vbproj") returned 0
	[0133.375] lstrlenA (lpString="*.vbproj") returned 8
	[0133.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.vcxproj") returned 0
	[0133.375] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.manifest") returned 0
	[0133.375] lstrlenA (lpString="*.manifest") returned 10
	[0133.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.php") returned 0
	[0133.376] lstrlenA (lpString="*.php") returned 5
	[0133.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.vbe") returned 0
	[0133.376] lstrlenA (lpString="*.vbe") returned 5
	[0133.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.vba") returned 0
	[0133.376] lstrlenA (lpString="*.vba") returned 5
	[0133.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.vbs") returned 0
	[0133.376] lstrlenA (lpString="*.vbs") returned 5
	[0133.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.bat") returned 0
	[0133.376] lstrlenA (lpString="*.bat") returned 5
	[0133.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.cmd") returned 0
	[0133.376] lstrlenA (lpString="*.cmd") returned 5
	[0133.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.js") returned 0
	[0133.376] lstrlenA (lpString="*.js") returned 4
	[0133.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.jscript") returned 0
	[0133.376] lstrlenA (lpString="*.jscript") returned 9
	[0133.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.hta") returned 0
	[0133.376] lstrlenA (lpString="*.hta") returned 5
	[0133.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.php7") returned 0
	[0133.376] lstrlenA (lpString="*.php7") returned 6
	[0133.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.db") returned 0
	[0133.376] lstrlenA (lpString="*.db") returned 4
	[0133.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.swf") returned 0
	[0133.376] lstrlenA (lpString="*.swf") returned 5
	[0133.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.eml") returned 0
	[0133.376] lstrlenA (lpString="*.eml") returned 5
	[0133.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.part") returned 0
	[0133.376] lstrlenA (lpString="*.part") returned 6
	[0133.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.nfo") returned 0
	[0133.376] lstrlenA (lpString="*.nfo") returned 5
	[0133.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.rsa") returned 0
	[0133.376] lstrlenA (lpString="*.rsa") returned 5
	[0133.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.key") returned 0
	[0133.376] lstrlenA (lpString="*.key") returned 5
	[0133.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.aes") returned 0
	[0133.377] lstrlenA (lpString="*.aes") returned 5
	[0133.377] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.blob") returned 0
	[0133.377] lstrlenA (lpString="*.blob") returned 6
	[0133.377] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.btc") returned 0
	[0133.377] lstrlenA (lpString="*.btc") returned 5
	[0133.377] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", pszSpec="*.wallet") returned 0
	[0133.377] lstrlenA (lpString="*.wallet") returned 8
	[0133.377] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6368e07, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7794358d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb7ea601f, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="sessionstore-backups", cAlternateFileName="SESSIO~1")) returned 1
	[0133.377] lstrcmpA (lpString1=".", lpString2="sessionstore-backups") returned -1
	[0133.377] lstrcmpA (lpString1="..", lpString2="sessionstore-backups") returned -1
	[0133.377] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json") returned="sessionCheckpoints.json"
	[0133.377] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="sessionstore-backups" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups"
	[0133.377] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups") returned 94
	[0133.377] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\*.*", lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6368e07, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7794358d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb7ea601f, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0xd8, cFileName=".", cAlternateFileName="")) returned 0x7cb750
	[0133.378] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.378] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6368e07, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7794358d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb7ea601f, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0xd8, cFileName="..", cAlternateFileName="")) returned 1
	[0133.378] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.378] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.378] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd3e77da, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd3e77da, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd3e77da, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1f37, dwReserved0=0x7b0000, dwReserved1=0xd8, cFileName="previous.js", cAlternateFileName="")) returned 1
	[0133.378] PeekMessageA (in: lpMsg=0x19f23c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f23c) returned 0
	[0133.379] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="previous.js") returned -1
	[0133.379] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="previous.js") returned -1
	[0133.379] lstrcmpiA (lpString1="", lpString2="previous.js") returned -1
	[0133.379] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\*.*") returned="*.*"
	[0133.379] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\"
	[0133.379] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\") returned=""
	[0133.379] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.379] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessionstore-backups\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0133.379] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessionstore-backups\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224
	[0133.379] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0133.379] WriteFile (in: hFile=0x224, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0133.380] SetFileTime (hFile=0x224, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0133.380] CloseHandle (hObject=0x224) returned 1
	[0133.381] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\", lpString2="previous.js" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js"
	[0133.381] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.zip") returned 0
	[0133.381] lstrlenA (lpString="*.zip") returned 5
	[0133.381] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.rar") returned 0
	[0133.381] lstrlenA (lpString="*.rar") returned 5
	[0133.381] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.7z") returned 0
	[0133.381] lstrlenA (lpString="*.7z") returned 4
	[0133.381] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.tar") returned 0
	[0133.381] lstrlenA (lpString="*.tar") returned 5
	[0133.381] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.gzip") returned 0
	[0133.381] lstrlenA (lpString="*.gzip") returned 6
	[0133.381] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.jpg") returned 0
	[0133.381] lstrlenA (lpString="*.jpg") returned 5
	[0133.381] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.jpeg") returned 0
	[0133.381] lstrlenA (lpString="*.jpeg") returned 6
	[0133.381] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.bmp") returned 0
	[0133.381] lstrlenA (lpString="*.bmp") returned 5
	[0133.381] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.gif") returned 0
	[0133.381] lstrlenA (lpString="*.gif") returned 5
	[0133.381] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.png") returned 0
	[0133.381] lstrlenA (lpString="*.png") returned 5
	[0133.381] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.doc") returned 0
	[0133.381] lstrlenA (lpString="*.doc") returned 5
	[0133.381] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.docx") returned 0
	[0133.381] lstrlenA (lpString="*.docx") returned 6
	[0133.381] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.xls") returned 0
	[0133.381] lstrlenA (lpString="*.xls") returned 5
	[0133.381] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.xlsx") returned 0
	[0133.381] lstrlenA (lpString="*.xlsx") returned 6
	[0133.381] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.ppt") returned 0
	[0133.381] lstrlenA (lpString="*.ppt") returned 5
	[0133.381] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.pptx") returned 0
	[0133.381] lstrlenA (lpString="*.pptx") returned 6
	[0133.381] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.txt") returned 0
	[0133.382] lstrlenA (lpString="*.txt") returned 5
	[0133.382] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.pdf") returned 0
	[0133.382] lstrlenA (lpString="*.pdf") returned 5
	[0133.382] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.htm") returned 0
	[0133.382] lstrlenA (lpString="*.htm") returned 5
	[0133.382] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.html") returned 0
	[0133.382] lstrlenA (lpString="*.html") returned 6
	[0133.382] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.mdb") returned 0
	[0133.382] lstrlenA (lpString="*.mdb") returned 5
	[0133.382] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.pfx") returned 0
	[0133.382] lstrlenA (lpString="*.pfx") returned 5
	[0133.382] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.md") returned 0
	[0133.382] lstrlenA (lpString="*.md") returned 4
	[0133.382] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.lnk") returned 0
	[0133.382] lstrlenA (lpString="*.lnk") returned 5
	[0133.382] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.torrent") returned 0
	[0133.382] lstrlenA (lpString="*.torrent") returned 9
	[0133.382] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.mov") returned 0
	[0133.382] lstrlenA (lpString="*.mov") returned 5
	[0133.382] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.3gp") returned 0
	[0133.382] lstrlenA (lpString="*.3gp") returned 5
	[0133.382] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.mpeg") returned 0
	[0133.382] lstrlenA (lpString="*.mpeg") returned 6
	[0133.382] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.mpg") returned 0
	[0133.382] lstrlenA (lpString="*.mpg") returned 5
	[0133.382] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.flv") returned 0
	[0133.382] lstrlenA (lpString="*.flv") returned 5
	[0133.382] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.avi") returned 0
	[0133.382] lstrlenA (lpString="*.avi") returned 5
	[0133.382] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.mp4") returned 0
	[0133.382] lstrlenA (lpString="*.mp4") returned 5
	[0133.383] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.wmv") returned 0
	[0133.383] lstrlenA (lpString="*.wmv") returned 5
	[0133.383] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.mkv") returned 0
	[0133.383] lstrlenA (lpString="*.mkv") returned 5
	[0133.383] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.mp3") returned 0
	[0133.383] lstrlenA (lpString="*.mp3") returned 5
	[0133.383] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.wav") returned 0
	[0133.383] lstrlenA (lpString="*.wav") returned 5
	[0133.383] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.flac") returned 0
	[0133.383] lstrlenA (lpString="*.flac") returned 6
	[0133.383] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.wma") returned 0
	[0133.383] lstrlenA (lpString="*.wma") returned 5
	[0133.383] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.au3") returned 0
	[0133.383] lstrlenA (lpString="*.au3") returned 5
	[0133.383] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.ahk") returned 0
	[0133.383] lstrlenA (lpString="*.ahk") returned 5
	[0133.383] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.c") returned 0
	[0133.383] lstrlenA (lpString="*.c") returned 3
	[0133.383] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.cc") returned 0
	[0133.383] lstrlenA (lpString="*.cc") returned 4
	[0133.383] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.cpp") returned 0
	[0133.383] lstrlenA (lpString="*.cpp") returned 5
	[0133.383] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.cxx") returned 0
	[0133.383] lstrlenA (lpString="*.cxx") returned 5
	[0133.383] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.c++") returned 0
	[0133.383] lstrlenA (lpString="*.c++") returned 5
	[0133.383] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.cs") returned 0
	[0133.383] lstrlenA (lpString="*.cs") returned 4
	[0133.383] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.vb") returned 0
	[0133.383] lstrlenA (lpString="*.vb") returned 4
	[0133.384] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.bas") returned 0
	[0133.384] lstrlenA (lpString="*.bas") returned 5
	[0133.384] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.csproj") returned 0
	[0133.384] lstrlenA (lpString="*.csproj") returned 8
	[0133.384] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.vbproj") returned 0
	[0133.384] lstrlenA (lpString="*.vbproj") returned 8
	[0133.384] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.vcxproj") returned 0
	[0133.384] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.384] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.manifest") returned 0
	[0133.384] lstrlenA (lpString="*.manifest") returned 10
	[0133.384] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.php") returned 0
	[0133.384] lstrlenA (lpString="*.php") returned 5
	[0133.384] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.vbe") returned 0
	[0133.384] lstrlenA (lpString="*.vbe") returned 5
	[0133.384] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.vba") returned 0
	[0133.384] lstrlenA (lpString="*.vba") returned 5
	[0133.384] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.vbs") returned 0
	[0133.384] lstrlenA (lpString="*.vbs") returned 5
	[0133.384] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.bat") returned 0
	[0133.384] lstrlenA (lpString="*.bat") returned 5
	[0133.384] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.cmd") returned 0
	[0133.384] lstrlenA (lpString="*.cmd") returned 5
	[0133.384] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", pszSpec="*.js") returned 1
	[0133.384] lstrlenA (lpString="*.js") returned 4
	[0133.384] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js"
	[0133.384] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js"
	[0133.384] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js."
	[0133.384] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js.exe"
	[0133.384] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224
	[0133.385] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f37
	[0133.385] GetFileTime (in: hFile=0x224, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcd3e77da, dwHighDateTime=0x1d327cb), lpLastAccessTime=0x407536*(dwLowDateTime=0xcd3e77da, dwHighDateTime=0x1d327cb), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcd3e77da, dwHighDateTime=0x1d327cb)) returned 1
	[0133.385] SetFilePointer (in: hFile=0x224, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.385] ReadFile (in: hFile=0x224, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1ef5, lpOverlapped=0x0) returned 1
	[0133.387] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js") returned="previous.js"
	[0133.387] SetFilePointer (in: hFile=0x224, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.387] WriteFile (in: hFile=0x224, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1ef5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1ef5, lpOverlapped=0x0) returned 1
	[0133.387] SetFileTime (hFile=0x224, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.387] CloseHandle (hObject=0x224) returned 1
	[0133.387] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js.exe")) returned 1
	[0133.388] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43824196, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x43824196, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x1407dfe9, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x36df, dwReserved0=0x0, dwReserved1=0x0, cFileName="upgrade.js-20170824053622", cAlternateFileName="UPGRAD~1.JS-")) returned 1
	[0133.388] PeekMessageA (in: lpMsg=0x19f23c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f23c) returned 0
	[0133.388] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="upgrade.js-20170824053622") returned -1
	[0133.388] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="upgrade.js-20170824053622") returned -1
	[0133.388] lstrcmpiA (lpString1="", lpString2="upgrade.js-20170824053622") returned -1
	[0133.388] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js") returned="previous.js"
	[0133.388] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\"
	[0133.388] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\") returned=""
	[0133.388] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.388] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessionstore-backups\\how-to-decrypt-files.htm")) returned 0x20
	[0133.388] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\", lpString2="upgrade.js-20170824053622" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622"
	[0133.388] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.zip") returned 0
	[0133.389] lstrlenA (lpString="*.zip") returned 5
	[0133.389] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.rar") returned 0
	[0133.389] lstrlenA (lpString="*.rar") returned 5
	[0133.389] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.7z") returned 0
	[0133.389] lstrlenA (lpString="*.7z") returned 4
	[0133.389] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.tar") returned 0
	[0133.389] lstrlenA (lpString="*.tar") returned 5
	[0133.389] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.gzip") returned 0
	[0133.389] lstrlenA (lpString="*.gzip") returned 6
	[0133.389] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.jpg") returned 0
	[0133.389] lstrlenA (lpString="*.jpg") returned 5
	[0133.389] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.jpeg") returned 0
	[0133.389] lstrlenA (lpString="*.jpeg") returned 6
	[0133.389] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.bmp") returned 0
	[0133.389] lstrlenA (lpString="*.bmp") returned 5
	[0133.389] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.gif") returned 0
	[0133.389] lstrlenA (lpString="*.gif") returned 5
	[0133.389] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.png") returned 0
	[0133.389] lstrlenA (lpString="*.png") returned 5
	[0133.389] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.doc") returned 0
	[0133.389] lstrlenA (lpString="*.doc") returned 5
	[0133.389] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.docx") returned 0
	[0133.389] lstrlenA (lpString="*.docx") returned 6
	[0133.389] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.xls") returned 0
	[0133.389] lstrlenA (lpString="*.xls") returned 5
	[0133.389] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.xlsx") returned 0
	[0133.389] lstrlenA (lpString="*.xlsx") returned 6
	[0133.389] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.ppt") returned 0
	[0133.389] lstrlenA (lpString="*.ppt") returned 5
	[0133.389] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.pptx") returned 0
	[0133.389] lstrlenA (lpString="*.pptx") returned 6
	[0133.389] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.txt") returned 0
	[0133.389] lstrlenA (lpString="*.txt") returned 5
	[0133.389] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.pdf") returned 0
	[0133.389] lstrlenA (lpString="*.pdf") returned 5
	[0133.390] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.htm") returned 0
	[0133.390] lstrlenA (lpString="*.htm") returned 5
	[0133.390] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.html") returned 0
	[0133.390] lstrlenA (lpString="*.html") returned 6
	[0133.390] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.mdb") returned 0
	[0133.390] lstrlenA (lpString="*.mdb") returned 5
	[0133.390] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.pfx") returned 0
	[0133.390] lstrlenA (lpString="*.pfx") returned 5
	[0133.390] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.md") returned 0
	[0133.390] lstrlenA (lpString="*.md") returned 4
	[0133.390] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.lnk") returned 0
	[0133.390] lstrlenA (lpString="*.lnk") returned 5
	[0133.390] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.torrent") returned 0
	[0133.390] lstrlenA (lpString="*.torrent") returned 9
	[0133.390] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.mov") returned 0
	[0133.390] lstrlenA (lpString="*.mov") returned 5
	[0133.390] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.3gp") returned 0
	[0133.390] lstrlenA (lpString="*.3gp") returned 5
	[0133.390] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.mpeg") returned 0
	[0133.390] lstrlenA (lpString="*.mpeg") returned 6
	[0133.390] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.mpg") returned 0
	[0133.390] lstrlenA (lpString="*.mpg") returned 5
	[0133.390] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.flv") returned 0
	[0133.390] lstrlenA (lpString="*.flv") returned 5
	[0133.390] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.avi") returned 0
	[0133.390] lstrlenA (lpString="*.avi") returned 5
	[0133.390] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.mp4") returned 0
	[0133.390] lstrlenA (lpString="*.mp4") returned 5
	[0133.390] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.wmv") returned 0
	[0133.390] lstrlenA (lpString="*.wmv") returned 5
	[0133.390] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.mkv") returned 0
	[0133.390] lstrlenA (lpString="*.mkv") returned 5
	[0133.390] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.mp3") returned 0
	[0133.390] lstrlenA (lpString="*.mp3") returned 5
	[0133.391] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.wav") returned 0
	[0133.391] lstrlenA (lpString="*.wav") returned 5
	[0133.391] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.flac") returned 0
	[0133.391] lstrlenA (lpString="*.flac") returned 6
	[0133.391] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.wma") returned 0
	[0133.391] lstrlenA (lpString="*.wma") returned 5
	[0133.391] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.au3") returned 0
	[0133.391] lstrlenA (lpString="*.au3") returned 5
	[0133.391] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.ahk") returned 0
	[0133.391] lstrlenA (lpString="*.ahk") returned 5
	[0133.391] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.c") returned 0
	[0133.391] lstrlenA (lpString="*.c") returned 3
	[0133.391] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.cc") returned 0
	[0133.391] lstrlenA (lpString="*.cc") returned 4
	[0133.391] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.cpp") returned 0
	[0133.391] lstrlenA (lpString="*.cpp") returned 5
	[0133.391] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.cxx") returned 0
	[0133.391] lstrlenA (lpString="*.cxx") returned 5
	[0133.391] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.c++") returned 0
	[0133.391] lstrlenA (lpString="*.c++") returned 5
	[0133.391] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.cs") returned 0
	[0133.391] lstrlenA (lpString="*.cs") returned 4
	[0133.391] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.vb") returned 0
	[0133.391] lstrlenA (lpString="*.vb") returned 4
	[0133.391] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.bas") returned 0
	[0133.391] lstrlenA (lpString="*.bas") returned 5
	[0133.391] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.csproj") returned 0
	[0133.391] lstrlenA (lpString="*.csproj") returned 8
	[0133.391] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.vbproj") returned 0
	[0133.391] lstrlenA (lpString="*.vbproj") returned 8
	[0133.391] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.vcxproj") returned 0
	[0133.391] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.391] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.manifest") returned 0
	[0133.391] lstrlenA (lpString="*.manifest") returned 10
	[0133.391] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.php") returned 0
	[0133.392] lstrlenA (lpString="*.php") returned 5
	[0133.392] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.vbe") returned 0
	[0133.392] lstrlenA (lpString="*.vbe") returned 5
	[0133.392] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.vba") returned 0
	[0133.392] lstrlenA (lpString="*.vba") returned 5
	[0133.392] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.vbs") returned 0
	[0133.392] lstrlenA (lpString="*.vbs") returned 5
	[0133.392] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.bat") returned 0
	[0133.392] lstrlenA (lpString="*.bat") returned 5
	[0133.392] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.cmd") returned 0
	[0133.392] lstrlenA (lpString="*.cmd") returned 5
	[0133.392] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.js") returned 0
	[0133.392] lstrlenA (lpString="*.js") returned 4
	[0133.392] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.jscript") returned 0
	[0133.392] lstrlenA (lpString="*.jscript") returned 9
	[0133.392] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.hta") returned 0
	[0133.392] lstrlenA (lpString="*.hta") returned 5
	[0133.392] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.php7") returned 0
	[0133.392] lstrlenA (lpString="*.php7") returned 6
	[0133.392] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.db") returned 0
	[0133.392] lstrlenA (lpString="*.db") returned 4
	[0133.392] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.swf") returned 0
	[0133.392] lstrlenA (lpString="*.swf") returned 5
	[0133.392] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.eml") returned 0
	[0133.392] lstrlenA (lpString="*.eml") returned 5
	[0133.392] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.part") returned 0
	[0133.392] lstrlenA (lpString="*.part") returned 6
	[0133.392] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.nfo") returned 0
	[0133.392] lstrlenA (lpString="*.nfo") returned 5
	[0133.392] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.rsa") returned 0
	[0133.392] lstrlenA (lpString="*.rsa") returned 5
	[0133.392] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.key") returned 0
	[0133.392] lstrlenA (lpString="*.key") returned 5
	[0133.392] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.aes") returned 0
	[0133.392] lstrlenA (lpString="*.aes") returned 5
	[0133.392] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.blob") returned 0
	[0133.393] lstrlenA (lpString="*.blob") returned 6
	[0133.393] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.btc") returned 0
	[0133.393] lstrlenA (lpString="*.btc") returned 5
	[0133.393] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", pszSpec="*.wallet") returned 0
	[0133.393] lstrlenA (lpString="*.wallet") returned 8
	[0133.393] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43824196, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x43824196, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x1407dfe9, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x36df, dwReserved0=0x0, dwReserved1=0x0, cFileName="upgrade.js-20170824053622", cAlternateFileName="UPGRAD~1.JS-")) returned 0
	[0133.393] FindClose (in: hFindFile=0x7cb750 | out: hFindFile=0x7cb750) returned 1
	[0133.393] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7e7fd9e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb7e7fd9e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb7e7fd9e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1433, dwReserved0=0x0, dwReserved1=0x0, cFileName="sessionstore.js", cAlternateFileName="SESSIO~1.JS")) returned 1
	[0133.393] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0133.393] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="sessionstore.js") returned -1
	[0133.393] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="sessionstore.js") returned -1
	[0133.393] lstrcmpiA (lpString1="", lpString2="sessionstore.js") returned -1
	[0133.393] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\*.*") returned="*.*"
	[0133.393] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\"
	[0133.393] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned=""
	[0133.393] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.393] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\how-to-decrypt-files.htm")) returned 0x20
	[0133.393] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="sessionstore.js" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js"
	[0133.393] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.zip") returned 0
	[0133.393] lstrlenA (lpString="*.zip") returned 5
	[0133.393] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.rar") returned 0
	[0133.393] lstrlenA (lpString="*.rar") returned 5
	[0133.393] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.7z") returned 0
	[0133.393] lstrlenA (lpString="*.7z") returned 4
	[0133.393] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.tar") returned 0
	[0133.393] lstrlenA (lpString="*.tar") returned 5
	[0133.393] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.gzip") returned 0
	[0133.393] lstrlenA (lpString="*.gzip") returned 6
	[0133.393] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.jpg") returned 0
	[0133.393] lstrlenA (lpString="*.jpg") returned 5
	[0133.394] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.jpeg") returned 0
	[0133.394] lstrlenA (lpString="*.jpeg") returned 6
	[0133.394] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.bmp") returned 0
	[0133.394] lstrlenA (lpString="*.bmp") returned 5
	[0133.394] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.gif") returned 0
	[0133.394] lstrlenA (lpString="*.gif") returned 5
	[0133.394] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.png") returned 0
	[0133.394] lstrlenA (lpString="*.png") returned 5
	[0133.394] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.doc") returned 0
	[0133.394] lstrlenA (lpString="*.doc") returned 5
	[0133.394] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.docx") returned 0
	[0133.394] lstrlenA (lpString="*.docx") returned 6
	[0133.394] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.xls") returned 0
	[0133.394] lstrlenA (lpString="*.xls") returned 5
	[0133.394] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.xlsx") returned 0
	[0133.394] lstrlenA (lpString="*.xlsx") returned 6
	[0133.394] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.ppt") returned 0
	[0133.394] lstrlenA (lpString="*.ppt") returned 5
	[0133.394] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.pptx") returned 0
	[0133.394] lstrlenA (lpString="*.pptx") returned 6
	[0133.394] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.txt") returned 0
	[0133.394] lstrlenA (lpString="*.txt") returned 5
	[0133.394] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.pdf") returned 0
	[0133.394] lstrlenA (lpString="*.pdf") returned 5
	[0133.394] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.htm") returned 0
	[0133.394] lstrlenA (lpString="*.htm") returned 5
	[0133.394] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.html") returned 0
	[0133.394] lstrlenA (lpString="*.html") returned 6
	[0133.394] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.mdb") returned 0
	[0133.394] lstrlenA (lpString="*.mdb") returned 5
	[0133.394] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.pfx") returned 0
	[0133.394] lstrlenA (lpString="*.pfx") returned 5
	[0133.394] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.md") returned 0
	[0133.394] lstrlenA (lpString="*.md") returned 4
	[0133.395] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.lnk") returned 0
	[0133.395] lstrlenA (lpString="*.lnk") returned 5
	[0133.395] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.torrent") returned 0
	[0133.395] lstrlenA (lpString="*.torrent") returned 9
	[0133.395] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.mov") returned 0
	[0133.395] lstrlenA (lpString="*.mov") returned 5
	[0133.395] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.3gp") returned 0
	[0133.395] lstrlenA (lpString="*.3gp") returned 5
	[0133.395] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.mpeg") returned 0
	[0133.395] lstrlenA (lpString="*.mpeg") returned 6
	[0133.395] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.mpg") returned 0
	[0133.395] lstrlenA (lpString="*.mpg") returned 5
	[0133.395] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.flv") returned 0
	[0133.395] lstrlenA (lpString="*.flv") returned 5
	[0133.395] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.avi") returned 0
	[0133.395] lstrlenA (lpString="*.avi") returned 5
	[0133.395] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.mp4") returned 0
	[0133.395] lstrlenA (lpString="*.mp4") returned 5
	[0133.395] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.wmv") returned 0
	[0133.395] lstrlenA (lpString="*.wmv") returned 5
	[0133.395] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.mkv") returned 0
	[0133.395] lstrlenA (lpString="*.mkv") returned 5
	[0133.395] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.mp3") returned 0
	[0133.395] lstrlenA (lpString="*.mp3") returned 5
	[0133.395] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.wav") returned 0
	[0133.395] lstrlenA (lpString="*.wav") returned 5
	[0133.395] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.flac") returned 0
	[0133.395] lstrlenA (lpString="*.flac") returned 6
	[0133.395] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.wma") returned 0
	[0133.395] lstrlenA (lpString="*.wma") returned 5
	[0133.395] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.au3") returned 0
	[0133.395] lstrlenA (lpString="*.au3") returned 5
	[0133.395] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.ahk") returned 0
	[0133.395] lstrlenA (lpString="*.ahk") returned 5
	[0133.396] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.c") returned 0
	[0133.396] lstrlenA (lpString="*.c") returned 3
	[0133.396] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.cc") returned 0
	[0133.396] lstrlenA (lpString="*.cc") returned 4
	[0133.396] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.cpp") returned 0
	[0133.396] lstrlenA (lpString="*.cpp") returned 5
	[0133.396] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.cxx") returned 0
	[0133.396] lstrlenA (lpString="*.cxx") returned 5
	[0133.396] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.c++") returned 0
	[0133.396] lstrlenA (lpString="*.c++") returned 5
	[0133.396] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.cs") returned 0
	[0133.396] lstrlenA (lpString="*.cs") returned 4
	[0133.396] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.vb") returned 0
	[0133.396] lstrlenA (lpString="*.vb") returned 4
	[0133.396] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.bas") returned 0
	[0133.396] lstrlenA (lpString="*.bas") returned 5
	[0133.396] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.csproj") returned 0
	[0133.396] lstrlenA (lpString="*.csproj") returned 8
	[0133.396] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.vbproj") returned 0
	[0133.396] lstrlenA (lpString="*.vbproj") returned 8
	[0133.396] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.vcxproj") returned 0
	[0133.396] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.396] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.manifest") returned 0
	[0133.396] lstrlenA (lpString="*.manifest") returned 10
	[0133.396] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.php") returned 0
	[0133.396] lstrlenA (lpString="*.php") returned 5
	[0133.396] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.vbe") returned 0
	[0133.396] lstrlenA (lpString="*.vbe") returned 5
	[0133.396] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.vba") returned 0
	[0133.396] lstrlenA (lpString="*.vba") returned 5
	[0133.396] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.vbs") returned 0
	[0133.396] lstrlenA (lpString="*.vbs") returned 5
	[0133.396] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.bat") returned 0
	[0133.396] lstrlenA (lpString="*.bat") returned 5
	[0133.396] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.cmd") returned 0
	[0133.397] lstrlenA (lpString="*.cmd") returned 5
	[0133.397] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", pszSpec="*.js") returned 1
	[0133.397] lstrlenA (lpString="*.js") returned 4
	[0133.397] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js"
	[0133.397] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js"
	[0133.397] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js."
	[0133.397] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js.exe"
	[0133.397] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessionstore.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0133.397] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1433
	[0133.397] GetFileTime (in: hFile=0x220, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb7e7fd9e, dwHighDateTime=0x1d327cc), lpLastAccessTime=0x407536*(dwLowDateTime=0xb7e7fd9e, dwHighDateTime=0x1d327cc), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb7e7fd9e, dwHighDateTime=0x1d327cc)) returned 1
	[0133.397] SetFilePointer (in: hFile=0x220, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.397] ReadFile (in: hFile=0x220, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x13f1, lpOverlapped=0x0) returned 1
	[0133.399] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js") returned="sessionstore.js"
	[0133.399] SetFilePointer (in: hFile=0x220, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.399] WriteFile (in: hFile=0x220, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x13f1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x13f1, lpOverlapped=0x0) returned 1
	[0133.399] SetFileTime (hFile=0x220, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.399] CloseHandle (hObject=0x220) returned 1
	[0133.399] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessionstore.js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessionstore.js.exe")) returned 1
	[0133.400] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x143f0f49, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x143f0f49, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xb81085d6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x71e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SiteSecurityServiceState.txt", cAlternateFileName="SITESE~1.TXT")) returned 1
	[0133.400] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0133.400] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="SiteSecurityServiceState.txt") returned -1
	[0133.400] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="SiteSecurityServiceState.txt") returned -1
	[0133.400] lstrcmpiA (lpString1="", lpString2="SiteSecurityServiceState.txt") returned -1
	[0133.400] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js") returned="sessionstore.js"
	[0133.400] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\"
	[0133.400] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned=""
	[0133.400] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.400] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\how-to-decrypt-files.htm")) returned 0x20
	[0133.400] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="SiteSecurityServiceState.txt" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt"
	[0133.400] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt", pszSpec="*.zip") returned 0
	[0133.400] lstrlenA (lpString="*.zip") returned 5
	[0133.400] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt", pszSpec="*.rar") returned 0
	[0133.400] lstrlenA (lpString="*.rar") returned 5
	[0133.400] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt", pszSpec="*.7z") returned 0
	[0133.400] lstrlenA (lpString="*.7z") returned 4
	[0133.400] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt", pszSpec="*.tar") returned 0
	[0133.400] lstrlenA (lpString="*.tar") returned 5
	[0133.400] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt", pszSpec="*.gzip") returned 0
	[0133.400] lstrlenA (lpString="*.gzip") returned 6
	[0133.400] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt", pszSpec="*.jpg") returned 0
	[0133.401] lstrlenA (lpString="*.jpg") returned 5
	[0133.401] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt", pszSpec="*.jpeg") returned 0
	[0133.401] lstrlenA (lpString="*.jpeg") returned 6
	[0133.401] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt", pszSpec="*.bmp") returned 0
	[0133.401] lstrlenA (lpString="*.bmp") returned 5
	[0133.401] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt", pszSpec="*.gif") returned 0
	[0133.401] lstrlenA (lpString="*.gif") returned 5
	[0133.401] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt", pszSpec="*.png") returned 0
	[0133.401] lstrlenA (lpString="*.png") returned 5
	[0133.401] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt", pszSpec="*.doc") returned 0
	[0133.401] lstrlenA (lpString="*.doc") returned 5
	[0133.401] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt", pszSpec="*.docx") returned 0
	[0133.401] lstrlenA (lpString="*.docx") returned 6
	[0133.401] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt", pszSpec="*.xls") returned 0
	[0133.401] lstrlenA (lpString="*.xls") returned 5
	[0133.401] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt", pszSpec="*.xlsx") returned 0
	[0133.401] lstrlenA (lpString="*.xlsx") returned 6
	[0133.401] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt", pszSpec="*.ppt") returned 0
	[0133.401] lstrlenA (lpString="*.ppt") returned 5
	[0133.401] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt", pszSpec="*.pptx") returned 0
	[0133.401] lstrlenA (lpString="*.pptx") returned 6
	[0133.401] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt", pszSpec="*.txt") returned 1
	[0133.401] lstrlenA (lpString="*.txt") returned 5
	[0133.401] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt"
	[0133.401] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt"
	[0133.401] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt."
	[0133.401] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt.exe"
	[0133.401] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sitesecurityservicestate.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0133.402] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x71e
	[0133.402] GetFileTime (in: hFile=0x220, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x143f0f49, dwHighDateTime=0x1d327ca), lpLastAccessTime=0x407536*(dwLowDateTime=0x143f0f49, dwHighDateTime=0x1d327ca), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb81085d6, dwHighDateTime=0x1d327cc)) returned 1
	[0133.402] SetFilePointer (in: hFile=0x220, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.402] ReadFile (in: hFile=0x220, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x6dc, lpOverlapped=0x0) returned 1
	[0133.403] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt") returned="SiteSecurityServiceState.txt"
	[0133.403] SetFilePointer (in: hFile=0x220, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.403] WriteFile (in: hFile=0x220, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x6dc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x6dc, lpOverlapped=0x0) returned 1
	[0133.404] SetFileTime (hFile=0x220, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.404] CloseHandle (hObject=0x220) returned 1
	[0133.404] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sitesecurityservicestate.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sitesecurityservicestate.txt.exe")) returned 1
	[0133.405] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c1abf, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x23c1abf, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x23c2e4c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="storage", cAlternateFileName="")) returned 1
	[0133.405] lstrcmpA (lpString1=".", lpString2="storage") returned -1
	[0133.405] lstrcmpA (lpString1="..", lpString2="storage") returned -1
	[0133.405] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt") returned="SiteSecurityServiceState.txt"
	[0133.405] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="storage" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage"
	[0133.405] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage") returned 81
	[0133.405] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\*.*", lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c1abf, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x23c1abf, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x23c2e4c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName=".", cAlternateFileName="")) returned 0x7cb750
	[0133.405] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.405] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c1abf, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x23c1abf, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x23c2e4c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="..", cAlternateFileName="")) returned 1
	[0133.405] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.406] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.406] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c2e4c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x23c2e4c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41de8bd2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="permanent", cAlternateFileName="PERMAN~1")) returned 1
	[0133.406] lstrcmpA (lpString1=".", lpString2="permanent") returned -1
	[0133.406] lstrcmpA (lpString1="..", lpString2="permanent") returned -1
	[0133.406] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\*.*") returned="*.*"
	[0133.406] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\", lpString2="permanent" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent"
	[0133.406] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent") returned 91
	[0133.406] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\*.*", lpFindFileData=0x19f110 | out: lpFindFileData=0x19f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c2e4c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x23c2e4c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41de8bd2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cbad0
	[0133.406] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.406] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f110 | out: lpFindFileData=0x19f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c2e4c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x23c2e4c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41de8bd2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0133.406] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.406] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.406] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f110 | out: lpFindFileData=0x19f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c2e4c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x246c9b2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x246c9b2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="chrome", cAlternateFileName="")) returned 1
	[0133.407] lstrcmpA (lpString1=".", lpString2="chrome") returned -1
	[0133.407] lstrcmpA (lpString1="..", lpString2="chrome") returned -1
	[0133.407] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\*.*") returned="*.*"
	[0133.407] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\", lpString2="chrome" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome"
	[0133.407] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome") returned 98
	[0133.407] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\*.*", lpFindFileData=0x19efc0 | out: lpFindFileData=0x19efc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c2e4c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x246c9b2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x246c9b2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cbb90
	[0133.407] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.407] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19efc0 | out: lpFindFileData=0x19efc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c2e4c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x246c9b2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x246c9b2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0133.407] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.407] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.407] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19efc0 | out: lpFindFileData=0x19efc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23c2e4c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x23c2e4c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x23c41d5, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x1d, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".metadata", cAlternateFileName="METADA~1")) returned 1
	[0133.407] PeekMessageA (in: lpMsg=0x19ef9c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19ef9c) returned 0
	[0133.407] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2=".metadata") returned 1
	[0133.407] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2=".metadata") returned 1
	[0133.407] lstrcmpiA (lpString1="", lpString2=".metadata") returned -1
	[0133.407] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\*.*") returned="*.*"
	[0133.407] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\"
	[0133.407] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\") returned=""
	[0133.407] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.407] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0133.407] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c
	[0133.410] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0133.410] WriteFile (in: hFile=0x22c, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0133.411] SetFileTime (hFile=0x22c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0133.411] CloseHandle (hObject=0x22c) returned 1
	[0133.411] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\", lpString2=".metadata" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata"
	[0133.411] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.zip") returned 0
	[0133.411] lstrlenA (lpString="*.zip") returned 5
	[0133.411] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.rar") returned 0
	[0133.411] lstrlenA (lpString="*.rar") returned 5
	[0133.411] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.7z") returned 0
	[0133.411] lstrlenA (lpString="*.7z") returned 4
	[0133.411] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.tar") returned 0
	[0133.411] lstrlenA (lpString="*.tar") returned 5
	[0133.411] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.gzip") returned 0
	[0133.411] lstrlenA (lpString="*.gzip") returned 6
	[0133.411] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.jpg") returned 0
	[0133.411] lstrlenA (lpString="*.jpg") returned 5
	[0133.411] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.jpeg") returned 0
	[0133.411] lstrlenA (lpString="*.jpeg") returned 6
	[0133.411] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.bmp") returned 0
	[0133.411] lstrlenA (lpString="*.bmp") returned 5
	[0133.412] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.gif") returned 0
	[0133.412] lstrlenA (lpString="*.gif") returned 5
	[0133.412] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.png") returned 0
	[0133.412] lstrlenA (lpString="*.png") returned 5
	[0133.412] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.doc") returned 0
	[0133.412] lstrlenA (lpString="*.doc") returned 5
	[0133.412] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.docx") returned 0
	[0133.412] lstrlenA (lpString="*.docx") returned 6
	[0133.412] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.xls") returned 0
	[0133.412] lstrlenA (lpString="*.xls") returned 5
	[0133.412] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.xlsx") returned 0
	[0133.412] lstrlenA (lpString="*.xlsx") returned 6
	[0133.412] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.ppt") returned 0
	[0133.412] lstrlenA (lpString="*.ppt") returned 5
	[0133.412] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.pptx") returned 0
	[0133.412] lstrlenA (lpString="*.pptx") returned 6
	[0133.412] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.txt") returned 0
	[0133.412] lstrlenA (lpString="*.txt") returned 5
	[0133.412] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.pdf") returned 0
	[0133.412] lstrlenA (lpString="*.pdf") returned 5
	[0133.412] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.htm") returned 0
	[0133.412] lstrlenA (lpString="*.htm") returned 5
	[0133.412] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.html") returned 0
	[0133.412] lstrlenA (lpString="*.html") returned 6
	[0133.412] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.mdb") returned 0
	[0133.412] lstrlenA (lpString="*.mdb") returned 5
	[0133.412] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.pfx") returned 0
	[0133.412] lstrlenA (lpString="*.pfx") returned 5
	[0133.412] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.md") returned 0
	[0133.412] lstrlenA (lpString="*.md") returned 4
	[0133.412] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.lnk") returned 0
	[0133.412] lstrlenA (lpString="*.lnk") returned 5
	[0133.412] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.torrent") returned 0
	[0133.412] lstrlenA (lpString="*.torrent") returned 9
	[0133.412] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.mov") returned 0
	[0133.413] lstrlenA (lpString="*.mov") returned 5
	[0133.413] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.3gp") returned 0
	[0133.413] lstrlenA (lpString="*.3gp") returned 5
	[0133.413] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.mpeg") returned 0
	[0133.413] lstrlenA (lpString="*.mpeg") returned 6
	[0133.413] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.mpg") returned 0
	[0133.413] lstrlenA (lpString="*.mpg") returned 5
	[0133.413] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.flv") returned 0
	[0133.413] lstrlenA (lpString="*.flv") returned 5
	[0133.413] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.avi") returned 0
	[0133.413] lstrlenA (lpString="*.avi") returned 5
	[0133.413] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.mp4") returned 0
	[0133.413] lstrlenA (lpString="*.mp4") returned 5
	[0133.413] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.wmv") returned 0
	[0133.413] lstrlenA (lpString="*.wmv") returned 5
	[0133.413] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.mkv") returned 0
	[0133.413] lstrlenA (lpString="*.mkv") returned 5
	[0133.413] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.mp3") returned 0
	[0133.413] lstrlenA (lpString="*.mp3") returned 5
	[0133.413] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.wav") returned 0
	[0133.413] lstrlenA (lpString="*.wav") returned 5
	[0133.413] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.flac") returned 0
	[0133.413] lstrlenA (lpString="*.flac") returned 6
	[0133.413] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.wma") returned 0
	[0133.413] lstrlenA (lpString="*.wma") returned 5
	[0133.413] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.au3") returned 0
	[0133.413] lstrlenA (lpString="*.au3") returned 5
	[0133.413] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.ahk") returned 0
	[0133.413] lstrlenA (lpString="*.ahk") returned 5
	[0133.413] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.c") returned 0
	[0133.413] lstrlenA (lpString="*.c") returned 3
	[0133.413] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.cc") returned 0
	[0133.413] lstrlenA (lpString="*.cc") returned 4
	[0133.413] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.cpp") returned 0
	[0133.413] lstrlenA (lpString="*.cpp") returned 5
	[0133.414] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.cxx") returned 0
	[0133.414] lstrlenA (lpString="*.cxx") returned 5
	[0133.414] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.c++") returned 0
	[0133.414] lstrlenA (lpString="*.c++") returned 5
	[0133.414] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.cs") returned 0
	[0133.414] lstrlenA (lpString="*.cs") returned 4
	[0133.414] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.vb") returned 0
	[0133.414] lstrlenA (lpString="*.vb") returned 4
	[0133.414] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.bas") returned 0
	[0133.414] lstrlenA (lpString="*.bas") returned 5
	[0133.414] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.csproj") returned 0
	[0133.414] lstrlenA (lpString="*.csproj") returned 8
	[0133.414] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.vbproj") returned 0
	[0133.414] lstrlenA (lpString="*.vbproj") returned 8
	[0133.414] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.vcxproj") returned 0
	[0133.414] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.414] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.manifest") returned 0
	[0133.414] lstrlenA (lpString="*.manifest") returned 10
	[0133.414] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.php") returned 0
	[0133.414] lstrlenA (lpString="*.php") returned 5
	[0133.414] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.vbe") returned 0
	[0133.414] lstrlenA (lpString="*.vbe") returned 5
	[0133.414] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.vba") returned 0
	[0133.414] lstrlenA (lpString="*.vba") returned 5
	[0133.414] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.vbs") returned 0
	[0133.414] lstrlenA (lpString="*.vbs") returned 5
	[0133.414] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.bat") returned 0
	[0133.414] lstrlenA (lpString="*.bat") returned 5
	[0133.414] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.cmd") returned 0
	[0133.414] lstrlenA (lpString="*.cmd") returned 5
	[0133.414] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.js") returned 0
	[0133.415] lstrlenA (lpString="*.js") returned 4
	[0133.415] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.jscript") returned 0
	[0133.415] lstrlenA (lpString="*.jscript") returned 9
	[0133.415] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.hta") returned 0
	[0133.415] lstrlenA (lpString="*.hta") returned 5
	[0133.415] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.php7") returned 0
	[0133.415] lstrlenA (lpString="*.php7") returned 6
	[0133.415] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.db") returned 0
	[0133.415] lstrlenA (lpString="*.db") returned 4
	[0133.415] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.swf") returned 0
	[0133.415] lstrlenA (lpString="*.swf") returned 5
	[0133.415] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.eml") returned 0
	[0133.415] lstrlenA (lpString="*.eml") returned 5
	[0133.415] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.part") returned 0
	[0133.415] lstrlenA (lpString="*.part") returned 6
	[0133.415] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.nfo") returned 0
	[0133.415] lstrlenA (lpString="*.nfo") returned 5
	[0133.415] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.rsa") returned 0
	[0133.415] lstrlenA (lpString="*.rsa") returned 5
	[0133.415] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.key") returned 0
	[0133.415] lstrlenA (lpString="*.key") returned 5
	[0133.415] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.aes") returned 0
	[0133.415] lstrlenA (lpString="*.aes") returned 5
	[0133.415] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.blob") returned 0
	[0133.415] lstrlenA (lpString="*.blob") returned 6
	[0133.415] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.btc") returned 0
	[0133.415] lstrlenA (lpString="*.btc") returned 5
	[0133.415] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", pszSpec="*.wallet") returned 0
	[0133.415] lstrlenA (lpString="*.wallet") returned 8
	[0133.415] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19efc0 | out: lpFindFileData=0x19efc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2409b53, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x2409b53, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x240aee0, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2a, dwReserved0=0x0, dwReserved1=0x0, cFileName=".metadata-v2", cAlternateFileName="METADA~2")) returned 1
	[0133.416] PeekMessageA (in: lpMsg=0x19ef9c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19ef9c) returned 0
	[0133.416] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2=".metadata-v2") returned 1
	[0133.416] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2=".metadata-v2") returned 1
	[0133.416] lstrcmpiA (lpString1="", lpString2=".metadata-v2") returned -1
	[0133.416] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata") returned=".metadata"
	[0133.416] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\"
	[0133.416] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\") returned=""
	[0133.416] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.416] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\how-to-decrypt-files.htm")) returned 0x20
	[0133.416] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\", lpString2=".metadata-v2" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2"
	[0133.416] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.zip") returned 0
	[0133.416] lstrlenA (lpString="*.zip") returned 5
	[0133.416] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.rar") returned 0
	[0133.416] lstrlenA (lpString="*.rar") returned 5
	[0133.416] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.7z") returned 0
	[0133.416] lstrlenA (lpString="*.7z") returned 4
	[0133.416] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.tar") returned 0
	[0133.416] lstrlenA (lpString="*.tar") returned 5
	[0133.416] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.gzip") returned 0
	[0133.416] lstrlenA (lpString="*.gzip") returned 6
	[0133.416] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.jpg") returned 0
	[0133.416] lstrlenA (lpString="*.jpg") returned 5
	[0133.416] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.jpeg") returned 0
	[0133.416] lstrlenA (lpString="*.jpeg") returned 6
	[0133.416] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.bmp") returned 0
	[0133.416] lstrlenA (lpString="*.bmp") returned 5
	[0133.416] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.gif") returned 0
	[0133.416] lstrlenA (lpString="*.gif") returned 5
	[0133.416] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.png") returned 0
	[0133.416] lstrlenA (lpString="*.png") returned 5
	[0133.416] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.doc") returned 0
	[0133.417] lstrlenA (lpString="*.doc") returned 5
	[0133.417] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.docx") returned 0
	[0133.417] lstrlenA (lpString="*.docx") returned 6
	[0133.417] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.xls") returned 0
	[0133.417] lstrlenA (lpString="*.xls") returned 5
	[0133.417] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.xlsx") returned 0
	[0133.417] lstrlenA (lpString="*.xlsx") returned 6
	[0133.417] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.ppt") returned 0
	[0133.417] lstrlenA (lpString="*.ppt") returned 5
	[0133.417] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.pptx") returned 0
	[0133.417] lstrlenA (lpString="*.pptx") returned 6
	[0133.417] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.txt") returned 0
	[0133.417] lstrlenA (lpString="*.txt") returned 5
	[0133.417] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.pdf") returned 0
	[0133.417] lstrlenA (lpString="*.pdf") returned 5
	[0133.417] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.htm") returned 0
	[0133.417] lstrlenA (lpString="*.htm") returned 5
	[0133.417] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.html") returned 0
	[0133.417] lstrlenA (lpString="*.html") returned 6
	[0133.417] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.mdb") returned 0
	[0133.417] lstrlenA (lpString="*.mdb") returned 5
	[0133.417] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.pfx") returned 0
	[0133.417] lstrlenA (lpString="*.pfx") returned 5
	[0133.417] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.md") returned 0
	[0133.417] lstrlenA (lpString="*.md") returned 4
	[0133.417] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.lnk") returned 0
	[0133.417] lstrlenA (lpString="*.lnk") returned 5
	[0133.417] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.torrent") returned 0
	[0133.417] lstrlenA (lpString="*.torrent") returned 9
	[0133.417] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.mov") returned 0
	[0133.417] lstrlenA (lpString="*.mov") returned 5
	[0133.417] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.3gp") returned 0
	[0133.417] lstrlenA (lpString="*.3gp") returned 5
	[0133.417] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.mpeg") returned 0
	[0133.417] lstrlenA (lpString="*.mpeg") returned 6
	[0133.418] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.mpg") returned 0
	[0133.418] lstrlenA (lpString="*.mpg") returned 5
	[0133.418] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.flv") returned 0
	[0133.418] lstrlenA (lpString="*.flv") returned 5
	[0133.418] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.avi") returned 0
	[0133.418] lstrlenA (lpString="*.avi") returned 5
	[0133.418] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.mp4") returned 0
	[0133.418] lstrlenA (lpString="*.mp4") returned 5
	[0133.418] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.wmv") returned 0
	[0133.418] lstrlenA (lpString="*.wmv") returned 5
	[0133.418] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.mkv") returned 0
	[0133.418] lstrlenA (lpString="*.mkv") returned 5
	[0133.418] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.mp3") returned 0
	[0133.418] lstrlenA (lpString="*.mp3") returned 5
	[0133.418] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.wav") returned 0
	[0133.418] lstrlenA (lpString="*.wav") returned 5
	[0133.418] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.flac") returned 0
	[0133.418] lstrlenA (lpString="*.flac") returned 6
	[0133.418] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.wma") returned 0
	[0133.418] lstrlenA (lpString="*.wma") returned 5
	[0133.418] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.au3") returned 0
	[0133.418] lstrlenA (lpString="*.au3") returned 5
	[0133.418] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.ahk") returned 0
	[0133.418] lstrlenA (lpString="*.ahk") returned 5
	[0133.418] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.c") returned 0
	[0133.418] lstrlenA (lpString="*.c") returned 3
	[0133.418] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.cc") returned 0
	[0133.418] lstrlenA (lpString="*.cc") returned 4
	[0133.418] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.cpp") returned 0
	[0133.418] lstrlenA (lpString="*.cpp") returned 5
	[0133.418] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.cxx") returned 0
	[0133.418] lstrlenA (lpString="*.cxx") returned 5
	[0133.418] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.c++") returned 0
	[0133.419] lstrlenA (lpString="*.c++") returned 5
	[0133.419] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.cs") returned 0
	[0133.419] lstrlenA (lpString="*.cs") returned 4
	[0133.419] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.vb") returned 0
	[0133.419] lstrlenA (lpString="*.vb") returned 4
	[0133.419] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.bas") returned 0
	[0133.419] lstrlenA (lpString="*.bas") returned 5
	[0133.419] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.csproj") returned 0
	[0133.419] lstrlenA (lpString="*.csproj") returned 8
	[0133.419] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.vbproj") returned 0
	[0133.419] lstrlenA (lpString="*.vbproj") returned 8
	[0133.419] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.vcxproj") returned 0
	[0133.419] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.419] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.manifest") returned 0
	[0133.419] lstrlenA (lpString="*.manifest") returned 10
	[0133.419] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.php") returned 0
	[0133.419] lstrlenA (lpString="*.php") returned 5
	[0133.419] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.vbe") returned 0
	[0133.419] lstrlenA (lpString="*.vbe") returned 5
	[0133.419] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.vba") returned 0
	[0133.419] lstrlenA (lpString="*.vba") returned 5
	[0133.419] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.vbs") returned 0
	[0133.419] lstrlenA (lpString="*.vbs") returned 5
	[0133.419] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.bat") returned 0
	[0133.419] lstrlenA (lpString="*.bat") returned 5
	[0133.419] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.cmd") returned 0
	[0133.419] lstrlenA (lpString="*.cmd") returned 5
	[0133.419] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.js") returned 0
	[0133.419] lstrlenA (lpString="*.js") returned 4
	[0133.419] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.jscript") returned 0
	[0133.419] lstrlenA (lpString="*.jscript") returned 9
	[0133.419] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.hta") returned 0
	[0133.419] lstrlenA (lpString="*.hta") returned 5
	[0133.419] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.php7") returned 0
	[0133.420] lstrlenA (lpString="*.php7") returned 6
	[0133.420] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.db") returned 0
	[0133.420] lstrlenA (lpString="*.db") returned 4
	[0133.420] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.swf") returned 0
	[0133.420] lstrlenA (lpString="*.swf") returned 5
	[0133.420] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.eml") returned 0
	[0133.420] lstrlenA (lpString="*.eml") returned 5
	[0133.420] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.part") returned 0
	[0133.420] lstrlenA (lpString="*.part") returned 6
	[0133.420] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.nfo") returned 0
	[0133.420] lstrlenA (lpString="*.nfo") returned 5
	[0133.420] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.rsa") returned 0
	[0133.420] lstrlenA (lpString="*.rsa") returned 5
	[0133.420] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.key") returned 0
	[0133.420] lstrlenA (lpString="*.key") returned 5
	[0133.420] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.aes") returned 0
	[0133.420] lstrlenA (lpString="*.aes") returned 5
	[0133.420] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.blob") returned 0
	[0133.420] lstrlenA (lpString="*.blob") returned 6
	[0133.420] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.btc") returned 0
	[0133.420] lstrlenA (lpString="*.btc") returned 5
	[0133.420] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", pszSpec="*.wallet") returned 0
	[0133.420] lstrlenA (lpString="*.wallet") returned 8
	[0133.420] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19efc0 | out: lpFindFileData=0x19efc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x246c9b2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7d09b9f, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xeffbe54, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650070, dwReserved1=0x6d0072, cFileName="idb", cAlternateFileName="")) returned 1
	[0133.420] lstrcmpA (lpString1=".", lpString2="idb") returned -1
	[0133.420] lstrcmpA (lpString1="..", lpString2="idb") returned -1
	[0133.420] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2") returned=".metadata-v2"
	[0133.420] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\", lpString2="idb" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb"
	[0133.420] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb") returned 102
	[0133.420] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\*.*", lpFindFileData=0x19ee70 | out: lpFindFileData=0x19ee70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x246c9b2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7d09b9f, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xeffbe54, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x108, cFileName=".", cAlternateFileName="")) returned 0x7cb790
	[0133.422] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.422] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19ee70 | out: lpFindFileData=0x19ee70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x246c9b2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7d09b9f, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xeffbe54, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x108, cFileName="..", cAlternateFileName="")) returned 1
	[0133.422] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.422] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.422] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19ee70 | out: lpFindFileData=0x19ee70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e680c0, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x2e680c0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x2e680c0, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x108, cFileName="2918063365piupsah.files", cAlternateFileName="291806~1.FIL")) returned 1
	[0133.422] lstrcmpA (lpString1=".", lpString2="2918063365piupsah.files") returned -1
	[0133.422] lstrcmpA (lpString1="..", lpString2="2918063365piupsah.files") returned -1
	[0133.422] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\*.*") returned="*.*"
	[0133.422] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\", lpString2="2918063365piupsah.files" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files"
	[0133.422] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files") returned 126
	[0133.422] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files\\*.*", lpFindFileData=0x19ed20 | out: lpFindFileData=0x19ed20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e680c0, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x2e680c0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x2e680c0, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cbbd0
	[0133.422] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.422] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19ed20 | out: lpFindFileData=0x19ed20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e680c0, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x2e680c0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x2e680c0, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0133.422] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.422] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.422] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19ed20 | out: lpFindFileData=0x19ed20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e680c0, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x2e680c0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x2e680c0, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 0
	[0133.422] FindClose (in: hFindFile=0x7cbbd0 | out: hFindFile=0x7cbbd0) returned 1
	[0133.423] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19ee70 | out: lpFindFileData=0x19ee70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x246c9b2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x246c9b2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4714894, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xc000, dwReserved0=0x7b0000, dwReserved1=0x108, cFileName="2918063365piupsah.sqlite", cAlternateFileName="291806~1.SQL")) returned 1
	[0133.423] PeekMessageA (in: lpMsg=0x19ee4c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19ee4c) returned 0
	[0133.423] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="2918063365piupsah.sqlite") returned 1
	[0133.423] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="2918063365piupsah.sqlite") returned 1
	[0133.423] lstrcmpiA (lpString1="", lpString2="2918063365piupsah.sqlite") returned -1
	[0133.423] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\*.*") returned="*.*"
	[0133.423] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\"
	[0133.423] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\") returned=""
	[0133.423] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.423] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0133.423] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230
	[0133.424] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0133.424] WriteFile (in: hFile=0x230, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0133.425] SetFileTime (hFile=0x230, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0133.425] CloseHandle (hObject=0x230) returned 1
	[0133.425] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\", lpString2="2918063365piupsah.sqlite" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite"
	[0133.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.zip") returned 0
	[0133.425] lstrlenA (lpString="*.zip") returned 5
	[0133.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.rar") returned 0
	[0133.425] lstrlenA (lpString="*.rar") returned 5
	[0133.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.7z") returned 0
	[0133.425] lstrlenA (lpString="*.7z") returned 4
	[0133.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.tar") returned 0
	[0133.425] lstrlenA (lpString="*.tar") returned 5
	[0133.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.gzip") returned 0
	[0133.425] lstrlenA (lpString="*.gzip") returned 6
	[0133.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.jpg") returned 0
	[0133.425] lstrlenA (lpString="*.jpg") returned 5
	[0133.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.jpeg") returned 0
	[0133.425] lstrlenA (lpString="*.jpeg") returned 6
	[0133.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.bmp") returned 0
	[0133.426] lstrlenA (lpString="*.bmp") returned 5
	[0133.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.gif") returned 0
	[0133.426] lstrlenA (lpString="*.gif") returned 5
	[0133.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.png") returned 0
	[0133.426] lstrlenA (lpString="*.png") returned 5
	[0133.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.doc") returned 0
	[0133.426] lstrlenA (lpString="*.doc") returned 5
	[0133.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.docx") returned 0
	[0133.426] lstrlenA (lpString="*.docx") returned 6
	[0133.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.xls") returned 0
	[0133.426] lstrlenA (lpString="*.xls") returned 5
	[0133.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.xlsx") returned 0
	[0133.426] lstrlenA (lpString="*.xlsx") returned 6
	[0133.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.ppt") returned 0
	[0133.426] lstrlenA (lpString="*.ppt") returned 5
	[0133.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.pptx") returned 0
	[0133.426] lstrlenA (lpString="*.pptx") returned 6
	[0133.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.txt") returned 0
	[0133.426] lstrlenA (lpString="*.txt") returned 5
	[0133.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.pdf") returned 0
	[0133.426] lstrlenA (lpString="*.pdf") returned 5
	[0133.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.htm") returned 0
	[0133.426] lstrlenA (lpString="*.htm") returned 5
	[0133.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.html") returned 0
	[0133.426] lstrlenA (lpString="*.html") returned 6
	[0133.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.mdb") returned 0
	[0133.426] lstrlenA (lpString="*.mdb") returned 5
	[0133.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.pfx") returned 0
	[0133.426] lstrlenA (lpString="*.pfx") returned 5
	[0133.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.md") returned 0
	[0133.426] lstrlenA (lpString="*.md") returned 4
	[0133.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.lnk") returned 0
	[0133.426] lstrlenA (lpString="*.lnk") returned 5
	[0133.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.torrent") returned 0
	[0133.427] lstrlenA (lpString="*.torrent") returned 9
	[0133.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.mov") returned 0
	[0133.427] lstrlenA (lpString="*.mov") returned 5
	[0133.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.3gp") returned 0
	[0133.427] lstrlenA (lpString="*.3gp") returned 5
	[0133.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.mpeg") returned 0
	[0133.427] lstrlenA (lpString="*.mpeg") returned 6
	[0133.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.mpg") returned 0
	[0133.427] lstrlenA (lpString="*.mpg") returned 5
	[0133.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.flv") returned 0
	[0133.427] lstrlenA (lpString="*.flv") returned 5
	[0133.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.avi") returned 0
	[0133.427] lstrlenA (lpString="*.avi") returned 5
	[0133.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.mp4") returned 0
	[0133.427] lstrlenA (lpString="*.mp4") returned 5
	[0133.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.wmv") returned 0
	[0133.427] lstrlenA (lpString="*.wmv") returned 5
	[0133.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.mkv") returned 0
	[0133.427] lstrlenA (lpString="*.mkv") returned 5
	[0133.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.mp3") returned 0
	[0133.427] lstrlenA (lpString="*.mp3") returned 5
	[0133.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.wav") returned 0
	[0133.427] lstrlenA (lpString="*.wav") returned 5
	[0133.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.flac") returned 0
	[0133.427] lstrlenA (lpString="*.flac") returned 6
	[0133.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.wma") returned 0
	[0133.427] lstrlenA (lpString="*.wma") returned 5
	[0133.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.au3") returned 0
	[0133.427] lstrlenA (lpString="*.au3") returned 5
	[0133.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.ahk") returned 0
	[0133.427] lstrlenA (lpString="*.ahk") returned 5
	[0133.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.c") returned 0
	[0133.427] lstrlenA (lpString="*.c") returned 3
	[0133.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.cc") returned 0
	[0133.428] lstrlenA (lpString="*.cc") returned 4
	[0133.428] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.cpp") returned 0
	[0133.428] lstrlenA (lpString="*.cpp") returned 5
	[0133.428] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.cxx") returned 0
	[0133.428] lstrlenA (lpString="*.cxx") returned 5
	[0133.428] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.c++") returned 0
	[0133.428] lstrlenA (lpString="*.c++") returned 5
	[0133.428] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.cs") returned 0
	[0133.428] lstrlenA (lpString="*.cs") returned 4
	[0133.428] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.vb") returned 0
	[0133.428] lstrlenA (lpString="*.vb") returned 4
	[0133.428] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.bas") returned 0
	[0133.428] lstrlenA (lpString="*.bas") returned 5
	[0133.428] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.csproj") returned 0
	[0133.428] lstrlenA (lpString="*.csproj") returned 8
	[0133.428] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.vbproj") returned 0
	[0133.428] lstrlenA (lpString="*.vbproj") returned 8
	[0133.428] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.vcxproj") returned 0
	[0133.428] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.428] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.manifest") returned 0
	[0133.428] lstrlenA (lpString="*.manifest") returned 10
	[0133.428] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.php") returned 0
	[0133.428] lstrlenA (lpString="*.php") returned 5
	[0133.428] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.vbe") returned 0
	[0133.428] lstrlenA (lpString="*.vbe") returned 5
	[0133.428] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.vba") returned 0
	[0133.428] lstrlenA (lpString="*.vba") returned 5
	[0133.428] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.vbs") returned 0
	[0133.428] lstrlenA (lpString="*.vbs") returned 5
	[0133.428] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.bat") returned 0
	[0133.428] lstrlenA (lpString="*.bat") returned 5
	[0133.428] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.cmd") returned 0
	[0133.428] lstrlenA (lpString="*.cmd") returned 5
	[0133.428] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.js") returned 0
	[0133.428] lstrlenA (lpString="*.js") returned 4
	[0133.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.jscript") returned 0
	[0133.429] lstrlenA (lpString="*.jscript") returned 9
	[0133.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.hta") returned 0
	[0133.429] lstrlenA (lpString="*.hta") returned 5
	[0133.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.php7") returned 0
	[0133.429] lstrlenA (lpString="*.php7") returned 6
	[0133.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.db") returned 0
	[0133.429] lstrlenA (lpString="*.db") returned 4
	[0133.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.swf") returned 0
	[0133.429] lstrlenA (lpString="*.swf") returned 5
	[0133.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.eml") returned 0
	[0133.429] lstrlenA (lpString="*.eml") returned 5
	[0133.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.part") returned 0
	[0133.429] lstrlenA (lpString="*.part") returned 6
	[0133.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.nfo") returned 0
	[0133.429] lstrlenA (lpString="*.nfo") returned 5
	[0133.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.rsa") returned 0
	[0133.429] lstrlenA (lpString="*.rsa") returned 5
	[0133.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.key") returned 0
	[0133.429] lstrlenA (lpString="*.key") returned 5
	[0133.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.aes") returned 0
	[0133.429] lstrlenA (lpString="*.aes") returned 5
	[0133.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.blob") returned 0
	[0133.429] lstrlenA (lpString="*.blob") returned 6
	[0133.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.btc") returned 0
	[0133.429] lstrlenA (lpString="*.btc") returned 5
	[0133.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", pszSpec="*.wallet") returned 0
	[0133.429] lstrlenA (lpString="*.wallet") returned 8
	[0133.429] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19ee70 | out: lpFindFileData=0x19ee70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x246c9b2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x246c9b2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4714894, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xc000, dwReserved0=0x7b0000, dwReserved1=0x108, cFileName="2918063365piupsah.sqlite", cAlternateFileName="291806~1.SQL")) returned 0
	[0133.429] FindClose (in: hFindFile=0x7cb790 | out: hFindFile=0x7cb790) returned 1
	[0133.430] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19efc0 | out: lpFindFileData=0x19efc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x246c9b2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7d09b9f, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xeffbe54, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650070, dwReserved1=0x6d0072, cFileName="idb", cAlternateFileName="")) returned 0
	[0133.430] FindClose (in: hFindFile=0x7cbb90 | out: hFindFile=0x7cbb90) returned 1
	[0133.430] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f110 | out: lpFindFileData=0x19f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41de8bd2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41ea4c3c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41ea601c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="moz-safe-about+home", cAlternateFileName="MOZ-SA~1")) returned 1
	[0133.430] lstrcmpA (lpString1=".", lpString2="moz-safe-about+home") returned -1
	[0133.430] lstrcmpA (lpString1="..", lpString2="moz-safe-about+home") returned -1
	[0133.430] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\*.*") returned="*.*"
	[0133.430] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\", lpString2="moz-safe-about+home" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home"
	[0133.430] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home") returned 111
	[0133.430] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\*.*", lpFindFileData=0x19efc0 | out: lpFindFileData=0x19efc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41de8bd2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41ea4c3c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41ea601c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb790
	[0133.430] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.430] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19efc0 | out: lpFindFileData=0x19efc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41de8bd2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41ea4c3c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41ea601c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.430] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.430] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.430] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19efc0 | out: lpFindFileData=0x19efc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41de9f5b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41de9f5b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41de9f5b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2e, dwReserved0=0x0, dwReserved1=0x0, cFileName=".metadata", cAlternateFileName="METADA~1")) returned 1
	[0133.430] PeekMessageA (in: lpMsg=0x19ef9c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19ef9c) returned 0
	[0133.430] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2=".metadata") returned 1
	[0133.430] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2=".metadata") returned 1
	[0133.430] lstrcmpiA (lpString1="", lpString2=".metadata") returned -1
	[0133.430] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\*.*") returned="*.*"
	[0133.430] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\"
	[0133.430] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\") returned=""
	[0133.430] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.430] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0133.431] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c
	[0133.432] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0133.433] WriteFile (in: hFile=0x22c, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0133.433] SetFileTime (hFile=0x22c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0133.433] CloseHandle (hObject=0x22c) returned 1
	[0133.434] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\", lpString2=".metadata" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata"
	[0133.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.zip") returned 0
	[0133.434] lstrlenA (lpString="*.zip") returned 5
	[0133.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.rar") returned 0
	[0133.434] lstrlenA (lpString="*.rar") returned 5
	[0133.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.7z") returned 0
	[0133.434] lstrlenA (lpString="*.7z") returned 4
	[0133.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.tar") returned 0
	[0133.434] lstrlenA (lpString="*.tar") returned 5
	[0133.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.gzip") returned 0
	[0133.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.jpg") returned 0
	[0133.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.jpeg") returned 0
	[0133.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.bmp") returned 0
	[0133.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.gif") returned 0
	[0133.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.png") returned 0
	[0133.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.doc") returned 0
	[0133.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.docx") returned 0
	[0133.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.xls") returned 0
	[0133.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.xlsx") returned 0
	[0133.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.ppt") returned 0
	[0133.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.pptx") returned 0
	[0133.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.txt") returned 0
	[0133.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.pdf") returned 0
	[0133.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.htm") returned 0
	[0133.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.html") returned 0
	[0133.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.mdb") returned 0
	[0133.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.pfx") returned 0
	[0133.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.md") returned 0
	[0133.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.lnk") returned 0
	[0133.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.torrent") returned 0
	[0133.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.mov") returned 0
	[0133.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.3gp") returned 0
	[0133.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.mpeg") returned 0
	[0133.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.mpg") returned 0
	[0133.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.flv") returned 0
	[0133.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.avi") returned 0
	[0133.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.mp4") returned 0
	[0133.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.wmv") returned 0
	[0133.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.mkv") returned 0
	[0133.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.mp3") returned 0
	[0133.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.wav") returned 0
	[0133.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.flac") returned 0
	[0133.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.wma") returned 0
	[0133.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.au3") returned 0
	[0133.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.ahk") returned 0
	[0133.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.c") returned 0
	[0133.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.cc") returned 0
	[0133.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.cpp") returned 0
	[0133.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.cxx") returned 0
	[0133.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.c++") returned 0
	[0133.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.cs") returned 0
	[0133.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.vb") returned 0
	[0133.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.bas") returned 0
	[0133.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.csproj") returned 0
	[0133.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.vbproj") returned 0
	[0133.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.vcxproj") returned 0
	[0133.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.manifest") returned 0
	[0133.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.php") returned 0
	[0133.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.vbe") returned 0
	[0133.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.vba") returned 0
	[0133.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.vbs") returned 0
	[0133.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.bat") returned 0
	[0133.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.cmd") returned 0
	[0133.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.js") returned 0
	[0133.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.jscript") returned 0
	[0133.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.hta") returned 0
	[0133.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.php7") returned 0
	[0133.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.db") returned 0
	[0133.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.swf") returned 0
	[0133.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.eml") returned 0
	[0133.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.part") returned 0
	[0133.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.nfo") returned 0
	[0133.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.rsa") returned 0
	[0133.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.key") returned 0
	[0133.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.aes") returned 0
	[0133.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.blob") returned 0
	[0133.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.btc") returned 0
	[0133.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", pszSpec="*.wallet") returned 0
	[0133.437] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19efc0 | out: lpFindFileData=0x19efc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41e667ed, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41e667ed, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41e667ed, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x0, dwReserved1=0x0, cFileName=".metadata-v2", cAlternateFileName="METADA~2")) returned 1
	[0133.437] PeekMessageA (in: lpMsg=0x19ef9c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19ef9c) returned 0
	[0133.437] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2=".metadata-v2") returned 1
	[0133.437] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2=".metadata-v2") returned 1
	[0133.437] lstrcmpiA (lpString1="", lpString2=".metadata-v2") returned -1
	[0133.437] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata") returned=".metadata"
	[0133.437] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\"
	[0133.437] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\") returned=""
	[0133.437] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.437] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\how-to-decrypt-files.htm")) returned 0x20
	[0133.437] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\", lpString2=".metadata-v2" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2"
	[0133.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.zip") returned 0
	[0133.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.rar") returned 0
	[0133.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.7z") returned 0
	[0133.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.tar") returned 0
	[0133.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.gzip") returned 0
	[0133.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.jpg") returned 0
	[0133.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.jpeg") returned 0
	[0133.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.bmp") returned 0
	[0133.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.gif") returned 0
	[0133.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.png") returned 0
	[0133.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.doc") returned 0
	[0133.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.docx") returned 0
	[0133.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.xls") returned 0
	[0133.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.xlsx") returned 0
	[0133.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.ppt") returned 0
	[0133.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.pptx") returned 0
	[0133.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.txt") returned 0
	[0133.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.pdf") returned 0
	[0133.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.htm") returned 0
	[0133.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.html") returned 0
	[0133.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.mdb") returned 0
	[0133.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.pfx") returned 0
	[0133.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.md") returned 0
	[0133.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.lnk") returned 0
	[0133.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.torrent") returned 0
	[0133.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.mov") returned 0
	[0133.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.3gp") returned 0
	[0133.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.mpeg") returned 0
	[0133.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.mpg") returned 0
	[0133.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.flv") returned 0
	[0133.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.avi") returned 0
	[0133.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.mp4") returned 0
	[0133.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.wmv") returned 0
	[0133.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.mkv") returned 0
	[0133.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.mp3") returned 0
	[0133.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.wav") returned 0
	[0133.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.flac") returned 0
	[0133.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.wma") returned 0
	[0133.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.au3") returned 0
	[0133.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.ahk") returned 0
	[0133.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.c") returned 0
	[0133.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.cc") returned 0
	[0133.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.cpp") returned 0
	[0133.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.cxx") returned 0
	[0133.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.c++") returned 0
	[0133.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.cs") returned 0
	[0133.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.vb") returned 0
	[0133.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.bas") returned 0
	[0133.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.csproj") returned 0
	[0133.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.vbproj") returned 0
	[0133.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.vcxproj") returned 0
	[0133.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.manifest") returned 0
	[0133.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.php") returned 0
	[0133.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.vbe") returned 0
	[0133.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.vba") returned 0
	[0133.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.vbs") returned 0
	[0133.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.bat") returned 0
	[0133.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.cmd") returned 0
	[0133.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.js") returned 0
	[0133.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.jscript") returned 0
	[0133.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.hta") returned 0
	[0133.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.php7") returned 0
	[0133.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.db") returned 0
	[0133.440] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.swf") returned 0
	[0133.440] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.eml") returned 0
	[0133.440] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.part") returned 0
	[0133.440] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.nfo") returned 0
	[0133.440] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.rsa") returned 0
	[0133.440] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.key") returned 0
	[0133.440] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.aes") returned 0
	[0133.440] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.blob") returned 0
	[0133.440] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.btc") returned 0
	[0133.440] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", pszSpec="*.wallet") returned 0
	[0133.440] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19efc0 | out: lpFindFileData=0x19efc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41ea601c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x826703d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xf722f14, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650070, dwReserved1=0x6d0072, cFileName="idb", cAlternateFileName="")) returned 1
	[0133.440] lstrcmpA (lpString1=".", lpString2="idb") returned -1
	[0133.440] lstrcmpA (lpString1="..", lpString2="idb") returned -1
	[0133.440] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2") returned=".metadata-v2"
	[0133.440] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\", lpString2="idb" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb"
	[0133.440] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\*.*", lpFindFileData=0x19ee70 | out: lpFindFileData=0x19ee70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41ea601c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x826703d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xf722f14, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x128, cFileName=".", cAlternateFileName="")) returned 0x7cb7d0
	[0133.442] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.442] FindNextFileA (in: hFindFile=0x7cb7d0, lpFindFileData=0x19ee70 | out: lpFindFileData=0x19ee70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41ea601c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x826703d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xf722f14, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x128, cFileName="..", cAlternateFileName="")) returned 1
	[0133.443] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.443] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.443] FindNextFileA (in: hFindFile=0x7cb7d0, lpFindFileData=0x19ee70 | out: lpFindFileData=0x19ee70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x421d9eea, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x421d9eea, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x421d9eea, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x128, cFileName="818200132aebmoouht.files", cAlternateFileName="818200~1.FIL")) returned 1
	[0133.443] lstrcmpA (lpString1=".", lpString2="818200132aebmoouht.files") returned -1
	[0133.443] lstrcmpA (lpString1="..", lpString2="818200132aebmoouht.files") returned -1
	[0133.443] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\*.*") returned="*.*"
	[0133.443] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\", lpString2="818200132aebmoouht.files" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files"
	[0133.443] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\*.*", lpFindFileData=0x19ed20 | out: lpFindFileData=0x19ed20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x421d9eea, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x421d9eea, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x421d9eea, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cb810
	[0133.443] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.443] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19ed20 | out: lpFindFileData=0x19ed20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x421d9eea, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x421d9eea, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x421d9eea, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0133.443] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.443] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.443] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19ed20 | out: lpFindFileData=0x19ed20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x421d9eea, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x421d9eea, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x421d9eea, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 0
	[0133.443] FindClose (in: hFindFile=0x7cb810 | out: hFindFile=0x7cb810) returned 1
	[0133.443] FindNextFileA (in: hFindFile=0x7cb7d0, lpFindFileData=0x19ee70 | out: lpFindFileData=0x19ee70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ea7396, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41ea7396, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x971d956, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x7b0000, dwReserved1=0x128, cFileName="818200132aebmoouht.sqlite", cAlternateFileName="818200~1.SQL")) returned 1
	[0133.443] PeekMessageA (in: lpMsg=0x19ee4c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19ee4c) returned 0
	[0133.443] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="818200132aebmoouht.sqlite") returned 1
	[0133.443] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="818200132aebmoouht.sqlite") returned 1
	[0133.443] lstrcmpiA (lpString1="", lpString2="818200132aebmoouht.sqlite") returned -1
	[0133.443] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\*.*") returned="*.*"
	[0133.443] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\"
	[0133.443] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\") returned=""
	[0133.443] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.443] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0133.444] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230
	[0133.444] WriteFile (in: hFile=0x230, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0133.445] SetFileTime (hFile=0x230, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0133.445] CloseHandle (hObject=0x230) returned 1
	[0133.445] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\", lpString2="818200132aebmoouht.sqlite" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite"
	[0133.445] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.zip") returned 0
	[0133.445] lstrlenA (lpString="*.zip") returned 5
	[0133.446] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.rar") returned 0
	[0133.446] lstrlenA (lpString="*.rar") returned 5
	[0133.446] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.7z") returned 0
	[0133.446] lstrlenA (lpString="*.7z") returned 4
	[0133.446] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.tar") returned 0
	[0133.446] lstrlenA (lpString="*.tar") returned 5
	[0133.446] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.gzip") returned 0
	[0133.446] lstrlenA (lpString="*.gzip") returned 6
	[0133.446] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.jpg") returned 0
	[0133.446] lstrlenA (lpString="*.jpg") returned 5
	[0133.446] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.jpeg") returned 0
	[0133.446] lstrlenA (lpString="*.jpeg") returned 6
	[0133.446] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.bmp") returned 0
	[0133.446] lstrlenA (lpString="*.bmp") returned 5
	[0133.446] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.gif") returned 0
	[0133.446] lstrlenA (lpString="*.gif") returned 5
	[0133.446] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.png") returned 0
	[0133.446] lstrlenA (lpString="*.png") returned 5
	[0133.446] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.doc") returned 0
	[0133.446] lstrlenA (lpString="*.doc") returned 5
	[0133.446] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.docx") returned 0
	[0133.446] lstrlenA (lpString="*.docx") returned 6
	[0133.446] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.xls") returned 0
	[0133.446] lstrlenA (lpString="*.xls") returned 5
	[0133.446] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.xlsx") returned 0
	[0133.446] lstrlenA (lpString="*.xlsx") returned 6
	[0133.446] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.ppt") returned 0
	[0133.446] lstrlenA (lpString="*.ppt") returned 5
	[0133.446] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.pptx") returned 0
	[0133.446] lstrlenA (lpString="*.pptx") returned 6
	[0133.446] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.txt") returned 0
	[0133.446] lstrlenA (lpString="*.txt") returned 5
	[0133.446] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.pdf") returned 0
	[0133.447] lstrlenA (lpString="*.pdf") returned 5
	[0133.447] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.htm") returned 0
	[0133.447] lstrlenA (lpString="*.htm") returned 5
	[0133.447] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.html") returned 0
	[0133.447] lstrlenA (lpString="*.html") returned 6
	[0133.447] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.mdb") returned 0
	[0133.447] lstrlenA (lpString="*.mdb") returned 5
	[0133.447] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.pfx") returned 0
	[0133.447] lstrlenA (lpString="*.pfx") returned 5
	[0133.447] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.md") returned 0
	[0133.447] lstrlenA (lpString="*.md") returned 4
	[0133.447] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.lnk") returned 0
	[0133.447] lstrlenA (lpString="*.lnk") returned 5
	[0133.447] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.torrent") returned 0
	[0133.447] lstrlenA (lpString="*.torrent") returned 9
	[0133.447] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.mov") returned 0
	[0133.447] lstrlenA (lpString="*.mov") returned 5
	[0133.447] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.3gp") returned 0
	[0133.447] lstrlenA (lpString="*.3gp") returned 5
	[0133.447] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.mpeg") returned 0
	[0133.447] lstrlenA (lpString="*.mpeg") returned 6
	[0133.447] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.mpg") returned 0
	[0133.447] lstrlenA (lpString="*.mpg") returned 5
	[0133.447] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.flv") returned 0
	[0133.447] lstrlenA (lpString="*.flv") returned 5
	[0133.447] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.avi") returned 0
	[0133.447] lstrlenA (lpString="*.avi") returned 5
	[0133.447] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.mp4") returned 0
	[0133.447] lstrlenA (lpString="*.mp4") returned 5
	[0133.447] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.wmv") returned 0
	[0133.447] lstrlenA (lpString="*.wmv") returned 5
	[0133.447] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.mkv") returned 0
	[0133.447] lstrlenA (lpString="*.mkv") returned 5
	[0133.447] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.mp3") returned 0
	[0133.448] lstrlenA (lpString="*.mp3") returned 5
	[0133.448] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.wav") returned 0
	[0133.448] lstrlenA (lpString="*.wav") returned 5
	[0133.448] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.flac") returned 0
	[0133.448] lstrlenA (lpString="*.flac") returned 6
	[0133.448] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.wma") returned 0
	[0133.448] lstrlenA (lpString="*.wma") returned 5
	[0133.448] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.au3") returned 0
	[0133.448] lstrlenA (lpString="*.au3") returned 5
	[0133.448] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.ahk") returned 0
	[0133.448] lstrlenA (lpString="*.ahk") returned 5
	[0133.448] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.c") returned 0
	[0133.448] lstrlenA (lpString="*.c") returned 3
	[0133.448] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.cc") returned 0
	[0133.448] lstrlenA (lpString="*.cc") returned 4
	[0133.448] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.cpp") returned 0
	[0133.448] lstrlenA (lpString="*.cpp") returned 5
	[0133.448] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.cxx") returned 0
	[0133.448] lstrlenA (lpString="*.cxx") returned 5
	[0133.448] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.c++") returned 0
	[0133.448] lstrlenA (lpString="*.c++") returned 5
	[0133.448] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.cs") returned 0
	[0133.448] lstrlenA (lpString="*.cs") returned 4
	[0133.448] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.vb") returned 0
	[0133.448] lstrlenA (lpString="*.vb") returned 4
	[0133.448] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.bas") returned 0
	[0133.448] lstrlenA (lpString="*.bas") returned 5
	[0133.448] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.csproj") returned 0
	[0133.448] lstrlenA (lpString="*.csproj") returned 8
	[0133.448] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.vbproj") returned 0
	[0133.448] lstrlenA (lpString="*.vbproj") returned 8
	[0133.448] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.vcxproj") returned 0
	[0133.448] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.448] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.manifest") returned 0
	[0133.449] lstrlenA (lpString="*.manifest") returned 10
	[0133.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.php") returned 0
	[0133.449] lstrlenA (lpString="*.php") returned 5
	[0133.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.vbe") returned 0
	[0133.449] lstrlenA (lpString="*.vbe") returned 5
	[0133.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.vba") returned 0
	[0133.449] lstrlenA (lpString="*.vba") returned 5
	[0133.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.vbs") returned 0
	[0133.449] lstrlenA (lpString="*.vbs") returned 5
	[0133.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.bat") returned 0
	[0133.449] lstrlenA (lpString="*.bat") returned 5
	[0133.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.cmd") returned 0
	[0133.449] lstrlenA (lpString="*.cmd") returned 5
	[0133.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.js") returned 0
	[0133.449] lstrlenA (lpString="*.js") returned 4
	[0133.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.jscript") returned 0
	[0133.449] lstrlenA (lpString="*.jscript") returned 9
	[0133.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.hta") returned 0
	[0133.449] lstrlenA (lpString="*.hta") returned 5
	[0133.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.php7") returned 0
	[0133.449] lstrlenA (lpString="*.php7") returned 6
	[0133.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.db") returned 0
	[0133.449] lstrlenA (lpString="*.db") returned 4
	[0133.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.swf") returned 0
	[0133.449] lstrlenA (lpString="*.swf") returned 5
	[0133.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.eml") returned 0
	[0133.449] lstrlenA (lpString="*.eml") returned 5
	[0133.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.part") returned 0
	[0133.449] lstrlenA (lpString="*.part") returned 6
	[0133.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.nfo") returned 0
	[0133.449] lstrlenA (lpString="*.nfo") returned 5
	[0133.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.rsa") returned 0
	[0133.449] lstrlenA (lpString="*.rsa") returned 5
	[0133.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.key") returned 0
	[0133.450] lstrlenA (lpString="*.key") returned 5
	[0133.450] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.aes") returned 0
	[0133.450] lstrlenA (lpString="*.aes") returned 5
	[0133.450] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.blob") returned 0
	[0133.450] lstrlenA (lpString="*.blob") returned 6
	[0133.450] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.btc") returned 0
	[0133.450] lstrlenA (lpString="*.btc") returned 5
	[0133.450] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", pszSpec="*.wallet") returned 0
	[0133.450] lstrlenA (lpString="*.wallet") returned 8
	[0133.450] FindNextFileA (in: hFindFile=0x7cb7d0, lpFindFileData=0x19ee70 | out: lpFindFileData=0x19ee70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ea7396, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41ea7396, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x971d956, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x7b0000, dwReserved1=0x128, cFileName="818200132aebmoouht.sqlite", cAlternateFileName="818200~1.SQL")) returned 0
	[0133.450] FindClose (in: hFindFile=0x7cb7d0 | out: hFindFile=0x7cb7d0) returned 1
	[0133.450] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19efc0 | out: lpFindFileData=0x19efc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41ea601c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x826703d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xf722f14, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650070, dwReserved1=0x6d0072, cFileName="idb", cAlternateFileName="")) returned 0
	[0133.450] FindClose (in: hFindFile=0x7cb790 | out: hFindFile=0x7cb790) returned 1
	[0133.450] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f110 | out: lpFindFileData=0x19f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41de8bd2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41ea4c3c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41ea601c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="moz-safe-about+home", cAlternateFileName="MOZ-SA~1")) returned 0
	[0133.450] FindClose (in: hFindFile=0x7cbad0 | out: hFindFile=0x7cbad0) returned 1
	[0133.450] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f260 | out: lpFindFileData=0x19f260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c2e4c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x23c2e4c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41de8bd2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="permanent", cAlternateFileName="PERMAN~1")) returned 0
	[0133.450] FindClose (in: hFindFile=0x7cb750 | out: hFindFile=0x7cb750) returned 1
	[0133.450] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f76d02, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x1f76d02, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x22b9f22, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x200, dwReserved0=0x0, dwReserved1=0x0, cFileName="storage.sqlite", cAlternateFileName="STORAG~1.SQL")) returned 1
	[0133.450] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0133.450] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="storage.sqlite") returned -1
	[0133.450] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="storage.sqlite") returned -1
	[0133.450] lstrcmpiA (lpString1="", lpString2="storage.sqlite") returned -1
	[0133.450] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\*.*") returned="*.*"
	[0133.450] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\"
	[0133.451] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned=""
	[0133.451] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.451] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\how-to-decrypt-files.htm")) returned 0x20
	[0133.451] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="storage.sqlite" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite"
	[0133.451] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite", pszSpec="*.zip") returned 0
	[0133.451] lstrlenA (lpString="*.zip") returned 5
	[0133.451] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite", pszSpec="*.rar") returned 0
	[0133.451] lstrlenA (lpString="*.rar") returned 5
	[0133.451] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite", pszSpec="*.7z") returned 0
	[0133.451] lstrlenA (lpString="*.7z") returned 4
	[0133.451] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite", pszSpec="*.tar") returned 0
	[0133.451] lstrlenA (lpString="*.tar") returned 5
	[0133.451] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite", pszSpec="*.gzip") returned 0
	[0133.451] lstrlenA (lpString="*.gzip") returned 6
	[0133.451] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite", pszSpec="*.jpg") returned 0
	[0133.451] lstrlenA (lpString="*.jpg") returned 5
	[0133.451] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite", pszSpec="*.jpeg") returned 0
	[0133.451] lstrlenA (lpString="*.jpeg") returned 6
	[0133.451] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite", pszSpec="*.bmp") returned 0
	[0133.451] lstrlenA (lpString="*.bmp") returned 5
	[0133.451] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite", pszSpec="*.gif") returned 0
	[0133.451] lstrlenA (lpString="*.gif") returned 5
	[0133.451] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite", pszSpec="*.png") returned 0
	[0133.451] lstrlenA (lpString="*.png") returned 5
	[0133.451] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite", pszSpec="*.doc") returned 0
	[0133.451] lstrlenA (lpString="*.doc") returned 5
	[0133.451] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite", pszSpec="*.docx") returned 0
	[0133.451] lstrlenA (lpString="*.docx") returned 6
	[0133.451] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite", pszSpec="*.xls") returned 0
	[0133.451] lstrlenA (lpString="*.xls") returned 5
	[0133.452] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite", pszSpec="*.xlsx") returned 0
	[0133.452] lstrlenA (lpString="*.xlsx") returned 6
	[0133.452] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite", pszSpec="*.ppt") returned 0
	[0133.452] lstrlenA (lpString="*.ppt") returned 5
	[0133.452] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite", pszSpec="*.pptx") returned 0
	[0133.452] lstrlenA (lpString="*.pptx") returned 6
	[0133.452] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite", pszSpec="*.txt") returned 0
	[0133.452] lstrlenA (lpString="*.txt") returned 5
	[0133.452] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite", pszSpec="*.pdf") returned 0
	[0133.452] lstrlenA (lpString="*.pdf") returned 5
	[0133.452] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite", pszSpec="*.htm") returned 0
	[0133.452] lstrlenA (lpString="*.htm") returned 5
	[0133.452] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite", pszSpec="*.html") returned 0
	[0133.452] lstrlenA (lpString="*.html") returned 6
	[0133.452] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite", pszSpec="*.mdb") returned 0
	[0133.452] lstrlenA (lpString="*.mdb") returned 5
	[0133.452] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite", pszSpec="*.pfx") returned 0
	[0133.452] lstrlenA (lpString="*.pfx") returned 5
	[0133.452] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite", pszSpec="*.md") returned 0
	[0133.452] lstrlenA (lpString="*.md") returned 4
	[0133.452] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite", pszSpec="*.lnk") returned 0
	[0133.452] lstrlenA (lpString="*.lnk") returned 5
	[0133.452] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite", pszSpec="*.torrent") returned 0
	[0133.452] lstrlenA (lpString="*.torrent") returned 9
	[0133.452] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite", pszSpec="*.mov") returned 0
	[0133.452] lstrlenA (lpString="*.mov") returned 5
	[0133.452] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite", pszSpec="*.3gp") returned 0
	[0133.452] lstrlenA (lpString="*.3gp") returned 5
	[0133.452] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite", pszSpec="*.mpeg") returned 0
	[0133.452] lstrlenA (lpString="*.mpeg") returned 6
	[0133.452] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite", pszSpec="*.mpg") returned 0
	[0133.452] lstrlenA (lpString="*.mpg") returned 5
	[0133.452] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite", pszSpec="*.flv") returned 0
	[0133.452] lstrlenA (lpString="*.flv") returned 5
	[0133.453] lstrlenA (lpString="*.avi") returned 5
	[0133.453] lstrlenA (lpString="*.mp4") returned 5
	[0133.453] lstrlenA (lpString="*.wmv") returned 5
	[0133.453] lstrlenA (lpString="*.mkv") returned 5
	[0133.453] lstrlenA (lpString="*.mp3") returned 5
	[0133.453] lstrlenA (lpString="*.wav") returned 5
	[0133.453] lstrlenA (lpString="*.flac") returned 6
	[0133.453] lstrlenA (lpString="*.wma") returned 5
	[0133.453] lstrlenA (lpString="*.au3") returned 5
	[0133.453] lstrlenA (lpString="*.ahk") returned 5
	[0133.453] lstrlenA (lpString="*.c") returned 3
	[0133.453] lstrlenA (lpString="*.cc") returned 4
	[0133.453] lstrlenA (lpString="*.cpp") returned 5
	[0133.453] lstrlenA (lpString="*.cxx") returned 5
	[0133.453] lstrlenA (lpString="*.c++") returned 5
	[0133.453] lstrlenA (lpString="*.cs") returned 4
	[0133.453] lstrlenA (lpString="*.vb") returned 4
	[0133.453] lstrlenA (lpString="*.bas") returned 5
	[0133.453] lstrlenA (lpString="*.csproj") returned 8
	[0133.453] lstrlenA (lpString="*.vbproj") returned 8
	[0133.453] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.453] lstrlenA (lpString="*.manifest") returned 10
	[0133.454] lstrlenA (lpString="*.php") returned 5
	[0133.454] lstrlenA (lpString="*.vbe") returned 5
	[0133.454] lstrlenA (lpString="*.vba") returned 5
	[0133.454] lstrlenA (lpString="*.vbs") returned 5
	[0133.454] lstrlenA (lpString="*.bat") returned 5
	[0133.454] lstrlenA (lpString="*.cmd") returned 5
	[0133.454] lstrlenA (lpString="*.js") returned 4
	[0133.454] lstrlenA (lpString="*.jscript") returned 9
	[0133.454] lstrlenA (lpString="*.hta") returned 5
	[0133.454] lstrlenA (lpString="*.php7") returned 6
	[0133.454] lstrlenA (lpString="*.db") returned 4
	[0133.454] lstrlenA (lpString="*.swf") returned 5
	[0133.454] lstrlenA (lpString="*.eml") returned 5
	[0133.454] lstrlenA (lpString="*.part") returned 6
	[0133.454] lstrlenA (lpString="*.nfo") returned 5
	[0133.454] lstrlenA (lpString="*.rsa") returned 5
	[0133.454] lstrlenA (lpString="*.key") returned 5
	[0133.454] lstrlenA (lpString="*.aes") returned 5
	[0133.454] lstrlenA (lpString="*.blob") returned 6
	[0133.454] lstrlenA (lpString="*.btc") returned 5
	[0133.454] lstrlenA (lpString="*.wallet") returned 8
	[0133.454] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x1d, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="times.json", cAlternateFileName="TIMES~1.JSO")) returned 1
	[0133.454] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0133.454] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="times.json") returned -1
	[0133.454] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="times.json") returned -1
	[0133.454] lstrcmpiA (lpString1="", lpString2="times.json") returned -1
	[0133.454] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite") returned="storage.sqlite"
	[0133.454] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\"
	[0133.455] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned=""
	[0133.455] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.455] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\how-to-decrypt-files.htm")) returned 0x20
	[0133.455] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="times.json" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\times.json") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\times.json"
	[0133.455] lstrlenA (lpString="*.zip") returned 5
	[0133.455] lstrlenA (lpString="*.rar") returned 5
	[0133.455] lstrlenA (lpString="*.7z") returned 4
	[0133.455] lstrlenA (lpString="*.tar") returned 5
	[0133.455] lstrlenA (lpString="*.gzip") returned 6
	[0133.455] lstrlenA (lpString="*.jpg") returned 5
	[0133.455] lstrlenA (lpString="*.jpeg") returned 6
	[0133.455] lstrlenA (lpString="*.bmp") returned 5
	[0133.455] lstrlenA (lpString="*.gif") returned 5
	[0133.455] lstrlenA (lpString="*.png") returned 5
	[0133.455] lstrlenA (lpString="*.doc") returned 5
	[0133.455] lstrlenA (lpString="*.docx") returned 6
	[0133.455] lstrlenA (lpString="*.xls") returned 5
	[0133.455] lstrlenA (lpString="*.xlsx") returned 6
	[0133.455] lstrlenA (lpString="*.ppt") returned 5
	[0133.455] lstrlenA (lpString="*.pptx") returned 6
	[0133.455] lstrlenA (lpString="*.txt") returned 5
	[0133.455] lstrlenA (lpString="*.pdf") returned 5
	[0133.455] lstrlenA (lpString="*.htm") returned 5
	[0133.455] lstrlenA (lpString="*.html") returned 6
	[0133.455] lstrlenA (lpString="*.mdb") returned 5
	[0133.455] lstrlenA (lpString="*.pfx") returned 5
	[0133.456] lstrlenA (lpString="*.md") returned 4
	[0133.456] lstrlenA (lpString="*.lnk") returned 5
	[0133.456] lstrlenA (lpString="*.torrent") returned 9
	[0133.456] lstrlenA (lpString="*.mov") returned 5
	[0133.456] lstrlenA (lpString="*.3gp") returned 5
	[0133.456] lstrlenA (lpString="*.mpeg") returned 6
	[0133.456] lstrlenA (lpString="*.mpg") returned 5
	[0133.456] lstrlenA (lpString="*.flv") returned 5
	[0133.456] lstrlenA (lpString="*.avi") returned 5
	[0133.456] lstrlenA (lpString="*.mp4") returned 5
	[0133.456] lstrlenA (lpString="*.wmv") returned 5
	[0133.456] lstrlenA (lpString="*.mkv") returned 5
	[0133.456] lstrlenA (lpString="*.mp3") returned 5
	[0133.456] lstrlenA (lpString="*.wav") returned 5
	[0133.456] lstrlenA (lpString="*.flac") returned 6
	[0133.456] lstrlenA (lpString="*.wma") returned 5
	[0133.456] lstrlenA (lpString="*.au3") returned 5
	[0133.456] lstrlenA (lpString="*.ahk") returned 5
	[0133.456] lstrlenA (lpString="*.c") returned 3
	[0133.456] lstrlenA (lpString="*.cc") returned 4
	[0133.456] lstrlenA (lpString="*.cpp") returned 5
	[0133.456] lstrlenA (lpString="*.cxx") returned 5
	[0133.456] lstrlenA (lpString="*.c++") returned 5
	[0133.456] lstrlenA (lpString="*.cs") returned 4
	[0133.456] lstrlenA (lpString="*.vb") returned 4
	[0133.456] lstrlenA (lpString="*.bas") returned 5
	[0133.456] lstrlenA (lpString="*.csproj") returned 8
	[0133.457] lstrlenA (lpString="*.vbproj") returned 8
	[0133.457] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.457] lstrlenA (lpString="*.manifest") returned 10
	[0133.457] lstrlenA (lpString="*.php") returned 5
	[0133.457] lstrlenA (lpString="*.vbe") returned 5
	[0133.457] lstrlenA (lpString="*.vba") returned 5
	[0133.457] lstrlenA (lpString="*.vbs") returned 5
	[0133.457] lstrlenA (lpString="*.bat") returned 5
	[0133.457] lstrlenA (lpString="*.cmd") returned 5
	[0133.457] lstrlenA (lpString="*.js") returned 4
	[0133.457] lstrlenA (lpString="*.jscript") returned 9
	[0133.457] lstrlenA (lpString="*.hta") returned 5
	[0133.457] lstrlenA (lpString="*.php7") returned 6
	[0133.457] lstrlenA (lpString="*.db") returned 4
	[0133.457] lstrlenA (lpString="*.swf") returned 5
	[0133.457] lstrlenA (lpString="*.eml") returned 5
	[0133.457] lstrlenA (lpString="*.part") returned 6
	[0133.457] lstrlenA (lpString="*.nfo") returned 5
	[0133.457] lstrlenA (lpString="*.rsa") returned 5
	[0133.457] lstrlenA (lpString="*.key") returned 5
	[0133.457] lstrlenA (lpString="*.aes") returned 5
	[0133.457] lstrlenA (lpString="*.blob") returned 6
	[0133.457] lstrlenA (lpString="*.btc") returned 5
	[0133.457] lstrlenA (lpString="*.wallet") returned 8
	[0133.457] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bd1119, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x2bd1119, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xb8239875, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="webappsstore.sqlite", cAlternateFileName="WEBAPP~1.SQL")) returned 1
	[0133.457] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0133.457] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="webappsstore.sqlite") returned -1
	[0133.457] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="webappsstore.sqlite") returned -1
	[0133.458] lstrcmpiA (lpString1="", lpString2="webappsstore.sqlite") returned -1
	[0133.458] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\times.json") returned="times.json"
	[0133.458] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\"
	[0133.458] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned=""
	[0133.458] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.458] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\how-to-decrypt-files.htm")) returned 0x20
	[0133.458] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="webappsstore.sqlite" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\webappsstore.sqlite") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\webappsstore.sqlite"
	[0133.458] lstrlenA (lpString="*.zip") returned 5
	[0133.458] lstrlenA (lpString="*.rar") returned 5
	[0133.458] lstrlenA (lpString="*.7z") returned 4
	[0133.458] lstrlenA (lpString="*.tar") returned 5
	[0133.458] lstrlenA (lpString="*.gzip") returned 6
	[0133.458] lstrlenA (lpString="*.jpg") returned 5
	[0133.458] lstrlenA (lpString="*.jpeg") returned 6
	[0133.458] lstrlenA (lpString="*.bmp") returned 5
	[0133.458] lstrlenA (lpString="*.gif") returned 5
	[0133.458] lstrlenA (lpString="*.png") returned 5
	[0133.458] lstrlenA (lpString="*.doc") returned 5
	[0133.458] lstrlenA (lpString="*.docx") returned 6
	[0133.458] lstrlenA (lpString="*.xls") returned 5
	[0133.458] lstrlenA (lpString="*.xlsx") returned 6
	[0133.458] lstrlenA (lpString="*.ppt") returned 5
	[0133.458] lstrlenA (lpString="*.pptx") returned 6
	[0133.458] lstrlenA (lpString="*.txt") returned 5
	[0133.458] lstrlenA (lpString="*.pdf") returned 5
	[0133.458] lstrlenA (lpString="*.htm") returned 5
	[0133.459] lstrlenA (lpString="*.html") returned 6
	[0133.459] lstrlenA (lpString="*.mdb") returned 5
	[0133.459] lstrlenA (lpString="*.pfx") returned 5
	[0133.459] lstrlenA (lpString="*.md") returned 4
	[0133.459] lstrlenA (lpString="*.lnk") returned 5
	[0133.459] lstrlenA (lpString="*.torrent") returned 9
	[0133.459] lstrlenA (lpString="*.mov") returned 5
	[0133.459] lstrlenA (lpString="*.3gp") returned 5
	[0133.459] lstrlenA (lpString="*.mpeg") returned 6
	[0133.459] lstrlenA (lpString="*.mpg") returned 5
	[0133.459] lstrlenA (lpString="*.flv") returned 5
	[0133.459] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8154a58, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb8154a58, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb8154a58, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15f, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="xulstore.json", cAlternateFileName="XULSTO~1.JSO")) returned 1
	[0133.459] PeekMessageA (in: lpMsg=0x19f38c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f38c) returned 0
	[0133.459] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="xulstore.json") returned -1
	[0133.459] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="xulstore.json") returned -1
	[0133.459] lstrcmpiA (lpString1="", lpString2="xulstore.json") returned -1
	[0133.459] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\webappsstore.sqlite") returned="webappsstore.sqlite"
	[0133.459] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\"
	[0133.459] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned=""
	[0133.459] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.459] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\how-to-decrypt-files.htm")) returned 0x20
	[0133.459] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="xulstore.json" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\xulstore.json") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\xulstore.json"
	[0133.459] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f3b0 | out: lpFindFileData=0x19f3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8154a58, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb8154a58, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb8154a58, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15f, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="xulstore.json", cAlternateFileName="XULSTO~1.JSO")) returned 0
	[0133.459] FindClose (in: hFindFile=0x7cb950 | out: hFindFile=0x7cb950) returned 1
	[0133.460] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb83449e5, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb83449e5, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="w7cr0hor.default", cAlternateFileName="W7CR0H~1.DEF")) returned 0
	[0133.460] FindClose (in: hFindFile=0x7cb850 | out: hFindFile=0x7cb850) returned 1
	[0133.460] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x7a, dwReserved0=0x77bf2eea, dwReserved1=0x9, cFileName="profiles.ini", cAlternateFileName="")) returned 1
	[0133.460] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0133.460] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="profiles.ini") returned -1
	[0133.460] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="profiles.ini") returned -1
	[0133.460] lstrcmpiA (lpString1="", lpString2="profiles.ini") returned -1
	[0133.460] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\*.*") returned="*.*"
	[0133.460] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\"
	[0133.460] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\") returned=""
	[0133.460] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.460] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0133.460] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0133.462] WriteFile (in: hFile=0x218, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0133.463] SetFileTime (hFile=0x218, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0133.463] CloseHandle (hObject=0x218) returned 1
	[0133.463] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="profiles.ini" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini"
	[0133.464] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x7a, dwReserved0=0x77bf2eea, dwReserved1=0x9, cFileName="profiles.ini", cAlternateFileName="")) returned 0
	[0133.464] FindClose (in: hFindFile=0x7cb690 | out: hFindFile=0x7cb690) returned 1
	[0133.464] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Firefox", cAlternateFileName="")) returned 0
	[0133.464] FindClose (in: hFindFile=0x7cb650 | out: hFindFile=0x7cb650) returned 1
	[0133.464] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf534ad0, ftCreationTime.dwHighDateTime=0x1d4c95f, ftLastAccessTime.dwLowDateTime=0x5621ea10, ftLastAccessTime.dwHighDateTime=0x1d4cb37, ftLastWriteTime.dwLowDateTime=0x5621ea10, ftLastWriteTime.dwHighDateTime=0x1d4cb37, nFileSizeHigh=0x0, nFileSizeLow=0x4d22, dwReserved0=0x1c, dwReserved1=0x1, cFileName="Oi5GMN1QpvA2TQWCgZ.m4a", cAlternateFileName="OI5GMN~1.M4A")) returned 1
	[0133.464] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0133.464] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Oi5GMN1QpvA2TQWCgZ.m4a") returned -1
	[0133.464] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Oi5GMN1QpvA2TQWCgZ.m4a") returned -1
	[0133.464] lstrcmpiA (lpString1="", lpString2="Oi5GMN1QpvA2TQWCgZ.m4a") returned -1
	[0133.464] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\*.*") returned="*.*"
	[0133.464] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\"
	[0133.464] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned=""
	[0133.464] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.464] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\how-to-decrypt-files.htm")) returned 0x20
	[0133.464] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Oi5GMN1QpvA2TQWCgZ.m4a" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Oi5GMN1QpvA2TQWCgZ.m4a") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Oi5GMN1QpvA2TQWCgZ.m4a"
	[0133.464] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec159570, ftCreationTime.dwHighDateTime=0x1d4cf39, ftLastAccessTime.dwLowDateTime=0xe2aa5fd0, ftLastAccessTime.dwHighDateTime=0x1d4c812, ftLastWriteTime.dwLowDateTime=0xe2aa5fd0, ftLastWriteTime.dwHighDateTime=0x1d4c812, nFileSizeHigh=0x0, nFileSizeLow=0x188fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="OIm3hzhAajZucOojXs.odt", cAlternateFileName="OIM3HZ~1.ODT")) returned 1
	[0133.464] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0133.464] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="OIm3hzhAajZucOojXs.odt") returned -1
	[0133.464] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="OIm3hzhAajZucOojXs.odt") returned -1
	[0133.464] lstrcmpiA (lpString1="", lpString2="OIm3hzhAajZucOojXs.odt") returned -1
	[0133.464] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Oi5GMN1QpvA2TQWCgZ.m4a") returned="Oi5GMN1QpvA2TQWCgZ.m4a"
	[0133.464] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\"
	[0133.464] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned=""
	[0133.464] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.465] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\how-to-decrypt-files.htm")) returned 0x20
	[0133.465] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="OIm3hzhAajZucOojXs.odt" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\OIm3hzhAajZucOojXs.odt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\OIm3hzhAajZucOojXs.odt"
	[0133.465] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcc4f390, ftCreationTime.dwHighDateTime=0x1d4c631, ftLastAccessTime.dwLowDateTime=0x4c7eb2f0, ftLastAccessTime.dwHighDateTime=0x1d4d4c3, ftLastWriteTime.dwLowDateTime=0x4c7eb2f0, ftLastWriteTime.dwHighDateTime=0x1d4d4c3, nFileSizeHigh=0x0, nFileSizeLow=0x5ec7, dwReserved0=0x0, dwReserved1=0x0, cFileName="OV9RpW8ry.png", cAlternateFileName="OV9RPW~1.PNG")) returned 1
	[0133.465] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0133.465] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="OV9RpW8ry.png") returned -1
	[0133.465] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="OV9RpW8ry.png") returned -1
	[0133.465] lstrcmpiA (lpString1="", lpString2="OV9RpW8ry.png") returned -1
	[0133.465] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\OIm3hzhAajZucOojXs.odt") returned="OIm3hzhAajZucOojXs.odt"
	[0133.465] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\"
	[0133.465] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned=""
	[0133.465] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.465] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\how-to-decrypt-files.htm")) returned 0x20
	[0133.465] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="OV9RpW8ry.png" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\OV9RpW8ry.png") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\OV9RpW8ry.png"
	[0133.465] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\OV9RpW8ry.png" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\OV9RpW8ry.png") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\OV9RpW8ry.png"
	[0133.465] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\OV9RpW8ry.png" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\OV9RpW8ry.png") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\OV9RpW8ry.png"
	[0133.465] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\OV9RpW8ry.png", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\OV9RpW8ry.png.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\OV9RpW8ry.png."
	[0133.465] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\OV9RpW8ry.png.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\OV9RpW8ry.png.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\OV9RpW8ry.png.exe"
	[0133.465] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\OV9RpW8ry.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ov9rpw8ry.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0133.466] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5ec7
	[0133.466] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xfcc4f390, dwHighDateTime=0x1d4c631), lpLastAccessTime=0x407536*(dwLowDateTime=0x4c7eb2f0, dwHighDateTime=0x1d4d4c3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4c7eb2f0, dwHighDateTime=0x1d4d4c3)) returned 1
	[0133.466] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.466] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x5e85, lpOverlapped=0x0) returned 1
	[0133.467] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\OV9RpW8ry.png") returned="OV9RpW8ry.png"
	[0133.467] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.467] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x5e85, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x5e85, lpOverlapped=0x0) returned 1
	[0133.467] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.467] CloseHandle (hObject=0x210) returned 1
	[0133.467] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\OV9RpW8ry.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ov9rpw8ry.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\OV9RpW8ry.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ov9rpw8ry.png.exe")) returned 1
	[0133.468] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbebe7380, ftCreationTime.dwHighDateTime=0x1d4c75f, ftLastAccessTime.dwLowDateTime=0xb2b0f200, ftLastAccessTime.dwHighDateTime=0x1d4cd9c, ftLastWriteTime.dwLowDateTime=0xb2b0f200, ftLastWriteTime.dwHighDateTime=0x1d4cd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10652, dwReserved0=0x0, dwReserved1=0x1, cFileName="oZ4625.swf", cAlternateFileName="")) returned 1
	[0133.468] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0133.468] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="oZ4625.swf") returned -1
	[0133.468] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="oZ4625.swf") returned -1
	[0133.468] lstrcmpiA (lpString1="", lpString2="oZ4625.swf") returned -1
	[0133.468] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\OV9RpW8ry.png") returned="OV9RpW8ry.png"
	[0133.468] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\"
	[0133.468] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned=""
	[0133.468] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.468] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\how-to-decrypt-files.htm")) returned 0x20
	[0133.468] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="oZ4625.swf" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf"
	[0133.468] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.zip") returned 0
	[0133.468] lstrlenA (lpString="*.zip") returned 5
	[0133.468] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.rar") returned 0
	[0133.468] lstrlenA (lpString="*.rar") returned 5
	[0133.468] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.7z") returned 0
	[0133.468] lstrlenA (lpString="*.7z") returned 4
	[0133.468] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.tar") returned 0
	[0133.469] lstrlenA (lpString="*.tar") returned 5
	[0133.469] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.gzip") returned 0
	[0133.469] lstrlenA (lpString="*.gzip") returned 6
	[0133.469] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.jpg") returned 0
	[0133.469] lstrlenA (lpString="*.jpg") returned 5
	[0133.469] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.jpeg") returned 0
	[0133.469] lstrlenA (lpString="*.jpeg") returned 6
	[0133.469] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.bmp") returned 0
	[0133.469] lstrlenA (lpString="*.bmp") returned 5
	[0133.469] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.gif") returned 0
	[0133.469] lstrlenA (lpString="*.gif") returned 5
	[0133.469] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.png") returned 0
	[0133.469] lstrlenA (lpString="*.png") returned 5
	[0133.469] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.doc") returned 0
	[0133.469] lstrlenA (lpString="*.doc") returned 5
	[0133.469] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.docx") returned 0
	[0133.469] lstrlenA (lpString="*.docx") returned 6
	[0133.469] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.xls") returned 0
	[0133.469] lstrlenA (lpString="*.xls") returned 5
	[0133.469] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.xlsx") returned 0
	[0133.469] lstrlenA (lpString="*.xlsx") returned 6
	[0133.469] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.ppt") returned 0
	[0133.469] lstrlenA (lpString="*.ppt") returned 5
	[0133.469] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.pptx") returned 0
	[0133.469] lstrlenA (lpString="*.pptx") returned 6
	[0133.469] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.txt") returned 0
	[0133.469] lstrlenA (lpString="*.txt") returned 5
	[0133.469] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.pdf") returned 0
	[0133.469] lstrlenA (lpString="*.pdf") returned 5
	[0133.469] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.htm") returned 0
	[0133.469] lstrlenA (lpString="*.htm") returned 5
	[0133.469] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.html") returned 0
	[0133.469] lstrlenA (lpString="*.html") returned 6
	[0133.469] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.mdb") returned 0
	[0133.470] lstrlenA (lpString="*.mdb") returned 5
	[0133.470] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.pfx") returned 0
	[0133.470] lstrlenA (lpString="*.pfx") returned 5
	[0133.470] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.md") returned 0
	[0133.470] lstrlenA (lpString="*.md") returned 4
	[0133.470] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.lnk") returned 0
	[0133.470] lstrlenA (lpString="*.lnk") returned 5
	[0133.470] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.torrent") returned 0
	[0133.470] lstrlenA (lpString="*.torrent") returned 9
	[0133.470] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.mov") returned 0
	[0133.470] lstrlenA (lpString="*.mov") returned 5
	[0133.470] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.3gp") returned 0
	[0133.470] lstrlenA (lpString="*.3gp") returned 5
	[0133.470] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.mpeg") returned 0
	[0133.470] lstrlenA (lpString="*.mpeg") returned 6
	[0133.470] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.mpg") returned 0
	[0133.470] lstrlenA (lpString="*.mpg") returned 5
	[0133.470] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.flv") returned 0
	[0133.470] lstrlenA (lpString="*.flv") returned 5
	[0133.470] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.avi") returned 0
	[0133.470] lstrlenA (lpString="*.avi") returned 5
	[0133.470] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.mp4") returned 0
	[0133.470] lstrlenA (lpString="*.mp4") returned 5
	[0133.470] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.wmv") returned 0
	[0133.470] lstrlenA (lpString="*.wmv") returned 5
	[0133.470] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.mkv") returned 0
	[0133.470] lstrlenA (lpString="*.mkv") returned 5
	[0133.470] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.mp3") returned 0
	[0133.470] lstrlenA (lpString="*.mp3") returned 5
	[0133.470] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.wav") returned 0
	[0133.470] lstrlenA (lpString="*.wav") returned 5
	[0133.470] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.flac") returned 0
	[0133.470] lstrlenA (lpString="*.flac") returned 6
	[0133.471] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.wma") returned 0
	[0133.471] lstrlenA (lpString="*.wma") returned 5
	[0133.471] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.au3") returned 0
	[0133.471] lstrlenA (lpString="*.au3") returned 5
	[0133.471] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.ahk") returned 0
	[0133.471] lstrlenA (lpString="*.ahk") returned 5
	[0133.471] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.c") returned 0
	[0133.471] lstrlenA (lpString="*.c") returned 3
	[0133.471] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.cc") returned 0
	[0133.471] lstrlenA (lpString="*.cc") returned 4
	[0133.471] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.cpp") returned 0
	[0133.471] lstrlenA (lpString="*.cpp") returned 5
	[0133.471] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.cxx") returned 0
	[0133.471] lstrlenA (lpString="*.cxx") returned 5
	[0133.471] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.c++") returned 0
	[0133.471] lstrlenA (lpString="*.c++") returned 5
	[0133.471] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.cs") returned 0
	[0133.471] lstrlenA (lpString="*.cs") returned 4
	[0133.471] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.vb") returned 0
	[0133.471] lstrlenA (lpString="*.vb") returned 4
	[0133.471] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.bas") returned 0
	[0133.471] lstrlenA (lpString="*.bas") returned 5
	[0133.471] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.csproj") returned 0
	[0133.471] lstrlenA (lpString="*.csproj") returned 8
	[0133.471] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.vbproj") returned 0
	[0133.471] lstrlenA (lpString="*.vbproj") returned 8
	[0133.471] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.vcxproj") returned 0
	[0133.471] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.471] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.manifest") returned 0
	[0133.471] lstrlenA (lpString="*.manifest") returned 10
	[0133.471] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.php") returned 0
	[0133.471] lstrlenA (lpString="*.php") returned 5
	[0133.471] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.vbe") returned 0
	[0133.471] lstrlenA (lpString="*.vbe") returned 5
	[0133.471] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.vba") returned 0
	[0133.472] lstrlenA (lpString="*.vba") returned 5
	[0133.472] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.vbs") returned 0
	[0133.472] lstrlenA (lpString="*.vbs") returned 5
	[0133.472] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.bat") returned 0
	[0133.472] lstrlenA (lpString="*.bat") returned 5
	[0133.472] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.cmd") returned 0
	[0133.472] lstrlenA (lpString="*.cmd") returned 5
	[0133.472] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.js") returned 0
	[0133.472] lstrlenA (lpString="*.js") returned 4
	[0133.472] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.jscript") returned 0
	[0133.472] lstrlenA (lpString="*.jscript") returned 9
	[0133.472] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.hta") returned 0
	[0133.472] lstrlenA (lpString="*.hta") returned 5
	[0133.472] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.php7") returned 0
	[0133.472] lstrlenA (lpString="*.php7") returned 6
	[0133.472] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.db") returned 0
	[0133.472] lstrlenA (lpString="*.db") returned 4
	[0133.472] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", pszSpec="*.swf") returned 1
	[0133.472] lstrlenA (lpString="*.swf") returned 5
	[0133.472] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf"
	[0133.472] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf"
	[0133.472] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf."
	[0133.472] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf.exe"
	[0133.472] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\oz4625.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0133.473] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10652
	[0133.473] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xbebe7380, dwHighDateTime=0x1d4c75f), lpLastAccessTime=0x407536*(dwLowDateTime=0xb2b0f200, dwHighDateTime=0x1d4cd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb2b0f200, dwHighDateTime=0x1d4cd9c)) returned 1
	[0133.473] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.473] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x10610, lpOverlapped=0x0) returned 1
	[0133.474] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf") returned="oZ4625.swf"
	[0133.474] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.474] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x10610, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x10610, lpOverlapped=0x0) returned 1
	[0133.474] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.474] CloseHandle (hObject=0x210) returned 1
	[0133.475] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\oz4625.swf"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\oz4625.swf.exe")) returned 1
	[0133.475] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa74cced0, ftCreationTime.dwHighDateTime=0x1d4c602, ftLastAccessTime.dwLowDateTime=0x54164ef0, ftLastAccessTime.dwHighDateTime=0x1d4d474, ftLastWriteTime.dwLowDateTime=0x54164ef0, ftLastWriteTime.dwHighDateTime=0x1d4d474, nFileSizeHigh=0x0, nFileSizeLow=0x9a11, dwReserved0=0x15, dwReserved1=0x1, cFileName="pOAF aUjf78X.odt", cAlternateFileName="POAFAU~1.ODT")) returned 1
	[0133.475] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0133.475] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="pOAF aUjf78X.odt") returned -1
	[0133.475] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="pOAF aUjf78X.odt") returned -1
	[0133.475] lstrcmpiA (lpString1="", lpString2="pOAF aUjf78X.odt") returned -1
	[0133.475] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\oZ4625.swf") returned="oZ4625.swf"
	[0133.475] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\"
	[0133.475] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned=""
	[0133.475] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.475] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\how-to-decrypt-files.htm")) returned 0x20
	[0133.476] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="pOAF aUjf78X.odt" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt"
	[0133.476] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.zip") returned 0
	[0133.476] lstrlenA (lpString="*.zip") returned 5
	[0133.476] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.rar") returned 0
	[0133.476] lstrlenA (lpString="*.rar") returned 5
	[0133.476] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.7z") returned 0
	[0133.476] lstrlenA (lpString="*.7z") returned 4
	[0133.476] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.tar") returned 0
	[0133.476] lstrlenA (lpString="*.tar") returned 5
	[0133.476] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.gzip") returned 0
	[0133.476] lstrlenA (lpString="*.gzip") returned 6
	[0133.476] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.jpg") returned 0
	[0133.476] lstrlenA (lpString="*.jpg") returned 5
	[0133.476] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.jpeg") returned 0
	[0133.476] lstrlenA (lpString="*.jpeg") returned 6
	[0133.476] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.bmp") returned 0
	[0133.476] lstrlenA (lpString="*.bmp") returned 5
	[0133.476] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.gif") returned 0
	[0133.476] lstrlenA (lpString="*.gif") returned 5
	[0133.476] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.png") returned 0
	[0133.476] lstrlenA (lpString="*.png") returned 5
	[0133.483] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.doc") returned 0
	[0133.483] lstrlenA (lpString="*.doc") returned 5
	[0133.483] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.docx") returned 0
	[0133.483] lstrlenA (lpString="*.docx") returned 6
	[0133.483] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.xls") returned 0
	[0133.483] lstrlenA (lpString="*.xls") returned 5
	[0133.483] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.xlsx") returned 0
	[0133.483] lstrlenA (lpString="*.xlsx") returned 6
	[0133.483] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.ppt") returned 0
	[0133.483] lstrlenA (lpString="*.ppt") returned 5
	[0133.483] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.pptx") returned 0
	[0133.483] lstrlenA (lpString="*.pptx") returned 6
	[0133.483] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.txt") returned 0
	[0133.483] lstrlenA (lpString="*.txt") returned 5
	[0133.483] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.pdf") returned 0
	[0133.483] lstrlenA (lpString="*.pdf") returned 5
	[0133.483] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.htm") returned 0
	[0133.483] lstrlenA (lpString="*.htm") returned 5
	[0133.483] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.html") returned 0
	[0133.483] lstrlenA (lpString="*.html") returned 6
	[0133.483] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.mdb") returned 0
	[0133.483] lstrlenA (lpString="*.mdb") returned 5
	[0133.483] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.pfx") returned 0
	[0133.483] lstrlenA (lpString="*.pfx") returned 5
	[0133.483] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.md") returned 0
	[0133.483] lstrlenA (lpString="*.md") returned 4
	[0133.483] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.lnk") returned 0
	[0133.483] lstrlenA (lpString="*.lnk") returned 5
	[0133.483] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.torrent") returned 0
	[0133.483] lstrlenA (lpString="*.torrent") returned 9
	[0133.483] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.mov") returned 0
	[0133.483] lstrlenA (lpString="*.mov") returned 5
	[0133.484] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.3gp") returned 0
	[0133.484] lstrlenA (lpString="*.3gp") returned 5
	[0133.484] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.mpeg") returned 0
	[0133.484] lstrlenA (lpString="*.mpeg") returned 6
	[0133.484] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.mpg") returned 0
	[0133.484] lstrlenA (lpString="*.mpg") returned 5
	[0133.484] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.flv") returned 0
	[0133.484] lstrlenA (lpString="*.flv") returned 5
	[0133.484] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.avi") returned 0
	[0133.484] lstrlenA (lpString="*.avi") returned 5
	[0133.484] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.mp4") returned 0
	[0133.484] lstrlenA (lpString="*.mp4") returned 5
	[0133.484] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.wmv") returned 0
	[0133.484] lstrlenA (lpString="*.wmv") returned 5
	[0133.484] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.mkv") returned 0
	[0133.484] lstrlenA (lpString="*.mkv") returned 5
	[0133.484] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.mp3") returned 0
	[0133.484] lstrlenA (lpString="*.mp3") returned 5
	[0133.484] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.wav") returned 0
	[0133.484] lstrlenA (lpString="*.wav") returned 5
	[0133.484] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.flac") returned 0
	[0133.484] lstrlenA (lpString="*.flac") returned 6
	[0133.484] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.wma") returned 0
	[0133.484] lstrlenA (lpString="*.wma") returned 5
	[0133.484] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.au3") returned 0
	[0133.484] lstrlenA (lpString="*.au3") returned 5
	[0133.484] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.ahk") returned 0
	[0133.484] lstrlenA (lpString="*.ahk") returned 5
	[0133.484] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.c") returned 0
	[0133.484] lstrlenA (lpString="*.c") returned 3
	[0133.484] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.cc") returned 0
	[0133.484] lstrlenA (lpString="*.cc") returned 4
	[0133.484] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.cpp") returned 0
	[0133.484] lstrlenA (lpString="*.cpp") returned 5
	[0133.484] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.cxx") returned 0
	[0133.485] lstrlenA (lpString="*.cxx") returned 5
	[0133.485] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.c++") returned 0
	[0133.485] lstrlenA (lpString="*.c++") returned 5
	[0133.485] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.cs") returned 0
	[0133.485] lstrlenA (lpString="*.cs") returned 4
	[0133.485] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.vb") returned 0
	[0133.485] lstrlenA (lpString="*.vb") returned 4
	[0133.485] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.bas") returned 0
	[0133.485] lstrlenA (lpString="*.bas") returned 5
	[0133.485] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.csproj") returned 0
	[0133.485] lstrlenA (lpString="*.csproj") returned 8
	[0133.485] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.vbproj") returned 0
	[0133.485] lstrlenA (lpString="*.vbproj") returned 8
	[0133.485] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.vcxproj") returned 0
	[0133.485] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.485] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.manifest") returned 0
	[0133.485] lstrlenA (lpString="*.manifest") returned 10
	[0133.485] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.php") returned 0
	[0133.485] lstrlenA (lpString="*.php") returned 5
	[0133.485] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.vbe") returned 0
	[0133.485] lstrlenA (lpString="*.vbe") returned 5
	[0133.485] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.vba") returned 0
	[0133.485] lstrlenA (lpString="*.vba") returned 5
	[0133.485] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.vbs") returned 0
	[0133.485] lstrlenA (lpString="*.vbs") returned 5
	[0133.485] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.bat") returned 0
	[0133.485] lstrlenA (lpString="*.bat") returned 5
	[0133.485] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.cmd") returned 0
	[0133.485] lstrlenA (lpString="*.cmd") returned 5
	[0133.485] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.js") returned 0
	[0133.485] lstrlenA (lpString="*.js") returned 4
	[0133.485] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.jscript") returned 0
	[0133.485] lstrlenA (lpString="*.jscript") returned 9
	[0133.485] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.hta") returned 0
	[0133.485] lstrlenA (lpString="*.hta") returned 5
	[0133.486] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.php7") returned 0
	[0133.486] lstrlenA (lpString="*.php7") returned 6
	[0133.486] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.db") returned 0
	[0133.486] lstrlenA (lpString="*.db") returned 4
	[0133.486] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.swf") returned 0
	[0133.486] lstrlenA (lpString="*.swf") returned 5
	[0133.486] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.eml") returned 0
	[0133.486] lstrlenA (lpString="*.eml") returned 5
	[0133.486] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.part") returned 0
	[0133.486] lstrlenA (lpString="*.part") returned 6
	[0133.486] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.nfo") returned 0
	[0133.486] lstrlenA (lpString="*.nfo") returned 5
	[0133.486] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.rsa") returned 0
	[0133.486] lstrlenA (lpString="*.rsa") returned 5
	[0133.486] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.key") returned 0
	[0133.486] lstrlenA (lpString="*.key") returned 5
	[0133.486] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.aes") returned 0
	[0133.486] lstrlenA (lpString="*.aes") returned 5
	[0133.486] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.blob") returned 0
	[0133.486] lstrlenA (lpString="*.blob") returned 6
	[0133.486] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.btc") returned 0
	[0133.486] lstrlenA (lpString="*.btc") returned 5
	[0133.486] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt", pszSpec="*.wallet") returned 0
	[0133.486] lstrlenA (lpString="*.wallet") returned 8
	[0133.486] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae840410, ftCreationTime.dwHighDateTime=0x1d4c860, ftLastAccessTime.dwLowDateTime=0xa9faca90, ftLastAccessTime.dwHighDateTime=0x1d4c9a1, ftLastWriteTime.dwLowDateTime=0xa9faca90, ftLastWriteTime.dwHighDateTime=0x1d4c9a1, nFileSizeHigh=0x0, nFileSizeLow=0xc2cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="rEUxuVQBw-mt.mp3", cAlternateFileName="REUXUV~1.MP3")) returned 1
	[0133.486] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0133.486] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="rEUxuVQBw-mt.mp3") returned -1
	[0133.486] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="rEUxuVQBw-mt.mp3") returned -1
	[0133.486] lstrcmpiA (lpString1="", lpString2="rEUxuVQBw-mt.mp3") returned -1
	[0133.486] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\pOAF aUjf78X.odt") returned="pOAF aUjf78X.odt"
	[0133.486] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\"
	[0133.486] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned=""
	[0133.486] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.487] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\how-to-decrypt-files.htm")) returned 0x20
	[0133.487] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="rEUxuVQBw-mt.mp3" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3"
	[0133.487] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3", pszSpec="*.zip") returned 0
	[0133.487] lstrlenA (lpString="*.zip") returned 5
	[0133.487] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3", pszSpec="*.rar") returned 0
	[0133.487] lstrlenA (lpString="*.rar") returned 5
	[0133.487] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3", pszSpec="*.7z") returned 0
	[0133.487] lstrlenA (lpString="*.7z") returned 4
	[0133.487] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3", pszSpec="*.tar") returned 0
	[0133.487] lstrlenA (lpString="*.tar") returned 5
	[0133.487] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3", pszSpec="*.gzip") returned 0
	[0133.487] lstrlenA (lpString="*.gzip") returned 6
	[0133.487] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3", pszSpec="*.jpg") returned 0
	[0133.487] lstrlenA (lpString="*.jpg") returned 5
	[0133.487] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3", pszSpec="*.jpeg") returned 0
	[0133.487] lstrlenA (lpString="*.jpeg") returned 6
	[0133.487] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3", pszSpec="*.bmp") returned 0
	[0133.487] lstrlenA (lpString="*.bmp") returned 5
	[0133.487] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3", pszSpec="*.gif") returned 0
	[0133.487] lstrlenA (lpString="*.gif") returned 5
	[0133.487] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3", pszSpec="*.png") returned 0
	[0133.487] lstrlenA (lpString="*.png") returned 5
	[0133.487] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3", pszSpec="*.doc") returned 0
	[0133.487] lstrlenA (lpString="*.doc") returned 5
	[0133.487] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3", pszSpec="*.docx") returned 0
	[0133.487] lstrlenA (lpString="*.docx") returned 6
	[0133.487] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3", pszSpec="*.xls") returned 0
	[0133.487] lstrlenA (lpString="*.xls") returned 5
	[0133.487] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3", pszSpec="*.xlsx") returned 0
	[0133.487] lstrlenA (lpString="*.xlsx") returned 6
	[0133.487] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3", pszSpec="*.ppt") returned 0
	[0133.487] lstrlenA (lpString="*.ppt") returned 5
	[0133.488] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3", pszSpec="*.pptx") returned 0
	[0133.488] lstrlenA (lpString="*.pptx") returned 6
	[0133.488] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3", pszSpec="*.txt") returned 0
	[0133.488] lstrlenA (lpString="*.txt") returned 5
	[0133.488] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3", pszSpec="*.pdf") returned 0
	[0133.488] lstrlenA (lpString="*.pdf") returned 5
	[0133.488] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3", pszSpec="*.htm") returned 0
	[0133.488] lstrlenA (lpString="*.htm") returned 5
	[0133.488] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3", pszSpec="*.html") returned 0
	[0133.488] lstrlenA (lpString="*.html") returned 6
	[0133.488] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3", pszSpec="*.mdb") returned 0
	[0133.488] lstrlenA (lpString="*.mdb") returned 5
	[0133.488] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3", pszSpec="*.pfx") returned 0
	[0133.488] lstrlenA (lpString="*.pfx") returned 5
	[0133.488] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3", pszSpec="*.md") returned 0
	[0133.488] lstrlenA (lpString="*.md") returned 4
	[0133.488] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3", pszSpec="*.lnk") returned 0
	[0133.488] lstrlenA (lpString="*.lnk") returned 5
	[0133.488] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3", pszSpec="*.torrent") returned 0
	[0133.488] lstrlenA (lpString="*.torrent") returned 9
	[0133.488] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3", pszSpec="*.mov") returned 0
	[0133.488] lstrlenA (lpString="*.mov") returned 5
	[0133.488] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3", pszSpec="*.3gp") returned 0
	[0133.488] lstrlenA (lpString="*.3gp") returned 5
	[0133.488] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3", pszSpec="*.mpeg") returned 0
	[0133.488] lstrlenA (lpString="*.mpeg") returned 6
	[0133.488] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3", pszSpec="*.mpg") returned 0
	[0133.488] lstrlenA (lpString="*.mpg") returned 5
	[0133.488] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3", pszSpec="*.flv") returned 0
	[0133.488] lstrlenA (lpString="*.flv") returned 5
	[0133.488] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3", pszSpec="*.avi") returned 0
	[0133.488] lstrlenA (lpString="*.avi") returned 5
	[0133.488] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3", pszSpec="*.mp4") returned 0
	[0133.488] lstrlenA (lpString="*.mp4") returned 5
	[0133.488] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3", pszSpec="*.wmv") returned 0
	[0133.489] lstrlenA (lpString="*.wmv") returned 5
	[0133.489] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3", pszSpec="*.mkv") returned 0
	[0133.489] lstrlenA (lpString="*.mkv") returned 5
	[0133.489] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3", pszSpec="*.mp3") returned 1
	[0133.489] lstrlenA (lpString="*.mp3") returned 5
	[0133.489] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3"
	[0133.489] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3"
	[0133.489] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3."
	[0133.489] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3.exe"
	[0133.489] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\reuxuvqbw-mt.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0133.489] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc2cb
	[0133.489] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xae840410, dwHighDateTime=0x1d4c860), lpLastAccessTime=0x407536*(dwLowDateTime=0xa9faca90, dwHighDateTime=0x1d4c9a1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa9faca90, dwHighDateTime=0x1d4c9a1)) returned 1
	[0133.489] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.489] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xc289, lpOverlapped=0x0) returned 1
	[0133.490] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3") returned="rEUxuVQBw-mt.mp3"
	[0133.491] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.491] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xc289, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xc289, lpOverlapped=0x0) returned 1
	[0133.491] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.491] CloseHandle (hObject=0x210) returned 1
	[0133.491] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\reuxuvqbw-mt.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\reuxuvqbw-mt.mp3.exe")) returned 1
	[0133.492] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0e94a40, ftCreationTime.dwHighDateTime=0x1d4cadd, ftLastAccessTime.dwLowDateTime=0x6a4411a0, ftLastAccessTime.dwHighDateTime=0x1d4ccc0, ftLastWriteTime.dwLowDateTime=0x6a4411a0, ftLastWriteTime.dwHighDateTime=0x1d4ccc0, nFileSizeHigh=0x0, nFileSizeLow=0xc3c6, dwReserved0=0x0, dwReserved1=0x1, cFileName="rWn3ah.mkv", cAlternateFileName="")) returned 1
	[0133.492] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0133.492] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="rWn3ah.mkv") returned -1
	[0133.492] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="rWn3ah.mkv") returned -1
	[0133.492] lstrcmpiA (lpString1="", lpString2="rWn3ah.mkv") returned -1
	[0133.492] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\rEUxuVQBw-mt.mp3") returned="rEUxuVQBw-mt.mp3"
	[0133.492] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\"
	[0133.492] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned=""
	[0133.492] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.492] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\how-to-decrypt-files.htm")) returned 0x20
	[0133.492] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="rWn3ah.mkv" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv"
	[0133.492] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv", pszSpec="*.zip") returned 0
	[0133.492] lstrlenA (lpString="*.zip") returned 5
	[0133.492] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv", pszSpec="*.rar") returned 0
	[0133.492] lstrlenA (lpString="*.rar") returned 5
	[0133.492] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv", pszSpec="*.7z") returned 0
	[0133.493] lstrlenA (lpString="*.7z") returned 4
	[0133.493] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv", pszSpec="*.tar") returned 0
	[0133.493] lstrlenA (lpString="*.tar") returned 5
	[0133.493] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv", pszSpec="*.gzip") returned 0
	[0133.493] lstrlenA (lpString="*.gzip") returned 6
	[0133.493] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv", pszSpec="*.jpg") returned 0
	[0133.493] lstrlenA (lpString="*.jpg") returned 5
	[0133.493] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv", pszSpec="*.jpeg") returned 0
	[0133.493] lstrlenA (lpString="*.jpeg") returned 6
	[0133.493] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv", pszSpec="*.bmp") returned 0
	[0133.493] lstrlenA (lpString="*.bmp") returned 5
	[0133.493] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv", pszSpec="*.gif") returned 0
	[0133.493] lstrlenA (lpString="*.gif") returned 5
	[0133.493] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv", pszSpec="*.png") returned 0
	[0133.493] lstrlenA (lpString="*.png") returned 5
	[0133.493] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv", pszSpec="*.doc") returned 0
	[0133.493] lstrlenA (lpString="*.doc") returned 5
	[0133.493] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv", pszSpec="*.docx") returned 0
	[0133.493] lstrlenA (lpString="*.docx") returned 6
	[0133.493] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv", pszSpec="*.xls") returned 0
	[0133.493] lstrlenA (lpString="*.xls") returned 5
	[0133.493] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv", pszSpec="*.xlsx") returned 0
	[0133.493] lstrlenA (lpString="*.xlsx") returned 6
	[0133.493] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv", pszSpec="*.ppt") returned 0
	[0133.493] lstrlenA (lpString="*.ppt") returned 5
	[0133.493] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv", pszSpec="*.pptx") returned 0
	[0133.493] lstrlenA (lpString="*.pptx") returned 6
	[0133.493] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv", pszSpec="*.txt") returned 0
	[0133.493] lstrlenA (lpString="*.txt") returned 5
	[0133.493] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv", pszSpec="*.pdf") returned 0
	[0133.493] lstrlenA (lpString="*.pdf") returned 5
	[0133.493] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv", pszSpec="*.htm") returned 0
	[0133.493] lstrlenA (lpString="*.htm") returned 5
	[0133.493] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv", pszSpec="*.html") returned 0
	[0133.493] lstrlenA (lpString="*.html") returned 6
	[0133.494] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv", pszSpec="*.mdb") returned 0
	[0133.494] lstrlenA (lpString="*.mdb") returned 5
	[0133.494] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv", pszSpec="*.pfx") returned 0
	[0133.494] lstrlenA (lpString="*.pfx") returned 5
	[0133.494] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv", pszSpec="*.md") returned 0
	[0133.494] lstrlenA (lpString="*.md") returned 4
	[0133.494] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv", pszSpec="*.lnk") returned 0
	[0133.494] lstrlenA (lpString="*.lnk") returned 5
	[0133.494] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv", pszSpec="*.torrent") returned 0
	[0133.494] lstrlenA (lpString="*.torrent") returned 9
	[0133.494] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv", pszSpec="*.mov") returned 0
	[0133.494] lstrlenA (lpString="*.mov") returned 5
	[0133.494] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv", pszSpec="*.3gp") returned 0
	[0133.494] lstrlenA (lpString="*.3gp") returned 5
	[0133.494] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv", pszSpec="*.mpeg") returned 0
	[0133.494] lstrlenA (lpString="*.mpeg") returned 6
	[0133.494] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv", pszSpec="*.mpg") returned 0
	[0133.494] lstrlenA (lpString="*.mpg") returned 5
	[0133.494] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv", pszSpec="*.flv") returned 0
	[0133.494] lstrlenA (lpString="*.flv") returned 5
	[0133.494] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv", pszSpec="*.avi") returned 0
	[0133.494] lstrlenA (lpString="*.avi") returned 5
	[0133.494] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv", pszSpec="*.mp4") returned 0
	[0133.494] lstrlenA (lpString="*.mp4") returned 5
	[0133.494] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv", pszSpec="*.wmv") returned 0
	[0133.494] lstrlenA (lpString="*.wmv") returned 5
	[0133.494] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv", pszSpec="*.mkv") returned 1
	[0133.494] lstrlenA (lpString="*.mkv") returned 5
	[0133.494] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv"
	[0133.494] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv"
	[0133.494] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv."
	[0133.494] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv.exe"
	[0133.494] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\rwn3ah.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0133.495] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc3c6
	[0133.495] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd0e94a40, dwHighDateTime=0x1d4cadd), lpLastAccessTime=0x407536*(dwLowDateTime=0x6a4411a0, dwHighDateTime=0x1d4ccc0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6a4411a0, dwHighDateTime=0x1d4ccc0)) returned 1
	[0133.495] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.495] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xc384, lpOverlapped=0x0) returned 1
	[0133.496] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv") returned="rWn3ah.mkv"
	[0133.496] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.496] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xc384, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xc384, lpOverlapped=0x0) returned 1
	[0133.496] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.497] CloseHandle (hObject=0x210) returned 1
	[0133.497] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\rwn3ah.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\rwn3ah.mkv.exe")) returned 1
	[0133.498] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x1, cFileName="Skype", cAlternateFileName="")) returned 1
	[0133.498] lstrcmpA (lpString1=".", lpString2="Skype") returned -1
	[0133.498] lstrcmpA (lpString1="..", lpString2="Skype") returned -1
	[0133.498] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\rWn3ah.mkv") returned="rWn3ah.mkv"
	[0133.498] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Skype" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype"
	[0133.498] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype") returned 37
	[0133.498] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName=".", cAlternateFileName="")) returned 0x7cb750
	[0133.498] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.498] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="..", cAlternateFileName="")) returned 1
	[0133.498] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.498] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.498] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="RootTools", cAlternateFileName="ROOTTO~1")) returned 1
	[0133.499] lstrcmpA (lpString1=".", lpString2="RootTools") returned -1
	[0133.499] lstrcmpA (lpString1="..", lpString2="RootTools") returned -1
	[0133.499] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\*.*") returned="*.*"
	[0133.499] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\", lpString2="RootTools" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools"
	[0133.499] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools") returned 47
	[0133.499] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\*.*", lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cb910
	[0133.499] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.499] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0133.499] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.499] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.499] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="roottools.conf", cAlternateFileName="ROOTTO~1.CON")) returned 1
	[0133.499] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0133.499] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="roottools.conf") returned -1
	[0133.499] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="roottools.conf") returned -1
	[0133.499] lstrcmpiA (lpString1="", lpString2="roottools.conf") returned -1
	[0133.499] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\*.*") returned="*.*"
	[0133.499] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\"
	[0133.499] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\") returned=""
	[0133.499] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.499] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\skype\\roottools\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0133.499] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\skype\\roottools\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0133.500] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0133.500] WriteFile (in: hFile=0x218, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0133.501] SetFileTime (hFile=0x218, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0133.501] CloseHandle (hObject=0x218) returned 1
	[0133.501] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\", lpString2="roottools.conf" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf"
	[0133.501] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.zip") returned 0
	[0133.501] lstrlenA (lpString="*.zip") returned 5
	[0133.501] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.rar") returned 0
	[0133.501] lstrlenA (lpString="*.rar") returned 5
	[0133.501] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.7z") returned 0
	[0133.501] lstrlenA (lpString="*.7z") returned 4
	[0133.501] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.tar") returned 0
	[0133.501] lstrlenA (lpString="*.tar") returned 5
	[0133.501] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.gzip") returned 0
	[0133.501] lstrlenA (lpString="*.gzip") returned 6
	[0133.501] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.jpg") returned 0
	[0133.501] lstrlenA (lpString="*.jpg") returned 5
	[0133.501] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.jpeg") returned 0
	[0133.501] lstrlenA (lpString="*.jpeg") returned 6
	[0133.501] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.bmp") returned 0
	[0133.501] lstrlenA (lpString="*.bmp") returned 5
	[0133.501] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.gif") returned 0
	[0133.501] lstrlenA (lpString="*.gif") returned 5
	[0133.501] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.png") returned 0
	[0133.501] lstrlenA (lpString="*.png") returned 5
	[0133.501] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.doc") returned 0
	[0133.501] lstrlenA (lpString="*.doc") returned 5
	[0133.501] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.docx") returned 0
	[0133.502] lstrlenA (lpString="*.docx") returned 6
	[0133.502] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.xls") returned 0
	[0133.502] lstrlenA (lpString="*.xls") returned 5
	[0133.502] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.xlsx") returned 0
	[0133.502] lstrlenA (lpString="*.xlsx") returned 6
	[0133.502] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.ppt") returned 0
	[0133.502] lstrlenA (lpString="*.ppt") returned 5
	[0133.502] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.pptx") returned 0
	[0133.502] lstrlenA (lpString="*.pptx") returned 6
	[0133.502] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.txt") returned 0
	[0133.502] lstrlenA (lpString="*.txt") returned 5
	[0133.502] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.pdf") returned 0
	[0133.502] lstrlenA (lpString="*.pdf") returned 5
	[0133.502] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.htm") returned 0
	[0133.502] lstrlenA (lpString="*.htm") returned 5
	[0133.502] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.html") returned 0
	[0133.502] lstrlenA (lpString="*.html") returned 6
	[0133.502] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.mdb") returned 0
	[0133.502] lstrlenA (lpString="*.mdb") returned 5
	[0133.502] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.pfx") returned 0
	[0133.502] lstrlenA (lpString="*.pfx") returned 5
	[0133.502] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.md") returned 0
	[0133.502] lstrlenA (lpString="*.md") returned 4
	[0133.502] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.lnk") returned 0
	[0133.502] lstrlenA (lpString="*.lnk") returned 5
	[0133.502] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.torrent") returned 0
	[0133.502] lstrlenA (lpString="*.torrent") returned 9
	[0133.502] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.mov") returned 0
	[0133.502] lstrlenA (lpString="*.mov") returned 5
	[0133.502] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.3gp") returned 0
	[0133.502] lstrlenA (lpString="*.3gp") returned 5
	[0133.502] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.mpeg") returned 0
	[0133.502] lstrlenA (lpString="*.mpeg") returned 6
	[0133.502] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.mpg") returned 0
	[0133.503] lstrlenA (lpString="*.mpg") returned 5
	[0133.503] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.flv") returned 0
	[0133.503] lstrlenA (lpString="*.flv") returned 5
	[0133.503] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.avi") returned 0
	[0133.503] lstrlenA (lpString="*.avi") returned 5
	[0133.503] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.mp4") returned 0
	[0133.503] lstrlenA (lpString="*.mp4") returned 5
	[0133.503] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.wmv") returned 0
	[0133.503] lstrlenA (lpString="*.wmv") returned 5
	[0133.503] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.mkv") returned 0
	[0133.503] lstrlenA (lpString="*.mkv") returned 5
	[0133.503] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.mp3") returned 0
	[0133.503] lstrlenA (lpString="*.mp3") returned 5
	[0133.503] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.wav") returned 0
	[0133.503] lstrlenA (lpString="*.wav") returned 5
	[0133.503] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.flac") returned 0
	[0133.503] lstrlenA (lpString="*.flac") returned 6
	[0133.503] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.wma") returned 0
	[0133.503] lstrlenA (lpString="*.wma") returned 5
	[0133.503] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.au3") returned 0
	[0133.503] lstrlenA (lpString="*.au3") returned 5
	[0133.503] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.ahk") returned 0
	[0133.503] lstrlenA (lpString="*.ahk") returned 5
	[0133.503] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.c") returned 0
	[0133.503] lstrlenA (lpString="*.c") returned 3
	[0133.503] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.cc") returned 0
	[0133.503] lstrlenA (lpString="*.cc") returned 4
	[0133.503] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.cpp") returned 0
	[0133.503] lstrlenA (lpString="*.cpp") returned 5
	[0133.503] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.cxx") returned 0
	[0133.503] lstrlenA (lpString="*.cxx") returned 5
	[0133.503] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.c++") returned 0
	[0133.503] lstrlenA (lpString="*.c++") returned 5
	[0133.503] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.cs") returned 0
	[0133.503] lstrlenA (lpString="*.cs") returned 4
	[0133.504] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.vb") returned 0
	[0133.504] lstrlenA (lpString="*.vb") returned 4
	[0133.504] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.bas") returned 0
	[0133.504] lstrlenA (lpString="*.bas") returned 5
	[0133.504] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.csproj") returned 0
	[0133.504] lstrlenA (lpString="*.csproj") returned 8
	[0133.504] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.vbproj") returned 0
	[0133.504] lstrlenA (lpString="*.vbproj") returned 8
	[0133.504] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.vcxproj") returned 0
	[0133.504] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.504] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.manifest") returned 0
	[0133.504] lstrlenA (lpString="*.manifest") returned 10
	[0133.504] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.php") returned 0
	[0133.504] lstrlenA (lpString="*.php") returned 5
	[0133.504] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.vbe") returned 0
	[0133.504] lstrlenA (lpString="*.vbe") returned 5
	[0133.504] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.vba") returned 0
	[0133.504] lstrlenA (lpString="*.vba") returned 5
	[0133.504] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.vbs") returned 0
	[0133.504] lstrlenA (lpString="*.vbs") returned 5
	[0133.504] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.bat") returned 0
	[0133.504] lstrlenA (lpString="*.bat") returned 5
	[0133.504] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.cmd") returned 0
	[0133.504] lstrlenA (lpString="*.cmd") returned 5
	[0133.504] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.js") returned 0
	[0133.504] lstrlenA (lpString="*.js") returned 4
	[0133.504] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.jscript") returned 0
	[0133.504] lstrlenA (lpString="*.jscript") returned 9
	[0133.504] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.hta") returned 0
	[0133.504] lstrlenA (lpString="*.hta") returned 5
	[0133.504] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.php7") returned 0
	[0133.504] lstrlenA (lpString="*.php7") returned 6
	[0133.504] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.db") returned 0
	[0133.504] lstrlenA (lpString="*.db") returned 4
	[0133.504] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.swf") returned 0
	[0133.505] lstrlenA (lpString="*.swf") returned 5
	[0133.505] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.eml") returned 0
	[0133.505] lstrlenA (lpString="*.eml") returned 5
	[0133.505] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.part") returned 0
	[0133.505] lstrlenA (lpString="*.part") returned 6
	[0133.505] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.nfo") returned 0
	[0133.505] lstrlenA (lpString="*.nfo") returned 5
	[0133.505] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.rsa") returned 0
	[0133.505] lstrlenA (lpString="*.rsa") returned 5
	[0133.505] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.key") returned 0
	[0133.505] lstrlenA (lpString="*.key") returned 5
	[0133.505] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.aes") returned 0
	[0133.505] lstrlenA (lpString="*.aes") returned 5
	[0133.505] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.blob") returned 0
	[0133.505] lstrlenA (lpString="*.blob") returned 6
	[0133.505] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.btc") returned 0
	[0133.505] lstrlenA (lpString="*.btc") returned 5
	[0133.505] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", pszSpec="*.wallet") returned 0
	[0133.505] lstrlenA (lpString="*.wallet") returned 8
	[0133.505] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="roottools.conf", cAlternateFileName="ROOTTO~1.CON")) returned 0
	[0133.505] FindClose (in: hFindFile=0x7cb910 | out: hFindFile=0x7cb910) returned 1
	[0133.505] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="RootTools", cAlternateFileName="ROOTTO~1")) returned 0
	[0133.505] FindClose (in: hFindFile=0x7cb750 | out: hFindFile=0x7cb750) returned 1
	[0133.505] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x1, cFileName="Sun", cAlternateFileName="")) returned 1
	[0133.505] lstrcmpA (lpString1=".", lpString2="Sun") returned -1
	[0133.505] lstrcmpA (lpString1="..", lpString2="Sun") returned -1
	[0133.505] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\*.*") returned="*.*"
	[0133.505] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Sun" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun"
	[0133.505] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun") returned 35
	[0133.505] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbad0
	[0133.506] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.506] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.506] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.506] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.506] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1
	[0133.506] lstrcmpA (lpString1=".", lpString2="Java") returned -1
	[0133.506] lstrcmpA (lpString1="..", lpString2="Java") returned -1
	[0133.506] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\*.*") returned="*.*"
	[0133.506] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\", lpString2="Java" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java"
	[0133.506] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java") returned 40
	[0133.506] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\*.*", lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cb650
	[0133.506] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.506] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0133.506] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.506] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.506] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1
	[0133.506] lstrcmpA (lpString1=".", lpString2="Deployment") returned -1
	[0133.506] lstrcmpA (lpString1="..", lpString2="Deployment") returned -1
	[0133.506] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\*.*") returned="*.*"
	[0133.506] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\", lpString2="Deployment" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\Deployment") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\Deployment"
	[0133.506] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\Deployment") returned 51
	[0133.506] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\Deployment\\*.*", lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cb790
	[0133.507] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.507] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0133.507] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.507] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.507] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 0
	[0133.507] FindClose (in: hFindFile=0x7cb790 | out: hFindFile=0x7cb790) returned 1
	[0133.507] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 0
	[0133.507] FindClose (in: hFindFile=0x7cb650 | out: hFindFile=0x7cb650) returned 1
	[0133.507] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 0
	[0133.507] FindClose (in: hFindFile=0x7cbad0 | out: hFindFile=0x7cbad0) returned 1
	[0133.507] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3443f80, ftCreationTime.dwHighDateTime=0x1d4d4c8, ftLastAccessTime.dwLowDateTime=0x8fcb19f0, ftLastAccessTime.dwHighDateTime=0x1d4ccbb, ftLastWriteTime.dwLowDateTime=0x8fcb19f0, ftLastWriteTime.dwHighDateTime=0x1d4ccbb, nFileSizeHigh=0x0, nFileSizeLow=0x140d1, dwReserved0=0x15, dwReserved1=0x1, cFileName="tgYZ7_ukrYj.png", cAlternateFileName="TGYZ7_~1.PNG")) returned 1
	[0133.507] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0133.507] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="tgYZ7_ukrYj.png") returned -1
	[0133.507] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="tgYZ7_ukrYj.png") returned -1
	[0133.507] lstrcmpiA (lpString1="", lpString2="tgYZ7_ukrYj.png") returned -1
	[0133.507] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\*.*") returned="*.*"
	[0133.507] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\"
	[0133.507] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned=""
	[0133.507] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.507] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\how-to-decrypt-files.htm")) returned 0x20
	[0133.508] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="tgYZ7_ukrYj.png" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\tgYZ7_ukrYj.png") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\tgYZ7_ukrYj.png"
	[0133.508] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\tgYZ7_ukrYj.png", pszSpec="*.zip") returned 0
	[0133.508] lstrlenA (lpString="*.zip") returned 5
	[0133.508] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\tgYZ7_ukrYj.png", pszSpec="*.rar") returned 0
	[0133.508] lstrlenA (lpString="*.rar") returned 5
	[0133.508] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\tgYZ7_ukrYj.png", pszSpec="*.7z") returned 0
	[0133.508] lstrlenA (lpString="*.7z") returned 4
	[0133.508] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\tgYZ7_ukrYj.png", pszSpec="*.tar") returned 0
	[0133.508] lstrlenA (lpString="*.tar") returned 5
	[0133.508] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\tgYZ7_ukrYj.png", pszSpec="*.gzip") returned 0
	[0133.508] lstrlenA (lpString="*.gzip") returned 6
	[0133.508] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\tgYZ7_ukrYj.png", pszSpec="*.jpg") returned 0
	[0133.508] lstrlenA (lpString="*.jpg") returned 5
	[0133.508] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\tgYZ7_ukrYj.png", pszSpec="*.jpeg") returned 0
	[0133.508] lstrlenA (lpString="*.jpeg") returned 6
	[0133.508] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\tgYZ7_ukrYj.png", pszSpec="*.bmp") returned 0
	[0133.508] lstrlenA (lpString="*.bmp") returned 5
	[0133.508] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\tgYZ7_ukrYj.png", pszSpec="*.gif") returned 0
	[0133.508] lstrlenA (lpString="*.gif") returned 5
	[0133.508] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\tgYZ7_ukrYj.png", pszSpec="*.png") returned 1
	[0133.508] lstrlenA (lpString="*.png") returned 5
	[0133.508] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\tgYZ7_ukrYj.png" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\tgYZ7_ukrYj.png") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\tgYZ7_ukrYj.png"
	[0133.508] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\tgYZ7_ukrYj.png" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\tgYZ7_ukrYj.png") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\tgYZ7_ukrYj.png"
	[0133.508] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\tgYZ7_ukrYj.png", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\tgYZ7_ukrYj.png.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\tgYZ7_ukrYj.png."
	[0133.508] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\tgYZ7_ukrYj.png.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\tgYZ7_ukrYj.png.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\tgYZ7_ukrYj.png.exe"
	[0133.508] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\tgYZ7_ukrYj.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\tgyz7_ukryj.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0133.509] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x140d1
	[0133.509] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd3443f80, dwHighDateTime=0x1d4d4c8), lpLastAccessTime=0x407536*(dwLowDateTime=0x8fcb19f0, dwHighDateTime=0x1d4ccbb), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8fcb19f0, dwHighDateTime=0x1d4ccbb)) returned 1
	[0133.509] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.509] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1408f, lpOverlapped=0x0) returned 1
	[0133.510] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\tgYZ7_ukrYj.png") returned="tgYZ7_ukrYj.png"
	[0133.510] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.510] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1408f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1408f, lpOverlapped=0x0) returned 1
	[0133.511] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.511] CloseHandle (hObject=0x210) returned 1
	[0133.511] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\tgYZ7_ukrYj.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\tgyz7_ukryj.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\tgYZ7_ukrYj.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\tgyz7_ukryj.png.exe")) returned 1
	[0133.511] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3654d8b0, ftCreationTime.dwHighDateTime=0x1d4c96f, ftLastAccessTime.dwLowDateTime=0xb2e49e60, ftLastAccessTime.dwHighDateTime=0x1d4c708, ftLastWriteTime.dwLowDateTime=0xb2e49e60, ftLastWriteTime.dwHighDateTime=0x1d4c708, nFileSizeHigh=0x0, nFileSizeLow=0xfeba, dwReserved0=0x0, dwReserved1=0x1, cFileName="Uk9k.png", cAlternateFileName="")) returned 1
	[0133.511] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0133.511] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Uk9k.png") returned -1
	[0133.512] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Uk9k.png") returned -1
	[0133.512] lstrcmpiA (lpString1="", lpString2="Uk9k.png") returned -1
	[0133.512] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\tgYZ7_ukrYj.png") returned="tgYZ7_ukrYj.png"
	[0133.512] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\"
	[0133.512] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned=""
	[0133.512] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.512] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\how-to-decrypt-files.htm")) returned 0x20
	[0133.512] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Uk9k.png" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Uk9k.png") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Uk9k.png"
	[0133.512] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Uk9k.png", pszSpec="*.zip") returned 0
	[0133.512] lstrlenA (lpString="*.zip") returned 5
	[0133.512] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Uk9k.png", pszSpec="*.rar") returned 0
	[0133.512] lstrlenA (lpString="*.rar") returned 5
	[0133.512] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Uk9k.png", pszSpec="*.7z") returned 0
	[0133.512] lstrlenA (lpString="*.7z") returned 4
	[0133.512] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Uk9k.png", pszSpec="*.tar") returned 0
	[0133.512] lstrlenA (lpString="*.tar") returned 5
	[0133.512] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Uk9k.png", pszSpec="*.gzip") returned 0
	[0133.512] lstrlenA (lpString="*.gzip") returned 6
	[0133.512] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Uk9k.png", pszSpec="*.jpg") returned 0
	[0133.512] lstrlenA (lpString="*.jpg") returned 5
	[0133.512] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Uk9k.png", pszSpec="*.jpeg") returned 0
	[0133.512] lstrlenA (lpString="*.jpeg") returned 6
	[0133.512] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Uk9k.png", pszSpec="*.bmp") returned 0
	[0133.512] lstrlenA (lpString="*.bmp") returned 5
	[0133.512] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Uk9k.png", pszSpec="*.gif") returned 0
	[0133.512] lstrlenA (lpString="*.gif") returned 5
	[0133.512] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Uk9k.png", pszSpec="*.png") returned 1
	[0133.512] lstrlenA (lpString="*.png") returned 5
	[0133.512] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Uk9k.png" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Uk9k.png") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Uk9k.png"
	[0133.512] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Uk9k.png" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Uk9k.png") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Uk9k.png"
	[0133.512] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Uk9k.png", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Uk9k.png.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Uk9k.png."
	[0133.512] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Uk9k.png.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Uk9k.png.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Uk9k.png.exe"
	[0133.513] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Uk9k.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\uk9k.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0133.513] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfeba
	[0133.513] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3654d8b0, dwHighDateTime=0x1d4c96f), lpLastAccessTime=0x407536*(dwLowDateTime=0xb2e49e60, dwHighDateTime=0x1d4c708), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb2e49e60, dwHighDateTime=0x1d4c708)) returned 1
	[0133.514] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.514] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xfe78, lpOverlapped=0x0) returned 1
	[0133.515] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Uk9k.png") returned="Uk9k.png"
	[0133.515] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.515] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xfe78, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xfe78, lpOverlapped=0x0) returned 1
	[0133.515] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.516] CloseHandle (hObject=0x210) returned 1
	[0133.516] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Uk9k.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\uk9k.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Uk9k.png.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\uk9k.png.exe")) returned 1
	[0133.516] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2278200, ftCreationTime.dwHighDateTime=0x1d4c976, ftLastAccessTime.dwLowDateTime=0x49207950, ftLastAccessTime.dwHighDateTime=0x1d4c879, ftLastWriteTime.dwLowDateTime=0x49207950, ftLastWriteTime.dwHighDateTime=0x1d4c879, nFileSizeHigh=0x0, nFileSizeLow=0x13ec1, dwReserved0=0x15, dwReserved1=0x1, cFileName="vbub.mp3", cAlternateFileName="")) returned 1
	[0133.516] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0133.516] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="vbub.mp3") returned -1
	[0133.516] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="vbub.mp3") returned -1
	[0133.516] lstrcmpiA (lpString1="", lpString2="vbub.mp3") returned -1
	[0133.516] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Uk9k.png") returned="Uk9k.png"
	[0133.516] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\"
	[0133.516] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned=""
	[0133.516] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.516] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\how-to-decrypt-files.htm")) returned 0x20
	[0133.517] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="vbub.mp3" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3"
	[0133.517] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3", pszSpec="*.zip") returned 0
	[0133.517] lstrlenA (lpString="*.zip") returned 5
	[0133.517] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3", pszSpec="*.rar") returned 0
	[0133.517] lstrlenA (lpString="*.rar") returned 5
	[0133.517] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3", pszSpec="*.7z") returned 0
	[0133.517] lstrlenA (lpString="*.7z") returned 4
	[0133.517] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3", pszSpec="*.tar") returned 0
	[0133.517] lstrlenA (lpString="*.tar") returned 5
	[0133.517] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3", pszSpec="*.gzip") returned 0
	[0133.517] lstrlenA (lpString="*.gzip") returned 6
	[0133.517] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3", pszSpec="*.jpg") returned 0
	[0133.517] lstrlenA (lpString="*.jpg") returned 5
	[0133.517] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3", pszSpec="*.jpeg") returned 0
	[0133.517] lstrlenA (lpString="*.jpeg") returned 6
	[0133.517] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3", pszSpec="*.bmp") returned 0
	[0133.517] lstrlenA (lpString="*.bmp") returned 5
	[0133.517] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3", pszSpec="*.gif") returned 0
	[0133.517] lstrlenA (lpString="*.gif") returned 5
	[0133.517] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3", pszSpec="*.png") returned 0
	[0133.517] lstrlenA (lpString="*.png") returned 5
	[0133.517] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3", pszSpec="*.doc") returned 0
	[0133.517] lstrlenA (lpString="*.doc") returned 5
	[0133.517] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3", pszSpec="*.docx") returned 0
	[0133.517] lstrlenA (lpString="*.docx") returned 6
	[0133.517] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3", pszSpec="*.xls") returned 0
	[0133.517] lstrlenA (lpString="*.xls") returned 5
	[0133.517] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3", pszSpec="*.xlsx") returned 0
	[0133.517] lstrlenA (lpString="*.xlsx") returned 6
	[0133.517] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3", pszSpec="*.ppt") returned 0
	[0133.517] lstrlenA (lpString="*.ppt") returned 5
	[0133.517] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3", pszSpec="*.pptx") returned 0
	[0133.517] lstrlenA (lpString="*.pptx") returned 6
	[0133.517] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3", pszSpec="*.txt") returned 0
	[0133.517] lstrlenA (lpString="*.txt") returned 5
	[0133.518] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3", pszSpec="*.pdf") returned 0
	[0133.518] lstrlenA (lpString="*.pdf") returned 5
	[0133.518] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3", pszSpec="*.htm") returned 0
	[0133.518] lstrlenA (lpString="*.htm") returned 5
	[0133.518] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3", pszSpec="*.html") returned 0
	[0133.518] lstrlenA (lpString="*.html") returned 6
	[0133.518] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3", pszSpec="*.mdb") returned 0
	[0133.518] lstrlenA (lpString="*.mdb") returned 5
	[0133.518] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3", pszSpec="*.pfx") returned 0
	[0133.518] lstrlenA (lpString="*.pfx") returned 5
	[0133.518] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3", pszSpec="*.md") returned 0
	[0133.518] lstrlenA (lpString="*.md") returned 4
	[0133.518] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3", pszSpec="*.lnk") returned 0
	[0133.518] lstrlenA (lpString="*.lnk") returned 5
	[0133.518] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3", pszSpec="*.torrent") returned 0
	[0133.518] lstrlenA (lpString="*.torrent") returned 9
	[0133.518] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3", pszSpec="*.mov") returned 0
	[0133.518] lstrlenA (lpString="*.mov") returned 5
	[0133.518] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3", pszSpec="*.3gp") returned 0
	[0133.518] lstrlenA (lpString="*.3gp") returned 5
	[0133.518] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3", pszSpec="*.mpeg") returned 0
	[0133.518] lstrlenA (lpString="*.mpeg") returned 6
	[0133.518] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3", pszSpec="*.mpg") returned 0
	[0133.518] lstrlenA (lpString="*.mpg") returned 5
	[0133.518] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3", pszSpec="*.flv") returned 0
	[0133.518] lstrlenA (lpString="*.flv") returned 5
	[0133.518] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3", pszSpec="*.avi") returned 0
	[0133.518] lstrlenA (lpString="*.avi") returned 5
	[0133.518] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3", pszSpec="*.mp4") returned 0
	[0133.518] lstrlenA (lpString="*.mp4") returned 5
	[0133.518] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3", pszSpec="*.wmv") returned 0
	[0133.518] lstrlenA (lpString="*.wmv") returned 5
	[0133.518] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3", pszSpec="*.mkv") returned 0
	[0133.518] lstrlenA (lpString="*.mkv") returned 5
	[0133.518] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3", pszSpec="*.mp3") returned 1
	[0133.519] lstrlenA (lpString="*.mp3") returned 5
	[0133.519] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3"
	[0133.519] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3"
	[0133.519] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3."
	[0133.519] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3.exe"
	[0133.519] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\vbub.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0133.519] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13ec1
	[0133.519] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc2278200, dwHighDateTime=0x1d4c976), lpLastAccessTime=0x407536*(dwLowDateTime=0x49207950, dwHighDateTime=0x1d4c879), lpLastWriteTime=0x40753e*(dwLowDateTime=0x49207950, dwHighDateTime=0x1d4c879)) returned 1
	[0133.519] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.519] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x13e7f, lpOverlapped=0x0) returned 1
	[0133.520] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3") returned="vbub.mp3"
	[0133.521] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.521] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x13e7f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x13e7f, lpOverlapped=0x0) returned 1
	[0133.521] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.521] CloseHandle (hObject=0x210) returned 1
	[0133.521] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\vbub.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\vbub.mp3.exe")) returned 1
	[0133.522] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3102d5f0, ftCreationTime.dwHighDateTime=0x1d4d43d, ftLastAccessTime.dwLowDateTime=0x1e132bd0, ftLastAccessTime.dwHighDateTime=0x1d4cfff, ftLastWriteTime.dwLowDateTime=0x1e132bd0, ftLastWriteTime.dwHighDateTime=0x1d4cfff, nFileSizeHigh=0x0, nFileSizeLow=0x9645, dwReserved0=0x15, dwReserved1=0x1, cFileName="vE1CtRD0Lml8GNpjN.odt", cAlternateFileName="VE1CTR~1.ODT")) returned 1
	[0133.522] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0133.522] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="vE1CtRD0Lml8GNpjN.odt") returned -1
	[0133.522] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="vE1CtRD0Lml8GNpjN.odt") returned -1
	[0133.522] lstrcmpiA (lpString1="", lpString2="vE1CtRD0Lml8GNpjN.odt") returned -1
	[0133.522] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\vbub.mp3") returned="vbub.mp3"
	[0133.522] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\"
	[0133.522] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned=""
	[0133.522] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.522] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\how-to-decrypt-files.htm")) returned 0x20
	[0133.522] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="vE1CtRD0Lml8GNpjN.odt" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt"
	[0133.522] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.zip") returned 0
	[0133.522] lstrlenA (lpString="*.zip") returned 5
	[0133.522] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.rar") returned 0
	[0133.522] lstrlenA (lpString="*.rar") returned 5
	[0133.522] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.7z") returned 0
	[0133.522] lstrlenA (lpString="*.7z") returned 4
	[0133.522] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.tar") returned 0
	[0133.522] lstrlenA (lpString="*.tar") returned 5
	[0133.522] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.gzip") returned 0
	[0133.522] lstrlenA (lpString="*.gzip") returned 6
	[0133.522] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.jpg") returned 0
	[0133.522] lstrlenA (lpString="*.jpg") returned 5
	[0133.522] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.jpeg") returned 0
	[0133.522] lstrlenA (lpString="*.jpeg") returned 6
	[0133.522] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.bmp") returned 0
	[0133.522] lstrlenA (lpString="*.bmp") returned 5
	[0133.522] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.gif") returned 0
	[0133.522] lstrlenA (lpString="*.gif") returned 5
	[0133.522] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.png") returned 0
	[0133.523] lstrlenA (lpString="*.png") returned 5
	[0133.523] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.doc") returned 0
	[0133.523] lstrlenA (lpString="*.doc") returned 5
	[0133.523] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.docx") returned 0
	[0133.523] lstrlenA (lpString="*.docx") returned 6
	[0133.523] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.xls") returned 0
	[0133.523] lstrlenA (lpString="*.xls") returned 5
	[0133.523] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.xlsx") returned 0
	[0133.523] lstrlenA (lpString="*.xlsx") returned 6
	[0133.523] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.ppt") returned 0
	[0133.523] lstrlenA (lpString="*.ppt") returned 5
	[0133.523] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.pptx") returned 0
	[0133.523] lstrlenA (lpString="*.pptx") returned 6
	[0133.523] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.txt") returned 0
	[0133.523] lstrlenA (lpString="*.txt") returned 5
	[0133.523] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.pdf") returned 0
	[0133.523] lstrlenA (lpString="*.pdf") returned 5
	[0133.529] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.htm") returned 0
	[0133.529] lstrlenA (lpString="*.htm") returned 5
	[0133.529] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.html") returned 0
	[0133.529] lstrlenA (lpString="*.html") returned 6
	[0133.529] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.mdb") returned 0
	[0133.529] lstrlenA (lpString="*.mdb") returned 5
	[0133.530] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.pfx") returned 0
	[0133.530] lstrlenA (lpString="*.pfx") returned 5
	[0133.530] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.md") returned 0
	[0133.530] lstrlenA (lpString="*.md") returned 4
	[0133.530] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.lnk") returned 0
	[0133.530] lstrlenA (lpString="*.lnk") returned 5
	[0133.530] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.torrent") returned 0
	[0133.530] lstrlenA (lpString="*.torrent") returned 9
	[0133.530] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.mov") returned 0
	[0133.530] lstrlenA (lpString="*.mov") returned 5
	[0133.530] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.3gp") returned 0
	[0133.530] lstrlenA (lpString="*.3gp") returned 5
	[0133.530] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.mpeg") returned 0
	[0133.530] lstrlenA (lpString="*.mpeg") returned 6
	[0133.530] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.mpg") returned 0
	[0133.530] lstrlenA (lpString="*.mpg") returned 5
	[0133.530] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.flv") returned 0
	[0133.530] lstrlenA (lpString="*.flv") returned 5
	[0133.530] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.avi") returned 0
	[0133.530] lstrlenA (lpString="*.avi") returned 5
	[0133.530] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.mp4") returned 0
	[0133.530] lstrlenA (lpString="*.mp4") returned 5
	[0133.530] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.wmv") returned 0
	[0133.530] lstrlenA (lpString="*.wmv") returned 5
	[0133.530] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.mkv") returned 0
	[0133.530] lstrlenA (lpString="*.mkv") returned 5
	[0133.530] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.mp3") returned 0
	[0133.530] lstrlenA (lpString="*.mp3") returned 5
	[0133.530] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.wav") returned 0
	[0133.530] lstrlenA (lpString="*.wav") returned 5
	[0133.530] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.flac") returned 0
	[0133.530] lstrlenA (lpString="*.flac") returned 6
	[0133.530] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.wma") returned 0
	[0133.530] lstrlenA (lpString="*.wma") returned 5
	[0133.530] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.au3") returned 0
	[0133.531] lstrlenA (lpString="*.au3") returned 5
	[0133.531] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.ahk") returned 0
	[0133.531] lstrlenA (lpString="*.ahk") returned 5
	[0133.531] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.c") returned 0
	[0133.531] lstrlenA (lpString="*.c") returned 3
	[0133.531] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.cc") returned 0
	[0133.531] lstrlenA (lpString="*.cc") returned 4
	[0133.531] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.cpp") returned 0
	[0133.531] lstrlenA (lpString="*.cpp") returned 5
	[0133.531] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.cxx") returned 0
	[0133.531] lstrlenA (lpString="*.cxx") returned 5
	[0133.531] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.c++") returned 0
	[0133.531] lstrlenA (lpString="*.c++") returned 5
	[0133.531] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.cs") returned 0
	[0133.531] lstrlenA (lpString="*.cs") returned 4
	[0133.531] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.vb") returned 0
	[0133.531] lstrlenA (lpString="*.vb") returned 4
	[0133.531] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.bas") returned 0
	[0133.531] lstrlenA (lpString="*.bas") returned 5
	[0133.531] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.csproj") returned 0
	[0133.531] lstrlenA (lpString="*.csproj") returned 8
	[0133.531] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.vbproj") returned 0
	[0133.531] lstrlenA (lpString="*.vbproj") returned 8
	[0133.531] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.vcxproj") returned 0
	[0133.531] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.531] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.manifest") returned 0
	[0133.531] lstrlenA (lpString="*.manifest") returned 10
	[0133.531] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.php") returned 0
	[0133.531] lstrlenA (lpString="*.php") returned 5
	[0133.531] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.vbe") returned 0
	[0133.531] lstrlenA (lpString="*.vbe") returned 5
	[0133.531] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.vba") returned 0
	[0133.531] lstrlenA (lpString="*.vba") returned 5
	[0133.531] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.vbs") returned 0
	[0133.531] lstrlenA (lpString="*.vbs") returned 5
	[0133.532] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.bat") returned 0
	[0133.532] lstrlenA (lpString="*.bat") returned 5
	[0133.532] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.cmd") returned 0
	[0133.532] lstrlenA (lpString="*.cmd") returned 5
	[0133.532] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.js") returned 0
	[0133.532] lstrlenA (lpString="*.js") returned 4
	[0133.532] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.jscript") returned 0
	[0133.532] lstrlenA (lpString="*.jscript") returned 9
	[0133.532] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.hta") returned 0
	[0133.532] lstrlenA (lpString="*.hta") returned 5
	[0133.532] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.php7") returned 0
	[0133.532] lstrlenA (lpString="*.php7") returned 6
	[0133.532] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.db") returned 0
	[0133.532] lstrlenA (lpString="*.db") returned 4
	[0133.532] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.swf") returned 0
	[0133.532] lstrlenA (lpString="*.swf") returned 5
	[0133.532] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.eml") returned 0
	[0133.532] lstrlenA (lpString="*.eml") returned 5
	[0133.532] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.part") returned 0
	[0133.532] lstrlenA (lpString="*.part") returned 6
	[0133.532] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.nfo") returned 0
	[0133.532] lstrlenA (lpString="*.nfo") returned 5
	[0133.532] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.rsa") returned 0
	[0133.532] lstrlenA (lpString="*.rsa") returned 5
	[0133.532] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.key") returned 0
	[0133.532] lstrlenA (lpString="*.key") returned 5
	[0133.532] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.aes") returned 0
	[0133.532] lstrlenA (lpString="*.aes") returned 5
	[0133.532] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.blob") returned 0
	[0133.532] lstrlenA (lpString="*.blob") returned 6
	[0133.532] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.btc") returned 0
	[0133.532] lstrlenA (lpString="*.btc") returned 5
	[0133.532] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt", pszSpec="*.wallet") returned 0
	[0133.532] lstrlenA (lpString="*.wallet") returned 8
	[0133.532] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc402cad0, ftCreationTime.dwHighDateTime=0x1d4caac, ftLastAccessTime.dwLowDateTime=0xe9e71480, ftLastAccessTime.dwHighDateTime=0x1d4cf6c, ftLastWriteTime.dwLowDateTime=0xe9e71480, ftLastWriteTime.dwHighDateTime=0x1d4cf6c, nFileSizeHigh=0x0, nFileSizeLow=0xe42c, dwReserved0=0x0, dwReserved1=0x0, cFileName="vRnOCwc0byMIsUzh3P6P.odt", cAlternateFileName="VRNOCW~1.ODT")) returned 1
	[0133.532] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0133.533] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="vRnOCwc0byMIsUzh3P6P.odt") returned -1
	[0133.533] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="vRnOCwc0byMIsUzh3P6P.odt") returned -1
	[0133.533] lstrcmpiA (lpString1="", lpString2="vRnOCwc0byMIsUzh3P6P.odt") returned -1
	[0133.533] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\vE1CtRD0Lml8GNpjN.odt") returned="vE1CtRD0Lml8GNpjN.odt"
	[0133.533] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\"
	[0133.533] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned=""
	[0133.533] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.533] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\how-to-decrypt-files.htm")) returned 0x20
	[0133.533] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="vRnOCwc0byMIsUzh3P6P.odt" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt"
	[0133.533] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.zip") returned 0
	[0133.533] lstrlenA (lpString="*.zip") returned 5
	[0133.533] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.rar") returned 0
	[0133.533] lstrlenA (lpString="*.rar") returned 5
	[0133.533] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.7z") returned 0
	[0133.533] lstrlenA (lpString="*.7z") returned 4
	[0133.533] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.tar") returned 0
	[0133.533] lstrlenA (lpString="*.tar") returned 5
	[0133.533] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.gzip") returned 0
	[0133.533] lstrlenA (lpString="*.gzip") returned 6
	[0133.533] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.jpg") returned 0
	[0133.533] lstrlenA (lpString="*.jpg") returned 5
	[0133.533] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.jpeg") returned 0
	[0133.533] lstrlenA (lpString="*.jpeg") returned 6
	[0133.533] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.bmp") returned 0
	[0133.533] lstrlenA (lpString="*.bmp") returned 5
	[0133.533] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.gif") returned 0
	[0133.533] lstrlenA (lpString="*.gif") returned 5
	[0133.533] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.png") returned 0
	[0133.533] lstrlenA (lpString="*.png") returned 5
	[0133.533] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.doc") returned 0
	[0133.533] lstrlenA (lpString="*.doc") returned 5
	[0133.533] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.docx") returned 0
	[0133.533] lstrlenA (lpString="*.docx") returned 6
	[0133.534] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.xls") returned 0
	[0133.534] lstrlenA (lpString="*.xls") returned 5
	[0133.534] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.xlsx") returned 0
	[0133.534] lstrlenA (lpString="*.xlsx") returned 6
	[0133.534] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.ppt") returned 0
	[0133.534] lstrlenA (lpString="*.ppt") returned 5
	[0133.534] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.pptx") returned 0
	[0133.534] lstrlenA (lpString="*.pptx") returned 6
	[0133.534] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.txt") returned 0
	[0133.534] lstrlenA (lpString="*.txt") returned 5
	[0133.534] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.pdf") returned 0
	[0133.534] lstrlenA (lpString="*.pdf") returned 5
	[0133.534] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.htm") returned 0
	[0133.534] lstrlenA (lpString="*.htm") returned 5
	[0133.534] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.html") returned 0
	[0133.534] lstrlenA (lpString="*.html") returned 6
	[0133.534] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.mdb") returned 0
	[0133.534] lstrlenA (lpString="*.mdb") returned 5
	[0133.534] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.pfx") returned 0
	[0133.534] lstrlenA (lpString="*.pfx") returned 5
	[0133.534] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.md") returned 0
	[0133.534] lstrlenA (lpString="*.md") returned 4
	[0133.534] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.lnk") returned 0
	[0133.534] lstrlenA (lpString="*.lnk") returned 5
	[0133.534] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.torrent") returned 0
	[0133.534] lstrlenA (lpString="*.torrent") returned 9
	[0133.534] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.mov") returned 0
	[0133.534] lstrlenA (lpString="*.mov") returned 5
	[0133.534] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.3gp") returned 0
	[0133.534] lstrlenA (lpString="*.3gp") returned 5
	[0133.534] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.mpeg") returned 0
	[0133.534] lstrlenA (lpString="*.mpeg") returned 6
	[0133.534] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.mpg") returned 0
	[0133.534] lstrlenA (lpString="*.mpg") returned 5
	[0133.534] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.flv") returned 0
	[0133.534] lstrlenA (lpString="*.flv") returned 5
	[0133.535] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.avi") returned 0
	[0133.535] lstrlenA (lpString="*.avi") returned 5
	[0133.535] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.mp4") returned 0
	[0133.535] lstrlenA (lpString="*.mp4") returned 5
	[0133.535] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.wmv") returned 0
	[0133.535] lstrlenA (lpString="*.wmv") returned 5
	[0133.535] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.mkv") returned 0
	[0133.535] lstrlenA (lpString="*.mkv") returned 5
	[0133.535] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.mp3") returned 0
	[0133.535] lstrlenA (lpString="*.mp3") returned 5
	[0133.535] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.wav") returned 0
	[0133.535] lstrlenA (lpString="*.wav") returned 5
	[0133.535] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.flac") returned 0
	[0133.535] lstrlenA (lpString="*.flac") returned 6
	[0133.535] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.wma") returned 0
	[0133.535] lstrlenA (lpString="*.wma") returned 5
	[0133.535] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.au3") returned 0
	[0133.535] lstrlenA (lpString="*.au3") returned 5
	[0133.535] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.ahk") returned 0
	[0133.535] lstrlenA (lpString="*.ahk") returned 5
	[0133.535] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.c") returned 0
	[0133.535] lstrlenA (lpString="*.c") returned 3
	[0133.535] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.cc") returned 0
	[0133.535] lstrlenA (lpString="*.cc") returned 4
	[0133.535] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.cpp") returned 0
	[0133.535] lstrlenA (lpString="*.cpp") returned 5
	[0133.535] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.cxx") returned 0
	[0133.535] lstrlenA (lpString="*.cxx") returned 5
	[0133.535] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.c++") returned 0
	[0133.535] lstrlenA (lpString="*.c++") returned 5
	[0133.535] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.cs") returned 0
	[0133.535] lstrlenA (lpString="*.cs") returned 4
	[0133.535] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.vb") returned 0
	[0133.535] lstrlenA (lpString="*.vb") returned 4
	[0133.535] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.bas") returned 0
	[0133.536] lstrlenA (lpString="*.bas") returned 5
	[0133.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.csproj") returned 0
	[0133.536] lstrlenA (lpString="*.csproj") returned 8
	[0133.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.vbproj") returned 0
	[0133.536] lstrlenA (lpString="*.vbproj") returned 8
	[0133.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.vcxproj") returned 0
	[0133.536] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.manifest") returned 0
	[0133.536] lstrlenA (lpString="*.manifest") returned 10
	[0133.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.php") returned 0
	[0133.536] lstrlenA (lpString="*.php") returned 5
	[0133.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.vbe") returned 0
	[0133.536] lstrlenA (lpString="*.vbe") returned 5
	[0133.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.vba") returned 0
	[0133.536] lstrlenA (lpString="*.vba") returned 5
	[0133.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.vbs") returned 0
	[0133.536] lstrlenA (lpString="*.vbs") returned 5
	[0133.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.bat") returned 0
	[0133.536] lstrlenA (lpString="*.bat") returned 5
	[0133.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.cmd") returned 0
	[0133.536] lstrlenA (lpString="*.cmd") returned 5
	[0133.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.js") returned 0
	[0133.536] lstrlenA (lpString="*.js") returned 4
	[0133.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.jscript") returned 0
	[0133.536] lstrlenA (lpString="*.jscript") returned 9
	[0133.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.hta") returned 0
	[0133.536] lstrlenA (lpString="*.hta") returned 5
	[0133.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.php7") returned 0
	[0133.536] lstrlenA (lpString="*.php7") returned 6
	[0133.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.db") returned 0
	[0133.536] lstrlenA (lpString="*.db") returned 4
	[0133.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.swf") returned 0
	[0133.536] lstrlenA (lpString="*.swf") returned 5
	[0133.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.eml") returned 0
	[0133.536] lstrlenA (lpString="*.eml") returned 5
	[0133.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.part") returned 0
	[0133.537] lstrlenA (lpString="*.part") returned 6
	[0133.537] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.nfo") returned 0
	[0133.537] lstrlenA (lpString="*.nfo") returned 5
	[0133.537] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.rsa") returned 0
	[0133.537] lstrlenA (lpString="*.rsa") returned 5
	[0133.537] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.key") returned 0
	[0133.537] lstrlenA (lpString="*.key") returned 5
	[0133.537] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.aes") returned 0
	[0133.537] lstrlenA (lpString="*.aes") returned 5
	[0133.537] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.blob") returned 0
	[0133.537] lstrlenA (lpString="*.blob") returned 6
	[0133.537] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.btc") returned 0
	[0133.537] lstrlenA (lpString="*.btc") returned 5
	[0133.537] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt", pszSpec="*.wallet") returned 0
	[0133.537] lstrlenA (lpString="*.wallet") returned 8
	[0133.537] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb494ea10, ftCreationTime.dwHighDateTime=0x1d4d2c7, ftLastAccessTime.dwLowDateTime=0x30a3fb20, ftLastAccessTime.dwHighDateTime=0x1d4c6aa, ftLastWriteTime.dwLowDateTime=0x30a3fb20, ftLastWriteTime.dwHighDateTime=0x1d4c6aa, nFileSizeHigh=0x0, nFileSizeLow=0x1fe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="xOLhos_mwzng6.bmp", cAlternateFileName="XOLHOS~1.BMP")) returned 1
	[0133.537] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0133.537] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="xOLhos_mwzng6.bmp") returned -1
	[0133.537] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="xOLhos_mwzng6.bmp") returned -1
	[0133.537] lstrcmpiA (lpString1="", lpString2="xOLhos_mwzng6.bmp") returned -1
	[0133.537] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\vRnOCwc0byMIsUzh3P6P.odt") returned="vRnOCwc0byMIsUzh3P6P.odt"
	[0133.537] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\"
	[0133.537] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned=""
	[0133.537] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.537] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\how-to-decrypt-files.htm")) returned 0x20
	[0133.537] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="xOLhos_mwzng6.bmp" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\xOLhos_mwzng6.bmp") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\xOLhos_mwzng6.bmp"
	[0133.537] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\xOLhos_mwzng6.bmp", pszSpec="*.zip") returned 0
	[0133.537] lstrlenA (lpString="*.zip") returned 5
	[0133.537] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\xOLhos_mwzng6.bmp", pszSpec="*.rar") returned 0
	[0133.537] lstrlenA (lpString="*.rar") returned 5
	[0133.537] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\xOLhos_mwzng6.bmp", pszSpec="*.7z") returned 0
	[0133.537] lstrlenA (lpString="*.7z") returned 4
	[0133.537] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\xOLhos_mwzng6.bmp", pszSpec="*.tar") returned 0
	[0133.537] lstrlenA (lpString="*.tar") returned 5
	[0133.538] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\xOLhos_mwzng6.bmp", pszSpec="*.gzip") returned 0
	[0133.538] lstrlenA (lpString="*.gzip") returned 6
	[0133.538] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\xOLhos_mwzng6.bmp", pszSpec="*.jpg") returned 0
	[0133.538] lstrlenA (lpString="*.jpg") returned 5
	[0133.538] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\xOLhos_mwzng6.bmp", pszSpec="*.jpeg") returned 0
	[0133.538] lstrlenA (lpString="*.jpeg") returned 6
	[0133.538] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\xOLhos_mwzng6.bmp", pszSpec="*.bmp") returned 1
	[0133.538] lstrlenA (lpString="*.bmp") returned 5
	[0133.538] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\xOLhos_mwzng6.bmp" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\xOLhos_mwzng6.bmp") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\xOLhos_mwzng6.bmp"
	[0133.538] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\xOLhos_mwzng6.bmp" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\xOLhos_mwzng6.bmp") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\xOLhos_mwzng6.bmp"
	[0133.538] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\xOLhos_mwzng6.bmp", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\xOLhos_mwzng6.bmp.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\xOLhos_mwzng6.bmp."
	[0133.538] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\xOLhos_mwzng6.bmp.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\xOLhos_mwzng6.bmp.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\xOLhos_mwzng6.bmp.exe"
	[0133.538] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\xOLhos_mwzng6.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\xolhos_mwzng6.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0133.538] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1fe3
	[0133.538] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb494ea10, dwHighDateTime=0x1d4d2c7), lpLastAccessTime=0x407536*(dwLowDateTime=0x30a3fb20, dwHighDateTime=0x1d4c6aa), lpLastWriteTime=0x40753e*(dwLowDateTime=0x30a3fb20, dwHighDateTime=0x1d4c6aa)) returned 1
	[0133.538] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.538] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1fa1, lpOverlapped=0x0) returned 1
	[0133.540] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\xOLhos_mwzng6.bmp") returned="xOLhos_mwzng6.bmp"
	[0133.540] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.540] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1fa1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1fa1, lpOverlapped=0x0) returned 1
	[0133.540] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.540] CloseHandle (hObject=0x210) returned 1
	[0133.540] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\xOLhos_mwzng6.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\xolhos_mwzng6.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\xOLhos_mwzng6.bmp.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\xolhos_mwzng6.bmp.exe")) returned 1
	[0133.541] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe76527f0, ftCreationTime.dwHighDateTime=0x1d4d477, ftLastAccessTime.dwLowDateTime=0xefc3f850, ftLastAccessTime.dwHighDateTime=0x1d4c6f2, ftLastWriteTime.dwLowDateTime=0xefc3f850, ftLastWriteTime.dwHighDateTime=0x1d4c6f2, nFileSizeHigh=0x0, nFileSizeLow=0xba70, dwReserved0=0x1f, dwReserved1=0x1, cFileName="XP3bosg.doc", cAlternateFileName="")) returned 1
	[0133.541] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0133.541] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="XP3bosg.doc") returned -1
	[0133.541] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="XP3bosg.doc") returned -1
	[0133.541] lstrcmpiA (lpString1="", lpString2="XP3bosg.doc") returned -1
	[0133.541] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\xOLhos_mwzng6.bmp") returned="xOLhos_mwzng6.bmp"
	[0133.541] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\"
	[0133.541] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned=""
	[0133.541] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.541] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\how-to-decrypt-files.htm")) returned 0x20
	[0133.541] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="XP3bosg.doc" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\XP3bosg.doc") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\XP3bosg.doc"
	[0133.541] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\XP3bosg.doc", pszSpec="*.zip") returned 0
	[0133.541] lstrlenA (lpString="*.zip") returned 5
	[0133.541] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\XP3bosg.doc", pszSpec="*.rar") returned 0
	[0133.541] lstrlenA (lpString="*.rar") returned 5
	[0133.541] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\XP3bosg.doc", pszSpec="*.7z") returned 0
	[0133.541] lstrlenA (lpString="*.7z") returned 4
	[0133.541] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\XP3bosg.doc", pszSpec="*.tar") returned 0
	[0133.541] lstrlenA (lpString="*.tar") returned 5
	[0133.541] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\XP3bosg.doc", pszSpec="*.gzip") returned 0
	[0133.541] lstrlenA (lpString="*.gzip") returned 6
	[0133.541] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\XP3bosg.doc", pszSpec="*.jpg") returned 0
	[0133.541] lstrlenA (lpString="*.jpg") returned 5
	[0133.541] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\XP3bosg.doc", pszSpec="*.jpeg") returned 0
	[0133.541] lstrlenA (lpString="*.jpeg") returned 6
	[0133.541] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\XP3bosg.doc", pszSpec="*.bmp") returned 0
	[0133.541] lstrlenA (lpString="*.bmp") returned 5
	[0133.541] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\XP3bosg.doc", pszSpec="*.gif") returned 0
	[0133.541] lstrlenA (lpString="*.gif") returned 5
	[0133.542] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\XP3bosg.doc", pszSpec="*.png") returned 0
	[0133.542] lstrlenA (lpString="*.png") returned 5
	[0133.542] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\XP3bosg.doc", pszSpec="*.doc") returned 1
	[0133.542] lstrlenA (lpString="*.doc") returned 5
	[0133.542] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\XP3bosg.doc" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\XP3bosg.doc") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\XP3bosg.doc"
	[0133.542] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\XP3bosg.doc" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\XP3bosg.doc") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\XP3bosg.doc"
	[0133.542] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\XP3bosg.doc", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\XP3bosg.doc.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\XP3bosg.doc."
	[0133.542] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\XP3bosg.doc.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\XP3bosg.doc.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\XP3bosg.doc.exe"
	[0133.542] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\XP3bosg.doc" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\xp3bosg.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0133.542] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xba70
	[0133.542] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe76527f0, dwHighDateTime=0x1d4d477), lpLastAccessTime=0x407536*(dwLowDateTime=0xefc3f850, dwHighDateTime=0x1d4c6f2), lpLastWriteTime=0x40753e*(dwLowDateTime=0xefc3f850, dwHighDateTime=0x1d4c6f2)) returned 1
	[0133.542] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.542] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xba2e, lpOverlapped=0x0) returned 1
	[0133.543] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\XP3bosg.doc") returned="XP3bosg.doc"
	[0133.543] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.543] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xba2e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xba2e, lpOverlapped=0x0) returned 1
	[0133.544] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.544] CloseHandle (hObject=0x210) returned 1
	[0133.544] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\XP3bosg.doc" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\xp3bosg.doc"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\XP3bosg.doc.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\xp3bosg.doc.exe")) returned 1
	[0133.544] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f271090, ftCreationTime.dwHighDateTime=0x1d4cbb7, ftLastAccessTime.dwLowDateTime=0xdb2255a0, ftLastAccessTime.dwHighDateTime=0x1d4c7dc, ftLastWriteTime.dwLowDateTime=0xdb2255a0, ftLastWriteTime.dwHighDateTime=0x1d4c7dc, nFileSizeHigh=0x0, nFileSizeLow=0xcc2c, dwReserved0=0x15, dwReserved1=0x1, cFileName="Y47wkBjpf pm.mkv", cAlternateFileName="Y47WKB~1.MKV")) returned 1
	[0133.544] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0133.544] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Y47wkBjpf pm.mkv") returned -1
	[0133.544] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Y47wkBjpf pm.mkv") returned -1
	[0133.544] lstrcmpiA (lpString1="", lpString2="Y47wkBjpf pm.mkv") returned -1
	[0133.544] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\XP3bosg.doc") returned="XP3bosg.doc"
	[0133.544] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\"
	[0133.545] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned=""
	[0133.545] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.545] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\how-to-decrypt-files.htm")) returned 0x20
	[0133.545] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Y47wkBjpf pm.mkv" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv"
	[0133.545] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv", pszSpec="*.zip") returned 0
	[0133.545] lstrlenA (lpString="*.zip") returned 5
	[0133.545] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv", pszSpec="*.rar") returned 0
	[0133.545] lstrlenA (lpString="*.rar") returned 5
	[0133.545] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv", pszSpec="*.7z") returned 0
	[0133.545] lstrlenA (lpString="*.7z") returned 4
	[0133.545] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv", pszSpec="*.tar") returned 0
	[0133.545] lstrlenA (lpString="*.tar") returned 5
	[0133.545] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv", pszSpec="*.gzip") returned 0
	[0133.545] lstrlenA (lpString="*.gzip") returned 6
	[0133.545] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv", pszSpec="*.jpg") returned 0
	[0133.545] lstrlenA (lpString="*.jpg") returned 5
	[0133.545] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv", pszSpec="*.jpeg") returned 0
	[0133.545] lstrlenA (lpString="*.jpeg") returned 6
	[0133.545] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv", pszSpec="*.bmp") returned 0
	[0133.547] lstrlenA (lpString="*.bmp") returned 5
	[0133.547] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv", pszSpec="*.gif") returned 0
	[0133.547] lstrlenA (lpString="*.gif") returned 5
	[0133.547] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv", pszSpec="*.png") returned 0
	[0133.547] lstrlenA (lpString="*.png") returned 5
	[0133.547] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv", pszSpec="*.doc") returned 0
	[0133.547] lstrlenA (lpString="*.doc") returned 5
	[0133.547] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv", pszSpec="*.docx") returned 0
	[0133.547] lstrlenA (lpString="*.docx") returned 6
	[0133.547] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv", pszSpec="*.xls") returned 0
	[0133.547] lstrlenA (lpString="*.xls") returned 5
	[0133.547] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv", pszSpec="*.xlsx") returned 0
	[0133.547] lstrlenA (lpString="*.xlsx") returned 6
	[0133.547] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv", pszSpec="*.ppt") returned 0
	[0133.547] lstrlenA (lpString="*.ppt") returned 5
	[0133.547] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv", pszSpec="*.pptx") returned 0
	[0133.547] lstrlenA (lpString="*.pptx") returned 6
	[0133.547] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv", pszSpec="*.txt") returned 0
	[0133.547] lstrlenA (lpString="*.txt") returned 5
	[0133.547] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv", pszSpec="*.pdf") returned 0
	[0133.547] lstrlenA (lpString="*.pdf") returned 5
	[0133.547] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv", pszSpec="*.htm") returned 0
	[0133.547] lstrlenA (lpString="*.htm") returned 5
	[0133.547] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv", pszSpec="*.html") returned 0
	[0133.547] lstrlenA (lpString="*.html") returned 6
	[0133.547] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv", pszSpec="*.mdb") returned 0
	[0133.547] lstrlenA (lpString="*.mdb") returned 5
	[0133.547] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv", pszSpec="*.pfx") returned 0
	[0133.547] lstrlenA (lpString="*.pfx") returned 5
	[0133.547] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv", pszSpec="*.md") returned 0
	[0133.547] lstrlenA (lpString="*.md") returned 4
	[0133.547] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv", pszSpec="*.lnk") returned 0
	[0133.547] lstrlenA (lpString="*.lnk") returned 5
	[0133.548] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv", pszSpec="*.torrent") returned 0
	[0133.548] lstrlenA (lpString="*.torrent") returned 9
	[0133.548] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv", pszSpec="*.mov") returned 0
	[0133.548] lstrlenA (lpString="*.mov") returned 5
	[0133.548] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv", pszSpec="*.3gp") returned 0
	[0133.548] lstrlenA (lpString="*.3gp") returned 5
	[0133.548] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv", pszSpec="*.mpeg") returned 0
	[0133.548] lstrlenA (lpString="*.mpeg") returned 6
	[0133.548] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv", pszSpec="*.mpg") returned 0
	[0133.548] lstrlenA (lpString="*.mpg") returned 5
	[0133.548] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv", pszSpec="*.flv") returned 0
	[0133.548] lstrlenA (lpString="*.flv") returned 5
	[0133.548] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv", pszSpec="*.avi") returned 0
	[0133.548] lstrlenA (lpString="*.avi") returned 5
	[0133.548] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv", pszSpec="*.mp4") returned 0
	[0133.548] lstrlenA (lpString="*.mp4") returned 5
	[0133.548] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv", pszSpec="*.wmv") returned 0
	[0133.548] lstrlenA (lpString="*.wmv") returned 5
	[0133.548] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv", pszSpec="*.mkv") returned 1
	[0133.548] lstrlenA (lpString="*.mkv") returned 5
	[0133.548] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv"
	[0133.548] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv"
	[0133.548] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv."
	[0133.548] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv.exe"
	[0133.548] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\y47wkbjpf pm.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0133.549] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcc2c
	[0133.549] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x2f271090, dwHighDateTime=0x1d4cbb7), lpLastAccessTime=0x407536*(dwLowDateTime=0xdb2255a0, dwHighDateTime=0x1d4c7dc), lpLastWriteTime=0x40753e*(dwLowDateTime=0xdb2255a0, dwHighDateTime=0x1d4c7dc)) returned 1
	[0133.549] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.549] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xcbea, lpOverlapped=0x0) returned 1
	[0133.550] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv") returned="Y47wkBjpf pm.mkv"
	[0133.550] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.550] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xcbea, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xcbea, lpOverlapped=0x0) returned 1
	[0133.550] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.550] CloseHandle (hObject=0x210) returned 1
	[0133.550] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\y47wkbjpf pm.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\y47wkbjpf pm.mkv.exe")) returned 1
	[0133.551] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x608d1b90, ftCreationTime.dwHighDateTime=0x1d4d092, ftLastAccessTime.dwLowDateTime=0xa58bae20, ftLastAccessTime.dwHighDateTime=0x1d4caf5, ftLastWriteTime.dwLowDateTime=0xa58bae20, ftLastWriteTime.dwHighDateTime=0x1d4caf5, nFileSizeHigh=0x0, nFileSizeLow=0xae65, dwReserved0=0x0, dwReserved1=0x1, cFileName="YFjKe_hsRAlrX4nS.mp4", cAlternateFileName="YFJKE_~1.MP4")) returned 1
	[0133.551] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0133.551] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="YFjKe_hsRAlrX4nS.mp4") returned -1
	[0133.551] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="YFjKe_hsRAlrX4nS.mp4") returned -1
	[0133.551] lstrcmpiA (lpString1="", lpString2="YFjKe_hsRAlrX4nS.mp4") returned -1
	[0133.551] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Y47wkBjpf pm.mkv") returned="Y47wkBjpf pm.mkv"
	[0133.551] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\"
	[0133.551] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned=""
	[0133.551] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.551] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\how-to-decrypt-files.htm")) returned 0x20
	[0133.551] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="YFjKe_hsRAlrX4nS.mp4" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4"
	[0133.551] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4", pszSpec="*.zip") returned 0
	[0133.551] lstrlenA (lpString="*.zip") returned 5
	[0133.551] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4", pszSpec="*.rar") returned 0
	[0133.551] lstrlenA (lpString="*.rar") returned 5
	[0133.551] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4", pszSpec="*.7z") returned 0
	[0133.551] lstrlenA (lpString="*.7z") returned 4
	[0133.552] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4", pszSpec="*.tar") returned 0
	[0133.552] lstrlenA (lpString="*.tar") returned 5
	[0133.552] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4", pszSpec="*.gzip") returned 0
	[0133.552] lstrlenA (lpString="*.gzip") returned 6
	[0133.552] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4", pszSpec="*.jpg") returned 0
	[0133.552] lstrlenA (lpString="*.jpg") returned 5
	[0133.552] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4", pszSpec="*.jpeg") returned 0
	[0133.552] lstrlenA (lpString="*.jpeg") returned 6
	[0133.552] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4", pszSpec="*.bmp") returned 0
	[0133.552] lstrlenA (lpString="*.bmp") returned 5
	[0133.552] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4", pszSpec="*.gif") returned 0
	[0133.552] lstrlenA (lpString="*.gif") returned 5
	[0133.552] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4", pszSpec="*.png") returned 0
	[0133.552] lstrlenA (lpString="*.png") returned 5
	[0133.552] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4", pszSpec="*.doc") returned 0
	[0133.552] lstrlenA (lpString="*.doc") returned 5
	[0133.552] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4", pszSpec="*.docx") returned 0
	[0133.552] lstrlenA (lpString="*.docx") returned 6
	[0133.552] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4", pszSpec="*.xls") returned 0
	[0133.552] lstrlenA (lpString="*.xls") returned 5
	[0133.552] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4", pszSpec="*.xlsx") returned 0
	[0133.552] lstrlenA (lpString="*.xlsx") returned 6
	[0133.552] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4", pszSpec="*.ppt") returned 0
	[0133.552] lstrlenA (lpString="*.ppt") returned 5
	[0133.552] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4", pszSpec="*.pptx") returned 0
	[0133.552] lstrlenA (lpString="*.pptx") returned 6
	[0133.552] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4", pszSpec="*.txt") returned 0
	[0133.552] lstrlenA (lpString="*.txt") returned 5
	[0133.552] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4", pszSpec="*.pdf") returned 0
	[0133.552] lstrlenA (lpString="*.pdf") returned 5
	[0133.552] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4", pszSpec="*.htm") returned 0
	[0133.552] lstrlenA (lpString="*.htm") returned 5
	[0133.552] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4", pszSpec="*.html") returned 0
	[0133.552] lstrlenA (lpString="*.html") returned 6
	[0133.552] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4", pszSpec="*.mdb") returned 0
	[0133.552] lstrlenA (lpString="*.mdb") returned 5
	[0133.553] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4", pszSpec="*.pfx") returned 0
	[0133.553] lstrlenA (lpString="*.pfx") returned 5
	[0133.553] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4", pszSpec="*.md") returned 0
	[0133.553] lstrlenA (lpString="*.md") returned 4
	[0133.553] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4", pszSpec="*.lnk") returned 0
	[0133.553] lstrlenA (lpString="*.lnk") returned 5
	[0133.553] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4", pszSpec="*.torrent") returned 0
	[0133.553] lstrlenA (lpString="*.torrent") returned 9
	[0133.553] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4", pszSpec="*.mov") returned 0
	[0133.553] lstrlenA (lpString="*.mov") returned 5
	[0133.553] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4", pszSpec="*.3gp") returned 0
	[0133.553] lstrlenA (lpString="*.3gp") returned 5
	[0133.553] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4", pszSpec="*.mpeg") returned 0
	[0133.553] lstrlenA (lpString="*.mpeg") returned 6
	[0133.553] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4", pszSpec="*.mpg") returned 0
	[0133.553] lstrlenA (lpString="*.mpg") returned 5
	[0133.553] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4", pszSpec="*.flv") returned 0
	[0133.553] lstrlenA (lpString="*.flv") returned 5
	[0133.553] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4", pszSpec="*.avi") returned 0
	[0133.553] lstrlenA (lpString="*.avi") returned 5
	[0133.553] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4", pszSpec="*.mp4") returned 1
	[0133.553] lstrlenA (lpString="*.mp4") returned 5
	[0133.553] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4"
	[0133.553] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4"
	[0133.553] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4."
	[0133.553] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4.exe"
	[0133.553] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\yfjke_hsralrx4ns.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0133.554] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae65
	[0133.554] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x608d1b90, dwHighDateTime=0x1d4d092), lpLastAccessTime=0x407536*(dwLowDateTime=0xa58bae20, dwHighDateTime=0x1d4caf5), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa58bae20, dwHighDateTime=0x1d4caf5)) returned 1
	[0133.554] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.554] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xae23, lpOverlapped=0x0) returned 1
	[0133.555] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4") returned="YFjKe_hsRAlrX4nS.mp4"
	[0133.555] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.555] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xae23, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xae23, lpOverlapped=0x0) returned 1
	[0133.555] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.555] CloseHandle (hObject=0x210) returned 1
	[0133.555] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\yfjke_hsralrx4ns.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\yfjke_hsralrx4ns.mp4.exe")) returned 1
	[0133.556] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21c3cf80, ftCreationTime.dwHighDateTime=0x1d4d367, ftLastAccessTime.dwLowDateTime=0xc013f5f0, ftLastAccessTime.dwHighDateTime=0x1d4ca13, ftLastWriteTime.dwLowDateTime=0xc013f5f0, ftLastWriteTime.dwHighDateTime=0x1d4ca13, nFileSizeHigh=0x0, nFileSizeLow=0xf0e3, dwReserved0=0x1c, dwReserved1=0x1, cFileName="_cJdisVTcJibh-qJG0V6.pptx", cAlternateFileName="_CJDIS~1.PPT")) returned 1
	[0133.556] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0133.556] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="_cJdisVTcJibh-qJG0V6.pptx") returned 1
	[0133.556] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="_cJdisVTcJibh-qJG0V6.pptx") returned 1
	[0133.556] lstrcmpiA (lpString1="", lpString2="_cJdisVTcJibh-qJG0V6.pptx") returned -1
	[0133.556] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\YFjKe_hsRAlrX4nS.mp4") returned="YFjKe_hsRAlrX4nS.mp4"
	[0133.556] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\"
	[0133.556] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned=""
	[0133.556] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.556] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\how-to-decrypt-files.htm")) returned 0x20
	[0133.556] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="_cJdisVTcJibh-qJG0V6.pptx" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\_cJdisVTcJibh-qJG0V6.pptx") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\_cJdisVTcJibh-qJG0V6.pptx"
	[0133.556] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\_cJdisVTcJibh-qJG0V6.pptx", pszSpec="*.zip") returned 0
	[0133.556] lstrlenA (lpString="*.zip") returned 5
	[0133.556] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\_cJdisVTcJibh-qJG0V6.pptx", pszSpec="*.rar") returned 0
	[0133.556] lstrlenA (lpString="*.rar") returned 5
	[0133.556] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\_cJdisVTcJibh-qJG0V6.pptx", pszSpec="*.7z") returned 0
	[0133.556] lstrlenA (lpString="*.7z") returned 4
	[0133.557] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\_cJdisVTcJibh-qJG0V6.pptx", pszSpec="*.tar") returned 0
	[0133.557] lstrlenA (lpString="*.tar") returned 5
	[0133.557] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\_cJdisVTcJibh-qJG0V6.pptx", pszSpec="*.gzip") returned 0
	[0133.557] lstrlenA (lpString="*.gzip") returned 6
	[0133.557] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\_cJdisVTcJibh-qJG0V6.pptx", pszSpec="*.jpg") returned 0
	[0133.557] lstrlenA (lpString="*.jpg") returned 5
	[0133.557] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\_cJdisVTcJibh-qJG0V6.pptx", pszSpec="*.jpeg") returned 0
	[0133.557] lstrlenA (lpString="*.jpeg") returned 6
	[0133.557] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\_cJdisVTcJibh-qJG0V6.pptx", pszSpec="*.bmp") returned 0
	[0133.557] lstrlenA (lpString="*.bmp") returned 5
	[0133.557] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\_cJdisVTcJibh-qJG0V6.pptx", pszSpec="*.gif") returned 0
	[0133.557] lstrlenA (lpString="*.gif") returned 5
	[0133.557] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\_cJdisVTcJibh-qJG0V6.pptx", pszSpec="*.png") returned 0
	[0133.557] lstrlenA (lpString="*.png") returned 5
	[0133.557] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\_cJdisVTcJibh-qJG0V6.pptx", pszSpec="*.doc") returned 0
	[0133.557] lstrlenA (lpString="*.doc") returned 5
	[0133.557] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\_cJdisVTcJibh-qJG0V6.pptx", pszSpec="*.docx") returned 0
	[0133.557] lstrlenA (lpString="*.docx") returned 6
	[0133.557] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\_cJdisVTcJibh-qJG0V6.pptx", pszSpec="*.xls") returned 0
	[0133.557] lstrlenA (lpString="*.xls") returned 5
	[0133.557] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\_cJdisVTcJibh-qJG0V6.pptx", pszSpec="*.xlsx") returned 0
	[0133.557] lstrlenA (lpString="*.xlsx") returned 6
	[0133.557] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\_cJdisVTcJibh-qJG0V6.pptx", pszSpec="*.ppt") returned 0
	[0133.557] lstrlenA (lpString="*.ppt") returned 5
	[0133.557] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\_cJdisVTcJibh-qJG0V6.pptx", pszSpec="*.pptx") returned 1
	[0133.557] lstrlenA (lpString="*.pptx") returned 6
	[0133.557] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\_cJdisVTcJibh-qJG0V6.pptx" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\_cJdisVTcJibh-qJG0V6.pptx") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\_cJdisVTcJibh-qJG0V6.pptx"
	[0133.557] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\_cJdisVTcJibh-qJG0V6.pptx" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\_cJdisVTcJibh-qJG0V6.pptx") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\_cJdisVTcJibh-qJG0V6.pptx"
	[0133.557] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\_cJdisVTcJibh-qJG0V6.pptx", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\_cJdisVTcJibh-qJG0V6.pptx.") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\_cJdisVTcJibh-qJG0V6.pptx."
	[0133.557] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\_cJdisVTcJibh-qJG0V6.pptx.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\_cJdisVTcJibh-qJG0V6.pptx.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\_cJdisVTcJibh-qJG0V6.pptx.exe"
	[0133.557] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\_cJdisVTcJibh-qJG0V6.pptx" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\_cjdisvtcjibh-qjg0v6.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0133.558] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf0e3
	[0133.558] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x21c3cf80, dwHighDateTime=0x1d4d367), lpLastAccessTime=0x407536*(dwLowDateTime=0xc013f5f0, dwHighDateTime=0x1d4ca13), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc013f5f0, dwHighDateTime=0x1d4ca13)) returned 1
	[0133.558] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.558] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xf0a1, lpOverlapped=0x0) returned 1
	[0133.559] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\_cJdisVTcJibh-qJG0V6.pptx") returned="_cJdisVTcJibh-qJG0V6.pptx"
	[0133.559] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.559] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xf0a1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xf0a1, lpOverlapped=0x0) returned 1
	[0133.559] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.559] CloseHandle (hObject=0x210) returned 1
	[0133.560] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\_cJdisVTcJibh-qJG0V6.pptx" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\_cjdisvtcjibh-qjg0v6.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\_cJdisVTcJibh-qJG0V6.pptx.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\_cjdisvtcjibh-qjg0v6.pptx.exe")) returned 1
	[0133.560] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21c3cf80, ftCreationTime.dwHighDateTime=0x1d4d367, ftLastAccessTime.dwLowDateTime=0xc013f5f0, ftLastAccessTime.dwHighDateTime=0x1d4ca13, ftLastWriteTime.dwLowDateTime=0xc013f5f0, ftLastWriteTime.dwHighDateTime=0x1d4ca13, nFileSizeHigh=0x0, nFileSizeLow=0xf0e3, dwReserved0=0x1c, dwReserved1=0x1, cFileName="_cJdisVTcJibh-qJG0V6.pptx", cAlternateFileName="_CJDIS~1.PPT")) returned 0
	[0133.560] FindClose (in: hFindFile=0x7cb5d0 | out: hFindFile=0x7cb5d0) returned 1
	[0133.560] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x11957edc, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x11957edc, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790065, dwReserved1=0x797765, cFileName="Roaming", cAlternateFileName="")) returned 0
	[0133.560] FindClose (in: hFindFile=0x7cb6d0 | out: hFindFile=0x7cb6d0) returned 1
	[0133.560] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x58, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0133.560] lstrcmpA (lpString1=".", lpString2="Application Data") returned -1
	[0133.560] lstrcmpA (lpString1="..", lpString2="Application Data") returned -1
	[0133.560] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\*.*") returned="*.*"
	[0133.560] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Application Data" | out: lpString1="C:\\Users\\FD1HVy\\Application Data") returned="C:\\Users\\FD1HVy\\Application Data"
	[0133.561] lstrlenA (lpString="C:\\Users\\FD1HVy\\Application Data") returned 32
	[0133.561] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Application Data\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x11957edc, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x11957edc, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790065, dwReserved1=0x797765, cFileName="Roaming", cAlternateFileName="\xcc\xff\x19")) returned 0xffffffff
	[0133.561] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x58, cFileName="Contacts", cAlternateFileName="")) returned 1
	[0133.561] lstrcmpA (lpString1=".", lpString2="Contacts") returned -1
	[0133.561] lstrcmpA (lpString1="..", lpString2="Contacts") returned -1
	[0133.561] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\*.*") returned="*.*"
	[0133.561] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Contacts" | out: lpString1="C:\\Users\\FD1HVy\\Contacts") returned="C:\\Users\\FD1HVy\\Contacts"
	[0133.561] lstrlenA (lpString="C:\\Users\\FD1HVy\\Contacts") returned 24
	[0133.561] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Contacts\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0260, dwReserved1=0x1000000, cFileName=".", cAlternateFileName="")) returned 0x7cbb90
	[0133.561] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.561] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0260, dwReserved1=0x1000000, cFileName="..", cAlternateFileName="")) returned 1
	[0133.561] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.561] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.561] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x7b0260, dwReserved1=0x1000000, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0133.561] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0133.562] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="desktop.ini") returned 1
	[0133.562] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="desktop.ini") returned 1
	[0133.562] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1
	[0133.562] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Contacts\\*.*") returned="*.*"
	[0133.562] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Contacts\\" | out: lpString1="C:\\Users\\FD1HVy\\Contacts\\") returned="C:\\Users\\FD1HVy\\Contacts\\"
	[0133.562] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Contacts\\" | out: pszPath="C:\\Users\\FD1HVy\\Contacts\\") returned=""
	[0133.562] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Contacts\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Contacts\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Contacts\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.562] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Contacts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\contacts\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0133.562] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Contacts\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\contacts\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0133.563] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0133.563] WriteFile (in: hFile=0x20c, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0133.563] SetFileTime (hFile=0x20c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0133.563] CloseHandle (hObject=0x20c) returned 1
	[0133.564] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Contacts\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Contacts\\desktop.ini") returned="C:\\Users\\FD1HVy\\Contacts\\desktop.ini"
	[0133.564] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.zip") returned 0
	[0133.564] lstrlenA (lpString="*.zip") returned 5
	[0133.564] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.rar") returned 0
	[0133.564] lstrlenA (lpString="*.rar") returned 5
	[0133.564] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.7z") returned 0
	[0133.564] lstrlenA (lpString="*.7z") returned 4
	[0133.564] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.tar") returned 0
	[0133.564] lstrlenA (lpString="*.tar") returned 5
	[0133.564] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.gzip") returned 0
	[0133.564] lstrlenA (lpString="*.gzip") returned 6
	[0133.564] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.jpg") returned 0
	[0133.564] lstrlenA (lpString="*.jpg") returned 5
	[0133.564] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.jpeg") returned 0
	[0133.564] lstrlenA (lpString="*.jpeg") returned 6
	[0133.564] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.bmp") returned 0
	[0133.564] lstrlenA (lpString="*.bmp") returned 5
	[0133.564] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.gif") returned 0
	[0133.564] lstrlenA (lpString="*.gif") returned 5
	[0133.564] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.png") returned 0
	[0133.564] lstrlenA (lpString="*.png") returned 5
	[0133.564] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.doc") returned 0
	[0133.564] lstrlenA (lpString="*.doc") returned 5
	[0133.564] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.docx") returned 0
	[0133.564] lstrlenA (lpString="*.docx") returned 6
	[0133.564] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.xls") returned 0
	[0133.564] lstrlenA (lpString="*.xls") returned 5
	[0133.564] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.xlsx") returned 0
	[0133.564] lstrlenA (lpString="*.xlsx") returned 6
	[0133.564] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.ppt") returned 0
	[0133.564] lstrlenA (lpString="*.ppt") returned 5
	[0133.564] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.pptx") returned 0
	[0133.564] lstrlenA (lpString="*.pptx") returned 6
	[0133.564] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.txt") returned 0
	[0133.565] lstrlenA (lpString="*.txt") returned 5
	[0133.565] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.pdf") returned 0
	[0133.565] lstrlenA (lpString="*.pdf") returned 5
	[0133.565] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.htm") returned 0
	[0133.565] lstrlenA (lpString="*.htm") returned 5
	[0133.565] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.html") returned 0
	[0133.565] lstrlenA (lpString="*.html") returned 6
	[0133.565] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.mdb") returned 0
	[0133.565] lstrlenA (lpString="*.mdb") returned 5
	[0133.565] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.pfx") returned 0
	[0133.565] lstrlenA (lpString="*.pfx") returned 5
	[0133.565] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.md") returned 0
	[0133.565] lstrlenA (lpString="*.md") returned 4
	[0133.565] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.lnk") returned 0
	[0133.565] lstrlenA (lpString="*.lnk") returned 5
	[0133.565] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.torrent") returned 0
	[0133.565] lstrlenA (lpString="*.torrent") returned 9
	[0133.565] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.mov") returned 0
	[0133.565] lstrlenA (lpString="*.mov") returned 5
	[0133.565] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.3gp") returned 0
	[0133.565] lstrlenA (lpString="*.3gp") returned 5
	[0133.565] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.mpeg") returned 0
	[0133.565] lstrlenA (lpString="*.mpeg") returned 6
	[0133.565] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.mpg") returned 0
	[0133.565] lstrlenA (lpString="*.mpg") returned 5
	[0133.565] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.flv") returned 0
	[0133.565] lstrlenA (lpString="*.flv") returned 5
	[0133.565] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.avi") returned 0
	[0133.565] lstrlenA (lpString="*.avi") returned 5
	[0133.565] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.mp4") returned 0
	[0133.565] lstrlenA (lpString="*.mp4") returned 5
	[0133.565] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.wmv") returned 0
	[0133.565] lstrlenA (lpString="*.wmv") returned 5
	[0133.565] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.mkv") returned 0
	[0133.565] lstrlenA (lpString="*.mkv") returned 5
	[0133.565] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.mp3") returned 0
	[0133.566] lstrlenA (lpString="*.mp3") returned 5
	[0133.566] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.wav") returned 0
	[0133.566] lstrlenA (lpString="*.wav") returned 5
	[0133.566] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.flac") returned 0
	[0133.566] lstrlenA (lpString="*.flac") returned 6
	[0133.566] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.wma") returned 0
	[0133.566] lstrlenA (lpString="*.wma") returned 5
	[0133.566] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.au3") returned 0
	[0133.566] lstrlenA (lpString="*.au3") returned 5
	[0133.566] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.ahk") returned 0
	[0133.566] lstrlenA (lpString="*.ahk") returned 5
	[0133.566] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.c") returned 0
	[0133.566] lstrlenA (lpString="*.c") returned 3
	[0133.566] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.cc") returned 0
	[0133.566] lstrlenA (lpString="*.cc") returned 4
	[0133.566] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.cpp") returned 0
	[0133.566] lstrlenA (lpString="*.cpp") returned 5
	[0133.566] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.cxx") returned 0
	[0133.566] lstrlenA (lpString="*.cxx") returned 5
	[0133.566] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.c++") returned 0
	[0133.566] lstrlenA (lpString="*.c++") returned 5
	[0133.566] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.cs") returned 0
	[0133.566] lstrlenA (lpString="*.cs") returned 4
	[0133.566] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.vb") returned 0
	[0133.566] lstrlenA (lpString="*.vb") returned 4
	[0133.566] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.bas") returned 0
	[0133.566] lstrlenA (lpString="*.bas") returned 5
	[0133.566] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.csproj") returned 0
	[0133.566] lstrlenA (lpString="*.csproj") returned 8
	[0133.566] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.vbproj") returned 0
	[0133.566] lstrlenA (lpString="*.vbproj") returned 8
	[0133.566] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.vcxproj") returned 0
	[0133.566] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.566] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.manifest") returned 0
	[0133.566] lstrlenA (lpString="*.manifest") returned 10
	[0133.566] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.php") returned 0
	[0133.567] lstrlenA (lpString="*.php") returned 5
	[0133.567] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.vbe") returned 0
	[0133.567] lstrlenA (lpString="*.vbe") returned 5
	[0133.567] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.vba") returned 0
	[0133.567] lstrlenA (lpString="*.vba") returned 5
	[0133.567] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.vbs") returned 0
	[0133.567] lstrlenA (lpString="*.vbs") returned 5
	[0133.567] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.bat") returned 0
	[0133.567] lstrlenA (lpString="*.bat") returned 5
	[0133.567] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.cmd") returned 0
	[0133.567] lstrlenA (lpString="*.cmd") returned 5
	[0133.567] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.js") returned 0
	[0133.567] lstrlenA (lpString="*.js") returned 4
	[0133.567] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.jscript") returned 0
	[0133.567] lstrlenA (lpString="*.jscript") returned 9
	[0133.567] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.hta") returned 0
	[0133.567] lstrlenA (lpString="*.hta") returned 5
	[0133.567] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.php7") returned 0
	[0133.567] lstrlenA (lpString="*.php7") returned 6
	[0133.567] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.db") returned 0
	[0133.567] lstrlenA (lpString="*.db") returned 4
	[0133.567] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.swf") returned 0
	[0133.567] lstrlenA (lpString="*.swf") returned 5
	[0133.567] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.eml") returned 0
	[0133.567] lstrlenA (lpString="*.eml") returned 5
	[0133.567] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.part") returned 0
	[0133.567] lstrlenA (lpString="*.part") returned 6
	[0133.567] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.nfo") returned 0
	[0133.567] lstrlenA (lpString="*.nfo") returned 5
	[0133.567] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.rsa") returned 0
	[0133.567] lstrlenA (lpString="*.rsa") returned 5
	[0133.567] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.key") returned 0
	[0133.567] lstrlenA (lpString="*.key") returned 5
	[0133.567] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.aes") returned 0
	[0133.567] lstrlenA (lpString="*.aes") returned 5
	[0133.567] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.blob") returned 0
	[0133.568] lstrlenA (lpString="*.blob") returned 6
	[0133.568] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.btc") returned 0
	[0133.568] lstrlenA (lpString="*.btc") returned 5
	[0133.568] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", pszSpec="*.wallet") returned 0
	[0133.568] lstrlenA (lpString="*.wallet") returned 8
	[0133.568] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x7b0260, dwReserved1=0x1000000, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0133.568] FindClose (in: hFindFile=0x7cbb90 | out: hFindFile=0x7cbb90) returned 1
	[0133.568] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1
	[0133.568] lstrcmpA (lpString1=".", lpString2="Cookies") returned -1
	[0133.568] lstrcmpA (lpString1="..", lpString2="Cookies") returned -1
	[0133.568] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\*.*") returned="*.*"
	[0133.568] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Cookies" | out: lpString1="C:\\Users\\FD1HVy\\Cookies") returned="C:\\Users\\FD1HVy\\Cookies"
	[0133.568] lstrlenA (lpString="C:\\Users\\FD1HVy\\Cookies") returned 23
	[0133.568] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Cookies\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x7b0260, dwReserved1=0x1000000, cFileName="desktop.ini", cAlternateFileName="\xcc\xff\x19")) returned 0xffffffff
	[0133.568] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x16eca1fb, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x16eca1fb, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1
	[0133.568] lstrcmpA (lpString1=".", lpString2="Desktop") returned -1
	[0133.568] lstrcmpA (lpString1="..", lpString2="Desktop") returned -1
	[0133.568] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\*.*") returned="*.*"
	[0133.568] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Desktop" | out: lpString1="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop"
	[0133.568] lstrlenA (lpString="C:\\Users\\FD1HVy\\Desktop") returned 23
	[0133.568] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x16eca1fb, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x16eca1fb, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x7cb5d0
	[0133.568] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.568] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x16eca1fb, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x16eca1fb, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1
	[0133.569] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.569] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.569] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f4b470, ftCreationTime.dwHighDateTime=0x1d4d0da, ftLastAccessTime.dwLowDateTime=0x7157ffb0, ftLastAccessTime.dwHighDateTime=0x1d4cc66, ftLastWriteTime.dwLowDateTime=0x7157ffb0, ftLastWriteTime.dwHighDateTime=0x1d4cc66, nFileSizeHigh=0x0, nFileSizeLow=0x7db6, dwReserved0=0x0, dwReserved1=0x1, cFileName="1oF_s.swf", cAlternateFileName="")) returned 1
	[0133.569] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0133.569] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="1oF_s.swf") returned 1
	[0133.569] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="1oF_s.swf") returned 1
	[0133.569] lstrcmpiA (lpString1="", lpString2="1oF_s.swf") returned -1
	[0133.569] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\*.*") returned="*.*"
	[0133.569] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0133.569] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0133.569] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.569] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0133.569] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0133.570] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0133.570] WriteFile (in: hFile=0x20c, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0133.571] SetFileTime (hFile=0x20c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0133.571] CloseHandle (hObject=0x20c) returned 1
	[0133.571] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="1oF_s.swf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf") returned="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf"
	[0133.571] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.zip") returned 0
	[0133.571] lstrlenA (lpString="*.zip") returned 5
	[0133.571] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.rar") returned 0
	[0133.571] lstrlenA (lpString="*.rar") returned 5
	[0133.571] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.7z") returned 0
	[0133.571] lstrlenA (lpString="*.7z") returned 4
	[0133.571] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.tar") returned 0
	[0133.571] lstrlenA (lpString="*.tar") returned 5
	[0133.572] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.gzip") returned 0
	[0133.572] lstrlenA (lpString="*.gzip") returned 6
	[0133.572] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.jpg") returned 0
	[0133.572] lstrlenA (lpString="*.jpg") returned 5
	[0133.572] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.jpeg") returned 0
	[0133.572] lstrlenA (lpString="*.jpeg") returned 6
	[0133.572] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.bmp") returned 0
	[0133.572] lstrlenA (lpString="*.bmp") returned 5
	[0133.572] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.gif") returned 0
	[0133.572] lstrlenA (lpString="*.gif") returned 5
	[0133.572] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.png") returned 0
	[0133.572] lstrlenA (lpString="*.png") returned 5
	[0133.572] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.doc") returned 0
	[0133.572] lstrlenA (lpString="*.doc") returned 5
	[0133.572] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.docx") returned 0
	[0133.572] lstrlenA (lpString="*.docx") returned 6
	[0133.572] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.xls") returned 0
	[0133.572] lstrlenA (lpString="*.xls") returned 5
	[0133.572] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.xlsx") returned 0
	[0133.572] lstrlenA (lpString="*.xlsx") returned 6
	[0133.572] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.ppt") returned 0
	[0133.572] lstrlenA (lpString="*.ppt") returned 5
	[0133.572] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.pptx") returned 0
	[0133.572] lstrlenA (lpString="*.pptx") returned 6
	[0133.572] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.txt") returned 0
	[0133.572] lstrlenA (lpString="*.txt") returned 5
	[0133.572] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.pdf") returned 0
	[0133.572] lstrlenA (lpString="*.pdf") returned 5
	[0133.572] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.htm") returned 0
	[0133.572] lstrlenA (lpString="*.htm") returned 5
	[0133.572] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.html") returned 0
	[0133.572] lstrlenA (lpString="*.html") returned 6
	[0133.572] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.mdb") returned 0
	[0133.572] lstrlenA (lpString="*.mdb") returned 5
	[0133.572] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.pfx") returned 0
	[0133.572] lstrlenA (lpString="*.pfx") returned 5
	[0133.573] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.md") returned 0
	[0133.573] lstrlenA (lpString="*.md") returned 4
	[0133.573] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.lnk") returned 0
	[0133.573] lstrlenA (lpString="*.lnk") returned 5
	[0133.573] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.torrent") returned 0
	[0133.573] lstrlenA (lpString="*.torrent") returned 9
	[0133.573] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.mov") returned 0
	[0133.573] lstrlenA (lpString="*.mov") returned 5
	[0133.573] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.3gp") returned 0
	[0133.573] lstrlenA (lpString="*.3gp") returned 5
	[0133.573] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.mpeg") returned 0
	[0133.573] lstrlenA (lpString="*.mpeg") returned 6
	[0133.573] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.mpg") returned 0
	[0133.573] lstrlenA (lpString="*.mpg") returned 5
	[0133.573] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.flv") returned 0
	[0133.573] lstrlenA (lpString="*.flv") returned 5
	[0133.573] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.avi") returned 0
	[0133.573] lstrlenA (lpString="*.avi") returned 5
	[0133.573] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.mp4") returned 0
	[0133.573] lstrlenA (lpString="*.mp4") returned 5
	[0133.573] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.wmv") returned 0
	[0133.573] lstrlenA (lpString="*.wmv") returned 5
	[0133.573] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.mkv") returned 0
	[0133.573] lstrlenA (lpString="*.mkv") returned 5
	[0133.573] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.mp3") returned 0
	[0133.573] lstrlenA (lpString="*.mp3") returned 5
	[0133.573] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.wav") returned 0
	[0133.573] lstrlenA (lpString="*.wav") returned 5
	[0133.573] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.flac") returned 0
	[0133.573] lstrlenA (lpString="*.flac") returned 6
	[0133.573] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.wma") returned 0
	[0133.573] lstrlenA (lpString="*.wma") returned 5
	[0133.573] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.au3") returned 0
	[0133.573] lstrlenA (lpString="*.au3") returned 5
	[0133.573] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.ahk") returned 0
	[0133.573] lstrlenA (lpString="*.ahk") returned 5
	[0133.574] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.c") returned 0
	[0133.574] lstrlenA (lpString="*.c") returned 3
	[0133.574] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.cc") returned 0
	[0133.574] lstrlenA (lpString="*.cc") returned 4
	[0133.574] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.cpp") returned 0
	[0133.574] lstrlenA (lpString="*.cpp") returned 5
	[0133.574] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.cxx") returned 0
	[0133.574] lstrlenA (lpString="*.cxx") returned 5
	[0133.574] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.c++") returned 0
	[0133.574] lstrlenA (lpString="*.c++") returned 5
	[0133.574] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.cs") returned 0
	[0133.574] lstrlenA (lpString="*.cs") returned 4
	[0133.574] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.vb") returned 0
	[0133.574] lstrlenA (lpString="*.vb") returned 4
	[0133.574] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.bas") returned 0
	[0133.574] lstrlenA (lpString="*.bas") returned 5
	[0133.574] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.csproj") returned 0
	[0133.574] lstrlenA (lpString="*.csproj") returned 8
	[0133.574] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.vbproj") returned 0
	[0133.574] lstrlenA (lpString="*.vbproj") returned 8
	[0133.574] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.vcxproj") returned 0
	[0133.574] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.574] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.manifest") returned 0
	[0133.574] lstrlenA (lpString="*.manifest") returned 10
	[0133.574] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.php") returned 0
	[0133.574] lstrlenA (lpString="*.php") returned 5
	[0133.574] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.vbe") returned 0
	[0133.574] lstrlenA (lpString="*.vbe") returned 5
	[0133.574] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.vba") returned 0
	[0133.574] lstrlenA (lpString="*.vba") returned 5
	[0133.574] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.vbs") returned 0
	[0133.574] lstrlenA (lpString="*.vbs") returned 5
	[0133.574] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.bat") returned 0
	[0133.574] lstrlenA (lpString="*.bat") returned 5
	[0133.574] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.cmd") returned 0
	[0133.574] lstrlenA (lpString="*.cmd") returned 5
	[0133.575] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.js") returned 0
	[0133.575] lstrlenA (lpString="*.js") returned 4
	[0133.575] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.jscript") returned 0
	[0133.575] lstrlenA (lpString="*.jscript") returned 9
	[0133.575] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.hta") returned 0
	[0133.575] lstrlenA (lpString="*.hta") returned 5
	[0133.575] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.php7") returned 0
	[0133.575] lstrlenA (lpString="*.php7") returned 6
	[0133.575] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.db") returned 0
	[0133.575] lstrlenA (lpString="*.db") returned 4
	[0133.575] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", pszSpec="*.swf") returned 1
	[0133.575] lstrlenA (lpString="*.swf") returned 5
	[0133.575] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf") returned="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf"
	[0133.575] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf") returned="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf"
	[0133.575] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf.") returned="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf."
	[0133.575] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf.exe") returned="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf.exe"
	[0133.575] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\1of_s.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0133.575] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7db6
	[0133.575] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x82f4b470, dwHighDateTime=0x1d4d0da), lpLastAccessTime=0x407536*(dwLowDateTime=0x7157ffb0, dwHighDateTime=0x1d4cc66), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7157ffb0, dwHighDateTime=0x1d4cc66)) returned 1
	[0133.575] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.575] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7d74, lpOverlapped=0x0) returned 1
	[0133.576] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf") returned="1oF_s.swf"
	[0133.576] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.576] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7d74, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7d74, lpOverlapped=0x0) returned 1
	[0133.577] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.577] CloseHandle (hObject=0x20c) returned 1
	[0133.577] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\1of_s.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\1of_s.swf.exe")) returned 1
	[0133.577] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90570dc0, ftCreationTime.dwHighDateTime=0x1d4d283, ftLastAccessTime.dwLowDateTime=0x24757550, ftLastAccessTime.dwHighDateTime=0x1d4c8cf, ftLastWriteTime.dwLowDateTime=0x24757550, ftLastWriteTime.dwHighDateTime=0x1d4c8cf, nFileSizeHigh=0x0, nFileSizeLow=0x4afa, dwReserved0=0x12, dwReserved1=0x1, cFileName="3r6UauwH.doc", cAlternateFileName="")) returned 1
	[0133.578] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0133.578] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="3r6UauwH.doc") returned 1
	[0133.578] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="3r6UauwH.doc") returned 1
	[0133.578] lstrcmpiA (lpString1="", lpString2="3r6UauwH.doc") returned -1
	[0133.578] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\1oF_s.swf") returned="1oF_s.swf"
	[0133.578] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0133.578] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0133.578] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.578] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0133.578] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="3r6UauwH.doc" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\3r6UauwH.doc") returned="C:\\Users\\FD1HVy\\Desktop\\3r6UauwH.doc"
	[0133.578] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\3r6UauwH.doc", pszSpec="*.zip") returned 0
	[0133.578] lstrlenA (lpString="*.zip") returned 5
	[0133.578] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\3r6UauwH.doc", pszSpec="*.rar") returned 0
	[0133.578] lstrlenA (lpString="*.rar") returned 5
	[0133.578] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\3r6UauwH.doc", pszSpec="*.7z") returned 0
	[0133.578] lstrlenA (lpString="*.7z") returned 4
	[0133.578] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\3r6UauwH.doc", pszSpec="*.tar") returned 0
	[0133.578] lstrlenA (lpString="*.tar") returned 5
	[0133.578] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\3r6UauwH.doc", pszSpec="*.gzip") returned 0
	[0133.578] lstrlenA (lpString="*.gzip") returned 6
	[0133.578] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\3r6UauwH.doc", pszSpec="*.jpg") returned 0
	[0133.578] lstrlenA (lpString="*.jpg") returned 5
	[0133.578] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\3r6UauwH.doc", pszSpec="*.jpeg") returned 0
	[0133.578] lstrlenA (lpString="*.jpeg") returned 6
	[0133.578] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\3r6UauwH.doc", pszSpec="*.bmp") returned 0
	[0133.578] lstrlenA (lpString="*.bmp") returned 5
	[0133.578] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\3r6UauwH.doc", pszSpec="*.gif") returned 0
	[0133.578] lstrlenA (lpString="*.gif") returned 5
	[0133.578] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\3r6UauwH.doc", pszSpec="*.png") returned 0
	[0133.578] lstrlenA (lpString="*.png") returned 5
	[0133.578] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\3r6UauwH.doc", pszSpec="*.doc") returned 1
	[0133.578] lstrlenA (lpString="*.doc") returned 5
	[0133.579] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Desktop\\3r6UauwH.doc" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\3r6UauwH.doc") returned="C:\\Users\\FD1HVy\\Desktop\\3r6UauwH.doc"
	[0133.579] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Desktop\\3r6UauwH.doc" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\3r6UauwH.doc") returned="C:\\Users\\FD1HVy\\Desktop\\3r6UauwH.doc"
	[0133.579] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\3r6UauwH.doc", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\3r6UauwH.doc.") returned="C:\\Users\\FD1HVy\\Desktop\\3r6UauwH.doc."
	[0133.579] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\3r6UauwH.doc.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\3r6UauwH.doc.exe") returned="C:\\Users\\FD1HVy\\Desktop\\3r6UauwH.doc.exe"
	[0133.579] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\3r6UauwH.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\3r6uauwh.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0133.579] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4afa
	[0133.579] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x90570dc0, dwHighDateTime=0x1d4d283), lpLastAccessTime=0x407536*(dwLowDateTime=0x24757550, dwHighDateTime=0x1d4c8cf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x24757550, dwHighDateTime=0x1d4c8cf)) returned 1
	[0133.579] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.579] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x4ab8, lpOverlapped=0x0) returned 1
	[0133.580] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\3r6UauwH.doc") returned="3r6UauwH.doc"
	[0133.580] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.580] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x4ab8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x4ab8, lpOverlapped=0x0) returned 1
	[0133.580] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.580] CloseHandle (hObject=0x20c) returned 1
	[0133.580] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\3r6UauwH.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\3r6uauwh.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\3r6UauwH.doc.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\3r6uauwh.doc.exe")) returned 1
	[0133.581] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65334770, ftCreationTime.dwHighDateTime=0x1d4d379, ftLastAccessTime.dwLowDateTime=0x5b105140, ftLastAccessTime.dwHighDateTime=0x1d4c6c5, ftLastWriteTime.dwLowDateTime=0x5b105140, ftLastWriteTime.dwHighDateTime=0x1d4c6c5, nFileSizeHigh=0x0, nFileSizeLow=0xad59, dwReserved0=0x12, dwReserved1=0x1, cFileName="4_WJKJ10 L0QHSb.avi", cAlternateFileName="4_WJKJ~1.AVI")) returned 1
	[0133.581] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0133.581] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="4_WJKJ10 L0QHSb.avi") returned 1
	[0133.581] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="4_WJKJ10 L0QHSb.avi") returned 1
	[0133.581] lstrcmpiA (lpString1="", lpString2="4_WJKJ10 L0QHSb.avi") returned -1
	[0133.581] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\3r6UauwH.doc") returned="3r6UauwH.doc"
	[0133.581] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0133.581] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0133.581] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.581] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0133.582] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="4_WJKJ10 L0QHSb.avi" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi") returned="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi"
	[0133.582] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi", pszSpec="*.zip") returned 0
	[0133.582] lstrlenA (lpString="*.zip") returned 5
	[0133.582] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi", pszSpec="*.rar") returned 0
	[0133.582] lstrlenA (lpString="*.rar") returned 5
	[0133.582] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi", pszSpec="*.7z") returned 0
	[0133.582] lstrlenA (lpString="*.7z") returned 4
	[0133.582] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi", pszSpec="*.tar") returned 0
	[0133.582] lstrlenA (lpString="*.tar") returned 5
	[0133.582] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi", pszSpec="*.gzip") returned 0
	[0133.582] lstrlenA (lpString="*.gzip") returned 6
	[0133.582] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi", pszSpec="*.jpg") returned 0
	[0133.582] lstrlenA (lpString="*.jpg") returned 5
	[0133.582] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi", pszSpec="*.jpeg") returned 0
	[0133.582] lstrlenA (lpString="*.jpeg") returned 6
	[0133.582] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi", pszSpec="*.bmp") returned 0
	[0133.582] lstrlenA (lpString="*.bmp") returned 5
	[0133.582] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi", pszSpec="*.gif") returned 0
	[0133.582] lstrlenA (lpString="*.gif") returned 5
	[0133.582] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi", pszSpec="*.png") returned 0
	[0133.582] lstrlenA (lpString="*.png") returned 5
	[0133.582] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi", pszSpec="*.doc") returned 0
	[0133.582] lstrlenA (lpString="*.doc") returned 5
	[0133.582] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi", pszSpec="*.docx") returned 0
	[0133.582] lstrlenA (lpString="*.docx") returned 6
	[0133.582] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi", pszSpec="*.xls") returned 0
	[0133.582] lstrlenA (lpString="*.xls") returned 5
	[0133.582] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi", pszSpec="*.xlsx") returned 0
	[0133.582] lstrlenA (lpString="*.xlsx") returned 6
	[0133.582] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi", pszSpec="*.ppt") returned 0
	[0133.582] lstrlenA (lpString="*.ppt") returned 5
	[0133.582] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi", pszSpec="*.pptx") returned 0
	[0133.583] lstrlenA (lpString="*.pptx") returned 6
	[0133.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi", pszSpec="*.txt") returned 0
	[0133.583] lstrlenA (lpString="*.txt") returned 5
	[0133.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi", pszSpec="*.pdf") returned 0
	[0133.583] lstrlenA (lpString="*.pdf") returned 5
	[0133.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi", pszSpec="*.htm") returned 0
	[0133.583] lstrlenA (lpString="*.htm") returned 5
	[0133.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi", pszSpec="*.html") returned 0
	[0133.583] lstrlenA (lpString="*.html") returned 6
	[0133.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi", pszSpec="*.mdb") returned 0
	[0133.583] lstrlenA (lpString="*.mdb") returned 5
	[0133.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi", pszSpec="*.pfx") returned 0
	[0133.583] lstrlenA (lpString="*.pfx") returned 5
	[0133.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi", pszSpec="*.md") returned 0
	[0133.583] lstrlenA (lpString="*.md") returned 4
	[0133.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi", pszSpec="*.lnk") returned 0
	[0133.583] lstrlenA (lpString="*.lnk") returned 5
	[0133.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi", pszSpec="*.torrent") returned 0
	[0133.583] lstrlenA (lpString="*.torrent") returned 9
	[0133.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi", pszSpec="*.mov") returned 0
	[0133.583] lstrlenA (lpString="*.mov") returned 5
	[0133.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi", pszSpec="*.3gp") returned 0
	[0133.583] lstrlenA (lpString="*.3gp") returned 5
	[0133.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi", pszSpec="*.mpeg") returned 0
	[0133.583] lstrlenA (lpString="*.mpeg") returned 6
	[0133.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi", pszSpec="*.mpg") returned 0
	[0133.583] lstrlenA (lpString="*.mpg") returned 5
	[0133.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi", pszSpec="*.flv") returned 0
	[0133.583] lstrlenA (lpString="*.flv") returned 5
	[0133.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi", pszSpec="*.avi") returned 1
	[0133.583] lstrlenA (lpString="*.avi") returned 5
	[0133.583] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi") returned="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi"
	[0133.583] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi") returned="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi"
	[0133.583] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi.") returned="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi."
	[0133.584] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\4_wjkj10 l0qhsb.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0133.584] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xad59
	[0133.584] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x65334770, dwHighDateTime=0x1d4d379), lpLastAccessTime=0x407536*(dwLowDateTime=0x5b105140, dwHighDateTime=0x1d4c6c5), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5b105140, dwHighDateTime=0x1d4c6c5)) returned 1
	[0133.584] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.584] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xad17, lpOverlapped=0x0) returned 1
	[0133.585] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi") returned="4_WJKJ10 L0QHSb.avi"
	[0133.586] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.586] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xad17, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xad17, lpOverlapped=0x0) returned 1
	[0133.586] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.586] CloseHandle (hObject=0x20c) returned 1
	[0133.586] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\4_wjkj10 l0qhsb.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\4_wjkj10 l0qhsb.avi.exe")) returned 1
	[0133.587] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa48f82e0, ftCreationTime.dwHighDateTime=0x1d4c98c, ftLastAccessTime.dwLowDateTime=0x338d20c0, ftLastAccessTime.dwHighDateTime=0x1d4c58b, ftLastWriteTime.dwLowDateTime=0x338d20c0, ftLastWriteTime.dwHighDateTime=0x1d4c58b, nFileSizeHigh=0x0, nFileSizeLow=0x124fe, dwReserved0=0x15, dwReserved1=0x1, cFileName="6AcX.jpg", cAlternateFileName="")) returned 1
	[0133.587] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0133.587] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="6AcX.jpg") returned 1
	[0133.587] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="6AcX.jpg") returned 1
	[0133.587] lstrcmpiA (lpString1="", lpString2="6AcX.jpg") returned -1
	[0133.587] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\4_WJKJ10 L0QHSb.avi") returned="4_WJKJ10 L0QHSb.avi"
	[0133.587] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0133.587] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0133.587] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.587] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0133.587] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="6AcX.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6AcX.jpg") returned="C:\\Users\\FD1HVy\\Desktop\\6AcX.jpg"
	[0133.587] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6AcX.jpg", pszSpec="*.zip") returned 0
	[0133.587] lstrlenA (lpString="*.zip") returned 5
	[0133.587] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6AcX.jpg", pszSpec="*.rar") returned 0
	[0133.587] lstrlenA (lpString="*.rar") returned 5
	[0133.587] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6AcX.jpg", pszSpec="*.7z") returned 0
	[0133.587] lstrlenA (lpString="*.7z") returned 4
	[0133.587] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6AcX.jpg", pszSpec="*.tar") returned 0
	[0133.587] lstrlenA (lpString="*.tar") returned 5
	[0133.587] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6AcX.jpg", pszSpec="*.gzip") returned 0
	[0133.587] lstrlenA (lpString="*.gzip") returned 6
	[0133.587] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6AcX.jpg", pszSpec="*.jpg") returned 1
	[0133.588] lstrlenA (lpString="*.jpg") returned 5
	[0133.588] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Desktop\\6AcX.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6AcX.jpg") returned="C:\\Users\\FD1HVy\\Desktop\\6AcX.jpg"
	[0133.588] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Desktop\\6AcX.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6AcX.jpg") returned="C:\\Users\\FD1HVy\\Desktop\\6AcX.jpg"
	[0133.588] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6AcX.jpg", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6AcX.jpg.") returned="C:\\Users\\FD1HVy\\Desktop\\6AcX.jpg."
	[0133.588] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6AcX.jpg.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6AcX.jpg.exe") returned="C:\\Users\\FD1HVy\\Desktop\\6AcX.jpg.exe"
	[0133.588] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6AcX.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\6acx.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0133.588] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x124fe
	[0133.588] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa48f82e0, dwHighDateTime=0x1d4c98c), lpLastAccessTime=0x407536*(dwLowDateTime=0x338d20c0, dwHighDateTime=0x1d4c58b), lpLastWriteTime=0x40753e*(dwLowDateTime=0x338d20c0, dwHighDateTime=0x1d4c58b)) returned 1
	[0133.588] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.588] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x124bc, lpOverlapped=0x0) returned 1
	[0133.589] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\6AcX.jpg") returned="6AcX.jpg"
	[0133.589] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.589] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x124bc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x124bc, lpOverlapped=0x0) returned 1
	[0133.590] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.590] CloseHandle (hObject=0x20c) returned 1
	[0133.590] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\6AcX.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\6acx.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\6AcX.jpg.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\6acx.jpg.exe")) returned 1
	[0133.591] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a0ca220, ftCreationTime.dwHighDateTime=0x1d4d447, ftLastAccessTime.dwLowDateTime=0x347713a0, ftLastAccessTime.dwHighDateTime=0x1d4d586, ftLastWriteTime.dwLowDateTime=0x347713a0, ftLastWriteTime.dwHighDateTime=0x1d4d586, nFileSizeHigh=0x0, nFileSizeLow=0xabd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="6jHmyJd7xe.odp", cAlternateFileName="6JHMYJ~1.ODP")) returned 1
	[0133.591] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0133.591] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="6jHmyJd7xe.odp") returned 1
	[0133.591] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="6jHmyJd7xe.odp") returned 1
	[0133.591] lstrcmpiA (lpString1="", lpString2="6jHmyJd7xe.odp") returned -1
	[0133.591] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\6AcX.jpg") returned="6AcX.jpg"
	[0133.591] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0133.591] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0133.591] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.591] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0133.591] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="6jHmyJd7xe.odp" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp") returned="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp"
	[0133.591] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.zip") returned 0
	[0133.591] lstrlenA (lpString="*.zip") returned 5
	[0133.591] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.rar") returned 0
	[0133.591] lstrlenA (lpString="*.rar") returned 5
	[0133.591] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.7z") returned 0
	[0133.591] lstrlenA (lpString="*.7z") returned 4
	[0133.591] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.tar") returned 0
	[0133.591] lstrlenA (lpString="*.tar") returned 5
	[0133.591] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.gzip") returned 0
	[0133.591] lstrlenA (lpString="*.gzip") returned 6
	[0133.591] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.jpg") returned 0
	[0133.591] lstrlenA (lpString="*.jpg") returned 5
	[0133.591] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.jpeg") returned 0
	[0133.591] lstrlenA (lpString="*.jpeg") returned 6
	[0133.591] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.bmp") returned 0
	[0133.591] lstrlenA (lpString="*.bmp") returned 5
	[0133.591] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.gif") returned 0
	[0133.591] lstrlenA (lpString="*.gif") returned 5
	[0133.591] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.png") returned 0
	[0133.592] lstrlenA (lpString="*.png") returned 5
	[0133.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.doc") returned 0
	[0133.592] lstrlenA (lpString="*.doc") returned 5
	[0133.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.docx") returned 0
	[0133.592] lstrlenA (lpString="*.docx") returned 6
	[0133.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.xls") returned 0
	[0133.592] lstrlenA (lpString="*.xls") returned 5
	[0133.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.xlsx") returned 0
	[0133.592] lstrlenA (lpString="*.xlsx") returned 6
	[0133.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.ppt") returned 0
	[0133.592] lstrlenA (lpString="*.ppt") returned 5
	[0133.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.pptx") returned 0
	[0133.592] lstrlenA (lpString="*.pptx") returned 6
	[0133.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.txt") returned 0
	[0133.592] lstrlenA (lpString="*.txt") returned 5
	[0133.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.pdf") returned 0
	[0133.592] lstrlenA (lpString="*.pdf") returned 5
	[0133.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.htm") returned 0
	[0133.592] lstrlenA (lpString="*.htm") returned 5
	[0133.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.html") returned 0
	[0133.592] lstrlenA (lpString="*.html") returned 6
	[0133.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.mdb") returned 0
	[0133.592] lstrlenA (lpString="*.mdb") returned 5
	[0133.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.pfx") returned 0
	[0133.592] lstrlenA (lpString="*.pfx") returned 5
	[0133.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.md") returned 0
	[0133.592] lstrlenA (lpString="*.md") returned 4
	[0133.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.lnk") returned 0
	[0133.592] lstrlenA (lpString="*.lnk") returned 5
	[0133.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.torrent") returned 0
	[0133.592] lstrlenA (lpString="*.torrent") returned 9
	[0133.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.mov") returned 0
	[0133.592] lstrlenA (lpString="*.mov") returned 5
	[0133.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.3gp") returned 0
	[0133.593] lstrlenA (lpString="*.3gp") returned 5
	[0133.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.mpeg") returned 0
	[0133.593] lstrlenA (lpString="*.mpeg") returned 6
	[0133.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.mpg") returned 0
	[0133.593] lstrlenA (lpString="*.mpg") returned 5
	[0133.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.flv") returned 0
	[0133.593] lstrlenA (lpString="*.flv") returned 5
	[0133.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.avi") returned 0
	[0133.593] lstrlenA (lpString="*.avi") returned 5
	[0133.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.mp4") returned 0
	[0133.593] lstrlenA (lpString="*.mp4") returned 5
	[0133.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.wmv") returned 0
	[0133.593] lstrlenA (lpString="*.wmv") returned 5
	[0133.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.mkv") returned 0
	[0133.593] lstrlenA (lpString="*.mkv") returned 5
	[0133.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.mp3") returned 0
	[0133.593] lstrlenA (lpString="*.mp3") returned 5
	[0133.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.wav") returned 0
	[0133.593] lstrlenA (lpString="*.wav") returned 5
	[0133.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.flac") returned 0
	[0133.593] lstrlenA (lpString="*.flac") returned 6
	[0133.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.wma") returned 0
	[0133.593] lstrlenA (lpString="*.wma") returned 5
	[0133.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.au3") returned 0
	[0133.593] lstrlenA (lpString="*.au3") returned 5
	[0133.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.ahk") returned 0
	[0133.593] lstrlenA (lpString="*.ahk") returned 5
	[0133.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.c") returned 0
	[0133.593] lstrlenA (lpString="*.c") returned 3
	[0133.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.cc") returned 0
	[0133.593] lstrlenA (lpString="*.cc") returned 4
	[0133.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.cpp") returned 0
	[0133.593] lstrlenA (lpString="*.cpp") returned 5
	[0133.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.cxx") returned 0
	[0133.593] lstrlenA (lpString="*.cxx") returned 5
	[0133.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.c++") returned 0
	[0133.594] lstrlenA (lpString="*.c++") returned 5
	[0133.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.cs") returned 0
	[0133.594] lstrlenA (lpString="*.cs") returned 4
	[0133.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.vb") returned 0
	[0133.594] lstrlenA (lpString="*.vb") returned 4
	[0133.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.bas") returned 0
	[0133.594] lstrlenA (lpString="*.bas") returned 5
	[0133.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.csproj") returned 0
	[0133.594] lstrlenA (lpString="*.csproj") returned 8
	[0133.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.vbproj") returned 0
	[0133.594] lstrlenA (lpString="*.vbproj") returned 8
	[0133.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.vcxproj") returned 0
	[0133.594] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.manifest") returned 0
	[0133.594] lstrlenA (lpString="*.manifest") returned 10
	[0133.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.php") returned 0
	[0133.594] lstrlenA (lpString="*.php") returned 5
	[0133.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.vbe") returned 0
	[0133.594] lstrlenA (lpString="*.vbe") returned 5
	[0133.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.vba") returned 0
	[0133.594] lstrlenA (lpString="*.vba") returned 5
	[0133.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.vbs") returned 0
	[0133.594] lstrlenA (lpString="*.vbs") returned 5
	[0133.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.bat") returned 0
	[0133.594] lstrlenA (lpString="*.bat") returned 5
	[0133.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.cmd") returned 0
	[0133.594] lstrlenA (lpString="*.cmd") returned 5
	[0133.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.js") returned 0
	[0133.594] lstrlenA (lpString="*.js") returned 4
	[0133.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.jscript") returned 0
	[0133.594] lstrlenA (lpString="*.jscript") returned 9
	[0133.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.hta") returned 0
	[0133.594] lstrlenA (lpString="*.hta") returned 5
	[0133.595] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.php7") returned 0
	[0133.595] lstrlenA (lpString="*.php7") returned 6
	[0133.595] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.db") returned 0
	[0133.595] lstrlenA (lpString="*.db") returned 4
	[0133.595] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.swf") returned 0
	[0133.595] lstrlenA (lpString="*.swf") returned 5
	[0133.595] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.eml") returned 0
	[0133.595] lstrlenA (lpString="*.eml") returned 5
	[0133.595] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.part") returned 0
	[0133.595] lstrlenA (lpString="*.part") returned 6
	[0133.595] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.nfo") returned 0
	[0133.595] lstrlenA (lpString="*.nfo") returned 5
	[0133.595] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.rsa") returned 0
	[0133.595] lstrlenA (lpString="*.rsa") returned 5
	[0133.595] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.key") returned 0
	[0133.595] lstrlenA (lpString="*.key") returned 5
	[0133.595] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.aes") returned 0
	[0133.595] lstrlenA (lpString="*.aes") returned 5
	[0133.595] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.blob") returned 0
	[0133.595] lstrlenA (lpString="*.blob") returned 6
	[0133.595] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.btc") returned 0
	[0133.595] lstrlenA (lpString="*.btc") returned 5
	[0133.595] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp", pszSpec="*.wallet") returned 0
	[0133.595] lstrlenA (lpString="*.wallet") returned 8
	[0133.595] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x995ac310, ftCreationTime.dwHighDateTime=0x1d4d488, ftLastAccessTime.dwLowDateTime=0x664f1ac0, ftLastAccessTime.dwHighDateTime=0x1d4cdb2, ftLastWriteTime.dwLowDateTime=0x664f1ac0, ftLastWriteTime.dwHighDateTime=0x1d4cdb2, nFileSizeHigh=0x0, nFileSizeLow=0x8fa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="6rSn1iM NDaJk5HYEZ.ods", cAlternateFileName="6RSN1I~1.ODS")) returned 1
	[0133.595] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0133.595] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="6rSn1iM NDaJk5HYEZ.ods") returned 1
	[0133.595] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="6rSn1iM NDaJk5HYEZ.ods") returned 1
	[0133.595] lstrcmpiA (lpString1="", lpString2="6rSn1iM NDaJk5HYEZ.ods") returned -1
	[0133.595] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\6jHmyJd7xe.odp") returned="6jHmyJd7xe.odp"
	[0133.595] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0133.595] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0133.595] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.595] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0133.596] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="6rSn1iM NDaJk5HYEZ.ods" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods") returned="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods"
	[0133.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.zip") returned 0
	[0133.596] lstrlenA (lpString="*.zip") returned 5
	[0133.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.rar") returned 0
	[0133.596] lstrlenA (lpString="*.rar") returned 5
	[0133.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.7z") returned 0
	[0133.596] lstrlenA (lpString="*.7z") returned 4
	[0133.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.tar") returned 0
	[0133.596] lstrlenA (lpString="*.tar") returned 5
	[0133.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.gzip") returned 0
	[0133.596] lstrlenA (lpString="*.gzip") returned 6
	[0133.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.jpg") returned 0
	[0133.596] lstrlenA (lpString="*.jpg") returned 5
	[0133.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.jpeg") returned 0
	[0133.596] lstrlenA (lpString="*.jpeg") returned 6
	[0133.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.bmp") returned 0
	[0133.596] lstrlenA (lpString="*.bmp") returned 5
	[0133.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.gif") returned 0
	[0133.596] lstrlenA (lpString="*.gif") returned 5
	[0133.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.png") returned 0
	[0133.596] lstrlenA (lpString="*.png") returned 5
	[0133.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.doc") returned 0
	[0133.596] lstrlenA (lpString="*.doc") returned 5
	[0133.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.docx") returned 0
	[0133.596] lstrlenA (lpString="*.docx") returned 6
	[0133.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.xls") returned 0
	[0133.596] lstrlenA (lpString="*.xls") returned 5
	[0133.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.xlsx") returned 0
	[0133.596] lstrlenA (lpString="*.xlsx") returned 6
	[0133.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.ppt") returned 0
	[0133.596] lstrlenA (lpString="*.ppt") returned 5
	[0133.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.pptx") returned 0
	[0133.596] lstrlenA (lpString="*.pptx") returned 6
	[0133.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.txt") returned 0
	[0133.597] lstrlenA (lpString="*.txt") returned 5
	[0133.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.pdf") returned 0
	[0133.597] lstrlenA (lpString="*.pdf") returned 5
	[0133.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.htm") returned 0
	[0133.597] lstrlenA (lpString="*.htm") returned 5
	[0133.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.html") returned 0
	[0133.597] lstrlenA (lpString="*.html") returned 6
	[0133.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.mdb") returned 0
	[0133.597] lstrlenA (lpString="*.mdb") returned 5
	[0133.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.pfx") returned 0
	[0133.597] lstrlenA (lpString="*.pfx") returned 5
	[0133.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.md") returned 0
	[0133.597] lstrlenA (lpString="*.md") returned 4
	[0133.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.lnk") returned 0
	[0133.597] lstrlenA (lpString="*.lnk") returned 5
	[0133.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.torrent") returned 0
	[0133.597] lstrlenA (lpString="*.torrent") returned 9
	[0133.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.mov") returned 0
	[0133.597] lstrlenA (lpString="*.mov") returned 5
	[0133.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.3gp") returned 0
	[0133.597] lstrlenA (lpString="*.3gp") returned 5
	[0133.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.mpeg") returned 0
	[0133.597] lstrlenA (lpString="*.mpeg") returned 6
	[0133.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.mpg") returned 0
	[0133.597] lstrlenA (lpString="*.mpg") returned 5
	[0133.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.flv") returned 0
	[0133.597] lstrlenA (lpString="*.flv") returned 5
	[0133.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.avi") returned 0
	[0133.597] lstrlenA (lpString="*.avi") returned 5
	[0133.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.mp4") returned 0
	[0133.597] lstrlenA (lpString="*.mp4") returned 5
	[0133.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.wmv") returned 0
	[0133.597] lstrlenA (lpString="*.wmv") returned 5
	[0133.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.mkv") returned 0
	[0133.598] lstrlenA (lpString="*.mkv") returned 5
	[0133.598] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.mp3") returned 0
	[0133.598] lstrlenA (lpString="*.mp3") returned 5
	[0133.598] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.wav") returned 0
	[0133.598] lstrlenA (lpString="*.wav") returned 5
	[0133.598] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.flac") returned 0
	[0133.598] lstrlenA (lpString="*.flac") returned 6
	[0133.598] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.wma") returned 0
	[0133.598] lstrlenA (lpString="*.wma") returned 5
	[0133.598] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.au3") returned 0
	[0133.598] lstrlenA (lpString="*.au3") returned 5
	[0133.598] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.ahk") returned 0
	[0133.598] lstrlenA (lpString="*.ahk") returned 5
	[0133.598] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.c") returned 0
	[0133.598] lstrlenA (lpString="*.c") returned 3
	[0133.598] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.cc") returned 0
	[0133.598] lstrlenA (lpString="*.cc") returned 4
	[0133.598] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.cpp") returned 0
	[0133.598] lstrlenA (lpString="*.cpp") returned 5
	[0133.598] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.cxx") returned 0
	[0133.598] lstrlenA (lpString="*.cxx") returned 5
	[0133.598] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.c++") returned 0
	[0133.598] lstrlenA (lpString="*.c++") returned 5
	[0133.598] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.cs") returned 0
	[0133.598] lstrlenA (lpString="*.cs") returned 4
	[0133.598] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.vb") returned 0
	[0133.598] lstrlenA (lpString="*.vb") returned 4
	[0133.598] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.bas") returned 0
	[0133.598] lstrlenA (lpString="*.bas") returned 5
	[0133.598] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.csproj") returned 0
	[0133.598] lstrlenA (lpString="*.csproj") returned 8
	[0133.598] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.vbproj") returned 0
	[0133.598] lstrlenA (lpString="*.vbproj") returned 8
	[0133.598] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.vcxproj") returned 0
	[0133.598] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.599] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.manifest") returned 0
	[0133.599] lstrlenA (lpString="*.manifest") returned 10
	[0133.599] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.php") returned 0
	[0133.599] lstrlenA (lpString="*.php") returned 5
	[0133.599] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.vbe") returned 0
	[0133.599] lstrlenA (lpString="*.vbe") returned 5
	[0133.599] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.vba") returned 0
	[0133.599] lstrlenA (lpString="*.vba") returned 5
	[0133.599] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.vbs") returned 0
	[0133.599] lstrlenA (lpString="*.vbs") returned 5
	[0133.599] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.bat") returned 0
	[0133.599] lstrlenA (lpString="*.bat") returned 5
	[0133.599] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.cmd") returned 0
	[0133.599] lstrlenA (lpString="*.cmd") returned 5
	[0133.599] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.js") returned 0
	[0133.599] lstrlenA (lpString="*.js") returned 4
	[0133.599] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.jscript") returned 0
	[0133.599] lstrlenA (lpString="*.jscript") returned 9
	[0133.599] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.hta") returned 0
	[0133.599] lstrlenA (lpString="*.hta") returned 5
	[0133.599] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.php7") returned 0
	[0133.599] lstrlenA (lpString="*.php7") returned 6
	[0133.599] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.db") returned 0
	[0133.599] lstrlenA (lpString="*.db") returned 4
	[0133.599] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.swf") returned 0
	[0133.599] lstrlenA (lpString="*.swf") returned 5
	[0133.599] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.eml") returned 0
	[0133.599] lstrlenA (lpString="*.eml") returned 5
	[0133.599] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.part") returned 0
	[0133.599] lstrlenA (lpString="*.part") returned 6
	[0133.599] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.nfo") returned 0
	[0133.599] lstrlenA (lpString="*.nfo") returned 5
	[0133.599] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.rsa") returned 0
	[0133.599] lstrlenA (lpString="*.rsa") returned 5
	[0133.599] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.key") returned 0
	[0133.599] lstrlenA (lpString="*.key") returned 5
	[0133.600] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.aes") returned 0
	[0133.600] lstrlenA (lpString="*.aes") returned 5
	[0133.600] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.blob") returned 0
	[0133.600] lstrlenA (lpString="*.blob") returned 6
	[0133.600] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.btc") returned 0
	[0133.600] lstrlenA (lpString="*.btc") returned 5
	[0133.600] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods", pszSpec="*.wallet") returned 0
	[0133.600] lstrlenA (lpString="*.wallet") returned 8
	[0133.600] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa991caf0, ftCreationTime.dwHighDateTime=0x1d4cf04, ftLastAccessTime.dwLowDateTime=0x7d4a7490, ftLastAccessTime.dwHighDateTime=0x1d4cb0a, ftLastWriteTime.dwLowDateTime=0x7d4a7490, ftLastWriteTime.dwHighDateTime=0x1d4cb0a, nFileSizeHigh=0x0, nFileSizeLow=0xd479, dwReserved0=0x0, dwReserved1=0x0, cFileName="8s0u2AZ3VngkS.wav", cAlternateFileName="8S0U2A~1.WAV")) returned 1
	[0133.600] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0133.600] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="8s0u2AZ3VngkS.wav") returned 1
	[0133.600] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="8s0u2AZ3VngkS.wav") returned 1
	[0133.600] lstrcmpiA (lpString1="", lpString2="8s0u2AZ3VngkS.wav") returned -1
	[0133.600] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\6rSn1iM NDaJk5HYEZ.ods") returned="6rSn1iM NDaJk5HYEZ.ods"
	[0133.600] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0133.600] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0133.600] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.600] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0133.600] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="8s0u2AZ3VngkS.wav" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav") returned="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav"
	[0133.600] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav", pszSpec="*.zip") returned 0
	[0133.600] lstrlenA (lpString="*.zip") returned 5
	[0133.600] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav", pszSpec="*.rar") returned 0
	[0133.600] lstrlenA (lpString="*.rar") returned 5
	[0133.600] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav", pszSpec="*.7z") returned 0
	[0133.600] lstrlenA (lpString="*.7z") returned 4
	[0133.600] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav", pszSpec="*.tar") returned 0
	[0133.600] lstrlenA (lpString="*.tar") returned 5
	[0133.600] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav", pszSpec="*.gzip") returned 0
	[0133.600] lstrlenA (lpString="*.gzip") returned 6
	[0133.600] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav", pszSpec="*.jpg") returned 0
	[0133.600] lstrlenA (lpString="*.jpg") returned 5
	[0133.600] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav", pszSpec="*.jpeg") returned 0
	[0133.600] lstrlenA (lpString="*.jpeg") returned 6
	[0133.600] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav", pszSpec="*.bmp") returned 0
	[0133.601] lstrlenA (lpString="*.bmp") returned 5
	[0133.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav", pszSpec="*.gif") returned 0
	[0133.601] lstrlenA (lpString="*.gif") returned 5
	[0133.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav", pszSpec="*.png") returned 0
	[0133.601] lstrlenA (lpString="*.png") returned 5
	[0133.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav", pszSpec="*.doc") returned 0
	[0133.601] lstrlenA (lpString="*.doc") returned 5
	[0133.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav", pszSpec="*.docx") returned 0
	[0133.601] lstrlenA (lpString="*.docx") returned 6
	[0133.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav", pszSpec="*.xls") returned 0
	[0133.601] lstrlenA (lpString="*.xls") returned 5
	[0133.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav", pszSpec="*.xlsx") returned 0
	[0133.601] lstrlenA (lpString="*.xlsx") returned 6
	[0133.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav", pszSpec="*.ppt") returned 0
	[0133.601] lstrlenA (lpString="*.ppt") returned 5
	[0133.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav", pszSpec="*.pptx") returned 0
	[0133.601] lstrlenA (lpString="*.pptx") returned 6
	[0133.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav", pszSpec="*.txt") returned 0
	[0133.601] lstrlenA (lpString="*.txt") returned 5
	[0133.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav", pszSpec="*.pdf") returned 0
	[0133.601] lstrlenA (lpString="*.pdf") returned 5
	[0133.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav", pszSpec="*.htm") returned 0
	[0133.601] lstrlenA (lpString="*.htm") returned 5
	[0133.607] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav", pszSpec="*.html") returned 0
	[0133.607] lstrlenA (lpString="*.html") returned 6
	[0133.607] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav", pszSpec="*.mdb") returned 0
	[0133.607] lstrlenA (lpString="*.mdb") returned 5
	[0133.607] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav", pszSpec="*.pfx") returned 0
	[0133.607] lstrlenA (lpString="*.pfx") returned 5
	[0133.608] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav", pszSpec="*.md") returned 0
	[0133.608] lstrlenA (lpString="*.md") returned 4
	[0133.608] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav", pszSpec="*.lnk") returned 0
	[0133.608] lstrlenA (lpString="*.lnk") returned 5
	[0133.608] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav", pszSpec="*.torrent") returned 0
	[0133.608] lstrlenA (lpString="*.torrent") returned 9
	[0133.608] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav", pszSpec="*.mov") returned 0
	[0133.608] lstrlenA (lpString="*.mov") returned 5
	[0133.608] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav", pszSpec="*.3gp") returned 0
	[0133.608] lstrlenA (lpString="*.3gp") returned 5
	[0133.608] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav", pszSpec="*.mpeg") returned 0
	[0133.608] lstrlenA (lpString="*.mpeg") returned 6
	[0133.608] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav", pszSpec="*.mpg") returned 0
	[0133.608] lstrlenA (lpString="*.mpg") returned 5
	[0133.608] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav", pszSpec="*.flv") returned 0
	[0133.608] lstrlenA (lpString="*.flv") returned 5
	[0133.608] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav", pszSpec="*.avi") returned 0
	[0133.608] lstrlenA (lpString="*.avi") returned 5
	[0133.608] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav", pszSpec="*.mp4") returned 0
	[0133.608] lstrlenA (lpString="*.mp4") returned 5
	[0133.608] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav", pszSpec="*.wmv") returned 0
	[0133.608] lstrlenA (lpString="*.wmv") returned 5
	[0133.608] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav", pszSpec="*.mkv") returned 0
	[0133.608] lstrlenA (lpString="*.mkv") returned 5
	[0133.608] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav", pszSpec="*.mp3") returned 0
	[0133.608] lstrlenA (lpString="*.mp3") returned 5
	[0133.608] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav", pszSpec="*.wav") returned 1
	[0133.608] lstrlenA (lpString="*.wav") returned 5
	[0133.608] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav") returned="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav"
	[0133.608] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav") returned="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav"
	[0133.608] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav.") returned="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav."
	[0133.608] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav.exe") returned="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav.exe"
	[0133.608] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\8s0u2az3vngks.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0133.609] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd479
	[0133.609] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa991caf0, dwHighDateTime=0x1d4cf04), lpLastAccessTime=0x407536*(dwLowDateTime=0x7d4a7490, dwHighDateTime=0x1d4cb0a), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7d4a7490, dwHighDateTime=0x1d4cb0a)) returned 1
	[0133.609] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.609] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xd437, lpOverlapped=0x0) returned 1
	[0133.610] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav") returned="8s0u2AZ3VngkS.wav"
	[0133.610] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.610] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xd437, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xd437, lpOverlapped=0x0) returned 1
	[0133.610] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.611] CloseHandle (hObject=0x20c) returned 1
	[0133.611] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\8s0u2az3vngks.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\8s0u2az3vngks.wav.exe")) returned 1
	[0133.611] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc435080, ftCreationTime.dwHighDateTime=0x1d543d9, ftLastAccessTime.dwLowDateTime=0xcdbe700, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0xbaaba00, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x15, dwReserved1=0x1, cFileName="a.exe", cAlternateFileName="")) returned 1
	[0133.611] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0133.611] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="a.exe") returned 1
	[0133.611] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="a.exe") returned 1
	[0133.611] lstrcmpiA (lpString1="", lpString2="a.exe") returned -1
	[0133.611] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\8s0u2AZ3VngkS.wav") returned="8s0u2AZ3VngkS.wav"
	[0133.611] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0133.611] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0133.611] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.612] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0133.612] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="a.exe" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\a.exe") returned="C:\\Users\\FD1HVy\\Desktop\\a.exe"
	[0133.612] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.zip") returned 0
	[0133.612] lstrlenA (lpString="*.zip") returned 5
	[0133.612] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.rar") returned 0
	[0133.612] lstrlenA (lpString="*.rar") returned 5
	[0133.612] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.7z") returned 0
	[0133.612] lstrlenA (lpString="*.7z") returned 4
	[0133.612] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.tar") returned 0
	[0133.612] lstrlenA (lpString="*.tar") returned 5
	[0133.612] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.gzip") returned 0
	[0133.612] lstrlenA (lpString="*.gzip") returned 6
	[0133.612] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.jpg") returned 0
	[0133.612] lstrlenA (lpString="*.jpg") returned 5
	[0133.612] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.jpeg") returned 0
	[0133.612] lstrlenA (lpString="*.jpeg") returned 6
	[0133.612] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.bmp") returned 0
	[0133.612] lstrlenA (lpString="*.bmp") returned 5
	[0133.612] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.gif") returned 0
	[0133.612] lstrlenA (lpString="*.gif") returned 5
	[0133.612] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.png") returned 0
	[0133.612] lstrlenA (lpString="*.png") returned 5
	[0133.612] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.doc") returned 0
	[0133.612] lstrlenA (lpString="*.doc") returned 5
	[0133.612] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.docx") returned 0
	[0133.612] lstrlenA (lpString="*.docx") returned 6
	[0133.612] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.xls") returned 0
	[0133.612] lstrlenA (lpString="*.xls") returned 5
	[0133.612] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.xlsx") returned 0
	[0133.612] lstrlenA (lpString="*.xlsx") returned 6
	[0133.612] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.ppt") returned 0
	[0133.612] lstrlenA (lpString="*.ppt") returned 5
	[0133.612] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.pptx") returned 0
	[0133.612] lstrlenA (lpString="*.pptx") returned 6
	[0133.613] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.txt") returned 0
	[0133.613] lstrlenA (lpString="*.txt") returned 5
	[0133.613] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.pdf") returned 0
	[0133.613] lstrlenA (lpString="*.pdf") returned 5
	[0133.613] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.htm") returned 0
	[0133.613] lstrlenA (lpString="*.htm") returned 5
	[0133.613] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.html") returned 0
	[0133.613] lstrlenA (lpString="*.html") returned 6
	[0133.613] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.mdb") returned 0
	[0133.613] lstrlenA (lpString="*.mdb") returned 5
	[0133.613] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.pfx") returned 0
	[0133.613] lstrlenA (lpString="*.pfx") returned 5
	[0133.613] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.md") returned 0
	[0133.613] lstrlenA (lpString="*.md") returned 4
	[0133.613] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.lnk") returned 0
	[0133.613] lstrlenA (lpString="*.lnk") returned 5
	[0133.613] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.torrent") returned 0
	[0133.613] lstrlenA (lpString="*.torrent") returned 9
	[0133.613] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.mov") returned 0
	[0133.613] lstrlenA (lpString="*.mov") returned 5
	[0133.613] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.3gp") returned 0
	[0133.613] lstrlenA (lpString="*.3gp") returned 5
	[0133.613] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.mpeg") returned 0
	[0133.613] lstrlenA (lpString="*.mpeg") returned 6
	[0133.613] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.mpg") returned 0
	[0133.613] lstrlenA (lpString="*.mpg") returned 5
	[0133.613] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.flv") returned 0
	[0133.613] lstrlenA (lpString="*.flv") returned 5
	[0133.613] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.avi") returned 0
	[0133.613] lstrlenA (lpString="*.avi") returned 5
	[0133.613] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.mp4") returned 0
	[0133.613] lstrlenA (lpString="*.mp4") returned 5
	[0133.613] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.wmv") returned 0
	[0133.613] lstrlenA (lpString="*.wmv") returned 5
	[0133.613] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.mkv") returned 0
	[0133.614] lstrlenA (lpString="*.mkv") returned 5
	[0133.614] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.mp3") returned 0
	[0133.614] lstrlenA (lpString="*.mp3") returned 5
	[0133.614] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.wav") returned 0
	[0133.614] lstrlenA (lpString="*.wav") returned 5
	[0133.614] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.flac") returned 0
	[0133.614] lstrlenA (lpString="*.flac") returned 6
	[0133.614] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.wma") returned 0
	[0133.614] lstrlenA (lpString="*.wma") returned 5
	[0133.614] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.au3") returned 0
	[0133.614] lstrlenA (lpString="*.au3") returned 5
	[0133.614] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.ahk") returned 0
	[0133.614] lstrlenA (lpString="*.ahk") returned 5
	[0133.614] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.c") returned 0
	[0133.614] lstrlenA (lpString="*.c") returned 3
	[0133.614] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.cc") returned 0
	[0133.614] lstrlenA (lpString="*.cc") returned 4
	[0133.614] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.cpp") returned 0
	[0133.614] lstrlenA (lpString="*.cpp") returned 5
	[0133.614] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.cxx") returned 0
	[0133.614] lstrlenA (lpString="*.cxx") returned 5
	[0133.614] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.c++") returned 0
	[0133.614] lstrlenA (lpString="*.c++") returned 5
	[0133.614] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.cs") returned 0
	[0133.614] lstrlenA (lpString="*.cs") returned 4
	[0133.614] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.vb") returned 0
	[0133.614] lstrlenA (lpString="*.vb") returned 4
	[0133.614] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.bas") returned 0
	[0133.614] lstrlenA (lpString="*.bas") returned 5
	[0133.614] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.csproj") returned 0
	[0133.614] lstrlenA (lpString="*.csproj") returned 8
	[0133.614] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.vbproj") returned 0
	[0133.614] lstrlenA (lpString="*.vbproj") returned 8
	[0133.614] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.vcxproj") returned 0
	[0133.614] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.615] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.manifest") returned 0
	[0133.615] lstrlenA (lpString="*.manifest") returned 10
	[0133.615] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.php") returned 0
	[0133.615] lstrlenA (lpString="*.php") returned 5
	[0133.615] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.vbe") returned 0
	[0133.615] lstrlenA (lpString="*.vbe") returned 5
	[0133.615] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.vba") returned 0
	[0133.615] lstrlenA (lpString="*.vba") returned 5
	[0133.615] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.vbs") returned 0
	[0133.615] lstrlenA (lpString="*.vbs") returned 5
	[0133.615] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.bat") returned 0
	[0133.615] lstrlenA (lpString="*.bat") returned 5
	[0133.615] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.cmd") returned 0
	[0133.615] lstrlenA (lpString="*.cmd") returned 5
	[0133.615] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.js") returned 0
	[0133.615] lstrlenA (lpString="*.js") returned 4
	[0133.615] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.jscript") returned 0
	[0133.615] lstrlenA (lpString="*.jscript") returned 9
	[0133.615] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.hta") returned 0
	[0133.615] lstrlenA (lpString="*.hta") returned 5
	[0133.615] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.php7") returned 0
	[0133.615] lstrlenA (lpString="*.php7") returned 6
	[0133.615] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.db") returned 0
	[0133.615] lstrlenA (lpString="*.db") returned 4
	[0133.615] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.swf") returned 0
	[0133.615] lstrlenA (lpString="*.swf") returned 5
	[0133.615] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.eml") returned 0
	[0133.615] lstrlenA (lpString="*.eml") returned 5
	[0133.615] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.part") returned 0
	[0133.615] lstrlenA (lpString="*.part") returned 6
	[0133.615] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.nfo") returned 0
	[0133.615] lstrlenA (lpString="*.nfo") returned 5
	[0133.615] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.rsa") returned 0
	[0133.615] lstrlenA (lpString="*.rsa") returned 5
	[0133.615] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.key") returned 0
	[0133.615] lstrlenA (lpString="*.key") returned 5
	[0133.616] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.aes") returned 0
	[0133.616] lstrlenA (lpString="*.aes") returned 5
	[0133.616] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.blob") returned 0
	[0133.616] lstrlenA (lpString="*.blob") returned 6
	[0133.616] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.btc") returned 0
	[0133.616] lstrlenA (lpString="*.btc") returned 5
	[0133.616] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\a.exe", pszSpec="*.wallet") returned 0
	[0133.616] lstrlenA (lpString="*.wallet") returned 8
	[0133.616] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x865ed820, ftCreationTime.dwHighDateTime=0x1d4d364, ftLastAccessTime.dwLowDateTime=0xe3779c00, ftLastAccessTime.dwHighDateTime=0x1d4d2b4, ftLastWriteTime.dwLowDateTime=0xe3779c00, ftLastWriteTime.dwHighDateTime=0x1d4d2b4, nFileSizeHigh=0x0, nFileSizeLow=0xc77e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADCSPz.swf", cAlternateFileName="")) returned 1
	[0133.616] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0133.616] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="ADCSPz.swf") returned 1
	[0133.616] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="ADCSPz.swf") returned 1
	[0133.616] lstrcmpiA (lpString1="", lpString2="ADCSPz.swf") returned -1
	[0133.616] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\a.exe") returned="a.exe"
	[0133.616] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0133.616] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0133.616] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.616] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0133.616] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="ADCSPz.swf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf") returned="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf"
	[0133.616] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.zip") returned 0
	[0133.616] lstrlenA (lpString="*.zip") returned 5
	[0133.616] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.rar") returned 0
	[0133.616] lstrlenA (lpString="*.rar") returned 5
	[0133.616] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.7z") returned 0
	[0133.616] lstrlenA (lpString="*.7z") returned 4
	[0133.616] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.tar") returned 0
	[0133.616] lstrlenA (lpString="*.tar") returned 5
	[0133.616] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.gzip") returned 0
	[0133.616] lstrlenA (lpString="*.gzip") returned 6
	[0133.616] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.jpg") returned 0
	[0133.616] lstrlenA (lpString="*.jpg") returned 5
	[0133.616] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.jpeg") returned 0
	[0133.617] lstrlenA (lpString="*.jpeg") returned 6
	[0133.617] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.bmp") returned 0
	[0133.617] lstrlenA (lpString="*.bmp") returned 5
	[0133.617] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.gif") returned 0
	[0133.617] lstrlenA (lpString="*.gif") returned 5
	[0133.617] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.png") returned 0
	[0133.617] lstrlenA (lpString="*.png") returned 5
	[0133.617] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.doc") returned 0
	[0133.617] lstrlenA (lpString="*.doc") returned 5
	[0133.617] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.docx") returned 0
	[0133.617] lstrlenA (lpString="*.docx") returned 6
	[0133.617] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.xls") returned 0
	[0133.617] lstrlenA (lpString="*.xls") returned 5
	[0133.617] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.xlsx") returned 0
	[0133.617] lstrlenA (lpString="*.xlsx") returned 6
	[0133.617] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.ppt") returned 0
	[0133.617] lstrlenA (lpString="*.ppt") returned 5
	[0133.617] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.pptx") returned 0
	[0133.617] lstrlenA (lpString="*.pptx") returned 6
	[0133.617] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.txt") returned 0
	[0133.617] lstrlenA (lpString="*.txt") returned 5
	[0133.617] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.pdf") returned 0
	[0133.617] lstrlenA (lpString="*.pdf") returned 5
	[0133.617] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.htm") returned 0
	[0133.617] lstrlenA (lpString="*.htm") returned 5
	[0133.617] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.html") returned 0
	[0133.617] lstrlenA (lpString="*.html") returned 6
	[0133.617] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.mdb") returned 0
	[0133.617] lstrlenA (lpString="*.mdb") returned 5
	[0133.617] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.pfx") returned 0
	[0133.617] lstrlenA (lpString="*.pfx") returned 5
	[0133.617] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.md") returned 0
	[0133.617] lstrlenA (lpString="*.md") returned 4
	[0133.617] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.lnk") returned 0
	[0133.618] lstrlenA (lpString="*.lnk") returned 5
	[0133.618] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.torrent") returned 0
	[0133.618] lstrlenA (lpString="*.torrent") returned 9
	[0133.618] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.mov") returned 0
	[0133.618] lstrlenA (lpString="*.mov") returned 5
	[0133.618] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.3gp") returned 0
	[0133.618] lstrlenA (lpString="*.3gp") returned 5
	[0133.618] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.mpeg") returned 0
	[0133.618] lstrlenA (lpString="*.mpeg") returned 6
	[0133.618] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.mpg") returned 0
	[0133.618] lstrlenA (lpString="*.mpg") returned 5
	[0133.618] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.flv") returned 0
	[0133.618] lstrlenA (lpString="*.flv") returned 5
	[0133.618] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.avi") returned 0
	[0133.618] lstrlenA (lpString="*.avi") returned 5
	[0133.618] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.mp4") returned 0
	[0133.618] lstrlenA (lpString="*.mp4") returned 5
	[0133.618] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.wmv") returned 0
	[0133.618] lstrlenA (lpString="*.wmv") returned 5
	[0133.618] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.mkv") returned 0
	[0133.618] lstrlenA (lpString="*.mkv") returned 5
	[0133.618] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.mp3") returned 0
	[0133.618] lstrlenA (lpString="*.mp3") returned 5
	[0133.618] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.wav") returned 0
	[0133.618] lstrlenA (lpString="*.wav") returned 5
	[0133.618] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.flac") returned 0
	[0133.618] lstrlenA (lpString="*.flac") returned 6
	[0133.618] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.wma") returned 0
	[0133.618] lstrlenA (lpString="*.wma") returned 5
	[0133.618] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.au3") returned 0
	[0133.618] lstrlenA (lpString="*.au3") returned 5
	[0133.618] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.ahk") returned 0
	[0133.618] lstrlenA (lpString="*.ahk") returned 5
	[0133.618] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.c") returned 0
	[0133.618] lstrlenA (lpString="*.c") returned 3
	[0133.619] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.cc") returned 0
	[0133.619] lstrlenA (lpString="*.cc") returned 4
	[0133.619] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.cpp") returned 0
	[0133.619] lstrlenA (lpString="*.cpp") returned 5
	[0133.619] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.cxx") returned 0
	[0133.619] lstrlenA (lpString="*.cxx") returned 5
	[0133.619] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.c++") returned 0
	[0133.619] lstrlenA (lpString="*.c++") returned 5
	[0133.619] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.cs") returned 0
	[0133.619] lstrlenA (lpString="*.cs") returned 4
	[0133.619] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.vb") returned 0
	[0133.619] lstrlenA (lpString="*.vb") returned 4
	[0133.619] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.bas") returned 0
	[0133.619] lstrlenA (lpString="*.bas") returned 5
	[0133.619] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.csproj") returned 0
	[0133.619] lstrlenA (lpString="*.csproj") returned 8
	[0133.619] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.vbproj") returned 0
	[0133.619] lstrlenA (lpString="*.vbproj") returned 8
	[0133.619] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.vcxproj") returned 0
	[0133.619] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.619] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.manifest") returned 0
	[0133.619] lstrlenA (lpString="*.manifest") returned 10
	[0133.619] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.php") returned 0
	[0133.619] lstrlenA (lpString="*.php") returned 5
	[0133.619] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.vbe") returned 0
	[0133.619] lstrlenA (lpString="*.vbe") returned 5
	[0133.619] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.vba") returned 0
	[0133.619] lstrlenA (lpString="*.vba") returned 5
	[0133.619] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.vbs") returned 0
	[0133.619] lstrlenA (lpString="*.vbs") returned 5
	[0133.619] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.bat") returned 0
	[0133.619] lstrlenA (lpString="*.bat") returned 5
	[0133.619] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.cmd") returned 0
	[0133.619] lstrlenA (lpString="*.cmd") returned 5
	[0133.619] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.js") returned 0
	[0133.619] lstrlenA (lpString="*.js") returned 4
	[0133.620] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.jscript") returned 0
	[0133.620] lstrlenA (lpString="*.jscript") returned 9
	[0133.620] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.hta") returned 0
	[0133.620] lstrlenA (lpString="*.hta") returned 5
	[0133.620] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.php7") returned 0
	[0133.620] lstrlenA (lpString="*.php7") returned 6
	[0133.620] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.db") returned 0
	[0133.620] lstrlenA (lpString="*.db") returned 4
	[0133.620] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", pszSpec="*.swf") returned 1
	[0133.620] lstrlenA (lpString="*.swf") returned 5
	[0133.620] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf") returned="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf"
	[0133.620] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf") returned="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf"
	[0133.620] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf.") returned="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf."
	[0133.620] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf.exe") returned="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf.exe"
	[0133.620] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\adcspz.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0133.620] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc77e
	[0133.620] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x865ed820, dwHighDateTime=0x1d4d364), lpLastAccessTime=0x407536*(dwLowDateTime=0xe3779c00, dwHighDateTime=0x1d4d2b4), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe3779c00, dwHighDateTime=0x1d4d2b4)) returned 1
	[0133.620] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.620] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xc73c, lpOverlapped=0x0) returned 1
	[0133.621] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf") returned="ADCSPz.swf"
	[0133.622] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.622] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xc73c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xc73c, lpOverlapped=0x0) returned 1
	[0133.622] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.622] CloseHandle (hObject=0x20c) returned 1
	[0133.622] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\adcspz.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\adcspz.swf.exe")) returned 1
	[0133.623] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b235fd0, ftCreationTime.dwHighDateTime=0x1d4cc24, ftLastAccessTime.dwLowDateTime=0x3741b360, ftLastAccessTime.dwHighDateTime=0x1d4cf46, ftLastWriteTime.dwLowDateTime=0x3741b360, ftLastWriteTime.dwHighDateTime=0x1d4cf46, nFileSizeHigh=0x0, nFileSizeLow=0xbcb9, dwReserved0=0x12, dwReserved1=0x1, cFileName="BSlA0Q_DsXzsosWLcK0B.flv", cAlternateFileName="BSLA0Q~1.FLV")) returned 1
	[0133.623] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0133.623] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="BSlA0Q_DsXzsosWLcK0B.flv") returned 1
	[0133.623] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="BSlA0Q_DsXzsosWLcK0B.flv") returned 1
	[0133.623] lstrcmpiA (lpString1="", lpString2="BSlA0Q_DsXzsosWLcK0B.flv") returned -1
	[0133.623] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\ADCSPz.swf") returned="ADCSPz.swf"
	[0133.623] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0133.623] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0133.623] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.623] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0133.623] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="BSlA0Q_DsXzsosWLcK0B.flv" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv") returned="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv"
	[0133.623] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv", pszSpec="*.zip") returned 0
	[0133.623] lstrlenA (lpString="*.zip") returned 5
	[0133.623] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv", pszSpec="*.rar") returned 0
	[0133.623] lstrlenA (lpString="*.rar") returned 5
	[0133.623] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv", pszSpec="*.7z") returned 0
	[0133.623] lstrlenA (lpString="*.7z") returned 4
	[0133.623] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv", pszSpec="*.tar") returned 0
	[0133.623] lstrlenA (lpString="*.tar") returned 5
	[0133.623] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv", pszSpec="*.gzip") returned 0
	[0133.623] lstrlenA (lpString="*.gzip") returned 6
	[0133.623] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv", pszSpec="*.jpg") returned 0
	[0133.623] lstrlenA (lpString="*.jpg") returned 5
	[0133.623] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv", pszSpec="*.jpeg") returned 0
	[0133.623] lstrlenA (lpString="*.jpeg") returned 6
	[0133.623] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv", pszSpec="*.bmp") returned 0
	[0133.623] lstrlenA (lpString="*.bmp") returned 5
	[0133.623] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv", pszSpec="*.gif") returned 0
	[0133.623] lstrlenA (lpString="*.gif") returned 5
	[0133.624] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv", pszSpec="*.png") returned 0
	[0133.624] lstrlenA (lpString="*.png") returned 5
	[0133.624] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv", pszSpec="*.doc") returned 0
	[0133.624] lstrlenA (lpString="*.doc") returned 5
	[0133.624] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv", pszSpec="*.docx") returned 0
	[0133.624] lstrlenA (lpString="*.docx") returned 6
	[0133.624] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv", pszSpec="*.xls") returned 0
	[0133.624] lstrlenA (lpString="*.xls") returned 5
	[0133.624] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv", pszSpec="*.xlsx") returned 0
	[0133.624] lstrlenA (lpString="*.xlsx") returned 6
	[0133.624] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv", pszSpec="*.ppt") returned 0
	[0133.624] lstrlenA (lpString="*.ppt") returned 5
	[0133.624] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv", pszSpec="*.pptx") returned 0
	[0133.624] lstrlenA (lpString="*.pptx") returned 6
	[0133.624] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv", pszSpec="*.txt") returned 0
	[0133.624] lstrlenA (lpString="*.txt") returned 5
	[0133.624] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv", pszSpec="*.pdf") returned 0
	[0133.624] lstrlenA (lpString="*.pdf") returned 5
	[0133.624] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv", pszSpec="*.htm") returned 0
	[0133.624] lstrlenA (lpString="*.htm") returned 5
	[0133.624] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv", pszSpec="*.html") returned 0
	[0133.624] lstrlenA (lpString="*.html") returned 6
	[0133.624] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv", pszSpec="*.mdb") returned 0
	[0133.624] lstrlenA (lpString="*.mdb") returned 5
	[0133.624] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv", pszSpec="*.pfx") returned 0
	[0133.624] lstrlenA (lpString="*.pfx") returned 5
	[0133.624] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv", pszSpec="*.md") returned 0
	[0133.624] lstrlenA (lpString="*.md") returned 4
	[0133.624] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv", pszSpec="*.lnk") returned 0
	[0133.624] lstrlenA (lpString="*.lnk") returned 5
	[0133.624] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv", pszSpec="*.torrent") returned 0
	[0133.624] lstrlenA (lpString="*.torrent") returned 9
	[0133.624] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv", pszSpec="*.mov") returned 0
	[0133.624] lstrlenA (lpString="*.mov") returned 5
	[0133.624] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv", pszSpec="*.3gp") returned 0
	[0133.624] lstrlenA (lpString="*.3gp") returned 5
	[0133.624] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv", pszSpec="*.mpeg") returned 0
	[0133.625] lstrlenA (lpString="*.mpeg") returned 6
	[0133.625] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv", pszSpec="*.mpg") returned 0
	[0133.625] lstrlenA (lpString="*.mpg") returned 5
	[0133.625] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv", pszSpec="*.flv") returned 1
	[0133.625] lstrlenA (lpString="*.flv") returned 5
	[0133.625] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv") returned="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv"
	[0133.625] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv") returned="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv"
	[0133.625] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv.") returned="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv."
	[0133.625] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv.exe") returned="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv.exe"
	[0133.625] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\bsla0q_dsxzsoswlck0b.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0133.625] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbcb9
	[0133.625] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3b235fd0, dwHighDateTime=0x1d4cc24), lpLastAccessTime=0x407536*(dwLowDateTime=0x3741b360, dwHighDateTime=0x1d4cf46), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3741b360, dwHighDateTime=0x1d4cf46)) returned 1
	[0133.625] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.625] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xbc77, lpOverlapped=0x0) returned 1
	[0133.626] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv") returned="BSlA0Q_DsXzsosWLcK0B.flv"
	[0133.626] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.626] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xbc77, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xbc77, lpOverlapped=0x0) returned 1
	[0133.627] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.627] CloseHandle (hObject=0x20c) returned 1
	[0133.627] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\bsla0q_dsxzsoswlck0b.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\bsla0q_dsxzsoswlck0b.flv.exe")) returned 1
	[0133.627] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc37d9260, ftCreationTime.dwHighDateTime=0x1d4d57a, ftLastAccessTime.dwLowDateTime=0xf6b60b80, ftLastAccessTime.dwHighDateTime=0x1d4d296, ftLastWriteTime.dwLowDateTime=0xf6b60b80, ftLastWriteTime.dwHighDateTime=0x1d4d296, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="Btbl", cAlternateFileName="")) returned 1
	[0133.627] lstrcmpA (lpString1=".", lpString2="Btbl") returned -1
	[0133.627] lstrcmpA (lpString1="..", lpString2="Btbl") returned -1
	[0133.627] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\BSlA0Q_DsXzsosWLcK0B.flv") returned="BSlA0Q_DsXzsosWLcK0B.flv"
	[0133.627] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="Btbl" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl") returned="C:\\Users\\FD1HVy\\Desktop\\Btbl"
	[0133.627] lstrlenA (lpString="C:\\Users\\FD1HVy\\Desktop\\Btbl") returned 28
	[0133.628] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Btbl\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc37d9260, ftCreationTime.dwHighDateTime=0x1d4d57a, ftLastAccessTime.dwLowDateTime=0xf6b60b80, ftLastAccessTime.dwHighDateTime=0x1d4d296, ftLastWriteTime.dwLowDateTime=0xf6b60b80, ftLastWriteTime.dwHighDateTime=0x1d4d296, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName=".", cAlternateFileName="")) returned 0x7cb750
	[0133.628] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0133.628] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc37d9260, ftCreationTime.dwHighDateTime=0x1d4d57a, ftLastAccessTime.dwLowDateTime=0xf6b60b80, ftLastAccessTime.dwHighDateTime=0x1d4d296, ftLastWriteTime.dwLowDateTime=0xf6b60b80, ftLastWriteTime.dwHighDateTime=0x1d4d296, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="..", cAlternateFileName="")) returned 1
	[0133.628] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0133.628] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0133.628] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x127fe650, ftCreationTime.dwHighDateTime=0x1d4cf8c, ftLastAccessTime.dwLowDateTime=0x2331b4f0, ftLastAccessTime.dwHighDateTime=0x1d4ca33, ftLastWriteTime.dwLowDateTime=0x2331b4f0, ftLastWriteTime.dwHighDateTime=0x1d4ca33, nFileSizeHigh=0x0, nFileSizeLow=0x151ef, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="-vcSsB9bX.pptx", cAlternateFileName="-VCSSB~1.PPT")) returned 1
	[0133.628] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0133.628] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="-vcSsB9bX.pptx") returned -1
	[0133.628] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="-vcSsB9bX.pptx") returned -1
	[0133.628] lstrcmpiA (lpString1="", lpString2="-vcSsB9bX.pptx") returned -1
	[0133.628] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\Btbl\\*.*") returned="*.*"
	[0133.628] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\Btbl\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\") returned="C:\\Users\\FD1HVy\\Desktop\\Btbl\\"
	[0133.628] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\Btbl\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\Btbl\\") returned=""
	[0133.628] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\Btbl\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.628] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Btbl\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\btbl\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0133.628] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Btbl\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\btbl\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0133.629] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0133.629] WriteFile (in: hFile=0x210, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0133.629] SetFileTime (hFile=0x210, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0133.630] CloseHandle (hObject=0x210) returned 1
	[0133.630] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\", lpString2="-vcSsB9bX.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\-vcSsB9bX.pptx") returned="C:\\Users\\FD1HVy\\Desktop\\Btbl\\-vcSsB9bX.pptx"
	[0133.630] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\-vcSsB9bX.pptx", pszSpec="*.zip") returned 0
	[0133.630] lstrlenA (lpString="*.zip") returned 5
	[0133.630] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\-vcSsB9bX.pptx", pszSpec="*.rar") returned 0
	[0133.630] lstrlenA (lpString="*.rar") returned 5
	[0133.630] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\-vcSsB9bX.pptx", pszSpec="*.7z") returned 0
	[0133.630] lstrlenA (lpString="*.7z") returned 4
	[0133.630] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\-vcSsB9bX.pptx", pszSpec="*.tar") returned 0
	[0133.630] lstrlenA (lpString="*.tar") returned 5
	[0133.630] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\-vcSsB9bX.pptx", pszSpec="*.gzip") returned 0
	[0133.630] lstrlenA (lpString="*.gzip") returned 6
	[0133.630] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\-vcSsB9bX.pptx", pszSpec="*.jpg") returned 0
	[0133.630] lstrlenA (lpString="*.jpg") returned 5
	[0133.630] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\-vcSsB9bX.pptx", pszSpec="*.jpeg") returned 0
	[0133.630] lstrlenA (lpString="*.jpeg") returned 6
	[0133.630] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\-vcSsB9bX.pptx", pszSpec="*.bmp") returned 0
	[0133.630] lstrlenA (lpString="*.bmp") returned 5
	[0133.630] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\-vcSsB9bX.pptx", pszSpec="*.gif") returned 0
	[0133.630] lstrlenA (lpString="*.gif") returned 5
	[0133.630] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\-vcSsB9bX.pptx", pszSpec="*.png") returned 0
	[0133.630] lstrlenA (lpString="*.png") returned 5
	[0133.630] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\-vcSsB9bX.pptx", pszSpec="*.doc") returned 0
	[0133.630] lstrlenA (lpString="*.doc") returned 5
	[0133.630] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\-vcSsB9bX.pptx", pszSpec="*.docx") returned 0
	[0133.630] lstrlenA (lpString="*.docx") returned 6
	[0133.630] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\-vcSsB9bX.pptx", pszSpec="*.xls") returned 0
	[0133.630] lstrlenA (lpString="*.xls") returned 5
	[0133.630] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\-vcSsB9bX.pptx", pszSpec="*.xlsx") returned 0
	[0133.630] lstrlenA (lpString="*.xlsx") returned 6
	[0133.630] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\-vcSsB9bX.pptx", pszSpec="*.ppt") returned 0
	[0133.631] lstrlenA (lpString="*.ppt") returned 5
	[0133.631] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\-vcSsB9bX.pptx", pszSpec="*.pptx") returned 1
	[0133.631] lstrlenA (lpString="*.pptx") returned 6
	[0133.631] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Desktop\\Btbl\\-vcSsB9bX.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\-vcSsB9bX.pptx") returned="C:\\Users\\FD1HVy\\Desktop\\Btbl\\-vcSsB9bX.pptx"
	[0133.631] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Desktop\\Btbl\\-vcSsB9bX.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\-vcSsB9bX.pptx") returned="C:\\Users\\FD1HVy\\Desktop\\Btbl\\-vcSsB9bX.pptx"
	[0133.631] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\-vcSsB9bX.pptx", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\-vcSsB9bX.pptx.") returned="C:\\Users\\FD1HVy\\Desktop\\Btbl\\-vcSsB9bX.pptx."
	[0133.631] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\-vcSsB9bX.pptx.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\-vcSsB9bX.pptx.exe") returned="C:\\Users\\FD1HVy\\Desktop\\Btbl\\-vcSsB9bX.pptx.exe"
	[0133.631] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Btbl\\-vcSsB9bX.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\btbl\\-vcssb9bx.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0133.631] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x151ef
	[0133.631] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x127fe650, dwHighDateTime=0x1d4cf8c), lpLastAccessTime=0x407536*(dwLowDateTime=0x2331b4f0, dwHighDateTime=0x1d4ca33), lpLastWriteTime=0x40753e*(dwLowDateTime=0x2331b4f0, dwHighDateTime=0x1d4ca33)) returned 1
	[0133.631] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.631] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x151ad, lpOverlapped=0x0) returned 1
	[0133.632] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\Btbl\\-vcSsB9bX.pptx") returned="-vcSsB9bX.pptx"
	[0133.633] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.633] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x151ad, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x151ad, lpOverlapped=0x0) returned 1
	[0133.633] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.633] CloseHandle (hObject=0x210) returned 1
	[0133.633] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\Btbl\\-vcSsB9bX.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\btbl\\-vcssb9bx.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\Btbl\\-vcSsB9bX.pptx.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\btbl\\-vcssb9bx.pptx.exe")) returned 1
	[0133.634] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb100df20, ftCreationTime.dwHighDateTime=0x1d4d05c, ftLastAccessTime.dwLowDateTime=0x3e872c60, ftLastAccessTime.dwHighDateTime=0x1d4d197, ftLastWriteTime.dwLowDateTime=0x3e872c60, ftLastWriteTime.dwHighDateTime=0x1d4d197, nFileSizeHigh=0x0, nFileSizeLow=0x14aa1, dwReserved0=0x15, dwReserved1=0x1, cFileName="7Vt5SGzu3VPPfyS3.odp", cAlternateFileName="7VT5SG~1.ODP")) returned 1
	[0133.634] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0133.634] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="7Vt5SGzu3VPPfyS3.odp") returned 1
	[0133.634] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="7Vt5SGzu3VPPfyS3.odp") returned 1
	[0133.634] lstrcmpiA (lpString1="", lpString2="7Vt5SGzu3VPPfyS3.odp") returned -1
	[0133.634] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\Btbl\\-vcSsB9bX.pptx") returned="-vcSsB9bX.pptx"
	[0133.634] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\Btbl\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\") returned="C:\\Users\\FD1HVy\\Desktop\\Btbl\\"
	[0133.634] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\Btbl\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\Btbl\\") returned=""
	[0133.634] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\Btbl\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.634] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Btbl\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\btbl\\how-to-decrypt-files.htm")) returned 0x20
	[0133.634] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\", lpString2="7Vt5SGzu3VPPfyS3.odp" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp") returned="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp"
	[0133.634] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.zip") returned 0
	[0133.634] lstrlenA (lpString="*.zip") returned 5
	[0133.634] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.rar") returned 0
	[0133.634] lstrlenA (lpString="*.rar") returned 5
	[0133.634] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.7z") returned 0
	[0133.635] lstrlenA (lpString="*.7z") returned 4
	[0133.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.tar") returned 0
	[0133.635] lstrlenA (lpString="*.tar") returned 5
	[0133.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.gzip") returned 0
	[0133.635] lstrlenA (lpString="*.gzip") returned 6
	[0133.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.jpg") returned 0
	[0133.635] lstrlenA (lpString="*.jpg") returned 5
	[0133.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.jpeg") returned 0
	[0133.635] lstrlenA (lpString="*.jpeg") returned 6
	[0133.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.bmp") returned 0
	[0133.635] lstrlenA (lpString="*.bmp") returned 5
	[0133.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.gif") returned 0
	[0133.635] lstrlenA (lpString="*.gif") returned 5
	[0133.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.png") returned 0
	[0133.635] lstrlenA (lpString="*.png") returned 5
	[0133.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.doc") returned 0
	[0133.635] lstrlenA (lpString="*.doc") returned 5
	[0133.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.docx") returned 0
	[0133.635] lstrlenA (lpString="*.docx") returned 6
	[0133.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.xls") returned 0
	[0133.635] lstrlenA (lpString="*.xls") returned 5
	[0133.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.xlsx") returned 0
	[0133.635] lstrlenA (lpString="*.xlsx") returned 6
	[0133.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.ppt") returned 0
	[0133.635] lstrlenA (lpString="*.ppt") returned 5
	[0133.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.pptx") returned 0
	[0133.635] lstrlenA (lpString="*.pptx") returned 6
	[0133.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.txt") returned 0
	[0133.635] lstrlenA (lpString="*.txt") returned 5
	[0133.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.pdf") returned 0
	[0133.635] lstrlenA (lpString="*.pdf") returned 5
	[0133.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.htm") returned 0
	[0133.635] lstrlenA (lpString="*.htm") returned 5
	[0133.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.html") returned 0
	[0133.635] lstrlenA (lpString="*.html") returned 6
	[0133.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.mdb") returned 0
	[0133.636] lstrlenA (lpString="*.mdb") returned 5
	[0133.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.pfx") returned 0
	[0133.636] lstrlenA (lpString="*.pfx") returned 5
	[0133.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.md") returned 0
	[0133.636] lstrlenA (lpString="*.md") returned 4
	[0133.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.lnk") returned 0
	[0133.636] lstrlenA (lpString="*.lnk") returned 5
	[0133.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.torrent") returned 0
	[0133.636] lstrlenA (lpString="*.torrent") returned 9
	[0133.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.mov") returned 0
	[0133.636] lstrlenA (lpString="*.mov") returned 5
	[0133.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.3gp") returned 0
	[0133.636] lstrlenA (lpString="*.3gp") returned 5
	[0133.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.mpeg") returned 0
	[0133.636] lstrlenA (lpString="*.mpeg") returned 6
	[0133.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.mpg") returned 0
	[0133.636] lstrlenA (lpString="*.mpg") returned 5
	[0133.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.flv") returned 0
	[0133.636] lstrlenA (lpString="*.flv") returned 5
	[0133.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.avi") returned 0
	[0133.636] lstrlenA (lpString="*.avi") returned 5
	[0133.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.mp4") returned 0
	[0133.636] lstrlenA (lpString="*.mp4") returned 5
	[0133.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.wmv") returned 0
	[0133.636] lstrlenA (lpString="*.wmv") returned 5
	[0133.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.mkv") returned 0
	[0133.636] lstrlenA (lpString="*.mkv") returned 5
	[0133.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.mp3") returned 0
	[0133.636] lstrlenA (lpString="*.mp3") returned 5
	[0133.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.wav") returned 0
	[0133.636] lstrlenA (lpString="*.wav") returned 5
	[0133.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.flac") returned 0
	[0133.636] lstrlenA (lpString="*.flac") returned 6
	[0133.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.wma") returned 0
	[0133.637] lstrlenA (lpString="*.wma") returned 5
	[0133.637] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.au3") returned 0
	[0133.637] lstrlenA (lpString="*.au3") returned 5
	[0133.637] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.ahk") returned 0
	[0133.637] lstrlenA (lpString="*.ahk") returned 5
	[0133.637] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.c") returned 0
	[0133.637] lstrlenA (lpString="*.c") returned 3
	[0133.637] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.cc") returned 0
	[0133.637] lstrlenA (lpString="*.cc") returned 4
	[0133.637] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.cpp") returned 0
	[0133.637] lstrlenA (lpString="*.cpp") returned 5
	[0133.637] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.cxx") returned 0
	[0133.637] lstrlenA (lpString="*.cxx") returned 5
	[0133.637] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.c++") returned 0
	[0133.637] lstrlenA (lpString="*.c++") returned 5
	[0133.637] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.cs") returned 0
	[0133.637] lstrlenA (lpString="*.cs") returned 4
	[0133.637] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.vb") returned 0
	[0133.637] lstrlenA (lpString="*.vb") returned 4
	[0133.637] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.bas") returned 0
	[0133.637] lstrlenA (lpString="*.bas") returned 5
	[0133.637] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.csproj") returned 0
	[0133.637] lstrlenA (lpString="*.csproj") returned 8
	[0133.637] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.vbproj") returned 0
	[0133.637] lstrlenA (lpString="*.vbproj") returned 8
	[0133.637] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.vcxproj") returned 0
	[0133.637] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.637] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.manifest") returned 0
	[0133.637] lstrlenA (lpString="*.manifest") returned 10
	[0133.637] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.php") returned 0
	[0133.637] lstrlenA (lpString="*.php") returned 5
	[0133.637] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.vbe") returned 0
	[0133.637] lstrlenA (lpString="*.vbe") returned 5
	[0133.637] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.vba") returned 0
	[0133.637] lstrlenA (lpString="*.vba") returned 5
	[0133.638] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.vbs") returned 0
	[0133.638] lstrlenA (lpString="*.vbs") returned 5
	[0133.638] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.bat") returned 0
	[0133.638] lstrlenA (lpString="*.bat") returned 5
	[0133.638] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.cmd") returned 0
	[0133.638] lstrlenA (lpString="*.cmd") returned 5
	[0133.638] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.js") returned 0
	[0133.638] lstrlenA (lpString="*.js") returned 4
	[0133.638] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.jscript") returned 0
	[0133.638] lstrlenA (lpString="*.jscript") returned 9
	[0133.638] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.hta") returned 0
	[0133.638] lstrlenA (lpString="*.hta") returned 5
	[0133.638] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.php7") returned 0
	[0133.638] lstrlenA (lpString="*.php7") returned 6
	[0133.638] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.db") returned 0
	[0133.638] lstrlenA (lpString="*.db") returned 4
	[0133.638] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.swf") returned 0
	[0133.638] lstrlenA (lpString="*.swf") returned 5
	[0133.638] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.eml") returned 0
	[0133.638] lstrlenA (lpString="*.eml") returned 5
	[0133.638] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.part") returned 0
	[0133.638] lstrlenA (lpString="*.part") returned 6
	[0133.638] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.nfo") returned 0
	[0133.638] lstrlenA (lpString="*.nfo") returned 5
	[0133.638] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.rsa") returned 0
	[0133.638] lstrlenA (lpString="*.rsa") returned 5
	[0133.638] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.key") returned 0
	[0133.638] lstrlenA (lpString="*.key") returned 5
	[0133.638] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.aes") returned 0
	[0133.638] lstrlenA (lpString="*.aes") returned 5
	[0133.638] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.blob") returned 0
	[0133.638] lstrlenA (lpString="*.blob") returned 6
	[0133.638] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.btc") returned 0
	[0133.638] lstrlenA (lpString="*.btc") returned 5
	[0133.638] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp", pszSpec="*.wallet") returned 0
	[0133.639] lstrlenA (lpString="*.wallet") returned 8
	[0133.639] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34f8ea00, ftCreationTime.dwHighDateTime=0x1d4ce84, ftLastAccessTime.dwLowDateTime=0x34b0a0e0, ftLastAccessTime.dwHighDateTime=0x1d4d42b, ftLastWriteTime.dwLowDateTime=0x34b0a0e0, ftLastWriteTime.dwHighDateTime=0x1d4d42b, nFileSizeHigh=0x0, nFileSizeLow=0xa955, dwReserved0=0x0, dwReserved1=0x0, cFileName="JoFiL.docx", cAlternateFileName="JOFIL~1.DOC")) returned 1
	[0133.639] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0133.639] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="JoFiL.docx") returned -1
	[0133.639] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="JoFiL.docx") returned -1
	[0133.639] lstrcmpiA (lpString1="", lpString2="JoFiL.docx") returned -1
	[0133.639] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\Btbl\\7Vt5SGzu3VPPfyS3.odp") returned="7Vt5SGzu3VPPfyS3.odp"
	[0133.639] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\Btbl\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\") returned="C:\\Users\\FD1HVy\\Desktop\\Btbl\\"
	[0133.639] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\Btbl\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\Btbl\\") returned=""
	[0133.639] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\Btbl\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.639] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Btbl\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\btbl\\how-to-decrypt-files.htm")) returned 0x20
	[0133.639] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\", lpString2="JoFiL.docx" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\JoFiL.docx") returned="C:\\Users\\FD1HVy\\Desktop\\Btbl\\JoFiL.docx"
	[0133.639] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\JoFiL.docx", pszSpec="*.zip") returned 0
	[0133.639] lstrlenA (lpString="*.zip") returned 5
	[0133.639] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\JoFiL.docx", pszSpec="*.rar") returned 0
	[0133.639] lstrlenA (lpString="*.rar") returned 5
	[0133.639] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\JoFiL.docx", pszSpec="*.7z") returned 0
	[0133.639] lstrlenA (lpString="*.7z") returned 4
	[0133.639] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\JoFiL.docx", pszSpec="*.tar") returned 0
	[0133.639] lstrlenA (lpString="*.tar") returned 5
	[0133.639] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\JoFiL.docx", pszSpec="*.gzip") returned 0
	[0133.639] lstrlenA (lpString="*.gzip") returned 6
	[0133.639] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\JoFiL.docx", pszSpec="*.jpg") returned 0
	[0133.639] lstrlenA (lpString="*.jpg") returned 5
	[0133.639] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\JoFiL.docx", pszSpec="*.jpeg") returned 0
	[0133.639] lstrlenA (lpString="*.jpeg") returned 6
	[0133.639] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\JoFiL.docx", pszSpec="*.bmp") returned 0
	[0133.639] lstrlenA (lpString="*.bmp") returned 5
	[0133.639] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\JoFiL.docx", pszSpec="*.gif") returned 0
	[0133.639] lstrlenA (lpString="*.gif") returned 5
	[0133.639] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\JoFiL.docx", pszSpec="*.png") returned 0
	[0133.639] lstrlenA (lpString="*.png") returned 5
	[0133.639] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\JoFiL.docx", pszSpec="*.doc") returned 0
	[0133.640] lstrlenA (lpString="*.doc") returned 5
	[0133.640] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\JoFiL.docx", pszSpec="*.docx") returned 1
	[0133.640] lstrlenA (lpString="*.docx") returned 6
	[0133.640] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Desktop\\Btbl\\JoFiL.docx" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\JoFiL.docx") returned="C:\\Users\\FD1HVy\\Desktop\\Btbl\\JoFiL.docx"
	[0133.640] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Desktop\\Btbl\\JoFiL.docx" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\JoFiL.docx") returned="C:\\Users\\FD1HVy\\Desktop\\Btbl\\JoFiL.docx"
	[0133.640] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\JoFiL.docx", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\JoFiL.docx.") returned="C:\\Users\\FD1HVy\\Desktop\\Btbl\\JoFiL.docx."
	[0133.640] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\JoFiL.docx.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\JoFiL.docx.exe") returned="C:\\Users\\FD1HVy\\Desktop\\Btbl\\JoFiL.docx.exe"
	[0133.640] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Btbl\\JoFiL.docx" (normalized: "c:\\users\\fd1hvy\\desktop\\btbl\\jofil.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0133.640] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa955
	[0133.640] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x34f8ea00, dwHighDateTime=0x1d4ce84), lpLastAccessTime=0x407536*(dwLowDateTime=0x34b0a0e0, dwHighDateTime=0x1d4d42b), lpLastWriteTime=0x40753e*(dwLowDateTime=0x34b0a0e0, dwHighDateTime=0x1d4d42b)) returned 1
	[0133.640] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.640] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xa913, lpOverlapped=0x0) returned 1
	[0133.641] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\Btbl\\JoFiL.docx") returned="JoFiL.docx"
	[0133.641] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.641] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xa913, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xa913, lpOverlapped=0x0) returned 1
	[0133.641] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.642] CloseHandle (hObject=0x210) returned 1
	[0133.642] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\Btbl\\JoFiL.docx" (normalized: "c:\\users\\fd1hvy\\desktop\\btbl\\jofil.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\Btbl\\JoFiL.docx.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\btbl\\jofil.docx.exe")) returned 1
	[0133.642] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7dd4120, ftCreationTime.dwHighDateTime=0x1d4cf74, ftLastAccessTime.dwLowDateTime=0x968d50, ftLastAccessTime.dwHighDateTime=0x1d4ca09, ftLastWriteTime.dwLowDateTime=0x968d50, ftLastWriteTime.dwHighDateTime=0x1d4ca09, nFileSizeHigh=0x0, nFileSizeLow=0x8c6d, dwReserved0=0x12, dwReserved1=0x1, cFileName="TRLvMyxEjgwGohekGD1.swf", cAlternateFileName="TRLVMY~1.SWF")) returned 1
	[0133.642] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0133.642] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="TRLvMyxEjgwGohekGD1.swf") returned -1
	[0133.642] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="TRLvMyxEjgwGohekGD1.swf") returned -1
	[0133.642] lstrcmpiA (lpString1="", lpString2="TRLvMyxEjgwGohekGD1.swf") returned -1
	[0133.642] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\Btbl\\JoFiL.docx") returned="JoFiL.docx"
	[0133.642] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\Btbl\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\") returned="C:\\Users\\FD1HVy\\Desktop\\Btbl\\"
	[0133.642] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\Btbl\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\Btbl\\") returned=""
	[0133.642] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\Btbl\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.643] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Btbl\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\btbl\\how-to-decrypt-files.htm")) returned 0x20
	[0133.643] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\", lpString2="TRLvMyxEjgwGohekGD1.swf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf") returned="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf"
	[0133.643] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.zip") returned 0
	[0133.643] lstrlenA (lpString="*.zip") returned 5
	[0133.643] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.rar") returned 0
	[0133.643] lstrlenA (lpString="*.rar") returned 5
	[0133.643] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.7z") returned 0
	[0133.643] lstrlenA (lpString="*.7z") returned 4
	[0133.643] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.tar") returned 0
	[0133.643] lstrlenA (lpString="*.tar") returned 5
	[0133.643] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.gzip") returned 0
	[0133.643] lstrlenA (lpString="*.gzip") returned 6
	[0133.643] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.jpg") returned 0
	[0133.643] lstrlenA (lpString="*.jpg") returned 5
	[0133.643] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.jpeg") returned 0
	[0133.643] lstrlenA (lpString="*.jpeg") returned 6
	[0133.643] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.bmp") returned 0
	[0133.643] lstrlenA (lpString="*.bmp") returned 5
	[0133.643] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.gif") returned 0
	[0133.643] lstrlenA (lpString="*.gif") returned 5
	[0133.643] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.png") returned 0
	[0133.643] lstrlenA (lpString="*.png") returned 5
	[0133.643] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.doc") returned 0
	[0133.643] lstrlenA (lpString="*.doc") returned 5
	[0133.643] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.docx") returned 0
	[0133.643] lstrlenA (lpString="*.docx") returned 6
	[0133.643] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.xls") returned 0
	[0133.643] lstrlenA (lpString="*.xls") returned 5
	[0133.643] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.xlsx") returned 0
	[0133.644] lstrlenA (lpString="*.xlsx") returned 6
	[0133.644] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.ppt") returned 0
	[0133.644] lstrlenA (lpString="*.ppt") returned 5
	[0133.644] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.pptx") returned 0
	[0133.644] lstrlenA (lpString="*.pptx") returned 6
	[0133.644] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.txt") returned 0
	[0133.644] lstrlenA (lpString="*.txt") returned 5
	[0133.644] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.pdf") returned 0
	[0133.644] lstrlenA (lpString="*.pdf") returned 5
	[0133.644] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.htm") returned 0
	[0133.644] lstrlenA (lpString="*.htm") returned 5
	[0133.644] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.html") returned 0
	[0133.644] lstrlenA (lpString="*.html") returned 6
	[0133.644] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.mdb") returned 0
	[0133.644] lstrlenA (lpString="*.mdb") returned 5
	[0133.644] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.pfx") returned 0
	[0133.644] lstrlenA (lpString="*.pfx") returned 5
	[0133.644] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.md") returned 0
	[0133.644] lstrlenA (lpString="*.md") returned 4
	[0133.644] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.lnk") returned 0
	[0133.644] lstrlenA (lpString="*.lnk") returned 5
	[0133.644] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.torrent") returned 0
	[0133.644] lstrlenA (lpString="*.torrent") returned 9
	[0133.644] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.mov") returned 0
	[0133.644] lstrlenA (lpString="*.mov") returned 5
	[0133.644] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.3gp") returned 0
	[0133.644] lstrlenA (lpString="*.3gp") returned 5
	[0133.644] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.mpeg") returned 0
	[0133.644] lstrlenA (lpString="*.mpeg") returned 6
	[0133.644] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.mpg") returned 0
	[0133.644] lstrlenA (lpString="*.mpg") returned 5
	[0133.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.flv") returned 0
	[0133.645] lstrlenA (lpString="*.flv") returned 5
	[0133.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.avi") returned 0
	[0133.645] lstrlenA (lpString="*.avi") returned 5
	[0133.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.mp4") returned 0
	[0133.645] lstrlenA (lpString="*.mp4") returned 5
	[0133.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.wmv") returned 0
	[0133.645] lstrlenA (lpString="*.wmv") returned 5
	[0133.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.mkv") returned 0
	[0133.645] lstrlenA (lpString="*.mkv") returned 5
	[0133.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.mp3") returned 0
	[0133.645] lstrlenA (lpString="*.mp3") returned 5
	[0133.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.wav") returned 0
	[0133.645] lstrlenA (lpString="*.wav") returned 5
	[0133.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.flac") returned 0
	[0133.645] lstrlenA (lpString="*.flac") returned 6
	[0133.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.wma") returned 0
	[0133.645] lstrlenA (lpString="*.wma") returned 5
	[0133.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.au3") returned 0
	[0133.645] lstrlenA (lpString="*.au3") returned 5
	[0133.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.ahk") returned 0
	[0133.645] lstrlenA (lpString="*.ahk") returned 5
	[0133.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.c") returned 0
	[0133.645] lstrlenA (lpString="*.c") returned 3
	[0133.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.cc") returned 0
	[0133.645] lstrlenA (lpString="*.cc") returned 4
	[0133.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.cpp") returned 0
	[0133.645] lstrlenA (lpString="*.cpp") returned 5
	[0133.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.cxx") returned 0
	[0133.645] lstrlenA (lpString="*.cxx") returned 5
	[0133.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.c++") returned 0
	[0133.645] lstrlenA (lpString="*.c++") returned 5
	[0133.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.cs") returned 0
	[0133.645] lstrlenA (lpString="*.cs") returned 4
	[0133.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.vb") returned 0
	[0133.646] lstrlenA (lpString="*.vb") returned 4
	[0133.646] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.bas") returned 0
	[0133.646] lstrlenA (lpString="*.bas") returned 5
	[0133.646] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.csproj") returned 0
	[0133.646] lstrlenA (lpString="*.csproj") returned 8
	[0133.646] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.vbproj") returned 0
	[0133.646] lstrlenA (lpString="*.vbproj") returned 8
	[0133.646] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.vcxproj") returned 0
	[0133.646] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.646] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.manifest") returned 0
	[0133.646] lstrlenA (lpString="*.manifest") returned 10
	[0133.646] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.php") returned 0
	[0133.646] lstrlenA (lpString="*.php") returned 5
	[0133.646] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.vbe") returned 0
	[0133.646] lstrlenA (lpString="*.vbe") returned 5
	[0133.646] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.vba") returned 0
	[0133.646] lstrlenA (lpString="*.vba") returned 5
	[0133.646] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.vbs") returned 0
	[0133.646] lstrlenA (lpString="*.vbs") returned 5
	[0133.646] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.bat") returned 0
	[0133.646] lstrlenA (lpString="*.bat") returned 5
	[0133.646] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.cmd") returned 0
	[0133.646] lstrlenA (lpString="*.cmd") returned 5
	[0133.646] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.js") returned 0
	[0133.646] lstrlenA (lpString="*.js") returned 4
	[0133.646] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.jscript") returned 0
	[0133.646] lstrlenA (lpString="*.jscript") returned 9
	[0133.646] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.hta") returned 0
	[0133.646] lstrlenA (lpString="*.hta") returned 5
	[0133.646] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.php7") returned 0
	[0133.646] lstrlenA (lpString="*.php7") returned 6
	[0133.646] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.db") returned 0
	[0133.646] lstrlenA (lpString="*.db") returned 4
	[0133.646] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", pszSpec="*.swf") returned 1
	[0133.646] lstrlenA (lpString="*.swf") returned 5
	[0133.647] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf") returned="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf"
	[0133.647] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf") returned="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf"
	[0133.647] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf.") returned="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf."
	[0133.647] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf.exe") returned="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf.exe"
	[0133.647] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\btbl\\trlvmyxejgwgohekgd1.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0133.647] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8c6d
	[0133.647] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe7dd4120, dwHighDateTime=0x1d4cf74), lpLastAccessTime=0x407536*(dwLowDateTime=0x968d50, dwHighDateTime=0x1d4ca09), lpLastWriteTime=0x40753e*(dwLowDateTime=0x968d50, dwHighDateTime=0x1d4ca09)) returned 1
	[0133.647] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.647] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x8c2b, lpOverlapped=0x0) returned 1
	[0133.648] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf") returned="TRLvMyxEjgwGohekGD1.swf"
	[0133.654] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.654] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x8c2b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x8c2b, lpOverlapped=0x0) returned 1
	[0133.654] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.654] CloseHandle (hObject=0x210) returned 1
	[0133.654] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\btbl\\trlvmyxejgwgohekgd1.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\btbl\\trlvmyxejgwgohekgd1.swf.exe")) returned 1
	[0133.655] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xade1cd60, ftCreationTime.dwHighDateTime=0x1d4d2e4, ftLastAccessTime.dwLowDateTime=0x72151280, ftLastAccessTime.dwHighDateTime=0x1d4d166, ftLastWriteTime.dwLowDateTime=0x72151280, ftLastWriteTime.dwHighDateTime=0x1d4d166, nFileSizeHigh=0x0, nFileSizeLow=0xccf6, dwReserved0=0x1c, dwReserved1=0x1, cFileName="YK_v.wav", cAlternateFileName="")) returned 1
	[0133.655] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0133.655] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="YK_v.wav") returned -1
	[0133.655] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="YK_v.wav") returned -1
	[0133.655] lstrcmpiA (lpString1="", lpString2="YK_v.wav") returned -1
	[0133.655] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\Btbl\\TRLvMyxEjgwGohekGD1.swf") returned="TRLvMyxEjgwGohekGD1.swf"
	[0133.655] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\Btbl\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\") returned="C:\\Users\\FD1HVy\\Desktop\\Btbl\\"
	[0133.655] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\Btbl\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\Btbl\\") returned=""
	[0133.655] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\Btbl\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.655] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Btbl\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\btbl\\how-to-decrypt-files.htm")) returned 0x20
	[0133.655] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\", lpString2="YK_v.wav" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav") returned="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav"
	[0133.655] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav", pszSpec="*.zip") returned 0
	[0133.655] lstrlenA (lpString="*.zip") returned 5
	[0133.655] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav", pszSpec="*.rar") returned 0
	[0133.655] lstrlenA (lpString="*.rar") returned 5
	[0133.655] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav", pszSpec="*.7z") returned 0
	[0133.655] lstrlenA (lpString="*.7z") returned 4
	[0133.655] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav", pszSpec="*.tar") returned 0
	[0133.655] lstrlenA (lpString="*.tar") returned 5
	[0133.655] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav", pszSpec="*.gzip") returned 0
	[0133.655] lstrlenA (lpString="*.gzip") returned 6
	[0133.655] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav", pszSpec="*.jpg") returned 0
	[0133.656] lstrlenA (lpString="*.jpg") returned 5
	[0133.656] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav", pszSpec="*.jpeg") returned 0
	[0133.656] lstrlenA (lpString="*.jpeg") returned 6
	[0133.656] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav", pszSpec="*.bmp") returned 0
	[0133.656] lstrlenA (lpString="*.bmp") returned 5
	[0133.656] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav", pszSpec="*.gif") returned 0
	[0133.656] lstrlenA (lpString="*.gif") returned 5
	[0133.656] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav", pszSpec="*.png") returned 0
	[0133.656] lstrlenA (lpString="*.png") returned 5
	[0133.656] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav", pszSpec="*.doc") returned 0
	[0133.656] lstrlenA (lpString="*.doc") returned 5
	[0133.656] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav", pszSpec="*.docx") returned 0
	[0133.656] lstrlenA (lpString="*.docx") returned 6
	[0133.656] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav", pszSpec="*.xls") returned 0
	[0133.656] lstrlenA (lpString="*.xls") returned 5
	[0133.656] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav", pszSpec="*.xlsx") returned 0
	[0133.656] lstrlenA (lpString="*.xlsx") returned 6
	[0133.656] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav", pszSpec="*.ppt") returned 0
	[0133.656] lstrlenA (lpString="*.ppt") returned 5
	[0133.656] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav", pszSpec="*.pptx") returned 0
	[0133.656] lstrlenA (lpString="*.pptx") returned 6
	[0133.656] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav", pszSpec="*.txt") returned 0
	[0133.656] lstrlenA (lpString="*.txt") returned 5
	[0133.656] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav", pszSpec="*.pdf") returned 0
	[0133.656] lstrlenA (lpString="*.pdf") returned 5
	[0133.656] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav", pszSpec="*.htm") returned 0
	[0133.656] lstrlenA (lpString="*.htm") returned 5
	[0133.656] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav", pszSpec="*.html") returned 0
	[0133.656] lstrlenA (lpString="*.html") returned 6
	[0133.656] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav", pszSpec="*.mdb") returned 0
	[0133.656] lstrlenA (lpString="*.mdb") returned 5
	[0133.656] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav", pszSpec="*.pfx") returned 0
	[0133.656] lstrlenA (lpString="*.pfx") returned 5
	[0133.656] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav", pszSpec="*.md") returned 0
	[0133.656] lstrlenA (lpString="*.md") returned 4
	[0133.656] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav", pszSpec="*.lnk") returned 0
	[0133.657] lstrlenA (lpString="*.lnk") returned 5
	[0133.657] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav", pszSpec="*.torrent") returned 0
	[0133.657] lstrlenA (lpString="*.torrent") returned 9
	[0133.657] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav", pszSpec="*.mov") returned 0
	[0133.657] lstrlenA (lpString="*.mov") returned 5
	[0133.657] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav", pszSpec="*.3gp") returned 0
	[0133.657] lstrlenA (lpString="*.3gp") returned 5
	[0133.657] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav", pszSpec="*.mpeg") returned 0
	[0133.657] lstrlenA (lpString="*.mpeg") returned 6
	[0133.657] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav", pszSpec="*.mpg") returned 0
	[0133.657] lstrlenA (lpString="*.mpg") returned 5
	[0133.657] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav", pszSpec="*.flv") returned 0
	[0133.657] lstrlenA (lpString="*.flv") returned 5
	[0133.657] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav", pszSpec="*.avi") returned 0
	[0133.657] lstrlenA (lpString="*.avi") returned 5
	[0133.657] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav", pszSpec="*.mp4") returned 0
	[0133.657] lstrlenA (lpString="*.mp4") returned 5
	[0133.657] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav", pszSpec="*.wmv") returned 0
	[0133.657] lstrlenA (lpString="*.wmv") returned 5
	[0133.657] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav", pszSpec="*.mkv") returned 0
	[0133.657] lstrlenA (lpString="*.mkv") returned 5
	[0133.657] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav", pszSpec="*.mp3") returned 0
	[0133.657] lstrlenA (lpString="*.mp3") returned 5
	[0133.657] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav", pszSpec="*.wav") returned 1
	[0133.657] lstrlenA (lpString="*.wav") returned 5
	[0133.657] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav") returned="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav"
	[0133.657] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav") returned="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav"
	[0133.657] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav.") returned="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav."
	[0133.657] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav.exe") returned="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav.exe"
	[0133.657] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\btbl\\yk_v.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0133.658] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xccf6
	[0133.658] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xade1cd60, dwHighDateTime=0x1d4d2e4), lpLastAccessTime=0x407536*(dwLowDateTime=0x72151280, dwHighDateTime=0x1d4d166), lpLastWriteTime=0x40753e*(dwLowDateTime=0x72151280, dwHighDateTime=0x1d4d166)) returned 1
	[0133.658] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.658] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xccb4, lpOverlapped=0x0) returned 1
	[0133.659] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav") returned="YK_v.wav"
	[0133.659] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.659] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xccb4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xccb4, lpOverlapped=0x0) returned 1
	[0133.659] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.659] CloseHandle (hObject=0x210) returned 1
	[0133.659] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\btbl\\yk_v.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\btbl\\yk_v.wav.exe")) returned 1
	[0133.660] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35046df0, ftCreationTime.dwHighDateTime=0x1d4c83d, ftLastAccessTime.dwLowDateTime=0x356bb4e0, ftLastAccessTime.dwHighDateTime=0x1d4c835, ftLastWriteTime.dwLowDateTime=0x356bb4e0, ftLastWriteTime.dwHighDateTime=0x1d4c835, nFileSizeHigh=0x0, nFileSizeLow=0x11f94, dwReserved0=0x12, dwReserved1=0x1, cFileName="zGbyLnnoR.m4a", cAlternateFileName="ZGBYLN~1.M4A")) returned 1
	[0133.660] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0133.660] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="zGbyLnnoR.m4a") returned -1
	[0133.660] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="zGbyLnnoR.m4a") returned -1
	[0133.660] lstrcmpiA (lpString1="", lpString2="zGbyLnnoR.m4a") returned -1
	[0133.660] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\Btbl\\YK_v.wav") returned="YK_v.wav"
	[0133.660] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\Btbl\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\") returned="C:\\Users\\FD1HVy\\Desktop\\Btbl\\"
	[0133.660] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\Btbl\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\Btbl\\") returned=""
	[0133.660] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\Btbl\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.660] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Btbl\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\btbl\\how-to-decrypt-files.htm")) returned 0x20
	[0133.660] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\", lpString2="zGbyLnnoR.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a") returned="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a"
	[0133.660] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.zip") returned 0
	[0133.660] lstrlenA (lpString="*.zip") returned 5
	[0133.660] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.rar") returned 0
	[0133.660] lstrlenA (lpString="*.rar") returned 5
	[0133.660] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.7z") returned 0
	[0133.660] lstrlenA (lpString="*.7z") returned 4
	[0133.660] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.tar") returned 0
	[0133.661] lstrlenA (lpString="*.tar") returned 5
	[0133.661] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.gzip") returned 0
	[0133.661] lstrlenA (lpString="*.gzip") returned 6
	[0133.661] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.jpg") returned 0
	[0133.661] lstrlenA (lpString="*.jpg") returned 5
	[0133.661] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.jpeg") returned 0
	[0133.661] lstrlenA (lpString="*.jpeg") returned 6
	[0133.661] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.bmp") returned 0
	[0133.661] lstrlenA (lpString="*.bmp") returned 5
	[0133.661] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.gif") returned 0
	[0133.661] lstrlenA (lpString="*.gif") returned 5
	[0133.661] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.png") returned 0
	[0133.661] lstrlenA (lpString="*.png") returned 5
	[0133.661] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.doc") returned 0
	[0133.661] lstrlenA (lpString="*.doc") returned 5
	[0133.661] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.docx") returned 0
	[0133.661] lstrlenA (lpString="*.docx") returned 6
	[0133.661] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.xls") returned 0
	[0133.661] lstrlenA (lpString="*.xls") returned 5
	[0133.661] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.xlsx") returned 0
	[0133.661] lstrlenA (lpString="*.xlsx") returned 6
	[0133.661] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.ppt") returned 0
	[0133.661] lstrlenA (lpString="*.ppt") returned 5
	[0133.661] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.pptx") returned 0
	[0133.661] lstrlenA (lpString="*.pptx") returned 6
	[0133.661] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.txt") returned 0
	[0133.661] lstrlenA (lpString="*.txt") returned 5
	[0133.661] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.pdf") returned 0
	[0133.661] lstrlenA (lpString="*.pdf") returned 5
	[0133.661] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.htm") returned 0
	[0133.661] lstrlenA (lpString="*.htm") returned 5
	[0133.661] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.html") returned 0
	[0133.661] lstrlenA (lpString="*.html") returned 6
	[0133.661] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.mdb") returned 0
	[0133.661] lstrlenA (lpString="*.mdb") returned 5
	[0133.661] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.pfx") returned 0
	[0133.662] lstrlenA (lpString="*.pfx") returned 5
	[0133.662] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.md") returned 0
	[0133.662] lstrlenA (lpString="*.md") returned 4
	[0133.662] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.lnk") returned 0
	[0133.662] lstrlenA (lpString="*.lnk") returned 5
	[0133.662] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.torrent") returned 0
	[0133.662] lstrlenA (lpString="*.torrent") returned 9
	[0133.662] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.mov") returned 0
	[0133.662] lstrlenA (lpString="*.mov") returned 5
	[0133.662] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.3gp") returned 0
	[0133.662] lstrlenA (lpString="*.3gp") returned 5
	[0133.662] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.mpeg") returned 0
	[0133.662] lstrlenA (lpString="*.mpeg") returned 6
	[0133.662] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.mpg") returned 0
	[0133.662] lstrlenA (lpString="*.mpg") returned 5
	[0133.662] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.flv") returned 0
	[0133.662] lstrlenA (lpString="*.flv") returned 5
	[0133.662] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.avi") returned 0
	[0133.662] lstrlenA (lpString="*.avi") returned 5
	[0133.662] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.mp4") returned 0
	[0133.662] lstrlenA (lpString="*.mp4") returned 5
	[0133.662] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.wmv") returned 0
	[0133.662] lstrlenA (lpString="*.wmv") returned 5
	[0133.662] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.mkv") returned 0
	[0133.662] lstrlenA (lpString="*.mkv") returned 5
	[0133.662] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.mp3") returned 0
	[0133.662] lstrlenA (lpString="*.mp3") returned 5
	[0133.662] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.wav") returned 0
	[0133.662] lstrlenA (lpString="*.wav") returned 5
	[0133.662] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.flac") returned 0
	[0133.662] lstrlenA (lpString="*.flac") returned 6
	[0133.662] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.wma") returned 0
	[0133.662] lstrlenA (lpString="*.wma") returned 5
	[0133.662] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.au3") returned 0
	[0133.662] lstrlenA (lpString="*.au3") returned 5
	[0133.663] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.ahk") returned 0
	[0133.663] lstrlenA (lpString="*.ahk") returned 5
	[0133.663] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.c") returned 0
	[0133.663] lstrlenA (lpString="*.c") returned 3
	[0133.663] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.cc") returned 0
	[0133.663] lstrlenA (lpString="*.cc") returned 4
	[0133.663] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.cpp") returned 0
	[0133.663] lstrlenA (lpString="*.cpp") returned 5
	[0133.663] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.cxx") returned 0
	[0133.663] lstrlenA (lpString="*.cxx") returned 5
	[0133.663] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.c++") returned 0
	[0133.663] lstrlenA (lpString="*.c++") returned 5
	[0133.663] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.cs") returned 0
	[0133.663] lstrlenA (lpString="*.cs") returned 4
	[0133.663] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.vb") returned 0
	[0133.663] lstrlenA (lpString="*.vb") returned 4
	[0133.663] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.bas") returned 0
	[0133.663] lstrlenA (lpString="*.bas") returned 5
	[0133.663] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.csproj") returned 0
	[0133.663] lstrlenA (lpString="*.csproj") returned 8
	[0133.663] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.vbproj") returned 0
	[0133.663] lstrlenA (lpString="*.vbproj") returned 8
	[0133.663] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.vcxproj") returned 0
	[0133.663] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.663] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.manifest") returned 0
	[0133.663] lstrlenA (lpString="*.manifest") returned 10
	[0133.663] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.php") returned 0
	[0133.663] lstrlenA (lpString="*.php") returned 5
	[0133.663] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.vbe") returned 0
	[0133.663] lstrlenA (lpString="*.vbe") returned 5
	[0133.663] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.vba") returned 0
	[0133.663] lstrlenA (lpString="*.vba") returned 5
	[0133.663] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.vbs") returned 0
	[0133.663] lstrlenA (lpString="*.vbs") returned 5
	[0133.664] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.bat") returned 0
	[0133.664] lstrlenA (lpString="*.bat") returned 5
	[0133.664] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.cmd") returned 0
	[0133.664] lstrlenA (lpString="*.cmd") returned 5
	[0133.664] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.js") returned 0
	[0133.664] lstrlenA (lpString="*.js") returned 4
	[0133.664] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.jscript") returned 0
	[0133.664] lstrlenA (lpString="*.jscript") returned 9
	[0133.664] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.hta") returned 0
	[0133.664] lstrlenA (lpString="*.hta") returned 5
	[0133.664] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.php7") returned 0
	[0133.664] lstrlenA (lpString="*.php7") returned 6
	[0133.664] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.db") returned 0
	[0133.664] lstrlenA (lpString="*.db") returned 4
	[0133.664] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.swf") returned 0
	[0133.664] lstrlenA (lpString="*.swf") returned 5
	[0133.664] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.eml") returned 0
	[0133.664] lstrlenA (lpString="*.eml") returned 5
	[0133.664] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.part") returned 0
	[0133.664] lstrlenA (lpString="*.part") returned 6
	[0133.664] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.nfo") returned 0
	[0133.664] lstrlenA (lpString="*.nfo") returned 5
	[0133.664] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.rsa") returned 0
	[0133.664] lstrlenA (lpString="*.rsa") returned 5
	[0133.664] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.key") returned 0
	[0133.664] lstrlenA (lpString="*.key") returned 5
	[0133.664] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.aes") returned 0
	[0133.664] lstrlenA (lpString="*.aes") returned 5
	[0133.665] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.blob") returned 0
	[0133.665] lstrlenA (lpString="*.blob") returned 6
	[0133.665] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.btc") returned 0
	[0133.665] lstrlenA (lpString="*.btc") returned 5
	[0133.665] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Btbl\\zGbyLnnoR.m4a", pszSpec="*.wallet") returned 0
	[0133.665] lstrlenA (lpString="*.wallet") returned 8
	[0133.665] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35046df0, ftCreationTime.dwHighDateTime=0x1d4c83d, ftLastAccessTime.dwLowDateTime=0x356bb4e0, ftLastAccessTime.dwHighDateTime=0x1d4c835, ftLastWriteTime.dwLowDateTime=0x356bb4e0, ftLastWriteTime.dwHighDateTime=0x1d4c835, nFileSizeHigh=0x0, nFileSizeLow=0x11f94, dwReserved0=0x12, dwReserved1=0x1, cFileName="zGbyLnnoR.m4a", cAlternateFileName="ZGBYLN~1.M4A")) returned 0
	[0133.665] FindClose (in: hFindFile=0x7cb750 | out: hFindFile=0x7cb750) returned 1
	[0133.665] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0e7c080, ftCreationTime.dwHighDateTime=0x1d4ca63, ftLastAccessTime.dwLowDateTime=0x9f5fa230, ftLastAccessTime.dwHighDateTime=0x1d4c7e5, ftLastWriteTime.dwLowDateTime=0x9f5fa230, ftLastWriteTime.dwHighDateTime=0x1d4c7e5, nFileSizeHigh=0x0, nFileSizeLow=0x134ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="cibv3 6XOI94A.wav", cAlternateFileName="CIBV36~1.WAV")) returned 1
	[0133.665] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0133.665] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="cibv3 6XOI94A.wav") returned 1
	[0133.665] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="cibv3 6XOI94A.wav") returned 1
	[0133.665] lstrcmpiA (lpString1="", lpString2="cibv3 6XOI94A.wav") returned -1
	[0133.665] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\*.*") returned="*.*"
	[0133.665] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0133.665] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0133.665] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.665] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0133.665] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="cibv3 6XOI94A.wav" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav") returned="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav"
	[0133.665] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav", pszSpec="*.zip") returned 0
	[0133.665] lstrlenA (lpString="*.zip") returned 5
	[0133.665] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav", pszSpec="*.rar") returned 0
	[0133.665] lstrlenA (lpString="*.rar") returned 5
	[0133.665] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav", pszSpec="*.7z") returned 0
	[0133.665] lstrlenA (lpString="*.7z") returned 4
	[0133.665] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav", pszSpec="*.tar") returned 0
	[0133.665] lstrlenA (lpString="*.tar") returned 5
	[0133.665] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav", pszSpec="*.gzip") returned 0
	[0133.665] lstrlenA (lpString="*.gzip") returned 6
	[0133.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav", pszSpec="*.jpg") returned 0
	[0133.666] lstrlenA (lpString="*.jpg") returned 5
	[0133.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav", pszSpec="*.jpeg") returned 0
	[0133.666] lstrlenA (lpString="*.jpeg") returned 6
	[0133.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav", pszSpec="*.bmp") returned 0
	[0133.666] lstrlenA (lpString="*.bmp") returned 5
	[0133.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav", pszSpec="*.gif") returned 0
	[0133.666] lstrlenA (lpString="*.gif") returned 5
	[0133.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav", pszSpec="*.png") returned 0
	[0133.666] lstrlenA (lpString="*.png") returned 5
	[0133.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav", pszSpec="*.doc") returned 0
	[0133.666] lstrlenA (lpString="*.doc") returned 5
	[0133.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav", pszSpec="*.docx") returned 0
	[0133.666] lstrlenA (lpString="*.docx") returned 6
	[0133.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav", pszSpec="*.xls") returned 0
	[0133.666] lstrlenA (lpString="*.xls") returned 5
	[0133.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav", pszSpec="*.xlsx") returned 0
	[0133.666] lstrlenA (lpString="*.xlsx") returned 6
	[0133.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav", pszSpec="*.ppt") returned 0
	[0133.666] lstrlenA (lpString="*.ppt") returned 5
	[0133.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav", pszSpec="*.pptx") returned 0
	[0133.666] lstrlenA (lpString="*.pptx") returned 6
	[0133.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav", pszSpec="*.txt") returned 0
	[0133.666] lstrlenA (lpString="*.txt") returned 5
	[0133.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav", pszSpec="*.pdf") returned 0
	[0133.666] lstrlenA (lpString="*.pdf") returned 5
	[0133.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav", pszSpec="*.htm") returned 0
	[0133.666] lstrlenA (lpString="*.htm") returned 5
	[0133.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav", pszSpec="*.html") returned 0
	[0133.666] lstrlenA (lpString="*.html") returned 6
	[0133.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav", pszSpec="*.mdb") returned 0
	[0133.666] lstrlenA (lpString="*.mdb") returned 5
	[0133.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav", pszSpec="*.pfx") returned 0
	[0133.666] lstrlenA (lpString="*.pfx") returned 5
	[0133.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav", pszSpec="*.md") returned 0
	[0133.666] lstrlenA (lpString="*.md") returned 4
	[0133.667] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav", pszSpec="*.lnk") returned 0
	[0133.667] lstrlenA (lpString="*.lnk") returned 5
	[0133.667] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav", pszSpec="*.torrent") returned 0
	[0133.667] lstrlenA (lpString="*.torrent") returned 9
	[0133.667] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav", pszSpec="*.mov") returned 0
	[0133.667] lstrlenA (lpString="*.mov") returned 5
	[0133.667] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav", pszSpec="*.3gp") returned 0
	[0133.667] lstrlenA (lpString="*.3gp") returned 5
	[0133.667] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav", pszSpec="*.mpeg") returned 0
	[0133.667] lstrlenA (lpString="*.mpeg") returned 6
	[0133.667] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav", pszSpec="*.mpg") returned 0
	[0133.667] lstrlenA (lpString="*.mpg") returned 5
	[0133.667] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav", pszSpec="*.flv") returned 0
	[0133.667] lstrlenA (lpString="*.flv") returned 5
	[0133.667] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav", pszSpec="*.avi") returned 0
	[0133.667] lstrlenA (lpString="*.avi") returned 5
	[0133.667] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav", pszSpec="*.mp4") returned 0
	[0133.667] lstrlenA (lpString="*.mp4") returned 5
	[0133.667] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav", pszSpec="*.wmv") returned 0
	[0133.667] lstrlenA (lpString="*.wmv") returned 5
	[0133.667] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav", pszSpec="*.mkv") returned 0
	[0133.667] lstrlenA (lpString="*.mkv") returned 5
	[0133.667] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav", pszSpec="*.mp3") returned 0
	[0133.667] lstrlenA (lpString="*.mp3") returned 5
	[0133.667] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav", pszSpec="*.wav") returned 1
	[0133.667] lstrlenA (lpString="*.wav") returned 5
	[0133.667] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav") returned="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav"
	[0133.667] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav") returned="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav"
	[0133.667] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav.") returned="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav."
	[0133.667] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav.exe") returned="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav.exe"
	[0133.667] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\cibv3 6xoi94a.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0133.668] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x134ff
	[0133.668] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf0e7c080, dwHighDateTime=0x1d4ca63), lpLastAccessTime=0x407536*(dwLowDateTime=0x9f5fa230, dwHighDateTime=0x1d4c7e5), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9f5fa230, dwHighDateTime=0x1d4c7e5)) returned 1
	[0133.668] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.668] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x134bd, lpOverlapped=0x0) returned 1
	[0133.669] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav") returned="cibv3 6XOI94A.wav"
	[0133.669] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.669] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x134bd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x134bd, lpOverlapped=0x0) returned 1
	[0133.670] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.670] CloseHandle (hObject=0x20c) returned 1
	[0133.672] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\cibv3 6xoi94a.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cibv3 6xoi94a.wav.exe")) returned 1
	[0133.672] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x15, dwReserved1=0x1, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0133.673] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0133.673] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="desktop.ini") returned 1
	[0133.673] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="desktop.ini") returned 1
	[0133.673] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1
	[0133.673] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\cibv3 6XOI94A.wav") returned="cibv3 6XOI94A.wav"
	[0133.673] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0133.673] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0133.673] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.673] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0133.673] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\desktop.ini") returned="C:\\Users\\FD1HVy\\Desktop\\desktop.ini"
	[0133.673] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.zip") returned 0
	[0133.673] lstrlenA (lpString="*.zip") returned 5
	[0133.673] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.rar") returned 0
	[0133.673] lstrlenA (lpString="*.rar") returned 5
	[0133.673] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.7z") returned 0
	[0133.673] lstrlenA (lpString="*.7z") returned 4
	[0133.673] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.tar") returned 0
	[0133.673] lstrlenA (lpString="*.tar") returned 5
	[0133.673] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.gzip") returned 0
	[0133.673] lstrlenA (lpString="*.gzip") returned 6
	[0133.673] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.jpg") returned 0
	[0133.673] lstrlenA (lpString="*.jpg") returned 5
	[0133.673] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.jpeg") returned 0
	[0133.673] lstrlenA (lpString="*.jpeg") returned 6
	[0133.673] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.bmp") returned 0
	[0133.673] lstrlenA (lpString="*.bmp") returned 5
	[0133.673] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.gif") returned 0
	[0133.673] lstrlenA (lpString="*.gif") returned 5
	[0133.673] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.png") returned 0
	[0133.673] lstrlenA (lpString="*.png") returned 5
	[0133.673] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.doc") returned 0
	[0133.673] lstrlenA (lpString="*.doc") returned 5
	[0133.674] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.docx") returned 0
	[0133.674] lstrlenA (lpString="*.docx") returned 6
	[0133.674] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.xls") returned 0
	[0133.674] lstrlenA (lpString="*.xls") returned 5
	[0133.674] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.xlsx") returned 0
	[0133.674] lstrlenA (lpString="*.xlsx") returned 6
	[0133.674] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.ppt") returned 0
	[0133.674] lstrlenA (lpString="*.ppt") returned 5
	[0133.674] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.pptx") returned 0
	[0133.674] lstrlenA (lpString="*.pptx") returned 6
	[0133.674] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.txt") returned 0
	[0133.674] lstrlenA (lpString="*.txt") returned 5
	[0133.674] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.pdf") returned 0
	[0133.674] lstrlenA (lpString="*.pdf") returned 5
	[0133.674] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.htm") returned 0
	[0133.674] lstrlenA (lpString="*.htm") returned 5
	[0133.674] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.html") returned 0
	[0133.674] lstrlenA (lpString="*.html") returned 6
	[0133.674] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.mdb") returned 0
	[0133.674] lstrlenA (lpString="*.mdb") returned 5
	[0133.674] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.pfx") returned 0
	[0133.674] lstrlenA (lpString="*.pfx") returned 5
	[0133.674] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.md") returned 0
	[0133.674] lstrlenA (lpString="*.md") returned 4
	[0133.674] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.lnk") returned 0
	[0133.674] lstrlenA (lpString="*.lnk") returned 5
	[0133.674] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.torrent") returned 0
	[0133.674] lstrlenA (lpString="*.torrent") returned 9
	[0133.674] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.mov") returned 0
	[0133.674] lstrlenA (lpString="*.mov") returned 5
	[0133.674] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.3gp") returned 0
	[0133.674] lstrlenA (lpString="*.3gp") returned 5
	[0133.674] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.mpeg") returned 0
	[0133.674] lstrlenA (lpString="*.mpeg") returned 6
	[0133.674] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.mpg") returned 0
	[0133.674] lstrlenA (lpString="*.mpg") returned 5
	[0133.675] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.flv") returned 0
	[0133.675] lstrlenA (lpString="*.flv") returned 5
	[0133.675] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.avi") returned 0
	[0133.675] lstrlenA (lpString="*.avi") returned 5
	[0133.675] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.mp4") returned 0
	[0133.675] lstrlenA (lpString="*.mp4") returned 5
	[0133.675] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.wmv") returned 0
	[0133.675] lstrlenA (lpString="*.wmv") returned 5
	[0133.675] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.mkv") returned 0
	[0133.675] lstrlenA (lpString="*.mkv") returned 5
	[0133.675] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.mp3") returned 0
	[0133.675] lstrlenA (lpString="*.mp3") returned 5
	[0133.675] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.wav") returned 0
	[0133.675] lstrlenA (lpString="*.wav") returned 5
	[0133.675] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.flac") returned 0
	[0133.675] lstrlenA (lpString="*.flac") returned 6
	[0133.675] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.wma") returned 0
	[0133.675] lstrlenA (lpString="*.wma") returned 5
	[0133.675] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.au3") returned 0
	[0133.675] lstrlenA (lpString="*.au3") returned 5
	[0133.675] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.ahk") returned 0
	[0133.675] lstrlenA (lpString="*.ahk") returned 5
	[0133.675] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.c") returned 0
	[0133.675] lstrlenA (lpString="*.c") returned 3
	[0133.675] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.cc") returned 0
	[0133.675] lstrlenA (lpString="*.cc") returned 4
	[0133.675] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.cpp") returned 0
	[0133.675] lstrlenA (lpString="*.cpp") returned 5
	[0133.675] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.cxx") returned 0
	[0133.675] lstrlenA (lpString="*.cxx") returned 5
	[0133.675] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.c++") returned 0
	[0133.675] lstrlenA (lpString="*.c++") returned 5
	[0133.675] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.cs") returned 0
	[0133.675] lstrlenA (lpString="*.cs") returned 4
	[0133.675] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.vb") returned 0
	[0133.676] lstrlenA (lpString="*.vb") returned 4
	[0133.676] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.bas") returned 0
	[0133.676] lstrlenA (lpString="*.bas") returned 5
	[0133.676] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.csproj") returned 0
	[0133.676] lstrlenA (lpString="*.csproj") returned 8
	[0133.676] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.vbproj") returned 0
	[0133.676] lstrlenA (lpString="*.vbproj") returned 8
	[0133.676] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.vcxproj") returned 0
	[0133.676] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.676] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.manifest") returned 0
	[0133.676] lstrlenA (lpString="*.manifest") returned 10
	[0133.676] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.php") returned 0
	[0133.676] lstrlenA (lpString="*.php") returned 5
	[0133.676] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.vbe") returned 0
	[0133.676] lstrlenA (lpString="*.vbe") returned 5
	[0133.676] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.vba") returned 0
	[0133.676] lstrlenA (lpString="*.vba") returned 5
	[0133.676] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.vbs") returned 0
	[0133.676] lstrlenA (lpString="*.vbs") returned 5
	[0133.676] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.bat") returned 0
	[0133.676] lstrlenA (lpString="*.bat") returned 5
	[0133.676] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.cmd") returned 0
	[0133.676] lstrlenA (lpString="*.cmd") returned 5
	[0133.676] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.js") returned 0
	[0133.676] lstrlenA (lpString="*.js") returned 4
	[0133.676] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.jscript") returned 0
	[0133.676] lstrlenA (lpString="*.jscript") returned 9
	[0133.676] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.hta") returned 0
	[0133.676] lstrlenA (lpString="*.hta") returned 5
	[0133.676] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.php7") returned 0
	[0133.676] lstrlenA (lpString="*.php7") returned 6
	[0133.676] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.db") returned 0
	[0133.676] lstrlenA (lpString="*.db") returned 4
	[0133.676] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.swf") returned 0
	[0133.676] lstrlenA (lpString="*.swf") returned 5
	[0133.676] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.eml") returned 0
	[0133.677] lstrlenA (lpString="*.eml") returned 5
	[0133.677] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.part") returned 0
	[0133.677] lstrlenA (lpString="*.part") returned 6
	[0133.677] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.nfo") returned 0
	[0133.677] lstrlenA (lpString="*.nfo") returned 5
	[0133.677] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.rsa") returned 0
	[0133.677] lstrlenA (lpString="*.rsa") returned 5
	[0133.677] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.key") returned 0
	[0133.677] lstrlenA (lpString="*.key") returned 5
	[0133.677] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.aes") returned 0
	[0133.677] lstrlenA (lpString="*.aes") returned 5
	[0133.677] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.blob") returned 0
	[0133.677] lstrlenA (lpString="*.blob") returned 6
	[0133.677] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.btc") returned 0
	[0133.677] lstrlenA (lpString="*.btc") returned 5
	[0133.677] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", pszSpec="*.wallet") returned 0
	[0133.677] lstrlenA (lpString="*.wallet") returned 8
	[0133.677] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf623fb20, ftCreationTime.dwHighDateTime=0x1d4d28a, ftLastAccessTime.dwLowDateTime=0x43475de0, ftLastAccessTime.dwHighDateTime=0x1d4d126, ftLastWriteTime.dwLowDateTime=0x43475de0, ftLastWriteTime.dwHighDateTime=0x1d4d126, nFileSizeHigh=0x0, nFileSizeLow=0xcec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="df2qnGKY77_f-tGQq_md.mp4", cAlternateFileName="DF2QNG~1.MP4")) returned 1
	[0133.677] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0133.677] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="df2qnGKY77_f-tGQq_md.mp4") returned 1
	[0133.677] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="df2qnGKY77_f-tGQq_md.mp4") returned 1
	[0133.677] lstrcmpiA (lpString1="", lpString2="df2qnGKY77_f-tGQq_md.mp4") returned -1
	[0133.677] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\desktop.ini") returned="desktop.ini"
	[0133.677] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0133.677] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0133.677] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.677] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0133.677] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="df2qnGKY77_f-tGQq_md.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4") returned="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4"
	[0133.677] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4", pszSpec="*.zip") returned 0
	[0133.677] lstrlenA (lpString="*.zip") returned 5
	[0133.677] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4", pszSpec="*.rar") returned 0
	[0133.677] lstrlenA (lpString="*.rar") returned 5
	[0133.677] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4", pszSpec="*.7z") returned 0
	[0133.678] lstrlenA (lpString="*.7z") returned 4
	[0133.678] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4", pszSpec="*.tar") returned 0
	[0133.678] lstrlenA (lpString="*.tar") returned 5
	[0133.678] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4", pszSpec="*.gzip") returned 0
	[0133.678] lstrlenA (lpString="*.gzip") returned 6
	[0133.678] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4", pszSpec="*.jpg") returned 0
	[0133.678] lstrlenA (lpString="*.jpg") returned 5
	[0133.678] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4", pszSpec="*.jpeg") returned 0
	[0133.678] lstrlenA (lpString="*.jpeg") returned 6
	[0133.678] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4", pszSpec="*.bmp") returned 0
	[0133.678] lstrlenA (lpString="*.bmp") returned 5
	[0133.678] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4", pszSpec="*.gif") returned 0
	[0133.678] lstrlenA (lpString="*.gif") returned 5
	[0133.678] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4", pszSpec="*.png") returned 0
	[0133.678] lstrlenA (lpString="*.png") returned 5
	[0133.678] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4", pszSpec="*.doc") returned 0
	[0133.678] lstrlenA (lpString="*.doc") returned 5
	[0133.678] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4", pszSpec="*.docx") returned 0
	[0133.678] lstrlenA (lpString="*.docx") returned 6
	[0133.678] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4", pszSpec="*.xls") returned 0
	[0133.678] lstrlenA (lpString="*.xls") returned 5
	[0133.678] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4", pszSpec="*.xlsx") returned 0
	[0133.678] lstrlenA (lpString="*.xlsx") returned 6
	[0133.678] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4", pszSpec="*.ppt") returned 0
	[0133.678] lstrlenA (lpString="*.ppt") returned 5
	[0133.678] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4", pszSpec="*.pptx") returned 0
	[0133.678] lstrlenA (lpString="*.pptx") returned 6
	[0133.678] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4", pszSpec="*.txt") returned 0
	[0133.678] lstrlenA (lpString="*.txt") returned 5
	[0133.678] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4", pszSpec="*.pdf") returned 0
	[0133.678] lstrlenA (lpString="*.pdf") returned 5
	[0133.678] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4", pszSpec="*.htm") returned 0
	[0133.678] lstrlenA (lpString="*.htm") returned 5
	[0133.678] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4", pszSpec="*.html") returned 0
	[0133.678] lstrlenA (lpString="*.html") returned 6
	[0133.678] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4", pszSpec="*.mdb") returned 0
	[0133.679] lstrlenA (lpString="*.mdb") returned 5
	[0133.679] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4", pszSpec="*.pfx") returned 0
	[0133.679] lstrlenA (lpString="*.pfx") returned 5
	[0133.679] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4", pszSpec="*.md") returned 0
	[0133.679] lstrlenA (lpString="*.md") returned 4
	[0133.679] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4", pszSpec="*.lnk") returned 0
	[0133.679] lstrlenA (lpString="*.lnk") returned 5
	[0133.679] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4", pszSpec="*.torrent") returned 0
	[0133.679] lstrlenA (lpString="*.torrent") returned 9
	[0133.679] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4", pszSpec="*.mov") returned 0
	[0133.679] lstrlenA (lpString="*.mov") returned 5
	[0133.679] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4", pszSpec="*.3gp") returned 0
	[0133.679] lstrlenA (lpString="*.3gp") returned 5
	[0133.679] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4", pszSpec="*.mpeg") returned 0
	[0133.679] lstrlenA (lpString="*.mpeg") returned 6
	[0133.679] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4", pszSpec="*.mpg") returned 0
	[0133.679] lstrlenA (lpString="*.mpg") returned 5
	[0133.679] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4", pszSpec="*.flv") returned 0
	[0133.679] lstrlenA (lpString="*.flv") returned 5
	[0133.679] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4", pszSpec="*.avi") returned 0
	[0133.679] lstrlenA (lpString="*.avi") returned 5
	[0133.679] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4", pszSpec="*.mp4") returned 1
	[0133.679] lstrlenA (lpString="*.mp4") returned 5
	[0133.679] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4") returned="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4"
	[0133.679] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4") returned="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4"
	[0133.679] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4.") returned="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4."
	[0133.679] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4.exe") returned="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4.exe"
	[0133.680] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\df2qngky77_f-tgqq_md.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0133.680] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcec8
	[0133.680] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf623fb20, dwHighDateTime=0x1d4d28a), lpLastAccessTime=0x407536*(dwLowDateTime=0x43475de0, dwHighDateTime=0x1d4d126), lpLastWriteTime=0x40753e*(dwLowDateTime=0x43475de0, dwHighDateTime=0x1d4d126)) returned 1
	[0133.680] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.680] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xce86, lpOverlapped=0x0) returned 1
	[0133.681] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4") returned="df2qnGKY77_f-tGQq_md.mp4"
	[0133.681] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.682] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xce86, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xce86, lpOverlapped=0x0) returned 1
	[0133.682] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.682] CloseHandle (hObject=0x20c) returned 1
	[0133.682] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\df2qngky77_f-tgqq_md.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\df2qngky77_f-tgqq_md.mp4.exe")) returned 1
	[0133.683] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34708b0, ftCreationTime.dwHighDateTime=0x1d4d592, ftLastAccessTime.dwLowDateTime=0x99cff6b0, ftLastAccessTime.dwHighDateTime=0x1d4cf30, ftLastWriteTime.dwLowDateTime=0x99cff6b0, ftLastWriteTime.dwHighDateTime=0x1d4cf30, nFileSizeHigh=0x0, nFileSizeLow=0xdabe, dwReserved0=0x0, dwReserved1=0x1, cFileName="ElDHlj7 oWvp.m4a", cAlternateFileName="ELDHLJ~1.M4A")) returned 1
	[0133.683] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0133.683] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="ElDHlj7 oWvp.m4a") returned -1
	[0133.683] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="ElDHlj7 oWvp.m4a") returned 1
	[0133.683] lstrcmpiA (lpString1="", lpString2="ElDHlj7 oWvp.m4a") returned -1
	[0133.683] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\df2qnGKY77_f-tGQq_md.mp4") returned="df2qnGKY77_f-tGQq_md.mp4"
	[0133.683] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0133.683] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0133.683] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.683] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0133.683] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="ElDHlj7 oWvp.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a") returned="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a"
	[0133.683] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.zip") returned 0
	[0133.683] lstrlenA (lpString="*.zip") returned 5
	[0133.683] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.rar") returned 0
	[0133.683] lstrlenA (lpString="*.rar") returned 5
	[0133.683] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.7z") returned 0
	[0133.683] lstrlenA (lpString="*.7z") returned 4
	[0133.683] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.tar") returned 0
	[0133.683] lstrlenA (lpString="*.tar") returned 5
	[0133.683] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.gzip") returned 0
	[0133.683] lstrlenA (lpString="*.gzip") returned 6
	[0133.683] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.jpg") returned 0
	[0133.683] lstrlenA (lpString="*.jpg") returned 5
	[0133.683] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.jpeg") returned 0
	[0133.683] lstrlenA (lpString="*.jpeg") returned 6
	[0133.683] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.bmp") returned 0
	[0133.683] lstrlenA (lpString="*.bmp") returned 5
	[0133.683] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.gif") returned 0
	[0133.683] lstrlenA (lpString="*.gif") returned 5
	[0133.683] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.png") returned 0
	[0133.683] lstrlenA (lpString="*.png") returned 5
	[0133.683] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.doc") returned 0
	[0133.684] lstrlenA (lpString="*.doc") returned 5
	[0133.684] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.docx") returned 0
	[0133.684] lstrlenA (lpString="*.docx") returned 6
	[0133.684] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.xls") returned 0
	[0133.684] lstrlenA (lpString="*.xls") returned 5
	[0133.684] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.xlsx") returned 0
	[0133.684] lstrlenA (lpString="*.xlsx") returned 6
	[0133.684] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.ppt") returned 0
	[0133.684] lstrlenA (lpString="*.ppt") returned 5
	[0133.684] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.pptx") returned 0
	[0133.684] lstrlenA (lpString="*.pptx") returned 6
	[0133.684] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.txt") returned 0
	[0133.684] lstrlenA (lpString="*.txt") returned 5
	[0133.684] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.pdf") returned 0
	[0133.684] lstrlenA (lpString="*.pdf") returned 5
	[0133.684] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.htm") returned 0
	[0133.684] lstrlenA (lpString="*.htm") returned 5
	[0133.684] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.html") returned 0
	[0133.684] lstrlenA (lpString="*.html") returned 6
	[0133.684] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.mdb") returned 0
	[0133.684] lstrlenA (lpString="*.mdb") returned 5
	[0133.684] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.pfx") returned 0
	[0133.684] lstrlenA (lpString="*.pfx") returned 5
	[0133.684] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.md") returned 0
	[0133.684] lstrlenA (lpString="*.md") returned 4
	[0133.684] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.lnk") returned 0
	[0133.684] lstrlenA (lpString="*.lnk") returned 5
	[0133.684] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.torrent") returned 0
	[0133.684] lstrlenA (lpString="*.torrent") returned 9
	[0133.684] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.mov") returned 0
	[0133.684] lstrlenA (lpString="*.mov") returned 5
	[0133.684] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.3gp") returned 0
	[0133.684] lstrlenA (lpString="*.3gp") returned 5
	[0133.684] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.mpeg") returned 0
	[0133.684] lstrlenA (lpString="*.mpeg") returned 6
	[0133.684] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.mpg") returned 0
	[0133.684] lstrlenA (lpString="*.mpg") returned 5
	[0133.685] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.flv") returned 0
	[0133.685] lstrlenA (lpString="*.flv") returned 5
	[0133.685] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.avi") returned 0
	[0133.685] lstrlenA (lpString="*.avi") returned 5
	[0133.685] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.mp4") returned 0
	[0133.685] lstrlenA (lpString="*.mp4") returned 5
	[0133.685] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.wmv") returned 0
	[0133.685] lstrlenA (lpString="*.wmv") returned 5
	[0133.685] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.mkv") returned 0
	[0133.685] lstrlenA (lpString="*.mkv") returned 5
	[0133.685] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.mp3") returned 0
	[0133.685] lstrlenA (lpString="*.mp3") returned 5
	[0133.685] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.wav") returned 0
	[0133.685] lstrlenA (lpString="*.wav") returned 5
	[0133.685] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.flac") returned 0
	[0133.685] lstrlenA (lpString="*.flac") returned 6
	[0133.685] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.wma") returned 0
	[0133.685] lstrlenA (lpString="*.wma") returned 5
	[0133.685] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.au3") returned 0
	[0133.685] lstrlenA (lpString="*.au3") returned 5
	[0133.685] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.ahk") returned 0
	[0133.685] lstrlenA (lpString="*.ahk") returned 5
	[0133.685] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.c") returned 0
	[0133.685] lstrlenA (lpString="*.c") returned 3
	[0133.685] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.cc") returned 0
	[0133.685] lstrlenA (lpString="*.cc") returned 4
	[0133.685] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.cpp") returned 0
	[0133.685] lstrlenA (lpString="*.cpp") returned 5
	[0133.685] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.cxx") returned 0
	[0133.685] lstrlenA (lpString="*.cxx") returned 5
	[0133.685] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.c++") returned 0
	[0133.685] lstrlenA (lpString="*.c++") returned 5
	[0133.685] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.cs") returned 0
	[0133.685] lstrlenA (lpString="*.cs") returned 4
	[0133.685] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.vb") returned 0
	[0133.685] lstrlenA (lpString="*.vb") returned 4
	[0133.686] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.bas") returned 0
	[0133.686] lstrlenA (lpString="*.bas") returned 5
	[0133.686] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.csproj") returned 0
	[0133.686] lstrlenA (lpString="*.csproj") returned 8
	[0133.686] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.vbproj") returned 0
	[0133.686] lstrlenA (lpString="*.vbproj") returned 8
	[0133.686] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.vcxproj") returned 0
	[0133.686] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.686] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.manifest") returned 0
	[0133.686] lstrlenA (lpString="*.manifest") returned 10
	[0133.686] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.php") returned 0
	[0133.686] lstrlenA (lpString="*.php") returned 5
	[0133.686] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.vbe") returned 0
	[0133.686] lstrlenA (lpString="*.vbe") returned 5
	[0133.686] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.vba") returned 0
	[0133.686] lstrlenA (lpString="*.vba") returned 5
	[0133.686] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.vbs") returned 0
	[0133.686] lstrlenA (lpString="*.vbs") returned 5
	[0133.686] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.bat") returned 0
	[0133.686] lstrlenA (lpString="*.bat") returned 5
	[0133.686] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.cmd") returned 0
	[0133.686] lstrlenA (lpString="*.cmd") returned 5
	[0133.686] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.js") returned 0
	[0133.686] lstrlenA (lpString="*.js") returned 4
	[0133.686] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.jscript") returned 0
	[0133.686] lstrlenA (lpString="*.jscript") returned 9
	[0133.686] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.hta") returned 0
	[0133.686] lstrlenA (lpString="*.hta") returned 5
	[0133.686] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.php7") returned 0
	[0133.686] lstrlenA (lpString="*.php7") returned 6
	[0133.686] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.db") returned 0
	[0133.686] lstrlenA (lpString="*.db") returned 4
	[0133.686] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.swf") returned 0
	[0133.686] lstrlenA (lpString="*.swf") returned 5
	[0133.686] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.eml") returned 0
	[0133.686] lstrlenA (lpString="*.eml") returned 5
	[0133.686] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.part") returned 0
	[0133.687] lstrlenA (lpString="*.part") returned 6
	[0133.687] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.nfo") returned 0
	[0133.687] lstrlenA (lpString="*.nfo") returned 5
	[0133.687] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.rsa") returned 0
	[0133.687] lstrlenA (lpString="*.rsa") returned 5
	[0133.687] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.key") returned 0
	[0133.687] lstrlenA (lpString="*.key") returned 5
	[0133.687] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.aes") returned 0
	[0133.687] lstrlenA (lpString="*.aes") returned 5
	[0133.687] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.blob") returned 0
	[0133.687] lstrlenA (lpString="*.blob") returned 6
	[0133.687] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.btc") returned 0
	[0133.687] lstrlenA (lpString="*.btc") returned 5
	[0133.687] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a", pszSpec="*.wallet") returned 0
	[0133.687] lstrlenA (lpString="*.wallet") returned 8
	[0133.687] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b44b40, ftCreationTime.dwHighDateTime=0x1d4d002, ftLastAccessTime.dwLowDateTime=0x8745d790, ftLastAccessTime.dwHighDateTime=0x1d4cc23, ftLastWriteTime.dwLowDateTime=0x8745d790, ftLastWriteTime.dwHighDateTime=0x1d4cc23, nFileSizeHigh=0x0, nFileSizeLow=0x79fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="fs2Ls1jsGfCkztgeA.avi", cAlternateFileName="FS2LS1~1.AVI")) returned 1
	[0133.687] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0133.687] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="fs2Ls1jsGfCkztgeA.avi") returned -1
	[0133.687] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="fs2Ls1jsGfCkztgeA.avi") returned 1
	[0133.687] lstrcmpiA (lpString1="", lpString2="fs2Ls1jsGfCkztgeA.avi") returned -1
	[0133.687] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\ElDHlj7 oWvp.m4a") returned="ElDHlj7 oWvp.m4a"
	[0133.687] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0133.687] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0133.687] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.687] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0133.687] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="fs2Ls1jsGfCkztgeA.avi" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi") returned="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi"
	[0133.687] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi", pszSpec="*.zip") returned 0
	[0133.687] lstrlenA (lpString="*.zip") returned 5
	[0133.687] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi", pszSpec="*.rar") returned 0
	[0133.687] lstrlenA (lpString="*.rar") returned 5
	[0133.687] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi", pszSpec="*.7z") returned 0
	[0133.687] lstrlenA (lpString="*.7z") returned 4
	[0133.687] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi", pszSpec="*.tar") returned 0
	[0133.688] lstrlenA (lpString="*.tar") returned 5
	[0133.688] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi", pszSpec="*.gzip") returned 0
	[0133.688] lstrlenA (lpString="*.gzip") returned 6
	[0133.688] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi", pszSpec="*.jpg") returned 0
	[0133.688] lstrlenA (lpString="*.jpg") returned 5
	[0133.688] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi", pszSpec="*.jpeg") returned 0
	[0133.688] lstrlenA (lpString="*.jpeg") returned 6
	[0133.688] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi", pszSpec="*.bmp") returned 0
	[0133.688] lstrlenA (lpString="*.bmp") returned 5
	[0133.688] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi", pszSpec="*.gif") returned 0
	[0133.688] lstrlenA (lpString="*.gif") returned 5
	[0133.688] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi", pszSpec="*.png") returned 0
	[0133.688] lstrlenA (lpString="*.png") returned 5
	[0133.688] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi", pszSpec="*.doc") returned 0
	[0133.688] lstrlenA (lpString="*.doc") returned 5
	[0133.688] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi", pszSpec="*.docx") returned 0
	[0133.688] lstrlenA (lpString="*.docx") returned 6
	[0133.688] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi", pszSpec="*.xls") returned 0
	[0133.688] lstrlenA (lpString="*.xls") returned 5
	[0133.688] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi", pszSpec="*.xlsx") returned 0
	[0133.688] lstrlenA (lpString="*.xlsx") returned 6
	[0133.688] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi", pszSpec="*.ppt") returned 0
	[0133.688] lstrlenA (lpString="*.ppt") returned 5
	[0133.688] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi", pszSpec="*.pptx") returned 0
	[0133.688] lstrlenA (lpString="*.pptx") returned 6
	[0133.688] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi", pszSpec="*.txt") returned 0
	[0133.688] lstrlenA (lpString="*.txt") returned 5
	[0133.688] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi", pszSpec="*.pdf") returned 0
	[0133.688] lstrlenA (lpString="*.pdf") returned 5
	[0133.688] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi", pszSpec="*.htm") returned 0
	[0133.688] lstrlenA (lpString="*.htm") returned 5
	[0133.688] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi", pszSpec="*.html") returned 0
	[0133.688] lstrlenA (lpString="*.html") returned 6
	[0133.688] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi", pszSpec="*.mdb") returned 0
	[0133.688] lstrlenA (lpString="*.mdb") returned 5
	[0133.688] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi", pszSpec="*.pfx") returned 0
	[0133.688] lstrlenA (lpString="*.pfx") returned 5
	[0133.689] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi", pszSpec="*.md") returned 0
	[0133.689] lstrlenA (lpString="*.md") returned 4
	[0133.689] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi", pszSpec="*.lnk") returned 0
	[0133.689] lstrlenA (lpString="*.lnk") returned 5
	[0133.689] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi", pszSpec="*.torrent") returned 0
	[0133.689] lstrlenA (lpString="*.torrent") returned 9
	[0133.689] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi", pszSpec="*.mov") returned 0
	[0133.689] lstrlenA (lpString="*.mov") returned 5
	[0133.689] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi", pszSpec="*.3gp") returned 0
	[0133.689] lstrlenA (lpString="*.3gp") returned 5
	[0133.689] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi", pszSpec="*.mpeg") returned 0
	[0133.689] lstrlenA (lpString="*.mpeg") returned 6
	[0133.689] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi", pszSpec="*.mpg") returned 0
	[0133.689] lstrlenA (lpString="*.mpg") returned 5
	[0133.689] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi", pszSpec="*.flv") returned 0
	[0133.689] lstrlenA (lpString="*.flv") returned 5
	[0133.689] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi", pszSpec="*.avi") returned 1
	[0133.689] lstrlenA (lpString="*.avi") returned 5
	[0133.689] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi") returned="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi"
	[0133.689] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi") returned="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi"
	[0133.689] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi.") returned="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi."
	[0133.689] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi.exe") returned="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi.exe"
	[0133.689] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\fs2ls1jsgfckztgea.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0133.689] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x79fd
	[0133.689] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe4b44b40, dwHighDateTime=0x1d4d002), lpLastAccessTime=0x407536*(dwLowDateTime=0x8745d790, dwHighDateTime=0x1d4cc23), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8745d790, dwHighDateTime=0x1d4cc23)) returned 1
	[0133.690] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.690] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x79bb, lpOverlapped=0x0) returned 1
	[0133.690] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi") returned="fs2Ls1jsGfCkztgeA.avi"
	[0133.691] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.691] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x79bb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x79bb, lpOverlapped=0x0) returned 1
	[0133.693] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.693] CloseHandle (hObject=0x20c) returned 1
	[0133.693] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\fs2ls1jsgfckztgea.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\fs2ls1jsgfckztgea.avi.exe")) returned 1
	[0133.693] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a55b880, ftCreationTime.dwHighDateTime=0x1d4c866, ftLastAccessTime.dwLowDateTime=0x4447e430, ftLastAccessTime.dwHighDateTime=0x1d4c681, ftLastWriteTime.dwLowDateTime=0x4447e430, ftLastWriteTime.dwHighDateTime=0x1d4c681, nFileSizeHigh=0x0, nFileSizeLow=0xb3dd, dwReserved0=0x0, dwReserved1=0x1, cFileName="gLdU8NFrnsI2x.flv", cAlternateFileName="GLDU8N~1.FLV")) returned 1
	[0133.693] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0133.693] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="gLdU8NFrnsI2x.flv") returned -1
	[0133.693] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="gLdU8NFrnsI2x.flv") returned 1
	[0133.693] lstrcmpiA (lpString1="", lpString2="gLdU8NFrnsI2x.flv") returned -1
	[0133.693] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\fs2Ls1jsGfCkztgeA.avi") returned="fs2Ls1jsGfCkztgeA.avi"
	[0133.694] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0133.694] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0133.694] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.694] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0133.694] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="gLdU8NFrnsI2x.flv" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv") returned="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv"
	[0133.694] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv", pszSpec="*.zip") returned 0
	[0133.694] lstrlenA (lpString="*.zip") returned 5
	[0133.694] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv", pszSpec="*.rar") returned 0
	[0133.694] lstrlenA (lpString="*.rar") returned 5
	[0133.694] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv", pszSpec="*.7z") returned 0
	[0133.694] lstrlenA (lpString="*.7z") returned 4
	[0133.694] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv", pszSpec="*.tar") returned 0
	[0133.694] lstrlenA (lpString="*.tar") returned 5
	[0133.694] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv", pszSpec="*.gzip") returned 0
	[0133.694] lstrlenA (lpString="*.gzip") returned 6
	[0133.694] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv", pszSpec="*.jpg") returned 0
	[0133.694] lstrlenA (lpString="*.jpg") returned 5
	[0133.694] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv", pszSpec="*.jpeg") returned 0
	[0133.694] lstrlenA (lpString="*.jpeg") returned 6
	[0133.694] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv", pszSpec="*.bmp") returned 0
	[0133.694] lstrlenA (lpString="*.bmp") returned 5
	[0133.694] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv", pszSpec="*.gif") returned 0
	[0133.694] lstrlenA (lpString="*.gif") returned 5
	[0133.694] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv", pszSpec="*.png") returned 0
	[0133.694] lstrlenA (lpString="*.png") returned 5
	[0133.694] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv", pszSpec="*.doc") returned 0
	[0133.694] lstrlenA (lpString="*.doc") returned 5
	[0133.694] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv", pszSpec="*.docx") returned 0
	[0133.694] lstrlenA (lpString="*.docx") returned 6
	[0133.694] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv", pszSpec="*.xls") returned 0
	[0133.694] lstrlenA (lpString="*.xls") returned 5
	[0133.694] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv", pszSpec="*.xlsx") returned 0
	[0133.695] lstrlenA (lpString="*.xlsx") returned 6
	[0133.695] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv", pszSpec="*.ppt") returned 0
	[0133.695] lstrlenA (lpString="*.ppt") returned 5
	[0133.695] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv", pszSpec="*.pptx") returned 0
	[0133.695] lstrlenA (lpString="*.pptx") returned 6
	[0133.695] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv", pszSpec="*.txt") returned 0
	[0133.695] lstrlenA (lpString="*.txt") returned 5
	[0133.695] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv", pszSpec="*.pdf") returned 0
	[0133.695] lstrlenA (lpString="*.pdf") returned 5
	[0133.695] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv", pszSpec="*.htm") returned 0
	[0133.695] lstrlenA (lpString="*.htm") returned 5
	[0133.695] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv", pszSpec="*.html") returned 0
	[0133.695] lstrlenA (lpString="*.html") returned 6
	[0133.695] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv", pszSpec="*.mdb") returned 0
	[0133.695] lstrlenA (lpString="*.mdb") returned 5
	[0133.695] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv", pszSpec="*.pfx") returned 0
	[0133.695] lstrlenA (lpString="*.pfx") returned 5
	[0133.695] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv", pszSpec="*.md") returned 0
	[0133.695] lstrlenA (lpString="*.md") returned 4
	[0133.695] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv", pszSpec="*.lnk") returned 0
	[0133.695] lstrlenA (lpString="*.lnk") returned 5
	[0133.695] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv", pszSpec="*.torrent") returned 0
	[0133.695] lstrlenA (lpString="*.torrent") returned 9
	[0133.695] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv", pszSpec="*.mov") returned 0
	[0133.695] lstrlenA (lpString="*.mov") returned 5
	[0133.695] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv", pszSpec="*.3gp") returned 0
	[0133.695] lstrlenA (lpString="*.3gp") returned 5
	[0133.695] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv", pszSpec="*.mpeg") returned 0
	[0133.695] lstrlenA (lpString="*.mpeg") returned 6
	[0133.696] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv", pszSpec="*.mpg") returned 0
	[0133.696] lstrlenA (lpString="*.mpg") returned 5
	[0133.696] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv", pszSpec="*.flv") returned 1
	[0133.696] lstrlenA (lpString="*.flv") returned 5
	[0133.696] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv") returned="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv"
	[0133.696] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv") returned="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv"
	[0133.696] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv.") returned="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv."
	[0133.696] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv.exe") returned="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv.exe"
	[0133.696] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\gldu8nfrnsi2x.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0133.696] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3dd
	[0133.696] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8a55b880, dwHighDateTime=0x1d4c866), lpLastAccessTime=0x407536*(dwLowDateTime=0x4447e430, dwHighDateTime=0x1d4c681), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4447e430, dwHighDateTime=0x1d4c681)) returned 1
	[0133.696] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.696] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xb39b, lpOverlapped=0x0) returned 1
	[0133.697] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv") returned="gLdU8NFrnsI2x.flv"
	[0133.697] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.697] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xb39b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xb39b, lpOverlapped=0x0) returned 1
	[0133.698] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.698] CloseHandle (hObject=0x20c) returned 1
	[0133.698] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\gldu8nfrnsi2x.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\gldu8nfrnsi2x.flv.exe")) returned 1
	[0133.698] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31df2680, ftCreationTime.dwHighDateTime=0x1d4d0ab, ftLastAccessTime.dwLowDateTime=0x367246a0, ftLastAccessTime.dwHighDateTime=0x1d4cb2e, ftLastWriteTime.dwLowDateTime=0x367246a0, ftLastWriteTime.dwHighDateTime=0x1d4cb2e, nFileSizeHigh=0x0, nFileSizeLow=0x1826a, dwReserved0=0x15, dwReserved1=0x1, cFileName="gWki.png", cAlternateFileName="")) returned 1
	[0133.698] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0133.698] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="gWki.png") returned -1
	[0133.698] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="gWki.png") returned 1
	[0133.698] lstrcmpiA (lpString1="", lpString2="gWki.png") returned -1
	[0133.698] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\gLdU8NFrnsI2x.flv") returned="gLdU8NFrnsI2x.flv"
	[0133.699] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0133.699] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0133.699] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.699] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0133.699] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="gWki.png" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\gWki.png") returned="C:\\Users\\FD1HVy\\Desktop\\gWki.png"
	[0133.699] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gWki.png", pszSpec="*.zip") returned 0
	[0133.699] lstrlenA (lpString="*.zip") returned 5
	[0133.699] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gWki.png", pszSpec="*.rar") returned 0
	[0133.699] lstrlenA (lpString="*.rar") returned 5
	[0133.699] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gWki.png", pszSpec="*.7z") returned 0
	[0133.699] lstrlenA (lpString="*.7z") returned 4
	[0133.699] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gWki.png", pszSpec="*.tar") returned 0
	[0133.699] lstrlenA (lpString="*.tar") returned 5
	[0133.699] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gWki.png", pszSpec="*.gzip") returned 0
	[0133.699] lstrlenA (lpString="*.gzip") returned 6
	[0133.699] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gWki.png", pszSpec="*.jpg") returned 0
	[0133.699] lstrlenA (lpString="*.jpg") returned 5
	[0133.699] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gWki.png", pszSpec="*.jpeg") returned 0
	[0133.699] lstrlenA (lpString="*.jpeg") returned 6
	[0133.699] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gWki.png", pszSpec="*.bmp") returned 0
	[0133.699] lstrlenA (lpString="*.bmp") returned 5
	[0133.699] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gWki.png", pszSpec="*.gif") returned 0
	[0133.699] lstrlenA (lpString="*.gif") returned 5
	[0133.699] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\gWki.png", pszSpec="*.png") returned 1
	[0133.699] lstrlenA (lpString="*.png") returned 5
	[0133.699] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Desktop\\gWki.png" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\gWki.png") returned="C:\\Users\\FD1HVy\\Desktop\\gWki.png"
	[0133.699] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Desktop\\gWki.png" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\gWki.png") returned="C:\\Users\\FD1HVy\\Desktop\\gWki.png"
	[0133.699] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\gWki.png", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\gWki.png.") returned="C:\\Users\\FD1HVy\\Desktop\\gWki.png."
	[0133.699] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\gWki.png.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\gWki.png.exe") returned="C:\\Users\\FD1HVy\\Desktop\\gWki.png.exe"
	[0133.699] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\gWki.png" (normalized: "c:\\users\\fd1hvy\\desktop\\gwki.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0133.700] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1826a
	[0133.700] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x31df2680, dwHighDateTime=0x1d4d0ab), lpLastAccessTime=0x407536*(dwLowDateTime=0x367246a0, dwHighDateTime=0x1d4cb2e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x367246a0, dwHighDateTime=0x1d4cb2e)) returned 1
	[0133.700] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.700] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x18228, lpOverlapped=0x0) returned 1
	[0133.701] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\gWki.png") returned="gWki.png"
	[0133.701] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.701] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x18228, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x18228, lpOverlapped=0x0) returned 1
	[0133.702] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.702] CloseHandle (hObject=0x20c) returned 1
	[0133.702] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\gWki.png" (normalized: "c:\\users\\fd1hvy\\desktop\\gwki.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\gWki.png.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\gwki.png.exe")) returned 1
	[0133.703] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aa81d20, ftCreationTime.dwHighDateTime=0x1d4c6ec, ftLastAccessTime.dwLowDateTime=0xc4577960, ftLastAccessTime.dwHighDateTime=0x1d4c9ce, ftLastWriteTime.dwLowDateTime=0xc4577960, ftLastWriteTime.dwHighDateTime=0x1d4c9ce, nFileSizeHigh=0x0, nFileSizeLow=0x987b, dwReserved0=0x0, dwReserved1=0x0, cFileName="hY2xZ39.jpg", cAlternateFileName="")) returned 1
	[0133.703] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0133.703] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="hY2xZ39.jpg") returned -1
	[0133.703] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="hY2xZ39.jpg") returned -1
	[0133.703] lstrcmpiA (lpString1="", lpString2="hY2xZ39.jpg") returned -1
	[0133.703] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0133.703] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0133.703] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.703] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0133.703] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="hY2xZ39.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\hY2xZ39.jpg") returned="C:\\Users\\FD1HVy\\Desktop\\hY2xZ39.jpg"
	[0133.703] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\hY2xZ39.jpg", pszSpec="*.zip") returned 0
	[0133.703] lstrlenA (lpString="*.zip") returned 5
	[0133.703] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\hY2xZ39.jpg", pszSpec="*.rar") returned 0
	[0133.703] lstrlenA (lpString="*.rar") returned 5
	[0133.703] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\hY2xZ39.jpg", pszSpec="*.7z") returned 0
	[0133.703] lstrlenA (lpString="*.7z") returned 4
	[0133.703] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\hY2xZ39.jpg", pszSpec="*.tar") returned 0
	[0133.703] lstrlenA (lpString="*.tar") returned 5
	[0133.703] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\hY2xZ39.jpg", pszSpec="*.gzip") returned 0
	[0133.703] lstrlenA (lpString="*.gzip") returned 6
	[0133.703] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\hY2xZ39.jpg", pszSpec="*.jpg") returned 1
	[0133.703] lstrlenA (lpString="*.jpg") returned 5
	[0133.703] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Desktop\\hY2xZ39.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\hY2xZ39.jpg") returned="C:\\Users\\FD1HVy\\Desktop\\hY2xZ39.jpg"
	[0133.703] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Desktop\\hY2xZ39.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\hY2xZ39.jpg") returned="C:\\Users\\FD1HVy\\Desktop\\hY2xZ39.jpg"
	[0133.703] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\hY2xZ39.jpg", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\hY2xZ39.jpg.") returned="C:\\Users\\FD1HVy\\Desktop\\hY2xZ39.jpg."
	[0133.703] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\hY2xZ39.jpg.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\hY2xZ39.jpg.exe") returned="C:\\Users\\FD1HVy\\Desktop\\hY2xZ39.jpg.exe"
	[0133.704] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\hY2xZ39.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\hy2xz39.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0133.704] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x987b
	[0133.704] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4aa81d20, dwHighDateTime=0x1d4c6ec), lpLastAccessTime=0x407536*(dwLowDateTime=0xc4577960, dwHighDateTime=0x1d4c9ce), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc4577960, dwHighDateTime=0x1d4c9ce)) returned 1
	[0133.704] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.704] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x9839, lpOverlapped=0x0) returned 1
	[0133.705] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.705] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x9839, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x9839, lpOverlapped=0x0) returned 1
	[0133.705] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.705] CloseHandle (hObject=0x20c) returned 1
	[0133.705] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\hY2xZ39.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\hy2xz39.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\hY2xZ39.jpg.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\hy2xz39.jpg.exe")) returned 1
	[0133.706] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94a28da0, ftCreationTime.dwHighDateTime=0x1d4c59f, ftLastAccessTime.dwLowDateTime=0x949afe80, ftLastAccessTime.dwHighDateTime=0x1d4d10e, ftLastWriteTime.dwLowDateTime=0x949afe80, ftLastWriteTime.dwHighDateTime=0x1d4d10e, nFileSizeHigh=0x0, nFileSizeLow=0x43c5, dwReserved0=0x12, dwReserved1=0x1, cFileName="IAE3ka.swf", cAlternateFileName="")) returned 1
	[0133.706] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0133.706] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="IAE3ka.swf") returned -1
	[0133.706] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="IAE3ka.swf") returned -1
	[0133.706] lstrcmpiA (lpString1="", lpString2="IAE3ka.swf") returned -1
	[0133.706] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\hY2xZ39.jpg") returned="hY2xZ39.jpg"
	[0133.706] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0133.706] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0133.706] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.706] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0133.706] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="IAE3ka.swf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf") returned="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf"
	[0133.706] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.zip") returned 0
	[0133.707] lstrlenA (lpString="*.zip") returned 5
	[0133.707] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.rar") returned 0
	[0133.707] lstrlenA (lpString="*.rar") returned 5
	[0133.707] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.7z") returned 0
	[0133.707] lstrlenA (lpString="*.7z") returned 4
	[0133.707] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.tar") returned 0
	[0133.707] lstrlenA (lpString="*.tar") returned 5
	[0133.707] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.gzip") returned 0
	[0133.707] lstrlenA (lpString="*.gzip") returned 6
	[0133.707] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.jpg") returned 0
	[0133.707] lstrlenA (lpString="*.jpg") returned 5
	[0133.707] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.jpeg") returned 0
	[0133.707] lstrlenA (lpString="*.jpeg") returned 6
	[0133.707] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.bmp") returned 0
	[0133.707] lstrlenA (lpString="*.bmp") returned 5
	[0133.707] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.gif") returned 0
	[0133.707] lstrlenA (lpString="*.gif") returned 5
	[0133.707] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.png") returned 0
	[0133.707] lstrlenA (lpString="*.png") returned 5
	[0133.707] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.doc") returned 0
	[0133.707] lstrlenA (lpString="*.doc") returned 5
	[0133.707] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.docx") returned 0
	[0133.707] lstrlenA (lpString="*.docx") returned 6
	[0133.707] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.xls") returned 0
	[0133.707] lstrlenA (lpString="*.xls") returned 5
	[0133.707] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.xlsx") returned 0
	[0133.707] lstrlenA (lpString="*.xlsx") returned 6
	[0133.707] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.ppt") returned 0
	[0133.707] lstrlenA (lpString="*.ppt") returned 5
	[0133.707] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.pptx") returned 0
	[0133.707] lstrlenA (lpString="*.pptx") returned 6
	[0133.707] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.txt") returned 0
	[0133.707] lstrlenA (lpString="*.txt") returned 5
	[0133.707] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.pdf") returned 0
	[0133.707] lstrlenA (lpString="*.pdf") returned 5
	[0133.708] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.htm") returned 0
	[0133.708] lstrlenA (lpString="*.htm") returned 5
	[0133.708] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.html") returned 0
	[0133.708] lstrlenA (lpString="*.html") returned 6
	[0133.708] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.mdb") returned 0
	[0133.708] lstrlenA (lpString="*.mdb") returned 5
	[0133.708] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.pfx") returned 0
	[0133.708] lstrlenA (lpString="*.pfx") returned 5
	[0133.708] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.md") returned 0
	[0133.708] lstrlenA (lpString="*.md") returned 4
	[0133.708] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.lnk") returned 0
	[0133.708] lstrlenA (lpString="*.lnk") returned 5
	[0133.708] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.torrent") returned 0
	[0133.708] lstrlenA (lpString="*.torrent") returned 9
	[0133.708] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.mov") returned 0
	[0133.708] lstrlenA (lpString="*.mov") returned 5
	[0133.708] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.3gp") returned 0
	[0133.708] lstrlenA (lpString="*.3gp") returned 5
	[0133.708] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.mpeg") returned 0
	[0133.708] lstrlenA (lpString="*.mpeg") returned 6
	[0133.708] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.mpg") returned 0
	[0133.708] lstrlenA (lpString="*.mpg") returned 5
	[0133.708] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.flv") returned 0
	[0133.708] lstrlenA (lpString="*.flv") returned 5
	[0133.708] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.avi") returned 0
	[0133.708] lstrlenA (lpString="*.avi") returned 5
	[0133.708] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.mp4") returned 0
	[0133.708] lstrlenA (lpString="*.mp4") returned 5
	[0133.708] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.wmv") returned 0
	[0133.708] lstrlenA (lpString="*.wmv") returned 5
	[0133.708] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.mkv") returned 0
	[0133.708] lstrlenA (lpString="*.mkv") returned 5
	[0133.708] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.mp3") returned 0
	[0133.708] lstrlenA (lpString="*.mp3") returned 5
	[0133.708] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.wav") returned 0
	[0133.709] lstrlenA (lpString="*.wav") returned 5
	[0133.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.flac") returned 0
	[0133.709] lstrlenA (lpString="*.flac") returned 6
	[0133.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.wma") returned 0
	[0133.709] lstrlenA (lpString="*.wma") returned 5
	[0133.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.au3") returned 0
	[0133.709] lstrlenA (lpString="*.au3") returned 5
	[0133.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.ahk") returned 0
	[0133.709] lstrlenA (lpString="*.ahk") returned 5
	[0133.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.c") returned 0
	[0133.709] lstrlenA (lpString="*.c") returned 3
	[0133.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.cc") returned 0
	[0133.709] lstrlenA (lpString="*.cc") returned 4
	[0133.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.cpp") returned 0
	[0133.709] lstrlenA (lpString="*.cpp") returned 5
	[0133.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.cxx") returned 0
	[0133.709] lstrlenA (lpString="*.cxx") returned 5
	[0133.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.c++") returned 0
	[0133.709] lstrlenA (lpString="*.c++") returned 5
	[0133.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.cs") returned 0
	[0133.709] lstrlenA (lpString="*.cs") returned 4
	[0133.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.vb") returned 0
	[0133.709] lstrlenA (lpString="*.vb") returned 4
	[0133.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.bas") returned 0
	[0133.709] lstrlenA (lpString="*.bas") returned 5
	[0133.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.csproj") returned 0
	[0133.709] lstrlenA (lpString="*.csproj") returned 8
	[0133.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.vbproj") returned 0
	[0133.709] lstrlenA (lpString="*.vbproj") returned 8
	[0133.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.vcxproj") returned 0
	[0133.709] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.manifest") returned 0
	[0133.709] lstrlenA (lpString="*.manifest") returned 10
	[0133.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.php") returned 0
	[0133.709] lstrlenA (lpString="*.php") returned 5
	[0133.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.vbe") returned 0
	[0133.710] lstrlenA (lpString="*.vbe") returned 5
	[0133.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.vba") returned 0
	[0133.710] lstrlenA (lpString="*.vba") returned 5
	[0133.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.vbs") returned 0
	[0133.710] lstrlenA (lpString="*.vbs") returned 5
	[0133.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.bat") returned 0
	[0133.710] lstrlenA (lpString="*.bat") returned 5
	[0133.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.cmd") returned 0
	[0133.710] lstrlenA (lpString="*.cmd") returned 5
	[0133.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.js") returned 0
	[0133.710] lstrlenA (lpString="*.js") returned 4
	[0133.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.jscript") returned 0
	[0133.710] lstrlenA (lpString="*.jscript") returned 9
	[0133.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.hta") returned 0
	[0133.710] lstrlenA (lpString="*.hta") returned 5
	[0133.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.php7") returned 0
	[0133.710] lstrlenA (lpString="*.php7") returned 6
	[0133.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.db") returned 0
	[0133.710] lstrlenA (lpString="*.db") returned 4
	[0133.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", pszSpec="*.swf") returned 1
	[0133.710] lstrlenA (lpString="*.swf") returned 5
	[0133.710] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf") returned="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf"
	[0133.710] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf") returned="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf"
	[0133.710] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf.") returned="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf."
	[0133.710] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf.exe") returned="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf.exe"
	[0133.710] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\iae3ka.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0133.711] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43c5
	[0133.711] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x94a28da0, dwHighDateTime=0x1d4c59f), lpLastAccessTime=0x407536*(dwLowDateTime=0x949afe80, dwHighDateTime=0x1d4d10e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x949afe80, dwHighDateTime=0x1d4d10e)) returned 1
	[0133.711] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.711] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x4383, lpOverlapped=0x0) returned 1
	[0133.712] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf") returned="IAE3ka.swf"
	[0133.712] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.712] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x4383, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x4383, lpOverlapped=0x0) returned 1
	[0133.712] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.712] CloseHandle (hObject=0x20c) returned 1
	[0133.712] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\iae3ka.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\iae3ka.swf.exe")) returned 1
	[0133.713] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x681ef830, ftCreationTime.dwHighDateTime=0x1d4c5f0, ftLastAccessTime.dwLowDateTime=0xa8f4c570, ftLastAccessTime.dwHighDateTime=0x1d4c7a2, ftLastWriteTime.dwLowDateTime=0xa8f4c570, ftLastWriteTime.dwHighDateTime=0x1d4c7a2, nFileSizeHigh=0x0, nFileSizeLow=0x5f2f, dwReserved0=0x12, dwReserved1=0x1, cFileName="iuSWIxWkYm2X.xlsx", cAlternateFileName="IUSWIX~1.XLS")) returned 1
	[0133.713] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0133.713] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="iuSWIxWkYm2X.xlsx") returned -1
	[0133.713] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="iuSWIxWkYm2X.xlsx") returned -1
	[0133.713] lstrcmpiA (lpString1="", lpString2="iuSWIxWkYm2X.xlsx") returned -1
	[0133.713] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\IAE3ka.swf") returned="IAE3ka.swf"
	[0133.713] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0133.713] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0133.713] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.713] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0133.713] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="iuSWIxWkYm2X.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\iuSWIxWkYm2X.xlsx") returned="C:\\Users\\FD1HVy\\Desktop\\iuSWIxWkYm2X.xlsx"
	[0133.713] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\iuSWIxWkYm2X.xlsx", pszSpec="*.zip") returned 0
	[0133.713] lstrlenA (lpString="*.zip") returned 5
	[0133.713] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\iuSWIxWkYm2X.xlsx", pszSpec="*.rar") returned 0
	[0133.713] lstrlenA (lpString="*.rar") returned 5
	[0133.713] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\iuSWIxWkYm2X.xlsx", pszSpec="*.7z") returned 0
	[0133.713] lstrlenA (lpString="*.7z") returned 4
	[0133.713] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\iuSWIxWkYm2X.xlsx", pszSpec="*.tar") returned 0
	[0133.713] lstrlenA (lpString="*.tar") returned 5
	[0133.713] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\iuSWIxWkYm2X.xlsx", pszSpec="*.gzip") returned 0
	[0133.713] lstrlenA (lpString="*.gzip") returned 6
	[0133.713] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\iuSWIxWkYm2X.xlsx", pszSpec="*.jpg") returned 0
	[0133.713] lstrlenA (lpString="*.jpg") returned 5
	[0133.713] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\iuSWIxWkYm2X.xlsx", pszSpec="*.jpeg") returned 0
	[0133.713] lstrlenA (lpString="*.jpeg") returned 6
	[0133.713] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\iuSWIxWkYm2X.xlsx", pszSpec="*.bmp") returned 0
	[0133.713] lstrlenA (lpString="*.bmp") returned 5
	[0133.713] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\iuSWIxWkYm2X.xlsx", pszSpec="*.gif") returned 0
	[0133.713] lstrlenA (lpString="*.gif") returned 5
	[0133.713] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\iuSWIxWkYm2X.xlsx", pszSpec="*.png") returned 0
	[0133.713] lstrlenA (lpString="*.png") returned 5
	[0133.714] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\iuSWIxWkYm2X.xlsx", pszSpec="*.doc") returned 0
	[0133.714] lstrlenA (lpString="*.doc") returned 5
	[0133.714] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\iuSWIxWkYm2X.xlsx", pszSpec="*.docx") returned 0
	[0133.714] lstrlenA (lpString="*.docx") returned 6
	[0133.714] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\iuSWIxWkYm2X.xlsx", pszSpec="*.xls") returned 0
	[0133.714] lstrlenA (lpString="*.xls") returned 5
	[0133.714] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\iuSWIxWkYm2X.xlsx", pszSpec="*.xlsx") returned 1
	[0133.714] lstrlenA (lpString="*.xlsx") returned 6
	[0133.714] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Desktop\\iuSWIxWkYm2X.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\iuSWIxWkYm2X.xlsx") returned="C:\\Users\\FD1HVy\\Desktop\\iuSWIxWkYm2X.xlsx"
	[0133.714] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Desktop\\iuSWIxWkYm2X.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\iuSWIxWkYm2X.xlsx") returned="C:\\Users\\FD1HVy\\Desktop\\iuSWIxWkYm2X.xlsx"
	[0133.714] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\iuSWIxWkYm2X.xlsx", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\iuSWIxWkYm2X.xlsx.") returned="C:\\Users\\FD1HVy\\Desktop\\iuSWIxWkYm2X.xlsx."
	[0133.714] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\iuSWIxWkYm2X.xlsx.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\iuSWIxWkYm2X.xlsx.exe") returned="C:\\Users\\FD1HVy\\Desktop\\iuSWIxWkYm2X.xlsx.exe"
	[0133.714] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\iuSWIxWkYm2X.xlsx" (normalized: "c:\\users\\fd1hvy\\desktop\\iuswixwkym2x.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0133.714] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5f2f
	[0133.714] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x681ef830, dwHighDateTime=0x1d4c5f0), lpLastAccessTime=0x407536*(dwLowDateTime=0xa8f4c570, dwHighDateTime=0x1d4c7a2), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa8f4c570, dwHighDateTime=0x1d4c7a2)) returned 1
	[0133.714] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.714] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x5eed, lpOverlapped=0x0) returned 1
	[0133.715] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\iuSWIxWkYm2X.xlsx") returned="iuSWIxWkYm2X.xlsx"
	[0133.715] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.715] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x5eed, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x5eed, lpOverlapped=0x0) returned 1
	[0133.715] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.716] CloseHandle (hObject=0x20c) returned 1
	[0133.716] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\iuSWIxWkYm2X.xlsx" (normalized: "c:\\users\\fd1hvy\\desktop\\iuswixwkym2x.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\iuSWIxWkYm2X.xlsx.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\iuswixwkym2x.xlsx.exe")) returned 1
	[0133.716] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5553a00, ftCreationTime.dwHighDateTime=0x1d4cb31, ftLastAccessTime.dwLowDateTime=0xafdb0af0, ftLastAccessTime.dwHighDateTime=0x1d4c623, ftLastWriteTime.dwLowDateTime=0xafdb0af0, ftLastWriteTime.dwHighDateTime=0x1d4c623, nFileSizeHigh=0x0, nFileSizeLow=0x11306, dwReserved0=0x15, dwReserved1=0x1, cFileName="JaeXpoe.wav", cAlternateFileName="")) returned 1
	[0133.716] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0133.716] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="JaeXpoe.wav") returned -1
	[0133.716] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="JaeXpoe.wav") returned -1
	[0133.716] lstrcmpiA (lpString1="", lpString2="JaeXpoe.wav") returned -1
	[0133.716] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\iuSWIxWkYm2X.xlsx") returned="iuSWIxWkYm2X.xlsx"
	[0133.716] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0133.716] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0133.716] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.716] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0133.717] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="JaeXpoe.wav" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav") returned="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav"
	[0133.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav", pszSpec="*.zip") returned 0
	[0133.717] lstrlenA (lpString="*.zip") returned 5
	[0133.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav", pszSpec="*.rar") returned 0
	[0133.717] lstrlenA (lpString="*.rar") returned 5
	[0133.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav", pszSpec="*.7z") returned 0
	[0133.717] lstrlenA (lpString="*.7z") returned 4
	[0133.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav", pszSpec="*.tar") returned 0
	[0133.717] lstrlenA (lpString="*.tar") returned 5
	[0133.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav", pszSpec="*.gzip") returned 0
	[0133.717] lstrlenA (lpString="*.gzip") returned 6
	[0133.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav", pszSpec="*.jpg") returned 0
	[0133.717] lstrlenA (lpString="*.jpg") returned 5
	[0133.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav", pszSpec="*.jpeg") returned 0
	[0133.717] lstrlenA (lpString="*.jpeg") returned 6
	[0133.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav", pszSpec="*.bmp") returned 0
	[0133.717] lstrlenA (lpString="*.bmp") returned 5
	[0133.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav", pszSpec="*.gif") returned 0
	[0133.717] lstrlenA (lpString="*.gif") returned 5
	[0133.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav", pszSpec="*.png") returned 0
	[0133.717] lstrlenA (lpString="*.png") returned 5
	[0133.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav", pszSpec="*.doc") returned 0
	[0133.717] lstrlenA (lpString="*.doc") returned 5
	[0133.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav", pszSpec="*.docx") returned 0
	[0133.717] lstrlenA (lpString="*.docx") returned 6
	[0133.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav", pszSpec="*.xls") returned 0
	[0133.717] lstrlenA (lpString="*.xls") returned 5
	[0133.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav", pszSpec="*.xlsx") returned 0
	[0133.717] lstrlenA (lpString="*.xlsx") returned 6
	[0133.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav", pszSpec="*.ppt") returned 0
	[0133.717] lstrlenA (lpString="*.ppt") returned 5
	[0133.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav", pszSpec="*.pptx") returned 0
	[0133.717] lstrlenA (lpString="*.pptx") returned 6
	[0133.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav", pszSpec="*.txt") returned 0
	[0133.718] lstrlenA (lpString="*.txt") returned 5
	[0133.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav", pszSpec="*.pdf") returned 0
	[0133.718] lstrlenA (lpString="*.pdf") returned 5
	[0133.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav", pszSpec="*.htm") returned 0
	[0133.718] lstrlenA (lpString="*.htm") returned 5
	[0133.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav", pszSpec="*.html") returned 0
	[0133.718] lstrlenA (lpString="*.html") returned 6
	[0133.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav", pszSpec="*.mdb") returned 0
	[0133.718] lstrlenA (lpString="*.mdb") returned 5
	[0133.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav", pszSpec="*.pfx") returned 0
	[0133.718] lstrlenA (lpString="*.pfx") returned 5
	[0133.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav", pszSpec="*.md") returned 0
	[0133.718] lstrlenA (lpString="*.md") returned 4
	[0133.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav", pszSpec="*.lnk") returned 0
	[0133.718] lstrlenA (lpString="*.lnk") returned 5
	[0133.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav", pszSpec="*.torrent") returned 0
	[0133.718] lstrlenA (lpString="*.torrent") returned 9
	[0133.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav", pszSpec="*.mov") returned 0
	[0133.718] lstrlenA (lpString="*.mov") returned 5
	[0133.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav", pszSpec="*.3gp") returned 0
	[0133.718] lstrlenA (lpString="*.3gp") returned 5
	[0133.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav", pszSpec="*.mpeg") returned 0
	[0133.718] lstrlenA (lpString="*.mpeg") returned 6
	[0133.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav", pszSpec="*.mpg") returned 0
	[0133.718] lstrlenA (lpString="*.mpg") returned 5
	[0133.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav", pszSpec="*.flv") returned 0
	[0133.718] lstrlenA (lpString="*.flv") returned 5
	[0133.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav", pszSpec="*.avi") returned 0
	[0133.718] lstrlenA (lpString="*.avi") returned 5
	[0133.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav", pszSpec="*.mp4") returned 0
	[0133.718] lstrlenA (lpString="*.mp4") returned 5
	[0133.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav", pszSpec="*.wmv") returned 0
	[0133.718] lstrlenA (lpString="*.wmv") returned 5
	[0133.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav", pszSpec="*.mkv") returned 0
	[0133.718] lstrlenA (lpString="*.mkv") returned 5
	[0133.719] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav", pszSpec="*.mp3") returned 0
	[0133.719] lstrlenA (lpString="*.mp3") returned 5
	[0133.719] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav", pszSpec="*.wav") returned 1
	[0133.719] lstrlenA (lpString="*.wav") returned 5
	[0133.719] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav") returned="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav"
	[0133.719] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav") returned="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav"
	[0133.719] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav.") returned="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav."
	[0133.719] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav.exe") returned="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav.exe"
	[0133.719] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\jaexpoe.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0133.719] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11306
	[0133.719] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc5553a00, dwHighDateTime=0x1d4cb31), lpLastAccessTime=0x407536*(dwLowDateTime=0xafdb0af0, dwHighDateTime=0x1d4c623), lpLastWriteTime=0x40753e*(dwLowDateTime=0xafdb0af0, dwHighDateTime=0x1d4c623)) returned 1
	[0133.719] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.719] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x112c4, lpOverlapped=0x0) returned 1
	[0133.720] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav") returned="JaeXpoe.wav"
	[0133.720] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.721] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x112c4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x112c4, lpOverlapped=0x0) returned 1
	[0133.721] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.721] CloseHandle (hObject=0x20c) returned 1
	[0133.721] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\jaexpoe.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\jaexpoe.wav.exe")) returned 1
	[0133.721] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x430f7730, ftCreationTime.dwHighDateTime=0x1d4ca92, ftLastAccessTime.dwLowDateTime=0x11489730, ftLastAccessTime.dwHighDateTime=0x1d4d02e, ftLastWriteTime.dwLowDateTime=0x11489730, ftLastWriteTime.dwHighDateTime=0x1d4d02e, nFileSizeHigh=0x0, nFileSizeLow=0x4d02, dwReserved0=0x12, dwReserved1=0x1, cFileName="LUcHz7.flv", cAlternateFileName="")) returned 1
	[0133.722] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0133.722] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="LUcHz7.flv") returned -1
	[0133.722] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="LUcHz7.flv") returned -1
	[0133.722] lstrcmpiA (lpString1="", lpString2="LUcHz7.flv") returned -1
	[0133.722] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\JaeXpoe.wav") returned="JaeXpoe.wav"
	[0133.722] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0133.722] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0133.722] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.722] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0133.722] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="LUcHz7.flv" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv") returned="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv"
	[0133.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv", pszSpec="*.zip") returned 0
	[0133.722] lstrlenA (lpString="*.zip") returned 5
	[0133.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv", pszSpec="*.rar") returned 0
	[0133.722] lstrlenA (lpString="*.rar") returned 5
	[0133.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv", pszSpec="*.7z") returned 0
	[0133.722] lstrlenA (lpString="*.7z") returned 4
	[0133.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv", pszSpec="*.tar") returned 0
	[0133.722] lstrlenA (lpString="*.tar") returned 5
	[0133.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv", pszSpec="*.gzip") returned 0
	[0133.722] lstrlenA (lpString="*.gzip") returned 6
	[0133.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv", pszSpec="*.jpg") returned 0
	[0133.722] lstrlenA (lpString="*.jpg") returned 5
	[0133.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv", pszSpec="*.jpeg") returned 0
	[0133.722] lstrlenA (lpString="*.jpeg") returned 6
	[0133.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv", pszSpec="*.bmp") returned 0
	[0133.722] lstrlenA (lpString="*.bmp") returned 5
	[0133.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv", pszSpec="*.gif") returned 0
	[0133.722] lstrlenA (lpString="*.gif") returned 5
	[0133.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv", pszSpec="*.png") returned 0
	[0133.722] lstrlenA (lpString="*.png") returned 5
	[0133.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv", pszSpec="*.doc") returned 0
	[0133.723] lstrlenA (lpString="*.doc") returned 5
	[0133.723] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv", pszSpec="*.docx") returned 0
	[0133.723] lstrlenA (lpString="*.docx") returned 6
	[0133.723] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv", pszSpec="*.xls") returned 0
	[0133.723] lstrlenA (lpString="*.xls") returned 5
	[0133.723] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv", pszSpec="*.xlsx") returned 0
	[0133.723] lstrlenA (lpString="*.xlsx") returned 6
	[0133.723] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv", pszSpec="*.ppt") returned 0
	[0133.723] lstrlenA (lpString="*.ppt") returned 5
	[0133.723] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv", pszSpec="*.pptx") returned 0
	[0133.723] lstrlenA (lpString="*.pptx") returned 6
	[0133.723] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv", pszSpec="*.txt") returned 0
	[0133.723] lstrlenA (lpString="*.txt") returned 5
	[0133.723] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv", pszSpec="*.pdf") returned 0
	[0133.723] lstrlenA (lpString="*.pdf") returned 5
	[0133.723] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv", pszSpec="*.htm") returned 0
	[0133.723] lstrlenA (lpString="*.htm") returned 5
	[0133.723] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv", pszSpec="*.html") returned 0
	[0133.723] lstrlenA (lpString="*.html") returned 6
	[0133.723] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv", pszSpec="*.mdb") returned 0
	[0133.723] lstrlenA (lpString="*.mdb") returned 5
	[0133.723] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv", pszSpec="*.pfx") returned 0
	[0133.723] lstrlenA (lpString="*.pfx") returned 5
	[0133.723] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv", pszSpec="*.md") returned 0
	[0133.723] lstrlenA (lpString="*.md") returned 4
	[0133.723] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv", pszSpec="*.lnk") returned 0
	[0133.723] lstrlenA (lpString="*.lnk") returned 5
	[0133.723] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv", pszSpec="*.torrent") returned 0
	[0133.723] lstrlenA (lpString="*.torrent") returned 9
	[0133.723] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv", pszSpec="*.mov") returned 0
	[0133.723] lstrlenA (lpString="*.mov") returned 5
	[0133.723] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv", pszSpec="*.3gp") returned 0
	[0133.723] lstrlenA (lpString="*.3gp") returned 5
	[0133.723] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv", pszSpec="*.mpeg") returned 0
	[0133.723] lstrlenA (lpString="*.mpeg") returned 6
	[0133.723] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv", pszSpec="*.mpg") returned 0
	[0133.723] lstrlenA (lpString="*.mpg") returned 5
	[0133.724] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv", pszSpec="*.flv") returned 1
	[0133.724] lstrlenA (lpString="*.flv") returned 5
	[0133.724] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv") returned="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv"
	[0133.724] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv") returned="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv"
	[0133.724] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv.") returned="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv."
	[0133.724] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv.exe") returned="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv.exe"
	[0133.724] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\luchz7.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0133.724] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4d02
	[0133.724] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x430f7730, dwHighDateTime=0x1d4ca92), lpLastAccessTime=0x407536*(dwLowDateTime=0x11489730, dwHighDateTime=0x1d4d02e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x11489730, dwHighDateTime=0x1d4d02e)) returned 1
	[0133.724] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.724] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x4cc0, lpOverlapped=0x0) returned 1
	[0133.725] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv") returned="LUcHz7.flv"
	[0133.725] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.725] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x4cc0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x4cc0, lpOverlapped=0x0) returned 1
	[0133.725] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.725] CloseHandle (hObject=0x20c) returned 1
	[0133.725] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\luchz7.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\luchz7.flv.exe")) returned 1
	[0133.726] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dbdfaf0, ftCreationTime.dwHighDateTime=0x1d4d42c, ftLastAccessTime.dwLowDateTime=0x5e61eff0, ftLastAccessTime.dwHighDateTime=0x1d4c807, ftLastWriteTime.dwLowDateTime=0x5e61eff0, ftLastWriteTime.dwHighDateTime=0x1d4c807, nFileSizeHigh=0x0, nFileSizeLow=0x164eb, dwReserved0=0x12, dwReserved1=0x1, cFileName="mUWQNXrPrLQPE6ziJ17.xls", cAlternateFileName="MUWQNX~1.XLS")) returned 1
	[0133.726] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0133.726] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="mUWQNXrPrLQPE6ziJ17.xls") returned -1
	[0133.726] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="mUWQNXrPrLQPE6ziJ17.xls") returned -1
	[0133.726] lstrcmpiA (lpString1="", lpString2="mUWQNXrPrLQPE6ziJ17.xls") returned -1
	[0133.726] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\LUcHz7.flv") returned="LUcHz7.flv"
	[0133.729] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0133.729] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0133.729] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.729] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0133.729] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="mUWQNXrPrLQPE6ziJ17.xls" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\mUWQNXrPrLQPE6ziJ17.xls") returned="C:\\Users\\FD1HVy\\Desktop\\mUWQNXrPrLQPE6ziJ17.xls"
	[0133.729] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\mUWQNXrPrLQPE6ziJ17.xls", pszSpec="*.zip") returned 0
	[0133.729] lstrlenA (lpString="*.zip") returned 5
	[0133.729] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\mUWQNXrPrLQPE6ziJ17.xls", pszSpec="*.rar") returned 0
	[0133.729] lstrlenA (lpString="*.rar") returned 5
	[0133.729] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\mUWQNXrPrLQPE6ziJ17.xls", pszSpec="*.7z") returned 0
	[0133.729] lstrlenA (lpString="*.7z") returned 4
	[0133.729] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\mUWQNXrPrLQPE6ziJ17.xls", pszSpec="*.tar") returned 0
	[0133.729] lstrlenA (lpString="*.tar") returned 5
	[0133.729] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\mUWQNXrPrLQPE6ziJ17.xls", pszSpec="*.gzip") returned 0
	[0133.729] lstrlenA (lpString="*.gzip") returned 6
	[0133.729] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\mUWQNXrPrLQPE6ziJ17.xls", pszSpec="*.jpg") returned 0
	[0133.729] lstrlenA (lpString="*.jpg") returned 5
	[0133.730] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\mUWQNXrPrLQPE6ziJ17.xls", pszSpec="*.jpeg") returned 0
	[0133.730] lstrlenA (lpString="*.jpeg") returned 6
	[0133.730] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\mUWQNXrPrLQPE6ziJ17.xls", pszSpec="*.bmp") returned 0
	[0133.730] lstrlenA (lpString="*.bmp") returned 5
	[0133.730] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\mUWQNXrPrLQPE6ziJ17.xls", pszSpec="*.gif") returned 0
	[0133.730] lstrlenA (lpString="*.gif") returned 5
	[0133.730] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\mUWQNXrPrLQPE6ziJ17.xls", pszSpec="*.png") returned 0
	[0133.730] lstrlenA (lpString="*.png") returned 5
	[0133.730] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\mUWQNXrPrLQPE6ziJ17.xls", pszSpec="*.doc") returned 0
	[0133.730] lstrlenA (lpString="*.doc") returned 5
	[0133.730] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\mUWQNXrPrLQPE6ziJ17.xls", pszSpec="*.docx") returned 0
	[0133.730] lstrlenA (lpString="*.docx") returned 6
	[0133.730] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\mUWQNXrPrLQPE6ziJ17.xls", pszSpec="*.xls") returned 1
	[0133.730] lstrlenA (lpString="*.xls") returned 5
	[0133.730] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Desktop\\mUWQNXrPrLQPE6ziJ17.xls" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\mUWQNXrPrLQPE6ziJ17.xls") returned="C:\\Users\\FD1HVy\\Desktop\\mUWQNXrPrLQPE6ziJ17.xls"
	[0133.730] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Desktop\\mUWQNXrPrLQPE6ziJ17.xls" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\mUWQNXrPrLQPE6ziJ17.xls") returned="C:\\Users\\FD1HVy\\Desktop\\mUWQNXrPrLQPE6ziJ17.xls"
	[0133.730] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\mUWQNXrPrLQPE6ziJ17.xls", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\mUWQNXrPrLQPE6ziJ17.xls.") returned="C:\\Users\\FD1HVy\\Desktop\\mUWQNXrPrLQPE6ziJ17.xls."
	[0133.730] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\mUWQNXrPrLQPE6ziJ17.xls.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\mUWQNXrPrLQPE6ziJ17.xls.exe") returned="C:\\Users\\FD1HVy\\Desktop\\mUWQNXrPrLQPE6ziJ17.xls.exe"
	[0133.730] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\mUWQNXrPrLQPE6ziJ17.xls" (normalized: "c:\\users\\fd1hvy\\desktop\\muwqnxrprlqpe6zij17.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0133.730] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x164eb
	[0133.730] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9dbdfaf0, dwHighDateTime=0x1d4d42c), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e61eff0, dwHighDateTime=0x1d4c807), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5e61eff0, dwHighDateTime=0x1d4c807)) returned 1
	[0133.730] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.731] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x164a9, lpOverlapped=0x0) returned 1
	[0133.732] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\mUWQNXrPrLQPE6ziJ17.xls") returned="mUWQNXrPrLQPE6ziJ17.xls"
	[0133.732] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.732] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x164a9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x164a9, lpOverlapped=0x0) returned 1
	[0133.732] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.733] CloseHandle (hObject=0x20c) returned 1
	[0133.733] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\mUWQNXrPrLQPE6ziJ17.xls" (normalized: "c:\\users\\fd1hvy\\desktop\\muwqnxrprlqpe6zij17.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\mUWQNXrPrLQPE6ziJ17.xls.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\muwqnxrprlqpe6zij17.xls.exe")) returned 1
	[0133.733] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d9c5000, ftCreationTime.dwHighDateTime=0x1d4d47e, ftLastAccessTime.dwLowDateTime=0x8355b150, ftLastAccessTime.dwHighDateTime=0x1d4d4d9, ftLastWriteTime.dwLowDateTime=0x8355b150, ftLastWriteTime.dwHighDateTime=0x1d4d4d9, nFileSizeHigh=0x0, nFileSizeLow=0xe18a, dwReserved0=0x0, dwReserved1=0x1, cFileName="rIXFL TdixDzTGvn_jNO.rtf", cAlternateFileName="RIXFLT~1.RTF")) returned 1
	[0133.733] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0133.733] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="rIXFL TdixDzTGvn_jNO.rtf") returned -1
	[0133.733] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="rIXFL TdixDzTGvn_jNO.rtf") returned -1
	[0133.733] lstrcmpiA (lpString1="", lpString2="rIXFL TdixDzTGvn_jNO.rtf") returned -1
	[0133.733] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\mUWQNXrPrLQPE6ziJ17.xls") returned="mUWQNXrPrLQPE6ziJ17.xls"
	[0133.733] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0133.733] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0133.733] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.733] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0133.734] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="rIXFL TdixDzTGvn_jNO.rtf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf") returned="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf"
	[0133.734] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.zip") returned 0
	[0133.734] lstrlenA (lpString="*.zip") returned 5
	[0133.734] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.rar") returned 0
	[0133.734] lstrlenA (lpString="*.rar") returned 5
	[0133.734] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.7z") returned 0
	[0133.734] lstrlenA (lpString="*.7z") returned 4
	[0133.734] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.tar") returned 0
	[0133.734] lstrlenA (lpString="*.tar") returned 5
	[0133.734] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.gzip") returned 0
	[0133.734] lstrlenA (lpString="*.gzip") returned 6
	[0133.734] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.jpg") returned 0
	[0133.734] lstrlenA (lpString="*.jpg") returned 5
	[0133.734] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.jpeg") returned 0
	[0133.734] lstrlenA (lpString="*.jpeg") returned 6
	[0133.734] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.bmp") returned 0
	[0133.734] lstrlenA (lpString="*.bmp") returned 5
	[0133.734] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.gif") returned 0
	[0133.734] lstrlenA (lpString="*.gif") returned 5
	[0133.734] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.png") returned 0
	[0133.734] lstrlenA (lpString="*.png") returned 5
	[0133.734] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.doc") returned 0
	[0133.734] lstrlenA (lpString="*.doc") returned 5
	[0133.734] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.docx") returned 0
	[0133.734] lstrlenA (lpString="*.docx") returned 6
	[0133.734] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.xls") returned 0
	[0133.734] lstrlenA (lpString="*.xls") returned 5
	[0133.734] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.xlsx") returned 0
	[0133.734] lstrlenA (lpString="*.xlsx") returned 6
	[0133.734] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.ppt") returned 0
	[0133.734] lstrlenA (lpString="*.ppt") returned 5
	[0133.734] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.pptx") returned 0
	[0133.735] lstrlenA (lpString="*.pptx") returned 6
	[0133.735] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.txt") returned 0
	[0133.735] lstrlenA (lpString="*.txt") returned 5
	[0133.735] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.pdf") returned 0
	[0133.735] lstrlenA (lpString="*.pdf") returned 5
	[0133.735] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.htm") returned 0
	[0133.735] lstrlenA (lpString="*.htm") returned 5
	[0133.735] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.html") returned 0
	[0133.735] lstrlenA (lpString="*.html") returned 6
	[0133.735] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.mdb") returned 0
	[0133.735] lstrlenA (lpString="*.mdb") returned 5
	[0133.735] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.pfx") returned 0
	[0133.735] lstrlenA (lpString="*.pfx") returned 5
	[0133.735] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.md") returned 0
	[0133.735] lstrlenA (lpString="*.md") returned 4
	[0133.735] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.lnk") returned 0
	[0133.735] lstrlenA (lpString="*.lnk") returned 5
	[0133.735] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.torrent") returned 0
	[0133.735] lstrlenA (lpString="*.torrent") returned 9
	[0133.735] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.mov") returned 0
	[0133.735] lstrlenA (lpString="*.mov") returned 5
	[0133.735] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.3gp") returned 0
	[0133.735] lstrlenA (lpString="*.3gp") returned 5
	[0133.735] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.mpeg") returned 0
	[0133.735] lstrlenA (lpString="*.mpeg") returned 6
	[0133.735] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.mpg") returned 0
	[0133.735] lstrlenA (lpString="*.mpg") returned 5
	[0133.735] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.flv") returned 0
	[0133.735] lstrlenA (lpString="*.flv") returned 5
	[0133.735] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.avi") returned 0
	[0133.735] lstrlenA (lpString="*.avi") returned 5
	[0133.735] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.mp4") returned 0
	[0133.735] lstrlenA (lpString="*.mp4") returned 5
	[0133.735] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.wmv") returned 0
	[0133.735] lstrlenA (lpString="*.wmv") returned 5
	[0133.736] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.mkv") returned 0
	[0133.736] lstrlenA (lpString="*.mkv") returned 5
	[0133.736] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.mp3") returned 0
	[0133.736] lstrlenA (lpString="*.mp3") returned 5
	[0133.736] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.wav") returned 0
	[0133.736] lstrlenA (lpString="*.wav") returned 5
	[0133.736] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.flac") returned 0
	[0133.736] lstrlenA (lpString="*.flac") returned 6
	[0133.736] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.wma") returned 0
	[0133.736] lstrlenA (lpString="*.wma") returned 5
	[0133.736] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.au3") returned 0
	[0133.736] lstrlenA (lpString="*.au3") returned 5
	[0133.736] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.ahk") returned 0
	[0133.736] lstrlenA (lpString="*.ahk") returned 5
	[0133.736] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.c") returned 0
	[0133.736] lstrlenA (lpString="*.c") returned 3
	[0133.736] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.cc") returned 0
	[0133.736] lstrlenA (lpString="*.cc") returned 4
	[0133.736] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.cpp") returned 0
	[0133.736] lstrlenA (lpString="*.cpp") returned 5
	[0133.736] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.cxx") returned 0
	[0133.736] lstrlenA (lpString="*.cxx") returned 5
	[0133.736] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.c++") returned 0
	[0133.736] lstrlenA (lpString="*.c++") returned 5
	[0133.736] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.cs") returned 0
	[0133.736] lstrlenA (lpString="*.cs") returned 4
	[0133.736] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.vb") returned 0
	[0133.736] lstrlenA (lpString="*.vb") returned 4
	[0133.736] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.bas") returned 0
	[0133.736] lstrlenA (lpString="*.bas") returned 5
	[0133.736] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.csproj") returned 0
	[0133.736] lstrlenA (lpString="*.csproj") returned 8
	[0133.736] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.vbproj") returned 0
	[0133.736] lstrlenA (lpString="*.vbproj") returned 8
	[0133.736] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.vcxproj") returned 0
	[0133.736] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.737] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.manifest") returned 0
	[0133.737] lstrlenA (lpString="*.manifest") returned 10
	[0133.737] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.php") returned 0
	[0133.737] lstrlenA (lpString="*.php") returned 5
	[0133.737] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.vbe") returned 0
	[0133.737] lstrlenA (lpString="*.vbe") returned 5
	[0133.737] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.vba") returned 0
	[0133.737] lstrlenA (lpString="*.vba") returned 5
	[0133.737] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.vbs") returned 0
	[0133.737] lstrlenA (lpString="*.vbs") returned 5
	[0133.737] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.bat") returned 0
	[0133.737] lstrlenA (lpString="*.bat") returned 5
	[0133.737] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.cmd") returned 0
	[0133.737] lstrlenA (lpString="*.cmd") returned 5
	[0133.737] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.js") returned 0
	[0133.737] lstrlenA (lpString="*.js") returned 4
	[0133.737] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.jscript") returned 0
	[0133.737] lstrlenA (lpString="*.jscript") returned 9
	[0133.737] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.hta") returned 0
	[0133.737] lstrlenA (lpString="*.hta") returned 5
	[0133.737] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.php7") returned 0
	[0133.737] lstrlenA (lpString="*.php7") returned 6
	[0133.737] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.db") returned 0
	[0133.737] lstrlenA (lpString="*.db") returned 4
	[0133.737] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.swf") returned 0
	[0133.737] lstrlenA (lpString="*.swf") returned 5
	[0133.737] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.eml") returned 0
	[0133.737] lstrlenA (lpString="*.eml") returned 5
	[0133.737] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.part") returned 0
	[0133.737] lstrlenA (lpString="*.part") returned 6
	[0133.737] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.nfo") returned 0
	[0133.737] lstrlenA (lpString="*.nfo") returned 5
	[0133.737] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.rsa") returned 0
	[0133.737] lstrlenA (lpString="*.rsa") returned 5
	[0133.737] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.key") returned 0
	[0133.738] lstrlenA (lpString="*.key") returned 5
	[0133.738] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.aes") returned 0
	[0133.738] lstrlenA (lpString="*.aes") returned 5
	[0133.738] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.blob") returned 0
	[0133.738] lstrlenA (lpString="*.blob") returned 6
	[0133.738] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.btc") returned 0
	[0133.738] lstrlenA (lpString="*.btc") returned 5
	[0133.738] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf", pszSpec="*.wallet") returned 0
	[0133.738] lstrlenA (lpString="*.wallet") returned 8
	[0133.738] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb680ab80, ftCreationTime.dwHighDateTime=0x1d4d32a, ftLastAccessTime.dwLowDateTime=0xcd0b64e0, ftLastAccessTime.dwHighDateTime=0x1d4cabe, ftLastWriteTime.dwLowDateTime=0xcd0b64e0, ftLastWriteTime.dwHighDateTime=0x1d4cabe, nFileSizeHigh=0x0, nFileSizeLow=0x1365, dwReserved0=0x0, dwReserved1=0x0, cFileName="rOWLU7ipLB1OvGHuTP-Y.jpg", cAlternateFileName="ROWLU7~1.JPG")) returned 1
	[0133.738] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0133.738] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="rOWLU7ipLB1OvGHuTP-Y.jpg") returned -1
	[0133.738] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="rOWLU7ipLB1OvGHuTP-Y.jpg") returned -1
	[0133.738] lstrcmpiA (lpString1="", lpString2="rOWLU7ipLB1OvGHuTP-Y.jpg") returned -1
	[0133.738] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\rIXFL TdixDzTGvn_jNO.rtf") returned="rIXFL TdixDzTGvn_jNO.rtf"
	[0133.738] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0133.738] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0133.738] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.738] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0133.738] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="rOWLU7ipLB1OvGHuTP-Y.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\rOWLU7ipLB1OvGHuTP-Y.jpg") returned="C:\\Users\\FD1HVy\\Desktop\\rOWLU7ipLB1OvGHuTP-Y.jpg"
	[0133.738] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rOWLU7ipLB1OvGHuTP-Y.jpg", pszSpec="*.zip") returned 0
	[0133.738] lstrlenA (lpString="*.zip") returned 5
	[0133.738] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rOWLU7ipLB1OvGHuTP-Y.jpg", pszSpec="*.rar") returned 0
	[0133.738] lstrlenA (lpString="*.rar") returned 5
	[0133.738] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rOWLU7ipLB1OvGHuTP-Y.jpg", pszSpec="*.7z") returned 0
	[0133.738] lstrlenA (lpString="*.7z") returned 4
	[0133.738] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rOWLU7ipLB1OvGHuTP-Y.jpg", pszSpec="*.tar") returned 0
	[0133.738] lstrlenA (lpString="*.tar") returned 5
	[0133.738] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rOWLU7ipLB1OvGHuTP-Y.jpg", pszSpec="*.gzip") returned 0
	[0133.738] lstrlenA (lpString="*.gzip") returned 6
	[0133.738] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\rOWLU7ipLB1OvGHuTP-Y.jpg", pszSpec="*.jpg") returned 1
	[0133.738] lstrlenA (lpString="*.jpg") returned 5
	[0133.739] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Desktop\\rOWLU7ipLB1OvGHuTP-Y.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\rOWLU7ipLB1OvGHuTP-Y.jpg") returned="C:\\Users\\FD1HVy\\Desktop\\rOWLU7ipLB1OvGHuTP-Y.jpg"
	[0133.739] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Desktop\\rOWLU7ipLB1OvGHuTP-Y.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\rOWLU7ipLB1OvGHuTP-Y.jpg") returned="C:\\Users\\FD1HVy\\Desktop\\rOWLU7ipLB1OvGHuTP-Y.jpg"
	[0133.739] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\rOWLU7ipLB1OvGHuTP-Y.jpg", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\rOWLU7ipLB1OvGHuTP-Y.jpg.") returned="C:\\Users\\FD1HVy\\Desktop\\rOWLU7ipLB1OvGHuTP-Y.jpg."
	[0133.739] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\rOWLU7ipLB1OvGHuTP-Y.jpg.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\rOWLU7ipLB1OvGHuTP-Y.jpg.exe") returned="C:\\Users\\FD1HVy\\Desktop\\rOWLU7ipLB1OvGHuTP-Y.jpg.exe"
	[0133.739] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\rOWLU7ipLB1OvGHuTP-Y.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\rowlu7iplb1ovghutp-y.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0133.739] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1365
	[0133.739] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb680ab80, dwHighDateTime=0x1d4d32a), lpLastAccessTime=0x407536*(dwLowDateTime=0xcd0b64e0, dwHighDateTime=0x1d4cabe), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcd0b64e0, dwHighDateTime=0x1d4cabe)) returned 1
	[0133.739] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.739] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1323, lpOverlapped=0x0) returned 1
	[0133.740] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\rOWLU7ipLB1OvGHuTP-Y.jpg") returned="rOWLU7ipLB1OvGHuTP-Y.jpg"
	[0133.740] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.740] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1323, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1323, lpOverlapped=0x0) returned 1
	[0133.740] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.740] CloseHandle (hObject=0x20c) returned 1
	[0133.740] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\rOWLU7ipLB1OvGHuTP-Y.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\rowlu7iplb1ovghutp-y.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\rOWLU7ipLB1OvGHuTP-Y.jpg.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\rowlu7iplb1ovghutp-y.jpg.exe")) returned 1
	[0133.741] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x504ee0d0, ftCreationTime.dwHighDateTime=0x1d4c6f9, ftLastAccessTime.dwLowDateTime=0x61344130, ftLastAccessTime.dwHighDateTime=0x1d4cd96, ftLastWriteTime.dwLowDateTime=0x61344130, ftLastWriteTime.dwHighDateTime=0x1d4cd96, nFileSizeHigh=0x0, nFileSizeLow=0x134c9, dwReserved0=0x0, dwReserved1=0x1, cFileName="s_yBLxG65s2hHtpxj1i.m4a", cAlternateFileName="S_YBLX~1.M4A")) returned 1
	[0133.741] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0133.741] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="s_yBLxG65s2hHtpxj1i.m4a") returned -1
	[0133.741] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="s_yBLxG65s2hHtpxj1i.m4a") returned -1
	[0133.741] lstrcmpiA (lpString1="", lpString2="s_yBLxG65s2hHtpxj1i.m4a") returned -1
	[0133.741] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\rOWLU7ipLB1OvGHuTP-Y.jpg") returned="rOWLU7ipLB1OvGHuTP-Y.jpg"
	[0133.741] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0133.741] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0133.741] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.741] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0133.741] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="s_yBLxG65s2hHtpxj1i.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a") returned="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a"
	[0133.741] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.zip") returned 0
	[0133.741] lstrlenA (lpString="*.zip") returned 5
	[0133.741] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.rar") returned 0
	[0133.741] lstrlenA (lpString="*.rar") returned 5
	[0133.741] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.7z") returned 0
	[0133.741] lstrlenA (lpString="*.7z") returned 4
	[0133.741] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.tar") returned 0
	[0133.741] lstrlenA (lpString="*.tar") returned 5
	[0133.741] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.gzip") returned 0
	[0133.741] lstrlenA (lpString="*.gzip") returned 6
	[0133.741] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.jpg") returned 0
	[0133.742] lstrlenA (lpString="*.jpg") returned 5
	[0133.742] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.jpeg") returned 0
	[0133.742] lstrlenA (lpString="*.jpeg") returned 6
	[0133.742] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.bmp") returned 0
	[0133.742] lstrlenA (lpString="*.bmp") returned 5
	[0133.742] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.gif") returned 0
	[0133.742] lstrlenA (lpString="*.gif") returned 5
	[0133.742] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.png") returned 0
	[0133.742] lstrlenA (lpString="*.png") returned 5
	[0133.742] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.doc") returned 0
	[0133.742] lstrlenA (lpString="*.doc") returned 5
	[0133.742] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.docx") returned 0
	[0133.742] lstrlenA (lpString="*.docx") returned 6
	[0133.742] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.xls") returned 0
	[0133.742] lstrlenA (lpString="*.xls") returned 5
	[0133.742] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.xlsx") returned 0
	[0133.742] lstrlenA (lpString="*.xlsx") returned 6
	[0133.742] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.ppt") returned 0
	[0133.742] lstrlenA (lpString="*.ppt") returned 5
	[0133.742] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.pptx") returned 0
	[0133.742] lstrlenA (lpString="*.pptx") returned 6
	[0133.742] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.txt") returned 0
	[0133.742] lstrlenA (lpString="*.txt") returned 5
	[0133.742] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.pdf") returned 0
	[0133.742] lstrlenA (lpString="*.pdf") returned 5
	[0133.742] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.htm") returned 0
	[0133.742] lstrlenA (lpString="*.htm") returned 5
	[0133.742] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.html") returned 0
	[0133.742] lstrlenA (lpString="*.html") returned 6
	[0133.742] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.mdb") returned 0
	[0133.742] lstrlenA (lpString="*.mdb") returned 5
	[0133.742] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.pfx") returned 0
	[0133.743] lstrlenA (lpString="*.pfx") returned 5
	[0133.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.md") returned 0
	[0133.743] lstrlenA (lpString="*.md") returned 4
	[0133.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.lnk") returned 0
	[0133.743] lstrlenA (lpString="*.lnk") returned 5
	[0133.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.torrent") returned 0
	[0133.743] lstrlenA (lpString="*.torrent") returned 9
	[0133.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.mov") returned 0
	[0133.743] lstrlenA (lpString="*.mov") returned 5
	[0133.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.3gp") returned 0
	[0133.743] lstrlenA (lpString="*.3gp") returned 5
	[0133.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.mpeg") returned 0
	[0133.743] lstrlenA (lpString="*.mpeg") returned 6
	[0133.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.mpg") returned 0
	[0133.743] lstrlenA (lpString="*.mpg") returned 5
	[0133.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.flv") returned 0
	[0133.743] lstrlenA (lpString="*.flv") returned 5
	[0133.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.avi") returned 0
	[0133.743] lstrlenA (lpString="*.avi") returned 5
	[0133.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.mp4") returned 0
	[0133.743] lstrlenA (lpString="*.mp4") returned 5
	[0133.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.wmv") returned 0
	[0133.743] lstrlenA (lpString="*.wmv") returned 5
	[0133.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.mkv") returned 0
	[0133.743] lstrlenA (lpString="*.mkv") returned 5
	[0133.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.mp3") returned 0
	[0133.743] lstrlenA (lpString="*.mp3") returned 5
	[0133.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.wav") returned 0
	[0133.743] lstrlenA (lpString="*.wav") returned 5
	[0133.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.flac") returned 0
	[0133.743] lstrlenA (lpString="*.flac") returned 6
	[0133.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.wma") returned 0
	[0133.743] lstrlenA (lpString="*.wma") returned 5
	[0133.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.au3") returned 0
	[0133.743] lstrlenA (lpString="*.au3") returned 5
	[0133.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.ahk") returned 0
	[0133.744] lstrlenA (lpString="*.ahk") returned 5
	[0133.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.c") returned 0
	[0133.744] lstrlenA (lpString="*.c") returned 3
	[0133.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.cc") returned 0
	[0133.744] lstrlenA (lpString="*.cc") returned 4
	[0133.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.cpp") returned 0
	[0133.744] lstrlenA (lpString="*.cpp") returned 5
	[0133.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.cxx") returned 0
	[0133.744] lstrlenA (lpString="*.cxx") returned 5
	[0133.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.c++") returned 0
	[0133.744] lstrlenA (lpString="*.c++") returned 5
	[0133.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.cs") returned 0
	[0133.744] lstrlenA (lpString="*.cs") returned 4
	[0133.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.vb") returned 0
	[0133.744] lstrlenA (lpString="*.vb") returned 4
	[0133.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.bas") returned 0
	[0133.744] lstrlenA (lpString="*.bas") returned 5
	[0133.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.csproj") returned 0
	[0133.744] lstrlenA (lpString="*.csproj") returned 8
	[0133.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.vbproj") returned 0
	[0133.744] lstrlenA (lpString="*.vbproj") returned 8
	[0133.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.vcxproj") returned 0
	[0133.744] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.manifest") returned 0
	[0133.744] lstrlenA (lpString="*.manifest") returned 10
	[0133.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.php") returned 0
	[0133.744] lstrlenA (lpString="*.php") returned 5
	[0133.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.vbe") returned 0
	[0133.744] lstrlenA (lpString="*.vbe") returned 5
	[0133.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.vba") returned 0
	[0133.744] lstrlenA (lpString="*.vba") returned 5
	[0133.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.vbs") returned 0
	[0133.744] lstrlenA (lpString="*.vbs") returned 5
	[0133.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.bat") returned 0
	[0133.744] lstrlenA (lpString="*.bat") returned 5
	[0133.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.cmd") returned 0
	[0133.745] lstrlenA (lpString="*.cmd") returned 5
	[0133.745] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.js") returned 0
	[0133.745] lstrlenA (lpString="*.js") returned 4
	[0133.745] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.jscript") returned 0
	[0133.745] lstrlenA (lpString="*.jscript") returned 9
	[0133.745] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.hta") returned 0
	[0133.745] lstrlenA (lpString="*.hta") returned 5
	[0133.745] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.php7") returned 0
	[0133.745] lstrlenA (lpString="*.php7") returned 6
	[0133.745] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.db") returned 0
	[0133.745] lstrlenA (lpString="*.db") returned 4
	[0133.745] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.swf") returned 0
	[0133.745] lstrlenA (lpString="*.swf") returned 5
	[0133.745] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.eml") returned 0
	[0133.745] lstrlenA (lpString="*.eml") returned 5
	[0133.745] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.part") returned 0
	[0133.745] lstrlenA (lpString="*.part") returned 6
	[0133.745] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.nfo") returned 0
	[0133.745] lstrlenA (lpString="*.nfo") returned 5
	[0133.745] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.rsa") returned 0
	[0133.745] lstrlenA (lpString="*.rsa") returned 5
	[0133.745] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.key") returned 0
	[0133.745] lstrlenA (lpString="*.key") returned 5
	[0133.745] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.aes") returned 0
	[0133.745] lstrlenA (lpString="*.aes") returned 5
	[0133.745] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.blob") returned 0
	[0133.745] lstrlenA (lpString="*.blob") returned 6
	[0133.745] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.btc") returned 0
	[0133.745] lstrlenA (lpString="*.btc") returned 5
	[0133.745] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a", pszSpec="*.wallet") returned 0
	[0133.745] lstrlenA (lpString="*.wallet") returned 8
	[0133.745] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ddb65c0, ftCreationTime.dwHighDateTime=0x1d4cd0d, ftLastAccessTime.dwLowDateTime=0xd80358e0, ftLastAccessTime.dwHighDateTime=0x1d4d341, ftLastWriteTime.dwLowDateTime=0xd80358e0, ftLastWriteTime.dwHighDateTime=0x1d4d341, nFileSizeHigh=0x0, nFileSizeLow=0xc5d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="T rxzyXICUPwq.docx", cAlternateFileName="TRXZYX~1.DOC")) returned 1
	[0133.745] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0133.745] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="T rxzyXICUPwq.docx") returned -1
	[0133.745] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="T rxzyXICUPwq.docx") returned -1
	[0133.746] lstrcmpiA (lpString1="", lpString2="T rxzyXICUPwq.docx") returned -1
	[0133.746] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\s_yBLxG65s2hHtpxj1i.m4a") returned="s_yBLxG65s2hHtpxj1i.m4a"
	[0133.746] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0133.746] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0133.746] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.746] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0133.746] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="T rxzyXICUPwq.docx" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\T rxzyXICUPwq.docx") returned="C:\\Users\\FD1HVy\\Desktop\\T rxzyXICUPwq.docx"
	[0133.746] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\T rxzyXICUPwq.docx", pszSpec="*.zip") returned 0
	[0133.746] lstrlenA (lpString="*.zip") returned 5
	[0133.746] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\T rxzyXICUPwq.docx", pszSpec="*.rar") returned 0
	[0133.746] lstrlenA (lpString="*.rar") returned 5
	[0133.746] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\T rxzyXICUPwq.docx", pszSpec="*.7z") returned 0
	[0133.746] lstrlenA (lpString="*.7z") returned 4
	[0133.746] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\T rxzyXICUPwq.docx", pszSpec="*.tar") returned 0
	[0133.746] lstrlenA (lpString="*.tar") returned 5
	[0133.746] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\T rxzyXICUPwq.docx", pszSpec="*.gzip") returned 0
	[0133.746] lstrlenA (lpString="*.gzip") returned 6
	[0133.746] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\T rxzyXICUPwq.docx", pszSpec="*.jpg") returned 0
	[0133.746] lstrlenA (lpString="*.jpg") returned 5
	[0133.746] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\T rxzyXICUPwq.docx", pszSpec="*.jpeg") returned 0
	[0133.746] lstrlenA (lpString="*.jpeg") returned 6
	[0133.746] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\T rxzyXICUPwq.docx", pszSpec="*.bmp") returned 0
	[0133.746] lstrlenA (lpString="*.bmp") returned 5
	[0133.746] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\T rxzyXICUPwq.docx", pszSpec="*.gif") returned 0
	[0133.746] lstrlenA (lpString="*.gif") returned 5
	[0133.746] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\T rxzyXICUPwq.docx", pszSpec="*.png") returned 0
	[0133.746] lstrlenA (lpString="*.png") returned 5
	[0133.746] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\T rxzyXICUPwq.docx", pszSpec="*.doc") returned 0
	[0133.746] lstrlenA (lpString="*.doc") returned 5
	[0133.746] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\T rxzyXICUPwq.docx", pszSpec="*.docx") returned 1
	[0133.746] lstrlenA (lpString="*.docx") returned 6
	[0133.747] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Desktop\\T rxzyXICUPwq.docx" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\T rxzyXICUPwq.docx") returned="C:\\Users\\FD1HVy\\Desktop\\T rxzyXICUPwq.docx"
	[0133.747] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Desktop\\T rxzyXICUPwq.docx" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\T rxzyXICUPwq.docx") returned="C:\\Users\\FD1HVy\\Desktop\\T rxzyXICUPwq.docx"
	[0133.747] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\T rxzyXICUPwq.docx", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\T rxzyXICUPwq.docx.") returned="C:\\Users\\FD1HVy\\Desktop\\T rxzyXICUPwq.docx."
	[0133.747] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\T rxzyXICUPwq.docx.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\T rxzyXICUPwq.docx.exe") returned="C:\\Users\\FD1HVy\\Desktop\\T rxzyXICUPwq.docx.exe"
	[0133.747] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\T rxzyXICUPwq.docx" (normalized: "c:\\users\\fd1hvy\\desktop\\t rxzyxicupwq.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0133.747] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc5d0
	[0133.747] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4ddb65c0, dwHighDateTime=0x1d4cd0d), lpLastAccessTime=0x407536*(dwLowDateTime=0xd80358e0, dwHighDateTime=0x1d4d341), lpLastWriteTime=0x40753e*(dwLowDateTime=0xd80358e0, dwHighDateTime=0x1d4d341)) returned 1
	[0133.747] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.747] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xc58e, lpOverlapped=0x0) returned 1
	[0133.748] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\T rxzyXICUPwq.docx") returned="T rxzyXICUPwq.docx"
	[0133.748] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.748] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xc58e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xc58e, lpOverlapped=0x0) returned 1
	[0133.749] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.749] CloseHandle (hObject=0x20c) returned 1
	[0133.749] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\T rxzyXICUPwq.docx" (normalized: "c:\\users\\fd1hvy\\desktop\\t rxzyxicupwq.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\T rxzyXICUPwq.docx.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\t rxzyxicupwq.docx.exe")) returned 1
	[0133.749] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f45f1b0, ftCreationTime.dwHighDateTime=0x1d4cc50, ftLastAccessTime.dwLowDateTime=0xf652a3f0, ftLastAccessTime.dwHighDateTime=0x1d4cf63, ftLastWriteTime.dwLowDateTime=0xf652a3f0, ftLastWriteTime.dwHighDateTime=0x1d4cf63, nFileSizeHigh=0x0, nFileSizeLow=0x13db8, dwReserved0=0x15, dwReserved1=0x1, cFileName="TaFI.bmp", cAlternateFileName="")) returned 1
	[0133.749] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0133.749] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="TaFI.bmp") returned -1
	[0133.749] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="TaFI.bmp") returned -1
	[0133.750] lstrcmpiA (lpString1="", lpString2="TaFI.bmp") returned -1
	[0133.750] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\T rxzyXICUPwq.docx") returned="T rxzyXICUPwq.docx"
	[0133.750] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0133.750] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0133.750] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.750] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0133.750] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="TaFI.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\TaFI.bmp") returned="C:\\Users\\FD1HVy\\Desktop\\TaFI.bmp"
	[0133.750] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\TaFI.bmp", pszSpec="*.zip") returned 0
	[0133.750] lstrlenA (lpString="*.zip") returned 5
	[0133.750] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\TaFI.bmp", pszSpec="*.rar") returned 0
	[0133.750] lstrlenA (lpString="*.rar") returned 5
	[0133.750] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\TaFI.bmp", pszSpec="*.7z") returned 0
	[0133.750] lstrlenA (lpString="*.7z") returned 4
	[0133.750] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\TaFI.bmp", pszSpec="*.tar") returned 0
	[0133.750] lstrlenA (lpString="*.tar") returned 5
	[0133.750] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\TaFI.bmp", pszSpec="*.gzip") returned 0
	[0133.750] lstrlenA (lpString="*.gzip") returned 6
	[0133.750] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\TaFI.bmp", pszSpec="*.jpg") returned 0
	[0133.750] lstrlenA (lpString="*.jpg") returned 5
	[0133.750] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\TaFI.bmp", pszSpec="*.jpeg") returned 0
	[0133.750] lstrlenA (lpString="*.jpeg") returned 6
	[0133.750] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\TaFI.bmp", pszSpec="*.bmp") returned 1
	[0133.750] lstrlenA (lpString="*.bmp") returned 5
	[0133.750] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Desktop\\TaFI.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\TaFI.bmp") returned="C:\\Users\\FD1HVy\\Desktop\\TaFI.bmp"
	[0133.750] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Desktop\\TaFI.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\TaFI.bmp") returned="C:\\Users\\FD1HVy\\Desktop\\TaFI.bmp"
	[0133.750] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\TaFI.bmp", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\TaFI.bmp.") returned="C:\\Users\\FD1HVy\\Desktop\\TaFI.bmp."
	[0133.750] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\TaFI.bmp.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\TaFI.bmp.exe") returned="C:\\Users\\FD1HVy\\Desktop\\TaFI.bmp.exe"
	[0133.750] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\TaFI.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\tafi.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0133.751] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13db8
	[0133.751] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x2f45f1b0, dwHighDateTime=0x1d4cc50), lpLastAccessTime=0x407536*(dwLowDateTime=0xf652a3f0, dwHighDateTime=0x1d4cf63), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf652a3f0, dwHighDateTime=0x1d4cf63)) returned 1
	[0133.751] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.751] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x13d76, lpOverlapped=0x0) returned 1
	[0133.752] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\TaFI.bmp") returned="TaFI.bmp"
	[0133.752] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.752] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x13d76, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x13d76, lpOverlapped=0x0) returned 1
	[0133.752] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.753] CloseHandle (hObject=0x20c) returned 1
	[0133.753] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TaFI.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\tafi.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\TaFI.bmp.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\tafi.bmp.exe")) returned 1
	[0133.753] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d7b1c0, ftCreationTime.dwHighDateTime=0x1d4d04e, ftLastAccessTime.dwLowDateTime=0x743e5c20, ftLastAccessTime.dwHighDateTime=0x1d4c797, ftLastWriteTime.dwLowDateTime=0x743e5c20, ftLastWriteTime.dwHighDateTime=0x1d4c797, nFileSizeHigh=0x0, nFileSizeLow=0x84a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="tLZq.png", cAlternateFileName="")) returned 1
	[0133.753] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0133.753] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="tLZq.png") returned -1
	[0133.753] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="tLZq.png") returned -1
	[0133.753] lstrcmpiA (lpString1="", lpString2="tLZq.png") returned -1
	[0133.753] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\TaFI.bmp") returned="TaFI.bmp"
	[0133.753] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0133.753] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0133.753] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.753] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0133.754] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="tLZq.png" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\tLZq.png") returned="C:\\Users\\FD1HVy\\Desktop\\tLZq.png"
	[0133.754] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\tLZq.png", pszSpec="*.zip") returned 0
	[0133.754] lstrlenA (lpString="*.zip") returned 5
	[0133.754] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\tLZq.png", pszSpec="*.rar") returned 0
	[0133.754] lstrlenA (lpString="*.rar") returned 5
	[0133.754] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\tLZq.png", pszSpec="*.7z") returned 0
	[0133.754] lstrlenA (lpString="*.7z") returned 4
	[0133.754] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\tLZq.png", pszSpec="*.tar") returned 0
	[0133.754] lstrlenA (lpString="*.tar") returned 5
	[0133.754] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\tLZq.png", pszSpec="*.gzip") returned 0
	[0133.754] lstrlenA (lpString="*.gzip") returned 6
	[0133.754] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\tLZq.png", pszSpec="*.jpg") returned 0
	[0133.754] lstrlenA (lpString="*.jpg") returned 5
	[0133.754] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\tLZq.png", pszSpec="*.jpeg") returned 0
	[0133.754] lstrlenA (lpString="*.jpeg") returned 6
	[0133.754] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\tLZq.png", pszSpec="*.bmp") returned 0
	[0133.754] lstrlenA (lpString="*.bmp") returned 5
	[0133.754] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\tLZq.png", pszSpec="*.gif") returned 0
	[0133.754] lstrlenA (lpString="*.gif") returned 5
	[0133.754] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\tLZq.png", pszSpec="*.png") returned 1
	[0133.754] lstrlenA (lpString="*.png") returned 5
	[0133.754] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Desktop\\tLZq.png" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\tLZq.png") returned="C:\\Users\\FD1HVy\\Desktop\\tLZq.png"
	[0133.754] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Desktop\\tLZq.png" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\tLZq.png") returned="C:\\Users\\FD1HVy\\Desktop\\tLZq.png"
	[0133.754] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\tLZq.png", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\tLZq.png.") returned="C:\\Users\\FD1HVy\\Desktop\\tLZq.png."
	[0133.754] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\tLZq.png.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\tLZq.png.exe") returned="C:\\Users\\FD1HVy\\Desktop\\tLZq.png.exe"
	[0133.754] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tLZq.png" (normalized: "c:\\users\\fd1hvy\\desktop\\tlzq.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0133.755] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x84a3
	[0133.755] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x93d7b1c0, dwHighDateTime=0x1d4d04e), lpLastAccessTime=0x407536*(dwLowDateTime=0x743e5c20, dwHighDateTime=0x1d4c797), lpLastWriteTime=0x40753e*(dwLowDateTime=0x743e5c20, dwHighDateTime=0x1d4c797)) returned 1
	[0133.755] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.755] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x8461, lpOverlapped=0x0) returned 1
	[0133.756] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\tLZq.png") returned="tLZq.png"
	[0133.756] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.756] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x8461, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x8461, lpOverlapped=0x0) returned 1
	[0133.756] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.756] CloseHandle (hObject=0x20c) returned 1
	[0133.756] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\tLZq.png" (normalized: "c:\\users\\fd1hvy\\desktop\\tlzq.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\tLZq.png.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\tlzq.png.exe")) returned 1
	[0133.757] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9798de00, ftCreationTime.dwHighDateTime=0x1d4ce15, ftLastAccessTime.dwLowDateTime=0x9f7abcc0, ftLastAccessTime.dwHighDateTime=0x1d4c810, ftLastWriteTime.dwLowDateTime=0x9f7abcc0, ftLastWriteTime.dwHighDateTime=0x1d4c810, nFileSizeHigh=0x0, nFileSizeLow=0x1786d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tm92QubEkE.gif", cAlternateFileName="TM92QU~1.GIF")) returned 1
	[0133.757] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0133.757] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Tm92QubEkE.gif") returned -1
	[0133.757] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Tm92QubEkE.gif") returned -1
	[0133.757] lstrcmpiA (lpString1="", lpString2="Tm92QubEkE.gif") returned -1
	[0133.757] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\tLZq.png") returned="tLZq.png"
	[0133.757] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0133.757] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0133.757] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.757] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0133.757] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="Tm92QubEkE.gif" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Tm92QubEkE.gif") returned="C:\\Users\\FD1HVy\\Desktop\\Tm92QubEkE.gif"
	[0133.757] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Tm92QubEkE.gif", pszSpec="*.zip") returned 0
	[0133.757] lstrlenA (lpString="*.zip") returned 5
	[0133.757] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Tm92QubEkE.gif", pszSpec="*.rar") returned 0
	[0133.757] lstrlenA (lpString="*.rar") returned 5
	[0133.757] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Tm92QubEkE.gif", pszSpec="*.7z") returned 0
	[0133.757] lstrlenA (lpString="*.7z") returned 4
	[0133.757] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Tm92QubEkE.gif", pszSpec="*.tar") returned 0
	[0133.757] lstrlenA (lpString="*.tar") returned 5
	[0133.757] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Tm92QubEkE.gif", pszSpec="*.gzip") returned 0
	[0133.757] lstrlenA (lpString="*.gzip") returned 6
	[0133.757] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Tm92QubEkE.gif", pszSpec="*.jpg") returned 0
	[0133.757] lstrlenA (lpString="*.jpg") returned 5
	[0133.758] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Tm92QubEkE.gif", pszSpec="*.jpeg") returned 0
	[0133.758] lstrlenA (lpString="*.jpeg") returned 6
	[0133.758] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Tm92QubEkE.gif", pszSpec="*.bmp") returned 0
	[0133.758] lstrlenA (lpString="*.bmp") returned 5
	[0133.758] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\Tm92QubEkE.gif", pszSpec="*.gif") returned 1
	[0133.758] lstrlenA (lpString="*.gif") returned 5
	[0133.758] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Desktop\\Tm92QubEkE.gif" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Tm92QubEkE.gif") returned="C:\\Users\\FD1HVy\\Desktop\\Tm92QubEkE.gif"
	[0133.758] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Desktop\\Tm92QubEkE.gif" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Tm92QubEkE.gif") returned="C:\\Users\\FD1HVy\\Desktop\\Tm92QubEkE.gif"
	[0133.758] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\Tm92QubEkE.gif", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Tm92QubEkE.gif.") returned="C:\\Users\\FD1HVy\\Desktop\\Tm92QubEkE.gif."
	[0133.758] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\Tm92QubEkE.gif.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Tm92QubEkE.gif.exe") returned="C:\\Users\\FD1HVy\\Desktop\\Tm92QubEkE.gif.exe"
	[0133.758] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Tm92QubEkE.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\tm92qubeke.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0133.758] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1786d
	[0133.759] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9798de00, dwHighDateTime=0x1d4ce15), lpLastAccessTime=0x407536*(dwLowDateTime=0x9f7abcc0, dwHighDateTime=0x1d4c810), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9f7abcc0, dwHighDateTime=0x1d4c810)) returned 1
	[0133.759] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.759] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1782b, lpOverlapped=0x0) returned 1
	[0133.760] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\Tm92QubEkE.gif") returned="Tm92QubEkE.gif"
	[0133.760] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.760] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1782b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1782b, lpOverlapped=0x0) returned 1
	[0133.760] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.760] CloseHandle (hObject=0x20c) returned 1
	[0133.761] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\Tm92QubEkE.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\tm92qubeke.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\Tm92QubEkE.gif.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\tm92qubeke.gif.exe")) returned 1
	[0133.761] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d959430, ftCreationTime.dwHighDateTime=0x1d4cffb, ftLastAccessTime.dwLowDateTime=0x1c83dfb0, ftLastAccessTime.dwHighDateTime=0x1d4c7f0, ftLastWriteTime.dwLowDateTime=0x1c83dfb0, ftLastWriteTime.dwHighDateTime=0x1d4c7f0, nFileSizeHigh=0x0, nFileSizeLow=0x2e0f, dwReserved0=0x12, dwReserved1=0x1, cFileName="UvNgc-5Umg4cH274N.png", cAlternateFileName="UVNGC-~1.PNG")) returned 1
	[0133.761] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0133.761] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="UvNgc-5Umg4cH274N.png") returned -1
	[0133.761] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="UvNgc-5Umg4cH274N.png") returned -1
	[0133.761] lstrcmpiA (lpString1="", lpString2="UvNgc-5Umg4cH274N.png") returned -1
	[0133.761] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\Tm92QubEkE.gif") returned="Tm92QubEkE.gif"
	[0133.761] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0133.761] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0133.761] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.761] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0133.761] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="UvNgc-5Umg4cH274N.png" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\UvNgc-5Umg4cH274N.png") returned="C:\\Users\\FD1HVy\\Desktop\\UvNgc-5Umg4cH274N.png"
	[0133.762] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\UvNgc-5Umg4cH274N.png", pszSpec="*.zip") returned 0
	[0133.762] lstrlenA (lpString="*.zip") returned 5
	[0133.762] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\UvNgc-5Umg4cH274N.png", pszSpec="*.rar") returned 0
	[0133.762] lstrlenA (lpString="*.rar") returned 5
	[0133.762] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\UvNgc-5Umg4cH274N.png", pszSpec="*.7z") returned 0
	[0133.762] lstrlenA (lpString="*.7z") returned 4
	[0133.762] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\UvNgc-5Umg4cH274N.png", pszSpec="*.tar") returned 0
	[0133.762] lstrlenA (lpString="*.tar") returned 5
	[0133.762] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\UvNgc-5Umg4cH274N.png", pszSpec="*.gzip") returned 0
	[0133.762] lstrlenA (lpString="*.gzip") returned 6
	[0133.762] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\UvNgc-5Umg4cH274N.png", pszSpec="*.jpg") returned 0
	[0133.762] lstrlenA (lpString="*.jpg") returned 5
	[0133.762] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\UvNgc-5Umg4cH274N.png", pszSpec="*.jpeg") returned 0
	[0133.762] lstrlenA (lpString="*.jpeg") returned 6
	[0133.762] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\UvNgc-5Umg4cH274N.png", pszSpec="*.bmp") returned 0
	[0133.762] lstrlenA (lpString="*.bmp") returned 5
	[0133.762] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\UvNgc-5Umg4cH274N.png", pszSpec="*.gif") returned 0
	[0133.762] lstrlenA (lpString="*.gif") returned 5
	[0133.762] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\UvNgc-5Umg4cH274N.png", pszSpec="*.png") returned 1
	[0133.762] lstrlenA (lpString="*.png") returned 5
	[0133.762] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Desktop\\UvNgc-5Umg4cH274N.png" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\UvNgc-5Umg4cH274N.png") returned="C:\\Users\\FD1HVy\\Desktop\\UvNgc-5Umg4cH274N.png"
	[0133.762] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Desktop\\UvNgc-5Umg4cH274N.png" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\UvNgc-5Umg4cH274N.png") returned="C:\\Users\\FD1HVy\\Desktop\\UvNgc-5Umg4cH274N.png"
	[0133.762] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\UvNgc-5Umg4cH274N.png", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\UvNgc-5Umg4cH274N.png.") returned="C:\\Users\\FD1HVy\\Desktop\\UvNgc-5Umg4cH274N.png."
	[0133.762] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\UvNgc-5Umg4cH274N.png.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\UvNgc-5Umg4cH274N.png.exe") returned="C:\\Users\\FD1HVy\\Desktop\\UvNgc-5Umg4cH274N.png.exe"
	[0133.762] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\UvNgc-5Umg4cH274N.png" (normalized: "c:\\users\\fd1hvy\\desktop\\uvngc-5umg4ch274n.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0133.763] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2e0f
	[0133.763] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1d959430, dwHighDateTime=0x1d4cffb), lpLastAccessTime=0x407536*(dwLowDateTime=0x1c83dfb0, dwHighDateTime=0x1d4c7f0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1c83dfb0, dwHighDateTime=0x1d4c7f0)) returned 1
	[0133.763] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.763] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x2dcd, lpOverlapped=0x0) returned 1
	[0133.763] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\UvNgc-5Umg4cH274N.png") returned="UvNgc-5Umg4cH274N.png"
	[0133.763] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0133.763] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x2dcd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x2dcd, lpOverlapped=0x0) returned 1
	[0133.764] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0133.764] CloseHandle (hObject=0x20c) returned 1
	[0133.764] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\UvNgc-5Umg4cH274N.png" (normalized: "c:\\users\\fd1hvy\\desktop\\uvngc-5umg4ch274n.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\UvNgc-5Umg4cH274N.png.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\uvngc-5umg4ch274n.png.exe")) returned 1
	[0133.764] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd62360, ftCreationTime.dwHighDateTime=0x1d4d4d6, ftLastAccessTime.dwLowDateTime=0x120913f0, ftLastAccessTime.dwHighDateTime=0x1d4c8ce, ftLastWriteTime.dwLowDateTime=0x120913f0, ftLastWriteTime.dwHighDateTime=0x1d4c8ce, nFileSizeHigh=0x0, nFileSizeLow=0x3c7e, dwReserved0=0x0, dwReserved1=0x1, cFileName="weKUNYY_.ots", cAlternateFileName="")) returned 1
	[0133.764] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0133.764] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="weKUNYY_.ots") returned -1
	[0133.764] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="weKUNYY_.ots") returned -1
	[0133.764] lstrcmpiA (lpString1="", lpString2="weKUNYY_.ots") returned -1
	[0133.764] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\UvNgc-5Umg4cH274N.png") returned="UvNgc-5Umg4cH274N.png"
	[0133.764] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0133.765] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0133.765] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.765] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0133.765] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="weKUNYY_.ots" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots") returned="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots"
	[0133.765] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.zip") returned 0
	[0133.765] lstrlenA (lpString="*.zip") returned 5
	[0133.765] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.rar") returned 0
	[0133.765] lstrlenA (lpString="*.rar") returned 5
	[0133.765] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.7z") returned 0
	[0133.765] lstrlenA (lpString="*.7z") returned 4
	[0133.765] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.tar") returned 0
	[0133.765] lstrlenA (lpString="*.tar") returned 5
	[0133.765] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.gzip") returned 0
	[0133.765] lstrlenA (lpString="*.gzip") returned 6
	[0133.765] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.jpg") returned 0
	[0133.765] lstrlenA (lpString="*.jpg") returned 5
	[0133.765] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.jpeg") returned 0
	[0133.765] lstrlenA (lpString="*.jpeg") returned 6
	[0133.765] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.bmp") returned 0
	[0133.765] lstrlenA (lpString="*.bmp") returned 5
	[0133.765] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.gif") returned 0
	[0133.765] lstrlenA (lpString="*.gif") returned 5
	[0133.765] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.png") returned 0
	[0133.765] lstrlenA (lpString="*.png") returned 5
	[0133.765] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.doc") returned 0
	[0133.765] lstrlenA (lpString="*.doc") returned 5
	[0133.765] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.docx") returned 0
	[0133.765] lstrlenA (lpString="*.docx") returned 6
	[0133.765] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.xls") returned 0
	[0133.765] lstrlenA (lpString="*.xls") returned 5
	[0133.765] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.xlsx") returned 0
	[0133.765] lstrlenA (lpString="*.xlsx") returned 6
	[0133.765] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.ppt") returned 0
	[0133.765] lstrlenA (lpString="*.ppt") returned 5
	[0133.766] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.pptx") returned 0
	[0133.766] lstrlenA (lpString="*.pptx") returned 6
	[0133.766] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.txt") returned 0
	[0133.766] lstrlenA (lpString="*.txt") returned 5
	[0133.766] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.pdf") returned 0
	[0133.766] lstrlenA (lpString="*.pdf") returned 5
	[0133.766] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.htm") returned 0
	[0133.766] lstrlenA (lpString="*.htm") returned 5
	[0133.766] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.html") returned 0
	[0133.766] lstrlenA (lpString="*.html") returned 6
	[0133.766] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.mdb") returned 0
	[0133.766] lstrlenA (lpString="*.mdb") returned 5
	[0133.766] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.pfx") returned 0
	[0133.766] lstrlenA (lpString="*.pfx") returned 5
	[0133.766] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.md") returned 0
	[0133.766] lstrlenA (lpString="*.md") returned 4
	[0133.766] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.lnk") returned 0
	[0133.766] lstrlenA (lpString="*.lnk") returned 5
	[0133.766] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.torrent") returned 0
	[0133.766] lstrlenA (lpString="*.torrent") returned 9
	[0133.766] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.mov") returned 0
	[0133.766] lstrlenA (lpString="*.mov") returned 5
	[0133.766] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.3gp") returned 0
	[0133.766] lstrlenA (lpString="*.3gp") returned 5
	[0133.766] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.mpeg") returned 0
	[0133.766] lstrlenA (lpString="*.mpeg") returned 6
	[0133.766] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.mpg") returned 0
	[0133.766] lstrlenA (lpString="*.mpg") returned 5
	[0133.766] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.flv") returned 0
	[0133.766] lstrlenA (lpString="*.flv") returned 5
	[0133.766] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.avi") returned 0
	[0133.766] lstrlenA (lpString="*.avi") returned 5
	[0133.766] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.mp4") returned 0
	[0133.766] lstrlenA (lpString="*.mp4") returned 5
	[0133.766] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.wmv") returned 0
	[0133.766] lstrlenA (lpString="*.wmv") returned 5
	[0133.767] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.mkv") returned 0
	[0133.767] lstrlenA (lpString="*.mkv") returned 5
	[0133.767] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.mp3") returned 0
	[0133.767] lstrlenA (lpString="*.mp3") returned 5
	[0133.767] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.wav") returned 0
	[0133.767] lstrlenA (lpString="*.wav") returned 5
	[0133.767] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.flac") returned 0
	[0133.767] lstrlenA (lpString="*.flac") returned 6
	[0133.767] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.wma") returned 0
	[0133.767] lstrlenA (lpString="*.wma") returned 5
	[0133.767] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.au3") returned 0
	[0133.767] lstrlenA (lpString="*.au3") returned 5
	[0133.767] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.ahk") returned 0
	[0133.767] lstrlenA (lpString="*.ahk") returned 5
	[0133.767] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.c") returned 0
	[0133.767] lstrlenA (lpString="*.c") returned 3
	[0133.767] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.cc") returned 0
	[0133.767] lstrlenA (lpString="*.cc") returned 4
	[0133.767] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.cpp") returned 0
	[0133.767] lstrlenA (lpString="*.cpp") returned 5
	[0133.767] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.cxx") returned 0
	[0133.767] lstrlenA (lpString="*.cxx") returned 5
	[0133.767] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.c++") returned 0
	[0133.767] lstrlenA (lpString="*.c++") returned 5
	[0133.767] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.cs") returned 0
	[0133.767] lstrlenA (lpString="*.cs") returned 4
	[0133.767] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.vb") returned 0
	[0133.767] lstrlenA (lpString="*.vb") returned 4
	[0133.767] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.bas") returned 0
	[0133.767] lstrlenA (lpString="*.bas") returned 5
	[0133.767] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.csproj") returned 0
	[0133.767] lstrlenA (lpString="*.csproj") returned 8
	[0133.767] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.vbproj") returned 0
	[0133.767] lstrlenA (lpString="*.vbproj") returned 8
	[0133.767] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.vcxproj") returned 0
	[0133.767] lstrlenA (lpString="*.vcxproj") returned 9
	[0133.768] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.manifest") returned 0
	[0133.768] lstrlenA (lpString="*.manifest") returned 10
	[0133.768] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.php") returned 0
	[0133.768] lstrlenA (lpString="*.php") returned 5
	[0133.768] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.vbe") returned 0
	[0133.768] lstrlenA (lpString="*.vbe") returned 5
	[0133.768] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.vba") returned 0
	[0133.768] lstrlenA (lpString="*.vba") returned 5
	[0133.768] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.vbs") returned 0
	[0133.768] lstrlenA (lpString="*.vbs") returned 5
	[0133.768] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.bat") returned 0
	[0133.768] lstrlenA (lpString="*.bat") returned 5
	[0133.768] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.cmd") returned 0
	[0133.768] lstrlenA (lpString="*.cmd") returned 5
	[0133.768] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.js") returned 0
	[0133.768] lstrlenA (lpString="*.js") returned 4
	[0133.768] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.jscript") returned 0
	[0133.768] lstrlenA (lpString="*.jscript") returned 9
	[0133.768] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.hta") returned 0
	[0133.768] lstrlenA (lpString="*.hta") returned 5
	[0133.768] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.php7") returned 0
	[0133.768] lstrlenA (lpString="*.php7") returned 6
	[0133.768] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.db") returned 0
	[0133.768] lstrlenA (lpString="*.db") returned 4
	[0133.768] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.swf") returned 0
	[0133.768] lstrlenA (lpString="*.swf") returned 5
	[0133.768] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.eml") returned 0
	[0133.768] lstrlenA (lpString="*.eml") returned 5
	[0133.768] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.part") returned 0
	[0133.768] lstrlenA (lpString="*.part") returned 6
	[0133.768] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.nfo") returned 0
	[0133.768] lstrlenA (lpString="*.nfo") returned 5
	[0133.768] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.rsa") returned 0
	[0133.768] lstrlenA (lpString="*.rsa") returned 5
	[0133.768] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.key") returned 0
	[0133.768] lstrlenA (lpString="*.key") returned 5
	[0133.769] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.aes") returned 0
	[0133.769] lstrlenA (lpString="*.aes") returned 5
	[0133.769] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.blob") returned 0
	[0133.769] lstrlenA (lpString="*.blob") returned 6
	[0133.769] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.btc") returned 0
	[0133.769] lstrlenA (lpString="*.btc") returned 5
	[0133.769] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots", pszSpec="*.wallet") returned 0
	[0133.769] lstrlenA (lpString="*.wallet") returned 8
	[0133.769] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cc66a30, ftCreationTime.dwHighDateTime=0x1d4d0f4, ftLastAccessTime.dwLowDateTime=0x5c174680, ftLastAccessTime.dwHighDateTime=0x1d4d2e5, ftLastWriteTime.dwLowDateTime=0x5c174680, ftLastWriteTime.dwHighDateTime=0x1d4d2e5, nFileSizeHigh=0x0, nFileSizeLow=0x994, dwReserved0=0x0, dwReserved1=0x0, cFileName="WTb_gtMorp6JLi.mp3", cAlternateFileName="WTB_GT~1.MP3")) returned 1
	[0133.769] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0133.769] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WTb_gtMorp6JLi.mp3") returned -1
	[0133.769] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WTb_gtMorp6JLi.mp3") returned -1
	[0133.769] lstrcmpiA (lpString1="", lpString2="WTb_gtMorp6JLi.mp3") returned -1
	[0133.769] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\weKUNYY_.ots") returned="weKUNYY_.ots"
	[0133.769] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0133.769] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0133.769] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0133.769] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0133.769] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="WTb_gtMorp6JLi.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3") returned="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3"
	[0133.769] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3", pszSpec="*.zip") returned 0
	[0133.769] lstrlenA (lpString="*.zip") returned 5
	[0133.769] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3", pszSpec="*.rar") returned 0
	[0133.769] lstrlenA (lpString="*.rar") returned 5
	[0133.769] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3", pszSpec="*.7z") returned 0
	[0133.769] lstrlenA (lpString="*.7z") returned 4
	[0133.769] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3", pszSpec="*.tar") returned 0
	[0133.769] lstrlenA (lpString="*.tar") returned 5
	[0133.769] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3", pszSpec="*.gzip") returned 0
	[0133.769] lstrlenA (lpString="*.gzip") returned 6
	[0133.769] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3", pszSpec="*.jpg") returned 0
	[0133.769] lstrlenA (lpString="*.jpg") returned 5
	[0133.769] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3", pszSpec="*.jpeg") returned 0
	[0133.769] lstrlenA (lpString="*.jpeg") returned 6
	[0133.769] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3", pszSpec="*.bmp") returned 0
	[0133.770] lstrlenA (lpString="*.bmp") returned 5
	[0133.770] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3", pszSpec="*.gif") returned 0
	[0133.770] lstrlenA (lpString="*.gif") returned 5
	[0133.770] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3", pszSpec="*.png") returned 0
	[0133.770] lstrlenA (lpString="*.png") returned 5
	[0133.770] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3", pszSpec="*.doc") returned 0
	[0133.770] lstrlenA (lpString="*.doc") returned 5
	[0133.770] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3", pszSpec="*.docx") returned 0
	[0133.770] lstrlenA (lpString="*.docx") returned 6
	[0133.770] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3", pszSpec="*.xls") returned 0
	[0133.770] lstrlenA (lpString="*.xls") returned 5
	[0133.770] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3", pszSpec="*.xlsx") returned 0
	[0133.770] lstrlenA (lpString="*.xlsx") returned 6
	[0133.770] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3", pszSpec="*.ppt") returned 0
	[0133.770] lstrlenA (lpString="*.ppt") returned 5
	[0133.770] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3", pszSpec="*.pptx") returned 0
	[0133.770] lstrlenA (lpString="*.pptx") returned 6
	[0133.770] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3", pszSpec="*.txt") returned 0
	[0133.770] lstrlenA (lpString="*.txt") returned 5
	[0133.770] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3", pszSpec="*.pdf") returned 0
	[0133.770] lstrlenA (lpString="*.pdf") returned 5
	[0133.770] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3", pszSpec="*.htm") returned 0
	[0133.770] lstrlenA (lpString="*.htm") returned 5
	[0133.770] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3", pszSpec="*.html") returned 0
	[0133.770] lstrlenA (lpString="*.html") returned 6
	[0133.770] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3", pszSpec="*.mdb") returned 0
	[0133.770] lstrlenA (lpString="*.mdb") returned 5
	[0133.770] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3", pszSpec="*.pfx") returned 0
	[0133.770] lstrlenA (lpString="*.pfx") returned 5
	[0133.770] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3", pszSpec="*.md") returned 0
	[0133.770] lstrlenA (lpString="*.md") returned 4
	[0133.770] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3", pszSpec="*.lnk") returned 0
	[0133.770] lstrlenA (lpString="*.lnk") returned 5
	[0133.770] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3", pszSpec="*.torrent") returned 0
	[0133.770] lstrlenA (lpString="*.torrent") returned 9
	[0133.770] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3", pszSpec="*.mov") returned 0
	[0133.771] lstrlenA (lpString="*.mov") returned 5
	[0133.771] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3", pszSpec="*.3gp") returned 0
	[0133.771] lstrlenA (lpString="*.3gp") returned 5
	[0133.771] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3", pszSpec="*.mpeg") returned 0
	[0133.771] lstrlenA (lpString="*.mpeg") returned 6
	[0133.771] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3", pszSpec="*.mpg") returned 0
	[0133.771] lstrlenA (lpString="*.mpg") returned 5
	[0133.771] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3", pszSpec="*.flv") returned 0
	[0133.771] lstrlenA (lpString="*.flv") returned 5
	[0133.771] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3", pszSpec="*.avi") returned 0
	[0133.771] lstrlenA (lpString="*.avi") returned 5
	[0133.771] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3", pszSpec="*.mp4") returned 0
	[0133.771] lstrlenA (lpString="*.mp4") returned 5
	[0133.771] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3", pszSpec="*.wmv") returned 0
	[0133.771] lstrlenA (lpString="*.wmv") returned 5
	[0133.771] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3", pszSpec="*.mkv") returned 0
	[0133.771] lstrlenA (lpString="*.mkv") returned 5
	[0133.771] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3", pszSpec="*.mp3") returned 1
	[0133.771] lstrlenA (lpString="*.mp3") returned 5
	[0133.771] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3") returned="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3"
	[0133.771] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3") returned="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3"
	[0133.771] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3.") returned="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3."
	[0133.771] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3.exe") returned="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3.exe"
	[0133.771] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\wtb_gtmorp6jli.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0134.416] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x994
	[0134.416] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1cc66a30, dwHighDateTime=0x1d4d0f4), lpLastAccessTime=0x407536*(dwLowDateTime=0x5c174680, dwHighDateTime=0x1d4d2e5), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5c174680, dwHighDateTime=0x1d4d2e5)) returned 1
	[0134.416] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.416] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x952, lpOverlapped=0x0) returned 1
	[0134.417] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3") returned="WTb_gtMorp6JLi.mp3"
	[0134.417] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.417] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x952, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x952, lpOverlapped=0x0) returned 1
	[0134.417] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.417] CloseHandle (hObject=0x20c) returned 1
	[0134.417] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\wtb_gtmorp6jli.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\wtb_gtmorp6jli.mp3.exe")) returned 1
	[0134.418] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff192c0, ftCreationTime.dwHighDateTime=0x1d4d1db, ftLastAccessTime.dwLowDateTime=0x61eb5120, ftLastAccessTime.dwHighDateTime=0x1d4d144, ftLastWriteTime.dwLowDateTime=0x61eb5120, ftLastWriteTime.dwHighDateTime=0x1d4d144, nFileSizeHigh=0x0, nFileSizeLow=0x115b1, dwReserved0=0x15, dwReserved1=0x1, cFileName="xuwVMALaiz6G.wav", cAlternateFileName="XUWVMA~1.WAV")) returned 1
	[0134.418] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0134.418] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="xuwVMALaiz6G.wav") returned -1
	[0134.418] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="xuwVMALaiz6G.wav") returned -1
	[0134.418] lstrcmpiA (lpString1="", lpString2="xuwVMALaiz6G.wav") returned -1
	[0134.418] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\WTb_gtMorp6JLi.mp3") returned="WTb_gtMorp6JLi.mp3"
	[0134.418] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0134.418] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0134.418] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.418] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0134.418] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="xuwVMALaiz6G.wav" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav") returned="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav"
	[0134.419] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav", pszSpec="*.zip") returned 0
	[0134.419] lstrlenA (lpString="*.zip") returned 5
	[0134.419] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav", pszSpec="*.rar") returned 0
	[0134.419] lstrlenA (lpString="*.rar") returned 5
	[0134.419] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav", pszSpec="*.7z") returned 0
	[0134.419] lstrlenA (lpString="*.7z") returned 4
	[0134.419] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav", pszSpec="*.tar") returned 0
	[0134.419] lstrlenA (lpString="*.tar") returned 5
	[0134.419] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav", pszSpec="*.gzip") returned 0
	[0134.419] lstrlenA (lpString="*.gzip") returned 6
	[0134.419] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav", pszSpec="*.jpg") returned 0
	[0134.419] lstrlenA (lpString="*.jpg") returned 5
	[0134.419] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav", pszSpec="*.jpeg") returned 0
	[0134.419] lstrlenA (lpString="*.jpeg") returned 6
	[0134.419] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav", pszSpec="*.bmp") returned 0
	[0134.419] lstrlenA (lpString="*.bmp") returned 5
	[0134.419] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav", pszSpec="*.gif") returned 0
	[0134.419] lstrlenA (lpString="*.gif") returned 5
	[0134.419] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav", pszSpec="*.png") returned 0
	[0134.419] lstrlenA (lpString="*.png") returned 5
	[0134.419] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav", pszSpec="*.doc") returned 0
	[0134.419] lstrlenA (lpString="*.doc") returned 5
	[0134.419] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav", pszSpec="*.docx") returned 0
	[0134.419] lstrlenA (lpString="*.docx") returned 6
	[0134.419] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav", pszSpec="*.xls") returned 0
	[0134.419] lstrlenA (lpString="*.xls") returned 5
	[0134.419] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav", pszSpec="*.xlsx") returned 0
	[0134.419] lstrlenA (lpString="*.xlsx") returned 6
	[0134.419] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav", pszSpec="*.ppt") returned 0
	[0134.419] lstrlenA (lpString="*.ppt") returned 5
	[0134.419] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav", pszSpec="*.pptx") returned 0
	[0134.419] lstrlenA (lpString="*.pptx") returned 6
	[0134.419] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav", pszSpec="*.txt") returned 0
	[0134.420] lstrlenA (lpString="*.txt") returned 5
	[0134.420] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav", pszSpec="*.pdf") returned 0
	[0134.420] lstrlenA (lpString="*.pdf") returned 5
	[0134.420] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav", pszSpec="*.htm") returned 0
	[0134.420] lstrlenA (lpString="*.htm") returned 5
	[0134.420] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav", pszSpec="*.html") returned 0
	[0134.420] lstrlenA (lpString="*.html") returned 6
	[0134.420] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav", pszSpec="*.mdb") returned 0
	[0134.420] lstrlenA (lpString="*.mdb") returned 5
	[0134.420] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav", pszSpec="*.pfx") returned 0
	[0134.420] lstrlenA (lpString="*.pfx") returned 5
	[0134.420] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav", pszSpec="*.md") returned 0
	[0134.420] lstrlenA (lpString="*.md") returned 4
	[0134.420] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav", pszSpec="*.lnk") returned 0
	[0134.420] lstrlenA (lpString="*.lnk") returned 5
	[0134.420] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav", pszSpec="*.torrent") returned 0
	[0134.420] lstrlenA (lpString="*.torrent") returned 9
	[0134.420] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav", pszSpec="*.mov") returned 0
	[0134.420] lstrlenA (lpString="*.mov") returned 5
	[0134.420] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav", pszSpec="*.3gp") returned 0
	[0134.420] lstrlenA (lpString="*.3gp") returned 5
	[0134.420] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav", pszSpec="*.mpeg") returned 0
	[0134.420] lstrlenA (lpString="*.mpeg") returned 6
	[0134.420] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav", pszSpec="*.mpg") returned 0
	[0134.420] lstrlenA (lpString="*.mpg") returned 5
	[0134.420] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav", pszSpec="*.flv") returned 0
	[0134.420] lstrlenA (lpString="*.flv") returned 5
	[0134.420] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav", pszSpec="*.avi") returned 0
	[0134.420] lstrlenA (lpString="*.avi") returned 5
	[0134.420] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav", pszSpec="*.mp4") returned 0
	[0134.420] lstrlenA (lpString="*.mp4") returned 5
	[0134.420] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav", pszSpec="*.wmv") returned 0
	[0134.420] lstrlenA (lpString="*.wmv") returned 5
	[0134.420] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav", pszSpec="*.mkv") returned 0
	[0134.420] lstrlenA (lpString="*.mkv") returned 5
	[0134.421] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav", pszSpec="*.mp3") returned 0
	[0134.421] lstrlenA (lpString="*.mp3") returned 5
	[0134.421] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav", pszSpec="*.wav") returned 1
	[0134.421] lstrlenA (lpString="*.wav") returned 5
	[0134.421] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav") returned="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav"
	[0134.421] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav") returned="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav"
	[0134.421] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav.") returned="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav."
	[0134.421] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav.exe") returned="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav.exe"
	[0134.421] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\xuwvmalaiz6g.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0134.421] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x115b1
	[0134.421] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xff192c0, dwHighDateTime=0x1d4d1db), lpLastAccessTime=0x407536*(dwLowDateTime=0x61eb5120, dwHighDateTime=0x1d4d144), lpLastWriteTime=0x40753e*(dwLowDateTime=0x61eb5120, dwHighDateTime=0x1d4d144)) returned 1
	[0134.421] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.421] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1156f, lpOverlapped=0x0) returned 1
	[0134.422] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav") returned="xuwVMALaiz6G.wav"
	[0134.423] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.423] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1156f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1156f, lpOverlapped=0x0) returned 1
	[0134.423] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.423] CloseHandle (hObject=0x20c) returned 1
	[0134.423] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\xuwvmalaiz6g.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\xuwvmalaiz6g.wav.exe")) returned 1
	[0134.424] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c329850, ftCreationTime.dwHighDateTime=0x1d4d544, ftLastAccessTime.dwLowDateTime=0x18532970, ftLastAccessTime.dwHighDateTime=0x1d4c910, ftLastWriteTime.dwLowDateTime=0x18532970, ftLastWriteTime.dwHighDateTime=0x1d4c910, nFileSizeHigh=0x0, nFileSizeLow=0x18839, dwReserved0=0x15, dwReserved1=0x1, cFileName="yRCKRx.rtf", cAlternateFileName="")) returned 1
	[0134.424] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0134.424] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="yRCKRx.rtf") returned -1
	[0134.424] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="yRCKRx.rtf") returned -1
	[0134.424] lstrcmpiA (lpString1="", lpString2="yRCKRx.rtf") returned -1
	[0134.424] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\xuwVMALaiz6G.wav") returned="xuwVMALaiz6G.wav"
	[0134.424] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0134.424] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0134.424] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.424] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0134.424] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="yRCKRx.rtf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf") returned="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf"
	[0134.424] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.zip") returned 0
	[0134.424] lstrlenA (lpString="*.zip") returned 5
	[0134.424] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.rar") returned 0
	[0134.424] lstrlenA (lpString="*.rar") returned 5
	[0134.424] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.7z") returned 0
	[0134.424] lstrlenA (lpString="*.7z") returned 4
	[0134.424] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.tar") returned 0
	[0134.424] lstrlenA (lpString="*.tar") returned 5
	[0134.424] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.gzip") returned 0
	[0134.424] lstrlenA (lpString="*.gzip") returned 6
	[0134.424] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.jpg") returned 0
	[0134.424] lstrlenA (lpString="*.jpg") returned 5
	[0134.424] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.jpeg") returned 0
	[0134.424] lstrlenA (lpString="*.jpeg") returned 6
	[0134.424] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.bmp") returned 0
	[0134.424] lstrlenA (lpString="*.bmp") returned 5
	[0134.424] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.gif") returned 0
	[0134.424] lstrlenA (lpString="*.gif") returned 5
	[0134.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.png") returned 0
	[0134.425] lstrlenA (lpString="*.png") returned 5
	[0134.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.doc") returned 0
	[0134.425] lstrlenA (lpString="*.doc") returned 5
	[0134.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.docx") returned 0
	[0134.425] lstrlenA (lpString="*.docx") returned 6
	[0134.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.xls") returned 0
	[0134.425] lstrlenA (lpString="*.xls") returned 5
	[0134.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.xlsx") returned 0
	[0134.425] lstrlenA (lpString="*.xlsx") returned 6
	[0134.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.ppt") returned 0
	[0134.425] lstrlenA (lpString="*.ppt") returned 5
	[0134.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.pptx") returned 0
	[0134.425] lstrlenA (lpString="*.pptx") returned 6
	[0134.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.txt") returned 0
	[0134.425] lstrlenA (lpString="*.txt") returned 5
	[0134.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.pdf") returned 0
	[0134.425] lstrlenA (lpString="*.pdf") returned 5
	[0134.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.htm") returned 0
	[0134.425] lstrlenA (lpString="*.htm") returned 5
	[0134.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.html") returned 0
	[0134.425] lstrlenA (lpString="*.html") returned 6
	[0134.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.mdb") returned 0
	[0134.425] lstrlenA (lpString="*.mdb") returned 5
	[0134.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.pfx") returned 0
	[0134.425] lstrlenA (lpString="*.pfx") returned 5
	[0134.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.md") returned 0
	[0134.425] lstrlenA (lpString="*.md") returned 4
	[0134.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.lnk") returned 0
	[0134.425] lstrlenA (lpString="*.lnk") returned 5
	[0134.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.torrent") returned 0
	[0134.425] lstrlenA (lpString="*.torrent") returned 9
	[0134.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.mov") returned 0
	[0134.425] lstrlenA (lpString="*.mov") returned 5
	[0134.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.3gp") returned 0
	[0134.425] lstrlenA (lpString="*.3gp") returned 5
	[0134.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.mpeg") returned 0
	[0134.426] lstrlenA (lpString="*.mpeg") returned 6
	[0134.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.mpg") returned 0
	[0134.426] lstrlenA (lpString="*.mpg") returned 5
	[0134.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.flv") returned 0
	[0134.426] lstrlenA (lpString="*.flv") returned 5
	[0134.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.avi") returned 0
	[0134.426] lstrlenA (lpString="*.avi") returned 5
	[0134.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.mp4") returned 0
	[0134.426] lstrlenA (lpString="*.mp4") returned 5
	[0134.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.wmv") returned 0
	[0134.426] lstrlenA (lpString="*.wmv") returned 5
	[0134.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.mkv") returned 0
	[0134.426] lstrlenA (lpString="*.mkv") returned 5
	[0134.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.mp3") returned 0
	[0134.426] lstrlenA (lpString="*.mp3") returned 5
	[0134.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.wav") returned 0
	[0134.426] lstrlenA (lpString="*.wav") returned 5
	[0134.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.flac") returned 0
	[0134.426] lstrlenA (lpString="*.flac") returned 6
	[0134.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.wma") returned 0
	[0134.426] lstrlenA (lpString="*.wma") returned 5
	[0134.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.au3") returned 0
	[0134.426] lstrlenA (lpString="*.au3") returned 5
	[0134.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.ahk") returned 0
	[0134.426] lstrlenA (lpString="*.ahk") returned 5
	[0134.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.c") returned 0
	[0134.426] lstrlenA (lpString="*.c") returned 3
	[0134.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.cc") returned 0
	[0134.426] lstrlenA (lpString="*.cc") returned 4
	[0134.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.cpp") returned 0
	[0134.426] lstrlenA (lpString="*.cpp") returned 5
	[0134.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.cxx") returned 0
	[0134.426] lstrlenA (lpString="*.cxx") returned 5
	[0134.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.c++") returned 0
	[0134.427] lstrlenA (lpString="*.c++") returned 5
	[0134.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.cs") returned 0
	[0134.427] lstrlenA (lpString="*.cs") returned 4
	[0134.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.vb") returned 0
	[0134.427] lstrlenA (lpString="*.vb") returned 4
	[0134.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.bas") returned 0
	[0134.427] lstrlenA (lpString="*.bas") returned 5
	[0134.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.csproj") returned 0
	[0134.427] lstrlenA (lpString="*.csproj") returned 8
	[0134.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.vbproj") returned 0
	[0134.427] lstrlenA (lpString="*.vbproj") returned 8
	[0134.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.vcxproj") returned 0
	[0134.427] lstrlenA (lpString="*.vcxproj") returned 9
	[0134.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.manifest") returned 0
	[0134.427] lstrlenA (lpString="*.manifest") returned 10
	[0134.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.php") returned 0
	[0134.427] lstrlenA (lpString="*.php") returned 5
	[0134.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.vbe") returned 0
	[0134.427] lstrlenA (lpString="*.vbe") returned 5
	[0134.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.vba") returned 0
	[0134.427] lstrlenA (lpString="*.vba") returned 5
	[0134.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.vbs") returned 0
	[0134.427] lstrlenA (lpString="*.vbs") returned 5
	[0134.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.bat") returned 0
	[0134.427] lstrlenA (lpString="*.bat") returned 5
	[0134.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.cmd") returned 0
	[0134.427] lstrlenA (lpString="*.cmd") returned 5
	[0134.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.js") returned 0
	[0134.427] lstrlenA (lpString="*.js") returned 4
	[0134.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.jscript") returned 0
	[0134.427] lstrlenA (lpString="*.jscript") returned 9
	[0134.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.hta") returned 0
	[0134.427] lstrlenA (lpString="*.hta") returned 5
	[0134.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.php7") returned 0
	[0134.428] lstrlenA (lpString="*.php7") returned 6
	[0134.428] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.db") returned 0
	[0134.428] lstrlenA (lpString="*.db") returned 4
	[0134.428] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.swf") returned 0
	[0134.428] lstrlenA (lpString="*.swf") returned 5
	[0134.428] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.eml") returned 0
	[0134.428] lstrlenA (lpString="*.eml") returned 5
	[0134.428] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.part") returned 0
	[0134.428] lstrlenA (lpString="*.part") returned 6
	[0134.428] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.nfo") returned 0
	[0134.428] lstrlenA (lpString="*.nfo") returned 5
	[0134.428] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.rsa") returned 0
	[0134.428] lstrlenA (lpString="*.rsa") returned 5
	[0134.428] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.key") returned 0
	[0134.428] lstrlenA (lpString="*.key") returned 5
	[0134.428] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.aes") returned 0
	[0134.428] lstrlenA (lpString="*.aes") returned 5
	[0134.428] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.blob") returned 0
	[0134.428] lstrlenA (lpString="*.blob") returned 6
	[0134.428] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.btc") returned 0
	[0134.428] lstrlenA (lpString="*.btc") returned 5
	[0134.428] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf", pszSpec="*.wallet") returned 0
	[0134.428] lstrlenA (lpString="*.wallet") returned 8
	[0134.428] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0dbce10, ftCreationTime.dwHighDateTime=0x1d4d36e, ftLastAccessTime.dwLowDateTime=0xeaebce30, ftLastAccessTime.dwHighDateTime=0x1d4cc96, ftLastWriteTime.dwLowDateTime=0xeaebce30, ftLastWriteTime.dwHighDateTime=0x1d4cc96, nFileSizeHigh=0x0, nFileSizeLow=0x1704a, dwReserved0=0x0, dwReserved1=0x0, cFileName="YUGJRIP95N2T.flv", cAlternateFileName="YUGJRI~1.FLV")) returned 1
	[0134.428] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0134.428] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="YUGJRIP95N2T.flv") returned -1
	[0134.428] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="YUGJRIP95N2T.flv") returned -1
	[0134.428] lstrcmpiA (lpString1="", lpString2="YUGJRIP95N2T.flv") returned -1
	[0134.428] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\yRCKRx.rtf") returned="yRCKRx.rtf"
	[0134.428] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0134.428] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0134.428] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.428] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0134.429] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="YUGJRIP95N2T.flv" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv") returned="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv"
	[0134.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv", pszSpec="*.zip") returned 0
	[0134.429] lstrlenA (lpString="*.zip") returned 5
	[0134.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv", pszSpec="*.rar") returned 0
	[0134.429] lstrlenA (lpString="*.rar") returned 5
	[0134.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv", pszSpec="*.7z") returned 0
	[0134.429] lstrlenA (lpString="*.7z") returned 4
	[0134.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv", pszSpec="*.tar") returned 0
	[0134.429] lstrlenA (lpString="*.tar") returned 5
	[0134.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv", pszSpec="*.gzip") returned 0
	[0134.429] lstrlenA (lpString="*.gzip") returned 6
	[0134.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv", pszSpec="*.jpg") returned 0
	[0134.429] lstrlenA (lpString="*.jpg") returned 5
	[0134.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv", pszSpec="*.jpeg") returned 0
	[0134.429] lstrlenA (lpString="*.jpeg") returned 6
	[0134.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv", pszSpec="*.bmp") returned 0
	[0134.429] lstrlenA (lpString="*.bmp") returned 5
	[0134.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv", pszSpec="*.gif") returned 0
	[0134.429] lstrlenA (lpString="*.gif") returned 5
	[0134.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv", pszSpec="*.png") returned 0
	[0134.429] lstrlenA (lpString="*.png") returned 5
	[0134.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv", pszSpec="*.doc") returned 0
	[0134.429] lstrlenA (lpString="*.doc") returned 5
	[0134.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv", pszSpec="*.docx") returned 0
	[0134.429] lstrlenA (lpString="*.docx") returned 6
	[0134.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv", pszSpec="*.xls") returned 0
	[0134.429] lstrlenA (lpString="*.xls") returned 5
	[0134.429] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv", pszSpec="*.xlsx") returned 0
	[0134.430] lstrlenA (lpString="*.xlsx") returned 6
	[0134.430] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv", pszSpec="*.ppt") returned 0
	[0134.430] lstrlenA (lpString="*.ppt") returned 5
	[0134.430] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv", pszSpec="*.pptx") returned 0
	[0134.430] lstrlenA (lpString="*.pptx") returned 6
	[0134.430] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv", pszSpec="*.txt") returned 0
	[0134.430] lstrlenA (lpString="*.txt") returned 5
	[0134.430] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv", pszSpec="*.pdf") returned 0
	[0134.430] lstrlenA (lpString="*.pdf") returned 5
	[0134.430] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv", pszSpec="*.htm") returned 0
	[0134.430] lstrlenA (lpString="*.htm") returned 5
	[0134.430] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv", pszSpec="*.html") returned 0
	[0134.430] lstrlenA (lpString="*.html") returned 6
	[0134.430] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv", pszSpec="*.mdb") returned 0
	[0134.430] lstrlenA (lpString="*.mdb") returned 5
	[0134.430] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv", pszSpec="*.pfx") returned 0
	[0134.430] lstrlenA (lpString="*.pfx") returned 5
	[0134.430] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv", pszSpec="*.md") returned 0
	[0134.430] lstrlenA (lpString="*.md") returned 4
	[0134.430] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv", pszSpec="*.lnk") returned 0
	[0134.430] lstrlenA (lpString="*.lnk") returned 5
	[0134.430] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv", pszSpec="*.torrent") returned 0
	[0134.430] lstrlenA (lpString="*.torrent") returned 9
	[0134.430] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv", pszSpec="*.mov") returned 0
	[0134.430] lstrlenA (lpString="*.mov") returned 5
	[0134.430] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv", pszSpec="*.3gp") returned 0
	[0134.430] lstrlenA (lpString="*.3gp") returned 5
	[0134.430] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv", pszSpec="*.mpeg") returned 0
	[0134.430] lstrlenA (lpString="*.mpeg") returned 6
	[0134.430] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv", pszSpec="*.mpg") returned 0
	[0134.430] lstrlenA (lpString="*.mpg") returned 5
	[0134.430] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv", pszSpec="*.flv") returned 1
	[0134.430] lstrlenA (lpString="*.flv") returned 5
	[0134.431] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv") returned="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv"
	[0134.431] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv") returned="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv"
	[0134.431] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv.") returned="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv."
	[0134.431] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv.exe") returned="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv.exe"
	[0134.431] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\yugjrip95n2t.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0134.431] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1704a
	[0134.431] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa0dbce10, dwHighDateTime=0x1d4d36e), lpLastAccessTime=0x407536*(dwLowDateTime=0xeaebce30, dwHighDateTime=0x1d4cc96), lpLastWriteTime=0x40753e*(dwLowDateTime=0xeaebce30, dwHighDateTime=0x1d4cc96)) returned 1
	[0134.431] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.431] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x17008, lpOverlapped=0x0) returned 1
	[0134.432] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv") returned="YUGJRIP95N2T.flv"
	[0134.433] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.433] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x17008, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x17008, lpOverlapped=0x0) returned 1
	[0134.433] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.433] CloseHandle (hObject=0x20c) returned 1
	[0134.433] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\yugjrip95n2t.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\yugjrip95n2t.flv.exe")) returned 1
	[0134.434] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ca263f0, ftCreationTime.dwHighDateTime=0x1d4d2ef, ftLastAccessTime.dwLowDateTime=0x2c4bf3e0, ftLastAccessTime.dwHighDateTime=0x1d4d459, ftLastWriteTime.dwLowDateTime=0x2c4bf3e0, ftLastWriteTime.dwHighDateTime=0x1d4d459, nFileSizeHigh=0x0, nFileSizeLow=0xfb83, dwReserved0=0x15, dwReserved1=0x1, cFileName="zDx2P.odp", cAlternateFileName="")) returned 1
	[0134.434] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0134.434] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="zDx2P.odp") returned -1
	[0134.434] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="zDx2P.odp") returned -1
	[0134.434] lstrcmpiA (lpString1="", lpString2="zDx2P.odp") returned -1
	[0134.434] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\YUGJRIP95N2T.flv") returned="YUGJRIP95N2T.flv"
	[0134.434] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0134.434] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0134.434] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.434] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0134.434] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="zDx2P.odp" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp") returned="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp"
	[0134.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.zip") returned 0
	[0134.434] lstrlenA (lpString="*.zip") returned 5
	[0134.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.rar") returned 0
	[0134.434] lstrlenA (lpString="*.rar") returned 5
	[0134.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.7z") returned 0
	[0134.434] lstrlenA (lpString="*.7z") returned 4
	[0134.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.tar") returned 0
	[0134.434] lstrlenA (lpString="*.tar") returned 5
	[0134.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.gzip") returned 0
	[0134.434] lstrlenA (lpString="*.gzip") returned 6
	[0134.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.jpg") returned 0
	[0134.434] lstrlenA (lpString="*.jpg") returned 5
	[0134.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.jpeg") returned 0
	[0134.435] lstrlenA (lpString="*.jpeg") returned 6
	[0134.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.bmp") returned 0
	[0134.435] lstrlenA (lpString="*.bmp") returned 5
	[0134.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.gif") returned 0
	[0134.435] lstrlenA (lpString="*.gif") returned 5
	[0134.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.png") returned 0
	[0134.435] lstrlenA (lpString="*.png") returned 5
	[0134.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.doc") returned 0
	[0134.435] lstrlenA (lpString="*.doc") returned 5
	[0134.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.docx") returned 0
	[0134.435] lstrlenA (lpString="*.docx") returned 6
	[0134.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.xls") returned 0
	[0134.435] lstrlenA (lpString="*.xls") returned 5
	[0134.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.xlsx") returned 0
	[0134.435] lstrlenA (lpString="*.xlsx") returned 6
	[0134.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.ppt") returned 0
	[0134.435] lstrlenA (lpString="*.ppt") returned 5
	[0134.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.pptx") returned 0
	[0134.435] lstrlenA (lpString="*.pptx") returned 6
	[0134.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.txt") returned 0
	[0134.435] lstrlenA (lpString="*.txt") returned 5
	[0134.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.pdf") returned 0
	[0134.435] lstrlenA (lpString="*.pdf") returned 5
	[0134.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.htm") returned 0
	[0134.435] lstrlenA (lpString="*.htm") returned 5
	[0134.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.html") returned 0
	[0134.435] lstrlenA (lpString="*.html") returned 6
	[0134.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.mdb") returned 0
	[0134.435] lstrlenA (lpString="*.mdb") returned 5
	[0134.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.pfx") returned 0
	[0134.435] lstrlenA (lpString="*.pfx") returned 5
	[0134.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.md") returned 0
	[0134.435] lstrlenA (lpString="*.md") returned 4
	[0134.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.lnk") returned 0
	[0134.435] lstrlenA (lpString="*.lnk") returned 5
	[0134.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.torrent") returned 0
	[0134.436] lstrlenA (lpString="*.torrent") returned 9
	[0134.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.mov") returned 0
	[0134.436] lstrlenA (lpString="*.mov") returned 5
	[0134.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.3gp") returned 0
	[0134.436] lstrlenA (lpString="*.3gp") returned 5
	[0134.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.mpeg") returned 0
	[0134.436] lstrlenA (lpString="*.mpeg") returned 6
	[0134.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.mpg") returned 0
	[0134.436] lstrlenA (lpString="*.mpg") returned 5
	[0134.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.flv") returned 0
	[0134.436] lstrlenA (lpString="*.flv") returned 5
	[0134.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.avi") returned 0
	[0134.436] lstrlenA (lpString="*.avi") returned 5
	[0134.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.mp4") returned 0
	[0134.436] lstrlenA (lpString="*.mp4") returned 5
	[0134.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.wmv") returned 0
	[0134.436] lstrlenA (lpString="*.wmv") returned 5
	[0134.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.mkv") returned 0
	[0134.436] lstrlenA (lpString="*.mkv") returned 5
	[0134.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.mp3") returned 0
	[0134.436] lstrlenA (lpString="*.mp3") returned 5
	[0134.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.wav") returned 0
	[0134.436] lstrlenA (lpString="*.wav") returned 5
	[0134.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.flac") returned 0
	[0134.436] lstrlenA (lpString="*.flac") returned 6
	[0134.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.wma") returned 0
	[0134.436] lstrlenA (lpString="*.wma") returned 5
	[0134.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.au3") returned 0
	[0134.436] lstrlenA (lpString="*.au3") returned 5
	[0134.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.ahk") returned 0
	[0134.436] lstrlenA (lpString="*.ahk") returned 5
	[0134.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.c") returned 0
	[0134.436] lstrlenA (lpString="*.c") returned 3
	[0134.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.cc") returned 0
	[0134.436] lstrlenA (lpString="*.cc") returned 4
	[0134.436] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.cpp") returned 0
	[0134.437] lstrlenA (lpString="*.cpp") returned 5
	[0134.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.cxx") returned 0
	[0134.437] lstrlenA (lpString="*.cxx") returned 5
	[0134.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.c++") returned 0
	[0134.437] lstrlenA (lpString="*.c++") returned 5
	[0134.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.cs") returned 0
	[0134.437] lstrlenA (lpString="*.cs") returned 4
	[0134.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.vb") returned 0
	[0134.437] lstrlenA (lpString="*.vb") returned 4
	[0134.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.bas") returned 0
	[0134.437] lstrlenA (lpString="*.bas") returned 5
	[0134.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.csproj") returned 0
	[0134.437] lstrlenA (lpString="*.csproj") returned 8
	[0134.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.vbproj") returned 0
	[0134.437] lstrlenA (lpString="*.vbproj") returned 8
	[0134.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.vcxproj") returned 0
	[0134.437] lstrlenA (lpString="*.vcxproj") returned 9
	[0134.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.manifest") returned 0
	[0134.437] lstrlenA (lpString="*.manifest") returned 10
	[0134.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.php") returned 0
	[0134.437] lstrlenA (lpString="*.php") returned 5
	[0134.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.vbe") returned 0
	[0134.437] lstrlenA (lpString="*.vbe") returned 5
	[0134.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.vba") returned 0
	[0134.437] lstrlenA (lpString="*.vba") returned 5
	[0134.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.vbs") returned 0
	[0134.437] lstrlenA (lpString="*.vbs") returned 5
	[0134.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.bat") returned 0
	[0134.437] lstrlenA (lpString="*.bat") returned 5
	[0134.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.cmd") returned 0
	[0134.437] lstrlenA (lpString="*.cmd") returned 5
	[0134.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.js") returned 0
	[0134.437] lstrlenA (lpString="*.js") returned 4
	[0134.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.jscript") returned 0
	[0134.437] lstrlenA (lpString="*.jscript") returned 9
	[0134.437] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.hta") returned 0
	[0134.438] lstrlenA (lpString="*.hta") returned 5
	[0134.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.php7") returned 0
	[0134.438] lstrlenA (lpString="*.php7") returned 6
	[0134.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.db") returned 0
	[0134.438] lstrlenA (lpString="*.db") returned 4
	[0134.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.swf") returned 0
	[0134.438] lstrlenA (lpString="*.swf") returned 5
	[0134.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.eml") returned 0
	[0134.438] lstrlenA (lpString="*.eml") returned 5
	[0134.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.part") returned 0
	[0134.438] lstrlenA (lpString="*.part") returned 6
	[0134.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.nfo") returned 0
	[0134.438] lstrlenA (lpString="*.nfo") returned 5
	[0134.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.rsa") returned 0
	[0134.438] lstrlenA (lpString="*.rsa") returned 5
	[0134.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.key") returned 0
	[0134.438] lstrlenA (lpString="*.key") returned 5
	[0134.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.aes") returned 0
	[0134.438] lstrlenA (lpString="*.aes") returned 5
	[0134.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.blob") returned 0
	[0134.438] lstrlenA (lpString="*.blob") returned 6
	[0134.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.btc") returned 0
	[0134.438] lstrlenA (lpString="*.btc") returned 5
	[0134.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp", pszSpec="*.wallet") returned 0
	[0134.438] lstrlenA (lpString="*.wallet") returned 8
	[0134.438] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x888a5780, ftCreationTime.dwHighDateTime=0x1d4c7db, ftLastAccessTime.dwLowDateTime=0xf3be17f0, ftLastAccessTime.dwHighDateTime=0x1d4d4a9, ftLastWriteTime.dwLowDateTime=0xf3be17f0, ftLastWriteTime.dwHighDateTime=0x1d4d4a9, nFileSizeHigh=0x0, nFileSizeLow=0x16aaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="zqEaNlGtx-l-frcZSL0.pdf", cAlternateFileName="ZQEANL~1.PDF")) returned 1
	[0134.438] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0134.438] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="zqEaNlGtx-l-frcZSL0.pdf") returned -1
	[0134.438] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="zqEaNlGtx-l-frcZSL0.pdf") returned -1
	[0134.438] lstrcmpiA (lpString1="", lpString2="zqEaNlGtx-l-frcZSL0.pdf") returned -1
	[0134.438] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\zDx2P.odp") returned="zDx2P.odp"
	[0134.438] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0134.438] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0134.438] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.439] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0134.439] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="zqEaNlGtx-l-frcZSL0.pdf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\zqEaNlGtx-l-frcZSL0.pdf") returned="C:\\Users\\FD1HVy\\Desktop\\zqEaNlGtx-l-frcZSL0.pdf"
	[0134.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zqEaNlGtx-l-frcZSL0.pdf", pszSpec="*.zip") returned 0
	[0134.439] lstrlenA (lpString="*.zip") returned 5
	[0134.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zqEaNlGtx-l-frcZSL0.pdf", pszSpec="*.rar") returned 0
	[0134.439] lstrlenA (lpString="*.rar") returned 5
	[0134.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zqEaNlGtx-l-frcZSL0.pdf", pszSpec="*.7z") returned 0
	[0134.439] lstrlenA (lpString="*.7z") returned 4
	[0134.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zqEaNlGtx-l-frcZSL0.pdf", pszSpec="*.tar") returned 0
	[0134.439] lstrlenA (lpString="*.tar") returned 5
	[0134.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zqEaNlGtx-l-frcZSL0.pdf", pszSpec="*.gzip") returned 0
	[0134.439] lstrlenA (lpString="*.gzip") returned 6
	[0134.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zqEaNlGtx-l-frcZSL0.pdf", pszSpec="*.jpg") returned 0
	[0134.439] lstrlenA (lpString="*.jpg") returned 5
	[0134.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zqEaNlGtx-l-frcZSL0.pdf", pszSpec="*.jpeg") returned 0
	[0134.439] lstrlenA (lpString="*.jpeg") returned 6
	[0134.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zqEaNlGtx-l-frcZSL0.pdf", pszSpec="*.bmp") returned 0
	[0134.439] lstrlenA (lpString="*.bmp") returned 5
	[0134.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zqEaNlGtx-l-frcZSL0.pdf", pszSpec="*.gif") returned 0
	[0134.439] lstrlenA (lpString="*.gif") returned 5
	[0134.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zqEaNlGtx-l-frcZSL0.pdf", pszSpec="*.png") returned 0
	[0134.439] lstrlenA (lpString="*.png") returned 5
	[0134.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zqEaNlGtx-l-frcZSL0.pdf", pszSpec="*.doc") returned 0
	[0134.439] lstrlenA (lpString="*.doc") returned 5
	[0134.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zqEaNlGtx-l-frcZSL0.pdf", pszSpec="*.docx") returned 0
	[0134.439] lstrlenA (lpString="*.docx") returned 6
	[0134.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zqEaNlGtx-l-frcZSL0.pdf", pszSpec="*.xls") returned 0
	[0134.439] lstrlenA (lpString="*.xls") returned 5
	[0134.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zqEaNlGtx-l-frcZSL0.pdf", pszSpec="*.xlsx") returned 0
	[0134.439] lstrlenA (lpString="*.xlsx") returned 6
	[0134.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zqEaNlGtx-l-frcZSL0.pdf", pszSpec="*.ppt") returned 0
	[0134.439] lstrlenA (lpString="*.ppt") returned 5
	[0134.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zqEaNlGtx-l-frcZSL0.pdf", pszSpec="*.pptx") returned 0
	[0134.439] lstrlenA (lpString="*.pptx") returned 6
	[0134.440] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zqEaNlGtx-l-frcZSL0.pdf", pszSpec="*.txt") returned 0
	[0134.440] lstrlenA (lpString="*.txt") returned 5
	[0134.440] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zqEaNlGtx-l-frcZSL0.pdf", pszSpec="*.pdf") returned 1
	[0134.440] lstrlenA (lpString="*.pdf") returned 5
	[0134.440] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Desktop\\zqEaNlGtx-l-frcZSL0.pdf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\zqEaNlGtx-l-frcZSL0.pdf") returned="C:\\Users\\FD1HVy\\Desktop\\zqEaNlGtx-l-frcZSL0.pdf"
	[0134.440] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Desktop\\zqEaNlGtx-l-frcZSL0.pdf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\zqEaNlGtx-l-frcZSL0.pdf") returned="C:\\Users\\FD1HVy\\Desktop\\zqEaNlGtx-l-frcZSL0.pdf"
	[0134.440] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\zqEaNlGtx-l-frcZSL0.pdf", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\zqEaNlGtx-l-frcZSL0.pdf.") returned="C:\\Users\\FD1HVy\\Desktop\\zqEaNlGtx-l-frcZSL0.pdf."
	[0134.440] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\zqEaNlGtx-l-frcZSL0.pdf.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\zqEaNlGtx-l-frcZSL0.pdf.exe") returned="C:\\Users\\FD1HVy\\Desktop\\zqEaNlGtx-l-frcZSL0.pdf.exe"
	[0134.440] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\zqEaNlGtx-l-frcZSL0.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\zqeanlgtx-l-frczsl0.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0134.440] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16aaa
	[0134.440] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x888a5780, dwHighDateTime=0x1d4c7db), lpLastAccessTime=0x407536*(dwLowDateTime=0xf3be17f0, dwHighDateTime=0x1d4d4a9), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf3be17f0, dwHighDateTime=0x1d4d4a9)) returned 1
	[0134.440] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.440] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x16a68, lpOverlapped=0x0) returned 1
	[0134.441] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\zqEaNlGtx-l-frcZSL0.pdf") returned="zqEaNlGtx-l-frcZSL0.pdf"
	[0134.442] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.442] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x16a68, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x16a68, lpOverlapped=0x0) returned 1
	[0134.442] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.442] CloseHandle (hObject=0x20c) returned 1
	[0134.442] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\zqEaNlGtx-l-frcZSL0.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\zqeanlgtx-l-frczsl0.pdf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\zqEaNlGtx-l-frcZSL0.pdf.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\zqeanlgtx-l-frczsl0.pdf.exe")) returned 1
	[0134.443] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0dc5120, ftCreationTime.dwHighDateTime=0x1d4c84e, ftLastAccessTime.dwLowDateTime=0x70bf27b0, ftLastAccessTime.dwHighDateTime=0x1d4d06f, ftLastWriteTime.dwLowDateTime=0x70bf27b0, ftLastWriteTime.dwHighDateTime=0x1d4d06f, nFileSizeHigh=0x0, nFileSizeLow=0x1672d, dwReserved0=0x0, dwReserved1=0x1, cFileName="zz_ENPhE.flv", cAlternateFileName="")) returned 1
	[0134.443] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0134.443] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="zz_ENPhE.flv") returned -1
	[0134.443] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="zz_ENPhE.flv") returned -1
	[0134.443] lstrcmpiA (lpString1="", lpString2="zz_ENPhE.flv") returned -1
	[0134.443] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\zqEaNlGtx-l-frcZSL0.pdf") returned="zqEaNlGtx-l-frcZSL0.pdf"
	[0134.443] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0134.443] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0134.443] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.443] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0134.443] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="zz_ENPhE.flv" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv") returned="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv"
	[0134.443] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv", pszSpec="*.zip") returned 0
	[0134.443] lstrlenA (lpString="*.zip") returned 5
	[0134.443] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv", pszSpec="*.rar") returned 0
	[0134.443] lstrlenA (lpString="*.rar") returned 5
	[0134.443] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv", pszSpec="*.7z") returned 0
	[0134.443] lstrlenA (lpString="*.7z") returned 4
	[0134.443] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv", pszSpec="*.tar") returned 0
	[0134.443] lstrlenA (lpString="*.tar") returned 5
	[0134.443] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv", pszSpec="*.gzip") returned 0
	[0134.443] lstrlenA (lpString="*.gzip") returned 6
	[0134.444] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv", pszSpec="*.jpg") returned 0
	[0134.444] lstrlenA (lpString="*.jpg") returned 5
	[0134.444] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv", pszSpec="*.jpeg") returned 0
	[0134.444] lstrlenA (lpString="*.jpeg") returned 6
	[0134.444] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv", pszSpec="*.bmp") returned 0
	[0134.444] lstrlenA (lpString="*.bmp") returned 5
	[0134.444] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv", pszSpec="*.gif") returned 0
	[0134.444] lstrlenA (lpString="*.gif") returned 5
	[0134.444] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv", pszSpec="*.png") returned 0
	[0134.444] lstrlenA (lpString="*.png") returned 5
	[0134.444] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv", pszSpec="*.doc") returned 0
	[0134.444] lstrlenA (lpString="*.doc") returned 5
	[0134.444] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv", pszSpec="*.docx") returned 0
	[0134.444] lstrlenA (lpString="*.docx") returned 6
	[0134.444] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv", pszSpec="*.xls") returned 0
	[0134.444] lstrlenA (lpString="*.xls") returned 5
	[0134.444] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv", pszSpec="*.xlsx") returned 0
	[0134.444] lstrlenA (lpString="*.xlsx") returned 6
	[0134.444] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv", pszSpec="*.ppt") returned 0
	[0134.444] lstrlenA (lpString="*.ppt") returned 5
	[0134.444] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv", pszSpec="*.pptx") returned 0
	[0134.444] lstrlenA (lpString="*.pptx") returned 6
	[0134.444] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv", pszSpec="*.txt") returned 0
	[0134.444] lstrlenA (lpString="*.txt") returned 5
	[0134.444] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv", pszSpec="*.pdf") returned 0
	[0134.444] lstrlenA (lpString="*.pdf") returned 5
	[0134.444] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv", pszSpec="*.htm") returned 0
	[0134.444] lstrlenA (lpString="*.htm") returned 5
	[0134.444] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv", pszSpec="*.html") returned 0
	[0134.444] lstrlenA (lpString="*.html") returned 6
	[0134.444] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv", pszSpec="*.mdb") returned 0
	[0134.444] lstrlenA (lpString="*.mdb") returned 5
	[0134.444] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv", pszSpec="*.pfx") returned 0
	[0134.444] lstrlenA (lpString="*.pfx") returned 5
	[0134.444] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv", pszSpec="*.md") returned 0
	[0134.444] lstrlenA (lpString="*.md") returned 4
	[0134.444] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv", pszSpec="*.lnk") returned 0
	[0134.445] lstrlenA (lpString="*.lnk") returned 5
	[0134.445] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv", pszSpec="*.torrent") returned 0
	[0134.445] lstrlenA (lpString="*.torrent") returned 9
	[0134.445] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv", pszSpec="*.mov") returned 0
	[0134.445] lstrlenA (lpString="*.mov") returned 5
	[0134.445] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv", pszSpec="*.3gp") returned 0
	[0134.445] lstrlenA (lpString="*.3gp") returned 5
	[0134.445] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv", pszSpec="*.mpeg") returned 0
	[0134.445] lstrlenA (lpString="*.mpeg") returned 6
	[0134.445] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv", pszSpec="*.mpg") returned 0
	[0134.445] lstrlenA (lpString="*.mpg") returned 5
	[0134.445] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv", pszSpec="*.flv") returned 1
	[0134.445] lstrlenA (lpString="*.flv") returned 5
	[0134.445] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv") returned="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv"
	[0134.445] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv") returned="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv"
	[0134.445] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv.") returned="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv."
	[0134.445] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv.exe") returned="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv.exe"
	[0134.445] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\zz_enphe.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0134.445] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1672d
	[0134.446] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb0dc5120, dwHighDateTime=0x1d4c84e), lpLastAccessTime=0x407536*(dwLowDateTime=0x70bf27b0, dwHighDateTime=0x1d4d06f), lpLastWriteTime=0x40753e*(dwLowDateTime=0x70bf27b0, dwHighDateTime=0x1d4d06f)) returned 1
	[0134.446] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.446] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x166eb, lpOverlapped=0x0) returned 1
	[0134.447] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv") returned="zz_ENPhE.flv"
	[0134.447] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.447] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x166eb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x166eb, lpOverlapped=0x0) returned 1
	[0134.448] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.448] CloseHandle (hObject=0x20c) returned 1
	[0134.448] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\zz_enphe.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\zz_enphe.flv.exe")) returned 1
	[0134.448] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38909450, ftCreationTime.dwHighDateTime=0x1d4c921, ftLastAccessTime.dwLowDateTime=0xd5d89ae0, ftLastAccessTime.dwHighDateTime=0x1d4c5b2, ftLastWriteTime.dwLowDateTime=0xd5d89ae0, ftLastWriteTime.dwHighDateTime=0x1d4c5b2, nFileSizeHigh=0x0, nFileSizeLow=0x358c, dwReserved0=0x12, dwReserved1=0x1, cFileName="_ccVRvpY_v.rtf", cAlternateFileName="_CCVRV~1.RTF")) returned 1
	[0134.448] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0134.448] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="_ccVRvpY_v.rtf") returned 1
	[0134.448] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="_ccVRvpY_v.rtf") returned 1
	[0134.448] lstrcmpiA (lpString1="", lpString2="_ccVRvpY_v.rtf") returned -1
	[0134.448] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Desktop\\zz_ENPhE.flv") returned="zz_ENPhE.flv"
	[0134.448] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\"
	[0134.448] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned=""
	[0134.448] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.449] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0134.449] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="_ccVRvpY_v.rtf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf") returned="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf"
	[0134.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.zip") returned 0
	[0134.449] lstrlenA (lpString="*.zip") returned 5
	[0134.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.rar") returned 0
	[0134.449] lstrlenA (lpString="*.rar") returned 5
	[0134.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.7z") returned 0
	[0134.449] lstrlenA (lpString="*.7z") returned 4
	[0134.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.tar") returned 0
	[0134.449] lstrlenA (lpString="*.tar") returned 5
	[0134.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.gzip") returned 0
	[0134.449] lstrlenA (lpString="*.gzip") returned 6
	[0134.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.jpg") returned 0
	[0134.449] lstrlenA (lpString="*.jpg") returned 5
	[0134.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.jpeg") returned 0
	[0134.449] lstrlenA (lpString="*.jpeg") returned 6
	[0134.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.bmp") returned 0
	[0134.449] lstrlenA (lpString="*.bmp") returned 5
	[0134.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.gif") returned 0
	[0134.449] lstrlenA (lpString="*.gif") returned 5
	[0134.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.png") returned 0
	[0134.449] lstrlenA (lpString="*.png") returned 5
	[0134.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.doc") returned 0
	[0134.449] lstrlenA (lpString="*.doc") returned 5
	[0134.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.docx") returned 0
	[0134.449] lstrlenA (lpString="*.docx") returned 6
	[0134.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.xls") returned 0
	[0134.449] lstrlenA (lpString="*.xls") returned 5
	[0134.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.xlsx") returned 0
	[0134.449] lstrlenA (lpString="*.xlsx") returned 6
	[0134.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.ppt") returned 0
	[0134.449] lstrlenA (lpString="*.ppt") returned 5
	[0134.449] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.pptx") returned 0
	[0134.449] lstrlenA (lpString="*.pptx") returned 6
	[0134.450] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.txt") returned 0
	[0134.450] lstrlenA (lpString="*.txt") returned 5
	[0134.450] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.pdf") returned 0
	[0134.450] lstrlenA (lpString="*.pdf") returned 5
	[0134.450] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.htm") returned 0
	[0134.450] lstrlenA (lpString="*.htm") returned 5
	[0134.450] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.html") returned 0
	[0134.450] lstrlenA (lpString="*.html") returned 6
	[0134.450] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.mdb") returned 0
	[0134.450] lstrlenA (lpString="*.mdb") returned 5
	[0134.450] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.pfx") returned 0
	[0134.450] lstrlenA (lpString="*.pfx") returned 5
	[0134.450] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.md") returned 0
	[0134.450] lstrlenA (lpString="*.md") returned 4
	[0134.450] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.lnk") returned 0
	[0134.450] lstrlenA (lpString="*.lnk") returned 5
	[0134.450] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.torrent") returned 0
	[0134.450] lstrlenA (lpString="*.torrent") returned 9
	[0134.450] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.mov") returned 0
	[0134.450] lstrlenA (lpString="*.mov") returned 5
	[0134.450] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.3gp") returned 0
	[0134.450] lstrlenA (lpString="*.3gp") returned 5
	[0134.450] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.mpeg") returned 0
	[0134.450] lstrlenA (lpString="*.mpeg") returned 6
	[0134.450] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.mpg") returned 0
	[0134.450] lstrlenA (lpString="*.mpg") returned 5
	[0134.450] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.flv") returned 0
	[0134.450] lstrlenA (lpString="*.flv") returned 5
	[0134.450] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.avi") returned 0
	[0134.450] lstrlenA (lpString="*.avi") returned 5
	[0134.450] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.mp4") returned 0
	[0134.450] lstrlenA (lpString="*.mp4") returned 5
	[0134.450] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.wmv") returned 0
	[0134.450] lstrlenA (lpString="*.wmv") returned 5
	[0134.450] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.mkv") returned 0
	[0134.450] lstrlenA (lpString="*.mkv") returned 5
	[0134.451] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.mp3") returned 0
	[0134.451] lstrlenA (lpString="*.mp3") returned 5
	[0134.451] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.wav") returned 0
	[0134.451] lstrlenA (lpString="*.wav") returned 5
	[0134.451] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.flac") returned 0
	[0134.451] lstrlenA (lpString="*.flac") returned 6
	[0134.451] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.wma") returned 0
	[0134.451] lstrlenA (lpString="*.wma") returned 5
	[0134.451] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.au3") returned 0
	[0134.451] lstrlenA (lpString="*.au3") returned 5
	[0134.451] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.ahk") returned 0
	[0134.451] lstrlenA (lpString="*.ahk") returned 5
	[0134.451] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.c") returned 0
	[0134.451] lstrlenA (lpString="*.c") returned 3
	[0134.451] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.cc") returned 0
	[0134.451] lstrlenA (lpString="*.cc") returned 4
	[0134.451] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.cpp") returned 0
	[0134.451] lstrlenA (lpString="*.cpp") returned 5
	[0134.451] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.cxx") returned 0
	[0134.451] lstrlenA (lpString="*.cxx") returned 5
	[0134.451] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.c++") returned 0
	[0134.451] lstrlenA (lpString="*.c++") returned 5
	[0134.451] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.cs") returned 0
	[0134.451] lstrlenA (lpString="*.cs") returned 4
	[0134.451] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.vb") returned 0
	[0134.451] lstrlenA (lpString="*.vb") returned 4
	[0134.451] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.bas") returned 0
	[0134.451] lstrlenA (lpString="*.bas") returned 5
	[0134.451] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.csproj") returned 0
	[0134.451] lstrlenA (lpString="*.csproj") returned 8
	[0134.451] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.vbproj") returned 0
	[0134.451] lstrlenA (lpString="*.vbproj") returned 8
	[0134.451] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.vcxproj") returned 0
	[0134.451] lstrlenA (lpString="*.vcxproj") returned 9
	[0134.451] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.manifest") returned 0
	[0134.452] lstrlenA (lpString="*.manifest") returned 10
	[0134.452] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.php") returned 0
	[0134.452] lstrlenA (lpString="*.php") returned 5
	[0134.452] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.vbe") returned 0
	[0134.452] lstrlenA (lpString="*.vbe") returned 5
	[0134.452] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.vba") returned 0
	[0134.452] lstrlenA (lpString="*.vba") returned 5
	[0134.452] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.vbs") returned 0
	[0134.452] lstrlenA (lpString="*.vbs") returned 5
	[0134.452] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.bat") returned 0
	[0134.452] lstrlenA (lpString="*.bat") returned 5
	[0134.452] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.cmd") returned 0
	[0134.452] lstrlenA (lpString="*.cmd") returned 5
	[0134.452] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.js") returned 0
	[0134.452] lstrlenA (lpString="*.js") returned 4
	[0134.452] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.jscript") returned 0
	[0134.452] lstrlenA (lpString="*.jscript") returned 9
	[0134.452] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.hta") returned 0
	[0134.452] lstrlenA (lpString="*.hta") returned 5
	[0134.452] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.php7") returned 0
	[0134.452] lstrlenA (lpString="*.php7") returned 6
	[0134.452] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.db") returned 0
	[0134.452] lstrlenA (lpString="*.db") returned 4
	[0134.452] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.swf") returned 0
	[0134.452] lstrlenA (lpString="*.swf") returned 5
	[0134.452] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.eml") returned 0
	[0134.452] lstrlenA (lpString="*.eml") returned 5
	[0134.452] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.part") returned 0
	[0134.452] lstrlenA (lpString="*.part") returned 6
	[0134.452] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.nfo") returned 0
	[0134.452] lstrlenA (lpString="*.nfo") returned 5
	[0134.452] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.rsa") returned 0
	[0134.452] lstrlenA (lpString="*.rsa") returned 5
	[0134.452] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.key") returned 0
	[0134.452] lstrlenA (lpString="*.key") returned 5
	[0134.452] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.aes") returned 0
	[0134.453] lstrlenA (lpString="*.aes") returned 5
	[0134.453] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.blob") returned 0
	[0134.453] lstrlenA (lpString="*.blob") returned 6
	[0134.453] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.btc") returned 0
	[0134.453] lstrlenA (lpString="*.btc") returned 5
	[0134.453] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Desktop\\_ccVRvpY_v.rtf", pszSpec="*.wallet") returned 0
	[0134.453] lstrlenA (lpString="*.wallet") returned 8
	[0134.453] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38909450, ftCreationTime.dwHighDateTime=0x1d4c921, ftLastAccessTime.dwLowDateTime=0xd5d89ae0, ftLastAccessTime.dwHighDateTime=0x1d4c5b2, ftLastWriteTime.dwLowDateTime=0xd5d89ae0, ftLastWriteTime.dwHighDateTime=0x1d4c5b2, nFileSizeHigh=0x0, nFileSizeLow=0x358c, dwReserved0=0x12, dwReserved1=0x1, cFileName="_ccVRvpY_v.rtf", cAlternateFileName="_CCVRV~1.RTF")) returned 0
	[0134.453] FindClose (in: hFindFile=0x7cb5d0 | out: hFindFile=0x7cb5d0) returned 1
	[0134.453] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x115782be, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x115782be, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1
	[0134.453] lstrcmpA (lpString1=".", lpString2="Documents") returned -1
	[0134.453] lstrcmpA (lpString1="..", lpString2="Documents") returned -1
	[0134.453] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\*.*") returned="*.*"
	[0134.453] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Documents" | out: lpString1="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents"
	[0134.453] lstrlenA (lpString="C:\\Users\\FD1HVy\\Documents") returned 25
	[0134.453] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x115782be, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x115782be, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb5d0
	[0134.453] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0134.453] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x115782be, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x115782be, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.453] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0134.453] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0134.453] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed88fe50, ftCreationTime.dwHighDateTime=0x1d4e821, ftLastAccessTime.dwLowDateTime=0x9d987980, ftLastAccessTime.dwHighDateTime=0x1d4fe19, ftLastWriteTime.dwLowDateTime=0x9d987980, ftLastWriteTime.dwHighDateTime=0x1d4fe19, nFileSizeHigh=0x0, nFileSizeLow=0x1127b, dwReserved0=0x0, dwReserved1=0x0, cFileName="5xoCiSrZl8nw-zT.pptx", cAlternateFileName="5XOCIS~1.PPT")) returned 1
	[0134.453] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0134.453] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="5xoCiSrZl8nw-zT.pptx") returned 1
	[0134.453] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="5xoCiSrZl8nw-zT.pptx") returned 1
	[0134.453] lstrcmpiA (lpString1="", lpString2="5xoCiSrZl8nw-zT.pptx") returned -1
	[0134.453] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\*.*") returned="*.*"
	[0134.453] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\"
	[0134.453] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned=""
	[0134.454] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.454] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0134.454] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0134.454] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0134.454] WriteFile (in: hFile=0x20c, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0134.455] SetFileTime (hFile=0x20c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0134.455] CloseHandle (hObject=0x20c) returned 1
	[0134.455] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="5xoCiSrZl8nw-zT.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\5xoCiSrZl8nw-zT.pptx") returned="C:\\Users\\FD1HVy\\Documents\\5xoCiSrZl8nw-zT.pptx"
	[0134.455] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\5xoCiSrZl8nw-zT.pptx", pszSpec="*.zip") returned 0
	[0134.455] lstrlenA (lpString="*.zip") returned 5
	[0134.455] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\5xoCiSrZl8nw-zT.pptx", pszSpec="*.rar") returned 0
	[0134.455] lstrlenA (lpString="*.rar") returned 5
	[0134.455] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\5xoCiSrZl8nw-zT.pptx", pszSpec="*.7z") returned 0
	[0134.455] lstrlenA (lpString="*.7z") returned 4
	[0134.455] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\5xoCiSrZl8nw-zT.pptx", pszSpec="*.tar") returned 0
	[0134.455] lstrlenA (lpString="*.tar") returned 5
	[0134.455] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\5xoCiSrZl8nw-zT.pptx", pszSpec="*.gzip") returned 0
	[0134.455] lstrlenA (lpString="*.gzip") returned 6
	[0134.455] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\5xoCiSrZl8nw-zT.pptx", pszSpec="*.jpg") returned 0
	[0134.455] lstrlenA (lpString="*.jpg") returned 5
	[0134.455] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\5xoCiSrZl8nw-zT.pptx", pszSpec="*.jpeg") returned 0
	[0134.455] lstrlenA (lpString="*.jpeg") returned 6
	[0134.456] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\5xoCiSrZl8nw-zT.pptx", pszSpec="*.bmp") returned 0
	[0134.456] lstrlenA (lpString="*.bmp") returned 5
	[0134.456] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\5xoCiSrZl8nw-zT.pptx", pszSpec="*.gif") returned 0
	[0134.456] lstrlenA (lpString="*.gif") returned 5
	[0134.456] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\5xoCiSrZl8nw-zT.pptx", pszSpec="*.png") returned 0
	[0134.456] lstrlenA (lpString="*.png") returned 5
	[0134.456] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\5xoCiSrZl8nw-zT.pptx", pszSpec="*.doc") returned 0
	[0134.456] lstrlenA (lpString="*.doc") returned 5
	[0134.456] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\5xoCiSrZl8nw-zT.pptx", pszSpec="*.docx") returned 0
	[0134.456] lstrlenA (lpString="*.docx") returned 6
	[0134.456] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\5xoCiSrZl8nw-zT.pptx", pszSpec="*.xls") returned 0
	[0134.456] lstrlenA (lpString="*.xls") returned 5
	[0134.456] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\5xoCiSrZl8nw-zT.pptx", pszSpec="*.xlsx") returned 0
	[0134.456] lstrlenA (lpString="*.xlsx") returned 6
	[0134.456] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\5xoCiSrZl8nw-zT.pptx", pszSpec="*.ppt") returned 0
	[0134.456] lstrlenA (lpString="*.ppt") returned 5
	[0134.456] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\5xoCiSrZl8nw-zT.pptx", pszSpec="*.pptx") returned 1
	[0134.456] lstrlenA (lpString="*.pptx") returned 6
	[0134.456] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Documents\\5xoCiSrZl8nw-zT.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\5xoCiSrZl8nw-zT.pptx") returned="C:\\Users\\FD1HVy\\Documents\\5xoCiSrZl8nw-zT.pptx"
	[0134.456] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Documents\\5xoCiSrZl8nw-zT.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\5xoCiSrZl8nw-zT.pptx") returned="C:\\Users\\FD1HVy\\Documents\\5xoCiSrZl8nw-zT.pptx"
	[0134.456] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\5xoCiSrZl8nw-zT.pptx", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Documents\\5xoCiSrZl8nw-zT.pptx.") returned="C:\\Users\\FD1HVy\\Documents\\5xoCiSrZl8nw-zT.pptx."
	[0134.456] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\5xoCiSrZl8nw-zT.pptx.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\5xoCiSrZl8nw-zT.pptx.exe") returned="C:\\Users\\FD1HVy\\Documents\\5xoCiSrZl8nw-zT.pptx.exe"
	[0134.456] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\5xoCiSrZl8nw-zT.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\5xocisrzl8nw-zt.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0134.456] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1127b
	[0134.456] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xed88fe50, dwHighDateTime=0x1d4e821), lpLastAccessTime=0x407536*(dwLowDateTime=0x9d987980, dwHighDateTime=0x1d4fe19), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9d987980, dwHighDateTime=0x1d4fe19)) returned 1
	[0134.457] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.457] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x11239, lpOverlapped=0x0) returned 1
	[0134.458] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\5xoCiSrZl8nw-zT.pptx") returned="5xoCiSrZl8nw-zT.pptx"
	[0134.458] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.458] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x11239, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x11239, lpOverlapped=0x0) returned 1
	[0134.458] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.458] CloseHandle (hObject=0x20c) returned 1
	[0134.458] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\5xoCiSrZl8nw-zT.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\5xocisrzl8nw-zt.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\5xoCiSrZl8nw-zT.pptx.exe" (normalized: "c:\\users\\fd1hvy\\documents\\5xocisrzl8nw-zt.pptx.exe")) returned 1
	[0134.459] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93086710, ftCreationTime.dwHighDateTime=0x1d50705, ftLastAccessTime.dwLowDateTime=0x8a233790, ftLastAccessTime.dwHighDateTime=0x1d4def3, ftLastWriteTime.dwLowDateTime=0x8a233790, ftLastWriteTime.dwHighDateTime=0x1d4def3, nFileSizeHigh=0x0, nFileSizeLow=0x1617f, dwReserved0=0x0, dwReserved1=0x1, cFileName="8HtdjyUfbgf8X.pptx", cAlternateFileName="8HTDJY~1.PPT")) returned 1
	[0134.459] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0134.459] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="8HtdjyUfbgf8X.pptx") returned 1
	[0134.459] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="8HtdjyUfbgf8X.pptx") returned 1
	[0134.459] lstrcmpiA (lpString1="", lpString2="8HtdjyUfbgf8X.pptx") returned -1
	[0134.459] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\5xoCiSrZl8nw-zT.pptx") returned="5xoCiSrZl8nw-zT.pptx"
	[0134.459] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\"
	[0134.459] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned=""
	[0134.459] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.459] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\how-to-decrypt-files.htm")) returned 0x20
	[0134.460] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="8HtdjyUfbgf8X.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\8HtdjyUfbgf8X.pptx") returned="C:\\Users\\FD1HVy\\Documents\\8HtdjyUfbgf8X.pptx"
	[0134.460] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\8HtdjyUfbgf8X.pptx", pszSpec="*.zip") returned 0
	[0134.460] lstrlenA (lpString="*.zip") returned 5
	[0134.460] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\8HtdjyUfbgf8X.pptx", pszSpec="*.rar") returned 0
	[0134.460] lstrlenA (lpString="*.rar") returned 5
	[0134.460] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\8HtdjyUfbgf8X.pptx", pszSpec="*.7z") returned 0
	[0134.460] lstrlenA (lpString="*.7z") returned 4
	[0134.460] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\8HtdjyUfbgf8X.pptx", pszSpec="*.tar") returned 0
	[0134.460] lstrlenA (lpString="*.tar") returned 5
	[0134.460] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\8HtdjyUfbgf8X.pptx", pszSpec="*.gzip") returned 0
	[0134.460] lstrlenA (lpString="*.gzip") returned 6
	[0134.460] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\8HtdjyUfbgf8X.pptx", pszSpec="*.jpg") returned 0
	[0134.460] lstrlenA (lpString="*.jpg") returned 5
	[0134.460] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\8HtdjyUfbgf8X.pptx", pszSpec="*.jpeg") returned 0
	[0134.460] lstrlenA (lpString="*.jpeg") returned 6
	[0134.460] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\8HtdjyUfbgf8X.pptx", pszSpec="*.bmp") returned 0
	[0134.460] lstrlenA (lpString="*.bmp") returned 5
	[0134.460] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\8HtdjyUfbgf8X.pptx", pszSpec="*.gif") returned 0
	[0134.460] lstrlenA (lpString="*.gif") returned 5
	[0134.460] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\8HtdjyUfbgf8X.pptx", pszSpec="*.png") returned 0
	[0134.460] lstrlenA (lpString="*.png") returned 5
	[0134.460] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\8HtdjyUfbgf8X.pptx", pszSpec="*.doc") returned 0
	[0134.460] lstrlenA (lpString="*.doc") returned 5
	[0134.460] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\8HtdjyUfbgf8X.pptx", pszSpec="*.docx") returned 0
	[0134.460] lstrlenA (lpString="*.docx") returned 6
	[0134.460] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\8HtdjyUfbgf8X.pptx", pszSpec="*.xls") returned 0
	[0134.460] lstrlenA (lpString="*.xls") returned 5
	[0134.460] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\8HtdjyUfbgf8X.pptx", pszSpec="*.xlsx") returned 0
	[0134.460] lstrlenA (lpString="*.xlsx") returned 6
	[0134.460] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\8HtdjyUfbgf8X.pptx", pszSpec="*.ppt") returned 0
	[0134.460] lstrlenA (lpString="*.ppt") returned 5
	[0134.460] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\8HtdjyUfbgf8X.pptx", pszSpec="*.pptx") returned 1
	[0134.460] lstrlenA (lpString="*.pptx") returned 6
	[0134.460] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Documents\\8HtdjyUfbgf8X.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\8HtdjyUfbgf8X.pptx") returned="C:\\Users\\FD1HVy\\Documents\\8HtdjyUfbgf8X.pptx"
	[0134.460] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Documents\\8HtdjyUfbgf8X.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\8HtdjyUfbgf8X.pptx") returned="C:\\Users\\FD1HVy\\Documents\\8HtdjyUfbgf8X.pptx"
	[0134.461] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\8HtdjyUfbgf8X.pptx", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Documents\\8HtdjyUfbgf8X.pptx.") returned="C:\\Users\\FD1HVy\\Documents\\8HtdjyUfbgf8X.pptx."
	[0134.504] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\8HtdjyUfbgf8X.pptx.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\8HtdjyUfbgf8X.pptx.exe") returned="C:\\Users\\FD1HVy\\Documents\\8HtdjyUfbgf8X.pptx.exe"
	[0134.504] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\8HtdjyUfbgf8X.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\8htdjyufbgf8x.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0134.505] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1617f
	[0134.505] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x93086710, dwHighDateTime=0x1d50705), lpLastAccessTime=0x407536*(dwLowDateTime=0x8a233790, dwHighDateTime=0x1d4def3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8a233790, dwHighDateTime=0x1d4def3)) returned 1
	[0134.505] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.505] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1613d, lpOverlapped=0x0) returned 1
	[0134.507] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\8HtdjyUfbgf8X.pptx") returned="8HtdjyUfbgf8X.pptx"
	[0134.507] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.507] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1613d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1613d, lpOverlapped=0x0) returned 1
	[0134.507] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.507] CloseHandle (hObject=0x20c) returned 1
	[0134.508] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\8HtdjyUfbgf8X.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\8htdjyufbgf8x.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\8HtdjyUfbgf8X.pptx.exe" (normalized: "c:\\users\\fd1hvy\\documents\\8htdjyufbgf8x.pptx.exe")) returned 1
	[0134.508] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc33a7db0, ftCreationTime.dwHighDateTime=0x1d4c87b, ftLastAccessTime.dwLowDateTime=0xb1c941f0, ftLastAccessTime.dwHighDateTime=0x1d4d56f, ftLastWriteTime.dwLowDateTime=0xb1c941f0, ftLastWriteTime.dwHighDateTime=0x1d4d56f, nFileSizeHigh=0x0, nFileSizeLow=0x18636, dwReserved0=0x1c, dwReserved1=0x1, cFileName="8S0qxa Fr.doc", cAlternateFileName="8S0QXA~1.DOC")) returned 1
	[0134.508] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0134.508] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="8S0qxa Fr.doc") returned 1
	[0134.508] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="8S0qxa Fr.doc") returned 1
	[0134.508] lstrcmpiA (lpString1="", lpString2="8S0qxa Fr.doc") returned -1
	[0134.508] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\8HtdjyUfbgf8X.pptx") returned="8HtdjyUfbgf8X.pptx"
	[0134.508] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\"
	[0134.508] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned=""
	[0134.509] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.509] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\how-to-decrypt-files.htm")) returned 0x20
	[0134.509] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="8S0qxa Fr.doc" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\8S0qxa Fr.doc") returned="C:\\Users\\FD1HVy\\Documents\\8S0qxa Fr.doc"
	[0134.509] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\8S0qxa Fr.doc", pszSpec="*.zip") returned 0
	[0134.509] lstrlenA (lpString="*.zip") returned 5
	[0134.509] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\8S0qxa Fr.doc", pszSpec="*.rar") returned 0
	[0134.509] lstrlenA (lpString="*.rar") returned 5
	[0134.509] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\8S0qxa Fr.doc", pszSpec="*.7z") returned 0
	[0134.509] lstrlenA (lpString="*.7z") returned 4
	[0134.509] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\8S0qxa Fr.doc", pszSpec="*.tar") returned 0
	[0134.509] lstrlenA (lpString="*.tar") returned 5
	[0134.509] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\8S0qxa Fr.doc", pszSpec="*.gzip") returned 0
	[0134.509] lstrlenA (lpString="*.gzip") returned 6
	[0134.509] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\8S0qxa Fr.doc", pszSpec="*.jpg") returned 0
	[0134.509] lstrlenA (lpString="*.jpg") returned 5
	[0134.509] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\8S0qxa Fr.doc", pszSpec="*.jpeg") returned 0
	[0134.509] lstrlenA (lpString="*.jpeg") returned 6
	[0134.509] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\8S0qxa Fr.doc", pszSpec="*.bmp") returned 0
	[0134.509] lstrlenA (lpString="*.bmp") returned 5
	[0134.509] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\8S0qxa Fr.doc", pszSpec="*.gif") returned 0
	[0134.509] lstrlenA (lpString="*.gif") returned 5
	[0134.509] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\8S0qxa Fr.doc", pszSpec="*.png") returned 0
	[0134.509] lstrlenA (lpString="*.png") returned 5
	[0134.509] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\8S0qxa Fr.doc", pszSpec="*.doc") returned 1
	[0134.509] lstrlenA (lpString="*.doc") returned 5
	[0134.509] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Documents\\8S0qxa Fr.doc" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\8S0qxa Fr.doc") returned="C:\\Users\\FD1HVy\\Documents\\8S0qxa Fr.doc"
	[0134.509] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Documents\\8S0qxa Fr.doc" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\8S0qxa Fr.doc") returned="C:\\Users\\FD1HVy\\Documents\\8S0qxa Fr.doc"
	[0134.509] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\8S0qxa Fr.doc", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Documents\\8S0qxa Fr.doc.") returned="C:\\Users\\FD1HVy\\Documents\\8S0qxa Fr.doc."
	[0134.509] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\8S0qxa Fr.doc.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\8S0qxa Fr.doc.exe") returned="C:\\Users\\FD1HVy\\Documents\\8S0qxa Fr.doc.exe"
	[0134.509] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\8S0qxa Fr.doc" (normalized: "c:\\users\\fd1hvy\\documents\\8s0qxa fr.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0134.510] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18636
	[0134.510] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc33a7db0, dwHighDateTime=0x1d4c87b), lpLastAccessTime=0x407536*(dwLowDateTime=0xb1c941f0, dwHighDateTime=0x1d4d56f), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb1c941f0, dwHighDateTime=0x1d4d56f)) returned 1
	[0134.510] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.510] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x185f4, lpOverlapped=0x0) returned 1
	[0134.511] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\8S0qxa Fr.doc") returned="8S0qxa Fr.doc"
	[0134.511] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.511] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x185f4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x185f4, lpOverlapped=0x0) returned 1
	[0134.512] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.512] CloseHandle (hObject=0x20c) returned 1
	[0134.512] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\8S0qxa Fr.doc" (normalized: "c:\\users\\fd1hvy\\documents\\8s0qxa fr.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\8S0qxa Fr.doc.exe" (normalized: "c:\\users\\fd1hvy\\documents\\8s0qxa fr.doc.exe")) returned 1
	[0134.513] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0c9a070, ftCreationTime.dwHighDateTime=0x1d529b6, ftLastAccessTime.dwLowDateTime=0x8d6c09b0, ftLastAccessTime.dwHighDateTime=0x1d4ba43, ftLastWriteTime.dwLowDateTime=0x8d6c09b0, ftLastWriteTime.dwHighDateTime=0x1d4ba43, nFileSizeHigh=0x0, nFileSizeLow=0x10f93, dwReserved0=0x12, dwReserved1=0x1, cFileName="A9aEwsAAJtxkBI.xlsx", cAlternateFileName="A9AEWS~1.XLS")) returned 1
	[0134.513] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0134.513] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="A9aEwsAAJtxkBI.xlsx") returned 1
	[0134.513] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="A9aEwsAAJtxkBI.xlsx") returned 1
	[0134.513] lstrcmpiA (lpString1="", lpString2="A9aEwsAAJtxkBI.xlsx") returned -1
	[0134.513] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\8S0qxa Fr.doc") returned="8S0qxa Fr.doc"
	[0134.513] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\"
	[0134.513] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned=""
	[0134.513] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.513] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\how-to-decrypt-files.htm")) returned 0x20
	[0134.513] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="A9aEwsAAJtxkBI.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\A9aEwsAAJtxkBI.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\A9aEwsAAJtxkBI.xlsx"
	[0134.513] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\A9aEwsAAJtxkBI.xlsx", pszSpec="*.zip") returned 0
	[0134.513] lstrlenA (lpString="*.zip") returned 5
	[0134.513] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\A9aEwsAAJtxkBI.xlsx", pszSpec="*.rar") returned 0
	[0134.513] lstrlenA (lpString="*.rar") returned 5
	[0134.513] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\A9aEwsAAJtxkBI.xlsx", pszSpec="*.7z") returned 0
	[0134.513] lstrlenA (lpString="*.7z") returned 4
	[0134.513] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\A9aEwsAAJtxkBI.xlsx", pszSpec="*.tar") returned 0
	[0134.513] lstrlenA (lpString="*.tar") returned 5
	[0134.513] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\A9aEwsAAJtxkBI.xlsx", pszSpec="*.gzip") returned 0
	[0134.513] lstrlenA (lpString="*.gzip") returned 6
	[0134.513] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\A9aEwsAAJtxkBI.xlsx", pszSpec="*.jpg") returned 0
	[0134.513] lstrlenA (lpString="*.jpg") returned 5
	[0134.513] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\A9aEwsAAJtxkBI.xlsx", pszSpec="*.jpeg") returned 0
	[0134.513] lstrlenA (lpString="*.jpeg") returned 6
	[0134.513] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\A9aEwsAAJtxkBI.xlsx", pszSpec="*.bmp") returned 0
	[0134.513] lstrlenA (lpString="*.bmp") returned 5
	[0134.513] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\A9aEwsAAJtxkBI.xlsx", pszSpec="*.gif") returned 0
	[0134.513] lstrlenA (lpString="*.gif") returned 5
	[0134.513] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\A9aEwsAAJtxkBI.xlsx", pszSpec="*.png") returned 0
	[0134.513] lstrlenA (lpString="*.png") returned 5
	[0134.514] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\A9aEwsAAJtxkBI.xlsx", pszSpec="*.doc") returned 0
	[0134.514] lstrlenA (lpString="*.doc") returned 5
	[0134.514] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\A9aEwsAAJtxkBI.xlsx", pszSpec="*.docx") returned 0
	[0134.514] lstrlenA (lpString="*.docx") returned 6
	[0134.514] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\A9aEwsAAJtxkBI.xlsx", pszSpec="*.xls") returned 0
	[0134.514] lstrlenA (lpString="*.xls") returned 5
	[0134.514] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\A9aEwsAAJtxkBI.xlsx", pszSpec="*.xlsx") returned 1
	[0134.514] lstrlenA (lpString="*.xlsx") returned 6
	[0134.514] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Documents\\A9aEwsAAJtxkBI.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\A9aEwsAAJtxkBI.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\A9aEwsAAJtxkBI.xlsx"
	[0134.514] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Documents\\A9aEwsAAJtxkBI.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\A9aEwsAAJtxkBI.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\A9aEwsAAJtxkBI.xlsx"
	[0134.514] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\A9aEwsAAJtxkBI.xlsx", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Documents\\A9aEwsAAJtxkBI.xlsx.") returned="C:\\Users\\FD1HVy\\Documents\\A9aEwsAAJtxkBI.xlsx."
	[0134.514] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\A9aEwsAAJtxkBI.xlsx.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\A9aEwsAAJtxkBI.xlsx.exe") returned="C:\\Users\\FD1HVy\\Documents\\A9aEwsAAJtxkBI.xlsx.exe"
	[0134.514] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\A9aEwsAAJtxkBI.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\a9aewsaajtxkbi.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0134.514] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10f93
	[0134.514] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf0c9a070, dwHighDateTime=0x1d529b6), lpLastAccessTime=0x407536*(dwLowDateTime=0x8d6c09b0, dwHighDateTime=0x1d4ba43), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d6c09b0, dwHighDateTime=0x1d4ba43)) returned 1
	[0134.514] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.514] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x10f51, lpOverlapped=0x0) returned 1
	[0134.515] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\A9aEwsAAJtxkBI.xlsx") returned="A9aEwsAAJtxkBI.xlsx"
	[0134.516] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.516] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x10f51, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x10f51, lpOverlapped=0x0) returned 1
	[0134.516] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.516] CloseHandle (hObject=0x20c) returned 1
	[0134.516] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\A9aEwsAAJtxkBI.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\a9aewsaajtxkbi.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\A9aEwsAAJtxkBI.xlsx.exe" (normalized: "c:\\users\\fd1hvy\\documents\\a9aewsaajtxkbi.xlsx.exe")) returned 1
	[0134.517] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63b01ef0, ftCreationTime.dwHighDateTime=0x1d4bac4, ftLastAccessTime.dwLowDateTime=0x3ce84c30, ftLastAccessTime.dwHighDateTime=0x1d4c36f, ftLastWriteTime.dwLowDateTime=0x3ce84c30, ftLastWriteTime.dwHighDateTime=0x1d4c36f, nFileSizeHigh=0x0, nFileSizeLow=0x6659, dwReserved0=0x0, dwReserved1=0x1, cFileName="BJ5lap_JfLplCeloeBpz.docx", cAlternateFileName="BJ5LAP~1.DOC")) returned 1
	[0134.517] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0134.517] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="BJ5lap_JfLplCeloeBpz.docx") returned 1
	[0134.517] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="BJ5lap_JfLplCeloeBpz.docx") returned 1
	[0134.517] lstrcmpiA (lpString1="", lpString2="BJ5lap_JfLplCeloeBpz.docx") returned -1
	[0134.517] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\A9aEwsAAJtxkBI.xlsx") returned="A9aEwsAAJtxkBI.xlsx"
	[0134.517] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\"
	[0134.517] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned=""
	[0134.517] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.517] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\how-to-decrypt-files.htm")) returned 0x20
	[0134.517] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="BJ5lap_JfLplCeloeBpz.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\BJ5lap_JfLplCeloeBpz.docx") returned="C:\\Users\\FD1HVy\\Documents\\BJ5lap_JfLplCeloeBpz.docx"
	[0134.517] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\BJ5lap_JfLplCeloeBpz.docx", pszSpec="*.zip") returned 0
	[0134.517] lstrlenA (lpString="*.zip") returned 5
	[0134.517] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\BJ5lap_JfLplCeloeBpz.docx", pszSpec="*.rar") returned 0
	[0134.517] lstrlenA (lpString="*.rar") returned 5
	[0134.517] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\BJ5lap_JfLplCeloeBpz.docx", pszSpec="*.7z") returned 0
	[0134.517] lstrlenA (lpString="*.7z") returned 4
	[0134.517] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\BJ5lap_JfLplCeloeBpz.docx", pszSpec="*.tar") returned 0
	[0134.517] lstrlenA (lpString="*.tar") returned 5
	[0134.517] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\BJ5lap_JfLplCeloeBpz.docx", pszSpec="*.gzip") returned 0
	[0134.517] lstrlenA (lpString="*.gzip") returned 6
	[0134.517] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\BJ5lap_JfLplCeloeBpz.docx", pszSpec="*.jpg") returned 0
	[0134.517] lstrlenA (lpString="*.jpg") returned 5
	[0134.517] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\BJ5lap_JfLplCeloeBpz.docx", pszSpec="*.jpeg") returned 0
	[0134.517] lstrlenA (lpString="*.jpeg") returned 6
	[0134.517] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\BJ5lap_JfLplCeloeBpz.docx", pszSpec="*.bmp") returned 0
	[0134.517] lstrlenA (lpString="*.bmp") returned 5
	[0134.518] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\BJ5lap_JfLplCeloeBpz.docx", pszSpec="*.gif") returned 0
	[0134.518] lstrlenA (lpString="*.gif") returned 5
	[0134.518] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\BJ5lap_JfLplCeloeBpz.docx", pszSpec="*.png") returned 0
	[0134.518] lstrlenA (lpString="*.png") returned 5
	[0134.518] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\BJ5lap_JfLplCeloeBpz.docx", pszSpec="*.doc") returned 0
	[0134.518] lstrlenA (lpString="*.doc") returned 5
	[0134.518] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\BJ5lap_JfLplCeloeBpz.docx", pszSpec="*.docx") returned 1
	[0134.518] lstrlenA (lpString="*.docx") returned 6
	[0134.518] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Documents\\BJ5lap_JfLplCeloeBpz.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\BJ5lap_JfLplCeloeBpz.docx") returned="C:\\Users\\FD1HVy\\Documents\\BJ5lap_JfLplCeloeBpz.docx"
	[0134.518] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Documents\\BJ5lap_JfLplCeloeBpz.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\BJ5lap_JfLplCeloeBpz.docx") returned="C:\\Users\\FD1HVy\\Documents\\BJ5lap_JfLplCeloeBpz.docx"
	[0134.518] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\BJ5lap_JfLplCeloeBpz.docx", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Documents\\BJ5lap_JfLplCeloeBpz.docx.") returned="C:\\Users\\FD1HVy\\Documents\\BJ5lap_JfLplCeloeBpz.docx."
	[0134.518] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\BJ5lap_JfLplCeloeBpz.docx.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\BJ5lap_JfLplCeloeBpz.docx.exe") returned="C:\\Users\\FD1HVy\\Documents\\BJ5lap_JfLplCeloeBpz.docx.exe"
	[0134.518] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\BJ5lap_JfLplCeloeBpz.docx" (normalized: "c:\\users\\fd1hvy\\documents\\bj5lap_jflplceloebpz.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0134.518] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6659
	[0134.518] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x63b01ef0, dwHighDateTime=0x1d4bac4), lpLastAccessTime=0x407536*(dwLowDateTime=0x3ce84c30, dwHighDateTime=0x1d4c36f), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3ce84c30, dwHighDateTime=0x1d4c36f)) returned 1
	[0134.518] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.518] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x6617, lpOverlapped=0x0) returned 1
	[0134.519] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\BJ5lap_JfLplCeloeBpz.docx") returned="BJ5lap_JfLplCeloeBpz.docx"
	[0134.519] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.519] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x6617, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x6617, lpOverlapped=0x0) returned 1
	[0134.520] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.520] CloseHandle (hObject=0x20c) returned 1
	[0134.520] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\BJ5lap_JfLplCeloeBpz.docx" (normalized: "c:\\users\\fd1hvy\\documents\\bj5lap_jflplceloebpz.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\BJ5lap_JfLplCeloeBpz.docx.exe" (normalized: "c:\\users\\fd1hvy\\documents\\bj5lap_jflplceloebpz.docx.exe")) returned 1
	[0134.520] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3340555c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3396299d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x9daec75b, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x55000, dwReserved0=0x1f, dwReserved1=0x1, cFileName="Database1.accdb", cAlternateFileName="DATABA~1.ACC")) returned 1
	[0134.520] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0134.520] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Database1.accdb") returned 1
	[0134.520] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Database1.accdb") returned 1
	[0134.520] lstrcmpiA (lpString1="", lpString2="Database1.accdb") returned -1
	[0134.520] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\BJ5lap_JfLplCeloeBpz.docx") returned="BJ5lap_JfLplCeloeBpz.docx"
	[0134.520] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\"
	[0134.520] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned=""
	[0134.520] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.521] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\how-to-decrypt-files.htm")) returned 0x20
	[0134.521] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="Database1.accdb" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Database1.accdb") returned="C:\\Users\\FD1HVy\\Documents\\Database1.accdb"
	[0134.521] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.zip") returned 0
	[0134.521] lstrlenA (lpString="*.zip") returned 5
	[0134.521] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.rar") returned 0
	[0134.521] lstrlenA (lpString="*.rar") returned 5
	[0134.521] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.7z") returned 0
	[0134.521] lstrlenA (lpString="*.7z") returned 4
	[0134.521] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.tar") returned 0
	[0134.521] lstrlenA (lpString="*.tar") returned 5
	[0134.521] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.gzip") returned 0
	[0134.521] lstrlenA (lpString="*.gzip") returned 6
	[0134.521] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.jpg") returned 0
	[0134.521] lstrlenA (lpString="*.jpg") returned 5
	[0134.521] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.jpeg") returned 0
	[0134.521] lstrlenA (lpString="*.jpeg") returned 6
	[0134.521] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.bmp") returned 0
	[0134.521] lstrlenA (lpString="*.bmp") returned 5
	[0134.521] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.gif") returned 0
	[0134.521] lstrlenA (lpString="*.gif") returned 5
	[0134.521] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.png") returned 0
	[0134.521] lstrlenA (lpString="*.png") returned 5
	[0134.521] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.doc") returned 0
	[0134.521] lstrlenA (lpString="*.doc") returned 5
	[0134.521] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.docx") returned 0
	[0134.521] lstrlenA (lpString="*.docx") returned 6
	[0134.521] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.xls") returned 0
	[0134.521] lstrlenA (lpString="*.xls") returned 5
	[0134.521] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.xlsx") returned 0
	[0134.521] lstrlenA (lpString="*.xlsx") returned 6
	[0134.521] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.ppt") returned 0
	[0134.521] lstrlenA (lpString="*.ppt") returned 5
	[0134.521] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.pptx") returned 0
	[0134.521] lstrlenA (lpString="*.pptx") returned 6
	[0134.521] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.txt") returned 0
	[0134.522] lstrlenA (lpString="*.txt") returned 5
	[0134.522] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.pdf") returned 0
	[0134.522] lstrlenA (lpString="*.pdf") returned 5
	[0134.522] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.htm") returned 0
	[0134.522] lstrlenA (lpString="*.htm") returned 5
	[0134.522] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.html") returned 0
	[0134.522] lstrlenA (lpString="*.html") returned 6
	[0134.522] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.mdb") returned 0
	[0134.522] lstrlenA (lpString="*.mdb") returned 5
	[0134.522] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.pfx") returned 0
	[0134.522] lstrlenA (lpString="*.pfx") returned 5
	[0134.522] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.md") returned 0
	[0134.522] lstrlenA (lpString="*.md") returned 4
	[0134.522] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.lnk") returned 0
	[0134.522] lstrlenA (lpString="*.lnk") returned 5
	[0134.522] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.torrent") returned 0
	[0134.522] lstrlenA (lpString="*.torrent") returned 9
	[0134.522] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.mov") returned 0
	[0134.522] lstrlenA (lpString="*.mov") returned 5
	[0134.522] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.3gp") returned 0
	[0134.522] lstrlenA (lpString="*.3gp") returned 5
	[0134.522] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.mpeg") returned 0
	[0134.522] lstrlenA (lpString="*.mpeg") returned 6
	[0134.522] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.mpg") returned 0
	[0134.522] lstrlenA (lpString="*.mpg") returned 5
	[0134.522] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.flv") returned 0
	[0134.522] lstrlenA (lpString="*.flv") returned 5
	[0134.522] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.avi") returned 0
	[0134.522] lstrlenA (lpString="*.avi") returned 5
	[0134.522] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.mp4") returned 0
	[0134.522] lstrlenA (lpString="*.mp4") returned 5
	[0134.522] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.wmv") returned 0
	[0134.522] lstrlenA (lpString="*.wmv") returned 5
	[0134.522] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.mkv") returned 0
	[0134.522] lstrlenA (lpString="*.mkv") returned 5
	[0134.522] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.mp3") returned 0
	[0134.523] lstrlenA (lpString="*.mp3") returned 5
	[0134.523] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.wav") returned 0
	[0134.523] lstrlenA (lpString="*.wav") returned 5
	[0134.523] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.flac") returned 0
	[0134.523] lstrlenA (lpString="*.flac") returned 6
	[0134.523] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.wma") returned 0
	[0134.523] lstrlenA (lpString="*.wma") returned 5
	[0134.523] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.au3") returned 0
	[0134.523] lstrlenA (lpString="*.au3") returned 5
	[0134.523] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.ahk") returned 0
	[0134.523] lstrlenA (lpString="*.ahk") returned 5
	[0134.523] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.c") returned 0
	[0134.523] lstrlenA (lpString="*.c") returned 3
	[0134.523] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.cc") returned 0
	[0134.523] lstrlenA (lpString="*.cc") returned 4
	[0134.523] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.cpp") returned 0
	[0134.523] lstrlenA (lpString="*.cpp") returned 5
	[0134.523] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.cxx") returned 0
	[0134.523] lstrlenA (lpString="*.cxx") returned 5
	[0134.523] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.c++") returned 0
	[0134.523] lstrlenA (lpString="*.c++") returned 5
	[0134.523] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.cs") returned 0
	[0134.523] lstrlenA (lpString="*.cs") returned 4
	[0134.523] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.vb") returned 0
	[0134.523] lstrlenA (lpString="*.vb") returned 4
	[0134.523] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.bas") returned 0
	[0134.523] lstrlenA (lpString="*.bas") returned 5
	[0134.524] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.csproj") returned 0
	[0134.524] lstrlenA (lpString="*.csproj") returned 8
	[0134.524] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.vbproj") returned 0
	[0134.524] lstrlenA (lpString="*.vbproj") returned 8
	[0134.524] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.vcxproj") returned 0
	[0134.524] lstrlenA (lpString="*.vcxproj") returned 9
	[0134.524] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.manifest") returned 0
	[0134.524] lstrlenA (lpString="*.manifest") returned 10
	[0134.524] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.php") returned 0
	[0134.524] lstrlenA (lpString="*.php") returned 5
	[0134.524] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.vbe") returned 0
	[0134.524] lstrlenA (lpString="*.vbe") returned 5
	[0134.524] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.vba") returned 0
	[0134.524] lstrlenA (lpString="*.vba") returned 5
	[0134.524] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.vbs") returned 0
	[0134.524] lstrlenA (lpString="*.vbs") returned 5
	[0134.524] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.bat") returned 0
	[0134.524] lstrlenA (lpString="*.bat") returned 5
	[0134.524] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.cmd") returned 0
	[0134.524] lstrlenA (lpString="*.cmd") returned 5
	[0134.524] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.js") returned 0
	[0134.524] lstrlenA (lpString="*.js") returned 4
	[0134.524] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.jscript") returned 0
	[0134.524] lstrlenA (lpString="*.jscript") returned 9
	[0134.524] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.hta") returned 0
	[0134.524] lstrlenA (lpString="*.hta") returned 5
	[0134.524] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.php7") returned 0
	[0134.524] lstrlenA (lpString="*.php7") returned 6
	[0134.524] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.db") returned 0
	[0134.524] lstrlenA (lpString="*.db") returned 4
	[0134.524] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.swf") returned 0
	[0134.524] lstrlenA (lpString="*.swf") returned 5
	[0134.524] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.eml") returned 0
	[0134.524] lstrlenA (lpString="*.eml") returned 5
	[0134.524] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.part") returned 0
	[0134.524] lstrlenA (lpString="*.part") returned 6
	[0134.525] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.nfo") returned 0
	[0134.525] lstrlenA (lpString="*.nfo") returned 5
	[0134.525] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.rsa") returned 0
	[0134.525] lstrlenA (lpString="*.rsa") returned 5
	[0134.525] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.key") returned 0
	[0134.525] lstrlenA (lpString="*.key") returned 5
	[0134.525] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.aes") returned 0
	[0134.525] lstrlenA (lpString="*.aes") returned 5
	[0134.525] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.blob") returned 0
	[0134.525] lstrlenA (lpString="*.blob") returned 6
	[0134.525] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.btc") returned 0
	[0134.525] lstrlenA (lpString="*.btc") returned 5
	[0134.525] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", pszSpec="*.wallet") returned 0
	[0134.525] lstrlenA (lpString="*.wallet") returned 8
	[0134.525] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440c5760, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440c5760, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0134.525] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0134.525] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="desktop.ini") returned 1
	[0134.525] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="desktop.ini") returned 1
	[0134.525] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1
	[0134.525] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\Database1.accdb") returned="Database1.accdb"
	[0134.525] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\"
	[0134.525] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned=""
	[0134.525] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.525] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\how-to-decrypt-files.htm")) returned 0x20
	[0134.525] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\desktop.ini") returned="C:\\Users\\FD1HVy\\Documents\\desktop.ini"
	[0134.525] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.zip") returned 0
	[0134.525] lstrlenA (lpString="*.zip") returned 5
	[0134.525] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.rar") returned 0
	[0134.525] lstrlenA (lpString="*.rar") returned 5
	[0134.525] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.7z") returned 0
	[0134.525] lstrlenA (lpString="*.7z") returned 4
	[0134.525] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.tar") returned 0
	[0134.526] lstrlenA (lpString="*.tar") returned 5
	[0134.526] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.gzip") returned 0
	[0134.526] lstrlenA (lpString="*.gzip") returned 6
	[0134.526] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.jpg") returned 0
	[0134.526] lstrlenA (lpString="*.jpg") returned 5
	[0134.526] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.jpeg") returned 0
	[0134.526] lstrlenA (lpString="*.jpeg") returned 6
	[0134.526] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.bmp") returned 0
	[0134.526] lstrlenA (lpString="*.bmp") returned 5
	[0134.526] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.gif") returned 0
	[0134.526] lstrlenA (lpString="*.gif") returned 5
	[0134.526] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.png") returned 0
	[0134.526] lstrlenA (lpString="*.png") returned 5
	[0134.526] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.doc") returned 0
	[0134.526] lstrlenA (lpString="*.doc") returned 5
	[0134.526] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.docx") returned 0
	[0134.526] lstrlenA (lpString="*.docx") returned 6
	[0134.526] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.xls") returned 0
	[0134.526] lstrlenA (lpString="*.xls") returned 5
	[0134.526] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.xlsx") returned 0
	[0134.526] lstrlenA (lpString="*.xlsx") returned 6
	[0134.526] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.ppt") returned 0
	[0134.526] lstrlenA (lpString="*.ppt") returned 5
	[0134.526] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.pptx") returned 0
	[0134.526] lstrlenA (lpString="*.pptx") returned 6
	[0134.526] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.txt") returned 0
	[0134.526] lstrlenA (lpString="*.txt") returned 5
	[0134.526] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.pdf") returned 0
	[0134.526] lstrlenA (lpString="*.pdf") returned 5
	[0134.526] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.htm") returned 0
	[0134.526] lstrlenA (lpString="*.htm") returned 5
	[0134.526] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.html") returned 0
	[0134.526] lstrlenA (lpString="*.html") returned 6
	[0134.526] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.mdb") returned 0
	[0134.526] lstrlenA (lpString="*.mdb") returned 5
	[0134.526] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.pfx") returned 0
	[0134.527] lstrlenA (lpString="*.pfx") returned 5
	[0134.527] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.md") returned 0
	[0134.527] lstrlenA (lpString="*.md") returned 4
	[0134.527] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.lnk") returned 0
	[0134.527] lstrlenA (lpString="*.lnk") returned 5
	[0134.527] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.torrent") returned 0
	[0134.527] lstrlenA (lpString="*.torrent") returned 9
	[0134.527] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.mov") returned 0
	[0134.527] lstrlenA (lpString="*.mov") returned 5
	[0134.527] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.3gp") returned 0
	[0134.527] lstrlenA (lpString="*.3gp") returned 5
	[0134.527] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.mpeg") returned 0
	[0134.527] lstrlenA (lpString="*.mpeg") returned 6
	[0134.527] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.mpg") returned 0
	[0134.527] lstrlenA (lpString="*.mpg") returned 5
	[0134.527] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.flv") returned 0
	[0134.527] lstrlenA (lpString="*.flv") returned 5
	[0134.527] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.avi") returned 0
	[0134.527] lstrlenA (lpString="*.avi") returned 5
	[0134.527] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.mp4") returned 0
	[0134.527] lstrlenA (lpString="*.mp4") returned 5
	[0134.527] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.wmv") returned 0
	[0134.527] lstrlenA (lpString="*.wmv") returned 5
	[0134.527] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.mkv") returned 0
	[0134.527] lstrlenA (lpString="*.mkv") returned 5
	[0134.527] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.mp3") returned 0
	[0134.527] lstrlenA (lpString="*.mp3") returned 5
	[0134.527] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.wav") returned 0
	[0134.527] lstrlenA (lpString="*.wav") returned 5
	[0134.527] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.flac") returned 0
	[0134.527] lstrlenA (lpString="*.flac") returned 6
	[0134.527] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.wma") returned 0
	[0134.527] lstrlenA (lpString="*.wma") returned 5
	[0134.527] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.au3") returned 0
	[0134.527] lstrlenA (lpString="*.au3") returned 5
	[0134.528] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.ahk") returned 0
	[0134.528] lstrlenA (lpString="*.ahk") returned 5
	[0134.528] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.c") returned 0
	[0134.528] lstrlenA (lpString="*.c") returned 3
	[0134.528] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.cc") returned 0
	[0134.528] lstrlenA (lpString="*.cc") returned 4
	[0134.528] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.cpp") returned 0
	[0134.528] lstrlenA (lpString="*.cpp") returned 5
	[0134.528] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.cxx") returned 0
	[0134.528] lstrlenA (lpString="*.cxx") returned 5
	[0134.528] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.c++") returned 0
	[0134.528] lstrlenA (lpString="*.c++") returned 5
	[0134.528] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.cs") returned 0
	[0134.528] lstrlenA (lpString="*.cs") returned 4
	[0134.528] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.vb") returned 0
	[0134.528] lstrlenA (lpString="*.vb") returned 4
	[0134.528] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.bas") returned 0
	[0134.528] lstrlenA (lpString="*.bas") returned 5
	[0134.528] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.csproj") returned 0
	[0134.528] lstrlenA (lpString="*.csproj") returned 8
	[0134.528] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.vbproj") returned 0
	[0134.528] lstrlenA (lpString="*.vbproj") returned 8
	[0134.528] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.vcxproj") returned 0
	[0134.528] lstrlenA (lpString="*.vcxproj") returned 9
	[0134.528] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.manifest") returned 0
	[0134.528] lstrlenA (lpString="*.manifest") returned 10
	[0134.528] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.php") returned 0
	[0134.528] lstrlenA (lpString="*.php") returned 5
	[0134.528] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.vbe") returned 0
	[0134.528] lstrlenA (lpString="*.vbe") returned 5
	[0134.528] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.vba") returned 0
	[0134.528] lstrlenA (lpString="*.vba") returned 5
	[0134.528] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.vbs") returned 0
	[0134.528] lstrlenA (lpString="*.vbs") returned 5
	[0134.528] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.bat") returned 0
	[0134.529] lstrlenA (lpString="*.bat") returned 5
	[0134.529] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.cmd") returned 0
	[0134.529] lstrlenA (lpString="*.cmd") returned 5
	[0134.529] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.js") returned 0
	[0134.529] lstrlenA (lpString="*.js") returned 4
	[0134.529] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.jscript") returned 0
	[0134.529] lstrlenA (lpString="*.jscript") returned 9
	[0134.529] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.hta") returned 0
	[0134.529] lstrlenA (lpString="*.hta") returned 5
	[0134.529] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.php7") returned 0
	[0134.529] lstrlenA (lpString="*.php7") returned 6
	[0134.529] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.db") returned 0
	[0134.529] lstrlenA (lpString="*.db") returned 4
	[0134.529] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.swf") returned 0
	[0134.529] lstrlenA (lpString="*.swf") returned 5
	[0134.529] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.eml") returned 0
	[0134.529] lstrlenA (lpString="*.eml") returned 5
	[0134.529] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.part") returned 0
	[0134.529] lstrlenA (lpString="*.part") returned 6
	[0134.529] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.nfo") returned 0
	[0134.529] lstrlenA (lpString="*.nfo") returned 5
	[0134.529] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.rsa") returned 0
	[0134.529] lstrlenA (lpString="*.rsa") returned 5
	[0134.529] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.key") returned 0
	[0134.529] lstrlenA (lpString="*.key") returned 5
	[0134.529] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.aes") returned 0
	[0134.529] lstrlenA (lpString="*.aes") returned 5
	[0134.529] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.blob") returned 0
	[0134.529] lstrlenA (lpString="*.blob") returned 6
	[0134.529] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.btc") returned 0
	[0134.529] lstrlenA (lpString="*.btc") returned 5
	[0134.529] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\desktop.ini", pszSpec="*.wallet") returned 0
	[0134.529] lstrlenA (lpString="*.wallet") returned 8
	[0134.529] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcda55a0, ftCreationTime.dwHighDateTime=0x1d5377e, ftLastAccessTime.dwLowDateTime=0x143f1a50, ftLastAccessTime.dwHighDateTime=0x1d4e5b8, ftLastWriteTime.dwLowDateTime=0x143f1a50, ftLastWriteTime.dwHighDateTime=0x1d4e5b8, nFileSizeHigh=0x0, nFileSizeLow=0xfcd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FWr 8BKK.docx", cAlternateFileName="FWR8BK~1.DOC")) returned 1
	[0134.529] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0134.530] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="FWr 8BKK.docx") returned -1
	[0134.530] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="FWr 8BKK.docx") returned 1
	[0134.530] lstrcmpiA (lpString1="", lpString2="FWr 8BKK.docx") returned -1
	[0134.530] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\desktop.ini") returned="desktop.ini"
	[0134.530] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\"
	[0134.530] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned=""
	[0134.530] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.530] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\how-to-decrypt-files.htm")) returned 0x20
	[0134.530] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="FWr 8BKK.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\FWr 8BKK.docx") returned="C:\\Users\\FD1HVy\\Documents\\FWr 8BKK.docx"
	[0134.530] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\FWr 8BKK.docx", pszSpec="*.zip") returned 0
	[0134.530] lstrlenA (lpString="*.zip") returned 5
	[0134.530] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\FWr 8BKK.docx", pszSpec="*.rar") returned 0
	[0134.530] lstrlenA (lpString="*.rar") returned 5
	[0134.530] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\FWr 8BKK.docx", pszSpec="*.7z") returned 0
	[0134.530] lstrlenA (lpString="*.7z") returned 4
	[0134.530] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\FWr 8BKK.docx", pszSpec="*.tar") returned 0
	[0134.530] lstrlenA (lpString="*.tar") returned 5
	[0134.530] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\FWr 8BKK.docx", pszSpec="*.gzip") returned 0
	[0134.530] lstrlenA (lpString="*.gzip") returned 6
	[0134.530] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\FWr 8BKK.docx", pszSpec="*.jpg") returned 0
	[0134.530] lstrlenA (lpString="*.jpg") returned 5
	[0134.530] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\FWr 8BKK.docx", pszSpec="*.jpeg") returned 0
	[0134.530] lstrlenA (lpString="*.jpeg") returned 6
	[0134.530] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\FWr 8BKK.docx", pszSpec="*.bmp") returned 0
	[0134.530] lstrlenA (lpString="*.bmp") returned 5
	[0134.530] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\FWr 8BKK.docx", pszSpec="*.gif") returned 0
	[0134.530] lstrlenA (lpString="*.gif") returned 5
	[0134.530] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\FWr 8BKK.docx", pszSpec="*.png") returned 0
	[0134.530] lstrlenA (lpString="*.png") returned 5
	[0134.530] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\FWr 8BKK.docx", pszSpec="*.doc") returned 0
	[0134.530] lstrlenA (lpString="*.doc") returned 5
	[0134.530] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\FWr 8BKK.docx", pszSpec="*.docx") returned 1
	[0134.530] lstrlenA (lpString="*.docx") returned 6
	[0134.531] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Documents\\FWr 8BKK.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\FWr 8BKK.docx") returned="C:\\Users\\FD1HVy\\Documents\\FWr 8BKK.docx"
	[0134.531] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Documents\\FWr 8BKK.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\FWr 8BKK.docx") returned="C:\\Users\\FD1HVy\\Documents\\FWr 8BKK.docx"
	[0134.531] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\FWr 8BKK.docx", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Documents\\FWr 8BKK.docx.") returned="C:\\Users\\FD1HVy\\Documents\\FWr 8BKK.docx."
	[0134.531] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\FWr 8BKK.docx.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\FWr 8BKK.docx.exe") returned="C:\\Users\\FD1HVy\\Documents\\FWr 8BKK.docx.exe"
	[0134.531] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\FWr 8BKK.docx" (normalized: "c:\\users\\fd1hvy\\documents\\fwr 8bkk.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0134.531] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfcd8
	[0134.531] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcda55a0, dwHighDateTime=0x1d5377e), lpLastAccessTime=0x407536*(dwLowDateTime=0x143f1a50, dwHighDateTime=0x1d4e5b8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x143f1a50, dwHighDateTime=0x1d4e5b8)) returned 1
	[0134.531] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.531] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xfc96, lpOverlapped=0x0) returned 1
	[0134.532] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\FWr 8BKK.docx") returned="FWr 8BKK.docx"
	[0134.532] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.532] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xfc96, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xfc96, lpOverlapped=0x0) returned 1
	[0134.533] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.533] CloseHandle (hObject=0x20c) returned 1
	[0134.533] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\FWr 8BKK.docx" (normalized: "c:\\users\\fd1hvy\\documents\\fwr 8bkk.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\FWr 8BKK.docx.exe" (normalized: "c:\\users\\fd1hvy\\documents\\fwr 8bkk.docx.exe")) returned 1
	[0134.533] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ec649a0, ftCreationTime.dwHighDateTime=0x1d517a5, ftLastAccessTime.dwLowDateTime=0x9951ec60, ftLastAccessTime.dwHighDateTime=0x1d50fc3, ftLastWriteTime.dwLowDateTime=0x9951ec60, ftLastWriteTime.dwHighDateTime=0x1d50fc3, nFileSizeHigh=0x0, nFileSizeLow=0x13817, dwReserved0=0x12, dwReserved1=0x1, cFileName="hXR1 C9Pfwz.pptx", cAlternateFileName="HXR1C9~1.PPT")) returned 1
	[0134.533] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0134.533] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="hXR1 C9Pfwz.pptx") returned -1
	[0134.533] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="hXR1 C9Pfwz.pptx") returned -1
	[0134.533] lstrcmpiA (lpString1="", lpString2="hXR1 C9Pfwz.pptx") returned -1
	[0134.533] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\FWr 8BKK.docx") returned="FWr 8BKK.docx"
	[0134.533] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\"
	[0134.534] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned=""
	[0134.534] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.534] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\how-to-decrypt-files.htm")) returned 0x20
	[0134.534] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="hXR1 C9Pfwz.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\hXR1 C9Pfwz.pptx") returned="C:\\Users\\FD1HVy\\Documents\\hXR1 C9Pfwz.pptx"
	[0134.534] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\hXR1 C9Pfwz.pptx", pszSpec="*.zip") returned 0
	[0134.534] lstrlenA (lpString="*.zip") returned 5
	[0134.534] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\hXR1 C9Pfwz.pptx", pszSpec="*.rar") returned 0
	[0134.534] lstrlenA (lpString="*.rar") returned 5
	[0134.534] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\hXR1 C9Pfwz.pptx", pszSpec="*.7z") returned 0
	[0134.534] lstrlenA (lpString="*.7z") returned 4
	[0134.534] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\hXR1 C9Pfwz.pptx", pszSpec="*.tar") returned 0
	[0134.534] lstrlenA (lpString="*.tar") returned 5
	[0134.534] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\hXR1 C9Pfwz.pptx", pszSpec="*.gzip") returned 0
	[0134.534] lstrlenA (lpString="*.gzip") returned 6
	[0134.534] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\hXR1 C9Pfwz.pptx", pszSpec="*.jpg") returned 0
	[0134.534] lstrlenA (lpString="*.jpg") returned 5
	[0134.534] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\hXR1 C9Pfwz.pptx", pszSpec="*.jpeg") returned 0
	[0134.534] lstrlenA (lpString="*.jpeg") returned 6
	[0134.534] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\hXR1 C9Pfwz.pptx", pszSpec="*.bmp") returned 0
	[0134.534] lstrlenA (lpString="*.bmp") returned 5
	[0134.534] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\hXR1 C9Pfwz.pptx", pszSpec="*.gif") returned 0
	[0134.534] lstrlenA (lpString="*.gif") returned 5
	[0134.534] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\hXR1 C9Pfwz.pptx", pszSpec="*.png") returned 0
	[0134.534] lstrlenA (lpString="*.png") returned 5
	[0134.534] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\hXR1 C9Pfwz.pptx", pszSpec="*.doc") returned 0
	[0134.534] lstrlenA (lpString="*.doc") returned 5
	[0134.534] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\hXR1 C9Pfwz.pptx", pszSpec="*.docx") returned 0
	[0134.534] lstrlenA (lpString="*.docx") returned 6
	[0134.534] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\hXR1 C9Pfwz.pptx", pszSpec="*.xls") returned 0
	[0134.534] lstrlenA (lpString="*.xls") returned 5
	[0134.534] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\hXR1 C9Pfwz.pptx", pszSpec="*.xlsx") returned 0
	[0134.534] lstrlenA (lpString="*.xlsx") returned 6
	[0134.535] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\hXR1 C9Pfwz.pptx", pszSpec="*.ppt") returned 0
	[0134.535] lstrlenA (lpString="*.ppt") returned 5
	[0134.535] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\hXR1 C9Pfwz.pptx", pszSpec="*.pptx") returned 1
	[0134.535] lstrlenA (lpString="*.pptx") returned 6
	[0134.535] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Documents\\hXR1 C9Pfwz.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\hXR1 C9Pfwz.pptx") returned="C:\\Users\\FD1HVy\\Documents\\hXR1 C9Pfwz.pptx"
	[0134.535] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Documents\\hXR1 C9Pfwz.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\hXR1 C9Pfwz.pptx") returned="C:\\Users\\FD1HVy\\Documents\\hXR1 C9Pfwz.pptx"
	[0134.535] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\hXR1 C9Pfwz.pptx", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Documents\\hXR1 C9Pfwz.pptx.") returned="C:\\Users\\FD1HVy\\Documents\\hXR1 C9Pfwz.pptx."
	[0134.535] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\hXR1 C9Pfwz.pptx.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\hXR1 C9Pfwz.pptx.exe") returned="C:\\Users\\FD1HVy\\Documents\\hXR1 C9Pfwz.pptx.exe"
	[0134.535] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\hXR1 C9Pfwz.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\hxr1 c9pfwz.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0134.535] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13817
	[0134.535] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8ec649a0, dwHighDateTime=0x1d517a5), lpLastAccessTime=0x407536*(dwLowDateTime=0x9951ec60, dwHighDateTime=0x1d50fc3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9951ec60, dwHighDateTime=0x1d50fc3)) returned 1
	[0134.535] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.535] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x137d5, lpOverlapped=0x0) returned 1
	[0134.536] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\hXR1 C9Pfwz.pptx") returned="hXR1 C9Pfwz.pptx"
	[0134.537] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.537] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x137d5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x137d5, lpOverlapped=0x0) returned 1
	[0134.537] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.537] CloseHandle (hObject=0x20c) returned 1
	[0134.537] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\hXR1 C9Pfwz.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\hxr1 c9pfwz.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\hXR1 C9Pfwz.pptx.exe" (normalized: "c:\\users\\fd1hvy\\documents\\hxr1 c9pfwz.pptx.exe")) returned 1
	[0134.538] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61630cf0, ftCreationTime.dwHighDateTime=0x1d4cc23, ftLastAccessTime.dwLowDateTime=0x914fba10, ftLastAccessTime.dwHighDateTime=0x1d4cb3a, ftLastWriteTime.dwLowDateTime=0x914fba10, ftLastWriteTime.dwHighDateTime=0x1d4cb3a, nFileSizeHigh=0x0, nFileSizeLow=0x18594, dwReserved0=0x15, dwReserved1=0x1, cFileName="ihFeRsxVwI9oz.docx", cAlternateFileName="IHFERS~1.DOC")) returned 1
	[0134.538] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0134.538] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="ihFeRsxVwI9oz.docx") returned -1
	[0134.538] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="ihFeRsxVwI9oz.docx") returned -1
	[0134.538] lstrcmpiA (lpString1="", lpString2="ihFeRsxVwI9oz.docx") returned -1
	[0134.538] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\hXR1 C9Pfwz.pptx") returned="hXR1 C9Pfwz.pptx"
	[0134.538] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\"
	[0134.538] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned=""
	[0134.538] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.538] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\how-to-decrypt-files.htm")) returned 0x20
	[0134.538] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="ihFeRsxVwI9oz.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ihFeRsxVwI9oz.docx") returned="C:\\Users\\FD1HVy\\Documents\\ihFeRsxVwI9oz.docx"
	[0134.538] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ihFeRsxVwI9oz.docx", pszSpec="*.zip") returned 0
	[0134.538] lstrlenA (lpString="*.zip") returned 5
	[0134.538] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ihFeRsxVwI9oz.docx", pszSpec="*.rar") returned 0
	[0134.538] lstrlenA (lpString="*.rar") returned 5
	[0134.538] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ihFeRsxVwI9oz.docx", pszSpec="*.7z") returned 0
	[0134.538] lstrlenA (lpString="*.7z") returned 4
	[0134.538] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ihFeRsxVwI9oz.docx", pszSpec="*.tar") returned 0
	[0134.538] lstrlenA (lpString="*.tar") returned 5
	[0134.538] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ihFeRsxVwI9oz.docx", pszSpec="*.gzip") returned 0
	[0134.538] lstrlenA (lpString="*.gzip") returned 6
	[0134.538] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ihFeRsxVwI9oz.docx", pszSpec="*.jpg") returned 0
	[0134.538] lstrlenA (lpString="*.jpg") returned 5
	[0134.538] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ihFeRsxVwI9oz.docx", pszSpec="*.jpeg") returned 0
	[0134.539] lstrlenA (lpString="*.jpeg") returned 6
	[0134.539] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ihFeRsxVwI9oz.docx", pszSpec="*.bmp") returned 0
	[0134.539] lstrlenA (lpString="*.bmp") returned 5
	[0134.539] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ihFeRsxVwI9oz.docx", pszSpec="*.gif") returned 0
	[0134.539] lstrlenA (lpString="*.gif") returned 5
	[0134.539] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ihFeRsxVwI9oz.docx", pszSpec="*.png") returned 0
	[0134.572] lstrlenA (lpString="*.png") returned 5
	[0134.572] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ihFeRsxVwI9oz.docx", pszSpec="*.doc") returned 0
	[0134.573] lstrlenA (lpString="*.doc") returned 5
	[0134.573] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ihFeRsxVwI9oz.docx", pszSpec="*.docx") returned 1
	[0134.573] lstrlenA (lpString="*.docx") returned 6
	[0134.573] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Documents\\ihFeRsxVwI9oz.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ihFeRsxVwI9oz.docx") returned="C:\\Users\\FD1HVy\\Documents\\ihFeRsxVwI9oz.docx"
	[0134.573] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Documents\\ihFeRsxVwI9oz.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ihFeRsxVwI9oz.docx") returned="C:\\Users\\FD1HVy\\Documents\\ihFeRsxVwI9oz.docx"
	[0134.573] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\ihFeRsxVwI9oz.docx", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ihFeRsxVwI9oz.docx.") returned="C:\\Users\\FD1HVy\\Documents\\ihFeRsxVwI9oz.docx."
	[0134.573] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\ihFeRsxVwI9oz.docx.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ihFeRsxVwI9oz.docx.exe") returned="C:\\Users\\FD1HVy\\Documents\\ihFeRsxVwI9oz.docx.exe"
	[0134.573] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\ihFeRsxVwI9oz.docx" (normalized: "c:\\users\\fd1hvy\\documents\\ihfersxvwi9oz.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0134.573] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18594
	[0134.573] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x61630cf0, dwHighDateTime=0x1d4cc23), lpLastAccessTime=0x407536*(dwLowDateTime=0x914fba10, dwHighDateTime=0x1d4cb3a), lpLastWriteTime=0x40753e*(dwLowDateTime=0x914fba10, dwHighDateTime=0x1d4cb3a)) returned 1
	[0134.573] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.573] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x18552, lpOverlapped=0x0) returned 1
	[0134.575] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\ihFeRsxVwI9oz.docx") returned="ihFeRsxVwI9oz.docx"
	[0134.575] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.575] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x18552, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x18552, lpOverlapped=0x0) returned 1
	[0134.575] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.576] CloseHandle (hObject=0x20c) returned 1
	[0134.576] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\ihFeRsxVwI9oz.docx" (normalized: "c:\\users\\fd1hvy\\documents\\ihfersxvwi9oz.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\ihFeRsxVwI9oz.docx.exe" (normalized: "c:\\users\\fd1hvy\\documents\\ihfersxvwi9oz.docx.exe")) returned 1
	[0134.576] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfea39dc0, ftCreationTime.dwHighDateTime=0x1d4e200, ftLastAccessTime.dwLowDateTime=0x52686e10, ftLastAccessTime.dwHighDateTime=0x1d4c8d2, ftLastWriteTime.dwLowDateTime=0x52686e10, ftLastWriteTime.dwHighDateTime=0x1d4c8d2, nFileSizeHigh=0x0, nFileSizeLow=0xe501, dwReserved0=0x1c, dwReserved1=0x1, cFileName="KwaAVgn.docx", cAlternateFileName="KWAAVG~1.DOC")) returned 1
	[0134.576] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0134.577] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="KwaAVgn.docx") returned -1
	[0134.577] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="KwaAVgn.docx") returned -1
	[0134.577] lstrcmpiA (lpString1="", lpString2="KwaAVgn.docx") returned -1
	[0134.577] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\ihFeRsxVwI9oz.docx") returned="ihFeRsxVwI9oz.docx"
	[0134.577] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\"
	[0134.577] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned=""
	[0134.577] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.577] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\how-to-decrypt-files.htm")) returned 0x20
	[0134.577] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="KwaAVgn.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\KwaAVgn.docx") returned="C:\\Users\\FD1HVy\\Documents\\KwaAVgn.docx"
	[0134.577] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\KwaAVgn.docx", pszSpec="*.zip") returned 0
	[0134.577] lstrlenA (lpString="*.zip") returned 5
	[0134.577] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\KwaAVgn.docx", pszSpec="*.rar") returned 0
	[0134.577] lstrlenA (lpString="*.rar") returned 5
	[0134.577] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\KwaAVgn.docx", pszSpec="*.7z") returned 0
	[0134.577] lstrlenA (lpString="*.7z") returned 4
	[0134.577] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\KwaAVgn.docx", pszSpec="*.tar") returned 0
	[0134.577] lstrlenA (lpString="*.tar") returned 5
	[0134.577] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\KwaAVgn.docx", pszSpec="*.gzip") returned 0
	[0134.577] lstrlenA (lpString="*.gzip") returned 6
	[0134.577] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\KwaAVgn.docx", pszSpec="*.jpg") returned 0
	[0134.577] lstrlenA (lpString="*.jpg") returned 5
	[0134.577] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\KwaAVgn.docx", pszSpec="*.jpeg") returned 0
	[0134.577] lstrlenA (lpString="*.jpeg") returned 6
	[0134.577] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\KwaAVgn.docx", pszSpec="*.bmp") returned 0
	[0134.577] lstrlenA (lpString="*.bmp") returned 5
	[0134.577] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\KwaAVgn.docx", pszSpec="*.gif") returned 0
	[0134.577] lstrlenA (lpString="*.gif") returned 5
	[0134.577] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\KwaAVgn.docx", pszSpec="*.png") returned 0
	[0134.577] lstrlenA (lpString="*.png") returned 5
	[0134.577] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\KwaAVgn.docx", pszSpec="*.doc") returned 0
	[0134.577] lstrlenA (lpString="*.doc") returned 5
	[0134.578] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\KwaAVgn.docx", pszSpec="*.docx") returned 1
	[0134.578] lstrlenA (lpString="*.docx") returned 6
	[0134.578] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Documents\\KwaAVgn.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\KwaAVgn.docx") returned="C:\\Users\\FD1HVy\\Documents\\KwaAVgn.docx"
	[0134.578] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Documents\\KwaAVgn.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\KwaAVgn.docx") returned="C:\\Users\\FD1HVy\\Documents\\KwaAVgn.docx"
	[0134.578] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\KwaAVgn.docx", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Documents\\KwaAVgn.docx.") returned="C:\\Users\\FD1HVy\\Documents\\KwaAVgn.docx."
	[0134.578] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\KwaAVgn.docx.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\KwaAVgn.docx.exe") returned="C:\\Users\\FD1HVy\\Documents\\KwaAVgn.docx.exe"
	[0134.578] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\KwaAVgn.docx" (normalized: "c:\\users\\fd1hvy\\documents\\kwaavgn.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0134.578] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe501
	[0134.578] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xfea39dc0, dwHighDateTime=0x1d4e200), lpLastAccessTime=0x407536*(dwLowDateTime=0x52686e10, dwHighDateTime=0x1d4c8d2), lpLastWriteTime=0x40753e*(dwLowDateTime=0x52686e10, dwHighDateTime=0x1d4c8d2)) returned 1
	[0134.578] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.578] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xe4bf, lpOverlapped=0x0) returned 1
	[0134.579] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\KwaAVgn.docx") returned="KwaAVgn.docx"
	[0134.579] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.579] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xe4bf, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xe4bf, lpOverlapped=0x0) returned 1
	[0134.580] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.580] CloseHandle (hObject=0x20c) returned 1
	[0134.580] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\KwaAVgn.docx" (normalized: "c:\\users\\fd1hvy\\documents\\kwaavgn.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\KwaAVgn.docx.exe" (normalized: "c:\\users\\fd1hvy\\documents\\kwaavgn.docx.exe")) returned 1
	[0134.580] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd343e250, ftCreationTime.dwHighDateTime=0x1d4cc6d, ftLastAccessTime.dwLowDateTime=0xea241c70, ftLastAccessTime.dwHighDateTime=0x1d4cb59, ftLastWriteTime.dwLowDateTime=0xea241c70, ftLastWriteTime.dwHighDateTime=0x1d4cb59, nFileSizeHigh=0x0, nFileSizeLow=0x565a, dwReserved0=0x12, dwReserved1=0x1, cFileName="M4jUJc NoID.rtf", cAlternateFileName="M4JUJC~1.RTF")) returned 1
	[0134.581] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0134.581] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="M4jUJc NoID.rtf") returned -1
	[0134.581] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="M4jUJc NoID.rtf") returned -1
	[0134.581] lstrcmpiA (lpString1="", lpString2="M4jUJc NoID.rtf") returned -1
	[0134.581] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\KwaAVgn.docx") returned="KwaAVgn.docx"
	[0134.581] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\"
	[0134.581] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned=""
	[0134.581] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.581] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\how-to-decrypt-files.htm")) returned 0x20
	[0134.581] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="M4jUJc NoID.rtf" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf") returned="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf"
	[0134.581] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.zip") returned 0
	[0134.581] lstrlenA (lpString="*.zip") returned 5
	[0134.581] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.rar") returned 0
	[0134.581] lstrlenA (lpString="*.rar") returned 5
	[0134.581] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.7z") returned 0
	[0134.581] lstrlenA (lpString="*.7z") returned 4
	[0134.581] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.tar") returned 0
	[0134.581] lstrlenA (lpString="*.tar") returned 5
	[0134.581] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.gzip") returned 0
	[0134.581] lstrlenA (lpString="*.gzip") returned 6
	[0134.581] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.jpg") returned 0
	[0134.581] lstrlenA (lpString="*.jpg") returned 5
	[0134.581] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.jpeg") returned 0
	[0134.581] lstrlenA (lpString="*.jpeg") returned 6
	[0134.581] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.bmp") returned 0
	[0134.581] lstrlenA (lpString="*.bmp") returned 5
	[0134.581] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.gif") returned 0
	[0134.581] lstrlenA (lpString="*.gif") returned 5
	[0134.581] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.png") returned 0
	[0134.581] lstrlenA (lpString="*.png") returned 5
	[0134.581] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.doc") returned 0
	[0134.582] lstrlenA (lpString="*.doc") returned 5
	[0134.582] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.docx") returned 0
	[0134.582] lstrlenA (lpString="*.docx") returned 6
	[0134.582] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.xls") returned 0
	[0134.582] lstrlenA (lpString="*.xls") returned 5
	[0134.582] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.xlsx") returned 0
	[0134.582] lstrlenA (lpString="*.xlsx") returned 6
	[0134.582] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.ppt") returned 0
	[0134.582] lstrlenA (lpString="*.ppt") returned 5
	[0134.582] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.pptx") returned 0
	[0134.582] lstrlenA (lpString="*.pptx") returned 6
	[0134.582] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.txt") returned 0
	[0134.582] lstrlenA (lpString="*.txt") returned 5
	[0134.582] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.pdf") returned 0
	[0134.582] lstrlenA (lpString="*.pdf") returned 5
	[0134.582] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.htm") returned 0
	[0134.582] lstrlenA (lpString="*.htm") returned 5
	[0134.582] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.html") returned 0
	[0134.582] lstrlenA (lpString="*.html") returned 6
	[0134.582] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.mdb") returned 0
	[0134.582] lstrlenA (lpString="*.mdb") returned 5
	[0134.582] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.pfx") returned 0
	[0134.582] lstrlenA (lpString="*.pfx") returned 5
	[0134.582] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.md") returned 0
	[0134.582] lstrlenA (lpString="*.md") returned 4
	[0134.582] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.lnk") returned 0
	[0134.582] lstrlenA (lpString="*.lnk") returned 5
	[0134.582] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.torrent") returned 0
	[0134.582] lstrlenA (lpString="*.torrent") returned 9
	[0134.582] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.mov") returned 0
	[0134.582] lstrlenA (lpString="*.mov") returned 5
	[0134.582] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.3gp") returned 0
	[0134.582] lstrlenA (lpString="*.3gp") returned 5
	[0134.582] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.mpeg") returned 0
	[0134.583] lstrlenA (lpString="*.mpeg") returned 6
	[0134.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.mpg") returned 0
	[0134.583] lstrlenA (lpString="*.mpg") returned 5
	[0134.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.flv") returned 0
	[0134.583] lstrlenA (lpString="*.flv") returned 5
	[0134.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.avi") returned 0
	[0134.583] lstrlenA (lpString="*.avi") returned 5
	[0134.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.mp4") returned 0
	[0134.583] lstrlenA (lpString="*.mp4") returned 5
	[0134.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.wmv") returned 0
	[0134.583] lstrlenA (lpString="*.wmv") returned 5
	[0134.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.mkv") returned 0
	[0134.583] lstrlenA (lpString="*.mkv") returned 5
	[0134.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.mp3") returned 0
	[0134.583] lstrlenA (lpString="*.mp3") returned 5
	[0134.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.wav") returned 0
	[0134.583] lstrlenA (lpString="*.wav") returned 5
	[0134.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.flac") returned 0
	[0134.583] lstrlenA (lpString="*.flac") returned 6
	[0134.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.wma") returned 0
	[0134.583] lstrlenA (lpString="*.wma") returned 5
	[0134.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.au3") returned 0
	[0134.583] lstrlenA (lpString="*.au3") returned 5
	[0134.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.ahk") returned 0
	[0134.583] lstrlenA (lpString="*.ahk") returned 5
	[0134.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.c") returned 0
	[0134.583] lstrlenA (lpString="*.c") returned 3
	[0134.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.cc") returned 0
	[0134.583] lstrlenA (lpString="*.cc") returned 4
	[0134.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.cpp") returned 0
	[0134.583] lstrlenA (lpString="*.cpp") returned 5
	[0134.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.cxx") returned 0
	[0134.583] lstrlenA (lpString="*.cxx") returned 5
	[0134.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.c++") returned 0
	[0134.583] lstrlenA (lpString="*.c++") returned 5
	[0134.584] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.cs") returned 0
	[0134.584] lstrlenA (lpString="*.cs") returned 4
	[0134.584] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.vb") returned 0
	[0134.584] lstrlenA (lpString="*.vb") returned 4
	[0134.584] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.bas") returned 0
	[0134.584] lstrlenA (lpString="*.bas") returned 5
	[0134.584] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.csproj") returned 0
	[0134.584] lstrlenA (lpString="*.csproj") returned 8
	[0134.584] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.vbproj") returned 0
	[0134.584] lstrlenA (lpString="*.vbproj") returned 8
	[0134.584] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.vcxproj") returned 0
	[0134.584] lstrlenA (lpString="*.vcxproj") returned 9
	[0134.584] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.manifest") returned 0
	[0134.584] lstrlenA (lpString="*.manifest") returned 10
	[0134.584] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.php") returned 0
	[0134.584] lstrlenA (lpString="*.php") returned 5
	[0134.584] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.vbe") returned 0
	[0134.584] lstrlenA (lpString="*.vbe") returned 5
	[0134.584] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.vba") returned 0
	[0134.584] lstrlenA (lpString="*.vba") returned 5
	[0134.584] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.vbs") returned 0
	[0134.584] lstrlenA (lpString="*.vbs") returned 5
	[0134.584] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.bat") returned 0
	[0134.584] lstrlenA (lpString="*.bat") returned 5
	[0134.584] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.cmd") returned 0
	[0134.584] lstrlenA (lpString="*.cmd") returned 5
	[0134.584] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.js") returned 0
	[0134.584] lstrlenA (lpString="*.js") returned 4
	[0134.584] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.jscript") returned 0
	[0134.584] lstrlenA (lpString="*.jscript") returned 9
	[0134.584] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.hta") returned 0
	[0134.584] lstrlenA (lpString="*.hta") returned 5
	[0134.584] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.php7") returned 0
	[0134.584] lstrlenA (lpString="*.php7") returned 6
	[0134.585] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.db") returned 0
	[0134.585] lstrlenA (lpString="*.db") returned 4
	[0134.585] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.swf") returned 0
	[0134.585] lstrlenA (lpString="*.swf") returned 5
	[0134.585] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.eml") returned 0
	[0134.585] lstrlenA (lpString="*.eml") returned 5
	[0134.585] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.part") returned 0
	[0134.585] lstrlenA (lpString="*.part") returned 6
	[0134.585] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.nfo") returned 0
	[0134.585] lstrlenA (lpString="*.nfo") returned 5
	[0134.585] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.rsa") returned 0
	[0134.585] lstrlenA (lpString="*.rsa") returned 5
	[0134.585] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.key") returned 0
	[0134.585] lstrlenA (lpString="*.key") returned 5
	[0134.585] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.aes") returned 0
	[0134.585] lstrlenA (lpString="*.aes") returned 5
	[0134.585] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.blob") returned 0
	[0134.585] lstrlenA (lpString="*.blob") returned 6
	[0134.585] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.btc") returned 0
	[0134.585] lstrlenA (lpString="*.btc") returned 5
	[0134.585] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf", pszSpec="*.wallet") returned 0
	[0134.585] lstrlenA (lpString="*.wallet") returned 8
	[0134.585] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1
	[0134.585] lstrcmpA (lpString1=".", lpString2="My Music") returned -1
	[0134.585] lstrcmpA (lpString1="..", lpString2="My Music") returned -1
	[0134.585] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\M4jUJc NoID.rtf") returned="M4jUJc NoID.rtf"
	[0134.585] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="My Music" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Music") returned="C:\\Users\\FD1HVy\\Documents\\My Music"
	[0134.585] lstrlenA (lpString="C:\\Users\\FD1HVy\\Documents\\My Music") returned 34
	[0134.585] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Music\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x19f988, ftCreationTime.dwLowDateTime=0x7c5638, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x15, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x18, nFileSizeHigh=0x207d0, nFileSizeLow=0x0, dwReserved0=0x7ba9f8, dwReserved1=0x404476, cFileName="\x01", cAlternateFileName="\xcc\xff\x19")) returned 0xffffffff
	[0134.586] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1
	[0134.586] lstrcmpA (lpString1=".", lpString2="My Pictures") returned -1
	[0134.586] lstrcmpA (lpString1="..", lpString2="My Pictures") returned -1
	[0134.586] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\*.*") returned="*.*"
	[0134.586] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="My Pictures" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Pictures") returned="C:\\Users\\FD1HVy\\Documents\\My Pictures"
	[0134.586] lstrlenA (lpString="C:\\Users\\FD1HVy\\Documents\\My Pictures") returned 37
	[0134.586] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Pictures\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x19f988, ftCreationTime.dwLowDateTime=0x7c5638, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x15, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x18, nFileSizeHigh=0x207d0, nFileSizeLow=0x0, dwReserved0=0x7ba9f8, dwReserved1=0x404476, cFileName="\x01", cAlternateFileName="\xcc\xff\x19")) returned 0xffffffff
	[0134.586] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1
	[0134.586] lstrcmpA (lpString1=".", lpString2="My Shapes") returned -1
	[0134.586] lstrcmpA (lpString1="..", lpString2="My Shapes") returned -1
	[0134.586] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\*.*") returned="*.*"
	[0134.586] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="My Shapes" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes"
	[0134.586] lstrlenA (lpString="C:\\Users\\FD1HVy\\Documents\\My Shapes") returned 35
	[0134.586] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x78, cFileName=".", cAlternateFileName="")) returned 0x7cb6d0
	[0134.587] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0134.587] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x78, cFileName="..", cAlternateFileName="")) returned 1
	[0134.587] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0134.587] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0134.587] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x7b0000, dwReserved1=0x78, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0134.587] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0134.587] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="desktop.ini") returned 1
	[0134.587] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="desktop.ini") returned 1
	[0134.587] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1
	[0134.587] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\My Shapes\\*.*") returned="*.*"
	[0134.587] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\My Shapes\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\"
	[0134.587] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\My Shapes\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\My Shapes\\") returned=""
	[0134.587] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.587] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0134.588] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0134.589] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0134.589] WriteFile (in: hFile=0x210, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0134.590] SetFileTime (hFile=0x210, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0134.590] CloseHandle (hObject=0x210) returned 1
	[0134.590] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini"
	[0134.590] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.zip") returned 0
	[0134.590] lstrlenA (lpString="*.zip") returned 5
	[0134.590] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.rar") returned 0
	[0134.590] lstrlenA (lpString="*.rar") returned 5
	[0134.590] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.7z") returned 0
	[0134.591] lstrlenA (lpString="*.7z") returned 4
	[0134.591] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.tar") returned 0
	[0134.591] lstrlenA (lpString="*.tar") returned 5
	[0134.591] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.gzip") returned 0
	[0134.591] lstrlenA (lpString="*.gzip") returned 6
	[0134.591] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.jpg") returned 0
	[0134.591] lstrlenA (lpString="*.jpg") returned 5
	[0134.591] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.jpeg") returned 0
	[0134.591] lstrlenA (lpString="*.jpeg") returned 6
	[0134.591] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.bmp") returned 0
	[0134.591] lstrlenA (lpString="*.bmp") returned 5
	[0134.591] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.gif") returned 0
	[0134.591] lstrlenA (lpString="*.gif") returned 5
	[0134.591] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.png") returned 0
	[0134.591] lstrlenA (lpString="*.png") returned 5
	[0134.591] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.doc") returned 0
	[0134.591] lstrlenA (lpString="*.doc") returned 5
	[0134.591] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.docx") returned 0
	[0134.591] lstrlenA (lpString="*.docx") returned 6
	[0134.591] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.xls") returned 0
	[0134.591] lstrlenA (lpString="*.xls") returned 5
	[0134.591] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.xlsx") returned 0
	[0134.591] lstrlenA (lpString="*.xlsx") returned 6
	[0134.591] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.ppt") returned 0
	[0134.591] lstrlenA (lpString="*.ppt") returned 5
	[0134.591] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.pptx") returned 0
	[0134.591] lstrlenA (lpString="*.pptx") returned 6
	[0134.591] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.txt") returned 0
	[0134.591] lstrlenA (lpString="*.txt") returned 5
	[0134.591] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.pdf") returned 0
	[0134.591] lstrlenA (lpString="*.pdf") returned 5
	[0134.591] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.htm") returned 0
	[0134.591] lstrlenA (lpString="*.htm") returned 5
	[0134.591] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.html") returned 0
	[0134.592] lstrlenA (lpString="*.html") returned 6
	[0134.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.mdb") returned 0
	[0134.592] lstrlenA (lpString="*.mdb") returned 5
	[0134.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.pfx") returned 0
	[0134.592] lstrlenA (lpString="*.pfx") returned 5
	[0134.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.md") returned 0
	[0134.592] lstrlenA (lpString="*.md") returned 4
	[0134.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.lnk") returned 0
	[0134.592] lstrlenA (lpString="*.lnk") returned 5
	[0134.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.torrent") returned 0
	[0134.592] lstrlenA (lpString="*.torrent") returned 9
	[0134.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.mov") returned 0
	[0134.592] lstrlenA (lpString="*.mov") returned 5
	[0134.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.3gp") returned 0
	[0134.592] lstrlenA (lpString="*.3gp") returned 5
	[0134.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.mpeg") returned 0
	[0134.592] lstrlenA (lpString="*.mpeg") returned 6
	[0134.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.mpg") returned 0
	[0134.592] lstrlenA (lpString="*.mpg") returned 5
	[0134.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.flv") returned 0
	[0134.592] lstrlenA (lpString="*.flv") returned 5
	[0134.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.avi") returned 0
	[0134.592] lstrlenA (lpString="*.avi") returned 5
	[0134.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.mp4") returned 0
	[0134.592] lstrlenA (lpString="*.mp4") returned 5
	[0134.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.wmv") returned 0
	[0134.592] lstrlenA (lpString="*.wmv") returned 5
	[0134.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.mkv") returned 0
	[0134.592] lstrlenA (lpString="*.mkv") returned 5
	[0134.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.mp3") returned 0
	[0134.592] lstrlenA (lpString="*.mp3") returned 5
	[0134.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.wav") returned 0
	[0134.592] lstrlenA (lpString="*.wav") returned 5
	[0134.592] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.flac") returned 0
	[0134.592] lstrlenA (lpString="*.flac") returned 6
	[0134.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.wma") returned 0
	[0134.593] lstrlenA (lpString="*.wma") returned 5
	[0134.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.au3") returned 0
	[0134.593] lstrlenA (lpString="*.au3") returned 5
	[0134.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.ahk") returned 0
	[0134.593] lstrlenA (lpString="*.ahk") returned 5
	[0134.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.c") returned 0
	[0134.593] lstrlenA (lpString="*.c") returned 3
	[0134.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.cc") returned 0
	[0134.593] lstrlenA (lpString="*.cc") returned 4
	[0134.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.cpp") returned 0
	[0134.593] lstrlenA (lpString="*.cpp") returned 5
	[0134.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.cxx") returned 0
	[0134.593] lstrlenA (lpString="*.cxx") returned 5
	[0134.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.c++") returned 0
	[0134.593] lstrlenA (lpString="*.c++") returned 5
	[0134.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.cs") returned 0
	[0134.593] lstrlenA (lpString="*.cs") returned 4
	[0134.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.vb") returned 0
	[0134.593] lstrlenA (lpString="*.vb") returned 4
	[0134.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.bas") returned 0
	[0134.593] lstrlenA (lpString="*.bas") returned 5
	[0134.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.csproj") returned 0
	[0134.593] lstrlenA (lpString="*.csproj") returned 8
	[0134.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.vbproj") returned 0
	[0134.593] lstrlenA (lpString="*.vbproj") returned 8
	[0134.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.vcxproj") returned 0
	[0134.593] lstrlenA (lpString="*.vcxproj") returned 9
	[0134.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.manifest") returned 0
	[0134.593] lstrlenA (lpString="*.manifest") returned 10
	[0134.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.php") returned 0
	[0134.593] lstrlenA (lpString="*.php") returned 5
	[0134.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.vbe") returned 0
	[0134.593] lstrlenA (lpString="*.vbe") returned 5
	[0134.593] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.vba") returned 0
	[0134.594] lstrlenA (lpString="*.vba") returned 5
	[0134.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.vbs") returned 0
	[0134.594] lstrlenA (lpString="*.vbs") returned 5
	[0134.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.bat") returned 0
	[0134.594] lstrlenA (lpString="*.bat") returned 5
	[0134.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.cmd") returned 0
	[0134.594] lstrlenA (lpString="*.cmd") returned 5
	[0134.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.js") returned 0
	[0134.594] lstrlenA (lpString="*.js") returned 4
	[0134.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.jscript") returned 0
	[0134.594] lstrlenA (lpString="*.jscript") returned 9
	[0134.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.hta") returned 0
	[0134.594] lstrlenA (lpString="*.hta") returned 5
	[0134.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.php7") returned 0
	[0134.594] lstrlenA (lpString="*.php7") returned 6
	[0134.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.db") returned 0
	[0134.594] lstrlenA (lpString="*.db") returned 4
	[0134.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.swf") returned 0
	[0134.594] lstrlenA (lpString="*.swf") returned 5
	[0134.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.eml") returned 0
	[0134.594] lstrlenA (lpString="*.eml") returned 5
	[0134.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.part") returned 0
	[0134.594] lstrlenA (lpString="*.part") returned 6
	[0134.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.nfo") returned 0
	[0134.594] lstrlenA (lpString="*.nfo") returned 5
	[0134.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.rsa") returned 0
	[0134.594] lstrlenA (lpString="*.rsa") returned 5
	[0134.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.key") returned 0
	[0134.594] lstrlenA (lpString="*.key") returned 5
	[0134.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.aes") returned 0
	[0134.594] lstrlenA (lpString="*.aes") returned 5
	[0134.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.blob") returned 0
	[0134.594] lstrlenA (lpString="*.blob") returned 6
	[0134.595] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.btc") returned 0
	[0134.595] lstrlenA (lpString="*.btc") returned 5
	[0134.595] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", pszSpec="*.wallet") returned 0
	[0134.595] lstrlenA (lpString="*.wallet") returned 8
	[0134.595] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1a0f60e, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1a0f60e, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="Favorites.vssx", cAlternateFileName="FAVORI~1.VSS")) returned 1
	[0134.595] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0134.595] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Favorites.vssx") returned -1
	[0134.595] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Favorites.vssx") returned 1
	[0134.595] lstrcmpiA (lpString1="", lpString2="Favorites.vssx") returned -1
	[0134.595] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini") returned="desktop.ini"
	[0134.595] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\My Shapes\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\"
	[0134.595] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\My Shapes\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\My Shapes\\") returned=""
	[0134.595] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.595] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\how-to-decrypt-files.htm")) returned 0x20
	[0134.595] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\", lpString2="Favorites.vssx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx"
	[0134.595] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.zip") returned 0
	[0134.595] lstrlenA (lpString="*.zip") returned 5
	[0134.595] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.rar") returned 0
	[0134.595] lstrlenA (lpString="*.rar") returned 5
	[0134.595] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.7z") returned 0
	[0134.595] lstrlenA (lpString="*.7z") returned 4
	[0134.595] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.tar") returned 0
	[0134.595] lstrlenA (lpString="*.tar") returned 5
	[0134.595] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.gzip") returned 0
	[0134.595] lstrlenA (lpString="*.gzip") returned 6
	[0134.595] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.jpg") returned 0
	[0134.595] lstrlenA (lpString="*.jpg") returned 5
	[0134.595] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.jpeg") returned 0
	[0134.595] lstrlenA (lpString="*.jpeg") returned 6
	[0134.595] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.bmp") returned 0
	[0134.596] lstrlenA (lpString="*.bmp") returned 5
	[0134.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.gif") returned 0
	[0134.596] lstrlenA (lpString="*.gif") returned 5
	[0134.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.png") returned 0
	[0134.596] lstrlenA (lpString="*.png") returned 5
	[0134.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.doc") returned 0
	[0134.596] lstrlenA (lpString="*.doc") returned 5
	[0134.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.docx") returned 0
	[0134.596] lstrlenA (lpString="*.docx") returned 6
	[0134.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.xls") returned 0
	[0134.596] lstrlenA (lpString="*.xls") returned 5
	[0134.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.xlsx") returned 0
	[0134.596] lstrlenA (lpString="*.xlsx") returned 6
	[0134.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.ppt") returned 0
	[0134.596] lstrlenA (lpString="*.ppt") returned 5
	[0134.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.pptx") returned 0
	[0134.596] lstrlenA (lpString="*.pptx") returned 6
	[0134.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.txt") returned 0
	[0134.596] lstrlenA (lpString="*.txt") returned 5
	[0134.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.pdf") returned 0
	[0134.596] lstrlenA (lpString="*.pdf") returned 5
	[0134.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.htm") returned 0
	[0134.596] lstrlenA (lpString="*.htm") returned 5
	[0134.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.html") returned 0
	[0134.596] lstrlenA (lpString="*.html") returned 6
	[0134.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.mdb") returned 0
	[0134.596] lstrlenA (lpString="*.mdb") returned 5
	[0134.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.pfx") returned 0
	[0134.596] lstrlenA (lpString="*.pfx") returned 5
	[0134.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.md") returned 0
	[0134.596] lstrlenA (lpString="*.md") returned 4
	[0134.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.lnk") returned 0
	[0134.596] lstrlenA (lpString="*.lnk") returned 5
	[0134.596] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.torrent") returned 0
	[0134.596] lstrlenA (lpString="*.torrent") returned 9
	[0134.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.mov") returned 0
	[0134.597] lstrlenA (lpString="*.mov") returned 5
	[0134.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.3gp") returned 0
	[0134.597] lstrlenA (lpString="*.3gp") returned 5
	[0134.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.mpeg") returned 0
	[0134.597] lstrlenA (lpString="*.mpeg") returned 6
	[0134.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.mpg") returned 0
	[0134.597] lstrlenA (lpString="*.mpg") returned 5
	[0134.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.flv") returned 0
	[0134.597] lstrlenA (lpString="*.flv") returned 5
	[0134.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.avi") returned 0
	[0134.597] lstrlenA (lpString="*.avi") returned 5
	[0134.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.mp4") returned 0
	[0134.597] lstrlenA (lpString="*.mp4") returned 5
	[0134.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.wmv") returned 0
	[0134.597] lstrlenA (lpString="*.wmv") returned 5
	[0134.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.mkv") returned 0
	[0134.597] lstrlenA (lpString="*.mkv") returned 5
	[0134.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.mp3") returned 0
	[0134.597] lstrlenA (lpString="*.mp3") returned 5
	[0134.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.wav") returned 0
	[0134.597] lstrlenA (lpString="*.wav") returned 5
	[0134.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.flac") returned 0
	[0134.597] lstrlenA (lpString="*.flac") returned 6
	[0134.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.wma") returned 0
	[0134.597] lstrlenA (lpString="*.wma") returned 5
	[0134.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.au3") returned 0
	[0134.597] lstrlenA (lpString="*.au3") returned 5
	[0134.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.ahk") returned 0
	[0134.597] lstrlenA (lpString="*.ahk") returned 5
	[0134.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.c") returned 0
	[0134.597] lstrlenA (lpString="*.c") returned 3
	[0134.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.cc") returned 0
	[0134.597] lstrlenA (lpString="*.cc") returned 4
	[0134.598] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.cpp") returned 0
	[0134.598] lstrlenA (lpString="*.cpp") returned 5
	[0134.598] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.cxx") returned 0
	[0134.598] lstrlenA (lpString="*.cxx") returned 5
	[0134.598] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.c++") returned 0
	[0134.598] lstrlenA (lpString="*.c++") returned 5
	[0134.598] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.cs") returned 0
	[0134.598] lstrlenA (lpString="*.cs") returned 4
	[0134.598] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.vb") returned 0
	[0134.598] lstrlenA (lpString="*.vb") returned 4
	[0134.598] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.bas") returned 0
	[0134.598] lstrlenA (lpString="*.bas") returned 5
	[0134.598] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.csproj") returned 0
	[0134.598] lstrlenA (lpString="*.csproj") returned 8
	[0134.598] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.vbproj") returned 0
	[0134.598] lstrlenA (lpString="*.vbproj") returned 8
	[0134.598] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.vcxproj") returned 0
	[0134.598] lstrlenA (lpString="*.vcxproj") returned 9
	[0134.598] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.manifest") returned 0
	[0134.598] lstrlenA (lpString="*.manifest") returned 10
	[0134.598] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.php") returned 0
	[0134.598] lstrlenA (lpString="*.php") returned 5
	[0134.598] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.vbe") returned 0
	[0134.598] lstrlenA (lpString="*.vbe") returned 5
	[0134.598] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.vba") returned 0
	[0134.598] lstrlenA (lpString="*.vba") returned 5
	[0134.598] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.vbs") returned 0
	[0134.598] lstrlenA (lpString="*.vbs") returned 5
	[0134.598] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.bat") returned 0
	[0134.598] lstrlenA (lpString="*.bat") returned 5
	[0134.598] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.cmd") returned 0
	[0134.598] lstrlenA (lpString="*.cmd") returned 5
	[0134.598] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.js") returned 0
	[0134.598] lstrlenA (lpString="*.js") returned 4
	[0134.599] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.jscript") returned 0
	[0134.599] lstrlenA (lpString="*.jscript") returned 9
	[0134.599] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.hta") returned 0
	[0134.599] lstrlenA (lpString="*.hta") returned 5
	[0134.599] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.php7") returned 0
	[0134.599] lstrlenA (lpString="*.php7") returned 6
	[0134.599] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.db") returned 0
	[0134.599] lstrlenA (lpString="*.db") returned 4
	[0134.599] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.swf") returned 0
	[0134.599] lstrlenA (lpString="*.swf") returned 5
	[0134.599] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.eml") returned 0
	[0134.599] lstrlenA (lpString="*.eml") returned 5
	[0134.599] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.part") returned 0
	[0134.599] lstrlenA (lpString="*.part") returned 6
	[0134.599] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.nfo") returned 0
	[0134.599] lstrlenA (lpString="*.nfo") returned 5
	[0134.599] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.rsa") returned 0
	[0134.599] lstrlenA (lpString="*.rsa") returned 5
	[0134.599] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.key") returned 0
	[0134.599] lstrlenA (lpString="*.key") returned 5
	[0134.599] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.aes") returned 0
	[0134.599] lstrlenA (lpString="*.aes") returned 5
	[0134.599] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.blob") returned 0
	[0134.599] lstrlenA (lpString="*.blob") returned 6
	[0134.599] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.btc") returned 0
	[0134.599] lstrlenA (lpString="*.btc") returned 5
	[0134.599] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", pszSpec="*.wallet") returned 0
	[0134.599] lstrlenA (lpString="*.wallet") returned 8
	[0134.599] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1
	[0134.599] lstrcmpA (lpString1=".", lpString2="_private") returned -1
	[0134.599] lstrcmpA (lpString1="..", lpString2="_private") returned -1
	[0134.599] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx") returned="Favorites.vssx"
	[0134.599] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\", lpString2="_private" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private"
	[0134.600] lstrlenA (lpString="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private") returned 44
	[0134.600] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x90, cFileName=".", cAlternateFileName="")) returned 0x7cbad0
	[0134.600] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0134.600] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x90, cFileName="..", cAlternateFileName="")) returned 1
	[0134.600] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0134.600] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0134.600] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x7b0000, dwReserved1=0x90, cFileName="folder.ico", cAlternateFileName="")) returned 1
	[0134.600] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0134.600] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="folder.ico") returned -1
	[0134.601] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="folder.ico") returned 1
	[0134.601] lstrcmpiA (lpString1="", lpString2="folder.ico") returned -1
	[0134.601] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\*.*") returned="*.*"
	[0134.601] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\"
	[0134.601] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\") returned=""
	[0134.601] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.601] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0134.601] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0134.601] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0134.601] WriteFile (in: hFile=0x214, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0134.602] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0134.602] CloseHandle (hObject=0x214) returned 1
	[0134.602] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\", lpString2="folder.ico" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico"
	[0134.603] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.zip") returned 0
	[0134.603] lstrlenA (lpString="*.zip") returned 5
	[0134.603] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.rar") returned 0
	[0134.603] lstrlenA (lpString="*.rar") returned 5
	[0134.603] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.7z") returned 0
	[0134.603] lstrlenA (lpString="*.7z") returned 4
	[0134.603] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.tar") returned 0
	[0134.603] lstrlenA (lpString="*.tar") returned 5
	[0134.603] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.gzip") returned 0
	[0134.603] lstrlenA (lpString="*.gzip") returned 6
	[0134.603] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.jpg") returned 0
	[0134.603] lstrlenA (lpString="*.jpg") returned 5
	[0134.603] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.jpeg") returned 0
	[0134.603] lstrlenA (lpString="*.jpeg") returned 6
	[0134.603] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.bmp") returned 0
	[0134.603] lstrlenA (lpString="*.bmp") returned 5
	[0134.603] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.gif") returned 0
	[0134.603] lstrlenA (lpString="*.gif") returned 5
	[0134.603] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.png") returned 0
	[0134.603] lstrlenA (lpString="*.png") returned 5
	[0134.603] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.doc") returned 0
	[0134.603] lstrlenA (lpString="*.doc") returned 5
	[0134.603] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.docx") returned 0
	[0134.603] lstrlenA (lpString="*.docx") returned 6
	[0134.603] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.xls") returned 0
	[0134.603] lstrlenA (lpString="*.xls") returned 5
	[0134.603] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.xlsx") returned 0
	[0134.603] lstrlenA (lpString="*.xlsx") returned 6
	[0134.603] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.ppt") returned 0
	[0134.603] lstrlenA (lpString="*.ppt") returned 5
	[0134.603] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.pptx") returned 0
	[0134.603] lstrlenA (lpString="*.pptx") returned 6
	[0134.603] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.txt") returned 0
	[0134.603] lstrlenA (lpString="*.txt") returned 5
	[0134.604] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.pdf") returned 0
	[0134.604] lstrlenA (lpString="*.pdf") returned 5
	[0134.604] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.htm") returned 0
	[0134.604] lstrlenA (lpString="*.htm") returned 5
	[0134.604] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.html") returned 0
	[0134.604] lstrlenA (lpString="*.html") returned 6
	[0134.604] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.mdb") returned 0
	[0134.604] lstrlenA (lpString="*.mdb") returned 5
	[0134.604] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.pfx") returned 0
	[0134.604] lstrlenA (lpString="*.pfx") returned 5
	[0134.604] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.md") returned 0
	[0134.604] lstrlenA (lpString="*.md") returned 4
	[0134.604] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.lnk") returned 0
	[0134.604] lstrlenA (lpString="*.lnk") returned 5
	[0134.604] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.torrent") returned 0
	[0134.604] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.mov") returned 0
	[0134.604] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.3gp") returned 0
	[0134.604] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.mpeg") returned 0
	[0134.604] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.mpg") returned 0
	[0134.604] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.flv") returned 0
	[0134.604] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.avi") returned 0
	[0134.604] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.mp4") returned 0
	[0134.604] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.wmv") returned 0
	[0134.604] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.mkv") returned 0
	[0134.604] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.mp3") returned 0
	[0134.604] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.wav") returned 0
	[0134.604] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.flac") returned 0
	[0134.604] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.wma") returned 0
	[0134.604] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.au3") returned 0
	[0134.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.ahk") returned 0
	[0134.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.c") returned 0
	[0134.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.cc") returned 0
	[0134.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.cpp") returned 0
	[0134.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.cxx") returned 0
	[0134.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.c++") returned 0
	[0134.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.cs") returned 0
	[0134.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.vb") returned 0
	[0134.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.bas") returned 0
	[0134.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.csproj") returned 0
	[0134.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.vbproj") returned 0
	[0134.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.vcxproj") returned 0
	[0134.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.manifest") returned 0
	[0134.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.php") returned 0
	[0134.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.vbe") returned 0
	[0134.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.vba") returned 0
	[0134.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.vbs") returned 0
	[0134.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.bat") returned 0
	[0134.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.cmd") returned 0
	[0134.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.js") returned 0
	[0134.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.jscript") returned 0
	[0134.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.hta") returned 0
	[0134.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.php7") returned 0
	[0134.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.db") returned 0
	[0134.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.swf") returned 0
	[0134.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.eml") returned 0
	[0134.606] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.part") returned 0
	[0134.606] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.nfo") returned 0
	[0134.606] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.rsa") returned 0
	[0134.606] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.key") returned 0
	[0134.606] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.aes") returned 0
	[0134.606] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.blob") returned 0
	[0134.606] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.btc") returned 0
	[0134.606] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.wallet") returned 0
	[0134.606] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x7b0000, dwReserved1=0x90, cFileName="folder.ico", cAlternateFileName="")) returned 0
	[0134.606] FindClose (in: hFindFile=0x7cbad0 | out: hFindFile=0x7cbad0) returned 1
	[0134.606] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0
	[0134.606] FindClose (in: hFindFile=0x7cb6d0 | out: hFindFile=0x7cb6d0) returned 1
	[0134.609] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1
	[0134.609] lstrcmpA (lpString1=".", lpString2="My Videos") returned -1
	[0134.609] lstrcmpA (lpString1="..", lpString2="My Videos") returned -1
	[0134.609] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\*.*") returned="*.*"
	[0134.609] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="My Videos" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Videos") returned="C:\\Users\\FD1HVy\\Documents\\My Videos"
	[0134.609] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Videos\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="\xcc\xff\x19")) returned 0xffffffff
	[0134.609] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bb372b0, ftCreationTime.dwHighDateTime=0x1d4b70d, ftLastAccessTime.dwLowDateTime=0xf8183950, ftLastAccessTime.dwHighDateTime=0x1d4da46, ftLastWriteTime.dwLowDateTime=0xf8183950, ftLastWriteTime.dwHighDateTime=0x1d4da46, nFileSizeHigh=0x0, nFileSizeLow=0x727a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nJAwaxOmRmde_9.xlsx", cAlternateFileName="NJAWAX~1.XLS")) returned 1
	[0134.609] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0134.610] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="nJAwaxOmRmde_9.xlsx") returned -1
	[0134.610] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="nJAwaxOmRmde_9.xlsx") returned -1
	[0134.610] lstrcmpiA (lpString1="", lpString2="nJAwaxOmRmde_9.xlsx") returned -1
	[0134.610] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\*.*") returned="*.*"
	[0134.610] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\"
	[0134.610] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned=""
	[0134.610] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.610] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\how-to-decrypt-files.htm")) returned 0x20
	[0134.610] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="nJAwaxOmRmde_9.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\nJAwaxOmRmde_9.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\nJAwaxOmRmde_9.xlsx"
	[0134.610] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\nJAwaxOmRmde_9.xlsx", pszSpec="*.zip") returned 0
	[0134.610] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\nJAwaxOmRmde_9.xlsx", pszSpec="*.rar") returned 0
	[0134.610] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\nJAwaxOmRmde_9.xlsx", pszSpec="*.7z") returned 0
	[0134.610] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\nJAwaxOmRmde_9.xlsx", pszSpec="*.tar") returned 0
	[0134.610] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\nJAwaxOmRmde_9.xlsx", pszSpec="*.gzip") returned 0
	[0134.610] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\nJAwaxOmRmde_9.xlsx", pszSpec="*.jpg") returned 0
	[0134.610] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\nJAwaxOmRmde_9.xlsx", pszSpec="*.jpeg") returned 0
	[0134.610] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\nJAwaxOmRmde_9.xlsx", pszSpec="*.bmp") returned 0
	[0134.610] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\nJAwaxOmRmde_9.xlsx", pszSpec="*.gif") returned 0
	[0134.610] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\nJAwaxOmRmde_9.xlsx", pszSpec="*.png") returned 0
	[0134.610] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\nJAwaxOmRmde_9.xlsx", pszSpec="*.doc") returned 0
	[0134.610] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\nJAwaxOmRmde_9.xlsx", pszSpec="*.docx") returned 0
	[0134.610] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\nJAwaxOmRmde_9.xlsx", pszSpec="*.xls") returned 0
	[0134.610] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\nJAwaxOmRmde_9.xlsx", pszSpec="*.xlsx") returned 1
	[0134.610] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Documents\\nJAwaxOmRmde_9.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\nJAwaxOmRmde_9.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\nJAwaxOmRmde_9.xlsx"
	[0134.610] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Documents\\nJAwaxOmRmde_9.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\nJAwaxOmRmde_9.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\nJAwaxOmRmde_9.xlsx"
	[0134.610] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\nJAwaxOmRmde_9.xlsx", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Documents\\nJAwaxOmRmde_9.xlsx.") returned="C:\\Users\\FD1HVy\\Documents\\nJAwaxOmRmde_9.xlsx."
	[0134.611] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\nJAwaxOmRmde_9.xlsx.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\nJAwaxOmRmde_9.xlsx.exe") returned="C:\\Users\\FD1HVy\\Documents\\nJAwaxOmRmde_9.xlsx.exe"
	[0134.611] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\nJAwaxOmRmde_9.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\njawaxomrmde_9.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0134.611] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x727a
	[0134.611] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1bb372b0, dwHighDateTime=0x1d4b70d), lpLastAccessTime=0x407536*(dwLowDateTime=0xf8183950, dwHighDateTime=0x1d4da46), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf8183950, dwHighDateTime=0x1d4da46)) returned 1
	[0134.611] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.611] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7238, lpOverlapped=0x0) returned 1
	[0134.612] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\nJAwaxOmRmde_9.xlsx") returned="nJAwaxOmRmde_9.xlsx"
	[0134.612] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.612] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7238, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7238, lpOverlapped=0x0) returned 1
	[0134.612] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.612] CloseHandle (hObject=0x20c) returned 1
	[0134.612] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nJAwaxOmRmde_9.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\njawaxomrmde_9.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nJAwaxOmRmde_9.xlsx.exe" (normalized: "c:\\users\\fd1hvy\\documents\\njawaxomrmde_9.xlsx.exe")) returned 1
	[0134.613] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cbc4f70, ftCreationTime.dwHighDateTime=0x1d4ed8d, ftLastAccessTime.dwLowDateTime=0x15bb0400, ftLastAccessTime.dwHighDateTime=0x1d530fb, ftLastWriteTime.dwLowDateTime=0x15bb0400, ftLastWriteTime.dwHighDateTime=0x1d530fb, nFileSizeHigh=0x0, nFileSizeLow=0x12ccb, dwReserved0=0x0, dwReserved1=0x1, cFileName="NjHN_ZTDMB_vAZc.xlsx", cAlternateFileName="NJHN_Z~1.XLS")) returned 1
	[0134.613] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0134.613] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NjHN_ZTDMB_vAZc.xlsx") returned -1
	[0134.613] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NjHN_ZTDMB_vAZc.xlsx") returned -1
	[0134.613] lstrcmpiA (lpString1="", lpString2="NjHN_ZTDMB_vAZc.xlsx") returned -1
	[0134.613] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\nJAwaxOmRmde_9.xlsx") returned="nJAwaxOmRmde_9.xlsx"
	[0134.613] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\"
	[0134.613] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned=""
	[0134.613] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.613] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\how-to-decrypt-files.htm")) returned 0x20
	[0134.613] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="NjHN_ZTDMB_vAZc.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\NjHN_ZTDMB_vAZc.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\NjHN_ZTDMB_vAZc.xlsx"
	[0134.613] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\NjHN_ZTDMB_vAZc.xlsx", pszSpec="*.zip") returned 0
	[0134.614] lstrlenA (lpString="*.zip") returned 5
	[0134.614] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\NjHN_ZTDMB_vAZc.xlsx", pszSpec="*.rar") returned 0
	[0134.614] lstrlenA (lpString="*.rar") returned 5
	[0134.614] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\NjHN_ZTDMB_vAZc.xlsx", pszSpec="*.7z") returned 0
	[0134.614] lstrlenA (lpString="*.7z") returned 4
	[0134.614] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\NjHN_ZTDMB_vAZc.xlsx", pszSpec="*.tar") returned 0
	[0134.614] lstrlenA (lpString="*.tar") returned 5
	[0134.614] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\NjHN_ZTDMB_vAZc.xlsx", pszSpec="*.gzip") returned 0
	[0134.614] lstrlenA (lpString="*.gzip") returned 6
	[0134.614] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\NjHN_ZTDMB_vAZc.xlsx", pszSpec="*.jpg") returned 0
	[0134.614] lstrlenA (lpString="*.jpg") returned 5
	[0134.614] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\NjHN_ZTDMB_vAZc.xlsx", pszSpec="*.jpeg") returned 0
	[0134.614] lstrlenA (lpString="*.jpeg") returned 6
	[0134.614] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\NjHN_ZTDMB_vAZc.xlsx", pszSpec="*.bmp") returned 0
	[0134.614] lstrlenA (lpString="*.bmp") returned 5
	[0134.614] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\NjHN_ZTDMB_vAZc.xlsx", pszSpec="*.gif") returned 0
	[0134.614] lstrlenA (lpString="*.gif") returned 5
	[0134.614] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\NjHN_ZTDMB_vAZc.xlsx", pszSpec="*.png") returned 0
	[0134.614] lstrlenA (lpString="*.png") returned 5
	[0134.614] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\NjHN_ZTDMB_vAZc.xlsx", pszSpec="*.doc") returned 0
	[0134.614] lstrlenA (lpString="*.doc") returned 5
	[0134.614] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\NjHN_ZTDMB_vAZc.xlsx", pszSpec="*.docx") returned 0
	[0134.614] lstrlenA (lpString="*.docx") returned 6
	[0134.614] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\NjHN_ZTDMB_vAZc.xlsx", pszSpec="*.xls") returned 0
	[0134.614] lstrlenA (lpString="*.xls") returned 5
	[0134.614] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\NjHN_ZTDMB_vAZc.xlsx", pszSpec="*.xlsx") returned 1
	[0134.614] lstrlenA (lpString="*.xlsx") returned 6
	[0134.614] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Documents\\NjHN_ZTDMB_vAZc.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\NjHN_ZTDMB_vAZc.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\NjHN_ZTDMB_vAZc.xlsx"
	[0134.614] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Documents\\NjHN_ZTDMB_vAZc.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\NjHN_ZTDMB_vAZc.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\NjHN_ZTDMB_vAZc.xlsx"
	[0134.614] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\NjHN_ZTDMB_vAZc.xlsx", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Documents\\NjHN_ZTDMB_vAZc.xlsx.") returned="C:\\Users\\FD1HVy\\Documents\\NjHN_ZTDMB_vAZc.xlsx."
	[0134.614] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\NjHN_ZTDMB_vAZc.xlsx.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\NjHN_ZTDMB_vAZc.xlsx.exe") returned="C:\\Users\\FD1HVy\\Documents\\NjHN_ZTDMB_vAZc.xlsx.exe"
	[0134.614] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\NjHN_ZTDMB_vAZc.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\njhn_ztdmb_vazc.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0134.615] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12ccb
	[0134.615] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8cbc4f70, dwHighDateTime=0x1d4ed8d), lpLastAccessTime=0x407536*(dwLowDateTime=0x15bb0400, dwHighDateTime=0x1d530fb), lpLastWriteTime=0x40753e*(dwLowDateTime=0x15bb0400, dwHighDateTime=0x1d530fb)) returned 1
	[0134.615] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.615] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x12c89, lpOverlapped=0x0) returned 1
	[0134.616] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\NjHN_ZTDMB_vAZc.xlsx") returned="NjHN_ZTDMB_vAZc.xlsx"
	[0134.616] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.616] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x12c89, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x12c89, lpOverlapped=0x0) returned 1
	[0134.617] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.617] CloseHandle (hObject=0x20c) returned 1
	[0134.643] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\NjHN_ZTDMB_vAZc.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\njhn_ztdmb_vazc.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\NjHN_ZTDMB_vAZc.xlsx.exe" (normalized: "c:\\users\\fd1hvy\\documents\\njhn_ztdmb_vazc.xlsx.exe")) returned 1
	[0134.644] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2422820, ftCreationTime.dwHighDateTime=0x1d4d46e, ftLastAccessTime.dwLowDateTime=0x4e635920, ftLastAccessTime.dwHighDateTime=0x1d4c999, ftLastWriteTime.dwLowDateTime=0x4e635920, ftLastWriteTime.dwHighDateTime=0x1d4c999, nFileSizeHigh=0x0, nFileSizeLow=0xdfde, dwReserved0=0x0, dwReserved1=0x1, cFileName="OoY2uDPOVdHwL7.doc", cAlternateFileName="OOY2UD~1.DOC")) returned 1
	[0134.644] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0134.644] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="OoY2uDPOVdHwL7.doc") returned -1
	[0134.644] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="OoY2uDPOVdHwL7.doc") returned -1
	[0134.644] lstrcmpiA (lpString1="", lpString2="OoY2uDPOVdHwL7.doc") returned -1
	[0134.644] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\NjHN_ZTDMB_vAZc.xlsx") returned="NjHN_ZTDMB_vAZc.xlsx"
	[0134.644] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\"
	[0134.644] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned=""
	[0134.644] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.644] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\how-to-decrypt-files.htm")) returned 0x20
	[0134.644] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="OoY2uDPOVdHwL7.doc" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\OoY2uDPOVdHwL7.doc") returned="C:\\Users\\FD1HVy\\Documents\\OoY2uDPOVdHwL7.doc"
	[0134.644] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\OoY2uDPOVdHwL7.doc", pszSpec="*.zip") returned 0
	[0134.644] lstrlenA (lpString="*.zip") returned 5
	[0134.644] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\OoY2uDPOVdHwL7.doc", pszSpec="*.rar") returned 0
	[0134.644] lstrlenA (lpString="*.rar") returned 5
	[0134.644] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\OoY2uDPOVdHwL7.doc", pszSpec="*.7z") returned 0
	[0134.644] lstrlenA (lpString="*.7z") returned 4
	[0134.644] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\OoY2uDPOVdHwL7.doc", pszSpec="*.tar") returned 0
	[0134.644] lstrlenA (lpString="*.tar") returned 5
	[0134.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\OoY2uDPOVdHwL7.doc", pszSpec="*.gzip") returned 0
	[0134.645] lstrlenA (lpString="*.gzip") returned 6
	[0134.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\OoY2uDPOVdHwL7.doc", pszSpec="*.jpg") returned 0
	[0134.645] lstrlenA (lpString="*.jpg") returned 5
	[0134.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\OoY2uDPOVdHwL7.doc", pszSpec="*.jpeg") returned 0
	[0134.645] lstrlenA (lpString="*.jpeg") returned 6
	[0134.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\OoY2uDPOVdHwL7.doc", pszSpec="*.bmp") returned 0
	[0134.645] lstrlenA (lpString="*.bmp") returned 5
	[0134.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\OoY2uDPOVdHwL7.doc", pszSpec="*.gif") returned 0
	[0134.645] lstrlenA (lpString="*.gif") returned 5
	[0134.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\OoY2uDPOVdHwL7.doc", pszSpec="*.png") returned 0
	[0134.645] lstrlenA (lpString="*.png") returned 5
	[0134.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\OoY2uDPOVdHwL7.doc", pszSpec="*.doc") returned 1
	[0134.645] lstrlenA (lpString="*.doc") returned 5
	[0134.645] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Documents\\OoY2uDPOVdHwL7.doc" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\OoY2uDPOVdHwL7.doc") returned="C:\\Users\\FD1HVy\\Documents\\OoY2uDPOVdHwL7.doc"
	[0134.645] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Documents\\OoY2uDPOVdHwL7.doc" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\OoY2uDPOVdHwL7.doc") returned="C:\\Users\\FD1HVy\\Documents\\OoY2uDPOVdHwL7.doc"
	[0134.645] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\OoY2uDPOVdHwL7.doc", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Documents\\OoY2uDPOVdHwL7.doc.") returned="C:\\Users\\FD1HVy\\Documents\\OoY2uDPOVdHwL7.doc."
	[0134.645] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\OoY2uDPOVdHwL7.doc.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\OoY2uDPOVdHwL7.doc.exe") returned="C:\\Users\\FD1HVy\\Documents\\OoY2uDPOVdHwL7.doc.exe"
	[0134.645] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\OoY2uDPOVdHwL7.doc" (normalized: "c:\\users\\fd1hvy\\documents\\ooy2udpovdhwl7.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0134.645] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdfde
	[0134.645] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf2422820, dwHighDateTime=0x1d4d46e), lpLastAccessTime=0x407536*(dwLowDateTime=0x4e635920, dwHighDateTime=0x1d4c999), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4e635920, dwHighDateTime=0x1d4c999)) returned 1
	[0134.645] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.646] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xdf9c, lpOverlapped=0x0) returned 1
	[0134.647] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\OoY2uDPOVdHwL7.doc") returned="OoY2uDPOVdHwL7.doc"
	[0134.647] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.647] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xdf9c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xdf9c, lpOverlapped=0x0) returned 1
	[0134.647] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.647] CloseHandle (hObject=0x20c) returned 1
	[0134.647] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\OoY2uDPOVdHwL7.doc" (normalized: "c:\\users\\fd1hvy\\documents\\ooy2udpovdhwl7.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\OoY2uDPOVdHwL7.doc.exe" (normalized: "c:\\users\\fd1hvy\\documents\\ooy2udpovdhwl7.doc.exe")) returned 1
	[0134.648] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c, dwReserved1=0x1, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1
	[0134.648] lstrcmpA (lpString1=".", lpString2="Outlook Files") returned -1
	[0134.648] lstrcmpA (lpString1="..", lpString2="Outlook Files") returned -1
	[0134.648] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\OoY2uDPOVdHwL7.doc") returned="OoY2uDPOVdHwL7.doc"
	[0134.648] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="Outlook Files" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Outlook Files") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files"
	[0134.648] lstrlenA (lpString="C:\\Users\\FD1HVy\\Documents\\Outlook Files") returned 39
	[0134.648] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName=".", cAlternateFileName="")) returned 0x7cb650
	[0134.649] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0134.649] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="..", cAlternateFileName="")) returned 1
	[0134.649] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0134.649] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0134.649] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddbf9d33, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 1
	[0134.649] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0134.649] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="kkcie@kdj.kd.pst") returned -1
	[0134.649] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="kkcie@kdj.kd.pst") returned -1
	[0134.649] lstrcmpiA (lpString1="", lpString2="kkcie@kdj.kd.pst") returned -1
	[0134.649] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*.*") returned="*.*"
	[0134.649] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\"
	[0134.649] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\") returned=""
	[0134.649] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.649] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0134.649] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0134.650] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0134.650] WriteFile (in: hFile=0x210, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0134.651] SetFileTime (hFile=0x210, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0134.651] CloseHandle (hObject=0x210) returned 1
	[0134.651] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\", lpString2="kkcie@kdj.kd.pst" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst"
	[0134.651] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.zip") returned 0
	[0134.651] lstrlenA (lpString="*.zip") returned 5
	[0134.651] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.rar") returned 0
	[0134.651] lstrlenA (lpString="*.rar") returned 5
	[0134.651] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.7z") returned 0
	[0134.652] lstrlenA (lpString="*.7z") returned 4
	[0134.652] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.tar") returned 0
	[0134.652] lstrlenA (lpString="*.tar") returned 5
	[0134.652] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.gzip") returned 0
	[0134.652] lstrlenA (lpString="*.gzip") returned 6
	[0134.652] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.jpg") returned 0
	[0134.652] lstrlenA (lpString="*.jpg") returned 5
	[0134.652] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.jpeg") returned 0
	[0134.652] lstrlenA (lpString="*.jpeg") returned 6
	[0134.652] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.bmp") returned 0
	[0134.652] lstrlenA (lpString="*.bmp") returned 5
	[0134.652] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.gif") returned 0
	[0134.652] lstrlenA (lpString="*.gif") returned 5
	[0134.652] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.png") returned 0
	[0134.652] lstrlenA (lpString="*.png") returned 5
	[0134.652] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.doc") returned 0
	[0134.652] lstrlenA (lpString="*.doc") returned 5
	[0134.652] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.docx") returned 0
	[0134.652] lstrlenA (lpString="*.docx") returned 6
	[0134.652] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.xls") returned 0
	[0134.652] lstrlenA (lpString="*.xls") returned 5
	[0134.652] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.xlsx") returned 0
	[0134.652] lstrlenA (lpString="*.xlsx") returned 6
	[0134.652] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.ppt") returned 0
	[0134.652] lstrlenA (lpString="*.ppt") returned 5
	[0134.652] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.pptx") returned 0
	[0134.652] lstrlenA (lpString="*.pptx") returned 6
	[0134.652] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.txt") returned 0
	[0134.652] lstrlenA (lpString="*.txt") returned 5
	[0134.652] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.pdf") returned 0
	[0134.652] lstrlenA (lpString="*.pdf") returned 5
	[0134.652] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.htm") returned 0
	[0134.652] lstrlenA (lpString="*.htm") returned 5
	[0134.652] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.html") returned 0
	[0134.652] lstrlenA (lpString="*.html") returned 6
	[0134.652] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.mdb") returned 0
	[0134.653] lstrlenA (lpString="*.mdb") returned 5
	[0134.653] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.pfx") returned 0
	[0134.653] lstrlenA (lpString="*.pfx") returned 5
	[0134.653] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.md") returned 0
	[0134.653] lstrlenA (lpString="*.md") returned 4
	[0134.653] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.lnk") returned 0
	[0134.653] lstrlenA (lpString="*.lnk") returned 5
	[0134.653] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.torrent") returned 0
	[0134.653] lstrlenA (lpString="*.torrent") returned 9
	[0134.653] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.mov") returned 0
	[0134.653] lstrlenA (lpString="*.mov") returned 5
	[0134.653] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.3gp") returned 0
	[0134.653] lstrlenA (lpString="*.3gp") returned 5
	[0134.653] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.mpeg") returned 0
	[0134.653] lstrlenA (lpString="*.mpeg") returned 6
	[0134.653] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.mpg") returned 0
	[0134.653] lstrlenA (lpString="*.mpg") returned 5
	[0134.653] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.flv") returned 0
	[0134.653] lstrlenA (lpString="*.flv") returned 5
	[0134.653] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.avi") returned 0
	[0134.653] lstrlenA (lpString="*.avi") returned 5
	[0134.653] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.mp4") returned 0
	[0134.653] lstrlenA (lpString="*.mp4") returned 5
	[0134.653] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.wmv") returned 0
	[0134.653] lstrlenA (lpString="*.wmv") returned 5
	[0134.653] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.mkv") returned 0
	[0134.653] lstrlenA (lpString="*.mkv") returned 5
	[0134.653] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.mp3") returned 0
	[0134.653] lstrlenA (lpString="*.mp3") returned 5
	[0134.653] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.wav") returned 0
	[0134.653] lstrlenA (lpString="*.wav") returned 5
	[0134.653] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.flac") returned 0
	[0134.653] lstrlenA (lpString="*.flac") returned 6
	[0134.653] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.wma") returned 0
	[0134.654] lstrlenA (lpString="*.wma") returned 5
	[0134.654] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.au3") returned 0
	[0134.654] lstrlenA (lpString="*.au3") returned 5
	[0134.654] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.ahk") returned 0
	[0134.654] lstrlenA (lpString="*.ahk") returned 5
	[0134.654] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.c") returned 0
	[0134.654] lstrlenA (lpString="*.c") returned 3
	[0134.654] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.cc") returned 0
	[0134.654] lstrlenA (lpString="*.cc") returned 4
	[0134.654] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.cpp") returned 0
	[0134.654] lstrlenA (lpString="*.cpp") returned 5
	[0134.654] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.cxx") returned 0
	[0134.654] lstrlenA (lpString="*.cxx") returned 5
	[0134.654] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.c++") returned 0
	[0134.654] lstrlenA (lpString="*.c++") returned 5
	[0134.654] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.cs") returned 0
	[0134.654] lstrlenA (lpString="*.cs") returned 4
	[0134.654] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.vb") returned 0
	[0134.654] lstrlenA (lpString="*.vb") returned 4
	[0134.654] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.bas") returned 0
	[0134.654] lstrlenA (lpString="*.bas") returned 5
	[0134.654] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.csproj") returned 0
	[0134.654] lstrlenA (lpString="*.csproj") returned 8
	[0134.654] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.vbproj") returned 0
	[0134.654] lstrlenA (lpString="*.vbproj") returned 8
	[0134.654] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.vcxproj") returned 0
	[0134.654] lstrlenA (lpString="*.vcxproj") returned 9
	[0134.654] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.manifest") returned 0
	[0134.654] lstrlenA (lpString="*.manifest") returned 10
	[0134.654] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.php") returned 0
	[0134.654] lstrlenA (lpString="*.php") returned 5
	[0134.654] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.vbe") returned 0
	[0134.654] lstrlenA (lpString="*.vbe") returned 5
	[0134.654] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.vba") returned 0
	[0134.655] lstrlenA (lpString="*.vba") returned 5
	[0134.655] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.vbs") returned 0
	[0134.655] lstrlenA (lpString="*.vbs") returned 5
	[0134.655] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.bat") returned 0
	[0134.655] lstrlenA (lpString="*.bat") returned 5
	[0134.655] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.cmd") returned 0
	[0134.655] lstrlenA (lpString="*.cmd") returned 5
	[0134.655] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.js") returned 0
	[0134.655] lstrlenA (lpString="*.js") returned 4
	[0134.655] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.jscript") returned 0
	[0134.655] lstrlenA (lpString="*.jscript") returned 9
	[0134.655] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.hta") returned 0
	[0134.655] lstrlenA (lpString="*.hta") returned 5
	[0134.655] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.php7") returned 0
	[0134.655] lstrlenA (lpString="*.php7") returned 6
	[0134.655] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.db") returned 0
	[0134.655] lstrlenA (lpString="*.db") returned 4
	[0134.655] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.swf") returned 0
	[0134.655] lstrlenA (lpString="*.swf") returned 5
	[0134.655] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.eml") returned 0
	[0134.655] lstrlenA (lpString="*.eml") returned 5
	[0134.655] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.part") returned 0
	[0134.655] lstrlenA (lpString="*.part") returned 6
	[0134.655] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.nfo") returned 0
	[0134.655] lstrlenA (lpString="*.nfo") returned 5
	[0134.655] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.rsa") returned 0
	[0134.655] lstrlenA (lpString="*.rsa") returned 5
	[0134.655] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.key") returned 0
	[0134.655] lstrlenA (lpString="*.key") returned 5
	[0134.655] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.aes") returned 0
	[0134.655] lstrlenA (lpString="*.aes") returned 5
	[0134.655] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.blob") returned 0
	[0134.655] lstrlenA (lpString="*.blob") returned 6
	[0134.655] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.btc") returned 0
	[0134.655] lstrlenA (lpString="*.btc") returned 5
	[0134.656] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", pszSpec="*.wallet") returned 0
	[0134.656] lstrlenA (lpString="*.wallet") returned 8
	[0134.656] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddbf9d33, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 0
	[0134.656] FindClose (in: hFindFile=0x7cb650 | out: hFindFile=0x7cb650) returned 1
	[0134.656] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10703dc0, ftCreationTime.dwHighDateTime=0x1d520ad, ftLastAccessTime.dwLowDateTime=0xe6c03f60, ftLastAccessTime.dwHighDateTime=0x1d5297c, ftLastWriteTime.dwLowDateTime=0xe6c03f60, ftLastWriteTime.dwHighDateTime=0x1d5297c, nFileSizeHigh=0x0, nFileSizeLow=0x17bdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="PaOZV.xlsx", cAlternateFileName="PAOZV~1.XLS")) returned 1
	[0134.656] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0134.656] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PaOZV.xlsx") returned -1
	[0134.656] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PaOZV.xlsx") returned -1
	[0134.656] lstrcmpiA (lpString1="", lpString2="PaOZV.xlsx") returned -1
	[0134.656] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\*.*") returned="*.*"
	[0134.656] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\"
	[0134.656] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned=""
	[0134.656] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.656] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\how-to-decrypt-files.htm")) returned 0x20
	[0134.656] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="PaOZV.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\PaOZV.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\PaOZV.xlsx"
	[0134.656] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\PaOZV.xlsx", pszSpec="*.zip") returned 0
	[0134.656] lstrlenA (lpString="*.zip") returned 5
	[0134.656] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\PaOZV.xlsx", pszSpec="*.rar") returned 0
	[0134.656] lstrlenA (lpString="*.rar") returned 5
	[0134.656] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\PaOZV.xlsx", pszSpec="*.7z") returned 0
	[0134.656] lstrlenA (lpString="*.7z") returned 4
	[0134.656] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\PaOZV.xlsx", pszSpec="*.tar") returned 0
	[0134.656] lstrlenA (lpString="*.tar") returned 5
	[0134.656] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\PaOZV.xlsx", pszSpec="*.gzip") returned 0
	[0134.656] lstrlenA (lpString="*.gzip") returned 6
	[0134.656] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\PaOZV.xlsx", pszSpec="*.jpg") returned 0
	[0134.656] lstrlenA (lpString="*.jpg") returned 5
	[0134.656] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\PaOZV.xlsx", pszSpec="*.jpeg") returned 0
	[0134.656] lstrlenA (lpString="*.jpeg") returned 6
	[0134.656] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\PaOZV.xlsx", pszSpec="*.bmp") returned 0
	[0134.657] lstrlenA (lpString="*.bmp") returned 5
	[0134.657] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\PaOZV.xlsx", pszSpec="*.gif") returned 0
	[0134.657] lstrlenA (lpString="*.gif") returned 5
	[0134.657] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\PaOZV.xlsx", pszSpec="*.png") returned 0
	[0134.657] lstrlenA (lpString="*.png") returned 5
	[0134.657] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\PaOZV.xlsx", pszSpec="*.doc") returned 0
	[0134.657] lstrlenA (lpString="*.doc") returned 5
	[0134.657] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\PaOZV.xlsx", pszSpec="*.docx") returned 0
	[0134.657] lstrlenA (lpString="*.docx") returned 6
	[0134.657] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\PaOZV.xlsx", pszSpec="*.xls") returned 0
	[0134.657] lstrlenA (lpString="*.xls") returned 5
	[0134.657] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\PaOZV.xlsx", pszSpec="*.xlsx") returned 1
	[0134.657] lstrlenA (lpString="*.xlsx") returned 6
	[0134.657] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Documents\\PaOZV.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\PaOZV.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\PaOZV.xlsx"
	[0134.657] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Documents\\PaOZV.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\PaOZV.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\PaOZV.xlsx"
	[0134.657] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\PaOZV.xlsx", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Documents\\PaOZV.xlsx.") returned="C:\\Users\\FD1HVy\\Documents\\PaOZV.xlsx."
	[0134.657] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\PaOZV.xlsx.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\PaOZV.xlsx.exe") returned="C:\\Users\\FD1HVy\\Documents\\PaOZV.xlsx.exe"
	[0134.657] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\PaOZV.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\paozv.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0134.657] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17bdf
	[0134.657] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x10703dc0, dwHighDateTime=0x1d520ad), lpLastAccessTime=0x407536*(dwLowDateTime=0xe6c03f60, dwHighDateTime=0x1d5297c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe6c03f60, dwHighDateTime=0x1d5297c)) returned 1
	[0134.657] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.657] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x17b9d, lpOverlapped=0x0) returned 1
	[0134.659] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\PaOZV.xlsx") returned="PaOZV.xlsx"
	[0134.659] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.659] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x17b9d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x17b9d, lpOverlapped=0x0) returned 1
	[0134.659] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.659] CloseHandle (hObject=0x20c) returned 1
	[0134.660] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\PaOZV.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\paozv.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\PaOZV.xlsx.exe" (normalized: "c:\\users\\fd1hvy\\documents\\paozv.xlsx.exe")) returned 1
	[0134.660] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55c876c0, ftCreationTime.dwHighDateTime=0x1d4f3b8, ftLastAccessTime.dwLowDateTime=0xe91a8f80, ftLastAccessTime.dwHighDateTime=0x1d4fefd, ftLastWriteTime.dwLowDateTime=0xe91a8f80, ftLastWriteTime.dwHighDateTime=0x1d4fefd, nFileSizeHigh=0x0, nFileSizeLow=0x1659c, dwReserved0=0x12, dwReserved1=0x1, cFileName="PGomyT8T.docx", cAlternateFileName="PGOMYT~1.DOC")) returned 1
	[0134.660] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0134.660] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PGomyT8T.docx") returned -1
	[0134.660] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PGomyT8T.docx") returned -1
	[0134.660] lstrcmpiA (lpString1="", lpString2="PGomyT8T.docx") returned -1
	[0134.660] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\PaOZV.xlsx") returned="PaOZV.xlsx"
	[0134.660] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\"
	[0134.660] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned=""
	[0134.660] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.660] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\how-to-decrypt-files.htm")) returned 0x20
	[0134.660] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="PGomyT8T.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\PGomyT8T.docx") returned="C:\\Users\\FD1HVy\\Documents\\PGomyT8T.docx"
	[0134.661] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\PGomyT8T.docx", pszSpec="*.zip") returned 0
	[0134.661] lstrlenA (lpString="*.zip") returned 5
	[0134.661] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\PGomyT8T.docx", pszSpec="*.rar") returned 0
	[0134.661] lstrlenA (lpString="*.rar") returned 5
	[0134.661] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\PGomyT8T.docx", pszSpec="*.7z") returned 0
	[0134.661] lstrlenA (lpString="*.7z") returned 4
	[0134.661] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\PGomyT8T.docx", pszSpec="*.tar") returned 0
	[0134.661] lstrlenA (lpString="*.tar") returned 5
	[0134.661] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\PGomyT8T.docx", pszSpec="*.gzip") returned 0
	[0134.661] lstrlenA (lpString="*.gzip") returned 6
	[0134.661] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\PGomyT8T.docx", pszSpec="*.jpg") returned 0
	[0134.661] lstrlenA (lpString="*.jpg") returned 5
	[0134.661] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\PGomyT8T.docx", pszSpec="*.jpeg") returned 0
	[0134.661] lstrlenA (lpString="*.jpeg") returned 6
	[0134.661] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\PGomyT8T.docx", pszSpec="*.bmp") returned 0
	[0134.661] lstrlenA (lpString="*.bmp") returned 5
	[0134.661] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\PGomyT8T.docx", pszSpec="*.gif") returned 0
	[0134.661] lstrlenA (lpString="*.gif") returned 5
	[0134.661] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\PGomyT8T.docx", pszSpec="*.png") returned 0
	[0134.661] lstrlenA (lpString="*.png") returned 5
	[0134.661] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\PGomyT8T.docx", pszSpec="*.doc") returned 0
	[0134.661] lstrlenA (lpString="*.doc") returned 5
	[0134.661] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\PGomyT8T.docx", pszSpec="*.docx") returned 1
	[0134.661] lstrlenA (lpString="*.docx") returned 6
	[0134.661] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Documents\\PGomyT8T.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\PGomyT8T.docx") returned="C:\\Users\\FD1HVy\\Documents\\PGomyT8T.docx"
	[0134.661] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Documents\\PGomyT8T.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\PGomyT8T.docx") returned="C:\\Users\\FD1HVy\\Documents\\PGomyT8T.docx"
	[0134.661] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\PGomyT8T.docx", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Documents\\PGomyT8T.docx.") returned="C:\\Users\\FD1HVy\\Documents\\PGomyT8T.docx."
	[0134.661] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\PGomyT8T.docx.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\PGomyT8T.docx.exe") returned="C:\\Users\\FD1HVy\\Documents\\PGomyT8T.docx.exe"
	[0134.661] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\PGomyT8T.docx" (normalized: "c:\\users\\fd1hvy\\documents\\pgomyt8t.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0134.662] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1659c
	[0134.662] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x55c876c0, dwHighDateTime=0x1d4f3b8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe91a8f80, dwHighDateTime=0x1d4fefd), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe91a8f80, dwHighDateTime=0x1d4fefd)) returned 1
	[0134.662] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.662] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1655a, lpOverlapped=0x0) returned 1
	[0134.663] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\PGomyT8T.docx") returned="PGomyT8T.docx"
	[0134.663] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.663] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1655a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1655a, lpOverlapped=0x0) returned 1
	[0134.664] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.664] CloseHandle (hObject=0x20c) returned 1
	[0134.664] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\PGomyT8T.docx" (normalized: "c:\\users\\fd1hvy\\documents\\pgomyt8t.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\PGomyT8T.docx.exe" (normalized: "c:\\users\\fd1hvy\\documents\\pgomyt8t.docx.exe")) returned 1
	[0134.665] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9579cbe0, ftCreationTime.dwHighDateTime=0x1d51882, ftLastAccessTime.dwLowDateTime=0x7d635b80, ftLastAccessTime.dwHighDateTime=0x1d4cb51, ftLastWriteTime.dwLowDateTime=0x7d635b80, ftLastWriteTime.dwHighDateTime=0x1d4cb51, nFileSizeHigh=0x0, nFileSizeLow=0x12445, dwReserved0=0x12, dwReserved1=0x1, cFileName="qdIT6CHRZ.pptx", cAlternateFileName="QDIT6C~1.PPT")) returned 1
	[0134.665] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0134.665] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="qdIT6CHRZ.pptx") returned -1
	[0134.665] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="qdIT6CHRZ.pptx") returned -1
	[0134.665] lstrcmpiA (lpString1="", lpString2="qdIT6CHRZ.pptx") returned -1
	[0134.665] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\PGomyT8T.docx") returned="PGomyT8T.docx"
	[0134.665] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\"
	[0134.665] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned=""
	[0134.665] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.665] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\how-to-decrypt-files.htm")) returned 0x20
	[0134.665] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="qdIT6CHRZ.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\qdIT6CHRZ.pptx") returned="C:\\Users\\FD1HVy\\Documents\\qdIT6CHRZ.pptx"
	[0134.665] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\qdIT6CHRZ.pptx", pszSpec="*.zip") returned 0
	[0134.665] lstrlenA (lpString="*.zip") returned 5
	[0134.665] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\qdIT6CHRZ.pptx", pszSpec="*.rar") returned 0
	[0134.665] lstrlenA (lpString="*.rar") returned 5
	[0134.665] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\qdIT6CHRZ.pptx", pszSpec="*.7z") returned 0
	[0134.665] lstrlenA (lpString="*.7z") returned 4
	[0134.665] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\qdIT6CHRZ.pptx", pszSpec="*.tar") returned 0
	[0134.665] lstrlenA (lpString="*.tar") returned 5
	[0134.665] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\qdIT6CHRZ.pptx", pszSpec="*.gzip") returned 0
	[0134.665] lstrlenA (lpString="*.gzip") returned 6
	[0134.665] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\qdIT6CHRZ.pptx", pszSpec="*.jpg") returned 0
	[0134.665] lstrlenA (lpString="*.jpg") returned 5
	[0134.665] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\qdIT6CHRZ.pptx", pszSpec="*.jpeg") returned 0
	[0134.665] lstrlenA (lpString="*.jpeg") returned 6
	[0134.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\qdIT6CHRZ.pptx", pszSpec="*.bmp") returned 0
	[0134.666] lstrlenA (lpString="*.bmp") returned 5
	[0134.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\qdIT6CHRZ.pptx", pszSpec="*.gif") returned 0
	[0134.666] lstrlenA (lpString="*.gif") returned 5
	[0134.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\qdIT6CHRZ.pptx", pszSpec="*.png") returned 0
	[0134.666] lstrlenA (lpString="*.png") returned 5
	[0134.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\qdIT6CHRZ.pptx", pszSpec="*.doc") returned 0
	[0134.666] lstrlenA (lpString="*.doc") returned 5
	[0134.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\qdIT6CHRZ.pptx", pszSpec="*.docx") returned 0
	[0134.666] lstrlenA (lpString="*.docx") returned 6
	[0134.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\qdIT6CHRZ.pptx", pszSpec="*.xls") returned 0
	[0134.666] lstrlenA (lpString="*.xls") returned 5
	[0134.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\qdIT6CHRZ.pptx", pszSpec="*.xlsx") returned 0
	[0134.666] lstrlenA (lpString="*.xlsx") returned 6
	[0134.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\qdIT6CHRZ.pptx", pszSpec="*.ppt") returned 0
	[0134.666] lstrlenA (lpString="*.ppt") returned 5
	[0134.666] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\qdIT6CHRZ.pptx", pszSpec="*.pptx") returned 1
	[0134.666] lstrlenA (lpString="*.pptx") returned 6
	[0134.666] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Documents\\qdIT6CHRZ.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\qdIT6CHRZ.pptx") returned="C:\\Users\\FD1HVy\\Documents\\qdIT6CHRZ.pptx"
	[0134.666] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Documents\\qdIT6CHRZ.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\qdIT6CHRZ.pptx") returned="C:\\Users\\FD1HVy\\Documents\\qdIT6CHRZ.pptx"
	[0134.666] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\qdIT6CHRZ.pptx", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Documents\\qdIT6CHRZ.pptx.") returned="C:\\Users\\FD1HVy\\Documents\\qdIT6CHRZ.pptx."
	[0134.666] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\qdIT6CHRZ.pptx.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\qdIT6CHRZ.pptx.exe") returned="C:\\Users\\FD1HVy\\Documents\\qdIT6CHRZ.pptx.exe"
	[0134.666] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\qdIT6CHRZ.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\qdit6chrz.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0134.666] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12445
	[0134.667] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9579cbe0, dwHighDateTime=0x1d51882), lpLastAccessTime=0x407536*(dwLowDateTime=0x7d635b80, dwHighDateTime=0x1d4cb51), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7d635b80, dwHighDateTime=0x1d4cb51)) returned 1
	[0134.667] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.667] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x12403, lpOverlapped=0x0) returned 1
	[0134.668] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\qdIT6CHRZ.pptx") returned="qdIT6CHRZ.pptx"
	[0134.668] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.668] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x12403, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x12403, lpOverlapped=0x0) returned 1
	[0134.668] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.668] CloseHandle (hObject=0x20c) returned 1
	[0134.668] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\qdIT6CHRZ.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\qdit6chrz.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\qdIT6CHRZ.pptx.exe" (normalized: "c:\\users\\fd1hvy\\documents\\qdit6chrz.pptx.exe")) returned 1
	[0134.669] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc303cf0, ftCreationTime.dwHighDateTime=0x1d53206, ftLastAccessTime.dwLowDateTime=0xd9bf3c20, ftLastAccessTime.dwHighDateTime=0x1d5170d, ftLastWriteTime.dwLowDateTime=0xd9bf3c20, ftLastWriteTime.dwHighDateTime=0x1d5170d, nFileSizeHigh=0x0, nFileSizeLow=0x16b2b, dwReserved0=0x15, dwReserved1=0x1, cFileName="QpiZcMo4JW5wvjMvbpXM.docx", cAlternateFileName="QPIZCM~1.DOC")) returned 1
	[0134.669] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0134.669] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="QpiZcMo4JW5wvjMvbpXM.docx") returned -1
	[0134.669] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="QpiZcMo4JW5wvjMvbpXM.docx") returned -1
	[0134.669] lstrcmpiA (lpString1="", lpString2="QpiZcMo4JW5wvjMvbpXM.docx") returned -1
	[0134.669] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\qdIT6CHRZ.pptx") returned="qdIT6CHRZ.pptx"
	[0134.669] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\"
	[0134.669] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned=""
	[0134.669] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.669] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\how-to-decrypt-files.htm")) returned 0x20
	[0134.669] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="QpiZcMo4JW5wvjMvbpXM.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\QpiZcMo4JW5wvjMvbpXM.docx") returned="C:\\Users\\FD1HVy\\Documents\\QpiZcMo4JW5wvjMvbpXM.docx"
	[0134.669] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\QpiZcMo4JW5wvjMvbpXM.docx", pszSpec="*.zip") returned 0
	[0134.669] lstrlenA (lpString="*.zip") returned 5
	[0134.669] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\QpiZcMo4JW5wvjMvbpXM.docx", pszSpec="*.rar") returned 0
	[0134.669] lstrlenA (lpString="*.rar") returned 5
	[0134.669] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\QpiZcMo4JW5wvjMvbpXM.docx", pszSpec="*.7z") returned 0
	[0134.670] lstrlenA (lpString="*.7z") returned 4
	[0134.670] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\QpiZcMo4JW5wvjMvbpXM.docx", pszSpec="*.tar") returned 0
	[0134.670] lstrlenA (lpString="*.tar") returned 5
	[0134.670] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\QpiZcMo4JW5wvjMvbpXM.docx", pszSpec="*.gzip") returned 0
	[0134.670] lstrlenA (lpString="*.gzip") returned 6
	[0134.670] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\QpiZcMo4JW5wvjMvbpXM.docx", pszSpec="*.jpg") returned 0
	[0134.670] lstrlenA (lpString="*.jpg") returned 5
	[0134.670] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\QpiZcMo4JW5wvjMvbpXM.docx", pszSpec="*.jpeg") returned 0
	[0134.670] lstrlenA (lpString="*.jpeg") returned 6
	[0134.670] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\QpiZcMo4JW5wvjMvbpXM.docx", pszSpec="*.bmp") returned 0
	[0134.670] lstrlenA (lpString="*.bmp") returned 5
	[0134.670] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\QpiZcMo4JW5wvjMvbpXM.docx", pszSpec="*.gif") returned 0
	[0134.670] lstrlenA (lpString="*.gif") returned 5
	[0134.670] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\QpiZcMo4JW5wvjMvbpXM.docx", pszSpec="*.png") returned 0
	[0134.670] lstrlenA (lpString="*.png") returned 5
	[0134.670] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\QpiZcMo4JW5wvjMvbpXM.docx", pszSpec="*.doc") returned 0
	[0134.670] lstrlenA (lpString="*.doc") returned 5
	[0134.670] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\QpiZcMo4JW5wvjMvbpXM.docx", pszSpec="*.docx") returned 1
	[0134.670] lstrlenA (lpString="*.docx") returned 6
	[0134.670] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Documents\\QpiZcMo4JW5wvjMvbpXM.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\QpiZcMo4JW5wvjMvbpXM.docx") returned="C:\\Users\\FD1HVy\\Documents\\QpiZcMo4JW5wvjMvbpXM.docx"
	[0134.670] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Documents\\QpiZcMo4JW5wvjMvbpXM.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\QpiZcMo4JW5wvjMvbpXM.docx") returned="C:\\Users\\FD1HVy\\Documents\\QpiZcMo4JW5wvjMvbpXM.docx"
	[0134.670] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\QpiZcMo4JW5wvjMvbpXM.docx", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Documents\\QpiZcMo4JW5wvjMvbpXM.docx.") returned="C:\\Users\\FD1HVy\\Documents\\QpiZcMo4JW5wvjMvbpXM.docx."
	[0134.670] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\QpiZcMo4JW5wvjMvbpXM.docx.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\QpiZcMo4JW5wvjMvbpXM.docx.exe") returned="C:\\Users\\FD1HVy\\Documents\\QpiZcMo4JW5wvjMvbpXM.docx.exe"
	[0134.670] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\QpiZcMo4JW5wvjMvbpXM.docx" (normalized: "c:\\users\\fd1hvy\\documents\\qpizcmo4jw5wvjmvbpxm.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0134.670] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16b2b
	[0134.671] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xfc303cf0, dwHighDateTime=0x1d53206), lpLastAccessTime=0x407536*(dwLowDateTime=0xd9bf3c20, dwHighDateTime=0x1d5170d), lpLastWriteTime=0x40753e*(dwLowDateTime=0xd9bf3c20, dwHighDateTime=0x1d5170d)) returned 1
	[0134.671] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.671] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x16ae9, lpOverlapped=0x0) returned 1
	[0134.672] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\QpiZcMo4JW5wvjMvbpXM.docx") returned="QpiZcMo4JW5wvjMvbpXM.docx"
	[0134.672] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.672] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x16ae9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x16ae9, lpOverlapped=0x0) returned 1
	[0134.672] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.673] CloseHandle (hObject=0x20c) returned 1
	[0134.673] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\QpiZcMo4JW5wvjMvbpXM.docx" (normalized: "c:\\users\\fd1hvy\\documents\\qpizcmo4jw5wvjmvbpxm.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\QpiZcMo4JW5wvjMvbpXM.docx.exe" (normalized: "c:\\users\\fd1hvy\\documents\\qpizcmo4jw5wvjmvbpxm.docx.exe")) returned 1
	[0134.673] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5668830, ftCreationTime.dwHighDateTime=0x1d4ce50, ftLastAccessTime.dwLowDateTime=0x42f8c400, ftLastAccessTime.dwHighDateTime=0x1d4cb18, ftLastWriteTime.dwLowDateTime=0x42f8c400, ftLastWriteTime.dwHighDateTime=0x1d4cb18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f, dwReserved1=0x1, cFileName="VyPXfmV5YHIXX", cAlternateFileName="VYPXFM~1")) returned 1
	[0134.673] lstrcmpA (lpString1=".", lpString2="VyPXfmV5YHIXX") returned -1
	[0134.673] lstrcmpA (lpString1="..", lpString2="VyPXfmV5YHIXX") returned -1
	[0134.673] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\QpiZcMo4JW5wvjMvbpXM.docx") returned="QpiZcMo4JW5wvjMvbpXM.docx"
	[0134.673] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="VyPXfmV5YHIXX" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX"
	[0134.673] lstrlenA (lpString="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX") returned 39
	[0134.673] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5668830, ftCreationTime.dwHighDateTime=0x1d4ce50, ftLastAccessTime.dwLowDateTime=0x42f8c400, ftLastAccessTime.dwHighDateTime=0x1d4cb18, ftLastWriteTime.dwLowDateTime=0x42f8c400, ftLastWriteTime.dwHighDateTime=0x1d4cb18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName=".", cAlternateFileName="")) returned 0x7cbb90
	[0134.674] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0134.674] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5668830, ftCreationTime.dwHighDateTime=0x1d4ce50, ftLastAccessTime.dwLowDateTime=0x42f8c400, ftLastAccessTime.dwHighDateTime=0x1d4cb18, ftLastWriteTime.dwLowDateTime=0x42f8c400, ftLastWriteTime.dwHighDateTime=0x1d4cb18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="..", cAlternateFileName="")) returned 1
	[0134.674] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0134.674] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0134.674] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f4399a0, ftCreationTime.dwHighDateTime=0x1d4cc76, ftLastAccessTime.dwLowDateTime=0xf762bcc0, ftLastAccessTime.dwHighDateTime=0x1d4d437, ftLastWriteTime.dwLowDateTime=0xf762bcc0, ftLastWriteTime.dwHighDateTime=0x1d4d437, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="cuWRZheedprN2Bv_zUnM.xls", cAlternateFileName="CUWRZH~1.XLS")) returned 1
	[0134.674] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0134.674] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="cuWRZheedprN2Bv_zUnM.xls") returned 1
	[0134.674] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="cuWRZheedprN2Bv_zUnM.xls") returned 1
	[0134.674] lstrcmpiA (lpString1="", lpString2="cuWRZheedprN2Bv_zUnM.xls") returned -1
	[0134.674] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\*.*") returned="*.*"
	[0134.674] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\"
	[0134.674] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\") returned=""
	[0134.674] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.674] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0134.674] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0134.675] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0134.675] WriteFile (in: hFile=0x210, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0134.676] SetFileTime (hFile=0x210, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0134.676] CloseHandle (hObject=0x210) returned 1
	[0134.676] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\", lpString2="cuWRZheedprN2Bv_zUnM.xls" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\cuWRZheedprN2Bv_zUnM.xls") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\cuWRZheedprN2Bv_zUnM.xls"
	[0134.676] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\cuWRZheedprN2Bv_zUnM.xls", pszSpec="*.zip") returned 0
	[0134.676] lstrlenA (lpString="*.zip") returned 5
	[0134.676] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\cuWRZheedprN2Bv_zUnM.xls", pszSpec="*.rar") returned 0
	[0134.676] lstrlenA (lpString="*.rar") returned 5
	[0134.676] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\cuWRZheedprN2Bv_zUnM.xls", pszSpec="*.7z") returned 0
	[0134.676] lstrlenA (lpString="*.7z") returned 4
	[0134.676] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\cuWRZheedprN2Bv_zUnM.xls", pszSpec="*.tar") returned 0
	[0134.676] lstrlenA (lpString="*.tar") returned 5
	[0134.676] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\cuWRZheedprN2Bv_zUnM.xls", pszSpec="*.gzip") returned 0
	[0134.676] lstrlenA (lpString="*.gzip") returned 6
	[0134.676] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\cuWRZheedprN2Bv_zUnM.xls", pszSpec="*.jpg") returned 0
	[0134.676] lstrlenA (lpString="*.jpg") returned 5
	[0134.676] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\cuWRZheedprN2Bv_zUnM.xls", pszSpec="*.jpeg") returned 0
	[0134.676] lstrlenA (lpString="*.jpeg") returned 6
	[0134.676] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\cuWRZheedprN2Bv_zUnM.xls", pszSpec="*.bmp") returned 0
	[0134.676] lstrlenA (lpString="*.bmp") returned 5
	[0134.676] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\cuWRZheedprN2Bv_zUnM.xls", pszSpec="*.gif") returned 0
	[0134.676] lstrlenA (lpString="*.gif") returned 5
	[0134.676] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\cuWRZheedprN2Bv_zUnM.xls", pszSpec="*.png") returned 0
	[0134.676] lstrlenA (lpString="*.png") returned 5
	[0134.676] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\cuWRZheedprN2Bv_zUnM.xls", pszSpec="*.doc") returned 0
	[0134.676] lstrlenA (lpString="*.doc") returned 5
	[0134.676] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\cuWRZheedprN2Bv_zUnM.xls", pszSpec="*.docx") returned 0
	[0134.676] lstrlenA (lpString="*.docx") returned 6
	[0134.677] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\cuWRZheedprN2Bv_zUnM.xls", pszSpec="*.xls") returned 1
	[0134.677] lstrlenA (lpString="*.xls") returned 5
	[0134.677] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\cuWRZheedprN2Bv_zUnM.xls" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\cuWRZheedprN2Bv_zUnM.xls") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\cuWRZheedprN2Bv_zUnM.xls"
	[0134.677] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\cuWRZheedprN2Bv_zUnM.xls" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\cuWRZheedprN2Bv_zUnM.xls") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\cuWRZheedprN2Bv_zUnM.xls"
	[0134.677] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\cuWRZheedprN2Bv_zUnM.xls", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\cuWRZheedprN2Bv_zUnM.xls.") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\cuWRZheedprN2Bv_zUnM.xls."
	[0134.677] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\cuWRZheedprN2Bv_zUnM.xls.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\cuWRZheedprN2Bv_zUnM.xls.exe") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\cuWRZheedprN2Bv_zUnM.xls.exe"
	[0134.677] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\cuWRZheedprN2Bv_zUnM.xls" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\cuwrzheedprn2bv_zunm.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0134.677] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6b0f
	[0134.677] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5f4399a0, dwHighDateTime=0x1d4cc76), lpLastAccessTime=0x407536*(dwLowDateTime=0xf762bcc0, dwHighDateTime=0x1d4d437), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf762bcc0, dwHighDateTime=0x1d4d437)) returned 1
	[0134.677] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.677] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x6acd, lpOverlapped=0x0) returned 1
	[0134.678] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\cuWRZheedprN2Bv_zUnM.xls") returned="cuWRZheedprN2Bv_zUnM.xls"
	[0134.678] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.678] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x6acd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x6acd, lpOverlapped=0x0) returned 1
	[0134.678] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.678] CloseHandle (hObject=0x210) returned 1
	[0134.679] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\cuWRZheedprN2Bv_zUnM.xls" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\cuwrzheedprn2bv_zunm.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\cuWRZheedprN2Bv_zUnM.xls.exe" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\cuwrzheedprn2bv_zunm.xls.exe")) returned 1
	[0134.679] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc57b28c0, ftCreationTime.dwHighDateTime=0x1d4d359, ftLastAccessTime.dwLowDateTime=0x11f1d670, ftLastAccessTime.dwHighDateTime=0x1d4c952, ftLastWriteTime.dwLowDateTime=0x11f1d670, ftLastWriteTime.dwHighDateTime=0x1d4c952, nFileSizeHigh=0x0, nFileSizeLow=0xe207, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBeNE4jh75orzB.pdf", cAlternateFileName="GBENE4~1.PDF")) returned 1
	[0134.679] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0134.679] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="GBeNE4jh75orzB.pdf") returned -1
	[0134.679] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="GBeNE4jh75orzB.pdf") returned 1
	[0134.679] lstrcmpiA (lpString1="", lpString2="GBeNE4jh75orzB.pdf") returned -1
	[0134.679] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\cuWRZheedprN2Bv_zUnM.xls") returned="cuWRZheedprN2Bv_zUnM.xls"
	[0134.697] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\"
	[0134.697] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\") returned=""
	[0134.697] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.697] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\how-to-decrypt-files.htm")) returned 0x20
	[0134.697] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\", lpString2="GBeNE4jh75orzB.pdf" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\GBeNE4jh75orzB.pdf") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\GBeNE4jh75orzB.pdf"
	[0134.697] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\GBeNE4jh75orzB.pdf", pszSpec="*.zip") returned 0
	[0134.698] lstrlenA (lpString="*.zip") returned 5
	[0134.698] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\GBeNE4jh75orzB.pdf", pszSpec="*.rar") returned 0
	[0134.698] lstrlenA (lpString="*.rar") returned 5
	[0134.698] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\GBeNE4jh75orzB.pdf", pszSpec="*.7z") returned 0
	[0134.698] lstrlenA (lpString="*.7z") returned 4
	[0134.698] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\GBeNE4jh75orzB.pdf", pszSpec="*.tar") returned 0
	[0134.698] lstrlenA (lpString="*.tar") returned 5
	[0134.698] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\GBeNE4jh75orzB.pdf", pszSpec="*.gzip") returned 0
	[0134.698] lstrlenA (lpString="*.gzip") returned 6
	[0134.698] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\GBeNE4jh75orzB.pdf", pszSpec="*.jpg") returned 0
	[0134.698] lstrlenA (lpString="*.jpg") returned 5
	[0134.698] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\GBeNE4jh75orzB.pdf", pszSpec="*.jpeg") returned 0
	[0134.698] lstrlenA (lpString="*.jpeg") returned 6
	[0134.698] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\GBeNE4jh75orzB.pdf", pszSpec="*.bmp") returned 0
	[0134.698] lstrlenA (lpString="*.bmp") returned 5
	[0134.698] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\GBeNE4jh75orzB.pdf", pszSpec="*.gif") returned 0
	[0134.698] lstrlenA (lpString="*.gif") returned 5
	[0134.698] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\GBeNE4jh75orzB.pdf", pszSpec="*.png") returned 0
	[0134.698] lstrlenA (lpString="*.png") returned 5
	[0134.698] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\GBeNE4jh75orzB.pdf", pszSpec="*.doc") returned 0
	[0134.698] lstrlenA (lpString="*.doc") returned 5
	[0134.698] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\GBeNE4jh75orzB.pdf", pszSpec="*.docx") returned 0
	[0134.698] lstrlenA (lpString="*.docx") returned 6
	[0134.698] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\GBeNE4jh75orzB.pdf", pszSpec="*.xls") returned 0
	[0134.698] lstrlenA (lpString="*.xls") returned 5
	[0134.698] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\GBeNE4jh75orzB.pdf", pszSpec="*.xlsx") returned 0
	[0134.698] lstrlenA (lpString="*.xlsx") returned 6
	[0134.698] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\GBeNE4jh75orzB.pdf", pszSpec="*.ppt") returned 0
	[0134.698] lstrlenA (lpString="*.ppt") returned 5
	[0134.698] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\GBeNE4jh75orzB.pdf", pszSpec="*.pptx") returned 0
	[0134.698] lstrlenA (lpString="*.pptx") returned 6
	[0134.698] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\GBeNE4jh75orzB.pdf", pszSpec="*.txt") returned 0
	[0134.698] lstrlenA (lpString="*.txt") returned 5
	[0134.698] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\GBeNE4jh75orzB.pdf", pszSpec="*.pdf") returned 1
	[0134.698] lstrlenA (lpString="*.pdf") returned 5
	[0134.699] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\GBeNE4jh75orzB.pdf" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\GBeNE4jh75orzB.pdf") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\GBeNE4jh75orzB.pdf"
	[0134.699] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\GBeNE4jh75orzB.pdf" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\GBeNE4jh75orzB.pdf") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\GBeNE4jh75orzB.pdf"
	[0134.699] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\GBeNE4jh75orzB.pdf", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\GBeNE4jh75orzB.pdf.") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\GBeNE4jh75orzB.pdf."
	[0134.699] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\GBeNE4jh75orzB.pdf.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\GBeNE4jh75orzB.pdf.exe") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\GBeNE4jh75orzB.pdf.exe"
	[0134.699] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\GBeNE4jh75orzB.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\gbene4jh75orzb.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0134.699] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe207
	[0134.699] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc57b28c0, dwHighDateTime=0x1d4d359), lpLastAccessTime=0x407536*(dwLowDateTime=0x11f1d670, dwHighDateTime=0x1d4c952), lpLastWriteTime=0x40753e*(dwLowDateTime=0x11f1d670, dwHighDateTime=0x1d4c952)) returned 1
	[0134.699] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.699] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xe1c5, lpOverlapped=0x0) returned 1
	[0134.700] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\GBeNE4jh75orzB.pdf") returned="GBeNE4jh75orzB.pdf"
	[0134.701] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.701] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xe1c5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xe1c5, lpOverlapped=0x0) returned 1
	[0134.701] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.701] CloseHandle (hObject=0x210) returned 1
	[0134.701] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\GBeNE4jh75orzB.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\gbene4jh75orzb.pdf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\GBeNE4jh75orzB.pdf.exe" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\gbene4jh75orzb.pdf.exe")) returned 1
	[0134.702] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bda7a40, ftCreationTime.dwHighDateTime=0x1d4c748, ftLastAccessTime.dwLowDateTime=0x78fd9580, ftLastAccessTime.dwHighDateTime=0x1d4ce74, ftLastWriteTime.dwLowDateTime=0x78fd9580, ftLastWriteTime.dwHighDateTime=0x1d4ce74, nFileSizeHigh=0x0, nFileSizeLow=0x17457, dwReserved0=0x0, dwReserved1=0x1, cFileName="gCzGdX7uICsD5.pdf", cAlternateFileName="GCZGDX~1.PDF")) returned 1
	[0134.702] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0134.702] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="gCzGdX7uICsD5.pdf") returned -1
	[0134.702] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="gCzGdX7uICsD5.pdf") returned 1
	[0134.702] lstrcmpiA (lpString1="", lpString2="gCzGdX7uICsD5.pdf") returned -1
	[0134.702] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\GBeNE4jh75orzB.pdf") returned="GBeNE4jh75orzB.pdf"
	[0134.702] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\"
	[0134.702] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\") returned=""
	[0134.702] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.702] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\how-to-decrypt-files.htm")) returned 0x20
	[0134.702] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\", lpString2="gCzGdX7uICsD5.pdf" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\gCzGdX7uICsD5.pdf") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\gCzGdX7uICsD5.pdf"
	[0134.702] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\gCzGdX7uICsD5.pdf", pszSpec="*.zip") returned 0
	[0134.702] lstrlenA (lpString="*.zip") returned 5
	[0134.702] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\gCzGdX7uICsD5.pdf", pszSpec="*.rar") returned 0
	[0134.702] lstrlenA (lpString="*.rar") returned 5
	[0134.702] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\gCzGdX7uICsD5.pdf", pszSpec="*.7z") returned 0
	[0134.702] lstrlenA (lpString="*.7z") returned 4
	[0134.702] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\gCzGdX7uICsD5.pdf", pszSpec="*.tar") returned 0
	[0134.702] lstrlenA (lpString="*.tar") returned 5
	[0134.702] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\gCzGdX7uICsD5.pdf", pszSpec="*.gzip") returned 0
	[0134.702] lstrlenA (lpString="*.gzip") returned 6
	[0134.702] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\gCzGdX7uICsD5.pdf", pszSpec="*.jpg") returned 0
	[0134.702] lstrlenA (lpString="*.jpg") returned 5
	[0134.702] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\gCzGdX7uICsD5.pdf", pszSpec="*.jpeg") returned 0
	[0134.702] lstrlenA (lpString="*.jpeg") returned 6
	[0134.702] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\gCzGdX7uICsD5.pdf", pszSpec="*.bmp") returned 0
	[0134.703] lstrlenA (lpString="*.bmp") returned 5
	[0134.703] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\gCzGdX7uICsD5.pdf", pszSpec="*.gif") returned 0
	[0134.703] lstrlenA (lpString="*.gif") returned 5
	[0134.703] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\gCzGdX7uICsD5.pdf", pszSpec="*.png") returned 0
	[0134.703] lstrlenA (lpString="*.png") returned 5
	[0134.703] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\gCzGdX7uICsD5.pdf", pszSpec="*.doc") returned 0
	[0134.703] lstrlenA (lpString="*.doc") returned 5
	[0134.703] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\gCzGdX7uICsD5.pdf", pszSpec="*.docx") returned 0
	[0134.703] lstrlenA (lpString="*.docx") returned 6
	[0134.703] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\gCzGdX7uICsD5.pdf", pszSpec="*.xls") returned 0
	[0134.703] lstrlenA (lpString="*.xls") returned 5
	[0134.703] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\gCzGdX7uICsD5.pdf", pszSpec="*.xlsx") returned 0
	[0134.703] lstrlenA (lpString="*.xlsx") returned 6
	[0134.703] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\gCzGdX7uICsD5.pdf", pszSpec="*.ppt") returned 0
	[0134.703] lstrlenA (lpString="*.ppt") returned 5
	[0134.703] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\gCzGdX7uICsD5.pdf", pszSpec="*.pptx") returned 0
	[0134.703] lstrlenA (lpString="*.pptx") returned 6
	[0134.703] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\gCzGdX7uICsD5.pdf", pszSpec="*.txt") returned 0
	[0134.703] lstrlenA (lpString="*.txt") returned 5
	[0134.703] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\gCzGdX7uICsD5.pdf", pszSpec="*.pdf") returned 1
	[0134.703] lstrlenA (lpString="*.pdf") returned 5
	[0134.703] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\gCzGdX7uICsD5.pdf" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\gCzGdX7uICsD5.pdf") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\gCzGdX7uICsD5.pdf"
	[0134.703] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\gCzGdX7uICsD5.pdf" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\gCzGdX7uICsD5.pdf") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\gCzGdX7uICsD5.pdf"
	[0134.703] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\gCzGdX7uICsD5.pdf", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\gCzGdX7uICsD5.pdf.") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\gCzGdX7uICsD5.pdf."
	[0134.703] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\gCzGdX7uICsD5.pdf.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\gCzGdX7uICsD5.pdf.exe") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\gCzGdX7uICsD5.pdf.exe"
	[0134.703] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\gCzGdX7uICsD5.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\gczgdx7uicsd5.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0134.704] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17457
	[0134.704] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6bda7a40, dwHighDateTime=0x1d4c748), lpLastAccessTime=0x407536*(dwLowDateTime=0x78fd9580, dwHighDateTime=0x1d4ce74), lpLastWriteTime=0x40753e*(dwLowDateTime=0x78fd9580, dwHighDateTime=0x1d4ce74)) returned 1
	[0134.704] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.704] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x17415, lpOverlapped=0x0) returned 1
	[0134.705] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\gCzGdX7uICsD5.pdf") returned="gCzGdX7uICsD5.pdf"
	[0134.705] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.705] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x17415, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x17415, lpOverlapped=0x0) returned 1
	[0134.706] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.706] CloseHandle (hObject=0x210) returned 1
	[0134.706] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\gCzGdX7uICsD5.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\gczgdx7uicsd5.pdf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\gCzGdX7uICsD5.pdf.exe" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\gczgdx7uicsd5.pdf.exe")) returned 1
	[0134.706] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x184560f0, ftCreationTime.dwHighDateTime=0x1d4ccf9, ftLastAccessTime.dwLowDateTime=0xf7172d0, ftLastAccessTime.dwHighDateTime=0x1d4d1c6, ftLastWriteTime.dwLowDateTime=0xf7172d0, ftLastWriteTime.dwHighDateTime=0x1d4d1c6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="H64l1QH5QcmfR", cAlternateFileName="H64L1Q~1")) returned 1
	[0134.706] lstrcmpA (lpString1=".", lpString2="H64l1QH5QcmfR") returned -1
	[0134.706] lstrcmpA (lpString1="..", lpString2="H64l1QH5QcmfR") returned -1
	[0134.706] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\gCzGdX7uICsD5.pdf") returned="gCzGdX7uICsD5.pdf"
	[0134.707] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\", lpString2="H64l1QH5QcmfR" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR"
	[0134.707] lstrlenA (lpString="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR") returned 53
	[0134.707] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x184560f0, ftCreationTime.dwHighDateTime=0x1d4ccf9, ftLastAccessTime.dwLowDateTime=0xf7172d0, ftLastAccessTime.dwHighDateTime=0x1d4d1c6, ftLastWriteTime.dwLowDateTime=0xf7172d0, ftLastWriteTime.dwHighDateTime=0x1d4d1c6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName=".", cAlternateFileName="")) returned 0x7cb990
	[0134.707] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0134.707] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x184560f0, ftCreationTime.dwHighDateTime=0x1d4ccf9, ftLastAccessTime.dwLowDateTime=0xf7172d0, ftLastAccessTime.dwHighDateTime=0x1d4d1c6, ftLastWriteTime.dwLowDateTime=0xf7172d0, ftLastWriteTime.dwHighDateTime=0x1d4d1c6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="..", cAlternateFileName="")) returned 1
	[0134.707] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0134.707] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0134.707] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbe4c530, ftCreationTime.dwHighDateTime=0x1d4d467, ftLastAccessTime.dwLowDateTime=0x915b14b0, ftLastAccessTime.dwHighDateTime=0x1d4d1dd, ftLastWriteTime.dwLowDateTime=0x915b14b0, ftLastWriteTime.dwHighDateTime=0x1d4d1dd, nFileSizeHigh=0x0, nFileSizeLow=0x17d9a, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="0EHZwZNbEe5opLmntyo.pps", cAlternateFileName="0EHZWZ~1.PPS")) returned 1
	[0134.707] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0134.707] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="0EHZwZNbEe5opLmntyo.pps") returned 1
	[0134.707] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="0EHZwZNbEe5opLmntyo.pps") returned 1
	[0134.707] lstrcmpiA (lpString1="", lpString2="0EHZwZNbEe5opLmntyo.pps") returned -1
	[0134.707] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\*.*") returned="*.*"
	[0134.707] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\"
	[0134.707] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\") returned=""
	[0134.707] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.707] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\h64l1qh5qcmfr\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0134.707] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\h64l1qh5qcmfr\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0134.708] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0134.708] WriteFile (in: hFile=0x214, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0134.709] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0134.709] CloseHandle (hObject=0x214) returned 1
	[0134.709] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\", lpString2="0EHZwZNbEe5opLmntyo.pps" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps"
	[0134.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.zip") returned 0
	[0134.709] lstrlenA (lpString="*.zip") returned 5
	[0134.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.rar") returned 0
	[0134.709] lstrlenA (lpString="*.rar") returned 5
	[0134.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.7z") returned 0
	[0134.709] lstrlenA (lpString="*.7z") returned 4
	[0134.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.tar") returned 0
	[0134.709] lstrlenA (lpString="*.tar") returned 5
	[0134.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.gzip") returned 0
	[0134.709] lstrlenA (lpString="*.gzip") returned 6
	[0134.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.jpg") returned 0
	[0134.709] lstrlenA (lpString="*.jpg") returned 5
	[0134.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.jpeg") returned 0
	[0134.709] lstrlenA (lpString="*.jpeg") returned 6
	[0134.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.bmp") returned 0
	[0134.709] lstrlenA (lpString="*.bmp") returned 5
	[0134.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.gif") returned 0
	[0134.709] lstrlenA (lpString="*.gif") returned 5
	[0134.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.png") returned 0
	[0134.709] lstrlenA (lpString="*.png") returned 5
	[0134.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.doc") returned 0
	[0134.709] lstrlenA (lpString="*.doc") returned 5
	[0134.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.docx") returned 0
	[0134.709] lstrlenA (lpString="*.docx") returned 6
	[0134.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.xls") returned 0
	[0134.710] lstrlenA (lpString="*.xls") returned 5
	[0134.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.xlsx") returned 0
	[0134.710] lstrlenA (lpString="*.xlsx") returned 6
	[0134.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.ppt") returned 0
	[0134.710] lstrlenA (lpString="*.ppt") returned 5
	[0134.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.pptx") returned 0
	[0134.710] lstrlenA (lpString="*.pptx") returned 6
	[0134.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.txt") returned 0
	[0134.710] lstrlenA (lpString="*.txt") returned 5
	[0134.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.pdf") returned 0
	[0134.710] lstrlenA (lpString="*.pdf") returned 5
	[0134.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.htm") returned 0
	[0134.710] lstrlenA (lpString="*.htm") returned 5
	[0134.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.html") returned 0
	[0134.710] lstrlenA (lpString="*.html") returned 6
	[0134.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.mdb") returned 0
	[0134.710] lstrlenA (lpString="*.mdb") returned 5
	[0134.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.pfx") returned 0
	[0134.710] lstrlenA (lpString="*.pfx") returned 5
	[0134.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.md") returned 0
	[0134.710] lstrlenA (lpString="*.md") returned 4
	[0134.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.lnk") returned 0
	[0134.710] lstrlenA (lpString="*.lnk") returned 5
	[0134.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.torrent") returned 0
	[0134.710] lstrlenA (lpString="*.torrent") returned 9
	[0134.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.mov") returned 0
	[0134.710] lstrlenA (lpString="*.mov") returned 5
	[0134.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.3gp") returned 0
	[0134.710] lstrlenA (lpString="*.3gp") returned 5
	[0134.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.mpeg") returned 0
	[0134.710] lstrlenA (lpString="*.mpeg") returned 6
	[0134.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.mpg") returned 0
	[0134.710] lstrlenA (lpString="*.mpg") returned 5
	[0134.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.flv") returned 0
	[0134.711] lstrlenA (lpString="*.flv") returned 5
	[0134.711] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.avi") returned 0
	[0134.711] lstrlenA (lpString="*.avi") returned 5
	[0134.711] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.mp4") returned 0
	[0134.711] lstrlenA (lpString="*.mp4") returned 5
	[0134.711] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.wmv") returned 0
	[0134.711] lstrlenA (lpString="*.wmv") returned 5
	[0134.711] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.mkv") returned 0
	[0134.711] lstrlenA (lpString="*.mkv") returned 5
	[0134.711] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.mp3") returned 0
	[0134.711] lstrlenA (lpString="*.mp3") returned 5
	[0134.711] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.wav") returned 0
	[0134.711] lstrlenA (lpString="*.wav") returned 5
	[0134.711] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.flac") returned 0
	[0134.711] lstrlenA (lpString="*.flac") returned 6
	[0134.711] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.wma") returned 0
	[0134.711] lstrlenA (lpString="*.wma") returned 5
	[0134.711] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.au3") returned 0
	[0134.711] lstrlenA (lpString="*.au3") returned 5
	[0134.711] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.ahk") returned 0
	[0134.711] lstrlenA (lpString="*.ahk") returned 5
	[0134.711] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.c") returned 0
	[0134.711] lstrlenA (lpString="*.c") returned 3
	[0134.711] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.cc") returned 0
	[0134.711] lstrlenA (lpString="*.cc") returned 4
	[0134.711] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.cpp") returned 0
	[0134.711] lstrlenA (lpString="*.cpp") returned 5
	[0134.711] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.cxx") returned 0
	[0134.711] lstrlenA (lpString="*.cxx") returned 5
	[0134.711] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.c++") returned 0
	[0134.711] lstrlenA (lpString="*.c++") returned 5
	[0134.711] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.cs") returned 0
	[0134.712] lstrlenA (lpString="*.cs") returned 4
	[0134.712] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.vb") returned 0
	[0134.712] lstrlenA (lpString="*.vb") returned 4
	[0134.712] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.bas") returned 0
	[0134.712] lstrlenA (lpString="*.bas") returned 5
	[0134.712] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.csproj") returned 0
	[0134.712] lstrlenA (lpString="*.csproj") returned 8
	[0134.712] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.vbproj") returned 0
	[0134.712] lstrlenA (lpString="*.vbproj") returned 8
	[0134.712] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.vcxproj") returned 0
	[0134.712] lstrlenA (lpString="*.vcxproj") returned 9
	[0134.712] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.manifest") returned 0
	[0134.712] lstrlenA (lpString="*.manifest") returned 10
	[0134.712] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.php") returned 0
	[0134.712] lstrlenA (lpString="*.php") returned 5
	[0134.712] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.vbe") returned 0
	[0134.712] lstrlenA (lpString="*.vbe") returned 5
	[0134.712] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.vba") returned 0
	[0134.712] lstrlenA (lpString="*.vba") returned 5
	[0134.712] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.vbs") returned 0
	[0134.712] lstrlenA (lpString="*.vbs") returned 5
	[0134.712] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.bat") returned 0
	[0134.712] lstrlenA (lpString="*.bat") returned 5
	[0134.712] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.cmd") returned 0
	[0134.712] lstrlenA (lpString="*.cmd") returned 5
	[0134.712] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.js") returned 0
	[0134.712] lstrlenA (lpString="*.js") returned 4
	[0134.712] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.jscript") returned 0
	[0134.712] lstrlenA (lpString="*.jscript") returned 9
	[0134.712] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.hta") returned 0
	[0134.712] lstrlenA (lpString="*.hta") returned 5
	[0134.712] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.php7") returned 0
	[0134.712] lstrlenA (lpString="*.php7") returned 6
	[0134.712] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.db") returned 0
	[0134.713] lstrlenA (lpString="*.db") returned 4
	[0134.713] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.swf") returned 0
	[0134.713] lstrlenA (lpString="*.swf") returned 5
	[0134.713] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.eml") returned 0
	[0134.713] lstrlenA (lpString="*.eml") returned 5
	[0134.713] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.part") returned 0
	[0134.713] lstrlenA (lpString="*.part") returned 6
	[0134.713] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.nfo") returned 0
	[0134.713] lstrlenA (lpString="*.nfo") returned 5
	[0134.713] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.rsa") returned 0
	[0134.713] lstrlenA (lpString="*.rsa") returned 5
	[0134.713] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.key") returned 0
	[0134.713] lstrlenA (lpString="*.key") returned 5
	[0134.713] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.aes") returned 0
	[0134.713] lstrlenA (lpString="*.aes") returned 5
	[0134.713] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.blob") returned 0
	[0134.713] lstrlenA (lpString="*.blob") returned 6
	[0134.713] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.btc") returned 0
	[0134.713] lstrlenA (lpString="*.btc") returned 5
	[0134.713] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps", pszSpec="*.wallet") returned 0
	[0134.713] lstrlenA (lpString="*.wallet") returned 8
	[0134.713] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab2834c0, ftCreationTime.dwHighDateTime=0x1d4ce88, ftLastAccessTime.dwLowDateTime=0x19b66d20, ftLastAccessTime.dwHighDateTime=0x1d4cb38, ftLastWriteTime.dwLowDateTime=0x19b66d20, ftLastWriteTime.dwHighDateTime=0x1d4cb38, nFileSizeHigh=0x0, nFileSizeLow=0x608d, dwReserved0=0x0, dwReserved1=0x0, cFileName="A2wTF-2aWGn.csv", cAlternateFileName="A2WTF-~1.CSV")) returned 1
	[0134.713] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0134.713] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="A2wTF-2aWGn.csv") returned 1
	[0134.713] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="A2wTF-2aWGn.csv") returned 1
	[0134.713] lstrcmpiA (lpString1="", lpString2="A2wTF-2aWGn.csv") returned -1
	[0134.713] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\0EHZwZNbEe5opLmntyo.pps") returned="0EHZwZNbEe5opLmntyo.pps"
	[0134.713] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\"
	[0134.713] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\") returned=""
	[0134.713] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.713] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\h64l1qh5qcmfr\\how-to-decrypt-files.htm")) returned 0x20
	[0134.714] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\", lpString2="A2wTF-2aWGn.csv" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv"
	[0134.714] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.zip") returned 0
	[0134.714] lstrlenA (lpString="*.zip") returned 5
	[0134.714] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.rar") returned 0
	[0134.714] lstrlenA (lpString="*.rar") returned 5
	[0134.714] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.7z") returned 0
	[0134.714] lstrlenA (lpString="*.7z") returned 4
	[0134.714] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.tar") returned 0
	[0134.714] lstrlenA (lpString="*.tar") returned 5
	[0134.714] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.gzip") returned 0
	[0134.714] lstrlenA (lpString="*.gzip") returned 6
	[0134.714] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.jpg") returned 0
	[0134.714] lstrlenA (lpString="*.jpg") returned 5
	[0134.714] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.jpeg") returned 0
	[0134.714] lstrlenA (lpString="*.jpeg") returned 6
	[0134.714] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.bmp") returned 0
	[0134.714] lstrlenA (lpString="*.bmp") returned 5
	[0134.714] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.gif") returned 0
	[0134.714] lstrlenA (lpString="*.gif") returned 5
	[0134.714] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.png") returned 0
	[0134.714] lstrlenA (lpString="*.png") returned 5
	[0134.714] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.doc") returned 0
	[0134.714] lstrlenA (lpString="*.doc") returned 5
	[0134.714] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.docx") returned 0
	[0134.714] lstrlenA (lpString="*.docx") returned 6
	[0134.714] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.xls") returned 0
	[0134.714] lstrlenA (lpString="*.xls") returned 5
	[0134.714] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.xlsx") returned 0
	[0134.714] lstrlenA (lpString="*.xlsx") returned 6
	[0134.714] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.ppt") returned 0
	[0134.714] lstrlenA (lpString="*.ppt") returned 5
	[0134.714] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.pptx") returned 0
	[0134.714] lstrlenA (lpString="*.pptx") returned 6
	[0134.715] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.txt") returned 0
	[0134.715] lstrlenA (lpString="*.txt") returned 5
	[0134.715] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.pdf") returned 0
	[0134.715] lstrlenA (lpString="*.pdf") returned 5
	[0134.715] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.htm") returned 0
	[0134.715] lstrlenA (lpString="*.htm") returned 5
	[0134.715] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.html") returned 0
	[0134.715] lstrlenA (lpString="*.html") returned 6
	[0134.715] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.mdb") returned 0
	[0134.715] lstrlenA (lpString="*.mdb") returned 5
	[0134.715] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.pfx") returned 0
	[0134.715] lstrlenA (lpString="*.pfx") returned 5
	[0134.715] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.md") returned 0
	[0134.715] lstrlenA (lpString="*.md") returned 4
	[0134.715] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.lnk") returned 0
	[0134.715] lstrlenA (lpString="*.lnk") returned 5
	[0134.715] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.torrent") returned 0
	[0134.715] lstrlenA (lpString="*.torrent") returned 9
	[0134.715] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.mov") returned 0
	[0134.715] lstrlenA (lpString="*.mov") returned 5
	[0134.715] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.3gp") returned 0
	[0134.715] lstrlenA (lpString="*.3gp") returned 5
	[0134.715] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.mpeg") returned 0
	[0134.715] lstrlenA (lpString="*.mpeg") returned 6
	[0134.715] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.mpg") returned 0
	[0134.715] lstrlenA (lpString="*.mpg") returned 5
	[0134.715] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.flv") returned 0
	[0134.715] lstrlenA (lpString="*.flv") returned 5
	[0134.715] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.avi") returned 0
	[0134.715] lstrlenA (lpString="*.avi") returned 5
	[0134.715] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.mp4") returned 0
	[0134.715] lstrlenA (lpString="*.mp4") returned 5
	[0134.715] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.wmv") returned 0
	[0134.715] lstrlenA (lpString="*.wmv") returned 5
	[0134.715] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.mkv") returned 0
	[0134.716] lstrlenA (lpString="*.mkv") returned 5
	[0134.716] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.mp3") returned 0
	[0134.716] lstrlenA (lpString="*.mp3") returned 5
	[0134.716] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.wav") returned 0
	[0134.716] lstrlenA (lpString="*.wav") returned 5
	[0134.716] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.flac") returned 0
	[0134.716] lstrlenA (lpString="*.flac") returned 6
	[0134.716] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.wma") returned 0
	[0134.716] lstrlenA (lpString="*.wma") returned 5
	[0134.716] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.au3") returned 0
	[0134.716] lstrlenA (lpString="*.au3") returned 5
	[0134.716] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.ahk") returned 0
	[0134.716] lstrlenA (lpString="*.ahk") returned 5
	[0134.716] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.c") returned 0
	[0134.716] lstrlenA (lpString="*.c") returned 3
	[0134.716] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.cc") returned 0
	[0134.716] lstrlenA (lpString="*.cc") returned 4
	[0134.716] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.cpp") returned 0
	[0134.716] lstrlenA (lpString="*.cpp") returned 5
	[0134.716] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.cxx") returned 0
	[0134.716] lstrlenA (lpString="*.cxx") returned 5
	[0134.716] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.c++") returned 0
	[0134.716] lstrlenA (lpString="*.c++") returned 5
	[0134.716] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.cs") returned 0
	[0134.716] lstrlenA (lpString="*.cs") returned 4
	[0134.716] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.vb") returned 0
	[0134.716] lstrlenA (lpString="*.vb") returned 4
	[0134.716] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.bas") returned 0
	[0134.716] lstrlenA (lpString="*.bas") returned 5
	[0134.716] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.csproj") returned 0
	[0134.716] lstrlenA (lpString="*.csproj") returned 8
	[0134.716] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.vbproj") returned 0
	[0134.716] lstrlenA (lpString="*.vbproj") returned 8
	[0134.716] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.vcxproj") returned 0
	[0134.716] lstrlenA (lpString="*.vcxproj") returned 9
	[0134.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.manifest") returned 0
	[0134.717] lstrlenA (lpString="*.manifest") returned 10
	[0134.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.php") returned 0
	[0134.717] lstrlenA (lpString="*.php") returned 5
	[0134.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.vbe") returned 0
	[0134.717] lstrlenA (lpString="*.vbe") returned 5
	[0134.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.vba") returned 0
	[0134.717] lstrlenA (lpString="*.vba") returned 5
	[0134.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.vbs") returned 0
	[0134.717] lstrlenA (lpString="*.vbs") returned 5
	[0134.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.bat") returned 0
	[0134.717] lstrlenA (lpString="*.bat") returned 5
	[0134.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.cmd") returned 0
	[0134.717] lstrlenA (lpString="*.cmd") returned 5
	[0134.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.js") returned 0
	[0134.717] lstrlenA (lpString="*.js") returned 4
	[0134.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.jscript") returned 0
	[0134.717] lstrlenA (lpString="*.jscript") returned 9
	[0134.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.hta") returned 0
	[0134.717] lstrlenA (lpString="*.hta") returned 5
	[0134.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.php7") returned 0
	[0134.717] lstrlenA (lpString="*.php7") returned 6
	[0134.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.db") returned 0
	[0134.717] lstrlenA (lpString="*.db") returned 4
	[0134.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.swf") returned 0
	[0134.717] lstrlenA (lpString="*.swf") returned 5
	[0134.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.eml") returned 0
	[0134.717] lstrlenA (lpString="*.eml") returned 5
	[0134.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.part") returned 0
	[0134.717] lstrlenA (lpString="*.part") returned 6
	[0134.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.nfo") returned 0
	[0134.717] lstrlenA (lpString="*.nfo") returned 5
	[0134.717] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.rsa") returned 0
	[0134.717] lstrlenA (lpString="*.rsa") returned 5
	[0134.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.key") returned 0
	[0134.718] lstrlenA (lpString="*.key") returned 5
	[0134.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.aes") returned 0
	[0134.718] lstrlenA (lpString="*.aes") returned 5
	[0134.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.blob") returned 0
	[0134.718] lstrlenA (lpString="*.blob") returned 6
	[0134.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.btc") returned 0
	[0134.718] lstrlenA (lpString="*.btc") returned 5
	[0134.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv", pszSpec="*.wallet") returned 0
	[0134.718] lstrlenA (lpString="*.wallet") returned 8
	[0134.718] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ddbbb0, ftCreationTime.dwHighDateTime=0x1d4c6eb, ftLastAccessTime.dwLowDateTime=0xa5f32670, ftLastAccessTime.dwHighDateTime=0x1d4c91c, ftLastWriteTime.dwLowDateTime=0xa5f32670, ftLastWriteTime.dwHighDateTime=0x1d4c91c, nFileSizeHigh=0x0, nFileSizeLow=0x1870b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AYPQs.pptx", cAlternateFileName="AYPQS~1.PPT")) returned 1
	[0134.718] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0134.718] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="AYPQs.pptx") returned 1
	[0134.718] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="AYPQs.pptx") returned 1
	[0134.718] lstrcmpiA (lpString1="", lpString2="AYPQs.pptx") returned -1
	[0134.718] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\A2wTF-2aWGn.csv") returned="A2wTF-2aWGn.csv"
	[0134.718] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\"
	[0134.718] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\") returned=""
	[0134.718] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.718] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\h64l1qh5qcmfr\\how-to-decrypt-files.htm")) returned 0x20
	[0134.718] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\", lpString2="AYPQs.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\AYPQs.pptx") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\AYPQs.pptx"
	[0134.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\AYPQs.pptx", pszSpec="*.zip") returned 0
	[0134.718] lstrlenA (lpString="*.zip") returned 5
	[0134.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\AYPQs.pptx", pszSpec="*.rar") returned 0
	[0134.718] lstrlenA (lpString="*.rar") returned 5
	[0134.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\AYPQs.pptx", pszSpec="*.7z") returned 0
	[0134.718] lstrlenA (lpString="*.7z") returned 4
	[0134.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\AYPQs.pptx", pszSpec="*.tar") returned 0
	[0134.718] lstrlenA (lpString="*.tar") returned 5
	[0134.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\AYPQs.pptx", pszSpec="*.gzip") returned 0
	[0134.718] lstrlenA (lpString="*.gzip") returned 6
	[0134.718] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\AYPQs.pptx", pszSpec="*.jpg") returned 0
	[0134.719] lstrlenA (lpString="*.jpg") returned 5
	[0134.719] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\AYPQs.pptx", pszSpec="*.jpeg") returned 0
	[0134.719] lstrlenA (lpString="*.jpeg") returned 6
	[0134.719] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\AYPQs.pptx", pszSpec="*.bmp") returned 0
	[0134.719] lstrlenA (lpString="*.bmp") returned 5
	[0134.719] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\AYPQs.pptx", pszSpec="*.gif") returned 0
	[0134.719] lstrlenA (lpString="*.gif") returned 5
	[0134.719] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\AYPQs.pptx", pszSpec="*.png") returned 0
	[0134.719] lstrlenA (lpString="*.png") returned 5
	[0134.719] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\AYPQs.pptx", pszSpec="*.doc") returned 0
	[0134.719] lstrlenA (lpString="*.doc") returned 5
	[0134.719] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\AYPQs.pptx", pszSpec="*.docx") returned 0
	[0134.719] lstrlenA (lpString="*.docx") returned 6
	[0134.719] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\AYPQs.pptx", pszSpec="*.xls") returned 0
	[0134.719] lstrlenA (lpString="*.xls") returned 5
	[0134.719] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\AYPQs.pptx", pszSpec="*.xlsx") returned 0
	[0134.719] lstrlenA (lpString="*.xlsx") returned 6
	[0134.719] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\AYPQs.pptx", pszSpec="*.ppt") returned 0
	[0134.719] lstrlenA (lpString="*.ppt") returned 5
	[0134.719] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\AYPQs.pptx", pszSpec="*.pptx") returned 1
	[0134.719] lstrlenA (lpString="*.pptx") returned 6
	[0134.719] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\AYPQs.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\AYPQs.pptx") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\AYPQs.pptx"
	[0134.719] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\AYPQs.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\AYPQs.pptx") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\AYPQs.pptx"
	[0134.719] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\AYPQs.pptx", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\AYPQs.pptx.") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\AYPQs.pptx."
	[0134.719] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\AYPQs.pptx.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\AYPQs.pptx.exe") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\AYPQs.pptx.exe"
	[0134.719] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\AYPQs.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\h64l1qh5qcmfr\\aypqs.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0134.720] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1870b
	[0134.720] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x50ddbbb0, dwHighDateTime=0x1d4c6eb), lpLastAccessTime=0x407536*(dwLowDateTime=0xa5f32670, dwHighDateTime=0x1d4c91c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa5f32670, dwHighDateTime=0x1d4c91c)) returned 1
	[0134.720] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.720] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x186c9, lpOverlapped=0x0) returned 1
	[0134.721] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\AYPQs.pptx") returned="AYPQs.pptx"
	[0134.721] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.721] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x186c9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x186c9, lpOverlapped=0x0) returned 1
	[0134.722] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.722] CloseHandle (hObject=0x214) returned 1
	[0134.722] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\AYPQs.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\h64l1qh5qcmfr\\aypqs.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\AYPQs.pptx.exe" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\h64l1qh5qcmfr\\aypqs.pptx.exe")) returned 1
	[0134.723] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x483e4d30, ftCreationTime.dwHighDateTime=0x1d4cefc, ftLastAccessTime.dwLowDateTime=0xdf5ba320, ftLastAccessTime.dwHighDateTime=0x1d4d30c, ftLastWriteTime.dwLowDateTime=0xdf5ba320, ftLastWriteTime.dwHighDateTime=0x1d4d30c, nFileSizeHigh=0x0, nFileSizeLow=0x11f9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="XgfX9ymIajHX.doc", cAlternateFileName="XGFX9Y~1.DOC")) returned 1
	[0134.723] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0134.723] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="XgfX9ymIajHX.doc") returned -1
	[0134.723] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="XgfX9ymIajHX.doc") returned -1
	[0134.723] lstrcmpiA (lpString1="", lpString2="XgfX9ymIajHX.doc") returned -1
	[0134.723] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\AYPQs.pptx") returned="AYPQs.pptx"
	[0134.723] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\"
	[0134.723] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\") returned=""
	[0134.723] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.723] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\h64l1qh5qcmfr\\how-to-decrypt-files.htm")) returned 0x20
	[0134.723] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\", lpString2="XgfX9ymIajHX.doc" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\XgfX9ymIajHX.doc") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\XgfX9ymIajHX.doc"
	[0134.723] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\XgfX9ymIajHX.doc", pszSpec="*.zip") returned 0
	[0134.723] lstrlenA (lpString="*.zip") returned 5
	[0134.723] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\XgfX9ymIajHX.doc", pszSpec="*.rar") returned 0
	[0134.723] lstrlenA (lpString="*.rar") returned 5
	[0134.723] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\XgfX9ymIajHX.doc", pszSpec="*.7z") returned 0
	[0134.723] lstrlenA (lpString="*.7z") returned 4
	[0134.723] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\XgfX9ymIajHX.doc", pszSpec="*.tar") returned 0
	[0134.723] lstrlenA (lpString="*.tar") returned 5
	[0134.723] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\XgfX9ymIajHX.doc", pszSpec="*.gzip") returned 0
	[0134.723] lstrlenA (lpString="*.gzip") returned 6
	[0134.723] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\XgfX9ymIajHX.doc", pszSpec="*.jpg") returned 0
	[0134.723] lstrlenA (lpString="*.jpg") returned 5
	[0134.723] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\XgfX9ymIajHX.doc", pszSpec="*.jpeg") returned 0
	[0134.723] lstrlenA (lpString="*.jpeg") returned 6
	[0134.724] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\XgfX9ymIajHX.doc", pszSpec="*.bmp") returned 0
	[0134.724] lstrlenA (lpString="*.bmp") returned 5
	[0134.724] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\XgfX9ymIajHX.doc", pszSpec="*.gif") returned 0
	[0134.724] lstrlenA (lpString="*.gif") returned 5
	[0134.724] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\XgfX9ymIajHX.doc", pszSpec="*.png") returned 0
	[0134.724] lstrlenA (lpString="*.png") returned 5
	[0134.724] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\XgfX9ymIajHX.doc", pszSpec="*.doc") returned 1
	[0134.724] lstrlenA (lpString="*.doc") returned 5
	[0134.724] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\XgfX9ymIajHX.doc" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\XgfX9ymIajHX.doc") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\XgfX9ymIajHX.doc"
	[0134.724] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\XgfX9ymIajHX.doc" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\XgfX9ymIajHX.doc") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\XgfX9ymIajHX.doc"
	[0134.724] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\XgfX9ymIajHX.doc", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\XgfX9ymIajHX.doc.") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\XgfX9ymIajHX.doc."
	[0134.724] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\XgfX9ymIajHX.doc.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\XgfX9ymIajHX.doc.exe") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\XgfX9ymIajHX.doc.exe"
	[0134.724] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\XgfX9ymIajHX.doc" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\h64l1qh5qcmfr\\xgfx9ymiajhx.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0134.724] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11f9b
	[0134.724] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x483e4d30, dwHighDateTime=0x1d4cefc), lpLastAccessTime=0x407536*(dwLowDateTime=0xdf5ba320, dwHighDateTime=0x1d4d30c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xdf5ba320, dwHighDateTime=0x1d4d30c)) returned 1
	[0134.724] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.724] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x11f59, lpOverlapped=0x0) returned 1
	[0134.725] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\XgfX9ymIajHX.doc") returned="XgfX9ymIajHX.doc"
	[0134.726] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.726] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x11f59, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x11f59, lpOverlapped=0x0) returned 1
	[0134.726] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.726] CloseHandle (hObject=0x214) returned 1
	[0134.727] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\XgfX9ymIajHX.doc" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\h64l1qh5qcmfr\\xgfx9ymiajhx.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\H64l1QH5QcmfR\\XgfX9ymIajHX.doc.exe" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\h64l1qh5qcmfr\\xgfx9ymiajhx.doc.exe")) returned 1
	[0134.727] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x483e4d30, ftCreationTime.dwHighDateTime=0x1d4cefc, ftLastAccessTime.dwLowDateTime=0xdf5ba320, ftLastAccessTime.dwHighDateTime=0x1d4d30c, ftLastWriteTime.dwLowDateTime=0xdf5ba320, ftLastWriteTime.dwHighDateTime=0x1d4d30c, nFileSizeHigh=0x0, nFileSizeLow=0x11f9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="XgfX9ymIajHX.doc", cAlternateFileName="XGFX9Y~1.DOC")) returned 0
	[0134.727] FindClose (in: hFindFile=0x7cb990 | out: hFindFile=0x7cb990) returned 1
	[0134.727] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae36c620, ftCreationTime.dwHighDateTime=0x1d4ca1b, ftLastAccessTime.dwLowDateTime=0x2f399480, ftLastAccessTime.dwHighDateTime=0x1d4cde3, ftLastWriteTime.dwLowDateTime=0x2f399480, ftLastWriteTime.dwHighDateTime=0x1d4cde3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20, dwReserved1=0x0, cFileName="Iht5qWf", cAlternateFileName="")) returned 1
	[0134.727] lstrcmpA (lpString1=".", lpString2="Iht5qWf") returned -1
	[0134.727] lstrcmpA (lpString1="..", lpString2="Iht5qWf") returned -1
	[0134.727] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\*.*") returned="*.*"
	[0134.727] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\", lpString2="Iht5qWf" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf"
	[0134.727] lstrlenA (lpString="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf") returned 47
	[0134.727] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae36c620, ftCreationTime.dwHighDateTime=0x1d4ca1b, ftLastAccessTime.dwLowDateTime=0x2f399480, ftLastAccessTime.dwHighDateTime=0x1d4cde3, ftLastWriteTime.dwLowDateTime=0x2f399480, ftLastWriteTime.dwHighDateTime=0x1d4cde3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb910
	[0134.728] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0134.728] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae36c620, ftCreationTime.dwHighDateTime=0x1d4ca1b, ftLastAccessTime.dwLowDateTime=0x2f399480, ftLastAccessTime.dwHighDateTime=0x1d4cde3, ftLastWriteTime.dwLowDateTime=0x2f399480, ftLastWriteTime.dwHighDateTime=0x1d4cde3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.728] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0134.728] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0134.728] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf33030d0, ftCreationTime.dwHighDateTime=0x1d4d49e, ftLastAccessTime.dwLowDateTime=0x4afeeba0, ftLastAccessTime.dwHighDateTime=0x1d4ca4d, ftLastWriteTime.dwLowDateTime=0x4afeeba0, ftLastWriteTime.dwHighDateTime=0x1d4ca4d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="aTTm7", cAlternateFileName="")) returned 1
	[0134.728] lstrcmpA (lpString1=".", lpString2="aTTm7") returned -1
	[0134.728] lstrcmpA (lpString1="..", lpString2="aTTm7") returned -1
	[0134.728] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\*.*") returned="*.*"
	[0134.728] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\", lpString2="aTTm7" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7"
	[0134.728] lstrlenA (lpString="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7") returned 53
	[0134.728] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\*.*", lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf33030d0, ftCreationTime.dwHighDateTime=0x1d4d49e, ftLastAccessTime.dwLowDateTime=0x4afeeba0, ftLastAccessTime.dwHighDateTime=0x1d4ca4d, ftLastWriteTime.dwLowDateTime=0x4afeeba0, ftLastWriteTime.dwHighDateTime=0x1d4ca4d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb950
	[0134.728] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0134.728] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf33030d0, ftCreationTime.dwHighDateTime=0x1d4d49e, ftLastAccessTime.dwLowDateTime=0x4afeeba0, ftLastAccessTime.dwHighDateTime=0x1d4ca4d, ftLastWriteTime.dwLowDateTime=0x4afeeba0, ftLastWriteTime.dwHighDateTime=0x1d4ca4d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.728] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0134.728] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0134.728] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab7a8be0, ftCreationTime.dwHighDateTime=0x1d4ca95, ftLastAccessTime.dwLowDateTime=0x3d6b22d0, ftLastAccessTime.dwHighDateTime=0x1d4d08b, ftLastWriteTime.dwLowDateTime=0x3d6b22d0, ftLastWriteTime.dwHighDateTime=0x1d4d08b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4, dwReserved1=0x0, cFileName="0I6iV1JNRFTVkRb_P", cAlternateFileName="0I6IV1~1")) returned 1
	[0134.728] lstrcmpA (lpString1=".", lpString2="0I6iV1JNRFTVkRb_P") returned -1
	[0134.728] lstrcmpA (lpString1="..", lpString2="0I6iV1JNRFTVkRb_P") returned -1
	[0134.728] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\*.*") returned="*.*"
	[0134.728] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\", lpString2="0I6iV1JNRFTVkRb_P" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P"
	[0134.728] lstrlenA (lpString="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P") returned 71
	[0134.728] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\*.*", lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab7a8be0, ftCreationTime.dwHighDateTime=0x1d4ca95, ftLastAccessTime.dwLowDateTime=0x3d6b22d0, ftLastAccessTime.dwHighDateTime=0x1d4d08b, ftLastWriteTime.dwLowDateTime=0x3d6b22d0, ftLastWriteTime.dwHighDateTime=0x1d4d08b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb650
	[0134.728] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0134.729] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab7a8be0, ftCreationTime.dwHighDateTime=0x1d4ca95, ftLastAccessTime.dwLowDateTime=0x3d6b22d0, ftLastAccessTime.dwHighDateTime=0x1d4d08b, ftLastWriteTime.dwLowDateTime=0x3d6b22d0, ftLastWriteTime.dwHighDateTime=0x1d4d08b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.729] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0134.729] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0134.729] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc01d53f0, ftCreationTime.dwHighDateTime=0x1d4d0e6, ftLastAccessTime.dwLowDateTime=0x7359500, ftLastAccessTime.dwHighDateTime=0x1d4d26c, ftLastWriteTime.dwLowDateTime=0x7359500, ftLastWriteTime.dwHighDateTime=0x1d4d26c, nFileSizeHigh=0x0, nFileSizeLow=0x12914, dwReserved0=0x2, dwReserved1=0x0, cFileName="07lqjr.rtf", cAlternateFileName="")) returned 1
	[0134.729] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0134.729] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="07lqjr.rtf") returned 1
	[0134.729] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="07lqjr.rtf") returned 1
	[0134.729] lstrcmpiA (lpString1="", lpString2="07lqjr.rtf") returned -1
	[0134.729] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\*.*") returned="*.*"
	[0134.729] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\"
	[0134.729] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\") returned=""
	[0134.729] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.729] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\attm7\\0i6iv1jnrftvkrb_p\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0134.729] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\attm7\\0i6iv1jnrftvkrb_p\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0134.778] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0134.778] WriteFile (in: hFile=0x21c, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0134.779] SetFileTime (hFile=0x21c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0134.779] CloseHandle (hObject=0x21c) returned 1
	[0134.779] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\", lpString2="07lqjr.rtf" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf"
	[0134.779] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.zip") returned 0
	[0134.779] lstrlenA (lpString="*.zip") returned 5
	[0134.779] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.rar") returned 0
	[0134.779] lstrlenA (lpString="*.rar") returned 5
	[0134.779] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.7z") returned 0
	[0134.779] lstrlenA (lpString="*.7z") returned 4
	[0134.779] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.tar") returned 0
	[0134.779] lstrlenA (lpString="*.tar") returned 5
	[0134.780] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.gzip") returned 0
	[0134.780] lstrlenA (lpString="*.gzip") returned 6
	[0134.780] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.jpg") returned 0
	[0134.780] lstrlenA (lpString="*.jpg") returned 5
	[0134.780] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.jpeg") returned 0
	[0134.780] lstrlenA (lpString="*.jpeg") returned 6
	[0134.780] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.bmp") returned 0
	[0134.780] lstrlenA (lpString="*.bmp") returned 5
	[0134.780] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.gif") returned 0
	[0134.780] lstrlenA (lpString="*.gif") returned 5
	[0134.780] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.png") returned 0
	[0134.780] lstrlenA (lpString="*.png") returned 5
	[0134.780] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.doc") returned 0
	[0134.780] lstrlenA (lpString="*.doc") returned 5
	[0134.780] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.docx") returned 0
	[0134.780] lstrlenA (lpString="*.docx") returned 6
	[0134.780] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.xls") returned 0
	[0134.780] lstrlenA (lpString="*.xls") returned 5
	[0134.780] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.xlsx") returned 0
	[0134.780] lstrlenA (lpString="*.xlsx") returned 6
	[0134.780] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.ppt") returned 0
	[0134.780] lstrlenA (lpString="*.ppt") returned 5
	[0134.780] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.pptx") returned 0
	[0134.780] lstrlenA (lpString="*.pptx") returned 6
	[0134.780] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.txt") returned 0
	[0134.780] lstrlenA (lpString="*.txt") returned 5
	[0134.780] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.pdf") returned 0
	[0134.780] lstrlenA (lpString="*.pdf") returned 5
	[0134.780] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.htm") returned 0
	[0134.780] lstrlenA (lpString="*.htm") returned 5
	[0134.780] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.html") returned 0
	[0134.780] lstrlenA (lpString="*.html") returned 6
	[0134.780] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.mdb") returned 0
	[0134.780] lstrlenA (lpString="*.mdb") returned 5
	[0134.780] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.pfx") returned 0
	[0134.781] lstrlenA (lpString="*.pfx") returned 5
	[0134.781] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.md") returned 0
	[0134.781] lstrlenA (lpString="*.md") returned 4
	[0134.781] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.lnk") returned 0
	[0134.781] lstrlenA (lpString="*.lnk") returned 5
	[0134.781] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.torrent") returned 0
	[0134.781] lstrlenA (lpString="*.torrent") returned 9
	[0134.781] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.mov") returned 0
	[0134.781] lstrlenA (lpString="*.mov") returned 5
	[0134.781] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.3gp") returned 0
	[0134.781] lstrlenA (lpString="*.3gp") returned 5
	[0134.781] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.mpeg") returned 0
	[0134.781] lstrlenA (lpString="*.mpeg") returned 6
	[0134.781] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.mpg") returned 0
	[0134.781] lstrlenA (lpString="*.mpg") returned 5
	[0134.781] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.flv") returned 0
	[0134.781] lstrlenA (lpString="*.flv") returned 5
	[0134.781] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.avi") returned 0
	[0134.781] lstrlenA (lpString="*.avi") returned 5
	[0134.781] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.mp4") returned 0
	[0134.781] lstrlenA (lpString="*.mp4") returned 5
	[0134.781] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.wmv") returned 0
	[0134.781] lstrlenA (lpString="*.wmv") returned 5
	[0134.781] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.mkv") returned 0
	[0134.781] lstrlenA (lpString="*.mkv") returned 5
	[0134.781] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.mp3") returned 0
	[0134.781] lstrlenA (lpString="*.mp3") returned 5
	[0134.781] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.wav") returned 0
	[0134.781] lstrlenA (lpString="*.wav") returned 5
	[0134.781] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.flac") returned 0
	[0134.781] lstrlenA (lpString="*.flac") returned 6
	[0134.781] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.wma") returned 0
	[0134.781] lstrlenA (lpString="*.wma") returned 5
	[0134.781] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.au3") returned 0
	[0134.781] lstrlenA (lpString="*.au3") returned 5
	[0134.782] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.ahk") returned 0
	[0134.782] lstrlenA (lpString="*.ahk") returned 5
	[0134.782] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.c") returned 0
	[0134.782] lstrlenA (lpString="*.c") returned 3
	[0134.782] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.cc") returned 0
	[0134.782] lstrlenA (lpString="*.cc") returned 4
	[0134.782] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.cpp") returned 0
	[0134.782] lstrlenA (lpString="*.cpp") returned 5
	[0134.782] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.cxx") returned 0
	[0134.782] lstrlenA (lpString="*.cxx") returned 5
	[0134.782] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.c++") returned 0
	[0134.782] lstrlenA (lpString="*.c++") returned 5
	[0134.782] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.cs") returned 0
	[0134.782] lstrlenA (lpString="*.cs") returned 4
	[0134.782] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.vb") returned 0
	[0134.782] lstrlenA (lpString="*.vb") returned 4
	[0134.782] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.bas") returned 0
	[0134.782] lstrlenA (lpString="*.bas") returned 5
	[0134.782] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.csproj") returned 0
	[0134.782] lstrlenA (lpString="*.csproj") returned 8
	[0134.782] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.vbproj") returned 0
	[0134.782] lstrlenA (lpString="*.vbproj") returned 8
	[0134.782] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.vcxproj") returned 0
	[0134.782] lstrlenA (lpString="*.vcxproj") returned 9
	[0134.782] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.manifest") returned 0
	[0134.782] lstrlenA (lpString="*.manifest") returned 10
	[0134.782] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.php") returned 0
	[0134.782] lstrlenA (lpString="*.php") returned 5
	[0134.782] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.vbe") returned 0
	[0134.782] lstrlenA (lpString="*.vbe") returned 5
	[0134.782] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.vba") returned 0
	[0134.782] lstrlenA (lpString="*.vba") returned 5
	[0134.782] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.vbs") returned 0
	[0134.783] lstrlenA (lpString="*.vbs") returned 5
	[0134.783] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.bat") returned 0
	[0134.783] lstrlenA (lpString="*.bat") returned 5
	[0134.783] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.cmd") returned 0
	[0134.783] lstrlenA (lpString="*.cmd") returned 5
	[0134.783] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.js") returned 0
	[0134.783] lstrlenA (lpString="*.js") returned 4
	[0134.783] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.jscript") returned 0
	[0134.783] lstrlenA (lpString="*.jscript") returned 9
	[0134.783] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.hta") returned 0
	[0134.783] lstrlenA (lpString="*.hta") returned 5
	[0134.783] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.php7") returned 0
	[0134.783] lstrlenA (lpString="*.php7") returned 6
	[0134.783] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.db") returned 0
	[0134.783] lstrlenA (lpString="*.db") returned 4
	[0134.783] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.swf") returned 0
	[0134.783] lstrlenA (lpString="*.swf") returned 5
	[0134.783] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.eml") returned 0
	[0134.783] lstrlenA (lpString="*.eml") returned 5
	[0134.783] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.part") returned 0
	[0134.783] lstrlenA (lpString="*.part") returned 6
	[0134.783] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.nfo") returned 0
	[0134.783] lstrlenA (lpString="*.nfo") returned 5
	[0134.783] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.rsa") returned 0
	[0134.783] lstrlenA (lpString="*.rsa") returned 5
	[0134.783] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.key") returned 0
	[0134.783] lstrlenA (lpString="*.key") returned 5
	[0134.783] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.aes") returned 0
	[0134.783] lstrlenA (lpString="*.aes") returned 5
	[0134.783] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.blob") returned 0
	[0134.783] lstrlenA (lpString="*.blob") returned 6
	[0134.783] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.btc") returned 0
	[0134.783] lstrlenA (lpString="*.btc") returned 5
	[0134.783] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf", pszSpec="*.wallet") returned 0
	[0134.783] lstrlenA (lpString="*.wallet") returned 8
	[0134.784] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8154450, ftCreationTime.dwHighDateTime=0x1d4d36f, ftLastAccessTime.dwLowDateTime=0xa5d8ac00, ftLastAccessTime.dwHighDateTime=0x1d4d1a0, ftLastWriteTime.dwLowDateTime=0xa5d8ac00, ftLastWriteTime.dwHighDateTime=0x1d4d1a0, nFileSizeHigh=0x0, nFileSizeLow=0x9a90, dwReserved0=0x0, dwReserved1=0x0, cFileName="E6humPJEo2XHiUU.xls", cAlternateFileName="E6HUMP~1.XLS")) returned 1
	[0134.784] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0134.784] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="E6humPJEo2XHiUU.xls") returned 1
	[0134.784] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="E6humPJEo2XHiUU.xls") returned 1
	[0134.784] lstrcmpiA (lpString1="", lpString2="E6humPJEo2XHiUU.xls") returned -1
	[0134.784] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\07lqjr.rtf") returned="07lqjr.rtf"
	[0134.784] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\"
	[0134.784] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\") returned=""
	[0134.784] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.784] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\attm7\\0i6iv1jnrftvkrb_p\\how-to-decrypt-files.htm")) returned 0x20
	[0134.784] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\", lpString2="E6humPJEo2XHiUU.xls" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\E6humPJEo2XHiUU.xls") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\E6humPJEo2XHiUU.xls"
	[0134.784] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\E6humPJEo2XHiUU.xls", pszSpec="*.zip") returned 0
	[0134.784] lstrlenA (lpString="*.zip") returned 5
	[0134.784] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\E6humPJEo2XHiUU.xls", pszSpec="*.rar") returned 0
	[0134.784] lstrlenA (lpString="*.rar") returned 5
	[0134.784] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\E6humPJEo2XHiUU.xls", pszSpec="*.7z") returned 0
	[0134.784] lstrlenA (lpString="*.7z") returned 4
	[0134.784] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\E6humPJEo2XHiUU.xls", pszSpec="*.tar") returned 0
	[0134.784] lstrlenA (lpString="*.tar") returned 5
	[0134.784] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\E6humPJEo2XHiUU.xls", pszSpec="*.gzip") returned 0
	[0134.784] lstrlenA (lpString="*.gzip") returned 6
	[0134.784] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\E6humPJEo2XHiUU.xls", pszSpec="*.jpg") returned 0
	[0134.784] lstrlenA (lpString="*.jpg") returned 5
	[0134.784] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\E6humPJEo2XHiUU.xls", pszSpec="*.jpeg") returned 0
	[0134.784] lstrlenA (lpString="*.jpeg") returned 6
	[0134.784] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\E6humPJEo2XHiUU.xls", pszSpec="*.bmp") returned 0
	[0134.784] lstrlenA (lpString="*.bmp") returned 5
	[0134.784] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\E6humPJEo2XHiUU.xls", pszSpec="*.gif") returned 0
	[0134.784] lstrlenA (lpString="*.gif") returned 5
	[0134.785] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\E6humPJEo2XHiUU.xls", pszSpec="*.png") returned 0
	[0134.785] lstrlenA (lpString="*.png") returned 5
	[0134.785] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\E6humPJEo2XHiUU.xls", pszSpec="*.doc") returned 0
	[0134.785] lstrlenA (lpString="*.doc") returned 5
	[0134.785] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\E6humPJEo2XHiUU.xls", pszSpec="*.docx") returned 0
	[0134.785] lstrlenA (lpString="*.docx") returned 6
	[0134.785] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\E6humPJEo2XHiUU.xls", pszSpec="*.xls") returned 1
	[0134.785] lstrlenA (lpString="*.xls") returned 5
	[0134.785] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\E6humPJEo2XHiUU.xls" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\E6humPJEo2XHiUU.xls") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\E6humPJEo2XHiUU.xls"
	[0134.785] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\E6humPJEo2XHiUU.xls" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\E6humPJEo2XHiUU.xls") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\E6humPJEo2XHiUU.xls"
	[0134.785] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\E6humPJEo2XHiUU.xls", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\E6humPJEo2XHiUU.xls.") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\E6humPJEo2XHiUU.xls."
	[0134.785] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\E6humPJEo2XHiUU.xls.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\E6humPJEo2XHiUU.xls.exe") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\E6humPJEo2XHiUU.xls.exe"
	[0134.785] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\E6humPJEo2XHiUU.xls" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\attm7\\0i6iv1jnrftvkrb_p\\e6humpjeo2xhiuu.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0134.785] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9a90
	[0134.785] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd8154450, dwHighDateTime=0x1d4d36f), lpLastAccessTime=0x407536*(dwLowDateTime=0xa5d8ac00, dwHighDateTime=0x1d4d1a0), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa5d8ac00, dwHighDateTime=0x1d4d1a0)) returned 1
	[0134.786] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.786] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x9a4e, lpOverlapped=0x0) returned 1
	[0134.786] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\E6humPJEo2XHiUU.xls") returned="E6humPJEo2XHiUU.xls"
	[0134.787] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.787] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x9a4e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x9a4e, lpOverlapped=0x0) returned 1
	[0134.787] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.787] CloseHandle (hObject=0x21c) returned 1
	[0134.787] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\E6humPJEo2XHiUU.xls" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\attm7\\0i6iv1jnrftvkrb_p\\e6humpjeo2xhiuu.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\E6humPJEo2XHiUU.xls.exe" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\attm7\\0i6iv1jnrftvkrb_p\\e6humpjeo2xhiuu.xls.exe")) returned 1
	[0134.788] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbd7ab40, ftCreationTime.dwHighDateTime=0x1d4c9f2, ftLastAccessTime.dwLowDateTime=0xf80f9c20, ftLastAccessTime.dwHighDateTime=0x1d4d4c7, ftLastWriteTime.dwLowDateTime=0xf80f9c20, ftLastWriteTime.dwHighDateTime=0x1d4d4c7, nFileSizeHigh=0x0, nFileSizeLow=0x8657, dwReserved0=0x0, dwReserved1=0x0, cFileName="egzqLAl.ppt", cAlternateFileName="")) returned 1
	[0134.788] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0134.788] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="egzqLAl.ppt") returned -1
	[0134.788] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="egzqLAl.ppt") returned 1
	[0134.788] lstrcmpiA (lpString1="", lpString2="egzqLAl.ppt") returned -1
	[0134.788] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\E6humPJEo2XHiUU.xls") returned="E6humPJEo2XHiUU.xls"
	[0134.788] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\"
	[0134.788] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\") returned=""
	[0134.788] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.788] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\attm7\\0i6iv1jnrftvkrb_p\\how-to-decrypt-files.htm")) returned 0x20
	[0134.788] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\", lpString2="egzqLAl.ppt" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\egzqLAl.ppt") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\egzqLAl.ppt"
	[0134.788] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\egzqLAl.ppt", pszSpec="*.zip") returned 0
	[0134.788] lstrlenA (lpString="*.zip") returned 5
	[0134.788] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\egzqLAl.ppt", pszSpec="*.rar") returned 0
	[0134.788] lstrlenA (lpString="*.rar") returned 5
	[0134.788] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\egzqLAl.ppt", pszSpec="*.7z") returned 0
	[0134.788] lstrlenA (lpString="*.7z") returned 4
	[0134.788] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\egzqLAl.ppt", pszSpec="*.tar") returned 0
	[0134.788] lstrlenA (lpString="*.tar") returned 5
	[0134.788] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\egzqLAl.ppt", pszSpec="*.gzip") returned 0
	[0134.788] lstrlenA (lpString="*.gzip") returned 6
	[0134.789] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\egzqLAl.ppt", pszSpec="*.jpg") returned 0
	[0134.789] lstrlenA (lpString="*.jpg") returned 5
	[0134.789] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\egzqLAl.ppt", pszSpec="*.jpeg") returned 0
	[0134.789] lstrlenA (lpString="*.jpeg") returned 6
	[0134.789] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\egzqLAl.ppt", pszSpec="*.bmp") returned 0
	[0134.790] lstrlenA (lpString="*.bmp") returned 5
	[0134.790] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\egzqLAl.ppt", pszSpec="*.gif") returned 0
	[0134.790] lstrlenA (lpString="*.gif") returned 5
	[0134.790] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\egzqLAl.ppt", pszSpec="*.png") returned 0
	[0134.790] lstrlenA (lpString="*.png") returned 5
	[0134.790] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\egzqLAl.ppt", pszSpec="*.doc") returned 0
	[0134.790] lstrlenA (lpString="*.doc") returned 5
	[0134.790] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\egzqLAl.ppt", pszSpec="*.docx") returned 0
	[0134.790] lstrlenA (lpString="*.docx") returned 6
	[0134.790] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\egzqLAl.ppt", pszSpec="*.xls") returned 0
	[0134.790] lstrlenA (lpString="*.xls") returned 5
	[0134.790] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\egzqLAl.ppt", pszSpec="*.xlsx") returned 0
	[0134.790] lstrlenA (lpString="*.xlsx") returned 6
	[0134.790] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\egzqLAl.ppt", pszSpec="*.ppt") returned 1
	[0134.790] lstrlenA (lpString="*.ppt") returned 5
	[0134.791] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\egzqLAl.ppt" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\egzqLAl.ppt") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\egzqLAl.ppt"
	[0134.791] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\egzqLAl.ppt" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\egzqLAl.ppt") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\egzqLAl.ppt"
	[0134.791] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\egzqLAl.ppt", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\egzqLAl.ppt.") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\egzqLAl.ppt."
	[0134.791] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\egzqLAl.ppt.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\egzqLAl.ppt.exe") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\egzqLAl.ppt.exe"
	[0134.791] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\egzqLAl.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\attm7\\0i6iv1jnrftvkrb_p\\egzqlal.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0134.791] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8657
	[0134.791] GetFileTime (in: hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xdbd7ab40, dwHighDateTime=0x1d4c9f2), lpLastAccessTime=0x407536*(dwLowDateTime=0xf80f9c20, dwHighDateTime=0x1d4d4c7), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf80f9c20, dwHighDateTime=0x1d4d4c7)) returned 1
	[0134.791] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.791] ReadFile (in: hFile=0x21c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x8615, lpOverlapped=0x0) returned 1
	[0134.792] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\egzqLAl.ppt") returned="egzqLAl.ppt"
	[0134.792] SetFilePointer (in: hFile=0x21c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.792] WriteFile (in: hFile=0x21c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x8615, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x8615, lpOverlapped=0x0) returned 1
	[0134.792] SetFileTime (hFile=0x21c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.793] CloseHandle (hObject=0x21c) returned 1
	[0134.793] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\egzqLAl.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\attm7\\0i6iv1jnrftvkrb_p\\egzqlal.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\egzqLAl.ppt.exe" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\attm7\\0i6iv1jnrftvkrb_p\\egzqlal.ppt.exe")) returned 1
	[0134.793] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a243d50, ftCreationTime.dwHighDateTime=0x1d4d402, ftLastAccessTime.dwLowDateTime=0xa0ad5f40, ftLastAccessTime.dwHighDateTime=0x1d4d1a6, ftLastWriteTime.dwLowDateTime=0xa0ad5f40, ftLastWriteTime.dwHighDateTime=0x1d4d1a6, nFileSizeHigh=0x0, nFileSizeLow=0xcf20, dwReserved0=0x0, dwReserved1=0x0, cFileName="I1zwy3ti0.rtf", cAlternateFileName="I1ZWY3~1.RTF")) returned 1
	[0134.793] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0134.793] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="I1zwy3ti0.rtf") returned -1
	[0134.793] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="I1zwy3ti0.rtf") returned -1
	[0134.793] lstrcmpiA (lpString1="", lpString2="I1zwy3ti0.rtf") returned -1
	[0134.793] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\egzqLAl.ppt") returned="egzqLAl.ppt"
	[0134.793] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\"
	[0134.793] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\") returned=""
	[0134.793] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.793] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\attm7\\0i6iv1jnrftvkrb_p\\how-to-decrypt-files.htm")) returned 0x20
	[0134.794] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\", lpString2="I1zwy3ti0.rtf" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf"
	[0134.794] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.zip") returned 0
	[0134.794] lstrlenA (lpString="*.zip") returned 5
	[0134.794] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.rar") returned 0
	[0134.794] lstrlenA (lpString="*.rar") returned 5
	[0134.794] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.7z") returned 0
	[0134.794] lstrlenA (lpString="*.7z") returned 4
	[0134.794] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.tar") returned 0
	[0134.794] lstrlenA (lpString="*.tar") returned 5
	[0134.794] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.gzip") returned 0
	[0134.794] lstrlenA (lpString="*.gzip") returned 6
	[0134.794] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.jpg") returned 0
	[0134.794] lstrlenA (lpString="*.jpg") returned 5
	[0134.794] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.jpeg") returned 0
	[0134.794] lstrlenA (lpString="*.jpeg") returned 6
	[0134.794] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.bmp") returned 0
	[0134.794] lstrlenA (lpString="*.bmp") returned 5
	[0134.794] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.gif") returned 0
	[0134.794] lstrlenA (lpString="*.gif") returned 5
	[0134.794] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.png") returned 0
	[0134.794] lstrlenA (lpString="*.png") returned 5
	[0134.794] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.doc") returned 0
	[0134.794] lstrlenA (lpString="*.doc") returned 5
	[0134.794] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.docx") returned 0
	[0134.794] lstrlenA (lpString="*.docx") returned 6
	[0134.794] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.xls") returned 0
	[0134.794] lstrlenA (lpString="*.xls") returned 5
	[0134.794] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.xlsx") returned 0
	[0134.794] lstrlenA (lpString="*.xlsx") returned 6
	[0134.794] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.ppt") returned 0
	[0134.794] lstrlenA (lpString="*.ppt") returned 5
	[0134.794] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.pptx") returned 0
	[0134.794] lstrlenA (lpString="*.pptx") returned 6
	[0134.795] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.txt") returned 0
	[0134.795] lstrlenA (lpString="*.txt") returned 5
	[0134.795] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.pdf") returned 0
	[0134.795] lstrlenA (lpString="*.pdf") returned 5
	[0134.795] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.htm") returned 0
	[0134.795] lstrlenA (lpString="*.htm") returned 5
	[0134.795] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.html") returned 0
	[0134.795] lstrlenA (lpString="*.html") returned 6
	[0134.795] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.mdb") returned 0
	[0134.795] lstrlenA (lpString="*.mdb") returned 5
	[0134.795] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.pfx") returned 0
	[0134.795] lstrlenA (lpString="*.pfx") returned 5
	[0134.795] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.md") returned 0
	[0134.795] lstrlenA (lpString="*.md") returned 4
	[0134.795] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.lnk") returned 0
	[0134.795] lstrlenA (lpString="*.lnk") returned 5
	[0134.795] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.torrent") returned 0
	[0134.795] lstrlenA (lpString="*.torrent") returned 9
	[0134.795] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.mov") returned 0
	[0134.795] lstrlenA (lpString="*.mov") returned 5
	[0134.795] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.3gp") returned 0
	[0134.795] lstrlenA (lpString="*.3gp") returned 5
	[0134.795] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.mpeg") returned 0
	[0134.795] lstrlenA (lpString="*.mpeg") returned 6
	[0134.795] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.mpg") returned 0
	[0134.795] lstrlenA (lpString="*.mpg") returned 5
	[0134.795] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.flv") returned 0
	[0134.795] lstrlenA (lpString="*.flv") returned 5
	[0134.795] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.avi") returned 0
	[0134.795] lstrlenA (lpString="*.avi") returned 5
	[0134.795] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.mp4") returned 0
	[0134.795] lstrlenA (lpString="*.mp4") returned 5
	[0134.795] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.wmv") returned 0
	[0134.795] lstrlenA (lpString="*.wmv") returned 5
	[0134.795] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.mkv") returned 0
	[0134.796] lstrlenA (lpString="*.mkv") returned 5
	[0134.796] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.mp3") returned 0
	[0134.796] lstrlenA (lpString="*.mp3") returned 5
	[0134.796] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.wav") returned 0
	[0134.796] lstrlenA (lpString="*.wav") returned 5
	[0134.796] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.flac") returned 0
	[0134.796] lstrlenA (lpString="*.flac") returned 6
	[0134.796] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.wma") returned 0
	[0134.796] lstrlenA (lpString="*.wma") returned 5
	[0134.796] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.au3") returned 0
	[0134.796] lstrlenA (lpString="*.au3") returned 5
	[0134.796] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.ahk") returned 0
	[0134.796] lstrlenA (lpString="*.ahk") returned 5
	[0134.796] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.c") returned 0
	[0134.796] lstrlenA (lpString="*.c") returned 3
	[0134.796] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.cc") returned 0
	[0134.796] lstrlenA (lpString="*.cc") returned 4
	[0134.796] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.cpp") returned 0
	[0134.796] lstrlenA (lpString="*.cpp") returned 5
	[0134.796] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.cxx") returned 0
	[0134.796] lstrlenA (lpString="*.cxx") returned 5
	[0134.796] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.c++") returned 0
	[0134.796] lstrlenA (lpString="*.c++") returned 5
	[0134.796] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.cs") returned 0
	[0134.796] lstrlenA (lpString="*.cs") returned 4
	[0134.796] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.vb") returned 0
	[0134.796] lstrlenA (lpString="*.vb") returned 4
	[0134.796] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.bas") returned 0
	[0134.796] lstrlenA (lpString="*.bas") returned 5
	[0134.796] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.csproj") returned 0
	[0134.796] lstrlenA (lpString="*.csproj") returned 8
	[0134.796] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.vbproj") returned 0
	[0134.796] lstrlenA (lpString="*.vbproj") returned 8
	[0134.796] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.vcxproj") returned 0
	[0134.796] lstrlenA (lpString="*.vcxproj") returned 9
	[0134.797] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.manifest") returned 0
	[0134.797] lstrlenA (lpString="*.manifest") returned 10
	[0134.797] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.php") returned 0
	[0134.797] lstrlenA (lpString="*.php") returned 5
	[0134.797] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.vbe") returned 0
	[0134.797] lstrlenA (lpString="*.vbe") returned 5
	[0134.797] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.vba") returned 0
	[0134.797] lstrlenA (lpString="*.vba") returned 5
	[0134.797] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.vbs") returned 0
	[0134.797] lstrlenA (lpString="*.vbs") returned 5
	[0134.797] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.bat") returned 0
	[0134.797] lstrlenA (lpString="*.bat") returned 5
	[0134.797] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.cmd") returned 0
	[0134.797] lstrlenA (lpString="*.cmd") returned 5
	[0134.797] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.js") returned 0
	[0134.797] lstrlenA (lpString="*.js") returned 4
	[0134.797] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.jscript") returned 0
	[0134.797] lstrlenA (lpString="*.jscript") returned 9
	[0134.797] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.hta") returned 0
	[0134.797] lstrlenA (lpString="*.hta") returned 5
	[0134.797] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.php7") returned 0
	[0134.797] lstrlenA (lpString="*.php7") returned 6
	[0134.797] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.db") returned 0
	[0134.797] lstrlenA (lpString="*.db") returned 4
	[0134.797] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.swf") returned 0
	[0134.797] lstrlenA (lpString="*.swf") returned 5
	[0134.797] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.eml") returned 0
	[0134.797] lstrlenA (lpString="*.eml") returned 5
	[0134.797] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.part") returned 0
	[0134.797] lstrlenA (lpString="*.part") returned 6
	[0134.797] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.nfo") returned 0
	[0134.797] lstrlenA (lpString="*.nfo") returned 5
	[0134.797] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.rsa") returned 0
	[0134.797] lstrlenA (lpString="*.rsa") returned 5
	[0134.797] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.key") returned 0
	[0134.797] lstrlenA (lpString="*.key") returned 5
	[0134.798] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.aes") returned 0
	[0134.798] lstrlenA (lpString="*.aes") returned 5
	[0134.798] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.blob") returned 0
	[0134.798] lstrlenA (lpString="*.blob") returned 6
	[0134.798] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.btc") returned 0
	[0134.798] lstrlenA (lpString="*.btc") returned 5
	[0134.798] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf", pszSpec="*.wallet") returned 0
	[0134.798] lstrlenA (lpString="*.wallet") returned 8
	[0134.798] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49e0ba0, ftCreationTime.dwHighDateTime=0x1d4d3a8, ftLastAccessTime.dwLowDateTime=0xa21b3b90, ftLastAccessTime.dwHighDateTime=0x1d4c7ec, ftLastWriteTime.dwLowDateTime=0xa21b3b90, ftLastWriteTime.dwHighDateTime=0x1d4c7ec, nFileSizeHigh=0x0, nFileSizeLow=0x17b5d, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="mdyXjTm2WryfCsZWNR2a.ods", cAlternateFileName="MDYXJT~1.ODS")) returned 1
	[0134.798] PeekMessageA (in: lpMsg=0x19f4dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f4dc) returned 0
	[0134.798] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="mdyXjTm2WryfCsZWNR2a.ods") returned -1
	[0134.798] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="mdyXjTm2WryfCsZWNR2a.ods") returned -1
	[0134.798] lstrcmpiA (lpString1="", lpString2="mdyXjTm2WryfCsZWNR2a.ods") returned -1
	[0134.798] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\I1zwy3ti0.rtf") returned="I1zwy3ti0.rtf"
	[0134.798] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\"
	[0134.798] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\") returned=""
	[0134.798] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.798] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\attm7\\0i6iv1jnrftvkrb_p\\how-to-decrypt-files.htm")) returned 0x20
	[0134.798] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\", lpString2="mdyXjTm2WryfCsZWNR2a.ods" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods"
	[0134.798] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.zip") returned 0
	[0134.798] lstrlenA (lpString="*.zip") returned 5
	[0134.798] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.rar") returned 0
	[0134.798] lstrlenA (lpString="*.rar") returned 5
	[0134.798] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.7z") returned 0
	[0134.798] lstrlenA (lpString="*.7z") returned 4
	[0134.798] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.tar") returned 0
	[0134.798] lstrlenA (lpString="*.tar") returned 5
	[0134.798] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.gzip") returned 0
	[0134.798] lstrlenA (lpString="*.gzip") returned 6
	[0134.798] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.jpg") returned 0
	[0134.798] lstrlenA (lpString="*.jpg") returned 5
	[0134.798] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.jpeg") returned 0
	[0134.799] lstrlenA (lpString="*.jpeg") returned 6
	[0134.799] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.bmp") returned 0
	[0134.799] lstrlenA (lpString="*.bmp") returned 5
	[0134.799] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.gif") returned 0
	[0134.799] lstrlenA (lpString="*.gif") returned 5
	[0134.799] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.png") returned 0
	[0134.799] lstrlenA (lpString="*.png") returned 5
	[0134.799] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.doc") returned 0
	[0134.799] lstrlenA (lpString="*.doc") returned 5
	[0134.799] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.docx") returned 0
	[0134.799] lstrlenA (lpString="*.docx") returned 6
	[0134.799] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.xls") returned 0
	[0134.799] lstrlenA (lpString="*.xls") returned 5
	[0134.799] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.xlsx") returned 0
	[0134.799] lstrlenA (lpString="*.xlsx") returned 6
	[0134.799] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.ppt") returned 0
	[0134.799] lstrlenA (lpString="*.ppt") returned 5
	[0134.799] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.pptx") returned 0
	[0134.799] lstrlenA (lpString="*.pptx") returned 6
	[0134.799] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.txt") returned 0
	[0134.799] lstrlenA (lpString="*.txt") returned 5
	[0134.799] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.pdf") returned 0
	[0134.799] lstrlenA (lpString="*.pdf") returned 5
	[0134.799] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.htm") returned 0
	[0134.799] lstrlenA (lpString="*.htm") returned 5
	[0134.799] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.html") returned 0
	[0134.799] lstrlenA (lpString="*.html") returned 6
	[0134.799] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.mdb") returned 0
	[0134.799] lstrlenA (lpString="*.mdb") returned 5
	[0134.799] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.pfx") returned 0
	[0134.799] lstrlenA (lpString="*.pfx") returned 5
	[0134.799] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.md") returned 0
	[0134.799] lstrlenA (lpString="*.md") returned 4
	[0134.799] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.lnk") returned 0
	[0134.799] lstrlenA (lpString="*.lnk") returned 5
	[0134.800] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.torrent") returned 0
	[0134.800] lstrlenA (lpString="*.torrent") returned 9
	[0134.800] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.mov") returned 0
	[0134.800] lstrlenA (lpString="*.mov") returned 5
	[0134.800] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.3gp") returned 0
	[0134.800] lstrlenA (lpString="*.3gp") returned 5
	[0134.800] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.mpeg") returned 0
	[0134.800] lstrlenA (lpString="*.mpeg") returned 6
	[0134.800] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.mpg") returned 0
	[0134.800] lstrlenA (lpString="*.mpg") returned 5
	[0134.800] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.flv") returned 0
	[0134.800] lstrlenA (lpString="*.flv") returned 5
	[0134.800] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.avi") returned 0
	[0134.800] lstrlenA (lpString="*.avi") returned 5
	[0134.800] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.mp4") returned 0
	[0134.800] lstrlenA (lpString="*.mp4") returned 5
	[0134.800] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.wmv") returned 0
	[0134.800] lstrlenA (lpString="*.wmv") returned 5
	[0134.800] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.mkv") returned 0
	[0134.800] lstrlenA (lpString="*.mkv") returned 5
	[0134.800] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.mp3") returned 0
	[0134.800] lstrlenA (lpString="*.mp3") returned 5
	[0134.800] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.wav") returned 0
	[0134.800] lstrlenA (lpString="*.wav") returned 5
	[0134.800] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.flac") returned 0
	[0134.800] lstrlenA (lpString="*.flac") returned 6
	[0134.800] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.wma") returned 0
	[0134.800] lstrlenA (lpString="*.wma") returned 5
	[0134.800] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.au3") returned 0
	[0134.800] lstrlenA (lpString="*.au3") returned 5
	[0134.800] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.ahk") returned 0
	[0134.800] lstrlenA (lpString="*.ahk") returned 5
	[0134.800] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.c") returned 0
	[0134.800] lstrlenA (lpString="*.c") returned 3
	[0134.800] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.cc") returned 0
	[0134.801] lstrlenA (lpString="*.cc") returned 4
	[0134.801] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.cpp") returned 0
	[0134.801] lstrlenA (lpString="*.cpp") returned 5
	[0134.801] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.cxx") returned 0
	[0134.801] lstrlenA (lpString="*.cxx") returned 5
	[0134.801] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.c++") returned 0
	[0134.801] lstrlenA (lpString="*.c++") returned 5
	[0134.801] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.cs") returned 0
	[0134.801] lstrlenA (lpString="*.cs") returned 4
	[0134.801] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.vb") returned 0
	[0134.801] lstrlenA (lpString="*.vb") returned 4
	[0134.801] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.bas") returned 0
	[0134.801] lstrlenA (lpString="*.bas") returned 5
	[0134.801] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.csproj") returned 0
	[0134.801] lstrlenA (lpString="*.csproj") returned 8
	[0134.801] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.vbproj") returned 0
	[0134.801] lstrlenA (lpString="*.vbproj") returned 8
	[0134.801] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.vcxproj") returned 0
	[0134.801] lstrlenA (lpString="*.vcxproj") returned 9
	[0134.801] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.manifest") returned 0
	[0134.801] lstrlenA (lpString="*.manifest") returned 10
	[0134.801] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.php") returned 0
	[0134.801] lstrlenA (lpString="*.php") returned 5
	[0134.801] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.vbe") returned 0
	[0134.801] lstrlenA (lpString="*.vbe") returned 5
	[0134.801] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.vba") returned 0
	[0134.801] lstrlenA (lpString="*.vba") returned 5
	[0134.801] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.vbs") returned 0
	[0134.801] lstrlenA (lpString="*.vbs") returned 5
	[0134.801] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.bat") returned 0
	[0134.801] lstrlenA (lpString="*.bat") returned 5
	[0134.801] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.cmd") returned 0
	[0134.801] lstrlenA (lpString="*.cmd") returned 5
	[0134.801] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.js") returned 0
	[0134.801] lstrlenA (lpString="*.js") returned 4
	[0134.802] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.jscript") returned 0
	[0134.802] lstrlenA (lpString="*.jscript") returned 9
	[0134.802] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.hta") returned 0
	[0134.802] lstrlenA (lpString="*.hta") returned 5
	[0134.802] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.php7") returned 0
	[0134.802] lstrlenA (lpString="*.php7") returned 6
	[0134.802] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.db") returned 0
	[0134.802] lstrlenA (lpString="*.db") returned 4
	[0134.802] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.swf") returned 0
	[0134.802] lstrlenA (lpString="*.swf") returned 5
	[0134.802] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.eml") returned 0
	[0134.802] lstrlenA (lpString="*.eml") returned 5
	[0134.802] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.part") returned 0
	[0134.802] lstrlenA (lpString="*.part") returned 6
	[0134.802] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.nfo") returned 0
	[0134.802] lstrlenA (lpString="*.nfo") returned 5
	[0134.802] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.rsa") returned 0
	[0134.802] lstrlenA (lpString="*.rsa") returned 5
	[0134.802] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.key") returned 0
	[0134.802] lstrlenA (lpString="*.key") returned 5
	[0134.802] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.aes") returned 0
	[0134.802] lstrlenA (lpString="*.aes") returned 5
	[0134.802] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.blob") returned 0
	[0134.802] lstrlenA (lpString="*.blob") returned 6
	[0134.802] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.btc") returned 0
	[0134.802] lstrlenA (lpString="*.btc") returned 5
	[0134.802] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\0I6iV1JNRFTVkRb_P\\mdyXjTm2WryfCsZWNR2a.ods", pszSpec="*.wallet") returned 0
	[0134.802] lstrlenA (lpString="*.wallet") returned 8
	[0134.802] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f500 | out: lpFindFileData=0x19f500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49e0ba0, ftCreationTime.dwHighDateTime=0x1d4d3a8, ftLastAccessTime.dwLowDateTime=0xa21b3b90, ftLastAccessTime.dwHighDateTime=0x1d4c7ec, ftLastWriteTime.dwLowDateTime=0xa21b3b90, ftLastWriteTime.dwHighDateTime=0x1d4c7ec, nFileSizeHigh=0x0, nFileSizeLow=0x17b5d, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="mdyXjTm2WryfCsZWNR2a.ods", cAlternateFileName="MDYXJT~1.ODS")) returned 0
	[0134.802] FindClose (in: hFindFile=0x7cb650 | out: hFindFile=0x7cb650) returned 1
	[0134.802] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x894e4630, ftCreationTime.dwHighDateTime=0x1d4cc2d, ftLastAccessTime.dwLowDateTime=0xda466c80, ftLastAccessTime.dwHighDateTime=0x1d4d2bc, ftLastWriteTime.dwLowDateTime=0xda466c80, ftLastWriteTime.dwHighDateTime=0x1d4d2bc, nFileSizeHigh=0x0, nFileSizeLow=0x149b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="bK34QYv22.docx", cAlternateFileName="BK34QY~1.DOC")) returned 1
	[0134.802] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0134.803] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bK34QYv22.docx") returned 1
	[0134.803] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bK34QYv22.docx") returned 1
	[0134.803] lstrcmpiA (lpString1="", lpString2="bK34QYv22.docx") returned -1
	[0134.803] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\*.*") returned="*.*"
	[0134.803] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\"
	[0134.803] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\") returned=""
	[0134.803] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.803] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\attm7\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0134.803] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\attm7\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0134.803] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0134.803] WriteFile (in: hFile=0x218, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0134.804] SetFileTime (hFile=0x218, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0134.804] CloseHandle (hObject=0x218) returned 1
	[0134.805] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\", lpString2="bK34QYv22.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\bK34QYv22.docx") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\bK34QYv22.docx"
	[0134.805] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\bK34QYv22.docx", pszSpec="*.zip") returned 0
	[0134.805] lstrlenA (lpString="*.zip") returned 5
	[0134.805] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\bK34QYv22.docx", pszSpec="*.rar") returned 0
	[0134.805] lstrlenA (lpString="*.rar") returned 5
	[0134.805] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\bK34QYv22.docx", pszSpec="*.7z") returned 0
	[0134.805] lstrlenA (lpString="*.7z") returned 4
	[0134.805] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\bK34QYv22.docx", pszSpec="*.tar") returned 0
	[0134.805] lstrlenA (lpString="*.tar") returned 5
	[0134.805] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\bK34QYv22.docx", pszSpec="*.gzip") returned 0
	[0134.805] lstrlenA (lpString="*.gzip") returned 6
	[0134.805] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\bK34QYv22.docx", pszSpec="*.jpg") returned 0
	[0134.805] lstrlenA (lpString="*.jpg") returned 5
	[0134.805] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\bK34QYv22.docx", pszSpec="*.jpeg") returned 0
	[0134.805] lstrlenA (lpString="*.jpeg") returned 6
	[0134.805] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\bK34QYv22.docx", pszSpec="*.bmp") returned 0
	[0134.805] lstrlenA (lpString="*.bmp") returned 5
	[0134.805] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\bK34QYv22.docx", pszSpec="*.gif") returned 0
	[0134.805] lstrlenA (lpString="*.gif") returned 5
	[0134.805] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\bK34QYv22.docx", pszSpec="*.png") returned 0
	[0134.805] lstrlenA (lpString="*.png") returned 5
	[0134.805] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\bK34QYv22.docx", pszSpec="*.doc") returned 0
	[0134.805] lstrlenA (lpString="*.doc") returned 5
	[0134.805] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\bK34QYv22.docx", pszSpec="*.docx") returned 1
	[0134.805] lstrlenA (lpString="*.docx") returned 6
	[0134.805] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\bK34QYv22.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\bK34QYv22.docx") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\bK34QYv22.docx"
	[0134.805] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\bK34QYv22.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\bK34QYv22.docx") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\bK34QYv22.docx"
	[0134.805] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\bK34QYv22.docx", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\bK34QYv22.docx.") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\bK34QYv22.docx."
	[0134.805] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\bK34QYv22.docx.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\bK34QYv22.docx.exe") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\bK34QYv22.docx.exe"
	[0134.806] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\bK34QYv22.docx" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\attm7\\bk34qyv22.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0134.806] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x149b5
	[0134.806] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x894e4630, dwHighDateTime=0x1d4cc2d), lpLastAccessTime=0x407536*(dwLowDateTime=0xda466c80, dwHighDateTime=0x1d4d2bc), lpLastWriteTime=0x40753e*(dwLowDateTime=0xda466c80, dwHighDateTime=0x1d4d2bc)) returned 1
	[0134.806] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.806] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x14973, lpOverlapped=0x0) returned 1
	[0134.807] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\bK34QYv22.docx") returned="bK34QYv22.docx"
	[0134.807] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.807] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x14973, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x14973, lpOverlapped=0x0) returned 1
	[0134.808] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.808] CloseHandle (hObject=0x218) returned 1
	[0134.808] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\bK34QYv22.docx" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\attm7\\bk34qyv22.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\bK34QYv22.docx.exe" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\attm7\\bk34qyv22.docx.exe")) returned 1
	[0134.808] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef77ac10, ftCreationTime.dwHighDateTime=0x1d4cbdf, ftLastAccessTime.dwLowDateTime=0x224d540, ftLastAccessTime.dwHighDateTime=0x1d4d35b, ftLastWriteTime.dwLowDateTime=0x224d540, ftLastWriteTime.dwHighDateTime=0x1d4d35b, nFileSizeHigh=0x0, nFileSizeLow=0x82e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="hhXww_.docx", cAlternateFileName="HHXWW_~1.DOC")) returned 1
	[0134.809] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0134.809] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="hhXww_.docx") returned -1
	[0134.809] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="hhXww_.docx") returned 1
	[0134.809] lstrcmpiA (lpString1="", lpString2="hhXww_.docx") returned -1
	[0134.809] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\bK34QYv22.docx") returned="bK34QYv22.docx"
	[0134.809] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\"
	[0134.809] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\") returned=""
	[0134.809] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.809] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\attm7\\how-to-decrypt-files.htm")) returned 0x20
	[0134.809] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\", lpString2="hhXww_.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\hhXww_.docx") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\hhXww_.docx"
	[0134.809] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\hhXww_.docx", pszSpec="*.zip") returned 0
	[0134.809] lstrlenA (lpString="*.zip") returned 5
	[0134.809] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\hhXww_.docx", pszSpec="*.rar") returned 0
	[0134.809] lstrlenA (lpString="*.rar") returned 5
	[0134.809] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\hhXww_.docx", pszSpec="*.7z") returned 0
	[0134.809] lstrlenA (lpString="*.7z") returned 4
	[0134.809] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\hhXww_.docx", pszSpec="*.tar") returned 0
	[0134.809] lstrlenA (lpString="*.tar") returned 5
	[0134.809] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\hhXww_.docx", pszSpec="*.gzip") returned 0
	[0134.809] lstrlenA (lpString="*.gzip") returned 6
	[0134.809] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\hhXww_.docx", pszSpec="*.jpg") returned 0
	[0134.809] lstrlenA (lpString="*.jpg") returned 5
	[0134.809] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\hhXww_.docx", pszSpec="*.jpeg") returned 0
	[0134.809] lstrlenA (lpString="*.jpeg") returned 6
	[0134.809] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\hhXww_.docx", pszSpec="*.bmp") returned 0
	[0134.809] lstrlenA (lpString="*.bmp") returned 5
	[0134.809] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\hhXww_.docx", pszSpec="*.gif") returned 0
	[0134.809] lstrlenA (lpString="*.gif") returned 5
	[0134.809] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\hhXww_.docx", pszSpec="*.png") returned 0
	[0134.809] lstrlenA (lpString="*.png") returned 5
	[0134.809] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\hhXww_.docx", pszSpec="*.doc") returned 0
	[0134.810] lstrlenA (lpString="*.doc") returned 5
	[0134.810] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\hhXww_.docx", pszSpec="*.docx") returned 1
	[0134.810] lstrlenA (lpString="*.docx") returned 6
	[0134.810] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\hhXww_.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\hhXww_.docx") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\hhXww_.docx"
	[0134.810] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\hhXww_.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\hhXww_.docx") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\hhXww_.docx"
	[0134.810] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\hhXww_.docx", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\hhXww_.docx.") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\hhXww_.docx."
	[0134.810] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\hhXww_.docx.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\hhXww_.docx.exe") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\hhXww_.docx.exe"
	[0134.810] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\hhXww_.docx" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\attm7\\hhxww_.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0134.810] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x82e4
	[0134.810] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xef77ac10, dwHighDateTime=0x1d4cbdf), lpLastAccessTime=0x407536*(dwLowDateTime=0x224d540, dwHighDateTime=0x1d4d35b), lpLastWriteTime=0x40753e*(dwLowDateTime=0x224d540, dwHighDateTime=0x1d4d35b)) returned 1
	[0134.810] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.810] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x82a2, lpOverlapped=0x0) returned 1
	[0134.811] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\hhXww_.docx") returned="hhXww_.docx"
	[0134.811] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.811] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x82a2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x82a2, lpOverlapped=0x0) returned 1
	[0134.811] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.811] CloseHandle (hObject=0x218) returned 1
	[0134.812] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\hhXww_.docx" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\attm7\\hhxww_.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\aTTm7\\hhXww_.docx.exe" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\attm7\\hhxww_.docx.exe")) returned 1
	[0134.812] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef77ac10, ftCreationTime.dwHighDateTime=0x1d4cbdf, ftLastAccessTime.dwLowDateTime=0x224d540, ftLastAccessTime.dwHighDateTime=0x1d4d35b, ftLastWriteTime.dwLowDateTime=0x224d540, ftLastWriteTime.dwHighDateTime=0x1d4d35b, nFileSizeHigh=0x0, nFileSizeLow=0x82e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="hhXww_.docx", cAlternateFileName="HHXWW_~1.DOC")) returned 0
	[0134.812] FindClose (in: hFindFile=0x7cb950 | out: hFindFile=0x7cb950) returned 1
	[0134.812] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0987420, ftCreationTime.dwHighDateTime=0x1d4d48c, ftLastAccessTime.dwLowDateTime=0x8be453a0, ftLastAccessTime.dwHighDateTime=0x1d4d32e, ftLastWriteTime.dwLowDateTime=0x8be453a0, ftLastWriteTime.dwHighDateTime=0x1d4d32e, nFileSizeHigh=0x0, nFileSizeLow=0xcbc7, dwReserved0=0x20, dwReserved1=0x1000000, cFileName="EvOop_-rc IDVY.ods", cAlternateFileName="EVOOP_~1.ODS")) returned 1
	[0134.812] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0134.812] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="EvOop_-rc IDVY.ods") returned -1
	[0134.812] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="EvOop_-rc IDVY.ods") returned 1
	[0134.812] lstrcmpiA (lpString1="", lpString2="EvOop_-rc IDVY.ods") returned -1
	[0134.812] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\*.*") returned="*.*"
	[0134.812] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\"
	[0134.812] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\") returned=""
	[0134.813] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.813] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0134.813] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0134.813] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0134.813] WriteFile (in: hFile=0x214, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0134.814] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0134.814] CloseHandle (hObject=0x214) returned 1
	[0134.814] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\", lpString2="EvOop_-rc IDVY.ods" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods"
	[0134.814] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.zip") returned 0
	[0134.814] lstrlenA (lpString="*.zip") returned 5
	[0134.814] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.rar") returned 0
	[0134.814] lstrlenA (lpString="*.rar") returned 5
	[0134.814] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.7z") returned 0
	[0134.814] lstrlenA (lpString="*.7z") returned 4
	[0134.814] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.tar") returned 0
	[0134.814] lstrlenA (lpString="*.tar") returned 5
	[0134.814] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.gzip") returned 0
	[0134.814] lstrlenA (lpString="*.gzip") returned 6
	[0134.814] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.jpg") returned 0
	[0134.814] lstrlenA (lpString="*.jpg") returned 5
	[0134.814] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.jpeg") returned 0
	[0134.814] lstrlenA (lpString="*.jpeg") returned 6
	[0134.815] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.bmp") returned 0
	[0134.815] lstrlenA (lpString="*.bmp") returned 5
	[0134.815] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.gif") returned 0
	[0134.815] lstrlenA (lpString="*.gif") returned 5
	[0134.815] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.png") returned 0
	[0134.815] lstrlenA (lpString="*.png") returned 5
	[0134.815] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.doc") returned 0
	[0134.815] lstrlenA (lpString="*.doc") returned 5
	[0134.815] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.docx") returned 0
	[0134.815] lstrlenA (lpString="*.docx") returned 6
	[0134.815] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.xls") returned 0
	[0134.815] lstrlenA (lpString="*.xls") returned 5
	[0134.815] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.xlsx") returned 0
	[0134.815] lstrlenA (lpString="*.xlsx") returned 6
	[0134.815] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.ppt") returned 0
	[0134.815] lstrlenA (lpString="*.ppt") returned 5
	[0134.815] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.pptx") returned 0
	[0134.815] lstrlenA (lpString="*.pptx") returned 6
	[0134.815] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.txt") returned 0
	[0134.815] lstrlenA (lpString="*.txt") returned 5
	[0134.815] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.pdf") returned 0
	[0134.815] lstrlenA (lpString="*.pdf") returned 5
	[0134.815] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.htm") returned 0
	[0134.815] lstrlenA (lpString="*.htm") returned 5
	[0134.815] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.html") returned 0
	[0134.815] lstrlenA (lpString="*.html") returned 6
	[0134.815] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.mdb") returned 0
	[0134.815] lstrlenA (lpString="*.mdb") returned 5
	[0134.815] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.pfx") returned 0
	[0134.815] lstrlenA (lpString="*.pfx") returned 5
	[0134.815] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.md") returned 0
	[0134.815] lstrlenA (lpString="*.md") returned 4
	[0134.815] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.lnk") returned 0
	[0134.815] lstrlenA (lpString="*.lnk") returned 5
	[0134.815] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.torrent") returned 0
	[0134.816] lstrlenA (lpString="*.torrent") returned 9
	[0134.816] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.mov") returned 0
	[0134.816] lstrlenA (lpString="*.mov") returned 5
	[0134.816] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.3gp") returned 0
	[0134.816] lstrlenA (lpString="*.3gp") returned 5
	[0134.816] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.mpeg") returned 0
	[0134.816] lstrlenA (lpString="*.mpeg") returned 6
	[0134.816] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.mpg") returned 0
	[0134.816] lstrlenA (lpString="*.mpg") returned 5
	[0134.816] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.flv") returned 0
	[0134.816] lstrlenA (lpString="*.flv") returned 5
	[0134.816] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.avi") returned 0
	[0134.816] lstrlenA (lpString="*.avi") returned 5
	[0134.816] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.mp4") returned 0
	[0134.816] lstrlenA (lpString="*.mp4") returned 5
	[0134.816] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.wmv") returned 0
	[0134.816] lstrlenA (lpString="*.wmv") returned 5
	[0134.816] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.mkv") returned 0
	[0134.816] lstrlenA (lpString="*.mkv") returned 5
	[0134.816] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.mp3") returned 0
	[0134.816] lstrlenA (lpString="*.mp3") returned 5
	[0134.816] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.wav") returned 0
	[0134.816] lstrlenA (lpString="*.wav") returned 5
	[0134.816] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.flac") returned 0
	[0134.816] lstrlenA (lpString="*.flac") returned 6
	[0134.816] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.wma") returned 0
	[0134.816] lstrlenA (lpString="*.wma") returned 5
	[0134.816] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.au3") returned 0
	[0134.816] lstrlenA (lpString="*.au3") returned 5
	[0134.816] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.ahk") returned 0
	[0134.816] lstrlenA (lpString="*.ahk") returned 5
	[0134.816] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.c") returned 0
	[0134.816] lstrlenA (lpString="*.c") returned 3
	[0134.816] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.cc") returned 0
	[0134.816] lstrlenA (lpString="*.cc") returned 4
	[0134.817] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.cpp") returned 0
	[0134.817] lstrlenA (lpString="*.cpp") returned 5
	[0134.817] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.cxx") returned 0
	[0134.817] lstrlenA (lpString="*.cxx") returned 5
	[0134.817] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.c++") returned 0
	[0134.817] lstrlenA (lpString="*.c++") returned 5
	[0134.817] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.cs") returned 0
	[0134.817] lstrlenA (lpString="*.cs") returned 4
	[0134.817] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.vb") returned 0
	[0134.817] lstrlenA (lpString="*.vb") returned 4
	[0134.817] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.bas") returned 0
	[0134.817] lstrlenA (lpString="*.bas") returned 5
	[0134.817] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.csproj") returned 0
	[0134.817] lstrlenA (lpString="*.csproj") returned 8
	[0134.817] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.vbproj") returned 0
	[0134.817] lstrlenA (lpString="*.vbproj") returned 8
	[0134.817] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.vcxproj") returned 0
	[0134.817] lstrlenA (lpString="*.vcxproj") returned 9
	[0134.817] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.manifest") returned 0
	[0134.817] lstrlenA (lpString="*.manifest") returned 10
	[0134.817] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.php") returned 0
	[0134.817] lstrlenA (lpString="*.php") returned 5
	[0134.817] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.vbe") returned 0
	[0134.817] lstrlenA (lpString="*.vbe") returned 5
	[0134.817] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.vba") returned 0
	[0134.817] lstrlenA (lpString="*.vba") returned 5
	[0134.817] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.vbs") returned 0
	[0134.817] lstrlenA (lpString="*.vbs") returned 5
	[0134.817] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.bat") returned 0
	[0134.817] lstrlenA (lpString="*.bat") returned 5
	[0134.817] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.cmd") returned 0
	[0134.817] lstrlenA (lpString="*.cmd") returned 5
	[0134.817] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.js") returned 0
	[0134.817] lstrlenA (lpString="*.js") returned 4
	[0134.818] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.jscript") returned 0
	[0134.818] lstrlenA (lpString="*.jscript") returned 9
	[0134.818] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.hta") returned 0
	[0134.818] lstrlenA (lpString="*.hta") returned 5
	[0134.818] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.php7") returned 0
	[0134.818] lstrlenA (lpString="*.php7") returned 6
	[0134.818] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.db") returned 0
	[0134.818] lstrlenA (lpString="*.db") returned 4
	[0134.818] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.swf") returned 0
	[0134.818] lstrlenA (lpString="*.swf") returned 5
	[0134.818] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.eml") returned 0
	[0134.818] lstrlenA (lpString="*.eml") returned 5
	[0134.818] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.part") returned 0
	[0134.818] lstrlenA (lpString="*.part") returned 6
	[0134.818] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.nfo") returned 0
	[0134.818] lstrlenA (lpString="*.nfo") returned 5
	[0134.818] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.rsa") returned 0
	[0134.818] lstrlenA (lpString="*.rsa") returned 5
	[0134.818] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.key") returned 0
	[0134.818] lstrlenA (lpString="*.key") returned 5
	[0134.818] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.aes") returned 0
	[0134.818] lstrlenA (lpString="*.aes") returned 5
	[0134.818] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.blob") returned 0
	[0134.818] lstrlenA (lpString="*.blob") returned 6
	[0134.818] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.btc") returned 0
	[0134.818] lstrlenA (lpString="*.btc") returned 5
	[0134.818] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods", pszSpec="*.wallet") returned 0
	[0134.818] lstrlenA (lpString="*.wallet") returned 8
	[0134.818] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317896c0, ftCreationTime.dwHighDateTime=0x1d4c68a, ftLastAccessTime.dwLowDateTime=0xa66986d0, ftLastAccessTime.dwHighDateTime=0x1d4cfde, ftLastWriteTime.dwLowDateTime=0xa66986d0, ftLastWriteTime.dwHighDateTime=0x1d4cfde, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GHi4txwrX", cAlternateFileName="GHI4TX~1")) returned 1
	[0134.818] lstrcmpA (lpString1=".", lpString2="GHi4txwrX") returned -1
	[0134.818] lstrcmpA (lpString1="..", lpString2="GHi4txwrX") returned -1
	[0134.818] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\EvOop_-rc IDVY.ods") returned="EvOop_-rc IDVY.ods"
	[0134.818] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\", lpString2="GHi4txwrX" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX"
	[0134.819] lstrlenA (lpString="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX") returned 57
	[0134.819] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\*.*", lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317896c0, ftCreationTime.dwHighDateTime=0x1d4c68a, ftLastAccessTime.dwLowDateTime=0xa66986d0, ftLastAccessTime.dwHighDateTime=0x1d4cfde, ftLastWriteTime.dwLowDateTime=0xa66986d0, ftLastWriteTime.dwHighDateTime=0x1d4cfde, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d3ed8, dwReserved1=0xa8, cFileName=".", cAlternateFileName="")) returned 0x7cb650
	[0134.819] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0134.819] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317896c0, ftCreationTime.dwHighDateTime=0x1d4c68a, ftLastAccessTime.dwLowDateTime=0xa66986d0, ftLastAccessTime.dwHighDateTime=0x1d4cfde, ftLastWriteTime.dwLowDateTime=0xa66986d0, ftLastWriteTime.dwHighDateTime=0x1d4cfde, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d3ed8, dwReserved1=0xa8, cFileName="..", cAlternateFileName="")) returned 1
	[0134.819] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0134.819] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0134.819] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5acc02f0, ftCreationTime.dwHighDateTime=0x1d4cc70, ftLastAccessTime.dwLowDateTime=0xbd0ed680, ftLastAccessTime.dwHighDateTime=0x1d4c906, ftLastWriteTime.dwLowDateTime=0xbd0ed680, ftLastWriteTime.dwHighDateTime=0x1d4c906, nFileSizeHigh=0x0, nFileSizeLow=0x60fa, dwReserved0=0x7d3ed8, dwReserved1=0xa8, cFileName="BKIXNiqtfqUizh.csv", cAlternateFileName="BKIXNI~1.CSV")) returned 1
	[0134.819] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0134.819] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="BKIXNiqtfqUizh.csv") returned 1
	[0134.819] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="BKIXNiqtfqUizh.csv") returned 1
	[0134.819] lstrcmpiA (lpString1="", lpString2="BKIXNiqtfqUizh.csv") returned -1
	[0134.819] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\*.*") returned="*.*"
	[0134.819] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\"
	[0134.819] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\") returned=""
	[0134.819] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.819] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\ghi4txwrx\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0134.819] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\ghi4txwrx\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0134.831] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0134.831] WriteFile (in: hFile=0x218, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0134.832] SetFileTime (hFile=0x218, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0134.832] CloseHandle (hObject=0x218) returned 1
	[0134.832] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\", lpString2="BKIXNiqtfqUizh.csv" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv"
	[0134.832] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.zip") returned 0
	[0134.832] lstrlenA (lpString="*.zip") returned 5
	[0134.832] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.rar") returned 0
	[0134.832] lstrlenA (lpString="*.rar") returned 5
	[0134.832] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.7z") returned 0
	[0134.832] lstrlenA (lpString="*.7z") returned 4
	[0134.832] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.tar") returned 0
	[0134.832] lstrlenA (lpString="*.tar") returned 5
	[0134.832] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.gzip") returned 0
	[0134.832] lstrlenA (lpString="*.gzip") returned 6
	[0134.832] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.jpg") returned 0
	[0134.832] lstrlenA (lpString="*.jpg") returned 5
	[0134.832] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.jpeg") returned 0
	[0134.832] lstrlenA (lpString="*.jpeg") returned 6
	[0134.832] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.bmp") returned 0
	[0134.832] lstrlenA (lpString="*.bmp") returned 5
	[0134.832] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.gif") returned 0
	[0134.832] lstrlenA (lpString="*.gif") returned 5
	[0134.832] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.png") returned 0
	[0134.832] lstrlenA (lpString="*.png") returned 5
	[0134.832] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.doc") returned 0
	[0134.832] lstrlenA (lpString="*.doc") returned 5
	[0134.832] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.docx") returned 0
	[0134.833] lstrlenA (lpString="*.docx") returned 6
	[0134.833] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.xls") returned 0
	[0134.833] lstrlenA (lpString="*.xls") returned 5
	[0134.833] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.xlsx") returned 0
	[0134.833] lstrlenA (lpString="*.xlsx") returned 6
	[0134.833] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.ppt") returned 0
	[0134.833] lstrlenA (lpString="*.ppt") returned 5
	[0134.833] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.pptx") returned 0
	[0134.833] lstrlenA (lpString="*.pptx") returned 6
	[0134.833] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.txt") returned 0
	[0134.833] lstrlenA (lpString="*.txt") returned 5
	[0134.833] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.pdf") returned 0
	[0134.833] lstrlenA (lpString="*.pdf") returned 5
	[0134.833] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.htm") returned 0
	[0134.833] lstrlenA (lpString="*.htm") returned 5
	[0134.833] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.html") returned 0
	[0134.833] lstrlenA (lpString="*.html") returned 6
	[0134.833] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.mdb") returned 0
	[0134.833] lstrlenA (lpString="*.mdb") returned 5
	[0134.833] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.pfx") returned 0
	[0134.833] lstrlenA (lpString="*.pfx") returned 5
	[0134.833] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.md") returned 0
	[0134.833] lstrlenA (lpString="*.md") returned 4
	[0134.833] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.lnk") returned 0
	[0134.833] lstrlenA (lpString="*.lnk") returned 5
	[0134.833] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.torrent") returned 0
	[0134.833] lstrlenA (lpString="*.torrent") returned 9
	[0134.833] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.mov") returned 0
	[0134.833] lstrlenA (lpString="*.mov") returned 5
	[0134.833] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.3gp") returned 0
	[0134.833] lstrlenA (lpString="*.3gp") returned 5
	[0134.833] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.mpeg") returned 0
	[0134.834] lstrlenA (lpString="*.mpeg") returned 6
	[0134.834] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.mpg") returned 0
	[0134.834] lstrlenA (lpString="*.mpg") returned 5
	[0134.834] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.flv") returned 0
	[0134.834] lstrlenA (lpString="*.flv") returned 5
	[0134.834] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.avi") returned 0
	[0134.834] lstrlenA (lpString="*.avi") returned 5
	[0134.834] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.mp4") returned 0
	[0134.834] lstrlenA (lpString="*.mp4") returned 5
	[0134.834] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.wmv") returned 0
	[0134.834] lstrlenA (lpString="*.wmv") returned 5
	[0134.834] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.mkv") returned 0
	[0134.834] lstrlenA (lpString="*.mkv") returned 5
	[0134.834] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.mp3") returned 0
	[0134.834] lstrlenA (lpString="*.mp3") returned 5
	[0134.834] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.wav") returned 0
	[0134.834] lstrlenA (lpString="*.wav") returned 5
	[0134.834] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.flac") returned 0
	[0134.834] lstrlenA (lpString="*.flac") returned 6
	[0134.834] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.wma") returned 0
	[0134.834] lstrlenA (lpString="*.wma") returned 5
	[0134.834] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.au3") returned 0
	[0134.834] lstrlenA (lpString="*.au3") returned 5
	[0134.834] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.ahk") returned 0
	[0134.834] lstrlenA (lpString="*.ahk") returned 5
	[0134.834] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.c") returned 0
	[0134.834] lstrlenA (lpString="*.c") returned 3
	[0134.834] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.cc") returned 0
	[0134.834] lstrlenA (lpString="*.cc") returned 4
	[0134.834] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.cpp") returned 0
	[0134.834] lstrlenA (lpString="*.cpp") returned 5
	[0134.834] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.cxx") returned 0
	[0134.834] lstrlenA (lpString="*.cxx") returned 5
	[0134.835] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.c++") returned 0
	[0134.835] lstrlenA (lpString="*.c++") returned 5
	[0134.835] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.cs") returned 0
	[0134.835] lstrlenA (lpString="*.cs") returned 4
	[0134.835] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.vb") returned 0
	[0134.835] lstrlenA (lpString="*.vb") returned 4
	[0134.835] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.bas") returned 0
	[0134.835] lstrlenA (lpString="*.bas") returned 5
	[0134.835] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.csproj") returned 0
	[0134.835] lstrlenA (lpString="*.csproj") returned 8
	[0134.835] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.vbproj") returned 0
	[0134.835] lstrlenA (lpString="*.vbproj") returned 8
	[0134.835] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.vcxproj") returned 0
	[0134.835] lstrlenA (lpString="*.vcxproj") returned 9
	[0134.835] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.manifest") returned 0
	[0134.835] lstrlenA (lpString="*.manifest") returned 10
	[0134.835] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.php") returned 0
	[0134.835] lstrlenA (lpString="*.php") returned 5
	[0134.835] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.vbe") returned 0
	[0134.835] lstrlenA (lpString="*.vbe") returned 5
	[0134.835] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.vba") returned 0
	[0134.835] lstrlenA (lpString="*.vba") returned 5
	[0134.835] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.vbs") returned 0
	[0134.835] lstrlenA (lpString="*.vbs") returned 5
	[0134.835] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.bat") returned 0
	[0134.835] lstrlenA (lpString="*.bat") returned 5
	[0134.835] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.cmd") returned 0
	[0134.835] lstrlenA (lpString="*.cmd") returned 5
	[0134.835] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.js") returned 0
	[0134.835] lstrlenA (lpString="*.js") returned 4
	[0134.835] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.jscript") returned 0
	[0134.835] lstrlenA (lpString="*.jscript") returned 9
	[0134.835] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.hta") returned 0
	[0134.836] lstrlenA (lpString="*.hta") returned 5
	[0134.836] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.php7") returned 0
	[0134.836] lstrlenA (lpString="*.php7") returned 6
	[0134.836] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.db") returned 0
	[0134.836] lstrlenA (lpString="*.db") returned 4
	[0134.836] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.swf") returned 0
	[0134.836] lstrlenA (lpString="*.swf") returned 5
	[0134.836] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.eml") returned 0
	[0134.836] lstrlenA (lpString="*.eml") returned 5
	[0134.836] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.part") returned 0
	[0134.836] lstrlenA (lpString="*.part") returned 6
	[0134.836] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.nfo") returned 0
	[0134.836] lstrlenA (lpString="*.nfo") returned 5
	[0134.836] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.rsa") returned 0
	[0134.836] lstrlenA (lpString="*.rsa") returned 5
	[0134.836] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.key") returned 0
	[0134.836] lstrlenA (lpString="*.key") returned 5
	[0134.836] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.aes") returned 0
	[0134.836] lstrlenA (lpString="*.aes") returned 5
	[0134.836] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.blob") returned 0
	[0134.836] lstrlenA (lpString="*.blob") returned 6
	[0134.836] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.btc") returned 0
	[0134.836] lstrlenA (lpString="*.btc") returned 5
	[0134.836] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv", pszSpec="*.wallet") returned 0
	[0134.836] lstrlenA (lpString="*.wallet") returned 8
	[0134.836] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab1a2410, ftCreationTime.dwHighDateTime=0x1d4d2f3, ftLastAccessTime.dwLowDateTime=0x8fba8990, ftLastAccessTime.dwHighDateTime=0x1d4cb86, ftLastWriteTime.dwLowDateTime=0x8fba8990, ftLastWriteTime.dwHighDateTime=0x1d4cb86, nFileSizeHigh=0x0, nFileSizeLow=0x11e04, dwReserved0=0x0, dwReserved1=0x0, cFileName="h7KLxcZmWOI8p8.ots", cAlternateFileName="H7KLXC~1.OTS")) returned 1
	[0134.836] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0134.837] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="h7KLxcZmWOI8p8.ots") returned -1
	[0134.837] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="h7KLxcZmWOI8p8.ots") returned 1
	[0134.837] lstrcmpiA (lpString1="", lpString2="h7KLxcZmWOI8p8.ots") returned -1
	[0134.837] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\BKIXNiqtfqUizh.csv") returned="BKIXNiqtfqUizh.csv"
	[0134.837] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\"
	[0134.837] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\") returned=""
	[0134.837] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.837] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\ghi4txwrx\\how-to-decrypt-files.htm")) returned 0x20
	[0134.837] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\", lpString2="h7KLxcZmWOI8p8.ots" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots"
	[0134.837] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.zip") returned 0
	[0134.837] lstrlenA (lpString="*.zip") returned 5
	[0134.837] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.rar") returned 0
	[0134.837] lstrlenA (lpString="*.rar") returned 5
	[0134.837] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.7z") returned 0
	[0134.837] lstrlenA (lpString="*.7z") returned 4
	[0134.837] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.tar") returned 0
	[0134.837] lstrlenA (lpString="*.tar") returned 5
	[0134.837] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.gzip") returned 0
	[0134.837] lstrlenA (lpString="*.gzip") returned 6
	[0134.837] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.jpg") returned 0
	[0134.837] lstrlenA (lpString="*.jpg") returned 5
	[0134.837] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.jpeg") returned 0
	[0134.837] lstrlenA (lpString="*.jpeg") returned 6
	[0134.837] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.bmp") returned 0
	[0134.837] lstrlenA (lpString="*.bmp") returned 5
	[0134.837] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.gif") returned 0
	[0134.837] lstrlenA (lpString="*.gif") returned 5
	[0134.837] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.png") returned 0
	[0134.837] lstrlenA (lpString="*.png") returned 5
	[0134.838] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.doc") returned 0
	[0134.838] lstrlenA (lpString="*.doc") returned 5
	[0134.838] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.docx") returned 0
	[0134.838] lstrlenA (lpString="*.docx") returned 6
	[0134.838] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.xls") returned 0
	[0134.838] lstrlenA (lpString="*.xls") returned 5
	[0134.838] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.xlsx") returned 0
	[0134.838] lstrlenA (lpString="*.xlsx") returned 6
	[0134.838] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.ppt") returned 0
	[0134.838] lstrlenA (lpString="*.ppt") returned 5
	[0134.838] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.pptx") returned 0
	[0134.838] lstrlenA (lpString="*.pptx") returned 6
	[0134.838] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.txt") returned 0
	[0134.838] lstrlenA (lpString="*.txt") returned 5
	[0134.838] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.pdf") returned 0
	[0134.838] lstrlenA (lpString="*.pdf") returned 5
	[0134.838] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.htm") returned 0
	[0134.838] lstrlenA (lpString="*.htm") returned 5
	[0134.838] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.html") returned 0
	[0134.838] lstrlenA (lpString="*.html") returned 6
	[0134.838] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.mdb") returned 0
	[0134.838] lstrlenA (lpString="*.mdb") returned 5
	[0134.838] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.pfx") returned 0
	[0134.838] lstrlenA (lpString="*.pfx") returned 5
	[0134.838] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.md") returned 0
	[0134.838] lstrlenA (lpString="*.md") returned 4
	[0134.838] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.lnk") returned 0
	[0134.838] lstrlenA (lpString="*.lnk") returned 5
	[0134.838] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.torrent") returned 0
	[0134.838] lstrlenA (lpString="*.torrent") returned 9
	[0134.838] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.mov") returned 0
	[0134.838] lstrlenA (lpString="*.mov") returned 5
	[0134.839] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.3gp") returned 0
	[0134.839] lstrlenA (lpString="*.3gp") returned 5
	[0134.839] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.mpeg") returned 0
	[0134.839] lstrlenA (lpString="*.mpeg") returned 6
	[0134.839] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.mpg") returned 0
	[0134.839] lstrlenA (lpString="*.mpg") returned 5
	[0134.839] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.flv") returned 0
	[0134.839] lstrlenA (lpString="*.flv") returned 5
	[0134.839] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.avi") returned 0
	[0134.839] lstrlenA (lpString="*.avi") returned 5
	[0134.839] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.mp4") returned 0
	[0134.839] lstrlenA (lpString="*.mp4") returned 5
	[0134.839] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.wmv") returned 0
	[0134.839] lstrlenA (lpString="*.wmv") returned 5
	[0134.839] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.mkv") returned 0
	[0134.839] lstrlenA (lpString="*.mkv") returned 5
	[0134.839] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.mp3") returned 0
	[0134.839] lstrlenA (lpString="*.mp3") returned 5
	[0134.839] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.wav") returned 0
	[0134.839] lstrlenA (lpString="*.wav") returned 5
	[0134.839] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.flac") returned 0
	[0134.839] lstrlenA (lpString="*.flac") returned 6
	[0134.839] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.wma") returned 0
	[0134.839] lstrlenA (lpString="*.wma") returned 5
	[0134.839] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.au3") returned 0
	[0134.839] lstrlenA (lpString="*.au3") returned 5
	[0134.839] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.ahk") returned 0
	[0134.839] lstrlenA (lpString="*.ahk") returned 5
	[0134.839] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.c") returned 0
	[0134.839] lstrlenA (lpString="*.c") returned 3
	[0134.839] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.cc") returned 0
	[0134.839] lstrlenA (lpString="*.cc") returned 4
	[0134.839] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.cpp") returned 0
	[0134.840] lstrlenA (lpString="*.cpp") returned 5
	[0134.840] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.cxx") returned 0
	[0134.840] lstrlenA (lpString="*.cxx") returned 5
	[0134.840] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.c++") returned 0
	[0134.840] lstrlenA (lpString="*.c++") returned 5
	[0134.840] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.cs") returned 0
	[0134.840] lstrlenA (lpString="*.cs") returned 4
	[0134.840] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.vb") returned 0
	[0134.840] lstrlenA (lpString="*.vb") returned 4
	[0134.840] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.bas") returned 0
	[0134.840] lstrlenA (lpString="*.bas") returned 5
	[0134.840] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.csproj") returned 0
	[0134.840] lstrlenA (lpString="*.csproj") returned 8
	[0134.840] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.vbproj") returned 0
	[0134.840] lstrlenA (lpString="*.vbproj") returned 8
	[0134.840] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.vcxproj") returned 0
	[0134.840] lstrlenA (lpString="*.vcxproj") returned 9
	[0134.840] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.manifest") returned 0
	[0134.840] lstrlenA (lpString="*.manifest") returned 10
	[0134.840] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.php") returned 0
	[0134.840] lstrlenA (lpString="*.php") returned 5
	[0134.840] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.vbe") returned 0
	[0134.840] lstrlenA (lpString="*.vbe") returned 5
	[0134.840] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.vba") returned 0
	[0134.840] lstrlenA (lpString="*.vba") returned 5
	[0134.840] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.vbs") returned 0
	[0134.840] lstrlenA (lpString="*.vbs") returned 5
	[0134.840] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.bat") returned 0
	[0134.840] lstrlenA (lpString="*.bat") returned 5
	[0134.840] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.cmd") returned 0
	[0134.840] lstrlenA (lpString="*.cmd") returned 5
	[0134.840] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.js") returned 0
	[0134.840] lstrlenA (lpString="*.js") returned 4
	[0134.840] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.jscript") returned 0
	[0134.841] lstrlenA (lpString="*.jscript") returned 9
	[0134.841] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.hta") returned 0
	[0134.841] lstrlenA (lpString="*.hta") returned 5
	[0134.841] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.php7") returned 0
	[0134.841] lstrlenA (lpString="*.php7") returned 6
	[0134.841] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.db") returned 0
	[0134.841] lstrlenA (lpString="*.db") returned 4
	[0134.841] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.swf") returned 0
	[0134.841] lstrlenA (lpString="*.swf") returned 5
	[0134.841] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.eml") returned 0
	[0134.841] lstrlenA (lpString="*.eml") returned 5
	[0134.841] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.part") returned 0
	[0134.841] lstrlenA (lpString="*.part") returned 6
	[0134.841] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.nfo") returned 0
	[0134.841] lstrlenA (lpString="*.nfo") returned 5
	[0134.841] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.rsa") returned 0
	[0134.841] lstrlenA (lpString="*.rsa") returned 5
	[0134.841] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.key") returned 0
	[0134.841] lstrlenA (lpString="*.key") returned 5
	[0134.841] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.aes") returned 0
	[0134.841] lstrlenA (lpString="*.aes") returned 5
	[0134.841] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.blob") returned 0
	[0134.841] lstrlenA (lpString="*.blob") returned 6
	[0134.841] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.btc") returned 0
	[0134.841] lstrlenA (lpString="*.btc") returned 5
	[0134.841] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\GHi4txwrX\\h7KLxcZmWOI8p8.ots", pszSpec="*.wallet") returned 0
	[0134.841] lstrlenA (lpString="*.wallet") returned 8
	[0134.841] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab1a2410, ftCreationTime.dwHighDateTime=0x1d4d2f3, ftLastAccessTime.dwLowDateTime=0x8fba8990, ftLastAccessTime.dwHighDateTime=0x1d4cb86, ftLastWriteTime.dwLowDateTime=0x8fba8990, ftLastWriteTime.dwHighDateTime=0x1d4cb86, nFileSizeHigh=0x0, nFileSizeLow=0x11e04, dwReserved0=0x0, dwReserved1=0x0, cFileName="h7KLxcZmWOI8p8.ots", cAlternateFileName="H7KLXC~1.OTS")) returned 0
	[0134.841] FindClose (in: hFindFile=0x7cb650 | out: hFindFile=0x7cb650) returned 1
	[0134.841] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x441a8270, ftCreationTime.dwHighDateTime=0x1d4cbee, ftLastAccessTime.dwLowDateTime=0x6d1addd0, ftLastAccessTime.dwHighDateTime=0x1d4cdbc, ftLastWriteTime.dwLowDateTime=0x6d1addd0, ftLastWriteTime.dwHighDateTime=0x1d4cdbc, nFileSizeHigh=0x0, nFileSizeLow=0x93da, dwReserved0=0x0, dwReserved1=0x0, cFileName="n8qoRgZJ.odp", cAlternateFileName="")) returned 1
	[0134.841] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0134.841] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="n8qoRgZJ.odp") returned -1
	[0134.842] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="n8qoRgZJ.odp") returned -1
	[0134.842] lstrcmpiA (lpString1="", lpString2="n8qoRgZJ.odp") returned -1
	[0134.842] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\*.*") returned="*.*"
	[0134.842] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\"
	[0134.842] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\") returned=""
	[0134.842] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.842] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\how-to-decrypt-files.htm")) returned 0x20
	[0134.842] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\", lpString2="n8qoRgZJ.odp" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\n8qoRgZJ.odp") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\n8qoRgZJ.odp"
	[0134.842] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\n8qoRgZJ.odp", pszSpec="*.zip") returned 0
	[0134.842] lstrlenA (lpString="*.zip") returned 5
	[0134.842] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\n8qoRgZJ.odp", pszSpec="*.rar") returned 0
	[0134.842] lstrlenA (lpString="*.rar") returned 5
	[0134.842] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\n8qoRgZJ.odp", pszSpec="*.7z") returned 0
	[0134.842] lstrlenA (lpString="*.7z") returned 4
	[0134.842] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\n8qoRgZJ.odp", pszSpec="*.tar") returned 0
	[0134.842] lstrlenA (lpString="*.tar") returned 5
	[0134.842] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\n8qoRgZJ.odp", pszSpec="*.gzip") returned 0
	[0134.842] lstrlenA (lpString="*.gzip") returned 6
	[0134.842] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\n8qoRgZJ.odp", pszSpec="*.jpg") returned 0
	[0134.842] lstrlenA (lpString="*.jpg") returned 5
	[0134.842] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\n8qoRgZJ.odp", pszSpec="*.jpeg") returned 0
	[0134.842] lstrlenA (lpString="*.jpeg") returned 6
	[0134.842] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\n8qoRgZJ.odp", pszSpec="*.bmp") returned 0
	[0134.842] lstrlenA (lpString="*.bmp") returned 5
	[0134.842] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\n8qoRgZJ.odp", pszSpec="*.gif") returned 0
	[0134.842] lstrlenA (lpString="*.gif") returned 5
	[0134.842] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\n8qoRgZJ.odp", pszSpec="*.png") returned 0
	[0134.842] lstrlenA (lpString="*.png") returned 5
	[0134.842] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\n8qoRgZJ.odp", pszSpec="*.doc") returned 0
	[0134.843] lstrlenA (lpString="*.doc") returned 5
	[0134.843] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\n8qoRgZJ.odp", pszSpec="*.docx") returned 0
	[0134.843] lstrlenA (lpString="*.docx") returned 6
	[0134.843] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\n8qoRgZJ.odp", pszSpec="*.xls") returned 0
	[0134.843] lstrlenA (lpString="*.xls") returned 5
	[0134.843] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\n8qoRgZJ.odp", pszSpec="*.xlsx") returned 0
	[0134.843] lstrlenA (lpString="*.xlsx") returned 6
	[0134.843] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\n8qoRgZJ.odp", pszSpec="*.ppt") returned 0
	[0134.843] lstrlenA (lpString="*.ppt") returned 5
	[0134.843] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\n8qoRgZJ.odp", pszSpec="*.pptx") returned 0
	[0134.843] lstrlenA (lpString="*.pptx") returned 6
	[0134.843] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\n8qoRgZJ.odp", pszSpec="*.txt") returned 0
	[0134.843] lstrlenA (lpString="*.txt") returned 5
	[0134.843] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\n8qoRgZJ.odp", pszSpec="*.pdf") returned 0
	[0134.843] lstrlenA (lpString="*.pdf") returned 5
	[0134.843] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\n8qoRgZJ.odp", pszSpec="*.htm") returned 0
	[0134.843] lstrlenA (lpString="*.htm") returned 5
	[0134.843] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\n8qoRgZJ.odp", pszSpec="*.html") returned 0
	[0134.843] lstrlenA (lpString="*.html") returned 6
	[0134.843] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\n8qoRgZJ.odp", pszSpec="*.mdb") returned 0
	[0134.843] lstrlenA (lpString="*.mdb") returned 5
	[0134.843] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\n8qoRgZJ.odp", pszSpec="*.pfx") returned 0
	[0134.843] lstrlenA (lpString="*.pfx") returned 5
	[0134.843] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\n8qoRgZJ.odp", pszSpec="*.md") returned 0
	[0134.843] lstrlenA (lpString="*.md") returned 4
	[0134.843] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\n8qoRgZJ.odp", pszSpec="*.lnk") returned 0
	[0134.843] lstrlenA (lpString="*.lnk") returned 5
	[0134.843] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\n8qoRgZJ.odp", pszSpec="*.torrent") returned 0
	[0134.843] lstrlenA (lpString="*.torrent") returned 9
	[0134.843] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\n8qoRgZJ.odp", pszSpec="*.mov") returned 0
	[0134.843] lstrlenA (lpString="*.mov") returned 5
	[0134.843] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\n8qoRgZJ.odp", pszSpec="*.3gp") returned 0
	[0134.843] lstrlenA (lpString="*.3gp") returned 5
	[0134.844] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\n8qoRgZJ.odp", pszSpec="*.mpeg") returned 0
	[0134.844] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\n8qoRgZJ.odp", pszSpec="*.mpg") returned 0
	[0134.844] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\n8qoRgZJ.odp", pszSpec="*.flv") returned 0
	[0134.844] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x247273d0, ftCreationTime.dwHighDateTime=0x1d4c8ea, ftLastAccessTime.dwLowDateTime=0x40508eb0, ftLastAccessTime.dwHighDateTime=0x1d4d0bb, ftLastWriteTime.dwLowDateTime=0x40508eb0, ftLastWriteTime.dwHighDateTime=0x1d4d0bb, nFileSizeHigh=0x0, nFileSizeLow=0xa79c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rx0C_.odp", cAlternateFileName="")) returned 1
	[0134.844] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0134.844] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Rx0C_.odp") returned -1
	[0134.844] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Rx0C_.odp") returned -1
	[0134.844] lstrcmpiA (lpString1="", lpString2="Rx0C_.odp") returned -1
	[0134.844] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\n8qoRgZJ.odp") returned="n8qoRgZJ.odp"
	[0134.844] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\"
	[0134.844] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\") returned=""
	[0134.844] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.844] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\how-to-decrypt-files.htm")) returned 0x20
	[0134.844] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\", lpString2="Rx0C_.odp" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\Rx0C_.odp") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\Rx0C_.odp"
	[0134.844] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2b81510, ftCreationTime.dwHighDateTime=0x1d4cf5d, ftLastAccessTime.dwLowDateTime=0x5f003690, ftLastAccessTime.dwHighDateTime=0x1d4d39e, ftLastWriteTime.dwLowDateTime=0x5f003690, ftLastWriteTime.dwHighDateTime=0x1d4d39e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UA7FxMqGv", cAlternateFileName="UA7FXM~1")) returned 1
	[0134.844] lstrcmpA (lpString1=".", lpString2="UA7FxMqGv") returned -1
	[0134.844] lstrcmpA (lpString1="..", lpString2="UA7FxMqGv") returned -1
	[0134.844] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\Rx0C_.odp") returned="Rx0C_.odp"
	[0134.845] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\", lpString2="UA7FxMqGv" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv"
	[0134.845] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\*.*", lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2b81510, ftCreationTime.dwHighDateTime=0x1d4cf5d, ftLastAccessTime.dwLowDateTime=0x5f003690, ftLastAccessTime.dwHighDateTime=0x1d4d39e, ftLastWriteTime.dwLowDateTime=0x5f003690, ftLastWriteTime.dwHighDateTime=0x1d4d39e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0xa8, cFileName=".", cAlternateFileName="")) returned 0x7cbad0
	[0134.845] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0134.845] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2b81510, ftCreationTime.dwHighDateTime=0x1d4cf5d, ftLastAccessTime.dwLowDateTime=0x5f003690, ftLastAccessTime.dwHighDateTime=0x1d4d39e, ftLastWriteTime.dwLowDateTime=0x5f003690, ftLastWriteTime.dwHighDateTime=0x1d4d39e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0xa8, cFileName="..", cAlternateFileName="")) returned 1
	[0134.845] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0134.845] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0134.845] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc69fc5d0, ftCreationTime.dwHighDateTime=0x1d4ca49, ftLastAccessTime.dwLowDateTime=0x47436470, ftLastAccessTime.dwHighDateTime=0x1d4cab4, ftLastWriteTime.dwLowDateTime=0x47436470, ftLastWriteTime.dwHighDateTime=0x1d4cab4, nFileSizeHigh=0x0, nFileSizeLow=0xed6, dwReserved0=0x7b0000, dwReserved1=0xa8, cFileName="cRmdgDEVmpJ2A1sVP.ods", cAlternateFileName="CRMDGD~1.ODS")) returned 1
	[0134.845] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0134.845] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="cRmdgDEVmpJ2A1sVP.ods") returned 1
	[0134.845] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="cRmdgDEVmpJ2A1sVP.ods") returned 1
	[0134.845] lstrcmpiA (lpString1="", lpString2="cRmdgDEVmpJ2A1sVP.ods") returned -1
	[0134.845] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\*.*") returned="*.*"
	[0134.845] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\"
	[0134.845] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\") returned=""
	[0134.845] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.845] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\ua7fxmqgv\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0134.845] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\ua7fxmqgv\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0134.847] WriteFile (in: hFile=0x218, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0134.848] SetFileTime (hFile=0x218, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0134.848] CloseHandle (hObject=0x218) returned 1
	[0134.848] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\", lpString2="cRmdgDEVmpJ2A1sVP.ods" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\cRmdgDEVmpJ2A1sVP.ods") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\cRmdgDEVmpJ2A1sVP.ods"
	[0134.848] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52c9eba0, ftCreationTime.dwHighDateTime=0x1d4d4de, ftLastAccessTime.dwLowDateTime=0x942f8c10, ftLastAccessTime.dwHighDateTime=0x1d4d43b, ftLastWriteTime.dwLowDateTime=0x942f8c10, ftLastWriteTime.dwHighDateTime=0x1d4d43b, nFileSizeHigh=0x0, nFileSizeLow=0x11ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="rJwvSJl.ppt", cAlternateFileName="")) returned 1
	[0134.848] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0134.848] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="rJwvSJl.ppt") returned -1
	[0134.848] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="rJwvSJl.ppt") returned -1
	[0134.848] lstrcmpiA (lpString1="", lpString2="rJwvSJl.ppt") returned -1
	[0134.848] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\cRmdgDEVmpJ2A1sVP.ods") returned="cRmdgDEVmpJ2A1sVP.ods"
	[0134.848] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\"
	[0134.848] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\") returned=""
	[0134.848] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.848] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\ua7fxmqgv\\how-to-decrypt-files.htm")) returned 0x20
	[0134.849] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\", lpString2="rJwvSJl.ppt" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\rJwvSJl.ppt") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\rJwvSJl.ppt"
	[0134.849] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\rJwvSJl.ppt" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\rJwvSJl.ppt") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\rJwvSJl.ppt"
	[0134.849] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\rJwvSJl.ppt" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\rJwvSJl.ppt") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\rJwvSJl.ppt"
	[0134.849] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\rJwvSJl.ppt", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\rJwvSJl.ppt.") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\rJwvSJl.ppt."
	[0134.849] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\rJwvSJl.ppt.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\rJwvSJl.ppt.exe") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\rJwvSJl.ppt.exe"
	[0134.849] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\rJwvSJl.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\ua7fxmqgv\\rjwvsjl.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0134.849] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11ae
	[0134.849] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x52c9eba0, dwHighDateTime=0x1d4d4de), lpLastAccessTime=0x407536*(dwLowDateTime=0x942f8c10, dwHighDateTime=0x1d4d43b), lpLastWriteTime=0x40753e*(dwLowDateTime=0x942f8c10, dwHighDateTime=0x1d4d43b)) returned 1
	[0134.849] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.849] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x116c, lpOverlapped=0x0) returned 1
	[0134.850] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\rJwvSJl.ppt") returned="rJwvSJl.ppt"
	[0134.850] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.850] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x116c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x116c, lpOverlapped=0x0) returned 1
	[0134.850] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.850] CloseHandle (hObject=0x218) returned 1
	[0134.850] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\rJwvSJl.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\ua7fxmqgv\\rjwvsjl.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UA7FxMqGv\\rJwvSJl.ppt.exe" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\ua7fxmqgv\\rjwvsjl.ppt.exe")) returned 1
	[0134.851] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52c9eba0, ftCreationTime.dwHighDateTime=0x1d4d4de, ftLastAccessTime.dwLowDateTime=0x942f8c10, ftLastAccessTime.dwHighDateTime=0x1d4d43b, ftLastWriteTime.dwLowDateTime=0x942f8c10, ftLastWriteTime.dwHighDateTime=0x1d4d43b, nFileSizeHigh=0x0, nFileSizeLow=0x11ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="rJwvSJl.ppt", cAlternateFileName="")) returned 0
	[0134.851] FindClose (in: hFindFile=0x7cbad0 | out: hFindFile=0x7cbad0) returned 1
	[0134.851] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c80830, ftCreationTime.dwHighDateTime=0x1d4d3b0, ftLastAccessTime.dwLowDateTime=0x2271c8a0, ftLastAccessTime.dwHighDateTime=0x1d4cd5a, ftLastWriteTime.dwLowDateTime=0x2271c8a0, ftLastWriteTime.dwHighDateTime=0x1d4cd5a, nFileSizeHigh=0x0, nFileSizeLow=0x10dab, dwReserved0=0x20, dwReserved1=0x0, cFileName="udnV.ots", cAlternateFileName="")) returned 1
	[0134.851] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0134.851] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="udnV.ots") returned -1
	[0134.852] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="udnV.ots") returned -1
	[0134.852] lstrcmpiA (lpString1="", lpString2="udnV.ots") returned -1
	[0134.852] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\*.*") returned="*.*"
	[0134.852] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\"
	[0134.852] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\") returned=""
	[0134.852] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.852] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\how-to-decrypt-files.htm")) returned 0x20
	[0134.852] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\", lpString2="udnV.ots" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots"
	[0134.852] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.zip") returned 0
	[0134.852] lstrlenA (lpString="*.zip") returned 5
	[0134.852] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.rar") returned 0
	[0134.852] lstrlenA (lpString="*.rar") returned 5
	[0134.852] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.7z") returned 0
	[0134.852] lstrlenA (lpString="*.7z") returned 4
	[0134.852] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.tar") returned 0
	[0134.852] lstrlenA (lpString="*.tar") returned 5
	[0134.852] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.gzip") returned 0
	[0134.852] lstrlenA (lpString="*.gzip") returned 6
	[0134.852] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.jpg") returned 0
	[0134.852] lstrlenA (lpString="*.jpg") returned 5
	[0134.852] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.jpeg") returned 0
	[0134.852] lstrlenA (lpString="*.jpeg") returned 6
	[0134.852] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.bmp") returned 0
	[0134.852] lstrlenA (lpString="*.bmp") returned 5
	[0134.852] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.gif") returned 0
	[0134.852] lstrlenA (lpString="*.gif") returned 5
	[0134.852] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.png") returned 0
	[0134.852] lstrlenA (lpString="*.png") returned 5
	[0134.852] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.doc") returned 0
	[0134.852] lstrlenA (lpString="*.doc") returned 5
	[0134.852] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.docx") returned 0
	[0134.852] lstrlenA (lpString="*.docx") returned 6
	[0134.853] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.xls") returned 0
	[0134.853] lstrlenA (lpString="*.xls") returned 5
	[0134.853] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.xlsx") returned 0
	[0134.853] lstrlenA (lpString="*.xlsx") returned 6
	[0134.853] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.ppt") returned 0
	[0134.853] lstrlenA (lpString="*.ppt") returned 5
	[0134.853] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.pptx") returned 0
	[0134.853] lstrlenA (lpString="*.pptx") returned 6
	[0134.853] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.txt") returned 0
	[0134.853] lstrlenA (lpString="*.txt") returned 5
	[0134.853] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.pdf") returned 0
	[0134.853] lstrlenA (lpString="*.pdf") returned 5
	[0134.853] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.htm") returned 0
	[0134.853] lstrlenA (lpString="*.htm") returned 5
	[0134.853] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.html") returned 0
	[0134.853] lstrlenA (lpString="*.html") returned 6
	[0134.853] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.mdb") returned 0
	[0134.853] lstrlenA (lpString="*.mdb") returned 5
	[0134.853] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.pfx") returned 0
	[0134.853] lstrlenA (lpString="*.pfx") returned 5
	[0134.853] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.md") returned 0
	[0134.853] lstrlenA (lpString="*.md") returned 4
	[0134.853] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.lnk") returned 0
	[0134.853] lstrlenA (lpString="*.lnk") returned 5
	[0134.853] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.torrent") returned 0
	[0134.853] lstrlenA (lpString="*.torrent") returned 9
	[0134.853] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.mov") returned 0
	[0134.853] lstrlenA (lpString="*.mov") returned 5
	[0134.853] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.3gp") returned 0
	[0134.853] lstrlenA (lpString="*.3gp") returned 5
	[0134.853] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.mpeg") returned 0
	[0134.853] lstrlenA (lpString="*.mpeg") returned 6
	[0134.853] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.mpg") returned 0
	[0134.853] lstrlenA (lpString="*.mpg") returned 5
	[0134.853] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.flv") returned 0
	[0134.853] lstrlenA (lpString="*.flv") returned 5
	[0134.854] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.avi") returned 0
	[0134.854] lstrlenA (lpString="*.avi") returned 5
	[0134.854] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.mp4") returned 0
	[0134.854] lstrlenA (lpString="*.mp4") returned 5
	[0134.854] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.wmv") returned 0
	[0134.854] lstrlenA (lpString="*.wmv") returned 5
	[0134.854] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.mkv") returned 0
	[0134.854] lstrlenA (lpString="*.mkv") returned 5
	[0134.854] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.mp3") returned 0
	[0134.854] lstrlenA (lpString="*.mp3") returned 5
	[0134.854] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.wav") returned 0
	[0134.854] lstrlenA (lpString="*.wav") returned 5
	[0134.854] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.flac") returned 0
	[0134.854] lstrlenA (lpString="*.flac") returned 6
	[0134.854] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.wma") returned 0
	[0134.854] lstrlenA (lpString="*.wma") returned 5
	[0134.854] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.au3") returned 0
	[0134.854] lstrlenA (lpString="*.au3") returned 5
	[0134.854] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.ahk") returned 0
	[0134.854] lstrlenA (lpString="*.ahk") returned 5
	[0134.854] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.c") returned 0
	[0134.854] lstrlenA (lpString="*.c") returned 3
	[0134.854] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.cc") returned 0
	[0134.854] lstrlenA (lpString="*.cc") returned 4
	[0134.854] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.cpp") returned 0
	[0134.854] lstrlenA (lpString="*.cpp") returned 5
	[0134.854] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.cxx") returned 0
	[0134.854] lstrlenA (lpString="*.cxx") returned 5
	[0134.854] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.c++") returned 0
	[0134.854] lstrlenA (lpString="*.c++") returned 5
	[0134.854] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.cs") returned 0
	[0134.854] lstrlenA (lpString="*.cs") returned 4
	[0134.854] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.vb") returned 0
	[0134.854] lstrlenA (lpString="*.vb") returned 4
	[0134.854] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.bas") returned 0
	[0134.855] lstrlenA (lpString="*.bas") returned 5
	[0134.855] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.csproj") returned 0
	[0134.855] lstrlenA (lpString="*.csproj") returned 8
	[0134.855] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.vbproj") returned 0
	[0134.855] lstrlenA (lpString="*.vbproj") returned 8
	[0134.855] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.vcxproj") returned 0
	[0134.855] lstrlenA (lpString="*.vcxproj") returned 9
	[0134.855] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.manifest") returned 0
	[0134.855] lstrlenA (lpString="*.manifest") returned 10
	[0134.855] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.php") returned 0
	[0134.855] lstrlenA (lpString="*.php") returned 5
	[0134.855] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.vbe") returned 0
	[0134.855] lstrlenA (lpString="*.vbe") returned 5
	[0134.855] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.vba") returned 0
	[0134.855] lstrlenA (lpString="*.vba") returned 5
	[0134.855] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.vbs") returned 0
	[0134.855] lstrlenA (lpString="*.vbs") returned 5
	[0134.855] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.bat") returned 0
	[0134.855] lstrlenA (lpString="*.bat") returned 5
	[0134.855] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.cmd") returned 0
	[0134.855] lstrlenA (lpString="*.cmd") returned 5
	[0134.855] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.js") returned 0
	[0134.855] lstrlenA (lpString="*.js") returned 4
	[0134.855] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.jscript") returned 0
	[0134.855] lstrlenA (lpString="*.jscript") returned 9
	[0134.855] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.hta") returned 0
	[0134.855] lstrlenA (lpString="*.hta") returned 5
	[0134.855] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.php7") returned 0
	[0134.855] lstrlenA (lpString="*.php7") returned 6
	[0134.855] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.db") returned 0
	[0134.855] lstrlenA (lpString="*.db") returned 4
	[0134.855] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.swf") returned 0
	[0134.855] lstrlenA (lpString="*.swf") returned 5
	[0134.856] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.eml") returned 0
	[0134.856] lstrlenA (lpString="*.eml") returned 5
	[0134.856] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.part") returned 0
	[0134.856] lstrlenA (lpString="*.part") returned 6
	[0134.856] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.nfo") returned 0
	[0134.856] lstrlenA (lpString="*.nfo") returned 5
	[0134.856] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.rsa") returned 0
	[0134.856] lstrlenA (lpString="*.rsa") returned 5
	[0134.856] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.key") returned 0
	[0134.856] lstrlenA (lpString="*.key") returned 5
	[0134.856] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.aes") returned 0
	[0134.856] lstrlenA (lpString="*.aes") returned 5
	[0134.856] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.blob") returned 0
	[0134.856] lstrlenA (lpString="*.blob") returned 6
	[0134.856] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.btc") returned 0
	[0134.856] lstrlenA (lpString="*.btc") returned 5
	[0134.856] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots", pszSpec="*.wallet") returned 0
	[0134.856] lstrlenA (lpString="*.wallet") returned 8
	[0134.856] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b29d180, ftCreationTime.dwHighDateTime=0x1d4c8b3, ftLastAccessTime.dwLowDateTime=0x5e1ddc80, ftLastAccessTime.dwHighDateTime=0x1d4d404, ftLastWriteTime.dwLowDateTime=0x5e1ddc80, ftLastWriteTime.dwHighDateTime=0x1d4d404, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UZNM2XfEt IgoSe", cAlternateFileName="UZNM2X~1")) returned 1
	[0134.856] lstrcmpA (lpString1=".", lpString2="UZNM2XfEt IgoSe") returned -1
	[0134.856] lstrcmpA (lpString1="..", lpString2="UZNM2XfEt IgoSe") returned -1
	[0134.856] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\udnV.ots") returned="udnV.ots"
	[0134.856] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\", lpString2="UZNM2XfEt IgoSe" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe"
	[0134.856] lstrlenA (lpString="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe") returned 63
	[0134.856] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\*.*", lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b29d180, ftCreationTime.dwHighDateTime=0x1d4c8b3, ftLastAccessTime.dwLowDateTime=0x5e1ddc80, ftLastAccessTime.dwHighDateTime=0x1d4d404, ftLastWriteTime.dwLowDateTime=0x5e1ddc80, ftLastWriteTime.dwHighDateTime=0x1d4d404, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0xa8, cFileName=".", cAlternateFileName="")) returned 0x7cb7d0
	[0134.856] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0134.856] FindNextFileA (in: hFindFile=0x7cb7d0, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b29d180, ftCreationTime.dwHighDateTime=0x1d4c8b3, ftLastAccessTime.dwLowDateTime=0x5e1ddc80, ftLastAccessTime.dwHighDateTime=0x1d4d404, ftLastWriteTime.dwLowDateTime=0x5e1ddc80, ftLastWriteTime.dwHighDateTime=0x1d4d404, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0xa8, cFileName="..", cAlternateFileName="")) returned 1
	[0134.856] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0134.856] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0134.856] FindNextFileA (in: hFindFile=0x7cb7d0, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62854140, ftCreationTime.dwHighDateTime=0x1d4d5a4, ftLastAccessTime.dwLowDateTime=0xa959aca0, ftLastAccessTime.dwHighDateTime=0x1d4d275, ftLastWriteTime.dwLowDateTime=0xa959aca0, ftLastWriteTime.dwHighDateTime=0x1d4d275, nFileSizeHigh=0x0, nFileSizeLow=0x7d39, dwReserved0=0x7b0000, dwReserved1=0xa8, cFileName="4PZUM3E9FK3kU9v.pdf", cAlternateFileName="4PZUM3~1.PDF")) returned 1
	[0134.857] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0134.857] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="4PZUM3E9FK3kU9v.pdf") returned 1
	[0134.857] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="4PZUM3E9FK3kU9v.pdf") returned 1
	[0134.857] lstrcmpiA (lpString1="", lpString2="4PZUM3E9FK3kU9v.pdf") returned -1
	[0134.857] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\*.*") returned="*.*"
	[0134.857] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\"
	[0134.857] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\") returned=""
	[0134.857] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.857] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\uznm2xfet igose\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0134.857] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\uznm2xfet igose\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0134.858] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0134.858] WriteFile (in: hFile=0x218, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0134.859] SetFileTime (hFile=0x218, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0134.859] CloseHandle (hObject=0x218) returned 1
	[0134.859] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\", lpString2="4PZUM3E9FK3kU9v.pdf" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\4PZUM3E9FK3kU9v.pdf") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\4PZUM3E9FK3kU9v.pdf"
	[0134.859] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\4PZUM3E9FK3kU9v.pdf", pszSpec="*.zip") returned 0
	[0134.859] lstrlenA (lpString="*.zip") returned 5
	[0134.859] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\4PZUM3E9FK3kU9v.pdf", pszSpec="*.rar") returned 0
	[0134.859] lstrlenA (lpString="*.rar") returned 5
	[0134.859] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\4PZUM3E9FK3kU9v.pdf", pszSpec="*.7z") returned 0
	[0134.859] lstrlenA (lpString="*.7z") returned 4
	[0134.859] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\4PZUM3E9FK3kU9v.pdf", pszSpec="*.tar") returned 0
	[0134.859] lstrlenA (lpString="*.tar") returned 5
	[0134.859] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\4PZUM3E9FK3kU9v.pdf", pszSpec="*.gzip") returned 0
	[0134.859] lstrlenA (lpString="*.gzip") returned 6
	[0134.859] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\4PZUM3E9FK3kU9v.pdf", pszSpec="*.jpg") returned 0
	[0134.859] lstrlenA (lpString="*.jpg") returned 5
	[0134.859] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\4PZUM3E9FK3kU9v.pdf", pszSpec="*.jpeg") returned 0
	[0134.859] lstrlenA (lpString="*.jpeg") returned 6
	[0134.859] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\4PZUM3E9FK3kU9v.pdf", pszSpec="*.bmp") returned 0
	[0134.859] lstrlenA (lpString="*.bmp") returned 5
	[0134.860] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\4PZUM3E9FK3kU9v.pdf", pszSpec="*.gif") returned 0
	[0134.860] lstrlenA (lpString="*.gif") returned 5
	[0134.860] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\4PZUM3E9FK3kU9v.pdf", pszSpec="*.png") returned 0
	[0134.860] lstrlenA (lpString="*.png") returned 5
	[0134.860] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\4PZUM3E9FK3kU9v.pdf", pszSpec="*.doc") returned 0
	[0134.860] lstrlenA (lpString="*.doc") returned 5
	[0134.860] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\4PZUM3E9FK3kU9v.pdf", pszSpec="*.docx") returned 0
	[0134.860] lstrlenA (lpString="*.docx") returned 6
	[0134.860] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\4PZUM3E9FK3kU9v.pdf", pszSpec="*.xls") returned 0
	[0134.860] lstrlenA (lpString="*.xls") returned 5
	[0134.860] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\4PZUM3E9FK3kU9v.pdf", pszSpec="*.xlsx") returned 0
	[0134.860] lstrlenA (lpString="*.xlsx") returned 6
	[0134.860] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\4PZUM3E9FK3kU9v.pdf", pszSpec="*.ppt") returned 0
	[0134.860] lstrlenA (lpString="*.ppt") returned 5
	[0134.860] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\4PZUM3E9FK3kU9v.pdf", pszSpec="*.pptx") returned 0
	[0134.860] lstrlenA (lpString="*.pptx") returned 6
	[0134.860] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\4PZUM3E9FK3kU9v.pdf", pszSpec="*.txt") returned 0
	[0134.860] lstrlenA (lpString="*.txt") returned 5
	[0134.860] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\4PZUM3E9FK3kU9v.pdf", pszSpec="*.pdf") returned 1
	[0134.860] lstrlenA (lpString="*.pdf") returned 5
	[0134.860] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\4PZUM3E9FK3kU9v.pdf" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\4PZUM3E9FK3kU9v.pdf") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\4PZUM3E9FK3kU9v.pdf"
	[0134.860] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\4PZUM3E9FK3kU9v.pdf" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\4PZUM3E9FK3kU9v.pdf") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\4PZUM3E9FK3kU9v.pdf"
	[0134.860] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\4PZUM3E9FK3kU9v.pdf", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\4PZUM3E9FK3kU9v.pdf.") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\4PZUM3E9FK3kU9v.pdf."
	[0134.860] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\4PZUM3E9FK3kU9v.pdf.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\4PZUM3E9FK3kU9v.pdf.exe") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\4PZUM3E9FK3kU9v.pdf.exe"
	[0134.860] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\4PZUM3E9FK3kU9v.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\uznm2xfet igose\\4pzum3e9fk3ku9v.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0134.861] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7d39
	[0134.861] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x62854140, dwHighDateTime=0x1d4d5a4), lpLastAccessTime=0x407536*(dwLowDateTime=0xa959aca0, dwHighDateTime=0x1d4d275), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa959aca0, dwHighDateTime=0x1d4d275)) returned 1
	[0134.861] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.861] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7cf7, lpOverlapped=0x0) returned 1
	[0134.862] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\4PZUM3E9FK3kU9v.pdf") returned="4PZUM3E9FK3kU9v.pdf"
	[0134.862] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.862] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7cf7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7cf7, lpOverlapped=0x0) returned 1
	[0134.862] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.862] CloseHandle (hObject=0x218) returned 1
	[0134.862] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\4PZUM3E9FK3kU9v.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\uznm2xfet igose\\4pzum3e9fk3ku9v.pdf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\4PZUM3E9FK3kU9v.pdf.exe" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\uznm2xfet igose\\4pzum3e9fk3ku9v.pdf.exe")) returned 1
	[0134.878] FindNextFileA (in: hFindFile=0x7cb7d0, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x157a9200, ftCreationTime.dwHighDateTime=0x1d4c8e4, ftLastAccessTime.dwLowDateTime=0xa5ddfc70, ftLastAccessTime.dwHighDateTime=0x1d4d3bf, ftLastWriteTime.dwLowDateTime=0xa5ddfc70, ftLastWriteTime.dwHighDateTime=0x1d4d3bf, nFileSizeHigh=0x0, nFileSizeLow=0x944e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PKtdnEbLfIRVXjWA.ppt", cAlternateFileName="PKTDNE~1.PPT")) returned 1
	[0134.878] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0134.878] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PKtdnEbLfIRVXjWA.ppt") returned -1
	[0134.878] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PKtdnEbLfIRVXjWA.ppt") returned -1
	[0134.878] lstrcmpiA (lpString1="", lpString2="PKtdnEbLfIRVXjWA.ppt") returned -1
	[0134.878] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\4PZUM3E9FK3kU9v.pdf") returned="4PZUM3E9FK3kU9v.pdf"
	[0134.878] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\"
	[0134.878] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\") returned=""
	[0134.878] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.878] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\uznm2xfet igose\\how-to-decrypt-files.htm")) returned 0x20
	[0134.878] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\", lpString2="PKtdnEbLfIRVXjWA.ppt" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\PKtdnEbLfIRVXjWA.ppt") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\PKtdnEbLfIRVXjWA.ppt"
	[0134.878] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\PKtdnEbLfIRVXjWA.ppt", pszSpec="*.zip") returned 0
	[0134.878] lstrlenA (lpString="*.zip") returned 5
	[0134.878] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\PKtdnEbLfIRVXjWA.ppt", pszSpec="*.rar") returned 0
	[0134.878] lstrlenA (lpString="*.rar") returned 5
	[0134.878] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\PKtdnEbLfIRVXjWA.ppt", pszSpec="*.7z") returned 0
	[0134.878] lstrlenA (lpString="*.7z") returned 4
	[0134.879] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\PKtdnEbLfIRVXjWA.ppt", pszSpec="*.tar") returned 0
	[0134.879] lstrlenA (lpString="*.tar") returned 5
	[0134.879] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\PKtdnEbLfIRVXjWA.ppt", pszSpec="*.gzip") returned 0
	[0134.879] lstrlenA (lpString="*.gzip") returned 6
	[0134.879] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\PKtdnEbLfIRVXjWA.ppt", pszSpec="*.jpg") returned 0
	[0134.879] lstrlenA (lpString="*.jpg") returned 5
	[0134.879] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\PKtdnEbLfIRVXjWA.ppt", pszSpec="*.jpeg") returned 0
	[0134.879] lstrlenA (lpString="*.jpeg") returned 6
	[0134.879] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\PKtdnEbLfIRVXjWA.ppt", pszSpec="*.bmp") returned 0
	[0134.879] lstrlenA (lpString="*.bmp") returned 5
	[0134.879] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\PKtdnEbLfIRVXjWA.ppt", pszSpec="*.gif") returned 0
	[0134.879] lstrlenA (lpString="*.gif") returned 5
	[0134.879] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\PKtdnEbLfIRVXjWA.ppt", pszSpec="*.png") returned 0
	[0134.879] lstrlenA (lpString="*.png") returned 5
	[0134.879] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\PKtdnEbLfIRVXjWA.ppt", pszSpec="*.doc") returned 0
	[0134.879] lstrlenA (lpString="*.doc") returned 5
	[0134.879] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\PKtdnEbLfIRVXjWA.ppt", pszSpec="*.docx") returned 0
	[0134.879] lstrlenA (lpString="*.docx") returned 6
	[0134.879] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\PKtdnEbLfIRVXjWA.ppt", pszSpec="*.xls") returned 0
	[0134.879] lstrlenA (lpString="*.xls") returned 5
	[0134.879] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\PKtdnEbLfIRVXjWA.ppt", pszSpec="*.xlsx") returned 0
	[0134.879] lstrlenA (lpString="*.xlsx") returned 6
	[0134.879] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\PKtdnEbLfIRVXjWA.ppt", pszSpec="*.ppt") returned 1
	[0134.879] lstrlenA (lpString="*.ppt") returned 5
	[0134.879] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\PKtdnEbLfIRVXjWA.ppt" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\PKtdnEbLfIRVXjWA.ppt") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\PKtdnEbLfIRVXjWA.ppt"
	[0134.879] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\PKtdnEbLfIRVXjWA.ppt" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\PKtdnEbLfIRVXjWA.ppt") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\PKtdnEbLfIRVXjWA.ppt"
	[0134.879] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\PKtdnEbLfIRVXjWA.ppt", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\PKtdnEbLfIRVXjWA.ppt.") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\PKtdnEbLfIRVXjWA.ppt."
	[0134.879] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\PKtdnEbLfIRVXjWA.ppt.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\PKtdnEbLfIRVXjWA.ppt.exe") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\PKtdnEbLfIRVXjWA.ppt.exe"
	[0134.879] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\PKtdnEbLfIRVXjWA.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\uznm2xfet igose\\pktdneblfirvxjwa.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0134.880] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x944e
	[0134.880] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x157a9200, dwHighDateTime=0x1d4c8e4), lpLastAccessTime=0x407536*(dwLowDateTime=0xa5ddfc70, dwHighDateTime=0x1d4d3bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa5ddfc70, dwHighDateTime=0x1d4d3bf)) returned 1
	[0134.880] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.880] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x940c, lpOverlapped=0x0) returned 1
	[0134.881] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\PKtdnEbLfIRVXjWA.ppt") returned="PKtdnEbLfIRVXjWA.ppt"
	[0134.881] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.881] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x940c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x940c, lpOverlapped=0x0) returned 1
	[0134.891] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.891] CloseHandle (hObject=0x218) returned 1
	[0134.891] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\PKtdnEbLfIRVXjWA.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\uznm2xfet igose\\pktdneblfirvxjwa.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\PKtdnEbLfIRVXjWA.ppt.exe" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\uznm2xfet igose\\pktdneblfirvxjwa.ppt.exe")) returned 1
	[0134.892] FindNextFileA (in: hFindFile=0x7cb7d0, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a590880, ftCreationTime.dwHighDateTime=0x1d4d232, ftLastAccessTime.dwLowDateTime=0x49955ac0, ftLastAccessTime.dwHighDateTime=0x1d4d046, ftLastWriteTime.dwLowDateTime=0x49955ac0, ftLastWriteTime.dwHighDateTime=0x1d4d046, nFileSizeHigh=0x0, nFileSizeLow=0x812c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RwkWmHC6l.pps", cAlternateFileName="RWKWMH~1.PPS")) returned 1
	[0134.892] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0134.892] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="RwkWmHC6l.pps") returned -1
	[0134.892] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="RwkWmHC6l.pps") returned -1
	[0134.892] lstrcmpiA (lpString1="", lpString2="RwkWmHC6l.pps") returned -1
	[0134.892] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\PKtdnEbLfIRVXjWA.ppt") returned="PKtdnEbLfIRVXjWA.ppt"
	[0134.892] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\"
	[0134.892] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\") returned=""
	[0134.892] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.892] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\uznm2xfet igose\\how-to-decrypt-files.htm")) returned 0x20
	[0134.892] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\", lpString2="RwkWmHC6l.pps" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps"
	[0134.892] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.zip") returned 0
	[0134.892] lstrlenA (lpString="*.zip") returned 5
	[0134.892] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.rar") returned 0
	[0134.892] lstrlenA (lpString="*.rar") returned 5
	[0134.892] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.7z") returned 0
	[0134.892] lstrlenA (lpString="*.7z") returned 4
	[0134.892] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.tar") returned 0
	[0134.893] lstrlenA (lpString="*.tar") returned 5
	[0134.893] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.gzip") returned 0
	[0134.893] lstrlenA (lpString="*.gzip") returned 6
	[0134.893] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.jpg") returned 0
	[0134.893] lstrlenA (lpString="*.jpg") returned 5
	[0134.893] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.jpeg") returned 0
	[0134.893] lstrlenA (lpString="*.jpeg") returned 6
	[0134.893] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.bmp") returned 0
	[0134.893] lstrlenA (lpString="*.bmp") returned 5
	[0134.893] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.gif") returned 0
	[0134.893] lstrlenA (lpString="*.gif") returned 5
	[0134.893] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.png") returned 0
	[0134.893] lstrlenA (lpString="*.png") returned 5
	[0134.893] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.doc") returned 0
	[0134.893] lstrlenA (lpString="*.doc") returned 5
	[0134.893] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.docx") returned 0
	[0134.893] lstrlenA (lpString="*.docx") returned 6
	[0134.893] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.xls") returned 0
	[0134.893] lstrlenA (lpString="*.xls") returned 5
	[0134.893] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.xlsx") returned 0
	[0134.893] lstrlenA (lpString="*.xlsx") returned 6
	[0134.893] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.ppt") returned 0
	[0134.893] lstrlenA (lpString="*.ppt") returned 5
	[0134.893] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.pptx") returned 0
	[0134.893] lstrlenA (lpString="*.pptx") returned 6
	[0134.893] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.txt") returned 0
	[0134.893] lstrlenA (lpString="*.txt") returned 5
	[0134.893] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.pdf") returned 0
	[0134.893] lstrlenA (lpString="*.pdf") returned 5
	[0134.893] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.htm") returned 0
	[0134.893] lstrlenA (lpString="*.htm") returned 5
	[0134.893] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.html") returned 0
	[0134.893] lstrlenA (lpString="*.html") returned 6
	[0134.893] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.mdb") returned 0
	[0134.893] lstrlenA (lpString="*.mdb") returned 5
	[0134.894] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.pfx") returned 0
	[0134.894] lstrlenA (lpString="*.pfx") returned 5
	[0134.894] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.md") returned 0
	[0134.894] lstrlenA (lpString="*.md") returned 4
	[0134.894] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.lnk") returned 0
	[0134.894] lstrlenA (lpString="*.lnk") returned 5
	[0134.894] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.torrent") returned 0
	[0134.894] lstrlenA (lpString="*.torrent") returned 9
	[0134.894] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.mov") returned 0
	[0134.894] lstrlenA (lpString="*.mov") returned 5
	[0134.894] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.3gp") returned 0
	[0134.894] lstrlenA (lpString="*.3gp") returned 5
	[0134.894] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.mpeg") returned 0
	[0134.894] lstrlenA (lpString="*.mpeg") returned 6
	[0134.894] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.mpg") returned 0
	[0134.894] lstrlenA (lpString="*.mpg") returned 5
	[0134.894] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.flv") returned 0
	[0134.894] lstrlenA (lpString="*.flv") returned 5
	[0134.894] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.avi") returned 0
	[0134.894] lstrlenA (lpString="*.avi") returned 5
	[0134.894] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.mp4") returned 0
	[0134.894] lstrlenA (lpString="*.mp4") returned 5
	[0134.894] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.wmv") returned 0
	[0134.894] lstrlenA (lpString="*.wmv") returned 5
	[0134.894] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.mkv") returned 0
	[0134.894] lstrlenA (lpString="*.mkv") returned 5
	[0134.894] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.mp3") returned 0
	[0134.894] lstrlenA (lpString="*.mp3") returned 5
	[0134.894] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.wav") returned 0
	[0134.894] lstrlenA (lpString="*.wav") returned 5
	[0134.894] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.flac") returned 0
	[0134.894] lstrlenA (lpString="*.flac") returned 6
	[0134.894] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.wma") returned 0
	[0134.894] lstrlenA (lpString="*.wma") returned 5
	[0134.895] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.au3") returned 0
	[0134.895] lstrlenA (lpString="*.au3") returned 5
	[0134.895] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.ahk") returned 0
	[0134.895] lstrlenA (lpString="*.ahk") returned 5
	[0134.895] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.c") returned 0
	[0134.895] lstrlenA (lpString="*.c") returned 3
	[0134.895] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.cc") returned 0
	[0134.895] lstrlenA (lpString="*.cc") returned 4
	[0134.895] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.cpp") returned 0
	[0134.895] lstrlenA (lpString="*.cpp") returned 5
	[0134.895] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.cxx") returned 0
	[0134.895] lstrlenA (lpString="*.cxx") returned 5
	[0134.895] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.c++") returned 0
	[0134.895] lstrlenA (lpString="*.c++") returned 5
	[0134.895] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.cs") returned 0
	[0134.895] lstrlenA (lpString="*.cs") returned 4
	[0134.895] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.vb") returned 0
	[0134.895] lstrlenA (lpString="*.vb") returned 4
	[0134.895] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.bas") returned 0
	[0134.895] lstrlenA (lpString="*.bas") returned 5
	[0134.895] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.csproj") returned 0
	[0134.895] lstrlenA (lpString="*.csproj") returned 8
	[0134.895] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.vbproj") returned 0
	[0134.895] lstrlenA (lpString="*.vbproj") returned 8
	[0134.895] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.vcxproj") returned 0
	[0134.895] lstrlenA (lpString="*.vcxproj") returned 9
	[0134.895] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.manifest") returned 0
	[0134.895] lstrlenA (lpString="*.manifest") returned 10
	[0134.895] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.php") returned 0
	[0134.895] lstrlenA (lpString="*.php") returned 5
	[0134.895] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.vbe") returned 0
	[0134.895] lstrlenA (lpString="*.vbe") returned 5
	[0134.895] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.vba") returned 0
	[0134.895] lstrlenA (lpString="*.vba") returned 5
	[0134.895] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.vbs") returned 0
	[0134.896] lstrlenA (lpString="*.vbs") returned 5
	[0134.896] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.bat") returned 0
	[0134.896] lstrlenA (lpString="*.bat") returned 5
	[0134.896] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.cmd") returned 0
	[0134.896] lstrlenA (lpString="*.cmd") returned 5
	[0134.896] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.js") returned 0
	[0134.896] lstrlenA (lpString="*.js") returned 4
	[0134.896] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.jscript") returned 0
	[0134.896] lstrlenA (lpString="*.jscript") returned 9
	[0134.896] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.hta") returned 0
	[0134.896] lstrlenA (lpString="*.hta") returned 5
	[0134.896] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.php7") returned 0
	[0134.896] lstrlenA (lpString="*.php7") returned 6
	[0134.896] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.db") returned 0
	[0134.896] lstrlenA (lpString="*.db") returned 4
	[0134.896] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.swf") returned 0
	[0134.896] lstrlenA (lpString="*.swf") returned 5
	[0134.896] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.eml") returned 0
	[0134.896] lstrlenA (lpString="*.eml") returned 5
	[0134.896] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.part") returned 0
	[0134.896] lstrlenA (lpString="*.part") returned 6
	[0134.896] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.nfo") returned 0
	[0134.896] lstrlenA (lpString="*.nfo") returned 5
	[0134.896] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.rsa") returned 0
	[0134.896] lstrlenA (lpString="*.rsa") returned 5
	[0134.896] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.key") returned 0
	[0134.896] lstrlenA (lpString="*.key") returned 5
	[0134.896] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.aes") returned 0
	[0134.896] lstrlenA (lpString="*.aes") returned 5
	[0134.896] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.blob") returned 0
	[0134.896] lstrlenA (lpString="*.blob") returned 6
	[0134.896] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.btc") returned 0
	[0134.896] lstrlenA (lpString="*.btc") returned 5
	[0134.896] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\UZNM2XfEt IgoSe\\RwkWmHC6l.pps", pszSpec="*.wallet") returned 0
	[0134.897] lstrlenA (lpString="*.wallet") returned 8
	[0134.897] FindNextFileA (in: hFindFile=0x7cb7d0, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a590880, ftCreationTime.dwHighDateTime=0x1d4d232, ftLastAccessTime.dwLowDateTime=0x49955ac0, ftLastAccessTime.dwHighDateTime=0x1d4d046, ftLastWriteTime.dwLowDateTime=0x49955ac0, ftLastWriteTime.dwHighDateTime=0x1d4d046, nFileSizeHigh=0x0, nFileSizeLow=0x812c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RwkWmHC6l.pps", cAlternateFileName="RWKWMH~1.PPS")) returned 0
	[0134.897] FindClose (in: hFindFile=0x7cb7d0 | out: hFindFile=0x7cb7d0) returned 1
	[0134.897] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c4f0580, ftCreationTime.dwHighDateTime=0x1d4c6e2, ftLastAccessTime.dwLowDateTime=0x803fac80, ftLastAccessTime.dwHighDateTime=0x1d4c798, ftLastWriteTime.dwLowDateTime=0x803fac80, ftLastWriteTime.dwHighDateTime=0x1d4c798, nFileSizeHigh=0x0, nFileSizeLow=0x16214, dwReserved0=0x0, dwReserved1=0x0, cFileName="_tY8c49u.pps", cAlternateFileName="")) returned 1
	[0134.897] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0134.897] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="_tY8c49u.pps") returned 1
	[0134.897] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="_tY8c49u.pps") returned 1
	[0134.897] lstrcmpiA (lpString1="", lpString2="_tY8c49u.pps") returned -1
	[0134.897] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\*.*") returned="*.*"
	[0134.897] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\"
	[0134.897] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\") returned=""
	[0134.897] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.897] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\iht5qwf\\how-to-decrypt-files.htm")) returned 0x20
	[0134.897] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\", lpString2="_tY8c49u.pps" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps"
	[0134.897] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.zip") returned 0
	[0134.897] lstrlenA (lpString="*.zip") returned 5
	[0134.897] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.rar") returned 0
	[0134.897] lstrlenA (lpString="*.rar") returned 5
	[0134.897] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.7z") returned 0
	[0134.897] lstrlenA (lpString="*.7z") returned 4
	[0134.897] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.tar") returned 0
	[0134.897] lstrlenA (lpString="*.tar") returned 5
	[0134.897] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.gzip") returned 0
	[0134.897] lstrlenA (lpString="*.gzip") returned 6
	[0134.897] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.jpg") returned 0
	[0134.897] lstrlenA (lpString="*.jpg") returned 5
	[0134.897] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.jpeg") returned 0
	[0134.897] lstrlenA (lpString="*.jpeg") returned 6
	[0134.897] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.bmp") returned 0
	[0134.897] lstrlenA (lpString="*.bmp") returned 5
	[0134.897] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.gif") returned 0
	[0134.898] lstrlenA (lpString="*.gif") returned 5
	[0134.898] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.png") returned 0
	[0134.898] lstrlenA (lpString="*.png") returned 5
	[0134.898] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.doc") returned 0
	[0134.898] lstrlenA (lpString="*.doc") returned 5
	[0134.898] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.docx") returned 0
	[0134.898] lstrlenA (lpString="*.docx") returned 6
	[0134.898] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.xls") returned 0
	[0134.898] lstrlenA (lpString="*.xls") returned 5
	[0134.898] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.xlsx") returned 0
	[0134.898] lstrlenA (lpString="*.xlsx") returned 6
	[0134.898] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.ppt") returned 0
	[0134.898] lstrlenA (lpString="*.ppt") returned 5
	[0134.898] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.pptx") returned 0
	[0134.898] lstrlenA (lpString="*.pptx") returned 6
	[0134.898] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.txt") returned 0
	[0134.898] lstrlenA (lpString="*.txt") returned 5
	[0134.898] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.pdf") returned 0
	[0134.898] lstrlenA (lpString="*.pdf") returned 5
	[0134.898] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.htm") returned 0
	[0134.898] lstrlenA (lpString="*.htm") returned 5
	[0134.898] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.html") returned 0
	[0134.898] lstrlenA (lpString="*.html") returned 6
	[0134.898] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.mdb") returned 0
	[0134.898] lstrlenA (lpString="*.mdb") returned 5
	[0134.898] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.pfx") returned 0
	[0134.898] lstrlenA (lpString="*.pfx") returned 5
	[0134.898] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.md") returned 0
	[0134.898] lstrlenA (lpString="*.md") returned 4
	[0134.899] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.lnk") returned 0
	[0134.899] lstrlenA (lpString="*.lnk") returned 5
	[0134.899] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.torrent") returned 0
	[0134.899] lstrlenA (lpString="*.torrent") returned 9
	[0134.899] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.mov") returned 0
	[0134.899] lstrlenA (lpString="*.mov") returned 5
	[0134.899] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.3gp") returned 0
	[0134.899] lstrlenA (lpString="*.3gp") returned 5
	[0134.899] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.mpeg") returned 0
	[0134.899] lstrlenA (lpString="*.mpeg") returned 6
	[0134.899] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.mpg") returned 0
	[0134.899] lstrlenA (lpString="*.mpg") returned 5
	[0134.899] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.flv") returned 0
	[0134.899] lstrlenA (lpString="*.flv") returned 5
	[0134.899] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.avi") returned 0
	[0134.899] lstrlenA (lpString="*.avi") returned 5
	[0134.899] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.mp4") returned 0
	[0134.899] lstrlenA (lpString="*.mp4") returned 5
	[0134.899] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.wmv") returned 0
	[0134.899] lstrlenA (lpString="*.wmv") returned 5
	[0134.899] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.mkv") returned 0
	[0134.899] lstrlenA (lpString="*.mkv") returned 5
	[0134.899] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.mp3") returned 0
	[0134.899] lstrlenA (lpString="*.mp3") returned 5
	[0134.899] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.wav") returned 0
	[0134.899] lstrlenA (lpString="*.wav") returned 5
	[0134.899] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.flac") returned 0
	[0134.899] lstrlenA (lpString="*.flac") returned 6
	[0134.899] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.wma") returned 0
	[0134.899] lstrlenA (lpString="*.wma") returned 5
	[0134.899] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.au3") returned 0
	[0134.899] lstrlenA (lpString="*.au3") returned 5
	[0134.899] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.ahk") returned 0
	[0134.899] lstrlenA (lpString="*.ahk") returned 5
	[0134.899] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.c") returned 0
	[0134.900] lstrlenA (lpString="*.c") returned 3
	[0134.900] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.cc") returned 0
	[0134.900] lstrlenA (lpString="*.cc") returned 4
	[0134.900] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.cpp") returned 0
	[0134.900] lstrlenA (lpString="*.cpp") returned 5
	[0134.900] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.cxx") returned 0
	[0134.900] lstrlenA (lpString="*.cxx") returned 5
	[0134.900] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.c++") returned 0
	[0134.900] lstrlenA (lpString="*.c++") returned 5
	[0134.900] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.cs") returned 0
	[0134.900] lstrlenA (lpString="*.cs") returned 4
	[0134.900] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.vb") returned 0
	[0134.900] lstrlenA (lpString="*.vb") returned 4
	[0134.900] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.bas") returned 0
	[0134.900] lstrlenA (lpString="*.bas") returned 5
	[0134.900] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.csproj") returned 0
	[0134.900] lstrlenA (lpString="*.csproj") returned 8
	[0134.900] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.vbproj") returned 0
	[0134.900] lstrlenA (lpString="*.vbproj") returned 8
	[0134.900] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.vcxproj") returned 0
	[0134.900] lstrlenA (lpString="*.vcxproj") returned 9
	[0134.900] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.manifest") returned 0
	[0134.900] lstrlenA (lpString="*.manifest") returned 10
	[0134.900] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.php") returned 0
	[0134.900] lstrlenA (lpString="*.php") returned 5
	[0134.900] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.vbe") returned 0
	[0134.900] lstrlenA (lpString="*.vbe") returned 5
	[0134.900] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.vba") returned 0
	[0134.900] lstrlenA (lpString="*.vba") returned 5
	[0134.900] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.vbs") returned 0
	[0134.900] lstrlenA (lpString="*.vbs") returned 5
	[0134.900] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.bat") returned 0
	[0134.900] lstrlenA (lpString="*.bat") returned 5
	[0134.900] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.cmd") returned 0
	[0134.900] lstrlenA (lpString="*.cmd") returned 5
	[0134.901] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.js") returned 0
	[0134.901] lstrlenA (lpString="*.js") returned 4
	[0134.901] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.jscript") returned 0
	[0134.901] lstrlenA (lpString="*.jscript") returned 9
	[0134.901] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.hta") returned 0
	[0134.901] lstrlenA (lpString="*.hta") returned 5
	[0134.901] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.php7") returned 0
	[0134.901] lstrlenA (lpString="*.php7") returned 6
	[0134.901] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.db") returned 0
	[0134.901] lstrlenA (lpString="*.db") returned 4
	[0134.901] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.swf") returned 0
	[0134.901] lstrlenA (lpString="*.swf") returned 5
	[0134.901] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.eml") returned 0
	[0134.901] lstrlenA (lpString="*.eml") returned 5
	[0134.901] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.part") returned 0
	[0134.901] lstrlenA (lpString="*.part") returned 6
	[0134.901] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.nfo") returned 0
	[0134.901] lstrlenA (lpString="*.nfo") returned 5
	[0134.901] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.rsa") returned 0
	[0134.901] lstrlenA (lpString="*.rsa") returned 5
	[0134.901] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.key") returned 0
	[0134.901] lstrlenA (lpString="*.key") returned 5
	[0134.901] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.aes") returned 0
	[0134.901] lstrlenA (lpString="*.aes") returned 5
	[0134.901] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.blob") returned 0
	[0134.901] lstrlenA (lpString="*.blob") returned 6
	[0134.901] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.btc") returned 0
	[0134.901] lstrlenA (lpString="*.btc") returned 5
	[0134.901] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\Iht5qWf\\_tY8c49u.pps", pszSpec="*.wallet") returned 0
	[0134.901] lstrlenA (lpString="*.wallet") returned 8
	[0134.901] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c4f0580, ftCreationTime.dwHighDateTime=0x1d4c6e2, ftLastAccessTime.dwLowDateTime=0x803fac80, ftLastAccessTime.dwHighDateTime=0x1d4c798, ftLastWriteTime.dwLowDateTime=0x803fac80, ftLastWriteTime.dwHighDateTime=0x1d4c798, nFileSizeHigh=0x0, nFileSizeLow=0x16214, dwReserved0=0x0, dwReserved1=0x0, cFileName="_tY8c49u.pps", cAlternateFileName="")) returned 0
	[0134.901] FindClose (in: hFindFile=0x7cb910 | out: hFindFile=0x7cb910) returned 1
	[0134.901] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6b88680, ftCreationTime.dwHighDateTime=0x1d4cad5, ftLastAccessTime.dwLowDateTime=0x58b30ac0, ftLastAccessTime.dwHighDateTime=0x1d4cd30, ftLastWriteTime.dwLowDateTime=0x58b30ac0, ftLastWriteTime.dwHighDateTime=0x1d4cd30, nFileSizeHigh=0x0, nFileSizeLow=0x27ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="rN VyFHY B.pptx", cAlternateFileName="RNVYFH~1.PPT")) returned 1
	[0134.902] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0134.902] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="rN VyFHY B.pptx") returned -1
	[0134.902] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="rN VyFHY B.pptx") returned -1
	[0134.902] lstrcmpiA (lpString1="", lpString2="rN VyFHY B.pptx") returned -1
	[0134.902] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\*.*") returned="*.*"
	[0134.902] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\"
	[0134.902] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\") returned=""
	[0134.902] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.902] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\how-to-decrypt-files.htm")) returned 0x20
	[0134.902] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\", lpString2="rN VyFHY B.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\rN VyFHY B.pptx") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\rN VyFHY B.pptx"
	[0134.902] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\rN VyFHY B.pptx", pszSpec="*.zip") returned 0
	[0134.902] lstrlenA (lpString="*.zip") returned 5
	[0134.902] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\rN VyFHY B.pptx", pszSpec="*.rar") returned 0
	[0134.902] lstrlenA (lpString="*.rar") returned 5
	[0134.902] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\rN VyFHY B.pptx", pszSpec="*.7z") returned 0
	[0134.902] lstrlenA (lpString="*.7z") returned 4
	[0134.902] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\rN VyFHY B.pptx", pszSpec="*.tar") returned 0
	[0134.902] lstrlenA (lpString="*.tar") returned 5
	[0134.902] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\rN VyFHY B.pptx", pszSpec="*.gzip") returned 0
	[0134.902] lstrlenA (lpString="*.gzip") returned 6
	[0134.902] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\rN VyFHY B.pptx", pszSpec="*.jpg") returned 0
	[0134.902] lstrlenA (lpString="*.jpg") returned 5
	[0134.902] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\rN VyFHY B.pptx", pszSpec="*.jpeg") returned 0
	[0134.902] lstrlenA (lpString="*.jpeg") returned 6
	[0134.902] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\rN VyFHY B.pptx", pszSpec="*.bmp") returned 0
	[0134.902] lstrlenA (lpString="*.bmp") returned 5
	[0134.902] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\rN VyFHY B.pptx", pszSpec="*.gif") returned 0
	[0134.902] lstrlenA (lpString="*.gif") returned 5
	[0134.902] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\rN VyFHY B.pptx", pszSpec="*.png") returned 0
	[0134.902] lstrlenA (lpString="*.png") returned 5
	[0134.902] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\rN VyFHY B.pptx", pszSpec="*.doc") returned 0
	[0134.902] lstrlenA (lpString="*.doc") returned 5
	[0134.903] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\rN VyFHY B.pptx", pszSpec="*.docx") returned 0
	[0134.903] lstrlenA (lpString="*.docx") returned 6
	[0134.903] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\rN VyFHY B.pptx", pszSpec="*.xls") returned 0
	[0134.903] lstrlenA (lpString="*.xls") returned 5
	[0134.903] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\rN VyFHY B.pptx", pszSpec="*.xlsx") returned 0
	[0134.903] lstrlenA (lpString="*.xlsx") returned 6
	[0134.903] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\rN VyFHY B.pptx", pszSpec="*.ppt") returned 0
	[0134.903] lstrlenA (lpString="*.ppt") returned 5
	[0134.903] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\rN VyFHY B.pptx", pszSpec="*.pptx") returned 1
	[0134.903] lstrlenA (lpString="*.pptx") returned 6
	[0134.903] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\rN VyFHY B.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\rN VyFHY B.pptx") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\rN VyFHY B.pptx"
	[0134.903] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\rN VyFHY B.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\rN VyFHY B.pptx") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\rN VyFHY B.pptx"
	[0134.903] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\rN VyFHY B.pptx", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\rN VyFHY B.pptx.") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\rN VyFHY B.pptx."
	[0134.903] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\rN VyFHY B.pptx.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\rN VyFHY B.pptx.exe") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\rN VyFHY B.pptx.exe"
	[0134.903] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\rN VyFHY B.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\rn vyfhy b.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0134.903] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x27ba
	[0134.903] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf6b88680, dwHighDateTime=0x1d4cad5), lpLastAccessTime=0x407536*(dwLowDateTime=0x58b30ac0, dwHighDateTime=0x1d4cd30), lpLastWriteTime=0x40753e*(dwLowDateTime=0x58b30ac0, dwHighDateTime=0x1d4cd30)) returned 1
	[0134.903] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.904] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x2778, lpOverlapped=0x0) returned 1
	[0134.904] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\rN VyFHY B.pptx") returned="rN VyFHY B.pptx"
	[0134.904] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.904] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x2778, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x2778, lpOverlapped=0x0) returned 1
	[0134.905] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.905] CloseHandle (hObject=0x210) returned 1
	[0134.905] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\rN VyFHY B.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\rn vyfhy b.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\rN VyFHY B.pptx.exe" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\rn vyfhy b.pptx.exe")) returned 1
	[0134.905] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabf56e80, ftCreationTime.dwHighDateTime=0x1d4d267, ftLastAccessTime.dwLowDateTime=0x9e7ff570, ftLastAccessTime.dwHighDateTime=0x1d4cba7, ftLastWriteTime.dwLowDateTime=0x9e7ff570, ftLastWriteTime.dwHighDateTime=0x1d4cba7, nFileSizeHigh=0x0, nFileSizeLow=0x60b2, dwReserved0=0x0, dwReserved1=0x1, cFileName="tIoUtMo.pps", cAlternateFileName="")) returned 1
	[0134.905] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0134.905] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="tIoUtMo.pps") returned -1
	[0134.905] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="tIoUtMo.pps") returned -1
	[0134.905] lstrcmpiA (lpString1="", lpString2="tIoUtMo.pps") returned -1
	[0134.905] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\rN VyFHY B.pptx") returned="rN VyFHY B.pptx"
	[0134.906] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\"
	[0134.906] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\") returned=""
	[0134.906] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.906] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\vypxfmv5yhixx\\how-to-decrypt-files.htm")) returned 0x20
	[0134.906] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\", lpString2="tIoUtMo.pps" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps") returned="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps"
	[0134.906] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.zip") returned 0
	[0134.906] lstrlenA (lpString="*.zip") returned 5
	[0134.906] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.rar") returned 0
	[0134.906] lstrlenA (lpString="*.rar") returned 5
	[0134.906] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.7z") returned 0
	[0134.906] lstrlenA (lpString="*.7z") returned 4
	[0134.906] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.tar") returned 0
	[0134.906] lstrlenA (lpString="*.tar") returned 5
	[0134.906] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.gzip") returned 0
	[0134.906] lstrlenA (lpString="*.gzip") returned 6
	[0134.906] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.jpg") returned 0
	[0134.906] lstrlenA (lpString="*.jpg") returned 5
	[0134.906] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.jpeg") returned 0
	[0134.906] lstrlenA (lpString="*.jpeg") returned 6
	[0134.906] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.bmp") returned 0
	[0134.906] lstrlenA (lpString="*.bmp") returned 5
	[0134.906] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.gif") returned 0
	[0134.906] lstrlenA (lpString="*.gif") returned 5
	[0134.906] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.png") returned 0
	[0134.906] lstrlenA (lpString="*.png") returned 5
	[0134.906] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.doc") returned 0
	[0134.906] lstrlenA (lpString="*.doc") returned 5
	[0134.906] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.docx") returned 0
	[0134.906] lstrlenA (lpString="*.docx") returned 6
	[0134.906] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.xls") returned 0
	[0134.906] lstrlenA (lpString="*.xls") returned 5
	[0134.906] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.xlsx") returned 0
	[0134.907] lstrlenA (lpString="*.xlsx") returned 6
	[0134.907] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.ppt") returned 0
	[0134.907] lstrlenA (lpString="*.ppt") returned 5
	[0134.907] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.pptx") returned 0
	[0134.907] lstrlenA (lpString="*.pptx") returned 6
	[0134.907] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.txt") returned 0
	[0134.907] lstrlenA (lpString="*.txt") returned 5
	[0134.907] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.pdf") returned 0
	[0134.907] lstrlenA (lpString="*.pdf") returned 5
	[0134.907] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.htm") returned 0
	[0134.907] lstrlenA (lpString="*.htm") returned 5
	[0134.907] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.html") returned 0
	[0134.907] lstrlenA (lpString="*.html") returned 6
	[0134.907] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.mdb") returned 0
	[0134.907] lstrlenA (lpString="*.mdb") returned 5
	[0134.907] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.pfx") returned 0
	[0134.907] lstrlenA (lpString="*.pfx") returned 5
	[0134.907] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.md") returned 0
	[0134.907] lstrlenA (lpString="*.md") returned 4
	[0134.907] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.lnk") returned 0
	[0134.907] lstrlenA (lpString="*.lnk") returned 5
	[0134.907] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.torrent") returned 0
	[0134.907] lstrlenA (lpString="*.torrent") returned 9
	[0134.907] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.mov") returned 0
	[0134.907] lstrlenA (lpString="*.mov") returned 5
	[0134.907] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.3gp") returned 0
	[0134.907] lstrlenA (lpString="*.3gp") returned 5
	[0134.907] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.mpeg") returned 0
	[0134.907] lstrlenA (lpString="*.mpeg") returned 6
	[0134.907] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.mpg") returned 0
	[0134.907] lstrlenA (lpString="*.mpg") returned 5
	[0134.907] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.flv") returned 0
	[0134.907] lstrlenA (lpString="*.flv") returned 5
	[0134.907] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.avi") returned 0
	[0134.907] lstrlenA (lpString="*.avi") returned 5
	[0134.908] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.mp4") returned 0
	[0134.908] lstrlenA (lpString="*.mp4") returned 5
	[0134.908] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.wmv") returned 0
	[0134.908] lstrlenA (lpString="*.wmv") returned 5
	[0134.908] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.mkv") returned 0
	[0134.908] lstrlenA (lpString="*.mkv") returned 5
	[0134.908] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.mp3") returned 0
	[0134.908] lstrlenA (lpString="*.mp3") returned 5
	[0134.908] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.wav") returned 0
	[0134.908] lstrlenA (lpString="*.wav") returned 5
	[0134.908] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.flac") returned 0
	[0134.908] lstrlenA (lpString="*.flac") returned 6
	[0134.908] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.wma") returned 0
	[0134.908] lstrlenA (lpString="*.wma") returned 5
	[0134.908] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.au3") returned 0
	[0134.908] lstrlenA (lpString="*.au3") returned 5
	[0134.908] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.ahk") returned 0
	[0134.908] lstrlenA (lpString="*.ahk") returned 5
	[0134.908] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.c") returned 0
	[0134.908] lstrlenA (lpString="*.c") returned 3
	[0134.908] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.cc") returned 0
	[0134.908] lstrlenA (lpString="*.cc") returned 4
	[0134.908] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.cpp") returned 0
	[0134.908] lstrlenA (lpString="*.cpp") returned 5
	[0134.908] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.cxx") returned 0
	[0134.908] lstrlenA (lpString="*.cxx") returned 5
	[0134.908] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.c++") returned 0
	[0134.908] lstrlenA (lpString="*.c++") returned 5
	[0134.908] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.cs") returned 0
	[0134.908] lstrlenA (lpString="*.cs") returned 4
	[0134.908] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.vb") returned 0
	[0134.908] lstrlenA (lpString="*.vb") returned 4
	[0134.908] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.bas") returned 0
	[0134.908] lstrlenA (lpString="*.bas") returned 5
	[0134.908] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.csproj") returned 0
	[0134.909] lstrlenA (lpString="*.csproj") returned 8
	[0134.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.vbproj") returned 0
	[0134.909] lstrlenA (lpString="*.vbproj") returned 8
	[0134.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.vcxproj") returned 0
	[0134.909] lstrlenA (lpString="*.vcxproj") returned 9
	[0134.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.manifest") returned 0
	[0134.909] lstrlenA (lpString="*.manifest") returned 10
	[0134.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.php") returned 0
	[0134.909] lstrlenA (lpString="*.php") returned 5
	[0134.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.vbe") returned 0
	[0134.909] lstrlenA (lpString="*.vbe") returned 5
	[0134.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.vba") returned 0
	[0134.909] lstrlenA (lpString="*.vba") returned 5
	[0134.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.vbs") returned 0
	[0134.909] lstrlenA (lpString="*.vbs") returned 5
	[0134.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.bat") returned 0
	[0134.909] lstrlenA (lpString="*.bat") returned 5
	[0134.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.cmd") returned 0
	[0134.909] lstrlenA (lpString="*.cmd") returned 5
	[0134.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.js") returned 0
	[0134.909] lstrlenA (lpString="*.js") returned 4
	[0134.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.jscript") returned 0
	[0134.909] lstrlenA (lpString="*.jscript") returned 9
	[0134.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.hta") returned 0
	[0134.909] lstrlenA (lpString="*.hta") returned 5
	[0134.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.php7") returned 0
	[0134.909] lstrlenA (lpString="*.php7") returned 6
	[0134.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.db") returned 0
	[0134.909] lstrlenA (lpString="*.db") returned 4
	[0134.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.swf") returned 0
	[0134.909] lstrlenA (lpString="*.swf") returned 5
	[0134.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.eml") returned 0
	[0134.909] lstrlenA (lpString="*.eml") returned 5
	[0134.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.part") returned 0
	[0134.909] lstrlenA (lpString="*.part") returned 6
	[0134.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.nfo") returned 0
	[0134.910] lstrlenA (lpString="*.nfo") returned 5
	[0134.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.rsa") returned 0
	[0134.910] lstrlenA (lpString="*.rsa") returned 5
	[0134.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.key") returned 0
	[0134.910] lstrlenA (lpString="*.key") returned 5
	[0134.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.aes") returned 0
	[0134.910] lstrlenA (lpString="*.aes") returned 5
	[0134.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.blob") returned 0
	[0134.910] lstrlenA (lpString="*.blob") returned 6
	[0134.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.btc") returned 0
	[0134.910] lstrlenA (lpString="*.btc") returned 5
	[0134.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\VyPXfmV5YHIXX\\tIoUtMo.pps", pszSpec="*.wallet") returned 0
	[0134.910] lstrlenA (lpString="*.wallet") returned 8
	[0134.910] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabf56e80, ftCreationTime.dwHighDateTime=0x1d4d267, ftLastAccessTime.dwLowDateTime=0x9e7ff570, ftLastAccessTime.dwHighDateTime=0x1d4cba7, ftLastWriteTime.dwLowDateTime=0x9e7ff570, ftLastWriteTime.dwHighDateTime=0x1d4cba7, nFileSizeHigh=0x0, nFileSizeLow=0x60b2, dwReserved0=0x0, dwReserved1=0x1, cFileName="tIoUtMo.pps", cAlternateFileName="")) returned 0
	[0134.910] FindClose (in: hFindFile=0x7cbb90 | out: hFindFile=0x7cbb90) returned 1
	[0134.910] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc59287b0, ftCreationTime.dwHighDateTime=0x1d4e478, ftLastAccessTime.dwLowDateTime=0x32574070, ftLastAccessTime.dwHighDateTime=0x1d501f2, ftLastWriteTime.dwLowDateTime=0x32574070, ftLastWriteTime.dwHighDateTime=0x1d501f2, nFileSizeHigh=0x0, nFileSizeLow=0xee18, dwReserved0=0x0, dwReserved1=0x0, cFileName="x3-QX_IoX_4.xlsx", cAlternateFileName="X3-QX_~1.XLS")) returned 1
	[0134.910] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0134.910] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="x3-QX_IoX_4.xlsx") returned -1
	[0134.910] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="x3-QX_IoX_4.xlsx") returned -1
	[0134.910] lstrcmpiA (lpString1="", lpString2="x3-QX_IoX_4.xlsx") returned -1
	[0134.910] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\*.*") returned="*.*"
	[0134.910] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\"
	[0134.910] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned=""
	[0134.910] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.910] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\how-to-decrypt-files.htm")) returned 0x20
	[0134.910] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="x3-QX_IoX_4.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\x3-QX_IoX_4.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\x3-QX_IoX_4.xlsx"
	[0134.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\x3-QX_IoX_4.xlsx", pszSpec="*.zip") returned 0
	[0134.910] lstrlenA (lpString="*.zip") returned 5
	[0134.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\x3-QX_IoX_4.xlsx", pszSpec="*.rar") returned 0
	[0134.911] lstrlenA (lpString="*.rar") returned 5
	[0134.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\x3-QX_IoX_4.xlsx", pszSpec="*.7z") returned 0
	[0134.911] lstrlenA (lpString="*.7z") returned 4
	[0134.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\x3-QX_IoX_4.xlsx", pszSpec="*.tar") returned 0
	[0134.911] lstrlenA (lpString="*.tar") returned 5
	[0134.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\x3-QX_IoX_4.xlsx", pszSpec="*.gzip") returned 0
	[0134.911] lstrlenA (lpString="*.gzip") returned 6
	[0134.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\x3-QX_IoX_4.xlsx", pszSpec="*.jpg") returned 0
	[0134.911] lstrlenA (lpString="*.jpg") returned 5
	[0134.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\x3-QX_IoX_4.xlsx", pszSpec="*.jpeg") returned 0
	[0134.911] lstrlenA (lpString="*.jpeg") returned 6
	[0134.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\x3-QX_IoX_4.xlsx", pszSpec="*.bmp") returned 0
	[0134.911] lstrlenA (lpString="*.bmp") returned 5
	[0134.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\x3-QX_IoX_4.xlsx", pszSpec="*.gif") returned 0
	[0134.911] lstrlenA (lpString="*.gif") returned 5
	[0134.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\x3-QX_IoX_4.xlsx", pszSpec="*.png") returned 0
	[0134.911] lstrlenA (lpString="*.png") returned 5
	[0134.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\x3-QX_IoX_4.xlsx", pszSpec="*.doc") returned 0
	[0134.911] lstrlenA (lpString="*.doc") returned 5
	[0134.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\x3-QX_IoX_4.xlsx", pszSpec="*.docx") returned 0
	[0134.911] lstrlenA (lpString="*.docx") returned 6
	[0134.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\x3-QX_IoX_4.xlsx", pszSpec="*.xls") returned 0
	[0134.911] lstrlenA (lpString="*.xls") returned 5
	[0134.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\x3-QX_IoX_4.xlsx", pszSpec="*.xlsx") returned 1
	[0134.911] lstrlenA (lpString="*.xlsx") returned 6
	[0134.911] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Documents\\x3-QX_IoX_4.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\x3-QX_IoX_4.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\x3-QX_IoX_4.xlsx"
	[0134.911] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Documents\\x3-QX_IoX_4.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\x3-QX_IoX_4.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\x3-QX_IoX_4.xlsx"
	[0134.911] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\x3-QX_IoX_4.xlsx", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Documents\\x3-QX_IoX_4.xlsx.") returned="C:\\Users\\FD1HVy\\Documents\\x3-QX_IoX_4.xlsx."
	[0134.911] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\x3-QX_IoX_4.xlsx.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\x3-QX_IoX_4.xlsx.exe") returned="C:\\Users\\FD1HVy\\Documents\\x3-QX_IoX_4.xlsx.exe"
	[0134.911] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\x3-QX_IoX_4.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\x3-qx_iox_4.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0134.912] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xee18
	[0134.912] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc59287b0, dwHighDateTime=0x1d4e478), lpLastAccessTime=0x407536*(dwLowDateTime=0x32574070, dwHighDateTime=0x1d501f2), lpLastWriteTime=0x40753e*(dwLowDateTime=0x32574070, dwHighDateTime=0x1d501f2)) returned 1
	[0134.912] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.912] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xedd6, lpOverlapped=0x0) returned 1
	[0134.913] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\x3-QX_IoX_4.xlsx") returned="x3-QX_IoX_4.xlsx"
	[0134.913] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.913] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xedd6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xedd6, lpOverlapped=0x0) returned 1
	[0134.913] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.913] CloseHandle (hObject=0x20c) returned 1
	[0134.914] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\x3-QX_IoX_4.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\x3-qx_iox_4.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\x3-QX_IoX_4.xlsx.exe" (normalized: "c:\\users\\fd1hvy\\documents\\x3-qx_iox_4.xlsx.exe")) returned 1
	[0134.914] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745cc4d0, ftCreationTime.dwHighDateTime=0x1d51710, ftLastAccessTime.dwLowDateTime=0x247e5b80, ftLastAccessTime.dwHighDateTime=0x1d4fbff, ftLastWriteTime.dwLowDateTime=0x247e5b80, ftLastWriteTime.dwHighDateTime=0x1d4fbff, nFileSizeHigh=0x0, nFileSizeLow=0xd4f3, dwReserved0=0x15, dwReserved1=0x1, cFileName="YygbELASpDN0dp.pptx", cAlternateFileName="YYGBEL~1.PPT")) returned 1
	[0134.915] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0134.919] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="YygbELASpDN0dp.pptx") returned -1
	[0134.919] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="YygbELASpDN0dp.pptx") returned -1
	[0134.919] lstrcmpiA (lpString1="", lpString2="YygbELASpDN0dp.pptx") returned -1
	[0134.919] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\x3-QX_IoX_4.xlsx") returned="x3-QX_IoX_4.xlsx"
	[0134.919] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\"
	[0134.919] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned=""
	[0134.920] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.920] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\how-to-decrypt-files.htm")) returned 0x20
	[0134.920] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="YygbELASpDN0dp.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\YygbELASpDN0dp.pptx") returned="C:\\Users\\FD1HVy\\Documents\\YygbELASpDN0dp.pptx"
	[0134.920] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\YygbELASpDN0dp.pptx", pszSpec="*.zip") returned 0
	[0134.920] lstrlenA (lpString="*.zip") returned 5
	[0134.920] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\YygbELASpDN0dp.pptx", pszSpec="*.rar") returned 0
	[0134.920] lstrlenA (lpString="*.rar") returned 5
	[0134.920] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\YygbELASpDN0dp.pptx", pszSpec="*.7z") returned 0
	[0134.920] lstrlenA (lpString="*.7z") returned 4
	[0134.920] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\YygbELASpDN0dp.pptx", pszSpec="*.tar") returned 0
	[0134.920] lstrlenA (lpString="*.tar") returned 5
	[0134.920] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\YygbELASpDN0dp.pptx", pszSpec="*.gzip") returned 0
	[0134.920] lstrlenA (lpString="*.gzip") returned 6
	[0134.920] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\YygbELASpDN0dp.pptx", pszSpec="*.jpg") returned 0
	[0134.920] lstrlenA (lpString="*.jpg") returned 5
	[0134.920] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\YygbELASpDN0dp.pptx", pszSpec="*.jpeg") returned 0
	[0134.920] lstrlenA (lpString="*.jpeg") returned 6
	[0134.920] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\YygbELASpDN0dp.pptx", pszSpec="*.bmp") returned 0
	[0134.920] lstrlenA (lpString="*.bmp") returned 5
	[0134.920] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\YygbELASpDN0dp.pptx", pszSpec="*.gif") returned 0
	[0134.920] lstrlenA (lpString="*.gif") returned 5
	[0134.920] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\YygbELASpDN0dp.pptx", pszSpec="*.png") returned 0
	[0134.920] lstrlenA (lpString="*.png") returned 5
	[0134.920] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\YygbELASpDN0dp.pptx", pszSpec="*.doc") returned 0
	[0134.920] lstrlenA (lpString="*.doc") returned 5
	[0134.920] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\YygbELASpDN0dp.pptx", pszSpec="*.docx") returned 0
	[0134.920] lstrlenA (lpString="*.docx") returned 6
	[0134.920] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\YygbELASpDN0dp.pptx", pszSpec="*.xls") returned 0
	[0134.920] lstrlenA (lpString="*.xls") returned 5
	[0134.920] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\YygbELASpDN0dp.pptx", pszSpec="*.xlsx") returned 0
	[0134.920] lstrlenA (lpString="*.xlsx") returned 6
	[0134.920] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\YygbELASpDN0dp.pptx", pszSpec="*.ppt") returned 0
	[0134.921] lstrlenA (lpString="*.ppt") returned 5
	[0134.921] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\YygbELASpDN0dp.pptx", pszSpec="*.pptx") returned 1
	[0134.921] lstrlenA (lpString="*.pptx") returned 6
	[0134.921] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Documents\\YygbELASpDN0dp.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\YygbELASpDN0dp.pptx") returned="C:\\Users\\FD1HVy\\Documents\\YygbELASpDN0dp.pptx"
	[0134.921] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Documents\\YygbELASpDN0dp.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\YygbELASpDN0dp.pptx") returned="C:\\Users\\FD1HVy\\Documents\\YygbELASpDN0dp.pptx"
	[0134.921] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\YygbELASpDN0dp.pptx", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Documents\\YygbELASpDN0dp.pptx.") returned="C:\\Users\\FD1HVy\\Documents\\YygbELASpDN0dp.pptx."
	[0134.921] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\YygbELASpDN0dp.pptx.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\YygbELASpDN0dp.pptx.exe") returned="C:\\Users\\FD1HVy\\Documents\\YygbELASpDN0dp.pptx.exe"
	[0134.921] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\YygbELASpDN0dp.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\yygbelaspdn0dp.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0134.921] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd4f3
	[0134.921] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x745cc4d0, dwHighDateTime=0x1d51710), lpLastAccessTime=0x407536*(dwLowDateTime=0x247e5b80, dwHighDateTime=0x1d4fbff), lpLastWriteTime=0x40753e*(dwLowDateTime=0x247e5b80, dwHighDateTime=0x1d4fbff)) returned 1
	[0134.921] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.921] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xd4b1, lpOverlapped=0x0) returned 1
	[0134.922] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\YygbELASpDN0dp.pptx") returned="YygbELASpDN0dp.pptx"
	[0134.922] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.922] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xd4b1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xd4b1, lpOverlapped=0x0) returned 1
	[0134.923] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.923] CloseHandle (hObject=0x20c) returned 1
	[0134.923] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\YygbELASpDN0dp.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\yygbelaspdn0dp.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\YygbELASpDN0dp.pptx.exe" (normalized: "c:\\users\\fd1hvy\\documents\\yygbelaspdn0dp.pptx.exe")) returned 1
	[0134.923] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1bd43ad0, ftCreationTime.dwHighDateTime=0x1d4c758, ftLastAccessTime.dwLowDateTime=0x40120300, ftLastAccessTime.dwHighDateTime=0x1d4cc71, ftLastWriteTime.dwLowDateTime=0x40120300, ftLastWriteTime.dwHighDateTime=0x1d4cc71, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="ZYtNaTjD-bN8", cAlternateFileName="ZYTNAT~1")) returned 1
	[0134.923] lstrcmpA (lpString1=".", lpString2="ZYtNaTjD-bN8") returned -1
	[0134.924] lstrcmpA (lpString1="..", lpString2="ZYtNaTjD-bN8") returned -1
	[0134.924] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\YygbELASpDN0dp.pptx") returned="YygbELASpDN0dp.pptx"
	[0134.924] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="ZYtNaTjD-bN8" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8"
	[0134.924] lstrlenA (lpString="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8") returned 38
	[0134.924] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1bd43ad0, ftCreationTime.dwHighDateTime=0x1d4c758, ftLastAccessTime.dwLowDateTime=0x40120300, ftLastAccessTime.dwHighDateTime=0x1d4cc71, ftLastWriteTime.dwLowDateTime=0x40120300, ftLastWriteTime.dwHighDateTime=0x1d4cc71, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName=".", cAlternateFileName="")) returned 0x7cb650
	[0134.924] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0134.924] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1bd43ad0, ftCreationTime.dwHighDateTime=0x1d4c758, ftLastAccessTime.dwLowDateTime=0x40120300, ftLastAccessTime.dwHighDateTime=0x1d4cc71, ftLastWriteTime.dwLowDateTime=0x40120300, ftLastWriteTime.dwHighDateTime=0x1d4cc71, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="..", cAlternateFileName="")) returned 1
	[0134.924] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0134.924] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0134.924] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77ffae30, ftCreationTime.dwHighDateTime=0x1d4c879, ftLastAccessTime.dwLowDateTime=0xe381a460, ftLastAccessTime.dwHighDateTime=0x1d4c8bf, ftLastWriteTime.dwLowDateTime=0xe381a460, ftLastWriteTime.dwHighDateTime=0x1d4c8bf, nFileSizeHigh=0x0, nFileSizeLow=0xc8a7, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="8cFETdC_9V.docx", cAlternateFileName="8CFETD~1.DOC")) returned 1
	[0134.924] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0134.924] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="8cFETdC_9V.docx") returned 1
	[0134.924] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="8cFETdC_9V.docx") returned 1
	[0134.924] lstrcmpiA (lpString1="", lpString2="8cFETdC_9V.docx") returned -1
	[0134.924] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\*.*") returned="*.*"
	[0134.924] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\"
	[0134.924] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\") returned=""
	[0134.924] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.924] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\zytnatjd-bn8\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0134.924] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\zytnatjd-bn8\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0134.925] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0134.925] WriteFile (in: hFile=0x210, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0134.926] SetFileTime (hFile=0x210, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0134.926] CloseHandle (hObject=0x210) returned 1
	[0134.926] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\", lpString2="8cFETdC_9V.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\8cFETdC_9V.docx") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\8cFETdC_9V.docx"
	[0134.926] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\8cFETdC_9V.docx", pszSpec="*.zip") returned 0
	[0134.926] lstrlenA (lpString="*.zip") returned 5
	[0134.926] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\8cFETdC_9V.docx", pszSpec="*.rar") returned 0
	[0134.926] lstrlenA (lpString="*.rar") returned 5
	[0134.926] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\8cFETdC_9V.docx", pszSpec="*.7z") returned 0
	[0134.926] lstrlenA (lpString="*.7z") returned 4
	[0134.926] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\8cFETdC_9V.docx", pszSpec="*.tar") returned 0
	[0134.926] lstrlenA (lpString="*.tar") returned 5
	[0134.926] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\8cFETdC_9V.docx", pszSpec="*.gzip") returned 0
	[0134.926] lstrlenA (lpString="*.gzip") returned 6
	[0134.926] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\8cFETdC_9V.docx", pszSpec="*.jpg") returned 0
	[0134.926] lstrlenA (lpString="*.jpg") returned 5
	[0134.926] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\8cFETdC_9V.docx", pszSpec="*.jpeg") returned 0
	[0134.926] lstrlenA (lpString="*.jpeg") returned 6
	[0134.926] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\8cFETdC_9V.docx", pszSpec="*.bmp") returned 0
	[0134.926] lstrlenA (lpString="*.bmp") returned 5
	[0134.926] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\8cFETdC_9V.docx", pszSpec="*.gif") returned 0
	[0134.926] lstrlenA (lpString="*.gif") returned 5
	[0134.926] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\8cFETdC_9V.docx", pszSpec="*.png") returned 0
	[0134.926] lstrlenA (lpString="*.png") returned 5
	[0134.926] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\8cFETdC_9V.docx", pszSpec="*.doc") returned 0
	[0134.926] lstrlenA (lpString="*.doc") returned 5
	[0134.926] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\8cFETdC_9V.docx", pszSpec="*.docx") returned 1
	[0134.927] lstrlenA (lpString="*.docx") returned 6
	[0134.927] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\8cFETdC_9V.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\8cFETdC_9V.docx") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\8cFETdC_9V.docx"
	[0134.927] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\8cFETdC_9V.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\8cFETdC_9V.docx") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\8cFETdC_9V.docx"
	[0134.927] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\8cFETdC_9V.docx", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\8cFETdC_9V.docx.") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\8cFETdC_9V.docx."
	[0134.927] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\8cFETdC_9V.docx.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\8cFETdC_9V.docx.exe") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\8cFETdC_9V.docx.exe"
	[0134.927] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\8cFETdC_9V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\zytnatjd-bn8\\8cfetdc_9v.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0134.927] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc8a7
	[0134.927] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x77ffae30, dwHighDateTime=0x1d4c879), lpLastAccessTime=0x407536*(dwLowDateTime=0xe381a460, dwHighDateTime=0x1d4c8bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe381a460, dwHighDateTime=0x1d4c8bf)) returned 1
	[0134.927] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.927] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xc865, lpOverlapped=0x0) returned 1
	[0134.928] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\8cFETdC_9V.docx") returned="8cFETdC_9V.docx"
	[0134.928] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.928] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xc865, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xc865, lpOverlapped=0x0) returned 1
	[0134.929] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.929] CloseHandle (hObject=0x210) returned 1
	[0134.929] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\8cFETdC_9V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\zytnatjd-bn8\\8cfetdc_9v.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\8cFETdC_9V.docx.exe" (normalized: "c:\\users\\fd1hvy\\documents\\zytnatjd-bn8\\8cfetdc_9v.docx.exe")) returned 1
	[0134.930] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16fd9cc0, ftCreationTime.dwHighDateTime=0x1d4d39e, ftLastAccessTime.dwLowDateTime=0x5efd0c50, ftLastAccessTime.dwHighDateTime=0x1d4c8a8, ftLastWriteTime.dwLowDateTime=0x5efd0c50, ftLastWriteTime.dwHighDateTime=0x1d4c8a8, nFileSizeHigh=0x0, nFileSizeLow=0x7f41, dwReserved0=0x0, dwReserved1=0x1, cFileName="n6ckkX7d.pptx", cAlternateFileName="N6CKKX~1.PPT")) returned 1
	[0134.930] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0134.930] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="n6ckkX7d.pptx") returned -1
	[0134.930] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="n6ckkX7d.pptx") returned -1
	[0134.930] lstrcmpiA (lpString1="", lpString2="n6ckkX7d.pptx") returned -1
	[0134.930] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\8cFETdC_9V.docx") returned="8cFETdC_9V.docx"
	[0134.930] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\"
	[0134.930] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\") returned=""
	[0134.930] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.930] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\zytnatjd-bn8\\how-to-decrypt-files.htm")) returned 0x20
	[0134.930] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\", lpString2="n6ckkX7d.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\n6ckkX7d.pptx") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\n6ckkX7d.pptx"
	[0134.930] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\n6ckkX7d.pptx", pszSpec="*.zip") returned 0
	[0134.930] lstrlenA (lpString="*.zip") returned 5
	[0134.930] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\n6ckkX7d.pptx", pszSpec="*.rar") returned 0
	[0134.930] lstrlenA (lpString="*.rar") returned 5
	[0134.930] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\n6ckkX7d.pptx", pszSpec="*.7z") returned 0
	[0134.930] lstrlenA (lpString="*.7z") returned 4
	[0134.930] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\n6ckkX7d.pptx", pszSpec="*.tar") returned 0
	[0134.930] lstrlenA (lpString="*.tar") returned 5
	[0134.930] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\n6ckkX7d.pptx", pszSpec="*.gzip") returned 0
	[0134.930] lstrlenA (lpString="*.gzip") returned 6
	[0134.930] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\n6ckkX7d.pptx", pszSpec="*.jpg") returned 0
	[0134.930] lstrlenA (lpString="*.jpg") returned 5
	[0134.930] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\n6ckkX7d.pptx", pszSpec="*.jpeg") returned 0
	[0134.931] lstrlenA (lpString="*.jpeg") returned 6
	[0134.931] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\n6ckkX7d.pptx", pszSpec="*.bmp") returned 0
	[0134.931] lstrlenA (lpString="*.bmp") returned 5
	[0134.931] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\n6ckkX7d.pptx", pszSpec="*.gif") returned 0
	[0134.931] lstrlenA (lpString="*.gif") returned 5
	[0134.931] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\n6ckkX7d.pptx", pszSpec="*.png") returned 0
	[0134.931] lstrlenA (lpString="*.png") returned 5
	[0134.931] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\n6ckkX7d.pptx", pszSpec="*.doc") returned 0
	[0134.931] lstrlenA (lpString="*.doc") returned 5
	[0134.931] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\n6ckkX7d.pptx", pszSpec="*.docx") returned 0
	[0134.931] lstrlenA (lpString="*.docx") returned 6
	[0134.931] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\n6ckkX7d.pptx", pszSpec="*.xls") returned 0
	[0134.931] lstrlenA (lpString="*.xls") returned 5
	[0134.931] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\n6ckkX7d.pptx", pszSpec="*.xlsx") returned 0
	[0134.931] lstrlenA (lpString="*.xlsx") returned 6
	[0134.931] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\n6ckkX7d.pptx", pszSpec="*.ppt") returned 0
	[0134.931] lstrlenA (lpString="*.ppt") returned 5
	[0134.931] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\n6ckkX7d.pptx", pszSpec="*.pptx") returned 1
	[0134.931] lstrlenA (lpString="*.pptx") returned 6
	[0134.931] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\n6ckkX7d.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\n6ckkX7d.pptx") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\n6ckkX7d.pptx"
	[0134.931] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\n6ckkX7d.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\n6ckkX7d.pptx") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\n6ckkX7d.pptx"
	[0134.931] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\n6ckkX7d.pptx", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\n6ckkX7d.pptx.") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\n6ckkX7d.pptx."
	[0134.931] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\n6ckkX7d.pptx.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\n6ckkX7d.pptx.exe") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\n6ckkX7d.pptx.exe"
	[0134.931] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\n6ckkX7d.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\zytnatjd-bn8\\n6ckkx7d.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0134.931] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7f41
	[0134.932] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x16fd9cc0, dwHighDateTime=0x1d4d39e), lpLastAccessTime=0x407536*(dwLowDateTime=0x5efd0c50, dwHighDateTime=0x1d4c8a8), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5efd0c50, dwHighDateTime=0x1d4c8a8)) returned 1
	[0134.932] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.932] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7eff, lpOverlapped=0x0) returned 1
	[0134.932] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\n6ckkX7d.pptx") returned="n6ckkX7d.pptx"
	[0134.933] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.933] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7eff, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7eff, lpOverlapped=0x0) returned 1
	[0134.933] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.933] CloseHandle (hObject=0x210) returned 1
	[0134.933] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\n6ckkX7d.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\zytnatjd-bn8\\n6ckkx7d.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\n6ckkX7d.pptx.exe" (normalized: "c:\\users\\fd1hvy\\documents\\zytnatjd-bn8\\n6ckkx7d.pptx.exe")) returned 1
	[0134.934] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30646820, ftCreationTime.dwHighDateTime=0x1d4d3f2, ftLastAccessTime.dwLowDateTime=0xecd214f0, ftLastAccessTime.dwHighDateTime=0x1d4cd47, ftLastWriteTime.dwLowDateTime=0xecd214f0, ftLastWriteTime.dwHighDateTime=0x1d4cd47, nFileSizeHigh=0x0, nFileSizeLow=0x89de, dwReserved0=0x1c, dwReserved1=0x1, cFileName="Nj7J.pps", cAlternateFileName="")) returned 1
	[0134.934] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0134.934] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Nj7J.pps") returned -1
	[0134.934] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Nj7J.pps") returned -1
	[0134.934] lstrcmpiA (lpString1="", lpString2="Nj7J.pps") returned -1
	[0134.934] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\n6ckkX7d.pptx") returned="n6ckkX7d.pptx"
	[0134.934] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\"
	[0134.934] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\") returned=""
	[0134.934] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.934] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\zytnatjd-bn8\\how-to-decrypt-files.htm")) returned 0x20
	[0134.934] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\", lpString2="Nj7J.pps" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps"
	[0134.934] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.zip") returned 0
	[0134.934] lstrlenA (lpString="*.zip") returned 5
	[0134.934] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.rar") returned 0
	[0134.934] lstrlenA (lpString="*.rar") returned 5
	[0134.934] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.7z") returned 0
	[0134.934] lstrlenA (lpString="*.7z") returned 4
	[0134.934] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.tar") returned 0
	[0134.934] lstrlenA (lpString="*.tar") returned 5
	[0134.934] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.gzip") returned 0
	[0134.934] lstrlenA (lpString="*.gzip") returned 6
	[0134.934] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.jpg") returned 0
	[0134.934] lstrlenA (lpString="*.jpg") returned 5
	[0134.934] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.jpeg") returned 0
	[0134.934] lstrlenA (lpString="*.jpeg") returned 6
	[0134.934] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.bmp") returned 0
	[0134.935] lstrlenA (lpString="*.bmp") returned 5
	[0134.935] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.gif") returned 0
	[0134.935] lstrlenA (lpString="*.gif") returned 5
	[0134.935] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.png") returned 0
	[0134.935] lstrlenA (lpString="*.png") returned 5
	[0134.935] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.doc") returned 0
	[0134.935] lstrlenA (lpString="*.doc") returned 5
	[0134.935] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.docx") returned 0
	[0134.935] lstrlenA (lpString="*.docx") returned 6
	[0134.935] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.xls") returned 0
	[0134.935] lstrlenA (lpString="*.xls") returned 5
	[0134.935] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.xlsx") returned 0
	[0134.935] lstrlenA (lpString="*.xlsx") returned 6
	[0134.935] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.ppt") returned 0
	[0134.935] lstrlenA (lpString="*.ppt") returned 5
	[0134.935] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.pptx") returned 0
	[0134.935] lstrlenA (lpString="*.pptx") returned 6
	[0134.935] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.txt") returned 0
	[0134.935] lstrlenA (lpString="*.txt") returned 5
	[0134.935] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.pdf") returned 0
	[0134.935] lstrlenA (lpString="*.pdf") returned 5
	[0134.935] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.htm") returned 0
	[0134.935] lstrlenA (lpString="*.htm") returned 5
	[0134.935] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.html") returned 0
	[0134.935] lstrlenA (lpString="*.html") returned 6
	[0134.935] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.mdb") returned 0
	[0134.935] lstrlenA (lpString="*.mdb") returned 5
	[0134.935] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.pfx") returned 0
	[0134.935] lstrlenA (lpString="*.pfx") returned 5
	[0134.935] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.md") returned 0
	[0134.935] lstrlenA (lpString="*.md") returned 4
	[0134.935] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.lnk") returned 0
	[0134.935] lstrlenA (lpString="*.lnk") returned 5
	[0134.935] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.torrent") returned 0
	[0134.936] lstrlenA (lpString="*.torrent") returned 9
	[0134.936] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.mov") returned 0
	[0134.936] lstrlenA (lpString="*.mov") returned 5
	[0134.936] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.3gp") returned 0
	[0134.936] lstrlenA (lpString="*.3gp") returned 5
	[0134.936] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.mpeg") returned 0
	[0134.936] lstrlenA (lpString="*.mpeg") returned 6
	[0134.936] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.mpg") returned 0
	[0134.936] lstrlenA (lpString="*.mpg") returned 5
	[0134.936] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.flv") returned 0
	[0134.936] lstrlenA (lpString="*.flv") returned 5
	[0134.936] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.avi") returned 0
	[0134.936] lstrlenA (lpString="*.avi") returned 5
	[0134.936] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.mp4") returned 0
	[0134.936] lstrlenA (lpString="*.mp4") returned 5
	[0134.936] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.wmv") returned 0
	[0134.936] lstrlenA (lpString="*.wmv") returned 5
	[0134.936] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.mkv") returned 0
	[0134.936] lstrlenA (lpString="*.mkv") returned 5
	[0134.936] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.mp3") returned 0
	[0134.936] lstrlenA (lpString="*.mp3") returned 5
	[0134.936] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.wav") returned 0
	[0134.936] lstrlenA (lpString="*.wav") returned 5
	[0134.936] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.flac") returned 0
	[0134.936] lstrlenA (lpString="*.flac") returned 6
	[0134.936] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.wma") returned 0
	[0134.936] lstrlenA (lpString="*.wma") returned 5
	[0134.936] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.au3") returned 0
	[0134.936] lstrlenA (lpString="*.au3") returned 5
	[0134.936] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.ahk") returned 0
	[0134.936] lstrlenA (lpString="*.ahk") returned 5
	[0134.936] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.c") returned 0
	[0134.936] lstrlenA (lpString="*.c") returned 3
	[0134.936] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.cc") returned 0
	[0134.936] lstrlenA (lpString="*.cc") returned 4
	[0134.936] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.cpp") returned 0
	[0134.937] lstrlenA (lpString="*.cpp") returned 5
	[0134.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.cxx") returned 0
	[0134.937] lstrlenA (lpString="*.cxx") returned 5
	[0134.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.c++") returned 0
	[0134.937] lstrlenA (lpString="*.c++") returned 5
	[0134.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.cs") returned 0
	[0134.937] lstrlenA (lpString="*.cs") returned 4
	[0134.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.vb") returned 0
	[0134.937] lstrlenA (lpString="*.vb") returned 4
	[0134.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.bas") returned 0
	[0134.937] lstrlenA (lpString="*.bas") returned 5
	[0134.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.csproj") returned 0
	[0134.937] lstrlenA (lpString="*.csproj") returned 8
	[0134.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.vbproj") returned 0
	[0134.937] lstrlenA (lpString="*.vbproj") returned 8
	[0134.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.vcxproj") returned 0
	[0134.937] lstrlenA (lpString="*.vcxproj") returned 9
	[0134.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.manifest") returned 0
	[0134.937] lstrlenA (lpString="*.manifest") returned 10
	[0134.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.php") returned 0
	[0134.937] lstrlenA (lpString="*.php") returned 5
	[0134.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.vbe") returned 0
	[0134.937] lstrlenA (lpString="*.vbe") returned 5
	[0134.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.vba") returned 0
	[0134.937] lstrlenA (lpString="*.vba") returned 5
	[0134.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.vbs") returned 0
	[0134.937] lstrlenA (lpString="*.vbs") returned 5
	[0134.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.bat") returned 0
	[0134.937] lstrlenA (lpString="*.bat") returned 5
	[0134.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.cmd") returned 0
	[0134.937] lstrlenA (lpString="*.cmd") returned 5
	[0134.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.js") returned 0
	[0134.937] lstrlenA (lpString="*.js") returned 4
	[0134.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.jscript") returned 0
	[0134.937] lstrlenA (lpString="*.jscript") returned 9
	[0134.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.hta") returned 0
	[0134.938] lstrlenA (lpString="*.hta") returned 5
	[0134.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.php7") returned 0
	[0134.938] lstrlenA (lpString="*.php7") returned 6
	[0134.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.db") returned 0
	[0134.938] lstrlenA (lpString="*.db") returned 4
	[0134.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.swf") returned 0
	[0134.938] lstrlenA (lpString="*.swf") returned 5
	[0134.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.eml") returned 0
	[0134.938] lstrlenA (lpString="*.eml") returned 5
	[0134.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.part") returned 0
	[0134.938] lstrlenA (lpString="*.part") returned 6
	[0134.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.nfo") returned 0
	[0134.938] lstrlenA (lpString="*.nfo") returned 5
	[0134.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.rsa") returned 0
	[0134.938] lstrlenA (lpString="*.rsa") returned 5
	[0134.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.key") returned 0
	[0134.938] lstrlenA (lpString="*.key") returned 5
	[0134.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.aes") returned 0
	[0134.938] lstrlenA (lpString="*.aes") returned 5
	[0134.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.blob") returned 0
	[0134.938] lstrlenA (lpString="*.blob") returned 6
	[0134.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.btc") returned 0
	[0134.938] lstrlenA (lpString="*.btc") returned 5
	[0134.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps", pszSpec="*.wallet") returned 0
	[0134.938] lstrlenA (lpString="*.wallet") returned 8
	[0134.938] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x241e4240, ftCreationTime.dwHighDateTime=0x1d4c6da, ftLastAccessTime.dwLowDateTime=0xf9614510, ftLastAccessTime.dwHighDateTime=0x1d4c874, ftLastWriteTime.dwLowDateTime=0xf9614510, ftLastWriteTime.dwHighDateTime=0x1d4c874, nFileSizeHigh=0x0, nFileSizeLow=0x127fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="nkeITn.xls", cAlternateFileName="")) returned 1
	[0134.938] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0134.938] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="nkeITn.xls") returned -1
	[0134.938] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="nkeITn.xls") returned -1
	[0134.938] lstrcmpiA (lpString1="", lpString2="nkeITn.xls") returned -1
	[0134.938] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\Nj7J.pps") returned="Nj7J.pps"
	[0134.938] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\"
	[0134.938] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\") returned=""
	[0134.938] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.939] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\zytnatjd-bn8\\how-to-decrypt-files.htm")) returned 0x20
	[0134.939] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\", lpString2="nkeITn.xls" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\nkeITn.xls") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\nkeITn.xls"
	[0134.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\nkeITn.xls", pszSpec="*.zip") returned 0
	[0134.939] lstrlenA (lpString="*.zip") returned 5
	[0134.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\nkeITn.xls", pszSpec="*.rar") returned 0
	[0134.939] lstrlenA (lpString="*.rar") returned 5
	[0134.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\nkeITn.xls", pszSpec="*.7z") returned 0
	[0134.939] lstrlenA (lpString="*.7z") returned 4
	[0134.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\nkeITn.xls", pszSpec="*.tar") returned 0
	[0134.939] lstrlenA (lpString="*.tar") returned 5
	[0134.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\nkeITn.xls", pszSpec="*.gzip") returned 0
	[0134.939] lstrlenA (lpString="*.gzip") returned 6
	[0134.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\nkeITn.xls", pszSpec="*.jpg") returned 0
	[0134.939] lstrlenA (lpString="*.jpg") returned 5
	[0134.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\nkeITn.xls", pszSpec="*.jpeg") returned 0
	[0134.939] lstrlenA (lpString="*.jpeg") returned 6
	[0134.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\nkeITn.xls", pszSpec="*.bmp") returned 0
	[0134.939] lstrlenA (lpString="*.bmp") returned 5
	[0134.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\nkeITn.xls", pszSpec="*.gif") returned 0
	[0134.939] lstrlenA (lpString="*.gif") returned 5
	[0134.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\nkeITn.xls", pszSpec="*.png") returned 0
	[0134.939] lstrlenA (lpString="*.png") returned 5
	[0134.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\nkeITn.xls", pszSpec="*.doc") returned 0
	[0134.939] lstrlenA (lpString="*.doc") returned 5
	[0134.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\nkeITn.xls", pszSpec="*.docx") returned 0
	[0134.939] lstrlenA (lpString="*.docx") returned 6
	[0134.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\nkeITn.xls", pszSpec="*.xls") returned 1
	[0134.939] lstrlenA (lpString="*.xls") returned 5
	[0134.939] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\nkeITn.xls" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\nkeITn.xls") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\nkeITn.xls"
	[0134.939] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\nkeITn.xls" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\nkeITn.xls") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\nkeITn.xls"
	[0134.939] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\nkeITn.xls", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\nkeITn.xls.") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\nkeITn.xls."
	[0134.939] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\nkeITn.xls.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\nkeITn.xls.exe") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\nkeITn.xls.exe"
	[0134.940] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\nkeITn.xls" (normalized: "c:\\users\\fd1hvy\\documents\\zytnatjd-bn8\\nkeitn.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0134.940] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x127fa
	[0134.940] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x241e4240, dwHighDateTime=0x1d4c6da), lpLastAccessTime=0x407536*(dwLowDateTime=0xf9614510, dwHighDateTime=0x1d4c874), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf9614510, dwHighDateTime=0x1d4c874)) returned 1
	[0134.940] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.940] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x127b8, lpOverlapped=0x0) returned 1
	[0134.941] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\nkeITn.xls") returned="nkeITn.xls"
	[0134.941] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.941] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x127b8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x127b8, lpOverlapped=0x0) returned 1
	[0134.942] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.942] CloseHandle (hObject=0x210) returned 1
	[0134.942] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\nkeITn.xls" (normalized: "c:\\users\\fd1hvy\\documents\\zytnatjd-bn8\\nkeitn.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\nkeITn.xls.exe" (normalized: "c:\\users\\fd1hvy\\documents\\zytnatjd-bn8\\nkeitn.xls.exe")) returned 1
	[0134.942] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad84f00, ftCreationTime.dwHighDateTime=0x1d4d50f, ftLastAccessTime.dwLowDateTime=0xf9f6a930, ftLastAccessTime.dwHighDateTime=0x1d4d557, ftLastWriteTime.dwLowDateTime=0xf9f6a930, ftLastWriteTime.dwHighDateTime=0x1d4d557, nFileSizeHigh=0x0, nFileSizeLow=0x9ea9, dwReserved0=0x1f, dwReserved1=0x1, cFileName="V-aPrqMkIyoz77F2xkD.docx", cAlternateFileName="V-APRQ~1.DOC")) returned 1
	[0134.942] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0134.942] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="V-aPrqMkIyoz77F2xkD.docx") returned -1
	[0134.942] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="V-aPrqMkIyoz77F2xkD.docx") returned -1
	[0134.942] lstrcmpiA (lpString1="", lpString2="V-aPrqMkIyoz77F2xkD.docx") returned -1
	[0134.943] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\nkeITn.xls") returned="nkeITn.xls"
	[0134.943] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\"
	[0134.943] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\") returned=""
	[0134.943] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.943] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\zytnatjd-bn8\\how-to-decrypt-files.htm")) returned 0x20
	[0134.943] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\", lpString2="V-aPrqMkIyoz77F2xkD.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\V-aPrqMkIyoz77F2xkD.docx") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\V-aPrqMkIyoz77F2xkD.docx"
	[0134.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\V-aPrqMkIyoz77F2xkD.docx", pszSpec="*.zip") returned 0
	[0134.943] lstrlenA (lpString="*.zip") returned 5
	[0134.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\V-aPrqMkIyoz77F2xkD.docx", pszSpec="*.rar") returned 0
	[0134.943] lstrlenA (lpString="*.rar") returned 5
	[0134.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\V-aPrqMkIyoz77F2xkD.docx", pszSpec="*.7z") returned 0
	[0134.943] lstrlenA (lpString="*.7z") returned 4
	[0134.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\V-aPrqMkIyoz77F2xkD.docx", pszSpec="*.tar") returned 0
	[0134.943] lstrlenA (lpString="*.tar") returned 5
	[0134.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\V-aPrqMkIyoz77F2xkD.docx", pszSpec="*.gzip") returned 0
	[0134.943] lstrlenA (lpString="*.gzip") returned 6
	[0134.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\V-aPrqMkIyoz77F2xkD.docx", pszSpec="*.jpg") returned 0
	[0134.943] lstrlenA (lpString="*.jpg") returned 5
	[0134.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\V-aPrqMkIyoz77F2xkD.docx", pszSpec="*.jpeg") returned 0
	[0134.943] lstrlenA (lpString="*.jpeg") returned 6
	[0134.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\V-aPrqMkIyoz77F2xkD.docx", pszSpec="*.bmp") returned 0
	[0134.943] lstrlenA (lpString="*.bmp") returned 5
	[0134.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\V-aPrqMkIyoz77F2xkD.docx", pszSpec="*.gif") returned 0
	[0134.943] lstrlenA (lpString="*.gif") returned 5
	[0134.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\V-aPrqMkIyoz77F2xkD.docx", pszSpec="*.png") returned 0
	[0134.943] lstrlenA (lpString="*.png") returned 5
	[0134.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\V-aPrqMkIyoz77F2xkD.docx", pszSpec="*.doc") returned 0
	[0134.943] lstrlenA (lpString="*.doc") returned 5
	[0134.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\V-aPrqMkIyoz77F2xkD.docx", pszSpec="*.docx") returned 1
	[0134.943] lstrlenA (lpString="*.docx") returned 6
	[0134.943] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\V-aPrqMkIyoz77F2xkD.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\V-aPrqMkIyoz77F2xkD.docx") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\V-aPrqMkIyoz77F2xkD.docx"
	[0134.943] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\V-aPrqMkIyoz77F2xkD.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\V-aPrqMkIyoz77F2xkD.docx") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\V-aPrqMkIyoz77F2xkD.docx"
	[0134.944] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\V-aPrqMkIyoz77F2xkD.docx", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\V-aPrqMkIyoz77F2xkD.docx.") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\V-aPrqMkIyoz77F2xkD.docx."
	[0134.944] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\V-aPrqMkIyoz77F2xkD.docx.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\V-aPrqMkIyoz77F2xkD.docx.exe") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\V-aPrqMkIyoz77F2xkD.docx.exe"
	[0134.944] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\V-aPrqMkIyoz77F2xkD.docx" (normalized: "c:\\users\\fd1hvy\\documents\\zytnatjd-bn8\\v-aprqmkiyoz77f2xkd.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0134.944] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9ea9
	[0134.944] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9ad84f00, dwHighDateTime=0x1d4d50f), lpLastAccessTime=0x407536*(dwLowDateTime=0xf9f6a930, dwHighDateTime=0x1d4d557), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf9f6a930, dwHighDateTime=0x1d4d557)) returned 1
	[0134.944] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.944] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x9e67, lpOverlapped=0x0) returned 1
	[0134.959] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\V-aPrqMkIyoz77F2xkD.docx") returned="V-aPrqMkIyoz77F2xkD.docx"
	[0134.960] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.960] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x9e67, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x9e67, lpOverlapped=0x0) returned 1
	[0134.960] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.960] CloseHandle (hObject=0x210) returned 1
	[0134.960] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\V-aPrqMkIyoz77F2xkD.docx" (normalized: "c:\\users\\fd1hvy\\documents\\zytnatjd-bn8\\v-aprqmkiyoz77f2xkd.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\V-aPrqMkIyoz77F2xkD.docx.exe" (normalized: "c:\\users\\fd1hvy\\documents\\zytnatjd-bn8\\v-aprqmkiyoz77f2xkd.docx.exe")) returned 1
	[0134.961] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8064790, ftCreationTime.dwHighDateTime=0x1d4cec5, ftLastAccessTime.dwLowDateTime=0x20c16630, ftLastAccessTime.dwHighDateTime=0x1d4d09f, ftLastWriteTime.dwLowDateTime=0x20c16630, ftLastWriteTime.dwHighDateTime=0x1d4d09f, nFileSizeHigh=0x0, nFileSizeLow=0x2d00, dwReserved0=0x0, dwReserved1=0x1, cFileName="_jpsD99xC_UAFHN7v.xlsx", cAlternateFileName="_JPSD9~1.XLS")) returned 1
	[0134.961] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0134.961] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="_jpsD99xC_UAFHN7v.xlsx") returned 1
	[0134.961] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="_jpsD99xC_UAFHN7v.xlsx") returned 1
	[0134.961] lstrcmpiA (lpString1="", lpString2="_jpsD99xC_UAFHN7v.xlsx") returned -1
	[0134.961] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\V-aPrqMkIyoz77F2xkD.docx") returned="V-aPrqMkIyoz77F2xkD.docx"
	[0134.961] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\"
	[0134.962] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\") returned=""
	[0134.962] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.962] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\documents\\zytnatjd-bn8\\how-to-decrypt-files.htm")) returned 0x20
	[0134.962] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\", lpString2="_jpsD99xC_UAFHN7v.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\_jpsD99xC_UAFHN7v.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\_jpsD99xC_UAFHN7v.xlsx"
	[0134.962] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\_jpsD99xC_UAFHN7v.xlsx", pszSpec="*.zip") returned 0
	[0134.962] lstrlenA (lpString="*.zip") returned 5
	[0134.962] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\_jpsD99xC_UAFHN7v.xlsx", pszSpec="*.rar") returned 0
	[0134.962] lstrlenA (lpString="*.rar") returned 5
	[0134.962] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\_jpsD99xC_UAFHN7v.xlsx", pszSpec="*.7z") returned 0
	[0134.962] lstrlenA (lpString="*.7z") returned 4
	[0134.962] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\_jpsD99xC_UAFHN7v.xlsx", pszSpec="*.tar") returned 0
	[0134.962] lstrlenA (lpString="*.tar") returned 5
	[0134.962] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\_jpsD99xC_UAFHN7v.xlsx", pszSpec="*.gzip") returned 0
	[0134.962] lstrlenA (lpString="*.gzip") returned 6
	[0134.962] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\_jpsD99xC_UAFHN7v.xlsx", pszSpec="*.jpg") returned 0
	[0134.962] lstrlenA (lpString="*.jpg") returned 5
	[0134.962] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\_jpsD99xC_UAFHN7v.xlsx", pszSpec="*.jpeg") returned 0
	[0134.962] lstrlenA (lpString="*.jpeg") returned 6
	[0134.962] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\_jpsD99xC_UAFHN7v.xlsx", pszSpec="*.bmp") returned 0
	[0134.962] lstrlenA (lpString="*.bmp") returned 5
	[0134.962] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\_jpsD99xC_UAFHN7v.xlsx", pszSpec="*.gif") returned 0
	[0134.962] lstrlenA (lpString="*.gif") returned 5
	[0134.962] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\_jpsD99xC_UAFHN7v.xlsx", pszSpec="*.png") returned 0
	[0134.962] lstrlenA (lpString="*.png") returned 5
	[0134.962] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\_jpsD99xC_UAFHN7v.xlsx", pszSpec="*.doc") returned 0
	[0134.962] lstrlenA (lpString="*.doc") returned 5
	[0134.962] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\_jpsD99xC_UAFHN7v.xlsx", pszSpec="*.docx") returned 0
	[0134.962] lstrlenA (lpString="*.docx") returned 6
	[0134.962] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\_jpsD99xC_UAFHN7v.xlsx", pszSpec="*.xls") returned 0
	[0134.962] lstrlenA (lpString="*.xls") returned 5
	[0134.962] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\_jpsD99xC_UAFHN7v.xlsx", pszSpec="*.xlsx") returned 1
	[0134.962] lstrlenA (lpString="*.xlsx") returned 6
	[0134.962] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\_jpsD99xC_UAFHN7v.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\_jpsD99xC_UAFHN7v.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\_jpsD99xC_UAFHN7v.xlsx"
	[0134.963] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\_jpsD99xC_UAFHN7v.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\_jpsD99xC_UAFHN7v.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\_jpsD99xC_UAFHN7v.xlsx"
	[0134.963] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\_jpsD99xC_UAFHN7v.xlsx", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\_jpsD99xC_UAFHN7v.xlsx.") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\_jpsD99xC_UAFHN7v.xlsx."
	[0134.963] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\_jpsD99xC_UAFHN7v.xlsx.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\_jpsD99xC_UAFHN7v.xlsx.exe") returned="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\_jpsD99xC_UAFHN7v.xlsx.exe"
	[0134.963] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\_jpsD99xC_UAFHN7v.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\zytnatjd-bn8\\_jpsd99xc_uafhn7v.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0134.963] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d00
	[0134.963] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa8064790, dwHighDateTime=0x1d4cec5), lpLastAccessTime=0x407536*(dwLowDateTime=0x20c16630, dwHighDateTime=0x1d4d09f), lpLastWriteTime=0x40753e*(dwLowDateTime=0x20c16630, dwHighDateTime=0x1d4d09f)) returned 1
	[0134.963] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.963] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x2cbe, lpOverlapped=0x0) returned 1
	[0134.964] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\_jpsD99xC_UAFHN7v.xlsx") returned="_jpsD99xC_UAFHN7v.xlsx"
	[0134.964] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0134.964] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x2cbe, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x2cbe, lpOverlapped=0x0) returned 1
	[0134.964] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0134.964] CloseHandle (hObject=0x210) returned 1
	[0134.964] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\_jpsD99xC_UAFHN7v.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\zytnatjd-bn8\\_jpsd99xc_uafhn7v.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\ZYtNaTjD-bN8\\_jpsD99xC_UAFHN7v.xlsx.exe" (normalized: "c:\\users\\fd1hvy\\documents\\zytnatjd-bn8\\_jpsd99xc_uafhn7v.xlsx.exe")) returned 1
	[0134.965] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8064790, ftCreationTime.dwHighDateTime=0x1d4cec5, ftLastAccessTime.dwLowDateTime=0x20c16630, ftLastAccessTime.dwHighDateTime=0x1d4d09f, ftLastWriteTime.dwLowDateTime=0x20c16630, ftLastWriteTime.dwHighDateTime=0x1d4d09f, nFileSizeHigh=0x0, nFileSizeLow=0x2d00, dwReserved0=0x0, dwReserved1=0x1, cFileName="_jpsD99xC_UAFHN7v.xlsx", cAlternateFileName="_JPSD9~1.XLS")) returned 0
	[0134.965] FindClose (in: hFindFile=0x7cb650 | out: hFindFile=0x7cb650) returned 1
	[0134.965] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1bd43ad0, ftCreationTime.dwHighDateTime=0x1d4c758, ftLastAccessTime.dwLowDateTime=0x40120300, ftLastAccessTime.dwHighDateTime=0x1d4cc71, ftLastWriteTime.dwLowDateTime=0x40120300, ftLastWriteTime.dwHighDateTime=0x1d4cc71, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="ZYtNaTjD-bN8", cAlternateFileName="ZYTNAT~1")) returned 0
	[0134.965] FindClose (in: hFindFile=0x7cb5d0 | out: hFindFile=0x7cb5d0) returned 1
	[0134.965] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc19bd8f2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc19bd8f2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0260, dwReserved1=0x1000000, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1
	[0134.965] lstrcmpA (lpString1=".", lpString2="Downloads") returned -1
	[0134.965] lstrcmpA (lpString1="..", lpString2="Downloads") returned -1
	[0134.965] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\*.*") returned="*.*"
	[0134.965] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Downloads" | out: lpString1="C:\\Users\\FD1HVy\\Downloads") returned="C:\\Users\\FD1HVy\\Downloads"
	[0134.965] lstrlenA (lpString="C:\\Users\\FD1HVy\\Downloads") returned 25
	[0134.965] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc19bd8f2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc19bd8f2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20, dwReserved1=0x1000000, cFileName=".", cAlternateFileName="")) returned 0x7cb5d0
	[0134.966] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0134.966] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc19bd8f2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc19bd8f2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20, dwReserved1=0x1000000, cFileName="..", cAlternateFileName="")) returned 1
	[0134.966] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0134.966] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0134.966] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x20, dwReserved1=0x1000000, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0134.966] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0134.966] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="desktop.ini") returned 1
	[0134.966] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="desktop.ini") returned 1
	[0134.966] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1
	[0134.966] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Downloads\\*.*") returned="*.*"
	[0134.966] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Downloads\\" | out: lpString1="C:\\Users\\FD1HVy\\Downloads\\") returned="C:\\Users\\FD1HVy\\Downloads\\"
	[0134.966] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Downloads\\" | out: pszPath="C:\\Users\\FD1HVy\\Downloads\\") returned=""
	[0134.966] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Downloads\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Downloads\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Downloads\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.966] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Downloads\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\downloads\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0134.966] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Downloads\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\downloads\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0134.969] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0134.969] WriteFile (in: hFile=0x20c, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0134.970] SetFileTime (hFile=0x20c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0134.970] CloseHandle (hObject=0x20c) returned 1
	[0134.970] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Downloads\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Downloads\\desktop.ini") returned="C:\\Users\\FD1HVy\\Downloads\\desktop.ini"
	[0134.970] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.zip") returned 0
	[0134.970] lstrlenA (lpString="*.zip") returned 5
	[0134.970] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.rar") returned 0
	[0134.970] lstrlenA (lpString="*.rar") returned 5
	[0134.970] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.7z") returned 0
	[0134.970] lstrlenA (lpString="*.7z") returned 4
	[0134.970] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.tar") returned 0
	[0134.970] lstrlenA (lpString="*.tar") returned 5
	[0134.970] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.gzip") returned 0
	[0134.970] lstrlenA (lpString="*.gzip") returned 6
	[0134.970] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.jpg") returned 0
	[0134.970] lstrlenA (lpString="*.jpg") returned 5
	[0134.970] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.jpeg") returned 0
	[0134.970] lstrlenA (lpString="*.jpeg") returned 6
	[0134.970] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.bmp") returned 0
	[0134.970] lstrlenA (lpString="*.bmp") returned 5
	[0134.970] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.gif") returned 0
	[0134.970] lstrlenA (lpString="*.gif") returned 5
	[0134.970] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.png") returned 0
	[0134.970] lstrlenA (lpString="*.png") returned 5
	[0134.970] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.doc") returned 0
	[0134.970] lstrlenA (lpString="*.doc") returned 5
	[0134.970] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.docx") returned 0
	[0134.970] lstrlenA (lpString="*.docx") returned 6
	[0134.971] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.xls") returned 0
	[0134.971] lstrlenA (lpString="*.xls") returned 5
	[0134.971] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.xlsx") returned 0
	[0134.971] lstrlenA (lpString="*.xlsx") returned 6
	[0134.971] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.ppt") returned 0
	[0134.971] lstrlenA (lpString="*.ppt") returned 5
	[0134.971] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.pptx") returned 0
	[0134.971] lstrlenA (lpString="*.pptx") returned 6
	[0134.971] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.txt") returned 0
	[0134.971] lstrlenA (lpString="*.txt") returned 5
	[0134.971] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.pdf") returned 0
	[0134.971] lstrlenA (lpString="*.pdf") returned 5
	[0134.971] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.htm") returned 0
	[0134.971] lstrlenA (lpString="*.htm") returned 5
	[0134.971] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.html") returned 0
	[0134.971] lstrlenA (lpString="*.html") returned 6
	[0134.971] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.mdb") returned 0
	[0134.971] lstrlenA (lpString="*.mdb") returned 5
	[0134.971] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.pfx") returned 0
	[0134.971] lstrlenA (lpString="*.pfx") returned 5
	[0134.971] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.md") returned 0
	[0134.971] lstrlenA (lpString="*.md") returned 4
	[0134.971] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.lnk") returned 0
	[0134.971] lstrlenA (lpString="*.lnk") returned 5
	[0134.971] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.torrent") returned 0
	[0134.971] lstrlenA (lpString="*.torrent") returned 9
	[0134.971] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.mov") returned 0
	[0134.971] lstrlenA (lpString="*.mov") returned 5
	[0134.971] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.3gp") returned 0
	[0134.971] lstrlenA (lpString="*.3gp") returned 5
	[0134.971] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.mpeg") returned 0
	[0134.971] lstrlenA (lpString="*.mpeg") returned 6
	[0134.971] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.mpg") returned 0
	[0134.971] lstrlenA (lpString="*.mpg") returned 5
	[0134.972] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.flv") returned 0
	[0134.972] lstrlenA (lpString="*.flv") returned 5
	[0134.972] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.avi") returned 0
	[0134.972] lstrlenA (lpString="*.avi") returned 5
	[0134.972] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.mp4") returned 0
	[0134.972] lstrlenA (lpString="*.mp4") returned 5
	[0134.972] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.wmv") returned 0
	[0134.972] lstrlenA (lpString="*.wmv") returned 5
	[0134.972] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.mkv") returned 0
	[0134.972] lstrlenA (lpString="*.mkv") returned 5
	[0134.972] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.mp3") returned 0
	[0134.972] lstrlenA (lpString="*.mp3") returned 5
	[0134.972] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.wav") returned 0
	[0134.972] lstrlenA (lpString="*.wav") returned 5
	[0134.972] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.flac") returned 0
	[0134.972] lstrlenA (lpString="*.flac") returned 6
	[0134.972] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.wma") returned 0
	[0134.972] lstrlenA (lpString="*.wma") returned 5
	[0134.972] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.au3") returned 0
	[0134.972] lstrlenA (lpString="*.au3") returned 5
	[0134.972] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.ahk") returned 0
	[0134.972] lstrlenA (lpString="*.ahk") returned 5
	[0134.972] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.c") returned 0
	[0134.972] lstrlenA (lpString="*.c") returned 3
	[0134.972] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.cc") returned 0
	[0134.972] lstrlenA (lpString="*.cc") returned 4
	[0134.972] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.cpp") returned 0
	[0134.972] lstrlenA (lpString="*.cpp") returned 5
	[0134.972] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.cxx") returned 0
	[0134.972] lstrlenA (lpString="*.cxx") returned 5
	[0134.972] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.c++") returned 0
	[0134.972] lstrlenA (lpString="*.c++") returned 5
	[0134.972] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.cs") returned 0
	[0134.972] lstrlenA (lpString="*.cs") returned 4
	[0134.972] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.vb") returned 0
	[0134.973] lstrlenA (lpString="*.vb") returned 4
	[0134.973] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.bas") returned 0
	[0134.973] lstrlenA (lpString="*.bas") returned 5
	[0134.973] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.csproj") returned 0
	[0134.973] lstrlenA (lpString="*.csproj") returned 8
	[0134.973] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.vbproj") returned 0
	[0134.973] lstrlenA (lpString="*.vbproj") returned 8
	[0134.973] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.vcxproj") returned 0
	[0134.973] lstrlenA (lpString="*.vcxproj") returned 9
	[0134.973] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.manifest") returned 0
	[0134.973] lstrlenA (lpString="*.manifest") returned 10
	[0134.973] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.php") returned 0
	[0134.973] lstrlenA (lpString="*.php") returned 5
	[0134.973] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.vbe") returned 0
	[0134.973] lstrlenA (lpString="*.vbe") returned 5
	[0134.973] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.vba") returned 0
	[0134.973] lstrlenA (lpString="*.vba") returned 5
	[0134.973] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.vbs") returned 0
	[0134.973] lstrlenA (lpString="*.vbs") returned 5
	[0134.973] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.bat") returned 0
	[0134.973] lstrlenA (lpString="*.bat") returned 5
	[0134.973] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.cmd") returned 0
	[0134.973] lstrlenA (lpString="*.cmd") returned 5
	[0134.973] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.js") returned 0
	[0134.973] lstrlenA (lpString="*.js") returned 4
	[0134.973] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.jscript") returned 0
	[0134.973] lstrlenA (lpString="*.jscript") returned 9
	[0134.973] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.hta") returned 0
	[0134.973] lstrlenA (lpString="*.hta") returned 5
	[0134.973] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.php7") returned 0
	[0134.973] lstrlenA (lpString="*.php7") returned 6
	[0134.973] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.db") returned 0
	[0134.973] lstrlenA (lpString="*.db") returned 4
	[0134.973] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.swf") returned 0
	[0134.973] lstrlenA (lpString="*.swf") returned 5
	[0134.974] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.eml") returned 0
	[0134.974] lstrlenA (lpString="*.eml") returned 5
	[0134.974] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.part") returned 0
	[0134.974] lstrlenA (lpString="*.part") returned 6
	[0134.974] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.nfo") returned 0
	[0134.974] lstrlenA (lpString="*.nfo") returned 5
	[0134.974] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.rsa") returned 0
	[0134.974] lstrlenA (lpString="*.rsa") returned 5
	[0134.974] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.key") returned 0
	[0134.974] lstrlenA (lpString="*.key") returned 5
	[0134.974] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.aes") returned 0
	[0134.974] lstrlenA (lpString="*.aes") returned 5
	[0134.974] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.blob") returned 0
	[0134.974] lstrlenA (lpString="*.blob") returned 6
	[0134.974] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.btc") returned 0
	[0134.974] lstrlenA (lpString="*.btc") returned 5
	[0134.974] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", pszSpec="*.wallet") returned 0
	[0134.974] lstrlenA (lpString="*.wallet") returned 8
	[0134.974] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x20, dwReserved1=0x1000000, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0134.974] FindClose (in: hFindFile=0x7cb5d0 | out: hFindFile=0x7cb5d0) returned 1
	[0134.974] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1
	[0134.974] lstrcmpA (lpString1=".", lpString2="Favorites") returned -1
	[0134.974] lstrcmpA (lpString1="..", lpString2="Favorites") returned -1
	[0134.974] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\*.*") returned="*.*"
	[0134.974] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Favorites" | out: lpString1="C:\\Users\\FD1HVy\\Favorites") returned="C:\\Users\\FD1HVy\\Favorites"
	[0134.974] lstrlenA (lpString="C:\\Users\\FD1HVy\\Favorites") returned 25
	[0134.974] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x7cbbd0
	[0134.975] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0134.975] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1
	[0134.975] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0134.975] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0134.975] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43598c8e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43b9f870, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x43b9f870, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x1, cFileName="Bing.url", cAlternateFileName="")) returned 1
	[0134.975] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0134.975] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Bing.url") returned 1
	[0134.975] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Bing.url") returned 1
	[0134.975] lstrcmpiA (lpString1="", lpString2="Bing.url") returned -1
	[0134.975] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Favorites\\*.*") returned="*.*"
	[0134.975] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Favorites\\" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\") returned="C:\\Users\\FD1HVy\\Favorites\\"
	[0134.975] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Favorites\\" | out: pszPath="C:\\Users\\FD1HVy\\Favorites\\") returned=""
	[0134.975] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Favorites\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Favorites\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.975] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Favorites\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\favorites\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0134.975] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Favorites\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\favorites\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0134.975] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0134.976] WriteFile (in: hFile=0x20c, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0134.978] SetFileTime (hFile=0x20c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0134.978] CloseHandle (hObject=0x20c) returned 1
	[0134.978] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Favorites\\", lpString2="Bing.url" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\Bing.url") returned="C:\\Users\\FD1HVy\\Favorites\\Bing.url"
	[0134.978] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.zip") returned 0
	[0134.979] lstrlenA (lpString="*.zip") returned 5
	[0134.979] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.rar") returned 0
	[0134.979] lstrlenA (lpString="*.rar") returned 5
	[0134.979] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.7z") returned 0
	[0134.979] lstrlenA (lpString="*.7z") returned 4
	[0134.979] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.tar") returned 0
	[0134.979] lstrlenA (lpString="*.tar") returned 5
	[0134.979] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.gzip") returned 0
	[0134.979] lstrlenA (lpString="*.gzip") returned 6
	[0134.979] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.jpg") returned 0
	[0134.979] lstrlenA (lpString="*.jpg") returned 5
	[0134.979] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.jpeg") returned 0
	[0134.979] lstrlenA (lpString="*.jpeg") returned 6
	[0134.979] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.bmp") returned 0
	[0134.979] lstrlenA (lpString="*.bmp") returned 5
	[0134.979] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.gif") returned 0
	[0134.979] lstrlenA (lpString="*.gif") returned 5
	[0134.979] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.png") returned 0
	[0134.979] lstrlenA (lpString="*.png") returned 5
	[0134.979] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.doc") returned 0
	[0134.979] lstrlenA (lpString="*.doc") returned 5
	[0134.979] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.docx") returned 0
	[0134.979] lstrlenA (lpString="*.docx") returned 6
	[0134.979] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.xls") returned 0
	[0134.979] lstrlenA (lpString="*.xls") returned 5
	[0134.979] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.xlsx") returned 0
	[0134.979] lstrlenA (lpString="*.xlsx") returned 6
	[0134.979] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.ppt") returned 0
	[0134.979] lstrlenA (lpString="*.ppt") returned 5
	[0134.979] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.pptx") returned 0
	[0134.979] lstrlenA (lpString="*.pptx") returned 6
	[0134.979] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.txt") returned 0
	[0134.979] lstrlenA (lpString="*.txt") returned 5
	[0134.979] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.pdf") returned 0
	[0134.979] lstrlenA (lpString="*.pdf") returned 5
	[0134.980] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.htm") returned 0
	[0134.980] lstrlenA (lpString="*.htm") returned 5
	[0134.980] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.html") returned 0
	[0134.980] lstrlenA (lpString="*.html") returned 6
	[0134.980] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.mdb") returned 0
	[0134.980] lstrlenA (lpString="*.mdb") returned 5
	[0134.980] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.pfx") returned 0
	[0134.980] lstrlenA (lpString="*.pfx") returned 5
	[0134.980] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.md") returned 0
	[0134.980] lstrlenA (lpString="*.md") returned 4
	[0134.980] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.lnk") returned 0
	[0134.980] lstrlenA (lpString="*.lnk") returned 5
	[0134.980] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.torrent") returned 0
	[0134.980] lstrlenA (lpString="*.torrent") returned 9
	[0134.980] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.mov") returned 0
	[0134.980] lstrlenA (lpString="*.mov") returned 5
	[0134.980] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.3gp") returned 0
	[0134.980] lstrlenA (lpString="*.3gp") returned 5
	[0134.980] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.mpeg") returned 0
	[0134.980] lstrlenA (lpString="*.mpeg") returned 6
	[0134.980] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.mpg") returned 0
	[0134.980] lstrlenA (lpString="*.mpg") returned 5
	[0134.980] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.flv") returned 0
	[0134.980] lstrlenA (lpString="*.flv") returned 5
	[0134.980] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.avi") returned 0
	[0134.980] lstrlenA (lpString="*.avi") returned 5
	[0134.980] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.mp4") returned 0
	[0134.980] lstrlenA (lpString="*.mp4") returned 5
	[0134.980] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.wmv") returned 0
	[0134.980] lstrlenA (lpString="*.wmv") returned 5
	[0134.980] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.mkv") returned 0
	[0134.980] lstrlenA (lpString="*.mkv") returned 5
	[0134.980] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.mp3") returned 0
	[0134.980] lstrlenA (lpString="*.mp3") returned 5
	[0134.980] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.wav") returned 0
	[0134.981] lstrlenA (lpString="*.wav") returned 5
	[0134.981] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.flac") returned 0
	[0134.981] lstrlenA (lpString="*.flac") returned 6
	[0134.981] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.wma") returned 0
	[0134.981] lstrlenA (lpString="*.wma") returned 5
	[0134.981] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.au3") returned 0
	[0134.981] lstrlenA (lpString="*.au3") returned 5
	[0134.981] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.ahk") returned 0
	[0134.981] lstrlenA (lpString="*.ahk") returned 5
	[0134.981] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.c") returned 0
	[0134.981] lstrlenA (lpString="*.c") returned 3
	[0134.981] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.cc") returned 0
	[0134.981] lstrlenA (lpString="*.cc") returned 4
	[0134.981] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.cpp") returned 0
	[0134.981] lstrlenA (lpString="*.cpp") returned 5
	[0134.981] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.cxx") returned 0
	[0134.981] lstrlenA (lpString="*.cxx") returned 5
	[0134.981] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.c++") returned 0
	[0134.981] lstrlenA (lpString="*.c++") returned 5
	[0134.981] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.cs") returned 0
	[0134.981] lstrlenA (lpString="*.cs") returned 4
	[0134.981] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.vb") returned 0
	[0134.981] lstrlenA (lpString="*.vb") returned 4
	[0134.981] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.bas") returned 0
	[0134.981] lstrlenA (lpString="*.bas") returned 5
	[0134.981] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.csproj") returned 0
	[0134.981] lstrlenA (lpString="*.csproj") returned 8
	[0134.981] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.vbproj") returned 0
	[0134.981] lstrlenA (lpString="*.vbproj") returned 8
	[0134.981] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.vcxproj") returned 0
	[0134.981] lstrlenA (lpString="*.vcxproj") returned 9
	[0134.981] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.manifest") returned 0
	[0134.981] lstrlenA (lpString="*.manifest") returned 10
	[0134.981] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.php") returned 0
	[0134.981] lstrlenA (lpString="*.php") returned 5
	[0134.982] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.vbe") returned 0
	[0134.982] lstrlenA (lpString="*.vbe") returned 5
	[0134.982] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.vba") returned 0
	[0134.982] lstrlenA (lpString="*.vba") returned 5
	[0134.982] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.vbs") returned 0
	[0134.982] lstrlenA (lpString="*.vbs") returned 5
	[0134.982] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.bat") returned 0
	[0134.982] lstrlenA (lpString="*.bat") returned 5
	[0134.982] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.cmd") returned 0
	[0134.982] lstrlenA (lpString="*.cmd") returned 5
	[0134.982] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.js") returned 0
	[0134.982] lstrlenA (lpString="*.js") returned 4
	[0134.982] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.jscript") returned 0
	[0134.982] lstrlenA (lpString="*.jscript") returned 9
	[0134.982] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.hta") returned 0
	[0134.982] lstrlenA (lpString="*.hta") returned 5
	[0134.982] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.php7") returned 0
	[0134.982] lstrlenA (lpString="*.php7") returned 6
	[0134.982] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.db") returned 0
	[0134.982] lstrlenA (lpString="*.db") returned 4
	[0134.982] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.swf") returned 0
	[0134.982] lstrlenA (lpString="*.swf") returned 5
	[0134.982] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.eml") returned 0
	[0134.982] lstrlenA (lpString="*.eml") returned 5
	[0134.982] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.part") returned 0
	[0134.982] lstrlenA (lpString="*.part") returned 6
	[0134.982] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.nfo") returned 0
	[0134.982] lstrlenA (lpString="*.nfo") returned 5
	[0134.982] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.rsa") returned 0
	[0134.982] lstrlenA (lpString="*.rsa") returned 5
	[0134.982] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.key") returned 0
	[0134.982] lstrlenA (lpString="*.key") returned 5
	[0134.982] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.aes") returned 0
	[0134.982] lstrlenA (lpString="*.aes") returned 5
	[0134.983] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.blob") returned 0
	[0134.983] lstrlenA (lpString="*.blob") returned 6
	[0134.983] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.btc") returned 0
	[0134.983] lstrlenA (lpString="*.btc") returned 5
	[0134.983] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Bing.url", pszSpec="*.wallet") returned 0
	[0134.983] lstrlenA (lpString="*.wallet") returned 8
	[0134.983] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x1, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0134.983] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0134.983] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="desktop.ini") returned 1
	[0134.983] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="desktop.ini") returned 1
	[0134.983] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1
	[0134.983] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Favorites\\Bing.url") returned="Bing.url"
	[0134.983] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Favorites\\" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\") returned="C:\\Users\\FD1HVy\\Favorites\\"
	[0134.983] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Favorites\\" | out: pszPath="C:\\Users\\FD1HVy\\Favorites\\") returned=""
	[0134.983] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Favorites\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Favorites\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.983] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Favorites\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\favorites\\how-to-decrypt-files.htm")) returned 0x20
	[0134.983] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Favorites\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\desktop.ini") returned="C:\\Users\\FD1HVy\\Favorites\\desktop.ini"
	[0134.983] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.zip") returned 0
	[0134.983] lstrlenA (lpString="*.zip") returned 5
	[0134.983] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.rar") returned 0
	[0134.983] lstrlenA (lpString="*.rar") returned 5
	[0134.983] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.7z") returned 0
	[0134.983] lstrlenA (lpString="*.7z") returned 4
	[0134.983] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.tar") returned 0
	[0134.983] lstrlenA (lpString="*.tar") returned 5
	[0134.983] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.gzip") returned 0
	[0134.983] lstrlenA (lpString="*.gzip") returned 6
	[0134.983] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.jpg") returned 0
	[0134.983] lstrlenA (lpString="*.jpg") returned 5
	[0134.983] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.jpeg") returned 0
	[0134.983] lstrlenA (lpString="*.jpeg") returned 6
	[0134.984] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.bmp") returned 0
	[0134.984] lstrlenA (lpString="*.bmp") returned 5
	[0134.984] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.gif") returned 0
	[0134.984] lstrlenA (lpString="*.gif") returned 5
	[0134.984] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.png") returned 0
	[0134.984] lstrlenA (lpString="*.png") returned 5
	[0134.984] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.doc") returned 0
	[0134.984] lstrlenA (lpString="*.doc") returned 5
	[0134.984] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.docx") returned 0
	[0134.984] lstrlenA (lpString="*.docx") returned 6
	[0134.984] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.xls") returned 0
	[0134.984] lstrlenA (lpString="*.xls") returned 5
	[0134.984] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.xlsx") returned 0
	[0134.984] lstrlenA (lpString="*.xlsx") returned 6
	[0134.984] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.ppt") returned 0
	[0134.984] lstrlenA (lpString="*.ppt") returned 5
	[0134.984] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.pptx") returned 0
	[0134.984] lstrlenA (lpString="*.pptx") returned 6
	[0134.984] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.txt") returned 0
	[0134.984] lstrlenA (lpString="*.txt") returned 5
	[0134.984] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.pdf") returned 0
	[0134.984] lstrlenA (lpString="*.pdf") returned 5
	[0134.984] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.htm") returned 0
	[0134.984] lstrlenA (lpString="*.htm") returned 5
	[0134.984] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.html") returned 0
	[0134.984] lstrlenA (lpString="*.html") returned 6
	[0134.984] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.mdb") returned 0
	[0134.984] lstrlenA (lpString="*.mdb") returned 5
	[0134.984] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.pfx") returned 0
	[0134.984] lstrlenA (lpString="*.pfx") returned 5
	[0134.984] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.md") returned 0
	[0134.984] lstrlenA (lpString="*.md") returned 4
	[0134.984] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.lnk") returned 0
	[0134.984] lstrlenA (lpString="*.lnk") returned 5
	[0134.984] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.torrent") returned 0
	[0134.985] lstrlenA (lpString="*.torrent") returned 9
	[0134.985] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.mov") returned 0
	[0134.985] lstrlenA (lpString="*.mov") returned 5
	[0134.985] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.3gp") returned 0
	[0134.985] lstrlenA (lpString="*.3gp") returned 5
	[0134.985] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.mpeg") returned 0
	[0134.985] lstrlenA (lpString="*.mpeg") returned 6
	[0134.985] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.mpg") returned 0
	[0134.985] lstrlenA (lpString="*.mpg") returned 5
	[0134.985] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.flv") returned 0
	[0134.985] lstrlenA (lpString="*.flv") returned 5
	[0134.985] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.avi") returned 0
	[0134.985] lstrlenA (lpString="*.avi") returned 5
	[0134.985] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.mp4") returned 0
	[0134.985] lstrlenA (lpString="*.mp4") returned 5
	[0134.985] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.wmv") returned 0
	[0134.985] lstrlenA (lpString="*.wmv") returned 5
	[0134.985] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.mkv") returned 0
	[0134.985] lstrlenA (lpString="*.mkv") returned 5
	[0134.985] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.mp3") returned 0
	[0134.985] lstrlenA (lpString="*.mp3") returned 5
	[0134.985] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.wav") returned 0
	[0134.985] lstrlenA (lpString="*.wav") returned 5
	[0134.985] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.flac") returned 0
	[0134.985] lstrlenA (lpString="*.flac") returned 6
	[0134.985] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.wma") returned 0
	[0134.985] lstrlenA (lpString="*.wma") returned 5
	[0134.985] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.au3") returned 0
	[0134.985] lstrlenA (lpString="*.au3") returned 5
	[0134.985] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.ahk") returned 0
	[0134.985] lstrlenA (lpString="*.ahk") returned 5
	[0134.985] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.c") returned 0
	[0134.985] lstrlenA (lpString="*.c") returned 3
	[0134.985] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.cc") returned 0
	[0134.985] lstrlenA (lpString="*.cc") returned 4
	[0134.986] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.cpp") returned 0
	[0134.986] lstrlenA (lpString="*.cpp") returned 5
	[0134.986] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.cxx") returned 0
	[0134.986] lstrlenA (lpString="*.cxx") returned 5
	[0134.986] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.c++") returned 0
	[0134.986] lstrlenA (lpString="*.c++") returned 5
	[0134.986] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.cs") returned 0
	[0134.986] lstrlenA (lpString="*.cs") returned 4
	[0134.986] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.vb") returned 0
	[0134.986] lstrlenA (lpString="*.vb") returned 4
	[0134.986] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.bas") returned 0
	[0134.986] lstrlenA (lpString="*.bas") returned 5
	[0134.986] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.csproj") returned 0
	[0134.986] lstrlenA (lpString="*.csproj") returned 8
	[0134.986] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.vbproj") returned 0
	[0134.986] lstrlenA (lpString="*.vbproj") returned 8
	[0134.986] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.vcxproj") returned 0
	[0134.986] lstrlenA (lpString="*.vcxproj") returned 9
	[0134.986] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.manifest") returned 0
	[0134.986] lstrlenA (lpString="*.manifest") returned 10
	[0134.986] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.php") returned 0
	[0134.986] lstrlenA (lpString="*.php") returned 5
	[0134.986] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.vbe") returned 0
	[0134.986] lstrlenA (lpString="*.vbe") returned 5
	[0134.986] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.vba") returned 0
	[0134.986] lstrlenA (lpString="*.vba") returned 5
	[0134.986] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.vbs") returned 0
	[0134.986] lstrlenA (lpString="*.vbs") returned 5
	[0134.986] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.bat") returned 0
	[0134.986] lstrlenA (lpString="*.bat") returned 5
	[0134.986] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.cmd") returned 0
	[0134.986] lstrlenA (lpString="*.cmd") returned 5
	[0134.986] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.js") returned 0
	[0134.986] lstrlenA (lpString="*.js") returned 4
	[0134.987] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.jscript") returned 0
	[0134.987] lstrlenA (lpString="*.jscript") returned 9
	[0134.987] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.hta") returned 0
	[0134.987] lstrlenA (lpString="*.hta") returned 5
	[0134.987] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.php7") returned 0
	[0134.987] lstrlenA (lpString="*.php7") returned 6
	[0134.987] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.db") returned 0
	[0134.987] lstrlenA (lpString="*.db") returned 4
	[0134.987] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.swf") returned 0
	[0134.987] lstrlenA (lpString="*.swf") returned 5
	[0134.987] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.eml") returned 0
	[0134.987] lstrlenA (lpString="*.eml") returned 5
	[0134.987] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.part") returned 0
	[0134.987] lstrlenA (lpString="*.part") returned 6
	[0134.987] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.nfo") returned 0
	[0134.987] lstrlenA (lpString="*.nfo") returned 5
	[0134.987] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.rsa") returned 0
	[0134.987] lstrlenA (lpString="*.rsa") returned 5
	[0134.987] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.key") returned 0
	[0134.987] lstrlenA (lpString="*.key") returned 5
	[0134.987] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.aes") returned 0
	[0134.987] lstrlenA (lpString="*.aes") returned 5
	[0134.987] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.blob") returned 0
	[0134.987] lstrlenA (lpString="*.blob") returned 6
	[0134.987] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.btc") returned 0
	[0134.987] lstrlenA (lpString="*.btc") returned 5
	[0134.987] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", pszSpec="*.wallet") returned 0
	[0134.987] lstrlenA (lpString="*.wallet") returned 8
	[0134.987] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1
	[0134.987] lstrcmpA (lpString1=".", lpString2="Links") returned -1
	[0134.987] lstrcmpA (lpString1="..", lpString2="Links") returned -1
	[0134.987] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Favorites\\desktop.ini") returned="desktop.ini"
	[0134.987] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Favorites\\", lpString2="Links" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\Links") returned="C:\\Users\\FD1HVy\\Favorites\\Links"
	[0134.987] lstrlenA (lpString="C:\\Users\\FD1HVy\\Favorites\\Links") returned 31
	[0134.987] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x78, cFileName=".", cAlternateFileName="")) returned 0x7cbad0
	[0134.988] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0134.988] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x78, cFileName="..", cAlternateFileName="")) returned 1
	[0134.988] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0134.988] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0134.988] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4360b38e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4360b38e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4360b38e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x7b0000, dwReserved1=0x78, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0134.988] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0134.988] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="desktop.ini") returned 1
	[0134.988] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="desktop.ini") returned 1
	[0134.988] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1
	[0134.988] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Favorites\\Links\\*.*") returned="*.*"
	[0134.988] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Favorites\\Links\\" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\Links\\") returned="C:\\Users\\FD1HVy\\Favorites\\Links\\"
	[0134.988] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Favorites\\Links\\" | out: pszPath="C:\\Users\\FD1HVy\\Favorites\\Links\\") returned=""
	[0134.988] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Favorites\\Links\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\Links\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Favorites\\Links\\HOW-TO-DECRYPT-FILES.HTM"
	[0134.988] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\favorites\\links\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0134.988] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\favorites\\links\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0134.989] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0134.989] WriteFile (in: hFile=0x210, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0134.990] SetFileTime (hFile=0x210, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0134.990] CloseHandle (hObject=0x210) returned 1
	[0134.990] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Favorites\\Links\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini") returned="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini"
	[0134.990] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.zip") returned 0
	[0134.990] lstrlenA (lpString="*.zip") returned 5
	[0134.991] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.rar") returned 0
	[0134.991] lstrlenA (lpString="*.rar") returned 5
	[0134.991] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.7z") returned 0
	[0134.991] lstrlenA (lpString="*.7z") returned 4
	[0134.991] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.tar") returned 0
	[0134.991] lstrlenA (lpString="*.tar") returned 5
	[0134.991] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.gzip") returned 0
	[0134.991] lstrlenA (lpString="*.gzip") returned 6
	[0134.991] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.jpg") returned 0
	[0134.991] lstrlenA (lpString="*.jpg") returned 5
	[0134.991] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.jpeg") returned 0
	[0134.991] lstrlenA (lpString="*.jpeg") returned 6
	[0134.991] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.bmp") returned 0
	[0134.991] lstrlenA (lpString="*.bmp") returned 5
	[0134.991] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.gif") returned 0
	[0134.991] lstrlenA (lpString="*.gif") returned 5
	[0134.991] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.png") returned 0
	[0134.991] lstrlenA (lpString="*.png") returned 5
	[0134.991] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.doc") returned 0
	[0134.991] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.docx") returned 0
	[0134.991] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.xls") returned 0
	[0134.991] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.xlsx") returned 0
	[0134.991] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.ppt") returned 0
	[0134.991] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.pptx") returned 0
	[0134.991] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.txt") returned 0
	[0134.991] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.pdf") returned 0
	[0134.991] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.htm") returned 0
	[0134.991] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.html") returned 0
	[0134.991] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.mdb") returned 0
	[0134.992] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.pfx") returned 0
	[0134.992] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.md") returned 0
	[0134.992] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.lnk") returned 0
	[0134.992] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.torrent") returned 0
	[0134.992] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.mov") returned 0
	[0134.992] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.3gp") returned 0
	[0134.992] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.mpeg") returned 0
	[0135.032] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.mpg") returned 0
	[0135.032] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.flv") returned 0
	[0135.032] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.avi") returned 0
	[0135.032] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.mp4") returned 0
	[0135.032] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.wmv") returned 0
	[0135.032] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.mkv") returned 0
	[0135.032] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.mp3") returned 0
	[0135.032] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.wav") returned 0
	[0135.032] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.flac") returned 0
	[0135.032] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.wma") returned 0
	[0135.032] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.au3") returned 0
	[0135.032] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.ahk") returned 0
	[0135.032] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.c") returned 0
	[0135.032] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.cc") returned 0
	[0135.032] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.cpp") returned 0
	[0135.032] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.cxx") returned 0
	[0135.032] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.c++") returned 0
	[0135.032] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.cs") returned 0
	[0135.032] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.vb") returned 0
	[0135.032] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.bas") returned 0
	[0135.032] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.csproj") returned 0
	[0135.032] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.vbproj") returned 0
	[0135.032] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.vcxproj") returned 0
	[0135.033] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.manifest") returned 0
	[0135.033] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.php") returned 0
	[0135.033] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.vbe") returned 0
	[0135.033] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.vba") returned 0
	[0135.033] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.vbs") returned 0
	[0135.033] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.bat") returned 0
	[0135.033] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.cmd") returned 0
	[0135.033] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.js") returned 0
	[0135.033] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.jscript") returned 0
	[0135.033] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.hta") returned 0
	[0135.033] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.php7") returned 0
	[0135.033] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.db") returned 0
	[0135.033] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.swf") returned 0
	[0135.033] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.eml") returned 0
	[0135.033] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.part") returned 0
	[0135.033] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.nfo") returned 0
	[0135.033] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.rsa") returned 0
	[0135.033] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.key") returned 0
	[0135.033] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.aes") returned 0
	[0135.033] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.blob") returned 0
	[0135.033] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.btc") returned 0
	[0135.033] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", pszSpec="*.wallet") returned 0
	[0135.033] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4360b38e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4360b38e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4360b38e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x7b0000, dwReserved1=0x78, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0135.033] FindClose (in: hFindFile=0x7cbad0 | out: hFindFile=0x7cbad0) returned 1
	[0135.034] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 0
	[0135.034] FindClose (in: hFindFile=0x7cbbd0 | out: hFindFile=0x7cbbd0) returned 1
	[0135.036] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1
	[0135.036] lstrcmpA (lpString1=".", lpString2="Links") returned -1
	[0135.036] lstrcmpA (lpString1="..", lpString2="Links") returned -1
	[0135.036] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\*.*") returned="*.*"
	[0135.036] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Links" | out: lpString1="C:\\Users\\FD1HVy\\Links") returned="C:\\Users\\FD1HVy\\Links"
	[0135.036] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Links\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbad0
	[0135.036] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0135.036] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0135.036] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0135.037] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0135.037] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcee4480b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0135.037] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.037] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="desktop.ini") returned 1
	[0135.037] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="desktop.ini") returned 1
	[0135.037] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1
	[0135.037] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Links\\*.*") returned="*.*"
	[0135.037] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Links\\" | out: lpString1="C:\\Users\\FD1HVy\\Links\\") returned="C:\\Users\\FD1HVy\\Links\\"
	[0135.037] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Links\\" | out: pszPath="C:\\Users\\FD1HVy\\Links\\") returned=""
	[0135.037] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Links\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Links\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Links\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.037] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Links\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\links\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0135.037] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Links\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\links\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.039] WriteFile (in: hFile=0x20c, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0135.040] SetFileTime (hFile=0x20c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0135.040] CloseHandle (hObject=0x20c) returned 1
	[0135.040] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Links\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Links\\desktop.ini") returned="C:\\Users\\FD1HVy\\Links\\desktop.ini"
	[0135.040] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\desktop.ini", pszSpec="*.zip") returned 0
	[0135.040] lstrlenA (lpString="*.zip") returned 5
	[0135.040] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\desktop.ini", pszSpec="*.rar") returned 0
	[0135.040] lstrlenA (lpString="*.rar") returned 5
	[0135.040] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\desktop.ini", pszSpec="*.7z") returned 0
	[0135.040] lstrlenA (lpString="*.7z") returned 4
	[0135.040] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\desktop.ini", pszSpec="*.tar") returned 0
	[0135.041] lstrlenA (lpString="*.tar") returned 5
	[0135.041] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\desktop.ini", pszSpec="*.gzip") returned 0
	[0135.041] lstrlenA (lpString="*.gzip") returned 6
	[0135.041] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\desktop.ini", pszSpec="*.jpg") returned 0
	[0135.041] lstrlenA (lpString="*.jpg") returned 5
	[0135.041] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\desktop.ini", pszSpec="*.jpeg") returned 0
	[0135.041] lstrlenA (lpString="*.jpeg") returned 6
	[0135.041] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\desktop.ini", pszSpec="*.bmp") returned 0
	[0135.041] lstrlenA (lpString="*.bmp") returned 5
	[0135.041] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\desktop.ini", pszSpec="*.gif") returned 0
	[0135.041] lstrlenA (lpString="*.gif") returned 5
	[0135.041] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\desktop.ini", pszSpec="*.png") returned 0
	[0135.041] lstrlenA (lpString="*.png") returned 5
	[0135.041] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\desktop.ini", pszSpec="*.doc") returned 0
	[0135.041] lstrlenA (lpString="*.doc") returned 5
	[0135.041] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\desktop.ini", pszSpec="*.docx") returned 0
	[0135.041] lstrlenA (lpString="*.docx") returned 6
	[0135.041] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\desktop.ini", pszSpec="*.xls") returned 0
	[0135.041] lstrlenA (lpString="*.xls") returned 5
	[0135.041] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\desktop.ini", pszSpec="*.xlsx") returned 0
	[0135.041] lstrlenA (lpString="*.xlsx") returned 6
	[0135.041] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\desktop.ini", pszSpec="*.ppt") returned 0
	[0135.041] lstrlenA (lpString="*.ppt") returned 5
	[0135.041] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\desktop.ini", pszSpec="*.pptx") returned 0
	[0135.041] lstrlenA (lpString="*.pptx") returned 6
	[0135.041] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\desktop.ini", pszSpec="*.txt") returned 0
	[0135.041] lstrlenA (lpString="*.txt") returned 5
	[0135.041] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\desktop.ini", pszSpec="*.pdf") returned 0
	[0135.041] lstrlenA (lpString="*.pdf") returned 5
	[0135.041] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\desktop.ini", pszSpec="*.htm") returned 0
	[0135.041] lstrlenA (lpString="*.htm") returned 5
	[0135.041] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\desktop.ini", pszSpec="*.html") returned 0
	[0135.041] lstrlenA (lpString="*.html") returned 6
	[0135.042] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\desktop.ini", pszSpec="*.mdb") returned 0
	[0135.042] lstrlenA (lpString="*.mdb") returned 5
	[0135.042] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\desktop.ini", pszSpec="*.pfx") returned 0
	[0135.042] lstrlenA (lpString="*.pfx") returned 5
	[0135.042] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\desktop.ini", pszSpec="*.md") returned 0
	[0135.042] lstrlenA (lpString="*.md") returned 4
	[0135.042] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\desktop.ini", pszSpec="*.lnk") returned 0
	[0135.042] lstrlenA (lpString="*.lnk") returned 5
	[0135.042] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\desktop.ini", pszSpec="*.torrent") returned 0
	[0135.042] lstrlenA (lpString="*.torrent") returned 9
	[0135.042] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\desktop.ini", pszSpec="*.mov") returned 0
	[0135.042] lstrlenA (lpString="*.mov") returned 5
	[0135.042] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\desktop.ini", pszSpec="*.3gp") returned 0
	[0135.042] lstrlenA (lpString="*.3gp") returned 5
	[0135.042] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\desktop.ini", pszSpec="*.mpeg") returned 0
	[0135.042] lstrlenA (lpString="*.mpeg") returned 6
	[0135.042] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\desktop.ini", pszSpec="*.mpg") returned 0
	[0135.042] lstrlenA (lpString="*.mpg") returned 5
	[0135.042] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\desktop.ini", pszSpec="*.flv") returned 0
	[0135.042] lstrlenA (lpString="*.flv") returned 5
	[0135.042] lstrlenA (lpString="*.avi") returned 5
	[0135.042] lstrlenA (lpString="*.mp4") returned 5
	[0135.042] lstrlenA (lpString="*.wmv") returned 5
	[0135.042] lstrlenA (lpString="*.mkv") returned 5
	[0135.042] lstrlenA (lpString="*.mp3") returned 5
	[0135.042] lstrlenA (lpString="*.wav") returned 5
	[0135.043] lstrlenA (lpString="*.flac") returned 6
	[0135.043] lstrlenA (lpString="*.wma") returned 5
	[0135.043] lstrlenA (lpString="*.au3") returned 5
	[0135.043] lstrlenA (lpString="*.ahk") returned 5
	[0135.043] lstrlenA (lpString="*.c") returned 3
	[0135.043] lstrlenA (lpString="*.cc") returned 4
	[0135.043] lstrlenA (lpString="*.cpp") returned 5
	[0135.043] lstrlenA (lpString="*.cxx") returned 5
	[0135.043] lstrlenA (lpString="*.c++") returned 5
	[0135.043] lstrlenA (lpString="*.cs") returned 4
	[0135.043] lstrlenA (lpString="*.vb") returned 4
	[0135.043] lstrlenA (lpString="*.bas") returned 5
	[0135.043] lstrlenA (lpString="*.csproj") returned 8
	[0135.043] lstrlenA (lpString="*.vbproj") returned 8
	[0135.043] lstrlenA (lpString="*.vcxproj") returned 9
	[0135.043] lstrlenA (lpString="*.manifest") returned 10
	[0135.043] lstrlenA (lpString="*.php") returned 5
	[0135.043] lstrlenA (lpString="*.vbe") returned 5
	[0135.043] lstrlenA (lpString="*.vba") returned 5
	[0135.043] lstrlenA (lpString="*.vbs") returned 5
	[0135.043] lstrlenA (lpString="*.bat") returned 5
	[0135.043] lstrlenA (lpString="*.cmd") returned 5
	[0135.043] lstrlenA (lpString="*.js") returned 4
	[0135.043] lstrlenA (lpString="*.jscript") returned 9
	[0135.043] lstrlenA (lpString="*.hta") returned 5
	[0135.043] lstrlenA (lpString="*.php7") returned 6
	[0135.043] lstrlenA (lpString="*.db") returned 4
	[0135.044] lstrlenA (lpString="*.swf") returned 5
	[0135.044] lstrlenA (lpString="*.eml") returned 5
	[0135.044] lstrlenA (lpString="*.part") returned 6
	[0135.044] lstrlenA (lpString="*.nfo") returned 5
	[0135.044] lstrlenA (lpString="*.rsa") returned 5
	[0135.044] lstrlenA (lpString="*.key") returned 5
	[0135.044] lstrlenA (lpString="*.aes") returned 5
	[0135.044] lstrlenA (lpString="*.blob") returned 6
	[0135.044] lstrlenA (lpString="*.btc") returned 5
	[0135.044] lstrlenA (lpString="*.wallet") returned 8
	[0135.044] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4428f2bb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4428f2bb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce90d59d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x1, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1
	[0135.044] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.044] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Desktop.lnk") returned 1
	[0135.044] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Desktop.lnk") returned 1
	[0135.044] lstrcmpiA (lpString1="", lpString2="Desktop.lnk") returned -1
	[0135.044] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Links\\desktop.ini") returned="desktop.ini"
	[0135.044] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Links\\" | out: lpString1="C:\\Users\\FD1HVy\\Links\\") returned="C:\\Users\\FD1HVy\\Links\\"
	[0135.044] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Links\\" | out: pszPath="C:\\Users\\FD1HVy\\Links\\") returned=""
	[0135.044] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Links\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Links\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Links\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.044] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Links\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\links\\how-to-decrypt-files.htm")) returned 0x20
	[0135.044] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Links\\", lpString2="Desktop.lnk" | out: lpString1="C:\\Users\\FD1HVy\\Links\\Desktop.lnk") returned="C:\\Users\\FD1HVy\\Links\\Desktop.lnk"
	[0135.044] lstrlenA (lpString="*.zip") returned 5
	[0135.044] lstrlenA (lpString="*.rar") returned 5
	[0135.044] lstrlenA (lpString="*.7z") returned 4
	[0135.044] lstrlenA (lpString="*.tar") returned 5
	[0135.044] lstrlenA (lpString="*.gzip") returned 6
	[0135.045] lstrlenA (lpString="*.jpg") returned 5
	[0135.045] lstrlenA (lpString="*.jpeg") returned 6
	[0135.045] lstrlenA (lpString="*.bmp") returned 5
	[0135.045] lstrlenA (lpString="*.gif") returned 5
	[0135.045] lstrlenA (lpString="*.png") returned 5
	[0135.045] lstrlenA (lpString="*.doc") returned 5
	[0135.045] lstrlenA (lpString="*.docx") returned 6
	[0135.045] lstrlenA (lpString="*.xls") returned 5
	[0135.045] lstrlenA (lpString="*.xlsx") returned 6
	[0135.045] lstrlenA (lpString="*.ppt") returned 5
	[0135.045] lstrlenA (lpString="*.pptx") returned 6
	[0135.045] lstrlenA (lpString="*.txt") returned 5
	[0135.045] lstrlenA (lpString="*.pdf") returned 5
	[0135.045] lstrlenA (lpString="*.htm") returned 5
	[0135.045] lstrlenA (lpString="*.html") returned 6
	[0135.045] lstrlenA (lpString="*.mdb") returned 5
	[0135.045] lstrlenA (lpString="*.pfx") returned 5
	[0135.045] lstrlenA (lpString="*.md") returned 4
	[0135.045] lstrlenA (lpString="*.lnk") returned 5
	[0135.045] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" | out: lpString1="C:\\Users\\FD1HVy\\Links\\Desktop.lnk") returned="C:\\Users\\FD1HVy\\Links\\Desktop.lnk"
	[0135.045] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" | out: lpString1="C:\\Users\\FD1HVy\\Links\\Desktop.lnk") returned="C:\\Users\\FD1HVy\\Links\\Desktop.lnk"
	[0135.045] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Links\\Desktop.lnk.") returned="C:\\Users\\FD1HVy\\Links\\Desktop.lnk."
	[0135.045] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Links\\Desktop.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Links\\Desktop.lnk.exe") returned="C:\\Users\\FD1HVy\\Links\\Desktop.lnk.exe"
	[0135.045] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.047] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f5
	[0135.047] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4428f2bb, dwHighDateTime=0x1d32722), lpLastAccessTime=0x407536*(dwLowDateTime=0x4428f2bb, dwHighDateTime=0x1d32722), lpLastWriteTime=0x40753e*(dwLowDateTime=0xce90d59d, dwHighDateTime=0x1d32743)) returned 1
	[0135.047] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.047] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1b3, lpOverlapped=0x0) returned 1
	[0135.048] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Links\\Desktop.lnk") returned="Desktop.lnk"
	[0135.048] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.048] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1b3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1b3, lpOverlapped=0x0) returned 1
	[0135.048] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.048] CloseHandle (hObject=0x20c) returned 1
	[0135.048] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk.exe" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk.exe")) returned 1
	[0135.049] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x442b54f3, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x442b54f3, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcec7abde, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x3ae, dwReserved0=0x12, dwReserved1=0x1, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1
	[0135.049] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.049] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Downloads.lnk") returned 1
	[0135.049] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Downloads.lnk") returned 1
	[0135.049] lstrcmpiA (lpString1="", lpString2="Downloads.lnk") returned -1
	[0135.049] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Links\\Desktop.lnk") returned="Desktop.lnk"
	[0135.049] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Links\\" | out: lpString1="C:\\Users\\FD1HVy\\Links\\") returned="C:\\Users\\FD1HVy\\Links\\"
	[0135.049] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Links\\" | out: pszPath="C:\\Users\\FD1HVy\\Links\\") returned=""
	[0135.049] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Links\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Links\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Links\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.049] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Links\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\links\\how-to-decrypt-files.htm")) returned 0x20
	[0135.049] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Links\\", lpString2="Downloads.lnk" | out: lpString1="C:\\Users\\FD1HVy\\Links\\Downloads.lnk") returned="C:\\Users\\FD1HVy\\Links\\Downloads.lnk"
	[0135.049] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", pszSpec="*.zip") returned 0
	[0135.049] lstrlenA (lpString="*.zip") returned 5
	[0135.049] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", pszSpec="*.rar") returned 0
	[0135.049] lstrlenA (lpString="*.rar") returned 5
	[0135.049] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", pszSpec="*.7z") returned 0
	[0135.049] lstrlenA (lpString="*.7z") returned 4
	[0135.049] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", pszSpec="*.tar") returned 0
	[0135.049] lstrlenA (lpString="*.tar") returned 5
	[0135.050] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", pszSpec="*.gzip") returned 0
	[0135.050] lstrlenA (lpString="*.gzip") returned 6
	[0135.050] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", pszSpec="*.jpg") returned 0
	[0135.050] lstrlenA (lpString="*.jpg") returned 5
	[0135.050] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", pszSpec="*.jpeg") returned 0
	[0135.050] lstrlenA (lpString="*.jpeg") returned 6
	[0135.050] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", pszSpec="*.bmp") returned 0
	[0135.050] lstrlenA (lpString="*.bmp") returned 5
	[0135.050] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", pszSpec="*.gif") returned 0
	[0135.050] lstrlenA (lpString="*.gif") returned 5
	[0135.050] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", pszSpec="*.png") returned 0
	[0135.050] lstrlenA (lpString="*.png") returned 5
	[0135.050] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", pszSpec="*.doc") returned 0
	[0135.050] lstrlenA (lpString="*.doc") returned 5
	[0135.050] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", pszSpec="*.docx") returned 0
	[0135.050] lstrlenA (lpString="*.docx") returned 6
	[0135.050] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", pszSpec="*.xls") returned 0
	[0135.050] lstrlenA (lpString="*.xls") returned 5
	[0135.050] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", pszSpec="*.xlsx") returned 0
	[0135.050] lstrlenA (lpString="*.xlsx") returned 6
	[0135.050] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", pszSpec="*.ppt") returned 0
	[0135.050] lstrlenA (lpString="*.ppt") returned 5
	[0135.050] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", pszSpec="*.pptx") returned 0
	[0135.050] lstrlenA (lpString="*.pptx") returned 6
	[0135.050] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", pszSpec="*.txt") returned 0
	[0135.050] lstrlenA (lpString="*.txt") returned 5
	[0135.050] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", pszSpec="*.pdf") returned 0
	[0135.050] lstrlenA (lpString="*.pdf") returned 5
	[0135.050] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", pszSpec="*.htm") returned 0
	[0135.050] lstrlenA (lpString="*.htm") returned 5
	[0135.050] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", pszSpec="*.html") returned 0
	[0135.050] lstrlenA (lpString="*.html") returned 6
	[0135.050] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", pszSpec="*.mdb") returned 0
	[0135.050] lstrlenA (lpString="*.mdb") returned 5
	[0135.050] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", pszSpec="*.pfx") returned 0
	[0135.050] lstrlenA (lpString="*.pfx") returned 5
	[0135.050] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", pszSpec="*.md") returned 0
	[0135.051] lstrlenA (lpString="*.md") returned 4
	[0135.051] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", pszSpec="*.lnk") returned 1
	[0135.051] lstrlenA (lpString="*.lnk") returned 5
	[0135.051] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" | out: lpString1="C:\\Users\\FD1HVy\\Links\\Downloads.lnk") returned="C:\\Users\\FD1HVy\\Links\\Downloads.lnk"
	[0135.051] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" | out: lpString1="C:\\Users\\FD1HVy\\Links\\Downloads.lnk") returned="C:\\Users\\FD1HVy\\Links\\Downloads.lnk"
	[0135.051] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Links\\Downloads.lnk.") returned="C:\\Users\\FD1HVy\\Links\\Downloads.lnk."
	[0135.051] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Links\\Downloads.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Links\\Downloads.lnk.exe") returned="C:\\Users\\FD1HVy\\Links\\Downloads.lnk.exe"
	[0135.051] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.051] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ae
	[0135.051] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x442b54f3, dwHighDateTime=0x1d32722), lpLastAccessTime=0x407536*(dwLowDateTime=0x442b54f3, dwHighDateTime=0x1d32722), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcec7abde, dwHighDateTime=0x1d32743)) returned 1
	[0135.051] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.051] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x36c, lpOverlapped=0x0) returned 1
	[0135.060] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Links\\Downloads.lnk") returned="Downloads.lnk"
	[0135.060] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.060] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x36c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x36c, lpOverlapped=0x0) returned 1
	[0135.060] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.060] CloseHandle (hObject=0x20c) returned 1
	[0135.061] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk.exe" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk.exe")) returned 1
	[0135.061] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x94664823, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x12, dwReserved1=0x1, cFileName="OneDrive.lnk", cAlternateFileName="")) returned 1
	[0135.061] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.061] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="OneDrive.lnk") returned -1
	[0135.061] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="OneDrive.lnk") returned -1
	[0135.061] lstrcmpiA (lpString1="", lpString2="OneDrive.lnk") returned -1
	[0135.061] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Links\\Downloads.lnk") returned="Downloads.lnk"
	[0135.061] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Links\\" | out: lpString1="C:\\Users\\FD1HVy\\Links\\") returned="C:\\Users\\FD1HVy\\Links\\"
	[0135.061] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Links\\" | out: pszPath="C:\\Users\\FD1HVy\\Links\\") returned=""
	[0135.061] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Links\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Links\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Links\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.061] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Links\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\links\\how-to-decrypt-files.htm")) returned 0x20
	[0135.062] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Links\\", lpString2="OneDrive.lnk" | out: lpString1="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk") returned="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk"
	[0135.062] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", pszSpec="*.zip") returned 0
	[0135.062] lstrlenA (lpString="*.zip") returned 5
	[0135.062] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", pszSpec="*.rar") returned 0
	[0135.062] lstrlenA (lpString="*.rar") returned 5
	[0135.062] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", pszSpec="*.7z") returned 0
	[0135.062] lstrlenA (lpString="*.7z") returned 4
	[0135.062] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", pszSpec="*.tar") returned 0
	[0135.062] lstrlenA (lpString="*.tar") returned 5
	[0135.062] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", pszSpec="*.gzip") returned 0
	[0135.062] lstrlenA (lpString="*.gzip") returned 6
	[0135.062] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", pszSpec="*.jpg") returned 0
	[0135.062] lstrlenA (lpString="*.jpg") returned 5
	[0135.062] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", pszSpec="*.jpeg") returned 0
	[0135.062] lstrlenA (lpString="*.jpeg") returned 6
	[0135.062] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", pszSpec="*.bmp") returned 0
	[0135.062] lstrlenA (lpString="*.bmp") returned 5
	[0135.062] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", pszSpec="*.gif") returned 0
	[0135.062] lstrlenA (lpString="*.gif") returned 5
	[0135.062] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", pszSpec="*.png") returned 0
	[0135.062] lstrlenA (lpString="*.png") returned 5
	[0135.062] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", pszSpec="*.doc") returned 0
	[0135.062] lstrlenA (lpString="*.doc") returned 5
	[0135.062] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", pszSpec="*.docx") returned 0
	[0135.062] lstrlenA (lpString="*.docx") returned 6
	[0135.062] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", pszSpec="*.xls") returned 0
	[0135.062] lstrlenA (lpString="*.xls") returned 5
	[0135.062] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", pszSpec="*.xlsx") returned 0
	[0135.062] lstrlenA (lpString="*.xlsx") returned 6
	[0135.062] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", pszSpec="*.ppt") returned 0
	[0135.062] lstrlenA (lpString="*.ppt") returned 5
	[0135.062] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", pszSpec="*.pptx") returned 0
	[0135.062] lstrlenA (lpString="*.pptx") returned 6
	[0135.062] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", pszSpec="*.txt") returned 0
	[0135.062] lstrlenA (lpString="*.txt") returned 5
	[0135.063] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", pszSpec="*.pdf") returned 0
	[0135.063] lstrlenA (lpString="*.pdf") returned 5
	[0135.063] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", pszSpec="*.htm") returned 0
	[0135.063] lstrlenA (lpString="*.htm") returned 5
	[0135.063] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", pszSpec="*.html") returned 0
	[0135.063] lstrlenA (lpString="*.html") returned 6
	[0135.063] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", pszSpec="*.mdb") returned 0
	[0135.063] lstrlenA (lpString="*.mdb") returned 5
	[0135.063] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", pszSpec="*.pfx") returned 0
	[0135.063] lstrlenA (lpString="*.pfx") returned 5
	[0135.063] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", pszSpec="*.md") returned 0
	[0135.063] lstrlenA (lpString="*.md") returned 4
	[0135.063] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", pszSpec="*.lnk") returned 1
	[0135.063] lstrlenA (lpString="*.lnk") returned 5
	[0135.063] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" | out: lpString1="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk") returned="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk"
	[0135.063] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" | out: lpString1="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk") returned="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk"
	[0135.063] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk.") returned="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk."
	[0135.063] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk.exe") returned="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk.exe"
	[0135.063] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.075] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x53a
	[0135.075] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3190fb5, dwHighDateTime=0x1d327b5), lpLastAccessTime=0x407536*(dwLowDateTime=0x9463e5c0, dwHighDateTime=0x1d39f5d), lpLastWriteTime=0x40753e*(dwLowDateTime=0x94664823, dwHighDateTime=0x1d39f5d)) returned 1
	[0135.076] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.076] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x4f8, lpOverlapped=0x0) returned 1
	[0135.077] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk") returned="OneDrive.lnk"
	[0135.077] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.077] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x4f8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x4f8, lpOverlapped=0x0) returned 1
	[0135.077] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.077] CloseHandle (hObject=0x20c) returned 1
	[0135.077] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk.exe" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk.exe")) returned 1
	[0135.078] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x94664823, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x12, dwReserved1=0x1, cFileName="OneDrive.lnk", cAlternateFileName="")) returned 0
	[0135.078] FindClose (in: hFindFile=0x7cbad0 | out: hFindFile=0x7cbad0) returned 1
	[0135.078] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x1000000, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1
	[0135.078] lstrcmpA (lpString1=".", lpString2="Local Settings") returned -1
	[0135.078] lstrcmpA (lpString1="..", lpString2="Local Settings") returned -1
	[0135.078] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\*.*") returned="*.*"
	[0135.078] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Local Settings" | out: lpString1="C:\\Users\\FD1HVy\\Local Settings") returned="C:\\Users\\FD1HVy\\Local Settings"
	[0135.078] lstrlenA (lpString="C:\\Users\\FD1HVy\\Local Settings") returned 30
	[0135.078] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Local Settings\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x94664823, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x12, dwReserved1=0x1, cFileName="OneDrive.lnk", cAlternateFileName="\xcc\xff\x19")) returned 0xffffffff
	[0135.079] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x11610b51, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x11610b51, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x1000000, cFileName="Music", cAlternateFileName="")) returned 1
	[0135.079] lstrcmpA (lpString1=".", lpString2="Music") returned -1
	[0135.079] lstrcmpA (lpString1="..", lpString2="Music") returned -1
	[0135.079] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\*.*") returned="*.*"
	[0135.079] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Music" | out: lpString1="C:\\Users\\FD1HVy\\Music") returned="C:\\Users\\FD1HVy\\Music"
	[0135.079] lstrlenA (lpString="C:\\Users\\FD1HVy\\Music") returned 21
	[0135.079] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Music\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x11610b51, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x11610b51, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x12, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x7cb5d0
	[0135.079] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0135.079] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x11610b51, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x11610b51, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x12, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1
	[0135.079] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0135.079] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0135.079] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf033570, ftCreationTime.dwHighDateTime=0x1d4d32b, ftLastAccessTime.dwLowDateTime=0xaa245b00, ftLastAccessTime.dwHighDateTime=0x1d4d246, ftLastWriteTime.dwLowDateTime=0xaa245b00, ftLastWriteTime.dwHighDateTime=0x1d4d246, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x12, dwReserved1=0x1, cFileName="2y4nPoi3R", cAlternateFileName="2Y4NPO~1")) returned 1
	[0135.079] lstrcmpA (lpString1=".", lpString2="2y4nPoi3R") returned -1
	[0135.079] lstrcmpA (lpString1="..", lpString2="2y4nPoi3R") returned -1
	[0135.079] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\*.*") returned="*.*"
	[0135.079] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="2y4nPoi3R" | out: lpString1="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R") returned="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R"
	[0135.079] lstrlenA (lpString="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R") returned 31
	[0135.079] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf033570, ftCreationTime.dwHighDateTime=0x1d4d32b, ftLastAccessTime.dwLowDateTime=0xaa245b00, ftLastAccessTime.dwHighDateTime=0x1d4d246, ftLastWriteTime.dwLowDateTime=0xaa245b00, ftLastWriteTime.dwHighDateTime=0x1d4d246, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cb910
	[0135.079] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0135.079] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf033570, ftCreationTime.dwHighDateTime=0x1d4d32b, ftLastAccessTime.dwLowDateTime=0xaa245b00, ftLastAccessTime.dwHighDateTime=0x1d4d246, ftLastWriteTime.dwLowDateTime=0xaa245b00, ftLastWriteTime.dwHighDateTime=0x1d4d246, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0135.079] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0135.079] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0135.079] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaba66fd0, ftCreationTime.dwHighDateTime=0x1d4c982, ftLastAccessTime.dwLowDateTime=0xf485f1f0, ftLastAccessTime.dwHighDateTime=0x1d4cead, ftLastWriteTime.dwLowDateTime=0xf485f1f0, ftLastWriteTime.dwHighDateTime=0x1d4cead, nFileSizeHigh=0x0, nFileSizeLow=0x1528d, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="8IApgJxUUkvT.m4a", cAlternateFileName="8IAPGJ~1.M4A")) returned 1
	[0135.079] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0135.079] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="8IApgJxUUkvT.m4a") returned 1
	[0135.079] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="8IApgJxUUkvT.m4a") returned 1
	[0135.079] lstrcmpiA (lpString1="", lpString2="8IApgJxUUkvT.m4a") returned -1
	[0135.080] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\*.*") returned="*.*"
	[0135.080] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\") returned="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\"
	[0135.080] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\") returned=""
	[0135.080] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.080] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\2y4npoi3r\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0135.080] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\2y4npoi3r\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0135.081] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0135.081] WriteFile (in: hFile=0x210, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0135.082] SetFileTime (hFile=0x210, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0135.082] CloseHandle (hObject=0x210) returned 1
	[0135.082] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\", lpString2="8IApgJxUUkvT.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a") returned="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a"
	[0135.082] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.zip") returned 0
	[0135.082] lstrlenA (lpString="*.zip") returned 5
	[0135.082] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.rar") returned 0
	[0135.082] lstrlenA (lpString="*.rar") returned 5
	[0135.083] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.7z") returned 0
	[0135.083] lstrlenA (lpString="*.7z") returned 4
	[0135.083] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.tar") returned 0
	[0135.083] lstrlenA (lpString="*.tar") returned 5
	[0135.083] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.gzip") returned 0
	[0135.083] lstrlenA (lpString="*.gzip") returned 6
	[0135.083] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.jpg") returned 0
	[0135.083] lstrlenA (lpString="*.jpg") returned 5
	[0135.083] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.jpeg") returned 0
	[0135.083] lstrlenA (lpString="*.jpeg") returned 6
	[0135.083] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.bmp") returned 0
	[0135.083] lstrlenA (lpString="*.bmp") returned 5
	[0135.083] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.gif") returned 0
	[0135.083] lstrlenA (lpString="*.gif") returned 5
	[0135.083] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.png") returned 0
	[0135.083] lstrlenA (lpString="*.png") returned 5
	[0135.083] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.doc") returned 0
	[0135.083] lstrlenA (lpString="*.doc") returned 5
	[0135.083] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.docx") returned 0
	[0135.083] lstrlenA (lpString="*.docx") returned 6
	[0135.083] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.xls") returned 0
	[0135.083] lstrlenA (lpString="*.xls") returned 5
	[0135.083] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.xlsx") returned 0
	[0135.083] lstrlenA (lpString="*.xlsx") returned 6
	[0135.083] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.ppt") returned 0
	[0135.083] lstrlenA (lpString="*.ppt") returned 5
	[0135.083] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.pptx") returned 0
	[0135.083] lstrlenA (lpString="*.pptx") returned 6
	[0135.083] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.txt") returned 0
	[0135.083] lstrlenA (lpString="*.txt") returned 5
	[0135.083] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.pdf") returned 0
	[0135.083] lstrlenA (lpString="*.pdf") returned 5
	[0135.083] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.htm") returned 0
	[0135.083] lstrlenA (lpString="*.htm") returned 5
	[0135.083] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.html") returned 0
	[0135.083] lstrlenA (lpString="*.html") returned 6
	[0135.083] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.mdb") returned 0
	[0135.084] lstrlenA (lpString="*.mdb") returned 5
	[0135.084] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.pfx") returned 0
	[0135.084] lstrlenA (lpString="*.pfx") returned 5
	[0135.084] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.md") returned 0
	[0135.084] lstrlenA (lpString="*.md") returned 4
	[0135.084] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.lnk") returned 0
	[0135.084] lstrlenA (lpString="*.lnk") returned 5
	[0135.084] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.torrent") returned 0
	[0135.084] lstrlenA (lpString="*.torrent") returned 9
	[0135.084] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.mov") returned 0
	[0135.084] lstrlenA (lpString="*.mov") returned 5
	[0135.084] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.3gp") returned 0
	[0135.084] lstrlenA (lpString="*.3gp") returned 5
	[0135.084] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.mpeg") returned 0
	[0135.084] lstrlenA (lpString="*.mpeg") returned 6
	[0135.084] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.mpg") returned 0
	[0135.084] lstrlenA (lpString="*.mpg") returned 5
	[0135.084] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.flv") returned 0
	[0135.084] lstrlenA (lpString="*.flv") returned 5
	[0135.084] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.avi") returned 0
	[0135.084] lstrlenA (lpString="*.avi") returned 5
	[0135.084] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.mp4") returned 0
	[0135.084] lstrlenA (lpString="*.mp4") returned 5
	[0135.084] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.wmv") returned 0
	[0135.084] lstrlenA (lpString="*.wmv") returned 5
	[0135.084] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.mkv") returned 0
	[0135.084] lstrlenA (lpString="*.mkv") returned 5
	[0135.084] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.mp3") returned 0
	[0135.084] lstrlenA (lpString="*.mp3") returned 5
	[0135.084] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.wav") returned 0
	[0135.084] lstrlenA (lpString="*.wav") returned 5
	[0135.084] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.flac") returned 0
	[0135.084] lstrlenA (lpString="*.flac") returned 6
	[0135.084] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.wma") returned 0
	[0135.084] lstrlenA (lpString="*.wma") returned 5
	[0135.085] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.au3") returned 0
	[0135.085] lstrlenA (lpString="*.au3") returned 5
	[0135.085] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.ahk") returned 0
	[0135.085] lstrlenA (lpString="*.ahk") returned 5
	[0135.085] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.c") returned 0
	[0135.085] lstrlenA (lpString="*.c") returned 3
	[0135.085] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.cc") returned 0
	[0135.085] lstrlenA (lpString="*.cc") returned 4
	[0135.085] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.cpp") returned 0
	[0135.085] lstrlenA (lpString="*.cpp") returned 5
	[0135.085] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.cxx") returned 0
	[0135.085] lstrlenA (lpString="*.cxx") returned 5
	[0135.085] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.c++") returned 0
	[0135.085] lstrlenA (lpString="*.c++") returned 5
	[0135.085] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.cs") returned 0
	[0135.085] lstrlenA (lpString="*.cs") returned 4
	[0135.085] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.vb") returned 0
	[0135.085] lstrlenA (lpString="*.vb") returned 4
	[0135.085] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.bas") returned 0
	[0135.085] lstrlenA (lpString="*.bas") returned 5
	[0135.085] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.csproj") returned 0
	[0135.085] lstrlenA (lpString="*.csproj") returned 8
	[0135.085] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.vbproj") returned 0
	[0135.085] lstrlenA (lpString="*.vbproj") returned 8
	[0135.085] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.vcxproj") returned 0
	[0135.085] lstrlenA (lpString="*.vcxproj") returned 9
	[0135.085] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.manifest") returned 0
	[0135.085] lstrlenA (lpString="*.manifest") returned 10
	[0135.085] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.php") returned 0
	[0135.085] lstrlenA (lpString="*.php") returned 5
	[0135.085] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.vbe") returned 0
	[0135.085] lstrlenA (lpString="*.vbe") returned 5
	[0135.085] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.vba") returned 0
	[0135.085] lstrlenA (lpString="*.vba") returned 5
	[0135.086] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.vbs") returned 0
	[0135.086] lstrlenA (lpString="*.vbs") returned 5
	[0135.086] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.bat") returned 0
	[0135.086] lstrlenA (lpString="*.bat") returned 5
	[0135.086] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.cmd") returned 0
	[0135.086] lstrlenA (lpString="*.cmd") returned 5
	[0135.086] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.js") returned 0
	[0135.086] lstrlenA (lpString="*.js") returned 4
	[0135.086] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.jscript") returned 0
	[0135.086] lstrlenA (lpString="*.jscript") returned 9
	[0135.086] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.hta") returned 0
	[0135.086] lstrlenA (lpString="*.hta") returned 5
	[0135.086] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.php7") returned 0
	[0135.086] lstrlenA (lpString="*.php7") returned 6
	[0135.086] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.db") returned 0
	[0135.086] lstrlenA (lpString="*.db") returned 4
	[0135.086] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.swf") returned 0
	[0135.086] lstrlenA (lpString="*.swf") returned 5
	[0135.086] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.eml") returned 0
	[0135.086] lstrlenA (lpString="*.eml") returned 5
	[0135.086] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.part") returned 0
	[0135.086] lstrlenA (lpString="*.part") returned 6
	[0135.086] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.nfo") returned 0
	[0135.086] lstrlenA (lpString="*.nfo") returned 5
	[0135.086] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.rsa") returned 0
	[0135.086] lstrlenA (lpString="*.rsa") returned 5
	[0135.086] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.key") returned 0
	[0135.086] lstrlenA (lpString="*.key") returned 5
	[0135.086] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.aes") returned 0
	[0135.087] lstrlenA (lpString="*.aes") returned 5
	[0135.087] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.blob") returned 0
	[0135.087] lstrlenA (lpString="*.blob") returned 6
	[0135.087] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.btc") returned 0
	[0135.087] lstrlenA (lpString="*.btc") returned 5
	[0135.087] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a", pszSpec="*.wallet") returned 0
	[0135.087] lstrlenA (lpString="*.wallet") returned 8
	[0135.087] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd69f8ce0, ftCreationTime.dwHighDateTime=0x1d4c73d, ftLastAccessTime.dwLowDateTime=0x7293fc0, ftLastAccessTime.dwHighDateTime=0x1d4d46b, ftLastWriteTime.dwLowDateTime=0x7293fc0, ftLastWriteTime.dwHighDateTime=0x1d4d46b, nFileSizeHigh=0x0, nFileSizeLow=0x2a51, dwReserved0=0x0, dwReserved1=0x0, cFileName="M3SFGRpvV7.wav", cAlternateFileName="M3SFGR~1.WAV")) returned 1
	[0135.087] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0135.087] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="M3SFGRpvV7.wav") returned -1
	[0135.087] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="M3SFGRpvV7.wav") returned -1
	[0135.087] lstrcmpiA (lpString1="", lpString2="M3SFGRpvV7.wav") returned -1
	[0135.087] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\8IApgJxUUkvT.m4a") returned="8IApgJxUUkvT.m4a"
	[0135.087] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\") returned="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\"
	[0135.087] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\") returned=""
	[0135.087] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.087] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\2y4npoi3r\\how-to-decrypt-files.htm")) returned 0x20
	[0135.087] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\", lpString2="M3SFGRpvV7.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav") returned="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav"
	[0135.087] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav", pszSpec="*.zip") returned 0
	[0135.087] lstrlenA (lpString="*.zip") returned 5
	[0135.087] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav", pszSpec="*.rar") returned 0
	[0135.087] lstrlenA (lpString="*.rar") returned 5
	[0135.087] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav", pszSpec="*.7z") returned 0
	[0135.087] lstrlenA (lpString="*.7z") returned 4
	[0135.087] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav", pszSpec="*.tar") returned 0
	[0135.087] lstrlenA (lpString="*.tar") returned 5
	[0135.087] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav", pszSpec="*.gzip") returned 0
	[0135.087] lstrlenA (lpString="*.gzip") returned 6
	[0135.087] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav", pszSpec="*.jpg") returned 0
	[0135.087] lstrlenA (lpString="*.jpg") returned 5
	[0135.088] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav", pszSpec="*.jpeg") returned 0
	[0135.088] lstrlenA (lpString="*.jpeg") returned 6
	[0135.088] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav", pszSpec="*.bmp") returned 0
	[0135.088] lstrlenA (lpString="*.bmp") returned 5
	[0135.088] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav", pszSpec="*.gif") returned 0
	[0135.088] lstrlenA (lpString="*.gif") returned 5
	[0135.088] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav", pszSpec="*.png") returned 0
	[0135.088] lstrlenA (lpString="*.png") returned 5
	[0135.088] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav", pszSpec="*.doc") returned 0
	[0135.088] lstrlenA (lpString="*.doc") returned 5
	[0135.088] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav", pszSpec="*.docx") returned 0
	[0135.088] lstrlenA (lpString="*.docx") returned 6
	[0135.088] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav", pszSpec="*.xls") returned 0
	[0135.088] lstrlenA (lpString="*.xls") returned 5
	[0135.088] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav", pszSpec="*.xlsx") returned 0
	[0135.088] lstrlenA (lpString="*.xlsx") returned 6
	[0135.088] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav", pszSpec="*.ppt") returned 0
	[0135.088] lstrlenA (lpString="*.ppt") returned 5
	[0135.088] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav", pszSpec="*.pptx") returned 0
	[0135.088] lstrlenA (lpString="*.pptx") returned 6
	[0135.088] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav", pszSpec="*.txt") returned 0
	[0135.088] lstrlenA (lpString="*.txt") returned 5
	[0135.088] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav", pszSpec="*.pdf") returned 0
	[0135.088] lstrlenA (lpString="*.pdf") returned 5
	[0135.088] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav", pszSpec="*.htm") returned 0
	[0135.088] lstrlenA (lpString="*.htm") returned 5
	[0135.088] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav", pszSpec="*.html") returned 0
	[0135.088] lstrlenA (lpString="*.html") returned 6
	[0135.088] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav", pszSpec="*.mdb") returned 0
	[0135.088] lstrlenA (lpString="*.mdb") returned 5
	[0135.088] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav", pszSpec="*.pfx") returned 0
	[0135.088] lstrlenA (lpString="*.pfx") returned 5
	[0135.088] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav", pszSpec="*.md") returned 0
	[0135.088] lstrlenA (lpString="*.md") returned 4
	[0135.088] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav", pszSpec="*.lnk") returned 0
	[0135.088] lstrlenA (lpString="*.lnk") returned 5
	[0135.089] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav", pszSpec="*.torrent") returned 0
	[0135.089] lstrlenA (lpString="*.torrent") returned 9
	[0135.089] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav", pszSpec="*.mov") returned 0
	[0135.089] lstrlenA (lpString="*.mov") returned 5
	[0135.089] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav", pszSpec="*.3gp") returned 0
	[0135.089] lstrlenA (lpString="*.3gp") returned 5
	[0135.089] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav", pszSpec="*.mpeg") returned 0
	[0135.089] lstrlenA (lpString="*.mpeg") returned 6
	[0135.089] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav", pszSpec="*.mpg") returned 0
	[0135.089] lstrlenA (lpString="*.mpg") returned 5
	[0135.089] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav", pszSpec="*.flv") returned 0
	[0135.089] lstrlenA (lpString="*.flv") returned 5
	[0135.089] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav", pszSpec="*.avi") returned 0
	[0135.089] lstrlenA (lpString="*.avi") returned 5
	[0135.089] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav", pszSpec="*.mp4") returned 0
	[0135.089] lstrlenA (lpString="*.mp4") returned 5
	[0135.089] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav", pszSpec="*.wmv") returned 0
	[0135.089] lstrlenA (lpString="*.wmv") returned 5
	[0135.089] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav", pszSpec="*.mkv") returned 0
	[0135.089] lstrlenA (lpString="*.mkv") returned 5
	[0135.089] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav", pszSpec="*.mp3") returned 0
	[0135.089] lstrlenA (lpString="*.mp3") returned 5
	[0135.089] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav", pszSpec="*.wav") returned 1
	[0135.089] lstrlenA (lpString="*.wav") returned 5
	[0135.089] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav") returned="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav"
	[0135.089] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav") returned="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav"
	[0135.089] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav.") returned="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav."
	[0135.089] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav.exe") returned="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav.exe"
	[0135.089] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav" (normalized: "c:\\users\\fd1hvy\\music\\2y4npoi3r\\m3sfgrpvv7.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0135.090] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2a51
	[0135.090] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd69f8ce0, dwHighDateTime=0x1d4c73d), lpLastAccessTime=0x407536*(dwLowDateTime=0x7293fc0, dwHighDateTime=0x1d4d46b), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7293fc0, dwHighDateTime=0x1d4d46b)) returned 1
	[0135.090] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.090] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x2a0f, lpOverlapped=0x0) returned 1
	[0135.091] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav") returned="M3SFGRpvV7.wav"
	[0135.091] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.091] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x2a0f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x2a0f, lpOverlapped=0x0) returned 1
	[0135.091] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.091] CloseHandle (hObject=0x210) returned 1
	[0135.091] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav" (normalized: "c:\\users\\fd1hvy\\music\\2y4npoi3r\\m3sfgrpvv7.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\2y4nPoi3R\\M3SFGRpvV7.wav.exe" (normalized: "c:\\users\\fd1hvy\\music\\2y4npoi3r\\m3sfgrpvv7.wav.exe")) returned 1
	[0135.092] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd69f8ce0, ftCreationTime.dwHighDateTime=0x1d4c73d, ftLastAccessTime.dwLowDateTime=0x7293fc0, ftLastAccessTime.dwHighDateTime=0x1d4d46b, ftLastWriteTime.dwLowDateTime=0x7293fc0, ftLastWriteTime.dwHighDateTime=0x1d4d46b, nFileSizeHigh=0x0, nFileSizeLow=0x2a51, dwReserved0=0x0, dwReserved1=0x0, cFileName="M3SFGRpvV7.wav", cAlternateFileName="M3SFGR~1.WAV")) returned 0
	[0135.092] FindClose (in: hFindFile=0x7cb910 | out: hFindFile=0x7cb910) returned 1
	[0135.092] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4409f518, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4409f518, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x7b0260, dwReserved1=0x1000000, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0135.092] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.092] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="desktop.ini") returned 1
	[0135.092] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="desktop.ini") returned 1
	[0135.092] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1
	[0135.092] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\*.*") returned="*.*"
	[0135.092] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\"
	[0135.092] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\") returned=""
	[0135.092] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.092] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0135.092] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Music\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.092] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0135.092] WriteFile (in: hFile=0x20c, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0135.093] SetFileTime (hFile=0x20c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0135.093] CloseHandle (hObject=0x20c) returned 1
	[0135.093] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Music\\desktop.ini") returned="C:\\Users\\FD1HVy\\Music\\desktop.ini"
	[0135.094] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.zip") returned 0
	[0135.094] lstrlenA (lpString="*.zip") returned 5
	[0135.094] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.rar") returned 0
	[0135.094] lstrlenA (lpString="*.rar") returned 5
	[0135.094] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.7z") returned 0
	[0135.094] lstrlenA (lpString="*.7z") returned 4
	[0135.094] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.tar") returned 0
	[0135.094] lstrlenA (lpString="*.tar") returned 5
	[0135.094] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.gzip") returned 0
	[0135.094] lstrlenA (lpString="*.gzip") returned 6
	[0135.094] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.jpg") returned 0
	[0135.094] lstrlenA (lpString="*.jpg") returned 5
	[0135.094] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.jpeg") returned 0
	[0135.094] lstrlenA (lpString="*.jpeg") returned 6
	[0135.094] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.bmp") returned 0
	[0135.094] lstrlenA (lpString="*.bmp") returned 5
	[0135.094] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.gif") returned 0
	[0135.094] lstrlenA (lpString="*.gif") returned 5
	[0135.094] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.png") returned 0
	[0135.094] lstrlenA (lpString="*.png") returned 5
	[0135.094] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.doc") returned 0
	[0135.094] lstrlenA (lpString="*.doc") returned 5
	[0135.094] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.docx") returned 0
	[0135.094] lstrlenA (lpString="*.docx") returned 6
	[0135.094] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.xls") returned 0
	[0135.094] lstrlenA (lpString="*.xls") returned 5
	[0135.094] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.xlsx") returned 0
	[0135.094] lstrlenA (lpString="*.xlsx") returned 6
	[0135.094] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.ppt") returned 0
	[0135.094] lstrlenA (lpString="*.ppt") returned 5
	[0135.094] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.pptx") returned 0
	[0135.094] lstrlenA (lpString="*.pptx") returned 6
	[0135.094] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.txt") returned 0
	[0135.094] lstrlenA (lpString="*.txt") returned 5
	[0135.095] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.pdf") returned 0
	[0135.095] lstrlenA (lpString="*.pdf") returned 5
	[0135.095] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.htm") returned 0
	[0135.095] lstrlenA (lpString="*.htm") returned 5
	[0135.095] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.html") returned 0
	[0135.095] lstrlenA (lpString="*.html") returned 6
	[0135.095] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.mdb") returned 0
	[0135.095] lstrlenA (lpString="*.mdb") returned 5
	[0135.095] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.pfx") returned 0
	[0135.095] lstrlenA (lpString="*.pfx") returned 5
	[0135.095] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.md") returned 0
	[0135.095] lstrlenA (lpString="*.md") returned 4
	[0135.095] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.lnk") returned 0
	[0135.095] lstrlenA (lpString="*.lnk") returned 5
	[0135.095] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.torrent") returned 0
	[0135.095] lstrlenA (lpString="*.torrent") returned 9
	[0135.095] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.mov") returned 0
	[0135.095] lstrlenA (lpString="*.mov") returned 5
	[0135.095] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.3gp") returned 0
	[0135.095] lstrlenA (lpString="*.3gp") returned 5
	[0135.095] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.mpeg") returned 0
	[0135.095] lstrlenA (lpString="*.mpeg") returned 6
	[0135.095] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.mpg") returned 0
	[0135.095] lstrlenA (lpString="*.mpg") returned 5
	[0135.095] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.flv") returned 0
	[0135.095] lstrlenA (lpString="*.flv") returned 5
	[0135.095] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.avi") returned 0
	[0135.095] lstrlenA (lpString="*.avi") returned 5
	[0135.095] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.mp4") returned 0
	[0135.095] lstrlenA (lpString="*.mp4") returned 5
	[0135.095] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.wmv") returned 0
	[0135.095] lstrlenA (lpString="*.wmv") returned 5
	[0135.095] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.mkv") returned 0
	[0135.095] lstrlenA (lpString="*.mkv") returned 5
	[0135.095] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.mp3") returned 0
	[0135.095] lstrlenA (lpString="*.mp3") returned 5
	[0135.096] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.wav") returned 0
	[0135.096] lstrlenA (lpString="*.wav") returned 5
	[0135.096] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.flac") returned 0
	[0135.096] lstrlenA (lpString="*.flac") returned 6
	[0135.096] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.wma") returned 0
	[0135.096] lstrlenA (lpString="*.wma") returned 5
	[0135.096] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.au3") returned 0
	[0135.096] lstrlenA (lpString="*.au3") returned 5
	[0135.096] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.ahk") returned 0
	[0135.096] lstrlenA (lpString="*.ahk") returned 5
	[0135.096] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.c") returned 0
	[0135.096] lstrlenA (lpString="*.c") returned 3
	[0135.096] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.cc") returned 0
	[0135.096] lstrlenA (lpString="*.cc") returned 4
	[0135.096] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.cpp") returned 0
	[0135.096] lstrlenA (lpString="*.cpp") returned 5
	[0135.096] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.cxx") returned 0
	[0135.096] lstrlenA (lpString="*.cxx") returned 5
	[0135.096] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.c++") returned 0
	[0135.096] lstrlenA (lpString="*.c++") returned 5
	[0135.096] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.cs") returned 0
	[0135.096] lstrlenA (lpString="*.cs") returned 4
	[0135.096] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.vb") returned 0
	[0135.096] lstrlenA (lpString="*.vb") returned 4
	[0135.096] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.bas") returned 0
	[0135.096] lstrlenA (lpString="*.bas") returned 5
	[0135.096] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.csproj") returned 0
	[0135.096] lstrlenA (lpString="*.csproj") returned 8
	[0135.096] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.vbproj") returned 0
	[0135.096] lstrlenA (lpString="*.vbproj") returned 8
	[0135.096] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.vcxproj") returned 0
	[0135.096] lstrlenA (lpString="*.vcxproj") returned 9
	[0135.096] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.manifest") returned 0
	[0135.096] lstrlenA (lpString="*.manifest") returned 10
	[0135.096] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.php") returned 0
	[0135.097] lstrlenA (lpString="*.php") returned 5
	[0135.097] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.vbe") returned 0
	[0135.097] lstrlenA (lpString="*.vbe") returned 5
	[0135.097] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.vba") returned 0
	[0135.097] lstrlenA (lpString="*.vba") returned 5
	[0135.097] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.vbs") returned 0
	[0135.097] lstrlenA (lpString="*.vbs") returned 5
	[0135.097] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.bat") returned 0
	[0135.097] lstrlenA (lpString="*.bat") returned 5
	[0135.097] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.cmd") returned 0
	[0135.097] lstrlenA (lpString="*.cmd") returned 5
	[0135.097] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.js") returned 0
	[0135.097] lstrlenA (lpString="*.js") returned 4
	[0135.097] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.jscript") returned 0
	[0135.097] lstrlenA (lpString="*.jscript") returned 9
	[0135.097] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.hta") returned 0
	[0135.097] lstrlenA (lpString="*.hta") returned 5
	[0135.097] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.php7") returned 0
	[0135.097] lstrlenA (lpString="*.php7") returned 6
	[0135.097] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.db") returned 0
	[0135.097] lstrlenA (lpString="*.db") returned 4
	[0135.097] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.swf") returned 0
	[0135.097] lstrlenA (lpString="*.swf") returned 5
	[0135.097] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.eml") returned 0
	[0135.097] lstrlenA (lpString="*.eml") returned 5
	[0135.097] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.part") returned 0
	[0135.097] lstrlenA (lpString="*.part") returned 6
	[0135.097] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.nfo") returned 0
	[0135.097] lstrlenA (lpString="*.nfo") returned 5
	[0135.097] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.rsa") returned 0
	[0135.097] lstrlenA (lpString="*.rsa") returned 5
	[0135.097] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.key") returned 0
	[0135.097] lstrlenA (lpString="*.key") returned 5
	[0135.097] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.aes") returned 0
	[0135.097] lstrlenA (lpString="*.aes") returned 5
	[0135.098] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.blob") returned 0
	[0135.098] lstrlenA (lpString="*.blob") returned 6
	[0135.098] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.btc") returned 0
	[0135.098] lstrlenA (lpString="*.btc") returned 5
	[0135.098] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\desktop.ini", pszSpec="*.wallet") returned 0
	[0135.098] lstrlenA (lpString="*.wallet") returned 8
	[0135.098] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee996710, ftCreationTime.dwHighDateTime=0x1d4c5aa, ftLastAccessTime.dwLowDateTime=0x9a7af210, ftLastAccessTime.dwHighDateTime=0x1d4c9b1, ftLastWriteTime.dwLowDateTime=0x9a7af210, ftLastWriteTime.dwHighDateTime=0x1d4c9b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="Hi_G UBIbBkjtun", cAlternateFileName="HI_GUB~1")) returned 1
	[0135.098] lstrcmpA (lpString1=".", lpString2="Hi_G UBIbBkjtun") returned -1
	[0135.098] lstrcmpA (lpString1="..", lpString2="Hi_G UBIbBkjtun") returned -1
	[0135.098] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\desktop.ini") returned="desktop.ini"
	[0135.098] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="Hi_G UBIbBkjtun" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun"
	[0135.098] lstrlenA (lpString="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun") returned 37
	[0135.098] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee996710, ftCreationTime.dwHighDateTime=0x1d4c5aa, ftLastAccessTime.dwLowDateTime=0x9a7af210, ftLastAccessTime.dwHighDateTime=0x1d4c9b1, ftLastWriteTime.dwLowDateTime=0x9a7af210, ftLastWriteTime.dwHighDateTime=0x1d4c9b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c7928, dwReserved1=0x70, cFileName=".", cAlternateFileName="")) returned 0x7cb750
	[0135.098] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0135.098] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee996710, ftCreationTime.dwHighDateTime=0x1d4c5aa, ftLastAccessTime.dwLowDateTime=0x9a7af210, ftLastAccessTime.dwHighDateTime=0x1d4c9b1, ftLastWriteTime.dwLowDateTime=0x9a7af210, ftLastWriteTime.dwHighDateTime=0x1d4c9b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c7928, dwReserved1=0x70, cFileName="..", cAlternateFileName="")) returned 1
	[0135.098] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0135.098] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0135.098] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffc0e40, ftCreationTime.dwHighDateTime=0x1d4d4f5, ftLastAccessTime.dwLowDateTime=0x318ee550, ftLastAccessTime.dwHighDateTime=0x1d4c5c3, ftLastWriteTime.dwLowDateTime=0x318ee550, ftLastWriteTime.dwHighDateTime=0x1d4c5c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c7928, dwReserved1=0x70, cFileName="6rbIhn", cAlternateFileName="")) returned 1
	[0135.098] lstrcmpA (lpString1=".", lpString2="6rbIhn") returned -1
	[0135.098] lstrcmpA (lpString1="..", lpString2="6rbIhn") returned -1
	[0135.098] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\*.*") returned="*.*"
	[0135.098] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\", lpString2="6rbIhn" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn"
	[0135.098] lstrlenA (lpString="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn") returned 44
	[0135.098] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffc0e40, ftCreationTime.dwHighDateTime=0x1d4d4f5, ftLastAccessTime.dwLowDateTime=0x318ee550, ftLastAccessTime.dwHighDateTime=0x1d4c5c3, ftLastWriteTime.dwLowDateTime=0x318ee550, ftLastWriteTime.dwHighDateTime=0x1d4c5c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cb650
	[0135.098] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0135.099] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffc0e40, ftCreationTime.dwHighDateTime=0x1d4d4f5, ftLastAccessTime.dwLowDateTime=0x318ee550, ftLastAccessTime.dwHighDateTime=0x1d4c5c3, ftLastWriteTime.dwLowDateTime=0x318ee550, ftLastWriteTime.dwHighDateTime=0x1d4c5c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0135.099] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0135.099] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0135.099] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbcb390, ftCreationTime.dwHighDateTime=0x1d4d199, ftLastAccessTime.dwLowDateTime=0xebcce5a0, ftLastAccessTime.dwHighDateTime=0x1d4d579, ftLastWriteTime.dwLowDateTime=0xebcce5a0, ftLastWriteTime.dwHighDateTime=0x1d4d579, nFileSizeHigh=0x0, nFileSizeLow=0x144d4, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="cXFYH86MJHV.mp3", cAlternateFileName="CXFYH8~1.MP3")) returned 1
	[0135.099] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0135.099] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="cXFYH86MJHV.mp3") returned 1
	[0135.099] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="cXFYH86MJHV.mp3") returned 1
	[0135.099] lstrcmpiA (lpString1="", lpString2="cXFYH86MJHV.mp3") returned -1
	[0135.099] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\*.*") returned="*.*"
	[0135.099] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\"
	[0135.099] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\") returned=""
	[0135.099] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.099] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\6rbihn\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0135.099] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\6rbihn\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0135.101] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0135.101] WriteFile (in: hFile=0x214, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0135.102] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0135.102] CloseHandle (hObject=0x214) returned 1
	[0135.102] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\", lpString2="cXFYH86MJHV.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3"
	[0135.102] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3", pszSpec="*.zip") returned 0
	[0135.102] lstrlenA (lpString="*.zip") returned 5
	[0135.102] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3", pszSpec="*.rar") returned 0
	[0135.102] lstrlenA (lpString="*.rar") returned 5
	[0135.102] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3", pszSpec="*.7z") returned 0
	[0135.102] lstrlenA (lpString="*.7z") returned 4
	[0135.102] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3", pszSpec="*.tar") returned 0
	[0135.103] lstrlenA (lpString="*.tar") returned 5
	[0135.103] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3", pszSpec="*.gzip") returned 0
	[0135.103] lstrlenA (lpString="*.gzip") returned 6
	[0135.103] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3", pszSpec="*.jpg") returned 0
	[0135.103] lstrlenA (lpString="*.jpg") returned 5
	[0135.103] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3", pszSpec="*.jpeg") returned 0
	[0135.103] lstrlenA (lpString="*.jpeg") returned 6
	[0135.103] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3", pszSpec="*.bmp") returned 0
	[0135.103] lstrlenA (lpString="*.bmp") returned 5
	[0135.103] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3", pszSpec="*.gif") returned 0
	[0135.103] lstrlenA (lpString="*.gif") returned 5
	[0135.103] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3", pszSpec="*.png") returned 0
	[0135.103] lstrlenA (lpString="*.png") returned 5
	[0135.103] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3", pszSpec="*.doc") returned 0
	[0135.103] lstrlenA (lpString="*.doc") returned 5
	[0135.103] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3", pszSpec="*.docx") returned 0
	[0135.103] lstrlenA (lpString="*.docx") returned 6
	[0135.103] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3", pszSpec="*.xls") returned 0
	[0135.103] lstrlenA (lpString="*.xls") returned 5
	[0135.103] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3", pszSpec="*.xlsx") returned 0
	[0135.103] lstrlenA (lpString="*.xlsx") returned 6
	[0135.103] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3", pszSpec="*.ppt") returned 0
	[0135.103] lstrlenA (lpString="*.ppt") returned 5
	[0135.103] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3", pszSpec="*.pptx") returned 0
	[0135.103] lstrlenA (lpString="*.pptx") returned 6
	[0135.103] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3", pszSpec="*.txt") returned 0
	[0135.103] lstrlenA (lpString="*.txt") returned 5
	[0135.103] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3", pszSpec="*.pdf") returned 0
	[0135.103] lstrlenA (lpString="*.pdf") returned 5
	[0135.103] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3", pszSpec="*.htm") returned 0
	[0135.103] lstrlenA (lpString="*.htm") returned 5
	[0135.103] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3", pszSpec="*.html") returned 0
	[0135.103] lstrlenA (lpString="*.html") returned 6
	[0135.103] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3", pszSpec="*.mdb") returned 0
	[0135.103] lstrlenA (lpString="*.mdb") returned 5
	[0135.104] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3", pszSpec="*.pfx") returned 0
	[0135.104] lstrlenA (lpString="*.pfx") returned 5
	[0135.104] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3", pszSpec="*.md") returned 0
	[0135.104] lstrlenA (lpString="*.md") returned 4
	[0135.104] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3", pszSpec="*.lnk") returned 0
	[0135.104] lstrlenA (lpString="*.lnk") returned 5
	[0135.104] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3", pszSpec="*.torrent") returned 0
	[0135.104] lstrlenA (lpString="*.torrent") returned 9
	[0135.104] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3", pszSpec="*.mov") returned 0
	[0135.104] lstrlenA (lpString="*.mov") returned 5
	[0135.104] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3", pszSpec="*.3gp") returned 0
	[0135.104] lstrlenA (lpString="*.3gp") returned 5
	[0135.104] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3", pszSpec="*.mpeg") returned 0
	[0135.104] lstrlenA (lpString="*.mpeg") returned 6
	[0135.104] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3", pszSpec="*.mpg") returned 0
	[0135.104] lstrlenA (lpString="*.mpg") returned 5
	[0135.104] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3", pszSpec="*.flv") returned 0
	[0135.104] lstrlenA (lpString="*.flv") returned 5
	[0135.104] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3", pszSpec="*.avi") returned 0
	[0135.104] lstrlenA (lpString="*.avi") returned 5
	[0135.104] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3", pszSpec="*.mp4") returned 0
	[0135.104] lstrlenA (lpString="*.mp4") returned 5
	[0135.104] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3", pszSpec="*.wmv") returned 0
	[0135.104] lstrlenA (lpString="*.wmv") returned 5
	[0135.104] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3", pszSpec="*.mkv") returned 0
	[0135.104] lstrlenA (lpString="*.mkv") returned 5
	[0135.104] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3", pszSpec="*.mp3") returned 1
	[0135.104] lstrlenA (lpString="*.mp3") returned 5
	[0135.104] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3"
	[0135.104] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3"
	[0135.104] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3.") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3."
	[0135.104] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3.exe") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3.exe"
	[0135.104] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\6rbihn\\cxfyh86mjhv.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0135.105] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x144d4
	[0135.105] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7cbcb390, dwHighDateTime=0x1d4d199), lpLastAccessTime=0x407536*(dwLowDateTime=0xebcce5a0, dwHighDateTime=0x1d4d579), lpLastWriteTime=0x40753e*(dwLowDateTime=0xebcce5a0, dwHighDateTime=0x1d4d579)) returned 1
	[0135.105] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.105] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x14492, lpOverlapped=0x0) returned 1
	[0135.106] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3") returned="cXFYH86MJHV.mp3"
	[0135.106] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.106] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x14492, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x14492, lpOverlapped=0x0) returned 1
	[0135.107] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.107] CloseHandle (hObject=0x214) returned 1
	[0135.107] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\6rbihn\\cxfyh86mjhv.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3.exe" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\6rbihn\\cxfyh86mjhv.mp3.exe")) returned 1
	[0135.107] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64b4b890, ftCreationTime.dwHighDateTime=0x1d4cd9a, ftLastAccessTime.dwLowDateTime=0x977b3860, ftLastAccessTime.dwHighDateTime=0x1d4d23d, ftLastWriteTime.dwLowDateTime=0x977b3860, ftLastWriteTime.dwHighDateTime=0x1d4d23d, nFileSizeHigh=0x0, nFileSizeLow=0x97da, dwReserved0=0x0, dwReserved1=0x1, cFileName="iKI1H4n.mp3", cAlternateFileName="")) returned 1
	[0135.107] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0135.107] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="iKI1H4n.mp3") returned -1
	[0135.108] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="iKI1H4n.mp3") returned -1
	[0135.108] lstrcmpiA (lpString1="", lpString2="iKI1H4n.mp3") returned -1
	[0135.108] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\cXFYH86MJHV.mp3") returned="cXFYH86MJHV.mp3"
	[0135.108] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\"
	[0135.108] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\") returned=""
	[0135.108] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.108] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\6rbihn\\how-to-decrypt-files.htm")) returned 0x20
	[0135.108] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\", lpString2="iKI1H4n.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3"
	[0135.108] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3", pszSpec="*.zip") returned 0
	[0135.108] lstrlenA (lpString="*.zip") returned 5
	[0135.108] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3", pszSpec="*.rar") returned 0
	[0135.108] lstrlenA (lpString="*.rar") returned 5
	[0135.108] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3", pszSpec="*.7z") returned 0
	[0135.108] lstrlenA (lpString="*.7z") returned 4
	[0135.108] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3", pszSpec="*.tar") returned 0
	[0135.108] lstrlenA (lpString="*.tar") returned 5
	[0135.108] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3", pszSpec="*.gzip") returned 0
	[0135.108] lstrlenA (lpString="*.gzip") returned 6
	[0135.108] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3", pszSpec="*.jpg") returned 0
	[0135.108] lstrlenA (lpString="*.jpg") returned 5
	[0135.108] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3", pszSpec="*.jpeg") returned 0
	[0135.108] lstrlenA (lpString="*.jpeg") returned 6
	[0135.108] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3", pszSpec="*.bmp") returned 0
	[0135.108] lstrlenA (lpString="*.bmp") returned 5
	[0135.108] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3", pszSpec="*.gif") returned 0
	[0135.108] lstrlenA (lpString="*.gif") returned 5
	[0135.108] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3", pszSpec="*.png") returned 0
	[0135.108] lstrlenA (lpString="*.png") returned 5
	[0135.108] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3", pszSpec="*.doc") returned 0
	[0135.108] lstrlenA (lpString="*.doc") returned 5
	[0135.108] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3", pszSpec="*.docx") returned 0
	[0135.109] lstrlenA (lpString="*.docx") returned 6
	[0135.109] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3", pszSpec="*.xls") returned 0
	[0135.109] lstrlenA (lpString="*.xls") returned 5
	[0135.109] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3", pszSpec="*.xlsx") returned 0
	[0135.109] lstrlenA (lpString="*.xlsx") returned 6
	[0135.109] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3", pszSpec="*.ppt") returned 0
	[0135.109] lstrlenA (lpString="*.ppt") returned 5
	[0135.109] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3", pszSpec="*.pptx") returned 0
	[0135.109] lstrlenA (lpString="*.pptx") returned 6
	[0135.109] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3", pszSpec="*.txt") returned 0
	[0135.109] lstrlenA (lpString="*.txt") returned 5
	[0135.109] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3", pszSpec="*.pdf") returned 0
	[0135.109] lstrlenA (lpString="*.pdf") returned 5
	[0135.109] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3", pszSpec="*.htm") returned 0
	[0135.109] lstrlenA (lpString="*.htm") returned 5
	[0135.109] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3", pszSpec="*.html") returned 0
	[0135.109] lstrlenA (lpString="*.html") returned 6
	[0135.109] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3", pszSpec="*.mdb") returned 0
	[0135.109] lstrlenA (lpString="*.mdb") returned 5
	[0135.109] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3", pszSpec="*.pfx") returned 0
	[0135.109] lstrlenA (lpString="*.pfx") returned 5
	[0135.109] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3", pszSpec="*.md") returned 0
	[0135.109] lstrlenA (lpString="*.md") returned 4
	[0135.109] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3", pszSpec="*.lnk") returned 0
	[0135.109] lstrlenA (lpString="*.lnk") returned 5
	[0135.109] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3", pszSpec="*.torrent") returned 0
	[0135.109] lstrlenA (lpString="*.torrent") returned 9
	[0135.109] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3", pszSpec="*.mov") returned 0
	[0135.109] lstrlenA (lpString="*.mov") returned 5
	[0135.109] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3", pszSpec="*.3gp") returned 0
	[0135.109] lstrlenA (lpString="*.3gp") returned 5
	[0135.109] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3", pszSpec="*.mpeg") returned 0
	[0135.109] lstrlenA (lpString="*.mpeg") returned 6
	[0135.109] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3", pszSpec="*.mpg") returned 0
	[0135.109] lstrlenA (lpString="*.mpg") returned 5
	[0135.109] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3", pszSpec="*.flv") returned 0
	[0135.110] lstrlenA (lpString="*.flv") returned 5
	[0135.110] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3", pszSpec="*.avi") returned 0
	[0135.110] lstrlenA (lpString="*.avi") returned 5
	[0135.110] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3", pszSpec="*.mp4") returned 0
	[0135.110] lstrlenA (lpString="*.mp4") returned 5
	[0135.110] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3", pszSpec="*.wmv") returned 0
	[0135.110] lstrlenA (lpString="*.wmv") returned 5
	[0135.110] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3", pszSpec="*.mkv") returned 0
	[0135.110] lstrlenA (lpString="*.mkv") returned 5
	[0135.110] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3", pszSpec="*.mp3") returned 1
	[0135.110] lstrlenA (lpString="*.mp3") returned 5
	[0135.110] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3"
	[0135.110] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3"
	[0135.110] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3.") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3."
	[0135.110] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3.exe") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3.exe"
	[0135.110] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\6rbihn\\iki1h4n.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0135.110] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x97da
	[0135.110] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x64b4b890, dwHighDateTime=0x1d4cd9a), lpLastAccessTime=0x407536*(dwLowDateTime=0x977b3860, dwHighDateTime=0x1d4d23d), lpLastWriteTime=0x40753e*(dwLowDateTime=0x977b3860, dwHighDateTime=0x1d4d23d)) returned 1
	[0135.110] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.110] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x9798, lpOverlapped=0x0) returned 1
	[0135.111] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3") returned="iKI1H4n.mp3"
	[0135.111] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.111] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x9798, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x9798, lpOverlapped=0x0) returned 1
	[0135.112] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.112] CloseHandle (hObject=0x214) returned 1
	[0135.112] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\6rbihn\\iki1h4n.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3.exe" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\6rbihn\\iki1h4n.mp3.exe")) returned 1
	[0135.112] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf759a030, ftCreationTime.dwHighDateTime=0x1d4cc90, ftLastAccessTime.dwLowDateTime=0xdcc14780, ftLastAccessTime.dwHighDateTime=0x1d4d430, ftLastWriteTime.dwLowDateTime=0xdcc14780, ftLastWriteTime.dwHighDateTime=0x1d4d430, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x1, cFileName="tORFHhdkHQ.wav", cAlternateFileName="TORFHH~1.WAV")) returned 1
	[0135.113] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0135.113] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="tORFHhdkHQ.wav") returned -1
	[0135.113] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="tORFHhdkHQ.wav") returned -1
	[0135.113] lstrcmpiA (lpString1="", lpString2="tORFHhdkHQ.wav") returned -1
	[0135.113] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\iKI1H4n.mp3") returned="iKI1H4n.mp3"
	[0135.113] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\"
	[0135.113] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\") returned=""
	[0135.113] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.113] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\6rbihn\\how-to-decrypt-files.htm")) returned 0x20
	[0135.113] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\", lpString2="tORFHhdkHQ.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav"
	[0135.113] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav", pszSpec="*.zip") returned 0
	[0135.113] lstrlenA (lpString="*.zip") returned 5
	[0135.113] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav", pszSpec="*.rar") returned 0
	[0135.113] lstrlenA (lpString="*.rar") returned 5
	[0135.113] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav", pszSpec="*.7z") returned 0
	[0135.113] lstrlenA (lpString="*.7z") returned 4
	[0135.113] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav", pszSpec="*.tar") returned 0
	[0135.113] lstrlenA (lpString="*.tar") returned 5
	[0135.113] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav", pszSpec="*.gzip") returned 0
	[0135.113] lstrlenA (lpString="*.gzip") returned 6
	[0135.113] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav", pszSpec="*.jpg") returned 0
	[0135.113] lstrlenA (lpString="*.jpg") returned 5
	[0135.113] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav", pszSpec="*.jpeg") returned 0
	[0135.113] lstrlenA (lpString="*.jpeg") returned 6
	[0135.113] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav", pszSpec="*.bmp") returned 0
	[0135.113] lstrlenA (lpString="*.bmp") returned 5
	[0135.113] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav", pszSpec="*.gif") returned 0
	[0135.113] lstrlenA (lpString="*.gif") returned 5
	[0135.113] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav", pszSpec="*.png") returned 0
	[0135.113] lstrlenA (lpString="*.png") returned 5
	[0135.113] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav", pszSpec="*.doc") returned 0
	[0135.114] lstrlenA (lpString="*.doc") returned 5
	[0135.114] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav", pszSpec="*.docx") returned 0
	[0135.114] lstrlenA (lpString="*.docx") returned 6
	[0135.114] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav", pszSpec="*.xls") returned 0
	[0135.114] lstrlenA (lpString="*.xls") returned 5
	[0135.114] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav", pszSpec="*.xlsx") returned 0
	[0135.114] lstrlenA (lpString="*.xlsx") returned 6
	[0135.114] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav", pszSpec="*.ppt") returned 0
	[0135.114] lstrlenA (lpString="*.ppt") returned 5
	[0135.114] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav", pszSpec="*.pptx") returned 0
	[0135.114] lstrlenA (lpString="*.pptx") returned 6
	[0135.114] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav", pszSpec="*.txt") returned 0
	[0135.114] lstrlenA (lpString="*.txt") returned 5
	[0135.114] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav", pszSpec="*.pdf") returned 0
	[0135.114] lstrlenA (lpString="*.pdf") returned 5
	[0135.114] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav", pszSpec="*.htm") returned 0
	[0135.114] lstrlenA (lpString="*.htm") returned 5
	[0135.114] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav", pszSpec="*.html") returned 0
	[0135.114] lstrlenA (lpString="*.html") returned 6
	[0135.114] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav", pszSpec="*.mdb") returned 0
	[0135.114] lstrlenA (lpString="*.mdb") returned 5
	[0135.114] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav", pszSpec="*.pfx") returned 0
	[0135.114] lstrlenA (lpString="*.pfx") returned 5
	[0135.114] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav", pszSpec="*.md") returned 0
	[0135.114] lstrlenA (lpString="*.md") returned 4
	[0135.114] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav", pszSpec="*.lnk") returned 0
	[0135.114] lstrlenA (lpString="*.lnk") returned 5
	[0135.114] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav", pszSpec="*.torrent") returned 0
	[0135.114] lstrlenA (lpString="*.torrent") returned 9
	[0135.114] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav", pszSpec="*.mov") returned 0
	[0135.114] lstrlenA (lpString="*.mov") returned 5
	[0135.114] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav", pszSpec="*.3gp") returned 0
	[0135.114] lstrlenA (lpString="*.3gp") returned 5
	[0135.114] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav", pszSpec="*.mpeg") returned 0
	[0135.115] lstrlenA (lpString="*.mpeg") returned 6
	[0135.115] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav", pszSpec="*.mpg") returned 0
	[0135.115] lstrlenA (lpString="*.mpg") returned 5
	[0135.115] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav", pszSpec="*.flv") returned 0
	[0135.115] lstrlenA (lpString="*.flv") returned 5
	[0135.115] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav", pszSpec="*.avi") returned 0
	[0135.115] lstrlenA (lpString="*.avi") returned 5
	[0135.115] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav", pszSpec="*.mp4") returned 0
	[0135.115] lstrlenA (lpString="*.mp4") returned 5
	[0135.115] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav", pszSpec="*.wmv") returned 0
	[0135.115] lstrlenA (lpString="*.wmv") returned 5
	[0135.115] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav", pszSpec="*.mkv") returned 0
	[0135.115] lstrlenA (lpString="*.mkv") returned 5
	[0135.115] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav", pszSpec="*.mp3") returned 0
	[0135.115] lstrlenA (lpString="*.mp3") returned 5
	[0135.115] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav", pszSpec="*.wav") returned 1
	[0135.115] lstrlenA (lpString="*.wav") returned 5
	[0135.115] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav"
	[0135.115] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav"
	[0135.115] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav.") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav."
	[0135.115] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav.exe") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav.exe"
	[0135.115] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\6rbihn\\torfhhdkhq.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0135.115] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x74e6
	[0135.115] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf759a030, dwHighDateTime=0x1d4cc90), lpLastAccessTime=0x407536*(dwLowDateTime=0xdcc14780, dwHighDateTime=0x1d4d430), lpLastWriteTime=0x40753e*(dwLowDateTime=0xdcc14780, dwHighDateTime=0x1d4d430)) returned 1
	[0135.116] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.116] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x74a4, lpOverlapped=0x0) returned 1
	[0135.116] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav") returned="tORFHhdkHQ.wav"
	[0135.117] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.117] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x74a4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x74a4, lpOverlapped=0x0) returned 1
	[0135.117] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.122] CloseHandle (hObject=0x214) returned 1
	[0135.122] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\6rbihn\\torfhhdkhq.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\6rbIhn\\tORFHhdkHQ.wav.exe" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\6rbihn\\torfhhdkhq.wav.exe")) returned 1
	[0135.123] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf759a030, ftCreationTime.dwHighDateTime=0x1d4cc90, ftLastAccessTime.dwLowDateTime=0xdcc14780, ftLastAccessTime.dwHighDateTime=0x1d4d430, ftLastWriteTime.dwLowDateTime=0xdcc14780, ftLastWriteTime.dwHighDateTime=0x1d4d430, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x1, cFileName="tORFHhdkHQ.wav", cAlternateFileName="TORFHH~1.WAV")) returned 0
	[0135.123] FindClose (in: hFindFile=0x7cb650 | out: hFindFile=0x7cb650) returned 1
	[0135.123] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa689da70, ftCreationTime.dwHighDateTime=0x1d4c6a6, ftLastAccessTime.dwLowDateTime=0xb36f6c60, ftLastAccessTime.dwHighDateTime=0x1d4d244, ftLastWriteTime.dwLowDateTime=0xb36f6c60, ftLastWriteTime.dwHighDateTime=0x1d4d244, nFileSizeHigh=0x0, nFileSizeLow=0x17a49, dwReserved0=0x7b0260, dwReserved1=0x1000000, cFileName="atfjcCBXW9fwwxL.mp3", cAlternateFileName="ATFJCC~1.MP3")) returned 1
	[0135.123] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0135.123] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="atfjcCBXW9fwwxL.mp3") returned 1
	[0135.123] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="atfjcCBXW9fwwxL.mp3") returned 1
	[0135.123] lstrcmpiA (lpString1="", lpString2="atfjcCBXW9fwwxL.mp3") returned -1
	[0135.123] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\*.*") returned="*.*"
	[0135.123] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\"
	[0135.123] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\") returned=""
	[0135.123] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.123] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0135.123] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0135.124] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0135.124] WriteFile (in: hFile=0x210, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0135.125] SetFileTime (hFile=0x210, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0135.125] CloseHandle (hObject=0x210) returned 1
	[0135.125] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\", lpString2="atfjcCBXW9fwwxL.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3"
	[0135.125] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3", pszSpec="*.zip") returned 0
	[0135.125] lstrlenA (lpString="*.zip") returned 5
	[0135.125] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3", pszSpec="*.rar") returned 0
	[0135.125] lstrlenA (lpString="*.rar") returned 5
	[0135.125] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3", pszSpec="*.7z") returned 0
	[0135.125] lstrlenA (lpString="*.7z") returned 4
	[0135.125] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3", pszSpec="*.tar") returned 0
	[0135.125] lstrlenA (lpString="*.tar") returned 5
	[0135.125] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3", pszSpec="*.gzip") returned 0
	[0135.125] lstrlenA (lpString="*.gzip") returned 6
	[0135.125] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3", pszSpec="*.jpg") returned 0
	[0135.125] lstrlenA (lpString="*.jpg") returned 5
	[0135.125] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3", pszSpec="*.jpeg") returned 0
	[0135.125] lstrlenA (lpString="*.jpeg") returned 6
	[0135.125] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3", pszSpec="*.bmp") returned 0
	[0135.125] lstrlenA (lpString="*.bmp") returned 5
	[0135.125] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3", pszSpec="*.gif") returned 0
	[0135.125] lstrlenA (lpString="*.gif") returned 5
	[0135.125] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3", pszSpec="*.png") returned 0
	[0135.125] lstrlenA (lpString="*.png") returned 5
	[0135.125] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3", pszSpec="*.doc") returned 0
	[0135.125] lstrlenA (lpString="*.doc") returned 5
	[0135.126] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3", pszSpec="*.docx") returned 0
	[0135.126] lstrlenA (lpString="*.docx") returned 6
	[0135.126] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3", pszSpec="*.xls") returned 0
	[0135.126] lstrlenA (lpString="*.xls") returned 5
	[0135.126] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3", pszSpec="*.xlsx") returned 0
	[0135.126] lstrlenA (lpString="*.xlsx") returned 6
	[0135.126] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3", pszSpec="*.ppt") returned 0
	[0135.126] lstrlenA (lpString="*.ppt") returned 5
	[0135.126] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3", pszSpec="*.pptx") returned 0
	[0135.126] lstrlenA (lpString="*.pptx") returned 6
	[0135.126] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3", pszSpec="*.txt") returned 0
	[0135.126] lstrlenA (lpString="*.txt") returned 5
	[0135.126] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3", pszSpec="*.pdf") returned 0
	[0135.126] lstrlenA (lpString="*.pdf") returned 5
	[0135.126] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3", pszSpec="*.htm") returned 0
	[0135.126] lstrlenA (lpString="*.htm") returned 5
	[0135.126] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3", pszSpec="*.html") returned 0
	[0135.126] lstrlenA (lpString="*.html") returned 6
	[0135.126] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3", pszSpec="*.mdb") returned 0
	[0135.126] lstrlenA (lpString="*.mdb") returned 5
	[0135.126] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3", pszSpec="*.pfx") returned 0
	[0135.126] lstrlenA (lpString="*.pfx") returned 5
	[0135.126] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3", pszSpec="*.md") returned 0
	[0135.126] lstrlenA (lpString="*.md") returned 4
	[0135.126] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3", pszSpec="*.lnk") returned 0
	[0135.126] lstrlenA (lpString="*.lnk") returned 5
	[0135.126] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3", pszSpec="*.torrent") returned 0
	[0135.126] lstrlenA (lpString="*.torrent") returned 9
	[0135.126] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3", pszSpec="*.mov") returned 0
	[0135.126] lstrlenA (lpString="*.mov") returned 5
	[0135.126] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3", pszSpec="*.3gp") returned 0
	[0135.126] lstrlenA (lpString="*.3gp") returned 5
	[0135.126] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3", pszSpec="*.mpeg") returned 0
	[0135.126] lstrlenA (lpString="*.mpeg") returned 6
	[0135.126] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3", pszSpec="*.mpg") returned 0
	[0135.127] lstrlenA (lpString="*.mpg") returned 5
	[0135.127] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3", pszSpec="*.flv") returned 0
	[0135.127] lstrlenA (lpString="*.flv") returned 5
	[0135.127] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3", pszSpec="*.avi") returned 0
	[0135.127] lstrlenA (lpString="*.avi") returned 5
	[0135.127] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3", pszSpec="*.mp4") returned 0
	[0135.127] lstrlenA (lpString="*.mp4") returned 5
	[0135.127] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3", pszSpec="*.wmv") returned 0
	[0135.127] lstrlenA (lpString="*.wmv") returned 5
	[0135.127] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3", pszSpec="*.mkv") returned 0
	[0135.127] lstrlenA (lpString="*.mkv") returned 5
	[0135.127] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3", pszSpec="*.mp3") returned 1
	[0135.127] lstrlenA (lpString="*.mp3") returned 5
	[0135.127] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3"
	[0135.127] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3"
	[0135.127] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3.") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3."
	[0135.127] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3.exe") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3.exe"
	[0135.127] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\atfjccbxw9fwwxl.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0135.127] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17a49
	[0135.127] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa689da70, dwHighDateTime=0x1d4c6a6), lpLastAccessTime=0x407536*(dwLowDateTime=0xb36f6c60, dwHighDateTime=0x1d4d244), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb36f6c60, dwHighDateTime=0x1d4d244)) returned 1
	[0135.127] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.127] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x17a07, lpOverlapped=0x0) returned 1
	[0135.129] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3") returned="atfjcCBXW9fwwxL.mp3"
	[0135.129] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.129] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x17a07, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x17a07, lpOverlapped=0x0) returned 1
	[0135.129] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.129] CloseHandle (hObject=0x210) returned 1
	[0135.130] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\atfjccbxw9fwwxl.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3.exe" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\atfjccbxw9fwwxl.mp3.exe")) returned 1
	[0135.130] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf69314c0, ftCreationTime.dwHighDateTime=0x1d4d347, ftLastAccessTime.dwLowDateTime=0xd9c0750, ftLastAccessTime.dwHighDateTime=0x1d4d30a, ftLastWriteTime.dwLowDateTime=0xd9c0750, ftLastWriteTime.dwHighDateTime=0x1d4d30a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="kPFqZ", cAlternateFileName="")) returned 1
	[0135.130] lstrcmpA (lpString1=".", lpString2="kPFqZ") returned -1
	[0135.130] lstrcmpA (lpString1="..", lpString2="kPFqZ") returned -1
	[0135.130] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\atfjcCBXW9fwwxL.mp3") returned="atfjcCBXW9fwwxL.mp3"
	[0135.130] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\", lpString2="kPFqZ" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ"
	[0135.130] lstrlenA (lpString="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ") returned 43
	[0135.130] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf69314c0, ftCreationTime.dwHighDateTime=0x1d4d347, ftLastAccessTime.dwLowDateTime=0xd9c0750, ftLastAccessTime.dwHighDateTime=0x1d4d30a, ftLastWriteTime.dwLowDateTime=0xd9c0750, ftLastWriteTime.dwHighDateTime=0x1d4d30a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName=".", cAlternateFileName="")) returned 0x7cbbd0
	[0135.130] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0135.130] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf69314c0, ftCreationTime.dwHighDateTime=0x1d4d347, ftLastAccessTime.dwLowDateTime=0xd9c0750, ftLastAccessTime.dwHighDateTime=0x1d4d30a, ftLastWriteTime.dwLowDateTime=0xd9c0750, ftLastWriteTime.dwHighDateTime=0x1d4d30a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="..", cAlternateFileName="")) returned 1
	[0135.131] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0135.131] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0135.131] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b36d1c0, ftCreationTime.dwHighDateTime=0x1d4d3a6, ftLastAccessTime.dwLowDateTime=0x821c33d0, ftLastAccessTime.dwHighDateTime=0x1d4d250, ftLastWriteTime.dwLowDateTime=0x821c33d0, ftLastWriteTime.dwHighDateTime=0x1d4d250, nFileSizeHigh=0x0, nFileSizeLow=0xc4b3, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="5fmstzDpGLAWOYy.m4a", cAlternateFileName="5FMSTZ~1.M4A")) returned 1
	[0135.131] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0135.131] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="5fmstzDpGLAWOYy.m4a") returned 1
	[0135.131] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="5fmstzDpGLAWOYy.m4a") returned 1
	[0135.131] lstrcmpiA (lpString1="", lpString2="5fmstzDpGLAWOYy.m4a") returned -1
	[0135.131] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\*.*") returned="*.*"
	[0135.131] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\"
	[0135.131] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\") returned=""
	[0135.131] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.131] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\kpfqz\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0135.131] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\kpfqz\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0135.135] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0135.135] WriteFile (in: hFile=0x214, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0135.136] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0135.136] CloseHandle (hObject=0x214) returned 1
	[0135.136] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\", lpString2="5fmstzDpGLAWOYy.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a"
	[0135.136] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.zip") returned 0
	[0135.136] lstrlenA (lpString="*.zip") returned 5
	[0135.136] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.rar") returned 0
	[0135.136] lstrlenA (lpString="*.rar") returned 5
	[0135.136] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.7z") returned 0
	[0135.136] lstrlenA (lpString="*.7z") returned 4
	[0135.136] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.tar") returned 0
	[0135.136] lstrlenA (lpString="*.tar") returned 5
	[0135.136] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.gzip") returned 0
	[0135.136] lstrlenA (lpString="*.gzip") returned 6
	[0135.136] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.jpg") returned 0
	[0135.136] lstrlenA (lpString="*.jpg") returned 5
	[0135.136] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.jpeg") returned 0
	[0135.136] lstrlenA (lpString="*.jpeg") returned 6
	[0135.136] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.bmp") returned 0
	[0135.136] lstrlenA (lpString="*.bmp") returned 5
	[0135.136] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.gif") returned 0
	[0135.136] lstrlenA (lpString="*.gif") returned 5
	[0135.136] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.png") returned 0
	[0135.136] lstrlenA (lpString="*.png") returned 5
	[0135.136] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.doc") returned 0
	[0135.136] lstrlenA (lpString="*.doc") returned 5
	[0135.136] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.docx") returned 0
	[0135.136] lstrlenA (lpString="*.docx") returned 6
	[0135.137] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.xls") returned 0
	[0135.137] lstrlenA (lpString="*.xls") returned 5
	[0135.137] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.xlsx") returned 0
	[0135.137] lstrlenA (lpString="*.xlsx") returned 6
	[0135.137] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.ppt") returned 0
	[0135.137] lstrlenA (lpString="*.ppt") returned 5
	[0135.137] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.pptx") returned 0
	[0135.137] lstrlenA (lpString="*.pptx") returned 6
	[0135.137] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.txt") returned 0
	[0135.137] lstrlenA (lpString="*.txt") returned 5
	[0135.137] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.pdf") returned 0
	[0135.137] lstrlenA (lpString="*.pdf") returned 5
	[0135.137] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.htm") returned 0
	[0135.137] lstrlenA (lpString="*.htm") returned 5
	[0135.137] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.html") returned 0
	[0135.137] lstrlenA (lpString="*.html") returned 6
	[0135.137] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.mdb") returned 0
	[0135.137] lstrlenA (lpString="*.mdb") returned 5
	[0135.137] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.pfx") returned 0
	[0135.137] lstrlenA (lpString="*.pfx") returned 5
	[0135.137] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.md") returned 0
	[0135.137] lstrlenA (lpString="*.md") returned 4
	[0135.137] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.lnk") returned 0
	[0135.137] lstrlenA (lpString="*.lnk") returned 5
	[0135.137] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.torrent") returned 0
	[0135.137] lstrlenA (lpString="*.torrent") returned 9
	[0135.137] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.mov") returned 0
	[0135.137] lstrlenA (lpString="*.mov") returned 5
	[0135.137] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.3gp") returned 0
	[0135.137] lstrlenA (lpString="*.3gp") returned 5
	[0135.137] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.mpeg") returned 0
	[0135.137] lstrlenA (lpString="*.mpeg") returned 6
	[0135.137] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.mpg") returned 0
	[0135.137] lstrlenA (lpString="*.mpg") returned 5
	[0135.137] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.flv") returned 0
	[0135.137] lstrlenA (lpString="*.flv") returned 5
	[0135.138] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.avi") returned 0
	[0135.138] lstrlenA (lpString="*.avi") returned 5
	[0135.138] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.mp4") returned 0
	[0135.138] lstrlenA (lpString="*.mp4") returned 5
	[0135.138] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.wmv") returned 0
	[0135.138] lstrlenA (lpString="*.wmv") returned 5
	[0135.138] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.mkv") returned 0
	[0135.138] lstrlenA (lpString="*.mkv") returned 5
	[0135.138] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.mp3") returned 0
	[0135.138] lstrlenA (lpString="*.mp3") returned 5
	[0135.138] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.wav") returned 0
	[0135.138] lstrlenA (lpString="*.wav") returned 5
	[0135.138] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.flac") returned 0
	[0135.138] lstrlenA (lpString="*.flac") returned 6
	[0135.138] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.wma") returned 0
	[0135.138] lstrlenA (lpString="*.wma") returned 5
	[0135.138] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.au3") returned 0
	[0135.138] lstrlenA (lpString="*.au3") returned 5
	[0135.138] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.ahk") returned 0
	[0135.138] lstrlenA (lpString="*.ahk") returned 5
	[0135.138] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.c") returned 0
	[0135.138] lstrlenA (lpString="*.c") returned 3
	[0135.138] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.cc") returned 0
	[0135.138] lstrlenA (lpString="*.cc") returned 4
	[0135.138] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.cpp") returned 0
	[0135.138] lstrlenA (lpString="*.cpp") returned 5
	[0135.138] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.cxx") returned 0
	[0135.138] lstrlenA (lpString="*.cxx") returned 5
	[0135.138] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.c++") returned 0
	[0135.138] lstrlenA (lpString="*.c++") returned 5
	[0135.138] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.cs") returned 0
	[0135.138] lstrlenA (lpString="*.cs") returned 4
	[0135.138] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.vb") returned 0
	[0135.138] lstrlenA (lpString="*.vb") returned 4
	[0135.138] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.bas") returned 0
	[0135.139] lstrlenA (lpString="*.bas") returned 5
	[0135.139] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.csproj") returned 0
	[0135.139] lstrlenA (lpString="*.csproj") returned 8
	[0135.139] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.vbproj") returned 0
	[0135.139] lstrlenA (lpString="*.vbproj") returned 8
	[0135.139] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.vcxproj") returned 0
	[0135.139] lstrlenA (lpString="*.vcxproj") returned 9
	[0135.139] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.manifest") returned 0
	[0135.139] lstrlenA (lpString="*.manifest") returned 10
	[0135.139] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.php") returned 0
	[0135.139] lstrlenA (lpString="*.php") returned 5
	[0135.139] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.vbe") returned 0
	[0135.139] lstrlenA (lpString="*.vbe") returned 5
	[0135.139] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.vba") returned 0
	[0135.139] lstrlenA (lpString="*.vba") returned 5
	[0135.139] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.vbs") returned 0
	[0135.139] lstrlenA (lpString="*.vbs") returned 5
	[0135.139] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.bat") returned 0
	[0135.139] lstrlenA (lpString="*.bat") returned 5
	[0135.139] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.cmd") returned 0
	[0135.139] lstrlenA (lpString="*.cmd") returned 5
	[0135.139] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.js") returned 0
	[0135.139] lstrlenA (lpString="*.js") returned 4
	[0135.139] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.jscript") returned 0
	[0135.139] lstrlenA (lpString="*.jscript") returned 9
	[0135.139] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.hta") returned 0
	[0135.139] lstrlenA (lpString="*.hta") returned 5
	[0135.139] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.php7") returned 0
	[0135.139] lstrlenA (lpString="*.php7") returned 6
	[0135.139] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.db") returned 0
	[0135.139] lstrlenA (lpString="*.db") returned 4
	[0135.139] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.swf") returned 0
	[0135.139] lstrlenA (lpString="*.swf") returned 5
	[0135.139] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.eml") returned 0
	[0135.140] lstrlenA (lpString="*.eml") returned 5
	[0135.140] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.part") returned 0
	[0135.140] lstrlenA (lpString="*.part") returned 6
	[0135.140] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.nfo") returned 0
	[0135.140] lstrlenA (lpString="*.nfo") returned 5
	[0135.140] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.rsa") returned 0
	[0135.140] lstrlenA (lpString="*.rsa") returned 5
	[0135.140] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.key") returned 0
	[0135.140] lstrlenA (lpString="*.key") returned 5
	[0135.140] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.aes") returned 0
	[0135.140] lstrlenA (lpString="*.aes") returned 5
	[0135.140] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.blob") returned 0
	[0135.140] lstrlenA (lpString="*.blob") returned 6
	[0135.140] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.btc") returned 0
	[0135.140] lstrlenA (lpString="*.btc") returned 5
	[0135.140] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a", pszSpec="*.wallet") returned 0
	[0135.140] lstrlenA (lpString="*.wallet") returned 8
	[0135.140] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7db23210, ftCreationTime.dwHighDateTime=0x1d4cb41, ftLastAccessTime.dwLowDateTime=0x27ec1c50, ftLastAccessTime.dwHighDateTime=0x1d4d2d1, ftLastWriteTime.dwLowDateTime=0x27ec1c50, ftLastWriteTime.dwHighDateTime=0x1d4d2d1, nFileSizeHigh=0x0, nFileSizeLow=0x170b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="a5ZVQwSnbNnbraZsk7F.mp3", cAlternateFileName="A5ZVQW~1.MP3")) returned 1
	[0135.140] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0135.140] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="a5ZVQwSnbNnbraZsk7F.mp3") returned 1
	[0135.140] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="a5ZVQwSnbNnbraZsk7F.mp3") returned 1
	[0135.140] lstrcmpiA (lpString1="", lpString2="a5ZVQwSnbNnbraZsk7F.mp3") returned -1
	[0135.140] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\5fmstzDpGLAWOYy.m4a") returned="5fmstzDpGLAWOYy.m4a"
	[0135.140] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\"
	[0135.140] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\") returned=""
	[0135.140] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.140] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\kpfqz\\how-to-decrypt-files.htm")) returned 0x20
	[0135.140] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\", lpString2="a5ZVQwSnbNnbraZsk7F.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3"
	[0135.140] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3", pszSpec="*.zip") returned 0
	[0135.140] lstrlenA (lpString="*.zip") returned 5
	[0135.140] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3", pszSpec="*.rar") returned 0
	[0135.140] lstrlenA (lpString="*.rar") returned 5
	[0135.140] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3", pszSpec="*.7z") returned 0
	[0135.141] lstrlenA (lpString="*.7z") returned 4
	[0135.141] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3", pszSpec="*.tar") returned 0
	[0135.141] lstrlenA (lpString="*.tar") returned 5
	[0135.141] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3", pszSpec="*.gzip") returned 0
	[0135.141] lstrlenA (lpString="*.gzip") returned 6
	[0135.141] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3", pszSpec="*.jpg") returned 0
	[0135.141] lstrlenA (lpString="*.jpg") returned 5
	[0135.141] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3", pszSpec="*.jpeg") returned 0
	[0135.141] lstrlenA (lpString="*.jpeg") returned 6
	[0135.141] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3", pszSpec="*.bmp") returned 0
	[0135.141] lstrlenA (lpString="*.bmp") returned 5
	[0135.141] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3", pszSpec="*.gif") returned 0
	[0135.141] lstrlenA (lpString="*.gif") returned 5
	[0135.141] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3", pszSpec="*.png") returned 0
	[0135.141] lstrlenA (lpString="*.png") returned 5
	[0135.141] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3", pszSpec="*.doc") returned 0
	[0135.141] lstrlenA (lpString="*.doc") returned 5
	[0135.141] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3", pszSpec="*.docx") returned 0
	[0135.141] lstrlenA (lpString="*.docx") returned 6
	[0135.141] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3", pszSpec="*.xls") returned 0
	[0135.141] lstrlenA (lpString="*.xls") returned 5
	[0135.141] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3", pszSpec="*.xlsx") returned 0
	[0135.141] lstrlenA (lpString="*.xlsx") returned 6
	[0135.141] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3", pszSpec="*.ppt") returned 0
	[0135.141] lstrlenA (lpString="*.ppt") returned 5
	[0135.141] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3", pszSpec="*.pptx") returned 0
	[0135.141] lstrlenA (lpString="*.pptx") returned 6
	[0135.141] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3", pszSpec="*.txt") returned 0
	[0135.141] lstrlenA (lpString="*.txt") returned 5
	[0135.141] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3", pszSpec="*.pdf") returned 0
	[0135.141] lstrlenA (lpString="*.pdf") returned 5
	[0135.141] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3", pszSpec="*.htm") returned 0
	[0135.141] lstrlenA (lpString="*.htm") returned 5
	[0135.141] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3", pszSpec="*.html") returned 0
	[0135.141] lstrlenA (lpString="*.html") returned 6
	[0135.142] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3", pszSpec="*.mdb") returned 0
	[0135.142] lstrlenA (lpString="*.mdb") returned 5
	[0135.142] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3", pszSpec="*.pfx") returned 0
	[0135.142] lstrlenA (lpString="*.pfx") returned 5
	[0135.142] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3", pszSpec="*.md") returned 0
	[0135.142] lstrlenA (lpString="*.md") returned 4
	[0135.142] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3", pszSpec="*.lnk") returned 0
	[0135.142] lstrlenA (lpString="*.lnk") returned 5
	[0135.142] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3", pszSpec="*.torrent") returned 0
	[0135.142] lstrlenA (lpString="*.torrent") returned 9
	[0135.142] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3", pszSpec="*.mov") returned 0
	[0135.142] lstrlenA (lpString="*.mov") returned 5
	[0135.142] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3", pszSpec="*.3gp") returned 0
	[0135.142] lstrlenA (lpString="*.3gp") returned 5
	[0135.142] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3", pszSpec="*.mpeg") returned 0
	[0135.142] lstrlenA (lpString="*.mpeg") returned 6
	[0135.142] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3", pszSpec="*.mpg") returned 0
	[0135.142] lstrlenA (lpString="*.mpg") returned 5
	[0135.142] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3", pszSpec="*.flv") returned 0
	[0135.142] lstrlenA (lpString="*.flv") returned 5
	[0135.142] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3", pszSpec="*.avi") returned 0
	[0135.142] lstrlenA (lpString="*.avi") returned 5
	[0135.142] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3", pszSpec="*.mp4") returned 0
	[0135.142] lstrlenA (lpString="*.mp4") returned 5
	[0135.142] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3", pszSpec="*.wmv") returned 0
	[0135.142] lstrlenA (lpString="*.wmv") returned 5
	[0135.142] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3", pszSpec="*.mkv") returned 0
	[0135.142] lstrlenA (lpString="*.mkv") returned 5
	[0135.142] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3", pszSpec="*.mp3") returned 1
	[0135.142] lstrlenA (lpString="*.mp3") returned 5
	[0135.142] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3"
	[0135.142] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3"
	[0135.142] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3.") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3."
	[0135.142] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3.exe") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3.exe"
	[0135.143] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\kpfqz\\a5zvqwsnbnnbrazsk7f.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0135.143] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x170b2
	[0135.143] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7db23210, dwHighDateTime=0x1d4cb41), lpLastAccessTime=0x407536*(dwLowDateTime=0x27ec1c50, dwHighDateTime=0x1d4d2d1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x27ec1c50, dwHighDateTime=0x1d4d2d1)) returned 1
	[0135.143] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.143] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x17070, lpOverlapped=0x0) returned 1
	[0135.144] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3") returned="a5ZVQwSnbNnbraZsk7F.mp3"
	[0135.144] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.145] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x17070, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x17070, lpOverlapped=0x0) returned 1
	[0135.145] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.145] CloseHandle (hObject=0x214) returned 1
	[0135.145] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\kpfqz\\a5zvqwsnbnnbrazsk7f.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3.exe" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\kpfqz\\a5zvqwsnbnnbrazsk7f.mp3.exe")) returned 1
	[0135.146] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dc7aed0, ftCreationTime.dwHighDateTime=0x1d4cf11, ftLastAccessTime.dwLowDateTime=0x348227c0, ftLastAccessTime.dwHighDateTime=0x1d4d1c3, ftLastWriteTime.dwLowDateTime=0x348227c0, ftLastWriteTime.dwHighDateTime=0x1d4d1c3, nFileSizeHigh=0x0, nFileSizeLow=0x823a, dwReserved0=0x0, dwReserved1=0x0, cFileName="amj7vZLap0H-.m4a", cAlternateFileName="AMJ7VZ~1.M4A")) returned 1
	[0135.146] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0135.146] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="amj7vZLap0H-.m4a") returned 1
	[0135.146] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="amj7vZLap0H-.m4a") returned 1
	[0135.146] lstrcmpiA (lpString1="", lpString2="amj7vZLap0H-.m4a") returned -1
	[0135.146] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\a5ZVQwSnbNnbraZsk7F.mp3") returned="a5ZVQwSnbNnbraZsk7F.mp3"
	[0135.146] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\"
	[0135.146] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\") returned=""
	[0135.146] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.146] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\kpfqz\\how-to-decrypt-files.htm")) returned 0x20
	[0135.146] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\", lpString2="amj7vZLap0H-.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a"
	[0135.146] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.zip") returned 0
	[0135.146] lstrlenA (lpString="*.zip") returned 5
	[0135.146] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.rar") returned 0
	[0135.146] lstrlenA (lpString="*.rar") returned 5
	[0135.146] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.7z") returned 0
	[0135.146] lstrlenA (lpString="*.7z") returned 4
	[0135.146] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.tar") returned 0
	[0135.146] lstrlenA (lpString="*.tar") returned 5
	[0135.146] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.gzip") returned 0
	[0135.146] lstrlenA (lpString="*.gzip") returned 6
	[0135.146] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.jpg") returned 0
	[0135.146] lstrlenA (lpString="*.jpg") returned 5
	[0135.147] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.jpeg") returned 0
	[0135.147] lstrlenA (lpString="*.jpeg") returned 6
	[0135.147] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.bmp") returned 0
	[0135.147] lstrlenA (lpString="*.bmp") returned 5
	[0135.147] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.gif") returned 0
	[0135.147] lstrlenA (lpString="*.gif") returned 5
	[0135.147] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.png") returned 0
	[0135.147] lstrlenA (lpString="*.png") returned 5
	[0135.147] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.doc") returned 0
	[0135.147] lstrlenA (lpString="*.doc") returned 5
	[0135.147] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.docx") returned 0
	[0135.147] lstrlenA (lpString="*.docx") returned 6
	[0135.147] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.xls") returned 0
	[0135.147] lstrlenA (lpString="*.xls") returned 5
	[0135.147] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.xlsx") returned 0
	[0135.147] lstrlenA (lpString="*.xlsx") returned 6
	[0135.147] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.ppt") returned 0
	[0135.147] lstrlenA (lpString="*.ppt") returned 5
	[0135.147] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.pptx") returned 0
	[0135.147] lstrlenA (lpString="*.pptx") returned 6
	[0135.147] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.txt") returned 0
	[0135.147] lstrlenA (lpString="*.txt") returned 5
	[0135.147] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.pdf") returned 0
	[0135.147] lstrlenA (lpString="*.pdf") returned 5
	[0135.147] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.htm") returned 0
	[0135.147] lstrlenA (lpString="*.htm") returned 5
	[0135.147] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.html") returned 0
	[0135.147] lstrlenA (lpString="*.html") returned 6
	[0135.147] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.mdb") returned 0
	[0135.147] lstrlenA (lpString="*.mdb") returned 5
	[0135.147] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.pfx") returned 0
	[0135.147] lstrlenA (lpString="*.pfx") returned 5
	[0135.147] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.md") returned 0
	[0135.147] lstrlenA (lpString="*.md") returned 4
	[0135.148] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.lnk") returned 0
	[0135.148] lstrlenA (lpString="*.lnk") returned 5
	[0135.148] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.torrent") returned 0
	[0135.148] lstrlenA (lpString="*.torrent") returned 9
	[0135.148] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.mov") returned 0
	[0135.148] lstrlenA (lpString="*.mov") returned 5
	[0135.148] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.3gp") returned 0
	[0135.148] lstrlenA (lpString="*.3gp") returned 5
	[0135.148] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.mpeg") returned 0
	[0135.148] lstrlenA (lpString="*.mpeg") returned 6
	[0135.148] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.mpg") returned 0
	[0135.148] lstrlenA (lpString="*.mpg") returned 5
	[0135.148] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.flv") returned 0
	[0135.148] lstrlenA (lpString="*.flv") returned 5
	[0135.148] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.avi") returned 0
	[0135.148] lstrlenA (lpString="*.avi") returned 5
	[0135.148] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.mp4") returned 0
	[0135.148] lstrlenA (lpString="*.mp4") returned 5
	[0135.148] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.wmv") returned 0
	[0135.148] lstrlenA (lpString="*.wmv") returned 5
	[0135.148] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.mkv") returned 0
	[0135.148] lstrlenA (lpString="*.mkv") returned 5
	[0135.148] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.mp3") returned 0
	[0135.148] lstrlenA (lpString="*.mp3") returned 5
	[0135.148] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.wav") returned 0
	[0135.148] lstrlenA (lpString="*.wav") returned 5
	[0135.148] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.flac") returned 0
	[0135.148] lstrlenA (lpString="*.flac") returned 6
	[0135.148] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.wma") returned 0
	[0135.148] lstrlenA (lpString="*.wma") returned 5
	[0135.148] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.au3") returned 0
	[0135.148] lstrlenA (lpString="*.au3") returned 5
	[0135.148] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.ahk") returned 0
	[0135.149] lstrlenA (lpString="*.ahk") returned 5
	[0135.149] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.c") returned 0
	[0135.149] lstrlenA (lpString="*.c") returned 3
	[0135.149] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.cc") returned 0
	[0135.149] lstrlenA (lpString="*.cc") returned 4
	[0135.149] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.cpp") returned 0
	[0135.149] lstrlenA (lpString="*.cpp") returned 5
	[0135.149] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.cxx") returned 0
	[0135.149] lstrlenA (lpString="*.cxx") returned 5
	[0135.149] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.c++") returned 0
	[0135.149] lstrlenA (lpString="*.c++") returned 5
	[0135.149] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.cs") returned 0
	[0135.149] lstrlenA (lpString="*.cs") returned 4
	[0135.149] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.vb") returned 0
	[0135.149] lstrlenA (lpString="*.vb") returned 4
	[0135.149] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.bas") returned 0
	[0135.149] lstrlenA (lpString="*.bas") returned 5
	[0135.149] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.csproj") returned 0
	[0135.149] lstrlenA (lpString="*.csproj") returned 8
	[0135.149] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.vbproj") returned 0
	[0135.149] lstrlenA (lpString="*.vbproj") returned 8
	[0135.149] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.vcxproj") returned 0
	[0135.149] lstrlenA (lpString="*.vcxproj") returned 9
	[0135.149] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.manifest") returned 0
	[0135.149] lstrlenA (lpString="*.manifest") returned 10
	[0135.149] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.php") returned 0
	[0135.149] lstrlenA (lpString="*.php") returned 5
	[0135.149] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.vbe") returned 0
	[0135.149] lstrlenA (lpString="*.vbe") returned 5
	[0135.149] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.vba") returned 0
	[0135.149] lstrlenA (lpString="*.vba") returned 5
	[0135.149] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.vbs") returned 0
	[0135.149] lstrlenA (lpString="*.vbs") returned 5
	[0135.150] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.bat") returned 0
	[0135.150] lstrlenA (lpString="*.bat") returned 5
	[0135.150] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.cmd") returned 0
	[0135.150] lstrlenA (lpString="*.cmd") returned 5
	[0135.150] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.js") returned 0
	[0135.150] lstrlenA (lpString="*.js") returned 4
	[0135.150] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.jscript") returned 0
	[0135.150] lstrlenA (lpString="*.jscript") returned 9
	[0135.150] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.hta") returned 0
	[0135.150] lstrlenA (lpString="*.hta") returned 5
	[0135.150] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.php7") returned 0
	[0135.150] lstrlenA (lpString="*.php7") returned 6
	[0135.150] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.db") returned 0
	[0135.150] lstrlenA (lpString="*.db") returned 4
	[0135.150] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.swf") returned 0
	[0135.150] lstrlenA (lpString="*.swf") returned 5
	[0135.150] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.eml") returned 0
	[0135.150] lstrlenA (lpString="*.eml") returned 5
	[0135.150] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.part") returned 0
	[0135.150] lstrlenA (lpString="*.part") returned 6
	[0135.150] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.nfo") returned 0
	[0135.150] lstrlenA (lpString="*.nfo") returned 5
	[0135.150] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.rsa") returned 0
	[0135.150] lstrlenA (lpString="*.rsa") returned 5
	[0135.150] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.key") returned 0
	[0135.150] lstrlenA (lpString="*.key") returned 5
	[0135.150] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.aes") returned 0
	[0135.150] lstrlenA (lpString="*.aes") returned 5
	[0135.150] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.blob") returned 0
	[0135.150] lstrlenA (lpString="*.blob") returned 6
	[0135.150] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.btc") returned 0
	[0135.150] lstrlenA (lpString="*.btc") returned 5
	[0135.150] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a", pszSpec="*.wallet") returned 0
	[0135.151] lstrlenA (lpString="*.wallet") returned 8
	[0135.151] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b705f40, ftCreationTime.dwHighDateTime=0x1d4cc07, ftLastAccessTime.dwLowDateTime=0x38d9fd50, ftLastAccessTime.dwHighDateTime=0x1d4d5ee, ftLastWriteTime.dwLowDateTime=0x38d9fd50, ftLastWriteTime.dwHighDateTime=0x1d4d5ee, nFileSizeHigh=0x0, nFileSizeLow=0x9364, dwReserved0=0x0, dwReserved1=0x0, cFileName="f4B1ueVK.m4a", cAlternateFileName="")) returned 1
	[0135.151] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0135.151] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="f4B1ueVK.m4a") returned -1
	[0135.151] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="f4B1ueVK.m4a") returned 1
	[0135.151] lstrcmpiA (lpString1="", lpString2="f4B1ueVK.m4a") returned -1
	[0135.151] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\amj7vZLap0H-.m4a") returned="amj7vZLap0H-.m4a"
	[0135.151] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\"
	[0135.151] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\") returned=""
	[0135.151] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.151] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\kpfqz\\how-to-decrypt-files.htm")) returned 0x20
	[0135.151] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\", lpString2="f4B1ueVK.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a"
	[0135.151] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.zip") returned 0
	[0135.151] lstrlenA (lpString="*.zip") returned 5
	[0135.151] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.rar") returned 0
	[0135.151] lstrlenA (lpString="*.rar") returned 5
	[0135.151] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.7z") returned 0
	[0135.151] lstrlenA (lpString="*.7z") returned 4
	[0135.151] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.tar") returned 0
	[0135.151] lstrlenA (lpString="*.tar") returned 5
	[0135.151] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.gzip") returned 0
	[0135.151] lstrlenA (lpString="*.gzip") returned 6
	[0135.151] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.jpg") returned 0
	[0135.151] lstrlenA (lpString="*.jpg") returned 5
	[0135.151] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.jpeg") returned 0
	[0135.151] lstrlenA (lpString="*.jpeg") returned 6
	[0135.151] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.bmp") returned 0
	[0135.151] lstrlenA (lpString="*.bmp") returned 5
	[0135.151] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.gif") returned 0
	[0135.151] lstrlenA (lpString="*.gif") returned 5
	[0135.151] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.png") returned 0
	[0135.152] lstrlenA (lpString="*.png") returned 5
	[0135.152] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.doc") returned 0
	[0135.152] lstrlenA (lpString="*.doc") returned 5
	[0135.152] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.docx") returned 0
	[0135.152] lstrlenA (lpString="*.docx") returned 6
	[0135.152] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.xls") returned 0
	[0135.152] lstrlenA (lpString="*.xls") returned 5
	[0135.152] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.xlsx") returned 0
	[0135.152] lstrlenA (lpString="*.xlsx") returned 6
	[0135.152] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.ppt") returned 0
	[0135.152] lstrlenA (lpString="*.ppt") returned 5
	[0135.152] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.pptx") returned 0
	[0135.152] lstrlenA (lpString="*.pptx") returned 6
	[0135.152] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.txt") returned 0
	[0135.152] lstrlenA (lpString="*.txt") returned 5
	[0135.152] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.pdf") returned 0
	[0135.152] lstrlenA (lpString="*.pdf") returned 5
	[0135.152] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.htm") returned 0
	[0135.152] lstrlenA (lpString="*.htm") returned 5
	[0135.152] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.html") returned 0
	[0135.152] lstrlenA (lpString="*.html") returned 6
	[0135.152] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.mdb") returned 0
	[0135.152] lstrlenA (lpString="*.mdb") returned 5
	[0135.152] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.pfx") returned 0
	[0135.152] lstrlenA (lpString="*.pfx") returned 5
	[0135.152] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.md") returned 0
	[0135.152] lstrlenA (lpString="*.md") returned 4
	[0135.152] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.lnk") returned 0
	[0135.152] lstrlenA (lpString="*.lnk") returned 5
	[0135.152] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.torrent") returned 0
	[0135.152] lstrlenA (lpString="*.torrent") returned 9
	[0135.152] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.mov") returned 0
	[0135.152] lstrlenA (lpString="*.mov") returned 5
	[0135.152] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.3gp") returned 0
	[0135.152] lstrlenA (lpString="*.3gp") returned 5
	[0135.152] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.mpeg") returned 0
	[0135.153] lstrlenA (lpString="*.mpeg") returned 6
	[0135.153] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.mpg") returned 0
	[0135.153] lstrlenA (lpString="*.mpg") returned 5
	[0135.153] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.flv") returned 0
	[0135.153] lstrlenA (lpString="*.flv") returned 5
	[0135.153] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.avi") returned 0
	[0135.153] lstrlenA (lpString="*.avi") returned 5
	[0135.153] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.mp4") returned 0
	[0135.153] lstrlenA (lpString="*.mp4") returned 5
	[0135.153] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.wmv") returned 0
	[0135.153] lstrlenA (lpString="*.wmv") returned 5
	[0135.153] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.mkv") returned 0
	[0135.153] lstrlenA (lpString="*.mkv") returned 5
	[0135.153] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.mp3") returned 0
	[0135.153] lstrlenA (lpString="*.mp3") returned 5
	[0135.153] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.wav") returned 0
	[0135.153] lstrlenA (lpString="*.wav") returned 5
	[0135.153] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.flac") returned 0
	[0135.153] lstrlenA (lpString="*.flac") returned 6
	[0135.153] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.wma") returned 0
	[0135.153] lstrlenA (lpString="*.wma") returned 5
	[0135.153] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.au3") returned 0
	[0135.153] lstrlenA (lpString="*.au3") returned 5
	[0135.153] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.ahk") returned 0
	[0135.153] lstrlenA (lpString="*.ahk") returned 5
	[0135.153] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.c") returned 0
	[0135.153] lstrlenA (lpString="*.c") returned 3
	[0135.153] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.cc") returned 0
	[0135.153] lstrlenA (lpString="*.cc") returned 4
	[0135.153] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.cpp") returned 0
	[0135.153] lstrlenA (lpString="*.cpp") returned 5
	[0135.153] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.cxx") returned 0
	[0135.153] lstrlenA (lpString="*.cxx") returned 5
	[0135.153] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.c++") returned 0
	[0135.153] lstrlenA (lpString="*.c++") returned 5
	[0135.153] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.cs") returned 0
	[0135.154] lstrlenA (lpString="*.cs") returned 4
	[0135.154] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.vb") returned 0
	[0135.154] lstrlenA (lpString="*.vb") returned 4
	[0135.154] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.bas") returned 0
	[0135.154] lstrlenA (lpString="*.bas") returned 5
	[0135.154] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.csproj") returned 0
	[0135.154] lstrlenA (lpString="*.csproj") returned 8
	[0135.154] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.vbproj") returned 0
	[0135.154] lstrlenA (lpString="*.vbproj") returned 8
	[0135.154] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.vcxproj") returned 0
	[0135.154] lstrlenA (lpString="*.vcxproj") returned 9
	[0135.154] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.manifest") returned 0
	[0135.154] lstrlenA (lpString="*.manifest") returned 10
	[0135.154] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.php") returned 0
	[0135.154] lstrlenA (lpString="*.php") returned 5
	[0135.154] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.vbe") returned 0
	[0135.154] lstrlenA (lpString="*.vbe") returned 5
	[0135.154] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.vba") returned 0
	[0135.154] lstrlenA (lpString="*.vba") returned 5
	[0135.154] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.vbs") returned 0
	[0135.154] lstrlenA (lpString="*.vbs") returned 5
	[0135.154] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.bat") returned 0
	[0135.154] lstrlenA (lpString="*.bat") returned 5
	[0135.154] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.cmd") returned 0
	[0135.154] lstrlenA (lpString="*.cmd") returned 5
	[0135.154] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.js") returned 0
	[0135.154] lstrlenA (lpString="*.js") returned 4
	[0135.154] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.jscript") returned 0
	[0135.154] lstrlenA (lpString="*.jscript") returned 9
	[0135.154] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.hta") returned 0
	[0135.154] lstrlenA (lpString="*.hta") returned 5
	[0135.154] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.php7") returned 0
	[0135.154] lstrlenA (lpString="*.php7") returned 6
	[0135.154] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.db") returned 0
	[0135.154] lstrlenA (lpString="*.db") returned 4
	[0135.155] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.swf") returned 0
	[0135.155] lstrlenA (lpString="*.swf") returned 5
	[0135.155] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.eml") returned 0
	[0135.155] lstrlenA (lpString="*.eml") returned 5
	[0135.155] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.part") returned 0
	[0135.155] lstrlenA (lpString="*.part") returned 6
	[0135.155] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.nfo") returned 0
	[0135.155] lstrlenA (lpString="*.nfo") returned 5
	[0135.155] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.rsa") returned 0
	[0135.155] lstrlenA (lpString="*.rsa") returned 5
	[0135.155] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.key") returned 0
	[0135.155] lstrlenA (lpString="*.key") returned 5
	[0135.155] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.aes") returned 0
	[0135.155] lstrlenA (lpString="*.aes") returned 5
	[0135.155] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.blob") returned 0
	[0135.155] lstrlenA (lpString="*.blob") returned 6
	[0135.155] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.btc") returned 0
	[0135.155] lstrlenA (lpString="*.btc") returned 5
	[0135.155] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a", pszSpec="*.wallet") returned 0
	[0135.155] lstrlenA (lpString="*.wallet") returned 8
	[0135.155] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9786880, ftCreationTime.dwHighDateTime=0x1d4c95d, ftLastAccessTime.dwLowDateTime=0xc5d53300, ftLastAccessTime.dwHighDateTime=0x1d4d5f3, ftLastWriteTime.dwLowDateTime=0xc5d53300, ftLastWriteTime.dwHighDateTime=0x1d4d5f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ipn0jJ9XLJBf-VqE4-MT", cAlternateFileName="IPN0JJ~1")) returned 1
	[0135.155] lstrcmpA (lpString1=".", lpString2="Ipn0jJ9XLJBf-VqE4-MT") returned -1
	[0135.155] lstrcmpA (lpString1="..", lpString2="Ipn0jJ9XLJBf-VqE4-MT") returned -1
	[0135.155] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\f4B1ueVK.m4a") returned="f4B1ueVK.m4a"
	[0135.155] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\", lpString2="Ipn0jJ9XLJBf-VqE4-MT" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT"
	[0135.155] lstrlenA (lpString="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT") returned 64
	[0135.155] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\*.*", lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9786880, ftCreationTime.dwHighDateTime=0x1d4c95d, ftLastAccessTime.dwLowDateTime=0xc5d53300, ftLastAccessTime.dwHighDateTime=0x1d4d5f3, ftLastWriteTime.dwLowDateTime=0xc5d53300, ftLastWriteTime.dwHighDateTime=0x1d4d5f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0xa0, cFileName=".", cAlternateFileName="")) returned 0x7cbad0
	[0135.155] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0135.155] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9786880, ftCreationTime.dwHighDateTime=0x1d4c95d, ftLastAccessTime.dwLowDateTime=0xc5d53300, ftLastAccessTime.dwHighDateTime=0x1d4d5f3, ftLastWriteTime.dwLowDateTime=0xc5d53300, ftLastWriteTime.dwHighDateTime=0x1d4d5f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0xa0, cFileName="..", cAlternateFileName="")) returned 1
	[0135.155] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0135.156] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0135.156] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe35ab0d0, ftCreationTime.dwHighDateTime=0x1d4ce64, ftLastAccessTime.dwLowDateTime=0x3bc25640, ftLastAccessTime.dwHighDateTime=0x1d4c642, ftLastWriteTime.dwLowDateTime=0x3bc25640, ftLastWriteTime.dwHighDateTime=0x1d4c642, nFileSizeHigh=0x0, nFileSizeLow=0xeee4, dwReserved0=0x7b0000, dwReserved1=0xa0, cFileName="IZKvCHuPXNSG.wav", cAlternateFileName="IZKVCH~1.WAV")) returned 1
	[0135.156] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0135.156] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="IZKvCHuPXNSG.wav") returned -1
	[0135.156] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="IZKvCHuPXNSG.wav") returned -1
	[0135.156] lstrcmpiA (lpString1="", lpString2="IZKvCHuPXNSG.wav") returned -1
	[0135.156] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\*.*") returned="*.*"
	[0135.156] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\"
	[0135.156] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\") returned=""
	[0135.156] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.156] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\kpfqz\\ipn0jj9xljbf-vqe4-mt\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0135.156] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\kpfqz\\ipn0jj9xljbf-vqe4-mt\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0135.159] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0135.159] WriteFile (in: hFile=0x218, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0135.160] SetFileTime (hFile=0x218, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0135.160] CloseHandle (hObject=0x218) returned 1
	[0135.160] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\", lpString2="IZKvCHuPXNSG.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav"
	[0135.160] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav", pszSpec="*.zip") returned 0
	[0135.160] lstrlenA (lpString="*.zip") returned 5
	[0135.160] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav", pszSpec="*.rar") returned 0
	[0135.160] lstrlenA (lpString="*.rar") returned 5
	[0135.160] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav", pszSpec="*.7z") returned 0
	[0135.160] lstrlenA (lpString="*.7z") returned 4
	[0135.160] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav", pszSpec="*.tar") returned 0
	[0135.160] lstrlenA (lpString="*.tar") returned 5
	[0135.160] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav", pszSpec="*.gzip") returned 0
	[0135.160] lstrlenA (lpString="*.gzip") returned 6
	[0135.160] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav", pszSpec="*.jpg") returned 0
	[0135.160] lstrlenA (lpString="*.jpg") returned 5
	[0135.160] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav", pszSpec="*.jpeg") returned 0
	[0135.160] lstrlenA (lpString="*.jpeg") returned 6
	[0135.160] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav", pszSpec="*.bmp") returned 0
	[0135.160] lstrlenA (lpString="*.bmp") returned 5
	[0135.160] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav", pszSpec="*.gif") returned 0
	[0135.160] lstrlenA (lpString="*.gif") returned 5
	[0135.160] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav", pszSpec="*.png") returned 0
	[0135.160] lstrlenA (lpString="*.png") returned 5
	[0135.160] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav", pszSpec="*.doc") returned 0
	[0135.160] lstrlenA (lpString="*.doc") returned 5
	[0135.160] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav", pszSpec="*.docx") returned 0
	[0135.161] lstrlenA (lpString="*.docx") returned 6
	[0135.161] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav", pszSpec="*.xls") returned 0
	[0135.161] lstrlenA (lpString="*.xls") returned 5
	[0135.161] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav", pszSpec="*.xlsx") returned 0
	[0135.161] lstrlenA (lpString="*.xlsx") returned 6
	[0135.161] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav", pszSpec="*.ppt") returned 0
	[0135.161] lstrlenA (lpString="*.ppt") returned 5
	[0135.161] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav", pszSpec="*.pptx") returned 0
	[0135.161] lstrlenA (lpString="*.pptx") returned 6
	[0135.161] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav", pszSpec="*.txt") returned 0
	[0135.161] lstrlenA (lpString="*.txt") returned 5
	[0135.161] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav", pszSpec="*.pdf") returned 0
	[0135.161] lstrlenA (lpString="*.pdf") returned 5
	[0135.161] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav", pszSpec="*.htm") returned 0
	[0135.161] lstrlenA (lpString="*.htm") returned 5
	[0135.161] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav", pszSpec="*.html") returned 0
	[0135.161] lstrlenA (lpString="*.html") returned 6
	[0135.161] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav", pszSpec="*.mdb") returned 0
	[0135.161] lstrlenA (lpString="*.mdb") returned 5
	[0135.161] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav", pszSpec="*.pfx") returned 0
	[0135.161] lstrlenA (lpString="*.pfx") returned 5
	[0135.161] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav", pszSpec="*.md") returned 0
	[0135.161] lstrlenA (lpString="*.md") returned 4
	[0135.161] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav", pszSpec="*.lnk") returned 0
	[0135.161] lstrlenA (lpString="*.lnk") returned 5
	[0135.161] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav", pszSpec="*.torrent") returned 0
	[0135.161] lstrlenA (lpString="*.torrent") returned 9
	[0135.161] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav", pszSpec="*.mov") returned 0
	[0135.161] lstrlenA (lpString="*.mov") returned 5
	[0135.161] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav", pszSpec="*.3gp") returned 0
	[0135.161] lstrlenA (lpString="*.3gp") returned 5
	[0135.161] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav", pszSpec="*.mpeg") returned 0
	[0135.161] lstrlenA (lpString="*.mpeg") returned 6
	[0135.161] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav", pszSpec="*.mpg") returned 0
	[0135.161] lstrlenA (lpString="*.mpg") returned 5
	[0135.162] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav", pszSpec="*.flv") returned 0
	[0135.162] lstrlenA (lpString="*.flv") returned 5
	[0135.162] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav", pszSpec="*.avi") returned 0
	[0135.162] lstrlenA (lpString="*.avi") returned 5
	[0135.162] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav", pszSpec="*.mp4") returned 0
	[0135.162] lstrlenA (lpString="*.mp4") returned 5
	[0135.162] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav", pszSpec="*.wmv") returned 0
	[0135.162] lstrlenA (lpString="*.wmv") returned 5
	[0135.162] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav", pszSpec="*.mkv") returned 0
	[0135.162] lstrlenA (lpString="*.mkv") returned 5
	[0135.162] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav", pszSpec="*.mp3") returned 0
	[0135.162] lstrlenA (lpString="*.mp3") returned 5
	[0135.162] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav", pszSpec="*.wav") returned 1
	[0135.162] lstrlenA (lpString="*.wav") returned 5
	[0135.162] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav"
	[0135.162] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav"
	[0135.162] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav.") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav."
	[0135.162] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav.exe") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav.exe"
	[0135.162] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\kpfqz\\ipn0jj9xljbf-vqe4-mt\\izkvchupxnsg.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0135.162] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xeee4
	[0135.162] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe35ab0d0, dwHighDateTime=0x1d4ce64), lpLastAccessTime=0x407536*(dwLowDateTime=0x3bc25640, dwHighDateTime=0x1d4c642), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3bc25640, dwHighDateTime=0x1d4c642)) returned 1
	[0135.162] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.163] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xeea2, lpOverlapped=0x0) returned 1
	[0135.164] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav") returned="IZKvCHuPXNSG.wav"
	[0135.168] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.168] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xeea2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xeea2, lpOverlapped=0x0) returned 1
	[0135.168] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.169] CloseHandle (hObject=0x218) returned 1
	[0135.169] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\kpfqz\\ipn0jj9xljbf-vqe4-mt\\izkvchupxnsg.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav.exe" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\kpfqz\\ipn0jj9xljbf-vqe4-mt\\izkvchupxnsg.wav.exe")) returned 1
	[0135.169] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe504220, ftCreationTime.dwHighDateTime=0x1d4d2a0, ftLastAccessTime.dwLowDateTime=0xfdf1a100, ftLastAccessTime.dwHighDateTime=0x1d4c8d4, ftLastWriteTime.dwLowDateTime=0xfdf1a100, ftLastWriteTime.dwHighDateTime=0x1d4c8d4, nFileSizeHigh=0x0, nFileSizeLow=0x3fd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="M1fzOSBXmrovVM.m4a", cAlternateFileName="M1FZOS~1.M4A")) returned 1
	[0135.169] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0135.169] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="M1fzOSBXmrovVM.m4a") returned -1
	[0135.169] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="M1fzOSBXmrovVM.m4a") returned -1
	[0135.169] lstrcmpiA (lpString1="", lpString2="M1fzOSBXmrovVM.m4a") returned -1
	[0135.169] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\IZKvCHuPXNSG.wav") returned="IZKvCHuPXNSG.wav"
	[0135.169] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\"
	[0135.169] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\") returned=""
	[0135.170] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.170] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\kpfqz\\ipn0jj9xljbf-vqe4-mt\\how-to-decrypt-files.htm")) returned 0x20
	[0135.170] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\", lpString2="M1fzOSBXmrovVM.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a"
	[0135.170] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.zip") returned 0
	[0135.170] lstrlenA (lpString="*.zip") returned 5
	[0135.170] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.rar") returned 0
	[0135.170] lstrlenA (lpString="*.rar") returned 5
	[0135.170] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.7z") returned 0
	[0135.170] lstrlenA (lpString="*.7z") returned 4
	[0135.170] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.tar") returned 0
	[0135.170] lstrlenA (lpString="*.tar") returned 5
	[0135.170] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.gzip") returned 0
	[0135.170] lstrlenA (lpString="*.gzip") returned 6
	[0135.170] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.jpg") returned 0
	[0135.170] lstrlenA (lpString="*.jpg") returned 5
	[0135.170] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.jpeg") returned 0
	[0135.170] lstrlenA (lpString="*.jpeg") returned 6
	[0135.170] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.bmp") returned 0
	[0135.170] lstrlenA (lpString="*.bmp") returned 5
	[0135.170] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.gif") returned 0
	[0135.170] lstrlenA (lpString="*.gif") returned 5
	[0135.170] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.png") returned 0
	[0135.170] lstrlenA (lpString="*.png") returned 5
	[0135.170] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.doc") returned 0
	[0135.170] lstrlenA (lpString="*.doc") returned 5
	[0135.170] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.docx") returned 0
	[0135.170] lstrlenA (lpString="*.docx") returned 6
	[0135.170] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.xls") returned 0
	[0135.170] lstrlenA (lpString="*.xls") returned 5
	[0135.170] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.xlsx") returned 0
	[0135.170] lstrlenA (lpString="*.xlsx") returned 6
	[0135.170] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.ppt") returned 0
	[0135.170] lstrlenA (lpString="*.ppt") returned 5
	[0135.171] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.pptx") returned 0
	[0135.171] lstrlenA (lpString="*.pptx") returned 6
	[0135.171] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.txt") returned 0
	[0135.171] lstrlenA (lpString="*.txt") returned 5
	[0135.171] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.pdf") returned 0
	[0135.171] lstrlenA (lpString="*.pdf") returned 5
	[0135.171] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.htm") returned 0
	[0135.171] lstrlenA (lpString="*.htm") returned 5
	[0135.171] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.html") returned 0
	[0135.171] lstrlenA (lpString="*.html") returned 6
	[0135.171] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.mdb") returned 0
	[0135.171] lstrlenA (lpString="*.mdb") returned 5
	[0135.171] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.pfx") returned 0
	[0135.171] lstrlenA (lpString="*.pfx") returned 5
	[0135.171] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.md") returned 0
	[0135.171] lstrlenA (lpString="*.md") returned 4
	[0135.171] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.lnk") returned 0
	[0135.171] lstrlenA (lpString="*.lnk") returned 5
	[0135.171] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.torrent") returned 0
	[0135.171] lstrlenA (lpString="*.torrent") returned 9
	[0135.171] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.mov") returned 0
	[0135.171] lstrlenA (lpString="*.mov") returned 5
	[0135.171] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.3gp") returned 0
	[0135.171] lstrlenA (lpString="*.3gp") returned 5
	[0135.171] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.mpeg") returned 0
	[0135.171] lstrlenA (lpString="*.mpeg") returned 6
	[0135.171] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.mpg") returned 0
	[0135.171] lstrlenA (lpString="*.mpg") returned 5
	[0135.171] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.flv") returned 0
	[0135.171] lstrlenA (lpString="*.flv") returned 5
	[0135.171] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.avi") returned 0
	[0135.171] lstrlenA (lpString="*.avi") returned 5
	[0135.171] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.mp4") returned 0
	[0135.171] lstrlenA (lpString="*.mp4") returned 5
	[0135.171] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.wmv") returned 0
	[0135.171] lstrlenA (lpString="*.wmv") returned 5
	[0135.172] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.mkv") returned 0
	[0135.172] lstrlenA (lpString="*.mkv") returned 5
	[0135.172] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.mp3") returned 0
	[0135.172] lstrlenA (lpString="*.mp3") returned 5
	[0135.172] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.wav") returned 0
	[0135.172] lstrlenA (lpString="*.wav") returned 5
	[0135.172] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.flac") returned 0
	[0135.172] lstrlenA (lpString="*.flac") returned 6
	[0135.172] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.wma") returned 0
	[0135.172] lstrlenA (lpString="*.wma") returned 5
	[0135.172] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.au3") returned 0
	[0135.172] lstrlenA (lpString="*.au3") returned 5
	[0135.172] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.ahk") returned 0
	[0135.172] lstrlenA (lpString="*.ahk") returned 5
	[0135.172] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.c") returned 0
	[0135.172] lstrlenA (lpString="*.c") returned 3
	[0135.172] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.cc") returned 0
	[0135.172] lstrlenA (lpString="*.cc") returned 4
	[0135.172] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.cpp") returned 0
	[0135.172] lstrlenA (lpString="*.cpp") returned 5
	[0135.172] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.cxx") returned 0
	[0135.172] lstrlenA (lpString="*.cxx") returned 5
	[0135.172] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.c++") returned 0
	[0135.172] lstrlenA (lpString="*.c++") returned 5
	[0135.172] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.cs") returned 0
	[0135.172] lstrlenA (lpString="*.cs") returned 4
	[0135.172] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.vb") returned 0
	[0135.172] lstrlenA (lpString="*.vb") returned 4
	[0135.172] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.bas") returned 0
	[0135.172] lstrlenA (lpString="*.bas") returned 5
	[0135.172] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.csproj") returned 0
	[0135.172] lstrlenA (lpString="*.csproj") returned 8
	[0135.172] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.vbproj") returned 0
	[0135.172] lstrlenA (lpString="*.vbproj") returned 8
	[0135.172] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.vcxproj") returned 0
	[0135.173] lstrlenA (lpString="*.vcxproj") returned 9
	[0135.173] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.manifest") returned 0
	[0135.173] lstrlenA (lpString="*.manifest") returned 10
	[0135.173] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.php") returned 0
	[0135.173] lstrlenA (lpString="*.php") returned 5
	[0135.173] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.vbe") returned 0
	[0135.173] lstrlenA (lpString="*.vbe") returned 5
	[0135.173] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.vba") returned 0
	[0135.173] lstrlenA (lpString="*.vba") returned 5
	[0135.173] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.vbs") returned 0
	[0135.173] lstrlenA (lpString="*.vbs") returned 5
	[0135.173] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.bat") returned 0
	[0135.173] lstrlenA (lpString="*.bat") returned 5
	[0135.173] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.cmd") returned 0
	[0135.173] lstrlenA (lpString="*.cmd") returned 5
	[0135.173] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.js") returned 0
	[0135.173] lstrlenA (lpString="*.js") returned 4
	[0135.173] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.jscript") returned 0
	[0135.173] lstrlenA (lpString="*.jscript") returned 9
	[0135.173] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.hta") returned 0
	[0135.173] lstrlenA (lpString="*.hta") returned 5
	[0135.173] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.php7") returned 0
	[0135.173] lstrlenA (lpString="*.php7") returned 6
	[0135.173] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.db") returned 0
	[0135.173] lstrlenA (lpString="*.db") returned 4
	[0135.173] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.swf") returned 0
	[0135.173] lstrlenA (lpString="*.swf") returned 5
	[0135.173] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.eml") returned 0
	[0135.173] lstrlenA (lpString="*.eml") returned 5
	[0135.173] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.part") returned 0
	[0135.173] lstrlenA (lpString="*.part") returned 6
	[0135.173] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.nfo") returned 0
	[0135.173] lstrlenA (lpString="*.nfo") returned 5
	[0135.173] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.rsa") returned 0
	[0135.173] lstrlenA (lpString="*.rsa") returned 5
	[0135.173] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.key") returned 0
	[0135.174] lstrlenA (lpString="*.key") returned 5
	[0135.174] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.aes") returned 0
	[0135.174] lstrlenA (lpString="*.aes") returned 5
	[0135.174] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.blob") returned 0
	[0135.174] lstrlenA (lpString="*.blob") returned 6
	[0135.174] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.btc") returned 0
	[0135.174] lstrlenA (lpString="*.btc") returned 5
	[0135.174] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\Ipn0jJ9XLJBf-VqE4-MT\\M1fzOSBXmrovVM.m4a", pszSpec="*.wallet") returned 0
	[0135.174] lstrlenA (lpString="*.wallet") returned 8
	[0135.174] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe504220, ftCreationTime.dwHighDateTime=0x1d4d2a0, ftLastAccessTime.dwLowDateTime=0xfdf1a100, ftLastAccessTime.dwHighDateTime=0x1d4c8d4, ftLastWriteTime.dwLowDateTime=0xfdf1a100, ftLastWriteTime.dwHighDateTime=0x1d4c8d4, nFileSizeHigh=0x0, nFileSizeLow=0x3fd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="M1fzOSBXmrovVM.m4a", cAlternateFileName="M1FZOS~1.M4A")) returned 0
	[0135.174] FindClose (in: hFindFile=0x7cbad0 | out: hFindFile=0x7cbad0) returned 1
	[0135.174] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0a44a20, ftCreationTime.dwHighDateTime=0x1d4ce1a, ftLastAccessTime.dwLowDateTime=0x6e51b780, ftLastAccessTime.dwHighDateTime=0x1d4c666, ftLastWriteTime.dwLowDateTime=0x6e51b780, ftLastWriteTime.dwHighDateTime=0x1d4c666, nFileSizeHigh=0x0, nFileSizeLow=0x3b21, dwReserved0=0x0, dwReserved1=0x0, cFileName="LFIKzkxmMrJEN2Bw8k7.m4a", cAlternateFileName="LFIKZK~1.M4A")) returned 1
	[0135.174] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0135.174] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="LFIKzkxmMrJEN2Bw8k7.m4a") returned -1
	[0135.174] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="LFIKzkxmMrJEN2Bw8k7.m4a") returned -1
	[0135.174] lstrcmpiA (lpString1="", lpString2="LFIKzkxmMrJEN2Bw8k7.m4a") returned -1
	[0135.174] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\*.*") returned="*.*"
	[0135.174] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\"
	[0135.174] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\") returned=""
	[0135.174] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.174] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\kpfqz\\how-to-decrypt-files.htm")) returned 0x20
	[0135.174] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\", lpString2="LFIKzkxmMrJEN2Bw8k7.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a"
	[0135.174] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.zip") returned 0
	[0135.174] lstrlenA (lpString="*.zip") returned 5
	[0135.174] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.rar") returned 0
	[0135.174] lstrlenA (lpString="*.rar") returned 5
	[0135.174] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.7z") returned 0
	[0135.174] lstrlenA (lpString="*.7z") returned 4
	[0135.174] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.tar") returned 0
	[0135.174] lstrlenA (lpString="*.tar") returned 5
	[0135.174] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.gzip") returned 0
	[0135.175] lstrlenA (lpString="*.gzip") returned 6
	[0135.175] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.jpg") returned 0
	[0135.175] lstrlenA (lpString="*.jpg") returned 5
	[0135.175] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.jpeg") returned 0
	[0135.175] lstrlenA (lpString="*.jpeg") returned 6
	[0135.175] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.bmp") returned 0
	[0135.175] lstrlenA (lpString="*.bmp") returned 5
	[0135.175] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.gif") returned 0
	[0135.175] lstrlenA (lpString="*.gif") returned 5
	[0135.175] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.png") returned 0
	[0135.175] lstrlenA (lpString="*.png") returned 5
	[0135.175] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.doc") returned 0
	[0135.175] lstrlenA (lpString="*.doc") returned 5
	[0135.175] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.docx") returned 0
	[0135.175] lstrlenA (lpString="*.docx") returned 6
	[0135.175] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.xls") returned 0
	[0135.175] lstrlenA (lpString="*.xls") returned 5
	[0135.175] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.xlsx") returned 0
	[0135.175] lstrlenA (lpString="*.xlsx") returned 6
	[0135.175] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.ppt") returned 0
	[0135.175] lstrlenA (lpString="*.ppt") returned 5
	[0135.175] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.pptx") returned 0
	[0135.175] lstrlenA (lpString="*.pptx") returned 6
	[0135.175] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.txt") returned 0
	[0135.175] lstrlenA (lpString="*.txt") returned 5
	[0135.175] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.pdf") returned 0
	[0135.175] lstrlenA (lpString="*.pdf") returned 5
	[0135.175] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.htm") returned 0
	[0135.175] lstrlenA (lpString="*.htm") returned 5
	[0135.175] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.html") returned 0
	[0135.175] lstrlenA (lpString="*.html") returned 6
	[0135.175] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.mdb") returned 0
	[0135.175] lstrlenA (lpString="*.mdb") returned 5
	[0135.175] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.pfx") returned 0
	[0135.175] lstrlenA (lpString="*.pfx") returned 5
	[0135.176] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.md") returned 0
	[0135.176] lstrlenA (lpString="*.md") returned 4
	[0135.176] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.lnk") returned 0
	[0135.176] lstrlenA (lpString="*.lnk") returned 5
	[0135.176] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.torrent") returned 0
	[0135.176] lstrlenA (lpString="*.torrent") returned 9
	[0135.176] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.mov") returned 0
	[0135.176] lstrlenA (lpString="*.mov") returned 5
	[0135.176] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.3gp") returned 0
	[0135.176] lstrlenA (lpString="*.3gp") returned 5
	[0135.176] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.mpeg") returned 0
	[0135.176] lstrlenA (lpString="*.mpeg") returned 6
	[0135.176] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.mpg") returned 0
	[0135.176] lstrlenA (lpString="*.mpg") returned 5
	[0135.176] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.flv") returned 0
	[0135.176] lstrlenA (lpString="*.flv") returned 5
	[0135.176] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.avi") returned 0
	[0135.176] lstrlenA (lpString="*.avi") returned 5
	[0135.176] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.mp4") returned 0
	[0135.176] lstrlenA (lpString="*.mp4") returned 5
	[0135.176] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.wmv") returned 0
	[0135.176] lstrlenA (lpString="*.wmv") returned 5
	[0135.176] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.mkv") returned 0
	[0135.176] lstrlenA (lpString="*.mkv") returned 5
	[0135.176] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.mp3") returned 0
	[0135.176] lstrlenA (lpString="*.mp3") returned 5
	[0135.176] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.wav") returned 0
	[0135.176] lstrlenA (lpString="*.wav") returned 5
	[0135.176] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.flac") returned 0
	[0135.176] lstrlenA (lpString="*.flac") returned 6
	[0135.176] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.wma") returned 0
	[0135.176] lstrlenA (lpString="*.wma") returned 5
	[0135.176] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.au3") returned 0
	[0135.176] lstrlenA (lpString="*.au3") returned 5
	[0135.176] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.ahk") returned 0
	[0135.177] lstrlenA (lpString="*.ahk") returned 5
	[0135.177] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.c") returned 0
	[0135.177] lstrlenA (lpString="*.c") returned 3
	[0135.177] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.cc") returned 0
	[0135.177] lstrlenA (lpString="*.cc") returned 4
	[0135.177] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.cpp") returned 0
	[0135.177] lstrlenA (lpString="*.cpp") returned 5
	[0135.177] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.cxx") returned 0
	[0135.177] lstrlenA (lpString="*.cxx") returned 5
	[0135.177] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.c++") returned 0
	[0135.177] lstrlenA (lpString="*.c++") returned 5
	[0135.177] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.cs") returned 0
	[0135.177] lstrlenA (lpString="*.cs") returned 4
	[0135.177] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.vb") returned 0
	[0135.177] lstrlenA (lpString="*.vb") returned 4
	[0135.177] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.bas") returned 0
	[0135.177] lstrlenA (lpString="*.bas") returned 5
	[0135.177] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.csproj") returned 0
	[0135.177] lstrlenA (lpString="*.csproj") returned 8
	[0135.177] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.vbproj") returned 0
	[0135.177] lstrlenA (lpString="*.vbproj") returned 8
	[0135.177] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.vcxproj") returned 0
	[0135.177] lstrlenA (lpString="*.vcxproj") returned 9
	[0135.177] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.manifest") returned 0
	[0135.177] lstrlenA (lpString="*.manifest") returned 10
	[0135.177] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.php") returned 0
	[0135.177] lstrlenA (lpString="*.php") returned 5
	[0135.177] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.vbe") returned 0
	[0135.177] lstrlenA (lpString="*.vbe") returned 5
	[0135.177] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.vba") returned 0
	[0135.177] lstrlenA (lpString="*.vba") returned 5
	[0135.177] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.vbs") returned 0
	[0135.177] lstrlenA (lpString="*.vbs") returned 5
	[0135.177] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.bat") returned 0
	[0135.177] lstrlenA (lpString="*.bat") returned 5
	[0135.177] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.cmd") returned 0
	[0135.178] lstrlenA (lpString="*.cmd") returned 5
	[0135.178] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.js") returned 0
	[0135.178] lstrlenA (lpString="*.js") returned 4
	[0135.178] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.jscript") returned 0
	[0135.178] lstrlenA (lpString="*.jscript") returned 9
	[0135.178] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.hta") returned 0
	[0135.178] lstrlenA (lpString="*.hta") returned 5
	[0135.178] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.php7") returned 0
	[0135.178] lstrlenA (lpString="*.php7") returned 6
	[0135.178] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.db") returned 0
	[0135.178] lstrlenA (lpString="*.db") returned 4
	[0135.178] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.swf") returned 0
	[0135.178] lstrlenA (lpString="*.swf") returned 5
	[0135.178] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.eml") returned 0
	[0135.178] lstrlenA (lpString="*.eml") returned 5
	[0135.178] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.part") returned 0
	[0135.178] lstrlenA (lpString="*.part") returned 6
	[0135.178] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.nfo") returned 0
	[0135.178] lstrlenA (lpString="*.nfo") returned 5
	[0135.178] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.rsa") returned 0
	[0135.178] lstrlenA (lpString="*.rsa") returned 5
	[0135.178] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.key") returned 0
	[0135.178] lstrlenA (lpString="*.key") returned 5
	[0135.178] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.aes") returned 0
	[0135.178] lstrlenA (lpString="*.aes") returned 5
	[0135.178] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.blob") returned 0
	[0135.178] lstrlenA (lpString="*.blob") returned 6
	[0135.178] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.btc") returned 0
	[0135.178] lstrlenA (lpString="*.btc") returned 5
	[0135.178] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a", pszSpec="*.wallet") returned 0
	[0135.178] lstrlenA (lpString="*.wallet") returned 8
	[0135.178] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f875330, ftCreationTime.dwHighDateTime=0x1d4c7b1, ftLastAccessTime.dwLowDateTime=0x335a16d0, ftLastAccessTime.dwHighDateTime=0x1d4ce73, ftLastWriteTime.dwLowDateTime=0x335a16d0, ftLastWriteTime.dwHighDateTime=0x1d4ce73, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="l_y2Qnb bnu", cAlternateFileName="L_Y2QN~1")) returned 1
	[0135.178] lstrcmpA (lpString1=".", lpString2="l_y2Qnb bnu") returned -1
	[0135.178] lstrcmpA (lpString1="..", lpString2="l_y2Qnb bnu") returned -1
	[0135.179] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\LFIKzkxmMrJEN2Bw8k7.m4a") returned="LFIKzkxmMrJEN2Bw8k7.m4a"
	[0135.179] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\", lpString2="l_y2Qnb bnu" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu"
	[0135.179] lstrlenA (lpString="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu") returned 55
	[0135.179] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\*.*", lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f875330, ftCreationTime.dwHighDateTime=0x1d4c7b1, ftLastAccessTime.dwLowDateTime=0x335a16d0, ftLastAccessTime.dwHighDateTime=0x1d4ce73, ftLastWriteTime.dwLowDateTime=0x335a16d0, ftLastWriteTime.dwHighDateTime=0x1d4ce73, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0xa0, cFileName=".", cAlternateFileName="")) returned 0x7cb990
	[0135.179] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0135.179] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f875330, ftCreationTime.dwHighDateTime=0x1d4c7b1, ftLastAccessTime.dwLowDateTime=0x335a16d0, ftLastAccessTime.dwHighDateTime=0x1d4ce73, ftLastWriteTime.dwLowDateTime=0x335a16d0, ftLastWriteTime.dwHighDateTime=0x1d4ce73, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0xa0, cFileName="..", cAlternateFileName="")) returned 1
	[0135.179] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0135.179] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0135.179] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94bce540, ftCreationTime.dwHighDateTime=0x1d4c614, ftLastAccessTime.dwLowDateTime=0x3fed5e10, ftLastAccessTime.dwHighDateTime=0x1d4d342, ftLastWriteTime.dwLowDateTime=0x3fed5e10, ftLastWriteTime.dwHighDateTime=0x1d4d342, nFileSizeHigh=0x0, nFileSizeLow=0x18b81, dwReserved0=0x7b0000, dwReserved1=0xa0, cFileName="1tr1f0D.mp3", cAlternateFileName="")) returned 1
	[0135.179] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0135.179] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="1tr1f0D.mp3") returned 1
	[0135.179] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="1tr1f0D.mp3") returned 1
	[0135.179] lstrcmpiA (lpString1="", lpString2="1tr1f0D.mp3") returned -1
	[0135.179] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\*.*") returned="*.*"
	[0135.179] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\"
	[0135.179] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\") returned=""
	[0135.179] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.179] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\kpfqz\\l_y2qnb bnu\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0135.179] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\kpfqz\\l_y2qnb bnu\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0135.180] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0135.180] WriteFile (in: hFile=0x218, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0135.181] SetFileTime (hFile=0x218, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0135.181] CloseHandle (hObject=0x218) returned 1
	[0135.181] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\", lpString2="1tr1f0D.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3"
	[0135.181] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3", pszSpec="*.zip") returned 0
	[0135.181] lstrlenA (lpString="*.zip") returned 5
	[0135.181] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3", pszSpec="*.rar") returned 0
	[0135.181] lstrlenA (lpString="*.rar") returned 5
	[0135.181] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3", pszSpec="*.7z") returned 0
	[0135.181] lstrlenA (lpString="*.7z") returned 4
	[0135.181] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3", pszSpec="*.tar") returned 0
	[0135.181] lstrlenA (lpString="*.tar") returned 5
	[0135.181] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3", pszSpec="*.gzip") returned 0
	[0135.181] lstrlenA (lpString="*.gzip") returned 6
	[0135.182] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3", pszSpec="*.jpg") returned 0
	[0135.182] lstrlenA (lpString="*.jpg") returned 5
	[0135.182] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3", pszSpec="*.jpeg") returned 0
	[0135.182] lstrlenA (lpString="*.jpeg") returned 6
	[0135.182] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3", pszSpec="*.bmp") returned 0
	[0135.182] lstrlenA (lpString="*.bmp") returned 5
	[0135.182] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3", pszSpec="*.gif") returned 0
	[0135.182] lstrlenA (lpString="*.gif") returned 5
	[0135.182] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3", pszSpec="*.png") returned 0
	[0135.182] lstrlenA (lpString="*.png") returned 5
	[0135.182] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3", pszSpec="*.doc") returned 0
	[0135.182] lstrlenA (lpString="*.doc") returned 5
	[0135.182] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3", pszSpec="*.docx") returned 0
	[0135.182] lstrlenA (lpString="*.docx") returned 6
	[0135.182] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3", pszSpec="*.xls") returned 0
	[0135.182] lstrlenA (lpString="*.xls") returned 5
	[0135.182] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3", pszSpec="*.xlsx") returned 0
	[0135.182] lstrlenA (lpString="*.xlsx") returned 6
	[0135.182] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3", pszSpec="*.ppt") returned 0
	[0135.182] lstrlenA (lpString="*.ppt") returned 5
	[0135.182] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3", pszSpec="*.pptx") returned 0
	[0135.182] lstrlenA (lpString="*.pptx") returned 6
	[0135.182] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3", pszSpec="*.txt") returned 0
	[0135.182] lstrlenA (lpString="*.txt") returned 5
	[0135.182] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3", pszSpec="*.pdf") returned 0
	[0135.182] lstrlenA (lpString="*.pdf") returned 5
	[0135.182] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3", pszSpec="*.htm") returned 0
	[0135.182] lstrlenA (lpString="*.htm") returned 5
	[0135.182] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3", pszSpec="*.html") returned 0
	[0135.182] lstrlenA (lpString="*.html") returned 6
	[0135.182] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3", pszSpec="*.mdb") returned 0
	[0135.182] lstrlenA (lpString="*.mdb") returned 5
	[0135.182] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3", pszSpec="*.pfx") returned 0
	[0135.182] lstrlenA (lpString="*.pfx") returned 5
	[0135.183] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3", pszSpec="*.md") returned 0
	[0135.183] lstrlenA (lpString="*.md") returned 4
	[0135.183] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3", pszSpec="*.lnk") returned 0
	[0135.183] lstrlenA (lpString="*.lnk") returned 5
	[0135.183] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3", pszSpec="*.torrent") returned 0
	[0135.183] lstrlenA (lpString="*.torrent") returned 9
	[0135.183] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3", pszSpec="*.mov") returned 0
	[0135.183] lstrlenA (lpString="*.mov") returned 5
	[0135.183] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3", pszSpec="*.3gp") returned 0
	[0135.183] lstrlenA (lpString="*.3gp") returned 5
	[0135.183] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3", pszSpec="*.mpeg") returned 0
	[0135.183] lstrlenA (lpString="*.mpeg") returned 6
	[0135.183] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3", pszSpec="*.mpg") returned 0
	[0135.183] lstrlenA (lpString="*.mpg") returned 5
	[0135.183] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3", pszSpec="*.flv") returned 0
	[0135.183] lstrlenA (lpString="*.flv") returned 5
	[0135.183] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3", pszSpec="*.avi") returned 0
	[0135.183] lstrlenA (lpString="*.avi") returned 5
	[0135.183] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3", pszSpec="*.mp4") returned 0
	[0135.183] lstrlenA (lpString="*.mp4") returned 5
	[0135.183] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3", pszSpec="*.wmv") returned 0
	[0135.183] lstrlenA (lpString="*.wmv") returned 5
	[0135.183] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3", pszSpec="*.mkv") returned 0
	[0135.183] lstrlenA (lpString="*.mkv") returned 5
	[0135.183] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3", pszSpec="*.mp3") returned 1
	[0135.183] lstrlenA (lpString="*.mp3") returned 5
	[0135.183] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3"
	[0135.183] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3"
	[0135.183] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3.") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3."
	[0135.183] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3.exe") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3.exe"
	[0135.183] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\kpfqz\\l_y2qnb bnu\\1tr1f0d.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0135.184] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18b81
	[0135.184] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x94bce540, dwHighDateTime=0x1d4c614), lpLastAccessTime=0x407536*(dwLowDateTime=0x3fed5e10, dwHighDateTime=0x1d4d342), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3fed5e10, dwHighDateTime=0x1d4d342)) returned 1
	[0135.184] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.184] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x18b3f, lpOverlapped=0x0) returned 1
	[0135.185] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3") returned="1tr1f0D.mp3"
	[0135.185] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.186] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x18b3f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x18b3f, lpOverlapped=0x0) returned 1
	[0135.186] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.186] CloseHandle (hObject=0x218) returned 1
	[0135.186] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\kpfqz\\l_y2qnb bnu\\1tr1f0d.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3.exe" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\kpfqz\\l_y2qnb bnu\\1tr1f0d.mp3.exe")) returned 1
	[0135.187] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5aa6b0, ftCreationTime.dwHighDateTime=0x1d4cd85, ftLastAccessTime.dwLowDateTime=0xf4bb07e0, ftLastAccessTime.dwHighDateTime=0x1d4d16f, ftLastWriteTime.dwLowDateTime=0xf4bb07e0, ftLastWriteTime.dwHighDateTime=0x1d4d16f, nFileSizeHigh=0x0, nFileSizeLow=0x160c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRw40M8ClA9-zaHf4.mp3", cAlternateFileName="CRW40M~1.MP3")) returned 1
	[0135.187] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0135.187] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="CRw40M8ClA9-zaHf4.mp3") returned 1
	[0135.187] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="CRw40M8ClA9-zaHf4.mp3") returned 1
	[0135.187] lstrcmpiA (lpString1="", lpString2="CRw40M8ClA9-zaHf4.mp3") returned -1
	[0135.187] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\1tr1f0D.mp3") returned="1tr1f0D.mp3"
	[0135.187] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\"
	[0135.187] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\") returned=""
	[0135.187] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.187] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\kpfqz\\l_y2qnb bnu\\how-to-decrypt-files.htm")) returned 0x20
	[0135.187] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\", lpString2="CRw40M8ClA9-zaHf4.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3"
	[0135.187] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3", pszSpec="*.zip") returned 0
	[0135.187] lstrlenA (lpString="*.zip") returned 5
	[0135.187] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3", pszSpec="*.rar") returned 0
	[0135.187] lstrlenA (lpString="*.rar") returned 5
	[0135.187] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3", pszSpec="*.7z") returned 0
	[0135.187] lstrlenA (lpString="*.7z") returned 4
	[0135.187] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3", pszSpec="*.tar") returned 0
	[0135.187] lstrlenA (lpString="*.tar") returned 5
	[0135.187] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3", pszSpec="*.gzip") returned 0
	[0135.187] lstrlenA (lpString="*.gzip") returned 6
	[0135.187] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3", pszSpec="*.jpg") returned 0
	[0135.187] lstrlenA (lpString="*.jpg") returned 5
	[0135.187] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3", pszSpec="*.jpeg") returned 0
	[0135.187] lstrlenA (lpString="*.jpeg") returned 6
	[0135.187] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3", pszSpec="*.bmp") returned 0
	[0135.187] lstrlenA (lpString="*.bmp") returned 5
	[0135.187] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3", pszSpec="*.gif") returned 0
	[0135.188] lstrlenA (lpString="*.gif") returned 5
	[0135.188] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3", pszSpec="*.png") returned 0
	[0135.188] lstrlenA (lpString="*.png") returned 5
	[0135.188] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3", pszSpec="*.doc") returned 0
	[0135.188] lstrlenA (lpString="*.doc") returned 5
	[0135.188] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3", pszSpec="*.docx") returned 0
	[0135.188] lstrlenA (lpString="*.docx") returned 6
	[0135.188] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3", pszSpec="*.xls") returned 0
	[0135.188] lstrlenA (lpString="*.xls") returned 5
	[0135.188] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3", pszSpec="*.xlsx") returned 0
	[0135.188] lstrlenA (lpString="*.xlsx") returned 6
	[0135.188] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3", pszSpec="*.ppt") returned 0
	[0135.188] lstrlenA (lpString="*.ppt") returned 5
	[0135.188] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3", pszSpec="*.pptx") returned 0
	[0135.188] lstrlenA (lpString="*.pptx") returned 6
	[0135.188] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3", pszSpec="*.txt") returned 0
	[0135.188] lstrlenA (lpString="*.txt") returned 5
	[0135.188] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3", pszSpec="*.pdf") returned 0
	[0135.188] lstrlenA (lpString="*.pdf") returned 5
	[0135.188] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3", pszSpec="*.htm") returned 0
	[0135.188] lstrlenA (lpString="*.htm") returned 5
	[0135.188] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3", pszSpec="*.html") returned 0
	[0135.188] lstrlenA (lpString="*.html") returned 6
	[0135.188] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3", pszSpec="*.mdb") returned 0
	[0135.188] lstrlenA (lpString="*.mdb") returned 5
	[0135.188] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3", pszSpec="*.pfx") returned 0
	[0135.188] lstrlenA (lpString="*.pfx") returned 5
	[0135.188] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3", pszSpec="*.md") returned 0
	[0135.188] lstrlenA (lpString="*.md") returned 4
	[0135.188] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3", pszSpec="*.lnk") returned 0
	[0135.188] lstrlenA (lpString="*.lnk") returned 5
	[0135.188] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3", pszSpec="*.torrent") returned 0
	[0135.188] lstrlenA (lpString="*.torrent") returned 9
	[0135.188] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3", pszSpec="*.mov") returned 0
	[0135.188] lstrlenA (lpString="*.mov") returned 5
	[0135.188] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3", pszSpec="*.3gp") returned 0
	[0135.189] lstrlenA (lpString="*.3gp") returned 5
	[0135.189] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3", pszSpec="*.mpeg") returned 0
	[0135.189] lstrlenA (lpString="*.mpeg") returned 6
	[0135.189] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3", pszSpec="*.mpg") returned 0
	[0135.189] lstrlenA (lpString="*.mpg") returned 5
	[0135.189] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3", pszSpec="*.flv") returned 0
	[0135.189] lstrlenA (lpString="*.flv") returned 5
	[0135.189] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3", pszSpec="*.avi") returned 0
	[0135.189] lstrlenA (lpString="*.avi") returned 5
	[0135.189] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3", pszSpec="*.mp4") returned 0
	[0135.189] lstrlenA (lpString="*.mp4") returned 5
	[0135.189] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3", pszSpec="*.wmv") returned 0
	[0135.189] lstrlenA (lpString="*.wmv") returned 5
	[0135.189] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3", pszSpec="*.mkv") returned 0
	[0135.189] lstrlenA (lpString="*.mkv") returned 5
	[0135.189] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3", pszSpec="*.mp3") returned 1
	[0135.189] lstrlenA (lpString="*.mp3") returned 5
	[0135.189] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3"
	[0135.189] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3"
	[0135.189] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3.") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3."
	[0135.189] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3.exe") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3.exe"
	[0135.189] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\kpfqz\\l_y2qnb bnu\\crw40m8cla9-zahf4.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0135.189] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x160c0
	[0135.189] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca5aa6b0, dwHighDateTime=0x1d4cd85), lpLastAccessTime=0x407536*(dwLowDateTime=0xf4bb07e0, dwHighDateTime=0x1d4d16f), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4bb07e0, dwHighDateTime=0x1d4d16f)) returned 1
	[0135.190] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.190] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1607e, lpOverlapped=0x0) returned 1
	[0135.191] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3") returned="CRw40M8ClA9-zaHf4.mp3"
	[0135.191] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.191] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1607e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1607e, lpOverlapped=0x0) returned 1
	[0135.191] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.192] CloseHandle (hObject=0x218) returned 1
	[0135.192] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\kpfqz\\l_y2qnb bnu\\crw40m8cla9-zahf4.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3.exe" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\kpfqz\\l_y2qnb bnu\\crw40m8cla9-zahf4.mp3.exe")) returned 1
	[0135.192] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe38294f0, ftCreationTime.dwHighDateTime=0x1d4c631, ftLastAccessTime.dwLowDateTime=0xb45a2fb0, ftLastAccessTime.dwHighDateTime=0x1d4cca0, ftLastWriteTime.dwLowDateTime=0xb45a2fb0, ftLastWriteTime.dwHighDateTime=0x1d4cca0, nFileSizeHigh=0x0, nFileSizeLow=0xd2c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="diJNtxrlIvz.wav", cAlternateFileName="DIJNTX~1.WAV")) returned 1
	[0135.192] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0135.192] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="diJNtxrlIvz.wav") returned 1
	[0135.192] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="diJNtxrlIvz.wav") returned 1
	[0135.192] lstrcmpiA (lpString1="", lpString2="diJNtxrlIvz.wav") returned -1
	[0135.192] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\CRw40M8ClA9-zaHf4.mp3") returned="CRw40M8ClA9-zaHf4.mp3"
	[0135.192] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\"
	[0135.192] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\") returned=""
	[0135.193] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.193] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\kpfqz\\l_y2qnb bnu\\how-to-decrypt-files.htm")) returned 0x20
	[0135.193] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\", lpString2="diJNtxrlIvz.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav"
	[0135.193] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav", pszSpec="*.zip") returned 0
	[0135.193] lstrlenA (lpString="*.zip") returned 5
	[0135.193] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav", pszSpec="*.rar") returned 0
	[0135.193] lstrlenA (lpString="*.rar") returned 5
	[0135.193] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav", pszSpec="*.7z") returned 0
	[0135.193] lstrlenA (lpString="*.7z") returned 4
	[0135.193] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav", pszSpec="*.tar") returned 0
	[0135.193] lstrlenA (lpString="*.tar") returned 5
	[0135.193] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav", pszSpec="*.gzip") returned 0
	[0135.193] lstrlenA (lpString="*.gzip") returned 6
	[0135.193] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav", pszSpec="*.jpg") returned 0
	[0135.193] lstrlenA (lpString="*.jpg") returned 5
	[0135.193] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav", pszSpec="*.jpeg") returned 0
	[0135.193] lstrlenA (lpString="*.jpeg") returned 6
	[0135.193] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav", pszSpec="*.bmp") returned 0
	[0135.193] lstrlenA (lpString="*.bmp") returned 5
	[0135.193] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav", pszSpec="*.gif") returned 0
	[0135.193] lstrlenA (lpString="*.gif") returned 5
	[0135.193] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav", pszSpec="*.png") returned 0
	[0135.193] lstrlenA (lpString="*.png") returned 5
	[0135.193] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav", pszSpec="*.doc") returned 0
	[0135.193] lstrlenA (lpString="*.doc") returned 5
	[0135.193] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav", pszSpec="*.docx") returned 0
	[0135.193] lstrlenA (lpString="*.docx") returned 6
	[0135.193] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav", pszSpec="*.xls") returned 0
	[0135.193] lstrlenA (lpString="*.xls") returned 5
	[0135.193] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav", pszSpec="*.xlsx") returned 0
	[0135.193] lstrlenA (lpString="*.xlsx") returned 6
	[0135.193] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav", pszSpec="*.ppt") returned 0
	[0135.194] lstrlenA (lpString="*.ppt") returned 5
	[0135.194] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav", pszSpec="*.pptx") returned 0
	[0135.194] lstrlenA (lpString="*.pptx") returned 6
	[0135.194] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav", pszSpec="*.txt") returned 0
	[0135.194] lstrlenA (lpString="*.txt") returned 5
	[0135.194] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav", pszSpec="*.pdf") returned 0
	[0135.194] lstrlenA (lpString="*.pdf") returned 5
	[0135.194] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav", pszSpec="*.htm") returned 0
	[0135.194] lstrlenA (lpString="*.htm") returned 5
	[0135.194] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav", pszSpec="*.html") returned 0
	[0135.194] lstrlenA (lpString="*.html") returned 6
	[0135.194] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav", pszSpec="*.mdb") returned 0
	[0135.194] lstrlenA (lpString="*.mdb") returned 5
	[0135.194] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav", pszSpec="*.pfx") returned 0
	[0135.194] lstrlenA (lpString="*.pfx") returned 5
	[0135.194] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav", pszSpec="*.md") returned 0
	[0135.194] lstrlenA (lpString="*.md") returned 4
	[0135.194] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav", pszSpec="*.lnk") returned 0
	[0135.194] lstrlenA (lpString="*.lnk") returned 5
	[0135.194] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav", pszSpec="*.torrent") returned 0
	[0135.194] lstrlenA (lpString="*.torrent") returned 9
	[0135.194] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav", pszSpec="*.mov") returned 0
	[0135.194] lstrlenA (lpString="*.mov") returned 5
	[0135.194] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav", pszSpec="*.3gp") returned 0
	[0135.194] lstrlenA (lpString="*.3gp") returned 5
	[0135.194] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav", pszSpec="*.mpeg") returned 0
	[0135.194] lstrlenA (lpString="*.mpeg") returned 6
	[0135.194] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav", pszSpec="*.mpg") returned 0
	[0135.194] lstrlenA (lpString="*.mpg") returned 5
	[0135.194] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav", pszSpec="*.flv") returned 0
	[0135.194] lstrlenA (lpString="*.flv") returned 5
	[0135.194] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav", pszSpec="*.avi") returned 0
	[0135.194] lstrlenA (lpString="*.avi") returned 5
	[0135.194] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav", pszSpec="*.mp4") returned 0
	[0135.194] lstrlenA (lpString="*.mp4") returned 5
	[0135.194] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav", pszSpec="*.wmv") returned 0
	[0135.195] lstrlenA (lpString="*.wmv") returned 5
	[0135.195] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav", pszSpec="*.mkv") returned 0
	[0135.195] lstrlenA (lpString="*.mkv") returned 5
	[0135.195] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav", pszSpec="*.mp3") returned 0
	[0135.195] lstrlenA (lpString="*.mp3") returned 5
	[0135.195] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav", pszSpec="*.wav") returned 1
	[0135.195] lstrlenA (lpString="*.wav") returned 5
	[0135.195] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav"
	[0135.195] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav"
	[0135.195] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav.") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav."
	[0135.195] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav.exe") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav.exe"
	[0135.195] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\kpfqz\\l_y2qnb bnu\\dijntxrlivz.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0135.195] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd2c7
	[0135.195] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe38294f0, dwHighDateTime=0x1d4c631), lpLastAccessTime=0x407536*(dwLowDateTime=0xb45a2fb0, dwHighDateTime=0x1d4cca0), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb45a2fb0, dwHighDateTime=0x1d4cca0)) returned 1
	[0135.195] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.195] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xd285, lpOverlapped=0x0) returned 1
	[0135.196] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav") returned="diJNtxrlIvz.wav"
	[0135.197] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.197] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xd285, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xd285, lpOverlapped=0x0) returned 1
	[0135.197] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.197] CloseHandle (hObject=0x218) returned 1
	[0135.197] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\kpfqz\\l_y2qnb bnu\\dijntxrlivz.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav.exe" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\kpfqz\\l_y2qnb bnu\\dijntxrlivz.wav.exe")) returned 1
	[0135.198] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52a1920, ftCreationTime.dwHighDateTime=0x1d4cf06, ftLastAccessTime.dwLowDateTime=0x35336310, ftLastAccessTime.dwHighDateTime=0x1d4cf15, ftLastWriteTime.dwLowDateTime=0x35336310, ftLastWriteTime.dwHighDateTime=0x1d4cf15, nFileSizeHigh=0x0, nFileSizeLow=0xe20b, dwReserved0=0x0, dwReserved1=0x0, cFileName="H2CCQ3i510Tjh.mp3", cAlternateFileName="H2CCQ3~1.MP3")) returned 1
	[0135.198] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0135.198] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="H2CCQ3i510Tjh.mp3") returned -1
	[0135.198] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="H2CCQ3i510Tjh.mp3") returned 1
	[0135.198] lstrcmpiA (lpString1="", lpString2="H2CCQ3i510Tjh.mp3") returned -1
	[0135.198] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\diJNtxrlIvz.wav") returned="diJNtxrlIvz.wav"
	[0135.198] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\"
	[0135.198] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\") returned=""
	[0135.198] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.198] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\kpfqz\\l_y2qnb bnu\\how-to-decrypt-files.htm")) returned 0x20
	[0135.198] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\", lpString2="H2CCQ3i510Tjh.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3"
	[0135.198] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3", pszSpec="*.zip") returned 0
	[0135.198] lstrlenA (lpString="*.zip") returned 5
	[0135.198] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3", pszSpec="*.rar") returned 0
	[0135.198] lstrlenA (lpString="*.rar") returned 5
	[0135.198] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3", pszSpec="*.7z") returned 0
	[0135.198] lstrlenA (lpString="*.7z") returned 4
	[0135.198] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3", pszSpec="*.tar") returned 0
	[0135.198] lstrlenA (lpString="*.tar") returned 5
	[0135.198] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3", pszSpec="*.gzip") returned 0
	[0135.198] lstrlenA (lpString="*.gzip") returned 6
	[0135.198] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3", pszSpec="*.jpg") returned 0
	[0135.198] lstrlenA (lpString="*.jpg") returned 5
	[0135.198] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3", pszSpec="*.jpeg") returned 0
	[0135.198] lstrlenA (lpString="*.jpeg") returned 6
	[0135.198] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3", pszSpec="*.bmp") returned 0
	[0135.199] lstrlenA (lpString="*.bmp") returned 5
	[0135.199] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3", pszSpec="*.gif") returned 0
	[0135.199] lstrlenA (lpString="*.gif") returned 5
	[0135.199] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3", pszSpec="*.png") returned 0
	[0135.199] lstrlenA (lpString="*.png") returned 5
	[0135.199] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3", pszSpec="*.doc") returned 0
	[0135.199] lstrlenA (lpString="*.doc") returned 5
	[0135.199] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3", pszSpec="*.docx") returned 0
	[0135.199] lstrlenA (lpString="*.docx") returned 6
	[0135.199] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3", pszSpec="*.xls") returned 0
	[0135.199] lstrlenA (lpString="*.xls") returned 5
	[0135.199] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3", pszSpec="*.xlsx") returned 0
	[0135.199] lstrlenA (lpString="*.xlsx") returned 6
	[0135.199] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3", pszSpec="*.ppt") returned 0
	[0135.199] lstrlenA (lpString="*.ppt") returned 5
	[0135.199] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3", pszSpec="*.pptx") returned 0
	[0135.199] lstrlenA (lpString="*.pptx") returned 6
	[0135.199] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3", pszSpec="*.txt") returned 0
	[0135.199] lstrlenA (lpString="*.txt") returned 5
	[0135.199] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3", pszSpec="*.pdf") returned 0
	[0135.199] lstrlenA (lpString="*.pdf") returned 5
	[0135.199] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3", pszSpec="*.htm") returned 0
	[0135.199] lstrlenA (lpString="*.htm") returned 5
	[0135.199] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3", pszSpec="*.html") returned 0
	[0135.199] lstrlenA (lpString="*.html") returned 6
	[0135.199] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3", pszSpec="*.mdb") returned 0
	[0135.199] lstrlenA (lpString="*.mdb") returned 5
	[0135.199] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3", pszSpec="*.pfx") returned 0
	[0135.199] lstrlenA (lpString="*.pfx") returned 5
	[0135.199] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3", pszSpec="*.md") returned 0
	[0135.199] lstrlenA (lpString="*.md") returned 4
	[0135.199] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3", pszSpec="*.lnk") returned 0
	[0135.199] lstrlenA (lpString="*.lnk") returned 5
	[0135.199] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3", pszSpec="*.torrent") returned 0
	[0135.199] lstrlenA (lpString="*.torrent") returned 9
	[0135.199] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3", pszSpec="*.mov") returned 0
	[0135.200] lstrlenA (lpString="*.mov") returned 5
	[0135.200] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3", pszSpec="*.3gp") returned 0
	[0135.200] lstrlenA (lpString="*.3gp") returned 5
	[0135.200] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3", pszSpec="*.mpeg") returned 0
	[0135.200] lstrlenA (lpString="*.mpeg") returned 6
	[0135.200] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3", pszSpec="*.mpg") returned 0
	[0135.200] lstrlenA (lpString="*.mpg") returned 5
	[0135.200] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3", pszSpec="*.flv") returned 0
	[0135.200] lstrlenA (lpString="*.flv") returned 5
	[0135.200] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3", pszSpec="*.avi") returned 0
	[0135.200] lstrlenA (lpString="*.avi") returned 5
	[0135.200] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3", pszSpec="*.mp4") returned 0
	[0135.200] lstrlenA (lpString="*.mp4") returned 5
	[0135.200] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3", pszSpec="*.wmv") returned 0
	[0135.200] lstrlenA (lpString="*.wmv") returned 5
	[0135.200] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3", pszSpec="*.mkv") returned 0
	[0135.200] lstrlenA (lpString="*.mkv") returned 5
	[0135.200] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3", pszSpec="*.mp3") returned 1
	[0135.200] lstrlenA (lpString="*.mp3") returned 5
	[0135.200] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3"
	[0135.200] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3"
	[0135.200] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3.") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3."
	[0135.200] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3.exe") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3.exe"
	[0135.200] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\kpfqz\\l_y2qnb bnu\\h2ccq3i510tjh.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0135.200] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe20b
	[0135.201] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa52a1920, dwHighDateTime=0x1d4cf06), lpLastAccessTime=0x407536*(dwLowDateTime=0x35336310, dwHighDateTime=0x1d4cf15), lpLastWriteTime=0x40753e*(dwLowDateTime=0x35336310, dwHighDateTime=0x1d4cf15)) returned 1
	[0135.201] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.201] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xe1c9, lpOverlapped=0x0) returned 1
	[0135.202] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3") returned="H2CCQ3i510Tjh.mp3"
	[0135.202] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.202] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xe1c9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xe1c9, lpOverlapped=0x0) returned 1
	[0135.202] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.202] CloseHandle (hObject=0x218) returned 1
	[0135.202] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\kpfqz\\l_y2qnb bnu\\h2ccq3i510tjh.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3.exe" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\kpfqz\\l_y2qnb bnu\\h2ccq3i510tjh.mp3.exe")) returned 1
	[0135.203] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1fbc230, ftCreationTime.dwHighDateTime=0x1d4c9bf, ftLastAccessTime.dwLowDateTime=0xf0a7e260, ftLastAccessTime.dwHighDateTime=0x1d4c673, ftLastWriteTime.dwLowDateTime=0xf0a7e260, ftLastWriteTime.dwHighDateTime=0x1d4c673, nFileSizeHigh=0x0, nFileSizeLow=0x13ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="kaHQwIXA8r2OPKx.m4a", cAlternateFileName="KAHQWI~1.M4A")) returned 1
	[0135.203] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0135.203] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="kaHQwIXA8r2OPKx.m4a") returned -1
	[0135.203] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="kaHQwIXA8r2OPKx.m4a") returned -1
	[0135.203] lstrcmpiA (lpString1="", lpString2="kaHQwIXA8r2OPKx.m4a") returned -1
	[0135.203] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\H2CCQ3i510Tjh.mp3") returned="H2CCQ3i510Tjh.mp3"
	[0135.203] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\"
	[0135.203] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\") returned=""
	[0135.203] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.203] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\kpfqz\\l_y2qnb bnu\\how-to-decrypt-files.htm")) returned 0x20
	[0135.203] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\", lpString2="kaHQwIXA8r2OPKx.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a"
	[0135.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.zip") returned 0
	[0135.203] lstrlenA (lpString="*.zip") returned 5
	[0135.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.rar") returned 0
	[0135.203] lstrlenA (lpString="*.rar") returned 5
	[0135.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.7z") returned 0
	[0135.203] lstrlenA (lpString="*.7z") returned 4
	[0135.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.tar") returned 0
	[0135.203] lstrlenA (lpString="*.tar") returned 5
	[0135.203] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.gzip") returned 0
	[0135.203] lstrlenA (lpString="*.gzip") returned 6
	[0135.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.jpg") returned 0
	[0135.204] lstrlenA (lpString="*.jpg") returned 5
	[0135.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.jpeg") returned 0
	[0135.204] lstrlenA (lpString="*.jpeg") returned 6
	[0135.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.bmp") returned 0
	[0135.204] lstrlenA (lpString="*.bmp") returned 5
	[0135.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.gif") returned 0
	[0135.204] lstrlenA (lpString="*.gif") returned 5
	[0135.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.png") returned 0
	[0135.204] lstrlenA (lpString="*.png") returned 5
	[0135.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.doc") returned 0
	[0135.204] lstrlenA (lpString="*.doc") returned 5
	[0135.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.docx") returned 0
	[0135.204] lstrlenA (lpString="*.docx") returned 6
	[0135.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.xls") returned 0
	[0135.204] lstrlenA (lpString="*.xls") returned 5
	[0135.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.xlsx") returned 0
	[0135.204] lstrlenA (lpString="*.xlsx") returned 6
	[0135.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.ppt") returned 0
	[0135.204] lstrlenA (lpString="*.ppt") returned 5
	[0135.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.pptx") returned 0
	[0135.204] lstrlenA (lpString="*.pptx") returned 6
	[0135.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.txt") returned 0
	[0135.204] lstrlenA (lpString="*.txt") returned 5
	[0135.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.pdf") returned 0
	[0135.204] lstrlenA (lpString="*.pdf") returned 5
	[0135.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.htm") returned 0
	[0135.204] lstrlenA (lpString="*.htm") returned 5
	[0135.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.html") returned 0
	[0135.204] lstrlenA (lpString="*.html") returned 6
	[0135.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.mdb") returned 0
	[0135.204] lstrlenA (lpString="*.mdb") returned 5
	[0135.204] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.pfx") returned 0
	[0135.204] lstrlenA (lpString="*.pfx") returned 5
	[0135.205] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.md") returned 0
	[0135.205] lstrlenA (lpString="*.md") returned 4
	[0135.205] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.lnk") returned 0
	[0135.205] lstrlenA (lpString="*.lnk") returned 5
	[0135.205] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.torrent") returned 0
	[0135.205] lstrlenA (lpString="*.torrent") returned 9
	[0135.205] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.mov") returned 0
	[0135.205] lstrlenA (lpString="*.mov") returned 5
	[0135.205] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.3gp") returned 0
	[0135.205] lstrlenA (lpString="*.3gp") returned 5
	[0135.205] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.mpeg") returned 0
	[0135.205] lstrlenA (lpString="*.mpeg") returned 6
	[0135.205] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.mpg") returned 0
	[0135.205] lstrlenA (lpString="*.mpg") returned 5
	[0135.205] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.flv") returned 0
	[0135.205] lstrlenA (lpString="*.flv") returned 5
	[0135.205] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.avi") returned 0
	[0135.205] lstrlenA (lpString="*.avi") returned 5
	[0135.205] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.mp4") returned 0
	[0135.205] lstrlenA (lpString="*.mp4") returned 5
	[0135.205] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.wmv") returned 0
	[0135.205] lstrlenA (lpString="*.wmv") returned 5
	[0135.205] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.mkv") returned 0
	[0135.205] lstrlenA (lpString="*.mkv") returned 5
	[0135.205] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.mp3") returned 0
	[0135.205] lstrlenA (lpString="*.mp3") returned 5
	[0135.205] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.wav") returned 0
	[0135.205] lstrlenA (lpString="*.wav") returned 5
	[0135.205] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.flac") returned 0
	[0135.205] lstrlenA (lpString="*.flac") returned 6
	[0135.205] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.wma") returned 0
	[0135.205] lstrlenA (lpString="*.wma") returned 5
	[0135.205] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.au3") returned 0
	[0135.205] lstrlenA (lpString="*.au3") returned 5
	[0135.205] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.ahk") returned 0
	[0135.206] lstrlenA (lpString="*.ahk") returned 5
	[0135.206] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.c") returned 0
	[0135.206] lstrlenA (lpString="*.c") returned 3
	[0135.206] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.cc") returned 0
	[0135.206] lstrlenA (lpString="*.cc") returned 4
	[0135.206] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.cpp") returned 0
	[0135.206] lstrlenA (lpString="*.cpp") returned 5
	[0135.206] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.cxx") returned 0
	[0135.206] lstrlenA (lpString="*.cxx") returned 5
	[0135.206] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.c++") returned 0
	[0135.206] lstrlenA (lpString="*.c++") returned 5
	[0135.206] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.cs") returned 0
	[0135.206] lstrlenA (lpString="*.cs") returned 4
	[0135.206] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.vb") returned 0
	[0135.206] lstrlenA (lpString="*.vb") returned 4
	[0135.206] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.bas") returned 0
	[0135.206] lstrlenA (lpString="*.bas") returned 5
	[0135.206] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.csproj") returned 0
	[0135.206] lstrlenA (lpString="*.csproj") returned 8
	[0135.206] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.vbproj") returned 0
	[0135.206] lstrlenA (lpString="*.vbproj") returned 8
	[0135.206] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.vcxproj") returned 0
	[0135.206] lstrlenA (lpString="*.vcxproj") returned 9
	[0135.206] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.manifest") returned 0
	[0135.206] lstrlenA (lpString="*.manifest") returned 10
	[0135.206] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.php") returned 0
	[0135.206] lstrlenA (lpString="*.php") returned 5
	[0135.206] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.vbe") returned 0
	[0135.206] lstrlenA (lpString="*.vbe") returned 5
	[0135.206] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.vba") returned 0
	[0135.206] lstrlenA (lpString="*.vba") returned 5
	[0135.206] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.vbs") returned 0
	[0135.206] lstrlenA (lpString="*.vbs") returned 5
	[0135.206] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.bat") returned 0
	[0135.207] lstrlenA (lpString="*.bat") returned 5
	[0135.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.cmd") returned 0
	[0135.207] lstrlenA (lpString="*.cmd") returned 5
	[0135.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.js") returned 0
	[0135.207] lstrlenA (lpString="*.js") returned 4
	[0135.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.jscript") returned 0
	[0135.207] lstrlenA (lpString="*.jscript") returned 9
	[0135.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.hta") returned 0
	[0135.207] lstrlenA (lpString="*.hta") returned 5
	[0135.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.php7") returned 0
	[0135.207] lstrlenA (lpString="*.php7") returned 6
	[0135.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.db") returned 0
	[0135.207] lstrlenA (lpString="*.db") returned 4
	[0135.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.swf") returned 0
	[0135.207] lstrlenA (lpString="*.swf") returned 5
	[0135.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.eml") returned 0
	[0135.207] lstrlenA (lpString="*.eml") returned 5
	[0135.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.part") returned 0
	[0135.207] lstrlenA (lpString="*.part") returned 6
	[0135.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.nfo") returned 0
	[0135.207] lstrlenA (lpString="*.nfo") returned 5
	[0135.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.rsa") returned 0
	[0135.207] lstrlenA (lpString="*.rsa") returned 5
	[0135.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.key") returned 0
	[0135.207] lstrlenA (lpString="*.key") returned 5
	[0135.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.aes") returned 0
	[0135.207] lstrlenA (lpString="*.aes") returned 5
	[0135.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.blob") returned 0
	[0135.207] lstrlenA (lpString="*.blob") returned 6
	[0135.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.btc") returned 0
	[0135.207] lstrlenA (lpString="*.btc") returned 5
	[0135.207] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\l_y2Qnb bnu\\kaHQwIXA8r2OPKx.m4a", pszSpec="*.wallet") returned 0
	[0135.207] lstrlenA (lpString="*.wallet") returned 8
	[0135.207] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1fbc230, ftCreationTime.dwHighDateTime=0x1d4c9bf, ftLastAccessTime.dwLowDateTime=0xf0a7e260, ftLastAccessTime.dwHighDateTime=0x1d4c673, ftLastWriteTime.dwLowDateTime=0xf0a7e260, ftLastWriteTime.dwHighDateTime=0x1d4c673, nFileSizeHigh=0x0, nFileSizeLow=0x13ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="kaHQwIXA8r2OPKx.m4a", cAlternateFileName="KAHQWI~1.M4A")) returned 0
	[0135.208] FindClose (in: hFindFile=0x7cb990 | out: hFindFile=0x7cb990) returned 1
	[0135.208] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42b58e20, ftCreationTime.dwHighDateTime=0x1d4d076, ftLastAccessTime.dwLowDateTime=0x7d3f3ca0, ftLastAccessTime.dwHighDateTime=0x1d4cb9c, ftLastWriteTime.dwLowDateTime=0x7d3f3ca0, ftLastWriteTime.dwHighDateTime=0x1d4cb9c, nFileSizeHigh=0x0, nFileSizeLow=0x17210, dwReserved0=0x0, dwReserved1=0x0, cFileName="M9t7cimcHHASa1dI7GWr.m4a", cAlternateFileName="M9T7CI~1.M4A")) returned 1
	[0135.208] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0135.208] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="M9t7cimcHHASa1dI7GWr.m4a") returned -1
	[0135.208] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="M9t7cimcHHASa1dI7GWr.m4a") returned -1
	[0135.208] lstrcmpiA (lpString1="", lpString2="M9t7cimcHHASa1dI7GWr.m4a") returned -1
	[0135.208] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\*.*") returned="*.*"
	[0135.208] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\"
	[0135.208] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\") returned=""
	[0135.208] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.208] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\kpfqz\\how-to-decrypt-files.htm")) returned 0x20
	[0135.208] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\", lpString2="M9t7cimcHHASa1dI7GWr.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a"
	[0135.208] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.zip") returned 0
	[0135.208] lstrlenA (lpString="*.zip") returned 5
	[0135.208] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.rar") returned 0
	[0135.208] lstrlenA (lpString="*.rar") returned 5
	[0135.208] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.7z") returned 0
	[0135.208] lstrlenA (lpString="*.7z") returned 4
	[0135.208] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.tar") returned 0
	[0135.208] lstrlenA (lpString="*.tar") returned 5
	[0135.208] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.gzip") returned 0
	[0135.208] lstrlenA (lpString="*.gzip") returned 6
	[0135.208] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.jpg") returned 0
	[0135.208] lstrlenA (lpString="*.jpg") returned 5
	[0135.208] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.jpeg") returned 0
	[0135.208] lstrlenA (lpString="*.jpeg") returned 6
	[0135.208] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.bmp") returned 0
	[0135.208] lstrlenA (lpString="*.bmp") returned 5
	[0135.208] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.gif") returned 0
	[0135.208] lstrlenA (lpString="*.gif") returned 5
	[0135.208] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.png") returned 0
	[0135.208] lstrlenA (lpString="*.png") returned 5
	[0135.209] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.doc") returned 0
	[0135.209] lstrlenA (lpString="*.doc") returned 5
	[0135.209] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.docx") returned 0
	[0135.209] lstrlenA (lpString="*.docx") returned 6
	[0135.209] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.xls") returned 0
	[0135.209] lstrlenA (lpString="*.xls") returned 5
	[0135.209] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.xlsx") returned 0
	[0135.209] lstrlenA (lpString="*.xlsx") returned 6
	[0135.209] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.ppt") returned 0
	[0135.209] lstrlenA (lpString="*.ppt") returned 5
	[0135.209] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.pptx") returned 0
	[0135.209] lstrlenA (lpString="*.pptx") returned 6
	[0135.209] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.txt") returned 0
	[0135.209] lstrlenA (lpString="*.txt") returned 5
	[0135.209] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.pdf") returned 0
	[0135.209] lstrlenA (lpString="*.pdf") returned 5
	[0135.209] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.htm") returned 0
	[0135.209] lstrlenA (lpString="*.htm") returned 5
	[0135.209] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.html") returned 0
	[0135.209] lstrlenA (lpString="*.html") returned 6
	[0135.209] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.mdb") returned 0
	[0135.209] lstrlenA (lpString="*.mdb") returned 5
	[0135.209] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.pfx") returned 0
	[0135.209] lstrlenA (lpString="*.pfx") returned 5
	[0135.209] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.md") returned 0
	[0135.209] lstrlenA (lpString="*.md") returned 4
	[0135.209] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.lnk") returned 0
	[0135.209] lstrlenA (lpString="*.lnk") returned 5
	[0135.209] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.torrent") returned 0
	[0135.209] lstrlenA (lpString="*.torrent") returned 9
	[0135.209] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.mov") returned 0
	[0135.209] lstrlenA (lpString="*.mov") returned 5
	[0135.209] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.3gp") returned 0
	[0135.209] lstrlenA (lpString="*.3gp") returned 5
	[0135.209] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.mpeg") returned 0
	[0135.209] lstrlenA (lpString="*.mpeg") returned 6
	[0135.210] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.mpg") returned 0
	[0135.210] lstrlenA (lpString="*.mpg") returned 5
	[0135.210] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.flv") returned 0
	[0135.210] lstrlenA (lpString="*.flv") returned 5
	[0135.210] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.avi") returned 0
	[0135.210] lstrlenA (lpString="*.avi") returned 5
	[0135.210] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.mp4") returned 0
	[0135.210] lstrlenA (lpString="*.mp4") returned 5
	[0135.210] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.wmv") returned 0
	[0135.210] lstrlenA (lpString="*.wmv") returned 5
	[0135.210] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.mkv") returned 0
	[0135.210] lstrlenA (lpString="*.mkv") returned 5
	[0135.210] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.mp3") returned 0
	[0135.210] lstrlenA (lpString="*.mp3") returned 5
	[0135.210] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.wav") returned 0
	[0135.210] lstrlenA (lpString="*.wav") returned 5
	[0135.210] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.flac") returned 0
	[0135.210] lstrlenA (lpString="*.flac") returned 6
	[0135.210] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.wma") returned 0
	[0135.210] lstrlenA (lpString="*.wma") returned 5
	[0135.210] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.au3") returned 0
	[0135.210] lstrlenA (lpString="*.au3") returned 5
	[0135.210] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.ahk") returned 0
	[0135.210] lstrlenA (lpString="*.ahk") returned 5
	[0135.210] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.c") returned 0
	[0135.210] lstrlenA (lpString="*.c") returned 3
	[0135.210] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.cc") returned 0
	[0135.210] lstrlenA (lpString="*.cc") returned 4
	[0135.210] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.cpp") returned 0
	[0135.210] lstrlenA (lpString="*.cpp") returned 5
	[0135.210] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.cxx") returned 0
	[0135.210] lstrlenA (lpString="*.cxx") returned 5
	[0135.210] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.c++") returned 0
	[0135.210] lstrlenA (lpString="*.c++") returned 5
	[0135.210] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.cs") returned 0
	[0135.210] lstrlenA (lpString="*.cs") returned 4
	[0135.219] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.vb") returned 0
	[0135.219] lstrlenA (lpString="*.vb") returned 4
	[0135.219] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.bas") returned 0
	[0135.219] lstrlenA (lpString="*.bas") returned 5
	[0135.219] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.csproj") returned 0
	[0135.219] lstrlenA (lpString="*.csproj") returned 8
	[0135.219] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.vbproj") returned 0
	[0135.219] lstrlenA (lpString="*.vbproj") returned 8
	[0135.219] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.vcxproj") returned 0
	[0135.219] lstrlenA (lpString="*.vcxproj") returned 9
	[0135.219] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.manifest") returned 0
	[0135.219] lstrlenA (lpString="*.manifest") returned 10
	[0135.219] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.php") returned 0
	[0135.219] lstrlenA (lpString="*.php") returned 5
	[0135.219] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.vbe") returned 0
	[0135.219] lstrlenA (lpString="*.vbe") returned 5
	[0135.219] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.vba") returned 0
	[0135.219] lstrlenA (lpString="*.vba") returned 5
	[0135.219] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.vbs") returned 0
	[0135.219] lstrlenA (lpString="*.vbs") returned 5
	[0135.219] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.bat") returned 0
	[0135.219] lstrlenA (lpString="*.bat") returned 5
	[0135.219] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.cmd") returned 0
	[0135.219] lstrlenA (lpString="*.cmd") returned 5
	[0135.219] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.js") returned 0
	[0135.219] lstrlenA (lpString="*.js") returned 4
	[0135.219] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.jscript") returned 0
	[0135.219] lstrlenA (lpString="*.jscript") returned 9
	[0135.219] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.hta") returned 0
	[0135.219] lstrlenA (lpString="*.hta") returned 5
	[0135.219] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.php7") returned 0
	[0135.219] lstrlenA (lpString="*.php7") returned 6
	[0135.219] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.db") returned 0
	[0135.220] lstrlenA (lpString="*.db") returned 4
	[0135.220] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.swf") returned 0
	[0135.220] lstrlenA (lpString="*.swf") returned 5
	[0135.220] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.eml") returned 0
	[0135.220] lstrlenA (lpString="*.eml") returned 5
	[0135.220] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.part") returned 0
	[0135.220] lstrlenA (lpString="*.part") returned 6
	[0135.220] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.nfo") returned 0
	[0135.220] lstrlenA (lpString="*.nfo") returned 5
	[0135.220] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.rsa") returned 0
	[0135.220] lstrlenA (lpString="*.rsa") returned 5
	[0135.220] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.key") returned 0
	[0135.220] lstrlenA (lpString="*.key") returned 5
	[0135.220] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.aes") returned 0
	[0135.220] lstrlenA (lpString="*.aes") returned 5
	[0135.220] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.blob") returned 0
	[0135.220] lstrlenA (lpString="*.blob") returned 6
	[0135.220] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.btc") returned 0
	[0135.220] lstrlenA (lpString="*.btc") returned 5
	[0135.220] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\kPFqZ\\M9t7cimcHHASa1dI7GWr.m4a", pszSpec="*.wallet") returned 0
	[0135.220] lstrlenA (lpString="*.wallet") returned 8
	[0135.220] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42b58e20, ftCreationTime.dwHighDateTime=0x1d4d076, ftLastAccessTime.dwLowDateTime=0x7d3f3ca0, ftLastAccessTime.dwHighDateTime=0x1d4cb9c, ftLastWriteTime.dwLowDateTime=0x7d3f3ca0, ftLastWriteTime.dwHighDateTime=0x1d4cb9c, nFileSizeHigh=0x0, nFileSizeLow=0x17210, dwReserved0=0x0, dwReserved1=0x0, cFileName="M9t7cimcHHASa1dI7GWr.m4a", cAlternateFileName="M9T7CI~1.M4A")) returned 0
	[0135.220] FindClose (in: hFindFile=0x7cbbd0 | out: hFindFile=0x7cbbd0) returned 1
	[0135.220] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24120650, ftCreationTime.dwHighDateTime=0x1d4d509, ftLastAccessTime.dwLowDateTime=0xdc6c91b0, ftLastAccessTime.dwHighDateTime=0x1d4d389, ftLastWriteTime.dwLowDateTime=0xdc6c91b0, ftLastWriteTime.dwHighDateTime=0x1d4d389, nFileSizeHigh=0x0, nFileSizeLow=0x15c8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="N6nBAO.wav", cAlternateFileName="")) returned 1
	[0135.220] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0135.220] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="N6nBAO.wav") returned -1
	[0135.220] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="N6nBAO.wav") returned -1
	[0135.220] lstrcmpiA (lpString1="", lpString2="N6nBAO.wav") returned -1
	[0135.220] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\*.*") returned="*.*"
	[0135.220] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\"
	[0135.220] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\") returned=""
	[0135.221] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.221] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\how-to-decrypt-files.htm")) returned 0x20
	[0135.221] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\", lpString2="N6nBAO.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav"
	[0135.221] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav", pszSpec="*.zip") returned 0
	[0135.221] lstrlenA (lpString="*.zip") returned 5
	[0135.221] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav", pszSpec="*.rar") returned 0
	[0135.221] lstrlenA (lpString="*.rar") returned 5
	[0135.221] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav", pszSpec="*.7z") returned 0
	[0135.221] lstrlenA (lpString="*.7z") returned 4
	[0135.221] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav", pszSpec="*.tar") returned 0
	[0135.221] lstrlenA (lpString="*.tar") returned 5
	[0135.221] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav", pszSpec="*.gzip") returned 0
	[0135.221] lstrlenA (lpString="*.gzip") returned 6
	[0135.221] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav", pszSpec="*.jpg") returned 0
	[0135.221] lstrlenA (lpString="*.jpg") returned 5
	[0135.221] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav", pszSpec="*.jpeg") returned 0
	[0135.221] lstrlenA (lpString="*.jpeg") returned 6
	[0135.221] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav", pszSpec="*.bmp") returned 0
	[0135.221] lstrlenA (lpString="*.bmp") returned 5
	[0135.221] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav", pszSpec="*.gif") returned 0
	[0135.221] lstrlenA (lpString="*.gif") returned 5
	[0135.221] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav", pszSpec="*.png") returned 0
	[0135.221] lstrlenA (lpString="*.png") returned 5
	[0135.221] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav", pszSpec="*.doc") returned 0
	[0135.221] lstrlenA (lpString="*.doc") returned 5
	[0135.221] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav", pszSpec="*.docx") returned 0
	[0135.221] lstrlenA (lpString="*.docx") returned 6
	[0135.221] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav", pszSpec="*.xls") returned 0
	[0135.221] lstrlenA (lpString="*.xls") returned 5
	[0135.221] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav", pszSpec="*.xlsx") returned 0
	[0135.221] lstrlenA (lpString="*.xlsx") returned 6
	[0135.221] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav", pszSpec="*.ppt") returned 0
	[0135.222] lstrlenA (lpString="*.ppt") returned 5
	[0135.222] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav", pszSpec="*.pptx") returned 0
	[0135.222] lstrlenA (lpString="*.pptx") returned 6
	[0135.222] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav", pszSpec="*.txt") returned 0
	[0135.222] lstrlenA (lpString="*.txt") returned 5
	[0135.222] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav", pszSpec="*.pdf") returned 0
	[0135.222] lstrlenA (lpString="*.pdf") returned 5
	[0135.222] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav", pszSpec="*.htm") returned 0
	[0135.222] lstrlenA (lpString="*.htm") returned 5
	[0135.222] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav", pszSpec="*.html") returned 0
	[0135.222] lstrlenA (lpString="*.html") returned 6
	[0135.222] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav", pszSpec="*.mdb") returned 0
	[0135.222] lstrlenA (lpString="*.mdb") returned 5
	[0135.222] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav", pszSpec="*.pfx") returned 0
	[0135.222] lstrlenA (lpString="*.pfx") returned 5
	[0135.222] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav", pszSpec="*.md") returned 0
	[0135.222] lstrlenA (lpString="*.md") returned 4
	[0135.222] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav", pszSpec="*.lnk") returned 0
	[0135.222] lstrlenA (lpString="*.lnk") returned 5
	[0135.222] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav", pszSpec="*.torrent") returned 0
	[0135.222] lstrlenA (lpString="*.torrent") returned 9
	[0135.222] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav", pszSpec="*.mov") returned 0
	[0135.222] lstrlenA (lpString="*.mov") returned 5
	[0135.222] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav", pszSpec="*.3gp") returned 0
	[0135.222] lstrlenA (lpString="*.3gp") returned 5
	[0135.222] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav", pszSpec="*.mpeg") returned 0
	[0135.222] lstrlenA (lpString="*.mpeg") returned 6
	[0135.222] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav", pszSpec="*.mpg") returned 0
	[0135.222] lstrlenA (lpString="*.mpg") returned 5
	[0135.222] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav", pszSpec="*.flv") returned 0
	[0135.222] lstrlenA (lpString="*.flv") returned 5
	[0135.222] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav", pszSpec="*.avi") returned 0
	[0135.222] lstrlenA (lpString="*.avi") returned 5
	[0135.222] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav", pszSpec="*.mp4") returned 0
	[0135.222] lstrlenA (lpString="*.mp4") returned 5
	[0135.223] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav", pszSpec="*.wmv") returned 0
	[0135.223] lstrlenA (lpString="*.wmv") returned 5
	[0135.223] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav", pszSpec="*.mkv") returned 0
	[0135.223] lstrlenA (lpString="*.mkv") returned 5
	[0135.223] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav", pszSpec="*.mp3") returned 0
	[0135.223] lstrlenA (lpString="*.mp3") returned 5
	[0135.223] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav", pszSpec="*.wav") returned 1
	[0135.223] lstrlenA (lpString="*.wav") returned 5
	[0135.223] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav"
	[0135.223] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav"
	[0135.223] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav.") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav."
	[0135.223] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav.exe") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav.exe"
	[0135.223] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\n6nbao.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0135.223] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15c8f
	[0135.223] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x24120650, dwHighDateTime=0x1d4d509), lpLastAccessTime=0x407536*(dwLowDateTime=0xdc6c91b0, dwHighDateTime=0x1d4d389), lpLastWriteTime=0x40753e*(dwLowDateTime=0xdc6c91b0, dwHighDateTime=0x1d4d389)) returned 1
	[0135.223] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.223] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x15c4d, lpOverlapped=0x0) returned 1
	[0135.225] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav") returned="N6nBAO.wav"
	[0135.225] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.225] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x15c4d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x15c4d, lpOverlapped=0x0) returned 1
	[0135.225] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.225] CloseHandle (hObject=0x210) returned 1
	[0135.225] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\n6nbao.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav.exe" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\n6nbao.wav.exe")) returned 1
	[0135.226] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3af4ecf0, ftCreationTime.dwHighDateTime=0x1d4cb4c, ftLastAccessTime.dwLowDateTime=0xaad60cb0, ftLastAccessTime.dwHighDateTime=0x1d4c5ee, ftLastWriteTime.dwLowDateTime=0xaad60cb0, ftLastWriteTime.dwHighDateTime=0x1d4c5ee, nFileSizeHigh=0x0, nFileSizeLow=0x1d41, dwReserved0=0x0, dwReserved1=0x1, cFileName="o9AIEJfO6WjHyD3.mp3", cAlternateFileName="O9AIEJ~1.MP3")) returned 1
	[0135.226] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0135.226] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="o9AIEJfO6WjHyD3.mp3") returned -1
	[0135.226] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="o9AIEJfO6WjHyD3.mp3") returned -1
	[0135.226] lstrcmpiA (lpString1="", lpString2="o9AIEJfO6WjHyD3.mp3") returned -1
	[0135.226] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\N6nBAO.wav") returned="N6nBAO.wav"
	[0135.226] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\"
	[0135.227] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\") returned=""
	[0135.227] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.227] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\how-to-decrypt-files.htm")) returned 0x20
	[0135.227] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\", lpString2="o9AIEJfO6WjHyD3.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3"
	[0135.227] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3", pszSpec="*.zip") returned 0
	[0135.227] lstrlenA (lpString="*.zip") returned 5
	[0135.227] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3", pszSpec="*.rar") returned 0
	[0135.227] lstrlenA (lpString="*.rar") returned 5
	[0135.227] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3", pszSpec="*.7z") returned 0
	[0135.227] lstrlenA (lpString="*.7z") returned 4
	[0135.227] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3", pszSpec="*.tar") returned 0
	[0135.227] lstrlenA (lpString="*.tar") returned 5
	[0135.227] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3", pszSpec="*.gzip") returned 0
	[0135.227] lstrlenA (lpString="*.gzip") returned 6
	[0135.227] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3", pszSpec="*.jpg") returned 0
	[0135.227] lstrlenA (lpString="*.jpg") returned 5
	[0135.227] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3", pszSpec="*.jpeg") returned 0
	[0135.227] lstrlenA (lpString="*.jpeg") returned 6
	[0135.227] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3", pszSpec="*.bmp") returned 0
	[0135.227] lstrlenA (lpString="*.bmp") returned 5
	[0135.227] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3", pszSpec="*.gif") returned 0
	[0135.227] lstrlenA (lpString="*.gif") returned 5
	[0135.227] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3", pszSpec="*.png") returned 0
	[0135.227] lstrlenA (lpString="*.png") returned 5
	[0135.227] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3", pszSpec="*.doc") returned 0
	[0135.227] lstrlenA (lpString="*.doc") returned 5
	[0135.227] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3", pszSpec="*.docx") returned 0
	[0135.227] lstrlenA (lpString="*.docx") returned 6
	[0135.227] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3", pszSpec="*.xls") returned 0
	[0135.227] lstrlenA (lpString="*.xls") returned 5
	[0135.227] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3", pszSpec="*.xlsx") returned 0
	[0135.227] lstrlenA (lpString="*.xlsx") returned 6
	[0135.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3", pszSpec="*.ppt") returned 0
	[0135.228] lstrlenA (lpString="*.ppt") returned 5
	[0135.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3", pszSpec="*.pptx") returned 0
	[0135.228] lstrlenA (lpString="*.pptx") returned 6
	[0135.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3", pszSpec="*.txt") returned 0
	[0135.228] lstrlenA (lpString="*.txt") returned 5
	[0135.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3", pszSpec="*.pdf") returned 0
	[0135.228] lstrlenA (lpString="*.pdf") returned 5
	[0135.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3", pszSpec="*.htm") returned 0
	[0135.228] lstrlenA (lpString="*.htm") returned 5
	[0135.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3", pszSpec="*.html") returned 0
	[0135.228] lstrlenA (lpString="*.html") returned 6
	[0135.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3", pszSpec="*.mdb") returned 0
	[0135.228] lstrlenA (lpString="*.mdb") returned 5
	[0135.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3", pszSpec="*.pfx") returned 0
	[0135.228] lstrlenA (lpString="*.pfx") returned 5
	[0135.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3", pszSpec="*.md") returned 0
	[0135.228] lstrlenA (lpString="*.md") returned 4
	[0135.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3", pszSpec="*.lnk") returned 0
	[0135.228] lstrlenA (lpString="*.lnk") returned 5
	[0135.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3", pszSpec="*.torrent") returned 0
	[0135.228] lstrlenA (lpString="*.torrent") returned 9
	[0135.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3", pszSpec="*.mov") returned 0
	[0135.228] lstrlenA (lpString="*.mov") returned 5
	[0135.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3", pszSpec="*.3gp") returned 0
	[0135.228] lstrlenA (lpString="*.3gp") returned 5
	[0135.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3", pszSpec="*.mpeg") returned 0
	[0135.228] lstrlenA (lpString="*.mpeg") returned 6
	[0135.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3", pszSpec="*.mpg") returned 0
	[0135.228] lstrlenA (lpString="*.mpg") returned 5
	[0135.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3", pszSpec="*.flv") returned 0
	[0135.228] lstrlenA (lpString="*.flv") returned 5
	[0135.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3", pszSpec="*.avi") returned 0
	[0135.228] lstrlenA (lpString="*.avi") returned 5
	[0135.228] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3", pszSpec="*.mp4") returned 0
	[0135.228] lstrlenA (lpString="*.mp4") returned 5
	[0135.229] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3", pszSpec="*.wmv") returned 0
	[0135.229] lstrlenA (lpString="*.wmv") returned 5
	[0135.229] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3", pszSpec="*.mkv") returned 0
	[0135.229] lstrlenA (lpString="*.mkv") returned 5
	[0135.229] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3", pszSpec="*.mp3") returned 1
	[0135.229] lstrlenA (lpString="*.mp3") returned 5
	[0135.229] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3"
	[0135.229] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3"
	[0135.229] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3.") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3."
	[0135.229] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3.exe") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3.exe"
	[0135.229] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\o9aiejfo6wjhyd3.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0135.229] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d41
	[0135.229] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3af4ecf0, dwHighDateTime=0x1d4cb4c), lpLastAccessTime=0x407536*(dwLowDateTime=0xaad60cb0, dwHighDateTime=0x1d4c5ee), lpLastWriteTime=0x40753e*(dwLowDateTime=0xaad60cb0, dwHighDateTime=0x1d4c5ee)) returned 1
	[0135.229] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.229] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1cff, lpOverlapped=0x0) returned 1
	[0135.230] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3") returned="o9AIEJfO6WjHyD3.mp3"
	[0135.230] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.230] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1cff, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1cff, lpOverlapped=0x0) returned 1
	[0135.230] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.230] CloseHandle (hObject=0x210) returned 1
	[0135.230] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\o9aiejfo6wjhyd3.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3.exe" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\o9aiejfo6wjhyd3.mp3.exe")) returned 1
	[0135.231] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbde370, ftCreationTime.dwHighDateTime=0x1d4c6b5, ftLastAccessTime.dwLowDateTime=0x388b5550, ftLastAccessTime.dwHighDateTime=0x1d4c83e, ftLastWriteTime.dwLowDateTime=0x388b5550, ftLastWriteTime.dwHighDateTime=0x1d4c83e, nFileSizeHigh=0x0, nFileSizeLow=0xc9fb, dwReserved0=0x0, dwReserved1=0x1, cFileName="xnEChqbXwen0MJA7OL.mp3", cAlternateFileName="XNECHQ~1.MP3")) returned 1
	[0135.231] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0135.231] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="xnEChqbXwen0MJA7OL.mp3") returned -1
	[0135.231] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="xnEChqbXwen0MJA7OL.mp3") returned -1
	[0135.231] lstrcmpiA (lpString1="", lpString2="xnEChqbXwen0MJA7OL.mp3") returned -1
	[0135.231] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\o9AIEJfO6WjHyD3.mp3") returned="o9AIEJfO6WjHyD3.mp3"
	[0135.231] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\"
	[0135.231] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\") returned=""
	[0135.231] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.231] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\how-to-decrypt-files.htm")) returned 0x20
	[0135.231] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\", lpString2="xnEChqbXwen0MJA7OL.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3"
	[0135.231] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3", pszSpec="*.zip") returned 0
	[0135.231] lstrlenA (lpString="*.zip") returned 5
	[0135.231] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3", pszSpec="*.rar") returned 0
	[0135.231] lstrlenA (lpString="*.rar") returned 5
	[0135.231] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3", pszSpec="*.7z") returned 0
	[0135.231] lstrlenA (lpString="*.7z") returned 4
	[0135.231] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3", pszSpec="*.tar") returned 0
	[0135.232] lstrlenA (lpString="*.tar") returned 5
	[0135.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3", pszSpec="*.gzip") returned 0
	[0135.232] lstrlenA (lpString="*.gzip") returned 6
	[0135.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3", pszSpec="*.jpg") returned 0
	[0135.232] lstrlenA (lpString="*.jpg") returned 5
	[0135.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3", pszSpec="*.jpeg") returned 0
	[0135.232] lstrlenA (lpString="*.jpeg") returned 6
	[0135.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3", pszSpec="*.bmp") returned 0
	[0135.232] lstrlenA (lpString="*.bmp") returned 5
	[0135.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3", pszSpec="*.gif") returned 0
	[0135.232] lstrlenA (lpString="*.gif") returned 5
	[0135.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3", pszSpec="*.png") returned 0
	[0135.232] lstrlenA (lpString="*.png") returned 5
	[0135.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3", pszSpec="*.doc") returned 0
	[0135.232] lstrlenA (lpString="*.doc") returned 5
	[0135.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3", pszSpec="*.docx") returned 0
	[0135.232] lstrlenA (lpString="*.docx") returned 6
	[0135.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3", pszSpec="*.xls") returned 0
	[0135.232] lstrlenA (lpString="*.xls") returned 5
	[0135.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3", pszSpec="*.xlsx") returned 0
	[0135.232] lstrlenA (lpString="*.xlsx") returned 6
	[0135.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3", pszSpec="*.ppt") returned 0
	[0135.232] lstrlenA (lpString="*.ppt") returned 5
	[0135.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3", pszSpec="*.pptx") returned 0
	[0135.232] lstrlenA (lpString="*.pptx") returned 6
	[0135.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3", pszSpec="*.txt") returned 0
	[0135.232] lstrlenA (lpString="*.txt") returned 5
	[0135.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3", pszSpec="*.pdf") returned 0
	[0135.232] lstrlenA (lpString="*.pdf") returned 5
	[0135.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3", pszSpec="*.htm") returned 0
	[0135.232] lstrlenA (lpString="*.htm") returned 5
	[0135.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3", pszSpec="*.html") returned 0
	[0135.232] lstrlenA (lpString="*.html") returned 6
	[0135.232] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3", pszSpec="*.mdb") returned 0
	[0135.232] lstrlenA (lpString="*.mdb") returned 5
	[0135.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3", pszSpec="*.pfx") returned 0
	[0135.233] lstrlenA (lpString="*.pfx") returned 5
	[0135.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3", pszSpec="*.md") returned 0
	[0135.233] lstrlenA (lpString="*.md") returned 4
	[0135.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3", pszSpec="*.lnk") returned 0
	[0135.233] lstrlenA (lpString="*.lnk") returned 5
	[0135.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3", pszSpec="*.torrent") returned 0
	[0135.233] lstrlenA (lpString="*.torrent") returned 9
	[0135.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3", pszSpec="*.mov") returned 0
	[0135.233] lstrlenA (lpString="*.mov") returned 5
	[0135.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3", pszSpec="*.3gp") returned 0
	[0135.233] lstrlenA (lpString="*.3gp") returned 5
	[0135.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3", pszSpec="*.mpeg") returned 0
	[0135.233] lstrlenA (lpString="*.mpeg") returned 6
	[0135.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3", pszSpec="*.mpg") returned 0
	[0135.233] lstrlenA (lpString="*.mpg") returned 5
	[0135.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3", pszSpec="*.flv") returned 0
	[0135.233] lstrlenA (lpString="*.flv") returned 5
	[0135.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3", pszSpec="*.avi") returned 0
	[0135.233] lstrlenA (lpString="*.avi") returned 5
	[0135.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3", pszSpec="*.mp4") returned 0
	[0135.233] lstrlenA (lpString="*.mp4") returned 5
	[0135.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3", pszSpec="*.wmv") returned 0
	[0135.233] lstrlenA (lpString="*.wmv") returned 5
	[0135.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3", pszSpec="*.mkv") returned 0
	[0135.233] lstrlenA (lpString="*.mkv") returned 5
	[0135.233] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3", pszSpec="*.mp3") returned 1
	[0135.233] lstrlenA (lpString="*.mp3") returned 5
	[0135.233] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3"
	[0135.233] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3"
	[0135.233] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3.") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3."
	[0135.233] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3.exe") returned="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3.exe"
	[0135.233] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\xnechqbxwen0mja7ol.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0135.234] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc9fb
	[0135.234] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xfbde370, dwHighDateTime=0x1d4c6b5), lpLastAccessTime=0x407536*(dwLowDateTime=0x388b5550, dwHighDateTime=0x1d4c83e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x388b5550, dwHighDateTime=0x1d4c83e)) returned 1
	[0135.234] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.234] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xc9b9, lpOverlapped=0x0) returned 1
	[0135.235] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3") returned="xnEChqbXwen0MJA7OL.mp3"
	[0135.235] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.235] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xc9b9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xc9b9, lpOverlapped=0x0) returned 1
	[0135.235] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.235] CloseHandle (hObject=0x210) returned 1
	[0135.236] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\xnechqbxwen0mja7ol.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Hi_G UBIbBkjtun\\xnEChqbXwen0MJA7OL.mp3.exe" (normalized: "c:\\users\\fd1hvy\\music\\hi_g ubibbkjtun\\xnechqbxwen0mja7ol.mp3.exe")) returned 1
	[0135.236] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbde370, ftCreationTime.dwHighDateTime=0x1d4c6b5, ftLastAccessTime.dwLowDateTime=0x388b5550, ftLastAccessTime.dwHighDateTime=0x1d4c83e, ftLastWriteTime.dwLowDateTime=0x388b5550, ftLastWriteTime.dwHighDateTime=0x1d4c83e, nFileSizeHigh=0x0, nFileSizeLow=0xc9fb, dwReserved0=0x0, dwReserved1=0x1, cFileName="xnEChqbXwen0MJA7OL.mp3", cAlternateFileName="XNECHQ~1.MP3")) returned 0
	[0135.236] FindClose (in: hFindFile=0x7cb750 | out: hFindFile=0x7cb750) returned 1
	[0135.236] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac10f330, ftCreationTime.dwHighDateTime=0x1d4d3cf, ftLastAccessTime.dwLowDateTime=0x46178120, ftLastAccessTime.dwHighDateTime=0x1d4ca10, ftLastWriteTime.dwLowDateTime=0x46178120, ftLastWriteTime.dwHighDateTime=0x1d4ca10, nFileSizeHigh=0x0, nFileSizeLow=0x15d52, dwReserved0=0x20, dwReserved1=0x1000000, cFileName="I1ZlcoCjIWQKak0-9FL.m4a", cAlternateFileName="I1ZLCO~1.M4A")) returned 1
	[0135.236] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.236] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="I1ZlcoCjIWQKak0-9FL.m4a") returned -1
	[0135.236] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="I1ZlcoCjIWQKak0-9FL.m4a") returned -1
	[0135.236] lstrcmpiA (lpString1="", lpString2="I1ZlcoCjIWQKak0-9FL.m4a") returned -1
	[0135.236] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\*.*") returned="*.*"
	[0135.236] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\"
	[0135.236] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\") returned=""
	[0135.237] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.237] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\how-to-decrypt-files.htm")) returned 0x20
	[0135.237] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="I1ZlcoCjIWQKak0-9FL.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a") returned="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a"
	[0135.237] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.zip") returned 0
	[0135.237] lstrlenA (lpString="*.zip") returned 5
	[0135.237] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.rar") returned 0
	[0135.237] lstrlenA (lpString="*.rar") returned 5
	[0135.237] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.7z") returned 0
	[0135.237] lstrlenA (lpString="*.7z") returned 4
	[0135.237] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.tar") returned 0
	[0135.237] lstrlenA (lpString="*.tar") returned 5
	[0135.237] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.gzip") returned 0
	[0135.237] lstrlenA (lpString="*.gzip") returned 6
	[0135.237] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.jpg") returned 0
	[0135.237] lstrlenA (lpString="*.jpg") returned 5
	[0135.237] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.jpeg") returned 0
	[0135.237] lstrlenA (lpString="*.jpeg") returned 6
	[0135.237] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.bmp") returned 0
	[0135.237] lstrlenA (lpString="*.bmp") returned 5
	[0135.237] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.gif") returned 0
	[0135.237] lstrlenA (lpString="*.gif") returned 5
	[0135.237] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.png") returned 0
	[0135.237] lstrlenA (lpString="*.png") returned 5
	[0135.237] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.doc") returned 0
	[0135.237] lstrlenA (lpString="*.doc") returned 5
	[0135.237] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.docx") returned 0
	[0135.237] lstrlenA (lpString="*.docx") returned 6
	[0135.237] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.xls") returned 0
	[0135.237] lstrlenA (lpString="*.xls") returned 5
	[0135.237] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.xlsx") returned 0
	[0135.237] lstrlenA (lpString="*.xlsx") returned 6
	[0135.237] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.ppt") returned 0
	[0135.238] lstrlenA (lpString="*.ppt") returned 5
	[0135.238] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.pptx") returned 0
	[0135.238] lstrlenA (lpString="*.pptx") returned 6
	[0135.238] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.txt") returned 0
	[0135.238] lstrlenA (lpString="*.txt") returned 5
	[0135.238] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.pdf") returned 0
	[0135.238] lstrlenA (lpString="*.pdf") returned 5
	[0135.238] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.htm") returned 0
	[0135.238] lstrlenA (lpString="*.htm") returned 5
	[0135.238] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.html") returned 0
	[0135.238] lstrlenA (lpString="*.html") returned 6
	[0135.238] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.mdb") returned 0
	[0135.238] lstrlenA (lpString="*.mdb") returned 5
	[0135.238] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.pfx") returned 0
	[0135.238] lstrlenA (lpString="*.pfx") returned 5
	[0135.238] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.md") returned 0
	[0135.238] lstrlenA (lpString="*.md") returned 4
	[0135.238] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.lnk") returned 0
	[0135.238] lstrlenA (lpString="*.lnk") returned 5
	[0135.238] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.torrent") returned 0
	[0135.238] lstrlenA (lpString="*.torrent") returned 9
	[0135.238] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.mov") returned 0
	[0135.238] lstrlenA (lpString="*.mov") returned 5
	[0135.238] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.3gp") returned 0
	[0135.238] lstrlenA (lpString="*.3gp") returned 5
	[0135.238] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.mpeg") returned 0
	[0135.238] lstrlenA (lpString="*.mpeg") returned 6
	[0135.238] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.mpg") returned 0
	[0135.238] lstrlenA (lpString="*.mpg") returned 5
	[0135.238] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.flv") returned 0
	[0135.238] lstrlenA (lpString="*.flv") returned 5
	[0135.238] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.avi") returned 0
	[0135.238] lstrlenA (lpString="*.avi") returned 5
	[0135.238] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.mp4") returned 0
	[0135.239] lstrlenA (lpString="*.mp4") returned 5
	[0135.239] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.wmv") returned 0
	[0135.239] lstrlenA (lpString="*.wmv") returned 5
	[0135.239] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.mkv") returned 0
	[0135.239] lstrlenA (lpString="*.mkv") returned 5
	[0135.239] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.mp3") returned 0
	[0135.239] lstrlenA (lpString="*.mp3") returned 5
	[0135.239] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.wav") returned 0
	[0135.239] lstrlenA (lpString="*.wav") returned 5
	[0135.239] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.flac") returned 0
	[0135.239] lstrlenA (lpString="*.flac") returned 6
	[0135.239] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.wma") returned 0
	[0135.239] lstrlenA (lpString="*.wma") returned 5
	[0135.239] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.au3") returned 0
	[0135.239] lstrlenA (lpString="*.au3") returned 5
	[0135.239] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.ahk") returned 0
	[0135.239] lstrlenA (lpString="*.ahk") returned 5
	[0135.239] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.c") returned 0
	[0135.239] lstrlenA (lpString="*.c") returned 3
	[0135.239] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.cc") returned 0
	[0135.239] lstrlenA (lpString="*.cc") returned 4
	[0135.239] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.cpp") returned 0
	[0135.239] lstrlenA (lpString="*.cpp") returned 5
	[0135.239] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.cxx") returned 0
	[0135.239] lstrlenA (lpString="*.cxx") returned 5
	[0135.239] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.c++") returned 0
	[0135.239] lstrlenA (lpString="*.c++") returned 5
	[0135.239] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.cs") returned 0
	[0135.239] lstrlenA (lpString="*.cs") returned 4
	[0135.239] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.vb") returned 0
	[0135.239] lstrlenA (lpString="*.vb") returned 4
	[0135.239] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.bas") returned 0
	[0135.239] lstrlenA (lpString="*.bas") returned 5
	[0135.239] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.csproj") returned 0
	[0135.240] lstrlenA (lpString="*.csproj") returned 8
	[0135.240] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.vbproj") returned 0
	[0135.240] lstrlenA (lpString="*.vbproj") returned 8
	[0135.240] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.vcxproj") returned 0
	[0135.240] lstrlenA (lpString="*.vcxproj") returned 9
	[0135.240] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.manifest") returned 0
	[0135.240] lstrlenA (lpString="*.manifest") returned 10
	[0135.240] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.php") returned 0
	[0135.240] lstrlenA (lpString="*.php") returned 5
	[0135.240] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.vbe") returned 0
	[0135.240] lstrlenA (lpString="*.vbe") returned 5
	[0135.240] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.vba") returned 0
	[0135.240] lstrlenA (lpString="*.vba") returned 5
	[0135.240] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.vbs") returned 0
	[0135.240] lstrlenA (lpString="*.vbs") returned 5
	[0135.240] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.bat") returned 0
	[0135.240] lstrlenA (lpString="*.bat") returned 5
	[0135.240] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.cmd") returned 0
	[0135.240] lstrlenA (lpString="*.cmd") returned 5
	[0135.240] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.js") returned 0
	[0135.240] lstrlenA (lpString="*.js") returned 4
	[0135.240] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.jscript") returned 0
	[0135.240] lstrlenA (lpString="*.jscript") returned 9
	[0135.240] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.hta") returned 0
	[0135.240] lstrlenA (lpString="*.hta") returned 5
	[0135.240] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.php7") returned 0
	[0135.240] lstrlenA (lpString="*.php7") returned 6
	[0135.240] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.db") returned 0
	[0135.240] lstrlenA (lpString="*.db") returned 4
	[0135.240] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.swf") returned 0
	[0135.240] lstrlenA (lpString="*.swf") returned 5
	[0135.240] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.eml") returned 0
	[0135.240] lstrlenA (lpString="*.eml") returned 5
	[0135.240] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.part") returned 0
	[0135.240] lstrlenA (lpString="*.part") returned 6
	[0135.240] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.nfo") returned 0
	[0135.241] lstrlenA (lpString="*.nfo") returned 5
	[0135.241] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.rsa") returned 0
	[0135.241] lstrlenA (lpString="*.rsa") returned 5
	[0135.241] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.key") returned 0
	[0135.241] lstrlenA (lpString="*.key") returned 5
	[0135.241] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.aes") returned 0
	[0135.241] lstrlenA (lpString="*.aes") returned 5
	[0135.241] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.blob") returned 0
	[0135.241] lstrlenA (lpString="*.blob") returned 6
	[0135.241] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.btc") returned 0
	[0135.241] lstrlenA (lpString="*.btc") returned 5
	[0135.241] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a", pszSpec="*.wallet") returned 0
	[0135.241] lstrlenA (lpString="*.wallet") returned 8
	[0135.241] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24325d70, ftCreationTime.dwHighDateTime=0x1d4ca72, ftLastAccessTime.dwLowDateTime=0x8e1ecba0, ftLastAccessTime.dwHighDateTime=0x1d4d4e1, ftLastWriteTime.dwLowDateTime=0x8e1ecba0, ftLastWriteTime.dwHighDateTime=0x1d4d4e1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q1uIW", cAlternateFileName="")) returned 1
	[0135.241] lstrcmpA (lpString1=".", lpString2="Q1uIW") returned -1
	[0135.241] lstrcmpA (lpString1="..", lpString2="Q1uIW") returned -1
	[0135.241] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\I1ZlcoCjIWQKak0-9FL.m4a") returned="I1ZlcoCjIWQKak0-9FL.m4a"
	[0135.241] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="Q1uIW" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW"
	[0135.241] lstrlenA (lpString="C:\\Users\\FD1HVy\\Music\\Q1uIW") returned 27
	[0135.241] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24325d70, ftCreationTime.dwHighDateTime=0x1d4ca72, ftLastAccessTime.dwLowDateTime=0x8e1ecba0, ftLastAccessTime.dwHighDateTime=0x1d4d4e1, ftLastWriteTime.dwLowDateTime=0x8e1ecba0, ftLastWriteTime.dwHighDateTime=0x1d4d4e1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x70, cFileName=".", cAlternateFileName="")) returned 0x7cbad0
	[0135.241] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0135.241] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24325d70, ftCreationTime.dwHighDateTime=0x1d4ca72, ftLastAccessTime.dwLowDateTime=0x8e1ecba0, ftLastAccessTime.dwHighDateTime=0x1d4d4e1, ftLastWriteTime.dwLowDateTime=0x8e1ecba0, ftLastWriteTime.dwHighDateTime=0x1d4d4e1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x70, cFileName="..", cAlternateFileName="")) returned 1
	[0135.241] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0135.241] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0135.241] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa661c710, ftCreationTime.dwHighDateTime=0x1d4ca2a, ftLastAccessTime.dwLowDateTime=0x9131ec80, ftLastAccessTime.dwHighDateTime=0x1d4c903, ftLastWriteTime.dwLowDateTime=0x9131ec80, ftLastWriteTime.dwHighDateTime=0x1d4c903, nFileSizeHigh=0x0, nFileSizeLow=0x3b88, dwReserved0=0x7b0000, dwReserved1=0x70, cFileName="6ZK8.wav", cAlternateFileName="")) returned 1
	[0135.241] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0135.241] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="6ZK8.wav") returned 1
	[0135.241] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="6ZK8.wav") returned 1
	[0135.241] lstrcmpiA (lpString1="", lpString2="6ZK8.wav") returned -1
	[0135.241] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\*.*") returned="*.*"
	[0135.241] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\Q1uIW\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\"
	[0135.242] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\") returned=""
	[0135.242] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.242] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0135.242] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0135.244] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0135.244] WriteFile (in: hFile=0x210, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0135.245] SetFileTime (hFile=0x210, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0135.245] CloseHandle (hObject=0x210) returned 1
	[0135.245] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\", lpString2="6ZK8.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav"
	[0135.245] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav", pszSpec="*.zip") returned 0
	[0135.245] lstrlenA (lpString="*.zip") returned 5
	[0135.245] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav", pszSpec="*.rar") returned 0
	[0135.245] lstrlenA (lpString="*.rar") returned 5
	[0135.245] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav", pszSpec="*.7z") returned 0
	[0135.245] lstrlenA (lpString="*.7z") returned 4
	[0135.245] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav", pszSpec="*.tar") returned 0
	[0135.245] lstrlenA (lpString="*.tar") returned 5
	[0135.245] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav", pszSpec="*.gzip") returned 0
	[0135.245] lstrlenA (lpString="*.gzip") returned 6
	[0135.245] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav", pszSpec="*.jpg") returned 0
	[0135.245] lstrlenA (lpString="*.jpg") returned 5
	[0135.246] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav", pszSpec="*.jpeg") returned 0
	[0135.246] lstrlenA (lpString="*.jpeg") returned 6
	[0135.246] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav", pszSpec="*.bmp") returned 0
	[0135.246] lstrlenA (lpString="*.bmp") returned 5
	[0135.246] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav", pszSpec="*.gif") returned 0
	[0135.246] lstrlenA (lpString="*.gif") returned 5
	[0135.246] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav", pszSpec="*.png") returned 0
	[0135.246] lstrlenA (lpString="*.png") returned 5
	[0135.246] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav", pszSpec="*.doc") returned 0
	[0135.246] lstrlenA (lpString="*.doc") returned 5
	[0135.246] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav", pszSpec="*.docx") returned 0
	[0135.246] lstrlenA (lpString="*.docx") returned 6
	[0135.246] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav", pszSpec="*.xls") returned 0
	[0135.246] lstrlenA (lpString="*.xls") returned 5
	[0135.246] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav", pszSpec="*.xlsx") returned 0
	[0135.246] lstrlenA (lpString="*.xlsx") returned 6
	[0135.246] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav", pszSpec="*.ppt") returned 0
	[0135.246] lstrlenA (lpString="*.ppt") returned 5
	[0135.246] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav", pszSpec="*.pptx") returned 0
	[0135.246] lstrlenA (lpString="*.pptx") returned 6
	[0135.246] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav", pszSpec="*.txt") returned 0
	[0135.246] lstrlenA (lpString="*.txt") returned 5
	[0135.246] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav", pszSpec="*.pdf") returned 0
	[0135.246] lstrlenA (lpString="*.pdf") returned 5
	[0135.246] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav", pszSpec="*.htm") returned 0
	[0135.246] lstrlenA (lpString="*.htm") returned 5
	[0135.246] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav", pszSpec="*.html") returned 0
	[0135.246] lstrlenA (lpString="*.html") returned 6
	[0135.246] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav", pszSpec="*.mdb") returned 0
	[0135.246] lstrlenA (lpString="*.mdb") returned 5
	[0135.246] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav", pszSpec="*.pfx") returned 0
	[0135.246] lstrlenA (lpString="*.pfx") returned 5
	[0135.246] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav", pszSpec="*.md") returned 0
	[0135.246] lstrlenA (lpString="*.md") returned 4
	[0135.247] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav", pszSpec="*.lnk") returned 0
	[0135.247] lstrlenA (lpString="*.lnk") returned 5
	[0135.247] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav", pszSpec="*.torrent") returned 0
	[0135.247] lstrlenA (lpString="*.torrent") returned 9
	[0135.247] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav", pszSpec="*.mov") returned 0
	[0135.247] lstrlenA (lpString="*.mov") returned 5
	[0135.247] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav", pszSpec="*.3gp") returned 0
	[0135.247] lstrlenA (lpString="*.3gp") returned 5
	[0135.247] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav", pszSpec="*.mpeg") returned 0
	[0135.247] lstrlenA (lpString="*.mpeg") returned 6
	[0135.247] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav", pszSpec="*.mpg") returned 0
	[0135.247] lstrlenA (lpString="*.mpg") returned 5
	[0135.247] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav", pszSpec="*.flv") returned 0
	[0135.247] lstrlenA (lpString="*.flv") returned 5
	[0135.247] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav", pszSpec="*.avi") returned 0
	[0135.247] lstrlenA (lpString="*.avi") returned 5
	[0135.247] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav", pszSpec="*.mp4") returned 0
	[0135.247] lstrlenA (lpString="*.mp4") returned 5
	[0135.247] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav", pszSpec="*.wmv") returned 0
	[0135.247] lstrlenA (lpString="*.wmv") returned 5
	[0135.247] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav", pszSpec="*.mkv") returned 0
	[0135.247] lstrlenA (lpString="*.mkv") returned 5
	[0135.247] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav", pszSpec="*.mp3") returned 0
	[0135.247] lstrlenA (lpString="*.mp3") returned 5
	[0135.247] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav", pszSpec="*.wav") returned 1
	[0135.247] lstrlenA (lpString="*.wav") returned 5
	[0135.247] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav"
	[0135.247] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav"
	[0135.247] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav.") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav."
	[0135.247] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav.exe") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav.exe"
	[0135.247] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\6zk8.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0135.248] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b88
	[0135.248] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa661c710, dwHighDateTime=0x1d4ca2a), lpLastAccessTime=0x407536*(dwLowDateTime=0x9131ec80, dwHighDateTime=0x1d4c903), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9131ec80, dwHighDateTime=0x1d4c903)) returned 1
	[0135.248] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.248] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x3b46, lpOverlapped=0x0) returned 1
	[0135.249] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav") returned="6ZK8.wav"
	[0135.249] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.249] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x3b46, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x3b46, lpOverlapped=0x0) returned 1
	[0135.249] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.249] CloseHandle (hObject=0x210) returned 1
	[0135.249] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\6zk8.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav.exe" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\6zk8.wav.exe")) returned 1
	[0135.250] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0cb580, ftCreationTime.dwHighDateTime=0x1d4cb0d, ftLastAccessTime.dwLowDateTime=0x7593d3a0, ftLastAccessTime.dwHighDateTime=0x1d4d153, ftLastWriteTime.dwLowDateTime=0x7593d3a0, ftLastWriteTime.dwHighDateTime=0x1d4d153, nFileSizeHigh=0x0, nFileSizeLow=0xeab1, dwReserved0=0x12, dwReserved1=0x1, cFileName="LYis.wav", cAlternateFileName="")) returned 1
	[0135.250] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0135.250] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="LYis.wav") returned -1
	[0135.250] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="LYis.wav") returned -1
	[0135.250] lstrcmpiA (lpString1="", lpString2="LYis.wav") returned -1
	[0135.250] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\6ZK8.wav") returned="6ZK8.wav"
	[0135.250] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\Q1uIW\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\"
	[0135.250] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\") returned=""
	[0135.250] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.250] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\how-to-decrypt-files.htm")) returned 0x20
	[0135.250] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\", lpString2="LYis.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav"
	[0135.250] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav", pszSpec="*.zip") returned 0
	[0135.250] lstrlenA (lpString="*.zip") returned 5
	[0135.250] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav", pszSpec="*.rar") returned 0
	[0135.250] lstrlenA (lpString="*.rar") returned 5
	[0135.250] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav", pszSpec="*.7z") returned 0
	[0135.250] lstrlenA (lpString="*.7z") returned 4
	[0135.250] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav", pszSpec="*.tar") returned 0
	[0135.250] lstrlenA (lpString="*.tar") returned 5
	[0135.250] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav", pszSpec="*.gzip") returned 0
	[0135.250] lstrlenA (lpString="*.gzip") returned 6
	[0135.250] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav", pszSpec="*.jpg") returned 0
	[0135.250] lstrlenA (lpString="*.jpg") returned 5
	[0135.250] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav", pszSpec="*.jpeg") returned 0
	[0135.250] lstrlenA (lpString="*.jpeg") returned 6
	[0135.250] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav", pszSpec="*.bmp") returned 0
	[0135.250] lstrlenA (lpString="*.bmp") returned 5
	[0135.250] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav", pszSpec="*.gif") returned 0
	[0135.250] lstrlenA (lpString="*.gif") returned 5
	[0135.251] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav", pszSpec="*.png") returned 0
	[0135.251] lstrlenA (lpString="*.png") returned 5
	[0135.251] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav", pszSpec="*.doc") returned 0
	[0135.251] lstrlenA (lpString="*.doc") returned 5
	[0135.251] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav", pszSpec="*.docx") returned 0
	[0135.251] lstrlenA (lpString="*.docx") returned 6
	[0135.251] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav", pszSpec="*.xls") returned 0
	[0135.251] lstrlenA (lpString="*.xls") returned 5
	[0135.251] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav", pszSpec="*.xlsx") returned 0
	[0135.251] lstrlenA (lpString="*.xlsx") returned 6
	[0135.251] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav", pszSpec="*.ppt") returned 0
	[0135.251] lstrlenA (lpString="*.ppt") returned 5
	[0135.251] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav", pszSpec="*.pptx") returned 0
	[0135.251] lstrlenA (lpString="*.pptx") returned 6
	[0135.251] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav", pszSpec="*.txt") returned 0
	[0135.251] lstrlenA (lpString="*.txt") returned 5
	[0135.251] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav", pszSpec="*.pdf") returned 0
	[0135.251] lstrlenA (lpString="*.pdf") returned 5
	[0135.251] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav", pszSpec="*.htm") returned 0
	[0135.251] lstrlenA (lpString="*.htm") returned 5
	[0135.251] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav", pszSpec="*.html") returned 0
	[0135.251] lstrlenA (lpString="*.html") returned 6
	[0135.251] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav", pszSpec="*.mdb") returned 0
	[0135.251] lstrlenA (lpString="*.mdb") returned 5
	[0135.251] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav", pszSpec="*.pfx") returned 0
	[0135.251] lstrlenA (lpString="*.pfx") returned 5
	[0135.251] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav", pszSpec="*.md") returned 0
	[0135.251] lstrlenA (lpString="*.md") returned 4
	[0135.251] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav", pszSpec="*.lnk") returned 0
	[0135.251] lstrlenA (lpString="*.lnk") returned 5
	[0135.251] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav", pszSpec="*.torrent") returned 0
	[0135.251] lstrlenA (lpString="*.torrent") returned 9
	[0135.251] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav", pszSpec="*.mov") returned 0
	[0135.251] lstrlenA (lpString="*.mov") returned 5
	[0135.251] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav", pszSpec="*.3gp") returned 0
	[0135.251] lstrlenA (lpString="*.3gp") returned 5
	[0135.252] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav", pszSpec="*.mpeg") returned 0
	[0135.252] lstrlenA (lpString="*.mpeg") returned 6
	[0135.252] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav", pszSpec="*.mpg") returned 0
	[0135.252] lstrlenA (lpString="*.mpg") returned 5
	[0135.252] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav", pszSpec="*.flv") returned 0
	[0135.252] lstrlenA (lpString="*.flv") returned 5
	[0135.252] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav", pszSpec="*.avi") returned 0
	[0135.252] lstrlenA (lpString="*.avi") returned 5
	[0135.252] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav", pszSpec="*.mp4") returned 0
	[0135.252] lstrlenA (lpString="*.mp4") returned 5
	[0135.252] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav", pszSpec="*.wmv") returned 0
	[0135.252] lstrlenA (lpString="*.wmv") returned 5
	[0135.252] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav", pszSpec="*.mkv") returned 0
	[0135.252] lstrlenA (lpString="*.mkv") returned 5
	[0135.252] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav", pszSpec="*.mp3") returned 0
	[0135.252] lstrlenA (lpString="*.mp3") returned 5
	[0135.252] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav", pszSpec="*.wav") returned 1
	[0135.252] lstrlenA (lpString="*.wav") returned 5
	[0135.252] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav"
	[0135.252] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav"
	[0135.252] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav.") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav."
	[0135.252] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav.exe") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav.exe"
	[0135.252] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\lyis.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0135.252] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xeab1
	[0135.252] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xaa0cb580, dwHighDateTime=0x1d4cb0d), lpLastAccessTime=0x407536*(dwLowDateTime=0x7593d3a0, dwHighDateTime=0x1d4d153), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7593d3a0, dwHighDateTime=0x1d4d153)) returned 1
	[0135.253] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.253] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xea6f, lpOverlapped=0x0) returned 1
	[0135.254] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav") returned="LYis.wav"
	[0135.254] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.254] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xea6f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xea6f, lpOverlapped=0x0) returned 1
	[0135.254] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.254] CloseHandle (hObject=0x210) returned 1
	[0135.254] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\lyis.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav.exe" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\lyis.wav.exe")) returned 1
	[0135.255] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6dff840, ftCreationTime.dwHighDateTime=0x1d4cbd2, ftLastAccessTime.dwLowDateTime=0xc254a2b0, ftLastAccessTime.dwHighDateTime=0x1d4c798, ftLastWriteTime.dwLowDateTime=0xc254a2b0, ftLastWriteTime.dwHighDateTime=0x1d4c798, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x12, dwReserved1=0x1, cFileName="o7e663sUPh6nPDOiLiB", cAlternateFileName="O7E663~1")) returned 1
	[0135.255] lstrcmpA (lpString1=".", lpString2="o7e663sUPh6nPDOiLiB") returned -1
	[0135.255] lstrcmpA (lpString1="..", lpString2="o7e663sUPh6nPDOiLiB") returned -1
	[0135.255] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\LYis.wav") returned="LYis.wav"
	[0135.255] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\", lpString2="o7e663sUPh6nPDOiLiB" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB"
	[0135.255] lstrlenA (lpString="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB") returned 47
	[0135.255] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6dff840, ftCreationTime.dwHighDateTime=0x1d4cbd2, ftLastAccessTime.dwLowDateTime=0xc254a2b0, ftLastAccessTime.dwHighDateTime=0x1d4c798, ftLastWriteTime.dwLowDateTime=0xc254a2b0, ftLastWriteTime.dwHighDateTime=0x1d4c798, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName=".", cAlternateFileName="")) returned 0x7cb650
	[0135.255] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0135.255] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6dff840, ftCreationTime.dwHighDateTime=0x1d4cbd2, ftLastAccessTime.dwLowDateTime=0xc254a2b0, ftLastAccessTime.dwHighDateTime=0x1d4c798, ftLastWriteTime.dwLowDateTime=0xc254a2b0, ftLastWriteTime.dwHighDateTime=0x1d4c798, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="..", cAlternateFileName="")) returned 1
	[0135.255] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0135.255] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0135.255] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3076f9d0, ftCreationTime.dwHighDateTime=0x1d4ced0, ftLastAccessTime.dwLowDateTime=0xce75d610, ftLastAccessTime.dwHighDateTime=0x1d4d22c, ftLastWriteTime.dwLowDateTime=0xce75d610, ftLastWriteTime.dwHighDateTime=0x1d4d22c, nFileSizeHigh=0x0, nFileSizeLow=0x44e9, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="GD7BIP AK_MP.m4a", cAlternateFileName="GD7BIP~1.M4A")) returned 1
	[0135.255] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0135.255] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="GD7BIP AK_MP.m4a") returned -1
	[0135.255] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="GD7BIP AK_MP.m4a") returned 1
	[0135.255] lstrcmpiA (lpString1="", lpString2="GD7BIP AK_MP.m4a") returned -1
	[0135.255] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\*.*") returned="*.*"
	[0135.255] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\"
	[0135.256] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\") returned=""
	[0135.256] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.256] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\o7e663suph6npdoilib\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0135.256] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\o7e663suph6npdoilib\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0135.256] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0135.256] WriteFile (in: hFile=0x214, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0135.257] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0135.257] CloseHandle (hObject=0x214) returned 1
	[0135.257] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\", lpString2="GD7BIP AK_MP.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a"
	[0135.257] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.zip") returned 0
	[0135.257] lstrlenA (lpString="*.zip") returned 5
	[0135.257] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.rar") returned 0
	[0135.257] lstrlenA (lpString="*.rar") returned 5
	[0135.257] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.7z") returned 0
	[0135.257] lstrlenA (lpString="*.7z") returned 4
	[0135.257] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.tar") returned 0
	[0135.257] lstrlenA (lpString="*.tar") returned 5
	[0135.257] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.gzip") returned 0
	[0135.257] lstrlenA (lpString="*.gzip") returned 6
	[0135.278] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.jpg") returned 0
	[0135.279] lstrlenA (lpString="*.jpg") returned 5
	[0135.279] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.jpeg") returned 0
	[0135.279] lstrlenA (lpString="*.jpeg") returned 6
	[0135.279] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.bmp") returned 0
	[0135.279] lstrlenA (lpString="*.bmp") returned 5
	[0135.279] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.gif") returned 0
	[0135.279] lstrlenA (lpString="*.gif") returned 5
	[0135.279] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.png") returned 0
	[0135.279] lstrlenA (lpString="*.png") returned 5
	[0135.279] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.doc") returned 0
	[0135.279] lstrlenA (lpString="*.doc") returned 5
	[0135.279] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.docx") returned 0
	[0135.279] lstrlenA (lpString="*.docx") returned 6
	[0135.279] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.xls") returned 0
	[0135.279] lstrlenA (lpString="*.xls") returned 5
	[0135.279] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.xlsx") returned 0
	[0135.279] lstrlenA (lpString="*.xlsx") returned 6
	[0135.279] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.ppt") returned 0
	[0135.279] lstrlenA (lpString="*.ppt") returned 5
	[0135.279] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.pptx") returned 0
	[0135.279] lstrlenA (lpString="*.pptx") returned 6
	[0135.279] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.txt") returned 0
	[0135.279] lstrlenA (lpString="*.txt") returned 5
	[0135.279] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.pdf") returned 0
	[0135.279] lstrlenA (lpString="*.pdf") returned 5
	[0135.279] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.htm") returned 0
	[0135.279] lstrlenA (lpString="*.htm") returned 5
	[0135.279] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.html") returned 0
	[0135.279] lstrlenA (lpString="*.html") returned 6
	[0135.279] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.mdb") returned 0
	[0135.279] lstrlenA (lpString="*.mdb") returned 5
	[0135.279] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.pfx") returned 0
	[0135.279] lstrlenA (lpString="*.pfx") returned 5
	[0135.279] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.md") returned 0
	[0135.280] lstrlenA (lpString="*.md") returned 4
	[0135.280] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.lnk") returned 0
	[0135.280] lstrlenA (lpString="*.lnk") returned 5
	[0135.280] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.torrent") returned 0
	[0135.280] lstrlenA (lpString="*.torrent") returned 9
	[0135.280] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.mov") returned 0
	[0135.280] lstrlenA (lpString="*.mov") returned 5
	[0135.280] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.3gp") returned 0
	[0135.280] lstrlenA (lpString="*.3gp") returned 5
	[0135.280] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.mpeg") returned 0
	[0135.280] lstrlenA (lpString="*.mpeg") returned 6
	[0135.280] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.mpg") returned 0
	[0135.280] lstrlenA (lpString="*.mpg") returned 5
	[0135.280] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.flv") returned 0
	[0135.280] lstrlenA (lpString="*.flv") returned 5
	[0135.280] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.avi") returned 0
	[0135.280] lstrlenA (lpString="*.avi") returned 5
	[0135.280] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.mp4") returned 0
	[0135.280] lstrlenA (lpString="*.mp4") returned 5
	[0135.280] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.wmv") returned 0
	[0135.280] lstrlenA (lpString="*.wmv") returned 5
	[0135.280] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.mkv") returned 0
	[0135.280] lstrlenA (lpString="*.mkv") returned 5
	[0135.280] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.mp3") returned 0
	[0135.280] lstrlenA (lpString="*.mp3") returned 5
	[0135.280] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.wav") returned 0
	[0135.280] lstrlenA (lpString="*.wav") returned 5
	[0135.280] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.flac") returned 0
	[0135.280] lstrlenA (lpString="*.flac") returned 6
	[0135.280] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.wma") returned 0
	[0135.280] lstrlenA (lpString="*.wma") returned 5
	[0135.280] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.au3") returned 0
	[0135.280] lstrlenA (lpString="*.au3") returned 5
	[0135.280] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.ahk") returned 0
	[0135.281] lstrlenA (lpString="*.ahk") returned 5
	[0135.281] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.c") returned 0
	[0135.281] lstrlenA (lpString="*.c") returned 3
	[0135.281] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.cc") returned 0
	[0135.281] lstrlenA (lpString="*.cc") returned 4
	[0135.281] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.cpp") returned 0
	[0135.281] lstrlenA (lpString="*.cpp") returned 5
	[0135.281] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.cxx") returned 0
	[0135.281] lstrlenA (lpString="*.cxx") returned 5
	[0135.281] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.c++") returned 0
	[0135.281] lstrlenA (lpString="*.c++") returned 5
	[0135.281] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.cs") returned 0
	[0135.281] lstrlenA (lpString="*.cs") returned 4
	[0135.281] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.vb") returned 0
	[0135.281] lstrlenA (lpString="*.vb") returned 4
	[0135.281] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.bas") returned 0
	[0135.281] lstrlenA (lpString="*.bas") returned 5
	[0135.281] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.csproj") returned 0
	[0135.281] lstrlenA (lpString="*.csproj") returned 8
	[0135.281] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.vbproj") returned 0
	[0135.281] lstrlenA (lpString="*.vbproj") returned 8
	[0135.281] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.vcxproj") returned 0
	[0135.281] lstrlenA (lpString="*.vcxproj") returned 9
	[0135.281] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.manifest") returned 0
	[0135.281] lstrlenA (lpString="*.manifest") returned 10
	[0135.281] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.php") returned 0
	[0135.281] lstrlenA (lpString="*.php") returned 5
	[0135.281] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.vbe") returned 0
	[0135.281] lstrlenA (lpString="*.vbe") returned 5
	[0135.281] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.vba") returned 0
	[0135.281] lstrlenA (lpString="*.vba") returned 5
	[0135.281] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.vbs") returned 0
	[0135.281] lstrlenA (lpString="*.vbs") returned 5
	[0135.281] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.bat") returned 0
	[0135.282] lstrlenA (lpString="*.bat") returned 5
	[0135.282] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.cmd") returned 0
	[0135.282] lstrlenA (lpString="*.cmd") returned 5
	[0135.282] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.js") returned 0
	[0135.282] lstrlenA (lpString="*.js") returned 4
	[0135.282] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.jscript") returned 0
	[0135.282] lstrlenA (lpString="*.jscript") returned 9
	[0135.282] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.hta") returned 0
	[0135.282] lstrlenA (lpString="*.hta") returned 5
	[0135.282] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.php7") returned 0
	[0135.282] lstrlenA (lpString="*.php7") returned 6
	[0135.282] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.db") returned 0
	[0135.282] lstrlenA (lpString="*.db") returned 4
	[0135.282] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.swf") returned 0
	[0135.282] lstrlenA (lpString="*.swf") returned 5
	[0135.282] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.eml") returned 0
	[0135.282] lstrlenA (lpString="*.eml") returned 5
	[0135.282] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.part") returned 0
	[0135.282] lstrlenA (lpString="*.part") returned 6
	[0135.282] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.nfo") returned 0
	[0135.282] lstrlenA (lpString="*.nfo") returned 5
	[0135.282] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.rsa") returned 0
	[0135.282] lstrlenA (lpString="*.rsa") returned 5
	[0135.282] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.key") returned 0
	[0135.282] lstrlenA (lpString="*.key") returned 5
	[0135.282] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.aes") returned 0
	[0135.282] lstrlenA (lpString="*.aes") returned 5
	[0135.282] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.blob") returned 0
	[0135.282] lstrlenA (lpString="*.blob") returned 6
	[0135.282] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.btc") returned 0
	[0135.282] lstrlenA (lpString="*.btc") returned 5
	[0135.282] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a", pszSpec="*.wallet") returned 0
	[0135.282] lstrlenA (lpString="*.wallet") returned 8
	[0135.282] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd4d3dd0, ftCreationTime.dwHighDateTime=0x1d4ce92, ftLastAccessTime.dwLowDateTime=0x96643c00, ftLastAccessTime.dwHighDateTime=0x1d4cf7d, ftLastWriteTime.dwLowDateTime=0x96643c00, ftLastWriteTime.dwHighDateTime=0x1d4cf7d, nFileSizeHigh=0x0, nFileSizeLow=0x1e5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="m11_TZ0zSxbeATjO.mp3", cAlternateFileName="M11_TZ~1.MP3")) returned 1
	[0135.283] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0135.283] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="m11_TZ0zSxbeATjO.mp3") returned -1
	[0135.283] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="m11_TZ0zSxbeATjO.mp3") returned -1
	[0135.283] lstrcmpiA (lpString1="", lpString2="m11_TZ0zSxbeATjO.mp3") returned -1
	[0135.283] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\GD7BIP AK_MP.m4a") returned="GD7BIP AK_MP.m4a"
	[0135.283] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\"
	[0135.283] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\") returned=""
	[0135.283] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.283] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\o7e663suph6npdoilib\\how-to-decrypt-files.htm")) returned 0x20
	[0135.283] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\", lpString2="m11_TZ0zSxbeATjO.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3"
	[0135.283] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3", pszSpec="*.zip") returned 0
	[0135.283] lstrlenA (lpString="*.zip") returned 5
	[0135.283] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3", pszSpec="*.rar") returned 0
	[0135.283] lstrlenA (lpString="*.rar") returned 5
	[0135.283] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3", pszSpec="*.7z") returned 0
	[0135.283] lstrlenA (lpString="*.7z") returned 4
	[0135.283] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3", pszSpec="*.tar") returned 0
	[0135.283] lstrlenA (lpString="*.tar") returned 5
	[0135.283] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3", pszSpec="*.gzip") returned 0
	[0135.283] lstrlenA (lpString="*.gzip") returned 6
	[0135.283] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3", pszSpec="*.jpg") returned 0
	[0135.283] lstrlenA (lpString="*.jpg") returned 5
	[0135.283] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3", pszSpec="*.jpeg") returned 0
	[0135.283] lstrlenA (lpString="*.jpeg") returned 6
	[0135.283] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3", pszSpec="*.bmp") returned 0
	[0135.283] lstrlenA (lpString="*.bmp") returned 5
	[0135.283] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3", pszSpec="*.gif") returned 0
	[0135.283] lstrlenA (lpString="*.gif") returned 5
	[0135.284] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3", pszSpec="*.png") returned 0
	[0135.284] lstrlenA (lpString="*.png") returned 5
	[0135.284] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3", pszSpec="*.doc") returned 0
	[0135.284] lstrlenA (lpString="*.doc") returned 5
	[0135.284] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3", pszSpec="*.docx") returned 0
	[0135.284] lstrlenA (lpString="*.docx") returned 6
	[0135.284] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3", pszSpec="*.xls") returned 0
	[0135.284] lstrlenA (lpString="*.xls") returned 5
	[0135.284] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3", pszSpec="*.xlsx") returned 0
	[0135.284] lstrlenA (lpString="*.xlsx") returned 6
	[0135.284] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3", pszSpec="*.ppt") returned 0
	[0135.284] lstrlenA (lpString="*.ppt") returned 5
	[0135.284] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3", pszSpec="*.pptx") returned 0
	[0135.284] lstrlenA (lpString="*.pptx") returned 6
	[0135.284] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3", pszSpec="*.txt") returned 0
	[0135.284] lstrlenA (lpString="*.txt") returned 5
	[0135.284] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3", pszSpec="*.pdf") returned 0
	[0135.284] lstrlenA (lpString="*.pdf") returned 5
	[0135.284] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3", pszSpec="*.htm") returned 0
	[0135.284] lstrlenA (lpString="*.htm") returned 5
	[0135.284] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3", pszSpec="*.html") returned 0
	[0135.284] lstrlenA (lpString="*.html") returned 6
	[0135.284] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3", pszSpec="*.mdb") returned 0
	[0135.284] lstrlenA (lpString="*.mdb") returned 5
	[0135.284] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3", pszSpec="*.pfx") returned 0
	[0135.284] lstrlenA (lpString="*.pfx") returned 5
	[0135.284] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3", pszSpec="*.md") returned 0
	[0135.284] lstrlenA (lpString="*.md") returned 4
	[0135.284] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3", pszSpec="*.lnk") returned 0
	[0135.284] lstrlenA (lpString="*.lnk") returned 5
	[0135.284] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3", pszSpec="*.torrent") returned 0
	[0135.284] lstrlenA (lpString="*.torrent") returned 9
	[0135.284] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3", pszSpec="*.mov") returned 0
	[0135.285] lstrlenA (lpString="*.mov") returned 5
	[0135.285] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3", pszSpec="*.3gp") returned 0
	[0135.285] lstrlenA (lpString="*.3gp") returned 5
	[0135.285] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3", pszSpec="*.mpeg") returned 0
	[0135.285] lstrlenA (lpString="*.mpeg") returned 6
	[0135.285] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3", pszSpec="*.mpg") returned 0
	[0135.285] lstrlenA (lpString="*.mpg") returned 5
	[0135.285] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3", pszSpec="*.flv") returned 0
	[0135.285] lstrlenA (lpString="*.flv") returned 5
	[0135.285] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3", pszSpec="*.avi") returned 0
	[0135.285] lstrlenA (lpString="*.avi") returned 5
	[0135.285] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3", pszSpec="*.mp4") returned 0
	[0135.285] lstrlenA (lpString="*.mp4") returned 5
	[0135.285] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3", pszSpec="*.wmv") returned 0
	[0135.285] lstrlenA (lpString="*.wmv") returned 5
	[0135.285] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3", pszSpec="*.mkv") returned 0
	[0135.285] lstrlenA (lpString="*.mkv") returned 5
	[0135.285] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3", pszSpec="*.mp3") returned 1
	[0135.285] lstrlenA (lpString="*.mp3") returned 5
	[0135.285] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3"
	[0135.285] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3"
	[0135.285] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3.") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3."
	[0135.285] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3.exe") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3.exe"
	[0135.285] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\o7e663suph6npdoilib\\m11_tz0zsxbeatjo.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0135.286] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1e5c
	[0135.286] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xbd4d3dd0, dwHighDateTime=0x1d4ce92), lpLastAccessTime=0x407536*(dwLowDateTime=0x96643c00, dwHighDateTime=0x1d4cf7d), lpLastWriteTime=0x40753e*(dwLowDateTime=0x96643c00, dwHighDateTime=0x1d4cf7d)) returned 1
	[0135.286] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.286] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1e1a, lpOverlapped=0x0) returned 1
	[0135.287] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3") returned="m11_TZ0zSxbeATjO.mp3"
	[0135.287] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.287] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1e1a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1e1a, lpOverlapped=0x0) returned 1
	[0135.287] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.287] CloseHandle (hObject=0x214) returned 1
	[0135.287] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\o7e663suph6npdoilib\\m11_tz0zsxbeatjo.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3.exe" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\o7e663suph6npdoilib\\m11_tz0zsxbeatjo.mp3.exe")) returned 1
	[0135.288] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5141f570, ftCreationTime.dwHighDateTime=0x1d4d4c5, ftLastAccessTime.dwLowDateTime=0xc9a23a10, ftLastAccessTime.dwHighDateTime=0x1d4cdaf, ftLastWriteTime.dwLowDateTime=0xc9a23a10, ftLastWriteTime.dwHighDateTime=0x1d4cdaf, nFileSizeHigh=0x0, nFileSizeLow=0x12aa4, dwReserved0=0x0, dwReserved1=0x0, cFileName="QI2uz.mp3", cAlternateFileName="")) returned 1
	[0135.288] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0135.288] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="QI2uz.mp3") returned -1
	[0135.288] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="QI2uz.mp3") returned -1
	[0135.288] lstrcmpiA (lpString1="", lpString2="QI2uz.mp3") returned -1
	[0135.288] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\m11_TZ0zSxbeATjO.mp3") returned="m11_TZ0zSxbeATjO.mp3"
	[0135.288] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\"
	[0135.289] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\") returned=""
	[0135.289] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.289] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\o7e663suph6npdoilib\\how-to-decrypt-files.htm")) returned 0x20
	[0135.289] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\", lpString2="QI2uz.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3"
	[0135.289] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3", pszSpec="*.zip") returned 0
	[0135.289] lstrlenA (lpString="*.zip") returned 5
	[0135.289] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3", pszSpec="*.rar") returned 0
	[0135.289] lstrlenA (lpString="*.rar") returned 5
	[0135.289] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3", pszSpec="*.7z") returned 0
	[0135.289] lstrlenA (lpString="*.7z") returned 4
	[0135.289] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3", pszSpec="*.tar") returned 0
	[0135.289] lstrlenA (lpString="*.tar") returned 5
	[0135.289] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3", pszSpec="*.gzip") returned 0
	[0135.289] lstrlenA (lpString="*.gzip") returned 6
	[0135.289] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3", pszSpec="*.jpg") returned 0
	[0135.289] lstrlenA (lpString="*.jpg") returned 5
	[0135.289] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3", pszSpec="*.jpeg") returned 0
	[0135.289] lstrlenA (lpString="*.jpeg") returned 6
	[0135.289] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3", pszSpec="*.bmp") returned 0
	[0135.289] lstrlenA (lpString="*.bmp") returned 5
	[0135.289] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3", pszSpec="*.gif") returned 0
	[0135.289] lstrlenA (lpString="*.gif") returned 5
	[0135.290] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3", pszSpec="*.png") returned 0
	[0135.290] lstrlenA (lpString="*.png") returned 5
	[0135.290] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3", pszSpec="*.doc") returned 0
	[0135.290] lstrlenA (lpString="*.doc") returned 5
	[0135.290] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3", pszSpec="*.docx") returned 0
	[0135.290] lstrlenA (lpString="*.docx") returned 6
	[0135.290] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3", pszSpec="*.xls") returned 0
	[0135.290] lstrlenA (lpString="*.xls") returned 5
	[0135.290] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3", pszSpec="*.xlsx") returned 0
	[0135.290] lstrlenA (lpString="*.xlsx") returned 6
	[0135.290] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3", pszSpec="*.ppt") returned 0
	[0135.290] lstrlenA (lpString="*.ppt") returned 5
	[0135.290] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3", pszSpec="*.pptx") returned 0
	[0135.290] lstrlenA (lpString="*.pptx") returned 6
	[0135.290] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3", pszSpec="*.txt") returned 0
	[0135.290] lstrlenA (lpString="*.txt") returned 5
	[0135.290] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3", pszSpec="*.pdf") returned 0
	[0135.290] lstrlenA (lpString="*.pdf") returned 5
	[0135.290] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3", pszSpec="*.htm") returned 0
	[0135.290] lstrlenA (lpString="*.htm") returned 5
	[0135.290] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3", pszSpec="*.html") returned 0
	[0135.290] lstrlenA (lpString="*.html") returned 6
	[0135.290] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3", pszSpec="*.mdb") returned 0
	[0135.290] lstrlenA (lpString="*.mdb") returned 5
	[0135.290] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3", pszSpec="*.pfx") returned 0
	[0135.290] lstrlenA (lpString="*.pfx") returned 5
	[0135.290] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3", pszSpec="*.md") returned 0
	[0135.290] lstrlenA (lpString="*.md") returned 4
	[0135.290] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3", pszSpec="*.lnk") returned 0
	[0135.290] lstrlenA (lpString="*.lnk") returned 5
	[0135.290] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3", pszSpec="*.torrent") returned 0
	[0135.290] lstrlenA (lpString="*.torrent") returned 9
	[0135.290] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3", pszSpec="*.mov") returned 0
	[0135.291] lstrlenA (lpString="*.mov") returned 5
	[0135.291] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3", pszSpec="*.3gp") returned 0
	[0135.291] lstrlenA (lpString="*.3gp") returned 5
	[0135.291] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3", pszSpec="*.mpeg") returned 0
	[0135.291] lstrlenA (lpString="*.mpeg") returned 6
	[0135.291] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3", pszSpec="*.mpg") returned 0
	[0135.291] lstrlenA (lpString="*.mpg") returned 5
	[0135.291] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3", pszSpec="*.flv") returned 0
	[0135.291] lstrlenA (lpString="*.flv") returned 5
	[0135.291] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3", pszSpec="*.avi") returned 0
	[0135.291] lstrlenA (lpString="*.avi") returned 5
	[0135.291] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3", pszSpec="*.mp4") returned 0
	[0135.291] lstrlenA (lpString="*.mp4") returned 5
	[0135.291] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3", pszSpec="*.wmv") returned 0
	[0135.291] lstrlenA (lpString="*.wmv") returned 5
	[0135.291] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3", pszSpec="*.mkv") returned 0
	[0135.291] lstrlenA (lpString="*.mkv") returned 5
	[0135.291] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3", pszSpec="*.mp3") returned 1
	[0135.291] lstrlenA (lpString="*.mp3") returned 5
	[0135.291] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3"
	[0135.291] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3"
	[0135.291] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3.") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3."
	[0135.291] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3.exe") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3.exe"
	[0135.291] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\o7e663suph6npdoilib\\qi2uz.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0135.292] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12aa4
	[0135.292] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5141f570, dwHighDateTime=0x1d4d4c5), lpLastAccessTime=0x407536*(dwLowDateTime=0xc9a23a10, dwHighDateTime=0x1d4cdaf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc9a23a10, dwHighDateTime=0x1d4cdaf)) returned 1
	[0135.292] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.292] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x12a62, lpOverlapped=0x0) returned 1
	[0135.293] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3") returned="QI2uz.mp3"
	[0135.293] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.293] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x12a62, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x12a62, lpOverlapped=0x0) returned 1
	[0135.293] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.293] CloseHandle (hObject=0x214) returned 1
	[0135.294] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\o7e663suph6npdoilib\\qi2uz.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3.exe" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\o7e663suph6npdoilib\\qi2uz.mp3.exe")) returned 1
	[0135.294] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb646730, ftCreationTime.dwHighDateTime=0x1d4d0e3, ftLastAccessTime.dwLowDateTime=0x5a5591e0, ftLastAccessTime.dwHighDateTime=0x1d4d3ac, ftLastWriteTime.dwLowDateTime=0x5a5591e0, ftLastWriteTime.dwHighDateTime=0x1d4d3ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="QnRzP0VE", cAlternateFileName="")) returned 1
	[0135.294] lstrcmpA (lpString1=".", lpString2="QnRzP0VE") returned -1
	[0135.294] lstrcmpA (lpString1="..", lpString2="QnRzP0VE") returned -1
	[0135.294] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QI2uz.mp3") returned="QI2uz.mp3"
	[0135.294] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\", lpString2="QnRzP0VE" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE"
	[0135.294] lstrlenA (lpString="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE") returned 56
	[0135.294] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\*.*", lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb646730, ftCreationTime.dwHighDateTime=0x1d4d0e3, ftLastAccessTime.dwLowDateTime=0x5a5591e0, ftLastAccessTime.dwHighDateTime=0x1d4d3ac, ftLastWriteTime.dwLowDateTime=0x5a5591e0, ftLastWriteTime.dwHighDateTime=0x1d4d3ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName=".", cAlternateFileName="")) returned 0x7cb690
	[0135.295] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0135.295] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb646730, ftCreationTime.dwHighDateTime=0x1d4d0e3, ftLastAccessTime.dwLowDateTime=0x5a5591e0, ftLastAccessTime.dwHighDateTime=0x1d4d3ac, ftLastWriteTime.dwLowDateTime=0x5a5591e0, ftLastWriteTime.dwHighDateTime=0x1d4d3ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="..", cAlternateFileName="")) returned 1
	[0135.295] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0135.295] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0135.295] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bf674f0, ftCreationTime.dwHighDateTime=0x1d4cb18, ftLastAccessTime.dwLowDateTime=0xefede940, ftLastAccessTime.dwHighDateTime=0x1d4c7c8, ftLastWriteTime.dwLowDateTime=0xefede940, ftLastWriteTime.dwHighDateTime=0x1d4c7c8, nFileSizeHigh=0x0, nFileSizeLow=0xcd64, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="4-5QZENBa.mp3", cAlternateFileName="4-5QZE~1.MP3")) returned 1
	[0135.295] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0135.295] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="4-5QZENBa.mp3") returned 1
	[0135.295] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="4-5QZENBa.mp3") returned 1
	[0135.295] lstrcmpiA (lpString1="", lpString2="4-5QZENBa.mp3") returned -1
	[0135.295] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\*.*") returned="*.*"
	[0135.295] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\"
	[0135.295] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\") returned=""
	[0135.295] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.295] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\o7e663suph6npdoilib\\qnrzp0ve\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0135.295] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\o7e663suph6npdoilib\\qnrzp0ve\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0135.295] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0135.295] WriteFile (in: hFile=0x218, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0135.296] SetFileTime (hFile=0x218, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0135.296] CloseHandle (hObject=0x218) returned 1
	[0135.297] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\", lpString2="4-5QZENBa.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3"
	[0135.297] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3", pszSpec="*.zip") returned 0
	[0135.297] lstrlenA (lpString="*.zip") returned 5
	[0135.297] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3", pszSpec="*.rar") returned 0
	[0135.297] lstrlenA (lpString="*.rar") returned 5
	[0135.297] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3", pszSpec="*.7z") returned 0
	[0135.297] lstrlenA (lpString="*.7z") returned 4
	[0135.297] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3", pszSpec="*.tar") returned 0
	[0135.297] lstrlenA (lpString="*.tar") returned 5
	[0135.297] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3", pszSpec="*.gzip") returned 0
	[0135.297] lstrlenA (lpString="*.gzip") returned 6
	[0135.297] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3", pszSpec="*.jpg") returned 0
	[0135.297] lstrlenA (lpString="*.jpg") returned 5
	[0135.297] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3", pszSpec="*.jpeg") returned 0
	[0135.297] lstrlenA (lpString="*.jpeg") returned 6
	[0135.297] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3", pszSpec="*.bmp") returned 0
	[0135.297] lstrlenA (lpString="*.bmp") returned 5
	[0135.297] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3", pszSpec="*.gif") returned 0
	[0135.297] lstrlenA (lpString="*.gif") returned 5
	[0135.297] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3", pszSpec="*.png") returned 0
	[0135.297] lstrlenA (lpString="*.png") returned 5
	[0135.297] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3", pszSpec="*.doc") returned 0
	[0135.297] lstrlenA (lpString="*.doc") returned 5
	[0135.297] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3", pszSpec="*.docx") returned 0
	[0135.297] lstrlenA (lpString="*.docx") returned 6
	[0135.297] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3", pszSpec="*.xls") returned 0
	[0135.297] lstrlenA (lpString="*.xls") returned 5
	[0135.297] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3", pszSpec="*.xlsx") returned 0
	[0135.297] lstrlenA (lpString="*.xlsx") returned 6
	[0135.297] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3", pszSpec="*.ppt") returned 0
	[0135.297] lstrlenA (lpString="*.ppt") returned 5
	[0135.297] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3", pszSpec="*.pptx") returned 0
	[0135.297] lstrlenA (lpString="*.pptx") returned 6
	[0135.297] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3", pszSpec="*.txt") returned 0
	[0135.298] lstrlenA (lpString="*.txt") returned 5
	[0135.298] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3", pszSpec="*.pdf") returned 0
	[0135.298] lstrlenA (lpString="*.pdf") returned 5
	[0135.298] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3", pszSpec="*.htm") returned 0
	[0135.298] lstrlenA (lpString="*.htm") returned 5
	[0135.298] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3", pszSpec="*.html") returned 0
	[0135.298] lstrlenA (lpString="*.html") returned 6
	[0135.298] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3", pszSpec="*.mdb") returned 0
	[0135.298] lstrlenA (lpString="*.mdb") returned 5
	[0135.298] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3", pszSpec="*.pfx") returned 0
	[0135.298] lstrlenA (lpString="*.pfx") returned 5
	[0135.298] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3", pszSpec="*.md") returned 0
	[0135.298] lstrlenA (lpString="*.md") returned 4
	[0135.298] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3", pszSpec="*.lnk") returned 0
	[0135.298] lstrlenA (lpString="*.lnk") returned 5
	[0135.298] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3", pszSpec="*.torrent") returned 0
	[0135.298] lstrlenA (lpString="*.torrent") returned 9
	[0135.298] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3", pszSpec="*.mov") returned 0
	[0135.298] lstrlenA (lpString="*.mov") returned 5
	[0135.298] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3", pszSpec="*.3gp") returned 0
	[0135.298] lstrlenA (lpString="*.3gp") returned 5
	[0135.298] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3", pszSpec="*.mpeg") returned 0
	[0135.298] lstrlenA (lpString="*.mpeg") returned 6
	[0135.298] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3", pszSpec="*.mpg") returned 0
	[0135.298] lstrlenA (lpString="*.mpg") returned 5
	[0135.298] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3", pszSpec="*.flv") returned 0
	[0135.298] lstrlenA (lpString="*.flv") returned 5
	[0135.298] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3", pszSpec="*.avi") returned 0
	[0135.298] lstrlenA (lpString="*.avi") returned 5
	[0135.298] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3", pszSpec="*.mp4") returned 0
	[0135.298] lstrlenA (lpString="*.mp4") returned 5
	[0135.298] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3", pszSpec="*.wmv") returned 0
	[0135.298] lstrlenA (lpString="*.wmv") returned 5
	[0135.299] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3", pszSpec="*.mkv") returned 0
	[0135.299] lstrlenA (lpString="*.mkv") returned 5
	[0135.299] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3", pszSpec="*.mp3") returned 1
	[0135.299] lstrlenA (lpString="*.mp3") returned 5
	[0135.299] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3"
	[0135.299] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3"
	[0135.299] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3.") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3."
	[0135.299] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3.exe") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3.exe"
	[0135.299] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\o7e663suph6npdoilib\\qnrzp0ve\\4-5qzenba.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0135.299] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcd64
	[0135.299] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7bf674f0, dwHighDateTime=0x1d4cb18), lpLastAccessTime=0x407536*(dwLowDateTime=0xefede940, dwHighDateTime=0x1d4c7c8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xefede940, dwHighDateTime=0x1d4c7c8)) returned 1
	[0135.299] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.299] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xcd22, lpOverlapped=0x0) returned 1
	[0135.300] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3") returned="4-5QZENBa.mp3"
	[0135.300] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.301] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xcd22, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xcd22, lpOverlapped=0x0) returned 1
	[0135.301] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.301] CloseHandle (hObject=0x218) returned 1
	[0135.301] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\o7e663suph6npdoilib\\qnrzp0ve\\4-5qzenba.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3.exe" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\o7e663suph6npdoilib\\qnrzp0ve\\4-5qzenba.mp3.exe")) returned 1
	[0135.302] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aca3af0, ftCreationTime.dwHighDateTime=0x1d4cf66, ftLastAccessTime.dwLowDateTime=0x36dc4ac0, ftLastAccessTime.dwHighDateTime=0x1d4ca78, ftLastWriteTime.dwLowDateTime=0x36dc4ac0, ftLastWriteTime.dwHighDateTime=0x1d4ca78, nFileSizeHigh=0x0, nFileSizeLow=0xf15f, dwReserved0=0x0, dwReserved1=0x0, cFileName="5v65dyXNB-dHFbYcIBoN.wav", cAlternateFileName="5V65DY~1.WAV")) returned 1
	[0135.302] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0135.302] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="5v65dyXNB-dHFbYcIBoN.wav") returned 1
	[0135.302] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="5v65dyXNB-dHFbYcIBoN.wav") returned 1
	[0135.302] lstrcmpiA (lpString1="", lpString2="5v65dyXNB-dHFbYcIBoN.wav") returned -1
	[0135.302] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\4-5QZENBa.mp3") returned="4-5QZENBa.mp3"
	[0135.302] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\"
	[0135.302] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\") returned=""
	[0135.302] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.302] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\o7e663suph6npdoilib\\qnrzp0ve\\how-to-decrypt-files.htm")) returned 0x20
	[0135.302] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\", lpString2="5v65dyXNB-dHFbYcIBoN.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav"
	[0135.302] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav", pszSpec="*.zip") returned 0
	[0135.302] lstrlenA (lpString="*.zip") returned 5
	[0135.302] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav", pszSpec="*.rar") returned 0
	[0135.302] lstrlenA (lpString="*.rar") returned 5
	[0135.302] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav", pszSpec="*.7z") returned 0
	[0135.302] lstrlenA (lpString="*.7z") returned 4
	[0135.302] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav", pszSpec="*.tar") returned 0
	[0135.302] lstrlenA (lpString="*.tar") returned 5
	[0135.302] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav", pszSpec="*.gzip") returned 0
	[0135.302] lstrlenA (lpString="*.gzip") returned 6
	[0135.302] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav", pszSpec="*.jpg") returned 0
	[0135.302] lstrlenA (lpString="*.jpg") returned 5
	[0135.302] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav", pszSpec="*.jpeg") returned 0
	[0135.302] lstrlenA (lpString="*.jpeg") returned 6
	[0135.302] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav", pszSpec="*.bmp") returned 0
	[0135.302] lstrlenA (lpString="*.bmp") returned 5
	[0135.303] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav", pszSpec="*.gif") returned 0
	[0135.303] lstrlenA (lpString="*.gif") returned 5
	[0135.303] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav", pszSpec="*.png") returned 0
	[0135.303] lstrlenA (lpString="*.png") returned 5
	[0135.303] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav", pszSpec="*.doc") returned 0
	[0135.303] lstrlenA (lpString="*.doc") returned 5
	[0135.303] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav", pszSpec="*.docx") returned 0
	[0135.303] lstrlenA (lpString="*.docx") returned 6
	[0135.303] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav", pszSpec="*.xls") returned 0
	[0135.303] lstrlenA (lpString="*.xls") returned 5
	[0135.303] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav", pszSpec="*.xlsx") returned 0
	[0135.303] lstrlenA (lpString="*.xlsx") returned 6
	[0135.303] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav", pszSpec="*.ppt") returned 0
	[0135.303] lstrlenA (lpString="*.ppt") returned 5
	[0135.303] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav", pszSpec="*.pptx") returned 0
	[0135.303] lstrlenA (lpString="*.pptx") returned 6
	[0135.303] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav", pszSpec="*.txt") returned 0
	[0135.303] lstrlenA (lpString="*.txt") returned 5
	[0135.303] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav", pszSpec="*.pdf") returned 0
	[0135.303] lstrlenA (lpString="*.pdf") returned 5
	[0135.303] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav", pszSpec="*.htm") returned 0
	[0135.303] lstrlenA (lpString="*.htm") returned 5
	[0135.303] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav", pszSpec="*.html") returned 0
	[0135.303] lstrlenA (lpString="*.html") returned 6
	[0135.303] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav", pszSpec="*.mdb") returned 0
	[0135.303] lstrlenA (lpString="*.mdb") returned 5
	[0135.303] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav", pszSpec="*.pfx") returned 0
	[0135.303] lstrlenA (lpString="*.pfx") returned 5
	[0135.303] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav", pszSpec="*.md") returned 0
	[0135.303] lstrlenA (lpString="*.md") returned 4
	[0135.303] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav", pszSpec="*.lnk") returned 0
	[0135.303] lstrlenA (lpString="*.lnk") returned 5
	[0135.303] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav", pszSpec="*.torrent") returned 0
	[0135.303] lstrlenA (lpString="*.torrent") returned 9
	[0135.303] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav", pszSpec="*.mov") returned 0
	[0135.304] lstrlenA (lpString="*.mov") returned 5
	[0135.304] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav", pszSpec="*.3gp") returned 0
	[0135.304] lstrlenA (lpString="*.3gp") returned 5
	[0135.304] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav", pszSpec="*.mpeg") returned 0
	[0135.304] lstrlenA (lpString="*.mpeg") returned 6
	[0135.304] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav", pszSpec="*.mpg") returned 0
	[0135.304] lstrlenA (lpString="*.mpg") returned 5
	[0135.304] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav", pszSpec="*.flv") returned 0
	[0135.304] lstrlenA (lpString="*.flv") returned 5
	[0135.304] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav", pszSpec="*.avi") returned 0
	[0135.304] lstrlenA (lpString="*.avi") returned 5
	[0135.304] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav", pszSpec="*.mp4") returned 0
	[0135.304] lstrlenA (lpString="*.mp4") returned 5
	[0135.304] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav", pszSpec="*.wmv") returned 0
	[0135.304] lstrlenA (lpString="*.wmv") returned 5
	[0135.304] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav", pszSpec="*.mkv") returned 0
	[0135.304] lstrlenA (lpString="*.mkv") returned 5
	[0135.304] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav", pszSpec="*.mp3") returned 0
	[0135.304] lstrlenA (lpString="*.mp3") returned 5
	[0135.304] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav", pszSpec="*.wav") returned 1
	[0135.304] lstrlenA (lpString="*.wav") returned 5
	[0135.304] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav"
	[0135.304] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav"
	[0135.304] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav.") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav."
	[0135.304] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav.exe") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav.exe"
	[0135.304] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\o7e663suph6npdoilib\\qnrzp0ve\\5v65dyxnb-dhfbycibon.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0135.305] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf15f
	[0135.305] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8aca3af0, dwHighDateTime=0x1d4cf66), lpLastAccessTime=0x407536*(dwLowDateTime=0x36dc4ac0, dwHighDateTime=0x1d4ca78), lpLastWriteTime=0x40753e*(dwLowDateTime=0x36dc4ac0, dwHighDateTime=0x1d4ca78)) returned 1
	[0135.305] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.305] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xf11d, lpOverlapped=0x0) returned 1
	[0135.306] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav") returned="5v65dyXNB-dHFbYcIBoN.wav"
	[0135.306] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.306] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xf11d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xf11d, lpOverlapped=0x0) returned 1
	[0135.307] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.307] CloseHandle (hObject=0x218) returned 1
	[0135.307] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\o7e663suph6npdoilib\\qnrzp0ve\\5v65dyxnb-dhfbycibon.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav.exe" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\o7e663suph6npdoilib\\qnrzp0ve\\5v65dyxnb-dhfbycibon.wav.exe")) returned 1
	[0135.307] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3652ab70, ftCreationTime.dwHighDateTime=0x1d4d0e6, ftLastAccessTime.dwLowDateTime=0xadb36830, ftLastAccessTime.dwHighDateTime=0x1d4d546, ftLastWriteTime.dwLowDateTime=0xadb36830, ftLastWriteTime.dwHighDateTime=0x1d4d546, nFileSizeHigh=0x0, nFileSizeLow=0x11a81, dwReserved0=0x0, dwReserved1=0x0, cFileName="k6qoquI u4IJ gCZpdK.m4a", cAlternateFileName="K6QOQU~1.M4A")) returned 1
	[0135.307] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0135.307] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="k6qoquI u4IJ gCZpdK.m4a") returned -1
	[0135.307] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="k6qoquI u4IJ gCZpdK.m4a") returned -1
	[0135.307] lstrcmpiA (lpString1="", lpString2="k6qoquI u4IJ gCZpdK.m4a") returned -1
	[0135.307] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\5v65dyXNB-dHFbYcIBoN.wav") returned="5v65dyXNB-dHFbYcIBoN.wav"
	[0135.308] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\"
	[0135.308] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\") returned=""
	[0135.308] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.308] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\o7e663suph6npdoilib\\qnrzp0ve\\how-to-decrypt-files.htm")) returned 0x20
	[0135.308] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\", lpString2="k6qoquI u4IJ gCZpdK.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a"
	[0135.308] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.zip") returned 0
	[0135.308] lstrlenA (lpString="*.zip") returned 5
	[0135.308] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.rar") returned 0
	[0135.308] lstrlenA (lpString="*.rar") returned 5
	[0135.308] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.7z") returned 0
	[0135.308] lstrlenA (lpString="*.7z") returned 4
	[0135.308] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.tar") returned 0
	[0135.308] lstrlenA (lpString="*.tar") returned 5
	[0135.308] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.gzip") returned 0
	[0135.308] lstrlenA (lpString="*.gzip") returned 6
	[0135.308] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.jpg") returned 0
	[0135.308] lstrlenA (lpString="*.jpg") returned 5
	[0135.308] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.jpeg") returned 0
	[0135.308] lstrlenA (lpString="*.jpeg") returned 6
	[0135.308] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.bmp") returned 0
	[0135.308] lstrlenA (lpString="*.bmp") returned 5
	[0135.308] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.gif") returned 0
	[0135.308] lstrlenA (lpString="*.gif") returned 5
	[0135.308] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.png") returned 0
	[0135.308] lstrlenA (lpString="*.png") returned 5
	[0135.308] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.doc") returned 0
	[0135.308] lstrlenA (lpString="*.doc") returned 5
	[0135.308] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.docx") returned 0
	[0135.308] lstrlenA (lpString="*.docx") returned 6
	[0135.308] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.xls") returned 0
	[0135.308] lstrlenA (lpString="*.xls") returned 5
	[0135.308] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.xlsx") returned 0
	[0135.309] lstrlenA (lpString="*.xlsx") returned 6
	[0135.309] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.ppt") returned 0
	[0135.309] lstrlenA (lpString="*.ppt") returned 5
	[0135.309] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.pptx") returned 0
	[0135.309] lstrlenA (lpString="*.pptx") returned 6
	[0135.309] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.txt") returned 0
	[0135.309] lstrlenA (lpString="*.txt") returned 5
	[0135.309] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.pdf") returned 0
	[0135.309] lstrlenA (lpString="*.pdf") returned 5
	[0135.309] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.htm") returned 0
	[0135.309] lstrlenA (lpString="*.htm") returned 5
	[0135.309] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.html") returned 0
	[0135.309] lstrlenA (lpString="*.html") returned 6
	[0135.309] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.mdb") returned 0
	[0135.309] lstrlenA (lpString="*.mdb") returned 5
	[0135.309] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.pfx") returned 0
	[0135.309] lstrlenA (lpString="*.pfx") returned 5
	[0135.309] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.md") returned 0
	[0135.309] lstrlenA (lpString="*.md") returned 4
	[0135.309] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.lnk") returned 0
	[0135.309] lstrlenA (lpString="*.lnk") returned 5
	[0135.309] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.torrent") returned 0
	[0135.309] lstrlenA (lpString="*.torrent") returned 9
	[0135.309] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.mov") returned 0
	[0135.309] lstrlenA (lpString="*.mov") returned 5
	[0135.309] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.3gp") returned 0
	[0135.309] lstrlenA (lpString="*.3gp") returned 5
	[0135.309] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.mpeg") returned 0
	[0135.309] lstrlenA (lpString="*.mpeg") returned 6
	[0135.309] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.mpg") returned 0
	[0135.309] lstrlenA (lpString="*.mpg") returned 5
	[0135.309] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.flv") returned 0
	[0135.309] lstrlenA (lpString="*.flv") returned 5
	[0135.309] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.avi") returned 0
	[0135.309] lstrlenA (lpString="*.avi") returned 5
	[0135.309] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.mp4") returned 0
	[0135.310] lstrlenA (lpString="*.mp4") returned 5
	[0135.310] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.wmv") returned 0
	[0135.310] lstrlenA (lpString="*.wmv") returned 5
	[0135.310] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.mkv") returned 0
	[0135.310] lstrlenA (lpString="*.mkv") returned 5
	[0135.310] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.mp3") returned 0
	[0135.310] lstrlenA (lpString="*.mp3") returned 5
	[0135.310] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.wav") returned 0
	[0135.310] lstrlenA (lpString="*.wav") returned 5
	[0135.310] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.flac") returned 0
	[0135.310] lstrlenA (lpString="*.flac") returned 6
	[0135.310] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.wma") returned 0
	[0135.310] lstrlenA (lpString="*.wma") returned 5
	[0135.310] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.au3") returned 0
	[0135.310] lstrlenA (lpString="*.au3") returned 5
	[0135.310] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.ahk") returned 0
	[0135.310] lstrlenA (lpString="*.ahk") returned 5
	[0135.310] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.c") returned 0
	[0135.310] lstrlenA (lpString="*.c") returned 3
	[0135.310] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.cc") returned 0
	[0135.310] lstrlenA (lpString="*.cc") returned 4
	[0135.310] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.cpp") returned 0
	[0135.310] lstrlenA (lpString="*.cpp") returned 5
	[0135.310] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.cxx") returned 0
	[0135.310] lstrlenA (lpString="*.cxx") returned 5
	[0135.310] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.c++") returned 0
	[0135.310] lstrlenA (lpString="*.c++") returned 5
	[0135.310] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.cs") returned 0
	[0135.310] lstrlenA (lpString="*.cs") returned 4
	[0135.310] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.vb") returned 0
	[0135.310] lstrlenA (lpString="*.vb") returned 4
	[0135.310] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.bas") returned 0
	[0135.310] lstrlenA (lpString="*.bas") returned 5
	[0135.310] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.csproj") returned 0
	[0135.311] lstrlenA (lpString="*.csproj") returned 8
	[0135.311] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.vbproj") returned 0
	[0135.311] lstrlenA (lpString="*.vbproj") returned 8
	[0135.311] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.vcxproj") returned 0
	[0135.311] lstrlenA (lpString="*.vcxproj") returned 9
	[0135.311] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.manifest") returned 0
	[0135.311] lstrlenA (lpString="*.manifest") returned 10
	[0135.311] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.php") returned 0
	[0135.311] lstrlenA (lpString="*.php") returned 5
	[0135.311] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.vbe") returned 0
	[0135.311] lstrlenA (lpString="*.vbe") returned 5
	[0135.311] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.vba") returned 0
	[0135.311] lstrlenA (lpString="*.vba") returned 5
	[0135.311] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.vbs") returned 0
	[0135.311] lstrlenA (lpString="*.vbs") returned 5
	[0135.311] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.bat") returned 0
	[0135.311] lstrlenA (lpString="*.bat") returned 5
	[0135.311] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.cmd") returned 0
	[0135.311] lstrlenA (lpString="*.cmd") returned 5
	[0135.311] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.js") returned 0
	[0135.311] lstrlenA (lpString="*.js") returned 4
	[0135.311] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.jscript") returned 0
	[0135.311] lstrlenA (lpString="*.jscript") returned 9
	[0135.311] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.hta") returned 0
	[0135.311] lstrlenA (lpString="*.hta") returned 5
	[0135.311] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.php7") returned 0
	[0135.311] lstrlenA (lpString="*.php7") returned 6
	[0135.311] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.db") returned 0
	[0135.311] lstrlenA (lpString="*.db") returned 4
	[0135.311] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.swf") returned 0
	[0135.311] lstrlenA (lpString="*.swf") returned 5
	[0135.311] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.eml") returned 0
	[0135.311] lstrlenA (lpString="*.eml") returned 5
	[0135.311] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.part") returned 0
	[0135.311] lstrlenA (lpString="*.part") returned 6
	[0135.311] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.nfo") returned 0
	[0135.312] lstrlenA (lpString="*.nfo") returned 5
	[0135.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.rsa") returned 0
	[0135.312] lstrlenA (lpString="*.rsa") returned 5
	[0135.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.key") returned 0
	[0135.312] lstrlenA (lpString="*.key") returned 5
	[0135.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.aes") returned 0
	[0135.312] lstrlenA (lpString="*.aes") returned 5
	[0135.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.blob") returned 0
	[0135.312] lstrlenA (lpString="*.blob") returned 6
	[0135.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.btc") returned 0
	[0135.312] lstrlenA (lpString="*.btc") returned 5
	[0135.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a", pszSpec="*.wallet") returned 0
	[0135.312] lstrlenA (lpString="*.wallet") returned 8
	[0135.312] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9eca7b90, ftCreationTime.dwHighDateTime=0x1d4cf8f, ftLastAccessTime.dwLowDateTime=0xada2afb0, ftLastAccessTime.dwHighDateTime=0x1d4d4e0, ftLastWriteTime.dwLowDateTime=0xada2afb0, ftLastWriteTime.dwHighDateTime=0x1d4d4e0, nFileSizeHigh=0x0, nFileSizeLow=0xdb63, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIUj-mS.wav", cAlternateFileName="")) returned 1
	[0135.312] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0135.312] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PIUj-mS.wav") returned -1
	[0135.312] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PIUj-mS.wav") returned -1
	[0135.312] lstrcmpiA (lpString1="", lpString2="PIUj-mS.wav") returned -1
	[0135.312] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\k6qoquI u4IJ gCZpdK.m4a") returned="k6qoquI u4IJ gCZpdK.m4a"
	[0135.312] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\"
	[0135.312] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\") returned=""
	[0135.312] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.312] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\o7e663suph6npdoilib\\qnrzp0ve\\how-to-decrypt-files.htm")) returned 0x20
	[0135.312] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\", lpString2="PIUj-mS.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav"
	[0135.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav", pszSpec="*.zip") returned 0
	[0135.312] lstrlenA (lpString="*.zip") returned 5
	[0135.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav", pszSpec="*.rar") returned 0
	[0135.312] lstrlenA (lpString="*.rar") returned 5
	[0135.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav", pszSpec="*.7z") returned 0
	[0135.312] lstrlenA (lpString="*.7z") returned 4
	[0135.312] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav", pszSpec="*.tar") returned 0
	[0135.312] lstrlenA (lpString="*.tar") returned 5
	[0135.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav", pszSpec="*.gzip") returned 0
	[0135.313] lstrlenA (lpString="*.gzip") returned 6
	[0135.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav", pszSpec="*.jpg") returned 0
	[0135.313] lstrlenA (lpString="*.jpg") returned 5
	[0135.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav", pszSpec="*.jpeg") returned 0
	[0135.313] lstrlenA (lpString="*.jpeg") returned 6
	[0135.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav", pszSpec="*.bmp") returned 0
	[0135.313] lstrlenA (lpString="*.bmp") returned 5
	[0135.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav", pszSpec="*.gif") returned 0
	[0135.313] lstrlenA (lpString="*.gif") returned 5
	[0135.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav", pszSpec="*.png") returned 0
	[0135.313] lstrlenA (lpString="*.png") returned 5
	[0135.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav", pszSpec="*.doc") returned 0
	[0135.313] lstrlenA (lpString="*.doc") returned 5
	[0135.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav", pszSpec="*.docx") returned 0
	[0135.313] lstrlenA (lpString="*.docx") returned 6
	[0135.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav", pszSpec="*.xls") returned 0
	[0135.313] lstrlenA (lpString="*.xls") returned 5
	[0135.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav", pszSpec="*.xlsx") returned 0
	[0135.313] lstrlenA (lpString="*.xlsx") returned 6
	[0135.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav", pszSpec="*.ppt") returned 0
	[0135.313] lstrlenA (lpString="*.ppt") returned 5
	[0135.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav", pszSpec="*.pptx") returned 0
	[0135.313] lstrlenA (lpString="*.pptx") returned 6
	[0135.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav", pszSpec="*.txt") returned 0
	[0135.313] lstrlenA (lpString="*.txt") returned 5
	[0135.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav", pszSpec="*.pdf") returned 0
	[0135.313] lstrlenA (lpString="*.pdf") returned 5
	[0135.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav", pszSpec="*.htm") returned 0
	[0135.313] lstrlenA (lpString="*.htm") returned 5
	[0135.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav", pszSpec="*.html") returned 0
	[0135.313] lstrlenA (lpString="*.html") returned 6
	[0135.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav", pszSpec="*.mdb") returned 0
	[0135.313] lstrlenA (lpString="*.mdb") returned 5
	[0135.313] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav", pszSpec="*.pfx") returned 0
	[0135.313] lstrlenA (lpString="*.pfx") returned 5
	[0135.314] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav", pszSpec="*.md") returned 0
	[0135.314] lstrlenA (lpString="*.md") returned 4
	[0135.314] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav", pszSpec="*.lnk") returned 0
	[0135.314] lstrlenA (lpString="*.lnk") returned 5
	[0135.314] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav", pszSpec="*.torrent") returned 0
	[0135.314] lstrlenA (lpString="*.torrent") returned 9
	[0135.314] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav", pszSpec="*.mov") returned 0
	[0135.314] lstrlenA (lpString="*.mov") returned 5
	[0135.314] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav", pszSpec="*.3gp") returned 0
	[0135.314] lstrlenA (lpString="*.3gp") returned 5
	[0135.314] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav", pszSpec="*.mpeg") returned 0
	[0135.314] lstrlenA (lpString="*.mpeg") returned 6
	[0135.314] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav", pszSpec="*.mpg") returned 0
	[0135.314] lstrlenA (lpString="*.mpg") returned 5
	[0135.314] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav", pszSpec="*.flv") returned 0
	[0135.314] lstrlenA (lpString="*.flv") returned 5
	[0135.314] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav", pszSpec="*.avi") returned 0
	[0135.314] lstrlenA (lpString="*.avi") returned 5
	[0135.314] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav", pszSpec="*.mp4") returned 0
	[0135.314] lstrlenA (lpString="*.mp4") returned 5
	[0135.314] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav", pszSpec="*.wmv") returned 0
	[0135.314] lstrlenA (lpString="*.wmv") returned 5
	[0135.314] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav", pszSpec="*.mkv") returned 0
	[0135.314] lstrlenA (lpString="*.mkv") returned 5
	[0135.314] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav", pszSpec="*.mp3") returned 0
	[0135.314] lstrlenA (lpString="*.mp3") returned 5
	[0135.314] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav", pszSpec="*.wav") returned 1
	[0135.314] lstrlenA (lpString="*.wav") returned 5
	[0135.314] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav"
	[0135.314] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav"
	[0135.314] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav.") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav."
	[0135.314] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav.exe") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav.exe"
	[0135.314] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\o7e663suph6npdoilib\\qnrzp0ve\\piuj-ms.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0135.315] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdb63
	[0135.315] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9eca7b90, dwHighDateTime=0x1d4cf8f), lpLastAccessTime=0x407536*(dwLowDateTime=0xada2afb0, dwHighDateTime=0x1d4d4e0), lpLastWriteTime=0x40753e*(dwLowDateTime=0xada2afb0, dwHighDateTime=0x1d4d4e0)) returned 1
	[0135.315] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.315] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xdb21, lpOverlapped=0x0) returned 1
	[0135.316] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav") returned="PIUj-mS.wav"
	[0135.316] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.316] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xdb21, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xdb21, lpOverlapped=0x0) returned 1
	[0135.316] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.316] CloseHandle (hObject=0x218) returned 1
	[0135.317] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\o7e663suph6npdoilib\\qnrzp0ve\\piuj-ms.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav.exe" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\o7e663suph6npdoilib\\qnrzp0ve\\piuj-ms.wav.exe")) returned 1
	[0135.320] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12149cb0, ftCreationTime.dwHighDateTime=0x1d4d0d1, ftLastAccessTime.dwLowDateTime=0x8518c6e0, ftLastAccessTime.dwHighDateTime=0x1d4c81c, ftLastWriteTime.dwLowDateTime=0x8518c6e0, ftLastWriteTime.dwHighDateTime=0x1d4c81c, nFileSizeHigh=0x0, nFileSizeLow=0xdff5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReREFaTpiB.wav", cAlternateFileName="REREFA~1.WAV")) returned 1
	[0135.320] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0135.320] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="ReREFaTpiB.wav") returned -1
	[0135.320] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="ReREFaTpiB.wav") returned -1
	[0135.327] lstrcmpiA (lpString1="", lpString2="ReREFaTpiB.wav") returned -1
	[0135.327] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\PIUj-mS.wav") returned="PIUj-mS.wav"
	[0135.327] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\"
	[0135.327] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\") returned=""
	[0135.327] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.327] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\o7e663suph6npdoilib\\qnrzp0ve\\how-to-decrypt-files.htm")) returned 0x20
	[0135.327] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\", lpString2="ReREFaTpiB.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav"
	[0135.327] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav", pszSpec="*.zip") returned 0
	[0135.327] lstrlenA (lpString="*.zip") returned 5
	[0135.327] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav", pszSpec="*.rar") returned 0
	[0135.327] lstrlenA (lpString="*.rar") returned 5
	[0135.327] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav", pszSpec="*.7z") returned 0
	[0135.327] lstrlenA (lpString="*.7z") returned 4
	[0135.327] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav", pszSpec="*.tar") returned 0
	[0135.327] lstrlenA (lpString="*.tar") returned 5
	[0135.327] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav", pszSpec="*.gzip") returned 0
	[0135.327] lstrlenA (lpString="*.gzip") returned 6
	[0135.327] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav", pszSpec="*.jpg") returned 0
	[0135.327] lstrlenA (lpString="*.jpg") returned 5
	[0135.327] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav", pszSpec="*.jpeg") returned 0
	[0135.327] lstrlenA (lpString="*.jpeg") returned 6
	[0135.327] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav", pszSpec="*.bmp") returned 0
	[0135.327] lstrlenA (lpString="*.bmp") returned 5
	[0135.327] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav", pszSpec="*.gif") returned 0
	[0135.327] lstrlenA (lpString="*.gif") returned 5
	[0135.328] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav", pszSpec="*.png") returned 0
	[0135.328] lstrlenA (lpString="*.png") returned 5
	[0135.328] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav", pszSpec="*.doc") returned 0
	[0135.328] lstrlenA (lpString="*.doc") returned 5
	[0135.328] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav", pszSpec="*.docx") returned 0
	[0135.328] lstrlenA (lpString="*.docx") returned 6
	[0135.328] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav", pszSpec="*.xls") returned 0
	[0135.328] lstrlenA (lpString="*.xls") returned 5
	[0135.328] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav", pszSpec="*.xlsx") returned 0
	[0135.328] lstrlenA (lpString="*.xlsx") returned 6
	[0135.328] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav", pszSpec="*.ppt") returned 0
	[0135.328] lstrlenA (lpString="*.ppt") returned 5
	[0135.328] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav", pszSpec="*.pptx") returned 0
	[0135.328] lstrlenA (lpString="*.pptx") returned 6
	[0135.328] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav", pszSpec="*.txt") returned 0
	[0135.328] lstrlenA (lpString="*.txt") returned 5
	[0135.328] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav", pszSpec="*.pdf") returned 0
	[0135.328] lstrlenA (lpString="*.pdf") returned 5
	[0135.328] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav", pszSpec="*.htm") returned 0
	[0135.328] lstrlenA (lpString="*.htm") returned 5
	[0135.328] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav", pszSpec="*.html") returned 0
	[0135.328] lstrlenA (lpString="*.html") returned 6
	[0135.328] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav", pszSpec="*.mdb") returned 0
	[0135.328] lstrlenA (lpString="*.mdb") returned 5
	[0135.328] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav", pszSpec="*.pfx") returned 0
	[0135.328] lstrlenA (lpString="*.pfx") returned 5
	[0135.328] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav", pszSpec="*.md") returned 0
	[0135.328] lstrlenA (lpString="*.md") returned 4
	[0135.328] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav", pszSpec="*.lnk") returned 0
	[0135.328] lstrlenA (lpString="*.lnk") returned 5
	[0135.328] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav", pszSpec="*.torrent") returned 0
	[0135.328] lstrlenA (lpString="*.torrent") returned 9
	[0135.328] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav", pszSpec="*.mov") returned 0
	[0135.328] lstrlenA (lpString="*.mov") returned 5
	[0135.329] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav", pszSpec="*.3gp") returned 0
	[0135.329] lstrlenA (lpString="*.3gp") returned 5
	[0135.329] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav", pszSpec="*.mpeg") returned 0
	[0135.329] lstrlenA (lpString="*.mpeg") returned 6
	[0135.329] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav", pszSpec="*.mpg") returned 0
	[0135.329] lstrlenA (lpString="*.mpg") returned 5
	[0135.329] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav", pszSpec="*.flv") returned 0
	[0135.329] lstrlenA (lpString="*.flv") returned 5
	[0135.329] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav", pszSpec="*.avi") returned 0
	[0135.329] lstrlenA (lpString="*.avi") returned 5
	[0135.329] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav", pszSpec="*.mp4") returned 0
	[0135.329] lstrlenA (lpString="*.mp4") returned 5
	[0135.329] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav", pszSpec="*.wmv") returned 0
	[0135.329] lstrlenA (lpString="*.wmv") returned 5
	[0135.329] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav", pszSpec="*.mkv") returned 0
	[0135.329] lstrlenA (lpString="*.mkv") returned 5
	[0135.329] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav", pszSpec="*.mp3") returned 0
	[0135.329] lstrlenA (lpString="*.mp3") returned 5
	[0135.329] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav", pszSpec="*.wav") returned 1
	[0135.329] lstrlenA (lpString="*.wav") returned 5
	[0135.329] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav"
	[0135.329] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav"
	[0135.329] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav.") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav."
	[0135.329] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav.exe") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav.exe"
	[0135.329] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\o7e663suph6npdoilib\\qnrzp0ve\\rerefatpib.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0135.330] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdff5
	[0135.330] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x12149cb0, dwHighDateTime=0x1d4d0d1), lpLastAccessTime=0x407536*(dwLowDateTime=0x8518c6e0, dwHighDateTime=0x1d4c81c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8518c6e0, dwHighDateTime=0x1d4c81c)) returned 1
	[0135.330] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.330] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xdfb3, lpOverlapped=0x0) returned 1
	[0135.331] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav") returned="ReREFaTpiB.wav"
	[0135.331] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.331] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xdfb3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xdfb3, lpOverlapped=0x0) returned 1
	[0135.331] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.331] CloseHandle (hObject=0x218) returned 1
	[0135.331] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\o7e663suph6npdoilib\\qnrzp0ve\\rerefatpib.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav.exe" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\o7e663suph6npdoilib\\qnrzp0ve\\rerefatpib.wav.exe")) returned 1
	[0135.332] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50f9a010, ftCreationTime.dwHighDateTime=0x1d4c807, ftLastAccessTime.dwLowDateTime=0xeb3052c0, ftLastAccessTime.dwHighDateTime=0x1d4d2a0, ftLastWriteTime.dwLowDateTime=0xeb3052c0, ftLastWriteTime.dwHighDateTime=0x1d4d2a0, nFileSizeHigh=0x0, nFileSizeLow=0x899d, dwReserved0=0x0, dwReserved1=0x0, cFileName="w501uWGkW-MmVP.m4a", cAlternateFileName="W501UW~1.M4A")) returned 1
	[0135.332] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0135.332] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="w501uWGkW-MmVP.m4a") returned -1
	[0135.332] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="w501uWGkW-MmVP.m4a") returned -1
	[0135.332] lstrcmpiA (lpString1="", lpString2="w501uWGkW-MmVP.m4a") returned -1
	[0135.332] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ReREFaTpiB.wav") returned="ReREFaTpiB.wav"
	[0135.332] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\"
	[0135.332] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\") returned=""
	[0135.332] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.332] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\o7e663suph6npdoilib\\qnrzp0ve\\how-to-decrypt-files.htm")) returned 0x20
	[0135.332] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\", lpString2="w501uWGkW-MmVP.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a"
	[0135.332] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.zip") returned 0
	[0135.333] lstrlenA (lpString="*.zip") returned 5
	[0135.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.rar") returned 0
	[0135.333] lstrlenA (lpString="*.rar") returned 5
	[0135.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.7z") returned 0
	[0135.333] lstrlenA (lpString="*.7z") returned 4
	[0135.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.tar") returned 0
	[0135.333] lstrlenA (lpString="*.tar") returned 5
	[0135.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.gzip") returned 0
	[0135.333] lstrlenA (lpString="*.gzip") returned 6
	[0135.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.jpg") returned 0
	[0135.333] lstrlenA (lpString="*.jpg") returned 5
	[0135.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.jpeg") returned 0
	[0135.333] lstrlenA (lpString="*.jpeg") returned 6
	[0135.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.bmp") returned 0
	[0135.333] lstrlenA (lpString="*.bmp") returned 5
	[0135.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.gif") returned 0
	[0135.333] lstrlenA (lpString="*.gif") returned 5
	[0135.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.png") returned 0
	[0135.333] lstrlenA (lpString="*.png") returned 5
	[0135.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.doc") returned 0
	[0135.333] lstrlenA (lpString="*.doc") returned 5
	[0135.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.docx") returned 0
	[0135.333] lstrlenA (lpString="*.docx") returned 6
	[0135.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.xls") returned 0
	[0135.333] lstrlenA (lpString="*.xls") returned 5
	[0135.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.xlsx") returned 0
	[0135.333] lstrlenA (lpString="*.xlsx") returned 6
	[0135.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.ppt") returned 0
	[0135.333] lstrlenA (lpString="*.ppt") returned 5
	[0135.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.pptx") returned 0
	[0135.333] lstrlenA (lpString="*.pptx") returned 6
	[0135.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.txt") returned 0
	[0135.333] lstrlenA (lpString="*.txt") returned 5
	[0135.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.pdf") returned 0
	[0135.333] lstrlenA (lpString="*.pdf") returned 5
	[0135.333] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.htm") returned 0
	[0135.334] lstrlenA (lpString="*.htm") returned 5
	[0135.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.html") returned 0
	[0135.334] lstrlenA (lpString="*.html") returned 6
	[0135.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.mdb") returned 0
	[0135.334] lstrlenA (lpString="*.mdb") returned 5
	[0135.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.pfx") returned 0
	[0135.334] lstrlenA (lpString="*.pfx") returned 5
	[0135.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.md") returned 0
	[0135.334] lstrlenA (lpString="*.md") returned 4
	[0135.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.lnk") returned 0
	[0135.334] lstrlenA (lpString="*.lnk") returned 5
	[0135.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.torrent") returned 0
	[0135.334] lstrlenA (lpString="*.torrent") returned 9
	[0135.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.mov") returned 0
	[0135.334] lstrlenA (lpString="*.mov") returned 5
	[0135.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.3gp") returned 0
	[0135.334] lstrlenA (lpString="*.3gp") returned 5
	[0135.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.mpeg") returned 0
	[0135.334] lstrlenA (lpString="*.mpeg") returned 6
	[0135.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.mpg") returned 0
	[0135.334] lstrlenA (lpString="*.mpg") returned 5
	[0135.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.flv") returned 0
	[0135.334] lstrlenA (lpString="*.flv") returned 5
	[0135.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.avi") returned 0
	[0135.334] lstrlenA (lpString="*.avi") returned 5
	[0135.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.mp4") returned 0
	[0135.334] lstrlenA (lpString="*.mp4") returned 5
	[0135.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.wmv") returned 0
	[0135.334] lstrlenA (lpString="*.wmv") returned 5
	[0135.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.mkv") returned 0
	[0135.334] lstrlenA (lpString="*.mkv") returned 5
	[0135.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.mp3") returned 0
	[0135.334] lstrlenA (lpString="*.mp3") returned 5
	[0135.334] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.wav") returned 0
	[0135.334] lstrlenA (lpString="*.wav") returned 5
	[0135.335] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.flac") returned 0
	[0135.335] lstrlenA (lpString="*.flac") returned 6
	[0135.335] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.wma") returned 0
	[0135.335] lstrlenA (lpString="*.wma") returned 5
	[0135.335] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.au3") returned 0
	[0135.335] lstrlenA (lpString="*.au3") returned 5
	[0135.335] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.ahk") returned 0
	[0135.335] lstrlenA (lpString="*.ahk") returned 5
	[0135.335] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.c") returned 0
	[0135.335] lstrlenA (lpString="*.c") returned 3
	[0135.335] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.cc") returned 0
	[0135.335] lstrlenA (lpString="*.cc") returned 4
	[0135.335] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.cpp") returned 0
	[0135.335] lstrlenA (lpString="*.cpp") returned 5
	[0135.335] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.cxx") returned 0
	[0135.335] lstrlenA (lpString="*.cxx") returned 5
	[0135.335] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.c++") returned 0
	[0135.335] lstrlenA (lpString="*.c++") returned 5
	[0135.335] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.cs") returned 0
	[0135.335] lstrlenA (lpString="*.cs") returned 4
	[0135.335] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.vb") returned 0
	[0135.335] lstrlenA (lpString="*.vb") returned 4
	[0135.335] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.bas") returned 0
	[0135.335] lstrlenA (lpString="*.bas") returned 5
	[0135.335] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.csproj") returned 0
	[0135.335] lstrlenA (lpString="*.csproj") returned 8
	[0135.335] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.vbproj") returned 0
	[0135.335] lstrlenA (lpString="*.vbproj") returned 8
	[0135.335] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.vcxproj") returned 0
	[0135.335] lstrlenA (lpString="*.vcxproj") returned 9
	[0135.335] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.manifest") returned 0
	[0135.335] lstrlenA (lpString="*.manifest") returned 10
	[0135.335] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.php") returned 0
	[0135.335] lstrlenA (lpString="*.php") returned 5
	[0135.335] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.vbe") returned 0
	[0135.336] lstrlenA (lpString="*.vbe") returned 5
	[0135.336] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.vba") returned 0
	[0135.336] lstrlenA (lpString="*.vba") returned 5
	[0135.336] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.vbs") returned 0
	[0135.337] lstrlenA (lpString="*.vbs") returned 5
	[0135.337] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.bat") returned 0
	[0135.337] lstrlenA (lpString="*.bat") returned 5
	[0135.337] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.cmd") returned 0
	[0135.337] lstrlenA (lpString="*.cmd") returned 5
	[0135.337] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.js") returned 0
	[0135.337] lstrlenA (lpString="*.js") returned 4
	[0135.337] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.jscript") returned 0
	[0135.337] lstrlenA (lpString="*.jscript") returned 9
	[0135.337] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.hta") returned 0
	[0135.337] lstrlenA (lpString="*.hta") returned 5
	[0135.337] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.php7") returned 0
	[0135.337] lstrlenA (lpString="*.php7") returned 6
	[0135.337] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.db") returned 0
	[0135.337] lstrlenA (lpString="*.db") returned 4
	[0135.337] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.swf") returned 0
	[0135.337] lstrlenA (lpString="*.swf") returned 5
	[0135.337] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.eml") returned 0
	[0135.337] lstrlenA (lpString="*.eml") returned 5
	[0135.337] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.part") returned 0
	[0135.337] lstrlenA (lpString="*.part") returned 6
	[0135.337] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.nfo") returned 0
	[0135.337] lstrlenA (lpString="*.nfo") returned 5
	[0135.337] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.rsa") returned 0
	[0135.337] lstrlenA (lpString="*.rsa") returned 5
	[0135.337] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.key") returned 0
	[0135.337] lstrlenA (lpString="*.key") returned 5
	[0135.337] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.aes") returned 0
	[0135.337] lstrlenA (lpString="*.aes") returned 5
	[0135.337] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.blob") returned 0
	[0135.337] lstrlenA (lpString="*.blob") returned 6
	[0135.337] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.btc") returned 0
	[0135.337] lstrlenA (lpString="*.btc") returned 5
	[0135.337] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a", pszSpec="*.wallet") returned 0
	[0135.338] lstrlenA (lpString="*.wallet") returned 8
	[0135.338] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff2eaf20, ftCreationTime.dwHighDateTime=0x1d4c606, ftLastAccessTime.dwLowDateTime=0x9a1c2200, ftLastAccessTime.dwHighDateTime=0x1d4d4ae, ftLastWriteTime.dwLowDateTime=0x9a1c2200, ftLastWriteTime.dwHighDateTime=0x1d4d4ae, nFileSizeHigh=0x0, nFileSizeLow=0x3f0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wlsxrEbr Tx0fO4non.m4a", cAlternateFileName="WLSXRE~1.M4A")) returned 1
	[0135.338] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0135.338] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="wlsxrEbr Tx0fO4non.m4a") returned -1
	[0135.338] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="wlsxrEbr Tx0fO4non.m4a") returned -1
	[0135.338] lstrcmpiA (lpString1="", lpString2="wlsxrEbr Tx0fO4non.m4a") returned -1
	[0135.338] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\w501uWGkW-MmVP.m4a") returned="w501uWGkW-MmVP.m4a"
	[0135.338] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\"
	[0135.338] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\") returned=""
	[0135.338] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.338] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\o7e663suph6npdoilib\\qnrzp0ve\\how-to-decrypt-files.htm")) returned 0x20
	[0135.338] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\", lpString2="wlsxrEbr Tx0fO4non.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a"
	[0135.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.zip") returned 0
	[0135.338] lstrlenA (lpString="*.zip") returned 5
	[0135.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.rar") returned 0
	[0135.338] lstrlenA (lpString="*.rar") returned 5
	[0135.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.7z") returned 0
	[0135.338] lstrlenA (lpString="*.7z") returned 4
	[0135.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.tar") returned 0
	[0135.338] lstrlenA (lpString="*.tar") returned 5
	[0135.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.gzip") returned 0
	[0135.338] lstrlenA (lpString="*.gzip") returned 6
	[0135.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.jpg") returned 0
	[0135.338] lstrlenA (lpString="*.jpg") returned 5
	[0135.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.jpeg") returned 0
	[0135.338] lstrlenA (lpString="*.jpeg") returned 6
	[0135.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.bmp") returned 0
	[0135.338] lstrlenA (lpString="*.bmp") returned 5
	[0135.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.gif") returned 0
	[0135.338] lstrlenA (lpString="*.gif") returned 5
	[0135.338] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.png") returned 0
	[0135.339] lstrlenA (lpString="*.png") returned 5
	[0135.339] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.doc") returned 0
	[0135.339] lstrlenA (lpString="*.doc") returned 5
	[0135.339] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.docx") returned 0
	[0135.339] lstrlenA (lpString="*.docx") returned 6
	[0135.339] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.xls") returned 0
	[0135.339] lstrlenA (lpString="*.xls") returned 5
	[0135.339] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.xlsx") returned 0
	[0135.339] lstrlenA (lpString="*.xlsx") returned 6
	[0135.339] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.ppt") returned 0
	[0135.339] lstrlenA (lpString="*.ppt") returned 5
	[0135.339] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.pptx") returned 0
	[0135.339] lstrlenA (lpString="*.pptx") returned 6
	[0135.339] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.txt") returned 0
	[0135.339] lstrlenA (lpString="*.txt") returned 5
	[0135.339] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.pdf") returned 0
	[0135.339] lstrlenA (lpString="*.pdf") returned 5
	[0135.339] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.htm") returned 0
	[0135.339] lstrlenA (lpString="*.htm") returned 5
	[0135.339] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.html") returned 0
	[0135.339] lstrlenA (lpString="*.html") returned 6
	[0135.339] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.mdb") returned 0
	[0135.339] lstrlenA (lpString="*.mdb") returned 5
	[0135.339] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.pfx") returned 0
	[0135.339] lstrlenA (lpString="*.pfx") returned 5
	[0135.339] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.md") returned 0
	[0135.339] lstrlenA (lpString="*.md") returned 4
	[0135.339] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.lnk") returned 0
	[0135.339] lstrlenA (lpString="*.lnk") returned 5
	[0135.339] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.torrent") returned 0
	[0135.339] lstrlenA (lpString="*.torrent") returned 9
	[0135.339] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.mov") returned 0
	[0135.339] lstrlenA (lpString="*.mov") returned 5
	[0135.339] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.3gp") returned 0
	[0135.339] lstrlenA (lpString="*.3gp") returned 5
	[0135.339] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.mpeg") returned 0
	[0135.340] lstrlenA (lpString="*.mpeg") returned 6
	[0135.340] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.mpg") returned 0
	[0135.340] lstrlenA (lpString="*.mpg") returned 5
	[0135.340] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.flv") returned 0
	[0135.340] lstrlenA (lpString="*.flv") returned 5
	[0135.340] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.avi") returned 0
	[0135.340] lstrlenA (lpString="*.avi") returned 5
	[0135.340] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.mp4") returned 0
	[0135.340] lstrlenA (lpString="*.mp4") returned 5
	[0135.340] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.wmv") returned 0
	[0135.340] lstrlenA (lpString="*.wmv") returned 5
	[0135.340] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.mkv") returned 0
	[0135.340] lstrlenA (lpString="*.mkv") returned 5
	[0135.340] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.mp3") returned 0
	[0135.340] lstrlenA (lpString="*.mp3") returned 5
	[0135.340] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.wav") returned 0
	[0135.340] lstrlenA (lpString="*.wav") returned 5
	[0135.340] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.flac") returned 0
	[0135.340] lstrlenA (lpString="*.flac") returned 6
	[0135.340] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.wma") returned 0
	[0135.340] lstrlenA (lpString="*.wma") returned 5
	[0135.340] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.au3") returned 0
	[0135.340] lstrlenA (lpString="*.au3") returned 5
	[0135.340] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.ahk") returned 0
	[0135.340] lstrlenA (lpString="*.ahk") returned 5
	[0135.340] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.c") returned 0
	[0135.340] lstrlenA (lpString="*.c") returned 3
	[0135.340] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.cc") returned 0
	[0135.340] lstrlenA (lpString="*.cc") returned 4
	[0135.340] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.cpp") returned 0
	[0135.340] lstrlenA (lpString="*.cpp") returned 5
	[0135.340] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.cxx") returned 0
	[0135.340] lstrlenA (lpString="*.cxx") returned 5
	[0135.340] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.c++") returned 0
	[0135.340] lstrlenA (lpString="*.c++") returned 5
	[0135.340] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.cs") returned 0
	[0135.341] lstrlenA (lpString="*.cs") returned 4
	[0135.341] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.vb") returned 0
	[0135.341] lstrlenA (lpString="*.vb") returned 4
	[0135.341] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.bas") returned 0
	[0135.341] lstrlenA (lpString="*.bas") returned 5
	[0135.341] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.csproj") returned 0
	[0135.341] lstrlenA (lpString="*.csproj") returned 8
	[0135.341] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.vbproj") returned 0
	[0135.341] lstrlenA (lpString="*.vbproj") returned 8
	[0135.341] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.vcxproj") returned 0
	[0135.341] lstrlenA (lpString="*.vcxproj") returned 9
	[0135.341] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.manifest") returned 0
	[0135.341] lstrlenA (lpString="*.manifest") returned 10
	[0135.341] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.php") returned 0
	[0135.341] lstrlenA (lpString="*.php") returned 5
	[0135.341] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.vbe") returned 0
	[0135.341] lstrlenA (lpString="*.vbe") returned 5
	[0135.341] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.vba") returned 0
	[0135.341] lstrlenA (lpString="*.vba") returned 5
	[0135.341] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.vbs") returned 0
	[0135.341] lstrlenA (lpString="*.vbs") returned 5
	[0135.341] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.bat") returned 0
	[0135.341] lstrlenA (lpString="*.bat") returned 5
	[0135.341] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.cmd") returned 0
	[0135.341] lstrlenA (lpString="*.cmd") returned 5
	[0135.341] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.js") returned 0
	[0135.341] lstrlenA (lpString="*.js") returned 4
	[0135.341] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.jscript") returned 0
	[0135.341] lstrlenA (lpString="*.jscript") returned 9
	[0135.341] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.hta") returned 0
	[0135.341] lstrlenA (lpString="*.hta") returned 5
	[0135.341] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.php7") returned 0
	[0135.341] lstrlenA (lpString="*.php7") returned 6
	[0135.341] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.db") returned 0
	[0135.341] lstrlenA (lpString="*.db") returned 4
	[0135.341] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.swf") returned 0
	[0135.342] lstrlenA (lpString="*.swf") returned 5
	[0135.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.eml") returned 0
	[0135.342] lstrlenA (lpString="*.eml") returned 5
	[0135.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.part") returned 0
	[0135.342] lstrlenA (lpString="*.part") returned 6
	[0135.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.nfo") returned 0
	[0135.342] lstrlenA (lpString="*.nfo") returned 5
	[0135.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.rsa") returned 0
	[0135.342] lstrlenA (lpString="*.rsa") returned 5
	[0135.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.key") returned 0
	[0135.342] lstrlenA (lpString="*.key") returned 5
	[0135.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.aes") returned 0
	[0135.342] lstrlenA (lpString="*.aes") returned 5
	[0135.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.blob") returned 0
	[0135.342] lstrlenA (lpString="*.blob") returned 6
	[0135.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.btc") returned 0
	[0135.342] lstrlenA (lpString="*.btc") returned 5
	[0135.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a", pszSpec="*.wallet") returned 0
	[0135.342] lstrlenA (lpString="*.wallet") returned 8
	[0135.342] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdef2330, ftCreationTime.dwHighDateTime=0x1d4c73f, ftLastAccessTime.dwLowDateTime=0xb677d950, ftLastAccessTime.dwHighDateTime=0x1d4c62e, ftLastWriteTime.dwLowDateTime=0xb677d950, ftLastWriteTime.dwHighDateTime=0x1d4c62e, nFileSizeHigh=0x0, nFileSizeLow=0x9a0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="XMn YR.mp3", cAlternateFileName="XMNYR~1.MP3")) returned 1
	[0135.342] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0135.342] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="XMn YR.mp3") returned -1
	[0135.342] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="XMn YR.mp3") returned -1
	[0135.342] lstrcmpiA (lpString1="", lpString2="XMn YR.mp3") returned -1
	[0135.342] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\wlsxrEbr Tx0fO4non.m4a") returned="wlsxrEbr Tx0fO4non.m4a"
	[0135.342] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\"
	[0135.342] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\") returned=""
	[0135.342] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.342] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\o7e663suph6npdoilib\\qnrzp0ve\\how-to-decrypt-files.htm")) returned 0x20
	[0135.342] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\", lpString2="XMn YR.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3"
	[0135.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3", pszSpec="*.zip") returned 0
	[0135.342] lstrlenA (lpString="*.zip") returned 5
	[0135.342] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3", pszSpec="*.rar") returned 0
	[0135.343] lstrlenA (lpString="*.rar") returned 5
	[0135.343] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3", pszSpec="*.7z") returned 0
	[0135.343] lstrlenA (lpString="*.7z") returned 4
	[0135.343] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3", pszSpec="*.tar") returned 0
	[0135.343] lstrlenA (lpString="*.tar") returned 5
	[0135.343] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3", pszSpec="*.gzip") returned 0
	[0135.343] lstrlenA (lpString="*.gzip") returned 6
	[0135.343] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3", pszSpec="*.jpg") returned 0
	[0135.343] lstrlenA (lpString="*.jpg") returned 5
	[0135.343] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3", pszSpec="*.jpeg") returned 0
	[0135.343] lstrlenA (lpString="*.jpeg") returned 6
	[0135.343] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3", pszSpec="*.bmp") returned 0
	[0135.343] lstrlenA (lpString="*.bmp") returned 5
	[0135.343] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3", pszSpec="*.gif") returned 0
	[0135.343] lstrlenA (lpString="*.gif") returned 5
	[0135.343] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3", pszSpec="*.png") returned 0
	[0135.343] lstrlenA (lpString="*.png") returned 5
	[0135.343] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3", pszSpec="*.doc") returned 0
	[0135.343] lstrlenA (lpString="*.doc") returned 5
	[0135.343] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3", pszSpec="*.docx") returned 0
	[0135.343] lstrlenA (lpString="*.docx") returned 6
	[0135.343] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3", pszSpec="*.xls") returned 0
	[0135.343] lstrlenA (lpString="*.xls") returned 5
	[0135.343] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3", pszSpec="*.xlsx") returned 0
	[0135.343] lstrlenA (lpString="*.xlsx") returned 6
	[0135.343] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3", pszSpec="*.ppt") returned 0
	[0135.343] lstrlenA (lpString="*.ppt") returned 5
	[0135.343] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3", pszSpec="*.pptx") returned 0
	[0135.343] lstrlenA (lpString="*.pptx") returned 6
	[0135.343] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3", pszSpec="*.txt") returned 0
	[0135.343] lstrlenA (lpString="*.txt") returned 5
	[0135.343] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3", pszSpec="*.pdf") returned 0
	[0135.343] lstrlenA (lpString="*.pdf") returned 5
	[0135.343] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3", pszSpec="*.htm") returned 0
	[0135.343] lstrlenA (lpString="*.htm") returned 5
	[0135.343] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3", pszSpec="*.html") returned 0
	[0135.344] lstrlenA (lpString="*.html") returned 6
	[0135.344] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3", pszSpec="*.mdb") returned 0
	[0135.344] lstrlenA (lpString="*.mdb") returned 5
	[0135.344] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3", pszSpec="*.pfx") returned 0
	[0135.344] lstrlenA (lpString="*.pfx") returned 5
	[0135.344] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3", pszSpec="*.md") returned 0
	[0135.344] lstrlenA (lpString="*.md") returned 4
	[0135.344] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3", pszSpec="*.lnk") returned 0
	[0135.344] lstrlenA (lpString="*.lnk") returned 5
	[0135.344] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3", pszSpec="*.torrent") returned 0
	[0135.344] lstrlenA (lpString="*.torrent") returned 9
	[0135.344] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3", pszSpec="*.mov") returned 0
	[0135.344] lstrlenA (lpString="*.mov") returned 5
	[0135.344] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3", pszSpec="*.3gp") returned 0
	[0135.344] lstrlenA (lpString="*.3gp") returned 5
	[0135.344] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3", pszSpec="*.mpeg") returned 0
	[0135.344] lstrlenA (lpString="*.mpeg") returned 6
	[0135.344] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3", pszSpec="*.mpg") returned 0
	[0135.344] lstrlenA (lpString="*.mpg") returned 5
	[0135.344] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3", pszSpec="*.flv") returned 0
	[0135.344] lstrlenA (lpString="*.flv") returned 5
	[0135.344] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3", pszSpec="*.avi") returned 0
	[0135.344] lstrlenA (lpString="*.avi") returned 5
	[0135.344] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3", pszSpec="*.mp4") returned 0
	[0135.344] lstrlenA (lpString="*.mp4") returned 5
	[0135.344] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3", pszSpec="*.wmv") returned 0
	[0135.344] lstrlenA (lpString="*.wmv") returned 5
	[0135.344] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3", pszSpec="*.mkv") returned 0
	[0135.344] lstrlenA (lpString="*.mkv") returned 5
	[0135.344] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3", pszSpec="*.mp3") returned 1
	[0135.344] lstrlenA (lpString="*.mp3") returned 5
	[0135.344] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3"
	[0135.344] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3"
	[0135.344] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3.") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3."
	[0135.344] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3.exe") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3.exe"
	[0135.345] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\o7e663suph6npdoilib\\qnrzp0ve\\xmn yr.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0135.345] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9a0b
	[0135.345] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xdef2330, dwHighDateTime=0x1d4c73f), lpLastAccessTime=0x407536*(dwLowDateTime=0xb677d950, dwHighDateTime=0x1d4c62e), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb677d950, dwHighDateTime=0x1d4c62e)) returned 1
	[0135.345] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.345] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x99c9, lpOverlapped=0x0) returned 1
	[0135.346] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3") returned="XMn YR.mp3"
	[0135.346] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.346] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x99c9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x99c9, lpOverlapped=0x0) returned 1
	[0135.346] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.346] CloseHandle (hObject=0x218) returned 1
	[0135.346] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\o7e663suph6npdoilib\\qnrzp0ve\\xmn yr.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3.exe" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\o7e663suph6npdoilib\\qnrzp0ve\\xmn yr.mp3.exe")) returned 1
	[0135.347] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a3a2550, ftCreationTime.dwHighDateTime=0x1d4d496, ftLastAccessTime.dwLowDateTime=0x1cbd5b90, ftLastAccessTime.dwHighDateTime=0x1d4d0ca, ftLastWriteTime.dwLowDateTime=0x1cbd5b90, ftLastWriteTime.dwHighDateTime=0x1d4d0ca, nFileSizeHigh=0x0, nFileSizeLow=0x12c63, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZVeQCbG3.wav", cAlternateFileName="")) returned 1
	[0135.347] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0135.347] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="ZVeQCbG3.wav") returned -1
	[0135.347] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="ZVeQCbG3.wav") returned -1
	[0135.347] lstrcmpiA (lpString1="", lpString2="ZVeQCbG3.wav") returned -1
	[0135.347] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\XMn YR.mp3") returned="XMn YR.mp3"
	[0135.347] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\"
	[0135.347] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\") returned=""
	[0135.347] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.347] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\o7e663suph6npdoilib\\qnrzp0ve\\how-to-decrypt-files.htm")) returned 0x20
	[0135.347] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\", lpString2="ZVeQCbG3.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav"
	[0135.347] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav", pszSpec="*.zip") returned 0
	[0135.347] lstrlenA (lpString="*.zip") returned 5
	[0135.348] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav", pszSpec="*.rar") returned 0
	[0135.348] lstrlenA (lpString="*.rar") returned 5
	[0135.348] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav", pszSpec="*.7z") returned 0
	[0135.348] lstrlenA (lpString="*.7z") returned 4
	[0135.348] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav", pszSpec="*.tar") returned 0
	[0135.348] lstrlenA (lpString="*.tar") returned 5
	[0135.348] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav", pszSpec="*.gzip") returned 0
	[0135.348] lstrlenA (lpString="*.gzip") returned 6
	[0135.348] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav", pszSpec="*.jpg") returned 0
	[0135.348] lstrlenA (lpString="*.jpg") returned 5
	[0135.348] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav", pszSpec="*.jpeg") returned 0
	[0135.348] lstrlenA (lpString="*.jpeg") returned 6
	[0135.348] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav", pszSpec="*.bmp") returned 0
	[0135.348] lstrlenA (lpString="*.bmp") returned 5
	[0135.348] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav", pszSpec="*.gif") returned 0
	[0135.348] lstrlenA (lpString="*.gif") returned 5
	[0135.348] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav", pszSpec="*.png") returned 0
	[0135.348] lstrlenA (lpString="*.png") returned 5
	[0135.348] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav", pszSpec="*.doc") returned 0
	[0135.348] lstrlenA (lpString="*.doc") returned 5
	[0135.348] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav", pszSpec="*.docx") returned 0
	[0135.348] lstrlenA (lpString="*.docx") returned 6
	[0135.348] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav", pszSpec="*.xls") returned 0
	[0135.348] lstrlenA (lpString="*.xls") returned 5
	[0135.348] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav", pszSpec="*.xlsx") returned 0
	[0135.348] lstrlenA (lpString="*.xlsx") returned 6
	[0135.348] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav", pszSpec="*.ppt") returned 0
	[0135.348] lstrlenA (lpString="*.ppt") returned 5
	[0135.348] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav", pszSpec="*.pptx") returned 0
	[0135.348] lstrlenA (lpString="*.pptx") returned 6
	[0135.348] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav", pszSpec="*.txt") returned 0
	[0135.348] lstrlenA (lpString="*.txt") returned 5
	[0135.348] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav", pszSpec="*.pdf") returned 0
	[0135.349] lstrlenA (lpString="*.pdf") returned 5
	[0135.349] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav", pszSpec="*.htm") returned 0
	[0135.349] lstrlenA (lpString="*.htm") returned 5
	[0135.349] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav", pszSpec="*.html") returned 0
	[0135.349] lstrlenA (lpString="*.html") returned 6
	[0135.349] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav", pszSpec="*.mdb") returned 0
	[0135.349] lstrlenA (lpString="*.mdb") returned 5
	[0135.349] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav", pszSpec="*.pfx") returned 0
	[0135.349] lstrlenA (lpString="*.pfx") returned 5
	[0135.349] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav", pszSpec="*.md") returned 0
	[0135.349] lstrlenA (lpString="*.md") returned 4
	[0135.349] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav", pszSpec="*.lnk") returned 0
	[0135.349] lstrlenA (lpString="*.lnk") returned 5
	[0135.349] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav", pszSpec="*.torrent") returned 0
	[0135.349] lstrlenA (lpString="*.torrent") returned 9
	[0135.349] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav", pszSpec="*.mov") returned 0
	[0135.349] lstrlenA (lpString="*.mov") returned 5
	[0135.349] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav", pszSpec="*.3gp") returned 0
	[0135.349] lstrlenA (lpString="*.3gp") returned 5
	[0135.349] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav", pszSpec="*.mpeg") returned 0
	[0135.349] lstrlenA (lpString="*.mpeg") returned 6
	[0135.349] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav", pszSpec="*.mpg") returned 0
	[0135.349] lstrlenA (lpString="*.mpg") returned 5
	[0135.349] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav", pszSpec="*.flv") returned 0
	[0135.349] lstrlenA (lpString="*.flv") returned 5
	[0135.349] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav", pszSpec="*.avi") returned 0
	[0135.349] lstrlenA (lpString="*.avi") returned 5
	[0135.349] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav", pszSpec="*.mp4") returned 0
	[0135.349] lstrlenA (lpString="*.mp4") returned 5
	[0135.349] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav", pszSpec="*.wmv") returned 0
	[0135.349] lstrlenA (lpString="*.wmv") returned 5
	[0135.349] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav", pszSpec="*.mkv") returned 0
	[0135.349] lstrlenA (lpString="*.mkv") returned 5
	[0135.349] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav", pszSpec="*.mp3") returned 0
	[0135.349] lstrlenA (lpString="*.mp3") returned 5
	[0135.349] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav", pszSpec="*.wav") returned 1
	[0135.350] lstrlenA (lpString="*.wav") returned 5
	[0135.350] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav"
	[0135.350] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav"
	[0135.350] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav.") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav."
	[0135.350] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav.exe") returned="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav.exe"
	[0135.350] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\o7e663suph6npdoilib\\qnrzp0ve\\zveqcbg3.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0135.350] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12c63
	[0135.350] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5a3a2550, dwHighDateTime=0x1d4d496), lpLastAccessTime=0x407536*(dwLowDateTime=0x1cbd5b90, dwHighDateTime=0x1d4d0ca), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1cbd5b90, dwHighDateTime=0x1d4d0ca)) returned 1
	[0135.350] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.350] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x12c21, lpOverlapped=0x0) returned 1
	[0135.351] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav") returned="ZVeQCbG3.wav"
	[0135.352] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.352] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x12c21, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x12c21, lpOverlapped=0x0) returned 1
	[0135.352] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.352] CloseHandle (hObject=0x218) returned 1
	[0135.352] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\o7e663suph6npdoilib\\qnrzp0ve\\zveqcbg3.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Q1uIW\\o7e663sUPh6nPDOiLiB\\QnRzP0VE\\ZVeQCbG3.wav.exe" (normalized: "c:\\users\\fd1hvy\\music\\q1uiw\\o7e663suph6npdoilib\\qnrzp0ve\\zveqcbg3.wav.exe")) returned 1
	[0135.353] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a3a2550, ftCreationTime.dwHighDateTime=0x1d4d496, ftLastAccessTime.dwLowDateTime=0x1cbd5b90, ftLastAccessTime.dwHighDateTime=0x1d4d0ca, ftLastWriteTime.dwLowDateTime=0x1cbd5b90, ftLastWriteTime.dwHighDateTime=0x1d4d0ca, nFileSizeHigh=0x0, nFileSizeLow=0x12c63, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZVeQCbG3.wav", cAlternateFileName="")) returned 0
	[0135.353] FindClose (in: hFindFile=0x7cb690 | out: hFindFile=0x7cb690) returned 1
	[0135.353] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb646730, ftCreationTime.dwHighDateTime=0x1d4d0e3, ftLastAccessTime.dwLowDateTime=0x5a5591e0, ftLastAccessTime.dwHighDateTime=0x1d4d3ac, ftLastWriteTime.dwLowDateTime=0x5a5591e0, ftLastWriteTime.dwHighDateTime=0x1d4d3ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="QnRzP0VE", cAlternateFileName="")) returned 0
	[0135.353] FindClose (in: hFindFile=0x7cb650 | out: hFindFile=0x7cb650) returned 1
	[0135.353] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6dff840, ftCreationTime.dwHighDateTime=0x1d4cbd2, ftLastAccessTime.dwLowDateTime=0xc254a2b0, ftLastAccessTime.dwHighDateTime=0x1d4c798, ftLastWriteTime.dwLowDateTime=0xc254a2b0, ftLastWriteTime.dwHighDateTime=0x1d4c798, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x12, dwReserved1=0x1, cFileName="o7e663sUPh6nPDOiLiB", cAlternateFileName="O7E663~1")) returned 0
	[0135.353] FindClose (in: hFindFile=0x7cbad0 | out: hFindFile=0x7cbad0) returned 1
	[0135.353] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d088e00, ftCreationTime.dwHighDateTime=0x1d4cef8, ftLastAccessTime.dwLowDateTime=0xd087c4c0, ftLastAccessTime.dwHighDateTime=0x1d4c829, ftLastWriteTime.dwLowDateTime=0xd087c4c0, ftLastWriteTime.dwHighDateTime=0x1d4c829, nFileSizeHigh=0x0, nFileSizeLow=0xc43a, dwReserved0=0x20, dwReserved1=0x0, cFileName="Qwy-XTTO.mp3", cAlternateFileName="")) returned 1
	[0135.353] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.353] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Qwy-XTTO.mp3") returned -1
	[0135.353] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Qwy-XTTO.mp3") returned -1
	[0135.353] lstrcmpiA (lpString1="", lpString2="Qwy-XTTO.mp3") returned -1
	[0135.353] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\*.*") returned="*.*"
	[0135.353] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Music\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\"
	[0135.353] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Music\\" | out: pszPath="C:\\Users\\FD1HVy\\Music\\") returned=""
	[0135.353] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Music\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Music\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.353] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Music\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\music\\how-to-decrypt-files.htm")) returned 0x20
	[0135.353] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="Qwy-XTTO.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3") returned="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3"
	[0135.353] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3", pszSpec="*.zip") returned 0
	[0135.353] lstrlenA (lpString="*.zip") returned 5
	[0135.353] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3", pszSpec="*.rar") returned 0
	[0135.353] lstrlenA (lpString="*.rar") returned 5
	[0135.353] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3", pszSpec="*.7z") returned 0
	[0135.353] lstrlenA (lpString="*.7z") returned 4
	[0135.354] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3", pszSpec="*.tar") returned 0
	[0135.354] lstrlenA (lpString="*.tar") returned 5
	[0135.354] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3", pszSpec="*.gzip") returned 0
	[0135.354] lstrlenA (lpString="*.gzip") returned 6
	[0135.354] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3", pszSpec="*.jpg") returned 0
	[0135.354] lstrlenA (lpString="*.jpg") returned 5
	[0135.354] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3", pszSpec="*.jpeg") returned 0
	[0135.354] lstrlenA (lpString="*.jpeg") returned 6
	[0135.354] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3", pszSpec="*.bmp") returned 0
	[0135.354] lstrlenA (lpString="*.bmp") returned 5
	[0135.354] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3", pszSpec="*.gif") returned 0
	[0135.354] lstrlenA (lpString="*.gif") returned 5
	[0135.354] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3", pszSpec="*.png") returned 0
	[0135.354] lstrlenA (lpString="*.png") returned 5
	[0135.354] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3", pszSpec="*.doc") returned 0
	[0135.354] lstrlenA (lpString="*.doc") returned 5
	[0135.354] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3", pszSpec="*.docx") returned 0
	[0135.354] lstrlenA (lpString="*.docx") returned 6
	[0135.354] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3", pszSpec="*.xls") returned 0
	[0135.354] lstrlenA (lpString="*.xls") returned 5
	[0135.354] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3", pszSpec="*.xlsx") returned 0
	[0135.354] lstrlenA (lpString="*.xlsx") returned 6
	[0135.354] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3", pszSpec="*.ppt") returned 0
	[0135.354] lstrlenA (lpString="*.ppt") returned 5
	[0135.354] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3", pszSpec="*.pptx") returned 0
	[0135.354] lstrlenA (lpString="*.pptx") returned 6
	[0135.354] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3", pszSpec="*.txt") returned 0
	[0135.354] lstrlenA (lpString="*.txt") returned 5
	[0135.354] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3", pszSpec="*.pdf") returned 0
	[0135.354] lstrlenA (lpString="*.pdf") returned 5
	[0135.354] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3", pszSpec="*.htm") returned 0
	[0135.354] lstrlenA (lpString="*.htm") returned 5
	[0135.354] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3", pszSpec="*.html") returned 0
	[0135.354] lstrlenA (lpString="*.html") returned 6
	[0135.355] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3", pszSpec="*.mdb") returned 0
	[0135.355] lstrlenA (lpString="*.mdb") returned 5
	[0135.355] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3", pszSpec="*.pfx") returned 0
	[0135.355] lstrlenA (lpString="*.pfx") returned 5
	[0135.355] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3", pszSpec="*.md") returned 0
	[0135.355] lstrlenA (lpString="*.md") returned 4
	[0135.355] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3", pszSpec="*.lnk") returned 0
	[0135.355] lstrlenA (lpString="*.lnk") returned 5
	[0135.355] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3", pszSpec="*.torrent") returned 0
	[0135.355] lstrlenA (lpString="*.torrent") returned 9
	[0135.355] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3", pszSpec="*.mov") returned 0
	[0135.355] lstrlenA (lpString="*.mov") returned 5
	[0135.355] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3", pszSpec="*.3gp") returned 0
	[0135.355] lstrlenA (lpString="*.3gp") returned 5
	[0135.355] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3", pszSpec="*.mpeg") returned 0
	[0135.355] lstrlenA (lpString="*.mpeg") returned 6
	[0135.355] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3", pszSpec="*.mpg") returned 0
	[0135.355] lstrlenA (lpString="*.mpg") returned 5
	[0135.355] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3", pszSpec="*.flv") returned 0
	[0135.355] lstrlenA (lpString="*.flv") returned 5
	[0135.355] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3", pszSpec="*.avi") returned 0
	[0135.355] lstrlenA (lpString="*.avi") returned 5
	[0135.355] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3", pszSpec="*.mp4") returned 0
	[0135.355] lstrlenA (lpString="*.mp4") returned 5
	[0135.355] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3", pszSpec="*.wmv") returned 0
	[0135.355] lstrlenA (lpString="*.wmv") returned 5
	[0135.355] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3", pszSpec="*.mkv") returned 0
	[0135.355] lstrlenA (lpString="*.mkv") returned 5
	[0135.355] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3", pszSpec="*.mp3") returned 1
	[0135.355] lstrlenA (lpString="*.mp3") returned 5
	[0135.355] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3") returned="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3"
	[0135.355] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3") returned="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3"
	[0135.355] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3.") returned="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3."
	[0135.355] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3.exe") returned="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3.exe"
	[0135.356] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3" (normalized: "c:\\users\\fd1hvy\\music\\qwy-xtto.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.356] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc43a
	[0135.356] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5d088e00, dwHighDateTime=0x1d4cef8), lpLastAccessTime=0x407536*(dwLowDateTime=0xd087c4c0, dwHighDateTime=0x1d4c829), lpLastWriteTime=0x40753e*(dwLowDateTime=0xd087c4c0, dwHighDateTime=0x1d4c829)) returned 1
	[0135.356] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.356] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xc3f8, lpOverlapped=0x0) returned 1
	[0135.357] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3") returned="Qwy-XTTO.mp3"
	[0135.357] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.357] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xc3f8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xc3f8, lpOverlapped=0x0) returned 1
	[0135.357] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.357] CloseHandle (hObject=0x20c) returned 1
	[0135.357] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3" (normalized: "c:\\users\\fd1hvy\\music\\qwy-xtto.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Qwy-XTTO.mp3.exe" (normalized: "c:\\users\\fd1hvy\\music\\qwy-xtto.mp3.exe")) returned 1
	[0135.358] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d088e00, ftCreationTime.dwHighDateTime=0x1d4cef8, ftLastAccessTime.dwLowDateTime=0xd087c4c0, ftLastAccessTime.dwHighDateTime=0x1d4c829, ftLastWriteTime.dwLowDateTime=0xd087c4c0, ftLastWriteTime.dwHighDateTime=0x1d4c829, nFileSizeHigh=0x0, nFileSizeLow=0xc43a, dwReserved0=0x20, dwReserved1=0x0, cFileName="Qwy-XTTO.mp3", cAlternateFileName="")) returned 0
	[0135.358] FindClose (in: hFindFile=0x7cb5d0 | out: hFindFile=0x7cb5d0) returned 1
	[0135.358] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x1000000, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1
	[0135.358] lstrcmpA (lpString1=".", lpString2="My Documents") returned -1
	[0135.358] lstrcmpA (lpString1="..", lpString2="My Documents") returned -1
	[0135.358] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\*.*") returned="*.*"
	[0135.358] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="My Documents" | out: lpString1="C:\\Users\\FD1HVy\\My Documents") returned="C:\\Users\\FD1HVy\\My Documents"
	[0135.358] lstrlenA (lpString="C:\\Users\\FD1HVy\\My Documents") returned 28
	[0135.358] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\My Documents\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d088e00, ftCreationTime.dwHighDateTime=0x1d4cef8, ftLastAccessTime.dwLowDateTime=0xd087c4c0, ftLastAccessTime.dwHighDateTime=0x1d4c829, ftLastWriteTime.dwLowDateTime=0xd087c4c0, ftLastWriteTime.dwHighDateTime=0x1d4c829, nFileSizeHigh=0x0, nFileSizeLow=0xc43a, dwReserved0=0x20, dwReserved1=0x0, cFileName="Qwy-XTTO.mp3", cAlternateFileName="\xcc\xff\x19")) returned 0xffffffff
	[0135.359] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x1000000, cFileName="NetHood", cAlternateFileName="")) returned 1
	[0135.359] lstrcmpA (lpString1=".", lpString2="NetHood") returned -1
	[0135.359] lstrcmpA (lpString1="..", lpString2="NetHood") returned -1
	[0135.359] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\*.*") returned="*.*"
	[0135.359] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="NetHood" | out: lpString1="C:\\Users\\FD1HVy\\NetHood") returned="C:\\Users\\FD1HVy\\NetHood"
	[0135.359] lstrlenA (lpString="C:\\Users\\FD1HVy\\NetHood") returned 23
	[0135.359] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\NetHood\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d088e00, ftCreationTime.dwHighDateTime=0x1d4cef8, ftLastAccessTime.dwLowDateTime=0xd087c4c0, ftLastAccessTime.dwHighDateTime=0x1d4c829, ftLastWriteTime.dwLowDateTime=0xd087c4c0, ftLastWriteTime.dwHighDateTime=0x1d4c829, nFileSizeHigh=0x0, nFileSizeLow=0xc43a, dwReserved0=0x20, dwReserved1=0x0, cFileName="Qwy-XTTO.mp3", cAlternateFileName="\xcc\xff\x19")) returned 0xffffffff
	[0135.359] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa9c141bf, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xa9c141bf, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x2c0000, dwReserved0=0xa0000003, dwReserved1=0x1000000, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1
	[0135.359] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0135.359] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NTUSER.DAT") returned -1
	[0135.359] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NTUSER.DAT") returned -1
	[0135.359] lstrcmpiA (lpString1="", lpString2="NTUSER.DAT") returned -1
	[0135.359] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\*.*") returned="*.*"
	[0135.359] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\" | out: lpString1="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\"
	[0135.359] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\" | out: pszPath="C:\\Users\\FD1HVy\\") returned=""
	[0135.359] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.359] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0135.359] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0135.361] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0135.361] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0135.362] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0135.362] CloseHandle (hObject=0x208) returned 1
	[0135.362] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="NTUSER.DAT" | out: lpString1="C:\\Users\\FD1HVy\\NTUSER.DAT") returned="C:\\Users\\FD1HVy\\NTUSER.DAT"
	[0135.362] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.zip") returned 0
	[0135.362] lstrlenA (lpString="*.zip") returned 5
	[0135.362] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.rar") returned 0
	[0135.362] lstrlenA (lpString="*.rar") returned 5
	[0135.362] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.7z") returned 0
	[0135.362] lstrlenA (lpString="*.7z") returned 4
	[0135.362] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.tar") returned 0
	[0135.362] lstrlenA (lpString="*.tar") returned 5
	[0135.362] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.gzip") returned 0
	[0135.362] lstrlenA (lpString="*.gzip") returned 6
	[0135.362] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.jpg") returned 0
	[0135.362] lstrlenA (lpString="*.jpg") returned 5
	[0135.362] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.jpeg") returned 0
	[0135.362] lstrlenA (lpString="*.jpeg") returned 6
	[0135.362] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.bmp") returned 0
	[0135.362] lstrlenA (lpString="*.bmp") returned 5
	[0135.362] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.gif") returned 0
	[0135.362] lstrlenA (lpString="*.gif") returned 5
	[0135.362] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.png") returned 0
	[0135.362] lstrlenA (lpString="*.png") returned 5
	[0135.362] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.doc") returned 0
	[0135.362] lstrlenA (lpString="*.doc") returned 5
	[0135.362] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.docx") returned 0
	[0135.362] lstrlenA (lpString="*.docx") returned 6
	[0135.362] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.xls") returned 0
	[0135.363] lstrlenA (lpString="*.xls") returned 5
	[0135.363] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.xlsx") returned 0
	[0135.363] lstrlenA (lpString="*.xlsx") returned 6
	[0135.363] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.ppt") returned 0
	[0135.363] lstrlenA (lpString="*.ppt") returned 5
	[0135.363] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.pptx") returned 0
	[0135.363] lstrlenA (lpString="*.pptx") returned 6
	[0135.363] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.txt") returned 0
	[0135.363] lstrlenA (lpString="*.txt") returned 5
	[0135.363] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.pdf") returned 0
	[0135.363] lstrlenA (lpString="*.pdf") returned 5
	[0135.363] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.htm") returned 0
	[0135.363] lstrlenA (lpString="*.htm") returned 5
	[0135.363] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.html") returned 0
	[0135.363] lstrlenA (lpString="*.html") returned 6
	[0135.363] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.mdb") returned 0
	[0135.363] lstrlenA (lpString="*.mdb") returned 5
	[0135.363] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.pfx") returned 0
	[0135.363] lstrlenA (lpString="*.pfx") returned 5
	[0135.363] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.md") returned 0
	[0135.363] lstrlenA (lpString="*.md") returned 4
	[0135.363] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.lnk") returned 0
	[0135.363] lstrlenA (lpString="*.lnk") returned 5
	[0135.363] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.torrent") returned 0
	[0135.363] lstrlenA (lpString="*.torrent") returned 9
	[0135.363] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.mov") returned 0
	[0135.363] lstrlenA (lpString="*.mov") returned 5
	[0135.363] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.3gp") returned 0
	[0135.363] lstrlenA (lpString="*.3gp") returned 5
	[0135.363] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.mpeg") returned 0
	[0135.363] lstrlenA (lpString="*.mpeg") returned 6
	[0135.363] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.mpg") returned 0
	[0135.363] lstrlenA (lpString="*.mpg") returned 5
	[0135.363] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.flv") returned 0
	[0135.363] lstrlenA (lpString="*.flv") returned 5
	[0135.364] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.avi") returned 0
	[0135.364] lstrlenA (lpString="*.avi") returned 5
	[0135.364] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.mp4") returned 0
	[0135.364] lstrlenA (lpString="*.mp4") returned 5
	[0135.364] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.wmv") returned 0
	[0135.364] lstrlenA (lpString="*.wmv") returned 5
	[0135.364] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.mkv") returned 0
	[0135.364] lstrlenA (lpString="*.mkv") returned 5
	[0135.364] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.mp3") returned 0
	[0135.364] lstrlenA (lpString="*.mp3") returned 5
	[0135.364] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.wav") returned 0
	[0135.364] lstrlenA (lpString="*.wav") returned 5
	[0135.364] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.flac") returned 0
	[0135.364] lstrlenA (lpString="*.flac") returned 6
	[0135.364] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.wma") returned 0
	[0135.364] lstrlenA (lpString="*.wma") returned 5
	[0135.364] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.au3") returned 0
	[0135.364] lstrlenA (lpString="*.au3") returned 5
	[0135.364] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.ahk") returned 0
	[0135.364] lstrlenA (lpString="*.ahk") returned 5
	[0135.364] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.c") returned 0
	[0135.364] lstrlenA (lpString="*.c") returned 3
	[0135.364] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.cc") returned 0
	[0135.364] lstrlenA (lpString="*.cc") returned 4
	[0135.364] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.cpp") returned 0
	[0135.364] lstrlenA (lpString="*.cpp") returned 5
	[0135.364] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.cxx") returned 0
	[0135.364] lstrlenA (lpString="*.cxx") returned 5
	[0135.364] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.c++") returned 0
	[0135.364] lstrlenA (lpString="*.c++") returned 5
	[0135.364] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.cs") returned 0
	[0135.364] lstrlenA (lpString="*.cs") returned 4
	[0135.364] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.vb") returned 0
	[0135.364] lstrlenA (lpString="*.vb") returned 4
	[0135.364] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.bas") returned 0
	[0135.364] lstrlenA (lpString="*.bas") returned 5
	[0135.365] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.csproj") returned 0
	[0135.365] lstrlenA (lpString="*.csproj") returned 8
	[0135.365] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.vbproj") returned 0
	[0135.365] lstrlenA (lpString="*.vbproj") returned 8
	[0135.365] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.vcxproj") returned 0
	[0135.365] lstrlenA (lpString="*.vcxproj") returned 9
	[0135.365] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.manifest") returned 0
	[0135.365] lstrlenA (lpString="*.manifest") returned 10
	[0135.365] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.php") returned 0
	[0135.365] lstrlenA (lpString="*.php") returned 5
	[0135.365] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.vbe") returned 0
	[0135.365] lstrlenA (lpString="*.vbe") returned 5
	[0135.365] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.vba") returned 0
	[0135.365] lstrlenA (lpString="*.vba") returned 5
	[0135.365] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.vbs") returned 0
	[0135.365] lstrlenA (lpString="*.vbs") returned 5
	[0135.365] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.bat") returned 0
	[0135.365] lstrlenA (lpString="*.bat") returned 5
	[0135.365] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.cmd") returned 0
	[0135.365] lstrlenA (lpString="*.cmd") returned 5
	[0135.365] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.js") returned 0
	[0135.365] lstrlenA (lpString="*.js") returned 4
	[0135.365] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.jscript") returned 0
	[0135.365] lstrlenA (lpString="*.jscript") returned 9
	[0135.365] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.hta") returned 0
	[0135.365] lstrlenA (lpString="*.hta") returned 5
	[0135.365] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.php7") returned 0
	[0135.365] lstrlenA (lpString="*.php7") returned 6
	[0135.365] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.db") returned 0
	[0135.365] lstrlenA (lpString="*.db") returned 4
	[0135.365] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.swf") returned 0
	[0135.365] lstrlenA (lpString="*.swf") returned 5
	[0135.365] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.eml") returned 0
	[0135.365] lstrlenA (lpString="*.eml") returned 5
	[0135.366] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.part") returned 0
	[0135.366] lstrlenA (lpString="*.part") returned 6
	[0135.366] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.nfo") returned 0
	[0135.366] lstrlenA (lpString="*.nfo") returned 5
	[0135.366] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.rsa") returned 0
	[0135.366] lstrlenA (lpString="*.rsa") returned 5
	[0135.366] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.key") returned 0
	[0135.366] lstrlenA (lpString="*.key") returned 5
	[0135.366] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.aes") returned 0
	[0135.366] lstrlenA (lpString="*.aes") returned 5
	[0135.366] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.blob") returned 0
	[0135.366] lstrlenA (lpString="*.blob") returned 6
	[0135.366] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.btc") returned 0
	[0135.366] lstrlenA (lpString="*.btc") returned 5
	[0135.366] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT", pszSpec="*.wallet") returned 0
	[0135.366] lstrlenA (lpString="*.wallet") returned 8
	[0135.366] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x21204700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1
	[0135.366] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0135.366] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="ntuser.dat.LOG1") returned -1
	[0135.366] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="ntuser.dat.LOG1") returned -1
	[0135.366] lstrcmpiA (lpString1="", lpString2="ntuser.dat.LOG1") returned -1
	[0135.366] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\NTUSER.DAT") returned="NTUSER.DAT"
	[0135.366] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\" | out: lpString1="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\"
	[0135.366] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\" | out: pszPath="C:\\Users\\FD1HVy\\") returned=""
	[0135.366] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.366] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\how-to-decrypt-files.htm")) returned 0x20
	[0135.366] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="ntuser.dat.LOG1" | out: lpString1="C:\\Users\\FD1HVy\\ntuser.dat.LOG1") returned="C:\\Users\\FD1HVy\\ntuser.dat.LOG1"
	[0135.366] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.zip") returned 0
	[0135.366] lstrlenA (lpString="*.zip") returned 5
	[0135.366] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.rar") returned 0
	[0135.366] lstrlenA (lpString="*.rar") returned 5
	[0135.366] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.7z") returned 0
	[0135.367] lstrlenA (lpString="*.7z") returned 4
	[0135.367] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.tar") returned 0
	[0135.367] lstrlenA (lpString="*.tar") returned 5
	[0135.367] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.gzip") returned 0
	[0135.367] lstrlenA (lpString="*.gzip") returned 6
	[0135.367] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.jpg") returned 0
	[0135.367] lstrlenA (lpString="*.jpg") returned 5
	[0135.367] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.jpeg") returned 0
	[0135.367] lstrlenA (lpString="*.jpeg") returned 6
	[0135.367] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.bmp") returned 0
	[0135.367] lstrlenA (lpString="*.bmp") returned 5
	[0135.367] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.gif") returned 0
	[0135.367] lstrlenA (lpString="*.gif") returned 5
	[0135.367] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.png") returned 0
	[0135.367] lstrlenA (lpString="*.png") returned 5
	[0135.367] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.doc") returned 0
	[0135.367] lstrlenA (lpString="*.doc") returned 5
	[0135.367] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.docx") returned 0
	[0135.367] lstrlenA (lpString="*.docx") returned 6
	[0135.367] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.xls") returned 0
	[0135.367] lstrlenA (lpString="*.xls") returned 5
	[0135.367] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.xlsx") returned 0
	[0135.367] lstrlenA (lpString="*.xlsx") returned 6
	[0135.368] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.ppt") returned 0
	[0135.368] lstrlenA (lpString="*.ppt") returned 5
	[0135.368] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.pptx") returned 0
	[0135.368] lstrlenA (lpString="*.pptx") returned 6
	[0135.368] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.txt") returned 0
	[0135.368] lstrlenA (lpString="*.txt") returned 5
	[0135.368] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.pdf") returned 0
	[0135.368] lstrlenA (lpString="*.pdf") returned 5
	[0135.368] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.htm") returned 0
	[0135.368] lstrlenA (lpString="*.htm") returned 5
	[0135.368] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.html") returned 0
	[0135.368] lstrlenA (lpString="*.html") returned 6
	[0135.368] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.mdb") returned 0
	[0135.368] lstrlenA (lpString="*.mdb") returned 5
	[0135.368] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.pfx") returned 0
	[0135.368] lstrlenA (lpString="*.pfx") returned 5
	[0135.368] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.md") returned 0
	[0135.368] lstrlenA (lpString="*.md") returned 4
	[0135.368] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.lnk") returned 0
	[0135.368] lstrlenA (lpString="*.lnk") returned 5
	[0135.368] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.torrent") returned 0
	[0135.368] lstrlenA (lpString="*.torrent") returned 9
	[0135.368] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.mov") returned 0
	[0135.368] lstrlenA (lpString="*.mov") returned 5
	[0135.368] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.3gp") returned 0
	[0135.368] lstrlenA (lpString="*.3gp") returned 5
	[0135.368] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.mpeg") returned 0
	[0135.368] lstrlenA (lpString="*.mpeg") returned 6
	[0135.368] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.mpg") returned 0
	[0135.368] lstrlenA (lpString="*.mpg") returned 5
	[0135.368] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.flv") returned 0
	[0135.368] lstrlenA (lpString="*.flv") returned 5
	[0135.368] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.avi") returned 0
	[0135.368] lstrlenA (lpString="*.avi") returned 5
	[0135.369] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.mp4") returned 0
	[0135.369] lstrlenA (lpString="*.mp4") returned 5
	[0135.369] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.wmv") returned 0
	[0135.369] lstrlenA (lpString="*.wmv") returned 5
	[0135.369] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.mkv") returned 0
	[0135.369] lstrlenA (lpString="*.mkv") returned 5
	[0135.369] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.mp3") returned 0
	[0135.369] lstrlenA (lpString="*.mp3") returned 5
	[0135.369] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.wav") returned 0
	[0135.369] lstrlenA (lpString="*.wav") returned 5
	[0135.369] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.flac") returned 0
	[0135.369] lstrlenA (lpString="*.flac") returned 6
	[0135.369] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.wma") returned 0
	[0135.369] lstrlenA (lpString="*.wma") returned 5
	[0135.369] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.au3") returned 0
	[0135.369] lstrlenA (lpString="*.au3") returned 5
	[0135.369] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.ahk") returned 0
	[0135.369] lstrlenA (lpString="*.ahk") returned 5
	[0135.369] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.c") returned 0
	[0135.369] lstrlenA (lpString="*.c") returned 3
	[0135.369] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.cc") returned 0
	[0135.369] lstrlenA (lpString="*.cc") returned 4
	[0135.369] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.cpp") returned 0
	[0135.369] lstrlenA (lpString="*.cpp") returned 5
	[0135.369] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.cxx") returned 0
	[0135.369] lstrlenA (lpString="*.cxx") returned 5
	[0135.369] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.c++") returned 0
	[0135.369] lstrlenA (lpString="*.c++") returned 5
	[0135.369] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.cs") returned 0
	[0135.369] lstrlenA (lpString="*.cs") returned 4
	[0135.369] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.vb") returned 0
	[0135.369] lstrlenA (lpString="*.vb") returned 4
	[0135.369] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.bas") returned 0
	[0135.369] lstrlenA (lpString="*.bas") returned 5
	[0135.369] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.csproj") returned 0
	[0135.369] lstrlenA (lpString="*.csproj") returned 8
	[0135.370] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.vbproj") returned 0
	[0135.370] lstrlenA (lpString="*.vbproj") returned 8
	[0135.370] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.vcxproj") returned 0
	[0135.370] lstrlenA (lpString="*.vcxproj") returned 9
	[0135.370] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.manifest") returned 0
	[0135.370] lstrlenA (lpString="*.manifest") returned 10
	[0135.370] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.php") returned 0
	[0135.370] lstrlenA (lpString="*.php") returned 5
	[0135.370] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.vbe") returned 0
	[0135.370] lstrlenA (lpString="*.vbe") returned 5
	[0135.370] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.vba") returned 0
	[0135.370] lstrlenA (lpString="*.vba") returned 5
	[0135.370] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.vbs") returned 0
	[0135.370] lstrlenA (lpString="*.vbs") returned 5
	[0135.370] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.bat") returned 0
	[0135.370] lstrlenA (lpString="*.bat") returned 5
	[0135.370] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.cmd") returned 0
	[0135.370] lstrlenA (lpString="*.cmd") returned 5
	[0135.370] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.js") returned 0
	[0135.370] lstrlenA (lpString="*.js") returned 4
	[0135.370] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.jscript") returned 0
	[0135.370] lstrlenA (lpString="*.jscript") returned 9
	[0135.370] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.hta") returned 0
	[0135.370] lstrlenA (lpString="*.hta") returned 5
	[0135.370] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.php7") returned 0
	[0135.370] lstrlenA (lpString="*.php7") returned 6
	[0135.370] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.db") returned 0
	[0135.370] lstrlenA (lpString="*.db") returned 4
	[0135.370] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.swf") returned 0
	[0135.370] lstrlenA (lpString="*.swf") returned 5
	[0135.370] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.eml") returned 0
	[0135.370] lstrlenA (lpString="*.eml") returned 5
	[0135.370] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.part") returned 0
	[0135.370] lstrlenA (lpString="*.part") returned 6
	[0135.370] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.nfo") returned 0
	[0135.371] lstrlenA (lpString="*.nfo") returned 5
	[0135.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.rsa") returned 0
	[0135.371] lstrlenA (lpString="*.rsa") returned 5
	[0135.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.key") returned 0
	[0135.371] lstrlenA (lpString="*.key") returned 5
	[0135.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.aes") returned 0
	[0135.371] lstrlenA (lpString="*.aes") returned 5
	[0135.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.blob") returned 0
	[0135.371] lstrlenA (lpString="*.blob") returned 6
	[0135.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.btc") returned 0
	[0135.371] lstrlenA (lpString="*.btc") returned 5
	[0135.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", pszSpec="*.wallet") returned 0
	[0135.371] lstrlenA (lpString="*.wallet") returned 8
	[0135.371] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x21204700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1
	[0135.371] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0135.371] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="ntuser.dat.LOG2") returned -1
	[0135.371] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="ntuser.dat.LOG2") returned -1
	[0135.371] lstrcmpiA (lpString1="", lpString2="ntuser.dat.LOG2") returned -1
	[0135.371] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\ntuser.dat.LOG1") returned="ntuser.dat.LOG1"
	[0135.371] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\" | out: lpString1="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\"
	[0135.371] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\" | out: pszPath="C:\\Users\\FD1HVy\\") returned=""
	[0135.371] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.371] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\how-to-decrypt-files.htm")) returned 0x20
	[0135.371] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="ntuser.dat.LOG2" | out: lpString1="C:\\Users\\FD1HVy\\ntuser.dat.LOG2") returned="C:\\Users\\FD1HVy\\ntuser.dat.LOG2"
	[0135.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.zip") returned 0
	[0135.371] lstrlenA (lpString="*.zip") returned 5
	[0135.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.rar") returned 0
	[0135.371] lstrlenA (lpString="*.rar") returned 5
	[0135.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.7z") returned 0
	[0135.371] lstrlenA (lpString="*.7z") returned 4
	[0135.371] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.tar") returned 0
	[0135.372] lstrlenA (lpString="*.tar") returned 5
	[0135.372] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.gzip") returned 0
	[0135.372] lstrlenA (lpString="*.gzip") returned 6
	[0135.372] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.jpg") returned 0
	[0135.372] lstrlenA (lpString="*.jpg") returned 5
	[0135.372] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.jpeg") returned 0
	[0135.372] lstrlenA (lpString="*.jpeg") returned 6
	[0135.372] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.bmp") returned 0
	[0135.372] lstrlenA (lpString="*.bmp") returned 5
	[0135.372] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.gif") returned 0
	[0135.372] lstrlenA (lpString="*.gif") returned 5
	[0135.372] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.png") returned 0
	[0135.372] lstrlenA (lpString="*.png") returned 5
	[0135.372] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.doc") returned 0
	[0135.372] lstrlenA (lpString="*.doc") returned 5
	[0135.372] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.docx") returned 0
	[0135.372] lstrlenA (lpString="*.docx") returned 6
	[0135.372] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.xls") returned 0
	[0135.372] lstrlenA (lpString="*.xls") returned 5
	[0135.372] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.xlsx") returned 0
	[0135.372] lstrlenA (lpString="*.xlsx") returned 6
	[0135.372] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.ppt") returned 0
	[0135.372] lstrlenA (lpString="*.ppt") returned 5
	[0135.372] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.pptx") returned 0
	[0135.372] lstrlenA (lpString="*.pptx") returned 6
	[0135.372] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.txt") returned 0
	[0135.372] lstrlenA (lpString="*.txt") returned 5
	[0135.372] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.pdf") returned 0
	[0135.372] lstrlenA (lpString="*.pdf") returned 5
	[0135.372] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.htm") returned 0
	[0135.372] lstrlenA (lpString="*.htm") returned 5
	[0135.372] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.html") returned 0
	[0135.372] lstrlenA (lpString="*.html") returned 6
	[0135.372] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.mdb") returned 0
	[0135.372] lstrlenA (lpString="*.mdb") returned 5
	[0135.373] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.pfx") returned 0
	[0135.373] lstrlenA (lpString="*.pfx") returned 5
	[0135.373] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.md") returned 0
	[0135.373] lstrlenA (lpString="*.md") returned 4
	[0135.373] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.lnk") returned 0
	[0135.373] lstrlenA (lpString="*.lnk") returned 5
	[0135.373] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.torrent") returned 0
	[0135.373] lstrlenA (lpString="*.torrent") returned 9
	[0135.373] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.mov") returned 0
	[0135.373] lstrlenA (lpString="*.mov") returned 5
	[0135.373] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.3gp") returned 0
	[0135.373] lstrlenA (lpString="*.3gp") returned 5
	[0135.373] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.mpeg") returned 0
	[0135.373] lstrlenA (lpString="*.mpeg") returned 6
	[0135.373] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.mpg") returned 0
	[0135.373] lstrlenA (lpString="*.mpg") returned 5
	[0135.373] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.flv") returned 0
	[0135.373] lstrlenA (lpString="*.flv") returned 5
	[0135.373] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.avi") returned 0
	[0135.373] lstrlenA (lpString="*.avi") returned 5
	[0135.373] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.mp4") returned 0
	[0135.373] lstrlenA (lpString="*.mp4") returned 5
	[0135.373] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.wmv") returned 0
	[0135.373] lstrlenA (lpString="*.wmv") returned 5
	[0135.373] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.mkv") returned 0
	[0135.373] lstrlenA (lpString="*.mkv") returned 5
	[0135.373] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.mp3") returned 0
	[0135.373] lstrlenA (lpString="*.mp3") returned 5
	[0135.373] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.wav") returned 0
	[0135.373] lstrlenA (lpString="*.wav") returned 5
	[0135.373] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.flac") returned 0
	[0135.373] lstrlenA (lpString="*.flac") returned 6
	[0135.373] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.wma") returned 0
	[0135.373] lstrlenA (lpString="*.wma") returned 5
	[0135.373] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.au3") returned 0
	[0135.374] lstrlenA (lpString="*.au3") returned 5
	[0135.374] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.ahk") returned 0
	[0135.374] lstrlenA (lpString="*.ahk") returned 5
	[0135.374] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.c") returned 0
	[0135.374] lstrlenA (lpString="*.c") returned 3
	[0135.374] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.cc") returned 0
	[0135.374] lstrlenA (lpString="*.cc") returned 4
	[0135.374] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.cpp") returned 0
	[0135.374] lstrlenA (lpString="*.cpp") returned 5
	[0135.374] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.cxx") returned 0
	[0135.374] lstrlenA (lpString="*.cxx") returned 5
	[0135.374] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.c++") returned 0
	[0135.374] lstrlenA (lpString="*.c++") returned 5
	[0135.374] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.cs") returned 0
	[0135.374] lstrlenA (lpString="*.cs") returned 4
	[0135.374] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.vb") returned 0
	[0135.374] lstrlenA (lpString="*.vb") returned 4
	[0135.374] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.bas") returned 0
	[0135.374] lstrlenA (lpString="*.bas") returned 5
	[0135.374] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.csproj") returned 0
	[0135.374] lstrlenA (lpString="*.csproj") returned 8
	[0135.374] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.vbproj") returned 0
	[0135.374] lstrlenA (lpString="*.vbproj") returned 8
	[0135.374] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.vcxproj") returned 0
	[0135.374] lstrlenA (lpString="*.vcxproj") returned 9
	[0135.374] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.manifest") returned 0
	[0135.374] lstrlenA (lpString="*.manifest") returned 10
	[0135.374] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.php") returned 0
	[0135.374] lstrlenA (lpString="*.php") returned 5
	[0135.374] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.vbe") returned 0
	[0135.374] lstrlenA (lpString="*.vbe") returned 5
	[0135.374] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.vba") returned 0
	[0135.374] lstrlenA (lpString="*.vba") returned 5
	[0135.374] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.vbs") returned 0
	[0135.374] lstrlenA (lpString="*.vbs") returned 5
	[0135.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.bat") returned 0
	[0135.375] lstrlenA (lpString="*.bat") returned 5
	[0135.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.cmd") returned 0
	[0135.375] lstrlenA (lpString="*.cmd") returned 5
	[0135.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.js") returned 0
	[0135.375] lstrlenA (lpString="*.js") returned 4
	[0135.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.jscript") returned 0
	[0135.375] lstrlenA (lpString="*.jscript") returned 9
	[0135.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.hta") returned 0
	[0135.375] lstrlenA (lpString="*.hta") returned 5
	[0135.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.php7") returned 0
	[0135.375] lstrlenA (lpString="*.php7") returned 6
	[0135.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.db") returned 0
	[0135.375] lstrlenA (lpString="*.db") returned 4
	[0135.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.swf") returned 0
	[0135.375] lstrlenA (lpString="*.swf") returned 5
	[0135.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.eml") returned 0
	[0135.375] lstrlenA (lpString="*.eml") returned 5
	[0135.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.part") returned 0
	[0135.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.nfo") returned 0
	[0135.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.rsa") returned 0
	[0135.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.key") returned 0
	[0135.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.aes") returned 0
	[0135.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.blob") returned 0
	[0135.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.btc") returned 0
	[0135.375] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", pszSpec="*.wallet") returned 0
	[0135.375] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1
	[0135.375] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0135.375] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf") returned -1
	[0135.375] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf") returned -1
	[0135.375] lstrcmpiA (lpString1="", lpString2="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf") returned -1
	[0135.376] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\ntuser.dat.LOG2") returned="ntuser.dat.LOG2"
	[0135.376] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\" | out: lpString1="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\"
	[0135.376] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\" | out: pszPath="C:\\Users\\FD1HVy\\") returned=""
	[0135.376] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.376] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\how-to-decrypt-files.htm")) returned 0x20
	[0135.376] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" | out: lpString1="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf") returned="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf"
	[0135.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", pszSpec="*.zip") returned 0
	[0135.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", pszSpec="*.rar") returned 0
	[0135.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", pszSpec="*.7z") returned 0
	[0135.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", pszSpec="*.tar") returned 0
	[0135.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", pszSpec="*.gzip") returned 0
	[0135.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", pszSpec="*.jpg") returned 0
	[0135.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", pszSpec="*.jpeg") returned 0
	[0135.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", pszSpec="*.bmp") returned 0
	[0135.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", pszSpec="*.gif") returned 0
	[0135.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", pszSpec="*.png") returned 0
	[0135.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", pszSpec="*.doc") returned 0
	[0135.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", pszSpec="*.docx") returned 0
	[0135.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", pszSpec="*.xls") returned 0
	[0135.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", pszSpec="*.xlsx") returned 0
	[0135.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", pszSpec="*.ppt") returned 0
	[0135.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", pszSpec="*.pptx") returned 0
	[0135.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", pszSpec="*.txt") returned 0
	[0135.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", pszSpec="*.pdf") returned 0
	[0135.376] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", pszSpec="*.htm") returned 0
	[0135.377] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", pszSpec="*.html") returned 0
	[0135.377] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", pszSpec="*.mdb") returned 0
	[0135.377] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", pszSpec="*.pfx") returned 0
	[0135.377] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", pszSpec="*.md") returned 0
	[0135.377] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", pszSpec="*.lnk") returned 0
	[0135.377] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", pszSpec="*.torrent") returned 0
	[0135.377] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", pszSpec="*.mov") returned 0
	[0135.377] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", pszSpec="*.3gp") returned 0
	[0135.377] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", pszSpec="*.mpeg") returned 0
	[0135.377] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", pszSpec="*.mpg") returned 0
	[0135.377] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", pszSpec="*.flv") returned 0
	[0135.377] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2122a949, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2122a949, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1
	[0135.377] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0135.377] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms") returned -1
	[0135.377] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms") returned -1
	[0135.377] lstrcmpiA (lpString1="", lpString2="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms") returned -1
	[0135.377] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf") returned="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf"
	[0135.377] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\" | out: lpString1="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\"
	[0135.377] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\" | out: pszPath="C:\\Users\\FD1HVy\\") returned=""
	[0135.377] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.378] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\how-to-decrypt-files.htm")) returned 0x20
	[0135.378] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" | out: lpString1="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms") returned="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms"
	[0135.378] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2122a949, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2122a949, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1
	[0135.378] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0135.378] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms") returned -1
	[0135.378] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms") returned -1
	[0135.378] lstrcmpiA (lpString1="", lpString2="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms") returned -1
	[0135.378] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms") returned="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms"
	[0135.378] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\" | out: lpString1="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\"
	[0135.378] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\" | out: pszPath="C:\\Users\\FD1HVy\\") returned=""
	[0135.378] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.378] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\how-to-decrypt-files.htm")) returned 0x20
	[0135.378] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" | out: lpString1="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms") returned="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms"
	[0135.378] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xc1adea7d, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc1adea7d, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc1adea7d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1
	[0135.378] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0135.378] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="ntuser.ini") returned -1
	[0135.378] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="ntuser.ini") returned -1
	[0135.378] lstrcmpiA (lpString1="", lpString2="ntuser.ini") returned -1
	[0135.378] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms") returned="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms"
	[0135.378] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\" | out: lpString1="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\"
	[0135.378] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\" | out: pszPath="C:\\Users\\FD1HVy\\") returned=""
	[0135.378] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.378] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\how-to-decrypt-files.htm")) returned 0x20
	[0135.379] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="ntuser.ini" | out: lpString1="C:\\Users\\FD1HVy\\ntuser.ini") returned="C:\\Users\\FD1HVy\\ntuser.ini"
	[0135.379] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive", cAlternateFileName="")) returned 1
	[0135.379] lstrcmpA (lpString1=".", lpString2="OneDrive") returned -1
	[0135.379] lstrcmpA (lpString1="..", lpString2="OneDrive") returned -1
	[0135.379] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\ntuser.ini") returned="ntuser.ini"
	[0135.379] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="OneDrive" | out: lpString1="C:\\Users\\FD1HVy\\OneDrive") returned="C:\\Users\\FD1HVy\\OneDrive"
	[0135.379] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\OneDrive\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x68, cFileName=".", cAlternateFileName="")) returned 0x7cb650
	[0135.379] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0135.379] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x68, cFileName="..", cAlternateFileName="")) returned 1
	[0135.379] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0135.379] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0135.379] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f0f0bc5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x93ef127a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x7b0000, dwReserved1=0x68, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0135.379] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.379] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="desktop.ini") returned 1
	[0135.379] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="desktop.ini") returned 1
	[0135.379] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1
	[0135.379] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\OneDrive\\*.*") returned="*.*"
	[0135.379] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\OneDrive\\" | out: lpString1="C:\\Users\\FD1HVy\\OneDrive\\") returned="C:\\Users\\FD1HVy\\OneDrive\\"
	[0135.379] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\OneDrive\\" | out: pszPath="C:\\Users\\FD1HVy\\OneDrive\\") returned=""
	[0135.379] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\OneDrive\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\OneDrive\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\OneDrive\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.379] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\OneDrive\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\onedrive\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0135.379] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\OneDrive\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\onedrive\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.380] WriteFile (in: hFile=0x20c, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0135.381] SetFileTime (hFile=0x20c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0135.381] CloseHandle (hObject=0x20c) returned 1
	[0135.381] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\OneDrive\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini") returned="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini"
	[0135.381] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f0f0bc5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x93ef127a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x7b0000, dwReserved1=0x68, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0135.381] FindClose (in: hFindFile=0x7cb650 | out: hFindFile=0x7cb650) returned 1
	[0135.381] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x1190babb, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x1190babb, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1
	[0135.381] lstrcmpA (lpString1=".", lpString2="Pictures") returned -1
	[0135.381] lstrcmpA (lpString1="..", lpString2="Pictures") returned -1
	[0135.381] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\*.*") returned="*.*"
	[0135.381] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Pictures" | out: lpString1="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures"
	[0135.381] lstrlenA (lpString="C:\\Users\\FD1HVy\\Pictures") returned 24
	[0135.381] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x1190babb, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x1190babb, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x7cb6d0
	[0135.381] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0135.381] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x1190babb, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x1190babb, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1
	[0135.382] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0135.382] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0135.382] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c6e85a0, ftCreationTime.dwHighDateTime=0x1d4ccdb, ftLastAccessTime.dwLowDateTime=0xda2d0110, ftLastAccessTime.dwHighDateTime=0x1d4d47d, ftLastWriteTime.dwLowDateTime=0xda2d0110, ftLastWriteTime.dwHighDateTime=0x1d4d47d, nFileSizeHigh=0x0, nFileSizeLow=0x1489d, dwReserved0=0x0, dwReserved1=0x1, cFileName="0QS1mo.bmp", cAlternateFileName="")) returned 1
	[0135.382] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.382] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="0QS1mo.bmp") returned 1
	[0135.382] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="0QS1mo.bmp") returned 1
	[0135.382] lstrcmpiA (lpString1="", lpString2="0QS1mo.bmp") returned -1
	[0135.382] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\*.*") returned="*.*"
	[0135.382] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.382] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.382] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.382] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0135.382] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.382] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0135.383] WriteFile (in: hFile=0x20c, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0135.384] SetFileTime (hFile=0x20c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0135.384] CloseHandle (hObject=0x20c) returned 1
	[0135.384] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="0QS1mo.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\0QS1mo.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\0QS1mo.bmp"
	[0135.384] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\0QS1mo.bmp", pszSpec="*.zip") returned 0
	[0135.384] lstrlenA (lpString="*.zip") returned 5
	[0135.384] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\0QS1mo.bmp", pszSpec="*.rar") returned 0
	[0135.384] lstrlenA (lpString="*.rar") returned 5
	[0135.384] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\0QS1mo.bmp", pszSpec="*.7z") returned 0
	[0135.384] lstrlenA (lpString="*.7z") returned 4
	[0135.384] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\0QS1mo.bmp", pszSpec="*.tar") returned 0
	[0135.385] lstrlenA (lpString="*.tar") returned 5
	[0135.385] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\0QS1mo.bmp", pszSpec="*.gzip") returned 0
	[0135.385] lstrlenA (lpString="*.gzip") returned 6
	[0135.385] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\0QS1mo.bmp", pszSpec="*.jpg") returned 0
	[0135.385] lstrlenA (lpString="*.jpg") returned 5
	[0135.385] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\0QS1mo.bmp", pszSpec="*.jpeg") returned 0
	[0135.385] lstrlenA (lpString="*.jpeg") returned 6
	[0135.385] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\0QS1mo.bmp", pszSpec="*.bmp") returned 1
	[0135.385] lstrlenA (lpString="*.bmp") returned 5
	[0135.385] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Pictures\\0QS1mo.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\0QS1mo.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\0QS1mo.bmp"
	[0135.385] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Pictures\\0QS1mo.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\0QS1mo.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\0QS1mo.bmp"
	[0135.385] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\0QS1mo.bmp", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\0QS1mo.bmp.") returned="C:\\Users\\FD1HVy\\Pictures\\0QS1mo.bmp."
	[0135.385] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\0QS1mo.bmp.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\0QS1mo.bmp.exe") returned="C:\\Users\\FD1HVy\\Pictures\\0QS1mo.bmp.exe"
	[0135.385] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\0QS1mo.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\0qs1mo.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.385] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1489d
	[0135.385] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9c6e85a0, dwHighDateTime=0x1d4ccdb), lpLastAccessTime=0x407536*(dwLowDateTime=0xda2d0110, dwHighDateTime=0x1d4d47d), lpLastWriteTime=0x40753e*(dwLowDateTime=0xda2d0110, dwHighDateTime=0x1d4d47d)) returned 1
	[0135.385] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.385] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1485b, lpOverlapped=0x0) returned 1
	[0135.387] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\0QS1mo.bmp") returned="0QS1mo.bmp"
	[0135.387] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.387] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1485b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1485b, lpOverlapped=0x0) returned 1
	[0135.387] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.387] CloseHandle (hObject=0x20c) returned 1
	[0135.387] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\0QS1mo.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\0qs1mo.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\0QS1mo.bmp.exe" (normalized: "c:\\users\\fd1hvy\\pictures\\0qs1mo.bmp.exe")) returned 1
	[0135.388] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c4b8b0, ftCreationTime.dwHighDateTime=0x1d4d078, ftLastAccessTime.dwLowDateTime=0x80243f90, ftLastAccessTime.dwHighDateTime=0x1d4d1fc, ftLastWriteTime.dwLowDateTime=0x80243f90, ftLastWriteTime.dwHighDateTime=0x1d4d1fc, nFileSizeHigh=0x0, nFileSizeLow=0x1add, dwReserved0=0x12, dwReserved1=0x1, cFileName="0ZtJsTkmMJ1t.gif", cAlternateFileName="0ZTJST~1.GIF")) returned 1
	[0135.388] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.388] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="0ZtJsTkmMJ1t.gif") returned 1
	[0135.388] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="0ZtJsTkmMJ1t.gif") returned 1
	[0135.388] lstrcmpiA (lpString1="", lpString2="0ZtJsTkmMJ1t.gif") returned -1
	[0135.388] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\0QS1mo.bmp") returned="0QS1mo.bmp"
	[0135.388] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.388] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.388] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.388] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0x20
	[0135.388] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="0ZtJsTkmMJ1t.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\0ZtJsTkmMJ1t.gif") returned="C:\\Users\\FD1HVy\\Pictures\\0ZtJsTkmMJ1t.gif"
	[0135.388] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\0ZtJsTkmMJ1t.gif", pszSpec="*.zip") returned 0
	[0135.388] lstrlenA (lpString="*.zip") returned 5
	[0135.388] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\0ZtJsTkmMJ1t.gif", pszSpec="*.rar") returned 0
	[0135.389] lstrlenA (lpString="*.rar") returned 5
	[0135.389] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\0ZtJsTkmMJ1t.gif", pszSpec="*.7z") returned 0
	[0135.389] lstrlenA (lpString="*.7z") returned 4
	[0135.389] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\0ZtJsTkmMJ1t.gif", pszSpec="*.tar") returned 0
	[0135.389] lstrlenA (lpString="*.tar") returned 5
	[0135.389] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\0ZtJsTkmMJ1t.gif", pszSpec="*.gzip") returned 0
	[0135.389] lstrlenA (lpString="*.gzip") returned 6
	[0135.389] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\0ZtJsTkmMJ1t.gif", pszSpec="*.jpg") returned 0
	[0135.389] lstrlenA (lpString="*.jpg") returned 5
	[0135.389] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\0ZtJsTkmMJ1t.gif", pszSpec="*.jpeg") returned 0
	[0135.389] lstrlenA (lpString="*.jpeg") returned 6
	[0135.389] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\0ZtJsTkmMJ1t.gif", pszSpec="*.bmp") returned 0
	[0135.389] lstrlenA (lpString="*.bmp") returned 5
	[0135.389] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\0ZtJsTkmMJ1t.gif", pszSpec="*.gif") returned 1
	[0135.389] lstrlenA (lpString="*.gif") returned 5
	[0135.389] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Pictures\\0ZtJsTkmMJ1t.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\0ZtJsTkmMJ1t.gif") returned="C:\\Users\\FD1HVy\\Pictures\\0ZtJsTkmMJ1t.gif"
	[0135.389] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Pictures\\0ZtJsTkmMJ1t.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\0ZtJsTkmMJ1t.gif") returned="C:\\Users\\FD1HVy\\Pictures\\0ZtJsTkmMJ1t.gif"
	[0135.389] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\0ZtJsTkmMJ1t.gif", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\0ZtJsTkmMJ1t.gif.") returned="C:\\Users\\FD1HVy\\Pictures\\0ZtJsTkmMJ1t.gif."
	[0135.389] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\0ZtJsTkmMJ1t.gif.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\0ZtJsTkmMJ1t.gif.exe") returned="C:\\Users\\FD1HVy\\Pictures\\0ZtJsTkmMJ1t.gif.exe"
	[0135.389] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\0ZtJsTkmMJ1t.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\0ztjstkmmj1t.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.389] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1add
	[0135.389] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c4b8b0, dwHighDateTime=0x1d4d078), lpLastAccessTime=0x407536*(dwLowDateTime=0x80243f90, dwHighDateTime=0x1d4d1fc), lpLastWriteTime=0x40753e*(dwLowDateTime=0x80243f90, dwHighDateTime=0x1d4d1fc)) returned 1
	[0135.389] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.389] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1a9b, lpOverlapped=0x0) returned 1
	[0135.390] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\0ZtJsTkmMJ1t.gif") returned="0ZtJsTkmMJ1t.gif"
	[0135.390] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.390] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1a9b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1a9b, lpOverlapped=0x0) returned 1
	[0135.390] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.391] CloseHandle (hObject=0x20c) returned 1
	[0135.391] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\0ZtJsTkmMJ1t.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\0ztjstkmmj1t.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\0ZtJsTkmMJ1t.gif.exe" (normalized: "c:\\users\\fd1hvy\\pictures\\0ztjstkmmj1t.gif.exe")) returned 1
	[0135.391] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfea8250, ftCreationTime.dwHighDateTime=0x1d4d1e5, ftLastAccessTime.dwLowDateTime=0xacacaf70, ftLastAccessTime.dwHighDateTime=0x1d4ca36, ftLastWriteTime.dwLowDateTime=0xacacaf70, ftLastWriteTime.dwHighDateTime=0x1d4ca36, nFileSizeHigh=0x0, nFileSizeLow=0xded5, dwReserved0=0x15, dwReserved1=0x1, cFileName="271w-RDH5eo6Mas.png", cAlternateFileName="271W-R~1.PNG")) returned 1
	[0135.391] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.391] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="271w-RDH5eo6Mas.png") returned 1
	[0135.391] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="271w-RDH5eo6Mas.png") returned 1
	[0135.391] lstrcmpiA (lpString1="", lpString2="271w-RDH5eo6Mas.png") returned -1
	[0135.391] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\0ZtJsTkmMJ1t.gif") returned="0ZtJsTkmMJ1t.gif"
	[0135.391] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.391] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.391] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.391] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0x20
	[0135.392] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="271w-RDH5eo6Mas.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\271w-RDH5eo6Mas.png") returned="C:\\Users\\FD1HVy\\Pictures\\271w-RDH5eo6Mas.png"
	[0135.392] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\271w-RDH5eo6Mas.png", pszSpec="*.zip") returned 0
	[0135.392] lstrlenA (lpString="*.zip") returned 5
	[0135.392] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\271w-RDH5eo6Mas.png", pszSpec="*.rar") returned 0
	[0135.392] lstrlenA (lpString="*.rar") returned 5
	[0135.392] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\271w-RDH5eo6Mas.png", pszSpec="*.7z") returned 0
	[0135.392] lstrlenA (lpString="*.7z") returned 4
	[0135.392] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\271w-RDH5eo6Mas.png", pszSpec="*.tar") returned 0
	[0135.392] lstrlenA (lpString="*.tar") returned 5
	[0135.392] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\271w-RDH5eo6Mas.png", pszSpec="*.gzip") returned 0
	[0135.392] lstrlenA (lpString="*.gzip") returned 6
	[0135.392] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\271w-RDH5eo6Mas.png", pszSpec="*.jpg") returned 0
	[0135.392] lstrlenA (lpString="*.jpg") returned 5
	[0135.392] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\271w-RDH5eo6Mas.png", pszSpec="*.jpeg") returned 0
	[0135.392] lstrlenA (lpString="*.jpeg") returned 6
	[0135.392] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\271w-RDH5eo6Mas.png", pszSpec="*.bmp") returned 0
	[0135.392] lstrlenA (lpString="*.bmp") returned 5
	[0135.392] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\271w-RDH5eo6Mas.png", pszSpec="*.gif") returned 0
	[0135.392] lstrlenA (lpString="*.gif") returned 5
	[0135.392] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\271w-RDH5eo6Mas.png", pszSpec="*.png") returned 1
	[0135.392] lstrlenA (lpString="*.png") returned 5
	[0135.392] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Pictures\\271w-RDH5eo6Mas.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\271w-RDH5eo6Mas.png") returned="C:\\Users\\FD1HVy\\Pictures\\271w-RDH5eo6Mas.png"
	[0135.392] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Pictures\\271w-RDH5eo6Mas.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\271w-RDH5eo6Mas.png") returned="C:\\Users\\FD1HVy\\Pictures\\271w-RDH5eo6Mas.png"
	[0135.392] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\271w-RDH5eo6Mas.png", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\271w-RDH5eo6Mas.png.") returned="C:\\Users\\FD1HVy\\Pictures\\271w-RDH5eo6Mas.png."
	[0135.392] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\271w-RDH5eo6Mas.png.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\271w-RDH5eo6Mas.png.exe") returned="C:\\Users\\FD1HVy\\Pictures\\271w-RDH5eo6Mas.png.exe"
	[0135.392] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\271w-RDH5eo6Mas.png" (normalized: "c:\\users\\fd1hvy\\pictures\\271w-rdh5eo6mas.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.393] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xded5
	[0135.393] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xfea8250, dwHighDateTime=0x1d4d1e5), lpLastAccessTime=0x407536*(dwLowDateTime=0xacacaf70, dwHighDateTime=0x1d4ca36), lpLastWriteTime=0x40753e*(dwLowDateTime=0xacacaf70, dwHighDateTime=0x1d4ca36)) returned 1
	[0135.393] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.393] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xde93, lpOverlapped=0x0) returned 1
	[0135.394] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\271w-RDH5eo6Mas.png") returned="271w-RDH5eo6Mas.png"
	[0135.394] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.394] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xde93, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xde93, lpOverlapped=0x0) returned 1
	[0135.394] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.394] CloseHandle (hObject=0x20c) returned 1
	[0135.394] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\271w-RDH5eo6Mas.png" (normalized: "c:\\users\\fd1hvy\\pictures\\271w-rdh5eo6mas.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\271w-RDH5eo6Mas.png.exe" (normalized: "c:\\users\\fd1hvy\\pictures\\271w-rdh5eo6mas.png.exe")) returned 1
	[0135.395] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8198b60, ftCreationTime.dwHighDateTime=0x1d4cf1b, ftLastAccessTime.dwLowDateTime=0x9c3415a0, ftLastAccessTime.dwHighDateTime=0x1d4d4e7, ftLastWriteTime.dwLowDateTime=0x9c3415a0, ftLastWriteTime.dwHighDateTime=0x1d4d4e7, nFileSizeHigh=0x0, nFileSizeLow=0xb134, dwReserved0=0x1c, dwReserved1=0x1, cFileName="8NLq3VD jI.bmp", cAlternateFileName="8NLQ3V~1.BMP")) returned 1
	[0135.395] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.395] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="8NLq3VD jI.bmp") returned 1
	[0135.395] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="8NLq3VD jI.bmp") returned 1
	[0135.395] lstrcmpiA (lpString1="", lpString2="8NLq3VD jI.bmp") returned -1
	[0135.395] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\271w-RDH5eo6Mas.png") returned="271w-RDH5eo6Mas.png"
	[0135.395] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.395] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.395] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.395] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0x20
	[0135.395] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="8NLq3VD jI.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\8NLq3VD jI.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\8NLq3VD jI.bmp"
	[0135.395] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\8NLq3VD jI.bmp", pszSpec="*.zip") returned 0
	[0135.395] lstrlenA (lpString="*.zip") returned 5
	[0135.395] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\8NLq3VD jI.bmp", pszSpec="*.rar") returned 0
	[0135.396] lstrlenA (lpString="*.rar") returned 5
	[0135.396] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\8NLq3VD jI.bmp", pszSpec="*.7z") returned 0
	[0135.396] lstrlenA (lpString="*.7z") returned 4
	[0135.396] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\8NLq3VD jI.bmp", pszSpec="*.tar") returned 0
	[0135.396] lstrlenA (lpString="*.tar") returned 5
	[0135.396] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\8NLq3VD jI.bmp", pszSpec="*.gzip") returned 0
	[0135.396] lstrlenA (lpString="*.gzip") returned 6
	[0135.396] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\8NLq3VD jI.bmp", pszSpec="*.jpg") returned 0
	[0135.396] lstrlenA (lpString="*.jpg") returned 5
	[0135.396] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\8NLq3VD jI.bmp", pszSpec="*.jpeg") returned 0
	[0135.396] lstrlenA (lpString="*.jpeg") returned 6
	[0135.396] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\8NLq3VD jI.bmp", pszSpec="*.bmp") returned 1
	[0135.396] lstrlenA (lpString="*.bmp") returned 5
	[0135.396] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Pictures\\8NLq3VD jI.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\8NLq3VD jI.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\8NLq3VD jI.bmp"
	[0135.396] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Pictures\\8NLq3VD jI.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\8NLq3VD jI.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\8NLq3VD jI.bmp"
	[0135.396] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\8NLq3VD jI.bmp", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\8NLq3VD jI.bmp.") returned="C:\\Users\\FD1HVy\\Pictures\\8NLq3VD jI.bmp."
	[0135.396] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\8NLq3VD jI.bmp.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\8NLq3VD jI.bmp.exe") returned="C:\\Users\\FD1HVy\\Pictures\\8NLq3VD jI.bmp.exe"
	[0135.396] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\8NLq3VD jI.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\8nlq3vd ji.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.396] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb134
	[0135.396] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa8198b60, dwHighDateTime=0x1d4cf1b), lpLastAccessTime=0x407536*(dwLowDateTime=0x9c3415a0, dwHighDateTime=0x1d4d4e7), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9c3415a0, dwHighDateTime=0x1d4d4e7)) returned 1
	[0135.396] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.396] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xb0f2, lpOverlapped=0x0) returned 1
	[0135.397] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\8NLq3VD jI.bmp") returned="8NLq3VD jI.bmp"
	[0135.398] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.398] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xb0f2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xb0f2, lpOverlapped=0x0) returned 1
	[0135.398] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.398] CloseHandle (hObject=0x20c) returned 1
	[0135.398] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\8NLq3VD jI.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\8nlq3vd ji.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\8NLq3VD jI.bmp.exe" (normalized: "c:\\users\\fd1hvy\\pictures\\8nlq3vd ji.bmp.exe")) returned 1
	[0135.400] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdb3b0d0, ftCreationTime.dwHighDateTime=0x1d4c863, ftLastAccessTime.dwLowDateTime=0x132a3d70, ftLastAccessTime.dwHighDateTime=0x1d4cf47, ftLastWriteTime.dwLowDateTime=0x132a3d70, ftLastWriteTime.dwHighDateTime=0x1d4cf47, nFileSizeHigh=0x0, nFileSizeLow=0x1674b, dwReserved0=0x12, dwReserved1=0x1, cFileName="8oHL_6.jpg", cAlternateFileName="")) returned 1
	[0135.400] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.400] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="8oHL_6.jpg") returned 1
	[0135.400] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="8oHL_6.jpg") returned 1
	[0135.400] lstrcmpiA (lpString1="", lpString2="8oHL_6.jpg") returned -1
	[0135.400] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\8NLq3VD jI.bmp") returned="8NLq3VD jI.bmp"
	[0135.400] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.400] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.400] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.400] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0x20
	[0135.400] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="8oHL_6.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\8oHL_6.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\8oHL_6.jpg"
	[0135.400] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\8oHL_6.jpg", pszSpec="*.zip") returned 0
	[0135.400] lstrlenA (lpString="*.zip") returned 5
	[0135.400] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\8oHL_6.jpg", pszSpec="*.rar") returned 0
	[0135.400] lstrlenA (lpString="*.rar") returned 5
	[0135.400] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\8oHL_6.jpg", pszSpec="*.7z") returned 0
	[0135.400] lstrlenA (lpString="*.7z") returned 4
	[0135.400] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\8oHL_6.jpg", pszSpec="*.tar") returned 0
	[0135.400] lstrlenA (lpString="*.tar") returned 5
	[0135.400] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\8oHL_6.jpg", pszSpec="*.gzip") returned 0
	[0135.400] lstrlenA (lpString="*.gzip") returned 6
	[0135.401] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\8oHL_6.jpg", pszSpec="*.jpg") returned 1
	[0135.401] lstrlenA (lpString="*.jpg") returned 5
	[0135.401] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Pictures\\8oHL_6.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\8oHL_6.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\8oHL_6.jpg"
	[0135.401] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Pictures\\8oHL_6.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\8oHL_6.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\8oHL_6.jpg"
	[0135.401] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\8oHL_6.jpg", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\8oHL_6.jpg.") returned="C:\\Users\\FD1HVy\\Pictures\\8oHL_6.jpg."
	[0135.401] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\8oHL_6.jpg.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\8oHL_6.jpg.exe") returned="C:\\Users\\FD1HVy\\Pictures\\8oHL_6.jpg.exe"
	[0135.401] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\8oHL_6.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\8ohl_6.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.401] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1674b
	[0135.401] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcdb3b0d0, dwHighDateTime=0x1d4c863), lpLastAccessTime=0x407536*(dwLowDateTime=0x132a3d70, dwHighDateTime=0x1d4cf47), lpLastWriteTime=0x40753e*(dwLowDateTime=0x132a3d70, dwHighDateTime=0x1d4cf47)) returned 1
	[0135.401] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.401] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x16709, lpOverlapped=0x0) returned 1
	[0135.402] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\8oHL_6.jpg") returned="8oHL_6.jpg"
	[0135.403] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.403] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x16709, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x16709, lpOverlapped=0x0) returned 1
	[0135.403] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.403] CloseHandle (hObject=0x20c) returned 1
	[0135.403] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\8oHL_6.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\8ohl_6.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\8oHL_6.jpg.exe" (normalized: "c:\\users\\fd1hvy\\pictures\\8ohl_6.jpg.exe")) returned 1
	[0135.404] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf06b58c0, ftCreationTime.dwHighDateTime=0x1d4cfee, ftLastAccessTime.dwLowDateTime=0xdf649ac0, ftLastAccessTime.dwHighDateTime=0x1d4d1c2, ftLastWriteTime.dwLowDateTime=0xdf649ac0, ftLastWriteTime.dwHighDateTime=0x1d4d1c2, nFileSizeHigh=0x0, nFileSizeLow=0x14e8c, dwReserved0=0x12, dwReserved1=0x1, cFileName="9w6LiECl.jpg", cAlternateFileName="")) returned 1
	[0135.404] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.404] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="9w6LiECl.jpg") returned 1
	[0135.404] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="9w6LiECl.jpg") returned 1
	[0135.404] lstrcmpiA (lpString1="", lpString2="9w6LiECl.jpg") returned -1
	[0135.404] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\8oHL_6.jpg") returned="8oHL_6.jpg"
	[0135.404] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.404] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.404] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.404] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0x20
	[0135.404] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="9w6LiECl.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\9w6LiECl.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\9w6LiECl.jpg"
	[0135.404] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\9w6LiECl.jpg", pszSpec="*.zip") returned 0
	[0135.404] lstrlenA (lpString="*.zip") returned 5
	[0135.404] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\9w6LiECl.jpg", pszSpec="*.rar") returned 0
	[0135.404] lstrlenA (lpString="*.rar") returned 5
	[0135.404] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\9w6LiECl.jpg", pszSpec="*.7z") returned 0
	[0135.404] lstrlenA (lpString="*.7z") returned 4
	[0135.404] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\9w6LiECl.jpg", pszSpec="*.tar") returned 0
	[0135.404] lstrlenA (lpString="*.tar") returned 5
	[0135.404] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\9w6LiECl.jpg", pszSpec="*.gzip") returned 0
	[0135.404] lstrlenA (lpString="*.gzip") returned 6
	[0135.404] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\9w6LiECl.jpg", pszSpec="*.jpg") returned 1
	[0135.404] lstrlenA (lpString="*.jpg") returned 5
	[0135.404] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Pictures\\9w6LiECl.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\9w6LiECl.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\9w6LiECl.jpg"
	[0135.404] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Pictures\\9w6LiECl.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\9w6LiECl.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\9w6LiECl.jpg"
	[0135.405] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\9w6LiECl.jpg", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\9w6LiECl.jpg.") returned="C:\\Users\\FD1HVy\\Pictures\\9w6LiECl.jpg."
	[0135.405] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\9w6LiECl.jpg.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\9w6LiECl.jpg.exe") returned="C:\\Users\\FD1HVy\\Pictures\\9w6LiECl.jpg.exe"
	[0135.405] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\9w6LiECl.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\9w6liecl.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.405] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14e8c
	[0135.405] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf06b58c0, dwHighDateTime=0x1d4cfee), lpLastAccessTime=0x407536*(dwLowDateTime=0xdf649ac0, dwHighDateTime=0x1d4d1c2), lpLastWriteTime=0x40753e*(dwLowDateTime=0xdf649ac0, dwHighDateTime=0x1d4d1c2)) returned 1
	[0135.405] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.405] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x14e4a, lpOverlapped=0x0) returned 1
	[0135.406] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\9w6LiECl.jpg") returned="9w6LiECl.jpg"
	[0135.406] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.406] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x14e4a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x14e4a, lpOverlapped=0x0) returned 1
	[0135.407] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.407] CloseHandle (hObject=0x20c) returned 1
	[0135.407] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\9w6LiECl.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\9w6liecl.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\9w6LiECl.jpg.exe" (normalized: "c:\\users\\fd1hvy\\pictures\\9w6liecl.jpg.exe")) returned 1
	[0135.408] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc8a9760, ftCreationTime.dwHighDateTime=0x1d4d41a, ftLastAccessTime.dwLowDateTime=0xcffed250, ftLastAccessTime.dwHighDateTime=0x1d4d4e5, ftLastWriteTime.dwLowDateTime=0xcffed250, ftLastWriteTime.dwHighDateTime=0x1d4d4e5, nFileSizeHigh=0x0, nFileSizeLow=0xf224, dwReserved0=0x12, dwReserved1=0x1, cFileName="AcMmOUQFXz5DQzxJ-oW.png", cAlternateFileName="ACMMOU~1.PNG")) returned 1
	[0135.408] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.408] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="AcMmOUQFXz5DQzxJ-oW.png") returned 1
	[0135.408] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="AcMmOUQFXz5DQzxJ-oW.png") returned 1
	[0135.408] lstrcmpiA (lpString1="", lpString2="AcMmOUQFXz5DQzxJ-oW.png") returned -1
	[0135.408] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\9w6LiECl.jpg") returned="9w6LiECl.jpg"
	[0135.408] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.408] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.408] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.408] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0x20
	[0135.408] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="AcMmOUQFXz5DQzxJ-oW.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\AcMmOUQFXz5DQzxJ-oW.png") returned="C:\\Users\\FD1HVy\\Pictures\\AcMmOUQFXz5DQzxJ-oW.png"
	[0135.408] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\AcMmOUQFXz5DQzxJ-oW.png", pszSpec="*.zip") returned 0
	[0135.408] lstrlenA (lpString="*.zip") returned 5
	[0135.408] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\AcMmOUQFXz5DQzxJ-oW.png", pszSpec="*.rar") returned 0
	[0135.408] lstrlenA (lpString="*.rar") returned 5
	[0135.408] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\AcMmOUQFXz5DQzxJ-oW.png", pszSpec="*.7z") returned 0
	[0135.408] lstrlenA (lpString="*.7z") returned 4
	[0135.408] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\AcMmOUQFXz5DQzxJ-oW.png", pszSpec="*.tar") returned 0
	[0135.408] lstrlenA (lpString="*.tar") returned 5
	[0135.408] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\AcMmOUQFXz5DQzxJ-oW.png", pszSpec="*.gzip") returned 0
	[0135.408] lstrlenA (lpString="*.gzip") returned 6
	[0135.408] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\AcMmOUQFXz5DQzxJ-oW.png", pszSpec="*.jpg") returned 0
	[0135.408] lstrlenA (lpString="*.jpg") returned 5
	[0135.408] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\AcMmOUQFXz5DQzxJ-oW.png", pszSpec="*.jpeg") returned 0
	[0135.408] lstrlenA (lpString="*.jpeg") returned 6
	[0135.408] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\AcMmOUQFXz5DQzxJ-oW.png", pszSpec="*.bmp") returned 0
	[0135.409] lstrlenA (lpString="*.bmp") returned 5
	[0135.409] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\AcMmOUQFXz5DQzxJ-oW.png", pszSpec="*.gif") returned 0
	[0135.409] lstrlenA (lpString="*.gif") returned 5
	[0135.409] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\AcMmOUQFXz5DQzxJ-oW.png", pszSpec="*.png") returned 1
	[0135.409] lstrlenA (lpString="*.png") returned 5
	[0135.409] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Pictures\\AcMmOUQFXz5DQzxJ-oW.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\AcMmOUQFXz5DQzxJ-oW.png") returned="C:\\Users\\FD1HVy\\Pictures\\AcMmOUQFXz5DQzxJ-oW.png"
	[0135.409] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Pictures\\AcMmOUQFXz5DQzxJ-oW.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\AcMmOUQFXz5DQzxJ-oW.png") returned="C:\\Users\\FD1HVy\\Pictures\\AcMmOUQFXz5DQzxJ-oW.png"
	[0135.409] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\AcMmOUQFXz5DQzxJ-oW.png", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\AcMmOUQFXz5DQzxJ-oW.png.") returned="C:\\Users\\FD1HVy\\Pictures\\AcMmOUQFXz5DQzxJ-oW.png."
	[0135.409] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\AcMmOUQFXz5DQzxJ-oW.png.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\AcMmOUQFXz5DQzxJ-oW.png.exe") returned="C:\\Users\\FD1HVy\\Pictures\\AcMmOUQFXz5DQzxJ-oW.png.exe"
	[0135.409] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\AcMmOUQFXz5DQzxJ-oW.png" (normalized: "c:\\users\\fd1hvy\\pictures\\acmmouqfxz5dqzxj-ow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.409] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf224
	[0135.409] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcc8a9760, dwHighDateTime=0x1d4d41a), lpLastAccessTime=0x407536*(dwLowDateTime=0xcffed250, dwHighDateTime=0x1d4d4e5), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcffed250, dwHighDateTime=0x1d4d4e5)) returned 1
	[0135.409] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.409] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xf1e2, lpOverlapped=0x0) returned 1
	[0135.410] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\AcMmOUQFXz5DQzxJ-oW.png") returned="AcMmOUQFXz5DQzxJ-oW.png"
	[0135.410] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.411] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xf1e2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xf1e2, lpOverlapped=0x0) returned 1
	[0135.411] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.411] CloseHandle (hObject=0x20c) returned 1
	[0135.411] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\AcMmOUQFXz5DQzxJ-oW.png" (normalized: "c:\\users\\fd1hvy\\pictures\\acmmouqfxz5dqzxj-ow.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\AcMmOUQFXz5DQzxJ-oW.png.exe" (normalized: "c:\\users\\fd1hvy\\pictures\\acmmouqfxz5dqzxj-ow.png.exe")) returned 1
	[0135.411] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4da358e0, ftCreationTime.dwHighDateTime=0x1d4c7f6, ftLastAccessTime.dwLowDateTime=0x155b11c0, ftLastAccessTime.dwHighDateTime=0x1d4c6e4, ftLastWriteTime.dwLowDateTime=0x155b11c0, ftLastWriteTime.dwHighDateTime=0x1d4c6e4, nFileSizeHigh=0x0, nFileSizeLow=0x12f7a, dwReserved0=0x0, dwReserved1=0x1, cFileName="ArjxZ57zscF_H.gif", cAlternateFileName="ARJXZ5~1.GIF")) returned 1
	[0135.412] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.412] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="ArjxZ57zscF_H.gif") returned 1
	[0135.412] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="ArjxZ57zscF_H.gif") returned 1
	[0135.412] lstrcmpiA (lpString1="", lpString2="ArjxZ57zscF_H.gif") returned -1
	[0135.412] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\AcMmOUQFXz5DQzxJ-oW.png") returned="AcMmOUQFXz5DQzxJ-oW.png"
	[0135.412] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.412] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.412] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.412] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0x20
	[0135.412] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="ArjxZ57zscF_H.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\ArjxZ57zscF_H.gif") returned="C:\\Users\\FD1HVy\\Pictures\\ArjxZ57zscF_H.gif"
	[0135.412] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\ArjxZ57zscF_H.gif", pszSpec="*.zip") returned 0
	[0135.412] lstrlenA (lpString="*.zip") returned 5
	[0135.412] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\ArjxZ57zscF_H.gif", pszSpec="*.rar") returned 0
	[0135.412] lstrlenA (lpString="*.rar") returned 5
	[0135.412] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\ArjxZ57zscF_H.gif", pszSpec="*.7z") returned 0
	[0135.412] lstrlenA (lpString="*.7z") returned 4
	[0135.412] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\ArjxZ57zscF_H.gif", pszSpec="*.tar") returned 0
	[0135.412] lstrlenA (lpString="*.tar") returned 5
	[0135.412] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\ArjxZ57zscF_H.gif", pszSpec="*.gzip") returned 0
	[0135.412] lstrlenA (lpString="*.gzip") returned 6
	[0135.412] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\ArjxZ57zscF_H.gif", pszSpec="*.jpg") returned 0
	[0135.412] lstrlenA (lpString="*.jpg") returned 5
	[0135.412] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\ArjxZ57zscF_H.gif", pszSpec="*.jpeg") returned 0
	[0135.412] lstrlenA (lpString="*.jpeg") returned 6
	[0135.412] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\ArjxZ57zscF_H.gif", pszSpec="*.bmp") returned 0
	[0135.412] lstrlenA (lpString="*.bmp") returned 5
	[0135.412] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\ArjxZ57zscF_H.gif", pszSpec="*.gif") returned 1
	[0135.412] lstrlenA (lpString="*.gif") returned 5
	[0135.412] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Pictures\\ArjxZ57zscF_H.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\ArjxZ57zscF_H.gif") returned="C:\\Users\\FD1HVy\\Pictures\\ArjxZ57zscF_H.gif"
	[0135.412] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Pictures\\ArjxZ57zscF_H.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\ArjxZ57zscF_H.gif") returned="C:\\Users\\FD1HVy\\Pictures\\ArjxZ57zscF_H.gif"
	[0135.412] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\ArjxZ57zscF_H.gif", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\ArjxZ57zscF_H.gif.") returned="C:\\Users\\FD1HVy\\Pictures\\ArjxZ57zscF_H.gif."
	[0135.413] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\ArjxZ57zscF_H.gif.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\ArjxZ57zscF_H.gif.exe") returned="C:\\Users\\FD1HVy\\Pictures\\ArjxZ57zscF_H.gif.exe"
	[0135.413] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ArjxZ57zscF_H.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\arjxz57zscf_h.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.413] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12f7a
	[0135.413] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4da358e0, dwHighDateTime=0x1d4c7f6), lpLastAccessTime=0x407536*(dwLowDateTime=0x155b11c0, dwHighDateTime=0x1d4c6e4), lpLastWriteTime=0x40753e*(dwLowDateTime=0x155b11c0, dwHighDateTime=0x1d4c6e4)) returned 1
	[0135.413] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.413] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x12f38, lpOverlapped=0x0) returned 1
	[0135.414] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\ArjxZ57zscF_H.gif") returned="ArjxZ57zscF_H.gif"
	[0135.415] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.415] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x12f38, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x12f38, lpOverlapped=0x0) returned 1
	[0135.415] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.415] CloseHandle (hObject=0x20c) returned 1
	[0135.415] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\ArjxZ57zscF_H.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\arjxz57zscf_h.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\ArjxZ57zscF_H.gif.exe" (normalized: "c:\\users\\fd1hvy\\pictures\\arjxz57zscf_h.gif.exe")) returned 1
	[0135.416] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb70af530, ftCreationTime.dwHighDateTime=0x1d4ca9a, ftLastAccessTime.dwLowDateTime=0x2c28ff50, ftLastAccessTime.dwHighDateTime=0x1d4d519, ftLastWriteTime.dwLowDateTime=0x2c28ff50, ftLastWriteTime.dwHighDateTime=0x1d4d519, nFileSizeHigh=0x0, nFileSizeLow=0xb6a7, dwReserved0=0x15, dwReserved1=0x1, cFileName="BTlOyYlra5k.gif", cAlternateFileName="BTLOYY~1.GIF")) returned 1
	[0135.416] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.416] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="BTlOyYlra5k.gif") returned 1
	[0135.416] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="BTlOyYlra5k.gif") returned 1
	[0135.416] lstrcmpiA (lpString1="", lpString2="BTlOyYlra5k.gif") returned -1
	[0135.416] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\ArjxZ57zscF_H.gif") returned="ArjxZ57zscF_H.gif"
	[0135.416] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.416] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.416] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.416] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0x20
	[0135.416] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="BTlOyYlra5k.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\BTlOyYlra5k.gif") returned="C:\\Users\\FD1HVy\\Pictures\\BTlOyYlra5k.gif"
	[0135.416] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\BTlOyYlra5k.gif", pszSpec="*.zip") returned 0
	[0135.416] lstrlenA (lpString="*.zip") returned 5
	[0135.416] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\BTlOyYlra5k.gif", pszSpec="*.rar") returned 0
	[0135.416] lstrlenA (lpString="*.rar") returned 5
	[0135.416] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\BTlOyYlra5k.gif", pszSpec="*.7z") returned 0
	[0135.416] lstrlenA (lpString="*.7z") returned 4
	[0135.416] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\BTlOyYlra5k.gif", pszSpec="*.tar") returned 0
	[0135.416] lstrlenA (lpString="*.tar") returned 5
	[0135.416] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\BTlOyYlra5k.gif", pszSpec="*.gzip") returned 0
	[0135.416] lstrlenA (lpString="*.gzip") returned 6
	[0135.416] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\BTlOyYlra5k.gif", pszSpec="*.jpg") returned 0
	[0135.416] lstrlenA (lpString="*.jpg") returned 5
	[0135.416] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\BTlOyYlra5k.gif", pszSpec="*.jpeg") returned 0
	[0135.416] lstrlenA (lpString="*.jpeg") returned 6
	[0135.416] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\BTlOyYlra5k.gif", pszSpec="*.bmp") returned 0
	[0135.416] lstrlenA (lpString="*.bmp") returned 5
	[0135.416] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\BTlOyYlra5k.gif", pszSpec="*.gif") returned 1
	[0135.417] lstrlenA (lpString="*.gif") returned 5
	[0135.417] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Pictures\\BTlOyYlra5k.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\BTlOyYlra5k.gif") returned="C:\\Users\\FD1HVy\\Pictures\\BTlOyYlra5k.gif"
	[0135.417] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Pictures\\BTlOyYlra5k.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\BTlOyYlra5k.gif") returned="C:\\Users\\FD1HVy\\Pictures\\BTlOyYlra5k.gif"
	[0135.417] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\BTlOyYlra5k.gif", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\BTlOyYlra5k.gif.") returned="C:\\Users\\FD1HVy\\Pictures\\BTlOyYlra5k.gif."
	[0135.417] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\BTlOyYlra5k.gif.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\BTlOyYlra5k.gif.exe") returned="C:\\Users\\FD1HVy\\Pictures\\BTlOyYlra5k.gif.exe"
	[0135.417] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\BTlOyYlra5k.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\btloyylra5k.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.417] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb6a7
	[0135.417] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb70af530, dwHighDateTime=0x1d4ca9a), lpLastAccessTime=0x407536*(dwLowDateTime=0x2c28ff50, dwHighDateTime=0x1d4d519), lpLastWriteTime=0x40753e*(dwLowDateTime=0x2c28ff50, dwHighDateTime=0x1d4d519)) returned 1
	[0135.417] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.417] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xb665, lpOverlapped=0x0) returned 1
	[0135.418] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\BTlOyYlra5k.gif") returned="BTlOyYlra5k.gif"
	[0135.418] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.418] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xb665, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xb665, lpOverlapped=0x0) returned 1
	[0135.418] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.419] CloseHandle (hObject=0x20c) returned 1
	[0135.419] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\BTlOyYlra5k.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\btloyylra5k.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\BTlOyYlra5k.gif.exe" (normalized: "c:\\users\\fd1hvy\\pictures\\btloyylra5k.gif.exe")) returned 1
	[0135.419] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x1, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1
	[0135.419] lstrcmpA (lpString1=".", lpString2="Camera Roll") returned -1
	[0135.419] lstrcmpA (lpString1="..", lpString2="Camera Roll") returned -1
	[0135.419] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\BTlOyYlra5k.gif") returned="BTlOyYlra5k.gif"
	[0135.419] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Camera Roll" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll"
	[0135.419] lstrlenA (lpString="C:\\Users\\FD1HVy\\Pictures\\Camera Roll") returned 36
	[0135.419] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName=".", cAlternateFileName="")) returned 0x7cbbd0
	[0135.420] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0135.420] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="..", cAlternateFileName="")) returned 1
	[0135.420] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0135.420] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0135.420] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0135.420] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0135.420] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="desktop.ini") returned 1
	[0135.420] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="desktop.ini") returned 1
	[0135.420] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1
	[0135.420] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*.*") returned="*.*"
	[0135.420] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\"
	[0135.420] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\") returned=""
	[0135.420] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.420] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0135.420] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0135.421] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0135.421] WriteFile (in: hFile=0x210, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0135.422] SetFileTime (hFile=0x210, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0135.422] CloseHandle (hObject=0x210) returned 1
	[0135.422] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini"
	[0135.422] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.zip") returned 0
	[0135.422] lstrlenA (lpString="*.zip") returned 5
	[0135.422] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.rar") returned 0
	[0135.422] lstrlenA (lpString="*.rar") returned 5
	[0135.422] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.7z") returned 0
	[0135.422] lstrlenA (lpString="*.7z") returned 4
	[0135.422] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.tar") returned 0
	[0135.422] lstrlenA (lpString="*.tar") returned 5
	[0135.422] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.gzip") returned 0
	[0135.422] lstrlenA (lpString="*.gzip") returned 6
	[0135.422] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.jpg") returned 0
	[0135.422] lstrlenA (lpString="*.jpg") returned 5
	[0135.423] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.jpeg") returned 0
	[0135.423] lstrlenA (lpString="*.jpeg") returned 6
	[0135.423] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.bmp") returned 0
	[0135.423] lstrlenA (lpString="*.bmp") returned 5
	[0135.423] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.gif") returned 0
	[0135.423] lstrlenA (lpString="*.gif") returned 5
	[0135.423] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.png") returned 0
	[0135.423] lstrlenA (lpString="*.png") returned 5
	[0135.423] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.doc") returned 0
	[0135.423] lstrlenA (lpString="*.doc") returned 5
	[0135.423] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.docx") returned 0
	[0135.423] lstrlenA (lpString="*.docx") returned 6
	[0135.423] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.xls") returned 0
	[0135.423] lstrlenA (lpString="*.xls") returned 5
	[0135.423] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.xlsx") returned 0
	[0135.423] lstrlenA (lpString="*.xlsx") returned 6
	[0135.423] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.ppt") returned 0
	[0135.423] lstrlenA (lpString="*.ppt") returned 5
	[0135.423] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.pptx") returned 0
	[0135.423] lstrlenA (lpString="*.pptx") returned 6
	[0135.423] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.txt") returned 0
	[0135.423] lstrlenA (lpString="*.txt") returned 5
	[0135.423] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.pdf") returned 0
	[0135.423] lstrlenA (lpString="*.pdf") returned 5
	[0135.423] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.htm") returned 0
	[0135.423] lstrlenA (lpString="*.htm") returned 5
	[0135.423] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.html") returned 0
	[0135.423] lstrlenA (lpString="*.html") returned 6
	[0135.423] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.mdb") returned 0
	[0135.423] lstrlenA (lpString="*.mdb") returned 5
	[0135.423] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.pfx") returned 0
	[0135.423] lstrlenA (lpString="*.pfx") returned 5
	[0135.423] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.md") returned 0
	[0135.423] lstrlenA (lpString="*.md") returned 4
	[0135.424] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.lnk") returned 0
	[0135.424] lstrlenA (lpString="*.lnk") returned 5
	[0135.424] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.torrent") returned 0
	[0135.424] lstrlenA (lpString="*.torrent") returned 9
	[0135.424] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.mov") returned 0
	[0135.424] lstrlenA (lpString="*.mov") returned 5
	[0135.424] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.3gp") returned 0
	[0135.424] lstrlenA (lpString="*.3gp") returned 5
	[0135.424] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.mpeg") returned 0
	[0135.424] lstrlenA (lpString="*.mpeg") returned 6
	[0135.424] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.mpg") returned 0
	[0135.424] lstrlenA (lpString="*.mpg") returned 5
	[0135.424] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.flv") returned 0
	[0135.424] lstrlenA (lpString="*.flv") returned 5
	[0135.424] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.avi") returned 0
	[0135.424] lstrlenA (lpString="*.avi") returned 5
	[0135.424] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.mp4") returned 0
	[0135.424] lstrlenA (lpString="*.mp4") returned 5
	[0135.424] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.wmv") returned 0
	[0135.424] lstrlenA (lpString="*.wmv") returned 5
	[0135.424] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.mkv") returned 0
	[0135.424] lstrlenA (lpString="*.mkv") returned 5
	[0135.424] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.mp3") returned 0
	[0135.424] lstrlenA (lpString="*.mp3") returned 5
	[0135.424] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.wav") returned 0
	[0135.424] lstrlenA (lpString="*.wav") returned 5
	[0135.424] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.flac") returned 0
	[0135.424] lstrlenA (lpString="*.flac") returned 6
	[0135.424] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.wma") returned 0
	[0135.424] lstrlenA (lpString="*.wma") returned 5
	[0135.424] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.au3") returned 0
	[0135.424] lstrlenA (lpString="*.au3") returned 5
	[0135.424] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.ahk") returned 0
	[0135.424] lstrlenA (lpString="*.ahk") returned 5
	[0135.424] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.c") returned 0
	[0135.425] lstrlenA (lpString="*.c") returned 3
	[0135.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.cc") returned 0
	[0135.425] lstrlenA (lpString="*.cc") returned 4
	[0135.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.cpp") returned 0
	[0135.425] lstrlenA (lpString="*.cpp") returned 5
	[0135.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.cxx") returned 0
	[0135.425] lstrlenA (lpString="*.cxx") returned 5
	[0135.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.c++") returned 0
	[0135.425] lstrlenA (lpString="*.c++") returned 5
	[0135.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.cs") returned 0
	[0135.425] lstrlenA (lpString="*.cs") returned 4
	[0135.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.vb") returned 0
	[0135.425] lstrlenA (lpString="*.vb") returned 4
	[0135.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.bas") returned 0
	[0135.425] lstrlenA (lpString="*.bas") returned 5
	[0135.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.csproj") returned 0
	[0135.425] lstrlenA (lpString="*.csproj") returned 8
	[0135.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.vbproj") returned 0
	[0135.425] lstrlenA (lpString="*.vbproj") returned 8
	[0135.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.vcxproj") returned 0
	[0135.425] lstrlenA (lpString="*.vcxproj") returned 9
	[0135.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.manifest") returned 0
	[0135.425] lstrlenA (lpString="*.manifest") returned 10
	[0135.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.php") returned 0
	[0135.425] lstrlenA (lpString="*.php") returned 5
	[0135.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.vbe") returned 0
	[0135.425] lstrlenA (lpString="*.vbe") returned 5
	[0135.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.vba") returned 0
	[0135.425] lstrlenA (lpString="*.vba") returned 5
	[0135.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.vbs") returned 0
	[0135.425] lstrlenA (lpString="*.vbs") returned 5
	[0135.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.bat") returned 0
	[0135.425] lstrlenA (lpString="*.bat") returned 5
	[0135.425] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.cmd") returned 0
	[0135.425] lstrlenA (lpString="*.cmd") returned 5
	[0135.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.js") returned 0
	[0135.426] lstrlenA (lpString="*.js") returned 4
	[0135.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.jscript") returned 0
	[0135.426] lstrlenA (lpString="*.jscript") returned 9
	[0135.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.hta") returned 0
	[0135.426] lstrlenA (lpString="*.hta") returned 5
	[0135.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.php7") returned 0
	[0135.426] lstrlenA (lpString="*.php7") returned 6
	[0135.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.db") returned 0
	[0135.426] lstrlenA (lpString="*.db") returned 4
	[0135.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.swf") returned 0
	[0135.426] lstrlenA (lpString="*.swf") returned 5
	[0135.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.eml") returned 0
	[0135.426] lstrlenA (lpString="*.eml") returned 5
	[0135.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.part") returned 0
	[0135.426] lstrlenA (lpString="*.part") returned 6
	[0135.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.nfo") returned 0
	[0135.426] lstrlenA (lpString="*.nfo") returned 5
	[0135.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.rsa") returned 0
	[0135.426] lstrlenA (lpString="*.rsa") returned 5
	[0135.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.key") returned 0
	[0135.426] lstrlenA (lpString="*.key") returned 5
	[0135.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.aes") returned 0
	[0135.426] lstrlenA (lpString="*.aes") returned 5
	[0135.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.blob") returned 0
	[0135.426] lstrlenA (lpString="*.blob") returned 6
	[0135.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.btc") returned 0
	[0135.426] lstrlenA (lpString="*.btc") returned 5
	[0135.426] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", pszSpec="*.wallet") returned 0
	[0135.426] lstrlenA (lpString="*.wallet") returned 8
	[0135.426] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0135.426] FindClose (in: hFindFile=0x7cbbd0 | out: hFindFile=0x7cbbd0) returned 1
	[0135.427] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99583be0, ftCreationTime.dwHighDateTime=0x1d4c920, ftLastAccessTime.dwLowDateTime=0x5e7600, ftLastAccessTime.dwHighDateTime=0x1d4c84b, ftLastWriteTime.dwLowDateTime=0x5e7600, ftLastWriteTime.dwHighDateTime=0x1d4c84b, nFileSizeHigh=0x0, nFileSizeLow=0x9140, dwReserved0=0x0, dwReserved1=0x0, cFileName="cjBo_h2RVabEoI9X_y4R.gif", cAlternateFileName="CJBO_H~1.GIF")) returned 1
	[0135.427] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.427] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="cjBo_h2RVabEoI9X_y4R.gif") returned 1
	[0135.427] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="cjBo_h2RVabEoI9X_y4R.gif") returned 1
	[0135.427] lstrcmpiA (lpString1="", lpString2="cjBo_h2RVabEoI9X_y4R.gif") returned -1
	[0135.427] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\*.*") returned="*.*"
	[0135.427] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.427] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.427] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.427] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0x20
	[0135.427] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="cjBo_h2RVabEoI9X_y4R.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\cjBo_h2RVabEoI9X_y4R.gif") returned="C:\\Users\\FD1HVy\\Pictures\\cjBo_h2RVabEoI9X_y4R.gif"
	[0135.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\cjBo_h2RVabEoI9X_y4R.gif", pszSpec="*.zip") returned 0
	[0135.427] lstrlenA (lpString="*.zip") returned 5
	[0135.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\cjBo_h2RVabEoI9X_y4R.gif", pszSpec="*.rar") returned 0
	[0135.427] lstrlenA (lpString="*.rar") returned 5
	[0135.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\cjBo_h2RVabEoI9X_y4R.gif", pszSpec="*.7z") returned 0
	[0135.427] lstrlenA (lpString="*.7z") returned 4
	[0135.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\cjBo_h2RVabEoI9X_y4R.gif", pszSpec="*.tar") returned 0
	[0135.427] lstrlenA (lpString="*.tar") returned 5
	[0135.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\cjBo_h2RVabEoI9X_y4R.gif", pszSpec="*.gzip") returned 0
	[0135.427] lstrlenA (lpString="*.gzip") returned 6
	[0135.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\cjBo_h2RVabEoI9X_y4R.gif", pszSpec="*.jpg") returned 0
	[0135.427] lstrlenA (lpString="*.jpg") returned 5
	[0135.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\cjBo_h2RVabEoI9X_y4R.gif", pszSpec="*.jpeg") returned 0
	[0135.427] lstrlenA (lpString="*.jpeg") returned 6
	[0135.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\cjBo_h2RVabEoI9X_y4R.gif", pszSpec="*.bmp") returned 0
	[0135.427] lstrlenA (lpString="*.bmp") returned 5
	[0135.427] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\cjBo_h2RVabEoI9X_y4R.gif", pszSpec="*.gif") returned 1
	[0135.427] lstrlenA (lpString="*.gif") returned 5
	[0135.427] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Pictures\\cjBo_h2RVabEoI9X_y4R.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\cjBo_h2RVabEoI9X_y4R.gif") returned="C:\\Users\\FD1HVy\\Pictures\\cjBo_h2RVabEoI9X_y4R.gif"
	[0135.427] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Pictures\\cjBo_h2RVabEoI9X_y4R.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\cjBo_h2RVabEoI9X_y4R.gif") returned="C:\\Users\\FD1HVy\\Pictures\\cjBo_h2RVabEoI9X_y4R.gif"
	[0135.428] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\cjBo_h2RVabEoI9X_y4R.gif", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\cjBo_h2RVabEoI9X_y4R.gif.") returned="C:\\Users\\FD1HVy\\Pictures\\cjBo_h2RVabEoI9X_y4R.gif."
	[0135.428] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\cjBo_h2RVabEoI9X_y4R.gif.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\cjBo_h2RVabEoI9X_y4R.gif.exe") returned="C:\\Users\\FD1HVy\\Pictures\\cjBo_h2RVabEoI9X_y4R.gif.exe"
	[0135.428] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\cjBo_h2RVabEoI9X_y4R.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\cjbo_h2rvabeoi9x_y4r.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.428] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9140
	[0135.428] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x99583be0, dwHighDateTime=0x1d4c920), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e7600, dwHighDateTime=0x1d4c84b), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5e7600, dwHighDateTime=0x1d4c84b)) returned 1
	[0135.428] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.428] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x90fe, lpOverlapped=0x0) returned 1
	[0135.429] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\cjBo_h2RVabEoI9X_y4R.gif") returned="cjBo_h2RVabEoI9X_y4R.gif"
	[0135.429] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.429] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x90fe, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x90fe, lpOverlapped=0x0) returned 1
	[0135.430] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.430] CloseHandle (hObject=0x20c) returned 1
	[0135.430] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\cjBo_h2RVabEoI9X_y4R.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\cjbo_h2rvabeoi9x_y4r.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\cjBo_h2RVabEoI9X_y4R.gif.exe" (normalized: "c:\\users\\fd1hvy\\pictures\\cjbo_h2rvabeoi9x_y4r.gif.exe")) returned 1
	[0135.430] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30338db0, ftCreationTime.dwHighDateTime=0x1d4d23d, ftLastAccessTime.dwLowDateTime=0x85d6b320, ftLastAccessTime.dwHighDateTime=0x1d4caa2, ftLastWriteTime.dwLowDateTime=0x85d6b320, ftLastWriteTime.dwHighDateTime=0x1d4caa2, nFileSizeHigh=0x0, nFileSizeLow=0x71de, dwReserved0=0x1f, dwReserved1=0x1, cFileName="cOFMPoe6EpAuu.jpg", cAlternateFileName="COFMPO~1.JPG")) returned 1
	[0135.430] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.431] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="cOFMPoe6EpAuu.jpg") returned 1
	[0135.431] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="cOFMPoe6EpAuu.jpg") returned 1
	[0135.431] lstrcmpiA (lpString1="", lpString2="cOFMPoe6EpAuu.jpg") returned -1
	[0135.431] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\cjBo_h2RVabEoI9X_y4R.gif") returned="cjBo_h2RVabEoI9X_y4R.gif"
	[0135.431] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.431] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.431] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.431] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0x20
	[0135.431] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="cOFMPoe6EpAuu.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\cOFMPoe6EpAuu.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\cOFMPoe6EpAuu.jpg"
	[0135.431] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\cOFMPoe6EpAuu.jpg", pszSpec="*.zip") returned 0
	[0135.431] lstrlenA (lpString="*.zip") returned 5
	[0135.431] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\cOFMPoe6EpAuu.jpg", pszSpec="*.rar") returned 0
	[0135.431] lstrlenA (lpString="*.rar") returned 5
	[0135.431] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\cOFMPoe6EpAuu.jpg", pszSpec="*.7z") returned 0
	[0135.431] lstrlenA (lpString="*.7z") returned 4
	[0135.431] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\cOFMPoe6EpAuu.jpg", pszSpec="*.tar") returned 0
	[0135.431] lstrlenA (lpString="*.tar") returned 5
	[0135.431] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\cOFMPoe6EpAuu.jpg", pszSpec="*.gzip") returned 0
	[0135.431] lstrlenA (lpString="*.gzip") returned 6
	[0135.431] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\cOFMPoe6EpAuu.jpg", pszSpec="*.jpg") returned 1
	[0135.431] lstrlenA (lpString="*.jpg") returned 5
	[0135.431] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Pictures\\cOFMPoe6EpAuu.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\cOFMPoe6EpAuu.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\cOFMPoe6EpAuu.jpg"
	[0135.431] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Pictures\\cOFMPoe6EpAuu.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\cOFMPoe6EpAuu.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\cOFMPoe6EpAuu.jpg"
	[0135.431] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\cOFMPoe6EpAuu.jpg", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\cOFMPoe6EpAuu.jpg.") returned="C:\\Users\\FD1HVy\\Pictures\\cOFMPoe6EpAuu.jpg."
	[0135.431] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\cOFMPoe6EpAuu.jpg.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\cOFMPoe6EpAuu.jpg.exe") returned="C:\\Users\\FD1HVy\\Pictures\\cOFMPoe6EpAuu.jpg.exe"
	[0135.431] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\cOFMPoe6EpAuu.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\cofmpoe6epauu.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.432] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x71de
	[0135.432] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x30338db0, dwHighDateTime=0x1d4d23d), lpLastAccessTime=0x407536*(dwLowDateTime=0x85d6b320, dwHighDateTime=0x1d4caa2), lpLastWriteTime=0x40753e*(dwLowDateTime=0x85d6b320, dwHighDateTime=0x1d4caa2)) returned 1
	[0135.432] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.432] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x719c, lpOverlapped=0x0) returned 1
	[0135.433] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\cOFMPoe6EpAuu.jpg") returned="cOFMPoe6EpAuu.jpg"
	[0135.433] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.433] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x719c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x719c, lpOverlapped=0x0) returned 1
	[0135.433] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.433] CloseHandle (hObject=0x20c) returned 1
	[0135.433] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\cOFMPoe6EpAuu.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\cofmpoe6epauu.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\cOFMPoe6EpAuu.jpg.exe" (normalized: "c:\\users\\fd1hvy\\pictures\\cofmpoe6epauu.jpg.exe")) returned 1
	[0135.434] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2228520, ftCreationTime.dwHighDateTime=0x1d4c965, ftLastAccessTime.dwLowDateTime=0xa98c2b90, ftLastAccessTime.dwHighDateTime=0x1d4caa4, ftLastWriteTime.dwLowDateTime=0xa98c2b90, ftLastWriteTime.dwHighDateTime=0x1d4caa4, nFileSizeHigh=0x0, nFileSizeLow=0xd702, dwReserved0=0x15, dwReserved1=0x1, cFileName="Dcy2YdaL.jpg", cAlternateFileName="")) returned 1
	[0135.434] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.434] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Dcy2YdaL.jpg") returned 1
	[0135.434] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Dcy2YdaL.jpg") returned 1
	[0135.434] lstrcmpiA (lpString1="", lpString2="Dcy2YdaL.jpg") returned -1
	[0135.434] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\cOFMPoe6EpAuu.jpg") returned="cOFMPoe6EpAuu.jpg"
	[0135.434] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.434] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.434] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.434] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0x20
	[0135.434] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Dcy2YdaL.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Dcy2YdaL.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\Dcy2YdaL.jpg"
	[0135.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Dcy2YdaL.jpg", pszSpec="*.zip") returned 0
	[0135.434] lstrlenA (lpString="*.zip") returned 5
	[0135.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Dcy2YdaL.jpg", pszSpec="*.rar") returned 0
	[0135.434] lstrlenA (lpString="*.rar") returned 5
	[0135.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Dcy2YdaL.jpg", pszSpec="*.7z") returned 0
	[0135.434] lstrlenA (lpString="*.7z") returned 4
	[0135.434] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Dcy2YdaL.jpg", pszSpec="*.tar") returned 0
	[0135.434] lstrlenA (lpString="*.tar") returned 5
	[0135.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Dcy2YdaL.jpg", pszSpec="*.gzip") returned 0
	[0135.435] lstrlenA (lpString="*.gzip") returned 6
	[0135.435] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Dcy2YdaL.jpg", pszSpec="*.jpg") returned 1
	[0135.435] lstrlenA (lpString="*.jpg") returned 5
	[0135.435] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Pictures\\Dcy2YdaL.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Dcy2YdaL.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\Dcy2YdaL.jpg"
	[0135.435] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Pictures\\Dcy2YdaL.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Dcy2YdaL.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\Dcy2YdaL.jpg"
	[0135.435] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Dcy2YdaL.jpg", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Dcy2YdaL.jpg.") returned="C:\\Users\\FD1HVy\\Pictures\\Dcy2YdaL.jpg."
	[0135.435] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Dcy2YdaL.jpg.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Dcy2YdaL.jpg.exe") returned="C:\\Users\\FD1HVy\\Pictures\\Dcy2YdaL.jpg.exe"
	[0135.435] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Dcy2YdaL.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\dcy2ydal.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.435] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd702
	[0135.435] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe2228520, dwHighDateTime=0x1d4c965), lpLastAccessTime=0x407536*(dwLowDateTime=0xa98c2b90, dwHighDateTime=0x1d4caa4), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa98c2b90, dwHighDateTime=0x1d4caa4)) returned 1
	[0135.435] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.435] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xd6c0, lpOverlapped=0x0) returned 1
	[0135.436] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\Dcy2YdaL.jpg") returned="Dcy2YdaL.jpg"
	[0135.436] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.436] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xd6c0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xd6c0, lpOverlapped=0x0) returned 1
	[0135.437] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.437] CloseHandle (hObject=0x20c) returned 1
	[0135.437] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Dcy2YdaL.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\dcy2ydal.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Dcy2YdaL.jpg.exe" (normalized: "c:\\users\\fd1hvy\\pictures\\dcy2ydal.jpg.exe")) returned 1
	[0135.438] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44053085, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44053085, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x12, dwReserved1=0x1, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0135.438] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.438] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="desktop.ini") returned 1
	[0135.438] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="desktop.ini") returned 1
	[0135.438] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1
	[0135.438] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\Dcy2YdaL.jpg") returned="Dcy2YdaL.jpg"
	[0135.438] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.438] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.438] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.438] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0x20
	[0135.438] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\desktop.ini") returned="C:\\Users\\FD1HVy\\Pictures\\desktop.ini"
	[0135.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.zip") returned 0
	[0135.438] lstrlenA (lpString="*.zip") returned 5
	[0135.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.rar") returned 0
	[0135.438] lstrlenA (lpString="*.rar") returned 5
	[0135.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.7z") returned 0
	[0135.438] lstrlenA (lpString="*.7z") returned 4
	[0135.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.tar") returned 0
	[0135.438] lstrlenA (lpString="*.tar") returned 5
	[0135.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.gzip") returned 0
	[0135.438] lstrlenA (lpString="*.gzip") returned 6
	[0135.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.jpg") returned 0
	[0135.438] lstrlenA (lpString="*.jpg") returned 5
	[0135.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.jpeg") returned 0
	[0135.438] lstrlenA (lpString="*.jpeg") returned 6
	[0135.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.bmp") returned 0
	[0135.438] lstrlenA (lpString="*.bmp") returned 5
	[0135.438] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.gif") returned 0
	[0135.438] lstrlenA (lpString="*.gif") returned 5
	[0135.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.png") returned 0
	[0135.439] lstrlenA (lpString="*.png") returned 5
	[0135.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.doc") returned 0
	[0135.439] lstrlenA (lpString="*.doc") returned 5
	[0135.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.docx") returned 0
	[0135.439] lstrlenA (lpString="*.docx") returned 6
	[0135.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.xls") returned 0
	[0135.439] lstrlenA (lpString="*.xls") returned 5
	[0135.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.xlsx") returned 0
	[0135.439] lstrlenA (lpString="*.xlsx") returned 6
	[0135.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.ppt") returned 0
	[0135.439] lstrlenA (lpString="*.ppt") returned 5
	[0135.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.pptx") returned 0
	[0135.439] lstrlenA (lpString="*.pptx") returned 6
	[0135.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.txt") returned 0
	[0135.439] lstrlenA (lpString="*.txt") returned 5
	[0135.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.pdf") returned 0
	[0135.439] lstrlenA (lpString="*.pdf") returned 5
	[0135.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.htm") returned 0
	[0135.439] lstrlenA (lpString="*.htm") returned 5
	[0135.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.html") returned 0
	[0135.439] lstrlenA (lpString="*.html") returned 6
	[0135.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.mdb") returned 0
	[0135.439] lstrlenA (lpString="*.mdb") returned 5
	[0135.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.pfx") returned 0
	[0135.439] lstrlenA (lpString="*.pfx") returned 5
	[0135.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.md") returned 0
	[0135.439] lstrlenA (lpString="*.md") returned 4
	[0135.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.lnk") returned 0
	[0135.439] lstrlenA (lpString="*.lnk") returned 5
	[0135.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.torrent") returned 0
	[0135.439] lstrlenA (lpString="*.torrent") returned 9
	[0135.439] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.mov") returned 0
	[0135.440] lstrlenA (lpString="*.mov") returned 5
	[0135.440] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.3gp") returned 0
	[0135.440] lstrlenA (lpString="*.3gp") returned 5
	[0135.440] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.mpeg") returned 0
	[0135.440] lstrlenA (lpString="*.mpeg") returned 6
	[0135.440] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.mpg") returned 0
	[0135.440] lstrlenA (lpString="*.mpg") returned 5
	[0135.440] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.flv") returned 0
	[0135.440] lstrlenA (lpString="*.flv") returned 5
	[0135.440] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.avi") returned 0
	[0135.440] lstrlenA (lpString="*.avi") returned 5
	[0135.440] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.mp4") returned 0
	[0135.440] lstrlenA (lpString="*.mp4") returned 5
	[0135.440] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.wmv") returned 0
	[0135.440] lstrlenA (lpString="*.wmv") returned 5
	[0135.440] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.mkv") returned 0
	[0135.440] lstrlenA (lpString="*.mkv") returned 5
	[0135.440] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.mp3") returned 0
	[0135.440] lstrlenA (lpString="*.mp3") returned 5
	[0135.440] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.wav") returned 0
	[0135.440] lstrlenA (lpString="*.wav") returned 5
	[0135.440] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.flac") returned 0
	[0135.440] lstrlenA (lpString="*.flac") returned 6
	[0135.440] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.wma") returned 0
	[0135.440] lstrlenA (lpString="*.wma") returned 5
	[0135.440] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.au3") returned 0
	[0135.440] lstrlenA (lpString="*.au3") returned 5
	[0135.440] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.ahk") returned 0
	[0135.440] lstrlenA (lpString="*.ahk") returned 5
	[0135.440] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.c") returned 0
	[0135.440] lstrlenA (lpString="*.c") returned 3
	[0135.440] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.cc") returned 0
	[0135.440] lstrlenA (lpString="*.cc") returned 4
	[0135.440] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.cpp") returned 0
	[0135.440] lstrlenA (lpString="*.cpp") returned 5
	[0135.441] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.cxx") returned 0
	[0135.441] lstrlenA (lpString="*.cxx") returned 5
	[0135.441] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.c++") returned 0
	[0135.441] lstrlenA (lpString="*.c++") returned 5
	[0135.441] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.cs") returned 0
	[0135.441] lstrlenA (lpString="*.cs") returned 4
	[0135.441] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.vb") returned 0
	[0135.441] lstrlenA (lpString="*.vb") returned 4
	[0135.441] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.bas") returned 0
	[0135.441] lstrlenA (lpString="*.bas") returned 5
	[0135.441] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.csproj") returned 0
	[0135.441] lstrlenA (lpString="*.csproj") returned 8
	[0135.441] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.vbproj") returned 0
	[0135.441] lstrlenA (lpString="*.vbproj") returned 8
	[0135.441] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.vcxproj") returned 0
	[0135.441] lstrlenA (lpString="*.vcxproj") returned 9
	[0135.441] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.manifest") returned 0
	[0135.441] lstrlenA (lpString="*.manifest") returned 10
	[0135.441] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.php") returned 0
	[0135.441] lstrlenA (lpString="*.php") returned 5
	[0135.441] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.vbe") returned 0
	[0135.441] lstrlenA (lpString="*.vbe") returned 5
	[0135.441] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.vba") returned 0
	[0135.441] lstrlenA (lpString="*.vba") returned 5
	[0135.441] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.vbs") returned 0
	[0135.441] lstrlenA (lpString="*.vbs") returned 5
	[0135.441] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.bat") returned 0
	[0135.441] lstrlenA (lpString="*.bat") returned 5
	[0135.441] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.cmd") returned 0
	[0135.441] lstrlenA (lpString="*.cmd") returned 5
	[0135.441] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.js") returned 0
	[0135.441] lstrlenA (lpString="*.js") returned 4
	[0135.441] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.jscript") returned 0
	[0135.442] lstrlenA (lpString="*.jscript") returned 9
	[0135.442] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.hta") returned 0
	[0135.442] lstrlenA (lpString="*.hta") returned 5
	[0135.442] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.php7") returned 0
	[0135.442] lstrlenA (lpString="*.php7") returned 6
	[0135.442] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.db") returned 0
	[0135.442] lstrlenA (lpString="*.db") returned 4
	[0135.442] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.swf") returned 0
	[0135.442] lstrlenA (lpString="*.swf") returned 5
	[0135.442] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.eml") returned 0
	[0135.442] lstrlenA (lpString="*.eml") returned 5
	[0135.442] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.part") returned 0
	[0135.442] lstrlenA (lpString="*.part") returned 6
	[0135.442] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.nfo") returned 0
	[0135.442] lstrlenA (lpString="*.nfo") returned 5
	[0135.442] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.rsa") returned 0
	[0135.442] lstrlenA (lpString="*.rsa") returned 5
	[0135.442] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.key") returned 0
	[0135.442] lstrlenA (lpString="*.key") returned 5
	[0135.442] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.aes") returned 0
	[0135.442] lstrlenA (lpString="*.aes") returned 5
	[0135.442] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.blob") returned 0
	[0135.442] lstrlenA (lpString="*.blob") returned 6
	[0135.442] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.btc") returned 0
	[0135.442] lstrlenA (lpString="*.btc") returned 5
	[0135.442] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", pszSpec="*.wallet") returned 0
	[0135.442] lstrlenA (lpString="*.wallet") returned 8
	[0135.442] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b8a0c50, ftCreationTime.dwHighDateTime=0x1d4d3f7, ftLastAccessTime.dwLowDateTime=0x3b1f76d0, ftLastAccessTime.dwHighDateTime=0x1d4c8c4, ftLastWriteTime.dwLowDateTime=0x3b1f76d0, ftLastWriteTime.dwHighDateTime=0x1d4c8c4, nFileSizeHigh=0x0, nFileSizeLow=0x275a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dnc8n plAA.gif", cAlternateFileName="DNC8NP~1.GIF")) returned 1
	[0135.442] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.442] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Dnc8n plAA.gif") returned 1
	[0135.442] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Dnc8n plAA.gif") returned 1
	[0135.442] lstrcmpiA (lpString1="", lpString2="Dnc8n plAA.gif") returned -1
	[0135.442] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\desktop.ini") returned="desktop.ini"
	[0135.443] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.443] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.443] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.443] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0x20
	[0135.443] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Dnc8n plAA.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Dnc8n plAA.gif") returned="C:\\Users\\FD1HVy\\Pictures\\Dnc8n plAA.gif"
	[0135.443] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Dnc8n plAA.gif", pszSpec="*.zip") returned 0
	[0135.443] lstrlenA (lpString="*.zip") returned 5
	[0135.443] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Dnc8n plAA.gif", pszSpec="*.rar") returned 0
	[0135.443] lstrlenA (lpString="*.rar") returned 5
	[0135.443] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Dnc8n plAA.gif", pszSpec="*.7z") returned 0
	[0135.443] lstrlenA (lpString="*.7z") returned 4
	[0135.443] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Dnc8n plAA.gif", pszSpec="*.tar") returned 0
	[0135.443] lstrlenA (lpString="*.tar") returned 5
	[0135.443] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Dnc8n plAA.gif", pszSpec="*.gzip") returned 0
	[0135.443] lstrlenA (lpString="*.gzip") returned 6
	[0135.443] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Dnc8n plAA.gif", pszSpec="*.jpg") returned 0
	[0135.443] lstrlenA (lpString="*.jpg") returned 5
	[0135.443] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Dnc8n plAA.gif", pszSpec="*.jpeg") returned 0
	[0135.443] lstrlenA (lpString="*.jpeg") returned 6
	[0135.443] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Dnc8n plAA.gif", pszSpec="*.bmp") returned 0
	[0135.443] lstrlenA (lpString="*.bmp") returned 5
	[0135.443] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Dnc8n plAA.gif", pszSpec="*.gif") returned 1
	[0135.443] lstrlenA (lpString="*.gif") returned 5
	[0135.443] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Pictures\\Dnc8n plAA.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Dnc8n plAA.gif") returned="C:\\Users\\FD1HVy\\Pictures\\Dnc8n plAA.gif"
	[0135.443] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Pictures\\Dnc8n plAA.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Dnc8n plAA.gif") returned="C:\\Users\\FD1HVy\\Pictures\\Dnc8n plAA.gif"
	[0135.443] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Dnc8n plAA.gif", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Dnc8n plAA.gif.") returned="C:\\Users\\FD1HVy\\Pictures\\Dnc8n plAA.gif."
	[0135.443] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Dnc8n plAA.gif.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Dnc8n plAA.gif.exe") returned="C:\\Users\\FD1HVy\\Pictures\\Dnc8n plAA.gif.exe"
	[0135.443] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Dnc8n plAA.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\dnc8n plaa.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.444] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x275a
	[0135.444] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8b8a0c50, dwHighDateTime=0x1d4d3f7), lpLastAccessTime=0x407536*(dwLowDateTime=0x3b1f76d0, dwHighDateTime=0x1d4c8c4), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3b1f76d0, dwHighDateTime=0x1d4c8c4)) returned 1
	[0135.444] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.444] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x2718, lpOverlapped=0x0) returned 1
	[0135.445] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\Dnc8n plAA.gif") returned="Dnc8n plAA.gif"
	[0135.445] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.445] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x2718, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x2718, lpOverlapped=0x0) returned 1
	[0135.445] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.519] CloseHandle (hObject=0x20c) returned 1
	[0135.520] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Dnc8n plAA.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\dnc8n plaa.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Dnc8n plAA.gif.exe" (normalized: "c:\\users\\fd1hvy\\pictures\\dnc8n plaa.gif.exe")) returned 1
	[0135.521] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x322a1e10, ftCreationTime.dwHighDateTime=0x1d4d420, ftLastAccessTime.dwLowDateTime=0xf9ca1990, ftLastAccessTime.dwHighDateTime=0x1d4d518, ftLastWriteTime.dwLowDateTime=0xf9ca1990, ftLastWriteTime.dwHighDateTime=0x1d4d518, nFileSizeHigh=0x0, nFileSizeLow=0x12f20, dwReserved0=0x12, dwReserved1=0x1, cFileName="eL3bJWxEYt.png", cAlternateFileName="EL3BJW~1.PNG")) returned 1
	[0135.521] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.521] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="eL3bJWxEYt.png") returned -1
	[0135.521] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="eL3bJWxEYt.png") returned 1
	[0135.521] lstrcmpiA (lpString1="", lpString2="eL3bJWxEYt.png") returned -1
	[0135.521] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\Dnc8n plAA.gif") returned="Dnc8n plAA.gif"
	[0135.521] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.521] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.521] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.521] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0x20
	[0135.521] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="eL3bJWxEYt.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\eL3bJWxEYt.png") returned="C:\\Users\\FD1HVy\\Pictures\\eL3bJWxEYt.png"
	[0135.521] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\eL3bJWxEYt.png", pszSpec="*.zip") returned 0
	[0135.521] lstrlenA (lpString="*.zip") returned 5
	[0135.521] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\eL3bJWxEYt.png", pszSpec="*.rar") returned 0
	[0135.521] lstrlenA (lpString="*.rar") returned 5
	[0135.521] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\eL3bJWxEYt.png", pszSpec="*.7z") returned 0
	[0135.521] lstrlenA (lpString="*.7z") returned 4
	[0135.521] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\eL3bJWxEYt.png", pszSpec="*.tar") returned 0
	[0135.521] lstrlenA (lpString="*.tar") returned 5
	[0135.521] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\eL3bJWxEYt.png", pszSpec="*.gzip") returned 0
	[0135.521] lstrlenA (lpString="*.gzip") returned 6
	[0135.521] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\eL3bJWxEYt.png", pszSpec="*.jpg") returned 0
	[0135.521] lstrlenA (lpString="*.jpg") returned 5
	[0135.522] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\eL3bJWxEYt.png", pszSpec="*.jpeg") returned 0
	[0135.522] lstrlenA (lpString="*.jpeg") returned 6
	[0135.522] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\eL3bJWxEYt.png", pszSpec="*.bmp") returned 0
	[0135.522] lstrlenA (lpString="*.bmp") returned 5
	[0135.522] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\eL3bJWxEYt.png", pszSpec="*.gif") returned 0
	[0135.522] lstrlenA (lpString="*.gif") returned 5
	[0135.522] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\eL3bJWxEYt.png", pszSpec="*.png") returned 1
	[0135.522] lstrlenA (lpString="*.png") returned 5
	[0135.522] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Pictures\\eL3bJWxEYt.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\eL3bJWxEYt.png") returned="C:\\Users\\FD1HVy\\Pictures\\eL3bJWxEYt.png"
	[0135.522] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Pictures\\eL3bJWxEYt.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\eL3bJWxEYt.png") returned="C:\\Users\\FD1HVy\\Pictures\\eL3bJWxEYt.png"
	[0135.522] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\eL3bJWxEYt.png", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\eL3bJWxEYt.png.") returned="C:\\Users\\FD1HVy\\Pictures\\eL3bJWxEYt.png."
	[0135.522] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\eL3bJWxEYt.png.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\eL3bJWxEYt.png.exe") returned="C:\\Users\\FD1HVy\\Pictures\\eL3bJWxEYt.png.exe"
	[0135.522] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\eL3bJWxEYt.png" (normalized: "c:\\users\\fd1hvy\\pictures\\el3bjwxeyt.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.522] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12f20
	[0135.522] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x322a1e10, dwHighDateTime=0x1d4d420), lpLastAccessTime=0x407536*(dwLowDateTime=0xf9ca1990, dwHighDateTime=0x1d4d518), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf9ca1990, dwHighDateTime=0x1d4d518)) returned 1
	[0135.523] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.523] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x12ede, lpOverlapped=0x0) returned 1
	[0135.524] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\eL3bJWxEYt.png") returned="eL3bJWxEYt.png"
	[0135.524] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.524] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x12ede, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x12ede, lpOverlapped=0x0) returned 1
	[0135.524] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.525] CloseHandle (hObject=0x20c) returned 1
	[0135.525] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\eL3bJWxEYt.png" (normalized: "c:\\users\\fd1hvy\\pictures\\el3bjwxeyt.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\eL3bJWxEYt.png.exe" (normalized: "c:\\users\\fd1hvy\\pictures\\el3bjwxeyt.png.exe")) returned 1
	[0135.526] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf95a4d0, ftCreationTime.dwHighDateTime=0x1d4ce37, ftLastAccessTime.dwLowDateTime=0xc8caaca0, ftLastAccessTime.dwHighDateTime=0x1d4d5f0, ftLastWriteTime.dwLowDateTime=0xc8caaca0, ftLastWriteTime.dwHighDateTime=0x1d4d5f0, nFileSizeHigh=0x0, nFileSizeLow=0x68f3, dwReserved0=0x12, dwReserved1=0x1, cFileName="fWOIT ZVW.jpg", cAlternateFileName="FWOITZ~1.JPG")) returned 1
	[0135.526] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.526] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="fWOIT ZVW.jpg") returned -1
	[0135.526] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="fWOIT ZVW.jpg") returned 1
	[0135.526] lstrcmpiA (lpString1="", lpString2="fWOIT ZVW.jpg") returned -1
	[0135.526] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\eL3bJWxEYt.png") returned="eL3bJWxEYt.png"
	[0135.526] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.526] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.526] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.526] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0x20
	[0135.526] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="fWOIT ZVW.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\fWOIT ZVW.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\fWOIT ZVW.jpg"
	[0135.526] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\fWOIT ZVW.jpg", pszSpec="*.zip") returned 0
	[0135.526] lstrlenA (lpString="*.zip") returned 5
	[0135.526] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\fWOIT ZVW.jpg", pszSpec="*.rar") returned 0
	[0135.526] lstrlenA (lpString="*.rar") returned 5
	[0135.526] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\fWOIT ZVW.jpg", pszSpec="*.7z") returned 0
	[0135.526] lstrlenA (lpString="*.7z") returned 4
	[0135.526] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\fWOIT ZVW.jpg", pszSpec="*.tar") returned 0
	[0135.526] lstrlenA (lpString="*.tar") returned 5
	[0135.526] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\fWOIT ZVW.jpg", pszSpec="*.gzip") returned 0
	[0135.526] lstrlenA (lpString="*.gzip") returned 6
	[0135.526] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\fWOIT ZVW.jpg", pszSpec="*.jpg") returned 1
	[0135.526] lstrlenA (lpString="*.jpg") returned 5
	[0135.526] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Pictures\\fWOIT ZVW.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\fWOIT ZVW.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\fWOIT ZVW.jpg"
	[0135.526] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Pictures\\fWOIT ZVW.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\fWOIT ZVW.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\fWOIT ZVW.jpg"
	[0135.526] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\fWOIT ZVW.jpg", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\fWOIT ZVW.jpg.") returned="C:\\Users\\FD1HVy\\Pictures\\fWOIT ZVW.jpg."
	[0135.526] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\fWOIT ZVW.jpg.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\fWOIT ZVW.jpg.exe") returned="C:\\Users\\FD1HVy\\Pictures\\fWOIT ZVW.jpg.exe"
	[0135.526] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\fWOIT ZVW.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\fwoit zvw.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.527] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x68f3
	[0135.527] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xaf95a4d0, dwHighDateTime=0x1d4ce37), lpLastAccessTime=0x407536*(dwLowDateTime=0xc8caaca0, dwHighDateTime=0x1d4d5f0), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc8caaca0, dwHighDateTime=0x1d4d5f0)) returned 1
	[0135.527] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.527] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x68b1, lpOverlapped=0x0) returned 1
	[0135.528] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\fWOIT ZVW.jpg") returned="fWOIT ZVW.jpg"
	[0135.528] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.528] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x68b1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x68b1, lpOverlapped=0x0) returned 1
	[0135.528] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.528] CloseHandle (hObject=0x20c) returned 1
	[0135.528] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\fWOIT ZVW.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\fwoit zvw.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\fWOIT ZVW.jpg.exe" (normalized: "c:\\users\\fd1hvy\\pictures\\fwoit zvw.jpg.exe")) returned 1
	[0135.529] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42925f0, ftCreationTime.dwHighDateTime=0x1d4cec8, ftLastAccessTime.dwLowDateTime=0xb623f310, ftLastAccessTime.dwHighDateTime=0x1d4c946, ftLastWriteTime.dwLowDateTime=0xb623f310, ftLastWriteTime.dwHighDateTime=0x1d4c946, nFileSizeHigh=0x0, nFileSizeLow=0x7e09, dwReserved0=0x12, dwReserved1=0x1, cFileName="gkxAkZA.jpg", cAlternateFileName="")) returned 1
	[0135.529] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.529] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="gkxAkZA.jpg") returned -1
	[0135.529] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="gkxAkZA.jpg") returned 1
	[0135.529] lstrcmpiA (lpString1="", lpString2="gkxAkZA.jpg") returned -1
	[0135.529] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\fWOIT ZVW.jpg") returned="fWOIT ZVW.jpg"
	[0135.529] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.529] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.529] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.529] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0x20
	[0135.529] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="gkxAkZA.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\gkxAkZA.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\gkxAkZA.jpg"
	[0135.529] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\gkxAkZA.jpg", pszSpec="*.zip") returned 0
	[0135.529] lstrlenA (lpString="*.zip") returned 5
	[0135.529] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\gkxAkZA.jpg", pszSpec="*.rar") returned 0
	[0135.529] lstrlenA (lpString="*.rar") returned 5
	[0135.529] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\gkxAkZA.jpg", pszSpec="*.7z") returned 0
	[0135.529] lstrlenA (lpString="*.7z") returned 4
	[0135.529] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\gkxAkZA.jpg", pszSpec="*.tar") returned 0
	[0135.529] lstrlenA (lpString="*.tar") returned 5
	[0135.530] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\gkxAkZA.jpg", pszSpec="*.gzip") returned 0
	[0135.530] lstrlenA (lpString="*.gzip") returned 6
	[0135.530] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\gkxAkZA.jpg", pszSpec="*.jpg") returned 1
	[0135.530] lstrlenA (lpString="*.jpg") returned 5
	[0135.530] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Pictures\\gkxAkZA.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\gkxAkZA.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\gkxAkZA.jpg"
	[0135.530] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Pictures\\gkxAkZA.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\gkxAkZA.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\gkxAkZA.jpg"
	[0135.530] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\gkxAkZA.jpg", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\gkxAkZA.jpg.") returned="C:\\Users\\FD1HVy\\Pictures\\gkxAkZA.jpg."
	[0135.530] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\gkxAkZA.jpg.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\gkxAkZA.jpg.exe") returned="C:\\Users\\FD1HVy\\Pictures\\gkxAkZA.jpg.exe"
	[0135.530] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\gkxAkZA.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\gkxakza.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.530] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7e09
	[0135.530] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe42925f0, dwHighDateTime=0x1d4cec8), lpLastAccessTime=0x407536*(dwLowDateTime=0xb623f310, dwHighDateTime=0x1d4c946), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb623f310, dwHighDateTime=0x1d4c946)) returned 1
	[0135.530] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.530] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7dc7, lpOverlapped=0x0) returned 1
	[0135.531] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\gkxAkZA.jpg") returned="gkxAkZA.jpg"
	[0135.531] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.531] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7dc7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7dc7, lpOverlapped=0x0) returned 1
	[0135.532] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.532] CloseHandle (hObject=0x20c) returned 1
	[0135.532] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\gkxAkZA.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\gkxakza.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\gkxAkZA.jpg.exe" (normalized: "c:\\users\\fd1hvy\\pictures\\gkxakza.jpg.exe")) returned 1
	[0135.532] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb0ca10, ftCreationTime.dwHighDateTime=0x1d4d392, ftLastAccessTime.dwLowDateTime=0x2179f240, ftLastAccessTime.dwHighDateTime=0x1d4cc35, ftLastWriteTime.dwLowDateTime=0x2179f240, ftLastWriteTime.dwHighDateTime=0x1d4cc35, nFileSizeHigh=0x0, nFileSizeLow=0x3eb6, dwReserved0=0x12, dwReserved1=0x1, cFileName="ITVh9Fmpp8JFx.gif", cAlternateFileName="ITVH9F~1.GIF")) returned 1
	[0135.532] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.532] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="ITVh9Fmpp8JFx.gif") returned -1
	[0135.532] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="ITVh9Fmpp8JFx.gif") returned -1
	[0135.532] lstrcmpiA (lpString1="", lpString2="ITVh9Fmpp8JFx.gif") returned -1
	[0135.532] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\gkxAkZA.jpg") returned="gkxAkZA.jpg"
	[0135.532] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.532] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.532] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.533] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0x20
	[0135.533] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="ITVh9Fmpp8JFx.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\ITVh9Fmpp8JFx.gif") returned="C:\\Users\\FD1HVy\\Pictures\\ITVh9Fmpp8JFx.gif"
	[0135.533] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\ITVh9Fmpp8JFx.gif", pszSpec="*.zip") returned 0
	[0135.533] lstrlenA (lpString="*.zip") returned 5
	[0135.533] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\ITVh9Fmpp8JFx.gif", pszSpec="*.rar") returned 0
	[0135.533] lstrlenA (lpString="*.rar") returned 5
	[0135.533] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\ITVh9Fmpp8JFx.gif", pszSpec="*.7z") returned 0
	[0135.533] lstrlenA (lpString="*.7z") returned 4
	[0135.533] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\ITVh9Fmpp8JFx.gif", pszSpec="*.tar") returned 0
	[0135.533] lstrlenA (lpString="*.tar") returned 5
	[0135.533] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\ITVh9Fmpp8JFx.gif", pszSpec="*.gzip") returned 0
	[0135.533] lstrlenA (lpString="*.gzip") returned 6
	[0135.533] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\ITVh9Fmpp8JFx.gif", pszSpec="*.jpg") returned 0
	[0135.533] lstrlenA (lpString="*.jpg") returned 5
	[0135.533] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\ITVh9Fmpp8JFx.gif", pszSpec="*.jpeg") returned 0
	[0135.533] lstrlenA (lpString="*.jpeg") returned 6
	[0135.533] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\ITVh9Fmpp8JFx.gif", pszSpec="*.bmp") returned 0
	[0135.533] lstrlenA (lpString="*.bmp") returned 5
	[0135.533] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\ITVh9Fmpp8JFx.gif", pszSpec="*.gif") returned 1
	[0135.533] lstrlenA (lpString="*.gif") returned 5
	[0135.533] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Pictures\\ITVh9Fmpp8JFx.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\ITVh9Fmpp8JFx.gif") returned="C:\\Users\\FD1HVy\\Pictures\\ITVh9Fmpp8JFx.gif"
	[0135.533] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Pictures\\ITVh9Fmpp8JFx.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\ITVh9Fmpp8JFx.gif") returned="C:\\Users\\FD1HVy\\Pictures\\ITVh9Fmpp8JFx.gif"
	[0135.533] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\ITVh9Fmpp8JFx.gif", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\ITVh9Fmpp8JFx.gif.") returned="C:\\Users\\FD1HVy\\Pictures\\ITVh9Fmpp8JFx.gif."
	[0135.533] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\ITVh9Fmpp8JFx.gif.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\ITVh9Fmpp8JFx.gif.exe") returned="C:\\Users\\FD1HVy\\Pictures\\ITVh9Fmpp8JFx.gif.exe"
	[0135.533] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ITVh9Fmpp8JFx.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\itvh9fmpp8jfx.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.534] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3eb6
	[0135.534] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6fb0ca10, dwHighDateTime=0x1d4d392), lpLastAccessTime=0x407536*(dwLowDateTime=0x2179f240, dwHighDateTime=0x1d4cc35), lpLastWriteTime=0x40753e*(dwLowDateTime=0x2179f240, dwHighDateTime=0x1d4cc35)) returned 1
	[0135.534] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.534] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x3e74, lpOverlapped=0x0) returned 1
	[0135.534] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\ITVh9Fmpp8JFx.gif") returned="ITVh9Fmpp8JFx.gif"
	[0135.535] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.535] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x3e74, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x3e74, lpOverlapped=0x0) returned 1
	[0135.535] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.535] CloseHandle (hObject=0x20c) returned 1
	[0135.535] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\ITVh9Fmpp8JFx.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\itvh9fmpp8jfx.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\ITVh9Fmpp8JFx.gif.exe" (normalized: "c:\\users\\fd1hvy\\pictures\\itvh9fmpp8jfx.gif.exe")) returned 1
	[0135.535] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd532a5a0, ftCreationTime.dwHighDateTime=0x1d4ca8e, ftLastAccessTime.dwLowDateTime=0x49c2b540, ftLastAccessTime.dwHighDateTime=0x1d4d589, ftLastWriteTime.dwLowDateTime=0x49c2b540, ftLastWriteTime.dwHighDateTime=0x1d4d589, nFileSizeHigh=0x0, nFileSizeLow=0x17cb2, dwReserved0=0x15, dwReserved1=0x1, cFileName="iYPF.gif", cAlternateFileName="")) returned 1
	[0135.536] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.536] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="iYPF.gif") returned -1
	[0135.536] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="iYPF.gif") returned -1
	[0135.536] lstrcmpiA (lpString1="", lpString2="iYPF.gif") returned -1
	[0135.536] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\ITVh9Fmpp8JFx.gif") returned="ITVh9Fmpp8JFx.gif"
	[0135.536] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.536] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.536] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.536] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0x20
	[0135.536] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="iYPF.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\iYPF.gif") returned="C:\\Users\\FD1HVy\\Pictures\\iYPF.gif"
	[0135.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\iYPF.gif", pszSpec="*.zip") returned 0
	[0135.536] lstrlenA (lpString="*.zip") returned 5
	[0135.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\iYPF.gif", pszSpec="*.rar") returned 0
	[0135.536] lstrlenA (lpString="*.rar") returned 5
	[0135.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\iYPF.gif", pszSpec="*.7z") returned 0
	[0135.536] lstrlenA (lpString="*.7z") returned 4
	[0135.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\iYPF.gif", pszSpec="*.tar") returned 0
	[0135.536] lstrlenA (lpString="*.tar") returned 5
	[0135.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\iYPF.gif", pszSpec="*.gzip") returned 0
	[0135.536] lstrlenA (lpString="*.gzip") returned 6
	[0135.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\iYPF.gif", pszSpec="*.jpg") returned 0
	[0135.536] lstrlenA (lpString="*.jpg") returned 5
	[0135.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\iYPF.gif", pszSpec="*.jpeg") returned 0
	[0135.536] lstrlenA (lpString="*.jpeg") returned 6
	[0135.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\iYPF.gif", pszSpec="*.bmp") returned 0
	[0135.536] lstrlenA (lpString="*.bmp") returned 5
	[0135.536] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\iYPF.gif", pszSpec="*.gif") returned 1
	[0135.536] lstrlenA (lpString="*.gif") returned 5
	[0135.536] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Pictures\\iYPF.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\iYPF.gif") returned="C:\\Users\\FD1HVy\\Pictures\\iYPF.gif"
	[0135.536] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Pictures\\iYPF.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\iYPF.gif") returned="C:\\Users\\FD1HVy\\Pictures\\iYPF.gif"
	[0135.537] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\iYPF.gif", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\iYPF.gif.") returned="C:\\Users\\FD1HVy\\Pictures\\iYPF.gif."
	[0135.537] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\iYPF.gif.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\iYPF.gif.exe") returned="C:\\Users\\FD1HVy\\Pictures\\iYPF.gif.exe"
	[0135.537] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\iYPF.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\iypf.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.537] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17cb2
	[0135.537] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd532a5a0, dwHighDateTime=0x1d4ca8e), lpLastAccessTime=0x407536*(dwLowDateTime=0x49c2b540, dwHighDateTime=0x1d4d589), lpLastWriteTime=0x40753e*(dwLowDateTime=0x49c2b540, dwHighDateTime=0x1d4d589)) returned 1
	[0135.537] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.537] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x17c70, lpOverlapped=0x0) returned 1
	[0135.538] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\iYPF.gif") returned="iYPF.gif"
	[0135.539] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.539] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x17c70, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x17c70, lpOverlapped=0x0) returned 1
	[0135.539] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.539] CloseHandle (hObject=0x20c) returned 1
	[0135.539] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\iYPF.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\iypf.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\iYPF.gif.exe" (normalized: "c:\\users\\fd1hvy\\pictures\\iypf.gif.exe")) returned 1
	[0135.540] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7e3da30, ftCreationTime.dwHighDateTime=0x1d4d17e, ftLastAccessTime.dwLowDateTime=0x95c6750, ftLastAccessTime.dwHighDateTime=0x1d4c7d1, ftLastWriteTime.dwLowDateTime=0x95c6750, ftLastWriteTime.dwHighDateTime=0x1d4c7d1, nFileSizeHigh=0x0, nFileSizeLow=0xcd45, dwReserved0=0x12, dwReserved1=0x1, cFileName="J-smxptjhdz3.gif", cAlternateFileName="J-SMXP~1.GIF")) returned 1
	[0135.540] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.540] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J-smxptjhdz3.gif") returned -1
	[0135.540] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J-smxptjhdz3.gif") returned -1
	[0135.540] lstrcmpiA (lpString1="", lpString2="J-smxptjhdz3.gif") returned -1
	[0135.540] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\iYPF.gif") returned="iYPF.gif"
	[0135.540] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.540] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.540] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.540] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0x20
	[0135.540] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="J-smxptjhdz3.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\J-smxptjhdz3.gif") returned="C:\\Users\\FD1HVy\\Pictures\\J-smxptjhdz3.gif"
	[0135.540] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\J-smxptjhdz3.gif", pszSpec="*.zip") returned 0
	[0135.540] lstrlenA (lpString="*.zip") returned 5
	[0135.540] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\J-smxptjhdz3.gif", pszSpec="*.rar") returned 0
	[0135.540] lstrlenA (lpString="*.rar") returned 5
	[0135.540] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\J-smxptjhdz3.gif", pszSpec="*.7z") returned 0
	[0135.540] lstrlenA (lpString="*.7z") returned 4
	[0135.540] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\J-smxptjhdz3.gif", pszSpec="*.tar") returned 0
	[0135.540] lstrlenA (lpString="*.tar") returned 5
	[0135.540] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\J-smxptjhdz3.gif", pszSpec="*.gzip") returned 0
	[0135.540] lstrlenA (lpString="*.gzip") returned 6
	[0135.540] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\J-smxptjhdz3.gif", pszSpec="*.jpg") returned 0
	[0135.540] lstrlenA (lpString="*.jpg") returned 5
	[0135.540] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\J-smxptjhdz3.gif", pszSpec="*.jpeg") returned 0
	[0135.540] lstrlenA (lpString="*.jpeg") returned 6
	[0135.540] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\J-smxptjhdz3.gif", pszSpec="*.bmp") returned 0
	[0135.541] lstrlenA (lpString="*.bmp") returned 5
	[0135.541] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\J-smxptjhdz3.gif", pszSpec="*.gif") returned 1
	[0135.541] lstrlenA (lpString="*.gif") returned 5
	[0135.541] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Pictures\\J-smxptjhdz3.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\J-smxptjhdz3.gif") returned="C:\\Users\\FD1HVy\\Pictures\\J-smxptjhdz3.gif"
	[0135.541] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Pictures\\J-smxptjhdz3.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\J-smxptjhdz3.gif") returned="C:\\Users\\FD1HVy\\Pictures\\J-smxptjhdz3.gif"
	[0135.541] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\J-smxptjhdz3.gif", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\J-smxptjhdz3.gif.") returned="C:\\Users\\FD1HVy\\Pictures\\J-smxptjhdz3.gif."
	[0135.541] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\J-smxptjhdz3.gif.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\J-smxptjhdz3.gif.exe") returned="C:\\Users\\FD1HVy\\Pictures\\J-smxptjhdz3.gif.exe"
	[0135.541] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\J-smxptjhdz3.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\j-smxptjhdz3.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.541] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcd45
	[0135.541] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc7e3da30, dwHighDateTime=0x1d4d17e), lpLastAccessTime=0x407536*(dwLowDateTime=0x95c6750, dwHighDateTime=0x1d4c7d1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x95c6750, dwHighDateTime=0x1d4c7d1)) returned 1
	[0135.541] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.541] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xcd03, lpOverlapped=0x0) returned 1
	[0135.542] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\J-smxptjhdz3.gif") returned="J-smxptjhdz3.gif"
	[0135.542] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.542] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xcd03, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xcd03, lpOverlapped=0x0) returned 1
	[0135.543] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.543] CloseHandle (hObject=0x20c) returned 1
	[0135.543] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\J-smxptjhdz3.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\j-smxptjhdz3.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\J-smxptjhdz3.gif.exe" (normalized: "c:\\users\\fd1hvy\\pictures\\j-smxptjhdz3.gif.exe")) returned 1
	[0135.543] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c0591d0, ftCreationTime.dwHighDateTime=0x1d4c7d1, ftLastAccessTime.dwLowDateTime=0x7edcb6a0, ftLastAccessTime.dwHighDateTime=0x1d4ce26, ftLastWriteTime.dwLowDateTime=0x7edcb6a0, ftLastWriteTime.dwHighDateTime=0x1d4ce26, nFileSizeHigh=0x0, nFileSizeLow=0x7ebc, dwReserved0=0x15, dwReserved1=0x1, cFileName="KXKXt8kgxU3cwbQtE.png", cAlternateFileName="KXKXT8~1.PNG")) returned 1
	[0135.543] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.543] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="KXKXt8kgxU3cwbQtE.png") returned -1
	[0135.543] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="KXKXt8kgxU3cwbQtE.png") returned -1
	[0135.544] lstrcmpiA (lpString1="", lpString2="KXKXt8kgxU3cwbQtE.png") returned -1
	[0135.544] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\J-smxptjhdz3.gif") returned="J-smxptjhdz3.gif"
	[0135.544] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.544] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.544] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.544] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0x20
	[0135.544] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="KXKXt8kgxU3cwbQtE.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\KXKXt8kgxU3cwbQtE.png") returned="C:\\Users\\FD1HVy\\Pictures\\KXKXt8kgxU3cwbQtE.png"
	[0135.544] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\KXKXt8kgxU3cwbQtE.png", pszSpec="*.zip") returned 0
	[0135.544] lstrlenA (lpString="*.zip") returned 5
	[0135.544] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\KXKXt8kgxU3cwbQtE.png", pszSpec="*.rar") returned 0
	[0135.544] lstrlenA (lpString="*.rar") returned 5
	[0135.544] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\KXKXt8kgxU3cwbQtE.png", pszSpec="*.7z") returned 0
	[0135.544] lstrlenA (lpString="*.7z") returned 4
	[0135.544] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\KXKXt8kgxU3cwbQtE.png", pszSpec="*.tar") returned 0
	[0135.544] lstrlenA (lpString="*.tar") returned 5
	[0135.544] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\KXKXt8kgxU3cwbQtE.png", pszSpec="*.gzip") returned 0
	[0135.544] lstrlenA (lpString="*.gzip") returned 6
	[0135.544] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\KXKXt8kgxU3cwbQtE.png", pszSpec="*.jpg") returned 0
	[0135.544] lstrlenA (lpString="*.jpg") returned 5
	[0135.544] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\KXKXt8kgxU3cwbQtE.png", pszSpec="*.jpeg") returned 0
	[0135.544] lstrlenA (lpString="*.jpeg") returned 6
	[0135.544] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\KXKXt8kgxU3cwbQtE.png", pszSpec="*.bmp") returned 0
	[0135.544] lstrlenA (lpString="*.bmp") returned 5
	[0135.544] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\KXKXt8kgxU3cwbQtE.png", pszSpec="*.gif") returned 0
	[0135.544] lstrlenA (lpString="*.gif") returned 5
	[0135.544] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\KXKXt8kgxU3cwbQtE.png", pszSpec="*.png") returned 1
	[0135.544] lstrlenA (lpString="*.png") returned 5
	[0135.544] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Pictures\\KXKXt8kgxU3cwbQtE.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\KXKXt8kgxU3cwbQtE.png") returned="C:\\Users\\FD1HVy\\Pictures\\KXKXt8kgxU3cwbQtE.png"
	[0135.544] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Pictures\\KXKXt8kgxU3cwbQtE.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\KXKXt8kgxU3cwbQtE.png") returned="C:\\Users\\FD1HVy\\Pictures\\KXKXt8kgxU3cwbQtE.png"
	[0135.544] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\KXKXt8kgxU3cwbQtE.png", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\KXKXt8kgxU3cwbQtE.png.") returned="C:\\Users\\FD1HVy\\Pictures\\KXKXt8kgxU3cwbQtE.png."
	[0135.544] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\KXKXt8kgxU3cwbQtE.png.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\KXKXt8kgxU3cwbQtE.png.exe") returned="C:\\Users\\FD1HVy\\Pictures\\KXKXt8kgxU3cwbQtE.png.exe"
	[0135.545] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\KXKXt8kgxU3cwbQtE.png" (normalized: "c:\\users\\fd1hvy\\pictures\\kxkxt8kgxu3cwbqte.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.545] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7ebc
	[0135.545] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9c0591d0, dwHighDateTime=0x1d4c7d1), lpLastAccessTime=0x407536*(dwLowDateTime=0x7edcb6a0, dwHighDateTime=0x1d4ce26), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7edcb6a0, dwHighDateTime=0x1d4ce26)) returned 1
	[0135.545] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.545] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7e7a, lpOverlapped=0x0) returned 1
	[0135.546] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\KXKXt8kgxU3cwbQtE.png") returned="KXKXt8kgxU3cwbQtE.png"
	[0135.546] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.546] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7e7a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7e7a, lpOverlapped=0x0) returned 1
	[0135.546] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.546] CloseHandle (hObject=0x20c) returned 1
	[0135.546] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\KXKXt8kgxU3cwbQtE.png" (normalized: "c:\\users\\fd1hvy\\pictures\\kxkxt8kgxu3cwbqte.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\KXKXt8kgxU3cwbQtE.png.exe" (normalized: "c:\\users\\fd1hvy\\pictures\\kxkxt8kgxu3cwbqte.png.exe")) returned 1
	[0135.550] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74b7940, ftCreationTime.dwHighDateTime=0x1d4d23e, ftLastAccessTime.dwLowDateTime=0x8eafe2f0, ftLastAccessTime.dwHighDateTime=0x1d4cf4d, ftLastWriteTime.dwLowDateTime=0x8eafe2f0, ftLastWriteTime.dwHighDateTime=0x1d4cf4d, nFileSizeHigh=0x0, nFileSizeLow=0x110a7, dwReserved0=0x0, dwReserved1=0x1, cFileName="leXZMGb.jpg", cAlternateFileName="")) returned 1
	[0135.551] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.551] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="leXZMGb.jpg") returned -1
	[0135.551] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="leXZMGb.jpg") returned -1
	[0135.551] lstrcmpiA (lpString1="", lpString2="leXZMGb.jpg") returned -1
	[0135.551] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\KXKXt8kgxU3cwbQtE.png") returned="KXKXt8kgxU3cwbQtE.png"
	[0135.551] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.551] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.551] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.551] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0x20
	[0135.551] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="leXZMGb.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\leXZMGb.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\leXZMGb.jpg"
	[0135.551] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\leXZMGb.jpg", pszSpec="*.zip") returned 0
	[0135.551] lstrlenA (lpString="*.zip") returned 5
	[0135.551] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\leXZMGb.jpg", pszSpec="*.rar") returned 0
	[0135.551] lstrlenA (lpString="*.rar") returned 5
	[0135.551] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\leXZMGb.jpg", pszSpec="*.7z") returned 0
	[0135.551] lstrlenA (lpString="*.7z") returned 4
	[0135.551] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\leXZMGb.jpg", pszSpec="*.tar") returned 0
	[0135.551] lstrlenA (lpString="*.tar") returned 5
	[0135.551] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\leXZMGb.jpg", pszSpec="*.gzip") returned 0
	[0135.551] lstrlenA (lpString="*.gzip") returned 6
	[0135.551] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\leXZMGb.jpg", pszSpec="*.jpg") returned 1
	[0135.551] lstrlenA (lpString="*.jpg") returned 5
	[0135.551] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Pictures\\leXZMGb.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\leXZMGb.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\leXZMGb.jpg"
	[0135.551] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Pictures\\leXZMGb.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\leXZMGb.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\leXZMGb.jpg"
	[0135.551] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\leXZMGb.jpg", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\leXZMGb.jpg.") returned="C:\\Users\\FD1HVy\\Pictures\\leXZMGb.jpg."
	[0135.551] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\leXZMGb.jpg.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\leXZMGb.jpg.exe") returned="C:\\Users\\FD1HVy\\Pictures\\leXZMGb.jpg.exe"
	[0135.551] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\leXZMGb.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\lexzmgb.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.552] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x110a7
	[0135.552] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd74b7940, dwHighDateTime=0x1d4d23e), lpLastAccessTime=0x407536*(dwLowDateTime=0x8eafe2f0, dwHighDateTime=0x1d4cf4d), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8eafe2f0, dwHighDateTime=0x1d4cf4d)) returned 1
	[0135.552] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.552] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x11065, lpOverlapped=0x0) returned 1
	[0135.553] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\leXZMGb.jpg") returned="leXZMGb.jpg"
	[0135.553] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.553] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x11065, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x11065, lpOverlapped=0x0) returned 1
	[0135.554] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.554] CloseHandle (hObject=0x20c) returned 1
	[0135.554] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\leXZMGb.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\lexzmgb.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\leXZMGb.jpg.exe" (normalized: "c:\\users\\fd1hvy\\pictures\\lexzmgb.jpg.exe")) returned 1
	[0135.554] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7916a90, ftCreationTime.dwHighDateTime=0x1d4d34a, ftLastAccessTime.dwLowDateTime=0x62e0c6a0, ftLastAccessTime.dwHighDateTime=0x1d4d2a2, ftLastWriteTime.dwLowDateTime=0x62e0c6a0, ftLastWriteTime.dwHighDateTime=0x1d4d2a2, nFileSizeHigh=0x0, nFileSizeLow=0x11fe3, dwReserved0=0x12, dwReserved1=0x1, cFileName="n-Bw0rDMdv 7_0.gif", cAlternateFileName="N-BW0R~1.GIF")) returned 1
	[0135.578] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.578] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="n-Bw0rDMdv 7_0.gif") returned -1
	[0135.578] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="n-Bw0rDMdv 7_0.gif") returned -1
	[0135.578] lstrcmpiA (lpString1="", lpString2="n-Bw0rDMdv 7_0.gif") returned -1
	[0135.578] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\leXZMGb.jpg") returned="leXZMGb.jpg"
	[0135.578] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.578] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.578] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.578] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0x20
	[0135.578] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="n-Bw0rDMdv 7_0.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\n-Bw0rDMdv 7_0.gif") returned="C:\\Users\\FD1HVy\\Pictures\\n-Bw0rDMdv 7_0.gif"
	[0135.578] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\n-Bw0rDMdv 7_0.gif", pszSpec="*.zip") returned 0
	[0135.579] lstrlenA (lpString="*.zip") returned 5
	[0135.579] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\n-Bw0rDMdv 7_0.gif", pszSpec="*.rar") returned 0
	[0135.579] lstrlenA (lpString="*.rar") returned 5
	[0135.579] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\n-Bw0rDMdv 7_0.gif", pszSpec="*.7z") returned 0
	[0135.579] lstrlenA (lpString="*.7z") returned 4
	[0135.579] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\n-Bw0rDMdv 7_0.gif", pszSpec="*.tar") returned 0
	[0135.579] lstrlenA (lpString="*.tar") returned 5
	[0135.579] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\n-Bw0rDMdv 7_0.gif", pszSpec="*.gzip") returned 0
	[0135.579] lstrlenA (lpString="*.gzip") returned 6
	[0135.579] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\n-Bw0rDMdv 7_0.gif", pszSpec="*.jpg") returned 0
	[0135.579] lstrlenA (lpString="*.jpg") returned 5
	[0135.579] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\n-Bw0rDMdv 7_0.gif", pszSpec="*.jpeg") returned 0
	[0135.579] lstrlenA (lpString="*.jpeg") returned 6
	[0135.579] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\n-Bw0rDMdv 7_0.gif", pszSpec="*.bmp") returned 0
	[0135.579] lstrlenA (lpString="*.bmp") returned 5
	[0135.579] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\n-Bw0rDMdv 7_0.gif", pszSpec="*.gif") returned 1
	[0135.579] lstrlenA (lpString="*.gif") returned 5
	[0135.579] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Pictures\\n-Bw0rDMdv 7_0.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\n-Bw0rDMdv 7_0.gif") returned="C:\\Users\\FD1HVy\\Pictures\\n-Bw0rDMdv 7_0.gif"
	[0135.579] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Pictures\\n-Bw0rDMdv 7_0.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\n-Bw0rDMdv 7_0.gif") returned="C:\\Users\\FD1HVy\\Pictures\\n-Bw0rDMdv 7_0.gif"
	[0135.579] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\n-Bw0rDMdv 7_0.gif", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\n-Bw0rDMdv 7_0.gif.") returned="C:\\Users\\FD1HVy\\Pictures\\n-Bw0rDMdv 7_0.gif."
	[0135.579] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\n-Bw0rDMdv 7_0.gif.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\n-Bw0rDMdv 7_0.gif.exe") returned="C:\\Users\\FD1HVy\\Pictures\\n-Bw0rDMdv 7_0.gif.exe"
	[0135.579] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\n-Bw0rDMdv 7_0.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\n-bw0rdmdv 7_0.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.580] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11fe3
	[0135.580] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf7916a90, dwHighDateTime=0x1d4d34a), lpLastAccessTime=0x407536*(dwLowDateTime=0x62e0c6a0, dwHighDateTime=0x1d4d2a2), lpLastWriteTime=0x40753e*(dwLowDateTime=0x62e0c6a0, dwHighDateTime=0x1d4d2a2)) returned 1
	[0135.580] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.580] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x11fa1, lpOverlapped=0x0) returned 1
	[0135.581] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\n-Bw0rDMdv 7_0.gif") returned="n-Bw0rDMdv 7_0.gif"
	[0135.581] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.581] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x11fa1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x11fa1, lpOverlapped=0x0) returned 1
	[0135.582] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.582] CloseHandle (hObject=0x20c) returned 1
	[0135.582] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\n-Bw0rDMdv 7_0.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\n-bw0rdmdv 7_0.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\n-Bw0rDMdv 7_0.gif.exe" (normalized: "c:\\users\\fd1hvy\\pictures\\n-bw0rdmdv 7_0.gif.exe")) returned 1
	[0135.582] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe51310, ftCreationTime.dwHighDateTime=0x1d4cdbd, ftLastAccessTime.dwLowDateTime=0xe38d6d40, ftLastAccessTime.dwHighDateTime=0x1d4ca09, ftLastWriteTime.dwLowDateTime=0xe38d6d40, ftLastWriteTime.dwHighDateTime=0x1d4ca09, nFileSizeHigh=0x0, nFileSizeLow=0x124e6, dwReserved0=0x15, dwReserved1=0x1, cFileName="OQNITW9zaCCsfR.jpg", cAlternateFileName="OQNITW~1.JPG")) returned 1
	[0135.582] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.583] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="OQNITW9zaCCsfR.jpg") returned -1
	[0135.583] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="OQNITW9zaCCsfR.jpg") returned -1
	[0135.583] lstrcmpiA (lpString1="", lpString2="OQNITW9zaCCsfR.jpg") returned -1
	[0135.583] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\n-Bw0rDMdv 7_0.gif") returned="n-Bw0rDMdv 7_0.gif"
	[0135.583] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.583] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.583] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.583] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0x20
	[0135.583] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="OQNITW9zaCCsfR.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\OQNITW9zaCCsfR.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\OQNITW9zaCCsfR.jpg"
	[0135.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\OQNITW9zaCCsfR.jpg", pszSpec="*.zip") returned 0
	[0135.583] lstrlenA (lpString="*.zip") returned 5
	[0135.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\OQNITW9zaCCsfR.jpg", pszSpec="*.rar") returned 0
	[0135.583] lstrlenA (lpString="*.rar") returned 5
	[0135.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\OQNITW9zaCCsfR.jpg", pszSpec="*.7z") returned 0
	[0135.583] lstrlenA (lpString="*.7z") returned 4
	[0135.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\OQNITW9zaCCsfR.jpg", pszSpec="*.tar") returned 0
	[0135.583] lstrlenA (lpString="*.tar") returned 5
	[0135.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\OQNITW9zaCCsfR.jpg", pszSpec="*.gzip") returned 0
	[0135.583] lstrlenA (lpString="*.gzip") returned 6
	[0135.583] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\OQNITW9zaCCsfR.jpg", pszSpec="*.jpg") returned 1
	[0135.583] lstrlenA (lpString="*.jpg") returned 5
	[0135.583] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Pictures\\OQNITW9zaCCsfR.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\OQNITW9zaCCsfR.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\OQNITW9zaCCsfR.jpg"
	[0135.583] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Pictures\\OQNITW9zaCCsfR.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\OQNITW9zaCCsfR.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\OQNITW9zaCCsfR.jpg"
	[0135.583] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\OQNITW9zaCCsfR.jpg", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\OQNITW9zaCCsfR.jpg.") returned="C:\\Users\\FD1HVy\\Pictures\\OQNITW9zaCCsfR.jpg."
	[0135.583] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\OQNITW9zaCCsfR.jpg.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\OQNITW9zaCCsfR.jpg.exe") returned="C:\\Users\\FD1HVy\\Pictures\\OQNITW9zaCCsfR.jpg.exe"
	[0135.583] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\OQNITW9zaCCsfR.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\oqnitw9zaccsfr.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.584] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x124e6
	[0135.584] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9fe51310, dwHighDateTime=0x1d4cdbd), lpLastAccessTime=0x407536*(dwLowDateTime=0xe38d6d40, dwHighDateTime=0x1d4ca09), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe38d6d40, dwHighDateTime=0x1d4ca09)) returned 1
	[0135.584] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.584] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x124a4, lpOverlapped=0x0) returned 1
	[0135.585] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\OQNITW9zaCCsfR.jpg") returned="OQNITW9zaCCsfR.jpg"
	[0135.585] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.585] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x124a4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x124a4, lpOverlapped=0x0) returned 1
	[0135.586] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.586] CloseHandle (hObject=0x20c) returned 1
	[0135.586] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\OQNITW9zaCCsfR.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\oqnitw9zaccsfr.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\OQNITW9zaCCsfR.jpg.exe" (normalized: "c:\\users\\fd1hvy\\pictures\\oqnitw9zaccsfr.jpg.exe")) returned 1
	[0135.586] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a2e60, ftCreationTime.dwHighDateTime=0x1d4c9d5, ftLastAccessTime.dwLowDateTime=0x7a5ad3e0, ftLastAccessTime.dwHighDateTime=0x1d4c616, ftLastWriteTime.dwLowDateTime=0x7a5ad3e0, ftLastWriteTime.dwHighDateTime=0x1d4c616, nFileSizeHigh=0x0, nFileSizeLow=0x10aad, dwReserved0=0x15, dwReserved1=0x1, cFileName="oxu1oMWWMSiVsH.jpg", cAlternateFileName="OXU1OM~1.JPG")) returned 1
	[0135.587] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.587] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="oxu1oMWWMSiVsH.jpg") returned -1
	[0135.587] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="oxu1oMWWMSiVsH.jpg") returned -1
	[0135.587] lstrcmpiA (lpString1="", lpString2="oxu1oMWWMSiVsH.jpg") returned -1
	[0135.587] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\OQNITW9zaCCsfR.jpg") returned="OQNITW9zaCCsfR.jpg"
	[0135.587] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.587] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.587] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.587] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0x20
	[0135.587] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="oxu1oMWWMSiVsH.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\oxu1oMWWMSiVsH.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\oxu1oMWWMSiVsH.jpg"
	[0135.587] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\oxu1oMWWMSiVsH.jpg", pszSpec="*.zip") returned 0
	[0135.587] lstrlenA (lpString="*.zip") returned 5
	[0135.587] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\oxu1oMWWMSiVsH.jpg", pszSpec="*.rar") returned 0
	[0135.587] lstrlenA (lpString="*.rar") returned 5
	[0135.587] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\oxu1oMWWMSiVsH.jpg", pszSpec="*.7z") returned 0
	[0135.587] lstrlenA (lpString="*.7z") returned 4
	[0135.587] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\oxu1oMWWMSiVsH.jpg", pszSpec="*.tar") returned 0
	[0135.587] lstrlenA (lpString="*.tar") returned 5
	[0135.587] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\oxu1oMWWMSiVsH.jpg", pszSpec="*.gzip") returned 0
	[0135.587] lstrlenA (lpString="*.gzip") returned 6
	[0135.587] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\oxu1oMWWMSiVsH.jpg", pszSpec="*.jpg") returned 1
	[0135.587] lstrlenA (lpString="*.jpg") returned 5
	[0135.587] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Pictures\\oxu1oMWWMSiVsH.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\oxu1oMWWMSiVsH.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\oxu1oMWWMSiVsH.jpg"
	[0135.587] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Pictures\\oxu1oMWWMSiVsH.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\oxu1oMWWMSiVsH.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\oxu1oMWWMSiVsH.jpg"
	[0135.587] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\oxu1oMWWMSiVsH.jpg", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\oxu1oMWWMSiVsH.jpg.") returned="C:\\Users\\FD1HVy\\Pictures\\oxu1oMWWMSiVsH.jpg."
	[0135.587] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\oxu1oMWWMSiVsH.jpg.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\oxu1oMWWMSiVsH.jpg.exe") returned="C:\\Users\\FD1HVy\\Pictures\\oxu1oMWWMSiVsH.jpg.exe"
	[0135.587] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\oxu1oMWWMSiVsH.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\oxu1omwwmsivsh.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.588] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10aad
	[0135.588] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x777a2e60, dwHighDateTime=0x1d4c9d5), lpLastAccessTime=0x407536*(dwLowDateTime=0x7a5ad3e0, dwHighDateTime=0x1d4c616), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7a5ad3e0, dwHighDateTime=0x1d4c616)) returned 1
	[0135.588] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.588] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x10a6b, lpOverlapped=0x0) returned 1
	[0135.589] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\oxu1oMWWMSiVsH.jpg") returned="oxu1oMWWMSiVsH.jpg"
	[0135.589] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.589] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x10a6b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x10a6b, lpOverlapped=0x0) returned 1
	[0135.589] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.590] CloseHandle (hObject=0x20c) returned 1
	[0135.590] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\oxu1oMWWMSiVsH.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\oxu1omwwmsivsh.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\oxu1oMWWMSiVsH.jpg.exe" (normalized: "c:\\users\\fd1hvy\\pictures\\oxu1omwwmsivsh.jpg.exe")) returned 1
	[0135.590] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc508210, ftCreationTime.dwHighDateTime=0x1d4cd6b, ftLastAccessTime.dwLowDateTime=0xc541d7c0, ftLastAccessTime.dwHighDateTime=0x1d4ca2e, ftLastWriteTime.dwLowDateTime=0xc541d7c0, ftLastWriteTime.dwHighDateTime=0x1d4ca2e, nFileSizeHigh=0x0, nFileSizeLow=0x7dbb, dwReserved0=0x15, dwReserved1=0x1, cFileName="p6OSEX0QDXu0.bmp", cAlternateFileName="P6OSEX~1.BMP")) returned 1
	[0135.590] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.590] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="p6OSEX0QDXu0.bmp") returned -1
	[0135.590] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="p6OSEX0QDXu0.bmp") returned -1
	[0135.590] lstrcmpiA (lpString1="", lpString2="p6OSEX0QDXu0.bmp") returned -1
	[0135.590] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\oxu1oMWWMSiVsH.jpg") returned="oxu1oMWWMSiVsH.jpg"
	[0135.590] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.590] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.590] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.591] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0x20
	[0135.591] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="p6OSEX0QDXu0.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\p6OSEX0QDXu0.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\p6OSEX0QDXu0.bmp"
	[0135.591] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\p6OSEX0QDXu0.bmp", pszSpec="*.zip") returned 0
	[0135.591] lstrlenA (lpString="*.zip") returned 5
	[0135.591] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\p6OSEX0QDXu0.bmp", pszSpec="*.rar") returned 0
	[0135.591] lstrlenA (lpString="*.rar") returned 5
	[0135.591] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\p6OSEX0QDXu0.bmp", pszSpec="*.7z") returned 0
	[0135.591] lstrlenA (lpString="*.7z") returned 4
	[0135.591] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\p6OSEX0QDXu0.bmp", pszSpec="*.tar") returned 0
	[0135.591] lstrlenA (lpString="*.tar") returned 5
	[0135.591] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\p6OSEX0QDXu0.bmp", pszSpec="*.gzip") returned 0
	[0135.591] lstrlenA (lpString="*.gzip") returned 6
	[0135.591] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\p6OSEX0QDXu0.bmp", pszSpec="*.jpg") returned 0
	[0135.591] lstrlenA (lpString="*.jpg") returned 5
	[0135.591] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\p6OSEX0QDXu0.bmp", pszSpec="*.jpeg") returned 0
	[0135.591] lstrlenA (lpString="*.jpeg") returned 6
	[0135.591] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\p6OSEX0QDXu0.bmp", pszSpec="*.bmp") returned 1
	[0135.591] lstrlenA (lpString="*.bmp") returned 5
	[0135.591] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Pictures\\p6OSEX0QDXu0.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\p6OSEX0QDXu0.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\p6OSEX0QDXu0.bmp"
	[0135.591] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Pictures\\p6OSEX0QDXu0.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\p6OSEX0QDXu0.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\p6OSEX0QDXu0.bmp"
	[0135.591] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\p6OSEX0QDXu0.bmp", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\p6OSEX0QDXu0.bmp.") returned="C:\\Users\\FD1HVy\\Pictures\\p6OSEX0QDXu0.bmp."
	[0135.591] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\p6OSEX0QDXu0.bmp.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\p6OSEX0QDXu0.bmp.exe") returned="C:\\Users\\FD1HVy\\Pictures\\p6OSEX0QDXu0.bmp.exe"
	[0135.591] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\p6OSEX0QDXu0.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\p6osex0qdxu0.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.592] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7dbb
	[0135.592] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcc508210, dwHighDateTime=0x1d4cd6b), lpLastAccessTime=0x407536*(dwLowDateTime=0xc541d7c0, dwHighDateTime=0x1d4ca2e), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc541d7c0, dwHighDateTime=0x1d4ca2e)) returned 1
	[0135.592] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.592] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7d79, lpOverlapped=0x0) returned 1
	[0135.593] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\p6OSEX0QDXu0.bmp") returned="p6OSEX0QDXu0.bmp"
	[0135.593] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.593] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7d79, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7d79, lpOverlapped=0x0) returned 1
	[0135.593] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.593] CloseHandle (hObject=0x20c) returned 1
	[0135.593] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\p6OSEX0QDXu0.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\p6osex0qdxu0.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\p6OSEX0QDXu0.bmp.exe" (normalized: "c:\\users\\fd1hvy\\pictures\\p6osex0qdxu0.bmp.exe")) returned 1
	[0135.594] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cffbc20, ftCreationTime.dwHighDateTime=0x1d4ca0f, ftLastAccessTime.dwLowDateTime=0xc8f6ee00, ftLastAccessTime.dwHighDateTime=0x1d4cdf3, ftLastWriteTime.dwLowDateTime=0xc8f6ee00, ftLastWriteTime.dwHighDateTime=0x1d4cdf3, nFileSizeHigh=0x0, nFileSizeLow=0x2923, dwReserved0=0x15, dwReserved1=0x1, cFileName="PMUpJ.jpg", cAlternateFileName="")) returned 1
	[0135.594] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.594] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PMUpJ.jpg") returned -1
	[0135.594] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PMUpJ.jpg") returned -1
	[0135.594] lstrcmpiA (lpString1="", lpString2="PMUpJ.jpg") returned -1
	[0135.594] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\p6OSEX0QDXu0.bmp") returned="p6OSEX0QDXu0.bmp"
	[0135.594] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.594] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.594] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.594] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0x20
	[0135.594] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="PMUpJ.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\PMUpJ.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\PMUpJ.jpg"
	[0135.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\PMUpJ.jpg", pszSpec="*.zip") returned 0
	[0135.594] lstrlenA (lpString="*.zip") returned 5
	[0135.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\PMUpJ.jpg", pszSpec="*.rar") returned 0
	[0135.594] lstrlenA (lpString="*.rar") returned 5
	[0135.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\PMUpJ.jpg", pszSpec="*.7z") returned 0
	[0135.594] lstrlenA (lpString="*.7z") returned 4
	[0135.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\PMUpJ.jpg", pszSpec="*.tar") returned 0
	[0135.594] lstrlenA (lpString="*.tar") returned 5
	[0135.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\PMUpJ.jpg", pszSpec="*.gzip") returned 0
	[0135.594] lstrlenA (lpString="*.gzip") returned 6
	[0135.594] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\PMUpJ.jpg", pszSpec="*.jpg") returned 1
	[0135.595] lstrlenA (lpString="*.jpg") returned 5
	[0135.595] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Pictures\\PMUpJ.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\PMUpJ.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\PMUpJ.jpg"
	[0135.595] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Pictures\\PMUpJ.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\PMUpJ.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\PMUpJ.jpg"
	[0135.595] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\PMUpJ.jpg", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\PMUpJ.jpg.") returned="C:\\Users\\FD1HVy\\Pictures\\PMUpJ.jpg."
	[0135.595] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\PMUpJ.jpg.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\PMUpJ.jpg.exe") returned="C:\\Users\\FD1HVy\\Pictures\\PMUpJ.jpg.exe"
	[0135.595] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\PMUpJ.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\pmupj.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.595] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2923
	[0135.595] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3cffbc20, dwHighDateTime=0x1d4ca0f), lpLastAccessTime=0x407536*(dwLowDateTime=0xc8f6ee00, dwHighDateTime=0x1d4cdf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc8f6ee00, dwHighDateTime=0x1d4cdf3)) returned 1
	[0135.595] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.595] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x28e1, lpOverlapped=0x0) returned 1
	[0135.596] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\PMUpJ.jpg") returned="PMUpJ.jpg"
	[0135.596] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.596] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x28e1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x28e1, lpOverlapped=0x0) returned 1
	[0135.596] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.596] CloseHandle (hObject=0x20c) returned 1
	[0135.596] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\PMUpJ.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\pmupj.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\PMUpJ.jpg.exe" (normalized: "c:\\users\\fd1hvy\\pictures\\pmupj.jpg.exe")) returned 1
	[0135.597] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e1fe710, ftCreationTime.dwHighDateTime=0x1d4d1b4, ftLastAccessTime.dwLowDateTime=0x2c15a3b0, ftLastAccessTime.dwHighDateTime=0x1d4c74a, ftLastWriteTime.dwLowDateTime=0x2c15a3b0, ftLastWriteTime.dwHighDateTime=0x1d4c74a, nFileSizeHigh=0x0, nFileSizeLow=0x432a, dwReserved0=0x12, dwReserved1=0x1, cFileName="r-mDosQlW1S2JDE4H7G7.gif", cAlternateFileName="R-MDOS~1.GIF")) returned 1
	[0135.597] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.597] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="r-mDosQlW1S2JDE4H7G7.gif") returned -1
	[0135.597] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="r-mDosQlW1S2JDE4H7G7.gif") returned -1
	[0135.597] lstrcmpiA (lpString1="", lpString2="r-mDosQlW1S2JDE4H7G7.gif") returned -1
	[0135.597] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\PMUpJ.jpg") returned="PMUpJ.jpg"
	[0135.597] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.597] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.597] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.597] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0x20
	[0135.597] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="r-mDosQlW1S2JDE4H7G7.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\r-mDosQlW1S2JDE4H7G7.gif") returned="C:\\Users\\FD1HVy\\Pictures\\r-mDosQlW1S2JDE4H7G7.gif"
	[0135.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\r-mDosQlW1S2JDE4H7G7.gif", pszSpec="*.zip") returned 0
	[0135.597] lstrlenA (lpString="*.zip") returned 5
	[0135.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\r-mDosQlW1S2JDE4H7G7.gif", pszSpec="*.rar") returned 0
	[0135.597] lstrlenA (lpString="*.rar") returned 5
	[0135.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\r-mDosQlW1S2JDE4H7G7.gif", pszSpec="*.7z") returned 0
	[0135.597] lstrlenA (lpString="*.7z") returned 4
	[0135.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\r-mDosQlW1S2JDE4H7G7.gif", pszSpec="*.tar") returned 0
	[0135.597] lstrlenA (lpString="*.tar") returned 5
	[0135.597] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\r-mDosQlW1S2JDE4H7G7.gif", pszSpec="*.gzip") returned 0
	[0135.597] lstrlenA (lpString="*.gzip") returned 6
	[0135.598] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\r-mDosQlW1S2JDE4H7G7.gif", pszSpec="*.jpg") returned 0
	[0135.598] lstrlenA (lpString="*.jpg") returned 5
	[0135.598] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\r-mDosQlW1S2JDE4H7G7.gif", pszSpec="*.jpeg") returned 0
	[0135.598] lstrlenA (lpString="*.jpeg") returned 6
	[0135.598] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\r-mDosQlW1S2JDE4H7G7.gif", pszSpec="*.bmp") returned 0
	[0135.598] lstrlenA (lpString="*.bmp") returned 5
	[0135.598] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\r-mDosQlW1S2JDE4H7G7.gif", pszSpec="*.gif") returned 1
	[0135.598] lstrlenA (lpString="*.gif") returned 5
	[0135.598] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Pictures\\r-mDosQlW1S2JDE4H7G7.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\r-mDosQlW1S2JDE4H7G7.gif") returned="C:\\Users\\FD1HVy\\Pictures\\r-mDosQlW1S2JDE4H7G7.gif"
	[0135.598] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Pictures\\r-mDosQlW1S2JDE4H7G7.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\r-mDosQlW1S2JDE4H7G7.gif") returned="C:\\Users\\FD1HVy\\Pictures\\r-mDosQlW1S2JDE4H7G7.gif"
	[0135.598] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\r-mDosQlW1S2JDE4H7G7.gif", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\r-mDosQlW1S2JDE4H7G7.gif.") returned="C:\\Users\\FD1HVy\\Pictures\\r-mDosQlW1S2JDE4H7G7.gif."
	[0135.598] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\r-mDosQlW1S2JDE4H7G7.gif.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\r-mDosQlW1S2JDE4H7G7.gif.exe") returned="C:\\Users\\FD1HVy\\Pictures\\r-mDosQlW1S2JDE4H7G7.gif.exe"
	[0135.598] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\r-mDosQlW1S2JDE4H7G7.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\r-mdosqlw1s2jde4h7g7.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.598] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x432a
	[0135.598] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6e1fe710, dwHighDateTime=0x1d4d1b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x2c15a3b0, dwHighDateTime=0x1d4c74a), lpLastWriteTime=0x40753e*(dwLowDateTime=0x2c15a3b0, dwHighDateTime=0x1d4c74a)) returned 1
	[0135.598] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.598] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x42e8, lpOverlapped=0x0) returned 1
	[0135.599] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\r-mDosQlW1S2JDE4H7G7.gif") returned="r-mDosQlW1S2JDE4H7G7.gif"
	[0135.599] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.599] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x42e8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x42e8, lpOverlapped=0x0) returned 1
	[0135.599] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.600] CloseHandle (hObject=0x20c) returned 1
	[0135.600] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\r-mDosQlW1S2JDE4H7G7.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\r-mdosqlw1s2jde4h7g7.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\r-mDosQlW1S2JDE4H7G7.gif.exe" (normalized: "c:\\users\\fd1hvy\\pictures\\r-mdosqlw1s2jde4h7g7.gif.exe")) returned 1
	[0135.600] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda580120, ftCreationTime.dwHighDateTime=0x1d4c826, ftLastAccessTime.dwLowDateTime=0xfb4be630, ftLastAccessTime.dwHighDateTime=0x1d4d429, ftLastWriteTime.dwLowDateTime=0xfb4be630, ftLastWriteTime.dwHighDateTime=0x1d4d429, nFileSizeHigh=0x0, nFileSizeLow=0x7b2a, dwReserved0=0x1f, dwReserved1=0x1, cFileName="rtiDr1nEn64E_ktx8_Y.png", cAlternateFileName="RTIDR1~1.PNG")) returned 1
	[0135.600] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.600] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="rtiDr1nEn64E_ktx8_Y.png") returned -1
	[0135.600] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="rtiDr1nEn64E_ktx8_Y.png") returned -1
	[0135.600] lstrcmpiA (lpString1="", lpString2="rtiDr1nEn64E_ktx8_Y.png") returned -1
	[0135.600] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\r-mDosQlW1S2JDE4H7G7.gif") returned="r-mDosQlW1S2JDE4H7G7.gif"
	[0135.600] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.600] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.600] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.600] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0x20
	[0135.601] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="rtiDr1nEn64E_ktx8_Y.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\rtiDr1nEn64E_ktx8_Y.png") returned="C:\\Users\\FD1HVy\\Pictures\\rtiDr1nEn64E_ktx8_Y.png"
	[0135.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\rtiDr1nEn64E_ktx8_Y.png", pszSpec="*.zip") returned 0
	[0135.601] lstrlenA (lpString="*.zip") returned 5
	[0135.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\rtiDr1nEn64E_ktx8_Y.png", pszSpec="*.rar") returned 0
	[0135.601] lstrlenA (lpString="*.rar") returned 5
	[0135.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\rtiDr1nEn64E_ktx8_Y.png", pszSpec="*.7z") returned 0
	[0135.601] lstrlenA (lpString="*.7z") returned 4
	[0135.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\rtiDr1nEn64E_ktx8_Y.png", pszSpec="*.tar") returned 0
	[0135.601] lstrlenA (lpString="*.tar") returned 5
	[0135.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\rtiDr1nEn64E_ktx8_Y.png", pszSpec="*.gzip") returned 0
	[0135.601] lstrlenA (lpString="*.gzip") returned 6
	[0135.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\rtiDr1nEn64E_ktx8_Y.png", pszSpec="*.jpg") returned 0
	[0135.601] lstrlenA (lpString="*.jpg") returned 5
	[0135.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\rtiDr1nEn64E_ktx8_Y.png", pszSpec="*.jpeg") returned 0
	[0135.601] lstrlenA (lpString="*.jpeg") returned 6
	[0135.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\rtiDr1nEn64E_ktx8_Y.png", pszSpec="*.bmp") returned 0
	[0135.601] lstrlenA (lpString="*.bmp") returned 5
	[0135.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\rtiDr1nEn64E_ktx8_Y.png", pszSpec="*.gif") returned 0
	[0135.601] lstrlenA (lpString="*.gif") returned 5
	[0135.601] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\rtiDr1nEn64E_ktx8_Y.png", pszSpec="*.png") returned 1
	[0135.602] lstrlenA (lpString="*.png") returned 5
	[0135.602] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Pictures\\rtiDr1nEn64E_ktx8_Y.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\rtiDr1nEn64E_ktx8_Y.png") returned="C:\\Users\\FD1HVy\\Pictures\\rtiDr1nEn64E_ktx8_Y.png"
	[0135.602] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Pictures\\rtiDr1nEn64E_ktx8_Y.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\rtiDr1nEn64E_ktx8_Y.png") returned="C:\\Users\\FD1HVy\\Pictures\\rtiDr1nEn64E_ktx8_Y.png"
	[0135.602] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\rtiDr1nEn64E_ktx8_Y.png", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\rtiDr1nEn64E_ktx8_Y.png.") returned="C:\\Users\\FD1HVy\\Pictures\\rtiDr1nEn64E_ktx8_Y.png."
	[0135.602] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\rtiDr1nEn64E_ktx8_Y.png.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\rtiDr1nEn64E_ktx8_Y.png.exe") returned="C:\\Users\\FD1HVy\\Pictures\\rtiDr1nEn64E_ktx8_Y.png.exe"
	[0135.602] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\rtiDr1nEn64E_ktx8_Y.png" (normalized: "c:\\users\\fd1hvy\\pictures\\rtidr1nen64e_ktx8_y.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.602] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7b2a
	[0135.602] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xda580120, dwHighDateTime=0x1d4c826), lpLastAccessTime=0x407536*(dwLowDateTime=0xfb4be630, dwHighDateTime=0x1d4d429), lpLastWriteTime=0x40753e*(dwLowDateTime=0xfb4be630, dwHighDateTime=0x1d4d429)) returned 1
	[0135.602] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.602] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7ae8, lpOverlapped=0x0) returned 1
	[0135.603] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\rtiDr1nEn64E_ktx8_Y.png") returned="rtiDr1nEn64E_ktx8_Y.png"
	[0135.603] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.603] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7ae8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7ae8, lpOverlapped=0x0) returned 1
	[0135.603] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.603] CloseHandle (hObject=0x20c) returned 1
	[0135.604] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\rtiDr1nEn64E_ktx8_Y.png" (normalized: "c:\\users\\fd1hvy\\pictures\\rtidr1nen64e_ktx8_y.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\rtiDr1nEn64E_ktx8_Y.png.exe" (normalized: "c:\\users\\fd1hvy\\pictures\\rtidr1nen64e_ktx8_y.png.exe")) returned 1
	[0135.604] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a439960, ftCreationTime.dwHighDateTime=0x1d4c6a0, ftLastAccessTime.dwLowDateTime=0x50a8a3c0, ftLastAccessTime.dwHighDateTime=0x1d4cb92, ftLastWriteTime.dwLowDateTime=0x50a8a3c0, ftLastWriteTime.dwHighDateTime=0x1d4cb92, nFileSizeHigh=0x0, nFileSizeLow=0x18e1, dwReserved0=0x0, dwReserved1=0x1, cFileName="S Pkp9uyQrDf0s3WlPx.jpg", cAlternateFileName="SPKP9U~1.JPG")) returned 1
	[0135.604] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.604] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="S Pkp9uyQrDf0s3WlPx.jpg") returned -1
	[0135.604] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="S Pkp9uyQrDf0s3WlPx.jpg") returned -1
	[0135.604] lstrcmpiA (lpString1="", lpString2="S Pkp9uyQrDf0s3WlPx.jpg") returned -1
	[0135.604] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\rtiDr1nEn64E_ktx8_Y.png") returned="rtiDr1nEn64E_ktx8_Y.png"
	[0135.604] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.604] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.604] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.604] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0x20
	[0135.605] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="S Pkp9uyQrDf0s3WlPx.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\S Pkp9uyQrDf0s3WlPx.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\S Pkp9uyQrDf0s3WlPx.jpg"
	[0135.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\S Pkp9uyQrDf0s3WlPx.jpg", pszSpec="*.zip") returned 0
	[0135.605] lstrlenA (lpString="*.zip") returned 5
	[0135.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\S Pkp9uyQrDf0s3WlPx.jpg", pszSpec="*.rar") returned 0
	[0135.605] lstrlenA (lpString="*.rar") returned 5
	[0135.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\S Pkp9uyQrDf0s3WlPx.jpg", pszSpec="*.7z") returned 0
	[0135.605] lstrlenA (lpString="*.7z") returned 4
	[0135.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\S Pkp9uyQrDf0s3WlPx.jpg", pszSpec="*.tar") returned 0
	[0135.605] lstrlenA (lpString="*.tar") returned 5
	[0135.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\S Pkp9uyQrDf0s3WlPx.jpg", pszSpec="*.gzip") returned 0
	[0135.605] lstrlenA (lpString="*.gzip") returned 6
	[0135.605] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\S Pkp9uyQrDf0s3WlPx.jpg", pszSpec="*.jpg") returned 1
	[0135.605] lstrlenA (lpString="*.jpg") returned 5
	[0135.605] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Pictures\\S Pkp9uyQrDf0s3WlPx.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\S Pkp9uyQrDf0s3WlPx.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\S Pkp9uyQrDf0s3WlPx.jpg"
	[0135.605] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Pictures\\S Pkp9uyQrDf0s3WlPx.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\S Pkp9uyQrDf0s3WlPx.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\S Pkp9uyQrDf0s3WlPx.jpg"
	[0135.605] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\S Pkp9uyQrDf0s3WlPx.jpg", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\S Pkp9uyQrDf0s3WlPx.jpg.") returned="C:\\Users\\FD1HVy\\Pictures\\S Pkp9uyQrDf0s3WlPx.jpg."
	[0135.605] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\S Pkp9uyQrDf0s3WlPx.jpg.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\S Pkp9uyQrDf0s3WlPx.jpg.exe") returned="C:\\Users\\FD1HVy\\Pictures\\S Pkp9uyQrDf0s3WlPx.jpg.exe"
	[0135.605] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\S Pkp9uyQrDf0s3WlPx.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\s pkp9uyqrdf0s3wlpx.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.605] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18e1
	[0135.605] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8a439960, dwHighDateTime=0x1d4c6a0), lpLastAccessTime=0x407536*(dwLowDateTime=0x50a8a3c0, dwHighDateTime=0x1d4cb92), lpLastWriteTime=0x40753e*(dwLowDateTime=0x50a8a3c0, dwHighDateTime=0x1d4cb92)) returned 1
	[0135.605] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.605] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x189f, lpOverlapped=0x0) returned 1
	[0135.606] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\S Pkp9uyQrDf0s3WlPx.jpg") returned="S Pkp9uyQrDf0s3WlPx.jpg"
	[0135.606] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.606] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x189f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x189f, lpOverlapped=0x0) returned 1
	[0135.606] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.629] CloseHandle (hObject=0x20c) returned 1
	[0135.629] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\S Pkp9uyQrDf0s3WlPx.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\s pkp9uyqrdf0s3wlpx.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\S Pkp9uyQrDf0s3WlPx.jpg.exe" (normalized: "c:\\users\\fd1hvy\\pictures\\s pkp9uyqrdf0s3wlpx.jpg.exe")) returned 1
	[0135.629] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1
	[0135.630] lstrcmpA (lpString1=".", lpString2="Saved Pictures") returned -1
	[0135.630] lstrcmpA (lpString1="..", lpString2="Saved Pictures") returned -1
	[0135.630] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\S Pkp9uyQrDf0s3WlPx.jpg") returned="S Pkp9uyQrDf0s3WlPx.jpg"
	[0135.630] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Saved Pictures" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures") returned="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures"
	[0135.630] lstrlenA (lpString="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures") returned 39
	[0135.630] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName=".", cAlternateFileName="")) returned 0x7cb5d0
	[0135.630] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0135.630] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="..", cAlternateFileName="")) returned 1
	[0135.630] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0135.630] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0135.630] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0135.630] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0135.630] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="desktop.ini") returned 1
	[0135.630] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="desktop.ini") returned 1
	[0135.630] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1
	[0135.630] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*.*") returned="*.*"
	[0135.630] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\"
	[0135.630] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\") returned=""
	[0135.630] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.630] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0135.630] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0135.631] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0135.631] WriteFile (in: hFile=0x210, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0135.632] SetFileTime (hFile=0x210, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0135.632] CloseHandle (hObject=0x210) returned 1
	[0135.632] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini") returned="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini"
	[0135.632] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.zip") returned 0
	[0135.632] lstrlenA (lpString="*.zip") returned 5
	[0135.632] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.rar") returned 0
	[0135.632] lstrlenA (lpString="*.rar") returned 5
	[0135.632] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.7z") returned 0
	[0135.632] lstrlenA (lpString="*.7z") returned 4
	[0135.632] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.tar") returned 0
	[0135.632] lstrlenA (lpString="*.tar") returned 5
	[0135.632] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.gzip") returned 0
	[0135.632] lstrlenA (lpString="*.gzip") returned 6
	[0135.632] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.jpg") returned 0
	[0135.632] lstrlenA (lpString="*.jpg") returned 5
	[0135.632] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.jpeg") returned 0
	[0135.632] lstrlenA (lpString="*.jpeg") returned 6
	[0135.632] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.bmp") returned 0
	[0135.633] lstrlenA (lpString="*.bmp") returned 5
	[0135.633] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.gif") returned 0
	[0135.633] lstrlenA (lpString="*.gif") returned 5
	[0135.633] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.png") returned 0
	[0135.633] lstrlenA (lpString="*.png") returned 5
	[0135.633] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.doc") returned 0
	[0135.633] lstrlenA (lpString="*.doc") returned 5
	[0135.633] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.docx") returned 0
	[0135.633] lstrlenA (lpString="*.docx") returned 6
	[0135.633] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.xls") returned 0
	[0135.633] lstrlenA (lpString="*.xls") returned 5
	[0135.633] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.xlsx") returned 0
	[0135.633] lstrlenA (lpString="*.xlsx") returned 6
	[0135.633] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.ppt") returned 0
	[0135.633] lstrlenA (lpString="*.ppt") returned 5
	[0135.633] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.pptx") returned 0
	[0135.633] lstrlenA (lpString="*.pptx") returned 6
	[0135.633] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.txt") returned 0
	[0135.633] lstrlenA (lpString="*.txt") returned 5
	[0135.633] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.pdf") returned 0
	[0135.633] lstrlenA (lpString="*.pdf") returned 5
	[0135.633] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.htm") returned 0
	[0135.633] lstrlenA (lpString="*.htm") returned 5
	[0135.633] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.html") returned 0
	[0135.633] lstrlenA (lpString="*.html") returned 6
	[0135.633] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.mdb") returned 0
	[0135.633] lstrlenA (lpString="*.mdb") returned 5
	[0135.633] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.pfx") returned 0
	[0135.633] lstrlenA (lpString="*.pfx") returned 5
	[0135.633] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.md") returned 0
	[0135.633] lstrlenA (lpString="*.md") returned 4
	[0135.633] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.lnk") returned 0
	[0135.633] lstrlenA (lpString="*.lnk") returned 5
	[0135.633] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.torrent") returned 0
	[0135.634] lstrlenA (lpString="*.torrent") returned 9
	[0135.634] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.mov") returned 0
	[0135.634] lstrlenA (lpString="*.mov") returned 5
	[0135.634] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.3gp") returned 0
	[0135.634] lstrlenA (lpString="*.3gp") returned 5
	[0135.634] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.mpeg") returned 0
	[0135.634] lstrlenA (lpString="*.mpeg") returned 6
	[0135.634] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.mpg") returned 0
	[0135.634] lstrlenA (lpString="*.mpg") returned 5
	[0135.634] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.flv") returned 0
	[0135.634] lstrlenA (lpString="*.flv") returned 5
	[0135.634] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.avi") returned 0
	[0135.634] lstrlenA (lpString="*.avi") returned 5
	[0135.634] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.mp4") returned 0
	[0135.634] lstrlenA (lpString="*.mp4") returned 5
	[0135.634] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.wmv") returned 0
	[0135.634] lstrlenA (lpString="*.wmv") returned 5
	[0135.634] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.mkv") returned 0
	[0135.634] lstrlenA (lpString="*.mkv") returned 5
	[0135.634] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.mp3") returned 0
	[0135.634] lstrlenA (lpString="*.mp3") returned 5
	[0135.634] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.wav") returned 0
	[0135.634] lstrlenA (lpString="*.wav") returned 5
	[0135.634] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.flac") returned 0
	[0135.634] lstrlenA (lpString="*.flac") returned 6
	[0135.634] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.wma") returned 0
	[0135.634] lstrlenA (lpString="*.wma") returned 5
	[0135.634] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.au3") returned 0
	[0135.634] lstrlenA (lpString="*.au3") returned 5
	[0135.634] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.ahk") returned 0
	[0135.634] lstrlenA (lpString="*.ahk") returned 5
	[0135.634] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.c") returned 0
	[0135.634] lstrlenA (lpString="*.c") returned 3
	[0135.634] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.cc") returned 0
	[0135.635] lstrlenA (lpString="*.cc") returned 4
	[0135.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.cpp") returned 0
	[0135.635] lstrlenA (lpString="*.cpp") returned 5
	[0135.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.cxx") returned 0
	[0135.635] lstrlenA (lpString="*.cxx") returned 5
	[0135.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.c++") returned 0
	[0135.635] lstrlenA (lpString="*.c++") returned 5
	[0135.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.cs") returned 0
	[0135.635] lstrlenA (lpString="*.cs") returned 4
	[0135.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.vb") returned 0
	[0135.635] lstrlenA (lpString="*.vb") returned 4
	[0135.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.bas") returned 0
	[0135.635] lstrlenA (lpString="*.bas") returned 5
	[0135.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.csproj") returned 0
	[0135.635] lstrlenA (lpString="*.csproj") returned 8
	[0135.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.vbproj") returned 0
	[0135.635] lstrlenA (lpString="*.vbproj") returned 8
	[0135.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.vcxproj") returned 0
	[0135.635] lstrlenA (lpString="*.vcxproj") returned 9
	[0135.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.manifest") returned 0
	[0135.635] lstrlenA (lpString="*.manifest") returned 10
	[0135.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.php") returned 0
	[0135.635] lstrlenA (lpString="*.php") returned 5
	[0135.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.vbe") returned 0
	[0135.635] lstrlenA (lpString="*.vbe") returned 5
	[0135.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.vba") returned 0
	[0135.635] lstrlenA (lpString="*.vba") returned 5
	[0135.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.vbs") returned 0
	[0135.635] lstrlenA (lpString="*.vbs") returned 5
	[0135.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.bat") returned 0
	[0135.635] lstrlenA (lpString="*.bat") returned 5
	[0135.635] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.cmd") returned 0
	[0135.635] lstrlenA (lpString="*.cmd") returned 5
	[0135.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.js") returned 0
	[0135.636] lstrlenA (lpString="*.js") returned 4
	[0135.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.jscript") returned 0
	[0135.636] lstrlenA (lpString="*.jscript") returned 9
	[0135.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.hta") returned 0
	[0135.636] lstrlenA (lpString="*.hta") returned 5
	[0135.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.php7") returned 0
	[0135.636] lstrlenA (lpString="*.php7") returned 6
	[0135.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.db") returned 0
	[0135.636] lstrlenA (lpString="*.db") returned 4
	[0135.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.swf") returned 0
	[0135.636] lstrlenA (lpString="*.swf") returned 5
	[0135.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.eml") returned 0
	[0135.636] lstrlenA (lpString="*.eml") returned 5
	[0135.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.part") returned 0
	[0135.636] lstrlenA (lpString="*.part") returned 6
	[0135.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.nfo") returned 0
	[0135.636] lstrlenA (lpString="*.nfo") returned 5
	[0135.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.rsa") returned 0
	[0135.636] lstrlenA (lpString="*.rsa") returned 5
	[0135.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.key") returned 0
	[0135.636] lstrlenA (lpString="*.key") returned 5
	[0135.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.aes") returned 0
	[0135.636] lstrlenA (lpString="*.aes") returned 5
	[0135.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.blob") returned 0
	[0135.636] lstrlenA (lpString="*.blob") returned 6
	[0135.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.btc") returned 0
	[0135.636] lstrlenA (lpString="*.btc") returned 5
	[0135.636] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", pszSpec="*.wallet") returned 0
	[0135.636] lstrlenA (lpString="*.wallet") returned 8
	[0135.636] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0135.636] FindClose (in: hFindFile=0x7cb5d0 | out: hFindFile=0x7cb5d0) returned 1
	[0135.636] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3242b00, ftCreationTime.dwHighDateTime=0x1d4cf8a, ftLastAccessTime.dwLowDateTime=0x822c6df0, ftLastAccessTime.dwHighDateTime=0x1d4d2f4, ftLastWriteTime.dwLowDateTime=0x822c6df0, ftLastWriteTime.dwHighDateTime=0x1d4d2f4, nFileSizeHigh=0x0, nFileSizeLow=0xaa4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="srVI38zQLI.bmp", cAlternateFileName="SRVI38~1.BMP")) returned 1
	[0135.637] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.637] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="srVI38zQLI.bmp") returned -1
	[0135.637] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="srVI38zQLI.bmp") returned -1
	[0135.637] lstrcmpiA (lpString1="", lpString2="srVI38zQLI.bmp") returned -1
	[0135.637] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\*.*") returned="*.*"
	[0135.637] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.637] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.637] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.637] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0x20
	[0135.637] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="srVI38zQLI.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\srVI38zQLI.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\srVI38zQLI.bmp"
	[0135.637] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\srVI38zQLI.bmp", pszSpec="*.zip") returned 0
	[0135.637] lstrlenA (lpString="*.zip") returned 5
	[0135.637] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\srVI38zQLI.bmp", pszSpec="*.rar") returned 0
	[0135.637] lstrlenA (lpString="*.rar") returned 5
	[0135.637] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\srVI38zQLI.bmp", pszSpec="*.7z") returned 0
	[0135.637] lstrlenA (lpString="*.7z") returned 4
	[0135.637] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\srVI38zQLI.bmp", pszSpec="*.tar") returned 0
	[0135.637] lstrlenA (lpString="*.tar") returned 5
	[0135.637] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\srVI38zQLI.bmp", pszSpec="*.gzip") returned 0
	[0135.637] lstrlenA (lpString="*.gzip") returned 6
	[0135.637] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\srVI38zQLI.bmp", pszSpec="*.jpg") returned 0
	[0135.637] lstrlenA (lpString="*.jpg") returned 5
	[0135.637] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\srVI38zQLI.bmp", pszSpec="*.jpeg") returned 0
	[0135.637] lstrlenA (lpString="*.jpeg") returned 6
	[0135.637] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\srVI38zQLI.bmp", pszSpec="*.bmp") returned 1
	[0135.637] lstrlenA (lpString="*.bmp") returned 5
	[0135.637] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Pictures\\srVI38zQLI.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\srVI38zQLI.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\srVI38zQLI.bmp"
	[0135.637] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Pictures\\srVI38zQLI.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\srVI38zQLI.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\srVI38zQLI.bmp"
	[0135.637] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\srVI38zQLI.bmp", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\srVI38zQLI.bmp.") returned="C:\\Users\\FD1HVy\\Pictures\\srVI38zQLI.bmp."
	[0135.637] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\srVI38zQLI.bmp.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\srVI38zQLI.bmp.exe") returned="C:\\Users\\FD1HVy\\Pictures\\srVI38zQLI.bmp.exe"
	[0135.637] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\srVI38zQLI.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\srvi38zqli.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.638] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaa4b
	[0135.638] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa3242b00, dwHighDateTime=0x1d4cf8a), lpLastAccessTime=0x407536*(dwLowDateTime=0x822c6df0, dwHighDateTime=0x1d4d2f4), lpLastWriteTime=0x40753e*(dwLowDateTime=0x822c6df0, dwHighDateTime=0x1d4d2f4)) returned 1
	[0135.638] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.638] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xaa09, lpOverlapped=0x0) returned 1
	[0135.639] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\srVI38zQLI.bmp") returned="srVI38zQLI.bmp"
	[0135.639] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.639] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xaa09, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xaa09, lpOverlapped=0x0) returned 1
	[0135.639] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.639] CloseHandle (hObject=0x20c) returned 1
	[0135.639] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\srVI38zQLI.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\srvi38zqli.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\srVI38zQLI.bmp.exe" (normalized: "c:\\users\\fd1hvy\\pictures\\srvi38zqli.bmp.exe")) returned 1
	[0135.640] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x920ec140, ftCreationTime.dwHighDateTime=0x1d4d5e3, ftLastAccessTime.dwLowDateTime=0x7d220c90, ftLastAccessTime.dwHighDateTime=0x1d4c8bb, ftLastWriteTime.dwLowDateTime=0x7d220c90, ftLastWriteTime.dwHighDateTime=0x1d4c8bb, nFileSizeHigh=0x0, nFileSizeLow=0xfdec, dwReserved0=0x12, dwReserved1=0x1, cFileName="t6hAveG7.gif", cAlternateFileName="")) returned 1
	[0135.640] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.640] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="t6hAveG7.gif") returned -1
	[0135.640] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="t6hAveG7.gif") returned -1
	[0135.640] lstrcmpiA (lpString1="", lpString2="t6hAveG7.gif") returned -1
	[0135.640] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\srVI38zQLI.bmp") returned="srVI38zQLI.bmp"
	[0135.640] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.640] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.640] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.640] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0x20
	[0135.640] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="t6hAveG7.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\t6hAveG7.gif") returned="C:\\Users\\FD1HVy\\Pictures\\t6hAveG7.gif"
	[0135.640] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\t6hAveG7.gif", pszSpec="*.zip") returned 0
	[0135.640] lstrlenA (lpString="*.zip") returned 5
	[0135.641] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\t6hAveG7.gif", pszSpec="*.rar") returned 0
	[0135.641] lstrlenA (lpString="*.rar") returned 5
	[0135.641] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\t6hAveG7.gif", pszSpec="*.7z") returned 0
	[0135.641] lstrlenA (lpString="*.7z") returned 4
	[0135.641] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\t6hAveG7.gif", pszSpec="*.tar") returned 0
	[0135.641] lstrlenA (lpString="*.tar") returned 5
	[0135.641] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\t6hAveG7.gif", pszSpec="*.gzip") returned 0
	[0135.641] lstrlenA (lpString="*.gzip") returned 6
	[0135.641] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\t6hAveG7.gif", pszSpec="*.jpg") returned 0
	[0135.641] lstrlenA (lpString="*.jpg") returned 5
	[0135.641] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\t6hAveG7.gif", pszSpec="*.jpeg") returned 0
	[0135.641] lstrlenA (lpString="*.jpeg") returned 6
	[0135.641] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\t6hAveG7.gif", pszSpec="*.bmp") returned 0
	[0135.641] lstrlenA (lpString="*.bmp") returned 5
	[0135.641] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\t6hAveG7.gif", pszSpec="*.gif") returned 1
	[0135.641] lstrlenA (lpString="*.gif") returned 5
	[0135.641] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Pictures\\t6hAveG7.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\t6hAveG7.gif") returned="C:\\Users\\FD1HVy\\Pictures\\t6hAveG7.gif"
	[0135.641] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Pictures\\t6hAveG7.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\t6hAveG7.gif") returned="C:\\Users\\FD1HVy\\Pictures\\t6hAveG7.gif"
	[0135.641] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\t6hAveG7.gif", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\t6hAveG7.gif.") returned="C:\\Users\\FD1HVy\\Pictures\\t6hAveG7.gif."
	[0135.641] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\t6hAveG7.gif.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\t6hAveG7.gif.exe") returned="C:\\Users\\FD1HVy\\Pictures\\t6hAveG7.gif.exe"
	[0135.641] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\t6hAveG7.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\t6haveg7.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.641] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfdec
	[0135.641] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x920ec140, dwHighDateTime=0x1d4d5e3), lpLastAccessTime=0x407536*(dwLowDateTime=0x7d220c90, dwHighDateTime=0x1d4c8bb), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7d220c90, dwHighDateTime=0x1d4c8bb)) returned 1
	[0135.641] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.642] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xfdaa, lpOverlapped=0x0) returned 1
	[0135.643] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\t6hAveG7.gif") returned="t6hAveG7.gif"
	[0135.643] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.643] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xfdaa, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xfdaa, lpOverlapped=0x0) returned 1
	[0135.643] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.643] CloseHandle (hObject=0x20c) returned 1
	[0135.643] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\t6hAveG7.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\t6haveg7.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\t6hAveG7.gif.exe" (normalized: "c:\\users\\fd1hvy\\pictures\\t6haveg7.gif.exe")) returned 1
	[0135.644] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d213a0, ftCreationTime.dwHighDateTime=0x1d4c9ec, ftLastAccessTime.dwLowDateTime=0xe6d795a0, ftLastAccessTime.dwHighDateTime=0x1d4c94d, ftLastWriteTime.dwLowDateTime=0xe6d795a0, ftLastWriteTime.dwHighDateTime=0x1d4c94d, nFileSizeHigh=0x0, nFileSizeLow=0x15f8c, dwReserved0=0x12, dwReserved1=0x1, cFileName="ThfkqOaJnX.png", cAlternateFileName="THFKQO~1.PNG")) returned 1
	[0135.644] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.644] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="ThfkqOaJnX.png") returned -1
	[0135.644] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="ThfkqOaJnX.png") returned -1
	[0135.644] lstrcmpiA (lpString1="", lpString2="ThfkqOaJnX.png") returned -1
	[0135.644] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\t6hAveG7.gif") returned="t6hAveG7.gif"
	[0135.644] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.644] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.644] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.644] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0x20
	[0135.644] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="ThfkqOaJnX.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\ThfkqOaJnX.png") returned="C:\\Users\\FD1HVy\\Pictures\\ThfkqOaJnX.png"
	[0135.644] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\ThfkqOaJnX.png", pszSpec="*.zip") returned 0
	[0135.644] lstrlenA (lpString="*.zip") returned 5
	[0135.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\ThfkqOaJnX.png", pszSpec="*.rar") returned 0
	[0135.645] lstrlenA (lpString="*.rar") returned 5
	[0135.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\ThfkqOaJnX.png", pszSpec="*.7z") returned 0
	[0135.645] lstrlenA (lpString="*.7z") returned 4
	[0135.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\ThfkqOaJnX.png", pszSpec="*.tar") returned 0
	[0135.645] lstrlenA (lpString="*.tar") returned 5
	[0135.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\ThfkqOaJnX.png", pszSpec="*.gzip") returned 0
	[0135.645] lstrlenA (lpString="*.gzip") returned 6
	[0135.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\ThfkqOaJnX.png", pszSpec="*.jpg") returned 0
	[0135.645] lstrlenA (lpString="*.jpg") returned 5
	[0135.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\ThfkqOaJnX.png", pszSpec="*.jpeg") returned 0
	[0135.645] lstrlenA (lpString="*.jpeg") returned 6
	[0135.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\ThfkqOaJnX.png", pszSpec="*.bmp") returned 0
	[0135.645] lstrlenA (lpString="*.bmp") returned 5
	[0135.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\ThfkqOaJnX.png", pszSpec="*.gif") returned 0
	[0135.645] lstrlenA (lpString="*.gif") returned 5
	[0135.645] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\ThfkqOaJnX.png", pszSpec="*.png") returned 1
	[0135.645] lstrlenA (lpString="*.png") returned 5
	[0135.645] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Pictures\\ThfkqOaJnX.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\ThfkqOaJnX.png") returned="C:\\Users\\FD1HVy\\Pictures\\ThfkqOaJnX.png"
	[0135.645] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Pictures\\ThfkqOaJnX.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\ThfkqOaJnX.png") returned="C:\\Users\\FD1HVy\\Pictures\\ThfkqOaJnX.png"
	[0135.645] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\ThfkqOaJnX.png", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\ThfkqOaJnX.png.") returned="C:\\Users\\FD1HVy\\Pictures\\ThfkqOaJnX.png."
	[0135.645] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\ThfkqOaJnX.png.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\ThfkqOaJnX.png.exe") returned="C:\\Users\\FD1HVy\\Pictures\\ThfkqOaJnX.png.exe"
	[0135.645] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ThfkqOaJnX.png" (normalized: "c:\\users\\fd1hvy\\pictures\\thfkqoajnx.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.645] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15f8c
	[0135.646] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x56d213a0, dwHighDateTime=0x1d4c9ec), lpLastAccessTime=0x407536*(dwLowDateTime=0xe6d795a0, dwHighDateTime=0x1d4c94d), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe6d795a0, dwHighDateTime=0x1d4c94d)) returned 1
	[0135.646] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.646] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x15f4a, lpOverlapped=0x0) returned 1
	[0135.647] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\ThfkqOaJnX.png") returned="ThfkqOaJnX.png"
	[0135.647] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.647] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x15f4a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x15f4a, lpOverlapped=0x0) returned 1
	[0135.647] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.648] CloseHandle (hObject=0x20c) returned 1
	[0135.648] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\ThfkqOaJnX.png" (normalized: "c:\\users\\fd1hvy\\pictures\\thfkqoajnx.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\ThfkqOaJnX.png.exe" (normalized: "c:\\users\\fd1hvy\\pictures\\thfkqoajnx.png.exe")) returned 1
	[0135.649] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc32047b0, ftCreationTime.dwHighDateTime=0x1d4cb28, ftLastAccessTime.dwLowDateTime=0xd72718d0, ftLastAccessTime.dwHighDateTime=0x1d4c8b0, ftLastWriteTime.dwLowDateTime=0xd72718d0, ftLastWriteTime.dwHighDateTime=0x1d4c8b0, nFileSizeHigh=0x0, nFileSizeLow=0x361d, dwReserved0=0x12, dwReserved1=0x1, cFileName="Tm7X0ZWsRnwHit.jpg", cAlternateFileName="TM7X0Z~1.JPG")) returned 1
	[0135.649] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.649] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Tm7X0ZWsRnwHit.jpg") returned -1
	[0135.649] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Tm7X0ZWsRnwHit.jpg") returned -1
	[0135.649] lstrcmpiA (lpString1="", lpString2="Tm7X0ZWsRnwHit.jpg") returned -1
	[0135.649] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\ThfkqOaJnX.png") returned="ThfkqOaJnX.png"
	[0135.649] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.649] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.649] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.649] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0x20
	[0135.649] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Tm7X0ZWsRnwHit.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Tm7X0ZWsRnwHit.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\Tm7X0ZWsRnwHit.jpg"
	[0135.649] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Tm7X0ZWsRnwHit.jpg", pszSpec="*.zip") returned 0
	[0135.649] lstrlenA (lpString="*.zip") returned 5
	[0135.649] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Tm7X0ZWsRnwHit.jpg", pszSpec="*.rar") returned 0
	[0135.649] lstrlenA (lpString="*.rar") returned 5
	[0135.649] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Tm7X0ZWsRnwHit.jpg", pszSpec="*.7z") returned 0
	[0135.649] lstrlenA (lpString="*.7z") returned 4
	[0135.649] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Tm7X0ZWsRnwHit.jpg", pszSpec="*.tar") returned 0
	[0135.649] lstrlenA (lpString="*.tar") returned 5
	[0135.649] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Tm7X0ZWsRnwHit.jpg", pszSpec="*.gzip") returned 0
	[0135.649] lstrlenA (lpString="*.gzip") returned 6
	[0135.649] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\Tm7X0ZWsRnwHit.jpg", pszSpec="*.jpg") returned 1
	[0135.649] lstrlenA (lpString="*.jpg") returned 5
	[0135.649] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Pictures\\Tm7X0ZWsRnwHit.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Tm7X0ZWsRnwHit.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\Tm7X0ZWsRnwHit.jpg"
	[0135.649] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Pictures\\Tm7X0ZWsRnwHit.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Tm7X0ZWsRnwHit.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\Tm7X0ZWsRnwHit.jpg"
	[0135.649] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Tm7X0ZWsRnwHit.jpg", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Tm7X0ZWsRnwHit.jpg.") returned="C:\\Users\\FD1HVy\\Pictures\\Tm7X0ZWsRnwHit.jpg."
	[0135.649] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Tm7X0ZWsRnwHit.jpg.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Tm7X0ZWsRnwHit.jpg.exe") returned="C:\\Users\\FD1HVy\\Pictures\\Tm7X0ZWsRnwHit.jpg.exe"
	[0135.649] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Tm7X0ZWsRnwHit.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tm7x0zwsrnwhit.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.650] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x361d
	[0135.650] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc32047b0, dwHighDateTime=0x1d4cb28), lpLastAccessTime=0x407536*(dwLowDateTime=0xd72718d0, dwHighDateTime=0x1d4c8b0), lpLastWriteTime=0x40753e*(dwLowDateTime=0xd72718d0, dwHighDateTime=0x1d4c8b0)) returned 1
	[0135.650] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.650] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x35db, lpOverlapped=0x0) returned 1
	[0135.651] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\Tm7X0ZWsRnwHit.jpg") returned="Tm7X0ZWsRnwHit.jpg"
	[0135.651] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.651] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x35db, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x35db, lpOverlapped=0x0) returned 1
	[0135.651] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.651] CloseHandle (hObject=0x20c) returned 1
	[0135.651] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Tm7X0ZWsRnwHit.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tm7x0zwsrnwhit.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Tm7X0ZWsRnwHit.jpg.exe" (normalized: "c:\\users\\fd1hvy\\pictures\\tm7x0zwsrnwhit.jpg.exe")) returned 1
	[0135.652] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4581fbc0, ftCreationTime.dwHighDateTime=0x1d4cb6c, ftLastAccessTime.dwLowDateTime=0x24539940, ftLastAccessTime.dwHighDateTime=0x1d4c60d, ftLastWriteTime.dwLowDateTime=0x24539940, ftLastWriteTime.dwHighDateTime=0x1d4c60d, nFileSizeHigh=0x0, nFileSizeLow=0x934a, dwReserved0=0x15, dwReserved1=0x1, cFileName="uMCVkil7.jpg", cAlternateFileName="")) returned 1
	[0135.652] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.652] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="uMCVkil7.jpg") returned -1
	[0135.652] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="uMCVkil7.jpg") returned -1
	[0135.652] lstrcmpiA (lpString1="", lpString2="uMCVkil7.jpg") returned -1
	[0135.652] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\Tm7X0ZWsRnwHit.jpg") returned="Tm7X0ZWsRnwHit.jpg"
	[0135.652] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.652] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.652] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.652] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0x20
	[0135.652] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="uMCVkil7.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\uMCVkil7.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\uMCVkil7.jpg"
	[0135.652] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\uMCVkil7.jpg", pszSpec="*.zip") returned 0
	[0135.652] lstrlenA (lpString="*.zip") returned 5
	[0135.652] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\uMCVkil7.jpg", pszSpec="*.rar") returned 0
	[0135.652] lstrlenA (lpString="*.rar") returned 5
	[0135.652] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\uMCVkil7.jpg", pszSpec="*.7z") returned 0
	[0135.652] lstrlenA (lpString="*.7z") returned 4
	[0135.652] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\uMCVkil7.jpg", pszSpec="*.tar") returned 0
	[0135.652] lstrlenA (lpString="*.tar") returned 5
	[0135.652] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\uMCVkil7.jpg", pszSpec="*.gzip") returned 0
	[0135.652] lstrlenA (lpString="*.gzip") returned 6
	[0135.652] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\uMCVkil7.jpg", pszSpec="*.jpg") returned 1
	[0135.652] lstrlenA (lpString="*.jpg") returned 5
	[0135.652] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Pictures\\uMCVkil7.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\uMCVkil7.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\uMCVkil7.jpg"
	[0135.652] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Pictures\\uMCVkil7.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\uMCVkil7.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\uMCVkil7.jpg"
	[0135.652] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\uMCVkil7.jpg", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\uMCVkil7.jpg.") returned="C:\\Users\\FD1HVy\\Pictures\\uMCVkil7.jpg."
	[0135.652] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\uMCVkil7.jpg.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\uMCVkil7.jpg.exe") returned="C:\\Users\\FD1HVy\\Pictures\\uMCVkil7.jpg.exe"
	[0135.653] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\uMCVkil7.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\umcvkil7.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.653] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x934a
	[0135.653] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4581fbc0, dwHighDateTime=0x1d4cb6c), lpLastAccessTime=0x407536*(dwLowDateTime=0x24539940, dwHighDateTime=0x1d4c60d), lpLastWriteTime=0x40753e*(dwLowDateTime=0x24539940, dwHighDateTime=0x1d4c60d)) returned 1
	[0135.653] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.653] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x9308, lpOverlapped=0x0) returned 1
	[0135.654] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\uMCVkil7.jpg") returned="uMCVkil7.jpg"
	[0135.654] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.654] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x9308, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x9308, lpOverlapped=0x0) returned 1
	[0135.654] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.654] CloseHandle (hObject=0x20c) returned 1
	[0135.654] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\uMCVkil7.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\umcvkil7.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\uMCVkil7.jpg.exe" (normalized: "c:\\users\\fd1hvy\\pictures\\umcvkil7.jpg.exe")) returned 1
	[0135.655] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9e79d90, ftCreationTime.dwHighDateTime=0x1d4cff1, ftLastAccessTime.dwLowDateTime=0xe7c9e850, ftLastAccessTime.dwHighDateTime=0x1d4d005, ftLastWriteTime.dwLowDateTime=0xe7c9e850, ftLastWriteTime.dwHighDateTime=0x1d4d005, nFileSizeHigh=0x0, nFileSizeLow=0xa890, dwReserved0=0x12, dwReserved1=0x1, cFileName="VQt2y.png", cAlternateFileName="")) returned 1
	[0135.655] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.677] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="VQt2y.png") returned -1
	[0135.677] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="VQt2y.png") returned -1
	[0135.677] lstrcmpiA (lpString1="", lpString2="VQt2y.png") returned -1
	[0135.677] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\uMCVkil7.jpg") returned="uMCVkil7.jpg"
	[0135.677] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.677] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.677] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.677] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0x20
	[0135.677] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="VQt2y.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\VQt2y.png") returned="C:\\Users\\FD1HVy\\Pictures\\VQt2y.png"
	[0135.677] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\VQt2y.png", pszSpec="*.zip") returned 0
	[0135.677] lstrlenA (lpString="*.zip") returned 5
	[0135.677] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\VQt2y.png", pszSpec="*.rar") returned 0
	[0135.677] lstrlenA (lpString="*.rar") returned 5
	[0135.678] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\VQt2y.png", pszSpec="*.7z") returned 0
	[0135.678] lstrlenA (lpString="*.7z") returned 4
	[0135.678] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\VQt2y.png", pszSpec="*.tar") returned 0
	[0135.678] lstrlenA (lpString="*.tar") returned 5
	[0135.678] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\VQt2y.png", pszSpec="*.gzip") returned 0
	[0135.678] lstrlenA (lpString="*.gzip") returned 6
	[0135.678] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\VQt2y.png", pszSpec="*.jpg") returned 0
	[0135.678] lstrlenA (lpString="*.jpg") returned 5
	[0135.678] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\VQt2y.png", pszSpec="*.jpeg") returned 0
	[0135.678] lstrlenA (lpString="*.jpeg") returned 6
	[0135.678] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\VQt2y.png", pszSpec="*.bmp") returned 0
	[0135.678] lstrlenA (lpString="*.bmp") returned 5
	[0135.678] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\VQt2y.png", pszSpec="*.gif") returned 0
	[0135.678] lstrlenA (lpString="*.gif") returned 5
	[0135.678] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\VQt2y.png", pszSpec="*.png") returned 1
	[0135.678] lstrlenA (lpString="*.png") returned 5
	[0135.678] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Pictures\\VQt2y.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\VQt2y.png") returned="C:\\Users\\FD1HVy\\Pictures\\VQt2y.png"
	[0135.678] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Pictures\\VQt2y.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\VQt2y.png") returned="C:\\Users\\FD1HVy\\Pictures\\VQt2y.png"
	[0135.678] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\VQt2y.png", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\VQt2y.png.") returned="C:\\Users\\FD1HVy\\Pictures\\VQt2y.png."
	[0135.678] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\VQt2y.png.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\VQt2y.png.exe") returned="C:\\Users\\FD1HVy\\Pictures\\VQt2y.png.exe"
	[0135.678] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\VQt2y.png" (normalized: "c:\\users\\fd1hvy\\pictures\\vqt2y.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.679] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa890
	[0135.679] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd9e79d90, dwHighDateTime=0x1d4cff1), lpLastAccessTime=0x407536*(dwLowDateTime=0xe7c9e850, dwHighDateTime=0x1d4d005), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe7c9e850, dwHighDateTime=0x1d4d005)) returned 1
	[0135.679] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.679] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xa84e, lpOverlapped=0x0) returned 1
	[0135.680] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\VQt2y.png") returned="VQt2y.png"
	[0135.680] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.680] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xa84e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xa84e, lpOverlapped=0x0) returned 1
	[0135.680] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.681] CloseHandle (hObject=0x20c) returned 1
	[0135.681] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\VQt2y.png" (normalized: "c:\\users\\fd1hvy\\pictures\\vqt2y.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\VQt2y.png.exe" (normalized: "c:\\users\\fd1hvy\\pictures\\vqt2y.png.exe")) returned 1
	[0135.681] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55da9d0, ftCreationTime.dwHighDateTime=0x1d4d2f2, ftLastAccessTime.dwLowDateTime=0xb202e800, ftLastAccessTime.dwHighDateTime=0x1d4c918, ftLastWriteTime.dwLowDateTime=0xb202e800, ftLastWriteTime.dwHighDateTime=0x1d4c918, nFileSizeHigh=0x0, nFileSizeLow=0x13c48, dwReserved0=0x12, dwReserved1=0x1, cFileName="w sqIsm1.png", cAlternateFileName="WSQISM~1.PNG")) returned 1
	[0135.681] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.681] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="w sqIsm1.png") returned -1
	[0135.681] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="w sqIsm1.png") returned -1
	[0135.682] lstrcmpiA (lpString1="", lpString2="w sqIsm1.png") returned -1
	[0135.682] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\VQt2y.png") returned="VQt2y.png"
	[0135.682] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.682] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.682] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.682] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0x20
	[0135.682] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="w sqIsm1.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\w sqIsm1.png") returned="C:\\Users\\FD1HVy\\Pictures\\w sqIsm1.png"
	[0135.682] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\w sqIsm1.png", pszSpec="*.zip") returned 0
	[0135.682] lstrlenA (lpString="*.zip") returned 5
	[0135.682] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\w sqIsm1.png", pszSpec="*.rar") returned 0
	[0135.682] lstrlenA (lpString="*.rar") returned 5
	[0135.682] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\w sqIsm1.png", pszSpec="*.7z") returned 0
	[0135.682] lstrlenA (lpString="*.7z") returned 4
	[0135.682] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\w sqIsm1.png", pszSpec="*.tar") returned 0
	[0135.682] lstrlenA (lpString="*.tar") returned 5
	[0135.682] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\w sqIsm1.png", pszSpec="*.gzip") returned 0
	[0135.682] lstrlenA (lpString="*.gzip") returned 6
	[0135.682] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\w sqIsm1.png", pszSpec="*.jpg") returned 0
	[0135.682] lstrlenA (lpString="*.jpg") returned 5
	[0135.682] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\w sqIsm1.png", pszSpec="*.jpeg") returned 0
	[0135.682] lstrlenA (lpString="*.jpeg") returned 6
	[0135.682] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\w sqIsm1.png", pszSpec="*.bmp") returned 0
	[0135.682] lstrlenA (lpString="*.bmp") returned 5
	[0135.682] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\w sqIsm1.png", pszSpec="*.gif") returned 0
	[0135.682] lstrlenA (lpString="*.gif") returned 5
	[0135.682] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\w sqIsm1.png", pszSpec="*.png") returned 1
	[0135.682] lstrlenA (lpString="*.png") returned 5
	[0135.682] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Pictures\\w sqIsm1.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\w sqIsm1.png") returned="C:\\Users\\FD1HVy\\Pictures\\w sqIsm1.png"
	[0135.682] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Pictures\\w sqIsm1.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\w sqIsm1.png") returned="C:\\Users\\FD1HVy\\Pictures\\w sqIsm1.png"
	[0135.682] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\w sqIsm1.png", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\w sqIsm1.png.") returned="C:\\Users\\FD1HVy\\Pictures\\w sqIsm1.png."
	[0135.683] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\w sqIsm1.png.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\w sqIsm1.png.exe") returned="C:\\Users\\FD1HVy\\Pictures\\w sqIsm1.png.exe"
	[0135.683] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\w sqIsm1.png" (normalized: "c:\\users\\fd1hvy\\pictures\\w sqism1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.683] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13c48
	[0135.683] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x55da9d0, dwHighDateTime=0x1d4d2f2), lpLastAccessTime=0x407536*(dwLowDateTime=0xb202e800, dwHighDateTime=0x1d4c918), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb202e800, dwHighDateTime=0x1d4c918)) returned 1
	[0135.683] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.683] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x13c06, lpOverlapped=0x0) returned 1
	[0135.684] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\w sqIsm1.png") returned="w sqIsm1.png"
	[0135.684] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.684] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x13c06, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x13c06, lpOverlapped=0x0) returned 1
	[0135.685] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.685] CloseHandle (hObject=0x20c) returned 1
	[0135.685] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\w sqIsm1.png" (normalized: "c:\\users\\fd1hvy\\pictures\\w sqism1.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\w sqIsm1.png.exe" (normalized: "c:\\users\\fd1hvy\\pictures\\w sqism1.png.exe")) returned 1
	[0135.685] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4549e2f0, ftCreationTime.dwHighDateTime=0x1d4d24a, ftLastAccessTime.dwLowDateTime=0x66cbab40, ftLastAccessTime.dwHighDateTime=0x1d4d338, ftLastWriteTime.dwLowDateTime=0x66cbab40, ftLastWriteTime.dwHighDateTime=0x1d4d338, nFileSizeHigh=0x0, nFileSizeLow=0x18123, dwReserved0=0x12, dwReserved1=0x1, cFileName="w4IkJmFZaSO9AzFVkP0.bmp", cAlternateFileName="W4IKJM~1.BMP")) returned 1
	[0135.686] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.686] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="w4IkJmFZaSO9AzFVkP0.bmp") returned -1
	[0135.686] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="w4IkJmFZaSO9AzFVkP0.bmp") returned -1
	[0135.686] lstrcmpiA (lpString1="", lpString2="w4IkJmFZaSO9AzFVkP0.bmp") returned -1
	[0135.686] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\w sqIsm1.png") returned="w sqIsm1.png"
	[0135.686] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.686] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.686] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.686] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0x20
	[0135.686] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="w4IkJmFZaSO9AzFVkP0.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\w4IkJmFZaSO9AzFVkP0.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\w4IkJmFZaSO9AzFVkP0.bmp"
	[0135.686] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\w4IkJmFZaSO9AzFVkP0.bmp", pszSpec="*.zip") returned 0
	[0135.686] lstrlenA (lpString="*.zip") returned 5
	[0135.686] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\w4IkJmFZaSO9AzFVkP0.bmp", pszSpec="*.rar") returned 0
	[0135.686] lstrlenA (lpString="*.rar") returned 5
	[0135.686] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\w4IkJmFZaSO9AzFVkP0.bmp", pszSpec="*.7z") returned 0
	[0135.686] lstrlenA (lpString="*.7z") returned 4
	[0135.686] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\w4IkJmFZaSO9AzFVkP0.bmp", pszSpec="*.tar") returned 0
	[0135.686] lstrlenA (lpString="*.tar") returned 5
	[0135.686] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\w4IkJmFZaSO9AzFVkP0.bmp", pszSpec="*.gzip") returned 0
	[0135.686] lstrlenA (lpString="*.gzip") returned 6
	[0135.686] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\w4IkJmFZaSO9AzFVkP0.bmp", pszSpec="*.jpg") returned 0
	[0135.686] lstrlenA (lpString="*.jpg") returned 5
	[0135.686] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\w4IkJmFZaSO9AzFVkP0.bmp", pszSpec="*.jpeg") returned 0
	[0135.686] lstrlenA (lpString="*.jpeg") returned 6
	[0135.686] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\w4IkJmFZaSO9AzFVkP0.bmp", pszSpec="*.bmp") returned 1
	[0135.686] lstrlenA (lpString="*.bmp") returned 5
	[0135.686] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Pictures\\w4IkJmFZaSO9AzFVkP0.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\w4IkJmFZaSO9AzFVkP0.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\w4IkJmFZaSO9AzFVkP0.bmp"
	[0135.686] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Pictures\\w4IkJmFZaSO9AzFVkP0.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\w4IkJmFZaSO9AzFVkP0.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\w4IkJmFZaSO9AzFVkP0.bmp"
	[0135.686] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\w4IkJmFZaSO9AzFVkP0.bmp", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\w4IkJmFZaSO9AzFVkP0.bmp.") returned="C:\\Users\\FD1HVy\\Pictures\\w4IkJmFZaSO9AzFVkP0.bmp."
	[0135.686] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\w4IkJmFZaSO9AzFVkP0.bmp.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\w4IkJmFZaSO9AzFVkP0.bmp.exe") returned="C:\\Users\\FD1HVy\\Pictures\\w4IkJmFZaSO9AzFVkP0.bmp.exe"
	[0135.687] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\w4IkJmFZaSO9AzFVkP0.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\w4ikjmfzaso9azfvkp0.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.687] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18123
	[0135.687] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4549e2f0, dwHighDateTime=0x1d4d24a), lpLastAccessTime=0x407536*(dwLowDateTime=0x66cbab40, dwHighDateTime=0x1d4d338), lpLastWriteTime=0x40753e*(dwLowDateTime=0x66cbab40, dwHighDateTime=0x1d4d338)) returned 1
	[0135.687] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.687] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x180e1, lpOverlapped=0x0) returned 1
	[0135.688] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\w4IkJmFZaSO9AzFVkP0.bmp") returned="w4IkJmFZaSO9AzFVkP0.bmp"
	[0135.689] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.689] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x180e1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x180e1, lpOverlapped=0x0) returned 1
	[0135.689] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.689] CloseHandle (hObject=0x20c) returned 1
	[0135.689] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\w4IkJmFZaSO9AzFVkP0.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\w4ikjmfzaso9azfvkp0.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\w4IkJmFZaSO9AzFVkP0.bmp.exe" (normalized: "c:\\users\\fd1hvy\\pictures\\w4ikjmfzaso9azfvkp0.bmp.exe")) returned 1
	[0135.690] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd04eeeb0, ftCreationTime.dwHighDateTime=0x1d4c6ae, ftLastAccessTime.dwLowDateTime=0xb30680d0, ftLastAccessTime.dwHighDateTime=0x1d4cc43, ftLastWriteTime.dwLowDateTime=0xb30680d0, ftLastWriteTime.dwHighDateTime=0x1d4cc43, nFileSizeHigh=0x0, nFileSizeLow=0xa3c6, dwReserved0=0x0, dwReserved1=0x1, cFileName="XZyKloOSGV-s.png", cAlternateFileName="XZYKLO~1.PNG")) returned 1
	[0135.690] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.690] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="XZyKloOSGV-s.png") returned -1
	[0135.690] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="XZyKloOSGV-s.png") returned -1
	[0135.690] lstrcmpiA (lpString1="", lpString2="XZyKloOSGV-s.png") returned -1
	[0135.690] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\w4IkJmFZaSO9AzFVkP0.bmp") returned="w4IkJmFZaSO9AzFVkP0.bmp"
	[0135.690] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\"
	[0135.690] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned=""
	[0135.690] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.690] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\pictures\\how-to-decrypt-files.htm")) returned 0x20
	[0135.690] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="XZyKloOSGV-s.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\XZyKloOSGV-s.png") returned="C:\\Users\\FD1HVy\\Pictures\\XZyKloOSGV-s.png"
	[0135.690] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\XZyKloOSGV-s.png", pszSpec="*.zip") returned 0
	[0135.690] lstrlenA (lpString="*.zip") returned 5
	[0135.690] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\XZyKloOSGV-s.png", pszSpec="*.rar") returned 0
	[0135.690] lstrlenA (lpString="*.rar") returned 5
	[0135.690] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\XZyKloOSGV-s.png", pszSpec="*.7z") returned 0
	[0135.690] lstrlenA (lpString="*.7z") returned 4
	[0135.690] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\XZyKloOSGV-s.png", pszSpec="*.tar") returned 0
	[0135.690] lstrlenA (lpString="*.tar") returned 5
	[0135.690] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\XZyKloOSGV-s.png", pszSpec="*.gzip") returned 0
	[0135.690] lstrlenA (lpString="*.gzip") returned 6
	[0135.690] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\XZyKloOSGV-s.png", pszSpec="*.jpg") returned 0
	[0135.690] lstrlenA (lpString="*.jpg") returned 5
	[0135.690] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\XZyKloOSGV-s.png", pszSpec="*.jpeg") returned 0
	[0135.690] lstrlenA (lpString="*.jpeg") returned 6
	[0135.690] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\XZyKloOSGV-s.png", pszSpec="*.bmp") returned 0
	[0135.690] lstrlenA (lpString="*.bmp") returned 5
	[0135.690] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\XZyKloOSGV-s.png", pszSpec="*.gif") returned 0
	[0135.691] lstrlenA (lpString="*.gif") returned 5
	[0135.691] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Pictures\\XZyKloOSGV-s.png", pszSpec="*.png") returned 1
	[0135.691] lstrlenA (lpString="*.png") returned 5
	[0135.691] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Pictures\\XZyKloOSGV-s.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\XZyKloOSGV-s.png") returned="C:\\Users\\FD1HVy\\Pictures\\XZyKloOSGV-s.png"
	[0135.691] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Pictures\\XZyKloOSGV-s.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\XZyKloOSGV-s.png") returned="C:\\Users\\FD1HVy\\Pictures\\XZyKloOSGV-s.png"
	[0135.691] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\XZyKloOSGV-s.png", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\XZyKloOSGV-s.png.") returned="C:\\Users\\FD1HVy\\Pictures\\XZyKloOSGV-s.png."
	[0135.691] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\XZyKloOSGV-s.png.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\XZyKloOSGV-s.png.exe") returned="C:\\Users\\FD1HVy\\Pictures\\XZyKloOSGV-s.png.exe"
	[0135.691] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Pictures\\XZyKloOSGV-s.png" (normalized: "c:\\users\\fd1hvy\\pictures\\xzykloosgv-s.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.691] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa3c6
	[0135.691] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd04eeeb0, dwHighDateTime=0x1d4c6ae), lpLastAccessTime=0x407536*(dwLowDateTime=0xb30680d0, dwHighDateTime=0x1d4cc43), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb30680d0, dwHighDateTime=0x1d4cc43)) returned 1
	[0135.691] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.691] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xa384, lpOverlapped=0x0) returned 1
	[0135.692] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Pictures\\XZyKloOSGV-s.png") returned="XZyKloOSGV-s.png"
	[0135.692] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.692] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xa384, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xa384, lpOverlapped=0x0) returned 1
	[0135.693] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.693] CloseHandle (hObject=0x20c) returned 1
	[0135.693] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\XZyKloOSGV-s.png" (normalized: "c:\\users\\fd1hvy\\pictures\\xzykloosgv-s.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\XZyKloOSGV-s.png.exe" (normalized: "c:\\users\\fd1hvy\\pictures\\xzykloosgv-s.png.exe")) returned 1
	[0135.693] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd04eeeb0, ftCreationTime.dwHighDateTime=0x1d4c6ae, ftLastAccessTime.dwLowDateTime=0xb30680d0, ftLastAccessTime.dwHighDateTime=0x1d4cc43, ftLastWriteTime.dwLowDateTime=0xb30680d0, ftLastWriteTime.dwHighDateTime=0x1d4cc43, nFileSizeHigh=0x0, nFileSizeLow=0xa3c6, dwReserved0=0x0, dwReserved1=0x1, cFileName="XZyKloOSGV-s.png", cAlternateFileName="XZYKLO~1.PNG")) returned 0
	[0135.693] FindClose (in: hFindFile=0x7cb6d0 | out: hFindFile=0x7cb6d0) returned 1
	[0135.693] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1
	[0135.694] lstrcmpA (lpString1=".", lpString2="PrintHood") returned -1
	[0135.694] lstrcmpA (lpString1="..", lpString2="PrintHood") returned -1
	[0135.694] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\*.*") returned="*.*"
	[0135.694] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="PrintHood" | out: lpString1="C:\\Users\\FD1HVy\\PrintHood") returned="C:\\Users\\FD1HVy\\PrintHood"
	[0135.694] lstrlenA (lpString="C:\\Users\\FD1HVy\\PrintHood") returned 25
	[0135.694] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\PrintHood\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd04eeeb0, ftCreationTime.dwHighDateTime=0x1d4c6ae, ftLastAccessTime.dwLowDateTime=0xb30680d0, ftLastAccessTime.dwHighDateTime=0x1d4cc43, ftLastWriteTime.dwLowDateTime=0xb30680d0, ftLastWriteTime.dwHighDateTime=0x1d4cc43, nFileSizeHigh=0x0, nFileSizeLow=0xa3c6, dwReserved0=0x0, dwReserved1=0x1, cFileName="XZyKloOSGV-s.png", cAlternateFileName="\xcc\xff\x19")) returned 0xffffffff
	[0135.694] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1
	[0135.694] lstrcmpA (lpString1=".", lpString2="Recent") returned -1
	[0135.694] lstrcmpA (lpString1="..", lpString2="Recent") returned -1
	[0135.694] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\*.*") returned="*.*"
	[0135.694] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Recent" | out: lpString1="C:\\Users\\FD1HVy\\Recent") returned="C:\\Users\\FD1HVy\\Recent"
	[0135.694] lstrlenA (lpString="C:\\Users\\FD1HVy\\Recent") returned 22
	[0135.694] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Recent\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd04eeeb0, ftCreationTime.dwHighDateTime=0x1d4c6ae, ftLastAccessTime.dwLowDateTime=0xb30680d0, ftLastAccessTime.dwHighDateTime=0x1d4cc43, ftLastWriteTime.dwLowDateTime=0xb30680d0, ftLastWriteTime.dwHighDateTime=0x1d4cc43, nFileSizeHigh=0x0, nFileSizeLow=0xa3c6, dwReserved0=0x0, dwReserved1=0x1, cFileName="XZyKloOSGV-s.png", cAlternateFileName="\xcc\xff\x19")) returned 0xffffffff
	[0135.694] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1
	[0135.694] lstrcmpA (lpString1=".", lpString2="Saved Games") returned -1
	[0135.694] lstrcmpA (lpString1="..", lpString2="Saved Games") returned -1
	[0135.694] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\*.*") returned="*.*"
	[0135.694] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Saved Games" | out: lpString1="C:\\Users\\FD1HVy\\Saved Games") returned="C:\\Users\\FD1HVy\\Saved Games"
	[0135.694] lstrlenA (lpString="C:\\Users\\FD1HVy\\Saved Games") returned 27
	[0135.694] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x7cb650
	[0135.694] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0135.694] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1
	[0135.695] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0135.695] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0135.695] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x15, dwReserved1=0x1, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0135.695] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.695] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="desktop.ini") returned 1
	[0135.695] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="desktop.ini") returned 1
	[0135.695] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1
	[0135.695] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Saved Games\\*.*") returned="*.*"
	[0135.695] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Saved Games\\" | out: lpString1="C:\\Users\\FD1HVy\\Saved Games\\") returned="C:\\Users\\FD1HVy\\Saved Games\\"
	[0135.695] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Saved Games\\" | out: pszPath="C:\\Users\\FD1HVy\\Saved Games\\") returned=""
	[0135.695] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Saved Games\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Saved Games\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Saved Games\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.695] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Saved Games\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\saved games\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0135.695] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Saved Games\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\saved games\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.696] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0135.696] WriteFile (in: hFile=0x20c, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0135.696] SetFileTime (hFile=0x20c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0135.697] CloseHandle (hObject=0x20c) returned 1
	[0135.697] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Saved Games\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini") returned="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini"
	[0135.697] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.zip") returned 0
	[0135.697] lstrlenA (lpString="*.zip") returned 5
	[0135.697] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.rar") returned 0
	[0135.697] lstrlenA (lpString="*.rar") returned 5
	[0135.697] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.7z") returned 0
	[0135.697] lstrlenA (lpString="*.7z") returned 4
	[0135.697] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.tar") returned 0
	[0135.697] lstrlenA (lpString="*.tar") returned 5
	[0135.697] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.gzip") returned 0
	[0135.697] lstrlenA (lpString="*.gzip") returned 6
	[0135.697] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.jpg") returned 0
	[0135.697] lstrlenA (lpString="*.jpg") returned 5
	[0135.697] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.jpeg") returned 0
	[0135.697] lstrlenA (lpString="*.jpeg") returned 6
	[0135.697] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.bmp") returned 0
	[0135.697] lstrlenA (lpString="*.bmp") returned 5
	[0135.697] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.gif") returned 0
	[0135.697] lstrlenA (lpString="*.gif") returned 5
	[0135.697] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.png") returned 0
	[0135.697] lstrlenA (lpString="*.png") returned 5
	[0135.697] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.doc") returned 0
	[0135.697] lstrlenA (lpString="*.doc") returned 5
	[0135.697] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.docx") returned 0
	[0135.697] lstrlenA (lpString="*.docx") returned 6
	[0135.697] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.xls") returned 0
	[0135.697] lstrlenA (lpString="*.xls") returned 5
	[0135.697] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.xlsx") returned 0
	[0135.697] lstrlenA (lpString="*.xlsx") returned 6
	[0135.697] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.ppt") returned 0
	[0135.698] lstrlenA (lpString="*.ppt") returned 5
	[0135.698] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.pptx") returned 0
	[0135.698] lstrlenA (lpString="*.pptx") returned 6
	[0135.698] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.txt") returned 0
	[0135.698] lstrlenA (lpString="*.txt") returned 5
	[0135.698] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.pdf") returned 0
	[0135.698] lstrlenA (lpString="*.pdf") returned 5
	[0135.698] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.htm") returned 0
	[0135.698] lstrlenA (lpString="*.htm") returned 5
	[0135.698] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.html") returned 0
	[0135.698] lstrlenA (lpString="*.html") returned 6
	[0135.698] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.mdb") returned 0
	[0135.698] lstrlenA (lpString="*.mdb") returned 5
	[0135.698] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.pfx") returned 0
	[0135.698] lstrlenA (lpString="*.pfx") returned 5
	[0135.698] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.md") returned 0
	[0135.698] lstrlenA (lpString="*.md") returned 4
	[0135.698] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.lnk") returned 0
	[0135.698] lstrlenA (lpString="*.lnk") returned 5
	[0135.698] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.torrent") returned 0
	[0135.698] lstrlenA (lpString="*.torrent") returned 9
	[0135.698] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.mov") returned 0
	[0135.698] lstrlenA (lpString="*.mov") returned 5
	[0135.698] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.3gp") returned 0
	[0135.698] lstrlenA (lpString="*.3gp") returned 5
	[0135.698] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.mpeg") returned 0
	[0135.698] lstrlenA (lpString="*.mpeg") returned 6
	[0135.698] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.mpg") returned 0
	[0135.698] lstrlenA (lpString="*.mpg") returned 5
	[0135.698] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.flv") returned 0
	[0135.698] lstrlenA (lpString="*.flv") returned 5
	[0135.699] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.avi") returned 0
	[0135.699] lstrlenA (lpString="*.avi") returned 5
	[0135.699] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.mp4") returned 0
	[0135.699] lstrlenA (lpString="*.mp4") returned 5
	[0135.699] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.wmv") returned 0
	[0135.699] lstrlenA (lpString="*.wmv") returned 5
	[0135.699] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.mkv") returned 0
	[0135.699] lstrlenA (lpString="*.mkv") returned 5
	[0135.699] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.mp3") returned 0
	[0135.699] lstrlenA (lpString="*.mp3") returned 5
	[0135.699] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.wav") returned 0
	[0135.699] lstrlenA (lpString="*.wav") returned 5
	[0135.699] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.flac") returned 0
	[0135.699] lstrlenA (lpString="*.flac") returned 6
	[0135.699] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.wma") returned 0
	[0135.699] lstrlenA (lpString="*.wma") returned 5
	[0135.699] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.au3") returned 0
	[0135.699] lstrlenA (lpString="*.au3") returned 5
	[0135.699] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.ahk") returned 0
	[0135.699] lstrlenA (lpString="*.ahk") returned 5
	[0135.699] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.c") returned 0
	[0135.699] lstrlenA (lpString="*.c") returned 3
	[0135.699] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.cc") returned 0
	[0135.699] lstrlenA (lpString="*.cc") returned 4
	[0135.699] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.cpp") returned 0
	[0135.699] lstrlenA (lpString="*.cpp") returned 5
	[0135.699] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.cxx") returned 0
	[0135.699] lstrlenA (lpString="*.cxx") returned 5
	[0135.699] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.c++") returned 0
	[0135.699] lstrlenA (lpString="*.c++") returned 5
	[0135.699] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.cs") returned 0
	[0135.700] lstrlenA (lpString="*.cs") returned 4
	[0135.700] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.vb") returned 0
	[0135.700] lstrlenA (lpString="*.vb") returned 4
	[0135.700] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.bas") returned 0
	[0135.700] lstrlenA (lpString="*.bas") returned 5
	[0135.700] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.csproj") returned 0
	[0135.700] lstrlenA (lpString="*.csproj") returned 8
	[0135.700] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.vbproj") returned 0
	[0135.700] lstrlenA (lpString="*.vbproj") returned 8
	[0135.700] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.vcxproj") returned 0
	[0135.700] lstrlenA (lpString="*.vcxproj") returned 9
	[0135.700] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.manifest") returned 0
	[0135.700] lstrlenA (lpString="*.manifest") returned 10
	[0135.700] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.php") returned 0
	[0135.700] lstrlenA (lpString="*.php") returned 5
	[0135.700] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.vbe") returned 0
	[0135.700] lstrlenA (lpString="*.vbe") returned 5
	[0135.700] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.vba") returned 0
	[0135.700] lstrlenA (lpString="*.vba") returned 5
	[0135.700] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.vbs") returned 0
	[0135.700] lstrlenA (lpString="*.vbs") returned 5
	[0135.700] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.bat") returned 0
	[0135.700] lstrlenA (lpString="*.bat") returned 5
	[0135.700] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.cmd") returned 0
	[0135.700] lstrlenA (lpString="*.cmd") returned 5
	[0135.700] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.js") returned 0
	[0135.700] lstrlenA (lpString="*.js") returned 4
	[0135.700] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.jscript") returned 0
	[0135.700] lstrlenA (lpString="*.jscript") returned 9
	[0135.700] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.hta") returned 0
	[0135.700] lstrlenA (lpString="*.hta") returned 5
	[0135.700] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.php7") returned 0
	[0135.700] lstrlenA (lpString="*.php7") returned 6
	[0135.700] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.db") returned 0
	[0135.701] lstrlenA (lpString="*.db") returned 4
	[0135.701] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.swf") returned 0
	[0135.701] lstrlenA (lpString="*.swf") returned 5
	[0135.701] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.eml") returned 0
	[0135.701] lstrlenA (lpString="*.eml") returned 5
	[0135.701] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.part") returned 0
	[0135.701] lstrlenA (lpString="*.part") returned 6
	[0135.701] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.nfo") returned 0
	[0135.701] lstrlenA (lpString="*.nfo") returned 5
	[0135.701] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.rsa") returned 0
	[0135.701] lstrlenA (lpString="*.rsa") returned 5
	[0135.701] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.key") returned 0
	[0135.701] lstrlenA (lpString="*.key") returned 5
	[0135.701] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.aes") returned 0
	[0135.701] lstrlenA (lpString="*.aes") returned 5
	[0135.701] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.blob") returned 0
	[0135.701] lstrlenA (lpString="*.blob") returned 6
	[0135.701] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.btc") returned 0
	[0135.701] lstrlenA (lpString="*.btc") returned 5
	[0135.701] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", pszSpec="*.wallet") returned 0
	[0135.701] lstrlenA (lpString="*.wallet") returned 8
	[0135.701] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x15, dwReserved1=0x1, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0135.701] FindClose (in: hFindFile=0x7cb650 | out: hFindFile=0x7cb650) returned 1
	[0135.701] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1
	[0135.701] lstrcmpA (lpString1=".", lpString2="Searches") returned -1
	[0135.701] lstrcmpA (lpString1="..", lpString2="Searches") returned -1
	[0135.701] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\*.*") returned="*.*"
	[0135.701] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Searches" | out: lpString1="C:\\Users\\FD1HVy\\Searches") returned="C:\\Users\\FD1HVy\\Searches"
	[0135.701] lstrlenA (lpString="C:\\Users\\FD1HVy\\Searches") returned 24
	[0135.701] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x7cb990
	[0135.702] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0135.702] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1
	[0135.702] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0135.702] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0135.702] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x1, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0135.702] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.702] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="desktop.ini") returned 1
	[0135.702] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="desktop.ini") returned 1
	[0135.702] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1
	[0135.702] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Searches\\*.*") returned="*.*"
	[0135.702] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Searches\\" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\") returned="C:\\Users\\FD1HVy\\Searches\\"
	[0135.702] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Searches\\" | out: pszPath="C:\\Users\\FD1HVy\\Searches\\") returned=""
	[0135.702] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Searches\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Searches\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.702] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Searches\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\searches\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0135.702] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Searches\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\searches\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.703] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0135.703] WriteFile (in: hFile=0x20c, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0135.703] SetFileTime (hFile=0x20c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0135.703] CloseHandle (hObject=0x20c) returned 1
	[0135.704] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Searches\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\desktop.ini") returned="C:\\Users\\FD1HVy\\Searches\\desktop.ini"
	[0135.704] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.zip") returned 0
	[0135.704] lstrlenA (lpString="*.zip") returned 5
	[0135.704] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.rar") returned 0
	[0135.704] lstrlenA (lpString="*.rar") returned 5
	[0135.704] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.7z") returned 0
	[0135.704] lstrlenA (lpString="*.7z") returned 4
	[0135.704] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.tar") returned 0
	[0135.704] lstrlenA (lpString="*.tar") returned 5
	[0135.704] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.gzip") returned 0
	[0135.704] lstrlenA (lpString="*.gzip") returned 6
	[0135.704] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.jpg") returned 0
	[0135.704] lstrlenA (lpString="*.jpg") returned 5
	[0135.704] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.jpeg") returned 0
	[0135.704] lstrlenA (lpString="*.jpeg") returned 6
	[0135.704] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.bmp") returned 0
	[0135.704] lstrlenA (lpString="*.bmp") returned 5
	[0135.704] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.gif") returned 0
	[0135.704] lstrlenA (lpString="*.gif") returned 5
	[0135.704] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.png") returned 0
	[0135.704] lstrlenA (lpString="*.png") returned 5
	[0135.704] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.doc") returned 0
	[0135.704] lstrlenA (lpString="*.doc") returned 5
	[0135.704] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.docx") returned 0
	[0135.704] lstrlenA (lpString="*.docx") returned 6
	[0135.704] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.xls") returned 0
	[0135.704] lstrlenA (lpString="*.xls") returned 5
	[0135.704] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.xlsx") returned 0
	[0135.704] lstrlenA (lpString="*.xlsx") returned 6
	[0135.704] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.ppt") returned 0
	[0135.704] lstrlenA (lpString="*.ppt") returned 5
	[0135.704] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.pptx") returned 0
	[0135.704] lstrlenA (lpString="*.pptx") returned 6
	[0135.704] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.txt") returned 0
	[0135.704] lstrlenA (lpString="*.txt") returned 5
	[0135.705] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.pdf") returned 0
	[0135.705] lstrlenA (lpString="*.pdf") returned 5
	[0135.705] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.htm") returned 0
	[0135.705] lstrlenA (lpString="*.htm") returned 5
	[0135.705] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.html") returned 0
	[0135.705] lstrlenA (lpString="*.html") returned 6
	[0135.705] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.mdb") returned 0
	[0135.705] lstrlenA (lpString="*.mdb") returned 5
	[0135.705] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.pfx") returned 0
	[0135.705] lstrlenA (lpString="*.pfx") returned 5
	[0135.705] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.md") returned 0
	[0135.705] lstrlenA (lpString="*.md") returned 4
	[0135.705] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.lnk") returned 0
	[0135.705] lstrlenA (lpString="*.lnk") returned 5
	[0135.705] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.torrent") returned 0
	[0135.705] lstrlenA (lpString="*.torrent") returned 9
	[0135.705] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.mov") returned 0
	[0135.705] lstrlenA (lpString="*.mov") returned 5
	[0135.705] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.3gp") returned 0
	[0135.705] lstrlenA (lpString="*.3gp") returned 5
	[0135.705] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.mpeg") returned 0
	[0135.705] lstrlenA (lpString="*.mpeg") returned 6
	[0135.705] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.mpg") returned 0
	[0135.705] lstrlenA (lpString="*.mpg") returned 5
	[0135.705] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.flv") returned 0
	[0135.705] lstrlenA (lpString="*.flv") returned 5
	[0135.705] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.avi") returned 0
	[0135.705] lstrlenA (lpString="*.avi") returned 5
	[0135.705] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.mp4") returned 0
	[0135.705] lstrlenA (lpString="*.mp4") returned 5
	[0135.705] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.wmv") returned 0
	[0135.705] lstrlenA (lpString="*.wmv") returned 5
	[0135.705] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.mkv") returned 0
	[0135.705] lstrlenA (lpString="*.mkv") returned 5
	[0135.705] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.mp3") returned 0
	[0135.705] lstrlenA (lpString="*.mp3") returned 5
	[0135.706] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.wav") returned 0
	[0135.706] lstrlenA (lpString="*.wav") returned 5
	[0135.706] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.flac") returned 0
	[0135.706] lstrlenA (lpString="*.flac") returned 6
	[0135.706] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.wma") returned 0
	[0135.706] lstrlenA (lpString="*.wma") returned 5
	[0135.706] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.au3") returned 0
	[0135.706] lstrlenA (lpString="*.au3") returned 5
	[0135.706] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.ahk") returned 0
	[0135.706] lstrlenA (lpString="*.ahk") returned 5
	[0135.706] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.c") returned 0
	[0135.706] lstrlenA (lpString="*.c") returned 3
	[0135.706] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.cc") returned 0
	[0135.706] lstrlenA (lpString="*.cc") returned 4
	[0135.706] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.cpp") returned 0
	[0135.706] lstrlenA (lpString="*.cpp") returned 5
	[0135.706] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.cxx") returned 0
	[0135.706] lstrlenA (lpString="*.cxx") returned 5
	[0135.706] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.c++") returned 0
	[0135.706] lstrlenA (lpString="*.c++") returned 5
	[0135.706] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.cs") returned 0
	[0135.706] lstrlenA (lpString="*.cs") returned 4
	[0135.706] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.vb") returned 0
	[0135.706] lstrlenA (lpString="*.vb") returned 4
	[0135.706] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.bas") returned 0
	[0135.706] lstrlenA (lpString="*.bas") returned 5
	[0135.706] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.csproj") returned 0
	[0135.706] lstrlenA (lpString="*.csproj") returned 8
	[0135.706] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.vbproj") returned 0
	[0135.706] lstrlenA (lpString="*.vbproj") returned 8
	[0135.706] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.vcxproj") returned 0
	[0135.706] lstrlenA (lpString="*.vcxproj") returned 9
	[0135.706] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.manifest") returned 0
	[0135.706] lstrlenA (lpString="*.manifest") returned 10
	[0135.706] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.php") returned 0
	[0135.707] lstrlenA (lpString="*.php") returned 5
	[0135.707] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.vbe") returned 0
	[0135.707] lstrlenA (lpString="*.vbe") returned 5
	[0135.707] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.vba") returned 0
	[0135.707] lstrlenA (lpString="*.vba") returned 5
	[0135.707] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.vbs") returned 0
	[0135.707] lstrlenA (lpString="*.vbs") returned 5
	[0135.707] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.bat") returned 0
	[0135.707] lstrlenA (lpString="*.bat") returned 5
	[0135.707] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.cmd") returned 0
	[0135.707] lstrlenA (lpString="*.cmd") returned 5
	[0135.707] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.js") returned 0
	[0135.707] lstrlenA (lpString="*.js") returned 4
	[0135.707] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.jscript") returned 0
	[0135.707] lstrlenA (lpString="*.jscript") returned 9
	[0135.707] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.hta") returned 0
	[0135.707] lstrlenA (lpString="*.hta") returned 5
	[0135.707] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.php7") returned 0
	[0135.707] lstrlenA (lpString="*.php7") returned 6
	[0135.707] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.db") returned 0
	[0135.707] lstrlenA (lpString="*.db") returned 4
	[0135.707] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.swf") returned 0
	[0135.707] lstrlenA (lpString="*.swf") returned 5
	[0135.707] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.eml") returned 0
	[0135.707] lstrlenA (lpString="*.eml") returned 5
	[0135.707] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.part") returned 0
	[0135.707] lstrlenA (lpString="*.part") returned 6
	[0135.707] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.nfo") returned 0
	[0135.707] lstrlenA (lpString="*.nfo") returned 5
	[0135.707] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.rsa") returned 0
	[0135.707] lstrlenA (lpString="*.rsa") returned 5
	[0135.707] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.key") returned 0
	[0135.707] lstrlenA (lpString="*.key") returned 5
	[0135.707] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.aes") returned 0
	[0135.708] lstrlenA (lpString="*.aes") returned 5
	[0135.708] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.blob") returned 0
	[0135.708] lstrlenA (lpString="*.blob") returned 6
	[0135.708] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.btc") returned 0
	[0135.708] lstrlenA (lpString="*.btc") returned 5
	[0135.708] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\desktop.ini", pszSpec="*.wallet") returned 0
	[0135.708] lstrlenA (lpString="*.wallet") returned 8
	[0135.708] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44269063, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44269063, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44269063, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x1, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1
	[0135.708] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.708] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Everywhere.search-ms") returned -1
	[0135.708] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Everywhere.search-ms") returned 1
	[0135.708] lstrcmpiA (lpString1="", lpString2="Everywhere.search-ms") returned -1
	[0135.708] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Searches\\desktop.ini") returned="desktop.ini"
	[0135.708] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Searches\\" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\") returned="C:\\Users\\FD1HVy\\Searches\\"
	[0135.708] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Searches\\" | out: pszPath="C:\\Users\\FD1HVy\\Searches\\") returned=""
	[0135.708] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Searches\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Searches\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.708] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Searches\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\searches\\how-to-decrypt-files.htm")) returned 0x20
	[0135.708] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Searches\\", lpString2="Everywhere.search-ms" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms") returned="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms"
	[0135.708] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.zip") returned 0
	[0135.708] lstrlenA (lpString="*.zip") returned 5
	[0135.708] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.rar") returned 0
	[0135.708] lstrlenA (lpString="*.rar") returned 5
	[0135.708] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.7z") returned 0
	[0135.708] lstrlenA (lpString="*.7z") returned 4
	[0135.708] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.tar") returned 0
	[0135.708] lstrlenA (lpString="*.tar") returned 5
	[0135.708] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.gzip") returned 0
	[0135.708] lstrlenA (lpString="*.gzip") returned 6
	[0135.708] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.jpg") returned 0
	[0135.708] lstrlenA (lpString="*.jpg") returned 5
	[0135.708] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.jpeg") returned 0
	[0135.708] lstrlenA (lpString="*.jpeg") returned 6
	[0135.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.bmp") returned 0
	[0135.709] lstrlenA (lpString="*.bmp") returned 5
	[0135.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.gif") returned 0
	[0135.709] lstrlenA (lpString="*.gif") returned 5
	[0135.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.png") returned 0
	[0135.709] lstrlenA (lpString="*.png") returned 5
	[0135.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.doc") returned 0
	[0135.709] lstrlenA (lpString="*.doc") returned 5
	[0135.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.docx") returned 0
	[0135.709] lstrlenA (lpString="*.docx") returned 6
	[0135.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.xls") returned 0
	[0135.709] lstrlenA (lpString="*.xls") returned 5
	[0135.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.xlsx") returned 0
	[0135.709] lstrlenA (lpString="*.xlsx") returned 6
	[0135.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.ppt") returned 0
	[0135.709] lstrlenA (lpString="*.ppt") returned 5
	[0135.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.pptx") returned 0
	[0135.709] lstrlenA (lpString="*.pptx") returned 6
	[0135.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.txt") returned 0
	[0135.709] lstrlenA (lpString="*.txt") returned 5
	[0135.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.pdf") returned 0
	[0135.709] lstrlenA (lpString="*.pdf") returned 5
	[0135.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.htm") returned 0
	[0135.709] lstrlenA (lpString="*.htm") returned 5
	[0135.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.html") returned 0
	[0135.709] lstrlenA (lpString="*.html") returned 6
	[0135.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.mdb") returned 0
	[0135.709] lstrlenA (lpString="*.mdb") returned 5
	[0135.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.pfx") returned 0
	[0135.709] lstrlenA (lpString="*.pfx") returned 5
	[0135.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.md") returned 0
	[0135.709] lstrlenA (lpString="*.md") returned 4
	[0135.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.lnk") returned 0
	[0135.709] lstrlenA (lpString="*.lnk") returned 5
	[0135.709] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.torrent") returned 0
	[0135.709] lstrlenA (lpString="*.torrent") returned 9
	[0135.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.mov") returned 0
	[0135.710] lstrlenA (lpString="*.mov") returned 5
	[0135.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.3gp") returned 0
	[0135.710] lstrlenA (lpString="*.3gp") returned 5
	[0135.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.mpeg") returned 0
	[0135.710] lstrlenA (lpString="*.mpeg") returned 6
	[0135.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.mpg") returned 0
	[0135.710] lstrlenA (lpString="*.mpg") returned 5
	[0135.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.flv") returned 0
	[0135.710] lstrlenA (lpString="*.flv") returned 5
	[0135.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.avi") returned 0
	[0135.710] lstrlenA (lpString="*.avi") returned 5
	[0135.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.mp4") returned 0
	[0135.710] lstrlenA (lpString="*.mp4") returned 5
	[0135.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.wmv") returned 0
	[0135.710] lstrlenA (lpString="*.wmv") returned 5
	[0135.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.mkv") returned 0
	[0135.710] lstrlenA (lpString="*.mkv") returned 5
	[0135.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.mp3") returned 0
	[0135.710] lstrlenA (lpString="*.mp3") returned 5
	[0135.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.wav") returned 0
	[0135.710] lstrlenA (lpString="*.wav") returned 5
	[0135.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.flac") returned 0
	[0135.710] lstrlenA (lpString="*.flac") returned 6
	[0135.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.wma") returned 0
	[0135.710] lstrlenA (lpString="*.wma") returned 5
	[0135.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.au3") returned 0
	[0135.710] lstrlenA (lpString="*.au3") returned 5
	[0135.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.ahk") returned 0
	[0135.710] lstrlenA (lpString="*.ahk") returned 5
	[0135.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.c") returned 0
	[0135.710] lstrlenA (lpString="*.c") returned 3
	[0135.710] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.cc") returned 0
	[0135.721] lstrlenA (lpString="*.cc") returned 4
	[0135.721] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.cpp") returned 0
	[0135.721] lstrlenA (lpString="*.cpp") returned 5
	[0135.721] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.cxx") returned 0
	[0135.721] lstrlenA (lpString="*.cxx") returned 5
	[0135.721] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.c++") returned 0
	[0135.721] lstrlenA (lpString="*.c++") returned 5
	[0135.721] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.cs") returned 0
	[0135.721] lstrlenA (lpString="*.cs") returned 4
	[0135.721] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.vb") returned 0
	[0135.721] lstrlenA (lpString="*.vb") returned 4
	[0135.721] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.bas") returned 0
	[0135.721] lstrlenA (lpString="*.bas") returned 5
	[0135.721] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.csproj") returned 0
	[0135.721] lstrlenA (lpString="*.csproj") returned 8
	[0135.721] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.vbproj") returned 0
	[0135.721] lstrlenA (lpString="*.vbproj") returned 8
	[0135.721] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.vcxproj") returned 0
	[0135.721] lstrlenA (lpString="*.vcxproj") returned 9
	[0135.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.manifest") returned 0
	[0135.722] lstrlenA (lpString="*.manifest") returned 10
	[0135.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.php") returned 0
	[0135.722] lstrlenA (lpString="*.php") returned 5
	[0135.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.vbe") returned 0
	[0135.722] lstrlenA (lpString="*.vbe") returned 5
	[0135.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.vba") returned 0
	[0135.722] lstrlenA (lpString="*.vba") returned 5
	[0135.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.vbs") returned 0
	[0135.722] lstrlenA (lpString="*.vbs") returned 5
	[0135.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.bat") returned 0
	[0135.722] lstrlenA (lpString="*.bat") returned 5
	[0135.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.cmd") returned 0
	[0135.722] lstrlenA (lpString="*.cmd") returned 5
	[0135.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.js") returned 0
	[0135.722] lstrlenA (lpString="*.js") returned 4
	[0135.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.jscript") returned 0
	[0135.722] lstrlenA (lpString="*.jscript") returned 9
	[0135.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.hta") returned 0
	[0135.722] lstrlenA (lpString="*.hta") returned 5
	[0135.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.php7") returned 0
	[0135.722] lstrlenA (lpString="*.php7") returned 6
	[0135.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.db") returned 0
	[0135.722] lstrlenA (lpString="*.db") returned 4
	[0135.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.swf") returned 0
	[0135.722] lstrlenA (lpString="*.swf") returned 5
	[0135.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.eml") returned 0
	[0135.722] lstrlenA (lpString="*.eml") returned 5
	[0135.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.part") returned 0
	[0135.722] lstrlenA (lpString="*.part") returned 6
	[0135.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.nfo") returned 0
	[0135.722] lstrlenA (lpString="*.nfo") returned 5
	[0135.722] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.rsa") returned 0
	[0135.723] lstrlenA (lpString="*.rsa") returned 5
	[0135.723] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.key") returned 0
	[0135.723] lstrlenA (lpString="*.key") returned 5
	[0135.723] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.aes") returned 0
	[0135.723] lstrlenA (lpString="*.aes") returned 5
	[0135.723] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.blob") returned 0
	[0135.723] lstrlenA (lpString="*.blob") returned 6
	[0135.723] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.btc") returned 0
	[0135.723] lstrlenA (lpString="*.btc") returned 5
	[0135.723] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", pszSpec="*.wallet") returned 0
	[0135.723] lstrlenA (lpString="*.wallet") returned 8
	[0135.723] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44242e24, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44242e24, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44242e24, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1
	[0135.723] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.723] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Indexed Locations.search-ms") returned -1
	[0135.723] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Indexed Locations.search-ms") returned -1
	[0135.723] lstrcmpiA (lpString1="", lpString2="Indexed Locations.search-ms") returned -1
	[0135.723] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms") returned="Everywhere.search-ms"
	[0135.723] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Searches\\" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\") returned="C:\\Users\\FD1HVy\\Searches\\"
	[0135.723] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Searches\\" | out: pszPath="C:\\Users\\FD1HVy\\Searches\\") returned=""
	[0135.723] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Searches\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Searches\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.723] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Searches\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\searches\\how-to-decrypt-files.htm")) returned 0x20
	[0135.723] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Searches\\", lpString2="Indexed Locations.search-ms" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms") returned="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms"
	[0135.723] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.zip") returned 0
	[0135.723] lstrlenA (lpString="*.zip") returned 5
	[0135.723] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.rar") returned 0
	[0135.723] lstrlenA (lpString="*.rar") returned 5
	[0135.723] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.7z") returned 0
	[0135.723] lstrlenA (lpString="*.7z") returned 4
	[0135.723] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.tar") returned 0
	[0135.723] lstrlenA (lpString="*.tar") returned 5
	[0135.724] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.gzip") returned 0
	[0135.724] lstrlenA (lpString="*.gzip") returned 6
	[0135.724] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.jpg") returned 0
	[0135.724] lstrlenA (lpString="*.jpg") returned 5
	[0135.724] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.jpeg") returned 0
	[0135.724] lstrlenA (lpString="*.jpeg") returned 6
	[0135.724] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.bmp") returned 0
	[0135.724] lstrlenA (lpString="*.bmp") returned 5
	[0135.724] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.gif") returned 0
	[0135.724] lstrlenA (lpString="*.gif") returned 5
	[0135.724] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.png") returned 0
	[0135.724] lstrlenA (lpString="*.png") returned 5
	[0135.724] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.doc") returned 0
	[0135.724] lstrlenA (lpString="*.doc") returned 5
	[0135.724] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.docx") returned 0
	[0135.724] lstrlenA (lpString="*.docx") returned 6
	[0135.724] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.xls") returned 0
	[0135.724] lstrlenA (lpString="*.xls") returned 5
	[0135.724] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.xlsx") returned 0
	[0135.724] lstrlenA (lpString="*.xlsx") returned 6
	[0135.724] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.ppt") returned 0
	[0135.724] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.pptx") returned 0
	[0135.724] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.txt") returned 0
	[0135.724] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.pdf") returned 0
	[0135.724] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.htm") returned 0
	[0135.724] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.html") returned 0
	[0135.724] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.mdb") returned 0
	[0135.724] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.pfx") returned 0
	[0135.724] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.md") returned 0
	[0135.724] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.lnk") returned 0
	[0135.724] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.torrent") returned 0
	[0135.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.mov") returned 0
	[0135.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.3gp") returned 0
	[0135.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.mpeg") returned 0
	[0135.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.mpg") returned 0
	[0135.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.flv") returned 0
	[0135.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.avi") returned 0
	[0135.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.mp4") returned 0
	[0135.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.wmv") returned 0
	[0135.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.mkv") returned 0
	[0135.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.mp3") returned 0
	[0135.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.wav") returned 0
	[0135.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.flac") returned 0
	[0135.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.wma") returned 0
	[0135.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.au3") returned 0
	[0135.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.ahk") returned 0
	[0135.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.c") returned 0
	[0135.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.cc") returned 0
	[0135.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.cpp") returned 0
	[0135.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.cxx") returned 0
	[0135.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.c++") returned 0
	[0135.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.cs") returned 0
	[0135.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.vb") returned 0
	[0135.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.bas") returned 0
	[0135.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.csproj") returned 0
	[0135.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.vbproj") returned 0
	[0135.725] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.vcxproj") returned 0
	[0135.726] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.manifest") returned 0
	[0135.726] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.php") returned 0
	[0135.726] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.vbe") returned 0
	[0135.726] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.vba") returned 0
	[0135.726] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.vbs") returned 0
	[0135.726] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.bat") returned 0
	[0135.726] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.cmd") returned 0
	[0135.726] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.js") returned 0
	[0135.726] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.jscript") returned 0
	[0135.726] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.hta") returned 0
	[0135.726] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.php7") returned 0
	[0135.726] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.db") returned 0
	[0135.726] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.swf") returned 0
	[0135.726] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.eml") returned 0
	[0135.726] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.part") returned 0
	[0135.726] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.nfo") returned 0
	[0135.726] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.rsa") returned 0
	[0135.726] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.key") returned 0
	[0135.726] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.aes") returned 0
	[0135.726] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.blob") returned 0
	[0135.727] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.btc") returned 0
	[0135.727] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", pszSpec="*.wallet") returned 0
	[0135.727] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x0, dwReserved1=0x0, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 1
	[0135.727] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.727] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms") returned -1
	[0135.727] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms") returned -1
	[0135.727] lstrcmpiA (lpString1="", lpString2="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms") returned -1
	[0135.727] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms") returned="Indexed Locations.search-ms"
	[0135.727] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Searches\\" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\") returned="C:\\Users\\FD1HVy\\Searches\\"
	[0135.727] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Searches\\" | out: pszPath="C:\\Users\\FD1HVy\\Searches\\") returned=""
	[0135.727] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Searches\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Searches\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.727] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Searches\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\searches\\how-to-decrypt-files.htm")) returned 0x20
	[0135.727] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Searches\\", lpString2="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms") returned="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms"
	[0135.727] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", pszSpec="*.zip") returned 0
	[0135.727] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", pszSpec="*.rar") returned 0
	[0135.727] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", pszSpec="*.7z") returned 0
	[0135.727] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", pszSpec="*.tar") returned 0
	[0135.727] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", pszSpec="*.gzip") returned 0
	[0135.727] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", pszSpec="*.jpg") returned 0
	[0135.727] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", pszSpec="*.jpeg") returned 0
	[0135.727] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", pszSpec="*.bmp") returned 0
	[0135.727] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", pszSpec="*.gif") returned 0
	[0135.727] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", pszSpec="*.png") returned 0
	[0135.727] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", pszSpec="*.doc") returned 0
	[0135.727] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", pszSpec="*.docx") returned 0
	[0135.727] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", pszSpec="*.xls") returned 0
	[0135.728] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", pszSpec="*.xlsx") returned 0
	[0135.728] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", pszSpec="*.ppt") returned 0
	[0135.728] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", pszSpec="*.pptx") returned 0
	[0135.728] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", pszSpec="*.txt") returned 0
	[0135.728] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", pszSpec="*.pdf") returned 0
	[0135.728] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", pszSpec="*.htm") returned 0
	[0135.728] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", pszSpec="*.html") returned 0
	[0135.728] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", pszSpec="*.mdb") returned 0
	[0135.728] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", pszSpec="*.pfx") returned 0
	[0135.728] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", pszSpec="*.md") returned 0
	[0135.728] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", pszSpec="*.lnk") returned 0
	[0135.728] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", pszSpec="*.torrent") returned 0
	[0135.728] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", pszSpec="*.mov") returned 0
	[0135.728] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", pszSpec="*.3gp") returned 0
	[0135.728] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", pszSpec="*.mpeg") returned 0
	[0135.728] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", pszSpec="*.mpg") returned 0
	[0135.728] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", pszSpec="*.flv") returned 0
	[0135.728] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x0, dwReserved1=0x0, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 0
	[0135.729] FindClose (in: hFindFile=0x7cb990 | out: hFindFile=0x7cb990) returned 1
	[0135.729] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1
	[0135.729] lstrcmpA (lpString1=".", lpString2="SendTo") returned -1
	[0135.729] lstrcmpA (lpString1="..", lpString2="SendTo") returned -1
	[0135.729] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\*.*") returned="*.*"
	[0135.729] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="SendTo" | out: lpString1="C:\\Users\\FD1HVy\\SendTo") returned="C:\\Users\\FD1HVy\\SendTo"
	[0135.729] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\SendTo\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x0, dwReserved1=0x0, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="\xcc\xff\x19")) returned 0xffffffff
	[0135.729] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1
	[0135.729] lstrcmpA (lpString1=".", lpString2="Start Menu") returned -1
	[0135.729] lstrcmpA (lpString1="..", lpString2="Start Menu") returned -1
	[0135.729] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\*.*") returned="*.*"
	[0135.729] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Start Menu" | out: lpString1="C:\\Users\\FD1HVy\\Start Menu") returned="C:\\Users\\FD1HVy\\Start Menu"
	[0135.729] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Start Menu\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x0, dwReserved1=0x0, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="\xcc\xff\x19")) returned 0xffffffff
	[0135.729] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0135.729] lstrcmpA (lpString1=".", lpString2="Templates") returned -1
	[0135.729] lstrcmpA (lpString1="..", lpString2="Templates") returned -1
	[0135.729] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\*.*") returned="*.*"
	[0135.729] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Templates" | out: lpString1="C:\\Users\\FD1HVy\\Templates") returned="C:\\Users\\FD1HVy\\Templates"
	[0135.729] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Templates\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x0, dwReserved1=0x0, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="\xcc\xff\x19")) returned 0xffffffff
	[0135.729] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x118995f2, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x118995f2, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1
	[0135.729] lstrcmpA (lpString1=".", lpString2="Videos") returned -1
	[0135.729] lstrcmpA (lpString1="..", lpString2="Videos") returned -1
	[0135.730] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\*.*") returned="*.*"
	[0135.730] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Videos" | out: lpString1="C:\\Users\\FD1HVy\\Videos") returned="C:\\Users\\FD1HVy\\Videos"
	[0135.730] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x118995f2, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x118995f2, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbad0
	[0135.730] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0135.730] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x118995f2, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x118995f2, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0135.730] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0135.730] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0135.730] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x866adce0, ftCreationTime.dwHighDateTime=0x1d4cec0, ftLastAccessTime.dwLowDateTime=0xd49cadf0, ftLastAccessTime.dwHighDateTime=0x1d4d233, ftLastWriteTime.dwLowDateTime=0xd49cadf0, ftLastWriteTime.dwHighDateTime=0x1d4d233, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8UFcG-haiTpskJzQ", cAlternateFileName="8UFCG-~1")) returned 1
	[0135.730] lstrcmpA (lpString1=".", lpString2="8UFcG-haiTpskJzQ") returned -1
	[0135.730] lstrcmpA (lpString1="..", lpString2="8UFcG-haiTpskJzQ") returned -1
	[0135.730] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\*.*") returned="*.*"
	[0135.730] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="8UFcG-haiTpskJzQ" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ"
	[0135.730] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x866adce0, ftCreationTime.dwHighDateTime=0x1d4cec0, ftLastAccessTime.dwLowDateTime=0xd49cadf0, ftLastAccessTime.dwHighDateTime=0x1d4d233, ftLastWriteTime.dwLowDateTime=0xd49cadf0, ftLastWriteTime.dwHighDateTime=0x1d4d233, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cb5d0
	[0135.730] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0135.730] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x866adce0, ftCreationTime.dwHighDateTime=0x1d4cec0, ftLastAccessTime.dwLowDateTime=0xd49cadf0, ftLastAccessTime.dwHighDateTime=0x1d4d233, ftLastWriteTime.dwLowDateTime=0xd49cadf0, ftLastWriteTime.dwHighDateTime=0x1d4d233, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0135.730] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0135.730] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0135.730] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x179f7e50, ftCreationTime.dwHighDateTime=0x1d4d0ba, ftLastAccessTime.dwLowDateTime=0x587a4430, ftLastAccessTime.dwHighDateTime=0x1d4ceb4, ftLastWriteTime.dwLowDateTime=0x587a4430, ftLastWriteTime.dwHighDateTime=0x1d4ceb4, nFileSizeHigh=0x0, nFileSizeLow=0x1542e, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="17-4bow-5 tANaCT.flv", cAlternateFileName="17-4BO~1.FLV")) returned 1
	[0135.730] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0135.730] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="17-4bow-5 tANaCT.flv") returned 1
	[0135.730] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="17-4bow-5 tANaCT.flv") returned 1
	[0135.730] lstrcmpiA (lpString1="", lpString2="17-4bow-5 tANaCT.flv") returned -1
	[0135.730] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\*.*") returned="*.*"
	[0135.730] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\"
	[0135.731] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\") returned=""
	[0135.731] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.731] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0135.731] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0135.733] WriteFile (in: hFile=0x210, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0135.734] SetFileTime (hFile=0x210, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0135.734] CloseHandle (hObject=0x210) returned 1
	[0135.734] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\", lpString2="17-4bow-5 tANaCT.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv"
	[0135.734] lstrlenA (lpString="*.zip") returned 5
	[0135.734] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv", pszSpec="*.rar") returned 0
	[0135.734] lstrlenA (lpString="*.rar") returned 5
	[0135.734] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv", pszSpec="*.7z") returned 0
	[0135.734] lstrlenA (lpString="*.7z") returned 4
	[0135.734] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv", pszSpec="*.tar") returned 0
	[0135.734] lstrlenA (lpString="*.tar") returned 5
	[0135.734] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv", pszSpec="*.gzip") returned 0
	[0135.734] lstrlenA (lpString="*.gzip") returned 6
	[0135.734] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv", pszSpec="*.jpg") returned 0
	[0135.734] lstrlenA (lpString="*.jpg") returned 5
	[0135.734] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv", pszSpec="*.jpeg") returned 0
	[0135.734] lstrlenA (lpString="*.jpeg") returned 6
	[0135.734] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv", pszSpec="*.bmp") returned 0
	[0135.734] lstrlenA (lpString="*.bmp") returned 5
	[0135.735] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv", pszSpec="*.gif") returned 0
	[0135.735] lstrlenA (lpString="*.gif") returned 5
	[0135.735] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv", pszSpec="*.png") returned 0
	[0135.735] lstrlenA (lpString="*.png") returned 5
	[0135.735] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv", pszSpec="*.doc") returned 0
	[0135.735] lstrlenA (lpString="*.doc") returned 5
	[0135.735] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv", pszSpec="*.docx") returned 0
	[0135.735] lstrlenA (lpString="*.docx") returned 6
	[0135.735] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv", pszSpec="*.xls") returned 0
	[0135.735] lstrlenA (lpString="*.xls") returned 5
	[0135.735] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv", pszSpec="*.xlsx") returned 0
	[0135.735] lstrlenA (lpString="*.xlsx") returned 6
	[0135.735] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv", pszSpec="*.ppt") returned 0
	[0135.735] lstrlenA (lpString="*.ppt") returned 5
	[0135.735] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv", pszSpec="*.pptx") returned 0
	[0135.735] lstrlenA (lpString="*.pptx") returned 6
	[0135.735] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv", pszSpec="*.txt") returned 0
	[0135.735] lstrlenA (lpString="*.txt") returned 5
	[0135.735] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv", pszSpec="*.pdf") returned 0
	[0135.735] lstrlenA (lpString="*.pdf") returned 5
	[0135.735] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv", pszSpec="*.htm") returned 0
	[0135.735] lstrlenA (lpString="*.htm") returned 5
	[0135.735] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv", pszSpec="*.html") returned 0
	[0135.735] lstrlenA (lpString="*.html") returned 6
	[0135.735] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv", pszSpec="*.mdb") returned 0
	[0135.735] lstrlenA (lpString="*.mdb") returned 5
	[0135.735] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv", pszSpec="*.pfx") returned 0
	[0135.735] lstrlenA (lpString="*.pfx") returned 5
	[0135.735] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv", pszSpec="*.md") returned 0
	[0135.735] lstrlenA (lpString="*.md") returned 4
	[0135.735] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv", pszSpec="*.lnk") returned 0
	[0135.735] lstrlenA (lpString="*.lnk") returned 5
	[0135.735] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv", pszSpec="*.torrent") returned 0
	[0135.735] lstrlenA (lpString="*.torrent") returned 9
	[0135.736] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv", pszSpec="*.mov") returned 0
	[0135.736] lstrlenA (lpString="*.mov") returned 5
	[0135.736] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv", pszSpec="*.3gp") returned 0
	[0135.736] lstrlenA (lpString="*.3gp") returned 5
	[0135.736] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv", pszSpec="*.mpeg") returned 0
	[0135.736] lstrlenA (lpString="*.mpeg") returned 6
	[0135.736] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv", pszSpec="*.mpg") returned 0
	[0135.736] lstrlenA (lpString="*.mpg") returned 5
	[0135.736] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv", pszSpec="*.flv") returned 1
	[0135.736] lstrlenA (lpString="*.flv") returned 5
	[0135.736] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv"
	[0135.736] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv"
	[0135.736] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv.") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv."
	[0135.736] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv.exe") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv.exe"
	[0135.736] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\17-4bow-5 tanact.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0135.736] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1542e
	[0135.736] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x179f7e50, dwHighDateTime=0x1d4d0ba), lpLastAccessTime=0x407536*(dwLowDateTime=0x587a4430, dwHighDateTime=0x1d4ceb4), lpLastWriteTime=0x40753e*(dwLowDateTime=0x587a4430, dwHighDateTime=0x1d4ceb4)) returned 1
	[0135.736] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.737] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x153ec, lpOverlapped=0x0) returned 1
	[0135.738] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv") returned="17-4bow-5 tANaCT.flv"
	[0135.738] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.738] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x153ec, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x153ec, lpOverlapped=0x0) returned 1
	[0135.738] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.738] CloseHandle (hObject=0x210) returned 1
	[0135.739] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\17-4bow-5 tanact.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv.exe" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\17-4bow-5 tanact.flv.exe")) returned 1
	[0135.739] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x965364d0, ftCreationTime.dwHighDateTime=0x1d4cf09, ftLastAccessTime.dwLowDateTime=0x72a920a0, ftLastAccessTime.dwHighDateTime=0x1d4c5eb, ftLastWriteTime.dwLowDateTime=0x72a920a0, ftLastWriteTime.dwHighDateTime=0x1d4c5eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="7ISVk", cAlternateFileName="")) returned 1
	[0135.739] lstrcmpA (lpString1=".", lpString2="7ISVk") returned -1
	[0135.739] lstrcmpA (lpString1="..", lpString2="7ISVk") returned -1
	[0135.739] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\17-4bow-5 tANaCT.flv") returned="17-4bow-5 tANaCT.flv"
	[0135.739] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\", lpString2="7ISVk" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\7ISVk") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\7ISVk"
	[0135.739] lstrlenA (lpString="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\7ISVk") returned 45
	[0135.739] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\7ISVk\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x965364d0, ftCreationTime.dwHighDateTime=0x1d4cf09, ftLastAccessTime.dwLowDateTime=0x72a920a0, ftLastAccessTime.dwHighDateTime=0x1d4c5eb, ftLastWriteTime.dwLowDateTime=0x72a920a0, ftLastWriteTime.dwHighDateTime=0x1d4c5eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName=".", cAlternateFileName="")) returned 0x7cbb90
	[0135.739] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0135.739] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x965364d0, ftCreationTime.dwHighDateTime=0x1d4cf09, ftLastAccessTime.dwLowDateTime=0x72a920a0, ftLastAccessTime.dwHighDateTime=0x1d4c5eb, ftLastWriteTime.dwLowDateTime=0x72a920a0, ftLastWriteTime.dwHighDateTime=0x1d4c5eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="..", cAlternateFileName="")) returned 1
	[0135.740] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0135.740] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0135.740] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x965364d0, ftCreationTime.dwHighDateTime=0x1d4cf09, ftLastAccessTime.dwLowDateTime=0x72a920a0, ftLastAccessTime.dwHighDateTime=0x1d4c5eb, ftLastWriteTime.dwLowDateTime=0x72a920a0, ftLastWriteTime.dwHighDateTime=0x1d4c5eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="..", cAlternateFileName="")) returned 0
	[0135.740] FindClose (in: hFindFile=0x7cbb90 | out: hFindFile=0x7cbb90) returned 1
	[0135.740] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9260a230, ftCreationTime.dwHighDateTime=0x1d4cf8a, ftLastAccessTime.dwLowDateTime=0xb6e58660, ftLastAccessTime.dwHighDateTime=0x1d4d13e, ftLastWriteTime.dwLowDateTime=0xb6e58660, ftLastWriteTime.dwHighDateTime=0x1d4d13e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="GDjs6TVN1VcFEQ", cAlternateFileName="GDJS6T~1")) returned 1
	[0135.740] lstrcmpA (lpString1=".", lpString2="GDjs6TVN1VcFEQ") returned -1
	[0135.740] lstrcmpA (lpString1="..", lpString2="GDjs6TVN1VcFEQ") returned -1
	[0135.740] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\*.*") returned="*.*"
	[0135.740] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\", lpString2="GDjs6TVN1VcFEQ" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ"
	[0135.740] lstrlenA (lpString="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ") returned 54
	[0135.740] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9260a230, ftCreationTime.dwHighDateTime=0x1d4cf8a, ftLastAccessTime.dwLowDateTime=0xb6e58660, ftLastAccessTime.dwHighDateTime=0x1d4d13e, ftLastWriteTime.dwLowDateTime=0xb6e58660, ftLastWriteTime.dwHighDateTime=0x1d4d13e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName=".", cAlternateFileName="")) returned 0x7cb650
	[0135.740] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0135.740] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9260a230, ftCreationTime.dwHighDateTime=0x1d4cf8a, ftLastAccessTime.dwLowDateTime=0xb6e58660, ftLastAccessTime.dwHighDateTime=0x1d4d13e, ftLastWriteTime.dwLowDateTime=0xb6e58660, ftLastWriteTime.dwHighDateTime=0x1d4d13e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="..", cAlternateFileName="")) returned 1
	[0135.740] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0135.740] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0135.740] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cf68b50, ftCreationTime.dwHighDateTime=0x1d4cc20, ftLastAccessTime.dwLowDateTime=0x169cb60, ftLastAccessTime.dwHighDateTime=0x1d4c9d3, ftLastWriteTime.dwLowDateTime=0x169cb60, ftLastWriteTime.dwHighDateTime=0x1d4c9d3, nFileSizeHigh=0x0, nFileSizeLow=0x4e88, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="mCVLcsCYyu5DoWanp.flv", cAlternateFileName="MCVLCS~1.FLV")) returned 1
	[0135.740] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0135.740] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="mCVLcsCYyu5DoWanp.flv") returned -1
	[0135.740] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="mCVLcsCYyu5DoWanp.flv") returned -1
	[0135.740] lstrcmpiA (lpString1="", lpString2="mCVLcsCYyu5DoWanp.flv") returned -1
	[0135.740] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\*.*") returned="*.*"
	[0135.740] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\"
	[0135.740] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\") returned=""
	[0135.740] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.740] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\gdjs6tvn1vcfeq\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0135.741] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\gdjs6tvn1vcfeq\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0135.741] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0135.741] WriteFile (in: hFile=0x214, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0135.742] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0135.742] CloseHandle (hObject=0x214) returned 1
	[0135.742] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\", lpString2="mCVLcsCYyu5DoWanp.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv"
	[0135.742] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv", pszSpec="*.zip") returned 0
	[0135.742] lstrlenA (lpString="*.zip") returned 5
	[0135.742] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv", pszSpec="*.rar") returned 0
	[0135.742] lstrlenA (lpString="*.rar") returned 5
	[0135.742] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv", pszSpec="*.7z") returned 0
	[0135.742] lstrlenA (lpString="*.7z") returned 4
	[0135.742] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv", pszSpec="*.tar") returned 0
	[0135.742] lstrlenA (lpString="*.tar") returned 5
	[0135.742] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv", pszSpec="*.gzip") returned 0
	[0135.742] lstrlenA (lpString="*.gzip") returned 6
	[0135.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv", pszSpec="*.jpg") returned 0
	[0135.743] lstrlenA (lpString="*.jpg") returned 5
	[0135.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv", pszSpec="*.jpeg") returned 0
	[0135.743] lstrlenA (lpString="*.jpeg") returned 6
	[0135.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv", pszSpec="*.bmp") returned 0
	[0135.743] lstrlenA (lpString="*.bmp") returned 5
	[0135.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv", pszSpec="*.gif") returned 0
	[0135.743] lstrlenA (lpString="*.gif") returned 5
	[0135.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv", pszSpec="*.png") returned 0
	[0135.743] lstrlenA (lpString="*.png") returned 5
	[0135.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv", pszSpec="*.doc") returned 0
	[0135.743] lstrlenA (lpString="*.doc") returned 5
	[0135.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv", pszSpec="*.docx") returned 0
	[0135.743] lstrlenA (lpString="*.docx") returned 6
	[0135.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv", pszSpec="*.xls") returned 0
	[0135.743] lstrlenA (lpString="*.xls") returned 5
	[0135.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv", pszSpec="*.xlsx") returned 0
	[0135.743] lstrlenA (lpString="*.xlsx") returned 6
	[0135.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv", pszSpec="*.ppt") returned 0
	[0135.743] lstrlenA (lpString="*.ppt") returned 5
	[0135.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv", pszSpec="*.pptx") returned 0
	[0135.743] lstrlenA (lpString="*.pptx") returned 6
	[0135.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv", pszSpec="*.txt") returned 0
	[0135.743] lstrlenA (lpString="*.txt") returned 5
	[0135.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv", pszSpec="*.pdf") returned 0
	[0135.743] lstrlenA (lpString="*.pdf") returned 5
	[0135.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv", pszSpec="*.htm") returned 0
	[0135.743] lstrlenA (lpString="*.htm") returned 5
	[0135.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv", pszSpec="*.html") returned 0
	[0135.743] lstrlenA (lpString="*.html") returned 6
	[0135.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv", pszSpec="*.mdb") returned 0
	[0135.743] lstrlenA (lpString="*.mdb") returned 5
	[0135.743] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv", pszSpec="*.pfx") returned 0
	[0135.743] lstrlenA (lpString="*.pfx") returned 5
	[0135.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv", pszSpec="*.md") returned 0
	[0135.744] lstrlenA (lpString="*.md") returned 4
	[0135.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv", pszSpec="*.lnk") returned 0
	[0135.744] lstrlenA (lpString="*.lnk") returned 5
	[0135.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv", pszSpec="*.torrent") returned 0
	[0135.744] lstrlenA (lpString="*.torrent") returned 9
	[0135.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv", pszSpec="*.mov") returned 0
	[0135.744] lstrlenA (lpString="*.mov") returned 5
	[0135.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv", pszSpec="*.3gp") returned 0
	[0135.744] lstrlenA (lpString="*.3gp") returned 5
	[0135.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv", pszSpec="*.mpeg") returned 0
	[0135.744] lstrlenA (lpString="*.mpeg") returned 6
	[0135.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv", pszSpec="*.mpg") returned 0
	[0135.744] lstrlenA (lpString="*.mpg") returned 5
	[0135.744] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv", pszSpec="*.flv") returned 1
	[0135.744] lstrlenA (lpString="*.flv") returned 5
	[0135.744] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv"
	[0135.744] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv"
	[0135.744] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv.") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv."
	[0135.744] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv.exe") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv.exe"
	[0135.744] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\gdjs6tvn1vcfeq\\mcvlcscyyu5dowanp.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0135.744] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4e88
	[0135.744] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9cf68b50, dwHighDateTime=0x1d4cc20), lpLastAccessTime=0x407536*(dwLowDateTime=0x169cb60, dwHighDateTime=0x1d4c9d3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x169cb60, dwHighDateTime=0x1d4c9d3)) returned 1
	[0135.745] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.745] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x4e46, lpOverlapped=0x0) returned 1
	[0135.745] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv") returned="mCVLcsCYyu5DoWanp.flv"
	[0135.745] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.746] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x4e46, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x4e46, lpOverlapped=0x0) returned 1
	[0135.746] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.746] CloseHandle (hObject=0x214) returned 1
	[0135.746] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\gdjs6tvn1vcfeq\\mcvlcscyyu5dowanp.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv.exe" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\gdjs6tvn1vcfeq\\mcvlcscyyu5dowanp.flv.exe")) returned 1
	[0135.746] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5a73d0, ftCreationTime.dwHighDateTime=0x1d4c99d, ftLastAccessTime.dwLowDateTime=0x3c24d1a0, ftLastAccessTime.dwHighDateTime=0x1d4ce92, ftLastWriteTime.dwLowDateTime=0x3c24d1a0, ftLastWriteTime.dwHighDateTime=0x1d4ce92, nFileSizeHigh=0x0, nFileSizeLow=0xb7f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="NRn-GWg -L94.mp4", cAlternateFileName="NRN-GW~1.MP4")) returned 1
	[0135.747] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0135.747] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="NRn-GWg -L94.mp4") returned -1
	[0135.747] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="NRn-GWg -L94.mp4") returned -1
	[0135.747] lstrcmpiA (lpString1="", lpString2="NRn-GWg -L94.mp4") returned -1
	[0135.747] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\mCVLcsCYyu5DoWanp.flv") returned="mCVLcsCYyu5DoWanp.flv"
	[0135.747] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\"
	[0135.747] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\") returned=""
	[0135.747] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.747] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\gdjs6tvn1vcfeq\\how-to-decrypt-files.htm")) returned 0x20
	[0135.747] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\", lpString2="NRn-GWg -L94.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4"
	[0135.747] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4", pszSpec="*.zip") returned 0
	[0135.747] lstrlenA (lpString="*.zip") returned 5
	[0135.747] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4", pszSpec="*.rar") returned 0
	[0135.747] lstrlenA (lpString="*.rar") returned 5
	[0135.747] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4", pszSpec="*.7z") returned 0
	[0135.747] lstrlenA (lpString="*.7z") returned 4
	[0135.747] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4", pszSpec="*.tar") returned 0
	[0135.747] lstrlenA (lpString="*.tar") returned 5
	[0135.747] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4", pszSpec="*.gzip") returned 0
	[0135.747] lstrlenA (lpString="*.gzip") returned 6
	[0135.747] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4", pszSpec="*.jpg") returned 0
	[0135.747] lstrlenA (lpString="*.jpg") returned 5
	[0135.747] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4", pszSpec="*.jpeg") returned 0
	[0135.747] lstrlenA (lpString="*.jpeg") returned 6
	[0135.747] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4", pszSpec="*.bmp") returned 0
	[0135.747] lstrlenA (lpString="*.bmp") returned 5
	[0135.747] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4", pszSpec="*.gif") returned 0
	[0135.747] lstrlenA (lpString="*.gif") returned 5
	[0135.747] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4", pszSpec="*.png") returned 0
	[0135.747] lstrlenA (lpString="*.png") returned 5
	[0135.748] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4", pszSpec="*.doc") returned 0
	[0135.748] lstrlenA (lpString="*.doc") returned 5
	[0135.748] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4", pszSpec="*.docx") returned 0
	[0135.748] lstrlenA (lpString="*.docx") returned 6
	[0135.748] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4", pszSpec="*.xls") returned 0
	[0135.748] lstrlenA (lpString="*.xls") returned 5
	[0135.748] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4", pszSpec="*.xlsx") returned 0
	[0135.748] lstrlenA (lpString="*.xlsx") returned 6
	[0135.748] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4", pszSpec="*.ppt") returned 0
	[0135.748] lstrlenA (lpString="*.ppt") returned 5
	[0135.748] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4", pszSpec="*.pptx") returned 0
	[0135.748] lstrlenA (lpString="*.pptx") returned 6
	[0135.748] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4", pszSpec="*.txt") returned 0
	[0135.748] lstrlenA (lpString="*.txt") returned 5
	[0135.748] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4", pszSpec="*.pdf") returned 0
	[0135.748] lstrlenA (lpString="*.pdf") returned 5
	[0135.748] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4", pszSpec="*.htm") returned 0
	[0135.748] lstrlenA (lpString="*.htm") returned 5
	[0135.748] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4", pszSpec="*.html") returned 0
	[0135.748] lstrlenA (lpString="*.html") returned 6
	[0135.748] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4", pszSpec="*.mdb") returned 0
	[0135.748] lstrlenA (lpString="*.mdb") returned 5
	[0135.748] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4", pszSpec="*.pfx") returned 0
	[0135.748] lstrlenA (lpString="*.pfx") returned 5
	[0135.748] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4", pszSpec="*.md") returned 0
	[0135.748] lstrlenA (lpString="*.md") returned 4
	[0135.748] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4", pszSpec="*.lnk") returned 0
	[0135.748] lstrlenA (lpString="*.lnk") returned 5
	[0135.748] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4", pszSpec="*.torrent") returned 0
	[0135.748] lstrlenA (lpString="*.torrent") returned 9
	[0135.748] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4", pszSpec="*.mov") returned 0
	[0135.748] lstrlenA (lpString="*.mov") returned 5
	[0135.748] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4", pszSpec="*.3gp") returned 0
	[0135.748] lstrlenA (lpString="*.3gp") returned 5
	[0135.749] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4", pszSpec="*.mpeg") returned 0
	[0135.749] lstrlenA (lpString="*.mpeg") returned 6
	[0135.749] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4", pszSpec="*.mpg") returned 0
	[0135.749] lstrlenA (lpString="*.mpg") returned 5
	[0135.749] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4", pszSpec="*.flv") returned 0
	[0135.749] lstrlenA (lpString="*.flv") returned 5
	[0135.749] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4", pszSpec="*.avi") returned 0
	[0135.749] lstrlenA (lpString="*.avi") returned 5
	[0135.749] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4", pszSpec="*.mp4") returned 1
	[0135.749] lstrlenA (lpString="*.mp4") returned 5
	[0135.749] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4"
	[0135.749] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4"
	[0135.749] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4.") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4."
	[0135.749] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4.exe") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4.exe"
	[0135.749] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\gdjs6tvn1vcfeq\\nrn-gwg -l94.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0135.749] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb7f6
	[0135.749] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5b5a73d0, dwHighDateTime=0x1d4c99d), lpLastAccessTime=0x407536*(dwLowDateTime=0x3c24d1a0, dwHighDateTime=0x1d4ce92), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3c24d1a0, dwHighDateTime=0x1d4ce92)) returned 1
	[0135.749] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.749] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xb7b4, lpOverlapped=0x0) returned 1
	[0135.750] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4") returned="NRn-GWg -L94.mp4"
	[0135.751] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.751] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xb7b4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xb7b4, lpOverlapped=0x0) returned 1
	[0135.751] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.751] CloseHandle (hObject=0x214) returned 1
	[0135.751] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\gdjs6tvn1vcfeq\\nrn-gwg -l94.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4.exe" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\gdjs6tvn1vcfeq\\nrn-gwg -l94.mp4.exe")) returned 1
	[0135.752] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf57acf30, ftCreationTime.dwHighDateTime=0x1d4cafd, ftLastAccessTime.dwLowDateTime=0x8bcb7050, ftLastAccessTime.dwHighDateTime=0x1d4c8ad, ftLastWriteTime.dwLowDateTime=0x8bcb7050, ftLastWriteTime.dwHighDateTime=0x1d4c8ad, nFileSizeHigh=0x0, nFileSizeLow=0x12f6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="WuNJBkKyh5h.flv", cAlternateFileName="WUNJBK~1.FLV")) returned 1
	[0135.752] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0135.752] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="WuNJBkKyh5h.flv") returned -1
	[0135.752] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="WuNJBkKyh5h.flv") returned -1
	[0135.752] lstrcmpiA (lpString1="", lpString2="WuNJBkKyh5h.flv") returned -1
	[0135.752] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\NRn-GWg -L94.mp4") returned="NRn-GWg -L94.mp4"
	[0135.752] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\"
	[0135.752] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\") returned=""
	[0135.752] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.752] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\gdjs6tvn1vcfeq\\how-to-decrypt-files.htm")) returned 0x20
	[0135.752] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\", lpString2="WuNJBkKyh5h.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv"
	[0135.752] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv", pszSpec="*.zip") returned 0
	[0135.752] lstrlenA (lpString="*.zip") returned 5
	[0135.752] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv", pszSpec="*.rar") returned 0
	[0135.752] lstrlenA (lpString="*.rar") returned 5
	[0135.752] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv", pszSpec="*.7z") returned 0
	[0135.752] lstrlenA (lpString="*.7z") returned 4
	[0135.752] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv", pszSpec="*.tar") returned 0
	[0135.752] lstrlenA (lpString="*.tar") returned 5
	[0135.752] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv", pszSpec="*.gzip") returned 0
	[0135.752] lstrlenA (lpString="*.gzip") returned 6
	[0135.752] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv", pszSpec="*.jpg") returned 0
	[0135.752] lstrlenA (lpString="*.jpg") returned 5
	[0135.752] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv", pszSpec="*.jpeg") returned 0
	[0135.752] lstrlenA (lpString="*.jpeg") returned 6
	[0135.752] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv", pszSpec="*.bmp") returned 0
	[0135.752] lstrlenA (lpString="*.bmp") returned 5
	[0135.752] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv", pszSpec="*.gif") returned 0
	[0135.752] lstrlenA (lpString="*.gif") returned 5
	[0135.753] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv", pszSpec="*.png") returned 0
	[0135.753] lstrlenA (lpString="*.png") returned 5
	[0135.753] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv", pszSpec="*.doc") returned 0
	[0135.753] lstrlenA (lpString="*.doc") returned 5
	[0135.753] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv", pszSpec="*.docx") returned 0
	[0135.753] lstrlenA (lpString="*.docx") returned 6
	[0135.753] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv", pszSpec="*.xls") returned 0
	[0135.753] lstrlenA (lpString="*.xls") returned 5
	[0135.753] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv", pszSpec="*.xlsx") returned 0
	[0135.753] lstrlenA (lpString="*.xlsx") returned 6
	[0135.753] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv", pszSpec="*.ppt") returned 0
	[0135.753] lstrlenA (lpString="*.ppt") returned 5
	[0135.753] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv", pszSpec="*.pptx") returned 0
	[0135.753] lstrlenA (lpString="*.pptx") returned 6
	[0135.753] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv", pszSpec="*.txt") returned 0
	[0135.753] lstrlenA (lpString="*.txt") returned 5
	[0135.753] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv", pszSpec="*.pdf") returned 0
	[0135.753] lstrlenA (lpString="*.pdf") returned 5
	[0135.753] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv", pszSpec="*.htm") returned 0
	[0135.753] lstrlenA (lpString="*.htm") returned 5
	[0135.753] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv", pszSpec="*.html") returned 0
	[0135.753] lstrlenA (lpString="*.html") returned 6
	[0135.753] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv", pszSpec="*.mdb") returned 0
	[0135.753] lstrlenA (lpString="*.mdb") returned 5
	[0135.753] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv", pszSpec="*.pfx") returned 0
	[0135.753] lstrlenA (lpString="*.pfx") returned 5
	[0135.753] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv", pszSpec="*.md") returned 0
	[0135.753] lstrlenA (lpString="*.md") returned 4
	[0135.753] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv", pszSpec="*.lnk") returned 0
	[0135.753] lstrlenA (lpString="*.lnk") returned 5
	[0135.753] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv", pszSpec="*.torrent") returned 0
	[0135.753] lstrlenA (lpString="*.torrent") returned 9
	[0135.753] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv", pszSpec="*.mov") returned 0
	[0135.753] lstrlenA (lpString="*.mov") returned 5
	[0135.754] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv", pszSpec="*.3gp") returned 0
	[0135.754] lstrlenA (lpString="*.3gp") returned 5
	[0135.754] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv", pszSpec="*.mpeg") returned 0
	[0135.754] lstrlenA (lpString="*.mpeg") returned 6
	[0135.754] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv", pszSpec="*.mpg") returned 0
	[0135.754] lstrlenA (lpString="*.mpg") returned 5
	[0135.754] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv", pszSpec="*.flv") returned 1
	[0135.754] lstrlenA (lpString="*.flv") returned 5
	[0135.754] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv"
	[0135.754] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv"
	[0135.754] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv.") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv."
	[0135.754] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv.exe") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv.exe"
	[0135.754] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\gdjs6tvn1vcfeq\\wunjbkkyh5h.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0135.754] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12f6b
	[0135.754] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf57acf30, dwHighDateTime=0x1d4cafd), lpLastAccessTime=0x407536*(dwLowDateTime=0x8bcb7050, dwHighDateTime=0x1d4c8ad), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bcb7050, dwHighDateTime=0x1d4c8ad)) returned 1
	[0135.754] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.754] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x12f29, lpOverlapped=0x0) returned 1
	[0135.755] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv") returned="WuNJBkKyh5h.flv"
	[0135.756] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.756] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x12f29, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x12f29, lpOverlapped=0x0) returned 1
	[0135.756] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.756] CloseHandle (hObject=0x214) returned 1
	[0135.756] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\gdjs6tvn1vcfeq\\wunjbkkyh5h.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv.exe" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\gdjs6tvn1vcfeq\\wunjbkkyh5h.flv.exe")) returned 1
	[0135.757] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x313395f0, ftCreationTime.dwHighDateTime=0x1d4d2a8, ftLastAccessTime.dwLowDateTime=0x33346e50, ftLastAccessTime.dwHighDateTime=0x1d4d150, ftLastWriteTime.dwLowDateTime=0x33346e50, ftLastWriteTime.dwHighDateTime=0x1d4d150, nFileSizeHigh=0x0, nFileSizeLow=0xee40, dwReserved0=0x0, dwReserved1=0x0, cFileName="x6ZLFcxo6NGe6PP.mkv", cAlternateFileName="X6ZLFC~1.MKV")) returned 1
	[0135.757] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0135.757] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="x6ZLFcxo6NGe6PP.mkv") returned -1
	[0135.757] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="x6ZLFcxo6NGe6PP.mkv") returned -1
	[0135.757] lstrcmpiA (lpString1="", lpString2="x6ZLFcxo6NGe6PP.mkv") returned -1
	[0135.757] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\WuNJBkKyh5h.flv") returned="WuNJBkKyh5h.flv"
	[0135.757] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\"
	[0135.757] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\") returned=""
	[0135.757] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.757] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\gdjs6tvn1vcfeq\\how-to-decrypt-files.htm")) returned 0x20
	[0135.757] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\", lpString2="x6ZLFcxo6NGe6PP.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv"
	[0135.757] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv", pszSpec="*.zip") returned 0
	[0135.757] lstrlenA (lpString="*.zip") returned 5
	[0135.757] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv", pszSpec="*.rar") returned 0
	[0135.757] lstrlenA (lpString="*.rar") returned 5
	[0135.804] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv", pszSpec="*.7z") returned 0
	[0135.804] lstrlenA (lpString="*.7z") returned 4
	[0135.804] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv", pszSpec="*.tar") returned 0
	[0135.804] lstrlenA (lpString="*.tar") returned 5
	[0135.804] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv", pszSpec="*.gzip") returned 0
	[0135.804] lstrlenA (lpString="*.gzip") returned 6
	[0135.805] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv", pszSpec="*.jpg") returned 0
	[0135.805] lstrlenA (lpString="*.jpg") returned 5
	[0135.805] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv", pszSpec="*.jpeg") returned 0
	[0135.805] lstrlenA (lpString="*.jpeg") returned 6
	[0135.805] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv", pszSpec="*.bmp") returned 0
	[0135.805] lstrlenA (lpString="*.bmp") returned 5
	[0135.805] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv", pszSpec="*.gif") returned 0
	[0135.805] lstrlenA (lpString="*.gif") returned 5
	[0135.805] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv", pszSpec="*.png") returned 0
	[0135.805] lstrlenA (lpString="*.png") returned 5
	[0135.805] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv", pszSpec="*.doc") returned 0
	[0135.805] lstrlenA (lpString="*.doc") returned 5
	[0135.805] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv", pszSpec="*.docx") returned 0
	[0135.805] lstrlenA (lpString="*.docx") returned 6
	[0135.805] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv", pszSpec="*.xls") returned 0
	[0135.805] lstrlenA (lpString="*.xls") returned 5
	[0135.805] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv", pszSpec="*.xlsx") returned 0
	[0135.805] lstrlenA (lpString="*.xlsx") returned 6
	[0135.805] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv", pszSpec="*.ppt") returned 0
	[0135.805] lstrlenA (lpString="*.ppt") returned 5
	[0135.805] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv", pszSpec="*.pptx") returned 0
	[0135.805] lstrlenA (lpString="*.pptx") returned 6
	[0135.805] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv", pszSpec="*.txt") returned 0
	[0135.805] lstrlenA (lpString="*.txt") returned 5
	[0135.805] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv", pszSpec="*.pdf") returned 0
	[0135.805] lstrlenA (lpString="*.pdf") returned 5
	[0135.805] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv", pszSpec="*.htm") returned 0
	[0135.805] lstrlenA (lpString="*.htm") returned 5
	[0135.805] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv", pszSpec="*.html") returned 0
	[0135.805] lstrlenA (lpString="*.html") returned 6
	[0135.805] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv", pszSpec="*.mdb") returned 0
	[0135.805] lstrlenA (lpString="*.mdb") returned 5
	[0135.805] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv", pszSpec="*.pfx") returned 0
	[0135.805] lstrlenA (lpString="*.pfx") returned 5
	[0135.806] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv", pszSpec="*.md") returned 0
	[0135.806] lstrlenA (lpString="*.md") returned 4
	[0135.806] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv", pszSpec="*.lnk") returned 0
	[0135.806] lstrlenA (lpString="*.lnk") returned 5
	[0135.806] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv", pszSpec="*.torrent") returned 0
	[0135.806] lstrlenA (lpString="*.torrent") returned 9
	[0135.806] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv", pszSpec="*.mov") returned 0
	[0135.806] lstrlenA (lpString="*.mov") returned 5
	[0135.806] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv", pszSpec="*.3gp") returned 0
	[0135.806] lstrlenA (lpString="*.3gp") returned 5
	[0135.806] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv", pszSpec="*.mpeg") returned 0
	[0135.806] lstrlenA (lpString="*.mpeg") returned 6
	[0135.806] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv", pszSpec="*.mpg") returned 0
	[0135.806] lstrlenA (lpString="*.mpg") returned 5
	[0135.806] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv", pszSpec="*.flv") returned 0
	[0135.806] lstrlenA (lpString="*.flv") returned 5
	[0135.806] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv", pszSpec="*.avi") returned 0
	[0135.806] lstrlenA (lpString="*.avi") returned 5
	[0135.806] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv", pszSpec="*.mp4") returned 0
	[0135.806] lstrlenA (lpString="*.mp4") returned 5
	[0135.806] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv", pszSpec="*.wmv") returned 0
	[0135.806] lstrlenA (lpString="*.wmv") returned 5
	[0135.806] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv", pszSpec="*.mkv") returned 1
	[0135.806] lstrlenA (lpString="*.mkv") returned 5
	[0135.806] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv"
	[0135.806] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv"
	[0135.806] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv.") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv."
	[0135.806] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv.exe") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv.exe"
	[0135.806] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\gdjs6tvn1vcfeq\\x6zlfcxo6nge6pp.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0135.807] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xee40
	[0135.807] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x313395f0, dwHighDateTime=0x1d4d2a8), lpLastAccessTime=0x407536*(dwLowDateTime=0x33346e50, dwHighDateTime=0x1d4d150), lpLastWriteTime=0x40753e*(dwLowDateTime=0x33346e50, dwHighDateTime=0x1d4d150)) returned 1
	[0135.807] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.807] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xedfe, lpOverlapped=0x0) returned 1
	[0135.808] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv") returned="x6ZLFcxo6NGe6PP.mkv"
	[0135.809] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.809] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xedfe, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xedfe, lpOverlapped=0x0) returned 1
	[0135.809] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.809] CloseHandle (hObject=0x214) returned 1
	[0135.809] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\gdjs6tvn1vcfeq\\x6zlfcxo6nge6pp.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv.exe" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\gdjs6tvn1vcfeq\\x6zlfcxo6nge6pp.mkv.exe")) returned 1
	[0135.810] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a6c5600, ftCreationTime.dwHighDateTime=0x1d4d0be, ftLastAccessTime.dwLowDateTime=0x742e7460, ftLastAccessTime.dwHighDateTime=0x1d4cb0a, ftLastWriteTime.dwLowDateTime=0x742e7460, ftLastWriteTime.dwHighDateTime=0x1d4cb0a, nFileSizeHigh=0x0, nFileSizeLow=0x105b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="zXTCHEoyb4wNbApqXI.mp4", cAlternateFileName="ZXTCHE~1.MP4")) returned 1
	[0135.810] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0135.810] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="zXTCHEoyb4wNbApqXI.mp4") returned -1
	[0135.810] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="zXTCHEoyb4wNbApqXI.mp4") returned -1
	[0135.810] lstrcmpiA (lpString1="", lpString2="zXTCHEoyb4wNbApqXI.mp4") returned -1
	[0135.810] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\x6ZLFcxo6NGe6PP.mkv") returned="x6ZLFcxo6NGe6PP.mkv"
	[0135.810] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\"
	[0135.810] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\") returned=""
	[0135.810] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.810] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\gdjs6tvn1vcfeq\\how-to-decrypt-files.htm")) returned 0x20
	[0135.810] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\", lpString2="zXTCHEoyb4wNbApqXI.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4"
	[0135.810] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4", pszSpec="*.zip") returned 0
	[0135.810] lstrlenA (lpString="*.zip") returned 5
	[0135.810] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4", pszSpec="*.rar") returned 0
	[0135.810] lstrlenA (lpString="*.rar") returned 5
	[0135.811] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4", pszSpec="*.7z") returned 0
	[0135.811] lstrlenA (lpString="*.7z") returned 4
	[0135.811] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4", pszSpec="*.tar") returned 0
	[0135.811] lstrlenA (lpString="*.tar") returned 5
	[0135.811] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4", pszSpec="*.gzip") returned 0
	[0135.811] lstrlenA (lpString="*.gzip") returned 6
	[0135.811] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4", pszSpec="*.jpg") returned 0
	[0135.811] lstrlenA (lpString="*.jpg") returned 5
	[0135.811] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4", pszSpec="*.jpeg") returned 0
	[0135.811] lstrlenA (lpString="*.jpeg") returned 6
	[0135.811] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4", pszSpec="*.bmp") returned 0
	[0135.811] lstrlenA (lpString="*.bmp") returned 5
	[0135.811] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4", pszSpec="*.gif") returned 0
	[0135.811] lstrlenA (lpString="*.gif") returned 5
	[0135.811] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4", pszSpec="*.png") returned 0
	[0135.811] lstrlenA (lpString="*.png") returned 5
	[0135.811] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4", pszSpec="*.doc") returned 0
	[0135.811] lstrlenA (lpString="*.doc") returned 5
	[0135.811] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4", pszSpec="*.docx") returned 0
	[0135.811] lstrlenA (lpString="*.docx") returned 6
	[0135.811] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4", pszSpec="*.xls") returned 0
	[0135.811] lstrlenA (lpString="*.xls") returned 5
	[0135.811] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4", pszSpec="*.xlsx") returned 0
	[0135.811] lstrlenA (lpString="*.xlsx") returned 6
	[0135.811] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4", pszSpec="*.ppt") returned 0
	[0135.811] lstrlenA (lpString="*.ppt") returned 5
	[0135.811] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4", pszSpec="*.pptx") returned 0
	[0135.811] lstrlenA (lpString="*.pptx") returned 6
	[0135.811] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4", pszSpec="*.txt") returned 0
	[0135.811] lstrlenA (lpString="*.txt") returned 5
	[0135.811] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4", pszSpec="*.pdf") returned 0
	[0135.811] lstrlenA (lpString="*.pdf") returned 5
	[0135.811] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4", pszSpec="*.htm") returned 0
	[0135.812] lstrlenA (lpString="*.htm") returned 5
	[0135.812] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4", pszSpec="*.html") returned 0
	[0135.812] lstrlenA (lpString="*.html") returned 6
	[0135.812] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4", pszSpec="*.mdb") returned 0
	[0135.812] lstrlenA (lpString="*.mdb") returned 5
	[0135.812] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4", pszSpec="*.pfx") returned 0
	[0135.812] lstrlenA (lpString="*.pfx") returned 5
	[0135.812] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4", pszSpec="*.md") returned 0
	[0135.812] lstrlenA (lpString="*.md") returned 4
	[0135.812] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4", pszSpec="*.lnk") returned 0
	[0135.812] lstrlenA (lpString="*.lnk") returned 5
	[0135.812] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4", pszSpec="*.torrent") returned 0
	[0135.812] lstrlenA (lpString="*.torrent") returned 9
	[0135.812] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4", pszSpec="*.mov") returned 0
	[0135.812] lstrlenA (lpString="*.mov") returned 5
	[0135.812] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4", pszSpec="*.3gp") returned 0
	[0135.812] lstrlenA (lpString="*.3gp") returned 5
	[0135.812] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4", pszSpec="*.mpeg") returned 0
	[0135.812] lstrlenA (lpString="*.mpeg") returned 6
	[0135.812] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4", pszSpec="*.mpg") returned 0
	[0135.812] lstrlenA (lpString="*.mpg") returned 5
	[0135.812] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4", pszSpec="*.flv") returned 0
	[0135.812] lstrlenA (lpString="*.flv") returned 5
	[0135.812] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4", pszSpec="*.avi") returned 0
	[0135.812] lstrlenA (lpString="*.avi") returned 5
	[0135.812] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4", pszSpec="*.mp4") returned 1
	[0135.812] lstrlenA (lpString="*.mp4") returned 5
	[0135.812] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4"
	[0135.812] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4"
	[0135.812] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4.") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4."
	[0135.812] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4.exe") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4.exe"
	[0135.812] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\gdjs6tvn1vcfeq\\zxtcheoyb4wnbapqxi.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0135.813] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x105b5
	[0135.813] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5a6c5600, dwHighDateTime=0x1d4d0be), lpLastAccessTime=0x407536*(dwLowDateTime=0x742e7460, dwHighDateTime=0x1d4cb0a), lpLastWriteTime=0x40753e*(dwLowDateTime=0x742e7460, dwHighDateTime=0x1d4cb0a)) returned 1
	[0135.813] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.813] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x10573, lpOverlapped=0x0) returned 1
	[0135.814] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4") returned="zXTCHEoyb4wNbApqXI.mp4"
	[0135.814] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.814] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x10573, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x10573, lpOverlapped=0x0) returned 1
	[0135.815] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.815] CloseHandle (hObject=0x214) returned 1
	[0135.815] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\gdjs6tvn1vcfeq\\zxtcheoyb4wnbapqxi.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\GDjs6TVN1VcFEQ\\zXTCHEoyb4wNbApqXI.mp4.exe" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\gdjs6tvn1vcfeq\\zxtcheoyb4wnbapqxi.mp4.exe")) returned 1
	[0135.815] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a6c5600, ftCreationTime.dwHighDateTime=0x1d4d0be, ftLastAccessTime.dwLowDateTime=0x742e7460, ftLastAccessTime.dwHighDateTime=0x1d4cb0a, ftLastWriteTime.dwLowDateTime=0x742e7460, ftLastWriteTime.dwHighDateTime=0x1d4cb0a, nFileSizeHigh=0x0, nFileSizeLow=0x105b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="zXTCHEoyb4wNbApqXI.mp4", cAlternateFileName="ZXTCHE~1.MP4")) returned 0
	[0135.816] FindClose (in: hFindFile=0x7cb650 | out: hFindFile=0x7cb650) returned 1
	[0135.816] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eb1b10, ftCreationTime.dwHighDateTime=0x1d4cf0a, ftLastAccessTime.dwLowDateTime=0x24fbfb70, ftLastAccessTime.dwHighDateTime=0x1d4d338, ftLastWriteTime.dwLowDateTime=0x24fbfb70, ftLastWriteTime.dwHighDateTime=0x1d4d338, nFileSizeHigh=0x0, nFileSizeLow=0x71b5, dwReserved0=0x20, dwReserved1=0x0, cFileName="IpTn1Je.flv", cAlternateFileName="")) returned 1
	[0135.816] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0135.816] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="IpTn1Je.flv") returned -1
	[0135.816] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="IpTn1Je.flv") returned -1
	[0135.816] lstrcmpiA (lpString1="", lpString2="IpTn1Je.flv") returned -1
	[0135.816] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\*.*") returned="*.*"
	[0135.816] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\"
	[0135.816] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\") returned=""
	[0135.816] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.816] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\how-to-decrypt-files.htm")) returned 0x20
	[0135.816] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\", lpString2="IpTn1Je.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv"
	[0135.816] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv", pszSpec="*.zip") returned 0
	[0135.816] lstrlenA (lpString="*.zip") returned 5
	[0135.816] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv", pszSpec="*.rar") returned 0
	[0135.816] lstrlenA (lpString="*.rar") returned 5
	[0135.816] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv", pszSpec="*.7z") returned 0
	[0135.816] lstrlenA (lpString="*.7z") returned 4
	[0135.816] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv", pszSpec="*.tar") returned 0
	[0135.816] lstrlenA (lpString="*.tar") returned 5
	[0135.816] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv", pszSpec="*.gzip") returned 0
	[0135.816] lstrlenA (lpString="*.gzip") returned 6
	[0135.816] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv", pszSpec="*.jpg") returned 0
	[0135.816] lstrlenA (lpString="*.jpg") returned 5
	[0135.816] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv", pszSpec="*.jpeg") returned 0
	[0135.816] lstrlenA (lpString="*.jpeg") returned 6
	[0135.816] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv", pszSpec="*.bmp") returned 0
	[0135.816] lstrlenA (lpString="*.bmp") returned 5
	[0135.816] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv", pszSpec="*.gif") returned 0
	[0135.816] lstrlenA (lpString="*.gif") returned 5
	[0135.817] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv", pszSpec="*.png") returned 0
	[0135.817] lstrlenA (lpString="*.png") returned 5
	[0135.817] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv", pszSpec="*.doc") returned 0
	[0135.817] lstrlenA (lpString="*.doc") returned 5
	[0135.817] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv", pszSpec="*.docx") returned 0
	[0135.817] lstrlenA (lpString="*.docx") returned 6
	[0135.817] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv", pszSpec="*.xls") returned 0
	[0135.817] lstrlenA (lpString="*.xls") returned 5
	[0135.817] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv", pszSpec="*.xlsx") returned 0
	[0135.817] lstrlenA (lpString="*.xlsx") returned 6
	[0135.817] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv", pszSpec="*.ppt") returned 0
	[0135.817] lstrlenA (lpString="*.ppt") returned 5
	[0135.817] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv", pszSpec="*.pptx") returned 0
	[0135.817] lstrlenA (lpString="*.pptx") returned 6
	[0135.817] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv", pszSpec="*.txt") returned 0
	[0135.817] lstrlenA (lpString="*.txt") returned 5
	[0135.817] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv", pszSpec="*.pdf") returned 0
	[0135.817] lstrlenA (lpString="*.pdf") returned 5
	[0135.817] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv", pszSpec="*.htm") returned 0
	[0135.817] lstrlenA (lpString="*.htm") returned 5
	[0135.817] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv", pszSpec="*.html") returned 0
	[0135.817] lstrlenA (lpString="*.html") returned 6
	[0135.817] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv", pszSpec="*.mdb") returned 0
	[0135.817] lstrlenA (lpString="*.mdb") returned 5
	[0135.817] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv", pszSpec="*.pfx") returned 0
	[0135.817] lstrlenA (lpString="*.pfx") returned 5
	[0135.817] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv", pszSpec="*.md") returned 0
	[0135.817] lstrlenA (lpString="*.md") returned 4
	[0135.817] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv", pszSpec="*.lnk") returned 0
	[0135.817] lstrlenA (lpString="*.lnk") returned 5
	[0135.817] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv", pszSpec="*.torrent") returned 0
	[0135.817] lstrlenA (lpString="*.torrent") returned 9
	[0135.817] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv", pszSpec="*.mov") returned 0
	[0135.817] lstrlenA (lpString="*.mov") returned 5
	[0135.818] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv", pszSpec="*.3gp") returned 0
	[0135.818] lstrlenA (lpString="*.3gp") returned 5
	[0135.818] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv", pszSpec="*.mpeg") returned 0
	[0135.818] lstrlenA (lpString="*.mpeg") returned 6
	[0135.818] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv", pszSpec="*.mpg") returned 0
	[0135.818] lstrlenA (lpString="*.mpg") returned 5
	[0135.818] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv", pszSpec="*.flv") returned 1
	[0135.818] lstrlenA (lpString="*.flv") returned 5
	[0135.818] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv"
	[0135.818] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv"
	[0135.818] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv.") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv."
	[0135.818] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv.exe") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv.exe"
	[0135.818] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\iptn1je.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0135.818] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x71b5
	[0135.818] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84eb1b10, dwHighDateTime=0x1d4cf0a), lpLastAccessTime=0x407536*(dwLowDateTime=0x24fbfb70, dwHighDateTime=0x1d4d338), lpLastWriteTime=0x40753e*(dwLowDateTime=0x24fbfb70, dwHighDateTime=0x1d4d338)) returned 1
	[0135.818] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.818] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x7173, lpOverlapped=0x0) returned 1
	[0135.819] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv") returned="IpTn1Je.flv"
	[0135.819] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.819] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x7173, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x7173, lpOverlapped=0x0) returned 1
	[0135.820] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.820] CloseHandle (hObject=0x210) returned 1
	[0135.820] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\iptn1je.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv.exe" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\iptn1je.flv.exe")) returned 1
	[0135.821] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5dc2590, ftCreationTime.dwHighDateTime=0x1d4d313, ftLastAccessTime.dwLowDateTime=0xa9b1c3a0, ftLastAccessTime.dwHighDateTime=0x1d4d2b5, ftLastWriteTime.dwLowDateTime=0xa9b1c3a0, ftLastWriteTime.dwHighDateTime=0x1d4d2b5, nFileSizeHigh=0x0, nFileSizeLow=0xe8a2, dwReserved0=0x1f, dwReserved1=0x1, cFileName="MqM0.flv", cAlternateFileName="")) returned 1
	[0135.821] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0135.821] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="MqM0.flv") returned -1
	[0135.821] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="MqM0.flv") returned -1
	[0135.821] lstrcmpiA (lpString1="", lpString2="MqM0.flv") returned -1
	[0135.821] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\IpTn1Je.flv") returned="IpTn1Je.flv"
	[0135.821] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\"
	[0135.821] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\") returned=""
	[0135.821] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.821] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\how-to-decrypt-files.htm")) returned 0x20
	[0135.821] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\", lpString2="MqM0.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv"
	[0135.821] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv", pszSpec="*.zip") returned 0
	[0135.821] lstrlenA (lpString="*.zip") returned 5
	[0135.821] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv", pszSpec="*.rar") returned 0
	[0135.821] lstrlenA (lpString="*.rar") returned 5
	[0135.821] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv", pszSpec="*.7z") returned 0
	[0135.821] lstrlenA (lpString="*.7z") returned 4
	[0135.821] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv", pszSpec="*.tar") returned 0
	[0135.821] lstrlenA (lpString="*.tar") returned 5
	[0135.821] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv", pszSpec="*.gzip") returned 0
	[0135.821] lstrlenA (lpString="*.gzip") returned 6
	[0135.821] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv", pszSpec="*.jpg") returned 0
	[0135.821] lstrlenA (lpString="*.jpg") returned 5
	[0135.821] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv", pszSpec="*.jpeg") returned 0
	[0135.821] lstrlenA (lpString="*.jpeg") returned 6
	[0135.821] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv", pszSpec="*.bmp") returned 0
	[0135.821] lstrlenA (lpString="*.bmp") returned 5
	[0135.821] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv", pszSpec="*.gif") returned 0
	[0135.822] lstrlenA (lpString="*.gif") returned 5
	[0135.822] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv", pszSpec="*.png") returned 0
	[0135.822] lstrlenA (lpString="*.png") returned 5
	[0135.822] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv", pszSpec="*.doc") returned 0
	[0135.822] lstrlenA (lpString="*.doc") returned 5
	[0135.822] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv", pszSpec="*.docx") returned 0
	[0135.822] lstrlenA (lpString="*.docx") returned 6
	[0135.822] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv", pszSpec="*.xls") returned 0
	[0135.822] lstrlenA (lpString="*.xls") returned 5
	[0135.822] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv", pszSpec="*.xlsx") returned 0
	[0135.822] lstrlenA (lpString="*.xlsx") returned 6
	[0135.822] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv", pszSpec="*.ppt") returned 0
	[0135.822] lstrlenA (lpString="*.ppt") returned 5
	[0135.822] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv", pszSpec="*.pptx") returned 0
	[0135.822] lstrlenA (lpString="*.pptx") returned 6
	[0135.822] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv", pszSpec="*.txt") returned 0
	[0135.822] lstrlenA (lpString="*.txt") returned 5
	[0135.822] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv", pszSpec="*.pdf") returned 0
	[0135.822] lstrlenA (lpString="*.pdf") returned 5
	[0135.822] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv", pszSpec="*.htm") returned 0
	[0135.822] lstrlenA (lpString="*.htm") returned 5
	[0135.822] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv", pszSpec="*.html") returned 0
	[0135.822] lstrlenA (lpString="*.html") returned 6
	[0135.822] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv", pszSpec="*.mdb") returned 0
	[0135.822] lstrlenA (lpString="*.mdb") returned 5
	[0135.822] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv", pszSpec="*.pfx") returned 0
	[0135.822] lstrlenA (lpString="*.pfx") returned 5
	[0135.822] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv", pszSpec="*.md") returned 0
	[0135.822] lstrlenA (lpString="*.md") returned 4
	[0135.822] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv", pszSpec="*.lnk") returned 0
	[0135.822] lstrlenA (lpString="*.lnk") returned 5
	[0135.823] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv", pszSpec="*.torrent") returned 0
	[0135.823] lstrlenA (lpString="*.torrent") returned 9
	[0135.823] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv", pszSpec="*.mov") returned 0
	[0135.823] lstrlenA (lpString="*.mov") returned 5
	[0135.823] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv", pszSpec="*.3gp") returned 0
	[0135.823] lstrlenA (lpString="*.3gp") returned 5
	[0135.823] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv", pszSpec="*.mpeg") returned 0
	[0135.823] lstrlenA (lpString="*.mpeg") returned 6
	[0135.823] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv", pszSpec="*.mpg") returned 0
	[0135.823] lstrlenA (lpString="*.mpg") returned 5
	[0135.823] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv", pszSpec="*.flv") returned 1
	[0135.823] lstrlenA (lpString="*.flv") returned 5
	[0135.823] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv"
	[0135.823] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv"
	[0135.823] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv.") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv."
	[0135.823] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv.exe") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv.exe"
	[0135.823] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\mqm0.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0135.823] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe8a2
	[0135.823] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5dc2590, dwHighDateTime=0x1d4d313), lpLastAccessTime=0x407536*(dwLowDateTime=0xa9b1c3a0, dwHighDateTime=0x1d4d2b5), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa9b1c3a0, dwHighDateTime=0x1d4d2b5)) returned 1
	[0135.823] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.823] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xe860, lpOverlapped=0x0) returned 1
	[0135.824] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv") returned="MqM0.flv"
	[0135.825] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.825] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xe860, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xe860, lpOverlapped=0x0) returned 1
	[0135.825] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.825] CloseHandle (hObject=0x210) returned 1
	[0135.825] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\mqm0.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv.exe" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\mqm0.flv.exe")) returned 1
	[0135.826] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88045590, ftCreationTime.dwHighDateTime=0x1d4d537, ftLastAccessTime.dwLowDateTime=0x503c17f0, ftLastAccessTime.dwHighDateTime=0x1d4c700, ftLastWriteTime.dwLowDateTime=0x503c17f0, ftLastWriteTime.dwHighDateTime=0x1d4c700, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="vxBXX0", cAlternateFileName="")) returned 1
	[0135.826] lstrcmpA (lpString1=".", lpString2="vxBXX0") returned -1
	[0135.826] lstrcmpA (lpString1="..", lpString2="vxBXX0") returned -1
	[0135.826] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\MqM0.flv") returned="MqM0.flv"
	[0135.826] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\", lpString2="vxBXX0" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0"
	[0135.826] lstrlenA (lpString="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0") returned 46
	[0135.826] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88045590, ftCreationTime.dwHighDateTime=0x1d4d537, ftLastAccessTime.dwLowDateTime=0x503c17f0, ftLastAccessTime.dwHighDateTime=0x1d4c700, ftLastWriteTime.dwLowDateTime=0x503c17f0, ftLastWriteTime.dwHighDateTime=0x1d4c700, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName=".", cAlternateFileName="")) returned 0x7cb910
	[0135.826] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0135.826] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88045590, ftCreationTime.dwHighDateTime=0x1d4d537, ftLastAccessTime.dwLowDateTime=0x503c17f0, ftLastAccessTime.dwHighDateTime=0x1d4c700, ftLastWriteTime.dwLowDateTime=0x503c17f0, ftLastWriteTime.dwHighDateTime=0x1d4c700, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="..", cAlternateFileName="")) returned 1
	[0135.826] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0135.826] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0135.826] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6651940, ftCreationTime.dwHighDateTime=0x1d4cd27, ftLastAccessTime.dwLowDateTime=0x91711010, ftLastAccessTime.dwHighDateTime=0x1d4cd2f, ftLastWriteTime.dwLowDateTime=0x91711010, ftLastWriteTime.dwHighDateTime=0x1d4cd2f, nFileSizeHigh=0x0, nFileSizeLow=0x10bfb, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="cLAZZ1.avi", cAlternateFileName="")) returned 1
	[0135.826] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0135.826] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="cLAZZ1.avi") returned 1
	[0135.826] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="cLAZZ1.avi") returned 1
	[0135.826] lstrcmpiA (lpString1="", lpString2="cLAZZ1.avi") returned -1
	[0135.826] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\*.*") returned="*.*"
	[0135.826] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\"
	[0135.826] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\") returned=""
	[0135.826] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.827] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0135.827] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0135.827] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0135.827] WriteFile (in: hFile=0x214, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0135.828] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0135.828] CloseHandle (hObject=0x214) returned 1
	[0135.828] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\", lpString2="cLAZZ1.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi"
	[0135.828] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi", pszSpec="*.zip") returned 0
	[0135.828] lstrlenA (lpString="*.zip") returned 5
	[0135.828] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi", pszSpec="*.rar") returned 0
	[0135.828] lstrlenA (lpString="*.rar") returned 5
	[0135.828] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi", pszSpec="*.7z") returned 0
	[0135.828] lstrlenA (lpString="*.7z") returned 4
	[0135.828] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi", pszSpec="*.tar") returned 0
	[0135.828] lstrlenA (lpString="*.tar") returned 5
	[0135.828] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi", pszSpec="*.gzip") returned 0
	[0135.828] lstrlenA (lpString="*.gzip") returned 6
	[0135.828] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi", pszSpec="*.jpg") returned 0
	[0135.828] lstrlenA (lpString="*.jpg") returned 5
	[0135.829] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi", pszSpec="*.jpeg") returned 0
	[0135.829] lstrlenA (lpString="*.jpeg") returned 6
	[0135.829] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi", pszSpec="*.bmp") returned 0
	[0135.829] lstrlenA (lpString="*.bmp") returned 5
	[0135.829] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi", pszSpec="*.gif") returned 0
	[0135.829] lstrlenA (lpString="*.gif") returned 5
	[0135.829] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi", pszSpec="*.png") returned 0
	[0135.829] lstrlenA (lpString="*.png") returned 5
	[0135.829] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi", pszSpec="*.doc") returned 0
	[0135.829] lstrlenA (lpString="*.doc") returned 5
	[0135.829] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi", pszSpec="*.docx") returned 0
	[0135.829] lstrlenA (lpString="*.docx") returned 6
	[0135.829] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi", pszSpec="*.xls") returned 0
	[0135.829] lstrlenA (lpString="*.xls") returned 5
	[0135.829] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi", pszSpec="*.xlsx") returned 0
	[0135.829] lstrlenA (lpString="*.xlsx") returned 6
	[0135.829] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi", pszSpec="*.ppt") returned 0
	[0135.829] lstrlenA (lpString="*.ppt") returned 5
	[0135.829] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi", pszSpec="*.pptx") returned 0
	[0135.829] lstrlenA (lpString="*.pptx") returned 6
	[0135.829] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi", pszSpec="*.txt") returned 0
	[0135.829] lstrlenA (lpString="*.txt") returned 5
	[0135.829] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi", pszSpec="*.pdf") returned 0
	[0135.829] lstrlenA (lpString="*.pdf") returned 5
	[0135.829] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi", pszSpec="*.htm") returned 0
	[0135.829] lstrlenA (lpString="*.htm") returned 5
	[0135.829] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi", pszSpec="*.html") returned 0
	[0135.829] lstrlenA (lpString="*.html") returned 6
	[0135.829] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi", pszSpec="*.mdb") returned 0
	[0135.829] lstrlenA (lpString="*.mdb") returned 5
	[0135.829] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi", pszSpec="*.pfx") returned 0
	[0135.829] lstrlenA (lpString="*.pfx") returned 5
	[0135.829] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi", pszSpec="*.md") returned 0
	[0135.829] lstrlenA (lpString="*.md") returned 4
	[0135.829] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi", pszSpec="*.lnk") returned 0
	[0135.829] lstrlenA (lpString="*.lnk") returned 5
	[0135.830] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi", pszSpec="*.torrent") returned 0
	[0135.830] lstrlenA (lpString="*.torrent") returned 9
	[0135.830] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi", pszSpec="*.mov") returned 0
	[0135.830] lstrlenA (lpString="*.mov") returned 5
	[0135.830] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi", pszSpec="*.3gp") returned 0
	[0135.830] lstrlenA (lpString="*.3gp") returned 5
	[0135.830] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi", pszSpec="*.mpeg") returned 0
	[0135.830] lstrlenA (lpString="*.mpeg") returned 6
	[0135.830] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi", pszSpec="*.mpg") returned 0
	[0135.830] lstrlenA (lpString="*.mpg") returned 5
	[0135.830] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi", pszSpec="*.flv") returned 0
	[0135.830] lstrlenA (lpString="*.flv") returned 5
	[0135.830] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi", pszSpec="*.avi") returned 1
	[0135.830] lstrlenA (lpString="*.avi") returned 5
	[0135.830] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi"
	[0135.830] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi"
	[0135.830] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi.") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi."
	[0135.830] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi.exe") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi.exe"
	[0135.830] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\clazz1.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0135.830] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10bfb
	[0135.830] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc6651940, dwHighDateTime=0x1d4cd27), lpLastAccessTime=0x407536*(dwLowDateTime=0x91711010, dwHighDateTime=0x1d4cd2f), lpLastWriteTime=0x40753e*(dwLowDateTime=0x91711010, dwHighDateTime=0x1d4cd2f)) returned 1
	[0135.831] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.831] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x10bb9, lpOverlapped=0x0) returned 1
	[0135.832] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi") returned="cLAZZ1.avi"
	[0135.832] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.832] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x10bb9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x10bb9, lpOverlapped=0x0) returned 1
	[0135.832] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.832] CloseHandle (hObject=0x214) returned 1
	[0135.832] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\clazz1.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi.exe" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\clazz1.avi.exe")) returned 1
	[0135.833] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ae49830, ftCreationTime.dwHighDateTime=0x1d4d3bc, ftLastAccessTime.dwLowDateTime=0x11185540, ftLastAccessTime.dwHighDateTime=0x1d4cb95, ftLastWriteTime.dwLowDateTime=0x11185540, ftLastWriteTime.dwHighDateTime=0x1d4cb95, nFileSizeHigh=0x0, nFileSizeLow=0xb75f, dwReserved0=0x0, dwReserved1=0x1, cFileName="d63SZmwpp.flv", cAlternateFileName="D63SZM~1.FLV")) returned 1
	[0135.833] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0135.833] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="d63SZmwpp.flv") returned 1
	[0135.833] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="d63SZmwpp.flv") returned 1
	[0135.833] lstrcmpiA (lpString1="", lpString2="d63SZmwpp.flv") returned -1
	[0135.833] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\cLAZZ1.avi") returned="cLAZZ1.avi"
	[0135.833] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\"
	[0135.833] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\") returned=""
	[0135.833] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.833] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\how-to-decrypt-files.htm")) returned 0x20
	[0135.833] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\", lpString2="d63SZmwpp.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv"
	[0135.833] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv", pszSpec="*.zip") returned 0
	[0135.833] lstrlenA (lpString="*.zip") returned 5
	[0135.833] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv", pszSpec="*.rar") returned 0
	[0135.833] lstrlenA (lpString="*.rar") returned 5
	[0135.834] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv", pszSpec="*.7z") returned 0
	[0135.834] lstrlenA (lpString="*.7z") returned 4
	[0135.834] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv", pszSpec="*.tar") returned 0
	[0135.834] lstrlenA (lpString="*.tar") returned 5
	[0135.834] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv", pszSpec="*.gzip") returned 0
	[0135.834] lstrlenA (lpString="*.gzip") returned 6
	[0135.834] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv", pszSpec="*.jpg") returned 0
	[0135.834] lstrlenA (lpString="*.jpg") returned 5
	[0135.834] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv", pszSpec="*.jpeg") returned 0
	[0135.834] lstrlenA (lpString="*.jpeg") returned 6
	[0135.834] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv", pszSpec="*.bmp") returned 0
	[0135.834] lstrlenA (lpString="*.bmp") returned 5
	[0135.834] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv", pszSpec="*.gif") returned 0
	[0135.834] lstrlenA (lpString="*.gif") returned 5
	[0135.834] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv", pszSpec="*.png") returned 0
	[0135.834] lstrlenA (lpString="*.png") returned 5
	[0135.834] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv", pszSpec="*.doc") returned 0
	[0135.834] lstrlenA (lpString="*.doc") returned 5
	[0135.834] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv", pszSpec="*.docx") returned 0
	[0135.834] lstrlenA (lpString="*.docx") returned 6
	[0135.834] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv", pszSpec="*.xls") returned 0
	[0135.834] lstrlenA (lpString="*.xls") returned 5
	[0135.834] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv", pszSpec="*.xlsx") returned 0
	[0135.834] lstrlenA (lpString="*.xlsx") returned 6
	[0135.834] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv", pszSpec="*.ppt") returned 0
	[0135.834] lstrlenA (lpString="*.ppt") returned 5
	[0135.834] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv", pszSpec="*.pptx") returned 0
	[0135.834] lstrlenA (lpString="*.pptx") returned 6
	[0135.834] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv", pszSpec="*.txt") returned 0
	[0135.834] lstrlenA (lpString="*.txt") returned 5
	[0135.834] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv", pszSpec="*.pdf") returned 0
	[0135.834] lstrlenA (lpString="*.pdf") returned 5
	[0135.834] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv", pszSpec="*.htm") returned 0
	[0135.834] lstrlenA (lpString="*.htm") returned 5
	[0135.835] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv", pszSpec="*.html") returned 0
	[0135.835] lstrlenA (lpString="*.html") returned 6
	[0135.835] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv", pszSpec="*.mdb") returned 0
	[0135.835] lstrlenA (lpString="*.mdb") returned 5
	[0135.835] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv", pszSpec="*.pfx") returned 0
	[0135.835] lstrlenA (lpString="*.pfx") returned 5
	[0135.835] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv", pszSpec="*.md") returned 0
	[0135.835] lstrlenA (lpString="*.md") returned 4
	[0135.835] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv", pszSpec="*.lnk") returned 0
	[0135.835] lstrlenA (lpString="*.lnk") returned 5
	[0135.835] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv", pszSpec="*.torrent") returned 0
	[0135.835] lstrlenA (lpString="*.torrent") returned 9
	[0135.835] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv", pszSpec="*.mov") returned 0
	[0135.835] lstrlenA (lpString="*.mov") returned 5
	[0135.835] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv", pszSpec="*.3gp") returned 0
	[0135.835] lstrlenA (lpString="*.3gp") returned 5
	[0135.835] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv", pszSpec="*.mpeg") returned 0
	[0135.835] lstrlenA (lpString="*.mpeg") returned 6
	[0135.835] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv", pszSpec="*.mpg") returned 0
	[0135.835] lstrlenA (lpString="*.mpg") returned 5
	[0135.835] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv", pszSpec="*.flv") returned 1
	[0135.835] lstrlenA (lpString="*.flv") returned 5
	[0135.835] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv"
	[0135.835] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv"
	[0135.835] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv.") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv."
	[0135.835] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv.exe") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv.exe"
	[0135.835] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\d63szmwpp.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0135.837] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb75f
	[0135.837] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5ae49830, dwHighDateTime=0x1d4d3bc), lpLastAccessTime=0x407536*(dwLowDateTime=0x11185540, dwHighDateTime=0x1d4cb95), lpLastWriteTime=0x40753e*(dwLowDateTime=0x11185540, dwHighDateTime=0x1d4cb95)) returned 1
	[0135.837] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.881] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xb71d, lpOverlapped=0x0) returned 1
	[0135.883] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv") returned="d63SZmwpp.flv"
	[0135.883] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.883] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xb71d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xb71d, lpOverlapped=0x0) returned 1
	[0135.883] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.883] CloseHandle (hObject=0x214) returned 1
	[0135.883] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\d63szmwpp.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv.exe" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\d63szmwpp.flv.exe")) returned 1
	[0135.885] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6ef20b0, ftCreationTime.dwHighDateTime=0x1d4cf86, ftLastAccessTime.dwLowDateTime=0x67c0d420, ftLastAccessTime.dwHighDateTime=0x1d4d0dc, ftLastWriteTime.dwLowDateTime=0x67c0d420, ftLastWriteTime.dwHighDateTime=0x1d4d0dc, nFileSizeHigh=0x0, nFileSizeLow=0x136b, dwReserved0=0x0, dwReserved1=0x1, cFileName="eiStck.mp4", cAlternateFileName="")) returned 1
	[0135.885] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0135.885] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="eiStck.mp4") returned -1
	[0135.885] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="eiStck.mp4") returned 1
	[0135.885] lstrcmpiA (lpString1="", lpString2="eiStck.mp4") returned -1
	[0135.885] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\d63SZmwpp.flv") returned="d63SZmwpp.flv"
	[0135.885] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\"
	[0135.885] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\") returned=""
	[0135.885] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.885] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\how-to-decrypt-files.htm")) returned 0x20
	[0135.885] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\", lpString2="eiStck.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4"
	[0135.885] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4", pszSpec="*.zip") returned 0
	[0135.885] lstrlenA (lpString="*.zip") returned 5
	[0135.885] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4", pszSpec="*.rar") returned 0
	[0135.885] lstrlenA (lpString="*.rar") returned 5
	[0135.885] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4", pszSpec="*.7z") returned 0
	[0135.885] lstrlenA (lpString="*.7z") returned 4
	[0135.885] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4", pszSpec="*.tar") returned 0
	[0135.885] lstrlenA (lpString="*.tar") returned 5
	[0135.885] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4", pszSpec="*.gzip") returned 0
	[0135.885] lstrlenA (lpString="*.gzip") returned 6
	[0135.885] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4", pszSpec="*.jpg") returned 0
	[0135.885] lstrlenA (lpString="*.jpg") returned 5
	[0135.885] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4", pszSpec="*.jpeg") returned 0
	[0135.885] lstrlenA (lpString="*.jpeg") returned 6
	[0135.885] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4", pszSpec="*.bmp") returned 0
	[0135.885] lstrlenA (lpString="*.bmp") returned 5
	[0135.885] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4", pszSpec="*.gif") returned 0
	[0135.886] lstrlenA (lpString="*.gif") returned 5
	[0135.886] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4", pszSpec="*.png") returned 0
	[0135.886] lstrlenA (lpString="*.png") returned 5
	[0135.886] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4", pszSpec="*.doc") returned 0
	[0135.886] lstrlenA (lpString="*.doc") returned 5
	[0135.886] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4", pszSpec="*.docx") returned 0
	[0135.886] lstrlenA (lpString="*.docx") returned 6
	[0135.886] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4", pszSpec="*.xls") returned 0
	[0135.886] lstrlenA (lpString="*.xls") returned 5
	[0135.886] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4", pszSpec="*.xlsx") returned 0
	[0135.886] lstrlenA (lpString="*.xlsx") returned 6
	[0135.886] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4", pszSpec="*.ppt") returned 0
	[0135.886] lstrlenA (lpString="*.ppt") returned 5
	[0135.886] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4", pszSpec="*.pptx") returned 0
	[0135.886] lstrlenA (lpString="*.pptx") returned 6
	[0135.886] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4", pszSpec="*.txt") returned 0
	[0135.886] lstrlenA (lpString="*.txt") returned 5
	[0135.886] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4", pszSpec="*.pdf") returned 0
	[0135.886] lstrlenA (lpString="*.pdf") returned 5
	[0135.886] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4", pszSpec="*.htm") returned 0
	[0135.886] lstrlenA (lpString="*.htm") returned 5
	[0135.886] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4", pszSpec="*.html") returned 0
	[0135.886] lstrlenA (lpString="*.html") returned 6
	[0135.886] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4", pszSpec="*.mdb") returned 0
	[0135.886] lstrlenA (lpString="*.mdb") returned 5
	[0135.886] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4", pszSpec="*.pfx") returned 0
	[0135.886] lstrlenA (lpString="*.pfx") returned 5
	[0135.886] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4", pszSpec="*.md") returned 0
	[0135.886] lstrlenA (lpString="*.md") returned 4
	[0135.886] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4", pszSpec="*.lnk") returned 0
	[0135.886] lstrlenA (lpString="*.lnk") returned 5
	[0135.886] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4", pszSpec="*.torrent") returned 0
	[0135.886] lstrlenA (lpString="*.torrent") returned 9
	[0135.887] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4", pszSpec="*.mov") returned 0
	[0135.887] lstrlenA (lpString="*.mov") returned 5
	[0135.887] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4", pszSpec="*.3gp") returned 0
	[0135.887] lstrlenA (lpString="*.3gp") returned 5
	[0135.887] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4", pszSpec="*.mpeg") returned 0
	[0135.887] lstrlenA (lpString="*.mpeg") returned 6
	[0135.887] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4", pszSpec="*.mpg") returned 0
	[0135.887] lstrlenA (lpString="*.mpg") returned 5
	[0135.887] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4", pszSpec="*.flv") returned 0
	[0135.887] lstrlenA (lpString="*.flv") returned 5
	[0135.887] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4", pszSpec="*.avi") returned 0
	[0135.887] lstrlenA (lpString="*.avi") returned 5
	[0135.887] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4", pszSpec="*.mp4") returned 1
	[0135.887] lstrlenA (lpString="*.mp4") returned 5
	[0135.887] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4"
	[0135.887] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4"
	[0135.887] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4.") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4."
	[0135.887] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4.exe") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4.exe"
	[0135.887] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\eistck.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0135.888] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x136b
	[0135.888] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd6ef20b0, dwHighDateTime=0x1d4cf86), lpLastAccessTime=0x407536*(dwLowDateTime=0x67c0d420, dwHighDateTime=0x1d4d0dc), lpLastWriteTime=0x40753e*(dwLowDateTime=0x67c0d420, dwHighDateTime=0x1d4d0dc)) returned 1
	[0135.888] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.888] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1329, lpOverlapped=0x0) returned 1
	[0135.889] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4") returned="eiStck.mp4"
	[0135.889] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.889] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1329, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1329, lpOverlapped=0x0) returned 1
	[0135.889] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.889] CloseHandle (hObject=0x214) returned 1
	[0135.889] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\eistck.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4.exe" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\eistck.mp4.exe")) returned 1
	[0135.890] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb0f29df0, ftCreationTime.dwHighDateTime=0x1d4d333, ftLastAccessTime.dwLowDateTime=0x9570fef0, ftLastAccessTime.dwHighDateTime=0x1d4cda7, ftLastWriteTime.dwLowDateTime=0x9570fef0, ftLastWriteTime.dwHighDateTime=0x1d4cda7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="eT0hGNACRWv", cAlternateFileName="ET0HGN~1")) returned 1
	[0135.890] lstrcmpA (lpString1=".", lpString2="eT0hGNACRWv") returned -1
	[0135.890] lstrcmpA (lpString1="..", lpString2="eT0hGNACRWv") returned -1
	[0135.890] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eiStck.mp4") returned="eiStck.mp4"
	[0135.890] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\", lpString2="eT0hGNACRWv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv"
	[0135.890] lstrlenA (lpString="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv") returned 58
	[0135.890] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\*.*", lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb0f29df0, ftCreationTime.dwHighDateTime=0x1d4d333, ftLastAccessTime.dwLowDateTime=0x9570fef0, ftLastAccessTime.dwHighDateTime=0x1d4cda7, ftLastWriteTime.dwLowDateTime=0x9570fef0, ftLastWriteTime.dwHighDateTime=0x1d4cda7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName=".", cAlternateFileName="")) returned 0x7cb850
	[0135.890] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0135.890] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb0f29df0, ftCreationTime.dwHighDateTime=0x1d4d333, ftLastAccessTime.dwLowDateTime=0x9570fef0, ftLastAccessTime.dwHighDateTime=0x1d4cda7, ftLastWriteTime.dwLowDateTime=0x9570fef0, ftLastWriteTime.dwHighDateTime=0x1d4cda7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="..", cAlternateFileName="")) returned 1
	[0135.890] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0135.890] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0135.890] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3343fca0, ftCreationTime.dwHighDateTime=0x1d4c866, ftLastAccessTime.dwLowDateTime=0x18d50ec0, ftLastAccessTime.dwHighDateTime=0x1d4d344, ftLastWriteTime.dwLowDateTime=0x18d50ec0, ftLastWriteTime.dwHighDateTime=0x1d4d344, nFileSizeHigh=0x0, nFileSizeLow=0xc637, dwReserved0=0x730072, dwReserved1=0x46005c, cFileName="QKeG 5KcU0vt0wN0E-tR.avi", cAlternateFileName="QKEG5K~1.AVI")) returned 1
	[0135.890] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0135.890] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="QKeG 5KcU0vt0wN0E-tR.avi") returned -1
	[0135.890] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="QKeG 5KcU0vt0wN0E-tR.avi") returned -1
	[0135.890] lstrcmpiA (lpString1="", lpString2="QKeG 5KcU0vt0wN0E-tR.avi") returned -1
	[0135.890] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\*.*") returned="*.*"
	[0135.890] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\"
	[0135.890] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\") returned=""
	[0135.890] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.890] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\et0hgnacrwv\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0135.890] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\et0hgnacrwv\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0135.892] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0135.892] WriteFile (in: hFile=0x218, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0135.893] SetFileTime (hFile=0x218, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0135.893] CloseHandle (hObject=0x218) returned 1
	[0135.893] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\", lpString2="QKeG 5KcU0vt0wN0E-tR.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi"
	[0135.893] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi", pszSpec="*.zip") returned 0
	[0135.893] lstrlenA (lpString="*.zip") returned 5
	[0135.893] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi", pszSpec="*.rar") returned 0
	[0135.893] lstrlenA (lpString="*.rar") returned 5
	[0135.893] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi", pszSpec="*.7z") returned 0
	[0135.893] lstrlenA (lpString="*.7z") returned 4
	[0135.893] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi", pszSpec="*.tar") returned 0
	[0135.893] lstrlenA (lpString="*.tar") returned 5
	[0135.893] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi", pszSpec="*.gzip") returned 0
	[0135.894] lstrlenA (lpString="*.gzip") returned 6
	[0135.894] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi", pszSpec="*.jpg") returned 0
	[0135.894] lstrlenA (lpString="*.jpg") returned 5
	[0135.894] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi", pszSpec="*.jpeg") returned 0
	[0135.894] lstrlenA (lpString="*.jpeg") returned 6
	[0135.894] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi", pszSpec="*.bmp") returned 0
	[0135.894] lstrlenA (lpString="*.bmp") returned 5
	[0135.894] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi", pszSpec="*.gif") returned 0
	[0135.894] lstrlenA (lpString="*.gif") returned 5
	[0135.894] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi", pszSpec="*.png") returned 0
	[0135.894] lstrlenA (lpString="*.png") returned 5
	[0135.894] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi", pszSpec="*.doc") returned 0
	[0135.894] lstrlenA (lpString="*.doc") returned 5
	[0135.894] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi", pszSpec="*.docx") returned 0
	[0135.894] lstrlenA (lpString="*.docx") returned 6
	[0135.894] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi", pszSpec="*.xls") returned 0
	[0135.894] lstrlenA (lpString="*.xls") returned 5
	[0135.894] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi", pszSpec="*.xlsx") returned 0
	[0135.894] lstrlenA (lpString="*.xlsx") returned 6
	[0135.894] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi", pszSpec="*.ppt") returned 0
	[0135.894] lstrlenA (lpString="*.ppt") returned 5
	[0135.894] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi", pszSpec="*.pptx") returned 0
	[0135.894] lstrlenA (lpString="*.pptx") returned 6
	[0135.894] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi", pszSpec="*.txt") returned 0
	[0135.894] lstrlenA (lpString="*.txt") returned 5
	[0135.894] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi", pszSpec="*.pdf") returned 0
	[0135.894] lstrlenA (lpString="*.pdf") returned 5
	[0135.894] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi", pszSpec="*.htm") returned 0
	[0135.894] lstrlenA (lpString="*.htm") returned 5
	[0135.894] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi", pszSpec="*.html") returned 0
	[0135.894] lstrlenA (lpString="*.html") returned 6
	[0135.894] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi", pszSpec="*.mdb") returned 0
	[0135.894] lstrlenA (lpString="*.mdb") returned 5
	[0135.894] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi", pszSpec="*.pfx") returned 0
	[0135.895] lstrlenA (lpString="*.pfx") returned 5
	[0135.895] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi", pszSpec="*.md") returned 0
	[0135.895] lstrlenA (lpString="*.md") returned 4
	[0135.895] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi", pszSpec="*.lnk") returned 0
	[0135.895] lstrlenA (lpString="*.lnk") returned 5
	[0135.895] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi", pszSpec="*.torrent") returned 0
	[0135.895] lstrlenA (lpString="*.torrent") returned 9
	[0135.895] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi", pszSpec="*.mov") returned 0
	[0135.895] lstrlenA (lpString="*.mov") returned 5
	[0135.895] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi", pszSpec="*.3gp") returned 0
	[0135.895] lstrlenA (lpString="*.3gp") returned 5
	[0135.895] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi", pszSpec="*.mpeg") returned 0
	[0135.895] lstrlenA (lpString="*.mpeg") returned 6
	[0135.895] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi", pszSpec="*.mpg") returned 0
	[0135.895] lstrlenA (lpString="*.mpg") returned 5
	[0135.895] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi", pszSpec="*.flv") returned 0
	[0135.895] lstrlenA (lpString="*.flv") returned 5
	[0135.895] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi", pszSpec="*.avi") returned 1
	[0135.895] lstrlenA (lpString="*.avi") returned 5
	[0135.895] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi"
	[0135.895] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi"
	[0135.895] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi.") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi."
	[0135.895] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi.exe") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi.exe"
	[0135.895] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\et0hgnacrwv\\qkeg 5kcu0vt0wn0e-tr.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0135.896] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc637
	[0135.896] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3343fca0, dwHighDateTime=0x1d4c866), lpLastAccessTime=0x407536*(dwLowDateTime=0x18d50ec0, dwHighDateTime=0x1d4d344), lpLastWriteTime=0x40753e*(dwLowDateTime=0x18d50ec0, dwHighDateTime=0x1d4d344)) returned 1
	[0135.896] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.896] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xc5f5, lpOverlapped=0x0) returned 1
	[0135.897] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi") returned="QKeG 5KcU0vt0wN0E-tR.avi"
	[0135.897] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.897] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xc5f5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xc5f5, lpOverlapped=0x0) returned 1
	[0135.897] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.897] CloseHandle (hObject=0x218) returned 1
	[0135.897] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\et0hgnacrwv\\qkeg 5kcu0vt0wn0e-tr.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi.exe" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\et0hgnacrwv\\qkeg 5kcu0vt0wn0e-tr.avi.exe")) returned 1
	[0135.898] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb16d0350, ftCreationTime.dwHighDateTime=0x1d4c628, ftLastAccessTime.dwLowDateTime=0xdeb6b910, ftLastAccessTime.dwHighDateTime=0x1d4cc94, ftLastWriteTime.dwLowDateTime=0xdeb6b910, ftLastWriteTime.dwHighDateTime=0x1d4cc94, nFileSizeHigh=0x0, nFileSizeLow=0x6ceb, dwReserved0=0x0, dwReserved1=0x0, cFileName="tuk9LttcHnJT.mp4", cAlternateFileName="TUK9LT~1.MP4")) returned 1
	[0135.898] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0
	[0135.899] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="tuk9LttcHnJT.mp4") returned -1
	[0135.899] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="tuk9LttcHnJT.mp4") returned -1
	[0135.899] lstrcmpiA (lpString1="", lpString2="tuk9LttcHnJT.mp4") returned -1
	[0135.899] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\QKeG 5KcU0vt0wN0E-tR.avi") returned="QKeG 5KcU0vt0wN0E-tR.avi"
	[0135.899] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\"
	[0135.899] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\") returned=""
	[0135.899] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.899] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\et0hgnacrwv\\how-to-decrypt-files.htm")) returned 0x20
	[0135.899] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\", lpString2="tuk9LttcHnJT.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4"
	[0135.899] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4", pszSpec="*.zip") returned 0
	[0135.899] lstrlenA (lpString="*.zip") returned 5
	[0135.899] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4", pszSpec="*.rar") returned 0
	[0135.899] lstrlenA (lpString="*.rar") returned 5
	[0135.899] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4", pszSpec="*.7z") returned 0
	[0135.899] lstrlenA (lpString="*.7z") returned 4
	[0135.899] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4", pszSpec="*.tar") returned 0
	[0135.899] lstrlenA (lpString="*.tar") returned 5
	[0135.899] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4", pszSpec="*.gzip") returned 0
	[0135.899] lstrlenA (lpString="*.gzip") returned 6
	[0135.899] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4", pszSpec="*.jpg") returned 0
	[0135.899] lstrlenA (lpString="*.jpg") returned 5
	[0135.899] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4", pszSpec="*.jpeg") returned 0
	[0135.899] lstrlenA (lpString="*.jpeg") returned 6
	[0135.899] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4", pszSpec="*.bmp") returned 0
	[0135.899] lstrlenA (lpString="*.bmp") returned 5
	[0135.899] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4", pszSpec="*.gif") returned 0
	[0135.899] lstrlenA (lpString="*.gif") returned 5
	[0135.899] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4", pszSpec="*.png") returned 0
	[0135.899] lstrlenA (lpString="*.png") returned 5
	[0135.899] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4", pszSpec="*.doc") returned 0
	[0135.900] lstrlenA (lpString="*.doc") returned 5
	[0135.900] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4", pszSpec="*.docx") returned 0
	[0135.900] lstrlenA (lpString="*.docx") returned 6
	[0135.900] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4", pszSpec="*.xls") returned 0
	[0135.900] lstrlenA (lpString="*.xls") returned 5
	[0135.900] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4", pszSpec="*.xlsx") returned 0
	[0135.900] lstrlenA (lpString="*.xlsx") returned 6
	[0135.900] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4", pszSpec="*.ppt") returned 0
	[0135.900] lstrlenA (lpString="*.ppt") returned 5
	[0135.900] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4", pszSpec="*.pptx") returned 0
	[0135.900] lstrlenA (lpString="*.pptx") returned 6
	[0135.900] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4", pszSpec="*.txt") returned 0
	[0135.900] lstrlenA (lpString="*.txt") returned 5
	[0135.900] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4", pszSpec="*.pdf") returned 0
	[0135.900] lstrlenA (lpString="*.pdf") returned 5
	[0135.900] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4", pszSpec="*.htm") returned 0
	[0135.900] lstrlenA (lpString="*.htm") returned 5
	[0135.900] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4", pszSpec="*.html") returned 0
	[0135.900] lstrlenA (lpString="*.html") returned 6
	[0135.900] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4", pszSpec="*.mdb") returned 0
	[0135.900] lstrlenA (lpString="*.mdb") returned 5
	[0135.900] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4", pszSpec="*.pfx") returned 0
	[0135.900] lstrlenA (lpString="*.pfx") returned 5
	[0135.900] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4", pszSpec="*.md") returned 0
	[0135.900] lstrlenA (lpString="*.md") returned 4
	[0135.900] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4", pszSpec="*.lnk") returned 0
	[0135.900] lstrlenA (lpString="*.lnk") returned 5
	[0135.900] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4", pszSpec="*.torrent") returned 0
	[0135.900] lstrlenA (lpString="*.torrent") returned 9
	[0135.900] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4", pszSpec="*.mov") returned 0
	[0135.900] lstrlenA (lpString="*.mov") returned 5
	[0135.900] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4", pszSpec="*.3gp") returned 0
	[0135.900] lstrlenA (lpString="*.3gp") returned 5
	[0135.900] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4", pszSpec="*.mpeg") returned 0
	[0135.900] lstrlenA (lpString="*.mpeg") returned 6
	[0135.901] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4", pszSpec="*.mpg") returned 0
	[0135.901] lstrlenA (lpString="*.mpg") returned 5
	[0135.901] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4", pszSpec="*.flv") returned 0
	[0135.901] lstrlenA (lpString="*.flv") returned 5
	[0135.901] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4", pszSpec="*.avi") returned 0
	[0135.901] lstrlenA (lpString="*.avi") returned 5
	[0135.901] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4", pszSpec="*.mp4") returned 1
	[0135.901] lstrlenA (lpString="*.mp4") returned 5
	[0135.901] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4"
	[0135.901] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4"
	[0135.901] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4.") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4."
	[0135.901] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4.exe") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4.exe"
	[0135.901] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\et0hgnacrwv\\tuk9lttchnjt.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0135.901] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6ceb
	[0135.901] GetFileTime (in: hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb16d0350, dwHighDateTime=0x1d4c628), lpLastAccessTime=0x407536*(dwLowDateTime=0xdeb6b910, dwHighDateTime=0x1d4cc94), lpLastWriteTime=0x40753e*(dwLowDateTime=0xdeb6b910, dwHighDateTime=0x1d4cc94)) returned 1
	[0135.901] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.901] ReadFile (in: hFile=0x218, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x6ca9, lpOverlapped=0x0) returned 1
	[0135.902] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4") returned="tuk9LttcHnJT.mp4"
	[0135.902] SetFilePointer (in: hFile=0x218, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.902] WriteFile (in: hFile=0x218, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x6ca9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x6ca9, lpOverlapped=0x0) returned 1
	[0135.903] SetFileTime (hFile=0x218, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.903] CloseHandle (hObject=0x218) returned 1
	[0135.903] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\et0hgnacrwv\\tuk9lttchnjt.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\eT0hGNACRWv\\tuk9LttcHnJT.mp4.exe" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\et0hgnacrwv\\tuk9lttchnjt.mp4.exe")) returned 1
	[0135.903] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb16d0350, ftCreationTime.dwHighDateTime=0x1d4c628, ftLastAccessTime.dwLowDateTime=0xdeb6b910, ftLastAccessTime.dwHighDateTime=0x1d4cc94, ftLastWriteTime.dwLowDateTime=0xdeb6b910, ftLastWriteTime.dwHighDateTime=0x1d4cc94, nFileSizeHigh=0x0, nFileSizeLow=0x6ceb, dwReserved0=0x0, dwReserved1=0x0, cFileName="tuk9LttcHnJT.mp4", cAlternateFileName="TUK9LT~1.MP4")) returned 0
	[0135.903] FindClose (in: hFindFile=0x7cb850 | out: hFindFile=0x7cb850) returned 1
	[0135.903] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3349c10, ftCreationTime.dwHighDateTime=0x1d4c82d, ftLastAccessTime.dwLowDateTime=0x6cd3dd40, ftLastAccessTime.dwHighDateTime=0x1d4ca9c, ftLastWriteTime.dwLowDateTime=0x6cd3dd40, ftLastWriteTime.dwHighDateTime=0x1d4ca9c, nFileSizeHigh=0x0, nFileSizeLow=0xd2f5, dwReserved0=0x20, dwReserved1=0x0, cFileName="F-DIy.mp4", cAlternateFileName="")) returned 1
	[0135.903] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0135.903] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="F-DIy.mp4") returned -1
	[0135.904] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="F-DIy.mp4") returned 1
	[0135.904] lstrcmpiA (lpString1="", lpString2="F-DIy.mp4") returned -1
	[0135.904] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\*.*") returned="*.*"
	[0135.904] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\"
	[0135.904] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\") returned=""
	[0135.904] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.904] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\how-to-decrypt-files.htm")) returned 0x20
	[0135.904] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\", lpString2="F-DIy.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4"
	[0135.904] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4", pszSpec="*.zip") returned 0
	[0135.904] lstrlenA (lpString="*.zip") returned 5
	[0135.904] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4", pszSpec="*.rar") returned 0
	[0135.904] lstrlenA (lpString="*.rar") returned 5
	[0135.904] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4", pszSpec="*.7z") returned 0
	[0135.904] lstrlenA (lpString="*.7z") returned 4
	[0135.904] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4", pszSpec="*.tar") returned 0
	[0135.904] lstrlenA (lpString="*.tar") returned 5
	[0135.904] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4", pszSpec="*.gzip") returned 0
	[0135.904] lstrlenA (lpString="*.gzip") returned 6
	[0135.904] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4", pszSpec="*.jpg") returned 0
	[0135.904] lstrlenA (lpString="*.jpg") returned 5
	[0135.904] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4", pszSpec="*.jpeg") returned 0
	[0135.904] lstrlenA (lpString="*.jpeg") returned 6
	[0135.904] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4", pszSpec="*.bmp") returned 0
	[0135.904] lstrlenA (lpString="*.bmp") returned 5
	[0135.904] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4", pszSpec="*.gif") returned 0
	[0135.904] lstrlenA (lpString="*.gif") returned 5
	[0135.904] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4", pszSpec="*.png") returned 0
	[0135.904] lstrlenA (lpString="*.png") returned 5
	[0135.904] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4", pszSpec="*.doc") returned 0
	[0135.905] lstrlenA (lpString="*.doc") returned 5
	[0135.905] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4", pszSpec="*.docx") returned 0
	[0135.905] lstrlenA (lpString="*.docx") returned 6
	[0135.905] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4", pszSpec="*.xls") returned 0
	[0135.905] lstrlenA (lpString="*.xls") returned 5
	[0135.905] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4", pszSpec="*.xlsx") returned 0
	[0135.905] lstrlenA (lpString="*.xlsx") returned 6
	[0135.905] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4", pszSpec="*.ppt") returned 0
	[0135.905] lstrlenA (lpString="*.ppt") returned 5
	[0135.905] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4", pszSpec="*.pptx") returned 0
	[0135.905] lstrlenA (lpString="*.pptx") returned 6
	[0135.905] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4", pszSpec="*.txt") returned 0
	[0135.905] lstrlenA (lpString="*.txt") returned 5
	[0135.905] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4", pszSpec="*.pdf") returned 0
	[0135.905] lstrlenA (lpString="*.pdf") returned 5
	[0135.905] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4", pszSpec="*.htm") returned 0
	[0135.905] lstrlenA (lpString="*.htm") returned 5
	[0135.905] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4", pszSpec="*.html") returned 0
	[0135.905] lstrlenA (lpString="*.html") returned 6
	[0135.905] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4", pszSpec="*.mdb") returned 0
	[0135.905] lstrlenA (lpString="*.mdb") returned 5
	[0135.905] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4", pszSpec="*.pfx") returned 0
	[0135.905] lstrlenA (lpString="*.pfx") returned 5
	[0135.905] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4", pszSpec="*.md") returned 0
	[0135.905] lstrlenA (lpString="*.md") returned 4
	[0135.905] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4", pszSpec="*.lnk") returned 0
	[0135.905] lstrlenA (lpString="*.lnk") returned 5
	[0135.905] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4", pszSpec="*.torrent") returned 0
	[0135.905] lstrlenA (lpString="*.torrent") returned 9
	[0135.905] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4", pszSpec="*.mov") returned 0
	[0135.905] lstrlenA (lpString="*.mov") returned 5
	[0135.905] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4", pszSpec="*.3gp") returned 0
	[0135.905] lstrlenA (lpString="*.3gp") returned 5
	[0135.905] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4", pszSpec="*.mpeg") returned 0
	[0135.906] lstrlenA (lpString="*.mpeg") returned 6
	[0135.906] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4", pszSpec="*.mpg") returned 0
	[0135.906] lstrlenA (lpString="*.mpg") returned 5
	[0135.906] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4", pszSpec="*.flv") returned 0
	[0135.906] lstrlenA (lpString="*.flv") returned 5
	[0135.906] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4", pszSpec="*.avi") returned 0
	[0135.906] lstrlenA (lpString="*.avi") returned 5
	[0135.906] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4", pszSpec="*.mp4") returned 1
	[0135.906] lstrlenA (lpString="*.mp4") returned 5
	[0135.906] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4"
	[0135.906] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4"
	[0135.906] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4.") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4."
	[0135.906] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4.exe") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4.exe"
	[0135.906] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\f-diy.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0135.906] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd2f5
	[0135.906] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3349c10, dwHighDateTime=0x1d4c82d), lpLastAccessTime=0x407536*(dwLowDateTime=0x6cd3dd40, dwHighDateTime=0x1d4ca9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6cd3dd40, dwHighDateTime=0x1d4ca9c)) returned 1
	[0135.906] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.906] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xd2b3, lpOverlapped=0x0) returned 1
	[0135.907] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4") returned="F-DIy.mp4"
	[0135.908] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.908] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xd2b3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xd2b3, lpOverlapped=0x0) returned 1
	[0135.908] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.908] CloseHandle (hObject=0x214) returned 1
	[0135.908] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\f-diy.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4.exe" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\f-diy.mp4.exe")) returned 1
	[0135.909] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f2a6010, ftCreationTime.dwHighDateTime=0x1d4c8b7, ftLastAccessTime.dwLowDateTime=0xc7ed9f90, ftLastAccessTime.dwHighDateTime=0x1d4ccdb, ftLastWriteTime.dwLowDateTime=0xc7ed9f90, ftLastWriteTime.dwHighDateTime=0x1d4ccdb, nFileSizeHigh=0x0, nFileSizeLow=0x27c7, dwReserved0=0x0, dwReserved1=0x1, cFileName="Sazdzm-q7Tza.mp4", cAlternateFileName="SAZDZM~1.MP4")) returned 1
	[0135.909] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0135.909] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Sazdzm-q7Tza.mp4") returned -1
	[0135.909] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Sazdzm-q7Tza.mp4") returned -1
	[0135.909] lstrcmpiA (lpString1="", lpString2="Sazdzm-q7Tza.mp4") returned -1
	[0135.909] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\F-DIy.mp4") returned="F-DIy.mp4"
	[0135.909] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\"
	[0135.909] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\") returned=""
	[0135.909] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.909] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\how-to-decrypt-files.htm")) returned 0x20
	[0135.909] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\", lpString2="Sazdzm-q7Tza.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4"
	[0135.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4", pszSpec="*.zip") returned 0
	[0135.909] lstrlenA (lpString="*.zip") returned 5
	[0135.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4", pszSpec="*.rar") returned 0
	[0135.909] lstrlenA (lpString="*.rar") returned 5
	[0135.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4", pszSpec="*.7z") returned 0
	[0135.909] lstrlenA (lpString="*.7z") returned 4
	[0135.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4", pszSpec="*.tar") returned 0
	[0135.909] lstrlenA (lpString="*.tar") returned 5
	[0135.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4", pszSpec="*.gzip") returned 0
	[0135.909] lstrlenA (lpString="*.gzip") returned 6
	[0135.909] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4", pszSpec="*.jpg") returned 0
	[0135.910] lstrlenA (lpString="*.jpg") returned 5
	[0135.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4", pszSpec="*.jpeg") returned 0
	[0135.910] lstrlenA (lpString="*.jpeg") returned 6
	[0135.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4", pszSpec="*.bmp") returned 0
	[0135.910] lstrlenA (lpString="*.bmp") returned 5
	[0135.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4", pszSpec="*.gif") returned 0
	[0135.910] lstrlenA (lpString="*.gif") returned 5
	[0135.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4", pszSpec="*.png") returned 0
	[0135.910] lstrlenA (lpString="*.png") returned 5
	[0135.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4", pszSpec="*.doc") returned 0
	[0135.910] lstrlenA (lpString="*.doc") returned 5
	[0135.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4", pszSpec="*.docx") returned 0
	[0135.910] lstrlenA (lpString="*.docx") returned 6
	[0135.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4", pszSpec="*.xls") returned 0
	[0135.910] lstrlenA (lpString="*.xls") returned 5
	[0135.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4", pszSpec="*.xlsx") returned 0
	[0135.910] lstrlenA (lpString="*.xlsx") returned 6
	[0135.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4", pszSpec="*.ppt") returned 0
	[0135.910] lstrlenA (lpString="*.ppt") returned 5
	[0135.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4", pszSpec="*.pptx") returned 0
	[0135.910] lstrlenA (lpString="*.pptx") returned 6
	[0135.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4", pszSpec="*.txt") returned 0
	[0135.910] lstrlenA (lpString="*.txt") returned 5
	[0135.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4", pszSpec="*.pdf") returned 0
	[0135.910] lstrlenA (lpString="*.pdf") returned 5
	[0135.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4", pszSpec="*.htm") returned 0
	[0135.910] lstrlenA (lpString="*.htm") returned 5
	[0135.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4", pszSpec="*.html") returned 0
	[0135.910] lstrlenA (lpString="*.html") returned 6
	[0135.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4", pszSpec="*.mdb") returned 0
	[0135.910] lstrlenA (lpString="*.mdb") returned 5
	[0135.910] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4", pszSpec="*.pfx") returned 0
	[0135.911] lstrlenA (lpString="*.pfx") returned 5
	[0135.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4", pszSpec="*.md") returned 0
	[0135.911] lstrlenA (lpString="*.md") returned 4
	[0135.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4", pszSpec="*.lnk") returned 0
	[0135.911] lstrlenA (lpString="*.lnk") returned 5
	[0135.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4", pszSpec="*.torrent") returned 0
	[0135.911] lstrlenA (lpString="*.torrent") returned 9
	[0135.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4", pszSpec="*.mov") returned 0
	[0135.911] lstrlenA (lpString="*.mov") returned 5
	[0135.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4", pszSpec="*.3gp") returned 0
	[0135.911] lstrlenA (lpString="*.3gp") returned 5
	[0135.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4", pszSpec="*.mpeg") returned 0
	[0135.911] lstrlenA (lpString="*.mpeg") returned 6
	[0135.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4", pszSpec="*.mpg") returned 0
	[0135.911] lstrlenA (lpString="*.mpg") returned 5
	[0135.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4", pszSpec="*.flv") returned 0
	[0135.911] lstrlenA (lpString="*.flv") returned 5
	[0135.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4", pszSpec="*.avi") returned 0
	[0135.911] lstrlenA (lpString="*.avi") returned 5
	[0135.911] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4", pszSpec="*.mp4") returned 1
	[0135.911] lstrlenA (lpString="*.mp4") returned 5
	[0135.911] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4"
	[0135.911] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4"
	[0135.911] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4.") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4."
	[0135.911] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4.exe") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4.exe"
	[0135.911] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\sazdzm-q7tza.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0135.912] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x27c7
	[0135.912] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5f2a6010, dwHighDateTime=0x1d4c8b7), lpLastAccessTime=0x407536*(dwLowDateTime=0xc7ed9f90, dwHighDateTime=0x1d4ccdb), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc7ed9f90, dwHighDateTime=0x1d4ccdb)) returned 1
	[0135.912] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.912] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x2785, lpOverlapped=0x0) returned 1
	[0135.913] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4") returned="Sazdzm-q7Tza.mp4"
	[0135.913] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.913] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x2785, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x2785, lpOverlapped=0x0) returned 1
	[0135.913] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.913] CloseHandle (hObject=0x214) returned 1
	[0135.913] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\sazdzm-q7tza.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4.exe" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\sazdzm-q7tza.mp4.exe")) returned 1
	[0135.914] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab13ea00, ftCreationTime.dwHighDateTime=0x1d4c7a4, ftLastAccessTime.dwLowDateTime=0xd69a57a0, ftLastAccessTime.dwHighDateTime=0x1d4cdde, ftLastWriteTime.dwLowDateTime=0xd69a57a0, ftLastWriteTime.dwHighDateTime=0x1d4cdde, nFileSizeHigh=0x0, nFileSizeLow=0x6dc, dwReserved0=0x0, dwReserved1=0x1, cFileName="xbXb56EultqBsTq0Dq8.avi", cAlternateFileName="XBXB56~1.AVI")) returned 1
	[0135.914] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0135.914] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="xbXb56EultqBsTq0Dq8.avi") returned -1
	[0135.914] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="xbXb56EultqBsTq0Dq8.avi") returned -1
	[0135.914] lstrcmpiA (lpString1="", lpString2="xbXb56EultqBsTq0Dq8.avi") returned -1
	[0135.914] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\Sazdzm-q7Tza.mp4") returned="Sazdzm-q7Tza.mp4"
	[0135.914] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\"
	[0135.914] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\") returned=""
	[0135.914] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.914] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\how-to-decrypt-files.htm")) returned 0x20
	[0135.914] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\", lpString2="xbXb56EultqBsTq0Dq8.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi"
	[0135.914] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi", pszSpec="*.zip") returned 0
	[0135.914] lstrlenA (lpString="*.zip") returned 5
	[0135.914] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi", pszSpec="*.rar") returned 0
	[0135.914] lstrlenA (lpString="*.rar") returned 5
	[0135.914] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi", pszSpec="*.7z") returned 0
	[0135.914] lstrlenA (lpString="*.7z") returned 4
	[0135.914] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi", pszSpec="*.tar") returned 0
	[0135.914] lstrlenA (lpString="*.tar") returned 5
	[0135.914] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi", pszSpec="*.gzip") returned 0
	[0135.916] lstrlenA (lpString="*.gzip") returned 6
	[0135.916] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi", pszSpec="*.jpg") returned 0
	[0135.916] lstrlenA (lpString="*.jpg") returned 5
	[0135.916] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi", pszSpec="*.jpeg") returned 0
	[0135.916] lstrlenA (lpString="*.jpeg") returned 6
	[0135.916] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi", pszSpec="*.bmp") returned 0
	[0135.916] lstrlenA (lpString="*.bmp") returned 5
	[0135.916] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi", pszSpec="*.gif") returned 0
	[0135.916] lstrlenA (lpString="*.gif") returned 5
	[0135.916] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi", pszSpec="*.png") returned 0
	[0135.916] lstrlenA (lpString="*.png") returned 5
	[0135.916] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi", pszSpec="*.doc") returned 0
	[0135.917] lstrlenA (lpString="*.doc") returned 5
	[0135.917] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi", pszSpec="*.docx") returned 0
	[0135.917] lstrlenA (lpString="*.docx") returned 6
	[0135.917] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi", pszSpec="*.xls") returned 0
	[0135.917] lstrlenA (lpString="*.xls") returned 5
	[0135.917] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi", pszSpec="*.xlsx") returned 0
	[0135.917] lstrlenA (lpString="*.xlsx") returned 6
	[0135.917] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi", pszSpec="*.ppt") returned 0
	[0135.917] lstrlenA (lpString="*.ppt") returned 5
	[0135.917] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi", pszSpec="*.pptx") returned 0
	[0135.917] lstrlenA (lpString="*.pptx") returned 6
	[0135.917] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi", pszSpec="*.txt") returned 0
	[0135.917] lstrlenA (lpString="*.txt") returned 5
	[0135.917] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi", pszSpec="*.pdf") returned 0
	[0135.917] lstrlenA (lpString="*.pdf") returned 5
	[0135.917] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi", pszSpec="*.htm") returned 0
	[0135.917] lstrlenA (lpString="*.htm") returned 5
	[0135.917] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi", pszSpec="*.html") returned 0
	[0135.917] lstrlenA (lpString="*.html") returned 6
	[0135.917] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi", pszSpec="*.mdb") returned 0
	[0135.917] lstrlenA (lpString="*.mdb") returned 5
	[0135.917] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi", pszSpec="*.pfx") returned 0
	[0135.917] lstrlenA (lpString="*.pfx") returned 5
	[0135.917] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi", pszSpec="*.md") returned 0
	[0135.917] lstrlenA (lpString="*.md") returned 4
	[0135.917] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi", pszSpec="*.lnk") returned 0
	[0135.917] lstrlenA (lpString="*.lnk") returned 5
	[0135.917] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi", pszSpec="*.torrent") returned 0
	[0135.917] lstrlenA (lpString="*.torrent") returned 9
	[0135.917] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi", pszSpec="*.mov") returned 0
	[0135.917] lstrlenA (lpString="*.mov") returned 5
	[0135.917] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi", pszSpec="*.3gp") returned 0
	[0135.917] lstrlenA (lpString="*.3gp") returned 5
	[0135.918] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi", pszSpec="*.mpeg") returned 0
	[0135.918] lstrlenA (lpString="*.mpeg") returned 6
	[0135.918] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi", pszSpec="*.mpg") returned 0
	[0135.918] lstrlenA (lpString="*.mpg") returned 5
	[0135.918] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi", pszSpec="*.flv") returned 0
	[0135.918] lstrlenA (lpString="*.flv") returned 5
	[0135.918] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi", pszSpec="*.avi") returned 1
	[0135.918] lstrlenA (lpString="*.avi") returned 5
	[0135.918] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi"
	[0135.918] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi"
	[0135.918] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi.") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi."
	[0135.918] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi.exe") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi.exe"
	[0135.918] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\xbxb56eultqbstq0dq8.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0135.918] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6dc
	[0135.918] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xab13ea00, dwHighDateTime=0x1d4c7a4), lpLastAccessTime=0x407536*(dwLowDateTime=0xd69a57a0, dwHighDateTime=0x1d4cdde), lpLastWriteTime=0x40753e*(dwLowDateTime=0xd69a57a0, dwHighDateTime=0x1d4cdde)) returned 1
	[0135.918] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.918] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x69a, lpOverlapped=0x0) returned 1
	[0135.919] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi") returned="xbXb56EultqBsTq0Dq8.avi"
	[0135.919] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.919] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x69a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x69a, lpOverlapped=0x0) returned 1
	[0135.920] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.920] CloseHandle (hObject=0x214) returned 1
	[0135.920] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\xbxb56eultqbstq0dq8.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi.exe" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\xbxb56eultqbstq0dq8.avi.exe")) returned 1
	[0135.920] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43cfab50, ftCreationTime.dwHighDateTime=0x1d4c69f, ftLastAccessTime.dwLowDateTime=0xd52505c0, ftLastAccessTime.dwHighDateTime=0x1d4cc6a, ftLastWriteTime.dwLowDateTime=0xd52505c0, ftLastWriteTime.dwHighDateTime=0x1d4cc6a, nFileSizeHigh=0x0, nFileSizeLow=0x18823, dwReserved0=0x0, dwReserved1=0x0, cFileName="zU_kMqr109w.flv", cAlternateFileName="ZU_KMQ~1.FLV")) returned 1
	[0135.920] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0135.920] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="zU_kMqr109w.flv") returned -1
	[0135.920] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="zU_kMqr109w.flv") returned -1
	[0135.921] lstrcmpiA (lpString1="", lpString2="zU_kMqr109w.flv") returned -1
	[0135.921] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\xbXb56EultqBsTq0Dq8.avi") returned="xbXb56EultqBsTq0Dq8.avi"
	[0135.921] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\"
	[0135.921] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\") returned=""
	[0135.921] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.921] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\how-to-decrypt-files.htm")) returned 0x20
	[0135.921] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\", lpString2="zU_kMqr109w.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv"
	[0135.921] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv", pszSpec="*.zip") returned 0
	[0135.921] lstrlenA (lpString="*.zip") returned 5
	[0135.921] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv", pszSpec="*.rar") returned 0
	[0135.921] lstrlenA (lpString="*.rar") returned 5
	[0135.921] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv", pszSpec="*.7z") returned 0
	[0135.921] lstrlenA (lpString="*.7z") returned 4
	[0135.921] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv", pszSpec="*.tar") returned 0
	[0135.921] lstrlenA (lpString="*.tar") returned 5
	[0135.921] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv", pszSpec="*.gzip") returned 0
	[0135.921] lstrlenA (lpString="*.gzip") returned 6
	[0135.921] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv", pszSpec="*.jpg") returned 0
	[0135.921] lstrlenA (lpString="*.jpg") returned 5
	[0135.921] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv", pszSpec="*.jpeg") returned 0
	[0135.921] lstrlenA (lpString="*.jpeg") returned 6
	[0135.921] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv", pszSpec="*.bmp") returned 0
	[0135.921] lstrlenA (lpString="*.bmp") returned 5
	[0135.921] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv", pszSpec="*.gif") returned 0
	[0135.921] lstrlenA (lpString="*.gif") returned 5
	[0135.921] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv", pszSpec="*.png") returned 0
	[0135.921] lstrlenA (lpString="*.png") returned 5
	[0135.921] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv", pszSpec="*.doc") returned 0
	[0135.921] lstrlenA (lpString="*.doc") returned 5
	[0135.922] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv", pszSpec="*.docx") returned 0
	[0135.922] lstrlenA (lpString="*.docx") returned 6
	[0135.922] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv", pszSpec="*.xls") returned 0
	[0135.922] lstrlenA (lpString="*.xls") returned 5
	[0135.922] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv", pszSpec="*.xlsx") returned 0
	[0135.922] lstrlenA (lpString="*.xlsx") returned 6
	[0135.922] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv", pszSpec="*.ppt") returned 0
	[0135.922] lstrlenA (lpString="*.ppt") returned 5
	[0135.922] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv", pszSpec="*.pptx") returned 0
	[0135.922] lstrlenA (lpString="*.pptx") returned 6
	[0135.922] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv", pszSpec="*.txt") returned 0
	[0135.922] lstrlenA (lpString="*.txt") returned 5
	[0135.922] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv", pszSpec="*.pdf") returned 0
	[0135.922] lstrlenA (lpString="*.pdf") returned 5
	[0135.922] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv", pszSpec="*.htm") returned 0
	[0135.922] lstrlenA (lpString="*.htm") returned 5
	[0135.922] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv", pszSpec="*.html") returned 0
	[0135.922] lstrlenA (lpString="*.html") returned 6
	[0135.922] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv", pszSpec="*.mdb") returned 0
	[0135.922] lstrlenA (lpString="*.mdb") returned 5
	[0135.922] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv", pszSpec="*.pfx") returned 0
	[0135.922] lstrlenA (lpString="*.pfx") returned 5
	[0135.922] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv", pszSpec="*.md") returned 0
	[0135.922] lstrlenA (lpString="*.md") returned 4
	[0135.922] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv", pszSpec="*.lnk") returned 0
	[0135.922] lstrlenA (lpString="*.lnk") returned 5
	[0135.922] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv", pszSpec="*.torrent") returned 0
	[0135.922] lstrlenA (lpString="*.torrent") returned 9
	[0135.922] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv", pszSpec="*.mov") returned 0
	[0135.922] lstrlenA (lpString="*.mov") returned 5
	[0135.922] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv", pszSpec="*.3gp") returned 0
	[0135.922] lstrlenA (lpString="*.3gp") returned 5
	[0135.922] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv", pszSpec="*.mpeg") returned 0
	[0135.923] lstrlenA (lpString="*.mpeg") returned 6
	[0135.923] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv", pszSpec="*.mpg") returned 0
	[0135.923] lstrlenA (lpString="*.mpg") returned 5
	[0135.923] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv", pszSpec="*.flv") returned 1
	[0135.923] lstrlenA (lpString="*.flv") returned 5
	[0135.923] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv"
	[0135.923] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv"
	[0135.923] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv.") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv."
	[0135.923] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv.exe") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv.exe"
	[0135.923] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\zu_kmqr109w.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0135.923] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18823
	[0135.923] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x43cfab50, dwHighDateTime=0x1d4c69f), lpLastAccessTime=0x407536*(dwLowDateTime=0xd52505c0, dwHighDateTime=0x1d4cc6a), lpLastWriteTime=0x40753e*(dwLowDateTime=0xd52505c0, dwHighDateTime=0x1d4cc6a)) returned 1
	[0135.923] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.923] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x187e1, lpOverlapped=0x0) returned 1
	[0135.925] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv") returned="zU_kMqr109w.flv"
	[0135.925] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.925] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x187e1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x187e1, lpOverlapped=0x0) returned 1
	[0135.925] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.926] CloseHandle (hObject=0x214) returned 1
	[0135.926] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\zu_kmqr109w.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv.exe" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\zu_kmqr109w.flv.exe")) returned 1
	[0135.926] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a9ad00, ftCreationTime.dwHighDateTime=0x1d4cbc7, ftLastAccessTime.dwLowDateTime=0x341afe90, ftLastAccessTime.dwHighDateTime=0x1d4cc3e, ftLastWriteTime.dwLowDateTime=0x341afe90, ftLastWriteTime.dwHighDateTime=0x1d4cc3e, nFileSizeHigh=0x0, nFileSizeLow=0x16358, dwReserved0=0x0, dwReserved1=0x1, cFileName="_8i2cghyRFW8I.swf", cAlternateFileName="_8I2CG~1.SWF")) returned 1
	[0135.926] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0135.926] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="_8i2cghyRFW8I.swf") returned 1
	[0135.926] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="_8i2cghyRFW8I.swf") returned 1
	[0135.926] lstrcmpiA (lpString1="", lpString2="_8i2cghyRFW8I.swf") returned -1
	[0135.926] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\zU_kMqr109w.flv") returned="zU_kMqr109w.flv"
	[0135.926] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\"
	[0135.927] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\") returned=""
	[0135.927] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.927] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\how-to-decrypt-files.htm")) returned 0x20
	[0135.927] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\", lpString2="_8i2cghyRFW8I.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf"
	[0135.927] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.zip") returned 0
	[0135.927] lstrlenA (lpString="*.zip") returned 5
	[0135.927] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.rar") returned 0
	[0135.927] lstrlenA (lpString="*.rar") returned 5
	[0135.927] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.7z") returned 0
	[0135.927] lstrlenA (lpString="*.7z") returned 4
	[0135.927] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.tar") returned 0
	[0135.927] lstrlenA (lpString="*.tar") returned 5
	[0135.927] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.gzip") returned 0
	[0135.927] lstrlenA (lpString="*.gzip") returned 6
	[0135.927] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.jpg") returned 0
	[0135.927] lstrlenA (lpString="*.jpg") returned 5
	[0135.927] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.jpeg") returned 0
	[0135.927] lstrlenA (lpString="*.jpeg") returned 6
	[0135.927] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.bmp") returned 0
	[0135.927] lstrlenA (lpString="*.bmp") returned 5
	[0135.927] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.gif") returned 0
	[0135.927] lstrlenA (lpString="*.gif") returned 5
	[0135.927] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.png") returned 0
	[0135.927] lstrlenA (lpString="*.png") returned 5
	[0135.927] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.doc") returned 0
	[0135.927] lstrlenA (lpString="*.doc") returned 5
	[0135.927] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.docx") returned 0
	[0135.927] lstrlenA (lpString="*.docx") returned 6
	[0135.927] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.xls") returned 0
	[0135.927] lstrlenA (lpString="*.xls") returned 5
	[0135.928] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.xlsx") returned 0
	[0135.928] lstrlenA (lpString="*.xlsx") returned 6
	[0135.928] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.ppt") returned 0
	[0135.928] lstrlenA (lpString="*.ppt") returned 5
	[0135.928] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.pptx") returned 0
	[0135.928] lstrlenA (lpString="*.pptx") returned 6
	[0135.928] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.txt") returned 0
	[0135.928] lstrlenA (lpString="*.txt") returned 5
	[0135.928] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.pdf") returned 0
	[0135.928] lstrlenA (lpString="*.pdf") returned 5
	[0135.928] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.htm") returned 0
	[0135.928] lstrlenA (lpString="*.htm") returned 5
	[0135.928] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.html") returned 0
	[0135.928] lstrlenA (lpString="*.html") returned 6
	[0135.928] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.mdb") returned 0
	[0135.928] lstrlenA (lpString="*.mdb") returned 5
	[0135.928] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.pfx") returned 0
	[0135.928] lstrlenA (lpString="*.pfx") returned 5
	[0135.928] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.md") returned 0
	[0135.928] lstrlenA (lpString="*.md") returned 4
	[0135.928] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.lnk") returned 0
	[0135.928] lstrlenA (lpString="*.lnk") returned 5
	[0135.928] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.torrent") returned 0
	[0135.928] lstrlenA (lpString="*.torrent") returned 9
	[0135.928] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.mov") returned 0
	[0135.928] lstrlenA (lpString="*.mov") returned 5
	[0135.928] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.3gp") returned 0
	[0135.928] lstrlenA (lpString="*.3gp") returned 5
	[0135.928] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.mpeg") returned 0
	[0135.928] lstrlenA (lpString="*.mpeg") returned 6
	[0135.928] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.mpg") returned 0
	[0135.928] lstrlenA (lpString="*.mpg") returned 5
	[0135.928] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.flv") returned 0
	[0135.928] lstrlenA (lpString="*.flv") returned 5
	[0135.928] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.avi") returned 0
	[0135.929] lstrlenA (lpString="*.avi") returned 5
	[0135.929] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.mp4") returned 0
	[0135.929] lstrlenA (lpString="*.mp4") returned 5
	[0135.929] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.wmv") returned 0
	[0135.929] lstrlenA (lpString="*.wmv") returned 5
	[0135.929] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.mkv") returned 0
	[0135.929] lstrlenA (lpString="*.mkv") returned 5
	[0135.929] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.mp3") returned 0
	[0135.929] lstrlenA (lpString="*.mp3") returned 5
	[0135.929] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.wav") returned 0
	[0135.929] lstrlenA (lpString="*.wav") returned 5
	[0135.929] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.flac") returned 0
	[0135.929] lstrlenA (lpString="*.flac") returned 6
	[0135.929] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.wma") returned 0
	[0135.929] lstrlenA (lpString="*.wma") returned 5
	[0135.929] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.au3") returned 0
	[0135.929] lstrlenA (lpString="*.au3") returned 5
	[0135.929] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.ahk") returned 0
	[0135.929] lstrlenA (lpString="*.ahk") returned 5
	[0135.929] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.c") returned 0
	[0135.929] lstrlenA (lpString="*.c") returned 3
	[0135.929] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.cc") returned 0
	[0135.929] lstrlenA (lpString="*.cc") returned 4
	[0135.929] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.cpp") returned 0
	[0135.929] lstrlenA (lpString="*.cpp") returned 5
	[0135.929] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.cxx") returned 0
	[0135.929] lstrlenA (lpString="*.cxx") returned 5
	[0135.929] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.c++") returned 0
	[0135.929] lstrlenA (lpString="*.c++") returned 5
	[0135.929] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.cs") returned 0
	[0135.929] lstrlenA (lpString="*.cs") returned 4
	[0135.929] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.vb") returned 0
	[0135.929] lstrlenA (lpString="*.vb") returned 4
	[0135.930] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.bas") returned 0
	[0135.930] lstrlenA (lpString="*.bas") returned 5
	[0135.930] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.csproj") returned 0
	[0135.930] lstrlenA (lpString="*.csproj") returned 8
	[0135.930] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.vbproj") returned 0
	[0135.930] lstrlenA (lpString="*.vbproj") returned 8
	[0135.930] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.vcxproj") returned 0
	[0135.930] lstrlenA (lpString="*.vcxproj") returned 9
	[0135.930] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.manifest") returned 0
	[0135.930] lstrlenA (lpString="*.manifest") returned 10
	[0135.930] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.php") returned 0
	[0135.930] lstrlenA (lpString="*.php") returned 5
	[0135.930] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.vbe") returned 0
	[0135.930] lstrlenA (lpString="*.vbe") returned 5
	[0135.930] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.vba") returned 0
	[0135.930] lstrlenA (lpString="*.vba") returned 5
	[0135.930] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.vbs") returned 0
	[0135.930] lstrlenA (lpString="*.vbs") returned 5
	[0135.930] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.bat") returned 0
	[0135.930] lstrlenA (lpString="*.bat") returned 5
	[0135.930] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.cmd") returned 0
	[0135.930] lstrlenA (lpString="*.cmd") returned 5
	[0135.930] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.js") returned 0
	[0135.930] lstrlenA (lpString="*.js") returned 4
	[0135.930] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.jscript") returned 0
	[0135.930] lstrlenA (lpString="*.jscript") returned 9
	[0135.930] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.hta") returned 0
	[0135.930] lstrlenA (lpString="*.hta") returned 5
	[0135.930] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.php7") returned 0
	[0135.930] lstrlenA (lpString="*.php7") returned 6
	[0135.930] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.db") returned 0
	[0135.930] lstrlenA (lpString="*.db") returned 4
	[0135.930] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", pszSpec="*.swf") returned 1
	[0135.930] lstrlenA (lpString="*.swf") returned 5
	[0135.931] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf"
	[0135.931] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf"
	[0135.931] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf.") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf."
	[0135.931] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf.exe") returned="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf.exe"
	[0135.931] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\_8i2cghyrfw8i.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0135.931] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16358
	[0135.931] GetFileTime (in: hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc1a9ad00, dwHighDateTime=0x1d4cbc7), lpLastAccessTime=0x407536*(dwLowDateTime=0x341afe90, dwHighDateTime=0x1d4cc3e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x341afe90, dwHighDateTime=0x1d4cc3e)) returned 1
	[0135.931] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.931] ReadFile (in: hFile=0x214, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x16316, lpOverlapped=0x0) returned 1
	[0135.932] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf") returned="_8i2cghyRFW8I.swf"
	[0135.933] SetFilePointer (in: hFile=0x214, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.933] WriteFile (in: hFile=0x214, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x16316, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x16316, lpOverlapped=0x0) returned 1
	[0135.933] SetFileTime (hFile=0x214, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.933] CloseHandle (hObject=0x214) returned 1
	[0135.933] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\_8i2cghyrfw8i.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\8UFcG-haiTpskJzQ\\vxBXX0\\_8i2cghyRFW8I.swf.exe" (normalized: "c:\\users\\fd1hvy\\videos\\8ufcg-haitpskjzq\\vxbxx0\\_8i2cghyrfw8i.swf.exe")) returned 1
	[0135.934] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a9ad00, ftCreationTime.dwHighDateTime=0x1d4cbc7, ftLastAccessTime.dwLowDateTime=0x341afe90, ftLastAccessTime.dwHighDateTime=0x1d4cc3e, ftLastWriteTime.dwLowDateTime=0x341afe90, ftLastWriteTime.dwHighDateTime=0x1d4cc3e, nFileSizeHigh=0x0, nFileSizeLow=0x16358, dwReserved0=0x0, dwReserved1=0x1, cFileName="_8i2cghyRFW8I.swf", cAlternateFileName="_8I2CG~1.SWF")) returned 0
	[0135.934] FindClose (in: hFindFile=0x7cb910 | out: hFindFile=0x7cb910) returned 1
	[0135.934] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88045590, ftCreationTime.dwHighDateTime=0x1d4d537, ftLastAccessTime.dwLowDateTime=0x503c17f0, ftLastAccessTime.dwHighDateTime=0x1d4c700, ftLastWriteTime.dwLowDateTime=0x503c17f0, ftLastWriteTime.dwHighDateTime=0x1d4c700, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="vxBXX0", cAlternateFileName="")) returned 0
	[0135.934] FindClose (in: hFindFile=0x7cb5d0 | out: hFindFile=0x7cb5d0) returned 1
	[0135.934] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43f94523, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43f94523, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x7b0260, dwReserved1=0x1000000, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0135.934] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.934] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="desktop.ini") returned 1
	[0135.934] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="desktop.ini") returned 1
	[0135.934] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1
	[0135.934] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\*.*") returned="*.*"
	[0135.934] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Videos\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\"
	[0135.934] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Videos\\" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\") returned=""
	[0135.934] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Videos\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.934] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Videos\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\videos\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0135.934] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Videos\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\videos\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.935] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0135.935] WriteFile (in: hFile=0x20c, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0135.936] SetFileTime (hFile=0x20c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0135.936] CloseHandle (hObject=0x20c) returned 1
	[0135.936] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\desktop.ini") returned="C:\\Users\\FD1HVy\\Videos\\desktop.ini"
	[0135.936] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.zip") returned 0
	[0135.936] lstrlenA (lpString="*.zip") returned 5
	[0135.936] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.rar") returned 0
	[0135.936] lstrlenA (lpString="*.rar") returned 5
	[0135.936] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.7z") returned 0
	[0135.937] lstrlenA (lpString="*.7z") returned 4
	[0135.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.tar") returned 0
	[0135.937] lstrlenA (lpString="*.tar") returned 5
	[0135.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.gzip") returned 0
	[0135.937] lstrlenA (lpString="*.gzip") returned 6
	[0135.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.jpg") returned 0
	[0135.937] lstrlenA (lpString="*.jpg") returned 5
	[0135.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.jpeg") returned 0
	[0135.937] lstrlenA (lpString="*.jpeg") returned 6
	[0135.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.bmp") returned 0
	[0135.937] lstrlenA (lpString="*.bmp") returned 5
	[0135.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.gif") returned 0
	[0135.937] lstrlenA (lpString="*.gif") returned 5
	[0135.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.png") returned 0
	[0135.937] lstrlenA (lpString="*.png") returned 5
	[0135.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.doc") returned 0
	[0135.937] lstrlenA (lpString="*.doc") returned 5
	[0135.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.docx") returned 0
	[0135.937] lstrlenA (lpString="*.docx") returned 6
	[0135.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.xls") returned 0
	[0135.937] lstrlenA (lpString="*.xls") returned 5
	[0135.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.xlsx") returned 0
	[0135.937] lstrlenA (lpString="*.xlsx") returned 6
	[0135.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.ppt") returned 0
	[0135.937] lstrlenA (lpString="*.ppt") returned 5
	[0135.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.pptx") returned 0
	[0135.937] lstrlenA (lpString="*.pptx") returned 6
	[0135.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.txt") returned 0
	[0135.937] lstrlenA (lpString="*.txt") returned 5
	[0135.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.pdf") returned 0
	[0135.937] lstrlenA (lpString="*.pdf") returned 5
	[0135.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.htm") returned 0
	[0135.937] lstrlenA (lpString="*.htm") returned 5
	[0135.937] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.html") returned 0
	[0135.938] lstrlenA (lpString="*.html") returned 6
	[0135.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.mdb") returned 0
	[0135.938] lstrlenA (lpString="*.mdb") returned 5
	[0135.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.pfx") returned 0
	[0135.938] lstrlenA (lpString="*.pfx") returned 5
	[0135.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.md") returned 0
	[0135.938] lstrlenA (lpString="*.md") returned 4
	[0135.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.lnk") returned 0
	[0135.938] lstrlenA (lpString="*.lnk") returned 5
	[0135.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.torrent") returned 0
	[0135.938] lstrlenA (lpString="*.torrent") returned 9
	[0135.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.mov") returned 0
	[0135.938] lstrlenA (lpString="*.mov") returned 5
	[0135.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.3gp") returned 0
	[0135.938] lstrlenA (lpString="*.3gp") returned 5
	[0135.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.mpeg") returned 0
	[0135.938] lstrlenA (lpString="*.mpeg") returned 6
	[0135.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.mpg") returned 0
	[0135.938] lstrlenA (lpString="*.mpg") returned 5
	[0135.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.flv") returned 0
	[0135.938] lstrlenA (lpString="*.flv") returned 5
	[0135.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.avi") returned 0
	[0135.938] lstrlenA (lpString="*.avi") returned 5
	[0135.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.mp4") returned 0
	[0135.938] lstrlenA (lpString="*.mp4") returned 5
	[0135.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.wmv") returned 0
	[0135.938] lstrlenA (lpString="*.wmv") returned 5
	[0135.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.mkv") returned 0
	[0135.938] lstrlenA (lpString="*.mkv") returned 5
	[0135.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.mp3") returned 0
	[0135.938] lstrlenA (lpString="*.mp3") returned 5
	[0135.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.wav") returned 0
	[0135.938] lstrlenA (lpString="*.wav") returned 5
	[0135.938] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.flac") returned 0
	[0135.938] lstrlenA (lpString="*.flac") returned 6
	[0135.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.wma") returned 0
	[0135.939] lstrlenA (lpString="*.wma") returned 5
	[0135.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.au3") returned 0
	[0135.939] lstrlenA (lpString="*.au3") returned 5
	[0135.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.ahk") returned 0
	[0135.939] lstrlenA (lpString="*.ahk") returned 5
	[0135.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.c") returned 0
	[0135.939] lstrlenA (lpString="*.c") returned 3
	[0135.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.cc") returned 0
	[0135.939] lstrlenA (lpString="*.cc") returned 4
	[0135.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.cpp") returned 0
	[0135.939] lstrlenA (lpString="*.cpp") returned 5
	[0135.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.cxx") returned 0
	[0135.939] lstrlenA (lpString="*.cxx") returned 5
	[0135.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.c++") returned 0
	[0135.939] lstrlenA (lpString="*.c++") returned 5
	[0135.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.cs") returned 0
	[0135.939] lstrlenA (lpString="*.cs") returned 4
	[0135.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.vb") returned 0
	[0135.939] lstrlenA (lpString="*.vb") returned 4
	[0135.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.bas") returned 0
	[0135.939] lstrlenA (lpString="*.bas") returned 5
	[0135.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.csproj") returned 0
	[0135.939] lstrlenA (lpString="*.csproj") returned 8
	[0135.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.vbproj") returned 0
	[0135.939] lstrlenA (lpString="*.vbproj") returned 8
	[0135.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.vcxproj") returned 0
	[0135.939] lstrlenA (lpString="*.vcxproj") returned 9
	[0135.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.manifest") returned 0
	[0135.939] lstrlenA (lpString="*.manifest") returned 10
	[0135.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.php") returned 0
	[0135.939] lstrlenA (lpString="*.php") returned 5
	[0135.939] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.vbe") returned 0
	[0135.939] lstrlenA (lpString="*.vbe") returned 5
	[0135.940] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.vba") returned 0
	[0135.940] lstrlenA (lpString="*.vba") returned 5
	[0135.940] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.vbs") returned 0
	[0135.940] lstrlenA (lpString="*.vbs") returned 5
	[0135.940] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.bat") returned 0
	[0135.940] lstrlenA (lpString="*.bat") returned 5
	[0135.940] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.cmd") returned 0
	[0135.940] lstrlenA (lpString="*.cmd") returned 5
	[0135.940] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.js") returned 0
	[0135.940] lstrlenA (lpString="*.js") returned 4
	[0135.940] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.jscript") returned 0
	[0135.940] lstrlenA (lpString="*.jscript") returned 9
	[0135.940] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.hta") returned 0
	[0135.940] lstrlenA (lpString="*.hta") returned 5
	[0135.940] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.php7") returned 0
	[0135.940] lstrlenA (lpString="*.php7") returned 6
	[0135.940] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.db") returned 0
	[0135.940] lstrlenA (lpString="*.db") returned 4
	[0135.940] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.swf") returned 0
	[0135.940] lstrlenA (lpString="*.swf") returned 5
	[0135.940] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.eml") returned 0
	[0135.940] lstrlenA (lpString="*.eml") returned 5
	[0135.940] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.part") returned 0
	[0135.940] lstrlenA (lpString="*.part") returned 6
	[0135.940] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.nfo") returned 0
	[0135.940] lstrlenA (lpString="*.nfo") returned 5
	[0135.940] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.rsa") returned 0
	[0135.940] lstrlenA (lpString="*.rsa") returned 5
	[0135.940] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.key") returned 0
	[0135.940] lstrlenA (lpString="*.key") returned 5
	[0135.940] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.aes") returned 0
	[0135.940] lstrlenA (lpString="*.aes") returned 5
	[0135.940] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.blob") returned 0
	[0135.940] lstrlenA (lpString="*.blob") returned 6
	[0135.940] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.btc") returned 0
	[0135.940] lstrlenA (lpString="*.btc") returned 5
	[0135.941] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\desktop.ini", pszSpec="*.wallet") returned 0
	[0135.941] lstrlenA (lpString="*.wallet") returned 8
	[0135.941] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d9f3260, ftCreationTime.dwHighDateTime=0x1d4ce18, ftLastAccessTime.dwLowDateTime=0xd633a2d0, ftLastAccessTime.dwHighDateTime=0x1d4c618, ftLastWriteTime.dwLowDateTime=0xd633a2d0, ftLastWriteTime.dwHighDateTime=0x1d4c618, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="enLrXss Klpa", cAlternateFileName="ENLRXS~1")) returned 1
	[0135.941] lstrcmpA (lpString1=".", lpString2="enLrXss Klpa") returned -1
	[0135.941] lstrcmpA (lpString1="..", lpString2="enLrXss Klpa") returned -1
	[0135.941] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\desktop.ini") returned="desktop.ini"
	[0135.941] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="enLrXss Klpa" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa") returned="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa"
	[0135.941] lstrlenA (lpString="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa") returned 35
	[0135.941] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d9f3260, ftCreationTime.dwHighDateTime=0x1d4ce18, ftLastAccessTime.dwLowDateTime=0xd633a2d0, ftLastAccessTime.dwHighDateTime=0x1d4c618, ftLastWriteTime.dwLowDateTime=0xd633a2d0, ftLastWriteTime.dwHighDateTime=0x1d4c618, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c7928, dwReserved1=0x70, cFileName=".", cAlternateFileName="")) returned 0x7cb810
	[0135.941] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0135.941] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d9f3260, ftCreationTime.dwHighDateTime=0x1d4ce18, ftLastAccessTime.dwLowDateTime=0xd633a2d0, ftLastAccessTime.dwHighDateTime=0x1d4c618, ftLastWriteTime.dwLowDateTime=0xd633a2d0, ftLastWriteTime.dwHighDateTime=0x1d4c618, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c7928, dwReserved1=0x70, cFileName="..", cAlternateFileName="")) returned 1
	[0135.941] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0135.941] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0135.941] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52454a20, ftCreationTime.dwHighDateTime=0x1d4cdbe, ftLastAccessTime.dwLowDateTime=0x7d7b4050, ftLastAccessTime.dwHighDateTime=0x1d4c71f, ftLastWriteTime.dwLowDateTime=0x7d7b4050, ftLastWriteTime.dwHighDateTime=0x1d4c71f, nFileSizeHigh=0x0, nFileSizeLow=0xbbba, dwReserved0=0x7c7928, dwReserved1=0x70, cFileName="38rwBzbr0qCk1.mkv", cAlternateFileName="38RWBZ~1.MKV")) returned 1
	[0135.941] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0135.941] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="38rwBzbr0qCk1.mkv") returned 1
	[0135.941] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="38rwBzbr0qCk1.mkv") returned 1
	[0135.941] lstrcmpiA (lpString1="", lpString2="38rwBzbr0qCk1.mkv") returned -1
	[0135.941] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\*.*") returned="*.*"
	[0135.941] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\") returned="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\"
	[0135.941] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\") returned=""
	[0135.941] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.941] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\videos\\enlrxss klpa\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0135.941] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\videos\\enlrxss klpa\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0135.942] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0135.942] WriteFile (in: hFile=0x210, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0135.943] SetFileTime (hFile=0x210, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0135.943] CloseHandle (hObject=0x210) returned 1
	[0135.943] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\", lpString2="38rwBzbr0qCk1.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv") returned="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv"
	[0135.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv", pszSpec="*.zip") returned 0
	[0135.943] lstrlenA (lpString="*.zip") returned 5
	[0135.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv", pszSpec="*.rar") returned 0
	[0135.943] lstrlenA (lpString="*.rar") returned 5
	[0135.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv", pszSpec="*.7z") returned 0
	[0135.943] lstrlenA (lpString="*.7z") returned 4
	[0135.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv", pszSpec="*.tar") returned 0
	[0135.943] lstrlenA (lpString="*.tar") returned 5
	[0135.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv", pszSpec="*.gzip") returned 0
	[0135.943] lstrlenA (lpString="*.gzip") returned 6
	[0135.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv", pszSpec="*.jpg") returned 0
	[0135.943] lstrlenA (lpString="*.jpg") returned 5
	[0135.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv", pszSpec="*.jpeg") returned 0
	[0135.943] lstrlenA (lpString="*.jpeg") returned 6
	[0135.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv", pszSpec="*.bmp") returned 0
	[0135.943] lstrlenA (lpString="*.bmp") returned 5
	[0135.943] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv", pszSpec="*.gif") returned 0
	[0135.943] lstrlenA (lpString="*.gif") returned 5
	[0135.944] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv", pszSpec="*.png") returned 0
	[0135.944] lstrlenA (lpString="*.png") returned 5
	[0135.944] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv", pszSpec="*.doc") returned 0
	[0135.944] lstrlenA (lpString="*.doc") returned 5
	[0135.944] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv", pszSpec="*.docx") returned 0
	[0135.944] lstrlenA (lpString="*.docx") returned 6
	[0135.944] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv", pszSpec="*.xls") returned 0
	[0135.944] lstrlenA (lpString="*.xls") returned 5
	[0135.944] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv", pszSpec="*.xlsx") returned 0
	[0135.944] lstrlenA (lpString="*.xlsx") returned 6
	[0135.944] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv", pszSpec="*.ppt") returned 0
	[0135.944] lstrlenA (lpString="*.ppt") returned 5
	[0135.944] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv", pszSpec="*.pptx") returned 0
	[0135.944] lstrlenA (lpString="*.pptx") returned 6
	[0135.944] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv", pszSpec="*.txt") returned 0
	[0135.944] lstrlenA (lpString="*.txt") returned 5
	[0135.944] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv", pszSpec="*.pdf") returned 0
	[0135.944] lstrlenA (lpString="*.pdf") returned 5
	[0135.944] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv", pszSpec="*.htm") returned 0
	[0135.944] lstrlenA (lpString="*.htm") returned 5
	[0135.944] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv", pszSpec="*.html") returned 0
	[0135.944] lstrlenA (lpString="*.html") returned 6
	[0135.944] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv", pszSpec="*.mdb") returned 0
	[0135.944] lstrlenA (lpString="*.mdb") returned 5
	[0135.944] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv", pszSpec="*.pfx") returned 0
	[0135.944] lstrlenA (lpString="*.pfx") returned 5
	[0135.944] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv", pszSpec="*.md") returned 0
	[0135.944] lstrlenA (lpString="*.md") returned 4
	[0135.944] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv", pszSpec="*.lnk") returned 0
	[0135.944] lstrlenA (lpString="*.lnk") returned 5
	[0135.944] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv", pszSpec="*.torrent") returned 0
	[0135.944] lstrlenA (lpString="*.torrent") returned 9
	[0135.944] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv", pszSpec="*.mov") returned 0
	[0135.944] lstrlenA (lpString="*.mov") returned 5
	[0135.945] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv", pszSpec="*.3gp") returned 0
	[0135.945] lstrlenA (lpString="*.3gp") returned 5
	[0135.945] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv", pszSpec="*.mpeg") returned 0
	[0135.945] lstrlenA (lpString="*.mpeg") returned 6
	[0135.945] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv", pszSpec="*.mpg") returned 0
	[0135.945] lstrlenA (lpString="*.mpg") returned 5
	[0135.945] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv", pszSpec="*.flv") returned 0
	[0135.945] lstrlenA (lpString="*.flv") returned 5
	[0135.945] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv", pszSpec="*.avi") returned 0
	[0135.945] lstrlenA (lpString="*.avi") returned 5
	[0135.945] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv", pszSpec="*.mp4") returned 0
	[0135.945] lstrlenA (lpString="*.mp4") returned 5
	[0135.945] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv", pszSpec="*.wmv") returned 0
	[0135.945] lstrlenA (lpString="*.wmv") returned 5
	[0135.955] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv", pszSpec="*.mkv") returned 1
	[0135.955] lstrlenA (lpString="*.mkv") returned 5
	[0135.955] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv") returned="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv"
	[0135.955] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv") returned="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv"
	[0135.955] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv.") returned="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv."
	[0135.955] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv.exe") returned="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv.exe"
	[0135.955] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\enlrxss klpa\\38rwbzbr0qck1.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0135.956] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbbba
	[0135.956] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x52454a20, dwHighDateTime=0x1d4cdbe), lpLastAccessTime=0x407536*(dwLowDateTime=0x7d7b4050, dwHighDateTime=0x1d4c71f), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7d7b4050, dwHighDateTime=0x1d4c71f)) returned 1
	[0135.956] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.956] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xbb78, lpOverlapped=0x0) returned 1
	[0135.957] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv") returned="38rwBzbr0qCk1.mkv"
	[0135.957] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.957] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xbb78, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xbb78, lpOverlapped=0x0) returned 1
	[0135.957] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.957] CloseHandle (hObject=0x210) returned 1
	[0135.958] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\enlrxss klpa\\38rwbzbr0qck1.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv.exe" (normalized: "c:\\users\\fd1hvy\\videos\\enlrxss klpa\\38rwbzbr0qck1.mkv.exe")) returned 1
	[0135.958] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcc7a7d0, ftCreationTime.dwHighDateTime=0x1d4ca04, ftLastAccessTime.dwLowDateTime=0x42d22d70, ftLastAccessTime.dwHighDateTime=0x1d4ca4d, ftLastWriteTime.dwLowDateTime=0x42d22d70, ftLastWriteTime.dwHighDateTime=0x1d4ca4d, nFileSizeHigh=0x0, nFileSizeLow=0x92cf, dwReserved0=0x0, dwReserved1=0x1, cFileName="if_jICRh47qUWF3u 6mL.mkv", cAlternateFileName="IF_JIC~1.MKV")) returned 1
	[0135.958] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0135.958] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="if_jICRh47qUWF3u 6mL.mkv") returned -1
	[0135.959] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="if_jICRh47qUWF3u 6mL.mkv") returned -1
	[0135.959] lstrcmpiA (lpString1="", lpString2="if_jICRh47qUWF3u 6mL.mkv") returned -1
	[0135.959] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\38rwBzbr0qCk1.mkv") returned="38rwBzbr0qCk1.mkv"
	[0135.959] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\") returned="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\"
	[0135.959] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\") returned=""
	[0135.959] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.959] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\videos\\enlrxss klpa\\how-to-decrypt-files.htm")) returned 0x20
	[0135.959] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\", lpString2="if_jICRh47qUWF3u 6mL.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv") returned="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv"
	[0135.959] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv", pszSpec="*.zip") returned 0
	[0135.959] lstrlenA (lpString="*.zip") returned 5
	[0135.959] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv", pszSpec="*.rar") returned 0
	[0135.959] lstrlenA (lpString="*.rar") returned 5
	[0135.959] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv", pszSpec="*.7z") returned 0
	[0135.959] lstrlenA (lpString="*.7z") returned 4
	[0135.959] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv", pszSpec="*.tar") returned 0
	[0135.959] lstrlenA (lpString="*.tar") returned 5
	[0135.959] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv", pszSpec="*.gzip") returned 0
	[0135.959] lstrlenA (lpString="*.gzip") returned 6
	[0135.959] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv", pszSpec="*.jpg") returned 0
	[0135.959] lstrlenA (lpString="*.jpg") returned 5
	[0135.959] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv", pszSpec="*.jpeg") returned 0
	[0135.959] lstrlenA (lpString="*.jpeg") returned 6
	[0135.959] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv", pszSpec="*.bmp") returned 0
	[0135.959] lstrlenA (lpString="*.bmp") returned 5
	[0135.959] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv", pszSpec="*.gif") returned 0
	[0135.959] lstrlenA (lpString="*.gif") returned 5
	[0135.959] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv", pszSpec="*.png") returned 0
	[0135.959] lstrlenA (lpString="*.png") returned 5
	[0135.959] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv", pszSpec="*.doc") returned 0
	[0135.959] lstrlenA (lpString="*.doc") returned 5
	[0135.960] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv", pszSpec="*.docx") returned 0
	[0135.960] lstrlenA (lpString="*.docx") returned 6
	[0135.960] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv", pszSpec="*.xls") returned 0
	[0135.960] lstrlenA (lpString="*.xls") returned 5
	[0135.960] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv", pszSpec="*.xlsx") returned 0
	[0135.960] lstrlenA (lpString="*.xlsx") returned 6
	[0135.960] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv", pszSpec="*.ppt") returned 0
	[0135.960] lstrlenA (lpString="*.ppt") returned 5
	[0135.960] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv", pszSpec="*.pptx") returned 0
	[0135.960] lstrlenA (lpString="*.pptx") returned 6
	[0135.960] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv", pszSpec="*.txt") returned 0
	[0135.960] lstrlenA (lpString="*.txt") returned 5
	[0135.960] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv", pszSpec="*.pdf") returned 0
	[0135.960] lstrlenA (lpString="*.pdf") returned 5
	[0135.960] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv", pszSpec="*.htm") returned 0
	[0135.960] lstrlenA (lpString="*.htm") returned 5
	[0135.960] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv", pszSpec="*.html") returned 0
	[0135.960] lstrlenA (lpString="*.html") returned 6
	[0135.960] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv", pszSpec="*.mdb") returned 0
	[0135.960] lstrlenA (lpString="*.mdb") returned 5
	[0135.960] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv", pszSpec="*.pfx") returned 0
	[0135.960] lstrlenA (lpString="*.pfx") returned 5
	[0135.960] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv", pszSpec="*.md") returned 0
	[0135.960] lstrlenA (lpString="*.md") returned 4
	[0135.960] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv", pszSpec="*.lnk") returned 0
	[0135.960] lstrlenA (lpString="*.lnk") returned 5
	[0135.960] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv", pszSpec="*.torrent") returned 0
	[0135.960] lstrlenA (lpString="*.torrent") returned 9
	[0135.960] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv", pszSpec="*.mov") returned 0
	[0135.960] lstrlenA (lpString="*.mov") returned 5
	[0135.960] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv", pszSpec="*.3gp") returned 0
	[0135.960] lstrlenA (lpString="*.3gp") returned 5
	[0135.960] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv", pszSpec="*.mpeg") returned 0
	[0135.960] lstrlenA (lpString="*.mpeg") returned 6
	[0135.960] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv", pszSpec="*.mpg") returned 0
	[0135.961] lstrlenA (lpString="*.mpg") returned 5
	[0135.962] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv", pszSpec="*.flv") returned 0
	[0135.962] lstrlenA (lpString="*.flv") returned 5
	[0135.962] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv", pszSpec="*.avi") returned 0
	[0135.962] lstrlenA (lpString="*.avi") returned 5
	[0135.962] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv", pszSpec="*.mp4") returned 0
	[0135.962] lstrlenA (lpString="*.mp4") returned 5
	[0135.962] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv", pszSpec="*.wmv") returned 0
	[0135.962] lstrlenA (lpString="*.wmv") returned 5
	[0135.962] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv", pszSpec="*.mkv") returned 1
	[0135.962] lstrlenA (lpString="*.mkv") returned 5
	[0135.962] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv") returned="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv"
	[0135.962] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv") returned="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv"
	[0135.962] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv.") returned="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv."
	[0135.962] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv.exe") returned="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv.exe"
	[0135.963] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\enlrxss klpa\\if_jicrh47quwf3u 6ml.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0135.963] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x92cf
	[0135.963] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xfcc7a7d0, dwHighDateTime=0x1d4ca04), lpLastAccessTime=0x407536*(dwLowDateTime=0x42d22d70, dwHighDateTime=0x1d4ca4d), lpLastWriteTime=0x40753e*(dwLowDateTime=0x42d22d70, dwHighDateTime=0x1d4ca4d)) returned 1
	[0135.963] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.963] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x928d, lpOverlapped=0x0) returned 1
	[0135.964] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv") returned="if_jICRh47qUWF3u 6mL.mkv"
	[0135.964] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.964] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x928d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x928d, lpOverlapped=0x0) returned 1
	[0135.968] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.968] CloseHandle (hObject=0x210) returned 1
	[0135.968] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\enlrxss klpa\\if_jicrh47quwf3u 6ml.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv.exe" (normalized: "c:\\users\\fd1hvy\\videos\\enlrxss klpa\\if_jicrh47quwf3u 6ml.mkv.exe")) returned 1
	[0135.969] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e709a0, ftCreationTime.dwHighDateTime=0x1d4c815, ftLastAccessTime.dwLowDateTime=0x2cd23580, ftLastAccessTime.dwHighDateTime=0x1d4d446, ftLastWriteTime.dwLowDateTime=0x2cd23580, ftLastWriteTime.dwHighDateTime=0x1d4d446, nFileSizeHigh=0x0, nFileSizeLow=0x132df, dwReserved0=0x0, dwReserved1=0x1, cFileName="iSLohWeO11c.swf", cAlternateFileName="ISLOHW~1.SWF")) returned 1
	[0135.969] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0135.969] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="iSLohWeO11c.swf") returned -1
	[0135.969] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="iSLohWeO11c.swf") returned -1
	[0135.969] lstrcmpiA (lpString1="", lpString2="iSLohWeO11c.swf") returned -1
	[0135.969] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\if_jICRh47qUWF3u 6mL.mkv") returned="if_jICRh47qUWF3u 6mL.mkv"
	[0135.969] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\") returned="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\"
	[0135.969] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\") returned=""
	[0135.969] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.969] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\videos\\enlrxss klpa\\how-to-decrypt-files.htm")) returned 0x20
	[0135.969] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\", lpString2="iSLohWeO11c.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf") returned="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf"
	[0135.969] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.zip") returned 0
	[0135.969] lstrlenA (lpString="*.zip") returned 5
	[0135.969] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.rar") returned 0
	[0135.969] lstrlenA (lpString="*.rar") returned 5
	[0135.969] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.7z") returned 0
	[0135.969] lstrlenA (lpString="*.7z") returned 4
	[0135.969] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.tar") returned 0
	[0135.969] lstrlenA (lpString="*.tar") returned 5
	[0135.969] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.gzip") returned 0
	[0135.969] lstrlenA (lpString="*.gzip") returned 6
	[0135.969] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.jpg") returned 0
	[0135.969] lstrlenA (lpString="*.jpg") returned 5
	[0135.969] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.jpeg") returned 0
	[0135.969] lstrlenA (lpString="*.jpeg") returned 6
	[0135.969] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.bmp") returned 0
	[0135.969] lstrlenA (lpString="*.bmp") returned 5
	[0135.969] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.gif") returned 0
	[0135.969] lstrlenA (lpString="*.gif") returned 5
	[0135.970] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.png") returned 0
	[0135.970] lstrlenA (lpString="*.png") returned 5
	[0135.970] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.doc") returned 0
	[0135.970] lstrlenA (lpString="*.doc") returned 5
	[0135.970] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.docx") returned 0
	[0135.970] lstrlenA (lpString="*.docx") returned 6
	[0135.970] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.xls") returned 0
	[0135.970] lstrlenA (lpString="*.xls") returned 5
	[0135.970] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.xlsx") returned 0
	[0135.970] lstrlenA (lpString="*.xlsx") returned 6
	[0135.970] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.ppt") returned 0
	[0135.970] lstrlenA (lpString="*.ppt") returned 5
	[0135.970] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.pptx") returned 0
	[0135.970] lstrlenA (lpString="*.pptx") returned 6
	[0135.970] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.txt") returned 0
	[0135.970] lstrlenA (lpString="*.txt") returned 5
	[0135.970] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.pdf") returned 0
	[0135.970] lstrlenA (lpString="*.pdf") returned 5
	[0135.970] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.htm") returned 0
	[0135.970] lstrlenA (lpString="*.htm") returned 5
	[0135.970] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.html") returned 0
	[0135.970] lstrlenA (lpString="*.html") returned 6
	[0135.970] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.mdb") returned 0
	[0135.970] lstrlenA (lpString="*.mdb") returned 5
	[0135.970] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.pfx") returned 0
	[0135.970] lstrlenA (lpString="*.pfx") returned 5
	[0135.970] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.md") returned 0
	[0135.970] lstrlenA (lpString="*.md") returned 4
	[0135.970] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.lnk") returned 0
	[0135.970] lstrlenA (lpString="*.lnk") returned 5
	[0135.970] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.torrent") returned 0
	[0135.970] lstrlenA (lpString="*.torrent") returned 9
	[0135.970] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.mov") returned 0
	[0135.970] lstrlenA (lpString="*.mov") returned 5
	[0135.971] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.3gp") returned 0
	[0135.971] lstrlenA (lpString="*.3gp") returned 5
	[0135.971] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.mpeg") returned 0
	[0135.971] lstrlenA (lpString="*.mpeg") returned 6
	[0135.971] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.mpg") returned 0
	[0135.971] lstrlenA (lpString="*.mpg") returned 5
	[0135.971] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.flv") returned 0
	[0135.971] lstrlenA (lpString="*.flv") returned 5
	[0135.971] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.avi") returned 0
	[0135.971] lstrlenA (lpString="*.avi") returned 5
	[0135.971] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.mp4") returned 0
	[0135.971] lstrlenA (lpString="*.mp4") returned 5
	[0135.971] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.wmv") returned 0
	[0135.971] lstrlenA (lpString="*.wmv") returned 5
	[0135.971] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.mkv") returned 0
	[0135.971] lstrlenA (lpString="*.mkv") returned 5
	[0135.971] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.mp3") returned 0
	[0135.971] lstrlenA (lpString="*.mp3") returned 5
	[0135.971] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.wav") returned 0
	[0135.971] lstrlenA (lpString="*.wav") returned 5
	[0135.971] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.flac") returned 0
	[0135.971] lstrlenA (lpString="*.flac") returned 6
	[0135.971] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.wma") returned 0
	[0135.971] lstrlenA (lpString="*.wma") returned 5
	[0135.971] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.au3") returned 0
	[0135.971] lstrlenA (lpString="*.au3") returned 5
	[0135.971] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.ahk") returned 0
	[0135.971] lstrlenA (lpString="*.ahk") returned 5
	[0135.971] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.c") returned 0
	[0135.971] lstrlenA (lpString="*.c") returned 3
	[0135.971] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.cc") returned 0
	[0135.971] lstrlenA (lpString="*.cc") returned 4
	[0135.971] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.cpp") returned 0
	[0135.972] lstrlenA (lpString="*.cpp") returned 5
	[0135.972] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.cxx") returned 0
	[0135.972] lstrlenA (lpString="*.cxx") returned 5
	[0135.972] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.c++") returned 0
	[0135.972] lstrlenA (lpString="*.c++") returned 5
	[0135.972] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.cs") returned 0
	[0135.972] lstrlenA (lpString="*.cs") returned 4
	[0135.972] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.vb") returned 0
	[0135.972] lstrlenA (lpString="*.vb") returned 4
	[0135.972] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.bas") returned 0
	[0135.972] lstrlenA (lpString="*.bas") returned 5
	[0135.972] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.csproj") returned 0
	[0135.972] lstrlenA (lpString="*.csproj") returned 8
	[0135.972] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.vbproj") returned 0
	[0135.972] lstrlenA (lpString="*.vbproj") returned 8
	[0135.972] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.vcxproj") returned 0
	[0135.972] lstrlenA (lpString="*.vcxproj") returned 9
	[0135.972] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.manifest") returned 0
	[0135.972] lstrlenA (lpString="*.manifest") returned 10
	[0135.972] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.php") returned 0
	[0135.972] lstrlenA (lpString="*.php") returned 5
	[0135.972] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.vbe") returned 0
	[0135.972] lstrlenA (lpString="*.vbe") returned 5
	[0135.972] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.vba") returned 0
	[0135.972] lstrlenA (lpString="*.vba") returned 5
	[0135.972] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.vbs") returned 0
	[0135.972] lstrlenA (lpString="*.vbs") returned 5
	[0135.972] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.bat") returned 0
	[0135.972] lstrlenA (lpString="*.bat") returned 5
	[0135.972] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.cmd") returned 0
	[0135.972] lstrlenA (lpString="*.cmd") returned 5
	[0135.972] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.js") returned 0
	[0135.972] lstrlenA (lpString="*.js") returned 4
	[0135.973] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.jscript") returned 0
	[0135.973] lstrlenA (lpString="*.jscript") returned 9
	[0135.973] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.hta") returned 0
	[0135.973] lstrlenA (lpString="*.hta") returned 5
	[0135.973] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.php7") returned 0
	[0135.973] lstrlenA (lpString="*.php7") returned 6
	[0135.973] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.db") returned 0
	[0135.973] lstrlenA (lpString="*.db") returned 4
	[0135.973] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", pszSpec="*.swf") returned 1
	[0135.973] lstrlenA (lpString="*.swf") returned 5
	[0135.973] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf") returned="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf"
	[0135.973] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf") returned="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf"
	[0135.973] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf.") returned="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf."
	[0135.973] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf.exe") returned="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf.exe"
	[0135.973] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf" (normalized: "c:\\users\\fd1hvy\\videos\\enlrxss klpa\\islohweo11c.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0135.973] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x132df
	[0135.973] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6e709a0, dwHighDateTime=0x1d4c815), lpLastAccessTime=0x407536*(dwLowDateTime=0x2cd23580, dwHighDateTime=0x1d4d446), lpLastWriteTime=0x40753e*(dwLowDateTime=0x2cd23580, dwHighDateTime=0x1d4d446)) returned 1
	[0135.973] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.973] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x1329d, lpOverlapped=0x0) returned 1
	[0135.975] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf") returned="iSLohWeO11c.swf"
	[0135.975] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.975] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x1329d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x1329d, lpOverlapped=0x0) returned 1
	[0135.975] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.975] CloseHandle (hObject=0x210) returned 1
	[0135.975] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf" (normalized: "c:\\users\\fd1hvy\\videos\\enlrxss klpa\\islohweo11c.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf.exe" (normalized: "c:\\users\\fd1hvy\\videos\\enlrxss klpa\\islohweo11c.swf.exe")) returned 1
	[0135.976] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbd5afc0, ftCreationTime.dwHighDateTime=0x1d4cad9, ftLastAccessTime.dwLowDateTime=0x5a920a90, ftLastAccessTime.dwHighDateTime=0x1d4cf0a, ftLastWriteTime.dwLowDateTime=0x5a920a90, ftLastWriteTime.dwHighDateTime=0x1d4cf0a, nFileSizeHigh=0x0, nFileSizeLow=0x80d0, dwReserved0=0x1f, dwReserved1=0x1, cFileName="J1EN0.flv", cAlternateFileName="")) returned 1
	[0135.976] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0135.976] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="J1EN0.flv") returned -1
	[0135.976] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="J1EN0.flv") returned -1
	[0135.976] lstrcmpiA (lpString1="", lpString2="J1EN0.flv") returned -1
	[0135.977] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\iSLohWeO11c.swf") returned="iSLohWeO11c.swf"
	[0135.977] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\") returned="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\"
	[0135.977] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\") returned=""
	[0135.977] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.977] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\videos\\enlrxss klpa\\how-to-decrypt-files.htm")) returned 0x20
	[0135.977] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\", lpString2="J1EN0.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv") returned="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv"
	[0135.977] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv", pszSpec="*.zip") returned 0
	[0135.977] lstrlenA (lpString="*.zip") returned 5
	[0135.977] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv", pszSpec="*.rar") returned 0
	[0135.977] lstrlenA (lpString="*.rar") returned 5
	[0135.977] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv", pszSpec="*.7z") returned 0
	[0135.977] lstrlenA (lpString="*.7z") returned 4
	[0135.977] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv", pszSpec="*.tar") returned 0
	[0135.977] lstrlenA (lpString="*.tar") returned 5
	[0135.977] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv", pszSpec="*.gzip") returned 0
	[0135.977] lstrlenA (lpString="*.gzip") returned 6
	[0135.977] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv", pszSpec="*.jpg") returned 0
	[0135.977] lstrlenA (lpString="*.jpg") returned 5
	[0135.977] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv", pszSpec="*.jpeg") returned 0
	[0135.977] lstrlenA (lpString="*.jpeg") returned 6
	[0135.977] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv", pszSpec="*.bmp") returned 0
	[0135.977] lstrlenA (lpString="*.bmp") returned 5
	[0135.977] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv", pszSpec="*.gif") returned 0
	[0135.977] lstrlenA (lpString="*.gif") returned 5
	[0135.977] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv", pszSpec="*.png") returned 0
	[0135.977] lstrlenA (lpString="*.png") returned 5
	[0135.977] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv", pszSpec="*.doc") returned 0
	[0135.977] lstrlenA (lpString="*.doc") returned 5
	[0135.978] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv", pszSpec="*.docx") returned 0
	[0135.978] lstrlenA (lpString="*.docx") returned 6
	[0135.978] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv", pszSpec="*.xls") returned 0
	[0135.978] lstrlenA (lpString="*.xls") returned 5
	[0135.978] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv", pszSpec="*.xlsx") returned 0
	[0135.978] lstrlenA (lpString="*.xlsx") returned 6
	[0135.978] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv", pszSpec="*.ppt") returned 0
	[0135.978] lstrlenA (lpString="*.ppt") returned 5
	[0135.978] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv", pszSpec="*.pptx") returned 0
	[0135.978] lstrlenA (lpString="*.pptx") returned 6
	[0135.978] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv", pszSpec="*.txt") returned 0
	[0135.978] lstrlenA (lpString="*.txt") returned 5
	[0135.978] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv", pszSpec="*.pdf") returned 0
	[0135.978] lstrlenA (lpString="*.pdf") returned 5
	[0135.978] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv", pszSpec="*.htm") returned 0
	[0135.978] lstrlenA (lpString="*.htm") returned 5
	[0135.978] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv", pszSpec="*.html") returned 0
	[0135.978] lstrlenA (lpString="*.html") returned 6
	[0135.978] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv", pszSpec="*.mdb") returned 0
	[0135.978] lstrlenA (lpString="*.mdb") returned 5
	[0135.978] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv", pszSpec="*.pfx") returned 0
	[0135.978] lstrlenA (lpString="*.pfx") returned 5
	[0135.978] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv", pszSpec="*.md") returned 0
	[0135.978] lstrlenA (lpString="*.md") returned 4
	[0135.978] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv", pszSpec="*.lnk") returned 0
	[0135.978] lstrlenA (lpString="*.lnk") returned 5
	[0135.978] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv", pszSpec="*.torrent") returned 0
	[0135.978] lstrlenA (lpString="*.torrent") returned 9
	[0135.978] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv", pszSpec="*.mov") returned 0
	[0135.978] lstrlenA (lpString="*.mov") returned 5
	[0135.978] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv", pszSpec="*.3gp") returned 0
	[0135.978] lstrlenA (lpString="*.3gp") returned 5
	[0135.978] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv", pszSpec="*.mpeg") returned 0
	[0135.978] lstrlenA (lpString="*.mpeg") returned 6
	[0135.979] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv", pszSpec="*.mpg") returned 0
	[0135.979] lstrlenA (lpString="*.mpg") returned 5
	[0135.979] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv", pszSpec="*.flv") returned 1
	[0135.979] lstrlenA (lpString="*.flv") returned 5
	[0135.979] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv") returned="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv"
	[0135.979] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv") returned="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv"
	[0135.979] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv.") returned="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv."
	[0135.979] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv.exe") returned="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv.exe"
	[0135.979] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv" (normalized: "c:\\users\\fd1hvy\\videos\\enlrxss klpa\\j1en0.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0135.979] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x80d0
	[0135.979] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcbd5afc0, dwHighDateTime=0x1d4cad9), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a920a90, dwHighDateTime=0x1d4cf0a), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5a920a90, dwHighDateTime=0x1d4cf0a)) returned 1
	[0135.979] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.979] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x808e, lpOverlapped=0x0) returned 1
	[0135.980] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv") returned="J1EN0.flv"
	[0135.980] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.980] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x808e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x808e, lpOverlapped=0x0) returned 1
	[0135.981] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.981] CloseHandle (hObject=0x210) returned 1
	[0135.981] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv" (normalized: "c:\\users\\fd1hvy\\videos\\enlrxss klpa\\j1en0.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv.exe" (normalized: "c:\\users\\fd1hvy\\videos\\enlrxss klpa\\j1en0.flv.exe")) returned 1
	[0135.981] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17d28780, ftCreationTime.dwHighDateTime=0x1d4c73e, ftLastAccessTime.dwLowDateTime=0xc8f3de70, ftLastAccessTime.dwHighDateTime=0x1d4ccfb, ftLastWriteTime.dwLowDateTime=0xc8f3de70, ftLastWriteTime.dwHighDateTime=0x1d4ccfb, nFileSizeHigh=0x0, nFileSizeLow=0xbb01, dwReserved0=0x0, dwReserved1=0x1, cFileName="Pz7N.mp4", cAlternateFileName="")) returned 1
	[0135.981] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0
	[0135.981] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Pz7N.mp4") returned -1
	[0135.981] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Pz7N.mp4") returned -1
	[0135.981] lstrcmpiA (lpString1="", lpString2="Pz7N.mp4") returned -1
	[0135.981] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\J1EN0.flv") returned="J1EN0.flv"
	[0135.982] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\") returned="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\"
	[0135.982] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\") returned=""
	[0135.982] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.982] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\videos\\enlrxss klpa\\how-to-decrypt-files.htm")) returned 0x20
	[0135.982] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\", lpString2="Pz7N.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4") returned="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4"
	[0135.982] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4", pszSpec="*.zip") returned 0
	[0135.982] lstrlenA (lpString="*.zip") returned 5
	[0135.982] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4", pszSpec="*.rar") returned 0
	[0135.982] lstrlenA (lpString="*.rar") returned 5
	[0135.982] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4", pszSpec="*.7z") returned 0
	[0135.982] lstrlenA (lpString="*.7z") returned 4
	[0135.982] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4", pszSpec="*.tar") returned 0
	[0135.982] lstrlenA (lpString="*.tar") returned 5
	[0135.982] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4", pszSpec="*.gzip") returned 0
	[0135.982] lstrlenA (lpString="*.gzip") returned 6
	[0135.982] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4", pszSpec="*.jpg") returned 0
	[0135.982] lstrlenA (lpString="*.jpg") returned 5
	[0135.982] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4", pszSpec="*.jpeg") returned 0
	[0135.982] lstrlenA (lpString="*.jpeg") returned 6
	[0135.982] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4", pszSpec="*.bmp") returned 0
	[0135.982] lstrlenA (lpString="*.bmp") returned 5
	[0135.982] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4", pszSpec="*.gif") returned 0
	[0135.982] lstrlenA (lpString="*.gif") returned 5
	[0135.982] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4", pszSpec="*.png") returned 0
	[0135.982] lstrlenA (lpString="*.png") returned 5
	[0135.982] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4", pszSpec="*.doc") returned 0
	[0135.982] lstrlenA (lpString="*.doc") returned 5
	[0135.982] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4", pszSpec="*.docx") returned 0
	[0135.982] lstrlenA (lpString="*.docx") returned 6
	[0135.982] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4", pszSpec="*.xls") returned 0
	[0135.982] lstrlenA (lpString="*.xls") returned 5
	[0135.983] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4", pszSpec="*.xlsx") returned 0
	[0135.983] lstrlenA (lpString="*.xlsx") returned 6
	[0135.983] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4", pszSpec="*.ppt") returned 0
	[0135.983] lstrlenA (lpString="*.ppt") returned 5
	[0135.983] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4", pszSpec="*.pptx") returned 0
	[0135.983] lstrlenA (lpString="*.pptx") returned 6
	[0135.983] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4", pszSpec="*.txt") returned 0
	[0135.983] lstrlenA (lpString="*.txt") returned 5
	[0135.983] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4", pszSpec="*.pdf") returned 0
	[0135.983] lstrlenA (lpString="*.pdf") returned 5
	[0135.983] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4", pszSpec="*.htm") returned 0
	[0135.983] lstrlenA (lpString="*.htm") returned 5
	[0135.983] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4", pszSpec="*.html") returned 0
	[0135.983] lstrlenA (lpString="*.html") returned 6
	[0135.983] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4", pszSpec="*.mdb") returned 0
	[0135.983] lstrlenA (lpString="*.mdb") returned 5
	[0135.983] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4", pszSpec="*.pfx") returned 0
	[0135.983] lstrlenA (lpString="*.pfx") returned 5
	[0135.983] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4", pszSpec="*.md") returned 0
	[0135.983] lstrlenA (lpString="*.md") returned 4
	[0135.983] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4", pszSpec="*.lnk") returned 0
	[0135.983] lstrlenA (lpString="*.lnk") returned 5
	[0135.983] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4", pszSpec="*.torrent") returned 0
	[0135.983] lstrlenA (lpString="*.torrent") returned 9
	[0135.983] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4", pszSpec="*.mov") returned 0
	[0135.983] lstrlenA (lpString="*.mov") returned 5
	[0135.983] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4", pszSpec="*.3gp") returned 0
	[0135.983] lstrlenA (lpString="*.3gp") returned 5
	[0135.983] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4", pszSpec="*.mpeg") returned 0
	[0135.983] lstrlenA (lpString="*.mpeg") returned 6
	[0135.983] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4", pszSpec="*.mpg") returned 0
	[0135.983] lstrlenA (lpString="*.mpg") returned 5
	[0135.983] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4", pszSpec="*.flv") returned 0
	[0135.983] lstrlenA (lpString="*.flv") returned 5
	[0135.984] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4", pszSpec="*.avi") returned 0
	[0135.984] lstrlenA (lpString="*.avi") returned 5
	[0135.984] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4", pszSpec="*.mp4") returned 1
	[0135.984] lstrlenA (lpString="*.mp4") returned 5
	[0135.984] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4") returned="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4"
	[0135.984] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4") returned="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4"
	[0135.984] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4.") returned="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4."
	[0135.984] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4.exe") returned="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4.exe"
	[0135.984] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\enlrxss klpa\\pz7n.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0135.984] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbb01
	[0135.984] GetFileTime (in: hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x17d28780, dwHighDateTime=0x1d4c73e), lpLastAccessTime=0x407536*(dwLowDateTime=0xc8f3de70, dwHighDateTime=0x1d4ccfb), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc8f3de70, dwHighDateTime=0x1d4ccfb)) returned 1
	[0135.984] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.984] ReadFile (in: hFile=0x210, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xbabf, lpOverlapped=0x0) returned 1
	[0135.985] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4") returned="Pz7N.mp4"
	[0135.985] SetFilePointer (in: hFile=0x210, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.985] WriteFile (in: hFile=0x210, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xbabf, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xbabf, lpOverlapped=0x0) returned 1
	[0135.986] SetFileTime (hFile=0x210, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0135.986] CloseHandle (hObject=0x210) returned 1
	[0135.986] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\enlrxss klpa\\pz7n.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\enLrXss Klpa\\Pz7N.mp4.exe" (normalized: "c:\\users\\fd1hvy\\videos\\enlrxss klpa\\pz7n.mp4.exe")) returned 1
	[0135.986] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17d28780, ftCreationTime.dwHighDateTime=0x1d4c73e, ftLastAccessTime.dwLowDateTime=0xc8f3de70, ftLastAccessTime.dwHighDateTime=0x1d4ccfb, ftLastWriteTime.dwLowDateTime=0xc8f3de70, ftLastWriteTime.dwHighDateTime=0x1d4ccfb, nFileSizeHigh=0x0, nFileSizeLow=0xbb01, dwReserved0=0x0, dwReserved1=0x1, cFileName="Pz7N.mp4", cAlternateFileName="")) returned 0
	[0135.986] FindClose (in: hFindFile=0x7cb810 | out: hFindFile=0x7cb810) returned 1
	[0135.987] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x387ff8a0, ftCreationTime.dwHighDateTime=0x1d4ceaa, ftLastAccessTime.dwLowDateTime=0xe72a0770, ftLastAccessTime.dwHighDateTime=0x1d4cce7, ftLastWriteTime.dwLowDateTime=0xe72a0770, ftLastWriteTime.dwHighDateTime=0x1d4cce7, nFileSizeHigh=0x0, nFileSizeLow=0xcc1d, dwReserved0=0x7b0260, dwReserved1=0x1000000, cFileName="iHvBG9sA.swf", cAlternateFileName="")) returned 1
	[0135.987] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0135.987] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="iHvBG9sA.swf") returned -1
	[0135.987] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="iHvBG9sA.swf") returned -1
	[0135.987] lstrcmpiA (lpString1="", lpString2="iHvBG9sA.swf") returned -1
	[0135.987] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\*.*") returned="*.*"
	[0135.987] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Videos\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\"
	[0135.987] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Videos\\" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\") returned=""
	[0135.987] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Videos\\HOW-TO-DECRYPT-FILES.HTM"
	[0135.987] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Videos\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\videos\\how-to-decrypt-files.htm")) returned 0x20
	[0135.987] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="iHvBG9sA.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf") returned="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf"
	[0135.987] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.zip") returned 0
	[0135.987] lstrlenA (lpString="*.zip") returned 5
	[0135.987] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.rar") returned 0
	[0135.987] lstrlenA (lpString="*.rar") returned 5
	[0135.987] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.7z") returned 0
	[0135.987] lstrlenA (lpString="*.7z") returned 4
	[0135.987] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.tar") returned 0
	[0135.987] lstrlenA (lpString="*.tar") returned 5
	[0135.987] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.gzip") returned 0
	[0135.987] lstrlenA (lpString="*.gzip") returned 6
	[0135.987] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.jpg") returned 0
	[0135.987] lstrlenA (lpString="*.jpg") returned 5
	[0135.987] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.jpeg") returned 0
	[0135.987] lstrlenA (lpString="*.jpeg") returned 6
	[0135.987] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.bmp") returned 0
	[0135.987] lstrlenA (lpString="*.bmp") returned 5
	[0135.987] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.gif") returned 0
	[0135.987] lstrlenA (lpString="*.gif") returned 5
	[0135.987] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.png") returned 0
	[0135.987] lstrlenA (lpString="*.png") returned 5
	[0135.988] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.doc") returned 0
	[0135.988] lstrlenA (lpString="*.doc") returned 5
	[0135.988] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.docx") returned 0
	[0135.988] lstrlenA (lpString="*.docx") returned 6
	[0135.988] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.xls") returned 0
	[0135.988] lstrlenA (lpString="*.xls") returned 5
	[0135.988] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.xlsx") returned 0
	[0135.988] lstrlenA (lpString="*.xlsx") returned 6
	[0135.988] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.ppt") returned 0
	[0135.988] lstrlenA (lpString="*.ppt") returned 5
	[0135.988] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.pptx") returned 0
	[0135.988] lstrlenA (lpString="*.pptx") returned 6
	[0135.988] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.txt") returned 0
	[0135.988] lstrlenA (lpString="*.txt") returned 5
	[0135.988] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.pdf") returned 0
	[0135.988] lstrlenA (lpString="*.pdf") returned 5
	[0135.988] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.htm") returned 0
	[0135.988] lstrlenA (lpString="*.htm") returned 5
	[0135.988] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.html") returned 0
	[0135.988] lstrlenA (lpString="*.html") returned 6
	[0135.988] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.mdb") returned 0
	[0135.988] lstrlenA (lpString="*.mdb") returned 5
	[0135.988] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.pfx") returned 0
	[0135.988] lstrlenA (lpString="*.pfx") returned 5
	[0135.988] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.md") returned 0
	[0135.988] lstrlenA (lpString="*.md") returned 4
	[0135.988] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.lnk") returned 0
	[0135.988] lstrlenA (lpString="*.lnk") returned 5
	[0135.988] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.torrent") returned 0
	[0135.988] lstrlenA (lpString="*.torrent") returned 9
	[0135.988] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.mov") returned 0
	[0135.988] lstrlenA (lpString="*.mov") returned 5
	[0135.988] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.3gp") returned 0
	[0135.988] lstrlenA (lpString="*.3gp") returned 5
	[0135.989] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.mpeg") returned 0
	[0135.989] lstrlenA (lpString="*.mpeg") returned 6
	[0135.989] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.mpg") returned 0
	[0135.989] lstrlenA (lpString="*.mpg") returned 5
	[0135.989] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.flv") returned 0
	[0135.989] lstrlenA (lpString="*.flv") returned 5
	[0135.989] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.avi") returned 0
	[0135.989] lstrlenA (lpString="*.avi") returned 5
	[0135.989] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.mp4") returned 0
	[0135.989] lstrlenA (lpString="*.mp4") returned 5
	[0135.989] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.wmv") returned 0
	[0135.989] lstrlenA (lpString="*.wmv") returned 5
	[0135.989] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.mkv") returned 0
	[0135.989] lstrlenA (lpString="*.mkv") returned 5
	[0135.989] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.mp3") returned 0
	[0135.989] lstrlenA (lpString="*.mp3") returned 5
	[0135.989] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.wav") returned 0
	[0135.989] lstrlenA (lpString="*.wav") returned 5
	[0135.989] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.flac") returned 0
	[0135.989] lstrlenA (lpString="*.flac") returned 6
	[0135.989] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.wma") returned 0
	[0135.989] lstrlenA (lpString="*.wma") returned 5
	[0135.989] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.au3") returned 0
	[0135.989] lstrlenA (lpString="*.au3") returned 5
	[0135.989] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.ahk") returned 0
	[0135.989] lstrlenA (lpString="*.ahk") returned 5
	[0135.989] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.c") returned 0
	[0135.989] lstrlenA (lpString="*.c") returned 3
	[0135.989] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.cc") returned 0
	[0135.989] lstrlenA (lpString="*.cc") returned 4
	[0135.989] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.cpp") returned 0
	[0135.989] lstrlenA (lpString="*.cpp") returned 5
	[0135.989] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.cxx") returned 0
	[0135.989] lstrlenA (lpString="*.cxx") returned 5
	[0135.990] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.c++") returned 0
	[0135.990] lstrlenA (lpString="*.c++") returned 5
	[0135.990] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.cs") returned 0
	[0135.990] lstrlenA (lpString="*.cs") returned 4
	[0135.990] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.vb") returned 0
	[0135.990] lstrlenA (lpString="*.vb") returned 4
	[0135.990] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.bas") returned 0
	[0135.990] lstrlenA (lpString="*.bas") returned 5
	[0135.990] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.csproj") returned 0
	[0135.990] lstrlenA (lpString="*.csproj") returned 8
	[0135.990] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.vbproj") returned 0
	[0135.990] lstrlenA (lpString="*.vbproj") returned 8
	[0135.990] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.vcxproj") returned 0
	[0135.990] lstrlenA (lpString="*.vcxproj") returned 9
	[0135.990] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.manifest") returned 0
	[0135.990] lstrlenA (lpString="*.manifest") returned 10
	[0135.990] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.php") returned 0
	[0135.990] lstrlenA (lpString="*.php") returned 5
	[0135.990] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.vbe") returned 0
	[0135.990] lstrlenA (lpString="*.vbe") returned 5
	[0135.990] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.vba") returned 0
	[0135.990] lstrlenA (lpString="*.vba") returned 5
	[0135.990] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.vbs") returned 0
	[0135.990] lstrlenA (lpString="*.vbs") returned 5
	[0135.990] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.bat") returned 0
	[0135.990] lstrlenA (lpString="*.bat") returned 5
	[0135.990] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.cmd") returned 0
	[0135.990] lstrlenA (lpString="*.cmd") returned 5
	[0135.990] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.js") returned 0
	[0135.990] lstrlenA (lpString="*.js") returned 4
	[0135.990] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.jscript") returned 0
	[0135.990] lstrlenA (lpString="*.jscript") returned 9
	[0135.990] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.hta") returned 0
	[0135.990] lstrlenA (lpString="*.hta") returned 5
	[0135.991] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.php7") returned 0
	[0135.991] lstrlenA (lpString="*.php7") returned 6
	[0135.991] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.db") returned 0
	[0135.991] lstrlenA (lpString="*.db") returned 4
	[0135.991] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", pszSpec="*.swf") returned 1
	[0135.991] lstrlenA (lpString="*.swf") returned 5
	[0135.991] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf") returned="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf"
	[0135.991] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf") returned="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf"
	[0135.991] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf.") returned="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf."
	[0135.991] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf.exe") returned="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf.exe"
	[0135.991] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf" (normalized: "c:\\users\\fd1hvy\\videos\\ihvbg9sa.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0135.991] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcc1d
	[0135.991] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x387ff8a0, dwHighDateTime=0x1d4ceaa), lpLastAccessTime=0x407536*(dwLowDateTime=0xe72a0770, dwHighDateTime=0x1d4cce7), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe72a0770, dwHighDateTime=0x1d4cce7)) returned 1
	[0135.991] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0135.991] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0xcbdb, lpOverlapped=0x0) returned 1
	[0136.027] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf") returned="iHvBG9sA.swf"
	[0136.027] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0136.027] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0xcbdb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0xcbdb, lpOverlapped=0x0) returned 1
	[0136.028] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0136.028] CloseHandle (hObject=0x20c) returned 1
	[0136.028] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf" (normalized: "c:\\users\\fd1hvy\\videos\\ihvbg9sa.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf.exe" (normalized: "c:\\users\\fd1hvy\\videos\\ihvbg9sa.swf.exe")) returned 1
	[0136.029] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64b5eba0, ftCreationTime.dwHighDateTime=0x1d4cbda, ftLastAccessTime.dwLowDateTime=0xc7ea7880, ftLastAccessTime.dwHighDateTime=0x1d4d571, ftLastWriteTime.dwLowDateTime=0xc7ea7880, ftLastWriteTime.dwHighDateTime=0x1d4d571, nFileSizeHigh=0x0, nFileSizeLow=0x6595, dwReserved0=0x12, dwReserved1=0x1, cFileName="ikoDoXQeZ.flv", cAlternateFileName="IKODOX~1.FLV")) returned 1
	[0136.029] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.029] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="ikoDoXQeZ.flv") returned -1
	[0136.029] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="ikoDoXQeZ.flv") returned -1
	[0136.029] lstrcmpiA (lpString1="", lpString2="ikoDoXQeZ.flv") returned -1
	[0136.029] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\iHvBG9sA.swf") returned="iHvBG9sA.swf"
	[0136.029] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Videos\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\"
	[0136.029] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Videos\\" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\") returned=""
	[0136.029] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Videos\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.029] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Videos\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\videos\\how-to-decrypt-files.htm")) returned 0x20
	[0136.029] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="ikoDoXQeZ.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv") returned="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv"
	[0136.029] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv", pszSpec="*.zip") returned 0
	[0136.029] lstrlenA (lpString="*.zip") returned 5
	[0136.029] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv", pszSpec="*.rar") returned 0
	[0136.029] lstrlenA (lpString="*.rar") returned 5
	[0136.029] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv", pszSpec="*.7z") returned 0
	[0136.029] lstrlenA (lpString="*.7z") returned 4
	[0136.029] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv", pszSpec="*.tar") returned 0
	[0136.029] lstrlenA (lpString="*.tar") returned 5
	[0136.030] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv", pszSpec="*.gzip") returned 0
	[0136.030] lstrlenA (lpString="*.gzip") returned 6
	[0136.030] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv", pszSpec="*.jpg") returned 0
	[0136.030] lstrlenA (lpString="*.jpg") returned 5
	[0136.030] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv", pszSpec="*.jpeg") returned 0
	[0136.030] lstrlenA (lpString="*.jpeg") returned 6
	[0136.030] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv", pszSpec="*.bmp") returned 0
	[0136.030] lstrlenA (lpString="*.bmp") returned 5
	[0136.030] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv", pszSpec="*.gif") returned 0
	[0136.030] lstrlenA (lpString="*.gif") returned 5
	[0136.030] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv", pszSpec="*.png") returned 0
	[0136.030] lstrlenA (lpString="*.png") returned 5
	[0136.030] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv", pszSpec="*.doc") returned 0
	[0136.030] lstrlenA (lpString="*.doc") returned 5
	[0136.030] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv", pszSpec="*.docx") returned 0
	[0136.030] lstrlenA (lpString="*.docx") returned 6
	[0136.030] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv", pszSpec="*.xls") returned 0
	[0136.030] lstrlenA (lpString="*.xls") returned 5
	[0136.030] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv", pszSpec="*.xlsx") returned 0
	[0136.030] lstrlenA (lpString="*.xlsx") returned 6
	[0136.030] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv", pszSpec="*.ppt") returned 0
	[0136.030] lstrlenA (lpString="*.ppt") returned 5
	[0136.030] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv", pszSpec="*.pptx") returned 0
	[0136.030] lstrlenA (lpString="*.pptx") returned 6
	[0136.030] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv", pszSpec="*.txt") returned 0
	[0136.030] lstrlenA (lpString="*.txt") returned 5
	[0136.030] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv", pszSpec="*.pdf") returned 0
	[0136.030] lstrlenA (lpString="*.pdf") returned 5
	[0136.030] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv", pszSpec="*.htm") returned 0
	[0136.030] lstrlenA (lpString="*.htm") returned 5
	[0136.030] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv", pszSpec="*.html") returned 0
	[0136.030] lstrlenA (lpString="*.html") returned 6
	[0136.030] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv", pszSpec="*.mdb") returned 0
	[0136.030] lstrlenA (lpString="*.mdb") returned 5
	[0136.031] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv", pszSpec="*.pfx") returned 0
	[0136.031] lstrlenA (lpString="*.pfx") returned 5
	[0136.031] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv", pszSpec="*.md") returned 0
	[0136.031] lstrlenA (lpString="*.md") returned 4
	[0136.031] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv", pszSpec="*.lnk") returned 0
	[0136.031] lstrlenA (lpString="*.lnk") returned 5
	[0136.031] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv", pszSpec="*.torrent") returned 0
	[0136.031] lstrlenA (lpString="*.torrent") returned 9
	[0136.031] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv", pszSpec="*.mov") returned 0
	[0136.031] lstrlenA (lpString="*.mov") returned 5
	[0136.031] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv", pszSpec="*.3gp") returned 0
	[0136.031] lstrlenA (lpString="*.3gp") returned 5
	[0136.031] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv", pszSpec="*.mpeg") returned 0
	[0136.031] lstrlenA (lpString="*.mpeg") returned 6
	[0136.031] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv", pszSpec="*.mpg") returned 0
	[0136.031] lstrlenA (lpString="*.mpg") returned 5
	[0136.031] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv", pszSpec="*.flv") returned 1
	[0136.031] lstrlenA (lpString="*.flv") returned 5
	[0136.031] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv") returned="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv"
	[0136.031] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv") returned="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv"
	[0136.031] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv.") returned="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv."
	[0136.031] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv.exe") returned="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv.exe"
	[0136.031] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv" (normalized: "c:\\users\\fd1hvy\\videos\\ikodoxqez.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0136.032] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6595
	[0136.032] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x64b5eba0, dwHighDateTime=0x1d4cbda), lpLastAccessTime=0x407536*(dwLowDateTime=0xc7ea7880, dwHighDateTime=0x1d4d571), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc7ea7880, dwHighDateTime=0x1d4d571)) returned 1
	[0136.032] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0136.032] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x6553, lpOverlapped=0x0) returned 1
	[0136.033] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv") returned="ikoDoXQeZ.flv"
	[0136.033] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0136.033] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x6553, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x6553, lpOverlapped=0x0) returned 1
	[0136.033] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0136.033] CloseHandle (hObject=0x20c) returned 1
	[0136.033] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv" (normalized: "c:\\users\\fd1hvy\\videos\\ikodoxqez.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv.exe" (normalized: "c:\\users\\fd1hvy\\videos\\ikodoxqez.flv.exe")) returned 1
	[0136.034] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x285801c0, ftCreationTime.dwHighDateTime=0x1d4d477, ftLastAccessTime.dwLowDateTime=0xa28b04d0, ftLastAccessTime.dwHighDateTime=0x1d4c5b1, ftLastWriteTime.dwLowDateTime=0xa28b04d0, ftLastWriteTime.dwHighDateTime=0x1d4c5b1, nFileSizeHigh=0x0, nFileSizeLow=0x13a7b, dwReserved0=0x12, dwReserved1=0x1, cFileName="LjBiz.mkv", cAlternateFileName="")) returned 1
	[0136.034] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.034] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="LjBiz.mkv") returned -1
	[0136.034] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="LjBiz.mkv") returned -1
	[0136.034] lstrcmpiA (lpString1="", lpString2="LjBiz.mkv") returned -1
	[0136.034] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\ikoDoXQeZ.flv") returned="ikoDoXQeZ.flv"
	[0136.034] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Videos\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\"
	[0136.034] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Videos\\" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\") returned=""
	[0136.034] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Videos\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.034] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Videos\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\videos\\how-to-decrypt-files.htm")) returned 0x20
	[0136.034] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="LjBiz.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv") returned="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv"
	[0136.034] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv", pszSpec="*.zip") returned 0
	[0136.034] lstrlenA (lpString="*.zip") returned 5
	[0136.034] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv", pszSpec="*.rar") returned 0
	[0136.034] lstrlenA (lpString="*.rar") returned 5
	[0136.034] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv", pszSpec="*.7z") returned 0
	[0136.035] lstrlenA (lpString="*.7z") returned 4
	[0136.035] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv", pszSpec="*.tar") returned 0
	[0136.035] lstrlenA (lpString="*.tar") returned 5
	[0136.035] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv", pszSpec="*.gzip") returned 0
	[0136.035] lstrlenA (lpString="*.gzip") returned 6
	[0136.035] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv", pszSpec="*.jpg") returned 0
	[0136.035] lstrlenA (lpString="*.jpg") returned 5
	[0136.035] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv", pszSpec="*.jpeg") returned 0
	[0136.035] lstrlenA (lpString="*.jpeg") returned 6
	[0136.035] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv", pszSpec="*.bmp") returned 0
	[0136.035] lstrlenA (lpString="*.bmp") returned 5
	[0136.035] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv", pszSpec="*.gif") returned 0
	[0136.035] lstrlenA (lpString="*.gif") returned 5
	[0136.035] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv", pszSpec="*.png") returned 0
	[0136.035] lstrlenA (lpString="*.png") returned 5
	[0136.035] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv", pszSpec="*.doc") returned 0
	[0136.035] lstrlenA (lpString="*.doc") returned 5
	[0136.035] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv", pszSpec="*.docx") returned 0
	[0136.035] lstrlenA (lpString="*.docx") returned 6
	[0136.035] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv", pszSpec="*.xls") returned 0
	[0136.035] lstrlenA (lpString="*.xls") returned 5
	[0136.035] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv", pszSpec="*.xlsx") returned 0
	[0136.035] lstrlenA (lpString="*.xlsx") returned 6
	[0136.035] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv", pszSpec="*.ppt") returned 0
	[0136.035] lstrlenA (lpString="*.ppt") returned 5
	[0136.035] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv", pszSpec="*.pptx") returned 0
	[0136.035] lstrlenA (lpString="*.pptx") returned 6
	[0136.035] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv", pszSpec="*.txt") returned 0
	[0136.035] lstrlenA (lpString="*.txt") returned 5
	[0136.035] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv", pszSpec="*.pdf") returned 0
	[0136.035] lstrlenA (lpString="*.pdf") returned 5
	[0136.035] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv", pszSpec="*.htm") returned 0
	[0136.035] lstrlenA (lpString="*.htm") returned 5
	[0136.035] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv", pszSpec="*.html") returned 0
	[0136.036] lstrlenA (lpString="*.html") returned 6
	[0136.036] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv", pszSpec="*.mdb") returned 0
	[0136.036] lstrlenA (lpString="*.mdb") returned 5
	[0136.036] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv", pszSpec="*.pfx") returned 0
	[0136.036] lstrlenA (lpString="*.pfx") returned 5
	[0136.036] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv", pszSpec="*.md") returned 0
	[0136.036] lstrlenA (lpString="*.md") returned 4
	[0136.036] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv", pszSpec="*.lnk") returned 0
	[0136.036] lstrlenA (lpString="*.lnk") returned 5
	[0136.036] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv", pszSpec="*.torrent") returned 0
	[0136.036] lstrlenA (lpString="*.torrent") returned 9
	[0136.036] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv", pszSpec="*.mov") returned 0
	[0136.036] lstrlenA (lpString="*.mov") returned 5
	[0136.036] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv", pszSpec="*.3gp") returned 0
	[0136.036] lstrlenA (lpString="*.3gp") returned 5
	[0136.036] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv", pszSpec="*.mpeg") returned 0
	[0136.036] lstrlenA (lpString="*.mpeg") returned 6
	[0136.036] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv", pszSpec="*.mpg") returned 0
	[0136.036] lstrlenA (lpString="*.mpg") returned 5
	[0136.036] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv", pszSpec="*.flv") returned 0
	[0136.036] lstrlenA (lpString="*.flv") returned 5
	[0136.036] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv", pszSpec="*.avi") returned 0
	[0136.036] lstrlenA (lpString="*.avi") returned 5
	[0136.036] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv", pszSpec="*.mp4") returned 0
	[0136.036] lstrlenA (lpString="*.mp4") returned 5
	[0136.036] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv", pszSpec="*.wmv") returned 0
	[0136.036] lstrlenA (lpString="*.wmv") returned 5
	[0136.036] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv", pszSpec="*.mkv") returned 1
	[0136.036] lstrlenA (lpString="*.mkv") returned 5
	[0136.036] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv") returned="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv"
	[0136.036] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv") returned="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv"
	[0136.036] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv.") returned="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv."
	[0136.036] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv.exe") returned="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv.exe"
	[0136.037] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\ljbiz.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0136.037] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13a7b
	[0136.037] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x285801c0, dwHighDateTime=0x1d4d477), lpLastAccessTime=0x407536*(dwLowDateTime=0xa28b04d0, dwHighDateTime=0x1d4c5b1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa28b04d0, dwHighDateTime=0x1d4c5b1)) returned 1
	[0136.037] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0136.037] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x13a39, lpOverlapped=0x0) returned 1
	[0136.038] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv") returned="LjBiz.mkv"
	[0136.038] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0136.038] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x13a39, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x13a39, lpOverlapped=0x0) returned 1
	[0136.039] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0136.039] CloseHandle (hObject=0x20c) returned 1
	[0136.039] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\ljbiz.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv.exe" (normalized: "c:\\users\\fd1hvy\\videos\\ljbiz.mkv.exe")) returned 1
	[0136.040] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5960fc40, ftCreationTime.dwHighDateTime=0x1d4ca36, ftLastAccessTime.dwLowDateTime=0x7647d50, ftLastAccessTime.dwHighDateTime=0x1d4cdc3, ftLastWriteTime.dwLowDateTime=0x7647d50, ftLastWriteTime.dwHighDateTime=0x1d4cdc3, nFileSizeHigh=0x0, nFileSizeLow=0x8268, dwReserved0=0x0, dwReserved1=0x0, cFileName="RrDfrHCvzDii-X.flv", cAlternateFileName="RRDFRH~1.FLV")) returned 1
	[0136.040] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.040] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="RrDfrHCvzDii-X.flv") returned -1
	[0136.040] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="RrDfrHCvzDii-X.flv") returned -1
	[0136.040] lstrcmpiA (lpString1="", lpString2="RrDfrHCvzDii-X.flv") returned -1
	[0136.040] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\LjBiz.mkv") returned="LjBiz.mkv"
	[0136.040] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Videos\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\"
	[0136.040] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Videos\\" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\") returned=""
	[0136.040] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Videos\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.040] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Videos\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\videos\\how-to-decrypt-files.htm")) returned 0x20
	[0136.040] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="RrDfrHCvzDii-X.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv") returned="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv"
	[0136.040] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv", pszSpec="*.zip") returned 0
	[0136.040] lstrlenA (lpString="*.zip") returned 5
	[0136.040] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv", pszSpec="*.rar") returned 0
	[0136.040] lstrlenA (lpString="*.rar") returned 5
	[0136.040] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv", pszSpec="*.7z") returned 0
	[0136.040] lstrlenA (lpString="*.7z") returned 4
	[0136.040] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv", pszSpec="*.tar") returned 0
	[0136.040] lstrlenA (lpString="*.tar") returned 5
	[0136.040] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv", pszSpec="*.gzip") returned 0
	[0136.041] lstrlenA (lpString="*.gzip") returned 6
	[0136.041] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv", pszSpec="*.jpg") returned 0
	[0136.041] lstrlenA (lpString="*.jpg") returned 5
	[0136.041] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv", pszSpec="*.jpeg") returned 0
	[0136.041] lstrlenA (lpString="*.jpeg") returned 6
	[0136.041] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv", pszSpec="*.bmp") returned 0
	[0136.041] lstrlenA (lpString="*.bmp") returned 5
	[0136.041] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv", pszSpec="*.gif") returned 0
	[0136.041] lstrlenA (lpString="*.gif") returned 5
	[0136.041] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv", pszSpec="*.png") returned 0
	[0136.041] lstrlenA (lpString="*.png") returned 5
	[0136.041] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv", pszSpec="*.doc") returned 0
	[0136.041] lstrlenA (lpString="*.doc") returned 5
	[0136.041] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv", pszSpec="*.docx") returned 0
	[0136.041] lstrlenA (lpString="*.docx") returned 6
	[0136.041] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv", pszSpec="*.xls") returned 0
	[0136.041] lstrlenA (lpString="*.xls") returned 5
	[0136.041] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv", pszSpec="*.xlsx") returned 0
	[0136.041] lstrlenA (lpString="*.xlsx") returned 6
	[0136.041] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv", pszSpec="*.ppt") returned 0
	[0136.041] lstrlenA (lpString="*.ppt") returned 5
	[0136.041] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv", pszSpec="*.pptx") returned 0
	[0136.041] lstrlenA (lpString="*.pptx") returned 6
	[0136.041] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv", pszSpec="*.txt") returned 0
	[0136.041] lstrlenA (lpString="*.txt") returned 5
	[0136.041] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv", pszSpec="*.pdf") returned 0
	[0136.041] lstrlenA (lpString="*.pdf") returned 5
	[0136.041] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv", pszSpec="*.htm") returned 0
	[0136.041] lstrlenA (lpString="*.htm") returned 5
	[0136.041] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv", pszSpec="*.html") returned 0
	[0136.041] lstrlenA (lpString="*.html") returned 6
	[0136.041] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv", pszSpec="*.mdb") returned 0
	[0136.041] lstrlenA (lpString="*.mdb") returned 5
	[0136.041] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv", pszSpec="*.pfx") returned 0
	[0136.042] lstrlenA (lpString="*.pfx") returned 5
	[0136.042] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv", pszSpec="*.md") returned 0
	[0136.042] lstrlenA (lpString="*.md") returned 4
	[0136.042] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv", pszSpec="*.lnk") returned 0
	[0136.042] lstrlenA (lpString="*.lnk") returned 5
	[0136.042] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv", pszSpec="*.torrent") returned 0
	[0136.042] lstrlenA (lpString="*.torrent") returned 9
	[0136.042] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv", pszSpec="*.mov") returned 0
	[0136.042] lstrlenA (lpString="*.mov") returned 5
	[0136.042] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv", pszSpec="*.3gp") returned 0
	[0136.042] lstrlenA (lpString="*.3gp") returned 5
	[0136.042] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv", pszSpec="*.mpeg") returned 0
	[0136.042] lstrlenA (lpString="*.mpeg") returned 6
	[0136.042] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv", pszSpec="*.mpg") returned 0
	[0136.042] lstrlenA (lpString="*.mpg") returned 5
	[0136.042] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv", pszSpec="*.flv") returned 1
	[0136.042] lstrlenA (lpString="*.flv") returned 5
	[0136.042] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv") returned="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv"
	[0136.042] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv") returned="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv"
	[0136.042] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv.") returned="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv."
	[0136.042] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv.exe") returned="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv.exe"
	[0136.042] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv" (normalized: "c:\\users\\fd1hvy\\videos\\rrdfrhcvzdii-x.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0136.042] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8268
	[0136.043] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5960fc40, dwHighDateTime=0x1d4ca36), lpLastAccessTime=0x407536*(dwLowDateTime=0x7647d50, dwHighDateTime=0x1d4cdc3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7647d50, dwHighDateTime=0x1d4cdc3)) returned 1
	[0136.043] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0136.043] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x8226, lpOverlapped=0x0) returned 1
	[0136.044] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv") returned="RrDfrHCvzDii-X.flv"
	[0136.044] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0136.044] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x8226, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x8226, lpOverlapped=0x0) returned 1
	[0136.044] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0136.044] CloseHandle (hObject=0x20c) returned 1
	[0136.044] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv" (normalized: "c:\\users\\fd1hvy\\videos\\rrdfrhcvzdii-x.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv.exe" (normalized: "c:\\users\\fd1hvy\\videos\\rrdfrhcvzdii-x.flv.exe")) returned 1
	[0136.045] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91025660, ftCreationTime.dwHighDateTime=0x1d4d54b, ftLastAccessTime.dwLowDateTime=0x83379590, ftLastAccessTime.dwHighDateTime=0x1d4c731, ftLastWriteTime.dwLowDateTime=0x83379590, ftLastWriteTime.dwHighDateTime=0x1d4c731, nFileSizeHigh=0x0, nFileSizeLow=0x52d3, dwReserved0=0x15, dwReserved1=0x1, cFileName="vwE7_oUr07lTo8dTGjIH.avi", cAlternateFileName="VWE7_O~1.AVI")) returned 1
	[0136.045] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.045] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="vwE7_oUr07lTo8dTGjIH.avi") returned -1
	[0136.045] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="vwE7_oUr07lTo8dTGjIH.avi") returned -1
	[0136.045] lstrcmpiA (lpString1="", lpString2="vwE7_oUr07lTo8dTGjIH.avi") returned -1
	[0136.045] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\RrDfrHCvzDii-X.flv") returned="RrDfrHCvzDii-X.flv"
	[0136.045] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Videos\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\"
	[0136.045] PathAddBackslashA (in: pszPath="C:\\Users\\FD1HVy\\Videos\\" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\") returned=""
	[0136.045] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\FD1HVy\\Videos\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.045] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\Videos\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\fd1hvy\\videos\\how-to-decrypt-files.htm")) returned 0x20
	[0136.045] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="vwE7_oUr07lTo8dTGjIH.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi") returned="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi"
	[0136.045] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi", pszSpec="*.zip") returned 0
	[0136.045] lstrlenA (lpString="*.zip") returned 5
	[0136.045] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi", pszSpec="*.rar") returned 0
	[0136.045] lstrlenA (lpString="*.rar") returned 5
	[0136.045] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi", pszSpec="*.7z") returned 0
	[0136.045] lstrlenA (lpString="*.7z") returned 4
	[0136.045] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi", pszSpec="*.tar") returned 0
	[0136.045] lstrlenA (lpString="*.tar") returned 5
	[0136.045] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi", pszSpec="*.gzip") returned 0
	[0136.045] lstrlenA (lpString="*.gzip") returned 6
	[0136.045] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi", pszSpec="*.jpg") returned 0
	[0136.045] lstrlenA (lpString="*.jpg") returned 5
	[0136.045] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi", pszSpec="*.jpeg") returned 0
	[0136.045] lstrlenA (lpString="*.jpeg") returned 6
	[0136.046] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi", pszSpec="*.bmp") returned 0
	[0136.046] lstrlenA (lpString="*.bmp") returned 5
	[0136.046] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi", pszSpec="*.gif") returned 0
	[0136.046] lstrlenA (lpString="*.gif") returned 5
	[0136.046] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi", pszSpec="*.png") returned 0
	[0136.046] lstrlenA (lpString="*.png") returned 5
	[0136.046] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi", pszSpec="*.doc") returned 0
	[0136.046] lstrlenA (lpString="*.doc") returned 5
	[0136.046] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi", pszSpec="*.docx") returned 0
	[0136.046] lstrlenA (lpString="*.docx") returned 6
	[0136.046] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi", pszSpec="*.xls") returned 0
	[0136.046] lstrlenA (lpString="*.xls") returned 5
	[0136.046] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi", pszSpec="*.xlsx") returned 0
	[0136.046] lstrlenA (lpString="*.xlsx") returned 6
	[0136.046] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi", pszSpec="*.ppt") returned 0
	[0136.046] lstrlenA (lpString="*.ppt") returned 5
	[0136.046] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi", pszSpec="*.pptx") returned 0
	[0136.046] lstrlenA (lpString="*.pptx") returned 6
	[0136.046] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi", pszSpec="*.txt") returned 0
	[0136.046] lstrlenA (lpString="*.txt") returned 5
	[0136.046] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi", pszSpec="*.pdf") returned 0
	[0136.046] lstrlenA (lpString="*.pdf") returned 5
	[0136.046] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi", pszSpec="*.htm") returned 0
	[0136.046] lstrlenA (lpString="*.htm") returned 5
	[0136.046] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi", pszSpec="*.html") returned 0
	[0136.046] lstrlenA (lpString="*.html") returned 6
	[0136.046] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi", pszSpec="*.mdb") returned 0
	[0136.046] lstrlenA (lpString="*.mdb") returned 5
	[0136.046] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi", pszSpec="*.pfx") returned 0
	[0136.046] lstrlenA (lpString="*.pfx") returned 5
	[0136.046] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi", pszSpec="*.md") returned 0
	[0136.046] lstrlenA (lpString="*.md") returned 4
	[0136.047] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi", pszSpec="*.lnk") returned 0
	[0136.047] lstrlenA (lpString="*.lnk") returned 5
	[0136.047] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi", pszSpec="*.torrent") returned 0
	[0136.047] lstrlenA (lpString="*.torrent") returned 9
	[0136.047] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi", pszSpec="*.mov") returned 0
	[0136.047] lstrlenA (lpString="*.mov") returned 5
	[0136.047] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi", pszSpec="*.3gp") returned 0
	[0136.047] lstrlenA (lpString="*.3gp") returned 5
	[0136.047] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi", pszSpec="*.mpeg") returned 0
	[0136.047] lstrlenA (lpString="*.mpeg") returned 6
	[0136.047] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi", pszSpec="*.mpg") returned 0
	[0136.047] lstrlenA (lpString="*.mpg") returned 5
	[0136.047] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi", pszSpec="*.flv") returned 0
	[0136.047] lstrlenA (lpString="*.flv") returned 5
	[0136.047] PathMatchSpecA (pszFile="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi", pszSpec="*.avi") returned 1
	[0136.047] lstrlenA (lpString="*.avi") returned 5
	[0136.047] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi") returned="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi"
	[0136.047] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi") returned="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi"
	[0136.047] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi", lpString2="." | out: lpString1="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi.") returned="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi."
	[0136.047] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi.", lpString2="exe" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi.exe") returned="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi.exe"
	[0136.047] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi" (normalized: "c:\\users\\fd1hvy\\videos\\vwe7_our07lto8dtgjih.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0136.047] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x52d3
	[0136.047] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x91025660, dwHighDateTime=0x1d4d54b), lpLastAccessTime=0x407536*(dwLowDateTime=0x83379590, dwHighDateTime=0x1d4c731), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83379590, dwHighDateTime=0x1d4c731)) returned 1
	[0136.048] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0136.048] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x5291, lpOverlapped=0x0) returned 1
	[0136.048] PathFindFileNameA (pszPath="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi") returned="vwE7_oUr07lTo8dTGjIH.avi"
	[0136.049] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0136.049] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x5291, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x5291, lpOverlapped=0x0) returned 1
	[0136.049] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0136.049] CloseHandle (hObject=0x20c) returned 1
	[0136.049] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi" (normalized: "c:\\users\\fd1hvy\\videos\\vwe7_our07lto8dtgjih.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\vwE7_oUr07lTo8dTGjIH.avi.exe" (normalized: "c:\\users\\fd1hvy\\videos\\vwe7_our07lto8dtgjih.avi.exe")) returned 1
	[0136.050] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91025660, ftCreationTime.dwHighDateTime=0x1d4d54b, ftLastAccessTime.dwLowDateTime=0x83379590, ftLastAccessTime.dwHighDateTime=0x1d4c731, ftLastWriteTime.dwLowDateTime=0x83379590, ftLastWriteTime.dwHighDateTime=0x1d4c731, nFileSizeHigh=0x0, nFileSizeLow=0x52d3, dwReserved0=0x15, dwReserved1=0x1, cFileName="vwE7_oUr07lTo8dTGjIH.avi", cAlternateFileName="VWE7_O~1.AVI")) returned 0
	[0136.050] FindClose (in: hFindFile=0x7cbad0 | out: hFindFile=0x7cbad0) returned 1
	[0136.050] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x118995f2, ftLastAccessTime.dwHighDateTime=0x1d543d9, ftLastWriteTime.dwLowDateTime=0x118995f2, ftLastWriteTime.dwHighDateTime=0x1d543d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0
	[0136.050] FindClose (in: hFindFile=0x7cb590 | out: hFindFile=0x7cb590) returned 1
	[0136.050] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3030312d, dwReserved1=0x2e2d7d30, cFileName="Public", cAlternateFileName="")) returned 1
	[0136.050] lstrcmpA (lpString1=".", lpString2="Public") returned -1
	[0136.050] lstrcmpA (lpString1="..", lpString2="Public") returned -1
	[0136.050] PathFindFileNameA (pszPath="C:\\Users\\*.*") returned="*.*"
	[0136.050] lstrcatA (in: lpString1="C:\\Users\\", lpString2="Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public"
	[0136.050] lstrlenA (lpString="C:\\Users\\Public") returned 15
	[0136.050] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0260, dwReserved1=0x1000000, cFileName=".", cAlternateFileName="")) returned 0x7cb9d0
	[0136.050] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.050] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0260, dwReserved1=0x1000000, cFileName="..", cAlternateFileName="")) returned 1
	[0136.050] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.050] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.050] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0260, dwReserved1=0x1000000, cFileName="AccountPictures", cAlternateFileName="ACCOUN~1")) returned 1
	[0136.050] lstrcmpA (lpString1=".", lpString2="AccountPictures") returned -1
	[0136.050] lstrcmpA (lpString1="..", lpString2="AccountPictures") returned -1
	[0136.050] PathFindFileNameA (pszPath="C:\\Users\\Public\\*.*") returned="*.*"
	[0136.050] lstrcatA (in: lpString1="C:\\Users\\Public\\", lpString2="AccountPictures" | out: lpString1="C:\\Users\\Public\\AccountPictures") returned="C:\\Users\\Public\\AccountPictures"
	[0136.050] lstrlenA (lpString="C:\\Users\\Public\\AccountPictures") returned 31
	[0136.050] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\AccountPictures\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cb750
	[0136.051] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.051] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0136.051] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.051] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.051] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xce317778, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0136.051] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.051] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="desktop.ini") returned 1
	[0136.051] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="desktop.ini") returned 1
	[0136.051] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1
	[0136.051] PathFindFileNameA (pszPath="C:\\Users\\Public\\AccountPictures\\*.*") returned="*.*"
	[0136.051] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\Public\\AccountPictures\\" | out: lpString1="C:\\Users\\Public\\AccountPictures\\") returned="C:\\Users\\Public\\AccountPictures\\"
	[0136.051] PathAddBackslashA (in: pszPath="C:\\Users\\Public\\AccountPictures\\" | out: pszPath="C:\\Users\\Public\\AccountPictures\\") returned=""
	[0136.051] lstrcatA (in: lpString1="C:\\Users\\Public\\AccountPictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\Public\\AccountPictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\Public\\AccountPictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.051] GetFileAttributesA (lpFileName="C:\\Users\\Public\\AccountPictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\public\\accountpictures\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.051] CreateFileA (lpFileName="C:\\Users\\Public\\AccountPictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\public\\accountpictures\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0136.052] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0136.052] WriteFile (in: hFile=0x20c, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0136.053] SetFileTime (hFile=0x20c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.053] CloseHandle (hObject=0x20c) returned 1
	[0136.053] lstrcatA (in: lpString1="C:\\Users\\Public\\AccountPictures\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\Public\\AccountPictures\\desktop.ini") returned="C:\\Users\\Public\\AccountPictures\\desktop.ini"
	[0136.053] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.zip") returned 0
	[0136.053] lstrlenA (lpString="*.zip") returned 5
	[0136.053] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.rar") returned 0
	[0136.053] lstrlenA (lpString="*.rar") returned 5
	[0136.053] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.7z") returned 0
	[0136.053] lstrlenA (lpString="*.7z") returned 4
	[0136.053] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.tar") returned 0
	[0136.053] lstrlenA (lpString="*.tar") returned 5
	[0136.053] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.gzip") returned 0
	[0136.053] lstrlenA (lpString="*.gzip") returned 6
	[0136.053] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.jpg") returned 0
	[0136.053] lstrlenA (lpString="*.jpg") returned 5
	[0136.053] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.jpeg") returned 0
	[0136.053] lstrlenA (lpString="*.jpeg") returned 6
	[0136.053] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.bmp") returned 0
	[0136.053] lstrlenA (lpString="*.bmp") returned 5
	[0136.053] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.gif") returned 0
	[0136.053] lstrlenA (lpString="*.gif") returned 5
	[0136.053] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.png") returned 0
	[0136.053] lstrlenA (lpString="*.png") returned 5
	[0136.053] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.doc") returned 0
	[0136.053] lstrlenA (lpString="*.doc") returned 5
	[0136.053] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.docx") returned 0
	[0136.054] lstrlenA (lpString="*.docx") returned 6
	[0136.054] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.xls") returned 0
	[0136.054] lstrlenA (lpString="*.xls") returned 5
	[0136.054] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.xlsx") returned 0
	[0136.054] lstrlenA (lpString="*.xlsx") returned 6
	[0136.054] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.ppt") returned 0
	[0136.054] lstrlenA (lpString="*.ppt") returned 5
	[0136.054] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.pptx") returned 0
	[0136.054] lstrlenA (lpString="*.pptx") returned 6
	[0136.054] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.txt") returned 0
	[0136.054] lstrlenA (lpString="*.txt") returned 5
	[0136.054] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.pdf") returned 0
	[0136.054] lstrlenA (lpString="*.pdf") returned 5
	[0136.054] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.htm") returned 0
	[0136.054] lstrlenA (lpString="*.htm") returned 5
	[0136.054] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.html") returned 0
	[0136.054] lstrlenA (lpString="*.html") returned 6
	[0136.054] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.mdb") returned 0
	[0136.054] lstrlenA (lpString="*.mdb") returned 5
	[0136.054] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.pfx") returned 0
	[0136.054] lstrlenA (lpString="*.pfx") returned 5
	[0136.054] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.md") returned 0
	[0136.054] lstrlenA (lpString="*.md") returned 4
	[0136.054] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.lnk") returned 0
	[0136.054] lstrlenA (lpString="*.lnk") returned 5
	[0136.054] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.torrent") returned 0
	[0136.054] lstrlenA (lpString="*.torrent") returned 9
	[0136.055] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.mov") returned 0
	[0136.055] lstrlenA (lpString="*.mov") returned 5
	[0136.055] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.3gp") returned 0
	[0136.055] lstrlenA (lpString="*.3gp") returned 5
	[0136.055] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.mpeg") returned 0
	[0136.055] lstrlenA (lpString="*.mpeg") returned 6
	[0136.055] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.mpg") returned 0
	[0136.055] lstrlenA (lpString="*.mpg") returned 5
	[0136.055] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.flv") returned 0
	[0136.055] lstrlenA (lpString="*.flv") returned 5
	[0136.055] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.avi") returned 0
	[0136.055] lstrlenA (lpString="*.avi") returned 5
	[0136.055] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.mp4") returned 0
	[0136.055] lstrlenA (lpString="*.mp4") returned 5
	[0136.055] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.wmv") returned 0
	[0136.055] lstrlenA (lpString="*.wmv") returned 5
	[0136.055] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.mkv") returned 0
	[0136.055] lstrlenA (lpString="*.mkv") returned 5
	[0136.055] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.mp3") returned 0
	[0136.055] lstrlenA (lpString="*.mp3") returned 5
	[0136.055] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.wav") returned 0
	[0136.055] lstrlenA (lpString="*.wav") returned 5
	[0136.055] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.flac") returned 0
	[0136.055] lstrlenA (lpString="*.flac") returned 6
	[0136.055] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.wma") returned 0
	[0136.055] lstrlenA (lpString="*.wma") returned 5
	[0136.055] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.au3") returned 0
	[0136.055] lstrlenA (lpString="*.au3") returned 5
	[0136.055] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.ahk") returned 0
	[0136.055] lstrlenA (lpString="*.ahk") returned 5
	[0136.055] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.c") returned 0
	[0136.055] lstrlenA (lpString="*.c") returned 3
	[0136.055] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.cc") returned 0
	[0136.055] lstrlenA (lpString="*.cc") returned 4
	[0136.056] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.cpp") returned 0
	[0136.056] lstrlenA (lpString="*.cpp") returned 5
	[0136.056] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.cxx") returned 0
	[0136.056] lstrlenA (lpString="*.cxx") returned 5
	[0136.056] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.c++") returned 0
	[0136.056] lstrlenA (lpString="*.c++") returned 5
	[0136.056] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.cs") returned 0
	[0136.056] lstrlenA (lpString="*.cs") returned 4
	[0136.056] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.vb") returned 0
	[0136.056] lstrlenA (lpString="*.vb") returned 4
	[0136.056] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.bas") returned 0
	[0136.056] lstrlenA (lpString="*.bas") returned 5
	[0136.056] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.csproj") returned 0
	[0136.056] lstrlenA (lpString="*.csproj") returned 8
	[0136.056] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.vbproj") returned 0
	[0136.056] lstrlenA (lpString="*.vbproj") returned 8
	[0136.056] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.vcxproj") returned 0
	[0136.056] lstrlenA (lpString="*.vcxproj") returned 9
	[0136.056] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.manifest") returned 0
	[0136.056] lstrlenA (lpString="*.manifest") returned 10
	[0136.056] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.php") returned 0
	[0136.056] lstrlenA (lpString="*.php") returned 5
	[0136.056] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.vbe") returned 0
	[0136.056] lstrlenA (lpString="*.vbe") returned 5
	[0136.056] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.vba") returned 0
	[0136.056] lstrlenA (lpString="*.vba") returned 5
	[0136.056] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.vbs") returned 0
	[0136.056] lstrlenA (lpString="*.vbs") returned 5
	[0136.056] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.bat") returned 0
	[0136.056] lstrlenA (lpString="*.bat") returned 5
	[0136.056] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.cmd") returned 0
	[0136.056] lstrlenA (lpString="*.cmd") returned 5
	[0136.056] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.js") returned 0
	[0136.056] lstrlenA (lpString="*.js") returned 4
	[0136.057] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.jscript") returned 0
	[0136.057] lstrlenA (lpString="*.jscript") returned 9
	[0136.057] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.hta") returned 0
	[0136.057] lstrlenA (lpString="*.hta") returned 5
	[0136.057] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.php7") returned 0
	[0136.057] lstrlenA (lpString="*.php7") returned 6
	[0136.057] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.db") returned 0
	[0136.057] lstrlenA (lpString="*.db") returned 4
	[0136.057] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.swf") returned 0
	[0136.057] lstrlenA (lpString="*.swf") returned 5
	[0136.057] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.eml") returned 0
	[0136.057] lstrlenA (lpString="*.eml") returned 5
	[0136.057] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.part") returned 0
	[0136.057] lstrlenA (lpString="*.part") returned 6
	[0136.057] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.nfo") returned 0
	[0136.057] lstrlenA (lpString="*.nfo") returned 5
	[0136.057] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.rsa") returned 0
	[0136.057] lstrlenA (lpString="*.rsa") returned 5
	[0136.057] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.key") returned 0
	[0136.057] lstrlenA (lpString="*.key") returned 5
	[0136.057] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.aes") returned 0
	[0136.057] lstrlenA (lpString="*.aes") returned 5
	[0136.057] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.blob") returned 0
	[0136.057] lstrlenA (lpString="*.blob") returned 6
	[0136.057] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.btc") returned 0
	[0136.057] lstrlenA (lpString="*.btc") returned 5
	[0136.057] PathMatchSpecA (pszFile="C:\\Users\\Public\\AccountPictures\\desktop.ini", pszSpec="*.wallet") returned 0
	[0136.057] lstrlenA (lpString="*.wallet") returned 8
	[0136.057] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xce317778, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0136.057] FindClose (in: hFindFile=0x7cb750 | out: hFindFile=0x7cb750) returned 1
	[0136.058] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c3ce2c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1
	[0136.058] lstrcmpA (lpString1=".", lpString2="Desktop") returned -1
	[0136.058] lstrcmpA (lpString1="..", lpString2="Desktop") returned -1
	[0136.058] PathFindFileNameA (pszPath="C:\\Users\\Public\\*.*") returned="*.*"
	[0136.058] lstrcatA (in: lpString1="C:\\Users\\Public\\", lpString2="Desktop" | out: lpString1="C:\\Users\\Public\\Desktop") returned="C:\\Users\\Public\\Desktop"
	[0136.058] lstrlenA (lpString="C:\\Users\\Public\\Desktop") returned 23
	[0136.058] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Desktop\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c3ce2c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb750
	[0136.058] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.058] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c3ce2c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.058] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.058] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.058] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38bb5c78, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38bb5c78, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x38bb5c78, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x852, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat Reader DC.lnk", cAlternateFileName="ACROBA~1.LNK")) returned 1
	[0136.058] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.058] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Acrobat Reader DC.lnk") returned 1
	[0136.058] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Acrobat Reader DC.lnk") returned 1
	[0136.058] lstrcmpiA (lpString1="", lpString2="Acrobat Reader DC.lnk") returned -1
	[0136.058] PathFindFileNameA (pszPath="C:\\Users\\Public\\Desktop\\*.*") returned="*.*"
	[0136.058] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\Public\\Desktop\\" | out: lpString1="C:\\Users\\Public\\Desktop\\") returned="C:\\Users\\Public\\Desktop\\"
	[0136.058] PathAddBackslashA (in: pszPath="C:\\Users\\Public\\Desktop\\" | out: pszPath="C:\\Users\\Public\\Desktop\\") returned=""
	[0136.058] lstrcatA (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\Public\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\Public\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.058] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\public\\desktop\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.058] CreateFileA (lpFileName="C:\\Users\\Public\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\public\\desktop\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0136.059] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0136.059] WriteFile (in: hFile=0x20c, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0136.060] SetFileTime (hFile=0x20c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.060] CloseHandle (hObject=0x20c) returned 1
	[0136.060] lstrcatA (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="Acrobat Reader DC.lnk" | out: lpString1="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk") returned="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk"
	[0136.060] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", pszSpec="*.zip") returned 0
	[0136.060] lstrlenA (lpString="*.zip") returned 5
	[0136.060] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", pszSpec="*.rar") returned 0
	[0136.061] lstrlenA (lpString="*.rar") returned 5
	[0136.061] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", pszSpec="*.7z") returned 0
	[0136.061] lstrlenA (lpString="*.7z") returned 4
	[0136.061] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", pszSpec="*.tar") returned 0
	[0136.061] lstrlenA (lpString="*.tar") returned 5
	[0136.061] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", pszSpec="*.gzip") returned 0
	[0136.061] lstrlenA (lpString="*.gzip") returned 6
	[0136.061] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", pszSpec="*.jpg") returned 0
	[0136.061] lstrlenA (lpString="*.jpg") returned 5
	[0136.061] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", pszSpec="*.jpeg") returned 0
	[0136.061] lstrlenA (lpString="*.jpeg") returned 6
	[0136.061] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", pszSpec="*.bmp") returned 0
	[0136.061] lstrlenA (lpString="*.bmp") returned 5
	[0136.061] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", pszSpec="*.gif") returned 0
	[0136.061] lstrlenA (lpString="*.gif") returned 5
	[0136.061] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", pszSpec="*.png") returned 0
	[0136.061] lstrlenA (lpString="*.png") returned 5
	[0136.061] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", pszSpec="*.doc") returned 0
	[0136.061] lstrlenA (lpString="*.doc") returned 5
	[0136.061] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", pszSpec="*.docx") returned 0
	[0136.061] lstrlenA (lpString="*.docx") returned 6
	[0136.061] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", pszSpec="*.xls") returned 0
	[0136.061] lstrlenA (lpString="*.xls") returned 5
	[0136.061] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", pszSpec="*.xlsx") returned 0
	[0136.061] lstrlenA (lpString="*.xlsx") returned 6
	[0136.061] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", pszSpec="*.ppt") returned 0
	[0136.061] lstrlenA (lpString="*.ppt") returned 5
	[0136.061] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", pszSpec="*.pptx") returned 0
	[0136.061] lstrlenA (lpString="*.pptx") returned 6
	[0136.061] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", pszSpec="*.txt") returned 0
	[0136.061] lstrlenA (lpString="*.txt") returned 5
	[0136.061] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", pszSpec="*.pdf") returned 0
	[0136.061] lstrlenA (lpString="*.pdf") returned 5
	[0136.061] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", pszSpec="*.htm") returned 0
	[0136.062] lstrlenA (lpString="*.htm") returned 5
	[0136.062] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", pszSpec="*.html") returned 0
	[0136.062] lstrlenA (lpString="*.html") returned 6
	[0136.062] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", pszSpec="*.mdb") returned 0
	[0136.062] lstrlenA (lpString="*.mdb") returned 5
	[0136.062] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", pszSpec="*.pfx") returned 0
	[0136.062] lstrlenA (lpString="*.pfx") returned 5
	[0136.062] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", pszSpec="*.md") returned 0
	[0136.062] lstrlenA (lpString="*.md") returned 4
	[0136.062] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", pszSpec="*.lnk") returned 1
	[0136.062] lstrlenA (lpString="*.lnk") returned 5
	[0136.062] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" | out: lpString1="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk") returned="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk"
	[0136.062] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" | out: lpString1="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk") returned="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk"
	[0136.062] lstrcatA (in: lpString1="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", lpString2="." | out: lpString1="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk.") returned="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk."
	[0136.062] lstrcatA (in: lpString1="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk.exe") returned="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk.exe"
	[0136.062] CreateFileA (lpFileName="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" (normalized: "c:\\users\\public\\desktop\\acrobat reader dc.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0136.062] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x852
	[0136.062] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x38bb5c78, dwHighDateTime=0x1d327c9), lpLastAccessTime=0x407536*(dwLowDateTime=0x38bb5c78, dwHighDateTime=0x1d327c9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x38bb5c78, dwHighDateTime=0x1d327c9)) returned 1
	[0136.062] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0136.062] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x810, lpOverlapped=0x0) returned 1
	[0136.063] PathFindFileNameA (pszPath="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk") returned="Acrobat Reader DC.lnk"
	[0136.063] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0136.063] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x810, lpOverlapped=0x0) returned 1
	[0136.063] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0136.064] CloseHandle (hObject=0x20c) returned 1
	[0136.064] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" (normalized: "c:\\users\\public\\desktop\\acrobat reader dc.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk.exe" (normalized: "c:\\users\\public\\desktop\\acrobat reader dc.lnk.exe")) returned 1
	[0136.064] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x1, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0136.064] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.064] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="desktop.ini") returned 1
	[0136.064] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="desktop.ini") returned 1
	[0136.064] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1
	[0136.064] PathFindFileNameA (pszPath="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk") returned="Acrobat Reader DC.lnk"
	[0136.064] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\Public\\Desktop\\" | out: lpString1="C:\\Users\\Public\\Desktop\\") returned="C:\\Users\\Public\\Desktop\\"
	[0136.064] PathAddBackslashA (in: pszPath="C:\\Users\\Public\\Desktop\\" | out: pszPath="C:\\Users\\Public\\Desktop\\") returned=""
	[0136.064] lstrcatA (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\Public\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\Public\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.064] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\public\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0136.065] lstrcatA (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\Public\\Desktop\\desktop.ini") returned="C:\\Users\\Public\\Desktop\\desktop.ini"
	[0136.065] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.zip") returned 0
	[0136.065] lstrlenA (lpString="*.zip") returned 5
	[0136.065] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.rar") returned 0
	[0136.065] lstrlenA (lpString="*.rar") returned 5
	[0136.065] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.7z") returned 0
	[0136.065] lstrlenA (lpString="*.7z") returned 4
	[0136.065] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.tar") returned 0
	[0136.065] lstrlenA (lpString="*.tar") returned 5
	[0136.065] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.gzip") returned 0
	[0136.065] lstrlenA (lpString="*.gzip") returned 6
	[0136.065] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.jpg") returned 0
	[0136.065] lstrlenA (lpString="*.jpg") returned 5
	[0136.065] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.jpeg") returned 0
	[0136.065] lstrlenA (lpString="*.jpeg") returned 6
	[0136.065] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.bmp") returned 0
	[0136.065] lstrlenA (lpString="*.bmp") returned 5
	[0136.065] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.gif") returned 0
	[0136.065] lstrlenA (lpString="*.gif") returned 5
	[0136.065] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.png") returned 0
	[0136.065] lstrlenA (lpString="*.png") returned 5
	[0136.065] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.doc") returned 0
	[0136.065] lstrlenA (lpString="*.doc") returned 5
	[0136.065] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.docx") returned 0
	[0136.065] lstrlenA (lpString="*.docx") returned 6
	[0136.065] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.xls") returned 0
	[0136.065] lstrlenA (lpString="*.xls") returned 5
	[0136.065] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.xlsx") returned 0
	[0136.065] lstrlenA (lpString="*.xlsx") returned 6
	[0136.065] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.ppt") returned 0
	[0136.065] lstrlenA (lpString="*.ppt") returned 5
	[0136.065] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.pptx") returned 0
	[0136.065] lstrlenA (lpString="*.pptx") returned 6
	[0136.066] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.txt") returned 0
	[0136.066] lstrlenA (lpString="*.txt") returned 5
	[0136.066] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.pdf") returned 0
	[0136.066] lstrlenA (lpString="*.pdf") returned 5
	[0136.066] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.htm") returned 0
	[0136.066] lstrlenA (lpString="*.htm") returned 5
	[0136.066] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.html") returned 0
	[0136.066] lstrlenA (lpString="*.html") returned 6
	[0136.066] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.mdb") returned 0
	[0136.066] lstrlenA (lpString="*.mdb") returned 5
	[0136.066] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.pfx") returned 0
	[0136.066] lstrlenA (lpString="*.pfx") returned 5
	[0136.066] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.md") returned 0
	[0136.066] lstrlenA (lpString="*.md") returned 4
	[0136.066] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.lnk") returned 0
	[0136.066] lstrlenA (lpString="*.lnk") returned 5
	[0136.066] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.torrent") returned 0
	[0136.066] lstrlenA (lpString="*.torrent") returned 9
	[0136.066] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.mov") returned 0
	[0136.066] lstrlenA (lpString="*.mov") returned 5
	[0136.066] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.3gp") returned 0
	[0136.066] lstrlenA (lpString="*.3gp") returned 5
	[0136.066] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.mpeg") returned 0
	[0136.066] lstrlenA (lpString="*.mpeg") returned 6
	[0136.066] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.mpg") returned 0
	[0136.066] lstrlenA (lpString="*.mpg") returned 5
	[0136.066] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.flv") returned 0
	[0136.066] lstrlenA (lpString="*.flv") returned 5
	[0136.066] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.avi") returned 0
	[0136.066] lstrlenA (lpString="*.avi") returned 5
	[0136.066] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.mp4") returned 0
	[0136.066] lstrlenA (lpString="*.mp4") returned 5
	[0136.066] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.wmv") returned 0
	[0136.067] lstrlenA (lpString="*.wmv") returned 5
	[0136.067] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.mkv") returned 0
	[0136.067] lstrlenA (lpString="*.mkv") returned 5
	[0136.067] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.mp3") returned 0
	[0136.067] lstrlenA (lpString="*.mp3") returned 5
	[0136.067] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.wav") returned 0
	[0136.067] lstrlenA (lpString="*.wav") returned 5
	[0136.067] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.flac") returned 0
	[0136.067] lstrlenA (lpString="*.flac") returned 6
	[0136.067] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.wma") returned 0
	[0136.067] lstrlenA (lpString="*.wma") returned 5
	[0136.067] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.au3") returned 0
	[0136.067] lstrlenA (lpString="*.au3") returned 5
	[0136.067] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.ahk") returned 0
	[0136.067] lstrlenA (lpString="*.ahk") returned 5
	[0136.067] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.c") returned 0
	[0136.067] lstrlenA (lpString="*.c") returned 3
	[0136.067] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.cc") returned 0
	[0136.067] lstrlenA (lpString="*.cc") returned 4
	[0136.067] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.cpp") returned 0
	[0136.067] lstrlenA (lpString="*.cpp") returned 5
	[0136.067] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.cxx") returned 0
	[0136.067] lstrlenA (lpString="*.cxx") returned 5
	[0136.067] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.c++") returned 0
	[0136.067] lstrlenA (lpString="*.c++") returned 5
	[0136.067] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.cs") returned 0
	[0136.067] lstrlenA (lpString="*.cs") returned 4
	[0136.067] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.vb") returned 0
	[0136.067] lstrlenA (lpString="*.vb") returned 4
	[0136.067] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.bas") returned 0
	[0136.067] lstrlenA (lpString="*.bas") returned 5
	[0136.067] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.csproj") returned 0
	[0136.067] lstrlenA (lpString="*.csproj") returned 8
	[0136.067] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.vbproj") returned 0
	[0136.067] lstrlenA (lpString="*.vbproj") returned 8
	[0136.068] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.vcxproj") returned 0
	[0136.068] lstrlenA (lpString="*.vcxproj") returned 9
	[0136.068] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.manifest") returned 0
	[0136.068] lstrlenA (lpString="*.manifest") returned 10
	[0136.068] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.php") returned 0
	[0136.068] lstrlenA (lpString="*.php") returned 5
	[0136.068] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.vbe") returned 0
	[0136.068] lstrlenA (lpString="*.vbe") returned 5
	[0136.068] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.vba") returned 0
	[0136.068] lstrlenA (lpString="*.vba") returned 5
	[0136.068] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.vbs") returned 0
	[0136.068] lstrlenA (lpString="*.vbs") returned 5
	[0136.068] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.bat") returned 0
	[0136.068] lstrlenA (lpString="*.bat") returned 5
	[0136.068] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.cmd") returned 0
	[0136.068] lstrlenA (lpString="*.cmd") returned 5
	[0136.068] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.js") returned 0
	[0136.068] lstrlenA (lpString="*.js") returned 4
	[0136.068] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.jscript") returned 0
	[0136.068] lstrlenA (lpString="*.jscript") returned 9
	[0136.068] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.hta") returned 0
	[0136.068] lstrlenA (lpString="*.hta") returned 5
	[0136.068] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.php7") returned 0
	[0136.068] lstrlenA (lpString="*.php7") returned 6
	[0136.068] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.db") returned 0
	[0136.068] lstrlenA (lpString="*.db") returned 4
	[0136.068] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.swf") returned 0
	[0136.068] lstrlenA (lpString="*.swf") returned 5
	[0136.068] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.eml") returned 0
	[0136.068] lstrlenA (lpString="*.eml") returned 5
	[0136.068] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.part") returned 0
	[0136.068] lstrlenA (lpString="*.part") returned 6
	[0136.068] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.nfo") returned 0
	[0136.068] lstrlenA (lpString="*.nfo") returned 5
	[0136.069] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.rsa") returned 0
	[0136.069] lstrlenA (lpString="*.rsa") returned 5
	[0136.069] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.key") returned 0
	[0136.069] lstrlenA (lpString="*.key") returned 5
	[0136.069] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.aes") returned 0
	[0136.069] lstrlenA (lpString="*.aes") returned 5
	[0136.069] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.blob") returned 0
	[0136.069] lstrlenA (lpString="*.blob") returned 6
	[0136.069] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.btc") returned 0
	[0136.069] lstrlenA (lpString="*.btc") returned 5
	[0136.069] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\desktop.ini", pszSpec="*.wallet") returned 0
	[0136.069] lstrlenA (lpString="*.wallet") returned 8
	[0136.069] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4c3ce2c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c6308a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x91a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1
	[0136.069] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.069] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Google Chrome.lnk") returned -1
	[0136.069] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Google Chrome.lnk") returned 1
	[0136.069] lstrcmpiA (lpString1="", lpString2="Google Chrome.lnk") returned -1
	[0136.069] PathFindFileNameA (pszPath="C:\\Users\\Public\\Desktop\\desktop.ini") returned="desktop.ini"
	[0136.069] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\Public\\Desktop\\" | out: lpString1="C:\\Users\\Public\\Desktop\\") returned="C:\\Users\\Public\\Desktop\\"
	[0136.069] PathAddBackslashA (in: pszPath="C:\\Users\\Public\\Desktop\\" | out: pszPath="C:\\Users\\Public\\Desktop\\") returned=""
	[0136.069] lstrcatA (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\Public\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\Public\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.069] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\public\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0136.069] lstrcatA (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="Google Chrome.lnk" | out: lpString1="C:\\Users\\Public\\Desktop\\Google Chrome.lnk") returned="C:\\Users\\Public\\Desktop\\Google Chrome.lnk"
	[0136.069] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", pszSpec="*.zip") returned 0
	[0136.069] lstrlenA (lpString="*.zip") returned 5
	[0136.069] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", pszSpec="*.rar") returned 0
	[0136.069] lstrlenA (lpString="*.rar") returned 5
	[0136.069] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", pszSpec="*.7z") returned 0
	[0136.069] lstrlenA (lpString="*.7z") returned 4
	[0136.069] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", pszSpec="*.tar") returned 0
	[0136.069] lstrlenA (lpString="*.tar") returned 5
	[0136.069] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", pszSpec="*.gzip") returned 0
	[0136.070] lstrlenA (lpString="*.gzip") returned 6
	[0136.070] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", pszSpec="*.jpg") returned 0
	[0136.070] lstrlenA (lpString="*.jpg") returned 5
	[0136.070] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", pszSpec="*.jpeg") returned 0
	[0136.070] lstrlenA (lpString="*.jpeg") returned 6
	[0136.070] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", pszSpec="*.bmp") returned 0
	[0136.070] lstrlenA (lpString="*.bmp") returned 5
	[0136.070] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", pszSpec="*.gif") returned 0
	[0136.070] lstrlenA (lpString="*.gif") returned 5
	[0136.070] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", pszSpec="*.png") returned 0
	[0136.070] lstrlenA (lpString="*.png") returned 5
	[0136.070] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", pszSpec="*.doc") returned 0
	[0136.070] lstrlenA (lpString="*.doc") returned 5
	[0136.070] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", pszSpec="*.docx") returned 0
	[0136.070] lstrlenA (lpString="*.docx") returned 6
	[0136.070] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", pszSpec="*.xls") returned 0
	[0136.070] lstrlenA (lpString="*.xls") returned 5
	[0136.070] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", pszSpec="*.xlsx") returned 0
	[0136.070] lstrlenA (lpString="*.xlsx") returned 6
	[0136.070] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", pszSpec="*.ppt") returned 0
	[0136.070] lstrlenA (lpString="*.ppt") returned 5
	[0136.070] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", pszSpec="*.pptx") returned 0
	[0136.070] lstrlenA (lpString="*.pptx") returned 6
	[0136.070] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", pszSpec="*.txt") returned 0
	[0136.070] lstrlenA (lpString="*.txt") returned 5
	[0136.071] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", pszSpec="*.pdf") returned 0
	[0136.071] lstrlenA (lpString="*.pdf") returned 5
	[0136.071] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", pszSpec="*.htm") returned 0
	[0136.071] lstrlenA (lpString="*.htm") returned 5
	[0136.071] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", pszSpec="*.html") returned 0
	[0136.071] lstrlenA (lpString="*.html") returned 6
	[0136.071] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", pszSpec="*.mdb") returned 0
	[0136.071] lstrlenA (lpString="*.mdb") returned 5
	[0136.071] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", pszSpec="*.pfx") returned 0
	[0136.071] lstrlenA (lpString="*.pfx") returned 5
	[0136.071] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", pszSpec="*.md") returned 0
	[0136.071] lstrlenA (lpString="*.md") returned 4
	[0136.071] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", pszSpec="*.lnk") returned 1
	[0136.071] lstrlenA (lpString="*.lnk") returned 5
	[0136.071] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" | out: lpString1="C:\\Users\\Public\\Desktop\\Google Chrome.lnk") returned="C:\\Users\\Public\\Desktop\\Google Chrome.lnk"
	[0136.071] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" | out: lpString1="C:\\Users\\Public\\Desktop\\Google Chrome.lnk") returned="C:\\Users\\Public\\Desktop\\Google Chrome.lnk"
	[0136.071] lstrcatA (in: lpString1="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", lpString2="." | out: lpString1="C:\\Users\\Public\\Desktop\\Google Chrome.lnk.") returned="C:\\Users\\Public\\Desktop\\Google Chrome.lnk."
	[0136.071] lstrcatA (in: lpString1="C:\\Users\\Public\\Desktop\\Google Chrome.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\Public\\Desktop\\Google Chrome.lnk.exe") returned="C:\\Users\\Public\\Desktop\\Google Chrome.lnk.exe"
	[0136.071] CreateFileA (lpFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0136.071] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x91a
	[0136.071] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe4c3ce2c, dwHighDateTime=0x1d327cb), lpLastAccessTime=0x407536*(dwLowDateTime=0xe4c3ce2c, dwHighDateTime=0x1d327cb), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe4c6308a, dwHighDateTime=0x1d327cb)) returned 1
	[0136.072] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0136.072] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x8d8, lpOverlapped=0x0) returned 1
	[0136.072] PathFindFileNameA (pszPath="C:\\Users\\Public\\Desktop\\Google Chrome.lnk") returned="Google Chrome.lnk"
	[0136.072] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0136.072] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x8d8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x8d8, lpOverlapped=0x0) returned 1
	[0136.073] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0136.073] CloseHandle (hObject=0x20c) returned 1
	[0136.073] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk.exe" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk.exe")) returned 1
	[0136.073] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef84fc3f, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef84fc3f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef84fc3f, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x3e7, dwReserved0=0x15, dwReserved1=0x1, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1
	[0136.073] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.073] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Mozilla Firefox.lnk") returned -1
	[0136.073] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Mozilla Firefox.lnk") returned -1
	[0136.073] lstrcmpiA (lpString1="", lpString2="Mozilla Firefox.lnk") returned -1
	[0136.073] PathFindFileNameA (pszPath="C:\\Users\\Public\\Desktop\\Google Chrome.lnk") returned="Google Chrome.lnk"
	[0136.073] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\Public\\Desktop\\" | out: lpString1="C:\\Users\\Public\\Desktop\\") returned="C:\\Users\\Public\\Desktop\\"
	[0136.074] PathAddBackslashA (in: pszPath="C:\\Users\\Public\\Desktop\\" | out: pszPath="C:\\Users\\Public\\Desktop\\") returned=""
	[0136.074] lstrcatA (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\Public\\Desktop\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\Public\\Desktop\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.074] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Desktop\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\public\\desktop\\how-to-decrypt-files.htm")) returned 0x20
	[0136.074] lstrcatA (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="Mozilla Firefox.lnk" | out: lpString1="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk") returned="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk"
	[0136.074] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", pszSpec="*.zip") returned 0
	[0136.074] lstrlenA (lpString="*.zip") returned 5
	[0136.074] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", pszSpec="*.rar") returned 0
	[0136.074] lstrlenA (lpString="*.rar") returned 5
	[0136.074] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", pszSpec="*.7z") returned 0
	[0136.074] lstrlenA (lpString="*.7z") returned 4
	[0136.074] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", pszSpec="*.tar") returned 0
	[0136.074] lstrlenA (lpString="*.tar") returned 5
	[0136.074] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", pszSpec="*.gzip") returned 0
	[0136.074] lstrlenA (lpString="*.gzip") returned 6
	[0136.074] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", pszSpec="*.jpg") returned 0
	[0136.074] lstrlenA (lpString="*.jpg") returned 5
	[0136.074] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", pszSpec="*.jpeg") returned 0
	[0136.074] lstrlenA (lpString="*.jpeg") returned 6
	[0136.074] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", pszSpec="*.bmp") returned 0
	[0136.074] lstrlenA (lpString="*.bmp") returned 5
	[0136.074] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", pszSpec="*.gif") returned 0
	[0136.074] lstrlenA (lpString="*.gif") returned 5
	[0136.074] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", pszSpec="*.png") returned 0
	[0136.074] lstrlenA (lpString="*.png") returned 5
	[0136.074] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", pszSpec="*.doc") returned 0
	[0136.074] lstrlenA (lpString="*.doc") returned 5
	[0136.074] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", pszSpec="*.docx") returned 0
	[0136.074] lstrlenA (lpString="*.docx") returned 6
	[0136.074] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", pszSpec="*.xls") returned 0
	[0136.074] lstrlenA (lpString="*.xls") returned 5
	[0136.074] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", pszSpec="*.xlsx") returned 0
	[0136.075] lstrlenA (lpString="*.xlsx") returned 6
	[0136.075] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", pszSpec="*.ppt") returned 0
	[0136.075] lstrlenA (lpString="*.ppt") returned 5
	[0136.075] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", pszSpec="*.pptx") returned 0
	[0136.075] lstrlenA (lpString="*.pptx") returned 6
	[0136.075] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", pszSpec="*.txt") returned 0
	[0136.075] lstrlenA (lpString="*.txt") returned 5
	[0136.075] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", pszSpec="*.pdf") returned 0
	[0136.075] lstrlenA (lpString="*.pdf") returned 5
	[0136.075] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", pszSpec="*.htm") returned 0
	[0136.075] lstrlenA (lpString="*.htm") returned 5
	[0136.075] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", pszSpec="*.html") returned 0
	[0136.075] lstrlenA (lpString="*.html") returned 6
	[0136.075] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", pszSpec="*.mdb") returned 0
	[0136.075] lstrlenA (lpString="*.mdb") returned 5
	[0136.075] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", pszSpec="*.pfx") returned 0
	[0136.075] lstrlenA (lpString="*.pfx") returned 5
	[0136.075] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", pszSpec="*.md") returned 0
	[0136.075] lstrlenA (lpString="*.md") returned 4
	[0136.075] PathMatchSpecA (pszFile="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", pszSpec="*.lnk") returned 1
	[0136.075] lstrlenA (lpString="*.lnk") returned 5
	[0136.075] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" | out: lpString1="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk") returned="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk"
	[0136.075] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" | out: lpString1="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk") returned="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk"
	[0136.075] lstrcatA (in: lpString1="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", lpString2="." | out: lpString1="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk.") returned="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk."
	[0136.075] lstrcatA (in: lpString1="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk.", lpString2="exe" | out: lpString1="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk.exe") returned="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk.exe"
	[0136.075] CreateFileA (lpFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0136.076] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e7
	[0136.076] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xef84fc3f, dwHighDateTime=0x1d327c9), lpLastAccessTime=0x407536*(dwLowDateTime=0xef84fc3f, dwHighDateTime=0x1d327c9), lpLastWriteTime=0x40753e*(dwLowDateTime=0xef84fc3f, dwHighDateTime=0x1d327c9)) returned 1
	[0136.076] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0136.076] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x3a5, lpOverlapped=0x0) returned 1
	[0136.076] PathFindFileNameA (pszPath="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk") returned="Mozilla Firefox.lnk"
	[0136.076] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0136.077] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x3a5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x3a5, lpOverlapped=0x0) returned 1
	[0136.077] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0136.077] CloseHandle (hObject=0x20c) returned 1
	[0136.077] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk.exe" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk.exe")) returned 1
	[0136.077] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef84fc3f, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef84fc3f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef84fc3f, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x3e7, dwReserved0=0x15, dwReserved1=0x1, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 0
	[0136.077] FindClose (in: hFindFile=0x7cb750 | out: hFindFile=0x7cb750) returned 1
	[0136.077] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x20, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0136.078] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0136.078] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="desktop.ini") returned 1
	[0136.078] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="desktop.ini") returned 1
	[0136.078] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1
	[0136.078] PathFindFileNameA (pszPath="C:\\Users\\Public\\*.*") returned="*.*"
	[0136.078] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\Public\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\"
	[0136.078] PathAddBackslashA (in: pszPath="C:\\Users\\Public\\" | out: pszPath="C:\\Users\\Public\\") returned=""
	[0136.078] lstrcatA (in: lpString1="C:\\Users\\Public\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\Public\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\Public\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.078] GetFileAttributesA (lpFileName="C:\\Users\\Public\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\public\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.078] CreateFileA (lpFileName="C:\\Users\\Public\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\public\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0136.078] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0136.078] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0136.079] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.079] CloseHandle (hObject=0x208) returned 1
	[0136.079] lstrcatA (in: lpString1="C:\\Users\\Public\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\Public\\desktop.ini") returned="C:\\Users\\Public\\desktop.ini"
	[0136.079] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.zip") returned 0
	[0136.079] lstrlenA (lpString="*.zip") returned 5
	[0136.079] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.rar") returned 0
	[0136.079] lstrlenA (lpString="*.rar") returned 5
	[0136.079] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.7z") returned 0
	[0136.080] lstrlenA (lpString="*.7z") returned 4
	[0136.080] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.tar") returned 0
	[0136.080] lstrlenA (lpString="*.tar") returned 5
	[0136.080] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.gzip") returned 0
	[0136.080] lstrlenA (lpString="*.gzip") returned 6
	[0136.080] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.jpg") returned 0
	[0136.080] lstrlenA (lpString="*.jpg") returned 5
	[0136.080] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.jpeg") returned 0
	[0136.080] lstrlenA (lpString="*.jpeg") returned 6
	[0136.080] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.bmp") returned 0
	[0136.080] lstrlenA (lpString="*.bmp") returned 5
	[0136.080] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.gif") returned 0
	[0136.080] lstrlenA (lpString="*.gif") returned 5
	[0136.080] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.png") returned 0
	[0136.080] lstrlenA (lpString="*.png") returned 5
	[0136.080] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.doc") returned 0
	[0136.080] lstrlenA (lpString="*.doc") returned 5
	[0136.080] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.docx") returned 0
	[0136.080] lstrlenA (lpString="*.docx") returned 6
	[0136.080] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.xls") returned 0
	[0136.080] lstrlenA (lpString="*.xls") returned 5
	[0136.080] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.xlsx") returned 0
	[0136.080] lstrlenA (lpString="*.xlsx") returned 6
	[0136.080] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.ppt") returned 0
	[0136.080] lstrlenA (lpString="*.ppt") returned 5
	[0136.080] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.pptx") returned 0
	[0136.080] lstrlenA (lpString="*.pptx") returned 6
	[0136.080] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.txt") returned 0
	[0136.080] lstrlenA (lpString="*.txt") returned 5
	[0136.080] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.pdf") returned 0
	[0136.080] lstrlenA (lpString="*.pdf") returned 5
	[0136.080] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.htm") returned 0
	[0136.080] lstrlenA (lpString="*.htm") returned 5
	[0136.080] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.html") returned 0
	[0136.081] lstrlenA (lpString="*.html") returned 6
	[0136.081] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.mdb") returned 0
	[0136.081] lstrlenA (lpString="*.mdb") returned 5
	[0136.081] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.pfx") returned 0
	[0136.081] lstrlenA (lpString="*.pfx") returned 5
	[0136.081] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.md") returned 0
	[0136.081] lstrlenA (lpString="*.md") returned 4
	[0136.081] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.lnk") returned 0
	[0136.081] lstrlenA (lpString="*.lnk") returned 5
	[0136.081] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.torrent") returned 0
	[0136.081] lstrlenA (lpString="*.torrent") returned 9
	[0136.081] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.mov") returned 0
	[0136.081] lstrlenA (lpString="*.mov") returned 5
	[0136.081] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.3gp") returned 0
	[0136.081] lstrlenA (lpString="*.3gp") returned 5
	[0136.081] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.mpeg") returned 0
	[0136.081] lstrlenA (lpString="*.mpeg") returned 6
	[0136.081] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.mpg") returned 0
	[0136.081] lstrlenA (lpString="*.mpg") returned 5
	[0136.081] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.flv") returned 0
	[0136.081] lstrlenA (lpString="*.flv") returned 5
	[0136.081] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.avi") returned 0
	[0136.081] lstrlenA (lpString="*.avi") returned 5
	[0136.081] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.mp4") returned 0
	[0136.081] lstrlenA (lpString="*.mp4") returned 5
	[0136.081] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.wmv") returned 0
	[0136.081] lstrlenA (lpString="*.wmv") returned 5
	[0136.081] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.mkv") returned 0
	[0136.081] lstrlenA (lpString="*.mkv") returned 5
	[0136.081] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.mp3") returned 0
	[0136.081] lstrlenA (lpString="*.mp3") returned 5
	[0136.081] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.wav") returned 0
	[0136.081] lstrlenA (lpString="*.wav") returned 5
	[0136.081] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.flac") returned 0
	[0136.082] lstrlenA (lpString="*.flac") returned 6
	[0136.082] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.wma") returned 0
	[0136.082] lstrlenA (lpString="*.wma") returned 5
	[0136.082] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.au3") returned 0
	[0136.082] lstrlenA (lpString="*.au3") returned 5
	[0136.082] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.ahk") returned 0
	[0136.082] lstrlenA (lpString="*.ahk") returned 5
	[0136.082] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.c") returned 0
	[0136.082] lstrlenA (lpString="*.c") returned 3
	[0136.082] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.cc") returned 0
	[0136.082] lstrlenA (lpString="*.cc") returned 4
	[0136.082] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.cpp") returned 0
	[0136.082] lstrlenA (lpString="*.cpp") returned 5
	[0136.082] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.cxx") returned 0
	[0136.082] lstrlenA (lpString="*.cxx") returned 5
	[0136.082] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.c++") returned 0
	[0136.082] lstrlenA (lpString="*.c++") returned 5
	[0136.082] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.cs") returned 0
	[0136.082] lstrlenA (lpString="*.cs") returned 4
	[0136.082] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.vb") returned 0
	[0136.082] lstrlenA (lpString="*.vb") returned 4
	[0136.082] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.bas") returned 0
	[0136.082] lstrlenA (lpString="*.bas") returned 5
	[0136.082] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.csproj") returned 0
	[0136.082] lstrlenA (lpString="*.csproj") returned 8
	[0136.082] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.vbproj") returned 0
	[0136.082] lstrlenA (lpString="*.vbproj") returned 8
	[0136.082] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.vcxproj") returned 0
	[0136.082] lstrlenA (lpString="*.vcxproj") returned 9
	[0136.082] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.manifest") returned 0
	[0136.082] lstrlenA (lpString="*.manifest") returned 10
	[0136.082] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.php") returned 0
	[0136.082] lstrlenA (lpString="*.php") returned 5
	[0136.082] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.vbe") returned 0
	[0136.083] lstrlenA (lpString="*.vbe") returned 5
	[0136.083] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.vba") returned 0
	[0136.083] lstrlenA (lpString="*.vba") returned 5
	[0136.083] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.vbs") returned 0
	[0136.083] lstrlenA (lpString="*.vbs") returned 5
	[0136.083] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.bat") returned 0
	[0136.083] lstrlenA (lpString="*.bat") returned 5
	[0136.083] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.cmd") returned 0
	[0136.083] lstrlenA (lpString="*.cmd") returned 5
	[0136.083] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.js") returned 0
	[0136.083] lstrlenA (lpString="*.js") returned 4
	[0136.083] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.jscript") returned 0
	[0136.083] lstrlenA (lpString="*.jscript") returned 9
	[0136.083] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.hta") returned 0
	[0136.083] lstrlenA (lpString="*.hta") returned 5
	[0136.083] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.php7") returned 0
	[0136.083] lstrlenA (lpString="*.php7") returned 6
	[0136.083] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.db") returned 0
	[0136.083] lstrlenA (lpString="*.db") returned 4
	[0136.083] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.swf") returned 0
	[0136.083] lstrlenA (lpString="*.swf") returned 5
	[0136.083] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.eml") returned 0
	[0136.083] lstrlenA (lpString="*.eml") returned 5
	[0136.083] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.part") returned 0
	[0136.083] lstrlenA (lpString="*.part") returned 6
	[0136.083] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.nfo") returned 0
	[0136.083] lstrlenA (lpString="*.nfo") returned 5
	[0136.083] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.rsa") returned 0
	[0136.083] lstrlenA (lpString="*.rsa") returned 5
	[0136.083] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.key") returned 0
	[0136.083] lstrlenA (lpString="*.key") returned 5
	[0136.083] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.aes") returned 0
	[0136.083] lstrlenA (lpString="*.aes") returned 5
	[0136.083] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.blob") returned 0
	[0136.083] lstrlenA (lpString="*.blob") returned 6
	[0136.084] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.btc") returned 0
	[0136.084] lstrlenA (lpString="*.btc") returned 5
	[0136.084] PathMatchSpecA (pszFile="C:\\Users\\Public\\desktop.ini", pszSpec="*.wallet") returned 0
	[0136.084] lstrlenA (lpString="*.wallet") returned 8
	[0136.084] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1
	[0136.084] lstrcmpA (lpString1=".", lpString2="Documents") returned -1
	[0136.084] lstrcmpA (lpString1="..", lpString2="Documents") returned -1
	[0136.084] PathFindFileNameA (pszPath="C:\\Users\\Public\\desktop.ini") returned="desktop.ini"
	[0136.084] lstrcatA (in: lpString1="C:\\Users\\Public\\", lpString2="Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents"
	[0136.084] lstrlenA (lpString="C:\\Users\\Public\\Documents") returned 25
	[0136.084] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Documents\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d12b0, dwReserved1=0x68, cFileName=".", cAlternateFileName="")) returned 0x7cbad0
	[0136.085] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.085] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d12b0, dwReserved1=0x68, cFileName="..", cAlternateFileName="")) returned 1
	[0136.085] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.085] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.085] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x7d12b0, dwReserved1=0x68, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0136.086] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.086] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="desktop.ini") returned 1
	[0136.086] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="desktop.ini") returned 1
	[0136.086] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1
	[0136.086] PathFindFileNameA (pszPath="C:\\Users\\Public\\Documents\\*.*") returned="*.*"
	[0136.086] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\Public\\Documents\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\"
	[0136.086] PathAddBackslashA (in: pszPath="C:\\Users\\Public\\Documents\\" | out: pszPath="C:\\Users\\Public\\Documents\\") returned=""
	[0136.086] lstrcatA (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\Public\\Documents\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\Public\\Documents\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.086] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Documents\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\public\\documents\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.086] CreateFileA (lpFileName="C:\\Users\\Public\\Documents\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\public\\documents\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0136.087] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0136.087] WriteFile (in: hFile=0x20c, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0136.087] SetFileTime (hFile=0x20c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.088] CloseHandle (hObject=0x20c) returned 1
	[0136.088] lstrcatA (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\Public\\Documents\\desktop.ini") returned="C:\\Users\\Public\\Documents\\desktop.ini"
	[0136.088] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.zip") returned 0
	[0136.088] lstrlenA (lpString="*.zip") returned 5
	[0136.088] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.rar") returned 0
	[0136.088] lstrlenA (lpString="*.rar") returned 5
	[0136.088] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.7z") returned 0
	[0136.088] lstrlenA (lpString="*.7z") returned 4
	[0136.088] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.tar") returned 0
	[0136.088] lstrlenA (lpString="*.tar") returned 5
	[0136.088] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.gzip") returned 0
	[0136.088] lstrlenA (lpString="*.gzip") returned 6
	[0136.088] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.jpg") returned 0
	[0136.088] lstrlenA (lpString="*.jpg") returned 5
	[0136.088] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.jpeg") returned 0
	[0136.088] lstrlenA (lpString="*.jpeg") returned 6
	[0136.088] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.bmp") returned 0
	[0136.088] lstrlenA (lpString="*.bmp") returned 5
	[0136.088] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.gif") returned 0
	[0136.088] lstrlenA (lpString="*.gif") returned 5
	[0136.088] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.png") returned 0
	[0136.088] lstrlenA (lpString="*.png") returned 5
	[0136.088] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.doc") returned 0
	[0136.088] lstrlenA (lpString="*.doc") returned 5
	[0136.088] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.docx") returned 0
	[0136.088] lstrlenA (lpString="*.docx") returned 6
	[0136.088] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.xls") returned 0
	[0136.088] lstrlenA (lpString="*.xls") returned 5
	[0136.088] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.xlsx") returned 0
	[0136.088] lstrlenA (lpString="*.xlsx") returned 6
	[0136.088] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.ppt") returned 0
	[0136.088] lstrlenA (lpString="*.ppt") returned 5
	[0136.089] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.pptx") returned 0
	[0136.089] lstrlenA (lpString="*.pptx") returned 6
	[0136.089] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.txt") returned 0
	[0136.089] lstrlenA (lpString="*.txt") returned 5
	[0136.089] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.pdf") returned 0
	[0136.089] lstrlenA (lpString="*.pdf") returned 5
	[0136.089] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.htm") returned 0
	[0136.089] lstrlenA (lpString="*.htm") returned 5
	[0136.089] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.html") returned 0
	[0136.089] lstrlenA (lpString="*.html") returned 6
	[0136.089] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.mdb") returned 0
	[0136.089] lstrlenA (lpString="*.mdb") returned 5
	[0136.089] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.pfx") returned 0
	[0136.089] lstrlenA (lpString="*.pfx") returned 5
	[0136.089] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.md") returned 0
	[0136.089] lstrlenA (lpString="*.md") returned 4
	[0136.089] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.lnk") returned 0
	[0136.089] lstrlenA (lpString="*.lnk") returned 5
	[0136.089] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.torrent") returned 0
	[0136.089] lstrlenA (lpString="*.torrent") returned 9
	[0136.089] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.mov") returned 0
	[0136.089] lstrlenA (lpString="*.mov") returned 5
	[0136.089] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.3gp") returned 0
	[0136.089] lstrlenA (lpString="*.3gp") returned 5
	[0136.089] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.mpeg") returned 0
	[0136.089] lstrlenA (lpString="*.mpeg") returned 6
	[0136.089] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.mpg") returned 0
	[0136.089] lstrlenA (lpString="*.mpg") returned 5
	[0136.089] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.flv") returned 0
	[0136.089] lstrlenA (lpString="*.flv") returned 5
	[0136.089] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.avi") returned 0
	[0136.089] lstrlenA (lpString="*.avi") returned 5
	[0136.089] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.mp4") returned 0
	[0136.089] lstrlenA (lpString="*.mp4") returned 5
	[0136.090] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.wmv") returned 0
	[0136.090] lstrlenA (lpString="*.wmv") returned 5
	[0136.090] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.mkv") returned 0
	[0136.090] lstrlenA (lpString="*.mkv") returned 5
	[0136.090] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.mp3") returned 0
	[0136.090] lstrlenA (lpString="*.mp3") returned 5
	[0136.090] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.wav") returned 0
	[0136.090] lstrlenA (lpString="*.wav") returned 5
	[0136.090] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.flac") returned 0
	[0136.090] lstrlenA (lpString="*.flac") returned 6
	[0136.090] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.wma") returned 0
	[0136.090] lstrlenA (lpString="*.wma") returned 5
	[0136.090] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.au3") returned 0
	[0136.090] lstrlenA (lpString="*.au3") returned 5
	[0136.090] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.ahk") returned 0
	[0136.090] lstrlenA (lpString="*.ahk") returned 5
	[0136.090] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.c") returned 0
	[0136.090] lstrlenA (lpString="*.c") returned 3
	[0136.090] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.cc") returned 0
	[0136.090] lstrlenA (lpString="*.cc") returned 4
	[0136.090] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.cpp") returned 0
	[0136.090] lstrlenA (lpString="*.cpp") returned 5
	[0136.090] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.cxx") returned 0
	[0136.090] lstrlenA (lpString="*.cxx") returned 5
	[0136.090] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.c++") returned 0
	[0136.090] lstrlenA (lpString="*.c++") returned 5
	[0136.090] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.cs") returned 0
	[0136.090] lstrlenA (lpString="*.cs") returned 4
	[0136.090] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.vb") returned 0
	[0136.090] lstrlenA (lpString="*.vb") returned 4
	[0136.090] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.bas") returned 0
	[0136.090] lstrlenA (lpString="*.bas") returned 5
	[0136.090] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.csproj") returned 0
	[0136.090] lstrlenA (lpString="*.csproj") returned 8
	[0136.091] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.vbproj") returned 0
	[0136.091] lstrlenA (lpString="*.vbproj") returned 8
	[0136.091] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.vcxproj") returned 0
	[0136.091] lstrlenA (lpString="*.vcxproj") returned 9
	[0136.091] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.manifest") returned 0
	[0136.091] lstrlenA (lpString="*.manifest") returned 10
	[0136.091] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.php") returned 0
	[0136.091] lstrlenA (lpString="*.php") returned 5
	[0136.091] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.vbe") returned 0
	[0136.091] lstrlenA (lpString="*.vbe") returned 5
	[0136.091] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.vba") returned 0
	[0136.091] lstrlenA (lpString="*.vba") returned 5
	[0136.091] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.vbs") returned 0
	[0136.091] lstrlenA (lpString="*.vbs") returned 5
	[0136.091] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.bat") returned 0
	[0136.091] lstrlenA (lpString="*.bat") returned 5
	[0136.091] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.cmd") returned 0
	[0136.091] lstrlenA (lpString="*.cmd") returned 5
	[0136.091] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.js") returned 0
	[0136.091] lstrlenA (lpString="*.js") returned 4
	[0136.091] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.jscript") returned 0
	[0136.091] lstrlenA (lpString="*.jscript") returned 9
	[0136.091] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.hta") returned 0
	[0136.091] lstrlenA (lpString="*.hta") returned 5
	[0136.091] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.php7") returned 0
	[0136.091] lstrlenA (lpString="*.php7") returned 6
	[0136.091] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.db") returned 0
	[0136.091] lstrlenA (lpString="*.db") returned 4
	[0136.091] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.swf") returned 0
	[0136.091] lstrlenA (lpString="*.swf") returned 5
	[0136.091] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.eml") returned 0
	[0136.091] lstrlenA (lpString="*.eml") returned 5
	[0136.091] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.part") returned 0
	[0136.091] lstrlenA (lpString="*.part") returned 6
	[0136.091] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.nfo") returned 0
	[0136.092] lstrlenA (lpString="*.nfo") returned 5
	[0136.092] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.rsa") returned 0
	[0136.092] lstrlenA (lpString="*.rsa") returned 5
	[0136.092] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.key") returned 0
	[0136.092] lstrlenA (lpString="*.key") returned 5
	[0136.092] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.aes") returned 0
	[0136.092] lstrlenA (lpString="*.aes") returned 5
	[0136.092] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.blob") returned 0
	[0136.092] lstrlenA (lpString="*.blob") returned 6
	[0136.092] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.btc") returned 0
	[0136.092] lstrlenA (lpString="*.btc") returned 5
	[0136.092] PathMatchSpecA (pszFile="C:\\Users\\Public\\Documents\\desktop.ini", pszSpec="*.wallet") returned 0
	[0136.092] lstrlenA (lpString="*.wallet") returned 8
	[0136.092] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x1, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1
	[0136.092] lstrcmpA (lpString1=".", lpString2="My Music") returned -1
	[0136.092] lstrcmpA (lpString1="..", lpString2="My Music") returned -1
	[0136.092] PathFindFileNameA (pszPath="C:\\Users\\Public\\Documents\\desktop.ini") returned="desktop.ini"
	[0136.092] lstrcatA (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="My Music" | out: lpString1="C:\\Users\\Public\\Documents\\My Music") returned="C:\\Users\\Public\\Documents\\My Music"
	[0136.092] lstrlenA (lpString="C:\\Users\\Public\\Documents\\My Music") returned 34
	[0136.092] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Documents\\My Music\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x19f988, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x18, nFileSizeHigh=0x207d0, nFileSizeLow=0x0, dwReserved0=0x7ba9f8, dwReserved1=0x404472, cFileName="\x01", cAlternateFileName="\xcc\xff\x19")) returned 0xffffffff
	[0136.092] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x1, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1
	[0136.092] lstrcmpA (lpString1=".", lpString2="My Pictures") returned -1
	[0136.092] lstrcmpA (lpString1="..", lpString2="My Pictures") returned -1
	[0136.092] PathFindFileNameA (pszPath="C:\\Users\\Public\\Documents\\*.*") returned="*.*"
	[0136.092] lstrcatA (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="My Pictures" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures") returned="C:\\Users\\Public\\Documents\\My Pictures"
	[0136.092] lstrlenA (lpString="C:\\Users\\Public\\Documents\\My Pictures") returned 37
	[0136.092] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x19f988, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x18, nFileSizeHigh=0x207d0, nFileSizeLow=0x0, dwReserved0=0x7ba9f8, dwReserved1=0x404472, cFileName="\x01", cAlternateFileName="\xcc\xff\x19")) returned 0xffffffff
	[0136.093] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x1, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1
	[0136.093] lstrcmpA (lpString1=".", lpString2="My Videos") returned -1
	[0136.093] lstrcmpA (lpString1="..", lpString2="My Videos") returned -1
	[0136.093] PathFindFileNameA (pszPath="C:\\Users\\Public\\Documents\\*.*") returned="*.*"
	[0136.093] lstrcatA (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="My Videos" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos") returned="C:\\Users\\Public\\Documents\\My Videos"
	[0136.093] lstrlenA (lpString="C:\\Users\\Public\\Documents\\My Videos") returned 35
	[0136.093] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x19f988, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x18, nFileSizeHigh=0x207d0, nFileSizeLow=0x0, dwReserved0=0x7ba9f8, dwReserved1=0x404472, cFileName="\x01", cAlternateFileName="\xcc\xff\x19")) returned 0xffffffff
	[0136.093] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x1, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0
	[0136.093] FindClose (in: hFindFile=0x7cbad0 | out: hFindFile=0x7cbad0) returned 1
	[0136.093] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1
	[0136.093] lstrcmpA (lpString1=".", lpString2="Downloads") returned -1
	[0136.093] lstrcmpA (lpString1="..", lpString2="Downloads") returned -1
	[0136.093] PathFindFileNameA (pszPath="C:\\Users\\Public\\*.*") returned="*.*"
	[0136.093] lstrcatA (in: lpString1="C:\\Users\\Public\\", lpString2="Downloads" | out: lpString1="C:\\Users\\Public\\Downloads") returned="C:\\Users\\Public\\Downloads"
	[0136.093] lstrlenA (lpString="C:\\Users\\Public\\Downloads") returned 25
	[0136.093] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Downloads\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x7cb790
	[0136.093] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.093] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1
	[0136.093] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.093] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.093] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x1, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0136.093] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.094] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="desktop.ini") returned 1
	[0136.094] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="desktop.ini") returned 1
	[0136.094] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1
	[0136.094] PathFindFileNameA (pszPath="C:\\Users\\Public\\Downloads\\*.*") returned="*.*"
	[0136.094] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\Public\\Downloads\\" | out: lpString1="C:\\Users\\Public\\Downloads\\") returned="C:\\Users\\Public\\Downloads\\"
	[0136.094] PathAddBackslashA (in: pszPath="C:\\Users\\Public\\Downloads\\" | out: pszPath="C:\\Users\\Public\\Downloads\\") returned=""
	[0136.094] lstrcatA (in: lpString1="C:\\Users\\Public\\Downloads\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\Public\\Downloads\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\Public\\Downloads\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.094] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Downloads\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\public\\downloads\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.094] CreateFileA (lpFileName="C:\\Users\\Public\\Downloads\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\public\\downloads\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0136.094] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0136.094] WriteFile (in: hFile=0x20c, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0136.095] SetFileTime (hFile=0x20c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.095] CloseHandle (hObject=0x20c) returned 1
	[0136.095] lstrcatA (in: lpString1="C:\\Users\\Public\\Downloads\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\Public\\Downloads\\desktop.ini") returned="C:\\Users\\Public\\Downloads\\desktop.ini"
	[0136.095] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.zip") returned 0
	[0136.095] lstrlenA (lpString="*.zip") returned 5
	[0136.095] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.rar") returned 0
	[0136.095] lstrlenA (lpString="*.rar") returned 5
	[0136.095] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.7z") returned 0
	[0136.095] lstrlenA (lpString="*.7z") returned 4
	[0136.095] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.tar") returned 0
	[0136.096] lstrlenA (lpString="*.tar") returned 5
	[0136.096] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.gzip") returned 0
	[0136.096] lstrlenA (lpString="*.gzip") returned 6
	[0136.096] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.jpg") returned 0
	[0136.096] lstrlenA (lpString="*.jpg") returned 5
	[0136.096] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.jpeg") returned 0
	[0136.096] lstrlenA (lpString="*.jpeg") returned 6
	[0136.096] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.bmp") returned 0
	[0136.096] lstrlenA (lpString="*.bmp") returned 5
	[0136.096] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.gif") returned 0
	[0136.096] lstrlenA (lpString="*.gif") returned 5
	[0136.096] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.png") returned 0
	[0136.096] lstrlenA (lpString="*.png") returned 5
	[0136.096] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.doc") returned 0
	[0136.096] lstrlenA (lpString="*.doc") returned 5
	[0136.096] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.docx") returned 0
	[0136.096] lstrlenA (lpString="*.docx") returned 6
	[0136.096] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.xls") returned 0
	[0136.096] lstrlenA (lpString="*.xls") returned 5
	[0136.096] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.xlsx") returned 0
	[0136.096] lstrlenA (lpString="*.xlsx") returned 6
	[0136.096] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.ppt") returned 0
	[0136.096] lstrlenA (lpString="*.ppt") returned 5
	[0136.096] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.pptx") returned 0
	[0136.096] lstrlenA (lpString="*.pptx") returned 6
	[0136.096] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.txt") returned 0
	[0136.096] lstrlenA (lpString="*.txt") returned 5
	[0136.096] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.pdf") returned 0
	[0136.096] lstrlenA (lpString="*.pdf") returned 5
	[0136.096] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.htm") returned 0
	[0136.096] lstrlenA (lpString="*.htm") returned 5
	[0136.096] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.html") returned 0
	[0136.096] lstrlenA (lpString="*.html") returned 6
	[0136.096] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.mdb") returned 0
	[0136.097] lstrlenA (lpString="*.mdb") returned 5
	[0136.097] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.pfx") returned 0
	[0136.097] lstrlenA (lpString="*.pfx") returned 5
	[0136.097] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.md") returned 0
	[0136.097] lstrlenA (lpString="*.md") returned 4
	[0136.097] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.lnk") returned 0
	[0136.097] lstrlenA (lpString="*.lnk") returned 5
	[0136.097] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.torrent") returned 0
	[0136.097] lstrlenA (lpString="*.torrent") returned 9
	[0136.097] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.mov") returned 0
	[0136.097] lstrlenA (lpString="*.mov") returned 5
	[0136.097] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.3gp") returned 0
	[0136.097] lstrlenA (lpString="*.3gp") returned 5
	[0136.097] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.mpeg") returned 0
	[0136.097] lstrlenA (lpString="*.mpeg") returned 6
	[0136.097] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.mpg") returned 0
	[0136.097] lstrlenA (lpString="*.mpg") returned 5
	[0136.097] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.flv") returned 0
	[0136.097] lstrlenA (lpString="*.flv") returned 5
	[0136.097] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.avi") returned 0
	[0136.097] lstrlenA (lpString="*.avi") returned 5
	[0136.097] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.mp4") returned 0
	[0136.097] lstrlenA (lpString="*.mp4") returned 5
	[0136.097] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.wmv") returned 0
	[0136.097] lstrlenA (lpString="*.wmv") returned 5
	[0136.097] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.mkv") returned 0
	[0136.097] lstrlenA (lpString="*.mkv") returned 5
	[0136.097] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.mp3") returned 0
	[0136.097] lstrlenA (lpString="*.mp3") returned 5
	[0136.097] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.wav") returned 0
	[0136.097] lstrlenA (lpString="*.wav") returned 5
	[0136.097] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.flac") returned 0
	[0136.097] lstrlenA (lpString="*.flac") returned 6
	[0136.097] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.wma") returned 0
	[0136.098] lstrlenA (lpString="*.wma") returned 5
	[0136.098] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.au3") returned 0
	[0136.098] lstrlenA (lpString="*.au3") returned 5
	[0136.098] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.ahk") returned 0
	[0136.098] lstrlenA (lpString="*.ahk") returned 5
	[0136.098] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.c") returned 0
	[0136.098] lstrlenA (lpString="*.c") returned 3
	[0136.098] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.cc") returned 0
	[0136.098] lstrlenA (lpString="*.cc") returned 4
	[0136.098] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.cpp") returned 0
	[0136.098] lstrlenA (lpString="*.cpp") returned 5
	[0136.098] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.cxx") returned 0
	[0136.098] lstrlenA (lpString="*.cxx") returned 5
	[0136.098] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.c++") returned 0
	[0136.098] lstrlenA (lpString="*.c++") returned 5
	[0136.098] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.cs") returned 0
	[0136.098] lstrlenA (lpString="*.cs") returned 4
	[0136.098] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.vb") returned 0
	[0136.098] lstrlenA (lpString="*.vb") returned 4
	[0136.098] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.bas") returned 0
	[0136.098] lstrlenA (lpString="*.bas") returned 5
	[0136.098] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.csproj") returned 0
	[0136.098] lstrlenA (lpString="*.csproj") returned 8
	[0136.098] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.vbproj") returned 0
	[0136.098] lstrlenA (lpString="*.vbproj") returned 8
	[0136.098] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.vcxproj") returned 0
	[0136.098] lstrlenA (lpString="*.vcxproj") returned 9
	[0136.098] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.manifest") returned 0
	[0136.098] lstrlenA (lpString="*.manifest") returned 10
	[0136.098] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.php") returned 0
	[0136.098] lstrlenA (lpString="*.php") returned 5
	[0136.098] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.vbe") returned 0
	[0136.098] lstrlenA (lpString="*.vbe") returned 5
	[0136.098] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.vba") returned 0
	[0136.099] lstrlenA (lpString="*.vba") returned 5
	[0136.099] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.vbs") returned 0
	[0136.099] lstrlenA (lpString="*.vbs") returned 5
	[0136.099] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.bat") returned 0
	[0136.099] lstrlenA (lpString="*.bat") returned 5
	[0136.099] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.cmd") returned 0
	[0136.099] lstrlenA (lpString="*.cmd") returned 5
	[0136.099] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.js") returned 0
	[0136.099] lstrlenA (lpString="*.js") returned 4
	[0136.099] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.jscript") returned 0
	[0136.099] lstrlenA (lpString="*.jscript") returned 9
	[0136.099] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.hta") returned 0
	[0136.099] lstrlenA (lpString="*.hta") returned 5
	[0136.099] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.php7") returned 0
	[0136.099] lstrlenA (lpString="*.php7") returned 6
	[0136.099] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.db") returned 0
	[0136.099] lstrlenA (lpString="*.db") returned 4
	[0136.099] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.swf") returned 0
	[0136.099] lstrlenA (lpString="*.swf") returned 5
	[0136.099] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.eml") returned 0
	[0136.099] lstrlenA (lpString="*.eml") returned 5
	[0136.099] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.part") returned 0
	[0136.099] lstrlenA (lpString="*.part") returned 6
	[0136.099] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.nfo") returned 0
	[0136.099] lstrlenA (lpString="*.nfo") returned 5
	[0136.099] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.rsa") returned 0
	[0136.099] lstrlenA (lpString="*.rsa") returned 5
	[0136.099] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.key") returned 0
	[0136.099] lstrlenA (lpString="*.key") returned 5
	[0136.099] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.aes") returned 0
	[0136.099] lstrlenA (lpString="*.aes") returned 5
	[0136.099] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.blob") returned 0
	[0136.099] lstrlenA (lpString="*.blob") returned 6
	[0136.099] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.btc") returned 0
	[0136.100] lstrlenA (lpString="*.btc") returned 5
	[0136.100] PathMatchSpecA (pszFile="C:\\Users\\Public\\Downloads\\desktop.ini", pszSpec="*.wallet") returned 0
	[0136.100] lstrlenA (lpString="*.wallet") returned 8
	[0136.100] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x1, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0136.100] FindClose (in: hFindFile=0x7cb790 | out: hFindFile=0x7cb790) returned 1
	[0136.100] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb207547d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb207547d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1
	[0136.100] lstrcmpA (lpString1=".", lpString2="Libraries") returned -1
	[0136.100] lstrcmpA (lpString1="..", lpString2="Libraries") returned -1
	[0136.100] PathFindFileNameA (pszPath="C:\\Users\\Public\\*.*") returned="*.*"
	[0136.100] lstrcatA (in: lpString1="C:\\Users\\Public\\", lpString2="Libraries" | out: lpString1="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries"
	[0136.100] lstrlenA (lpString="C:\\Users\\Public\\Libraries") returned 25
	[0136.100] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Libraries\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb207547d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb207547d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x7cbbd0
	[0136.100] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.100] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb207547d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb207547d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1
	[0136.100] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.100] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.100] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x1, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0136.100] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.100] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="desktop.ini") returned 1
	[0136.100] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="desktop.ini") returned 1
	[0136.100] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1
	[0136.100] PathFindFileNameA (pszPath="C:\\Users\\Public\\Libraries\\*.*") returned="*.*"
	[0136.100] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\Public\\Libraries\\" | out: lpString1="C:\\Users\\Public\\Libraries\\") returned="C:\\Users\\Public\\Libraries\\"
	[0136.100] PathAddBackslashA (in: pszPath="C:\\Users\\Public\\Libraries\\" | out: pszPath="C:\\Users\\Public\\Libraries\\") returned=""
	[0136.101] lstrcatA (in: lpString1="C:\\Users\\Public\\Libraries\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\Public\\Libraries\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\Public\\Libraries\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.101] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Libraries\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\public\\libraries\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.101] CreateFileA (lpFileName="C:\\Users\\Public\\Libraries\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\public\\libraries\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0136.103] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0136.103] WriteFile (in: hFile=0x20c, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0136.104] SetFileTime (hFile=0x20c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.104] CloseHandle (hObject=0x20c) returned 1
	[0136.104] lstrcatA (in: lpString1="C:\\Users\\Public\\Libraries\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\Public\\Libraries\\desktop.ini") returned="C:\\Users\\Public\\Libraries\\desktop.ini"
	[0136.104] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.zip") returned 0
	[0136.104] lstrlenA (lpString="*.zip") returned 5
	[0136.104] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.rar") returned 0
	[0136.104] lstrlenA (lpString="*.rar") returned 5
	[0136.104] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.7z") returned 0
	[0136.104] lstrlenA (lpString="*.7z") returned 4
	[0136.104] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.tar") returned 0
	[0136.104] lstrlenA (lpString="*.tar") returned 5
	[0136.104] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.gzip") returned 0
	[0136.104] lstrlenA (lpString="*.gzip") returned 6
	[0136.104] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.jpg") returned 0
	[0136.104] lstrlenA (lpString="*.jpg") returned 5
	[0136.105] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.jpeg") returned 0
	[0136.105] lstrlenA (lpString="*.jpeg") returned 6
	[0136.105] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.bmp") returned 0
	[0136.105] lstrlenA (lpString="*.bmp") returned 5
	[0136.105] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.gif") returned 0
	[0136.105] lstrlenA (lpString="*.gif") returned 5
	[0136.105] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.png") returned 0
	[0136.105] lstrlenA (lpString="*.png") returned 5
	[0136.105] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.doc") returned 0
	[0136.105] lstrlenA (lpString="*.doc") returned 5
	[0136.105] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.docx") returned 0
	[0136.105] lstrlenA (lpString="*.docx") returned 6
	[0136.105] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.xls") returned 0
	[0136.105] lstrlenA (lpString="*.xls") returned 5
	[0136.105] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.xlsx") returned 0
	[0136.105] lstrlenA (lpString="*.xlsx") returned 6
	[0136.105] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.ppt") returned 0
	[0136.105] lstrlenA (lpString="*.ppt") returned 5
	[0136.105] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.pptx") returned 0
	[0136.105] lstrlenA (lpString="*.pptx") returned 6
	[0136.105] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.txt") returned 0
	[0136.105] lstrlenA (lpString="*.txt") returned 5
	[0136.105] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.pdf") returned 0
	[0136.105] lstrlenA (lpString="*.pdf") returned 5
	[0136.105] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.htm") returned 0
	[0136.105] lstrlenA (lpString="*.htm") returned 5
	[0136.105] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.html") returned 0
	[0136.105] lstrlenA (lpString="*.html") returned 6
	[0136.105] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.mdb") returned 0
	[0136.105] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.pfx") returned 0
	[0136.105] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.md") returned 0
	[0136.105] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.lnk") returned 0
	[0136.106] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.torrent") returned 0
	[0136.106] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.mov") returned 0
	[0136.106] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.3gp") returned 0
	[0136.106] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.mpeg") returned 0
	[0136.106] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.mpg") returned 0
	[0136.106] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.flv") returned 0
	[0136.106] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.avi") returned 0
	[0136.106] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.mp4") returned 0
	[0136.106] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.wmv") returned 0
	[0136.106] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.mkv") returned 0
	[0136.106] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.mp3") returned 0
	[0136.106] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.wav") returned 0
	[0136.106] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.flac") returned 0
	[0136.106] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.wma") returned 0
	[0136.106] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.au3") returned 0
	[0136.106] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.ahk") returned 0
	[0136.106] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.c") returned 0
	[0136.106] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.cc") returned 0
	[0136.106] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.cpp") returned 0
	[0136.106] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.cxx") returned 0
	[0136.106] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.c++") returned 0
	[0136.106] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.cs") returned 0
	[0136.106] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.vb") returned 0
	[0136.106] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.bas") returned 0
	[0136.106] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.csproj") returned 0
	[0136.107] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.vbproj") returned 0
	[0136.107] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.vcxproj") returned 0
	[0136.107] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.manifest") returned 0
	[0136.107] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.php") returned 0
	[0136.107] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.vbe") returned 0
	[0136.107] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.vba") returned 0
	[0136.107] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.vbs") returned 0
	[0136.107] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.bat") returned 0
	[0136.107] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.cmd") returned 0
	[0136.107] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.js") returned 0
	[0136.107] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.jscript") returned 0
	[0136.107] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.hta") returned 0
	[0136.107] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.php7") returned 0
	[0136.107] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.db") returned 0
	[0136.107] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.swf") returned 0
	[0136.107] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.eml") returned 0
	[0136.107] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.part") returned 0
	[0136.107] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.nfo") returned 0
	[0136.107] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.rsa") returned 0
	[0136.107] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.key") returned 0
	[0136.107] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.aes") returned 0
	[0136.107] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.blob") returned 0
	[0136.107] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.btc") returned 0
	[0136.107] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\desktop.ini", pszSpec="*.wallet") returned 0
	[0136.107] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x1, cFileName="RecordedTV.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 1
	[0136.108] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.108] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="RecordedTV.library-ms") returned -1
	[0136.108] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="RecordedTV.library-ms") returned -1
	[0136.108] lstrcmpiA (lpString1="", lpString2="RecordedTV.library-ms") returned -1
	[0136.108] PathFindFileNameA (pszPath="C:\\Users\\Public\\Libraries\\desktop.ini") returned="desktop.ini"
	[0136.108] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\Public\\Libraries\\" | out: lpString1="C:\\Users\\Public\\Libraries\\") returned="C:\\Users\\Public\\Libraries\\"
	[0136.108] PathAddBackslashA (in: pszPath="C:\\Users\\Public\\Libraries\\" | out: pszPath="C:\\Users\\Public\\Libraries\\") returned=""
	[0136.108] lstrcatA (in: lpString1="C:\\Users\\Public\\Libraries\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\Public\\Libraries\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\Public\\Libraries\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.108] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Libraries\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\public\\libraries\\how-to-decrypt-files.htm")) returned 0x20
	[0136.108] lstrcatA (in: lpString1="C:\\Users\\Public\\Libraries\\", lpString2="RecordedTV.library-ms" | out: lpString1="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms") returned="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms"
	[0136.108] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.zip") returned 0
	[0136.108] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.rar") returned 0
	[0136.108] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.7z") returned 0
	[0136.108] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.tar") returned 0
	[0136.108] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.gzip") returned 0
	[0136.108] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.jpg") returned 0
	[0136.108] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.jpeg") returned 0
	[0136.108] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.bmp") returned 0
	[0136.108] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.gif") returned 0
	[0136.108] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.png") returned 0
	[0136.108] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.doc") returned 0
	[0136.108] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.docx") returned 0
	[0136.108] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.xls") returned 0
	[0136.108] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.xlsx") returned 0
	[0136.108] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.ppt") returned 0
	[0136.109] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.pptx") returned 0
	[0136.109] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.txt") returned 0
	[0136.109] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.pdf") returned 0
	[0136.109] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.htm") returned 0
	[0136.109] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.html") returned 0
	[0136.109] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.mdb") returned 0
	[0136.109] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.pfx") returned 0
	[0136.109] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.md") returned 0
	[0136.109] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.lnk") returned 0
	[0136.109] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.torrent") returned 0
	[0136.109] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.mov") returned 0
	[0136.109] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.3gp") returned 0
	[0136.109] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.mpeg") returned 0
	[0136.109] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.mpg") returned 0
	[0136.109] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.flv") returned 0
	[0136.109] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.avi") returned 0
	[0136.109] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.mp4") returned 0
	[0136.109] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.wmv") returned 0
	[0136.109] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.mkv") returned 0
	[0136.109] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.mp3") returned 0
	[0136.109] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.wav") returned 0
	[0136.109] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.flac") returned 0
	[0136.109] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.wma") returned 0
	[0136.109] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.au3") returned 0
	[0136.109] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.ahk") returned 0
	[0136.109] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.c") returned 0
	[0136.110] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.cc") returned 0
	[0136.110] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.cpp") returned 0
	[0136.110] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.cxx") returned 0
	[0136.110] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.c++") returned 0
	[0136.110] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.cs") returned 0
	[0136.110] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.vb") returned 0
	[0136.110] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.bas") returned 0
	[0136.110] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.csproj") returned 0
	[0136.110] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.vbproj") returned 0
	[0136.110] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.vcxproj") returned 0
	[0136.110] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.manifest") returned 0
	[0136.110] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.php") returned 0
	[0136.110] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.vbe") returned 0
	[0136.110] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.vba") returned 0
	[0136.110] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.vbs") returned 0
	[0136.110] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.bat") returned 0
	[0136.110] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.cmd") returned 0
	[0136.110] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.js") returned 0
	[0136.110] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.jscript") returned 0
	[0136.110] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.hta") returned 0
	[0136.110] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.php7") returned 0
	[0136.110] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.db") returned 0
	[0136.110] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.swf") returned 0
	[0136.110] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.eml") returned 0
	[0136.110] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.part") returned 0
	[0136.111] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.nfo") returned 0
	[0136.111] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.rsa") returned 0
	[0136.111] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.key") returned 0
	[0136.111] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.aes") returned 0
	[0136.111] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.blob") returned 0
	[0136.111] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.btc") returned 0
	[0136.111] PathMatchSpecA (pszFile="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", pszSpec="*.wallet") returned 0
	[0136.111] FindNextFileA (in: hFindFile=0x7cbbd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x1, cFileName="RecordedTV.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 0
	[0136.111] FindClose (in: hFindFile=0x7cbbd0 | out: hFindFile=0x7cbbd0) returned 1
	[0136.111] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1
	[0136.111] lstrcmpA (lpString1=".", lpString2="Music") returned -1
	[0136.111] lstrcmpA (lpString1="..", lpString2="Music") returned -1
	[0136.111] PathFindFileNameA (pszPath="C:\\Users\\Public\\*.*") returned="*.*"
	[0136.111] lstrcatA (in: lpString1="C:\\Users\\Public\\", lpString2="Music" | out: lpString1="C:\\Users\\Public\\Music") returned="C:\\Users\\Public\\Music"
	[0136.111] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Music\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb810
	[0136.111] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.111] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.111] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.111] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.111] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0136.111] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.111] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="desktop.ini") returned 1
	[0136.111] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="desktop.ini") returned 1
	[0136.112] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1
	[0136.112] PathFindFileNameA (pszPath="C:\\Users\\Public\\Music\\*.*") returned="*.*"
	[0136.112] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\Public\\Music\\" | out: lpString1="C:\\Users\\Public\\Music\\") returned="C:\\Users\\Public\\Music\\"
	[0136.112] PathAddBackslashA (in: pszPath="C:\\Users\\Public\\Music\\" | out: pszPath="C:\\Users\\Public\\Music\\") returned=""
	[0136.112] lstrcatA (in: lpString1="C:\\Users\\Public\\Music\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\Public\\Music\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\Public\\Music\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.112] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Music\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\public\\music\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.112] CreateFileA (lpFileName="C:\\Users\\Public\\Music\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\public\\music\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0136.112] WriteFile (in: hFile=0x20c, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0136.113] SetFileTime (hFile=0x20c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.113] CloseHandle (hObject=0x20c) returned 1
	[0136.113] lstrcatA (in: lpString1="C:\\Users\\Public\\Music\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\Public\\Music\\desktop.ini") returned="C:\\Users\\Public\\Music\\desktop.ini"
	[0136.113] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.zip") returned 0
	[0136.113] lstrlenA (lpString="*.zip") returned 5
	[0136.113] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.rar") returned 0
	[0136.113] lstrlenA (lpString="*.rar") returned 5
	[0136.113] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.7z") returned 0
	[0136.113] lstrlenA (lpString="*.7z") returned 4
	[0136.113] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.tar") returned 0
	[0136.113] lstrlenA (lpString="*.tar") returned 5
	[0136.113] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.gzip") returned 0
	[0136.113] lstrlenA (lpString="*.gzip") returned 6
	[0136.114] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.jpg") returned 0
	[0136.114] lstrlenA (lpString="*.jpg") returned 5
	[0136.114] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.jpeg") returned 0
	[0136.114] lstrlenA (lpString="*.jpeg") returned 6
	[0136.114] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.bmp") returned 0
	[0136.114] lstrlenA (lpString="*.bmp") returned 5
	[0136.114] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.gif") returned 0
	[0136.114] lstrlenA (lpString="*.gif") returned 5
	[0136.114] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.png") returned 0
	[0136.114] lstrlenA (lpString="*.png") returned 5
	[0136.114] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.doc") returned 0
	[0136.114] lstrlenA (lpString="*.doc") returned 5
	[0136.114] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.docx") returned 0
	[0136.114] lstrlenA (lpString="*.docx") returned 6
	[0136.114] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.xls") returned 0
	[0136.114] lstrlenA (lpString="*.xls") returned 5
	[0136.114] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.xlsx") returned 0
	[0136.114] lstrlenA (lpString="*.xlsx") returned 6
	[0136.114] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.ppt") returned 0
	[0136.114] lstrlenA (lpString="*.ppt") returned 5
	[0136.114] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.pptx") returned 0
	[0136.114] lstrlenA (lpString="*.pptx") returned 6
	[0136.114] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.txt") returned 0
	[0136.114] lstrlenA (lpString="*.txt") returned 5
	[0136.114] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.pdf") returned 0
	[0136.114] lstrlenA (lpString="*.pdf") returned 5
	[0136.114] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.htm") returned 0
	[0136.114] lstrlenA (lpString="*.htm") returned 5
	[0136.114] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.html") returned 0
	[0136.114] lstrlenA (lpString="*.html") returned 6
	[0136.114] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.mdb") returned 0
	[0136.114] lstrlenA (lpString="*.mdb") returned 5
	[0136.114] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.pfx") returned 0
	[0136.115] lstrlenA (lpString="*.pfx") returned 5
	[0136.115] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.md") returned 0
	[0136.115] lstrlenA (lpString="*.md") returned 4
	[0136.115] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.lnk") returned 0
	[0136.115] lstrlenA (lpString="*.lnk") returned 5
	[0136.115] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.torrent") returned 0
	[0136.115] lstrlenA (lpString="*.torrent") returned 9
	[0136.115] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.mov") returned 0
	[0136.115] lstrlenA (lpString="*.mov") returned 5
	[0136.115] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.3gp") returned 0
	[0136.115] lstrlenA (lpString="*.3gp") returned 5
	[0136.115] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.mpeg") returned 0
	[0136.115] lstrlenA (lpString="*.mpeg") returned 6
	[0136.115] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.mpg") returned 0
	[0136.115] lstrlenA (lpString="*.mpg") returned 5
	[0136.115] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.flv") returned 0
	[0136.115] lstrlenA (lpString="*.flv") returned 5
	[0136.115] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.avi") returned 0
	[0136.115] lstrlenA (lpString="*.avi") returned 5
	[0136.115] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.mp4") returned 0
	[0136.115] lstrlenA (lpString="*.mp4") returned 5
	[0136.115] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.wmv") returned 0
	[0136.115] lstrlenA (lpString="*.wmv") returned 5
	[0136.115] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.mkv") returned 0
	[0136.115] lstrlenA (lpString="*.mkv") returned 5
	[0136.115] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.mp3") returned 0
	[0136.115] lstrlenA (lpString="*.mp3") returned 5
	[0136.115] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.wav") returned 0
	[0136.115] lstrlenA (lpString="*.wav") returned 5
	[0136.115] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.flac") returned 0
	[0136.115] lstrlenA (lpString="*.flac") returned 6
	[0136.115] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.wma") returned 0
	[0136.115] lstrlenA (lpString="*.wma") returned 5
	[0136.115] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.au3") returned 0
	[0136.115] lstrlenA (lpString="*.au3") returned 5
	[0136.116] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.ahk") returned 0
	[0136.116] lstrlenA (lpString="*.ahk") returned 5
	[0136.116] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.c") returned 0
	[0136.116] lstrlenA (lpString="*.c") returned 3
	[0136.116] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.cc") returned 0
	[0136.116] lstrlenA (lpString="*.cc") returned 4
	[0136.116] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.cpp") returned 0
	[0136.116] lstrlenA (lpString="*.cpp") returned 5
	[0136.116] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.cxx") returned 0
	[0136.116] lstrlenA (lpString="*.cxx") returned 5
	[0136.116] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.c++") returned 0
	[0136.116] lstrlenA (lpString="*.c++") returned 5
	[0136.116] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.cs") returned 0
	[0136.116] lstrlenA (lpString="*.cs") returned 4
	[0136.116] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.vb") returned 0
	[0136.116] lstrlenA (lpString="*.vb") returned 4
	[0136.116] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.bas") returned 0
	[0136.116] lstrlenA (lpString="*.bas") returned 5
	[0136.116] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.csproj") returned 0
	[0136.116] lstrlenA (lpString="*.csproj") returned 8
	[0136.116] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.vbproj") returned 0
	[0136.116] lstrlenA (lpString="*.vbproj") returned 8
	[0136.116] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.vcxproj") returned 0
	[0136.116] lstrlenA (lpString="*.vcxproj") returned 9
	[0136.116] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.manifest") returned 0
	[0136.116] lstrlenA (lpString="*.manifest") returned 10
	[0136.116] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.php") returned 0
	[0136.116] lstrlenA (lpString="*.php") returned 5
	[0136.116] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.vbe") returned 0
	[0136.116] lstrlenA (lpString="*.vbe") returned 5
	[0136.116] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.vba") returned 0
	[0136.116] lstrlenA (lpString="*.vba") returned 5
	[0136.116] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.vbs") returned 0
	[0136.116] lstrlenA (lpString="*.vbs") returned 5
	[0136.117] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.bat") returned 0
	[0136.117] lstrlenA (lpString="*.bat") returned 5
	[0136.117] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.cmd") returned 0
	[0136.117] lstrlenA (lpString="*.cmd") returned 5
	[0136.117] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.js") returned 0
	[0136.117] lstrlenA (lpString="*.js") returned 4
	[0136.117] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.jscript") returned 0
	[0136.117] lstrlenA (lpString="*.jscript") returned 9
	[0136.117] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.hta") returned 0
	[0136.117] lstrlenA (lpString="*.hta") returned 5
	[0136.117] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.php7") returned 0
	[0136.117] lstrlenA (lpString="*.php7") returned 6
	[0136.117] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.db") returned 0
	[0136.117] lstrlenA (lpString="*.db") returned 4
	[0136.117] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.swf") returned 0
	[0136.117] lstrlenA (lpString="*.swf") returned 5
	[0136.117] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.eml") returned 0
	[0136.117] lstrlenA (lpString="*.eml") returned 5
	[0136.117] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.part") returned 0
	[0136.117] lstrlenA (lpString="*.part") returned 6
	[0136.117] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.nfo") returned 0
	[0136.117] lstrlenA (lpString="*.nfo") returned 5
	[0136.117] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.rsa") returned 0
	[0136.118] lstrlenA (lpString="*.rsa") returned 5
	[0136.118] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.key") returned 0
	[0136.118] lstrlenA (lpString="*.key") returned 5
	[0136.118] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.aes") returned 0
	[0136.118] lstrlenA (lpString="*.aes") returned 5
	[0136.118] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.blob") returned 0
	[0136.118] lstrlenA (lpString="*.blob") returned 6
	[0136.118] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.btc") returned 0
	[0136.118] lstrlenA (lpString="*.btc") returned 5
	[0136.118] PathMatchSpecA (pszFile="C:\\Users\\Public\\Music\\desktop.ini", pszSpec="*.wallet") returned 0
	[0136.118] lstrlenA (lpString="*.wallet") returned 8
	[0136.118] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0136.118] FindClose (in: hFindFile=0x7cb810 | out: hFindFile=0x7cb810) returned 1
	[0136.118] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1
	[0136.118] lstrcmpA (lpString1=".", lpString2="Pictures") returned -1
	[0136.118] lstrcmpA (lpString1="..", lpString2="Pictures") returned -1
	[0136.118] PathFindFileNameA (pszPath="C:\\Users\\Public\\*.*") returned="*.*"
	[0136.118] lstrcatA (in: lpString1="C:\\Users\\Public\\", lpString2="Pictures" | out: lpString1="C:\\Users\\Public\\Pictures") returned="C:\\Users\\Public\\Pictures"
	[0136.118] lstrlenA (lpString="C:\\Users\\Public\\Pictures") returned 24
	[0136.118] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Pictures\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x7cbb90
	[0136.118] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.118] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1
	[0136.119] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.119] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.119] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x1, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0136.119] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.119] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="desktop.ini") returned 1
	[0136.119] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="desktop.ini") returned 1
	[0136.119] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1
	[0136.119] PathFindFileNameA (pszPath="C:\\Users\\Public\\Pictures\\*.*") returned="*.*"
	[0136.119] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\Public\\Pictures\\" | out: lpString1="C:\\Users\\Public\\Pictures\\") returned="C:\\Users\\Public\\Pictures\\"
	[0136.119] PathAddBackslashA (in: pszPath="C:\\Users\\Public\\Pictures\\" | out: pszPath="C:\\Users\\Public\\Pictures\\") returned=""
	[0136.119] lstrcatA (in: lpString1="C:\\Users\\Public\\Pictures\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\Public\\Pictures\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\Public\\Pictures\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.119] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\public\\pictures\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.119] CreateFileA (lpFileName="C:\\Users\\Public\\Pictures\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\public\\pictures\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0136.119] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0136.119] WriteFile (in: hFile=0x20c, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0136.120] SetFileTime (hFile=0x20c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.120] CloseHandle (hObject=0x20c) returned 1
	[0136.120] lstrcatA (in: lpString1="C:\\Users\\Public\\Pictures\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\Public\\Pictures\\desktop.ini") returned="C:\\Users\\Public\\Pictures\\desktop.ini"
	[0136.121] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.zip") returned 0
	[0136.121] lstrlenA (lpString="*.zip") returned 5
	[0136.121] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.rar") returned 0
	[0136.121] lstrlenA (lpString="*.rar") returned 5
	[0136.121] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.7z") returned 0
	[0136.121] lstrlenA (lpString="*.7z") returned 4
	[0136.121] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.tar") returned 0
	[0136.121] lstrlenA (lpString="*.tar") returned 5
	[0136.121] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.gzip") returned 0
	[0136.121] lstrlenA (lpString="*.gzip") returned 6
	[0136.121] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.jpg") returned 0
	[0136.121] lstrlenA (lpString="*.jpg") returned 5
	[0136.121] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.jpeg") returned 0
	[0136.121] lstrlenA (lpString="*.jpeg") returned 6
	[0136.121] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.bmp") returned 0
	[0136.121] lstrlenA (lpString="*.bmp") returned 5
	[0136.121] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.gif") returned 0
	[0136.121] lstrlenA (lpString="*.gif") returned 5
	[0136.121] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.png") returned 0
	[0136.121] lstrlenA (lpString="*.png") returned 5
	[0136.121] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.doc") returned 0
	[0136.121] lstrlenA (lpString="*.doc") returned 5
	[0136.121] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.docx") returned 0
	[0136.121] lstrlenA (lpString="*.docx") returned 6
	[0136.121] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.xls") returned 0
	[0136.121] lstrlenA (lpString="*.xls") returned 5
	[0136.121] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.xlsx") returned 0
	[0136.121] lstrlenA (lpString="*.xlsx") returned 6
	[0136.121] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.ppt") returned 0
	[0136.121] lstrlenA (lpString="*.ppt") returned 5
	[0136.121] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.pptx") returned 0
	[0136.121] lstrlenA (lpString="*.pptx") returned 6
	[0136.121] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.txt") returned 0
	[0136.122] lstrlenA (lpString="*.txt") returned 5
	[0136.122] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.pdf") returned 0
	[0136.122] lstrlenA (lpString="*.pdf") returned 5
	[0136.122] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.htm") returned 0
	[0136.122] lstrlenA (lpString="*.htm") returned 5
	[0136.122] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.html") returned 0
	[0136.122] lstrlenA (lpString="*.html") returned 6
	[0136.122] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.mdb") returned 0
	[0136.122] lstrlenA (lpString="*.mdb") returned 5
	[0136.122] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.pfx") returned 0
	[0136.122] lstrlenA (lpString="*.pfx") returned 5
	[0136.122] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.md") returned 0
	[0136.122] lstrlenA (lpString="*.md") returned 4
	[0136.122] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.lnk") returned 0
	[0136.122] lstrlenA (lpString="*.lnk") returned 5
	[0136.122] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.torrent") returned 0
	[0136.122] lstrlenA (lpString="*.torrent") returned 9
	[0136.122] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.mov") returned 0
	[0136.122] lstrlenA (lpString="*.mov") returned 5
	[0136.122] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.3gp") returned 0
	[0136.122] lstrlenA (lpString="*.3gp") returned 5
	[0136.122] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.mpeg") returned 0
	[0136.122] lstrlenA (lpString="*.mpeg") returned 6
	[0136.122] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.mpg") returned 0
	[0136.122] lstrlenA (lpString="*.mpg") returned 5
	[0136.122] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.flv") returned 0
	[0136.122] lstrlenA (lpString="*.flv") returned 5
	[0136.122] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.avi") returned 0
	[0136.122] lstrlenA (lpString="*.avi") returned 5
	[0136.122] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.mp4") returned 0
	[0136.122] lstrlenA (lpString="*.mp4") returned 5
	[0136.122] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.wmv") returned 0
	[0136.122] lstrlenA (lpString="*.wmv") returned 5
	[0136.123] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.mkv") returned 0
	[0136.123] lstrlenA (lpString="*.mkv") returned 5
	[0136.123] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.mp3") returned 0
	[0136.123] lstrlenA (lpString="*.mp3") returned 5
	[0136.123] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.wav") returned 0
	[0136.123] lstrlenA (lpString="*.wav") returned 5
	[0136.123] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.flac") returned 0
	[0136.123] lstrlenA (lpString="*.flac") returned 6
	[0136.123] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.wma") returned 0
	[0136.123] lstrlenA (lpString="*.wma") returned 5
	[0136.123] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.au3") returned 0
	[0136.123] lstrlenA (lpString="*.au3") returned 5
	[0136.123] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.ahk") returned 0
	[0136.123] lstrlenA (lpString="*.ahk") returned 5
	[0136.123] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.c") returned 0
	[0136.123] lstrlenA (lpString="*.c") returned 3
	[0136.123] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.cc") returned 0
	[0136.123] lstrlenA (lpString="*.cc") returned 4
	[0136.123] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.cpp") returned 0
	[0136.123] lstrlenA (lpString="*.cpp") returned 5
	[0136.123] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.cxx") returned 0
	[0136.123] lstrlenA (lpString="*.cxx") returned 5
	[0136.123] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.c++") returned 0
	[0136.123] lstrlenA (lpString="*.c++") returned 5
	[0136.123] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.cs") returned 0
	[0136.123] lstrlenA (lpString="*.cs") returned 4
	[0136.123] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.vb") returned 0
	[0136.123] lstrlenA (lpString="*.vb") returned 4
	[0136.123] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.bas") returned 0
	[0136.123] lstrlenA (lpString="*.bas") returned 5
	[0136.123] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.csproj") returned 0
	[0136.123] lstrlenA (lpString="*.csproj") returned 8
	[0136.123] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.vbproj") returned 0
	[0136.123] lstrlenA (lpString="*.vbproj") returned 8
	[0136.124] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.vcxproj") returned 0
	[0136.124] lstrlenA (lpString="*.vcxproj") returned 9
	[0136.124] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.manifest") returned 0
	[0136.124] lstrlenA (lpString="*.manifest") returned 10
	[0136.124] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.php") returned 0
	[0136.124] lstrlenA (lpString="*.php") returned 5
	[0136.124] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.vbe") returned 0
	[0136.124] lstrlenA (lpString="*.vbe") returned 5
	[0136.124] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.vba") returned 0
	[0136.124] lstrlenA (lpString="*.vba") returned 5
	[0136.124] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.vbs") returned 0
	[0136.124] lstrlenA (lpString="*.vbs") returned 5
	[0136.124] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.bat") returned 0
	[0136.124] lstrlenA (lpString="*.bat") returned 5
	[0136.124] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.cmd") returned 0
	[0136.124] lstrlenA (lpString="*.cmd") returned 5
	[0136.124] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.js") returned 0
	[0136.124] lstrlenA (lpString="*.js") returned 4
	[0136.124] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.jscript") returned 0
	[0136.124] lstrlenA (lpString="*.jscript") returned 9
	[0136.124] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.hta") returned 0
	[0136.124] lstrlenA (lpString="*.hta") returned 5
	[0136.124] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.php7") returned 0
	[0136.124] lstrlenA (lpString="*.php7") returned 6
	[0136.124] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.db") returned 0
	[0136.124] lstrlenA (lpString="*.db") returned 4
	[0136.124] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.swf") returned 0
	[0136.124] lstrlenA (lpString="*.swf") returned 5
	[0136.124] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.eml") returned 0
	[0136.124] lstrlenA (lpString="*.eml") returned 5
	[0136.124] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.part") returned 0
	[0136.124] lstrlenA (lpString="*.part") returned 6
	[0136.124] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.nfo") returned 0
	[0136.124] lstrlenA (lpString="*.nfo") returned 5
	[0136.124] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.rsa") returned 0
	[0136.125] lstrlenA (lpString="*.rsa") returned 5
	[0136.125] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.key") returned 0
	[0136.125] lstrlenA (lpString="*.key") returned 5
	[0136.125] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.aes") returned 0
	[0136.125] lstrlenA (lpString="*.aes") returned 5
	[0136.125] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.blob") returned 0
	[0136.125] lstrlenA (lpString="*.blob") returned 6
	[0136.125] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.btc") returned 0
	[0136.125] lstrlenA (lpString="*.btc") returned 5
	[0136.125] PathMatchSpecA (pszFile="C:\\Users\\Public\\Pictures\\desktop.ini", pszSpec="*.wallet") returned 0
	[0136.125] lstrlenA (lpString="*.wallet") returned 8
	[0136.125] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x1, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0136.125] FindClose (in: hFindFile=0x7cbb90 | out: hFindFile=0x7cbb90) returned 1
	[0136.125] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1
	[0136.125] lstrcmpA (lpString1=".", lpString2="Videos") returned -1
	[0136.125] lstrcmpA (lpString1="..", lpString2="Videos") returned -1
	[0136.125] PathFindFileNameA (pszPath="C:\\Users\\Public\\*.*") returned="*.*"
	[0136.125] lstrcatA (in: lpString1="C:\\Users\\Public\\", lpString2="Videos" | out: lpString1="C:\\Users\\Public\\Videos") returned="C:\\Users\\Public\\Videos"
	[0136.125] lstrlenA (lpString="C:\\Users\\Public\\Videos") returned 22
	[0136.125] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Videos\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x7cb890
	[0136.125] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.125] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1
	[0136.125] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.125] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.125] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x1, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0136.126] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.126] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="desktop.ini") returned 1
	[0136.126] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="desktop.ini") returned 1
	[0136.126] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1
	[0136.126] PathFindFileNameA (pszPath="C:\\Users\\Public\\Videos\\*.*") returned="*.*"
	[0136.126] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\Public\\Videos\\" | out: lpString1="C:\\Users\\Public\\Videos\\") returned="C:\\Users\\Public\\Videos\\"
	[0136.126] PathAddBackslashA (in: pszPath="C:\\Users\\Public\\Videos\\" | out: pszPath="C:\\Users\\Public\\Videos\\") returned=""
	[0136.126] lstrcatA (in: lpString1="C:\\Users\\Public\\Videos\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Users\\Public\\Videos\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Users\\Public\\Videos\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.126] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Videos\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\public\\videos\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.126] CreateFileA (lpFileName="C:\\Users\\Public\\Videos\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\users\\public\\videos\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0136.127] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0136.127] WriteFile (in: hFile=0x20c, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0136.128] SetFileTime (hFile=0x20c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.128] CloseHandle (hObject=0x20c) returned 1
	[0136.128] lstrcatA (in: lpString1="C:\\Users\\Public\\Videos\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\Public\\Videos\\desktop.ini") returned="C:\\Users\\Public\\Videos\\desktop.ini"
	[0136.128] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.zip") returned 0
	[0136.128] lstrlenA (lpString="*.zip") returned 5
	[0136.128] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.rar") returned 0
	[0136.128] lstrlenA (lpString="*.rar") returned 5
	[0136.128] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.7z") returned 0
	[0136.128] lstrlenA (lpString="*.7z") returned 4
	[0136.128] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.tar") returned 0
	[0136.128] lstrlenA (lpString="*.tar") returned 5
	[0136.128] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.gzip") returned 0
	[0136.128] lstrlenA (lpString="*.gzip") returned 6
	[0136.128] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.jpg") returned 0
	[0136.129] lstrlenA (lpString="*.jpg") returned 5
	[0136.129] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.jpeg") returned 0
	[0136.129] lstrlenA (lpString="*.jpeg") returned 6
	[0136.129] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.bmp") returned 0
	[0136.129] lstrlenA (lpString="*.bmp") returned 5
	[0136.129] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.gif") returned 0
	[0136.129] lstrlenA (lpString="*.gif") returned 5
	[0136.129] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.png") returned 0
	[0136.129] lstrlenA (lpString="*.png") returned 5
	[0136.129] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.doc") returned 0
	[0136.129] lstrlenA (lpString="*.doc") returned 5
	[0136.129] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.docx") returned 0
	[0136.129] lstrlenA (lpString="*.docx") returned 6
	[0136.129] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.xls") returned 0
	[0136.129] lstrlenA (lpString="*.xls") returned 5
	[0136.129] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.xlsx") returned 0
	[0136.129] lstrlenA (lpString="*.xlsx") returned 6
	[0136.129] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.ppt") returned 0
	[0136.129] lstrlenA (lpString="*.ppt") returned 5
	[0136.129] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.pptx") returned 0
	[0136.129] lstrlenA (lpString="*.pptx") returned 6
	[0136.129] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.txt") returned 0
	[0136.129] lstrlenA (lpString="*.txt") returned 5
	[0136.129] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.pdf") returned 0
	[0136.129] lstrlenA (lpString="*.pdf") returned 5
	[0136.129] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.htm") returned 0
	[0136.129] lstrlenA (lpString="*.htm") returned 5
	[0136.129] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.html") returned 0
	[0136.129] lstrlenA (lpString="*.html") returned 6
	[0136.129] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.mdb") returned 0
	[0136.129] lstrlenA (lpString="*.mdb") returned 5
	[0136.129] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.pfx") returned 0
	[0136.129] lstrlenA (lpString="*.pfx") returned 5
	[0136.129] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.md") returned 0
	[0136.130] lstrlenA (lpString="*.md") returned 4
	[0136.130] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.lnk") returned 0
	[0136.130] lstrlenA (lpString="*.lnk") returned 5
	[0136.130] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.torrent") returned 0
	[0136.130] lstrlenA (lpString="*.torrent") returned 9
	[0136.130] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.mov") returned 0
	[0136.130] lstrlenA (lpString="*.mov") returned 5
	[0136.130] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.3gp") returned 0
	[0136.130] lstrlenA (lpString="*.3gp") returned 5
	[0136.130] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.mpeg") returned 0
	[0136.130] lstrlenA (lpString="*.mpeg") returned 6
	[0136.130] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.mpg") returned 0
	[0136.130] lstrlenA (lpString="*.mpg") returned 5
	[0136.130] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.flv") returned 0
	[0136.130] lstrlenA (lpString="*.flv") returned 5
	[0136.130] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.avi") returned 0
	[0136.130] lstrlenA (lpString="*.avi") returned 5
	[0136.130] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.mp4") returned 0
	[0136.130] lstrlenA (lpString="*.mp4") returned 5
	[0136.130] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.wmv") returned 0
	[0136.130] lstrlenA (lpString="*.wmv") returned 5
	[0136.130] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.mkv") returned 0
	[0136.130] lstrlenA (lpString="*.mkv") returned 5
	[0136.130] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.mp3") returned 0
	[0136.130] lstrlenA (lpString="*.mp3") returned 5
	[0136.130] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.wav") returned 0
	[0136.130] lstrlenA (lpString="*.wav") returned 5
	[0136.130] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.flac") returned 0
	[0136.130] lstrlenA (lpString="*.flac") returned 6
	[0136.130] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.wma") returned 0
	[0136.130] lstrlenA (lpString="*.wma") returned 5
	[0136.130] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.au3") returned 0
	[0136.130] lstrlenA (lpString="*.au3") returned 5
	[0136.130] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.ahk") returned 0
	[0136.131] lstrlenA (lpString="*.ahk") returned 5
	[0136.131] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.c") returned 0
	[0136.131] lstrlenA (lpString="*.c") returned 3
	[0136.131] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.cc") returned 0
	[0136.131] lstrlenA (lpString="*.cc") returned 4
	[0136.131] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.cpp") returned 0
	[0136.131] lstrlenA (lpString="*.cpp") returned 5
	[0136.131] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.cxx") returned 0
	[0136.131] lstrlenA (lpString="*.cxx") returned 5
	[0136.131] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.c++") returned 0
	[0136.131] lstrlenA (lpString="*.c++") returned 5
	[0136.131] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.cs") returned 0
	[0136.131] lstrlenA (lpString="*.cs") returned 4
	[0136.131] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.vb") returned 0
	[0136.131] lstrlenA (lpString="*.vb") returned 4
	[0136.131] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.bas") returned 0
	[0136.131] lstrlenA (lpString="*.bas") returned 5
	[0136.131] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.csproj") returned 0
	[0136.131] lstrlenA (lpString="*.csproj") returned 8
	[0136.131] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.vbproj") returned 0
	[0136.131] lstrlenA (lpString="*.vbproj") returned 8
	[0136.131] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.vcxproj") returned 0
	[0136.131] lstrlenA (lpString="*.vcxproj") returned 9
	[0136.131] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.manifest") returned 0
	[0136.131] lstrlenA (lpString="*.manifest") returned 10
	[0136.131] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.php") returned 0
	[0136.131] lstrlenA (lpString="*.php") returned 5
	[0136.131] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.vbe") returned 0
	[0136.131] lstrlenA (lpString="*.vbe") returned 5
	[0136.131] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.vba") returned 0
	[0136.131] lstrlenA (lpString="*.vba") returned 5
	[0136.131] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.vbs") returned 0
	[0136.131] lstrlenA (lpString="*.vbs") returned 5
	[0136.131] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.bat") returned 0
	[0136.131] lstrlenA (lpString="*.bat") returned 5
	[0136.132] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.cmd") returned 0
	[0136.132] lstrlenA (lpString="*.cmd") returned 5
	[0136.132] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.js") returned 0
	[0136.132] lstrlenA (lpString="*.js") returned 4
	[0136.132] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.jscript") returned 0
	[0136.132] lstrlenA (lpString="*.jscript") returned 9
	[0136.132] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.hta") returned 0
	[0136.132] lstrlenA (lpString="*.hta") returned 5
	[0136.132] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.php7") returned 0
	[0136.132] lstrlenA (lpString="*.php7") returned 6
	[0136.132] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.db") returned 0
	[0136.132] lstrlenA (lpString="*.db") returned 4
	[0136.132] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.swf") returned 0
	[0136.132] lstrlenA (lpString="*.swf") returned 5
	[0136.132] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.eml") returned 0
	[0136.132] lstrlenA (lpString="*.eml") returned 5
	[0136.132] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.part") returned 0
	[0136.132] lstrlenA (lpString="*.part") returned 6
	[0136.132] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.nfo") returned 0
	[0136.132] lstrlenA (lpString="*.nfo") returned 5
	[0136.132] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.rsa") returned 0
	[0136.132] lstrlenA (lpString="*.rsa") returned 5
	[0136.132] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.key") returned 0
	[0136.132] lstrlenA (lpString="*.key") returned 5
	[0136.132] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.aes") returned 0
	[0136.132] lstrlenA (lpString="*.aes") returned 5
	[0136.132] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.blob") returned 0
	[0136.132] lstrlenA (lpString="*.blob") returned 6
	[0136.132] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.btc") returned 0
	[0136.132] lstrlenA (lpString="*.btc") returned 5
	[0136.132] PathMatchSpecA (pszFile="C:\\Users\\Public\\Videos\\desktop.ini", pszSpec="*.wallet") returned 0
	[0136.133] lstrlenA (lpString="*.wallet") returned 8
	[0136.133] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x1, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0136.133] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1
	[0136.133] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0
	[0136.133] FindClose (in: hFindFile=0x7cb9d0 | out: hFindFile=0x7cb9d0) returned 1
	[0136.133] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3030312d, dwReserved1=0x2e2d7d30, cFileName="Public", cAlternateFileName="")) returned 0
	[0136.133] FindClose (in: hFindFile=0x7cbc50 | out: hFindFile=0x7cbc50) returned 1
	[0136.133] FindNextFileA (in: hFindFile=0x7cba90, lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x434d542e, dwReserved1=0x61746e6f, cFileName="Windows", cAlternateFileName="")) returned 1
	[0136.133] lstrcmpA (lpString1=".", lpString2="Windows") returned -1
	[0136.133] lstrcmpA (lpString1="..", lpString2="Windows") returned -1
	[0136.133] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*"
	[0136.133] lstrcatA (in: lpString1="C:\\", lpString2="Windows" | out: lpString1="C:\\Windows") returned="C:\\Windows"
	[0136.133] lstrlenA (lpString="C:\\Windows") returned 10
	[0136.133] FindFirstFileA (in: lpFileName="C:\\Windows\\*.*", lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb850
	[0136.133] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.133] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.133] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.133] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.133] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd48678d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa55324, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="addins", cAlternateFileName="")) returned 1
	[0136.134] lstrcmpA (lpString1=".", lpString2="addins") returned -1
	[0136.134] lstrcmpA (lpString1="..", lpString2="addins") returned -1
	[0136.134] PathFindFileNameA (pszPath="C:\\Windows\\*.*") returned="*.*"
	[0136.134] lstrcatA (in: lpString1="C:\\Windows\\", lpString2="addins" | out: lpString1="C:\\Windows\\addins") returned="C:\\Windows\\addins"
	[0136.134] lstrlenA (lpString="C:\\Windows\\addins") returned 17
	[0136.134] FindFirstFileA (in: lpFileName="C:\\Windows\\addins\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd48678d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa55324, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cb790
	[0136.134] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.134] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd48678d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa55324, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0136.134] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.134] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.134] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d027e99, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9d027e99, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9d027e99, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x322, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="FXSEXT.ecf", cAlternateFileName="")) returned 1
	[0136.134] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0136.134] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="FXSEXT.ecf") returned -1
	[0136.134] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="FXSEXT.ecf") returned 1
	[0136.134] lstrcmpiA (lpString1="", lpString2="FXSEXT.ecf") returned -1
	[0136.134] PathFindFileNameA (pszPath="C:\\Windows\\addins\\*.*") returned="*.*"
	[0136.134] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\addins\\" | out: lpString1="C:\\Windows\\addins\\") returned="C:\\Windows\\addins\\"
	[0136.134] PathAddBackslashA (in: pszPath="C:\\Windows\\addins\\" | out: pszPath="C:\\Windows\\addins\\") returned=""
	[0136.134] lstrcatA (in: lpString1="C:\\Windows\\addins\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\addins\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\addins\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.134] GetFileAttributesA (lpFileName="C:\\Windows\\addins\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\addins\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.134] CreateFileA (lpFileName="C:\\Windows\\addins\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\addins\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0136.135] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0136.135] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0136.136] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.136] CloseHandle (hObject=0x208) returned 1
	[0136.136] lstrcatA (in: lpString1="C:\\Windows\\addins\\", lpString2="FXSEXT.ecf" | out: lpString1="C:\\Windows\\addins\\FXSEXT.ecf") returned="C:\\Windows\\addins\\FXSEXT.ecf"
	[0136.136] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.zip") returned 0
	[0136.136] lstrlenA (lpString="*.zip") returned 5
	[0136.136] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.rar") returned 0
	[0136.136] lstrlenA (lpString="*.rar") returned 5
	[0136.136] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.7z") returned 0
	[0136.136] lstrlenA (lpString="*.7z") returned 4
	[0136.136] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.tar") returned 0
	[0136.136] lstrlenA (lpString="*.tar") returned 5
	[0136.136] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.gzip") returned 0
	[0136.136] lstrlenA (lpString="*.gzip") returned 6
	[0136.136] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.jpg") returned 0
	[0136.136] lstrlenA (lpString="*.jpg") returned 5
	[0136.136] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.jpeg") returned 0
	[0136.136] lstrlenA (lpString="*.jpeg") returned 6
	[0136.137] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.bmp") returned 0
	[0136.137] lstrlenA (lpString="*.bmp") returned 5
	[0136.137] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.gif") returned 0
	[0136.137] lstrlenA (lpString="*.gif") returned 5
	[0136.137] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.png") returned 0
	[0136.137] lstrlenA (lpString="*.png") returned 5
	[0136.137] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.doc") returned 0
	[0136.137] lstrlenA (lpString="*.doc") returned 5
	[0136.137] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.docx") returned 0
	[0136.137] lstrlenA (lpString="*.docx") returned 6
	[0136.137] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.xls") returned 0
	[0136.137] lstrlenA (lpString="*.xls") returned 5
	[0136.137] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.xlsx") returned 0
	[0136.137] lstrlenA (lpString="*.xlsx") returned 6
	[0136.137] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.ppt") returned 0
	[0136.137] lstrlenA (lpString="*.ppt") returned 5
	[0136.137] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.pptx") returned 0
	[0136.137] lstrlenA (lpString="*.pptx") returned 6
	[0136.137] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.txt") returned 0
	[0136.137] lstrlenA (lpString="*.txt") returned 5
	[0136.137] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.pdf") returned 0
	[0136.137] lstrlenA (lpString="*.pdf") returned 5
	[0136.137] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.htm") returned 0
	[0136.137] lstrlenA (lpString="*.htm") returned 5
	[0136.137] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.html") returned 0
	[0136.137] lstrlenA (lpString="*.html") returned 6
	[0136.137] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.mdb") returned 0
	[0136.137] lstrlenA (lpString="*.mdb") returned 5
	[0136.137] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.pfx") returned 0
	[0136.137] lstrlenA (lpString="*.pfx") returned 5
	[0136.137] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.md") returned 0
	[0136.137] lstrlenA (lpString="*.md") returned 4
	[0136.137] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.lnk") returned 0
	[0136.138] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.torrent") returned 0
	[0136.138] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.mov") returned 0
	[0136.138] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.3gp") returned 0
	[0136.138] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.mpeg") returned 0
	[0136.138] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.mpg") returned 0
	[0136.138] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.flv") returned 0
	[0136.138] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.avi") returned 0
	[0136.138] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.mp4") returned 0
	[0136.138] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.wmv") returned 0
	[0136.138] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.mkv") returned 0
	[0136.138] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.mp3") returned 0
	[0136.138] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.wav") returned 0
	[0136.138] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.flac") returned 0
	[0136.138] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.wma") returned 0
	[0136.138] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.au3") returned 0
	[0136.138] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.ahk") returned 0
	[0136.138] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.c") returned 0
	[0136.138] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.cc") returned 0
	[0136.138] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.cpp") returned 0
	[0136.138] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.cxx") returned 0
	[0136.138] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.c++") returned 0
	[0136.138] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.cs") returned 0
	[0136.138] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.vb") returned 0
	[0136.138] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.bas") returned 0
	[0136.139] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.csproj") returned 0
	[0136.139] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.vbproj") returned 0
	[0136.139] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.vcxproj") returned 0
	[0136.139] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.manifest") returned 0
	[0136.139] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.php") returned 0
	[0136.139] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.vbe") returned 0
	[0136.139] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.vba") returned 0
	[0136.139] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.vbs") returned 0
	[0136.139] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.bat") returned 0
	[0136.139] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.cmd") returned 0
	[0136.139] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.js") returned 0
	[0136.139] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.jscript") returned 0
	[0136.139] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.hta") returned 0
	[0136.139] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.php7") returned 0
	[0136.139] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.db") returned 0
	[0136.139] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.swf") returned 0
	[0136.139] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.eml") returned 0
	[0136.139] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.part") returned 0
	[0136.139] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.nfo") returned 0
	[0136.139] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.rsa") returned 0
	[0136.139] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.key") returned 0
	[0136.139] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.aes") returned 0
	[0136.139] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.blob") returned 0
	[0136.139] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.btc") returned 0
	[0136.139] PathMatchSpecA (pszFile="C:\\Windows\\addins\\FXSEXT.ecf", pszSpec="*.wallet") returned 0
	[0136.139] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d027e99, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9d027e99, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9d027e99, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x322, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="FXSEXT.ecf", cAlternateFileName="")) returned 0
	[0136.140] FindClose (in: hFindFile=0x7cb790 | out: hFindFile=0x7cb790) returned 1
	[0136.140] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb7482c44, ftLastAccessTime.dwHighDateTime=0x1d3278b, ftLastWriteTime.dwLowDateTime=0xb7482c44, ftLastWriteTime.dwHighDateTime=0x1d3278b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="appcompat", cAlternateFileName="APPCOM~1")) returned 1
	[0136.140] lstrcmpA (lpString1=".", lpString2="appcompat") returned -1
	[0136.140] lstrcmpA (lpString1="..", lpString2="appcompat") returned -1
	[0136.140] PathFindFileNameA (pszPath="C:\\Windows\\*.*") returned="*.*"
	[0136.140] lstrcatA (in: lpString1="C:\\Windows\\", lpString2="appcompat" | out: lpString1="C:\\Windows\\appcompat") returned="C:\\Windows\\appcompat"
	[0136.140] FindFirstFileA (in: lpFileName="C:\\Windows\\appcompat\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb7482c44, ftLastAccessTime.dwHighDateTime=0x1d3278b, ftLastWriteTime.dwLowDateTime=0xb7482c44, ftLastWriteTime.dwHighDateTime=0x1d3278b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb690
	[0136.140] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.140] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb7482c44, ftLastAccessTime.dwHighDateTime=0x1d3278b, ftLastWriteTime.dwLowDateTime=0xb7482c44, ftLastWriteTime.dwHighDateTime=0x1d3278b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.140] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.140] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.140] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd2e4b434, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xd2e4b434, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="appraiser", cAlternateFileName="APPRAI~1")) returned 1
	[0136.140] lstrcmpA (lpString1=".", lpString2="appraiser") returned -1
	[0136.140] lstrcmpA (lpString1="..", lpString2="appraiser") returned -1
	[0136.140] PathFindFileNameA (pszPath="C:\\Windows\\appcompat\\*.*") returned="*.*"
	[0136.140] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\", lpString2="appraiser" | out: lpString1="C:\\Windows\\appcompat\\appraiser") returned="C:\\Windows\\appcompat\\appraiser"
	[0136.140] FindFirstFileA (in: lpFileName="C:\\Windows\\appcompat\\appraiser\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd2e4b434, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xd2e4b434, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cbad0
	[0136.142] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.142] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd2e4b434, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xd2e4b434, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0136.142] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.142] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.142] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf108980, ftCreationTime.dwHighDateTime=0x1d336d7, ftLastAccessTime.dwLowDateTime=0xe6118a0, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0xe6118a0, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="AltData", cAlternateFileName="")) returned 1
	[0136.142] lstrcmpA (lpString1=".", lpString2="AltData") returned -1
	[0136.142] lstrcmpA (lpString1="..", lpString2="AltData") returned -1
	[0136.142] PathFindFileNameA (pszPath="C:\\Windows\\appcompat\\appraiser\\*.*") returned="*.*"
	[0136.142] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\appraiser\\", lpString2="AltData" | out: lpString1="C:\\Windows\\appcompat\\appraiser\\AltData") returned="C:\\Windows\\appcompat\\appraiser\\AltData"
	[0136.142] FindFirstFileA (in: lpFileName="C:\\Windows\\appcompat\\appraiser\\AltData\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf108980, ftCreationTime.dwHighDateTime=0x1d336d7, ftLastAccessTime.dwLowDateTime=0xe6118a0, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0xe6118a0, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb9d0
	[0136.142] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.142] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf108980, ftCreationTime.dwHighDateTime=0x1d336d7, ftLastAccessTime.dwLowDateTime=0xe6118a0, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0xe6118a0, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.142] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.142] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.142] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf108980, ftCreationTime.dwHighDateTime=0x1d336d7, ftLastAccessTime.dwLowDateTime=0xe6118a0, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0xe6118a0, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0136.142] FindClose (in: hFindFile=0x7cb9d0 | out: hFindFile=0x7cb9d0) returned 1
	[0136.143] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbeaa0c0b, ftCreationTime.dwHighDateTime=0x1d336d7, ftLastAccessTime.dwLowDateTime=0xbeaa0c0b, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0xbf0bc51e, ftLastWriteTime.dwHighDateTime=0x1d336d7, nFileSizeHigh=0x0, nFileSizeLow=0x2567ac, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Appraiser_AlternateData.cab", cAlternateFileName="APPRAI~1.CAB")) returned 1
	[0136.143] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.143] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Appraiser_AlternateData.cab") returned 1
	[0136.143] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Appraiser_AlternateData.cab") returned 1
	[0136.143] lstrcmpiA (lpString1="", lpString2="Appraiser_AlternateData.cab") returned -1
	[0136.143] PathFindFileNameA (pszPath="C:\\Windows\\appcompat\\appraiser\\*.*") returned="*.*"
	[0136.143] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\appcompat\\appraiser\\" | out: lpString1="C:\\Windows\\appcompat\\appraiser\\") returned="C:\\Windows\\appcompat\\appraiser\\"
	[0136.143] PathAddBackslashA (in: pszPath="C:\\Windows\\appcompat\\appraiser\\" | out: pszPath="C:\\Windows\\appcompat\\appraiser\\") returned=""
	[0136.143] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\appraiser\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\appcompat\\appraiser\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\appcompat\\appraiser\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.143] GetFileAttributesA (lpFileName="C:\\Windows\\appcompat\\appraiser\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\appcompat\\appraiser\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.143] CreateFileA (lpFileName="C:\\Windows\\appcompat\\appraiser\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\appcompat\\appraiser\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0136.144] WriteFile (in: hFile=0x20c, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0136.145] SetFileTime (hFile=0x20c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.145] CloseHandle (hObject=0x20c) returned 1
	[0136.145] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\appraiser\\", lpString2="Appraiser_AlternateData.cab" | out: lpString1="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab") returned="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab"
	[0136.145] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.zip") returned 0
	[0136.145] lstrlenA (lpString="*.zip") returned 5
	[0136.145] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.rar") returned 0
	[0136.145] lstrlenA (lpString="*.rar") returned 5
	[0136.145] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.7z") returned 0
	[0136.145] lstrlenA (lpString="*.7z") returned 4
	[0136.145] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.tar") returned 0
	[0136.145] lstrlenA (lpString="*.tar") returned 5
	[0136.145] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.gzip") returned 0
	[0136.145] lstrlenA (lpString="*.gzip") returned 6
	[0136.145] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.jpg") returned 0
	[0136.145] lstrlenA (lpString="*.jpg") returned 5
	[0136.145] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.jpeg") returned 0
	[0136.145] lstrlenA (lpString="*.jpeg") returned 6
	[0136.145] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.bmp") returned 0
	[0136.145] lstrlenA (lpString="*.bmp") returned 5
	[0136.145] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.gif") returned 0
	[0136.145] lstrlenA (lpString="*.gif") returned 5
	[0136.145] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.png") returned 0
	[0136.145] lstrlenA (lpString="*.png") returned 5
	[0136.145] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.doc") returned 0
	[0136.145] lstrlenA (lpString="*.doc") returned 5
	[0136.145] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.docx") returned 0
	[0136.145] lstrlenA (lpString="*.docx") returned 6
	[0136.145] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.xls") returned 0
	[0136.145] lstrlenA (lpString="*.xls") returned 5
	[0136.145] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.xlsx") returned 0
	[0136.146] lstrlenA (lpString="*.xlsx") returned 6
	[0136.146] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.ppt") returned 0
	[0136.146] lstrlenA (lpString="*.ppt") returned 5
	[0136.146] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.pptx") returned 0
	[0136.146] lstrlenA (lpString="*.pptx") returned 6
	[0136.146] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.txt") returned 0
	[0136.146] lstrlenA (lpString="*.txt") returned 5
	[0136.146] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.pdf") returned 0
	[0136.146] lstrlenA (lpString="*.pdf") returned 5
	[0136.146] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.htm") returned 0
	[0136.146] lstrlenA (lpString="*.htm") returned 5
	[0136.146] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.html") returned 0
	[0136.146] lstrlenA (lpString="*.html") returned 6
	[0136.146] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.mdb") returned 0
	[0136.146] lstrlenA (lpString="*.mdb") returned 5
	[0136.146] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.pfx") returned 0
	[0136.146] lstrlenA (lpString="*.pfx") returned 5
	[0136.146] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.md") returned 0
	[0136.146] lstrlenA (lpString="*.md") returned 4
	[0136.146] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.lnk") returned 0
	[0136.146] lstrlenA (lpString="*.lnk") returned 5
	[0136.146] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.torrent") returned 0
	[0136.146] lstrlenA (lpString="*.torrent") returned 9
	[0136.146] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.mov") returned 0
	[0136.146] lstrlenA (lpString="*.mov") returned 5
	[0136.146] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.3gp") returned 0
	[0136.146] lstrlenA (lpString="*.3gp") returned 5
	[0136.146] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.mpeg") returned 0
	[0136.146] lstrlenA (lpString="*.mpeg") returned 6
	[0136.146] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.mpg") returned 0
	[0136.146] lstrlenA (lpString="*.mpg") returned 5
	[0136.146] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.flv") returned 0
	[0136.146] lstrlenA (lpString="*.flv") returned 5
	[0136.147] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.avi") returned 0
	[0136.147] lstrlenA (lpString="*.avi") returned 5
	[0136.147] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.mp4") returned 0
	[0136.147] lstrlenA (lpString="*.mp4") returned 5
	[0136.147] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.wmv") returned 0
	[0136.147] lstrlenA (lpString="*.wmv") returned 5
	[0136.147] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.mkv") returned 0
	[0136.147] lstrlenA (lpString="*.mkv") returned 5
	[0136.147] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.mp3") returned 0
	[0136.147] lstrlenA (lpString="*.mp3") returned 5
	[0136.147] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.wav") returned 0
	[0136.147] lstrlenA (lpString="*.wav") returned 5
	[0136.147] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.flac") returned 0
	[0136.147] lstrlenA (lpString="*.flac") returned 6
	[0136.147] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.wma") returned 0
	[0136.147] lstrlenA (lpString="*.wma") returned 5
	[0136.147] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.au3") returned 0
	[0136.147] lstrlenA (lpString="*.au3") returned 5
	[0136.147] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.ahk") returned 0
	[0136.147] lstrlenA (lpString="*.ahk") returned 5
	[0136.147] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.c") returned 0
	[0136.147] lstrlenA (lpString="*.c") returned 3
	[0136.147] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.cc") returned 0
	[0136.147] lstrlenA (lpString="*.cc") returned 4
	[0136.147] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.cpp") returned 0
	[0136.147] lstrlenA (lpString="*.cpp") returned 5
	[0136.147] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.cxx") returned 0
	[0136.147] lstrlenA (lpString="*.cxx") returned 5
	[0136.147] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.c++") returned 0
	[0136.147] lstrlenA (lpString="*.c++") returned 5
	[0136.147] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.cs") returned 0
	[0136.147] lstrlenA (lpString="*.cs") returned 4
	[0136.147] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.vb") returned 0
	[0136.147] lstrlenA (lpString="*.vb") returned 4
	[0136.147] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.bas") returned 0
	[0136.148] lstrlenA (lpString="*.bas") returned 5
	[0136.148] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.csproj") returned 0
	[0136.148] lstrlenA (lpString="*.csproj") returned 8
	[0136.148] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.vbproj") returned 0
	[0136.148] lstrlenA (lpString="*.vbproj") returned 8
	[0136.148] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.vcxproj") returned 0
	[0136.148] lstrlenA (lpString="*.vcxproj") returned 9
	[0136.148] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.manifest") returned 0
	[0136.148] lstrlenA (lpString="*.manifest") returned 10
	[0136.148] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.php") returned 0
	[0136.148] lstrlenA (lpString="*.php") returned 5
	[0136.148] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.vbe") returned 0
	[0136.148] lstrlenA (lpString="*.vbe") returned 5
	[0136.148] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.vba") returned 0
	[0136.148] lstrlenA (lpString="*.vba") returned 5
	[0136.148] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.vbs") returned 0
	[0136.148] lstrlenA (lpString="*.vbs") returned 5
	[0136.148] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.bat") returned 0
	[0136.148] lstrlenA (lpString="*.bat") returned 5
	[0136.148] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.cmd") returned 0
	[0136.148] lstrlenA (lpString="*.cmd") returned 5
	[0136.148] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.js") returned 0
	[0136.148] lstrlenA (lpString="*.js") returned 4
	[0136.148] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.jscript") returned 0
	[0136.148] lstrlenA (lpString="*.jscript") returned 9
	[0136.148] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.hta") returned 0
	[0136.148] lstrlenA (lpString="*.hta") returned 5
	[0136.149] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.php7") returned 0
	[0136.149] lstrlenA (lpString="*.php7") returned 6
	[0136.149] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.db") returned 0
	[0136.149] lstrlenA (lpString="*.db") returned 4
	[0136.149] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.swf") returned 0
	[0136.149] lstrlenA (lpString="*.swf") returned 5
	[0136.149] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.eml") returned 0
	[0136.149] lstrlenA (lpString="*.eml") returned 5
	[0136.149] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.part") returned 0
	[0136.149] lstrlenA (lpString="*.part") returned 6
	[0136.149] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.nfo") returned 0
	[0136.149] lstrlenA (lpString="*.nfo") returned 5
	[0136.149] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.rsa") returned 0
	[0136.149] lstrlenA (lpString="*.rsa") returned 5
	[0136.149] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.key") returned 0
	[0136.149] lstrlenA (lpString="*.key") returned 5
	[0136.149] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.aes") returned 0
	[0136.149] lstrlenA (lpString="*.aes") returned 5
	[0136.149] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.blob") returned 0
	[0136.149] lstrlenA (lpString="*.blob") returned 6
	[0136.149] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.btc") returned 0
	[0136.149] lstrlenA (lpString="*.btc") returned 5
	[0136.149] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab", pszSpec="*.wallet") returned 0
	[0136.149] lstrlenA (lpString="*.wallet") returned 8
	[0136.149] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7db92, ftCreationTime.dwHighDateTime=0x1d3278c, ftLastAccessTime.dwLowDateTime=0x3d7db92, ftLastAccessTime.dwHighDateTime=0x1d3278c, ftLastWriteTime.dwLowDateTime=0xcd6b413f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0xf1e0, dwReserved0=0x0, dwReserved1=0x1, cFileName="APPRAISER_FileInventory.xml", cAlternateFileName="APPRAI~1.XML")) returned 1
	[0136.149] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.149] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="APPRAISER_FileInventory.xml") returned 1
	[0136.149] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="APPRAISER_FileInventory.xml") returned 1
	[0136.149] lstrcmpiA (lpString1="", lpString2="APPRAISER_FileInventory.xml") returned -1
	[0136.149] PathFindFileNameA (pszPath="C:\\Windows\\appcompat\\appraiser\\Appraiser_AlternateData.cab") returned="Appraiser_AlternateData.cab"
	[0136.149] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\appcompat\\appraiser\\" | out: lpString1="C:\\Windows\\appcompat\\appraiser\\") returned="C:\\Windows\\appcompat\\appraiser\\"
	[0136.149] PathAddBackslashA (in: pszPath="C:\\Windows\\appcompat\\appraiser\\" | out: pszPath="C:\\Windows\\appcompat\\appraiser\\") returned=""
	[0136.149] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\appraiser\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\appcompat\\appraiser\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\appcompat\\appraiser\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.150] GetFileAttributesA (lpFileName="C:\\Windows\\appcompat\\appraiser\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\appcompat\\appraiser\\how-to-decrypt-files.htm")) returned 0x20
	[0136.150] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\appraiser\\", lpString2="APPRAISER_FileInventory.xml" | out: lpString1="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml") returned="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml"
	[0136.150] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.zip") returned 0
	[0136.150] lstrlenA (lpString="*.zip") returned 5
	[0136.150] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.rar") returned 0
	[0136.150] lstrlenA (lpString="*.rar") returned 5
	[0136.150] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.7z") returned 0
	[0136.150] lstrlenA (lpString="*.7z") returned 4
	[0136.150] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.tar") returned 0
	[0136.150] lstrlenA (lpString="*.tar") returned 5
	[0136.150] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.gzip") returned 0
	[0136.150] lstrlenA (lpString="*.gzip") returned 6
	[0136.150] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.jpg") returned 0
	[0136.150] lstrlenA (lpString="*.jpg") returned 5
	[0136.150] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.jpeg") returned 0
	[0136.150] lstrlenA (lpString="*.jpeg") returned 6
	[0136.150] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.bmp") returned 0
	[0136.150] lstrlenA (lpString="*.bmp") returned 5
	[0136.150] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.gif") returned 0
	[0136.150] lstrlenA (lpString="*.gif") returned 5
	[0136.150] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.png") returned 0
	[0136.150] lstrlenA (lpString="*.png") returned 5
	[0136.150] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.doc") returned 0
	[0136.150] lstrlenA (lpString="*.doc") returned 5
	[0136.150] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.docx") returned 0
	[0136.150] lstrlenA (lpString="*.docx") returned 6
	[0136.150] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.xls") returned 0
	[0136.150] lstrlenA (lpString="*.xls") returned 5
	[0136.150] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.xlsx") returned 0
	[0136.150] lstrlenA (lpString="*.xlsx") returned 6
	[0136.151] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.ppt") returned 0
	[0136.151] lstrlenA (lpString="*.ppt") returned 5
	[0136.151] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.pptx") returned 0
	[0136.151] lstrlenA (lpString="*.pptx") returned 6
	[0136.151] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.txt") returned 0
	[0136.151] lstrlenA (lpString="*.txt") returned 5
	[0136.151] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.pdf") returned 0
	[0136.151] lstrlenA (lpString="*.pdf") returned 5
	[0136.151] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.htm") returned 0
	[0136.151] lstrlenA (lpString="*.htm") returned 5
	[0136.151] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.html") returned 0
	[0136.151] lstrlenA (lpString="*.html") returned 6
	[0136.151] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.mdb") returned 0
	[0136.151] lstrlenA (lpString="*.mdb") returned 5
	[0136.151] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.pfx") returned 0
	[0136.151] lstrlenA (lpString="*.pfx") returned 5
	[0136.151] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.md") returned 0
	[0136.151] lstrlenA (lpString="*.md") returned 4
	[0136.151] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.lnk") returned 0
	[0136.151] lstrlenA (lpString="*.lnk") returned 5
	[0136.151] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.torrent") returned 0
	[0136.151] lstrlenA (lpString="*.torrent") returned 9
	[0136.151] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.mov") returned 0
	[0136.151] lstrlenA (lpString="*.mov") returned 5
	[0136.151] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.3gp") returned 0
	[0136.151] lstrlenA (lpString="*.3gp") returned 5
	[0136.151] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.mpeg") returned 0
	[0136.151] lstrlenA (lpString="*.mpeg") returned 6
	[0136.151] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.mpg") returned 0
	[0136.151] lstrlenA (lpString="*.mpg") returned 5
	[0136.151] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.flv") returned 0
	[0136.151] lstrlenA (lpString="*.flv") returned 5
	[0136.151] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.avi") returned 0
	[0136.152] lstrlenA (lpString="*.avi") returned 5
	[0136.152] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.mp4") returned 0
	[0136.152] lstrlenA (lpString="*.mp4") returned 5
	[0136.152] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.wmv") returned 0
	[0136.152] lstrlenA (lpString="*.wmv") returned 5
	[0136.152] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.mkv") returned 0
	[0136.152] lstrlenA (lpString="*.mkv") returned 5
	[0136.152] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.mp3") returned 0
	[0136.152] lstrlenA (lpString="*.mp3") returned 5
	[0136.152] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.wav") returned 0
	[0136.152] lstrlenA (lpString="*.wav") returned 5
	[0136.152] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.flac") returned 0
	[0136.152] lstrlenA (lpString="*.flac") returned 6
	[0136.152] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.wma") returned 0
	[0136.152] lstrlenA (lpString="*.wma") returned 5
	[0136.152] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.au3") returned 0
	[0136.152] lstrlenA (lpString="*.au3") returned 5
	[0136.152] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.ahk") returned 0
	[0136.152] lstrlenA (lpString="*.ahk") returned 5
	[0136.152] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.c") returned 0
	[0136.152] lstrlenA (lpString="*.c") returned 3
	[0136.152] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.cc") returned 0
	[0136.152] lstrlenA (lpString="*.cc") returned 4
	[0136.152] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.cpp") returned 0
	[0136.152] lstrlenA (lpString="*.cpp") returned 5
	[0136.152] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.cxx") returned 0
	[0136.152] lstrlenA (lpString="*.cxx") returned 5
	[0136.152] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.c++") returned 0
	[0136.152] lstrlenA (lpString="*.c++") returned 5
	[0136.152] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.cs") returned 0
	[0136.152] lstrlenA (lpString="*.cs") returned 4
	[0136.152] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.vb") returned 0
	[0136.152] lstrlenA (lpString="*.vb") returned 4
	[0136.152] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.bas") returned 0
	[0136.152] lstrlenA (lpString="*.bas") returned 5
	[0136.153] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.csproj") returned 0
	[0136.153] lstrlenA (lpString="*.csproj") returned 8
	[0136.153] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.vbproj") returned 0
	[0136.153] lstrlenA (lpString="*.vbproj") returned 8
	[0136.153] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.vcxproj") returned 0
	[0136.153] lstrlenA (lpString="*.vcxproj") returned 9
	[0136.153] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.manifest") returned 0
	[0136.153] lstrlenA (lpString="*.manifest") returned 10
	[0136.153] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.php") returned 0
	[0136.153] lstrlenA (lpString="*.php") returned 5
	[0136.153] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.vbe") returned 0
	[0136.153] lstrlenA (lpString="*.vbe") returned 5
	[0136.153] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.vba") returned 0
	[0136.153] lstrlenA (lpString="*.vba") returned 5
	[0136.153] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.vbs") returned 0
	[0136.153] lstrlenA (lpString="*.vbs") returned 5
	[0136.153] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.bat") returned 0
	[0136.153] lstrlenA (lpString="*.bat") returned 5
	[0136.153] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.cmd") returned 0
	[0136.153] lstrlenA (lpString="*.cmd") returned 5
	[0136.153] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.js") returned 0
	[0136.153] lstrlenA (lpString="*.js") returned 4
	[0136.153] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.jscript") returned 0
	[0136.153] lstrlenA (lpString="*.jscript") returned 9
	[0136.153] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.hta") returned 0
	[0136.153] lstrlenA (lpString="*.hta") returned 5
	[0136.153] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.php7") returned 0
	[0136.153] lstrlenA (lpString="*.php7") returned 6
	[0136.153] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.db") returned 0
	[0136.153] lstrlenA (lpString="*.db") returned 4
	[0136.153] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.swf") returned 0
	[0136.153] lstrlenA (lpString="*.swf") returned 5
	[0136.153] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.eml") returned 0
	[0136.153] lstrlenA (lpString="*.eml") returned 5
	[0136.153] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.part") returned 0
	[0136.154] lstrlenA (lpString="*.part") returned 6
	[0136.154] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.nfo") returned 0
	[0136.154] lstrlenA (lpString="*.nfo") returned 5
	[0136.154] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.rsa") returned 0
	[0136.154] lstrlenA (lpString="*.rsa") returned 5
	[0136.154] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.key") returned 0
	[0136.154] lstrlenA (lpString="*.key") returned 5
	[0136.154] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.aes") returned 0
	[0136.154] lstrlenA (lpString="*.aes") returned 5
	[0136.154] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.blob") returned 0
	[0136.154] lstrlenA (lpString="*.blob") returned 6
	[0136.154] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.btc") returned 0
	[0136.154] lstrlenA (lpString="*.btc") returned 5
	[0136.154] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml", pszSpec="*.wallet") returned 0
	[0136.154] lstrlenA (lpString="*.wallet") returned 8
	[0136.154] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2e4b434, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0xd2e4b434, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xe27eea3, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x72c9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="APPRAISER_TelemetryBaseline_RS3.bin", cAlternateFileName="APPRAI~2.BIN")) returned 1
	[0136.154] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.154] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="APPRAISER_TelemetryBaseline_RS3.bin") returned 1
	[0136.154] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="APPRAISER_TelemetryBaseline_RS3.bin") returned 1
	[0136.154] lstrcmpiA (lpString1="", lpString2="APPRAISER_TelemetryBaseline_RS3.bin") returned -1
	[0136.154] PathFindFileNameA (pszPath="C:\\Windows\\appcompat\\appraiser\\APPRAISER_FileInventory.xml") returned="APPRAISER_FileInventory.xml"
	[0136.154] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\appcompat\\appraiser\\" | out: lpString1="C:\\Windows\\appcompat\\appraiser\\") returned="C:\\Windows\\appcompat\\appraiser\\"
	[0136.154] PathAddBackslashA (in: pszPath="C:\\Windows\\appcompat\\appraiser\\" | out: pszPath="C:\\Windows\\appcompat\\appraiser\\") returned=""
	[0136.154] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\appraiser\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\appcompat\\appraiser\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\appcompat\\appraiser\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.154] GetFileAttributesA (lpFileName="C:\\Windows\\appcompat\\appraiser\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\appcompat\\appraiser\\how-to-decrypt-files.htm")) returned 0x20
	[0136.154] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\appraiser\\", lpString2="APPRAISER_TelemetryBaseline_RS3.bin" | out: lpString1="C:\\Windows\\appcompat\\appraiser\\APPRAISER_TelemetryBaseline_RS3.bin") returned="C:\\Windows\\appcompat\\appraiser\\APPRAISER_TelemetryBaseline_RS3.bin"
	[0136.154] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_TelemetryBaseline_RS3.bin", pszSpec="*.zip") returned 0
	[0136.154] lstrlenA (lpString="*.zip") returned 5
	[0136.154] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_TelemetryBaseline_RS3.bin", pszSpec="*.rar") returned 0
	[0136.154] lstrlenA (lpString="*.rar") returned 5
	[0136.155] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_TelemetryBaseline_RS3.bin", pszSpec="*.7z") returned 0
	[0136.155] lstrlenA (lpString="*.7z") returned 4
	[0136.155] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_TelemetryBaseline_RS3.bin", pszSpec="*.tar") returned 0
	[0136.155] lstrlenA (lpString="*.tar") returned 5
	[0136.155] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_TelemetryBaseline_RS3.bin", pszSpec="*.gzip") returned 0
	[0136.155] lstrlenA (lpString="*.gzip") returned 6
	[0136.155] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_TelemetryBaseline_RS3.bin", pszSpec="*.jpg") returned 0
	[0136.155] lstrlenA (lpString="*.jpg") returned 5
	[0136.155] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_TelemetryBaseline_RS3.bin", pszSpec="*.jpeg") returned 0
	[0136.155] lstrlenA (lpString="*.jpeg") returned 6
	[0136.155] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_TelemetryBaseline_RS3.bin", pszSpec="*.bmp") returned 0
	[0136.155] lstrlenA (lpString="*.bmp") returned 5
	[0136.155] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_TelemetryBaseline_RS3.bin", pszSpec="*.gif") returned 0
	[0136.155] lstrlenA (lpString="*.gif") returned 5
	[0136.155] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_TelemetryBaseline_RS3.bin", pszSpec="*.png") returned 0
	[0136.155] lstrlenA (lpString="*.png") returned 5
	[0136.155] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_TelemetryBaseline_RS3.bin", pszSpec="*.doc") returned 0
	[0136.155] lstrlenA (lpString="*.doc") returned 5
	[0136.155] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_TelemetryBaseline_RS3.bin", pszSpec="*.docx") returned 0
	[0136.155] lstrlenA (lpString="*.docx") returned 6
	[0136.155] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_TelemetryBaseline_RS3.bin", pszSpec="*.xls") returned 0
	[0136.155] lstrlenA (lpString="*.xls") returned 5
	[0136.155] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_TelemetryBaseline_RS3.bin", pszSpec="*.xlsx") returned 0
	[0136.155] lstrlenA (lpString="*.xlsx") returned 6
	[0136.155] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_TelemetryBaseline_RS3.bin", pszSpec="*.ppt") returned 0
	[0136.155] lstrlenA (lpString="*.ppt") returned 5
	[0136.155] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_TelemetryBaseline_RS3.bin", pszSpec="*.pptx") returned 0
	[0136.155] lstrlenA (lpString="*.pptx") returned 6
	[0136.155] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_TelemetryBaseline_RS3.bin", pszSpec="*.txt") returned 0
	[0136.155] lstrlenA (lpString="*.txt") returned 5
	[0136.155] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_TelemetryBaseline_RS3.bin", pszSpec="*.pdf") returned 0
	[0136.155] lstrlenA (lpString="*.pdf") returned 5
	[0136.155] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_TelemetryBaseline_RS3.bin", pszSpec="*.htm") returned 0
	[0136.155] lstrlenA (lpString="*.htm") returned 5
	[0136.156] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_TelemetryBaseline_RS3.bin", pszSpec="*.html") returned 0
	[0136.156] lstrlenA (lpString="*.html") returned 6
	[0136.156] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_TelemetryBaseline_RS3.bin", pszSpec="*.mdb") returned 0
	[0136.156] lstrlenA (lpString="*.mdb") returned 5
	[0136.156] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_TelemetryBaseline_RS3.bin", pszSpec="*.pfx") returned 0
	[0136.156] lstrlenA (lpString="*.pfx") returned 5
	[0136.156] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_TelemetryBaseline_RS3.bin", pszSpec="*.md") returned 0
	[0136.156] lstrlenA (lpString="*.md") returned 4
	[0136.156] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_TelemetryBaseline_RS3.bin", pszSpec="*.lnk") returned 0
	[0136.156] lstrlenA (lpString="*.lnk") returned 5
	[0136.156] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_TelemetryBaseline_RS3.bin", pszSpec="*.torrent") returned 0
	[0136.156] lstrlenA (lpString="*.torrent") returned 9
	[0136.156] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_TelemetryBaseline_RS3.bin", pszSpec="*.mov") returned 0
	[0136.156] lstrlenA (lpString="*.mov") returned 5
	[0136.156] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_TelemetryBaseline_RS3.bin", pszSpec="*.3gp") returned 0
	[0136.156] lstrlenA (lpString="*.3gp") returned 5
	[0136.156] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_TelemetryBaseline_RS3.bin", pszSpec="*.mpeg") returned 0
	[0136.156] lstrlenA (lpString="*.mpeg") returned 6
	[0136.156] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_TelemetryBaseline_RS3.bin", pszSpec="*.mpg") returned 0
	[0136.156] lstrlenA (lpString="*.mpg") returned 5
	[0136.156] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\appraiser\\APPRAISER_TelemetryBaseline_RS3.bin", pszSpec="*.flv") returned 0
	[0136.156] lstrlenA (lpString="*.flv") returned 5
	[0136.156] lstrlenA (lpString="*.avi") returned 5
	[0136.156] lstrlenA (lpString="*.mp4") returned 5
	[0136.156] lstrlenA (lpString="*.wmv") returned 5
	[0136.157] lstrlenA (lpString="*.mkv") returned 5
	[0136.157] lstrlenA (lpString="*.mp3") returned 5
	[0136.157] lstrlenA (lpString="*.wav") returned 5
	[0136.157] lstrlenA (lpString="*.flac") returned 6
	[0136.157] lstrlenA (lpString="*.wma") returned 5
	[0136.157] lstrlenA (lpString="*.au3") returned 5
	[0136.157] lstrlenA (lpString="*.ahk") returned 5
	[0136.157] lstrlenA (lpString="*.c") returned 3
	[0136.157] lstrlenA (lpString="*.cc") returned 4
	[0136.157] lstrlenA (lpString="*.cpp") returned 5
	[0136.157] lstrlenA (lpString="*.cxx") returned 5
	[0136.157] lstrlenA (lpString="*.c++") returned 5
	[0136.157] lstrlenA (lpString="*.cs") returned 4
	[0136.157] lstrlenA (lpString="*.vb") returned 4
	[0136.157] lstrlenA (lpString="*.bas") returned 5
	[0136.157] lstrlenA (lpString="*.csproj") returned 8
	[0136.157] lstrlenA (lpString="*.vbproj") returned 8
	[0136.157] lstrlenA (lpString="*.vcxproj") returned 9
	[0136.157] lstrlenA (lpString="*.manifest") returned 10
	[0136.157] lstrlenA (lpString="*.php") returned 5
	[0136.157] lstrlenA (lpString="*.vbe") returned 5
	[0136.157] lstrlenA (lpString="*.vba") returned 5
	[0136.157] lstrlenA (lpString="*.vbs") returned 5
	[0136.157] lstrlenA (lpString="*.bat") returned 5
	[0136.157] lstrlenA (lpString="*.cmd") returned 5
	[0136.157] lstrlenA (lpString="*.js") returned 4
	[0136.157] lstrlenA (lpString="*.jscript") returned 9
	[0136.157] lstrlenA (lpString="*.hta") returned 5
	[0136.158] lstrlenA (lpString="*.php7") returned 6
	[0136.158] lstrlenA (lpString="*.db") returned 4
	[0136.158] lstrlenA (lpString="*.swf") returned 5
	[0136.158] lstrlenA (lpString="*.eml") returned 5
	[0136.158] lstrlenA (lpString="*.part") returned 6
	[0136.158] lstrlenA (lpString="*.nfo") returned 5
	[0136.158] lstrlenA (lpString="*.rsa") returned 5
	[0136.158] lstrlenA (lpString="*.key") returned 5
	[0136.158] lstrlenA (lpString="*.aes") returned 5
	[0136.158] lstrlenA (lpString="*.blob") returned 6
	[0136.158] lstrlenA (lpString="*.btc") returned 5
	[0136.158] lstrlenA (lpString="*.wallet") returned 8
	[0136.158] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5df8cdd, ftCreationTime.dwHighDateTime=0x1d3278c, ftLastAccessTime.dwLowDateTime=0x5df8cdd, ftLastAccessTime.dwHighDateTime=0x1d3278c, ftLastWriteTime.dwLowDateTime=0xde2bc91, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x53ec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="APPRAISER_TelemetryBaseline_UNV.bin", cAlternateFileName="APPRAI~1.BIN")) returned 1
	[0136.158] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.158] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="APPRAISER_TelemetryBaseline_UNV.bin") returned 1
	[0136.158] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="APPRAISER_TelemetryBaseline_UNV.bin") returned 1
	[0136.158] lstrcmpiA (lpString1="", lpString2="APPRAISER_TelemetryBaseline_UNV.bin") returned -1
	[0136.158] PathFindFileNameA (pszPath="C:\\Windows\\appcompat\\appraiser\\APPRAISER_TelemetryBaseline_RS3.bin") returned="APPRAISER_TelemetryBaseline_RS3.bin"
	[0136.158] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\appcompat\\appraiser\\" | out: lpString1="C:\\Windows\\appcompat\\appraiser\\") returned="C:\\Windows\\appcompat\\appraiser\\"
	[0136.158] PathAddBackslashA (in: pszPath="C:\\Windows\\appcompat\\appraiser\\" | out: pszPath="C:\\Windows\\appcompat\\appraiser\\") returned=""
	[0136.158] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\appraiser\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\appcompat\\appraiser\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\appcompat\\appraiser\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.158] GetFileAttributesA (lpFileName="C:\\Windows\\appcompat\\appraiser\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\appcompat\\appraiser\\how-to-decrypt-files.htm")) returned 0x20
	[0136.158] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\appraiser\\", lpString2="APPRAISER_TelemetryBaseline_UNV.bin" | out: lpString1="C:\\Windows\\appcompat\\appraiser\\APPRAISER_TelemetryBaseline_UNV.bin") returned="C:\\Windows\\appcompat\\appraiser\\APPRAISER_TelemetryBaseline_UNV.bin"
	[0136.158] lstrlenA (lpString="*.zip") returned 5
	[0136.158] lstrlenA (lpString="*.rar") returned 5
	[0136.158] lstrlenA (lpString="*.7z") returned 4
	[0136.158] lstrlenA (lpString="*.tar") returned 5
	[0136.159] lstrlenA (lpString="*.gzip") returned 6
	[0136.159] lstrlenA (lpString="*.jpg") returned 5
	[0136.159] lstrlenA (lpString="*.jpeg") returned 6
	[0136.159] lstrlenA (lpString="*.bmp") returned 5
	[0136.159] lstrlenA (lpString="*.gif") returned 5
	[0136.159] lstrlenA (lpString="*.png") returned 5
	[0136.159] lstrlenA (lpString="*.doc") returned 5
	[0136.159] lstrlenA (lpString="*.docx") returned 6
	[0136.159] lstrlenA (lpString="*.xls") returned 5
	[0136.159] lstrlenA (lpString="*.xlsx") returned 6
	[0136.159] lstrlenA (lpString="*.ppt") returned 5
	[0136.159] lstrlenA (lpString="*.pptx") returned 6
	[0136.159] lstrlenA (lpString="*.txt") returned 5
	[0136.159] lstrlenA (lpString="*.pdf") returned 5
	[0136.159] lstrlenA (lpString="*.htm") returned 5
	[0136.159] lstrlenA (lpString="*.html") returned 6
	[0136.159] lstrlenA (lpString="*.mdb") returned 5
	[0136.159] lstrlenA (lpString="*.pfx") returned 5
	[0136.159] lstrlenA (lpString="*.md") returned 4
	[0136.159] lstrlenA (lpString="*.lnk") returned 5
	[0136.159] lstrlenA (lpString="*.torrent") returned 9
	[0136.159] lstrlenA (lpString="*.mov") returned 5
	[0136.159] lstrlenA (lpString="*.3gp") returned 5
	[0136.159] lstrlenA (lpString="*.mpeg") returned 6
	[0136.159] lstrlenA (lpString="*.mpg") returned 5
	[0136.159] lstrlenA (lpString="*.flv") returned 5
	[0136.160] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd4925511, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d53e9c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Telemetry", cAlternateFileName="TELEME~1")) returned 1
	[0136.160] lstrcmpA (lpString1=".", lpString2="Telemetry") returned -1
	[0136.160] lstrcmpA (lpString1="..", lpString2="Telemetry") returned -1
	[0136.160] PathFindFileNameA (pszPath="C:\\Windows\\appcompat\\appraiser\\APPRAISER_TelemetryBaseline_UNV.bin") returned="APPRAISER_TelemetryBaseline_UNV.bin"
	[0136.160] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\appraiser\\", lpString2="Telemetry" | out: lpString1="C:\\Windows\\appcompat\\appraiser\\Telemetry") returned="C:\\Windows\\appcompat\\appraiser\\Telemetry"
	[0136.160] FindFirstFileA (in: lpFileName="C:\\Windows\\appcompat\\appraiser\\Telemetry\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd4925511, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d53e9c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x7cb6d0
	[0136.160] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.160] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd4925511, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d53e9c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x80, cFileName="..", cAlternateFileName="")) returned 1
	[0136.160] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.160] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.160] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd4925511, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d53e9c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x80, cFileName="..", cAlternateFileName="")) returned 0
	[0136.160] FindClose (in: hFindFile=0x7cb6d0 | out: hFindFile=0x7cb6d0) returned 1
	[0136.160] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd4925511, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d53e9c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Telemetry", cAlternateFileName="TELEME~1")) returned 0
	[0136.160] FindClose (in: hFindFile=0x7cbad0 | out: hFindFile=0x7cbad0) returned 1
	[0136.160] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5de79321, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x5de79321, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 1
	[0136.160] lstrcmpA (lpString1=".", lpString2="Programs") returned -1
	[0136.160] lstrcmpA (lpString1="..", lpString2="Programs") returned -1
	[0136.160] PathFindFileNameA (pszPath="C:\\Windows\\appcompat\\*.*") returned="*.*"
	[0136.160] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\", lpString2="Programs" | out: lpString1="C:\\Windows\\appcompat\\Programs") returned="C:\\Windows\\appcompat\\Programs"
	[0136.160] FindFirstFileA (in: lpFileName="C:\\Windows\\appcompat\\Programs\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5de79321, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x5de79321, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb650
	[0136.161] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.161] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5de79321, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x5de79321, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.161] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.161] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.161] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bb2eca1, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x32f3cd47, ftLastAccessTime.dwHighDateTime=0x1d4d5d0, ftLastWriteTime.dwLowDateTime=0x32f3cd47, ftLastWriteTime.dwHighDateTime=0x1d4d5d0, nFileSizeHigh=0x0, nFileSizeLow=0x340000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Amcache.hve", cAlternateFileName="")) returned 1
	[0136.161] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.161] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Amcache.hve") returned 1
	[0136.161] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Amcache.hve") returned 1
	[0136.161] lstrcmpiA (lpString1="", lpString2="Amcache.hve") returned -1
	[0136.161] PathFindFileNameA (pszPath="C:\\Windows\\appcompat\\Programs\\*.*") returned="*.*"
	[0136.161] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\appcompat\\Programs\\" | out: lpString1="C:\\Windows\\appcompat\\Programs\\") returned="C:\\Windows\\appcompat\\Programs\\"
	[0136.161] PathAddBackslashA (in: pszPath="C:\\Windows\\appcompat\\Programs\\" | out: pszPath="C:\\Windows\\appcompat\\Programs\\") returned=""
	[0136.161] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\Programs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\appcompat\\Programs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\appcompat\\Programs\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.161] GetFileAttributesA (lpFileName="C:\\Windows\\appcompat\\Programs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\appcompat\\programs\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.161] CreateFileA (lpFileName="C:\\Windows\\appcompat\\Programs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\appcompat\\programs\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0136.162] WriteFile (in: hFile=0x20c, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0136.163] SetFileTime (hFile=0x20c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.163] CloseHandle (hObject=0x20c) returned 1
	[0136.163] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\Programs\\", lpString2="Amcache.hve" | out: lpString1="C:\\Windows\\appcompat\\Programs\\Amcache.hve") returned="C:\\Windows\\appcompat\\Programs\\Amcache.hve"
	[0136.163] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.zip") returned 0
	[0136.163] lstrlenA (lpString="*.zip") returned 5
	[0136.163] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.rar") returned 0
	[0136.163] lstrlenA (lpString="*.rar") returned 5
	[0136.163] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.7z") returned 0
	[0136.163] lstrlenA (lpString="*.7z") returned 4
	[0136.163] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.tar") returned 0
	[0136.163] lstrlenA (lpString="*.tar") returned 5
	[0136.163] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.gzip") returned 0
	[0136.163] lstrlenA (lpString="*.gzip") returned 6
	[0136.163] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.jpg") returned 0
	[0136.163] lstrlenA (lpString="*.jpg") returned 5
	[0136.163] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.jpeg") returned 0
	[0136.163] lstrlenA (lpString="*.jpeg") returned 6
	[0136.163] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.bmp") returned 0
	[0136.163] lstrlenA (lpString="*.bmp") returned 5
	[0136.163] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.gif") returned 0
	[0136.163] lstrlenA (lpString="*.gif") returned 5
	[0136.163] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.png") returned 0
	[0136.164] lstrlenA (lpString="*.png") returned 5
	[0136.164] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.doc") returned 0
	[0136.164] lstrlenA (lpString="*.doc") returned 5
	[0136.164] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.docx") returned 0
	[0136.164] lstrlenA (lpString="*.docx") returned 6
	[0136.164] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.xls") returned 0
	[0136.164] lstrlenA (lpString="*.xls") returned 5
	[0136.164] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.xlsx") returned 0
	[0136.164] lstrlenA (lpString="*.xlsx") returned 6
	[0136.164] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.ppt") returned 0
	[0136.164] lstrlenA (lpString="*.ppt") returned 5
	[0136.164] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.pptx") returned 0
	[0136.164] lstrlenA (lpString="*.pptx") returned 6
	[0136.164] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.txt") returned 0
	[0136.164] lstrlenA (lpString="*.txt") returned 5
	[0136.164] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.pdf") returned 0
	[0136.164] lstrlenA (lpString="*.pdf") returned 5
	[0136.164] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.htm") returned 0
	[0136.164] lstrlenA (lpString="*.htm") returned 5
	[0136.164] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.html") returned 0
	[0136.164] lstrlenA (lpString="*.html") returned 6
	[0136.164] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.mdb") returned 0
	[0136.164] lstrlenA (lpString="*.mdb") returned 5
	[0136.164] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.pfx") returned 0
	[0136.165] lstrlenA (lpString="*.pfx") returned 5
	[0136.165] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.md") returned 0
	[0136.165] lstrlenA (lpString="*.md") returned 4
	[0136.165] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.lnk") returned 0
	[0136.165] lstrlenA (lpString="*.lnk") returned 5
	[0136.165] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.torrent") returned 0
	[0136.165] lstrlenA (lpString="*.torrent") returned 9
	[0136.165] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.mov") returned 0
	[0136.165] lstrlenA (lpString="*.mov") returned 5
	[0136.165] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.3gp") returned 0
	[0136.165] lstrlenA (lpString="*.3gp") returned 5
	[0136.165] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.mpeg") returned 0
	[0136.165] lstrlenA (lpString="*.mpeg") returned 6
	[0136.165] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.mpg") returned 0
	[0136.165] lstrlenA (lpString="*.mpg") returned 5
	[0136.165] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.flv") returned 0
	[0136.165] lstrlenA (lpString="*.flv") returned 5
	[0136.165] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.avi") returned 0
	[0136.165] lstrlenA (lpString="*.avi") returned 5
	[0136.165] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.mp4") returned 0
	[0136.165] lstrlenA (lpString="*.mp4") returned 5
	[0136.165] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.wmv") returned 0
	[0136.165] lstrlenA (lpString="*.wmv") returned 5
	[0136.165] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.mkv") returned 0
	[0136.165] lstrlenA (lpString="*.mkv") returned 5
	[0136.165] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.mp3") returned 0
	[0136.165] lstrlenA (lpString="*.mp3") returned 5
	[0136.165] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.wav") returned 0
	[0136.165] lstrlenA (lpString="*.wav") returned 5
	[0136.165] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.flac") returned 0
	[0136.165] lstrlenA (lpString="*.flac") returned 6
	[0136.165] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.wma") returned 0
	[0136.165] lstrlenA (lpString="*.wma") returned 5
	[0136.165] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.au3") returned 0
	[0136.165] lstrlenA (lpString="*.au3") returned 5
	[0136.166] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.ahk") returned 0
	[0136.166] lstrlenA (lpString="*.ahk") returned 5
	[0136.166] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.c") returned 0
	[0136.166] lstrlenA (lpString="*.c") returned 3
	[0136.166] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.cc") returned 0
	[0136.166] lstrlenA (lpString="*.cc") returned 4
	[0136.166] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.cpp") returned 0
	[0136.166] lstrlenA (lpString="*.cpp") returned 5
	[0136.166] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.cxx") returned 0
	[0136.166] lstrlenA (lpString="*.cxx") returned 5
	[0136.166] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.c++") returned 0
	[0136.166] lstrlenA (lpString="*.c++") returned 5
	[0136.166] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.cs") returned 0
	[0136.166] lstrlenA (lpString="*.cs") returned 4
	[0136.166] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.vb") returned 0
	[0136.166] lstrlenA (lpString="*.vb") returned 4
	[0136.166] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.bas") returned 0
	[0136.166] lstrlenA (lpString="*.bas") returned 5
	[0136.166] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.csproj") returned 0
	[0136.166] lstrlenA (lpString="*.csproj") returned 8
	[0136.166] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.vbproj") returned 0
	[0136.166] lstrlenA (lpString="*.vbproj") returned 8
	[0136.166] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.vcxproj") returned 0
	[0136.166] lstrlenA (lpString="*.vcxproj") returned 9
	[0136.166] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.manifest") returned 0
	[0136.166] lstrlenA (lpString="*.manifest") returned 10
	[0136.166] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.php") returned 0
	[0136.166] lstrlenA (lpString="*.php") returned 5
	[0136.166] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.vbe") returned 0
	[0136.166] lstrlenA (lpString="*.vbe") returned 5
	[0136.166] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.vba") returned 0
	[0136.166] lstrlenA (lpString="*.vba") returned 5
	[0136.166] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.vbs") returned 0
	[0136.166] lstrlenA (lpString="*.vbs") returned 5
	[0136.167] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.bat") returned 0
	[0136.167] lstrlenA (lpString="*.bat") returned 5
	[0136.167] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.cmd") returned 0
	[0136.167] lstrlenA (lpString="*.cmd") returned 5
	[0136.167] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.js") returned 0
	[0136.167] lstrlenA (lpString="*.js") returned 4
	[0136.167] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.jscript") returned 0
	[0136.167] lstrlenA (lpString="*.jscript") returned 9
	[0136.167] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.hta") returned 0
	[0136.167] lstrlenA (lpString="*.hta") returned 5
	[0136.167] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.php7") returned 0
	[0136.167] lstrlenA (lpString="*.php7") returned 6
	[0136.167] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.db") returned 0
	[0136.167] lstrlenA (lpString="*.db") returned 4
	[0136.167] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.swf") returned 0
	[0136.167] lstrlenA (lpString="*.swf") returned 5
	[0136.167] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.eml") returned 0
	[0136.167] lstrlenA (lpString="*.eml") returned 5
	[0136.167] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.part") returned 0
	[0136.167] lstrlenA (lpString="*.part") returned 6
	[0136.167] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.nfo") returned 0
	[0136.167] lstrlenA (lpString="*.nfo") returned 5
	[0136.167] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.rsa") returned 0
	[0136.167] lstrlenA (lpString="*.rsa") returned 5
	[0136.167] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.key") returned 0
	[0136.167] lstrlenA (lpString="*.key") returned 5
	[0136.167] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.aes") returned 0
	[0136.167] lstrlenA (lpString="*.aes") returned 5
	[0136.167] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.blob") returned 0
	[0136.167] lstrlenA (lpString="*.blob") returned 6
	[0136.167] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.btc") returned 0
	[0136.167] lstrlenA (lpString="*.btc") returned 5
	[0136.167] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve", pszSpec="*.wallet") returned 0
	[0136.168] lstrlenA (lpString="*.wallet") returned 8
	[0136.168] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x89817fa9, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x89817fa9, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x89817fa9, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x1, cFileName="Amcache.hve.LOG1", cAlternateFileName="AMCACH~1.LOG")) returned 1
	[0136.168] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.168] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Amcache.hve.LOG1") returned 1
	[0136.168] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Amcache.hve.LOG1") returned 1
	[0136.168] lstrcmpiA (lpString1="", lpString2="Amcache.hve.LOG1") returned -1
	[0136.168] PathFindFileNameA (pszPath="C:\\Windows\\appcompat\\Programs\\Amcache.hve") returned="Amcache.hve"
	[0136.168] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\appcompat\\Programs\\" | out: lpString1="C:\\Windows\\appcompat\\Programs\\") returned="C:\\Windows\\appcompat\\Programs\\"
	[0136.168] PathAddBackslashA (in: pszPath="C:\\Windows\\appcompat\\Programs\\" | out: pszPath="C:\\Windows\\appcompat\\Programs\\") returned=""
	[0136.168] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\Programs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\appcompat\\Programs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\appcompat\\Programs\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.168] GetFileAttributesA (lpFileName="C:\\Windows\\appcompat\\Programs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\appcompat\\programs\\how-to-decrypt-files.htm")) returned 0x20
	[0136.168] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\Programs\\", lpString2="Amcache.hve.LOG1" | out: lpString1="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1") returned="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1"
	[0136.168] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.zip") returned 0
	[0136.168] lstrlenA (lpString="*.zip") returned 5
	[0136.168] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.rar") returned 0
	[0136.168] lstrlenA (lpString="*.rar") returned 5
	[0136.168] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.7z") returned 0
	[0136.168] lstrlenA (lpString="*.7z") returned 4
	[0136.168] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.tar") returned 0
	[0136.168] lstrlenA (lpString="*.tar") returned 5
	[0136.168] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.gzip") returned 0
	[0136.168] lstrlenA (lpString="*.gzip") returned 6
	[0136.168] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.jpg") returned 0
	[0136.168] lstrlenA (lpString="*.jpg") returned 5
	[0136.168] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.jpeg") returned 0
	[0136.168] lstrlenA (lpString="*.jpeg") returned 6
	[0136.168] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.bmp") returned 0
	[0136.168] lstrlenA (lpString="*.bmp") returned 5
	[0136.168] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.gif") returned 0
	[0136.168] lstrlenA (lpString="*.gif") returned 5
	[0136.168] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.png") returned 0
	[0136.169] lstrlenA (lpString="*.png") returned 5
	[0136.169] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.doc") returned 0
	[0136.169] lstrlenA (lpString="*.doc") returned 5
	[0136.169] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.docx") returned 0
	[0136.169] lstrlenA (lpString="*.docx") returned 6
	[0136.169] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.xls") returned 0
	[0136.169] lstrlenA (lpString="*.xls") returned 5
	[0136.169] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.xlsx") returned 0
	[0136.169] lstrlenA (lpString="*.xlsx") returned 6
	[0136.169] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.ppt") returned 0
	[0136.169] lstrlenA (lpString="*.ppt") returned 5
	[0136.169] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.pptx") returned 0
	[0136.169] lstrlenA (lpString="*.pptx") returned 6
	[0136.169] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.txt") returned 0
	[0136.169] lstrlenA (lpString="*.txt") returned 5
	[0136.169] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.pdf") returned 0
	[0136.169] lstrlenA (lpString="*.pdf") returned 5
	[0136.169] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.htm") returned 0
	[0136.169] lstrlenA (lpString="*.htm") returned 5
	[0136.169] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.html") returned 0
	[0136.169] lstrlenA (lpString="*.html") returned 6
	[0136.169] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.mdb") returned 0
	[0136.169] lstrlenA (lpString="*.mdb") returned 5
	[0136.169] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.pfx") returned 0
	[0136.169] lstrlenA (lpString="*.pfx") returned 5
	[0136.169] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.md") returned 0
	[0136.169] lstrlenA (lpString="*.md") returned 4
	[0136.169] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.lnk") returned 0
	[0136.169] lstrlenA (lpString="*.lnk") returned 5
	[0136.169] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.torrent") returned 0
	[0136.169] lstrlenA (lpString="*.torrent") returned 9
	[0136.169] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.mov") returned 0
	[0136.169] lstrlenA (lpString="*.mov") returned 5
	[0136.169] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.3gp") returned 0
	[0136.169] lstrlenA (lpString="*.3gp") returned 5
	[0136.170] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.mpeg") returned 0
	[0136.170] lstrlenA (lpString="*.mpeg") returned 6
	[0136.170] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.mpg") returned 0
	[0136.170] lstrlenA (lpString="*.mpg") returned 5
	[0136.170] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.flv") returned 0
	[0136.170] lstrlenA (lpString="*.flv") returned 5
	[0136.170] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.avi") returned 0
	[0136.170] lstrlenA (lpString="*.avi") returned 5
	[0136.170] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.mp4") returned 0
	[0136.170] lstrlenA (lpString="*.mp4") returned 5
	[0136.170] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.wmv") returned 0
	[0136.170] lstrlenA (lpString="*.wmv") returned 5
	[0136.170] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.mkv") returned 0
	[0136.170] lstrlenA (lpString="*.mkv") returned 5
	[0136.170] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.mp3") returned 0
	[0136.170] lstrlenA (lpString="*.mp3") returned 5
	[0136.170] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.wav") returned 0
	[0136.170] lstrlenA (lpString="*.wav") returned 5
	[0136.170] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.flac") returned 0
	[0136.170] lstrlenA (lpString="*.flac") returned 6
	[0136.170] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.wma") returned 0
	[0136.170] lstrlenA (lpString="*.wma") returned 5
	[0136.170] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.au3") returned 0
	[0136.170] lstrlenA (lpString="*.au3") returned 5
	[0136.170] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.ahk") returned 0
	[0136.170] lstrlenA (lpString="*.ahk") returned 5
	[0136.170] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.c") returned 0
	[0136.170] lstrlenA (lpString="*.c") returned 3
	[0136.170] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.cc") returned 0
	[0136.170] lstrlenA (lpString="*.cc") returned 4
	[0136.170] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.cpp") returned 0
	[0136.170] lstrlenA (lpString="*.cpp") returned 5
	[0136.170] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.cxx") returned 0
	[0136.170] lstrlenA (lpString="*.cxx") returned 5
	[0136.171] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.c++") returned 0
	[0136.171] lstrlenA (lpString="*.c++") returned 5
	[0136.171] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.cs") returned 0
	[0136.171] lstrlenA (lpString="*.cs") returned 4
	[0136.171] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.vb") returned 0
	[0136.171] lstrlenA (lpString="*.vb") returned 4
	[0136.171] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.bas") returned 0
	[0136.171] lstrlenA (lpString="*.bas") returned 5
	[0136.171] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.csproj") returned 0
	[0136.171] lstrlenA (lpString="*.csproj") returned 8
	[0136.171] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.vbproj") returned 0
	[0136.171] lstrlenA (lpString="*.vbproj") returned 8
	[0136.171] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.vcxproj") returned 0
	[0136.171] lstrlenA (lpString="*.vcxproj") returned 9
	[0136.171] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.manifest") returned 0
	[0136.171] lstrlenA (lpString="*.manifest") returned 10
	[0136.171] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.php") returned 0
	[0136.171] lstrlenA (lpString="*.php") returned 5
	[0136.171] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.vbe") returned 0
	[0136.171] lstrlenA (lpString="*.vbe") returned 5
	[0136.171] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.vba") returned 0
	[0136.171] lstrlenA (lpString="*.vba") returned 5
	[0136.171] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.vbs") returned 0
	[0136.171] lstrlenA (lpString="*.vbs") returned 5
	[0136.171] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.bat") returned 0
	[0136.171] lstrlenA (lpString="*.bat") returned 5
	[0136.171] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.cmd") returned 0
	[0136.171] lstrlenA (lpString="*.cmd") returned 5
	[0136.171] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.js") returned 0
	[0136.171] lstrlenA (lpString="*.js") returned 4
	[0136.171] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.jscript") returned 0
	[0136.171] lstrlenA (lpString="*.jscript") returned 9
	[0136.171] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.hta") returned 0
	[0136.171] lstrlenA (lpString="*.hta") returned 5
	[0136.172] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.php7") returned 0
	[0136.172] lstrlenA (lpString="*.php7") returned 6
	[0136.172] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.db") returned 0
	[0136.172] lstrlenA (lpString="*.db") returned 4
	[0136.172] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.swf") returned 0
	[0136.172] lstrlenA (lpString="*.swf") returned 5
	[0136.172] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.eml") returned 0
	[0136.172] lstrlenA (lpString="*.eml") returned 5
	[0136.172] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.part") returned 0
	[0136.172] lstrlenA (lpString="*.part") returned 6
	[0136.172] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.nfo") returned 0
	[0136.172] lstrlenA (lpString="*.nfo") returned 5
	[0136.172] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.rsa") returned 0
	[0136.172] lstrlenA (lpString="*.rsa") returned 5
	[0136.172] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.key") returned 0
	[0136.172] lstrlenA (lpString="*.key") returned 5
	[0136.172] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.aes") returned 0
	[0136.172] lstrlenA (lpString="*.aes") returned 5
	[0136.172] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.blob") returned 0
	[0136.172] lstrlenA (lpString="*.blob") returned 6
	[0136.172] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.btc") returned 0
	[0136.172] lstrlenA (lpString="*.btc") returned 5
	[0136.172] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1", pszSpec="*.wallet") returned 0
	[0136.172] lstrlenA (lpString="*.wallet") returned 8
	[0136.172] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x89817fa9, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x89817fa9, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x89817fa9, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Amcache.hve.LOG2", cAlternateFileName="AMCACH~2.LOG")) returned 1
	[0136.172] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.172] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Amcache.hve.LOG2") returned 1
	[0136.172] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Amcache.hve.LOG2") returned 1
	[0136.172] lstrcmpiA (lpString1="", lpString2="Amcache.hve.LOG2") returned -1
	[0136.172] PathFindFileNameA (pszPath="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG1") returned="Amcache.hve.LOG1"
	[0136.172] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\appcompat\\Programs\\" | out: lpString1="C:\\Windows\\appcompat\\Programs\\") returned="C:\\Windows\\appcompat\\Programs\\"
	[0136.172] PathAddBackslashA (in: pszPath="C:\\Windows\\appcompat\\Programs\\" | out: pszPath="C:\\Windows\\appcompat\\Programs\\") returned=""
	[0136.172] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\Programs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\appcompat\\Programs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\appcompat\\Programs\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.172] GetFileAttributesA (lpFileName="C:\\Windows\\appcompat\\Programs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\appcompat\\programs\\how-to-decrypt-files.htm")) returned 0x20
	[0136.173] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\Programs\\", lpString2="Amcache.hve.LOG2" | out: lpString1="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2") returned="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2"
	[0136.173] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.zip") returned 0
	[0136.173] lstrlenA (lpString="*.zip") returned 5
	[0136.173] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.rar") returned 0
	[0136.173] lstrlenA (lpString="*.rar") returned 5
	[0136.173] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.7z") returned 0
	[0136.173] lstrlenA (lpString="*.7z") returned 4
	[0136.173] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.tar") returned 0
	[0136.173] lstrlenA (lpString="*.tar") returned 5
	[0136.173] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.gzip") returned 0
	[0136.173] lstrlenA (lpString="*.gzip") returned 6
	[0136.173] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.jpg") returned 0
	[0136.173] lstrlenA (lpString="*.jpg") returned 5
	[0136.173] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.jpeg") returned 0
	[0136.173] lstrlenA (lpString="*.jpeg") returned 6
	[0136.173] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.bmp") returned 0
	[0136.173] lstrlenA (lpString="*.bmp") returned 5
	[0136.173] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.gif") returned 0
	[0136.173] lstrlenA (lpString="*.gif") returned 5
	[0136.173] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.png") returned 0
	[0136.173] lstrlenA (lpString="*.png") returned 5
	[0136.173] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.doc") returned 0
	[0136.173] lstrlenA (lpString="*.doc") returned 5
	[0136.173] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.docx") returned 0
	[0136.173] lstrlenA (lpString="*.docx") returned 6
	[0136.173] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.xls") returned 0
	[0136.173] lstrlenA (lpString="*.xls") returned 5
	[0136.173] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.xlsx") returned 0
	[0136.173] lstrlenA (lpString="*.xlsx") returned 6
	[0136.173] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.ppt") returned 0
	[0136.173] lstrlenA (lpString="*.ppt") returned 5
	[0136.173] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.pptx") returned 0
	[0136.173] lstrlenA (lpString="*.pptx") returned 6
	[0136.174] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.txt") returned 0
	[0136.174] lstrlenA (lpString="*.txt") returned 5
	[0136.174] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.pdf") returned 0
	[0136.174] lstrlenA (lpString="*.pdf") returned 5
	[0136.174] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.htm") returned 0
	[0136.174] lstrlenA (lpString="*.htm") returned 5
	[0136.174] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.html") returned 0
	[0136.174] lstrlenA (lpString="*.html") returned 6
	[0136.174] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.mdb") returned 0
	[0136.174] lstrlenA (lpString="*.mdb") returned 5
	[0136.174] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.pfx") returned 0
	[0136.174] lstrlenA (lpString="*.pfx") returned 5
	[0136.174] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.md") returned 0
	[0136.174] lstrlenA (lpString="*.md") returned 4
	[0136.174] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.lnk") returned 0
	[0136.174] lstrlenA (lpString="*.lnk") returned 5
	[0136.174] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.torrent") returned 0
	[0136.174] lstrlenA (lpString="*.torrent") returned 9
	[0136.174] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.mov") returned 0
	[0136.174] lstrlenA (lpString="*.mov") returned 5
	[0136.174] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.3gp") returned 0
	[0136.174] lstrlenA (lpString="*.3gp") returned 5
	[0136.174] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.mpeg") returned 0
	[0136.174] lstrlenA (lpString="*.mpeg") returned 6
	[0136.174] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.mpg") returned 0
	[0136.174] lstrlenA (lpString="*.mpg") returned 5
	[0136.174] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.flv") returned 0
	[0136.174] lstrlenA (lpString="*.flv") returned 5
	[0136.174] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.avi") returned 0
	[0136.174] lstrlenA (lpString="*.avi") returned 5
	[0136.174] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.mp4") returned 0
	[0136.174] lstrlenA (lpString="*.mp4") returned 5
	[0136.174] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.wmv") returned 0
	[0136.175] lstrlenA (lpString="*.wmv") returned 5
	[0136.175] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.mkv") returned 0
	[0136.175] lstrlenA (lpString="*.mkv") returned 5
	[0136.175] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.mp3") returned 0
	[0136.175] lstrlenA (lpString="*.mp3") returned 5
	[0136.175] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.wav") returned 0
	[0136.175] lstrlenA (lpString="*.wav") returned 5
	[0136.175] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.flac") returned 0
	[0136.175] lstrlenA (lpString="*.flac") returned 6
	[0136.175] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.wma") returned 0
	[0136.175] lstrlenA (lpString="*.wma") returned 5
	[0136.175] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.au3") returned 0
	[0136.175] lstrlenA (lpString="*.au3") returned 5
	[0136.175] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.ahk") returned 0
	[0136.175] lstrlenA (lpString="*.ahk") returned 5
	[0136.175] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.c") returned 0
	[0136.175] lstrlenA (lpString="*.c") returned 3
	[0136.175] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.cc") returned 0
	[0136.175] lstrlenA (lpString="*.cc") returned 4
	[0136.175] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.cpp") returned 0
	[0136.175] lstrlenA (lpString="*.cpp") returned 5
	[0136.175] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.cxx") returned 0
	[0136.175] lstrlenA (lpString="*.cxx") returned 5
	[0136.175] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.c++") returned 0
	[0136.175] lstrlenA (lpString="*.c++") returned 5
	[0136.175] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.cs") returned 0
	[0136.175] lstrlenA (lpString="*.cs") returned 4
	[0136.175] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.vb") returned 0
	[0136.175] lstrlenA (lpString="*.vb") returned 4
	[0136.175] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.bas") returned 0
	[0136.175] lstrlenA (lpString="*.bas") returned 5
	[0136.175] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.csproj") returned 0
	[0136.175] lstrlenA (lpString="*.csproj") returned 8
	[0136.175] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.vbproj") returned 0
	[0136.176] lstrlenA (lpString="*.vbproj") returned 8
	[0136.176] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.vcxproj") returned 0
	[0136.176] lstrlenA (lpString="*.vcxproj") returned 9
	[0136.176] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.manifest") returned 0
	[0136.176] lstrlenA (lpString="*.manifest") returned 10
	[0136.176] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.php") returned 0
	[0136.176] lstrlenA (lpString="*.php") returned 5
	[0136.176] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.vbe") returned 0
	[0136.176] lstrlenA (lpString="*.vbe") returned 5
	[0136.176] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.vba") returned 0
	[0136.176] lstrlenA (lpString="*.vba") returned 5
	[0136.176] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.vbs") returned 0
	[0136.176] lstrlenA (lpString="*.vbs") returned 5
	[0136.176] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.bat") returned 0
	[0136.176] lstrlenA (lpString="*.bat") returned 5
	[0136.176] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.cmd") returned 0
	[0136.176] lstrlenA (lpString="*.cmd") returned 5
	[0136.176] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.js") returned 0
	[0136.176] lstrlenA (lpString="*.js") returned 4
	[0136.176] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.jscript") returned 0
	[0136.176] lstrlenA (lpString="*.jscript") returned 9
	[0136.176] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.hta") returned 0
	[0136.176] lstrlenA (lpString="*.hta") returned 5
	[0136.176] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.php7") returned 0
	[0136.176] lstrlenA (lpString="*.php7") returned 6
	[0136.176] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.db") returned 0
	[0136.176] lstrlenA (lpString="*.db") returned 4
	[0136.176] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.swf") returned 0
	[0136.176] lstrlenA (lpString="*.swf") returned 5
	[0136.176] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.eml") returned 0
	[0136.176] lstrlenA (lpString="*.eml") returned 5
	[0136.176] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.part") returned 0
	[0136.176] lstrlenA (lpString="*.part") returned 6
	[0136.176] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.nfo") returned 0
	[0136.177] lstrlenA (lpString="*.nfo") returned 5
	[0136.177] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.rsa") returned 0
	[0136.177] lstrlenA (lpString="*.rsa") returned 5
	[0136.177] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.key") returned 0
	[0136.177] lstrlenA (lpString="*.key") returned 5
	[0136.177] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.aes") returned 0
	[0136.177] lstrlenA (lpString="*.aes") returned 5
	[0136.177] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.blob") returned 0
	[0136.177] lstrlenA (lpString="*.blob") returned 6
	[0136.177] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.btc") returned 0
	[0136.177] lstrlenA (lpString="*.btc") returned 5
	[0136.177] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2", pszSpec="*.wallet") returned 0
	[0136.177] lstrlenA (lpString="*.wallet") returned 8
	[0136.177] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4bbed9f1, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x4bbed9f1, ftLastAccessTime.dwHighDateTime=0x1d32747, ftLastWriteTime.dwLowDateTime=0x4bbed9f1, ftLastWriteTime.dwHighDateTime=0x1d32747, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Amcache.hve.tmp.LOG1", cAlternateFileName="AMCACH~3.LOG")) returned 1
	[0136.177] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.177] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Amcache.hve.tmp.LOG1") returned 1
	[0136.177] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Amcache.hve.tmp.LOG1") returned 1
	[0136.177] lstrcmpiA (lpString1="", lpString2="Amcache.hve.tmp.LOG1") returned -1
	[0136.177] PathFindFileNameA (pszPath="C:\\Windows\\appcompat\\Programs\\Amcache.hve.LOG2") returned="Amcache.hve.LOG2"
	[0136.177] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\appcompat\\Programs\\" | out: lpString1="C:\\Windows\\appcompat\\Programs\\") returned="C:\\Windows\\appcompat\\Programs\\"
	[0136.177] PathAddBackslashA (in: pszPath="C:\\Windows\\appcompat\\Programs\\" | out: pszPath="C:\\Windows\\appcompat\\Programs\\") returned=""
	[0136.177] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\Programs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\appcompat\\Programs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\appcompat\\Programs\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.177] GetFileAttributesA (lpFileName="C:\\Windows\\appcompat\\Programs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\appcompat\\programs\\how-to-decrypt-files.htm")) returned 0x20
	[0136.177] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\Programs\\", lpString2="Amcache.hve.tmp.LOG1" | out: lpString1="C:\\Windows\\appcompat\\Programs\\Amcache.hve.tmp.LOG1") returned="C:\\Windows\\appcompat\\Programs\\Amcache.hve.tmp.LOG1"
	[0136.177] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.tmp.LOG1", pszSpec="*.zip") returned 0
	[0136.177] lstrlenA (lpString="*.zip") returned 5
	[0136.177] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.tmp.LOG1", pszSpec="*.rar") returned 0
	[0136.177] lstrlenA (lpString="*.rar") returned 5
	[0136.177] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.tmp.LOG1", pszSpec="*.7z") returned 0
	[0136.177] lstrlenA (lpString="*.7z") returned 4
	[0136.177] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.tmp.LOG1", pszSpec="*.tar") returned 0
	[0136.178] lstrlenA (lpString="*.tar") returned 5
	[0136.178] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.tmp.LOG1", pszSpec="*.gzip") returned 0
	[0136.178] lstrlenA (lpString="*.gzip") returned 6
	[0136.178] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.tmp.LOG1", pszSpec="*.jpg") returned 0
	[0136.178] lstrlenA (lpString="*.jpg") returned 5
	[0136.178] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.tmp.LOG1", pszSpec="*.jpeg") returned 0
	[0136.178] lstrlenA (lpString="*.jpeg") returned 6
	[0136.178] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.tmp.LOG1", pszSpec="*.bmp") returned 0
	[0136.178] lstrlenA (lpString="*.bmp") returned 5
	[0136.178] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.tmp.LOG1", pszSpec="*.gif") returned 0
	[0136.178] lstrlenA (lpString="*.gif") returned 5
	[0136.178] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.tmp.LOG1", pszSpec="*.png") returned 0
	[0136.178] lstrlenA (lpString="*.png") returned 5
	[0136.178] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.tmp.LOG1", pszSpec="*.doc") returned 0
	[0136.178] lstrlenA (lpString="*.doc") returned 5
	[0136.178] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.tmp.LOG1", pszSpec="*.docx") returned 0
	[0136.178] lstrlenA (lpString="*.docx") returned 6
	[0136.178] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.tmp.LOG1", pszSpec="*.xls") returned 0
	[0136.178] lstrlenA (lpString="*.xls") returned 5
	[0136.178] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.tmp.LOG1", pszSpec="*.xlsx") returned 0
	[0136.178] lstrlenA (lpString="*.xlsx") returned 6
	[0136.178] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.tmp.LOG1", pszSpec="*.ppt") returned 0
	[0136.178] lstrlenA (lpString="*.ppt") returned 5
	[0136.178] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.tmp.LOG1", pszSpec="*.pptx") returned 0
	[0136.178] lstrlenA (lpString="*.pptx") returned 6
	[0136.178] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.tmp.LOG1", pszSpec="*.txt") returned 0
	[0136.178] lstrlenA (lpString="*.txt") returned 5
	[0136.178] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.tmp.LOG1", pszSpec="*.pdf") returned 0
	[0136.178] lstrlenA (lpString="*.pdf") returned 5
	[0136.178] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.tmp.LOG1", pszSpec="*.htm") returned 0
	[0136.178] lstrlenA (lpString="*.htm") returned 5
	[0136.178] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.tmp.LOG1", pszSpec="*.html") returned 0
	[0136.178] lstrlenA (lpString="*.html") returned 6
	[0136.179] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.tmp.LOG1", pszSpec="*.mdb") returned 0
	[0136.179] lstrlenA (lpString="*.mdb") returned 5
	[0136.179] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.tmp.LOG1", pszSpec="*.pfx") returned 0
	[0136.179] lstrlenA (lpString="*.pfx") returned 5
	[0136.179] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.tmp.LOG1", pszSpec="*.md") returned 0
	[0136.179] lstrlenA (lpString="*.md") returned 4
	[0136.179] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.tmp.LOG1", pszSpec="*.lnk") returned 0
	[0136.179] lstrlenA (lpString="*.lnk") returned 5
	[0136.179] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.tmp.LOG1", pszSpec="*.torrent") returned 0
	[0136.179] lstrlenA (lpString="*.torrent") returned 9
	[0136.179] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.tmp.LOG1", pszSpec="*.mov") returned 0
	[0136.179] lstrlenA (lpString="*.mov") returned 5
	[0136.179] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.tmp.LOG1", pszSpec="*.3gp") returned 0
	[0136.179] lstrlenA (lpString="*.3gp") returned 5
	[0136.179] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.tmp.LOG1", pszSpec="*.mpeg") returned 0
	[0136.179] lstrlenA (lpString="*.mpeg") returned 6
	[0136.179] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.tmp.LOG1", pszSpec="*.mpg") returned 0
	[0136.179] lstrlenA (lpString="*.mpg") returned 5
	[0136.179] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\Programs\\Amcache.hve.tmp.LOG1", pszSpec="*.flv") returned 0
	[0136.179] lstrlenA (lpString="*.flv") returned 5
	[0136.180] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4bbed9f1, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x4bbed9f1, ftLastAccessTime.dwHighDateTime=0x1d32747, ftLastWriteTime.dwLowDateTime=0x4bbed9f1, ftLastWriteTime.dwHighDateTime=0x1d32747, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Amcache.hve.tmp.LOG2", cAlternateFileName="AMCACH~4.LOG")) returned 1
	[0136.180] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.180] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Amcache.hve.tmp.LOG2") returned 1
	[0136.180] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Amcache.hve.tmp.LOG2") returned 1
	[0136.180] lstrcmpiA (lpString1="", lpString2="Amcache.hve.tmp.LOG2") returned -1
	[0136.180] PathFindFileNameA (pszPath="C:\\Windows\\appcompat\\Programs\\Amcache.hve.tmp.LOG1") returned="Amcache.hve.tmp.LOG1"
	[0136.180] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\appcompat\\Programs\\" | out: lpString1="C:\\Windows\\appcompat\\Programs\\") returned="C:\\Windows\\appcompat\\Programs\\"
	[0136.180] PathAddBackslashA (in: pszPath="C:\\Windows\\appcompat\\Programs\\" | out: pszPath="C:\\Windows\\appcompat\\Programs\\") returned=""
	[0136.180] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\Programs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\appcompat\\Programs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\appcompat\\Programs\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.180] GetFileAttributesA (lpFileName="C:\\Windows\\appcompat\\Programs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\appcompat\\programs\\how-to-decrypt-files.htm")) returned 0x20
	[0136.180] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\Programs\\", lpString2="Amcache.hve.tmp.LOG2" | out: lpString1="C:\\Windows\\appcompat\\Programs\\Amcache.hve.tmp.LOG2") returned="C:\\Windows\\appcompat\\Programs\\Amcache.hve.tmp.LOG2"
	[0136.180] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc5e1b56, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0xc5e1b56, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0xdbb9e12, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Amcache.hve{c7ddffe0-9313-11e7-a915-e8daaaf0a0ed}.TM.blf", cAlternateFileName="AMCACH~1.BLF")) returned 1
	[0136.180] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.180] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Amcache.hve{c7ddffe0-9313-11e7-a915-e8daaaf0a0ed}.TM.blf") returned 1
	[0136.180] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Amcache.hve{c7ddffe0-9313-11e7-a915-e8daaaf0a0ed}.TM.blf") returned 1
	[0136.180] lstrcmpiA (lpString1="", lpString2="Amcache.hve{c7ddffe0-9313-11e7-a915-e8daaaf0a0ed}.TM.blf") returned -1
	[0136.180] PathFindFileNameA (pszPath="C:\\Windows\\appcompat\\Programs\\Amcache.hve.tmp.LOG2") returned="Amcache.hve.tmp.LOG2"
	[0136.180] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\appcompat\\Programs\\" | out: lpString1="C:\\Windows\\appcompat\\Programs\\") returned="C:\\Windows\\appcompat\\Programs\\"
	[0136.180] PathAddBackslashA (in: pszPath="C:\\Windows\\appcompat\\Programs\\" | out: pszPath="C:\\Windows\\appcompat\\Programs\\") returned=""
	[0136.180] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\Programs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\appcompat\\Programs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\appcompat\\Programs\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.180] GetFileAttributesA (lpFileName="C:\\Windows\\appcompat\\Programs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\appcompat\\programs\\how-to-decrypt-files.htm")) returned 0x20
	[0136.180] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\Programs\\", lpString2="Amcache.hve{c7ddffe0-9313-11e7-a915-e8daaaf0a0ed}.TM.blf" | out: lpString1="C:\\Windows\\appcompat\\Programs\\Amcache.hve{c7ddffe0-9313-11e7-a915-e8daaaf0a0ed}.TM.blf") returned="C:\\Windows\\appcompat\\Programs\\Amcache.hve{c7ddffe0-9313-11e7-a915-e8daaaf0a0ed}.TM.blf"
	[0136.181] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcd550e9, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0xcd550e9, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0xdbb9e12, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Amcache.hve{c7ddffe0-9313-11e7-a915-e8daaaf0a0ed}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="AMCACH~1.REG")) returned 1
	[0136.181] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.181] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Amcache.hve{c7ddffe0-9313-11e7-a915-e8daaaf0a0ed}.TMContainer00000000000000000001.regtrans-ms") returned 1
	[0136.181] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Amcache.hve{c7ddffe0-9313-11e7-a915-e8daaaf0a0ed}.TMContainer00000000000000000001.regtrans-ms") returned 1
	[0136.181] lstrcmpiA (lpString1="", lpString2="Amcache.hve{c7ddffe0-9313-11e7-a915-e8daaaf0a0ed}.TMContainer00000000000000000001.regtrans-ms") returned -1
	[0136.181] PathFindFileNameA (pszPath="C:\\Windows\\appcompat\\Programs\\Amcache.hve{c7ddffe0-9313-11e7-a915-e8daaaf0a0ed}.TM.blf") returned="Amcache.hve{c7ddffe0-9313-11e7-a915-e8daaaf0a0ed}.TM.blf"
	[0136.181] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\appcompat\\Programs\\" | out: lpString1="C:\\Windows\\appcompat\\Programs\\") returned="C:\\Windows\\appcompat\\Programs\\"
	[0136.181] PathAddBackslashA (in: pszPath="C:\\Windows\\appcompat\\Programs\\" | out: pszPath="C:\\Windows\\appcompat\\Programs\\") returned=""
	[0136.181] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\Programs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\appcompat\\Programs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\appcompat\\Programs\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.181] GetFileAttributesA (lpFileName="C:\\Windows\\appcompat\\Programs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\appcompat\\programs\\how-to-decrypt-files.htm")) returned 0x20
	[0136.181] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\Programs\\", lpString2="Amcache.hve{c7ddffe0-9313-11e7-a915-e8daaaf0a0ed}.TMContainer00000000000000000001.regtrans-ms" | out: lpString1="C:\\Windows\\appcompat\\Programs\\Amcache.hve{c7ddffe0-9313-11e7-a915-e8daaaf0a0ed}.TMContainer00000000000000000001.regtrans-ms") returned="C:\\Windows\\appcompat\\Programs\\Amcache.hve{c7ddffe0-9313-11e7-a915-e8daaaf0a0ed}.TMContainer00000000000000000001.regtrans-ms"
	[0136.181] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd2b2593, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0xd2b2593, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0xdbb9e12, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Amcache.hve{c7ddffe0-9313-11e7-a915-e8daaaf0a0ed}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="AMCACH~2.REG")) returned 1
	[0136.181] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.181] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Amcache.hve{c7ddffe0-9313-11e7-a915-e8daaaf0a0ed}.TMContainer00000000000000000002.regtrans-ms") returned 1
	[0136.181] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Amcache.hve{c7ddffe0-9313-11e7-a915-e8daaaf0a0ed}.TMContainer00000000000000000002.regtrans-ms") returned 1
	[0136.181] lstrcmpiA (lpString1="", lpString2="Amcache.hve{c7ddffe0-9313-11e7-a915-e8daaaf0a0ed}.TMContainer00000000000000000002.regtrans-ms") returned -1
	[0136.181] PathFindFileNameA (pszPath="C:\\Windows\\appcompat\\Programs\\Amcache.hve{c7ddffe0-9313-11e7-a915-e8daaaf0a0ed}.TMContainer00000000000000000001.regtrans-ms") returned="Amcache.hve{c7ddffe0-9313-11e7-a915-e8daaaf0a0ed}.TMContainer00000000000000000001.regtrans-ms"
	[0136.181] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\appcompat\\Programs\\" | out: lpString1="C:\\Windows\\appcompat\\Programs\\") returned="C:\\Windows\\appcompat\\Programs\\"
	[0136.181] PathAddBackslashA (in: pszPath="C:\\Windows\\appcompat\\Programs\\" | out: pszPath="C:\\Windows\\appcompat\\Programs\\") returned=""
	[0136.181] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\Programs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\appcompat\\Programs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\appcompat\\Programs\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.181] GetFileAttributesA (lpFileName="C:\\Windows\\appcompat\\Programs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\appcompat\\programs\\how-to-decrypt-files.htm")) returned 0x20
	[0136.181] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\Programs\\", lpString2="Amcache.hve{c7ddffe0-9313-11e7-a915-e8daaaf0a0ed}.TMContainer00000000000000000002.regtrans-ms" | out: lpString1="C:\\Windows\\appcompat\\Programs\\Amcache.hve{c7ddffe0-9313-11e7-a915-e8daaaf0a0ed}.TMContainer00000000000000000002.regtrans-ms") returned="C:\\Windows\\appcompat\\Programs\\Amcache.hve{c7ddffe0-9313-11e7-a915-e8daaaf0a0ed}.TMContainer00000000000000000002.regtrans-ms"
	[0136.182] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x872c5f20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x872c5f20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x8778aa65, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Amcache.hve{fae99309-933c-11e7-a51d-b808901d6c9b}.TM.blf", cAlternateFileName="AMCACH~2.BLF")) returned 1
	[0136.182] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.182] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Amcache.hve{fae99309-933c-11e7-a51d-b808901d6c9b}.TM.blf") returned 1
	[0136.182] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Amcache.hve{fae99309-933c-11e7-a51d-b808901d6c9b}.TM.blf") returned 1
	[0136.182] lstrcmpiA (lpString1="", lpString2="Amcache.hve{fae99309-933c-11e7-a51d-b808901d6c9b}.TM.blf") returned -1
	[0136.182] PathFindFileNameA (pszPath="C:\\Windows\\appcompat\\Programs\\Amcache.hve{c7ddffe0-9313-11e7-a915-e8daaaf0a0ed}.TMContainer00000000000000000002.regtrans-ms") returned="Amcache.hve{c7ddffe0-9313-11e7-a915-e8daaaf0a0ed}.TMContainer00000000000000000002.regtrans-ms"
	[0136.182] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\appcompat\\Programs\\" | out: lpString1="C:\\Windows\\appcompat\\Programs\\") returned="C:\\Windows\\appcompat\\Programs\\"
	[0136.182] PathAddBackslashA (in: pszPath="C:\\Windows\\appcompat\\Programs\\" | out: pszPath="C:\\Windows\\appcompat\\Programs\\") returned=""
	[0136.182] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\Programs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\appcompat\\Programs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\appcompat\\Programs\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.182] GetFileAttributesA (lpFileName="C:\\Windows\\appcompat\\Programs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\appcompat\\programs\\how-to-decrypt-files.htm")) returned 0x20
	[0136.182] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\Programs\\", lpString2="Amcache.hve{fae99309-933c-11e7-a51d-b808901d6c9b}.TM.blf" | out: lpString1="C:\\Windows\\appcompat\\Programs\\Amcache.hve{fae99309-933c-11e7-a51d-b808901d6c9b}.TM.blf") returned="C:\\Windows\\appcompat\\Programs\\Amcache.hve{fae99309-933c-11e7-a51d-b808901d6c9b}.TM.blf"
	[0136.182] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x874437d0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x874437d0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x876f208b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Amcache.hve{fae99309-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="AMCACH~3.REG")) returned 1
	[0136.182] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.182] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Amcache.hve{fae99309-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms") returned 1
	[0136.182] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Amcache.hve{fae99309-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms") returned 1
	[0136.182] lstrcmpiA (lpString1="", lpString2="Amcache.hve{fae99309-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms") returned -1
	[0136.182] PathFindFileNameA (pszPath="C:\\Windows\\appcompat\\Programs\\Amcache.hve{fae99309-933c-11e7-a51d-b808901d6c9b}.TM.blf") returned="Amcache.hve{fae99309-933c-11e7-a51d-b808901d6c9b}.TM.blf"
	[0136.182] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\appcompat\\Programs\\" | out: lpString1="C:\\Windows\\appcompat\\Programs\\") returned="C:\\Windows\\appcompat\\Programs\\"
	[0136.182] PathAddBackslashA (in: pszPath="C:\\Windows\\appcompat\\Programs\\" | out: pszPath="C:\\Windows\\appcompat\\Programs\\") returned=""
	[0136.182] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\Programs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\appcompat\\Programs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\appcompat\\Programs\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.182] GetFileAttributesA (lpFileName="C:\\Windows\\appcompat\\Programs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\appcompat\\programs\\how-to-decrypt-files.htm")) returned 0x20
	[0136.182] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\Programs\\", lpString2="Amcache.hve{fae99309-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" | out: lpString1="C:\\Windows\\appcompat\\Programs\\Amcache.hve{fae99309-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms") returned="C:\\Windows\\appcompat\\Programs\\Amcache.hve{fae99309-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms"
	[0136.183] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8763352c, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8763352c, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x8778aa65, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Amcache.hve{fae99309-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="AMCACH~4.REG")) returned 1
	[0136.183] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.183] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Amcache.hve{fae99309-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms") returned 1
	[0136.183] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Amcache.hve{fae99309-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms") returned 1
	[0136.183] lstrcmpiA (lpString1="", lpString2="Amcache.hve{fae99309-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms") returned -1
	[0136.183] PathFindFileNameA (pszPath="C:\\Windows\\appcompat\\Programs\\Amcache.hve{fae99309-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms") returned="Amcache.hve{fae99309-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms"
	[0136.183] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\appcompat\\Programs\\" | out: lpString1="C:\\Windows\\appcompat\\Programs\\") returned="C:\\Windows\\appcompat\\Programs\\"
	[0136.183] PathAddBackslashA (in: pszPath="C:\\Windows\\appcompat\\Programs\\" | out: pszPath="C:\\Windows\\appcompat\\Programs\\") returned=""
	[0136.183] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\Programs\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\appcompat\\Programs\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\appcompat\\Programs\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.183] GetFileAttributesA (lpFileName="C:\\Windows\\appcompat\\Programs\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\appcompat\\programs\\how-to-decrypt-files.htm")) returned 0x20
	[0136.183] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\Programs\\", lpString2="Amcache.hve{fae99309-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" | out: lpString1="C:\\Windows\\appcompat\\Programs\\Amcache.hve{fae99309-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms") returned="C:\\Windows\\appcompat\\Programs\\Amcache.hve{fae99309-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms"
	[0136.183] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8763352c, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8763352c, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x8778aa65, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Amcache.hve{fae99309-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="AMCACH~4.REG")) returned 0
	[0136.183] FindClose (in: hFindFile=0x7cb650 | out: hFindFile=0x7cb650) returned 1
	[0136.183] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7482c44, ftCreationTime.dwHighDateTime=0x1d3278b, ftLastAccessTime.dwLowDateTime=0xd2ee3ced, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xd2ee3ced, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UA", cAlternateFileName="")) returned 1
	[0136.183] lstrcmpA (lpString1=".", lpString2="UA") returned -1
	[0136.183] lstrcmpA (lpString1="..", lpString2="UA") returned -1
	[0136.183] PathFindFileNameA (pszPath="C:\\Windows\\appcompat\\*.*") returned="*.*"
	[0136.183] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\", lpString2="UA" | out: lpString1="C:\\Windows\\appcompat\\UA") returned="C:\\Windows\\appcompat\\UA"
	[0136.183] FindFirstFileA (in: lpFileName="C:\\Windows\\appcompat\\UA\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7482c44, ftCreationTime.dwHighDateTime=0x1d3278b, ftLastAccessTime.dwLowDateTime=0xd2ee3ced, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xd2ee3ced, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbad0
	[0136.184] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.184] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7482c44, ftCreationTime.dwHighDateTime=0x1d3278b, ftLastAccessTime.dwLowDateTime=0xd2ee3ced, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xd2ee3ced, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.184] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.184] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.184] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2ee3ced, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0xd2ee3ced, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xdc3c054, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x317, dwReserved0=0x0, dwReserved1=0x0, cFileName="Appraiser_RS3.JSON", cAlternateFileName="APPRAI~1.JSO")) returned 1
	[0136.184] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.184] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Appraiser_RS3.JSON") returned 1
	[0136.184] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Appraiser_RS3.JSON") returned 1
	[0136.184] lstrcmpiA (lpString1="", lpString2="Appraiser_RS3.JSON") returned -1
	[0136.184] PathFindFileNameA (pszPath="C:\\Windows\\appcompat\\UA\\*.*") returned="*.*"
	[0136.184] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\appcompat\\UA\\" | out: lpString1="C:\\Windows\\appcompat\\UA\\") returned="C:\\Windows\\appcompat\\UA\\"
	[0136.184] PathAddBackslashA (in: pszPath="C:\\Windows\\appcompat\\UA\\" | out: pszPath="C:\\Windows\\appcompat\\UA\\") returned=""
	[0136.184] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\UA\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\appcompat\\UA\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\appcompat\\UA\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.184] GetFileAttributesA (lpFileName="C:\\Windows\\appcompat\\UA\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\appcompat\\ua\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.184] CreateFileA (lpFileName="C:\\Windows\\appcompat\\UA\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\appcompat\\ua\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0136.187] WriteFile (in: hFile=0x20c, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0136.188] SetFileTime (hFile=0x20c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.188] CloseHandle (hObject=0x20c) returned 1
	[0136.188] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\UA\\", lpString2="Appraiser_RS3.JSON" | out: lpString1="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON") returned="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON"
	[0136.188] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.zip") returned 0
	[0136.188] lstrlenA (lpString="*.zip") returned 5
	[0136.188] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.rar") returned 0
	[0136.188] lstrlenA (lpString="*.rar") returned 5
	[0136.188] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.7z") returned 0
	[0136.188] lstrlenA (lpString="*.7z") returned 4
	[0136.188] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.tar") returned 0
	[0136.188] lstrlenA (lpString="*.tar") returned 5
	[0136.188] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.gzip") returned 0
	[0136.188] lstrlenA (lpString="*.gzip") returned 6
	[0136.188] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.jpg") returned 0
	[0136.188] lstrlenA (lpString="*.jpg") returned 5
	[0136.188] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.jpeg") returned 0
	[0136.188] lstrlenA (lpString="*.jpeg") returned 6
	[0136.188] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.bmp") returned 0
	[0136.188] lstrlenA (lpString="*.bmp") returned 5
	[0136.188] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.gif") returned 0
	[0136.188] lstrlenA (lpString="*.gif") returned 5
	[0136.188] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.png") returned 0
	[0136.188] lstrlenA (lpString="*.png") returned 5
	[0136.188] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.doc") returned 0
	[0136.189] lstrlenA (lpString="*.doc") returned 5
	[0136.189] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.docx") returned 0
	[0136.189] lstrlenA (lpString="*.docx") returned 6
	[0136.189] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.xls") returned 0
	[0136.189] lstrlenA (lpString="*.xls") returned 5
	[0136.189] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.xlsx") returned 0
	[0136.189] lstrlenA (lpString="*.xlsx") returned 6
	[0136.189] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.ppt") returned 0
	[0136.189] lstrlenA (lpString="*.ppt") returned 5
	[0136.189] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.pptx") returned 0
	[0136.189] lstrlenA (lpString="*.pptx") returned 6
	[0136.189] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.txt") returned 0
	[0136.189] lstrlenA (lpString="*.txt") returned 5
	[0136.189] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.pdf") returned 0
	[0136.189] lstrlenA (lpString="*.pdf") returned 5
	[0136.189] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.htm") returned 0
	[0136.189] lstrlenA (lpString="*.htm") returned 5
	[0136.189] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.html") returned 0
	[0136.189] lstrlenA (lpString="*.html") returned 6
	[0136.189] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.mdb") returned 0
	[0136.189] lstrlenA (lpString="*.mdb") returned 5
	[0136.189] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.pfx") returned 0
	[0136.189] lstrlenA (lpString="*.pfx") returned 5
	[0136.189] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.md") returned 0
	[0136.189] lstrlenA (lpString="*.md") returned 4
	[0136.189] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.lnk") returned 0
	[0136.189] lstrlenA (lpString="*.lnk") returned 5
	[0136.189] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.torrent") returned 0
	[0136.189] lstrlenA (lpString="*.torrent") returned 9
	[0136.189] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.mov") returned 0
	[0136.189] lstrlenA (lpString="*.mov") returned 5
	[0136.189] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.3gp") returned 0
	[0136.189] lstrlenA (lpString="*.3gp") returned 5
	[0136.189] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.mpeg") returned 0
	[0136.190] lstrlenA (lpString="*.mpeg") returned 6
	[0136.190] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.mpg") returned 0
	[0136.190] lstrlenA (lpString="*.mpg") returned 5
	[0136.190] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.flv") returned 0
	[0136.190] lstrlenA (lpString="*.flv") returned 5
	[0136.190] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.avi") returned 0
	[0136.190] lstrlenA (lpString="*.avi") returned 5
	[0136.190] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.mp4") returned 0
	[0136.190] lstrlenA (lpString="*.mp4") returned 5
	[0136.190] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.wmv") returned 0
	[0136.190] lstrlenA (lpString="*.wmv") returned 5
	[0136.190] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.mkv") returned 0
	[0136.190] lstrlenA (lpString="*.mkv") returned 5
	[0136.190] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.mp3") returned 0
	[0136.190] lstrlenA (lpString="*.mp3") returned 5
	[0136.190] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.wav") returned 0
	[0136.190] lstrlenA (lpString="*.wav") returned 5
	[0136.190] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.flac") returned 0
	[0136.190] lstrlenA (lpString="*.flac") returned 6
	[0136.190] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.wma") returned 0
	[0136.190] lstrlenA (lpString="*.wma") returned 5
	[0136.190] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.au3") returned 0
	[0136.190] lstrlenA (lpString="*.au3") returned 5
	[0136.190] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.ahk") returned 0
	[0136.190] lstrlenA (lpString="*.ahk") returned 5
	[0136.190] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.c") returned 0
	[0136.190] lstrlenA (lpString="*.c") returned 3
	[0136.190] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.cc") returned 0
	[0136.190] lstrlenA (lpString="*.cc") returned 4
	[0136.190] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.cpp") returned 0
	[0136.190] lstrlenA (lpString="*.cpp") returned 5
	[0136.190] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.cxx") returned 0
	[0136.190] lstrlenA (lpString="*.cxx") returned 5
	[0136.191] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.c++") returned 0
	[0136.191] lstrlenA (lpString="*.c++") returned 5
	[0136.191] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.cs") returned 0
	[0136.191] lstrlenA (lpString="*.cs") returned 4
	[0136.191] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.vb") returned 0
	[0136.191] lstrlenA (lpString="*.vb") returned 4
	[0136.191] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.bas") returned 0
	[0136.191] lstrlenA (lpString="*.bas") returned 5
	[0136.191] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.csproj") returned 0
	[0136.191] lstrlenA (lpString="*.csproj") returned 8
	[0136.191] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.vbproj") returned 0
	[0136.191] lstrlenA (lpString="*.vbproj") returned 8
	[0136.191] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.vcxproj") returned 0
	[0136.191] lstrlenA (lpString="*.vcxproj") returned 9
	[0136.191] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.manifest") returned 0
	[0136.191] lstrlenA (lpString="*.manifest") returned 10
	[0136.191] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.php") returned 0
	[0136.191] lstrlenA (lpString="*.php") returned 5
	[0136.191] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.vbe") returned 0
	[0136.191] lstrlenA (lpString="*.vbe") returned 5
	[0136.191] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.vba") returned 0
	[0136.191] lstrlenA (lpString="*.vba") returned 5
	[0136.191] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.vbs") returned 0
	[0136.191] lstrlenA (lpString="*.vbs") returned 5
	[0136.191] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.bat") returned 0
	[0136.191] lstrlenA (lpString="*.bat") returned 5
	[0136.191] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.cmd") returned 0
	[0136.191] lstrlenA (lpString="*.cmd") returned 5
	[0136.191] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.js") returned 0
	[0136.191] lstrlenA (lpString="*.js") returned 4
	[0136.191] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.jscript") returned 0
	[0136.191] lstrlenA (lpString="*.jscript") returned 9
	[0136.191] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.hta") returned 0
	[0136.192] lstrlenA (lpString="*.hta") returned 5
	[0136.192] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.php7") returned 0
	[0136.192] lstrlenA (lpString="*.php7") returned 6
	[0136.192] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.db") returned 0
	[0136.192] lstrlenA (lpString="*.db") returned 4
	[0136.192] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.swf") returned 0
	[0136.192] lstrlenA (lpString="*.swf") returned 5
	[0136.192] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.eml") returned 0
	[0136.192] lstrlenA (lpString="*.eml") returned 5
	[0136.192] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.part") returned 0
	[0136.192] lstrlenA (lpString="*.part") returned 6
	[0136.192] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.nfo") returned 0
	[0136.192] lstrlenA (lpString="*.nfo") returned 5
	[0136.192] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.rsa") returned 0
	[0136.192] lstrlenA (lpString="*.rsa") returned 5
	[0136.192] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.key") returned 0
	[0136.192] lstrlenA (lpString="*.key") returned 5
	[0136.192] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.aes") returned 0
	[0136.192] lstrlenA (lpString="*.aes") returned 5
	[0136.192] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.blob") returned 0
	[0136.192] lstrlenA (lpString="*.blob") returned 6
	[0136.192] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.btc") returned 0
	[0136.192] lstrlenA (lpString="*.btc") returned 5
	[0136.192] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON", pszSpec="*.wallet") returned 0
	[0136.192] lstrlenA (lpString="*.wallet") returned 8
	[0136.192] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e8b55f, ftCreationTime.dwHighDateTime=0x1d3278c, ftLastAccessTime.dwLowDateTime=0x5e8b55f, ftLastAccessTime.dwHighDateTime=0x1d3278c, ftLastWriteTime.dwLowDateTime=0xd79d5c7, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x185, dwReserved0=0x0, dwReserved1=0x1, cFileName="GenericApp.png", cAlternateFileName="GENERI~1.PNG")) returned 1
	[0136.192] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.192] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="GenericApp.png") returned -1
	[0136.192] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="GenericApp.png") returned 1
	[0136.192] lstrcmpiA (lpString1="", lpString2="GenericApp.png") returned -1
	[0136.192] PathFindFileNameA (pszPath="C:\\Windows\\appcompat\\UA\\Appraiser_RS3.JSON") returned="Appraiser_RS3.JSON"
	[0136.192] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\appcompat\\UA\\" | out: lpString1="C:\\Windows\\appcompat\\UA\\") returned="C:\\Windows\\appcompat\\UA\\"
	[0136.192] PathAddBackslashA (in: pszPath="C:\\Windows\\appcompat\\UA\\" | out: pszPath="C:\\Windows\\appcompat\\UA\\") returned=""
	[0136.192] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\UA\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\appcompat\\UA\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\appcompat\\UA\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.193] GetFileAttributesA (lpFileName="C:\\Windows\\appcompat\\UA\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\appcompat\\ua\\how-to-decrypt-files.htm")) returned 0x20
	[0136.193] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\UA\\", lpString2="GenericApp.png" | out: lpString1="C:\\Windows\\appcompat\\UA\\GenericApp.png") returned="C:\\Windows\\appcompat\\UA\\GenericApp.png"
	[0136.193] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\GenericApp.png", pszSpec="*.zip") returned 0
	[0136.193] lstrlenA (lpString="*.zip") returned 5
	[0136.193] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\GenericApp.png", pszSpec="*.rar") returned 0
	[0136.193] lstrlenA (lpString="*.rar") returned 5
	[0136.193] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\GenericApp.png", pszSpec="*.7z") returned 0
	[0136.193] lstrlenA (lpString="*.7z") returned 4
	[0136.193] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\GenericApp.png", pszSpec="*.tar") returned 0
	[0136.193] lstrlenA (lpString="*.tar") returned 5
	[0136.193] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\GenericApp.png", pszSpec="*.gzip") returned 0
	[0136.193] lstrlenA (lpString="*.gzip") returned 6
	[0136.193] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\GenericApp.png", pszSpec="*.jpg") returned 0
	[0136.193] lstrlenA (lpString="*.jpg") returned 5
	[0136.193] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\GenericApp.png", pszSpec="*.jpeg") returned 0
	[0136.193] lstrlenA (lpString="*.jpeg") returned 6
	[0136.193] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\GenericApp.png", pszSpec="*.bmp") returned 0
	[0136.193] lstrlenA (lpString="*.bmp") returned 5
	[0136.193] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\GenericApp.png", pszSpec="*.gif") returned 0
	[0136.193] lstrlenA (lpString="*.gif") returned 5
	[0136.193] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\GenericApp.png", pszSpec="*.png") returned 1
	[0136.193] lstrlenA (lpString="*.png") returned 5
	[0136.193] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\appcompat\\UA\\GenericApp.png" | out: lpString1="C:\\Windows\\appcompat\\UA\\GenericApp.png") returned="C:\\Windows\\appcompat\\UA\\GenericApp.png"
	[0136.193] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\appcompat\\UA\\GenericApp.png" | out: lpString1="C:\\Windows\\appcompat\\UA\\GenericApp.png") returned="C:\\Windows\\appcompat\\UA\\GenericApp.png"
	[0136.193] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\UA\\GenericApp.png", lpString2="." | out: lpString1="C:\\Windows\\appcompat\\UA\\GenericApp.png.") returned="C:\\Windows\\appcompat\\UA\\GenericApp.png."
	[0136.193] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\UA\\GenericApp.png.", lpString2="exe" | out: lpString1="C:\\Windows\\appcompat\\UA\\GenericApp.png.exe") returned="C:\\Windows\\appcompat\\UA\\GenericApp.png.exe"
	[0136.193] CreateFileA (lpFileName="C:\\Windows\\appcompat\\UA\\GenericApp.png" (normalized: "c:\\windows\\appcompat\\ua\\genericapp.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0136.194] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x185
	[0136.194] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5e8b55f, dwHighDateTime=0x1d3278c), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e8b55f, dwHighDateTime=0x1d3278c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xd79d5c7, dwHighDateTime=0x1d3375b)) returned 1
	[0136.194] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0136.194] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x143, lpOverlapped=0x0) returned 1
	[0136.195] PathFindFileNameA (pszPath="C:\\Windows\\appcompat\\UA\\GenericApp.png") returned="GenericApp.png"
	[0136.196] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0136.196] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x143, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x143, lpOverlapped=0x0) returned 1
	[0136.196] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0136.196] CloseHandle (hObject=0x20c) returned 1
	[0136.196] MoveFileA (lpExistingFileName="C:\\Windows\\appcompat\\UA\\GenericApp.png" (normalized: "c:\\windows\\appcompat\\ua\\genericapp.png"), lpNewFileName="C:\\Windows\\appcompat\\UA\\GenericApp.png.exe" (normalized: "c:\\windows\\appcompat\\ua\\genericapp.png.exe")) returned 1
	[0136.197] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eed103, ftCreationTime.dwHighDateTime=0x1d3278c, ftLastAccessTime.dwLowDateTime=0x5eed103, ftLastAccessTime.dwHighDateTime=0x1d3278c, ftLastWriteTime.dwLowDateTime=0x5f1e052, ftLastWriteTime.dwHighDateTime=0x1d3278c, nFileSizeHigh=0x0, nFileSizeLow=0x992, dwReserved0=0x12, dwReserved1=0x1, cFileName="GenericError.png", cAlternateFileName="GENERI~2.PNG")) returned 1
	[0136.197] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.197] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="GenericError.png") returned -1
	[0136.197] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="GenericError.png") returned 1
	[0136.197] lstrcmpiA (lpString1="", lpString2="GenericError.png") returned -1
	[0136.197] PathFindFileNameA (pszPath="C:\\Windows\\appcompat\\UA\\GenericApp.png") returned="GenericApp.png"
	[0136.197] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\appcompat\\UA\\" | out: lpString1="C:\\Windows\\appcompat\\UA\\") returned="C:\\Windows\\appcompat\\UA\\"
	[0136.197] PathAddBackslashA (in: pszPath="C:\\Windows\\appcompat\\UA\\" | out: pszPath="C:\\Windows\\appcompat\\UA\\") returned=""
	[0136.197] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\UA\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\appcompat\\UA\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\appcompat\\UA\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.197] GetFileAttributesA (lpFileName="C:\\Windows\\appcompat\\UA\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\appcompat\\ua\\how-to-decrypt-files.htm")) returned 0x20
	[0136.197] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\UA\\", lpString2="GenericError.png" | out: lpString1="C:\\Windows\\appcompat\\UA\\GenericError.png") returned="C:\\Windows\\appcompat\\UA\\GenericError.png"
	[0136.197] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\GenericError.png", pszSpec="*.zip") returned 0
	[0136.197] lstrlenA (lpString="*.zip") returned 5
	[0136.197] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\GenericError.png", pszSpec="*.rar") returned 0
	[0136.197] lstrlenA (lpString="*.rar") returned 5
	[0136.197] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\GenericError.png", pszSpec="*.7z") returned 0
	[0136.197] lstrlenA (lpString="*.7z") returned 4
	[0136.197] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\GenericError.png", pszSpec="*.tar") returned 0
	[0136.197] lstrlenA (lpString="*.tar") returned 5
	[0136.197] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\GenericError.png", pszSpec="*.gzip") returned 0
	[0136.197] lstrlenA (lpString="*.gzip") returned 6
	[0136.197] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\GenericError.png", pszSpec="*.jpg") returned 0
	[0136.197] lstrlenA (lpString="*.jpg") returned 5
	[0136.197] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\GenericError.png", pszSpec="*.jpeg") returned 0
	[0136.197] lstrlenA (lpString="*.jpeg") returned 6
	[0136.197] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\GenericError.png", pszSpec="*.bmp") returned 0
	[0136.197] lstrlenA (lpString="*.bmp") returned 5
	[0136.197] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\GenericError.png", pszSpec="*.gif") returned 0
	[0136.197] lstrlenA (lpString="*.gif") returned 5
	[0136.197] PathMatchSpecA (pszFile="C:\\Windows\\appcompat\\UA\\GenericError.png", pszSpec="*.png") returned 1
	[0136.197] lstrlenA (lpString="*.png") returned 5
	[0136.198] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\appcompat\\UA\\GenericError.png" | out: lpString1="C:\\Windows\\appcompat\\UA\\GenericError.png") returned="C:\\Windows\\appcompat\\UA\\GenericError.png"
	[0136.198] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\appcompat\\UA\\GenericError.png" | out: lpString1="C:\\Windows\\appcompat\\UA\\GenericError.png") returned="C:\\Windows\\appcompat\\UA\\GenericError.png"
	[0136.198] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\UA\\GenericError.png", lpString2="." | out: lpString1="C:\\Windows\\appcompat\\UA\\GenericError.png.") returned="C:\\Windows\\appcompat\\UA\\GenericError.png."
	[0136.198] lstrcatA (in: lpString1="C:\\Windows\\appcompat\\UA\\GenericError.png.", lpString2="exe" | out: lpString1="C:\\Windows\\appcompat\\UA\\GenericError.png.exe") returned="C:\\Windows\\appcompat\\UA\\GenericError.png.exe"
	[0136.198] CreateFileA (lpFileName="C:\\Windows\\appcompat\\UA\\GenericError.png" (normalized: "c:\\windows\\appcompat\\ua\\genericerror.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0136.198] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x992
	[0136.198] GetFileTime (in: hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5eed103, dwHighDateTime=0x1d3278c), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eed103, dwHighDateTime=0x1d3278c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5f1e052, dwHighDateTime=0x1d3278c)) returned 1
	[0136.198] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0136.198] ReadFile (in: hFile=0x20c, lpBuffer=0x21b9020, nNumberOfBytesToRead=0x1fc2e9, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesRead=0x40655d*=0x950, lpOverlapped=0x0) returned 1
	[0136.200] PathFindFileNameA (pszPath="C:\\Windows\\appcompat\\UA\\GenericError.png") returned="GenericError.png"
	[0136.200] SetFilePointer (in: hFile=0x20c, lDistanceToMove=66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42
	[0136.200] WriteFile (in: hFile=0x20c, lpBuffer=0x21b9020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x21b9020*, lpNumberOfBytesWritten=0x406561*=0x950, lpOverlapped=0x0) returned 1
	[0136.200] SetFileTime (hFile=0x20c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0136.200] CloseHandle (hObject=0x20c) returned 1
	[0136.200] MoveFileA (lpExistingFileName="C:\\Windows\\appcompat\\UA\\GenericError.png" (normalized: "c:\\windows\\appcompat\\ua\\genericerror.png"), lpNewFileName="C:\\Windows\\appcompat\\UA\\GenericError.png.exe" (normalized: "c:\\windows\\appcompat\\ua\\genericerror.png.exe")) returned 1
	[0136.201] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eed103, ftCreationTime.dwHighDateTime=0x1d3278c, ftLastAccessTime.dwLowDateTime=0x5eed103, ftLastAccessTime.dwHighDateTime=0x1d3278c, ftLastWriteTime.dwLowDateTime=0x5f1e052, ftLastWriteTime.dwHighDateTime=0x1d3278c, nFileSizeHigh=0x0, nFileSizeLow=0x992, dwReserved0=0x12, dwReserved1=0x1, cFileName="GenericError.png", cAlternateFileName="GENERI~2.PNG")) returned 0
	[0136.201] FindClose (in: hFindFile=0x7cbad0 | out: hFindFile=0x7cbad0) returned 1
	[0136.201] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7482c44, ftCreationTime.dwHighDateTime=0x1d3278b, ftLastAccessTime.dwLowDateTime=0xd2ee3ced, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xd2ee3ced, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UA", cAlternateFileName="")) returned 0
	[0136.201] FindClose (in: hFindFile=0x7cb690 | out: hFindFile=0x7cb690) returned 1
	[0136.201] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9be24fef, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x9be24fef, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4d542e7d, dwReserved1=0x746e6f43, cFileName="AppPatch", cAlternateFileName="")) returned 1
	[0136.201] lstrcmpA (lpString1=".", lpString2="AppPatch") returned -1
	[0136.201] lstrcmpA (lpString1="..", lpString2="AppPatch") returned -1
	[0136.201] PathFindFileNameA (pszPath="C:\\Windows\\*.*") returned="*.*"
	[0136.201] lstrcatA (in: lpString1="C:\\Windows\\", lpString2="AppPatch" | out: lpString1="C:\\Windows\\AppPatch") returned="C:\\Windows\\AppPatch"
	[0136.201] lstrlenA (lpString="C:\\Windows\\AppPatch") returned 19
	[0136.201] FindFirstFileA (in: lpFileName="C:\\Windows\\AppPatch\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9be24fef, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x9be24fef, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb9d0
	[0136.202] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.202] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9be24fef, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x9be24fef, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.202] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.202] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.202] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7763f417, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7763f417, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7763f417, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24ce00, dwReserved0=0x20, dwReserved1=0x0, cFileName="AcGenral.dll", cAlternateFileName="")) returned 1
	[0136.202] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0136.202] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="AcGenral.dll") returned 1
	[0136.202] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="AcGenral.dll") returned 1
	[0136.202] lstrcmpiA (lpString1="", lpString2="AcGenral.dll") returned -1
	[0136.202] PathFindFileNameA (pszPath="C:\\Windows\\AppPatch\\*.*") returned="*.*"
	[0136.202] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\AppPatch\\" | out: lpString1="C:\\Windows\\AppPatch\\") returned="C:\\Windows\\AppPatch\\"
	[0136.202] PathAddBackslashA (in: pszPath="C:\\Windows\\AppPatch\\" | out: pszPath="C:\\Windows\\AppPatch\\") returned=""
	[0136.202] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\AppPatch\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\AppPatch\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.202] GetFileAttributesA (lpFileName="C:\\Windows\\AppPatch\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\apppatch\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.202] CreateFileA (lpFileName="C:\\Windows\\AppPatch\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\apppatch\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0136.203] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0136.203] WriteFile (in: hFile=0x208, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0136.204] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.204] CloseHandle (hObject=0x208) returned 1
	[0136.204] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\", lpString2="AcGenral.dll" | out: lpString1="C:\\Windows\\AppPatch\\AcGenral.dll") returned="C:\\Windows\\AppPatch\\AcGenral.dll"
	[0136.204] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.zip") returned 0
	[0136.204] lstrlenA (lpString="*.zip") returned 5
	[0136.204] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.rar") returned 0
	[0136.204] lstrlenA (lpString="*.rar") returned 5
	[0136.204] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.7z") returned 0
	[0136.204] lstrlenA (lpString="*.7z") returned 4
	[0136.204] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.tar") returned 0
	[0136.204] lstrlenA (lpString="*.tar") returned 5
	[0136.204] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.gzip") returned 0
	[0136.204] lstrlenA (lpString="*.gzip") returned 6
	[0136.204] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.jpg") returned 0
	[0136.204] lstrlenA (lpString="*.jpg") returned 5
	[0136.204] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.jpeg") returned 0
	[0136.204] lstrlenA (lpString="*.jpeg") returned 6
	[0136.204] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.bmp") returned 0
	[0136.204] lstrlenA (lpString="*.bmp") returned 5
	[0136.204] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.gif") returned 0
	[0136.204] lstrlenA (lpString="*.gif") returned 5
	[0136.204] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.png") returned 0
	[0136.204] lstrlenA (lpString="*.png") returned 5
	[0136.204] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.doc") returned 0
	[0136.204] lstrlenA (lpString="*.doc") returned 5
	[0136.204] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.docx") returned 0
	[0136.204] lstrlenA (lpString="*.docx") returned 6
	[0136.204] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.xls") returned 0
	[0136.205] lstrlenA (lpString="*.xls") returned 5
	[0136.205] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.xlsx") returned 0
	[0136.205] lstrlenA (lpString="*.xlsx") returned 6
	[0136.205] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.ppt") returned 0
	[0136.205] lstrlenA (lpString="*.ppt") returned 5
	[0136.205] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.pptx") returned 0
	[0136.205] lstrlenA (lpString="*.pptx") returned 6
	[0136.205] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.txt") returned 0
	[0136.205] lstrlenA (lpString="*.txt") returned 5
	[0136.205] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.pdf") returned 0
	[0136.205] lstrlenA (lpString="*.pdf") returned 5
	[0136.205] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.htm") returned 0
	[0136.205] lstrlenA (lpString="*.htm") returned 5
	[0136.205] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.html") returned 0
	[0136.205] lstrlenA (lpString="*.html") returned 6
	[0136.205] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.mdb") returned 0
	[0136.205] lstrlenA (lpString="*.mdb") returned 5
	[0136.205] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.pfx") returned 0
	[0136.205] lstrlenA (lpString="*.pfx") returned 5
	[0136.205] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.md") returned 0
	[0136.205] lstrlenA (lpString="*.md") returned 4
	[0136.205] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.lnk") returned 0
	[0136.205] lstrlenA (lpString="*.lnk") returned 5
	[0136.205] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.torrent") returned 0
	[0136.205] lstrlenA (lpString="*.torrent") returned 9
	[0136.205] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.mov") returned 0
	[0136.205] lstrlenA (lpString="*.mov") returned 5
	[0136.205] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.3gp") returned 0
	[0136.205] lstrlenA (lpString="*.3gp") returned 5
	[0136.205] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.mpeg") returned 0
	[0136.205] lstrlenA (lpString="*.mpeg") returned 6
	[0136.205] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.mpg") returned 0
	[0136.205] lstrlenA (lpString="*.mpg") returned 5
	[0136.205] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.flv") returned 0
	[0136.205] lstrlenA (lpString="*.flv") returned 5
	[0136.206] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.avi") returned 0
	[0136.206] lstrlenA (lpString="*.avi") returned 5
	[0136.206] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.mp4") returned 0
	[0136.206] lstrlenA (lpString="*.mp4") returned 5
	[0136.206] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.wmv") returned 0
	[0136.206] lstrlenA (lpString="*.wmv") returned 5
	[0136.206] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.mkv") returned 0
	[0136.206] lstrlenA (lpString="*.mkv") returned 5
	[0136.206] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.mp3") returned 0
	[0136.206] lstrlenA (lpString="*.mp3") returned 5
	[0136.206] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.wav") returned 0
	[0136.206] lstrlenA (lpString="*.wav") returned 5
	[0136.206] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.flac") returned 0
	[0136.206] lstrlenA (lpString="*.flac") returned 6
	[0136.206] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.wma") returned 0
	[0136.206] lstrlenA (lpString="*.wma") returned 5
	[0136.206] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.au3") returned 0
	[0136.206] lstrlenA (lpString="*.au3") returned 5
	[0136.206] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.ahk") returned 0
	[0136.206] lstrlenA (lpString="*.ahk") returned 5
	[0136.206] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.c") returned 0
	[0136.206] lstrlenA (lpString="*.c") returned 3
	[0136.206] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.cc") returned 0
	[0136.206] lstrlenA (lpString="*.cc") returned 4
	[0136.206] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.cpp") returned 0
	[0136.206] lstrlenA (lpString="*.cpp") returned 5
	[0136.206] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.cxx") returned 0
	[0136.206] lstrlenA (lpString="*.cxx") returned 5
	[0136.206] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.c++") returned 0
	[0136.206] lstrlenA (lpString="*.c++") returned 5
	[0136.206] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.cs") returned 0
	[0136.206] lstrlenA (lpString="*.cs") returned 4
	[0136.206] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.vb") returned 0
	[0136.206] lstrlenA (lpString="*.vb") returned 4
	[0136.207] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.bas") returned 0
	[0136.207] lstrlenA (lpString="*.bas") returned 5
	[0136.207] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.csproj") returned 0
	[0136.207] lstrlenA (lpString="*.csproj") returned 8
	[0136.207] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.vbproj") returned 0
	[0136.207] lstrlenA (lpString="*.vbproj") returned 8
	[0136.207] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.vcxproj") returned 0
	[0136.207] lstrlenA (lpString="*.vcxproj") returned 9
	[0136.207] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.manifest") returned 0
	[0136.207] lstrlenA (lpString="*.manifest") returned 10
	[0136.207] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.php") returned 0
	[0136.207] lstrlenA (lpString="*.php") returned 5
	[0136.207] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.vbe") returned 0
	[0136.207] lstrlenA (lpString="*.vbe") returned 5
	[0136.207] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.vba") returned 0
	[0136.207] lstrlenA (lpString="*.vba") returned 5
	[0136.207] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.vbs") returned 0
	[0136.207] lstrlenA (lpString="*.vbs") returned 5
	[0136.207] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.bat") returned 0
	[0136.207] lstrlenA (lpString="*.bat") returned 5
	[0136.207] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.cmd") returned 0
	[0136.207] lstrlenA (lpString="*.cmd") returned 5
	[0136.207] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.js") returned 0
	[0136.207] lstrlenA (lpString="*.js") returned 4
	[0136.207] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.jscript") returned 0
	[0136.207] lstrlenA (lpString="*.jscript") returned 9
	[0136.207] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.hta") returned 0
	[0136.207] lstrlenA (lpString="*.hta") returned 5
	[0136.207] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.php7") returned 0
	[0136.207] lstrlenA (lpString="*.php7") returned 6
	[0136.207] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.db") returned 0
	[0136.207] lstrlenA (lpString="*.db") returned 4
	[0136.207] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.swf") returned 0
	[0136.208] lstrlenA (lpString="*.swf") returned 5
	[0136.208] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.eml") returned 0
	[0136.208] lstrlenA (lpString="*.eml") returned 5
	[0136.208] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.part") returned 0
	[0136.208] lstrlenA (lpString="*.part") returned 6
	[0136.208] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.nfo") returned 0
	[0136.208] lstrlenA (lpString="*.nfo") returned 5
	[0136.208] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.rsa") returned 0
	[0136.208] lstrlenA (lpString="*.rsa") returned 5
	[0136.208] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.key") returned 0
	[0136.208] lstrlenA (lpString="*.key") returned 5
	[0136.208] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.aes") returned 0
	[0136.208] lstrlenA (lpString="*.aes") returned 5
	[0136.208] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.blob") returned 0
	[0136.208] lstrlenA (lpString="*.blob") returned 6
	[0136.208] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.btc") returned 0
	[0136.208] lstrlenA (lpString="*.btc") returned 5
	[0136.208] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcGenral.dll", pszSpec="*.wallet") returned 0
	[0136.208] lstrlenA (lpString="*.wallet") returned 8
	[0136.208] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x775f2f48, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x775f2f48, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x775f2f48, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x50400, dwReserved0=0x0, dwReserved1=0x1, cFileName="AcLayers.dll", cAlternateFileName="")) returned 1
	[0136.208] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0136.208] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="AcLayers.dll") returned 1
	[0136.208] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="AcLayers.dll") returned 1
	[0136.208] lstrcmpiA (lpString1="", lpString2="AcLayers.dll") returned -1
	[0136.208] PathFindFileNameA (pszPath="C:\\Windows\\AppPatch\\AcGenral.dll") returned="AcGenral.dll"
	[0136.208] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\AppPatch\\" | out: lpString1="C:\\Windows\\AppPatch\\") returned="C:\\Windows\\AppPatch\\"
	[0136.208] PathAddBackslashA (in: pszPath="C:\\Windows\\AppPatch\\" | out: pszPath="C:\\Windows\\AppPatch\\") returned=""
	[0136.208] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\AppPatch\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\AppPatch\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.208] GetFileAttributesA (lpFileName="C:\\Windows\\AppPatch\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\apppatch\\how-to-decrypt-files.htm")) returned 0x20
	[0136.208] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\", lpString2="AcLayers.dll" | out: lpString1="C:\\Windows\\AppPatch\\AcLayers.dll") returned="C:\\Windows\\AppPatch\\AcLayers.dll"
	[0136.208] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.zip") returned 0
	[0136.209] lstrlenA (lpString="*.zip") returned 5
	[0136.209] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.rar") returned 0
	[0136.209] lstrlenA (lpString="*.rar") returned 5
	[0136.209] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.7z") returned 0
	[0136.209] lstrlenA (lpString="*.7z") returned 4
	[0136.209] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.tar") returned 0
	[0136.209] lstrlenA (lpString="*.tar") returned 5
	[0136.209] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.gzip") returned 0
	[0136.209] lstrlenA (lpString="*.gzip") returned 6
	[0136.209] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.jpg") returned 0
	[0136.209] lstrlenA (lpString="*.jpg") returned 5
	[0136.209] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.jpeg") returned 0
	[0136.209] lstrlenA (lpString="*.jpeg") returned 6
	[0136.209] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.bmp") returned 0
	[0136.209] lstrlenA (lpString="*.bmp") returned 5
	[0136.209] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.gif") returned 0
	[0136.209] lstrlenA (lpString="*.gif") returned 5
	[0136.209] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.png") returned 0
	[0136.209] lstrlenA (lpString="*.png") returned 5
	[0136.209] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.doc") returned 0
	[0136.209] lstrlenA (lpString="*.doc") returned 5
	[0136.209] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.docx") returned 0
	[0136.209] lstrlenA (lpString="*.docx") returned 6
	[0136.209] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.xls") returned 0
	[0136.209] lstrlenA (lpString="*.xls") returned 5
	[0136.209] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.xlsx") returned 0
	[0136.209] lstrlenA (lpString="*.xlsx") returned 6
	[0136.209] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.ppt") returned 0
	[0136.209] lstrlenA (lpString="*.ppt") returned 5
	[0136.209] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.pptx") returned 0
	[0136.209] lstrlenA (lpString="*.pptx") returned 6
	[0136.209] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.txt") returned 0
	[0136.209] lstrlenA (lpString="*.txt") returned 5
	[0136.209] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.pdf") returned 0
	[0136.210] lstrlenA (lpString="*.pdf") returned 5
	[0136.210] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.htm") returned 0
	[0136.210] lstrlenA (lpString="*.htm") returned 5
	[0136.210] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.html") returned 0
	[0136.210] lstrlenA (lpString="*.html") returned 6
	[0136.210] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.mdb") returned 0
	[0136.210] lstrlenA (lpString="*.mdb") returned 5
	[0136.210] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.pfx") returned 0
	[0136.210] lstrlenA (lpString="*.pfx") returned 5
	[0136.210] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.md") returned 0
	[0136.210] lstrlenA (lpString="*.md") returned 4
	[0136.210] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.lnk") returned 0
	[0136.210] lstrlenA (lpString="*.lnk") returned 5
	[0136.210] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.torrent") returned 0
	[0136.210] lstrlenA (lpString="*.torrent") returned 9
	[0136.210] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.mov") returned 0
	[0136.210] lstrlenA (lpString="*.mov") returned 5
	[0136.210] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.3gp") returned 0
	[0136.210] lstrlenA (lpString="*.3gp") returned 5
	[0136.210] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.mpeg") returned 0
	[0136.210] lstrlenA (lpString="*.mpeg") returned 6
	[0136.210] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.mpg") returned 0
	[0136.210] lstrlenA (lpString="*.mpg") returned 5
	[0136.210] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.flv") returned 0
	[0136.210] lstrlenA (lpString="*.flv") returned 5
	[0136.210] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.avi") returned 0
	[0136.210] lstrlenA (lpString="*.avi") returned 5
	[0136.210] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.mp4") returned 0
	[0136.210] lstrlenA (lpString="*.mp4") returned 5
	[0136.210] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.wmv") returned 0
	[0136.210] lstrlenA (lpString="*.wmv") returned 5
	[0136.210] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.mkv") returned 0
	[0136.210] lstrlenA (lpString="*.mkv") returned 5
	[0136.211] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.mp3") returned 0
	[0136.211] lstrlenA (lpString="*.mp3") returned 5
	[0136.211] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.wav") returned 0
	[0136.211] lstrlenA (lpString="*.wav") returned 5
	[0136.211] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.flac") returned 0
	[0136.211] lstrlenA (lpString="*.flac") returned 6
	[0136.211] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.wma") returned 0
	[0136.211] lstrlenA (lpString="*.wma") returned 5
	[0136.211] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.au3") returned 0
	[0136.211] lstrlenA (lpString="*.au3") returned 5
	[0136.211] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.ahk") returned 0
	[0136.211] lstrlenA (lpString="*.ahk") returned 5
	[0136.211] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.c") returned 0
	[0136.211] lstrlenA (lpString="*.c") returned 3
	[0136.211] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.cc") returned 0
	[0136.211] lstrlenA (lpString="*.cc") returned 4
	[0136.211] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.cpp") returned 0
	[0136.211] lstrlenA (lpString="*.cpp") returned 5
	[0136.211] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.cxx") returned 0
	[0136.211] lstrlenA (lpString="*.cxx") returned 5
	[0136.211] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.c++") returned 0
	[0136.211] lstrlenA (lpString="*.c++") returned 5
	[0136.211] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.cs") returned 0
	[0136.211] lstrlenA (lpString="*.cs") returned 4
	[0136.211] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.vb") returned 0
	[0136.211] lstrlenA (lpString="*.vb") returned 4
	[0136.211] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.bas") returned 0
	[0136.212] lstrlenA (lpString="*.bas") returned 5
	[0136.212] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.csproj") returned 0
	[0136.212] lstrlenA (lpString="*.csproj") returned 8
	[0136.212] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.vbproj") returned 0
	[0136.212] lstrlenA (lpString="*.vbproj") returned 8
	[0136.212] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.vcxproj") returned 0
	[0136.212] lstrlenA (lpString="*.vcxproj") returned 9
	[0136.212] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.manifest") returned 0
	[0136.212] lstrlenA (lpString="*.manifest") returned 10
	[0136.212] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.php") returned 0
	[0136.212] lstrlenA (lpString="*.php") returned 5
	[0136.212] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.vbe") returned 0
	[0136.212] lstrlenA (lpString="*.vbe") returned 5
	[0136.212] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.vba") returned 0
	[0136.212] lstrlenA (lpString="*.vba") returned 5
	[0136.212] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.vbs") returned 0
	[0136.212] lstrlenA (lpString="*.vbs") returned 5
	[0136.212] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.bat") returned 0
	[0136.212] lstrlenA (lpString="*.bat") returned 5
	[0136.212] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.cmd") returned 0
	[0136.212] lstrlenA (lpString="*.cmd") returned 5
	[0136.212] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.js") returned 0
	[0136.212] lstrlenA (lpString="*.js") returned 4
	[0136.212] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.jscript") returned 0
	[0136.212] lstrlenA (lpString="*.jscript") returned 9
	[0136.212] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.hta") returned 0
	[0136.212] lstrlenA (lpString="*.hta") returned 5
	[0136.212] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.php7") returned 0
	[0136.212] lstrlenA (lpString="*.php7") returned 6
	[0136.212] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.db") returned 0
	[0136.212] lstrlenA (lpString="*.db") returned 4
	[0136.212] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.swf") returned 0
	[0136.212] lstrlenA (lpString="*.swf") returned 5
	[0136.212] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.eml") returned 0
	[0136.212] lstrlenA (lpString="*.eml") returned 5
	[0136.213] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.part") returned 0
	[0136.213] lstrlenA (lpString="*.part") returned 6
	[0136.213] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.nfo") returned 0
	[0136.213] lstrlenA (lpString="*.nfo") returned 5
	[0136.213] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.rsa") returned 0
	[0136.213] lstrlenA (lpString="*.rsa") returned 5
	[0136.213] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.key") returned 0
	[0136.213] lstrlenA (lpString="*.key") returned 5
	[0136.213] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.aes") returned 0
	[0136.213] lstrlenA (lpString="*.aes") returned 5
	[0136.213] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.blob") returned 0
	[0136.213] lstrlenA (lpString="*.blob") returned 6
	[0136.213] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.btc") returned 0
	[0136.213] lstrlenA (lpString="*.btc") returned 5
	[0136.213] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcLayers.dll", pszSpec="*.wallet") returned 0
	[0136.213] lstrlenA (lpString="*.wallet") returned 8
	[0136.213] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79d0ef21, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x79d0ef21, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x79d0ef21, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x4efa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcRes.dll", cAlternateFileName="")) returned 1
	[0136.213] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0136.213] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="AcRes.dll") returned 1
	[0136.213] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="AcRes.dll") returned 1
	[0136.213] lstrcmpiA (lpString1="", lpString2="AcRes.dll") returned -1
	[0136.213] PathFindFileNameA (pszPath="C:\\Windows\\AppPatch\\AcLayers.dll") returned="AcLayers.dll"
	[0136.213] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\AppPatch\\" | out: lpString1="C:\\Windows\\AppPatch\\") returned="C:\\Windows\\AppPatch\\"
	[0136.213] PathAddBackslashA (in: pszPath="C:\\Windows\\AppPatch\\" | out: pszPath="C:\\Windows\\AppPatch\\") returned=""
	[0136.213] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\AppPatch\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\AppPatch\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.213] GetFileAttributesA (lpFileName="C:\\Windows\\AppPatch\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\apppatch\\how-to-decrypt-files.htm")) returned 0x20
	[0136.213] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\", lpString2="AcRes.dll" | out: lpString1="C:\\Windows\\AppPatch\\AcRes.dll") returned="C:\\Windows\\AppPatch\\AcRes.dll"
	[0136.213] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.zip") returned 0
	[0136.213] lstrlenA (lpString="*.zip") returned 5
	[0136.213] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.rar") returned 0
	[0136.213] lstrlenA (lpString="*.rar") returned 5
	[0136.214] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.7z") returned 0
	[0136.214] lstrlenA (lpString="*.7z") returned 4
	[0136.214] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.tar") returned 0
	[0136.214] lstrlenA (lpString="*.tar") returned 5
	[0136.214] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.gzip") returned 0
	[0136.214] lstrlenA (lpString="*.gzip") returned 6
	[0136.214] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.jpg") returned 0
	[0136.214] lstrlenA (lpString="*.jpg") returned 5
	[0136.214] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.jpeg") returned 0
	[0136.214] lstrlenA (lpString="*.jpeg") returned 6
	[0136.214] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.bmp") returned 0
	[0136.214] lstrlenA (lpString="*.bmp") returned 5
	[0136.214] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.gif") returned 0
	[0136.214] lstrlenA (lpString="*.gif") returned 5
	[0136.214] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.png") returned 0
	[0136.214] lstrlenA (lpString="*.png") returned 5
	[0136.214] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.doc") returned 0
	[0136.214] lstrlenA (lpString="*.doc") returned 5
	[0136.214] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.docx") returned 0
	[0136.214] lstrlenA (lpString="*.docx") returned 6
	[0136.214] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.xls") returned 0
	[0136.214] lstrlenA (lpString="*.xls") returned 5
	[0136.214] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.xlsx") returned 0
	[0136.214] lstrlenA (lpString="*.xlsx") returned 6
	[0136.214] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.ppt") returned 0
	[0136.214] lstrlenA (lpString="*.ppt") returned 5
	[0136.214] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.pptx") returned 0
	[0136.214] lstrlenA (lpString="*.pptx") returned 6
	[0136.214] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.txt") returned 0
	[0136.214] lstrlenA (lpString="*.txt") returned 5
	[0136.214] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.pdf") returned 0
	[0136.214] lstrlenA (lpString="*.pdf") returned 5
	[0136.214] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.htm") returned 0
	[0136.215] lstrlenA (lpString="*.htm") returned 5
	[0136.215] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.html") returned 0
	[0136.215] lstrlenA (lpString="*.html") returned 6
	[0136.215] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.mdb") returned 0
	[0136.215] lstrlenA (lpString="*.mdb") returned 5
	[0136.215] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.pfx") returned 0
	[0136.215] lstrlenA (lpString="*.pfx") returned 5
	[0136.215] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.md") returned 0
	[0136.215] lstrlenA (lpString="*.md") returned 4
	[0136.215] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.lnk") returned 0
	[0136.215] lstrlenA (lpString="*.lnk") returned 5
	[0136.215] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.torrent") returned 0
	[0136.215] lstrlenA (lpString="*.torrent") returned 9
	[0136.215] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.mov") returned 0
	[0136.215] lstrlenA (lpString="*.mov") returned 5
	[0136.215] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.3gp") returned 0
	[0136.215] lstrlenA (lpString="*.3gp") returned 5
	[0136.215] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.mpeg") returned 0
	[0136.215] lstrlenA (lpString="*.mpeg") returned 6
	[0136.215] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.mpg") returned 0
	[0136.215] lstrlenA (lpString="*.mpg") returned 5
	[0136.215] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.flv") returned 0
	[0136.215] lstrlenA (lpString="*.flv") returned 5
	[0136.215] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.avi") returned 0
	[0136.215] lstrlenA (lpString="*.avi") returned 5
	[0136.215] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.mp4") returned 0
	[0136.215] lstrlenA (lpString="*.mp4") returned 5
	[0136.215] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.wmv") returned 0
	[0136.215] lstrlenA (lpString="*.wmv") returned 5
	[0136.215] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.mkv") returned 0
	[0136.215] lstrlenA (lpString="*.mkv") returned 5
	[0136.215] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.mp3") returned 0
	[0136.215] lstrlenA (lpString="*.mp3") returned 5
	[0136.215] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.wav") returned 0
	[0136.216] lstrlenA (lpString="*.wav") returned 5
	[0136.216] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.flac") returned 0
	[0136.216] lstrlenA (lpString="*.flac") returned 6
	[0136.216] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.wma") returned 0
	[0136.216] lstrlenA (lpString="*.wma") returned 5
	[0136.216] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.au3") returned 0
	[0136.216] lstrlenA (lpString="*.au3") returned 5
	[0136.216] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.ahk") returned 0
	[0136.216] lstrlenA (lpString="*.ahk") returned 5
	[0136.216] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.c") returned 0
	[0136.216] lstrlenA (lpString="*.c") returned 3
	[0136.216] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.cc") returned 0
	[0136.216] lstrlenA (lpString="*.cc") returned 4
	[0136.216] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.cpp") returned 0
	[0136.216] lstrlenA (lpString="*.cpp") returned 5
	[0136.216] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.cxx") returned 0
	[0136.216] lstrlenA (lpString="*.cxx") returned 5
	[0136.216] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.c++") returned 0
	[0136.216] lstrlenA (lpString="*.c++") returned 5
	[0136.216] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.cs") returned 0
	[0136.216] lstrlenA (lpString="*.cs") returned 4
	[0136.216] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.vb") returned 0
	[0136.216] lstrlenA (lpString="*.vb") returned 4
	[0136.216] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.bas") returned 0
	[0136.216] lstrlenA (lpString="*.bas") returned 5
	[0136.216] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.csproj") returned 0
	[0136.216] lstrlenA (lpString="*.csproj") returned 8
	[0136.216] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.vbproj") returned 0
	[0136.216] lstrlenA (lpString="*.vbproj") returned 8
	[0136.216] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.vcxproj") returned 0
	[0136.216] lstrlenA (lpString="*.vcxproj") returned 9
	[0136.216] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.manifest") returned 0
	[0136.216] lstrlenA (lpString="*.manifest") returned 10
	[0136.216] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.php") returned 0
	[0136.217] lstrlenA (lpString="*.php") returned 5
	[0136.217] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.vbe") returned 0
	[0136.217] lstrlenA (lpString="*.vbe") returned 5
	[0136.217] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.vba") returned 0
	[0136.217] lstrlenA (lpString="*.vba") returned 5
	[0136.217] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.vbs") returned 0
	[0136.217] lstrlenA (lpString="*.vbs") returned 5
	[0136.217] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.bat") returned 0
	[0136.217] lstrlenA (lpString="*.bat") returned 5
	[0136.217] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.cmd") returned 0
	[0136.217] lstrlenA (lpString="*.cmd") returned 5
	[0136.217] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.js") returned 0
	[0136.217] lstrlenA (lpString="*.js") returned 4
	[0136.217] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.jscript") returned 0
	[0136.217] lstrlenA (lpString="*.jscript") returned 9
	[0136.217] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.hta") returned 0
	[0136.217] lstrlenA (lpString="*.hta") returned 5
	[0136.217] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.php7") returned 0
	[0136.217] lstrlenA (lpString="*.php7") returned 6
	[0136.217] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.db") returned 0
	[0136.217] lstrlenA (lpString="*.db") returned 4
	[0136.217] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.swf") returned 0
	[0136.217] lstrlenA (lpString="*.swf") returned 5
	[0136.217] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.eml") returned 0
	[0136.217] lstrlenA (lpString="*.eml") returned 5
	[0136.217] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.part") returned 0
	[0136.217] lstrlenA (lpString="*.part") returned 6
	[0136.217] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.nfo") returned 0
	[0136.217] lstrlenA (lpString="*.nfo") returned 5
	[0136.217] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.rsa") returned 0
	[0136.217] lstrlenA (lpString="*.rsa") returned 5
	[0136.217] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.key") returned 0
	[0136.217] lstrlenA (lpString="*.key") returned 5
	[0136.217] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.aes") returned 0
	[0136.217] lstrlenA (lpString="*.aes") returned 5
	[0136.218] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.blob") returned 0
	[0136.218] lstrlenA (lpString="*.blob") returned 6
	[0136.218] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.btc") returned 0
	[0136.218] lstrlenA (lpString="*.btc") returned 5
	[0136.218] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcRes.dll", pszSpec="*.wallet") returned 0
	[0136.218] lstrlenA (lpString="*.wallet") returned 8
	[0136.218] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41a8d3b9, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xf60d4e3e, ftLastAccessTime.dwHighDateTime=0x1d2fa0c, ftLastWriteTime.dwLowDateTime=0x41a8d3b9, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x76600, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcSpecfc.dll", cAlternateFileName="")) returned 1
	[0136.218] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0136.218] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="AcSpecfc.dll") returned 1
	[0136.218] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="AcSpecfc.dll") returned 1
	[0136.218] lstrcmpiA (lpString1="", lpString2="AcSpecfc.dll") returned -1
	[0136.218] PathFindFileNameA (pszPath="C:\\Windows\\AppPatch\\AcRes.dll") returned="AcRes.dll"
	[0136.218] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\AppPatch\\" | out: lpString1="C:\\Windows\\AppPatch\\") returned="C:\\Windows\\AppPatch\\"
	[0136.218] PathAddBackslashA (in: pszPath="C:\\Windows\\AppPatch\\" | out: pszPath="C:\\Windows\\AppPatch\\") returned=""
	[0136.218] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\AppPatch\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\AppPatch\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.218] GetFileAttributesA (lpFileName="C:\\Windows\\AppPatch\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\apppatch\\how-to-decrypt-files.htm")) returned 0x20
	[0136.218] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\", lpString2="AcSpecfc.dll" | out: lpString1="C:\\Windows\\AppPatch\\AcSpecfc.dll") returned="C:\\Windows\\AppPatch\\AcSpecfc.dll"
	[0136.218] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcSpecfc.dll", pszSpec="*.zip") returned 0
	[0136.218] lstrlenA (lpString="*.zip") returned 5
	[0136.218] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcSpecfc.dll", pszSpec="*.rar") returned 0
	[0136.218] lstrlenA (lpString="*.rar") returned 5
	[0136.218] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcSpecfc.dll", pszSpec="*.7z") returned 0
	[0136.218] lstrlenA (lpString="*.7z") returned 4
	[0136.218] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcSpecfc.dll", pszSpec="*.tar") returned 0
	[0136.218] lstrlenA (lpString="*.tar") returned 5
	[0136.218] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcSpecfc.dll", pszSpec="*.gzip") returned 0
	[0136.218] lstrlenA (lpString="*.gzip") returned 6
	[0136.218] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcSpecfc.dll", pszSpec="*.jpg") returned 0
	[0136.218] lstrlenA (lpString="*.jpg") returned 5
	[0136.218] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcSpecfc.dll", pszSpec="*.jpeg") returned 0
	[0136.218] lstrlenA (lpString="*.jpeg") returned 6
	[0136.219] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcSpecfc.dll", pszSpec="*.bmp") returned 0
	[0136.219] lstrlenA (lpString="*.bmp") returned 5
	[0136.219] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcSpecfc.dll", pszSpec="*.gif") returned 0
	[0136.219] lstrlenA (lpString="*.gif") returned 5
	[0136.219] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcSpecfc.dll", pszSpec="*.png") returned 0
	[0136.219] lstrlenA (lpString="*.png") returned 5
	[0136.219] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcSpecfc.dll", pszSpec="*.doc") returned 0
	[0136.219] lstrlenA (lpString="*.doc") returned 5
	[0136.219] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcSpecfc.dll", pszSpec="*.docx") returned 0
	[0136.219] lstrlenA (lpString="*.docx") returned 6
	[0136.219] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcSpecfc.dll", pszSpec="*.xls") returned 0
	[0136.219] lstrlenA (lpString="*.xls") returned 5
	[0136.219] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcSpecfc.dll", pszSpec="*.xlsx") returned 0
	[0136.219] lstrlenA (lpString="*.xlsx") returned 6
	[0136.219] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcSpecfc.dll", pszSpec="*.ppt") returned 0
	[0136.219] lstrlenA (lpString="*.ppt") returned 5
	[0136.219] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcSpecfc.dll", pszSpec="*.pptx") returned 0
	[0136.219] lstrlenA (lpString="*.pptx") returned 6
	[0136.219] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcSpecfc.dll", pszSpec="*.txt") returned 0
	[0136.219] lstrlenA (lpString="*.txt") returned 5
	[0136.219] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcSpecfc.dll", pszSpec="*.pdf") returned 0
	[0136.219] lstrlenA (lpString="*.pdf") returned 5
	[0136.219] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcSpecfc.dll", pszSpec="*.htm") returned 0
	[0136.219] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcSpecfc.dll", pszSpec="*.html") returned 0
	[0136.219] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcSpecfc.dll", pszSpec="*.mdb") returned 0
	[0136.219] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcSpecfc.dll", pszSpec="*.pfx") returned 0
	[0136.219] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcSpecfc.dll", pszSpec="*.md") returned 0
	[0136.219] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcSpecfc.dll", pszSpec="*.lnk") returned 0
	[0136.219] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcSpecfc.dll", pszSpec="*.torrent") returned 0
	[0136.220] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcSpecfc.dll", pszSpec="*.mov") returned 0
	[0136.220] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcSpecfc.dll", pszSpec="*.3gp") returned 0
	[0136.220] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcSpecfc.dll", pszSpec="*.mpeg") returned 0
	[0136.220] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcSpecfc.dll", pszSpec="*.mpg") returned 0
	[0136.220] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\AcSpecfc.dll", pszSpec="*.flv") returned 0
	[0136.220] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72042972, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x72042972, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x72042972, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcWinRT.dll", cAlternateFileName="")) returned 1
	[0136.220] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0136.220] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="AcWinRT.dll") returned 1
	[0136.220] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="AcWinRT.dll") returned 1
	[0136.220] lstrcmpiA (lpString1="", lpString2="AcWinRT.dll") returned -1
	[0136.220] PathFindFileNameA (pszPath="C:\\Windows\\AppPatch\\AcSpecfc.dll") returned="AcSpecfc.dll"
	[0136.220] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\AppPatch\\" | out: lpString1="C:\\Windows\\AppPatch\\") returned="C:\\Windows\\AppPatch\\"
	[0136.220] PathAddBackslashA (in: pszPath="C:\\Windows\\AppPatch\\" | out: pszPath="C:\\Windows\\AppPatch\\") returned=""
	[0136.220] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\AppPatch\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\AppPatch\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.220] GetFileAttributesA (lpFileName="C:\\Windows\\AppPatch\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\apppatch\\how-to-decrypt-files.htm")) returned 0x20
	[0136.220] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\", lpString2="AcWinRT.dll" | out: lpString1="C:\\Windows\\AppPatch\\AcWinRT.dll") returned="C:\\Windows\\AppPatch\\AcWinRT.dll"
	[0136.220] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4d04b1, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6b4d04b1, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6b4d04b1, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9600, dwReserved0=0x0, dwReserved1=0x0, cFileName="acwow64.dll", cAlternateFileName="")) returned 1
	[0136.220] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0136.220] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="acwow64.dll") returned 1
	[0136.220] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="acwow64.dll") returned 1
	[0136.220] lstrcmpiA (lpString1="", lpString2="acwow64.dll") returned -1
	[0136.221] PathFindFileNameA (pszPath="C:\\Windows\\AppPatch\\AcWinRT.dll") returned="AcWinRT.dll"
	[0136.221] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\AppPatch\\" | out: lpString1="C:\\Windows\\AppPatch\\") returned="C:\\Windows\\AppPatch\\"
	[0136.221] PathAddBackslashA (in: pszPath="C:\\Windows\\AppPatch\\" | out: pszPath="C:\\Windows\\AppPatch\\") returned=""
	[0136.221] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\AppPatch\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\AppPatch\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.221] GetFileAttributesA (lpFileName="C:\\Windows\\AppPatch\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\apppatch\\how-to-decrypt-files.htm")) returned 0x20
	[0136.221] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\", lpString2="acwow64.dll" | out: lpString1="C:\\Windows\\AppPatch\\acwow64.dll") returned="C:\\Windows\\AppPatch\\acwow64.dll"
	[0136.221] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x775f2f48, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x775f2f48, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x775f2f48, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x15600, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcXtrnal.dll", cAlternateFileName="")) returned 1
	[0136.221] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0136.221] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="AcXtrnal.dll") returned 1
	[0136.221] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="AcXtrnal.dll") returned 1
	[0136.221] lstrcmpiA (lpString1="", lpString2="AcXtrnal.dll") returned -1
	[0136.221] PathFindFileNameA (pszPath="C:\\Windows\\AppPatch\\acwow64.dll") returned="acwow64.dll"
	[0136.221] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\AppPatch\\" | out: lpString1="C:\\Windows\\AppPatch\\") returned="C:\\Windows\\AppPatch\\"
	[0136.221] PathAddBackslashA (in: pszPath="C:\\Windows\\AppPatch\\" | out: pszPath="C:\\Windows\\AppPatch\\") returned=""
	[0136.221] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\AppPatch\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\AppPatch\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.221] GetFileAttributesA (lpFileName="C:\\Windows\\AppPatch\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\apppatch\\how-to-decrypt-files.htm")) returned 0x20
	[0136.221] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\", lpString2="AcXtrnal.dll" | out: lpString1="C:\\Windows\\AppPatch\\AcXtrnal.dll") returned="C:\\Windows\\AppPatch\\AcXtrnal.dll"
	[0136.221] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9be24fef, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x9be24fef, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="apppatch64", cAlternateFileName="APPPAT~1")) returned 1
	[0136.221] lstrcmpA (lpString1=".", lpString2="apppatch64") returned -1
	[0136.221] lstrcmpA (lpString1="..", lpString2="apppatch64") returned -1
	[0136.221] PathFindFileNameA (pszPath="C:\\Windows\\AppPatch\\AcXtrnal.dll") returned="AcXtrnal.dll"
	[0136.221] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\", lpString2="apppatch64" | out: lpString1="C:\\Windows\\AppPatch\\apppatch64") returned="C:\\Windows\\AppPatch\\apppatch64"
	[0136.221] FindFirstFileA (in: lpFileName="C:\\Windows\\AppPatch\\apppatch64\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9be24fef, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x9be24fef, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x70, cFileName=".", cAlternateFileName="")) returned 0x7cb690
	[0136.222] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.222] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9be24fef, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x9be24fef, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x70, cFileName="..", cAlternateFileName="")) returned 1
	[0136.222] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.222] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.222] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6875c7b8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6875c7b8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6875c7b8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x50400, dwReserved0=0x7b0000, dwReserved1=0x70, cFileName="AcGenral.dll", cAlternateFileName="")) returned 1
	[0136.222] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.222] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="AcGenral.dll") returned 1
	[0136.222] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="AcGenral.dll") returned 1
	[0136.222] lstrcmpiA (lpString1="", lpString2="AcGenral.dll") returned -1
	[0136.222] PathFindFileNameA (pszPath="C:\\Windows\\AppPatch\\apppatch64\\*.*") returned="*.*"
	[0136.222] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\AppPatch\\apppatch64\\" | out: lpString1="C:\\Windows\\AppPatch\\apppatch64\\") returned="C:\\Windows\\AppPatch\\apppatch64\\"
	[0136.222] PathAddBackslashA (in: pszPath="C:\\Windows\\AppPatch\\apppatch64\\" | out: pszPath="C:\\Windows\\AppPatch\\apppatch64\\") returned=""
	[0136.222] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\apppatch64\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\AppPatch\\apppatch64\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\AppPatch\\apppatch64\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.222] GetFileAttributesA (lpFileName="C:\\Windows\\AppPatch\\apppatch64\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\apppatch\\apppatch64\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.222] CreateFileA (lpFileName="C:\\Windows\\AppPatch\\apppatch64\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\apppatch\\apppatch64\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0136.223] WriteFile (in: hFile=0x20c, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0136.224] SetFileTime (hFile=0x20c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.224] CloseHandle (hObject=0x20c) returned 1
	[0136.224] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\apppatch64\\", lpString2="AcGenral.dll" | out: lpString1="C:\\Windows\\AppPatch\\apppatch64\\AcGenral.dll") returned="C:\\Windows\\AppPatch\\apppatch64\\AcGenral.dll"
	[0136.224] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6875c7b8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6875c7b8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6875c7b8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3b200, dwReserved0=0x0, dwReserved1=0x1, cFileName="AcLayers.dll", cAlternateFileName="")) returned 1
	[0136.224] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.224] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="AcLayers.dll") returned 1
	[0136.224] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="AcLayers.dll") returned 1
	[0136.224] lstrcmpiA (lpString1="", lpString2="AcLayers.dll") returned -1
	[0136.224] PathFindFileNameA (pszPath="C:\\Windows\\AppPatch\\apppatch64\\AcGenral.dll") returned="AcGenral.dll"
	[0136.224] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\AppPatch\\apppatch64\\" | out: lpString1="C:\\Windows\\AppPatch\\apppatch64\\") returned="C:\\Windows\\AppPatch\\apppatch64\\"
	[0136.224] PathAddBackslashA (in: pszPath="C:\\Windows\\AppPatch\\apppatch64\\" | out: pszPath="C:\\Windows\\AppPatch\\apppatch64\\") returned=""
	[0136.224] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\apppatch64\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\AppPatch\\apppatch64\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\AppPatch\\apppatch64\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.224] GetFileAttributesA (lpFileName="C:\\Windows\\AppPatch\\apppatch64\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\apppatch\\apppatch64\\how-to-decrypt-files.htm")) returned 0x20
	[0136.224] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\apppatch64\\", lpString2="AcLayers.dll" | out: lpString1="C:\\Windows\\AppPatch\\apppatch64\\AcLayers.dll") returned="C:\\Windows\\AppPatch\\apppatch64\\AcLayers.dll"
	[0136.224] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47f19e38, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x1d85ae2, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x47f19e38, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0xda00, dwReserved0=0x0, dwReserved1=0x0, cFileName="acspecfc.dll", cAlternateFileName="")) returned 1
	[0136.224] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.224] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="acspecfc.dll") returned 1
	[0136.225] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="acspecfc.dll") returned 1
	[0136.225] lstrcmpiA (lpString1="", lpString2="acspecfc.dll") returned -1
	[0136.225] PathFindFileNameA (pszPath="C:\\Windows\\AppPatch\\apppatch64\\AcLayers.dll") returned="AcLayers.dll"
	[0136.225] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\AppPatch\\apppatch64\\" | out: lpString1="C:\\Windows\\AppPatch\\apppatch64\\") returned="C:\\Windows\\AppPatch\\apppatch64\\"
	[0136.225] PathAddBackslashA (in: pszPath="C:\\Windows\\AppPatch\\apppatch64\\" | out: pszPath="C:\\Windows\\AppPatch\\apppatch64\\") returned=""
	[0136.225] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\apppatch64\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\AppPatch\\apppatch64\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\AppPatch\\apppatch64\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.225] GetFileAttributesA (lpFileName="C:\\Windows\\AppPatch\\apppatch64\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\apppatch\\apppatch64\\how-to-decrypt-files.htm")) returned 0x20
	[0136.225] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\apppatch64\\", lpString2="acspecfc.dll" | out: lpString1="C:\\Windows\\AppPatch\\apppatch64\\acspecfc.dll") returned="C:\\Windows\\AppPatch\\apppatch64\\acspecfc.dll"
	[0136.225] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5420a973, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x5420a973, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x5420a973, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcWinRT.dll", cAlternateFileName="")) returned 1
	[0136.225] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.225] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="AcWinRT.dll") returned 1
	[0136.225] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="AcWinRT.dll") returned 1
	[0136.225] lstrcmpiA (lpString1="", lpString2="AcWinRT.dll") returned -1
	[0136.225] PathFindFileNameA (pszPath="C:\\Windows\\AppPatch\\apppatch64\\acspecfc.dll") returned="acspecfc.dll"
	[0136.225] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\AppPatch\\apppatch64\\" | out: lpString1="C:\\Windows\\AppPatch\\apppatch64\\") returned="C:\\Windows\\AppPatch\\apppatch64\\"
	[0136.225] PathAddBackslashA (in: pszPath="C:\\Windows\\AppPatch\\apppatch64\\" | out: pszPath="C:\\Windows\\AppPatch\\apppatch64\\") returned=""
	[0136.225] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\apppatch64\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\AppPatch\\apppatch64\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\AppPatch\\apppatch64\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.225] GetFileAttributesA (lpFileName="C:\\Windows\\AppPatch\\apppatch64\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\apppatch\\apppatch64\\how-to-decrypt-files.htm")) returned 0x20
	[0136.225] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\apppatch64\\", lpString2="AcWinRT.dll" | out: lpString1="C:\\Windows\\AppPatch\\apppatch64\\AcWinRT.dll") returned="C:\\Windows\\AppPatch\\apppatch64\\AcWinRT.dll"
	[0136.225] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68736548, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x68736548, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x68736548, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcXtrnal.dll", cAlternateFileName="")) returned 1
	[0136.225] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.225] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="AcXtrnal.dll") returned 1
	[0136.225] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="AcXtrnal.dll") returned 1
	[0136.225] lstrcmpiA (lpString1="", lpString2="AcXtrnal.dll") returned -1
	[0136.225] PathFindFileNameA (pszPath="C:\\Windows\\AppPatch\\apppatch64\\AcWinRT.dll") returned="AcWinRT.dll"
	[0136.225] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\AppPatch\\apppatch64\\" | out: lpString1="C:\\Windows\\AppPatch\\apppatch64\\") returned="C:\\Windows\\AppPatch\\apppatch64\\"
	[0136.226] PathAddBackslashA (in: pszPath="C:\\Windows\\AppPatch\\apppatch64\\" | out: pszPath="C:\\Windows\\AppPatch\\apppatch64\\") returned=""
	[0136.226] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\apppatch64\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\AppPatch\\apppatch64\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\AppPatch\\apppatch64\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.226] GetFileAttributesA (lpFileName="C:\\Windows\\AppPatch\\apppatch64\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\apppatch\\apppatch64\\how-to-decrypt-files.htm")) returned 0x20
	[0136.226] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\apppatch64\\", lpString2="AcXtrnal.dll" | out: lpString1="C:\\Windows\\AppPatch\\apppatch64\\AcXtrnal.dll") returned="C:\\Windows\\AppPatch\\apppatch64\\AcXtrnal.dll"
	[0136.226] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c168ee7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c168ee7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c168ee7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3ae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="pcamain.sdb", cAlternateFileName="")) returned 1
	[0136.226] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.226] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="pcamain.sdb") returned -1
	[0136.226] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="pcamain.sdb") returned -1
	[0136.226] lstrcmpiA (lpString1="", lpString2="pcamain.sdb") returned -1
	[0136.226] PathFindFileNameA (pszPath="C:\\Windows\\AppPatch\\apppatch64\\AcXtrnal.dll") returned="AcXtrnal.dll"
	[0136.226] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\AppPatch\\apppatch64\\" | out: lpString1="C:\\Windows\\AppPatch\\apppatch64\\") returned="C:\\Windows\\AppPatch\\apppatch64\\"
	[0136.226] PathAddBackslashA (in: pszPath="C:\\Windows\\AppPatch\\apppatch64\\" | out: pszPath="C:\\Windows\\AppPatch\\apppatch64\\") returned=""
	[0136.226] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\apppatch64\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\AppPatch\\apppatch64\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\AppPatch\\apppatch64\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.226] GetFileAttributesA (lpFileName="C:\\Windows\\AppPatch\\apppatch64\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\apppatch\\apppatch64\\how-to-decrypt-files.htm")) returned 0x20
	[0136.226] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\apppatch64\\", lpString2="pcamain.sdb" | out: lpString1="C:\\Windows\\AppPatch\\apppatch64\\pcamain.sdb") returned="C:\\Windows\\AppPatch\\apppatch64\\pcamain.sdb"
	[0136.227] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75051397, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x75051397, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x75051397, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x8a722, dwReserved0=0x0, dwReserved1=0x0, cFileName="sysmain.sdb", cAlternateFileName="")) returned 1
	[0136.227] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.227] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="sysmain.sdb") returned -1
	[0136.227] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="sysmain.sdb") returned -1
	[0136.227] lstrcmpiA (lpString1="", lpString2="sysmain.sdb") returned -1
	[0136.227] PathFindFileNameA (pszPath="C:\\Windows\\AppPatch\\apppatch64\\pcamain.sdb") returned="pcamain.sdb"
	[0136.227] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\AppPatch\\apppatch64\\" | out: lpString1="C:\\Windows\\AppPatch\\apppatch64\\") returned="C:\\Windows\\AppPatch\\apppatch64\\"
	[0136.227] PathAddBackslashA (in: pszPath="C:\\Windows\\AppPatch\\apppatch64\\" | out: pszPath="C:\\Windows\\AppPatch\\apppatch64\\") returned=""
	[0136.227] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\apppatch64\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\AppPatch\\apppatch64\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\AppPatch\\apppatch64\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.227] GetFileAttributesA (lpFileName="C:\\Windows\\AppPatch\\apppatch64\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\apppatch\\apppatch64\\how-to-decrypt-files.htm")) returned 0x20
	[0136.227] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\apppatch64\\", lpString2="sysmain.sdb" | out: lpString1="C:\\Windows\\AppPatch\\apppatch64\\sysmain.sdb") returned="C:\\Windows\\AppPatch\\apppatch64\\sysmain.sdb"
	[0136.227] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75051397, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x75051397, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x75051397, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x8a722, dwReserved0=0x0, dwReserved1=0x0, cFileName="sysmain.sdb", cAlternateFileName="")) returned 0
	[0136.227] FindClose (in: hFindFile=0x7cb690 | out: hFindFile=0x7cb690) returned 1
	[0136.227] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd4ce4e2d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d53e9c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Custom", cAlternateFileName="")) returned 1
	[0136.227] lstrcmpA (lpString1=".", lpString2="Custom") returned -1
	[0136.227] lstrcmpA (lpString1="..", lpString2="Custom") returned -1
	[0136.227] PathFindFileNameA (pszPath="C:\\Windows\\AppPatch\\*.*") returned="*.*"
	[0136.228] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\", lpString2="Custom" | out: lpString1="C:\\Windows\\AppPatch\\Custom") returned="C:\\Windows\\AppPatch\\Custom"
	[0136.228] lstrlenA (lpString="C:\\Windows\\AppPatch\\Custom") returned 26
	[0136.228] FindFirstFileA (in: lpFileName="C:\\Windows\\AppPatch\\Custom\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd4ce4e2d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d53e9c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb990
	[0136.228] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.228] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd4ce4e2d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d53e9c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.228] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.228] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.228] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd4ce588b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d53e9c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Custom64", cAlternateFileName="")) returned 1
	[0136.228] lstrcmpA (lpString1=".", lpString2="Custom64") returned -1
	[0136.228] lstrcmpA (lpString1="..", lpString2="Custom64") returned -1
	[0136.228] PathFindFileNameA (pszPath="C:\\Windows\\AppPatch\\Custom\\*.*") returned="*.*"
	[0136.228] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\Custom\\", lpString2="Custom64" | out: lpString1="C:\\Windows\\AppPatch\\Custom\\Custom64") returned="C:\\Windows\\AppPatch\\Custom\\Custom64"
	[0136.228] lstrlenA (lpString="C:\\Windows\\AppPatch\\Custom\\Custom64") returned 35
	[0136.228] FindFirstFileA (in: lpFileName="C:\\Windows\\AppPatch\\Custom\\Custom64\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd4ce588b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d53e9c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cbad0
	[0136.228] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.228] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd4ce588b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d53e9c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0136.228] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.228] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.228] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd4ce588b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d53e9c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 0
	[0136.228] FindClose (in: hFindFile=0x7cbad0 | out: hFindFile=0x7cbad0) returned 1
	[0136.228] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd4ce588b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d53e9c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Custom64", cAlternateFileName="")) returned 0
	[0136.229] FindClose (in: hFindFile=0x7cb990 | out: hFindFile=0x7cb990) returned 1
	[0136.229] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x750e9d0a, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x750e9d0a, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x750e9d0a, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x2d6ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="drvmain.sdb", cAlternateFileName="")) returned 1
	[0136.229] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0136.229] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="drvmain.sdb") returned 1
	[0136.229] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="drvmain.sdb") returned 1
	[0136.229] lstrcmpiA (lpString1="", lpString2="drvmain.sdb") returned -1
	[0136.229] PathFindFileNameA (pszPath="C:\\Windows\\AppPatch\\*.*") returned="*.*"
	[0136.229] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\AppPatch\\" | out: lpString1="C:\\Windows\\AppPatch\\") returned="C:\\Windows\\AppPatch\\"
	[0136.229] PathAddBackslashA (in: pszPath="C:\\Windows\\AppPatch\\" | out: pszPath="C:\\Windows\\AppPatch\\") returned=""
	[0136.229] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\AppPatch\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\AppPatch\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.229] GetFileAttributesA (lpFileName="C:\\Windows\\AppPatch\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\apppatch\\how-to-decrypt-files.htm")) returned 0x20
	[0136.229] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\", lpString2="drvmain.sdb" | out: lpString1="C:\\Windows\\AppPatch\\drvmain.sdb") returned="C:\\Windows\\AppPatch\\drvmain.sdb"
	[0136.229] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.zip") returned 0
	[0136.229] lstrlenA (lpString="*.zip") returned 5
	[0136.229] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.rar") returned 0
	[0136.229] lstrlenA (lpString="*.rar") returned 5
	[0136.229] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.7z") returned 0
	[0136.229] lstrlenA (lpString="*.7z") returned 4
	[0136.229] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.tar") returned 0
	[0136.229] lstrlenA (lpString="*.tar") returned 5
	[0136.229] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.gzip") returned 0
	[0136.229] lstrlenA (lpString="*.gzip") returned 6
	[0136.229] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.jpg") returned 0
	[0136.229] lstrlenA (lpString="*.jpg") returned 5
	[0136.229] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.jpeg") returned 0
	[0136.229] lstrlenA (lpString="*.jpeg") returned 6
	[0136.229] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.bmp") returned 0
	[0136.229] lstrlenA (lpString="*.bmp") returned 5
	[0136.229] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.gif") returned 0
	[0136.229] lstrlenA (lpString="*.gif") returned 5
	[0136.230] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.png") returned 0
	[0136.230] lstrlenA (lpString="*.png") returned 5
	[0136.230] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.doc") returned 0
	[0136.230] lstrlenA (lpString="*.doc") returned 5
	[0136.230] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.docx") returned 0
	[0136.230] lstrlenA (lpString="*.docx") returned 6
	[0136.230] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.xls") returned 0
	[0136.230] lstrlenA (lpString="*.xls") returned 5
	[0136.230] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.xlsx") returned 0
	[0136.230] lstrlenA (lpString="*.xlsx") returned 6
	[0136.230] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.ppt") returned 0
	[0136.230] lstrlenA (lpString="*.ppt") returned 5
	[0136.230] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.pptx") returned 0
	[0136.230] lstrlenA (lpString="*.pptx") returned 6
	[0136.230] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.txt") returned 0
	[0136.230] lstrlenA (lpString="*.txt") returned 5
	[0136.230] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.pdf") returned 0
	[0136.230] lstrlenA (lpString="*.pdf") returned 5
	[0136.230] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.htm") returned 0
	[0136.230] lstrlenA (lpString="*.htm") returned 5
	[0136.230] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.html") returned 0
	[0136.230] lstrlenA (lpString="*.html") returned 6
	[0136.230] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.mdb") returned 0
	[0136.230] lstrlenA (lpString="*.mdb") returned 5
	[0136.230] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.pfx") returned 0
	[0136.230] lstrlenA (lpString="*.pfx") returned 5
	[0136.230] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.md") returned 0
	[0136.230] lstrlenA (lpString="*.md") returned 4
	[0136.230] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.lnk") returned 0
	[0136.230] lstrlenA (lpString="*.lnk") returned 5
	[0136.230] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.torrent") returned 0
	[0136.230] lstrlenA (lpString="*.torrent") returned 9
	[0136.230] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.mov") returned 0
	[0136.230] lstrlenA (lpString="*.mov") returned 5
	[0136.231] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.3gp") returned 0
	[0136.231] lstrlenA (lpString="*.3gp") returned 5
	[0136.231] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.mpeg") returned 0
	[0136.231] lstrlenA (lpString="*.mpeg") returned 6
	[0136.231] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.mpg") returned 0
	[0136.231] lstrlenA (lpString="*.mpg") returned 5
	[0136.231] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.flv") returned 0
	[0136.231] lstrlenA (lpString="*.flv") returned 5
	[0136.231] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.avi") returned 0
	[0136.231] lstrlenA (lpString="*.avi") returned 5
	[0136.231] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.mp4") returned 0
	[0136.231] lstrlenA (lpString="*.mp4") returned 5
	[0136.231] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.wmv") returned 0
	[0136.231] lstrlenA (lpString="*.wmv") returned 5
	[0136.231] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.mkv") returned 0
	[0136.231] lstrlenA (lpString="*.mkv") returned 5
	[0136.231] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.mp3") returned 0
	[0136.231] lstrlenA (lpString="*.mp3") returned 5
	[0136.231] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.wav") returned 0
	[0136.231] lstrlenA (lpString="*.wav") returned 5
	[0136.231] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.flac") returned 0
	[0136.231] lstrlenA (lpString="*.flac") returned 6
	[0136.231] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.wma") returned 0
	[0136.231] lstrlenA (lpString="*.wma") returned 5
	[0136.231] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.au3") returned 0
	[0136.231] lstrlenA (lpString="*.au3") returned 5
	[0136.231] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.ahk") returned 0
	[0136.231] lstrlenA (lpString="*.ahk") returned 5
	[0136.231] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.c") returned 0
	[0136.231] lstrlenA (lpString="*.c") returned 3
	[0136.231] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.cc") returned 0
	[0136.231] lstrlenA (lpString="*.cc") returned 4
	[0136.231] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.cpp") returned 0
	[0136.232] lstrlenA (lpString="*.cpp") returned 5
	[0136.232] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.cxx") returned 0
	[0136.232] lstrlenA (lpString="*.cxx") returned 5
	[0136.232] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.c++") returned 0
	[0136.232] lstrlenA (lpString="*.c++") returned 5
	[0136.232] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.cs") returned 0
	[0136.232] lstrlenA (lpString="*.cs") returned 4
	[0136.232] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.vb") returned 0
	[0136.232] lstrlenA (lpString="*.vb") returned 4
	[0136.232] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.bas") returned 0
	[0136.232] lstrlenA (lpString="*.bas") returned 5
	[0136.232] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.csproj") returned 0
	[0136.232] lstrlenA (lpString="*.csproj") returned 8
	[0136.232] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.vbproj") returned 0
	[0136.232] lstrlenA (lpString="*.vbproj") returned 8
	[0136.232] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.vcxproj") returned 0
	[0136.232] lstrlenA (lpString="*.vcxproj") returned 9
	[0136.232] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.manifest") returned 0
	[0136.232] lstrlenA (lpString="*.manifest") returned 10
	[0136.232] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.php") returned 0
	[0136.232] lstrlenA (lpString="*.php") returned 5
	[0136.232] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.vbe") returned 0
	[0136.232] lstrlenA (lpString="*.vbe") returned 5
	[0136.232] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.vba") returned 0
	[0136.232] lstrlenA (lpString="*.vba") returned 5
	[0136.232] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.vbs") returned 0
	[0136.232] lstrlenA (lpString="*.vbs") returned 5
	[0136.232] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.bat") returned 0
	[0136.232] lstrlenA (lpString="*.bat") returned 5
	[0136.232] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.cmd") returned 0
	[0136.232] lstrlenA (lpString="*.cmd") returned 5
	[0136.232] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.js") returned 0
	[0136.232] lstrlenA (lpString="*.js") returned 4
	[0136.232] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.jscript") returned 0
	[0136.232] lstrlenA (lpString="*.jscript") returned 9
	[0136.233] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.hta") returned 0
	[0136.233] lstrlenA (lpString="*.hta") returned 5
	[0136.233] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.php7") returned 0
	[0136.233] lstrlenA (lpString="*.php7") returned 6
	[0136.233] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.db") returned 0
	[0136.233] lstrlenA (lpString="*.db") returned 4
	[0136.233] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.swf") returned 0
	[0136.233] lstrlenA (lpString="*.swf") returned 5
	[0136.233] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.eml") returned 0
	[0136.233] lstrlenA (lpString="*.eml") returned 5
	[0136.233] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.part") returned 0
	[0136.233] lstrlenA (lpString="*.part") returned 6
	[0136.233] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.nfo") returned 0
	[0136.233] lstrlenA (lpString="*.nfo") returned 5
	[0136.233] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.rsa") returned 0
	[0136.233] lstrlenA (lpString="*.rsa") returned 5
	[0136.233] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.key") returned 0
	[0136.233] lstrlenA (lpString="*.key") returned 5
	[0136.233] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.aes") returned 0
	[0136.233] lstrlenA (lpString="*.aes") returned 5
	[0136.233] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.blob") returned 0
	[0136.233] lstrlenA (lpString="*.blob") returned 6
	[0136.233] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.btc") returned 0
	[0136.233] lstrlenA (lpString="*.btc") returned 5
	[0136.233] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\drvmain.sdb", pszSpec="*.wallet") returned 0
	[0136.233] lstrlenA (lpString="*.wallet") returned 8
	[0136.233] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x9be24fef, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x9be24fef, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0136.233] lstrcmpA (lpString1=".", lpString2="en-US") returned -1
	[0136.233] lstrcmpA (lpString1="..", lpString2="en-US") returned -1
	[0136.233] PathFindFileNameA (pszPath="C:\\Windows\\AppPatch\\drvmain.sdb") returned="drvmain.sdb"
	[0136.233] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\", lpString2="en-US" | out: lpString1="C:\\Windows\\AppPatch\\en-US") returned="C:\\Windows\\AppPatch\\en-US"
	[0136.233] lstrlenA (lpString="C:\\Windows\\AppPatch\\en-US") returned 25
	[0136.233] FindFirstFileA (in: lpFileName="C:\\Windows\\AppPatch\\en-US\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x9be24fef, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x9be24fef, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x70, cFileName=".", cAlternateFileName="")) returned 0x7cb890
	[0136.234] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.234] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x9be24fef, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x9be24fef, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x70, cFileName="..", cAlternateFileName="")) returned 1
	[0136.234] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.234] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.234] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a866ff, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x79a866ff, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x79a866ff, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x4cc00, dwReserved0=0x7b0000, dwReserved1=0x70, cFileName="AcRes.dll.mui", cAlternateFileName="")) returned 1
	[0136.234] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0
	[0136.234] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="AcRes.dll.mui") returned 1
	[0136.234] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="AcRes.dll.mui") returned 1
	[0136.234] lstrcmpiA (lpString1="", lpString2="AcRes.dll.mui") returned -1
	[0136.234] PathFindFileNameA (pszPath="C:\\Windows\\AppPatch\\en-US\\*.*") returned="*.*"
	[0136.234] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\AppPatch\\en-US\\" | out: lpString1="C:\\Windows\\AppPatch\\en-US\\") returned="C:\\Windows\\AppPatch\\en-US\\"
	[0136.234] PathAddBackslashA (in: pszPath="C:\\Windows\\AppPatch\\en-US\\" | out: pszPath="C:\\Windows\\AppPatch\\en-US\\") returned=""
	[0136.234] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\en-US\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\AppPatch\\en-US\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\AppPatch\\en-US\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.234] GetFileAttributesA (lpFileName="C:\\Windows\\AppPatch\\en-US\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\apppatch\\en-us\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.234] CreateFileA (lpFileName="C:\\Windows\\AppPatch\\en-US\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\apppatch\\en-us\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0136.235] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0136.235] WriteFile (in: hFile=0x20c, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0136.236] SetFileTime (hFile=0x20c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.236] CloseHandle (hObject=0x20c) returned 1
	[0136.236] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\en-US\\", lpString2="AcRes.dll.mui" | out: lpString1="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui") returned="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui"
	[0136.236] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.zip") returned 0
	[0136.236] lstrlenA (lpString="*.zip") returned 5
	[0136.237] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.rar") returned 0
	[0136.237] lstrlenA (lpString="*.rar") returned 5
	[0136.237] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.7z") returned 0
	[0136.237] lstrlenA (lpString="*.7z") returned 4
	[0136.237] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.tar") returned 0
	[0136.237] lstrlenA (lpString="*.tar") returned 5
	[0136.237] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.gzip") returned 0
	[0136.237] lstrlenA (lpString="*.gzip") returned 6
	[0136.237] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.jpg") returned 0
	[0136.237] lstrlenA (lpString="*.jpg") returned 5
	[0136.237] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.jpeg") returned 0
	[0136.237] lstrlenA (lpString="*.jpeg") returned 6
	[0136.237] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.bmp") returned 0
	[0136.237] lstrlenA (lpString="*.bmp") returned 5
	[0136.237] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.gif") returned 0
	[0136.237] lstrlenA (lpString="*.gif") returned 5
	[0136.237] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.png") returned 0
	[0136.237] lstrlenA (lpString="*.png") returned 5
	[0136.237] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.doc") returned 0
	[0136.237] lstrlenA (lpString="*.doc") returned 5
	[0136.237] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.docx") returned 0
	[0136.237] lstrlenA (lpString="*.docx") returned 6
	[0136.237] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.xls") returned 0
	[0136.237] lstrlenA (lpString="*.xls") returned 5
	[0136.237] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.xlsx") returned 0
	[0136.237] lstrlenA (lpString="*.xlsx") returned 6
	[0136.237] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.ppt") returned 0
	[0136.237] lstrlenA (lpString="*.ppt") returned 5
	[0136.237] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.pptx") returned 0
	[0136.237] lstrlenA (lpString="*.pptx") returned 6
	[0136.237] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.txt") returned 0
	[0136.237] lstrlenA (lpString="*.txt") returned 5
	[0136.237] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.pdf") returned 0
	[0136.237] lstrlenA (lpString="*.pdf") returned 5
	[0136.238] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.htm") returned 0
	[0136.238] lstrlenA (lpString="*.htm") returned 5
	[0136.238] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.html") returned 0
	[0136.238] lstrlenA (lpString="*.html") returned 6
	[0136.238] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.mdb") returned 0
	[0136.238] lstrlenA (lpString="*.mdb") returned 5
	[0136.238] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.pfx") returned 0
	[0136.238] lstrlenA (lpString="*.pfx") returned 5
	[0136.238] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.md") returned 0
	[0136.238] lstrlenA (lpString="*.md") returned 4
	[0136.238] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.lnk") returned 0
	[0136.238] lstrlenA (lpString="*.lnk") returned 5
	[0136.238] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.torrent") returned 0
	[0136.238] lstrlenA (lpString="*.torrent") returned 9
	[0136.238] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.mov") returned 0
	[0136.238] lstrlenA (lpString="*.mov") returned 5
	[0136.238] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.3gp") returned 0
	[0136.238] lstrlenA (lpString="*.3gp") returned 5
	[0136.238] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.mpeg") returned 0
	[0136.238] lstrlenA (lpString="*.mpeg") returned 6
	[0136.238] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.mpg") returned 0
	[0136.238] lstrlenA (lpString="*.mpg") returned 5
	[0136.238] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.flv") returned 0
	[0136.238] lstrlenA (lpString="*.flv") returned 5
	[0136.238] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.avi") returned 0
	[0136.238] lstrlenA (lpString="*.avi") returned 5
	[0136.238] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.mp4") returned 0
	[0136.238] lstrlenA (lpString="*.mp4") returned 5
	[0136.238] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.wmv") returned 0
	[0136.238] lstrlenA (lpString="*.wmv") returned 5
	[0136.238] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.mkv") returned 0
	[0136.238] lstrlenA (lpString="*.mkv") returned 5
	[0136.238] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.mp3") returned 0
	[0136.238] lstrlenA (lpString="*.mp3") returned 5
	[0136.239] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.wav") returned 0
	[0136.239] lstrlenA (lpString="*.wav") returned 5
	[0136.239] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.flac") returned 0
	[0136.239] lstrlenA (lpString="*.flac") returned 6
	[0136.239] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.wma") returned 0
	[0136.239] lstrlenA (lpString="*.wma") returned 5
	[0136.239] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.au3") returned 0
	[0136.239] lstrlenA (lpString="*.au3") returned 5
	[0136.239] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.ahk") returned 0
	[0136.239] lstrlenA (lpString="*.ahk") returned 5
	[0136.239] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.c") returned 0
	[0136.239] lstrlenA (lpString="*.c") returned 3
	[0136.239] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.cc") returned 0
	[0136.239] lstrlenA (lpString="*.cc") returned 4
	[0136.239] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.cpp") returned 0
	[0136.239] lstrlenA (lpString="*.cpp") returned 5
	[0136.239] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.cxx") returned 0
	[0136.239] lstrlenA (lpString="*.cxx") returned 5
	[0136.239] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.c++") returned 0
	[0136.239] lstrlenA (lpString="*.c++") returned 5
	[0136.239] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.cs") returned 0
	[0136.239] lstrlenA (lpString="*.cs") returned 4
	[0136.239] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.vb") returned 0
	[0136.239] lstrlenA (lpString="*.vb") returned 4
	[0136.240] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.bas") returned 0
	[0136.240] lstrlenA (lpString="*.bas") returned 5
	[0136.240] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.csproj") returned 0
	[0136.240] lstrlenA (lpString="*.csproj") returned 8
	[0136.240] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.vbproj") returned 0
	[0136.240] lstrlenA (lpString="*.vbproj") returned 8
	[0136.240] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.vcxproj") returned 0
	[0136.240] lstrlenA (lpString="*.vcxproj") returned 9
	[0136.240] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.manifest") returned 0
	[0136.240] lstrlenA (lpString="*.manifest") returned 10
	[0136.240] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.php") returned 0
	[0136.240] lstrlenA (lpString="*.php") returned 5
	[0136.241] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.vbe") returned 0
	[0136.241] lstrlenA (lpString="*.vbe") returned 5
	[0136.241] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.vba") returned 0
	[0136.241] lstrlenA (lpString="*.vba") returned 5
	[0136.241] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.vbs") returned 0
	[0136.241] lstrlenA (lpString="*.vbs") returned 5
	[0136.241] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.bat") returned 0
	[0136.241] lstrlenA (lpString="*.bat") returned 5
	[0136.241] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.cmd") returned 0
	[0136.241] lstrlenA (lpString="*.cmd") returned 5
	[0136.241] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.js") returned 0
	[0136.241] lstrlenA (lpString="*.js") returned 4
	[0136.241] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.jscript") returned 0
	[0136.241] lstrlenA (lpString="*.jscript") returned 9
	[0136.241] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.hta") returned 0
	[0136.241] lstrlenA (lpString="*.hta") returned 5
	[0136.241] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.php7") returned 0
	[0136.241] lstrlenA (lpString="*.php7") returned 6
	[0136.241] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.db") returned 0
	[0136.241] lstrlenA (lpString="*.db") returned 4
	[0136.241] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.swf") returned 0
	[0136.241] lstrlenA (lpString="*.swf") returned 5
	[0136.241] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.eml") returned 0
	[0136.241] lstrlenA (lpString="*.eml") returned 5
	[0136.241] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.part") returned 0
	[0136.241] lstrlenA (lpString="*.part") returned 6
	[0136.241] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.nfo") returned 0
	[0136.241] lstrlenA (lpString="*.nfo") returned 5
	[0136.241] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.rsa") returned 0
	[0136.241] lstrlenA (lpString="*.rsa") returned 5
	[0136.241] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.key") returned 0
	[0136.241] lstrlenA (lpString="*.key") returned 5
	[0136.241] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.aes") returned 0
	[0136.241] lstrlenA (lpString="*.aes") returned 5
	[0136.242] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.blob") returned 0
	[0136.242] lstrlenA (lpString="*.blob") returned 6
	[0136.242] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.btc") returned 0
	[0136.242] lstrlenA (lpString="*.btc") returned 5
	[0136.242] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui", pszSpec="*.wallet") returned 0
	[0136.242] lstrlenA (lpString="*.wallet") returned 8
	[0136.242] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a866ff, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x79a866ff, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x79a866ff, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x4cc00, dwReserved0=0x7b0000, dwReserved1=0x70, cFileName="AcRes.dll.mui", cAlternateFileName="")) returned 0
	[0136.242] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1
	[0136.242] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3995286e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3995286e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3995286e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x103a, dwReserved0=0x0, dwReserved1=0x0, cFileName="frxmain.sdb", cAlternateFileName="")) returned 1
	[0136.242] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0136.242] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="frxmain.sdb") returned -1
	[0136.242] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="frxmain.sdb") returned 1
	[0136.242] lstrcmpiA (lpString1="", lpString2="frxmain.sdb") returned -1
	[0136.242] PathFindFileNameA (pszPath="C:\\Windows\\AppPatch\\*.*") returned="*.*"
	[0136.242] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\AppPatch\\" | out: lpString1="C:\\Windows\\AppPatch\\") returned="C:\\Windows\\AppPatch\\"
	[0136.242] PathAddBackslashA (in: pszPath="C:\\Windows\\AppPatch\\" | out: pszPath="C:\\Windows\\AppPatch\\") returned=""
	[0136.242] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\AppPatch\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\AppPatch\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.242] GetFileAttributesA (lpFileName="C:\\Windows\\AppPatch\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\apppatch\\how-to-decrypt-files.htm")) returned 0x20
	[0136.242] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\", lpString2="frxmain.sdb" | out: lpString1="C:\\Windows\\AppPatch\\frxmain.sdb") returned="C:\\Windows\\AppPatch\\frxmain.sdb"
	[0136.242] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.zip") returned 0
	[0136.242] lstrlenA (lpString="*.zip") returned 5
	[0136.242] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.rar") returned 0
	[0136.243] lstrlenA (lpString="*.rar") returned 5
	[0136.243] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.7z") returned 0
	[0136.243] lstrlenA (lpString="*.7z") returned 4
	[0136.243] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.tar") returned 0
	[0136.243] lstrlenA (lpString="*.tar") returned 5
	[0136.243] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.gzip") returned 0
	[0136.243] lstrlenA (lpString="*.gzip") returned 6
	[0136.243] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.jpg") returned 0
	[0136.243] lstrlenA (lpString="*.jpg") returned 5
	[0136.243] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.jpeg") returned 0
	[0136.243] lstrlenA (lpString="*.jpeg") returned 6
	[0136.243] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.bmp") returned 0
	[0136.243] lstrlenA (lpString="*.bmp") returned 5
	[0136.243] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.gif") returned 0
	[0136.243] lstrlenA (lpString="*.gif") returned 5
	[0136.243] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.png") returned 0
	[0136.243] lstrlenA (lpString="*.png") returned 5
	[0136.243] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.doc") returned 0
	[0136.243] lstrlenA (lpString="*.doc") returned 5
	[0136.243] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.docx") returned 0
	[0136.243] lstrlenA (lpString="*.docx") returned 6
	[0136.243] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.xls") returned 0
	[0136.243] lstrlenA (lpString="*.xls") returned 5
	[0136.243] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.xlsx") returned 0
	[0136.243] lstrlenA (lpString="*.xlsx") returned 6
	[0136.243] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.ppt") returned 0
	[0136.243] lstrlenA (lpString="*.ppt") returned 5
	[0136.243] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.pptx") returned 0
	[0136.243] lstrlenA (lpString="*.pptx") returned 6
	[0136.243] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.txt") returned 0
	[0136.243] lstrlenA (lpString="*.txt") returned 5
	[0136.243] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.pdf") returned 0
	[0136.243] lstrlenA (lpString="*.pdf") returned 5
	[0136.244] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.htm") returned 0
	[0136.244] lstrlenA (lpString="*.htm") returned 5
	[0136.244] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.html") returned 0
	[0136.244] lstrlenA (lpString="*.html") returned 6
	[0136.244] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.mdb") returned 0
	[0136.244] lstrlenA (lpString="*.mdb") returned 5
	[0136.244] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.pfx") returned 0
	[0136.244] lstrlenA (lpString="*.pfx") returned 5
	[0136.244] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.md") returned 0
	[0136.244] lstrlenA (lpString="*.md") returned 4
	[0136.244] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.lnk") returned 0
	[0136.244] lstrlenA (lpString="*.lnk") returned 5
	[0136.244] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.torrent") returned 0
	[0136.244] lstrlenA (lpString="*.torrent") returned 9
	[0136.244] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.mov") returned 0
	[0136.244] lstrlenA (lpString="*.mov") returned 5
	[0136.244] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.3gp") returned 0
	[0136.244] lstrlenA (lpString="*.3gp") returned 5
	[0136.244] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.mpeg") returned 0
	[0136.244] lstrlenA (lpString="*.mpeg") returned 6
	[0136.244] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.mpg") returned 0
	[0136.244] lstrlenA (lpString="*.mpg") returned 5
	[0136.244] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.flv") returned 0
	[0136.244] lstrlenA (lpString="*.flv") returned 5
	[0136.244] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.avi") returned 0
	[0136.244] lstrlenA (lpString="*.avi") returned 5
	[0136.244] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.mp4") returned 0
	[0136.244] lstrlenA (lpString="*.mp4") returned 5
	[0136.244] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.wmv") returned 0
	[0136.244] lstrlenA (lpString="*.wmv") returned 5
	[0136.244] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.mkv") returned 0
	[0136.244] lstrlenA (lpString="*.mkv") returned 5
	[0136.244] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.mp3") returned 0
	[0136.244] lstrlenA (lpString="*.mp3") returned 5
	[0136.244] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.wav") returned 0
	[0136.245] lstrlenA (lpString="*.wav") returned 5
	[0136.245] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.flac") returned 0
	[0136.245] lstrlenA (lpString="*.flac") returned 6
	[0136.245] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.wma") returned 0
	[0136.245] lstrlenA (lpString="*.wma") returned 5
	[0136.245] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.au3") returned 0
	[0136.245] lstrlenA (lpString="*.au3") returned 5
	[0136.245] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.ahk") returned 0
	[0136.245] lstrlenA (lpString="*.ahk") returned 5
	[0136.245] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.c") returned 0
	[0136.245] lstrlenA (lpString="*.c") returned 3
	[0136.245] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.cc") returned 0
	[0136.245] lstrlenA (lpString="*.cc") returned 4
	[0136.245] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.cpp") returned 0
	[0136.245] lstrlenA (lpString="*.cpp") returned 5
	[0136.245] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.cxx") returned 0
	[0136.245] lstrlenA (lpString="*.cxx") returned 5
	[0136.245] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.c++") returned 0
	[0136.245] lstrlenA (lpString="*.c++") returned 5
	[0136.245] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.cs") returned 0
	[0136.245] lstrlenA (lpString="*.cs") returned 4
	[0136.245] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.vb") returned 0
	[0136.245] lstrlenA (lpString="*.vb") returned 4
	[0136.245] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.bas") returned 0
	[0136.245] lstrlenA (lpString="*.bas") returned 5
	[0136.245] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.csproj") returned 0
	[0136.245] lstrlenA (lpString="*.csproj") returned 8
	[0136.245] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.vbproj") returned 0
	[0136.245] lstrlenA (lpString="*.vbproj") returned 8
	[0136.245] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.vcxproj") returned 0
	[0136.245] lstrlenA (lpString="*.vcxproj") returned 9
	[0136.245] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.manifest") returned 0
	[0136.245] lstrlenA (lpString="*.manifest") returned 10
	[0136.245] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.php") returned 0
	[0136.246] lstrlenA (lpString="*.php") returned 5
	[0136.246] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.vbe") returned 0
	[0136.246] lstrlenA (lpString="*.vbe") returned 5
	[0136.246] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.vba") returned 0
	[0136.246] lstrlenA (lpString="*.vba") returned 5
	[0136.246] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.vbs") returned 0
	[0136.246] lstrlenA (lpString="*.vbs") returned 5
	[0136.246] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.bat") returned 0
	[0136.246] lstrlenA (lpString="*.bat") returned 5
	[0136.246] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.cmd") returned 0
	[0136.246] lstrlenA (lpString="*.cmd") returned 5
	[0136.246] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.js") returned 0
	[0136.246] lstrlenA (lpString="*.js") returned 4
	[0136.246] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.jscript") returned 0
	[0136.246] lstrlenA (lpString="*.jscript") returned 9
	[0136.246] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.hta") returned 0
	[0136.246] lstrlenA (lpString="*.hta") returned 5
	[0136.246] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.php7") returned 0
	[0136.246] lstrlenA (lpString="*.php7") returned 6
	[0136.246] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.db") returned 0
	[0136.246] lstrlenA (lpString="*.db") returned 4
	[0136.246] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.swf") returned 0
	[0136.246] lstrlenA (lpString="*.swf") returned 5
	[0136.246] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.eml") returned 0
	[0136.246] lstrlenA (lpString="*.eml") returned 5
	[0136.246] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.part") returned 0
	[0136.246] lstrlenA (lpString="*.part") returned 6
	[0136.246] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.nfo") returned 0
	[0136.246] lstrlenA (lpString="*.nfo") returned 5
	[0136.246] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.rsa") returned 0
	[0136.246] lstrlenA (lpString="*.rsa") returned 5
	[0136.246] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.key") returned 0
	[0136.246] lstrlenA (lpString="*.key") returned 5
	[0136.246] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.aes") returned 0
	[0136.247] lstrlenA (lpString="*.aes") returned 5
	[0136.247] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.blob") returned 0
	[0136.247] lstrlenA (lpString="*.blob") returned 6
	[0136.247] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.btc") returned 0
	[0136.247] lstrlenA (lpString="*.btc") returned 5
	[0136.247] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\frxmain.sdb", pszSpec="*.wallet") returned 0
	[0136.247] lstrlenA (lpString="*.wallet") returned 8
	[0136.247] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4659eb17, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x1d39639, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x4659eb17, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x2e0b6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="msimain.sdb", cAlternateFileName="")) returned 1
	[0136.247] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0136.247] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="msimain.sdb") returned -1
	[0136.247] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="msimain.sdb") returned -1
	[0136.247] lstrcmpiA (lpString1="", lpString2="msimain.sdb") returned -1
	[0136.247] PathFindFileNameA (pszPath="C:\\Windows\\AppPatch\\frxmain.sdb") returned="frxmain.sdb"
	[0136.247] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\AppPatch\\" | out: lpString1="C:\\Windows\\AppPatch\\") returned="C:\\Windows\\AppPatch\\"
	[0136.247] PathAddBackslashA (in: pszPath="C:\\Windows\\AppPatch\\" | out: pszPath="C:\\Windows\\AppPatch\\") returned=""
	[0136.247] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\AppPatch\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\AppPatch\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.247] GetFileAttributesA (lpFileName="C:\\Windows\\AppPatch\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\apppatch\\how-to-decrypt-files.htm")) returned 0x20
	[0136.247] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\", lpString2="msimain.sdb" | out: lpString1="C:\\Windows\\AppPatch\\msimain.sdb") returned="C:\\Windows\\AppPatch\\msimain.sdb"
	[0136.247] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\msimain.sdb", pszSpec="*.zip") returned 0
	[0136.247] lstrlenA (lpString="*.zip") returned 5
	[0136.247] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\msimain.sdb", pszSpec="*.rar") returned 0
	[0136.247] lstrlenA (lpString="*.rar") returned 5
	[0136.247] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\msimain.sdb", pszSpec="*.7z") returned 0
	[0136.247] lstrlenA (lpString="*.7z") returned 4
	[0136.247] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\msimain.sdb", pszSpec="*.tar") returned 0
	[0136.247] lstrlenA (lpString="*.tar") returned 5
	[0136.247] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\msimain.sdb", pszSpec="*.gzip") returned 0
	[0136.247] lstrlenA (lpString="*.gzip") returned 6
	[0136.247] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\msimain.sdb", pszSpec="*.jpg") returned 0
	[0136.247] lstrlenA (lpString="*.jpg") returned 5
	[0136.247] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\msimain.sdb", pszSpec="*.jpeg") returned 0
	[0136.248] lstrlenA (lpString="*.jpeg") returned 6
	[0136.248] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\msimain.sdb", pszSpec="*.bmp") returned 0
	[0136.248] lstrlenA (lpString="*.bmp") returned 5
	[0136.248] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\msimain.sdb", pszSpec="*.gif") returned 0
	[0136.248] lstrlenA (lpString="*.gif") returned 5
	[0136.248] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\msimain.sdb", pszSpec="*.png") returned 0
	[0136.248] lstrlenA (lpString="*.png") returned 5
	[0136.248] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\msimain.sdb", pszSpec="*.doc") returned 0
	[0136.248] lstrlenA (lpString="*.doc") returned 5
	[0136.248] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\msimain.sdb", pszSpec="*.docx") returned 0
	[0136.248] lstrlenA (lpString="*.docx") returned 6
	[0136.248] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\msimain.sdb", pszSpec="*.xls") returned 0
	[0136.248] lstrlenA (lpString="*.xls") returned 5
	[0136.248] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\msimain.sdb", pszSpec="*.xlsx") returned 0
	[0136.248] lstrlenA (lpString="*.xlsx") returned 6
	[0136.248] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\msimain.sdb", pszSpec="*.ppt") returned 0
	[0136.248] lstrlenA (lpString="*.ppt") returned 5
	[0136.248] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\msimain.sdb", pszSpec="*.pptx") returned 0
	[0136.248] lstrlenA (lpString="*.pptx") returned 6
	[0136.248] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\msimain.sdb", pszSpec="*.txt") returned 0
	[0136.248] lstrlenA (lpString="*.txt") returned 5
	[0136.248] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\msimain.sdb", pszSpec="*.pdf") returned 0
	[0136.248] lstrlenA (lpString="*.pdf") returned 5
	[0136.248] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\msimain.sdb", pszSpec="*.htm") returned 0
	[0136.248] lstrlenA (lpString="*.htm") returned 5
	[0136.248] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\msimain.sdb", pszSpec="*.html") returned 0
	[0136.248] lstrlenA (lpString="*.html") returned 6
	[0136.248] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\msimain.sdb", pszSpec="*.mdb") returned 0
	[0136.248] lstrlenA (lpString="*.mdb") returned 5
	[0136.248] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\msimain.sdb", pszSpec="*.pfx") returned 0
	[0136.248] lstrlenA (lpString="*.pfx") returned 5
	[0136.248] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\msimain.sdb", pszSpec="*.md") returned 0
	[0136.248] lstrlenA (lpString="*.md") returned 4
	[0136.248] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\msimain.sdb", pszSpec="*.lnk") returned 0
	[0136.248] lstrlenA (lpString="*.lnk") returned 5
	[0136.249] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\msimain.sdb", pszSpec="*.torrent") returned 0
	[0136.249] lstrlenA (lpString="*.torrent") returned 9
	[0136.249] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\msimain.sdb", pszSpec="*.mov") returned 0
	[0136.249] lstrlenA (lpString="*.mov") returned 5
	[0136.249] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\msimain.sdb", pszSpec="*.3gp") returned 0
	[0136.249] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\msimain.sdb", pszSpec="*.mpeg") returned 0
	[0136.249] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\msimain.sdb", pszSpec="*.mpg") returned 0
	[0136.249] PathMatchSpecA (pszFile="C:\\Windows\\AppPatch\\msimain.sdb", pszSpec="*.flv") returned 0
	[0136.249] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b483fe6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6b483fe6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6b483fe6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="pcamain.sdb", cAlternateFileName="")) returned 1
	[0136.249] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0136.249] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="pcamain.sdb") returned -1
	[0136.249] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="pcamain.sdb") returned -1
	[0136.249] lstrcmpiA (lpString1="", lpString2="pcamain.sdb") returned -1
	[0136.249] PathFindFileNameA (pszPath="C:\\Windows\\AppPatch\\msimain.sdb") returned="msimain.sdb"
	[0136.249] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\AppPatch\\" | out: lpString1="C:\\Windows\\AppPatch\\") returned="C:\\Windows\\AppPatch\\"
	[0136.249] PathAddBackslashA (in: pszPath="C:\\Windows\\AppPatch\\" | out: pszPath="C:\\Windows\\AppPatch\\") returned=""
	[0136.249] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\AppPatch\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\AppPatch\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.249] GetFileAttributesA (lpFileName="C:\\Windows\\AppPatch\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\apppatch\\how-to-decrypt-files.htm")) returned 0x20
	[0136.249] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\", lpString2="pcamain.sdb" | out: lpString1="C:\\Windows\\AppPatch\\pcamain.sdb") returned="C:\\Windows\\AppPatch\\pcamain.sdb"
	[0136.249] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ce8ca3, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x79ce8ca3, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x79d0ef21, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x3b1f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="sysmain.sdb", cAlternateFileName="")) returned 1
	[0136.250] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0
	[0136.250] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="sysmain.sdb") returned -1
	[0136.250] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="sysmain.sdb") returned -1
	[0136.250] lstrcmpiA (lpString1="", lpString2="sysmain.sdb") returned -1
	[0136.250] PathFindFileNameA (pszPath="C:\\Windows\\AppPatch\\pcamain.sdb") returned="pcamain.sdb"
	[0136.250] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\AppPatch\\" | out: lpString1="C:\\Windows\\AppPatch\\") returned="C:\\Windows\\AppPatch\\"
	[0136.250] PathAddBackslashA (in: pszPath="C:\\Windows\\AppPatch\\" | out: pszPath="C:\\Windows\\AppPatch\\") returned=""
	[0136.250] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\AppPatch\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\AppPatch\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.250] GetFileAttributesA (lpFileName="C:\\Windows\\AppPatch\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\apppatch\\how-to-decrypt-files.htm")) returned 0x20
	[0136.250] lstrcatA (in: lpString1="C:\\Windows\\AppPatch\\", lpString2="sysmain.sdb" | out: lpString1="C:\\Windows\\AppPatch\\sysmain.sdb") returned="C:\\Windows\\AppPatch\\sysmain.sdb"
	[0136.250] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ce8ca3, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x79ce8ca3, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x79d0ef21, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x3b1f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="sysmain.sdb", cAlternateFileName="")) returned 0
	[0136.250] FindClose (in: hFindFile=0x7cb9d0 | out: hFindFile=0x7cb9d0) returned 1
	[0136.250] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x12b43423, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x12b43423, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppReadiness", cAlternateFileName="APPREA~1")) returned 1
	[0136.250] lstrcmpA (lpString1=".", lpString2="AppReadiness") returned -1
	[0136.250] lstrcmpA (lpString1="..", lpString2="AppReadiness") returned -1
	[0136.250] PathFindFileNameA (pszPath="C:\\Windows\\*.*") returned="*.*"
	[0136.250] lstrcatA (in: lpString1="C:\\Windows\\", lpString2="AppReadiness" | out: lpString1="C:\\Windows\\AppReadiness") returned="C:\\Windows\\AppReadiness"
	[0136.250] FindFirstFileA (in: lpFileName="C:\\Windows\\AppReadiness\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x12b43423, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x12b43423, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbc50
	[0136.250] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.250] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x12b43423, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x12b43423, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.250] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.250] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.250] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x12b43423, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x12b43423, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0136.251] FindClose (in: hFindFile=0x7cbc50 | out: hFindFile=0x7cbc50) returned 1
	[0136.251] FindNextFileA (in: hFindFile=0x7cb850, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8708dc51, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x8708dc51, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="assembly", cAlternateFileName="")) returned 1
	[0136.251] lstrcmpA (lpString1=".", lpString2="assembly") returned -1
	[0136.251] lstrcmpA (lpString1="..", lpString2="assembly") returned -1
	[0136.251] PathFindFileNameA (pszPath="C:\\Windows\\*.*") returned="*.*"
	[0136.251] lstrcatA (in: lpString1="C:\\Windows\\", lpString2="assembly" | out: lpString1="C:\\Windows\\assembly") returned="C:\\Windows\\assembly"
	[0136.251] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8708dc51, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x8708dc51, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb590
	[0136.251] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.251] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8708dc51, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x8708dc51, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.251] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.251] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.251] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x430e620c, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x4ef1cf0b, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ef1cf0b, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GAC", cAlternateFileName="")) returned 1
	[0136.251] lstrcmpA (lpString1=".", lpString2="GAC") returned -1
	[0136.251] lstrcmpA (lpString1="..", lpString2="GAC") returned -1
	[0136.251] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\*.*") returned="*.*"
	[0136.251] lstrcatA (in: lpString1="C:\\Windows\\assembly\\", lpString2="GAC" | out: lpString1="C:\\Windows\\assembly\\GAC") returned="C:\\Windows\\assembly\\GAC"
	[0136.251] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x430e620c, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x4ef1cf0b, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ef1cf0b, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cb810
	[0136.252] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.252] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x430e620c, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x4ef1cf0b, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ef1cf0b, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0136.252] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.252] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.252] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4eef6cc6, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="ADODB", cAlternateFileName="")) returned 1
	[0136.252] lstrcmpA (lpString1=".", lpString2="ADODB") returned -1
	[0136.252] lstrcmpA (lpString1="..", lpString2="ADODB") returned -1
	[0136.252] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC\\*.*") returned="*.*"
	[0136.252] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\", lpString2="ADODB" | out: lpString1="C:\\Windows\\assembly\\GAC\\ADODB") returned="C:\\Windows\\assembly\\GAC\\ADODB"
	[0136.252] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC\\ADODB\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4eef6cc6, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cb9d0
	[0136.253] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.253] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4eef6cc6, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0136.253] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.253] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.253] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a022e6b, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="7.0.3300.0__b03f5f7f11d50a3a", cAlternateFileName="703300~1.0__")) returned 1
	[0136.253] lstrcmpA (lpString1=".", lpString2="7.0.3300.0__b03f5f7f11d50a3a") returned -1
	[0136.253] lstrcmpA (lpString1="..", lpString2="7.0.3300.0__b03f5f7f11d50a3a") returned -1
	[0136.253] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC\\ADODB\\*.*") returned="*.*"
	[0136.253] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\ADODB\\", lpString2="7.0.3300.0__b03f5f7f11d50a3a" | out: lpString1="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a") returned="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a"
	[0136.253] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a022e6b, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb5d0
	[0136.254] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.254] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a022e6b, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.254] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.254] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.254] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a022e6b, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a022e6b, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a022e6b, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x1caa8, dwReserved0=0x2, dwReserved1=0x0, cFileName="adodb.dll", cAlternateFileName="")) returned 1
	[0136.254] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.254] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="adodb.dll") returned 1
	[0136.254] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="adodb.dll") returned 1
	[0136.254] lstrcmpiA (lpString1="", lpString2="adodb.dll") returned -1
	[0136.254] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\*.*") returned="*.*"
	[0136.254] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\"
	[0136.254] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\") returned=""
	[0136.254] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.254] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac\\adodb\\7.0.3300.0__b03f5f7f11d50a3a\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.254] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac\\adodb\\7.0.3300.0__b03f5f7f11d50a3a\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0136.257] WriteFile (in: hFile=0x214, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0136.258] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.258] CloseHandle (hObject=0x214) returned 1
	[0136.258] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\", lpString2="adodb.dll" | out: lpString1="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll") returned="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll"
	[0136.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.zip") returned 0
	[0136.258] lstrlenA (lpString="*.zip") returned 5
	[0136.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.rar") returned 0
	[0136.258] lstrlenA (lpString="*.rar") returned 5
	[0136.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.7z") returned 0
	[0136.258] lstrlenA (lpString="*.7z") returned 4
	[0136.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.tar") returned 0
	[0136.258] lstrlenA (lpString="*.tar") returned 5
	[0136.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.gzip") returned 0
	[0136.258] lstrlenA (lpString="*.gzip") returned 6
	[0136.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.jpg") returned 0
	[0136.258] lstrlenA (lpString="*.jpg") returned 5
	[0136.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.jpeg") returned 0
	[0136.258] lstrlenA (lpString="*.jpeg") returned 6
	[0136.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.bmp") returned 0
	[0136.258] lstrlenA (lpString="*.bmp") returned 5
	[0136.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.gif") returned 0
	[0136.258] lstrlenA (lpString="*.gif") returned 5
	[0136.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.png") returned 0
	[0136.258] lstrlenA (lpString="*.png") returned 5
	[0136.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.doc") returned 0
	[0136.258] lstrlenA (lpString="*.doc") returned 5
	[0136.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.docx") returned 0
	[0136.259] lstrlenA (lpString="*.docx") returned 6
	[0136.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.xls") returned 0
	[0136.259] lstrlenA (lpString="*.xls") returned 5
	[0136.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.xlsx") returned 0
	[0136.259] lstrlenA (lpString="*.xlsx") returned 6
	[0136.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.ppt") returned 0
	[0136.259] lstrlenA (lpString="*.ppt") returned 5
	[0136.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.pptx") returned 0
	[0136.259] lstrlenA (lpString="*.pptx") returned 6
	[0136.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.txt") returned 0
	[0136.259] lstrlenA (lpString="*.txt") returned 5
	[0136.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.pdf") returned 0
	[0136.259] lstrlenA (lpString="*.pdf") returned 5
	[0136.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.htm") returned 0
	[0136.259] lstrlenA (lpString="*.htm") returned 5
	[0136.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.html") returned 0
	[0136.259] lstrlenA (lpString="*.html") returned 6
	[0136.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.mdb") returned 0
	[0136.259] lstrlenA (lpString="*.mdb") returned 5
	[0136.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.pfx") returned 0
	[0136.259] lstrlenA (lpString="*.pfx") returned 5
	[0136.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.md") returned 0
	[0136.259] lstrlenA (lpString="*.md") returned 4
	[0136.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.lnk") returned 0
	[0136.259] lstrlenA (lpString="*.lnk") returned 5
	[0136.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.torrent") returned 0
	[0136.259] lstrlenA (lpString="*.torrent") returned 9
	[0136.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.mov") returned 0
	[0136.259] lstrlenA (lpString="*.mov") returned 5
	[0136.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.3gp") returned 0
	[0136.259] lstrlenA (lpString="*.3gp") returned 5
	[0136.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.mpeg") returned 0
	[0136.260] lstrlenA (lpString="*.mpeg") returned 6
	[0136.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.mpg") returned 0
	[0136.260] lstrlenA (lpString="*.mpg") returned 5
	[0136.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.flv") returned 0
	[0136.260] lstrlenA (lpString="*.flv") returned 5
	[0136.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.avi") returned 0
	[0136.260] lstrlenA (lpString="*.avi") returned 5
	[0136.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.mp4") returned 0
	[0136.260] lstrlenA (lpString="*.mp4") returned 5
	[0136.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.wmv") returned 0
	[0136.260] lstrlenA (lpString="*.wmv") returned 5
	[0136.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.mkv") returned 0
	[0136.260] lstrlenA (lpString="*.mkv") returned 5
	[0136.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.mp3") returned 0
	[0136.260] lstrlenA (lpString="*.mp3") returned 5
	[0136.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.wav") returned 0
	[0136.260] lstrlenA (lpString="*.wav") returned 5
	[0136.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.flac") returned 0
	[0136.260] lstrlenA (lpString="*.flac") returned 6
	[0136.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.wma") returned 0
	[0136.260] lstrlenA (lpString="*.wma") returned 5
	[0136.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.au3") returned 0
	[0136.260] lstrlenA (lpString="*.au3") returned 5
	[0136.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.ahk") returned 0
	[0136.260] lstrlenA (lpString="*.ahk") returned 5
	[0136.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.c") returned 0
	[0136.260] lstrlenA (lpString="*.c") returned 3
	[0136.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.cc") returned 0
	[0136.260] lstrlenA (lpString="*.cc") returned 4
	[0136.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.cpp") returned 0
	[0136.260] lstrlenA (lpString="*.cpp") returned 5
	[0136.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.cxx") returned 0
	[0136.260] lstrlenA (lpString="*.cxx") returned 5
	[0136.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.c++") returned 0
	[0136.260] lstrlenA (lpString="*.c++") returned 5
	[0136.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.cs") returned 0
	[0136.261] lstrlenA (lpString="*.cs") returned 4
	[0136.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.vb") returned 0
	[0136.261] lstrlenA (lpString="*.vb") returned 4
	[0136.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.bas") returned 0
	[0136.261] lstrlenA (lpString="*.bas") returned 5
	[0136.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.csproj") returned 0
	[0136.261] lstrlenA (lpString="*.csproj") returned 8
	[0136.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.vbproj") returned 0
	[0136.261] lstrlenA (lpString="*.vbproj") returned 8
	[0136.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.vcxproj") returned 0
	[0136.261] lstrlenA (lpString="*.vcxproj") returned 9
	[0136.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.manifest") returned 0
	[0136.261] lstrlenA (lpString="*.manifest") returned 10
	[0136.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.php") returned 0
	[0136.261] lstrlenA (lpString="*.php") returned 5
	[0136.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.vbe") returned 0
	[0136.261] lstrlenA (lpString="*.vbe") returned 5
	[0136.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.vba") returned 0
	[0136.261] lstrlenA (lpString="*.vba") returned 5
	[0136.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.vbs") returned 0
	[0136.261] lstrlenA (lpString="*.vbs") returned 5
	[0136.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.bat") returned 0
	[0136.261] lstrlenA (lpString="*.bat") returned 5
	[0136.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.cmd") returned 0
	[0136.261] lstrlenA (lpString="*.cmd") returned 5
	[0136.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.js") returned 0
	[0136.261] lstrlenA (lpString="*.js") returned 4
	[0136.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.jscript") returned 0
	[0136.261] lstrlenA (lpString="*.jscript") returned 9
	[0136.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.hta") returned 0
	[0136.261] lstrlenA (lpString="*.hta") returned 5
	[0136.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.php7") returned 0
	[0136.261] lstrlenA (lpString="*.php7") returned 6
	[0136.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.db") returned 0
	[0136.262] lstrlenA (lpString="*.db") returned 4
	[0136.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.swf") returned 0
	[0136.262] lstrlenA (lpString="*.swf") returned 5
	[0136.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.eml") returned 0
	[0136.262] lstrlenA (lpString="*.eml") returned 5
	[0136.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.part") returned 0
	[0136.262] lstrlenA (lpString="*.part") returned 6
	[0136.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.nfo") returned 0
	[0136.262] lstrlenA (lpString="*.nfo") returned 5
	[0136.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.rsa") returned 0
	[0136.262] lstrlenA (lpString="*.rsa") returned 5
	[0136.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.key") returned 0
	[0136.262] lstrlenA (lpString="*.key") returned 5
	[0136.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.aes") returned 0
	[0136.262] lstrlenA (lpString="*.aes") returned 5
	[0136.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.blob") returned 0
	[0136.262] lstrlenA (lpString="*.blob") returned 6
	[0136.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.btc") returned 0
	[0136.262] lstrlenA (lpString="*.btc") returned 5
	[0136.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll", pszSpec="*.wallet") returned 0
	[0136.262] lstrlenA (lpString="*.wallet") returned 8
	[0136.262] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eef6cc6, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="__AssemblyInfo__.ini", cAlternateFileName="__ASSE~1.INI")) returned 1
	[0136.262] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.262] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="__AssemblyInfo__.ini") returned 1
	[0136.262] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="__AssemblyInfo__.ini") returned 1
	[0136.262] lstrcmpiA (lpString1="", lpString2="__AssemblyInfo__.ini") returned -1
	[0136.262] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\adodb.dll") returned="adodb.dll"
	[0136.262] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\"
	[0136.262] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\") returned=""
	[0136.262] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.262] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac\\adodb\\7.0.3300.0__b03f5f7f11d50a3a\\how-to-decrypt-files.htm")) returned 0x20
	[0136.263] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\", lpString2="__AssemblyInfo__.ini" | out: lpString1="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini") returned="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini"
	[0136.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.zip") returned 0
	[0136.263] lstrlenA (lpString="*.zip") returned 5
	[0136.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.rar") returned 0
	[0136.263] lstrlenA (lpString="*.rar") returned 5
	[0136.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.7z") returned 0
	[0136.263] lstrlenA (lpString="*.7z") returned 4
	[0136.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.tar") returned 0
	[0136.263] lstrlenA (lpString="*.tar") returned 5
	[0136.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.gzip") returned 0
	[0136.263] lstrlenA (lpString="*.gzip") returned 6
	[0136.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.jpg") returned 0
	[0136.263] lstrlenA (lpString="*.jpg") returned 5
	[0136.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.jpeg") returned 0
	[0136.263] lstrlenA (lpString="*.jpeg") returned 6
	[0136.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.bmp") returned 0
	[0136.263] lstrlenA (lpString="*.bmp") returned 5
	[0136.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.gif") returned 0
	[0136.263] lstrlenA (lpString="*.gif") returned 5
	[0136.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.png") returned 0
	[0136.263] lstrlenA (lpString="*.png") returned 5
	[0136.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.doc") returned 0
	[0136.263] lstrlenA (lpString="*.doc") returned 5
	[0136.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.docx") returned 0
	[0136.263] lstrlenA (lpString="*.docx") returned 6
	[0136.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.xls") returned 0
	[0136.263] lstrlenA (lpString="*.xls") returned 5
	[0136.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.xlsx") returned 0
	[0136.263] lstrlenA (lpString="*.xlsx") returned 6
	[0136.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.ppt") returned 0
	[0136.263] lstrlenA (lpString="*.ppt") returned 5
	[0136.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.pptx") returned 0
	[0136.264] lstrlenA (lpString="*.pptx") returned 6
	[0136.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.txt") returned 0
	[0136.264] lstrlenA (lpString="*.txt") returned 5
	[0136.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.pdf") returned 0
	[0136.264] lstrlenA (lpString="*.pdf") returned 5
	[0136.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.htm") returned 0
	[0136.264] lstrlenA (lpString="*.htm") returned 5
	[0136.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.html") returned 0
	[0136.264] lstrlenA (lpString="*.html") returned 6
	[0136.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.mdb") returned 0
	[0136.264] lstrlenA (lpString="*.mdb") returned 5
	[0136.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.pfx") returned 0
	[0136.264] lstrlenA (lpString="*.pfx") returned 5
	[0136.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.md") returned 0
	[0136.264] lstrlenA (lpString="*.md") returned 4
	[0136.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.lnk") returned 0
	[0136.264] lstrlenA (lpString="*.lnk") returned 5
	[0136.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.torrent") returned 0
	[0136.264] lstrlenA (lpString="*.torrent") returned 9
	[0136.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.mov") returned 0
	[0136.264] lstrlenA (lpString="*.mov") returned 5
	[0136.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.3gp") returned 0
	[0136.264] lstrlenA (lpString="*.3gp") returned 5
	[0136.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.mpeg") returned 0
	[0136.264] lstrlenA (lpString="*.mpeg") returned 6
	[0136.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.mpg") returned 0
	[0136.264] lstrlenA (lpString="*.mpg") returned 5
	[0136.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.flv") returned 0
	[0136.264] lstrlenA (lpString="*.flv") returned 5
	[0136.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.avi") returned 0
	[0136.264] lstrlenA (lpString="*.avi") returned 5
	[0136.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.mp4") returned 0
	[0136.264] lstrlenA (lpString="*.mp4") returned 5
	[0136.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.wmv") returned 0
	[0136.265] lstrlenA (lpString="*.wmv") returned 5
	[0136.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.mkv") returned 0
	[0136.265] lstrlenA (lpString="*.mkv") returned 5
	[0136.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.mp3") returned 0
	[0136.265] lstrlenA (lpString="*.mp3") returned 5
	[0136.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.wav") returned 0
	[0136.265] lstrlenA (lpString="*.wav") returned 5
	[0136.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.flac") returned 0
	[0136.265] lstrlenA (lpString="*.flac") returned 6
	[0136.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.wma") returned 0
	[0136.265] lstrlenA (lpString="*.wma") returned 5
	[0136.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.au3") returned 0
	[0136.265] lstrlenA (lpString="*.au3") returned 5
	[0136.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.ahk") returned 0
	[0136.265] lstrlenA (lpString="*.ahk") returned 5
	[0136.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.c") returned 0
	[0136.265] lstrlenA (lpString="*.c") returned 3
	[0136.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.cc") returned 0
	[0136.265] lstrlenA (lpString="*.cc") returned 4
	[0136.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.cpp") returned 0
	[0136.265] lstrlenA (lpString="*.cpp") returned 5
	[0136.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.cxx") returned 0
	[0136.265] lstrlenA (lpString="*.cxx") returned 5
	[0136.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.c++") returned 0
	[0136.265] lstrlenA (lpString="*.c++") returned 5
	[0136.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.cs") returned 0
	[0136.265] lstrlenA (lpString="*.cs") returned 4
	[0136.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.vb") returned 0
	[0136.265] lstrlenA (lpString="*.vb") returned 4
	[0136.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.bas") returned 0
	[0136.265] lstrlenA (lpString="*.bas") returned 5
	[0136.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.csproj") returned 0
	[0136.265] lstrlenA (lpString="*.csproj") returned 8
	[0136.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.vbproj") returned 0
	[0136.266] lstrlenA (lpString="*.vbproj") returned 8
	[0136.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.vcxproj") returned 0
	[0136.266] lstrlenA (lpString="*.vcxproj") returned 9
	[0136.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.manifest") returned 0
	[0136.266] lstrlenA (lpString="*.manifest") returned 10
	[0136.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.php") returned 0
	[0136.266] lstrlenA (lpString="*.php") returned 5
	[0136.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.vbe") returned 0
	[0136.266] lstrlenA (lpString="*.vbe") returned 5
	[0136.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.vba") returned 0
	[0136.266] lstrlenA (lpString="*.vba") returned 5
	[0136.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.vbs") returned 0
	[0136.266] lstrlenA (lpString="*.vbs") returned 5
	[0136.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.bat") returned 0
	[0136.266] lstrlenA (lpString="*.bat") returned 5
	[0136.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.cmd") returned 0
	[0136.266] lstrlenA (lpString="*.cmd") returned 5
	[0136.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.js") returned 0
	[0136.266] lstrlenA (lpString="*.js") returned 4
	[0136.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.jscript") returned 0
	[0136.266] lstrlenA (lpString="*.jscript") returned 9
	[0136.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.hta") returned 0
	[0136.266] lstrlenA (lpString="*.hta") returned 5
	[0136.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.php7") returned 0
	[0136.266] lstrlenA (lpString="*.php7") returned 6
	[0136.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.db") returned 0
	[0136.266] lstrlenA (lpString="*.db") returned 4
	[0136.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.swf") returned 0
	[0136.266] lstrlenA (lpString="*.swf") returned 5
	[0136.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.eml") returned 0
	[0136.266] lstrlenA (lpString="*.eml") returned 5
	[0136.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.part") returned 0
	[0136.266] lstrlenA (lpString="*.part") returned 6
	[0136.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.nfo") returned 0
	[0136.267] lstrlenA (lpString="*.nfo") returned 5
	[0136.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.rsa") returned 0
	[0136.267] lstrlenA (lpString="*.rsa") returned 5
	[0136.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.key") returned 0
	[0136.267] lstrlenA (lpString="*.key") returned 5
	[0136.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.aes") returned 0
	[0136.267] lstrlenA (lpString="*.aes") returned 5
	[0136.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.blob") returned 0
	[0136.267] lstrlenA (lpString="*.blob") returned 6
	[0136.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.btc") returned 0
	[0136.267] lstrlenA (lpString="*.btc") returned 5
	[0136.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.wallet") returned 0
	[0136.267] lstrlenA (lpString="*.wallet") returned 8
	[0136.267] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eef6cc6, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="__AssemblyInfo__.ini", cAlternateFileName="__ASSE~1.INI")) returned 0
	[0136.267] FindClose (in: hFindFile=0x7cb5d0 | out: hFindFile=0x7cb5d0) returned 1
	[0136.267] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a022e6b, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="7.0.3300.0__b03f5f7f11d50a3a", cAlternateFileName="703300~1.0__")) returned 0
	[0136.267] FindClose (in: hFindFile=0x7cb9d0 | out: hFindFile=0x7cb9d0) returned 1
	[0136.267] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4eef6cc6, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Extensibility", cAlternateFileName="EXTENS~1")) returned 1
	[0136.267] lstrcmpA (lpString1=".", lpString2="Extensibility") returned -1
	[0136.267] lstrcmpA (lpString1="..", lpString2="Extensibility") returned -1
	[0136.267] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC\\*.*") returned="*.*"
	[0136.267] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\", lpString2="Extensibility" | out: lpString1="C:\\Windows\\assembly\\GAC\\Extensibility") returned="C:\\Windows\\assembly\\GAC\\Extensibility"
	[0136.267] lstrlenA (lpString="C:\\Windows\\assembly\\GAC\\Extensibility") returned 37
	[0136.267] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC\\Extensibility\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4eef6cc6, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbc50
	[0136.268] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.268] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4eef6cc6, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.268] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.268] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.268] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a0bb87e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7.0.3300.0__b03f5f7f11d50a3a", cAlternateFileName="703300~1.0__")) returned 1
	[0136.268] lstrcmpA (lpString1=".", lpString2="7.0.3300.0__b03f5f7f11d50a3a") returned -1
	[0136.268] lstrcmpA (lpString1="..", lpString2="7.0.3300.0__b03f5f7f11d50a3a") returned -1
	[0136.268] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC\\Extensibility\\*.*") returned="*.*"
	[0136.268] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\Extensibility\\", lpString2="7.0.3300.0__b03f5f7f11d50a3a" | out: lpString1="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a") returned="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a"
	[0136.268] lstrlenA (lpString="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a") returned 66
	[0136.268] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a0bb87e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cb6d0
	[0136.268] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.268] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a0bb87e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0136.268] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.268] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.268] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0bb87e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a0bb87e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a0bb87e, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x3240, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="extensibility.dll", cAlternateFileName="EXTENS~1.DLL")) returned 1
	[0136.268] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.268] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="extensibility.dll") returned -1
	[0136.268] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="extensibility.dll") returned 1
	[0136.268] lstrcmpiA (lpString1="", lpString2="extensibility.dll") returned -1
	[0136.268] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\*.*") returned="*.*"
	[0136.268] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\"
	[0136.268] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\") returned=""
	[0136.269] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.269] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac\\extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.269] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac\\extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0136.271] lstrlenA (lpString="<html lang=\"ru\"><head><meta charset=\"windows-1251\"><title>!!! FILES ENCRYPTED !!!</title><style>body{background-color: #000; color: red; font-size: 11pt; font-family: verdana;}h1{font-weight: normal; margin-bottom: 5px; color: red;}h2{font-weight: normal; color: #00dd00;}</style> </head> <body><h1>Ooops, your important files are encrypted!</h1>If you see this text, your files are no longer accessible, because they have been encrypted.<br/>perhaps you looking for a way to decrypt your files, but DON'T waste your time. No one can<br/>recover your files without our decryption key.<br/><br/>Please follow the instructions:<br/><br/>1. Send $600 worth of Bitcoins to the following address:<br/><br/>1LS32VsvWhWU6ud9h3xEJuJzgEbRtBnymE<br/><br/>2. Send your Bitcoin wallet ID and your ID to E-mail mcrypt2019@yandex.com.<br/>Your personal ID:<br/><br/>N8B4XRqE6LZb3WYDLBTuP8moMgJCAKN9mZ4sq3JD2eyFGeP8JgDLLJ5XN6bw</body></html>") returned 926
	[0136.271] WriteFile (in: hFile=0x214, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0136.272] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.272] CloseHandle (hObject=0x214) returned 1
	[0136.272] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\", lpString2="extensibility.dll" | out: lpString1="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll") returned="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll"
	[0136.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.zip") returned 0
	[0136.272] lstrlenA (lpString="*.zip") returned 5
	[0136.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.rar") returned 0
	[0136.272] lstrlenA (lpString="*.rar") returned 5
	[0136.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.7z") returned 0
	[0136.272] lstrlenA (lpString="*.7z") returned 4
	[0136.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.tar") returned 0
	[0136.272] lstrlenA (lpString="*.tar") returned 5
	[0136.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.gzip") returned 0
	[0136.272] lstrlenA (lpString="*.gzip") returned 6
	[0136.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.jpg") returned 0
	[0136.272] lstrlenA (lpString="*.jpg") returned 5
	[0136.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.jpeg") returned 0
	[0136.273] lstrlenA (lpString="*.jpeg") returned 6
	[0136.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.bmp") returned 0
	[0136.273] lstrlenA (lpString="*.bmp") returned 5
	[0136.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.gif") returned 0
	[0136.273] lstrlenA (lpString="*.gif") returned 5
	[0136.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.png") returned 0
	[0136.273] lstrlenA (lpString="*.png") returned 5
	[0136.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.doc") returned 0
	[0136.273] lstrlenA (lpString="*.doc") returned 5
	[0136.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.docx") returned 0
	[0136.273] lstrlenA (lpString="*.docx") returned 6
	[0136.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.xls") returned 0
	[0136.273] lstrlenA (lpString="*.xls") returned 5
	[0136.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.xlsx") returned 0
	[0136.273] lstrlenA (lpString="*.xlsx") returned 6
	[0136.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.ppt") returned 0
	[0136.273] lstrlenA (lpString="*.ppt") returned 5
	[0136.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.pptx") returned 0
	[0136.273] lstrlenA (lpString="*.pptx") returned 6
	[0136.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.txt") returned 0
	[0136.273] lstrlenA (lpString="*.txt") returned 5
	[0136.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.pdf") returned 0
	[0136.273] lstrlenA (lpString="*.pdf") returned 5
	[0136.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.htm") returned 0
	[0136.273] lstrlenA (lpString="*.htm") returned 5
	[0136.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.html") returned 0
	[0136.274] lstrlenA (lpString="*.html") returned 6
	[0136.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.mdb") returned 0
	[0136.274] lstrlenA (lpString="*.mdb") returned 5
	[0136.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.pfx") returned 0
	[0136.274] lstrlenA (lpString="*.pfx") returned 5
	[0136.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.md") returned 0
	[0136.274] lstrlenA (lpString="*.md") returned 4
	[0136.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.lnk") returned 0
	[0136.274] lstrlenA (lpString="*.lnk") returned 5
	[0136.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.torrent") returned 0
	[0136.274] lstrlenA (lpString="*.torrent") returned 9
	[0136.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.mov") returned 0
	[0136.274] lstrlenA (lpString="*.mov") returned 5
	[0136.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.3gp") returned 0
	[0136.274] lstrlenA (lpString="*.3gp") returned 5
	[0136.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.mpeg") returned 0
	[0136.274] lstrlenA (lpString="*.mpeg") returned 6
	[0136.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.mpg") returned 0
	[0136.274] lstrlenA (lpString="*.mpg") returned 5
	[0136.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.flv") returned 0
	[0136.274] lstrlenA (lpString="*.flv") returned 5
	[0136.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.avi") returned 0
	[0136.274] lstrlenA (lpString="*.avi") returned 5
	[0136.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.mp4") returned 0
	[0136.274] lstrlenA (lpString="*.mp4") returned 5
	[0136.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.wmv") returned 0
	[0136.274] lstrlenA (lpString="*.wmv") returned 5
	[0136.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.mkv") returned 0
	[0136.274] lstrlenA (lpString="*.mkv") returned 5
	[0136.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.mp3") returned 0
	[0136.274] lstrlenA (lpString="*.mp3") returned 5
	[0136.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.wav") returned 0
	[0136.274] lstrlenA (lpString="*.wav") returned 5
	[0136.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.flac") returned 0
	[0136.275] lstrlenA (lpString="*.flac") returned 6
	[0136.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.wma") returned 0
	[0136.275] lstrlenA (lpString="*.wma") returned 5
	[0136.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.au3") returned 0
	[0136.275] lstrlenA (lpString="*.au3") returned 5
	[0136.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.ahk") returned 0
	[0136.275] lstrlenA (lpString="*.ahk") returned 5
	[0136.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.c") returned 0
	[0136.275] lstrlenA (lpString="*.c") returned 3
	[0136.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.cc") returned 0
	[0136.275] lstrlenA (lpString="*.cc") returned 4
	[0136.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.cpp") returned 0
	[0136.275] lstrlenA (lpString="*.cpp") returned 5
	[0136.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.cxx") returned 0
	[0136.275] lstrlenA (lpString="*.cxx") returned 5
	[0136.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.c++") returned 0
	[0136.275] lstrlenA (lpString="*.c++") returned 5
	[0136.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.cs") returned 0
	[0136.275] lstrlenA (lpString="*.cs") returned 4
	[0136.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.vb") returned 0
	[0136.275] lstrlenA (lpString="*.vb") returned 4
	[0136.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.bas") returned 0
	[0136.275] lstrlenA (lpString="*.bas") returned 5
	[0136.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.csproj") returned 0
	[0136.275] lstrlenA (lpString="*.csproj") returned 8
	[0136.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.vbproj") returned 0
	[0136.275] lstrlenA (lpString="*.vbproj") returned 8
	[0136.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.vcxproj") returned 0
	[0136.275] lstrlenA (lpString="*.vcxproj") returned 9
	[0136.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.manifest") returned 0
	[0136.275] lstrlenA (lpString="*.manifest") returned 10
	[0136.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.php") returned 0
	[0136.275] lstrlenA (lpString="*.php") returned 5
	[0136.276] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.vbe") returned 0
	[0136.276] lstrlenA (lpString="*.vbe") returned 5
	[0136.276] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.vba") returned 0
	[0136.276] lstrlenA (lpString="*.vba") returned 5
	[0136.276] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.vbs") returned 0
	[0136.276] lstrlenA (lpString="*.vbs") returned 5
	[0136.276] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.bat") returned 0
	[0136.276] lstrlenA (lpString="*.bat") returned 5
	[0136.276] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.cmd") returned 0
	[0136.276] lstrlenA (lpString="*.cmd") returned 5
	[0136.276] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.js") returned 0
	[0136.276] lstrlenA (lpString="*.js") returned 4
	[0136.276] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.jscript") returned 0
	[0136.276] lstrlenA (lpString="*.jscript") returned 9
	[0136.276] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.hta") returned 0
	[0136.276] lstrlenA (lpString="*.hta") returned 5
	[0136.276] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.php7") returned 0
	[0136.276] lstrlenA (lpString="*.php7") returned 6
	[0136.276] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.db") returned 0
	[0136.276] lstrlenA (lpString="*.db") returned 4
	[0136.276] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.swf") returned 0
	[0136.276] lstrlenA (lpString="*.swf") returned 5
	[0136.276] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.eml") returned 0
	[0136.276] lstrlenA (lpString="*.eml") returned 5
	[0136.276] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.part") returned 0
	[0136.276] lstrlenA (lpString="*.part") returned 6
	[0136.276] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.nfo") returned 0
	[0136.276] lstrlenA (lpString="*.nfo") returned 5
	[0136.276] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.rsa") returned 0
	[0136.276] lstrlenA (lpString="*.rsa") returned 5
	[0136.276] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.key") returned 0
	[0136.276] lstrlenA (lpString="*.key") returned 5
	[0136.276] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.aes") returned 0
	[0136.276] lstrlenA (lpString="*.aes") returned 5
	[0136.277] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.blob") returned 0
	[0136.277] lstrlenA (lpString="*.blob") returned 6
	[0136.277] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.btc") returned 0
	[0136.277] lstrlenA (lpString="*.btc") returned 5
	[0136.277] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll", pszSpec="*.wallet") returned 0
	[0136.277] lstrlenA (lpString="*.wallet") returned 8
	[0136.277] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eef6cc6, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="__AssemblyInfo__.ini", cAlternateFileName="__ASSE~1.INI")) returned 1
	[0136.277] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.277] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="__AssemblyInfo__.ini") returned 1
	[0136.277] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="__AssemblyInfo__.ini") returned 1
	[0136.277] lstrcmpiA (lpString1="", lpString2="__AssemblyInfo__.ini") returned -1
	[0136.277] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\extensibility.dll") returned="extensibility.dll"
	[0136.277] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\"
	[0136.277] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\") returned=""
	[0136.277] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.277] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac\\extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\how-to-decrypt-files.htm")) returned 0x20
	[0136.277] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\", lpString2="__AssemblyInfo__.ini" | out: lpString1="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini") returned="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini"
	[0136.277] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.zip") returned 0
	[0136.277] lstrlenA (lpString="*.zip") returned 5
	[0136.277] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.rar") returned 0
	[0136.277] lstrlenA (lpString="*.rar") returned 5
	[0136.277] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.7z") returned 0
	[0136.277] lstrlenA (lpString="*.7z") returned 4
	[0136.277] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.tar") returned 0
	[0136.277] lstrlenA (lpString="*.tar") returned 5
	[0136.277] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.gzip") returned 0
	[0136.277] lstrlenA (lpString="*.gzip") returned 6
	[0136.277] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.jpg") returned 0
	[0136.277] lstrlenA (lpString="*.jpg") returned 5
	[0136.278] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.jpeg") returned 0
	[0136.278] lstrlenA (lpString="*.jpeg") returned 6
	[0136.278] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.bmp") returned 0
	[0136.278] lstrlenA (lpString="*.bmp") returned 5
	[0136.278] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.gif") returned 0
	[0136.278] lstrlenA (lpString="*.gif") returned 5
	[0136.278] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.png") returned 0
	[0136.278] lstrlenA (lpString="*.png") returned 5
	[0136.278] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.doc") returned 0
	[0136.278] lstrlenA (lpString="*.doc") returned 5
	[0136.278] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.docx") returned 0
	[0136.278] lstrlenA (lpString="*.docx") returned 6
	[0136.278] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.xls") returned 0
	[0136.278] lstrlenA (lpString="*.xls") returned 5
	[0136.278] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.xlsx") returned 0
	[0136.278] lstrlenA (lpString="*.xlsx") returned 6
	[0136.278] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.ppt") returned 0
	[0136.278] lstrlenA (lpString="*.ppt") returned 5
	[0136.278] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.pptx") returned 0
	[0136.278] lstrlenA (lpString="*.pptx") returned 6
	[0136.278] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.txt") returned 0
	[0136.278] lstrlenA (lpString="*.txt") returned 5
	[0136.278] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.pdf") returned 0
	[0136.278] lstrlenA (lpString="*.pdf") returned 5
	[0136.278] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.htm") returned 0
	[0136.278] lstrlenA (lpString="*.htm") returned 5
	[0136.278] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.html") returned 0
	[0136.278] lstrlenA (lpString="*.html") returned 6
	[0136.278] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.mdb") returned 0
	[0136.278] lstrlenA (lpString="*.mdb") returned 5
	[0136.278] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.pfx") returned 0
	[0136.278] lstrlenA (lpString="*.pfx") returned 5
	[0136.278] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.md") returned 0
	[0136.278] lstrlenA (lpString="*.md") returned 4
	[0136.279] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.lnk") returned 0
	[0136.279] lstrlenA (lpString="*.lnk") returned 5
	[0136.279] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.torrent") returned 0
	[0136.279] lstrlenA (lpString="*.torrent") returned 9
	[0136.279] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.mov") returned 0
	[0136.279] lstrlenA (lpString="*.mov") returned 5
	[0136.279] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.3gp") returned 0
	[0136.279] lstrlenA (lpString="*.3gp") returned 5
	[0136.279] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.mpeg") returned 0
	[0136.279] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.mpg") returned 0
	[0136.279] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.flv") returned 0
	[0136.279] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.avi") returned 0
	[0136.279] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.mp4") returned 0
	[0136.279] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.wmv") returned 0
	[0136.279] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.mkv") returned 0
	[0136.279] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.mp3") returned 0
	[0136.279] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.wav") returned 0
	[0136.279] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.flac") returned 0
	[0136.279] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.wma") returned 0
	[0136.279] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.au3") returned 0
	[0136.279] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.ahk") returned 0
	[0136.279] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.c") returned 0
	[0136.279] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.cc") returned 0
	[0136.279] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.cpp") returned 0
	[0136.279] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.cxx") returned 0
	[0136.279] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.c++") returned 0
	[0136.279] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.cs") returned 0
	[0136.280] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.vb") returned 0
	[0136.280] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.bas") returned 0
	[0136.280] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.csproj") returned 0
	[0136.280] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.vbproj") returned 0
	[0136.280] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.vcxproj") returned 0
	[0136.280] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.manifest") returned 0
	[0136.280] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.php") returned 0
	[0136.280] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.vbe") returned 0
	[0136.280] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.vba") returned 0
	[0136.280] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.vbs") returned 0
	[0136.280] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.bat") returned 0
	[0136.280] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.cmd") returned 0
	[0136.280] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.js") returned 0
	[0136.280] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.jscript") returned 0
	[0136.280] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.hta") returned 0
	[0136.280] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.php7") returned 0
	[0136.280] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.db") returned 0
	[0136.280] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.swf") returned 0
	[0136.280] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.eml") returned 0
	[0136.280] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.part") returned 0
	[0136.280] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.nfo") returned 0
	[0136.280] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.rsa") returned 0
	[0136.280] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.key") returned 0
	[0136.280] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.aes") returned 0
	[0136.281] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.blob") returned 0
	[0136.281] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.btc") returned 0
	[0136.281] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.wallet") returned 0
	[0136.281] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eef6cc6, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="__AssemblyInfo__.ini", cAlternateFileName="__ASSE~1.INI")) returned 0
	[0136.281] FindClose (in: hFindFile=0x7cb6d0 | out: hFindFile=0x7cb6d0) returned 1
	[0136.281] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a0bb87e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7.0.3300.0__b03f5f7f11d50a3a", cAlternateFileName="703300~1.0__")) returned 0
	[0136.281] FindClose (in: hFindFile=0x7cbc50 | out: hFindFile=0x7cbc50) returned 1
	[0136.281] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4eef6cc6, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.mshtml", cAlternateFileName="MICROS~1.MSH")) returned 1
	[0136.281] lstrcmpA (lpString1=".", lpString2="Microsoft.mshtml") returned -1
	[0136.281] lstrcmpA (lpString1="..", lpString2="Microsoft.mshtml") returned -1
	[0136.281] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC\\*.*") returned="*.*"
	[0136.281] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\", lpString2="Microsoft.mshtml" | out: lpString1="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml") returned="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml"
	[0136.281] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4eef6cc6, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb7d0
	[0136.282] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.282] FindNextFileA (in: hFindFile=0x7cb7d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4eef6cc6, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.282] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.282] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.282] FindNextFileA (in: hFindFile=0x7cb7d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a9600d2, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7.0.3300.0__b03f5f7f11d50a3a", cAlternateFileName="703300~1.0__")) returned 1
	[0136.282] lstrcmpA (lpString1=".", lpString2="7.0.3300.0__b03f5f7f11d50a3a") returned -1
	[0136.282] lstrcmpA (lpString1="..", lpString2="7.0.3300.0__b03f5f7f11d50a3a") returned -1
	[0136.282] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\*.*") returned="*.*"
	[0136.282] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\", lpString2="7.0.3300.0__b03f5f7f11d50a3a" | out: lpString1="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a") returned="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a"
	[0136.282] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a9600d2, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cbb90
	[0136.282] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.282] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a9600d2, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0136.282] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.282] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.282] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a9600d2, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a9600d2, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aa44eb9, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x7a5040, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.mshtml.dll", cAlternateFileName="MICROS~1.DLL")) returned 1
	[0136.283] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.283] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft.mshtml.dll") returned -1
	[0136.283] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft.mshtml.dll") returned -1
	[0136.283] lstrcmpiA (lpString1="", lpString2="Microsoft.mshtml.dll") returned -1
	[0136.283] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\*.*") returned="*.*"
	[0136.283] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\"
	[0136.283] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\") returned=""
	[0136.283] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.283] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac\\microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.283] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac\\microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0136.285] WriteFile (in: hFile=0x214, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0136.286] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.286] CloseHandle (hObject=0x214) returned 1
	[0136.286] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\", lpString2="Microsoft.mshtml.dll" | out: lpString1="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll") returned="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll"
	[0136.286] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.zip") returned 0
	[0136.286] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.rar") returned 0
	[0136.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.7z") returned 0
	[0136.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.tar") returned 0
	[0136.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.gzip") returned 0
	[0136.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.jpg") returned 0
	[0136.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.jpeg") returned 0
	[0136.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.bmp") returned 0
	[0136.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.gif") returned 0
	[0136.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.png") returned 0
	[0136.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.doc") returned 0
	[0136.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.docx") returned 0
	[0136.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.xls") returned 0
	[0136.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.xlsx") returned 0
	[0136.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.ppt") returned 0
	[0136.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.pptx") returned 0
	[0136.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.txt") returned 0
	[0136.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.pdf") returned 0
	[0136.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.htm") returned 0
	[0136.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.html") returned 0
	[0136.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.mdb") returned 0
	[0136.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.pfx") returned 0
	[0136.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.md") returned 0
	[0136.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.lnk") returned 0
	[0136.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.torrent") returned 0
	[0136.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.mov") returned 0
	[0136.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.3gp") returned 0
	[0136.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.mpeg") returned 0
	[0136.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.mpg") returned 0
	[0136.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.flv") returned 0
	[0136.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.avi") returned 0
	[0136.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.mp4") returned 0
	[0136.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.wmv") returned 0
	[0136.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.mkv") returned 0
	[0136.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.mp3") returned 0
	[0136.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.wav") returned 0
	[0136.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.flac") returned 0
	[0136.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.wma") returned 0
	[0136.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.au3") returned 0
	[0136.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.ahk") returned 0
	[0136.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.c") returned 0
	[0136.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.cc") returned 0
	[0136.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.cpp") returned 0
	[0136.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.cxx") returned 0
	[0136.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.c++") returned 0
	[0136.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.cs") returned 0
	[0136.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.vb") returned 0
	[0136.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.bas") returned 0
	[0136.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.csproj") returned 0
	[0136.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.vbproj") returned 0
	[0136.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.vcxproj") returned 0
	[0136.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.manifest") returned 0
	[0136.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.php") returned 0
	[0136.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.vbe") returned 0
	[0136.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.vba") returned 0
	[0136.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.vbs") returned 0
	[0136.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.bat") returned 0
	[0136.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.cmd") returned 0
	[0136.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.js") returned 0
	[0136.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.jscript") returned 0
	[0136.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.hta") returned 0
	[0136.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.php7") returned 0
	[0136.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.db") returned 0
	[0136.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.swf") returned 0
	[0136.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.eml") returned 0
	[0136.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.part") returned 0
	[0136.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.nfo") returned 0
	[0136.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.rsa") returned 0
	[0136.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.key") returned 0
	[0136.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.aes") returned 0
	[0136.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.blob") returned 0
	[0136.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.btc") returned 0
	[0136.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll", pszSpec="*.wallet") returned 0
	[0136.290] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eef6cc6, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="__AssemblyInfo__.ini", cAlternateFileName="__ASSE~1.INI")) returned 1
	[0136.290] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.290] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="__AssemblyInfo__.ini") returned 1
	[0136.290] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="__AssemblyInfo__.ini") returned 1
	[0136.290] lstrcmpiA (lpString1="", lpString2="__AssemblyInfo__.ini") returned -1
	[0136.290] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.mshtml.dll") returned="Microsoft.mshtml.dll"
	[0136.290] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\"
	[0136.290] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\") returned=""
	[0136.290] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.290] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac\\microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\how-to-decrypt-files.htm")) returned 0x20
	[0136.290] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\", lpString2="__AssemblyInfo__.ini" | out: lpString1="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini") returned="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini"
	[0136.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.zip") returned 0
	[0136.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.rar") returned 0
	[0136.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.7z") returned 0
	[0136.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.tar") returned 0
	[0136.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.gzip") returned 0
	[0136.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.jpg") returned 0
	[0136.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.jpeg") returned 0
	[0136.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.bmp") returned 0
	[0136.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.gif") returned 0
	[0136.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.png") returned 0
	[0136.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.doc") returned 0
	[0136.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.docx") returned 0
	[0136.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.xls") returned 0
	[0136.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.xlsx") returned 0
	[0136.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.ppt") returned 0
	[0136.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.pptx") returned 0
	[0136.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.txt") returned 0
	[0136.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.pdf") returned 0
	[0136.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.htm") returned 0
	[0136.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.html") returned 0
	[0136.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.mdb") returned 0
	[0136.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.pfx") returned 0
	[0136.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.md") returned 0
	[0136.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.lnk") returned 0
	[0136.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.torrent") returned 0
	[0136.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.mov") returned 0
	[0136.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.3gp") returned 0
	[0136.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.mpeg") returned 0
	[0136.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.mpg") returned 0
	[0136.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini", pszSpec="*.flv") returned 0
	[0136.292] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eef6cc6, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="__AssemblyInfo__.ini", cAlternateFileName="__ASSE~1.INI")) returned 0
	[0136.292] FindClose (in: hFindFile=0x7cbb90 | out: hFindFile=0x7cbb90) returned 1
	[0136.292] FindNextFileA (in: hFindFile=0x7cb7d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a9600d2, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7.0.3300.0__b03f5f7f11d50a3a", cAlternateFileName="703300~1.0__")) returned 0
	[0136.292] FindClose (in: hFindFile=0x7cb7d0 | out: hFindFile=0x7cb7d0) returned 1
	[0136.292] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4eed0a61, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eed0a61, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eed0a61, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.StdFormat", cAlternateFileName="MICROS~1.STD")) returned 1
	[0136.292] lstrcmpA (lpString1=".", lpString2="Microsoft.StdFormat") returned -1
	[0136.292] lstrcmpA (lpString1="..", lpString2="Microsoft.StdFormat") returned -1
	[0136.292] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC\\*.*") returned="*.*"
	[0136.292] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\", lpString2="Microsoft.StdFormat" | out: lpString1="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat") returned="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat"
	[0136.292] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4eed0a61, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eed0a61, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eed0a61, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb7d0
	[0136.292] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.292] FindNextFileA (in: hFindFile=0x7cb7d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4eed0a61, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eed0a61, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eed0a61, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.292] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.292] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.292] FindNextFileA (in: hFindFile=0x7cb7d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4aa913e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eed0a61, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eed0a61, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7.0.3300.0__b03f5f7f11d50a3a", cAlternateFileName="703300~1.0__")) returned 1
	[0136.292] lstrcmpA (lpString1=".", lpString2="7.0.3300.0__b03f5f7f11d50a3a") returned -1
	[0136.292] lstrcmpA (lpString1="..", lpString2="7.0.3300.0__b03f5f7f11d50a3a") returned -1
	[0136.292] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\*.*") returned="*.*"
	[0136.292] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\", lpString2="7.0.3300.0__b03f5f7f11d50a3a" | out: lpString1="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a") returned="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a"
	[0136.292] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4aa913e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eed0a61, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eed0a61, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cbad0
	[0136.293] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.293] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4aa913e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eed0a61, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eed0a61, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0136.293] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.293] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.293] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aa913e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4aa913e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aa913e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x5440, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.stdformat.dll", cAlternateFileName="MICROS~1.DLL")) returned 1
	[0136.293] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.293] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft.stdformat.dll") returned -1
	[0136.293] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft.stdformat.dll") returned -1
	[0136.293] lstrcmpiA (lpString1="", lpString2="Microsoft.stdformat.dll") returned -1
	[0136.293] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a\\*.*") returned="*.*"
	[0136.293] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a\\"
	[0136.293] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a\\") returned=""
	[0136.293] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.293] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac\\microsoft.stdformat\\7.0.3300.0__b03f5f7f11d50a3a\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.294] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac\\microsoft.stdformat\\7.0.3300.0__b03f5f7f11d50a3a\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0136.296] WriteFile (in: hFile=0x214, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0136.297] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.297] CloseHandle (hObject=0x214) returned 1
	[0136.297] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a\\", lpString2="Microsoft.stdformat.dll" | out: lpString1="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.stdformat.dll") returned="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.stdformat.dll"
	[0136.297] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eed0a61, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eed0a61, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eed0a61, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="__AssemblyInfo__.ini", cAlternateFileName="__ASSE~1.INI")) returned 1
	[0136.297] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.297] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="__AssemblyInfo__.ini") returned 1
	[0136.297] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="__AssemblyInfo__.ini") returned 1
	[0136.297] lstrcmpiA (lpString1="", lpString2="__AssemblyInfo__.ini") returned -1
	[0136.297] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a\\Microsoft.stdformat.dll") returned="Microsoft.stdformat.dll"
	[0136.297] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a\\"
	[0136.297] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a\\") returned=""
	[0136.297] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.297] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac\\microsoft.stdformat\\7.0.3300.0__b03f5f7f11d50a3a\\how-to-decrypt-files.htm")) returned 0x20
	[0136.297] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a\\", lpString2="__AssemblyInfo__.ini" | out: lpString1="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini") returned="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini"
	[0136.297] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eed0a61, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eed0a61, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eed0a61, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="__AssemblyInfo__.ini", cAlternateFileName="__ASSE~1.INI")) returned 0
	[0136.297] FindClose (in: hFindFile=0x7cbad0 | out: hFindFile=0x7cbad0) returned 1
	[0136.297] FindNextFileA (in: hFindFile=0x7cb7d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4aa913e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eed0a61, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eed0a61, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7.0.3300.0__b03f5f7f11d50a3a", cAlternateFileName="703300~1.0__")) returned 0
	[0136.297] FindClose (in: hFindFile=0x7cb7d0 | out: hFindFile=0x7cb7d0) returned 1
	[0136.298] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ef1cf0b, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ef1cf0b, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ef1cf0b, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="mscomctl", cAlternateFileName="")) returned 1
	[0136.298] lstrcmpA (lpString1=".", lpString2="mscomctl") returned -1
	[0136.298] lstrcmpA (lpString1="..", lpString2="mscomctl") returned -1
	[0136.298] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC\\*.*") returned="*.*"
	[0136.298] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\", lpString2="mscomctl" | out: lpString1="C:\\Windows\\assembly\\GAC\\mscomctl") returned="C:\\Windows\\assembly\\GAC\\mscomctl"
	[0136.298] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC\\mscomctl\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ef1cf0b, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ef1cf0b, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ef1cf0b, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb950
	[0136.298] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.298] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ef1cf0b, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ef1cf0b, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ef1cf0b, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.298] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.298] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.298] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4aadd873, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ef1cf0b, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ef1cf0b, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0.4504.0__31bf3856ad364e35", cAlternateFileName="100450~1.0__")) returned 1
	[0136.298] lstrcmpA (lpString1=".", lpString2="10.0.4504.0__31bf3856ad364e35") returned -1
	[0136.298] lstrcmpA (lpString1="..", lpString2="10.0.4504.0__31bf3856ad364e35") returned -1
	[0136.298] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC\\mscomctl\\*.*") returned="*.*"
	[0136.298] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\mscomctl\\", lpString2="10.0.4504.0__31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35"
	[0136.298] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4aadd873, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ef1cf0b, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ef1cf0b, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cb910
	[0136.299] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.299] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4aadd873, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ef1cf0b, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ef1cf0b, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0136.299] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.299] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.299] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aadd873, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x38000, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="MSCOMCTL.DLL", cAlternateFileName="")) returned 1
	[0136.299] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.299] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="MSCOMCTL.DLL") returned -1
	[0136.299] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="MSCOMCTL.DLL") returned -1
	[0136.299] lstrcmpiA (lpString1="", lpString2="MSCOMCTL.DLL") returned -1
	[0136.299] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35\\*.*") returned="*.*"
	[0136.299] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35\\"
	[0136.299] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35\\") returned=""
	[0136.299] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.299] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac\\mscomctl\\10.0.4504.0__31bf3856ad364e35\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.299] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac\\mscomctl\\10.0.4504.0__31bf3856ad364e35\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0136.301] WriteFile (in: hFile=0x214, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0136.302] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.302] CloseHandle (hObject=0x214) returned 1
	[0136.303] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35\\", lpString2="MSCOMCTL.DLL" | out: lpString1="C:\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35\\MSCOMCTL.DLL") returned="C:\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35\\MSCOMCTL.DLL"
	[0136.303] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ef1cf0b, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ef1cf0b, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ef1cf0b, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="__AssemblyInfo__.ini", cAlternateFileName="__ASSE~1.INI")) returned 1
	[0136.303] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.303] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="__AssemblyInfo__.ini") returned 1
	[0136.303] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="__AssemblyInfo__.ini") returned 1
	[0136.303] lstrcmpiA (lpString1="", lpString2="__AssemblyInfo__.ini") returned -1
	[0136.303] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35\\MSCOMCTL.DLL") returned="MSCOMCTL.DLL"
	[0136.303] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35\\"
	[0136.303] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35\\") returned=""
	[0136.303] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.303] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac\\mscomctl\\10.0.4504.0__31bf3856ad364e35\\how-to-decrypt-files.htm")) returned 0x20
	[0136.303] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35\\", lpString2="__AssemblyInfo__.ini" | out: lpString1="C:\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35\\__AssemblyInfo__.ini") returned="C:\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35\\__AssemblyInfo__.ini"
	[0136.303] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ef1cf0b, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ef1cf0b, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ef1cf0b, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="__AssemblyInfo__.ini", cAlternateFileName="__ASSE~1.INI")) returned 0
	[0136.303] FindClose (in: hFindFile=0x7cb910 | out: hFindFile=0x7cb910) returned 1
	[0136.303] FindNextFileA (in: hFindFile=0x7cb950, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4aadd873, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ef1cf0b, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ef1cf0b, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0.4504.0__31bf3856ad364e35", cAlternateFileName="100450~1.0__")) returned 0
	[0136.303] FindClose (in: hFindFile=0x7cb950 | out: hFindFile=0x7cb950) returned 1
	[0136.303] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4eef6cc6, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="MSDATASRC", cAlternateFileName="MSDATA~1")) returned 1
	[0136.303] lstrcmpA (lpString1=".", lpString2="MSDATASRC") returned -1
	[0136.304] lstrcmpA (lpString1="..", lpString2="MSDATASRC") returned -1
	[0136.304] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC\\*.*") returned="*.*"
	[0136.304] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\", lpString2="MSDATASRC" | out: lpString1="C:\\Windows\\assembly\\GAC\\MSDATASRC") returned="C:\\Windows\\assembly\\GAC\\MSDATASRC"
	[0136.304] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC\\MSDATASRC\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4eef6cc6, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb990
	[0136.304] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.304] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4eef6cc6, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.304] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.304] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.304] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4aadd873, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7.0.3300.0__b03f5f7f11d50a3a", cAlternateFileName="703300~1.0__")) returned 1
	[0136.304] lstrcmpA (lpString1=".", lpString2="7.0.3300.0__b03f5f7f11d50a3a") returned -1
	[0136.304] lstrcmpA (lpString1="..", lpString2="7.0.3300.0__b03f5f7f11d50a3a") returned -1
	[0136.304] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC\\MSDATASRC\\*.*") returned="*.*"
	[0136.304] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\MSDATASRC\\", lpString2="7.0.3300.0__b03f5f7f11d50a3a" | out: lpString1="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a") returned="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a"
	[0136.304] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4aadd873, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cbc50
	[0136.304] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.304] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4aadd873, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0136.307] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.307] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.307] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aadd873, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x3040, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="msdatasrc.dll", cAlternateFileName="MSDATA~1.DLL")) returned 1
	[0136.307] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.320] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="msdatasrc.dll") returned -1
	[0136.320] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="msdatasrc.dll") returned -1
	[0136.320] lstrcmpiA (lpString1="", lpString2="msdatasrc.dll") returned -1
	[0136.320] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a\\*.*") returned="*.*"
	[0136.320] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a\\"
	[0136.320] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a\\") returned=""
	[0136.320] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.320] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac\\msdatasrc\\7.0.3300.0__b03f5f7f11d50a3a\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.321] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac\\msdatasrc\\7.0.3300.0__b03f5f7f11d50a3a\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0136.323] WriteFile (in: hFile=0x214, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0136.323] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.323] CloseHandle (hObject=0x214) returned 1
	[0136.324] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a\\", lpString2="msdatasrc.dll" | out: lpString1="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a\\msdatasrc.dll") returned="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a\\msdatasrc.dll"
	[0136.324] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eef6cc6, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="__AssemblyInfo__.ini", cAlternateFileName="__ASSE~1.INI")) returned 1
	[0136.324] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.324] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="__AssemblyInfo__.ini") returned 1
	[0136.324] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="__AssemblyInfo__.ini") returned 1
	[0136.324] lstrcmpiA (lpString1="", lpString2="__AssemblyInfo__.ini") returned -1
	[0136.324] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a\\msdatasrc.dll") returned="msdatasrc.dll"
	[0136.324] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a\\"
	[0136.324] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a\\") returned=""
	[0136.324] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.324] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac\\msdatasrc\\7.0.3300.0__b03f5f7f11d50a3a\\how-to-decrypt-files.htm")) returned 0x20
	[0136.324] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a\\", lpString2="__AssemblyInfo__.ini" | out: lpString1="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini") returned="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini"
	[0136.324] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eef6cc6, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="__AssemblyInfo__.ini", cAlternateFileName="__ASSE~1.INI")) returned 0
	[0136.324] FindClose (in: hFindFile=0x7cbc50 | out: hFindFile=0x7cbc50) returned 1
	[0136.324] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4aadd873, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7.0.3300.0__b03f5f7f11d50a3a", cAlternateFileName="703300~1.0__")) returned 0
	[0136.324] FindClose (in: hFindFile=0x7cb990 | out: hFindFile=0x7cb990) returned 1
	[0136.324] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4eef6cc6, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="stdole", cAlternateFileName="")) returned 1
	[0136.324] lstrcmpA (lpString1=".", lpString2="stdole") returned -1
	[0136.324] lstrcmpA (lpString1="..", lpString2="stdole") returned -1
	[0136.324] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC\\*.*") returned="*.*"
	[0136.324] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\", lpString2="stdole" | out: lpString1="C:\\Windows\\assembly\\GAC\\stdole") returned="C:\\Windows\\assembly\\GAC\\stdole"
	[0136.325] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC\\stdole\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4eef6cc6, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbc50
	[0136.325] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.325] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4eef6cc6, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.325] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.325] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.325] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ae24be2, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7.0.3300.0__b03f5f7f11d50a3a", cAlternateFileName="703300~1.0__")) returned 1
	[0136.325] lstrcmpA (lpString1=".", lpString2="7.0.3300.0__b03f5f7f11d50a3a") returned -1
	[0136.325] lstrcmpA (lpString1="..", lpString2="7.0.3300.0__b03f5f7f11d50a3a") returned -1
	[0136.325] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC\\stdole\\*.*") returned="*.*"
	[0136.325] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\stdole\\", lpString2="7.0.3300.0__b03f5f7f11d50a3a" | out: lpString1="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a") returned="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a"
	[0136.325] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ae24be2, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb5d0
	[0136.325] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.325] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ae24be2, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.325] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.325] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.325] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ae24be2, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae24be2, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae24be2, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x5aa8, dwReserved0=0x2, dwReserved1=0x0, cFileName="stdole.dll", cAlternateFileName="")) returned 1
	[0136.325] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.325] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="stdole.dll") returned -1
	[0136.325] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="stdole.dll") returned -1
	[0136.325] lstrcmpiA (lpString1="", lpString2="stdole.dll") returned -1
	[0136.325] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\*.*") returned="*.*"
	[0136.325] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\"
	[0136.325] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\") returned=""
	[0136.326] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.326] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.326] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0136.328] WriteFile (in: hFile=0x214, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0136.329] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.329] CloseHandle (hObject=0x214) returned 1
	[0136.332] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\", lpString2="stdole.dll" | out: lpString1="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\stdole.dll") returned="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\stdole.dll"
	[0136.332] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eef6cc6, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0xc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="__AssemblyInfo__.ini", cAlternateFileName="__ASSE~1.INI")) returned 1
	[0136.332] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.332] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="__AssemblyInfo__.ini") returned 1
	[0136.332] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="__AssemblyInfo__.ini") returned 1
	[0136.332] lstrcmpiA (lpString1="", lpString2="__AssemblyInfo__.ini") returned -1
	[0136.332] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\stdole.dll") returned="stdole.dll"
	[0136.332] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\"
	[0136.332] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\") returned=""
	[0136.333] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.333] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\how-to-decrypt-files.htm")) returned 0x20
	[0136.333] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\", lpString2="__AssemblyInfo__.ini" | out: lpString1="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini") returned="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\__AssemblyInfo__.ini"
	[0136.333] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eef6cc6, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0xc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="__AssemblyInfo__.ini", cAlternateFileName="__ASSE~1.INI")) returned 0
	[0136.333] FindClose (in: hFindFile=0x7cb5d0 | out: hFindFile=0x7cb5d0) returned 1
	[0136.333] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ae24be2, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7.0.3300.0__b03f5f7f11d50a3a", cAlternateFileName="703300~1.0__")) returned 0
	[0136.333] FindClose (in: hFindFile=0x7cbc50 | out: hFindFile=0x7cbc50) returned 1
	[0136.333] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4eef6cc6, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4eef6cc6, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4eef6cc6, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="stdole", cAlternateFileName="")) returned 0
	[0136.333] FindClose (in: hFindFile=0x7cb810 | out: hFindFile=0x7cb810) returned 1
	[0136.333] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x736ee56c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736ee56c, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GAC_32", cAlternateFileName="")) returned 1
	[0136.333] lstrcmpA (lpString1=".", lpString2="GAC_32") returned -1
	[0136.333] lstrcmpA (lpString1="..", lpString2="GAC_32") returned -1
	[0136.333] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\*.*") returned="*.*"
	[0136.333] lstrcatA (in: lpString1="C:\\Windows\\assembly\\", lpString2="GAC_32" | out: lpString1="C:\\Windows\\assembly\\GAC_32") returned="C:\\Windows\\assembly\\GAC_32"
	[0136.333] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x736ee56c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736ee56c, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cb5d0
	[0136.333] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.333] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x736ee56c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736ee56c, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0136.333] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.333] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.334] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x735e34d0, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x735e34d0, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x735e34d0, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="CustomMarshalers", cAlternateFileName="CUSTOM~1")) returned 1
	[0136.334] lstrcmpA (lpString1=".", lpString2="CustomMarshalers") returned -1
	[0136.334] lstrcmpA (lpString1="..", lpString2="CustomMarshalers") returned -1
	[0136.334] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\*.*") returned="*.*"
	[0136.334] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\", lpString2="CustomMarshalers" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers") returned="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers"
	[0136.334] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x735e34d0, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x735e34d0, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x735e34d0, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cb990
	[0136.337] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.337] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x735e34d0, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x735e34d0, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x735e34d0, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0136.337] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.337] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.337] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x735e34d0, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x735e34d0, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x735e34d0, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="2.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="200~1.0__")) returned 1
	[0136.337] lstrcmpA (lpString1=".", lpString2="2.0.0.0__b03f5f7f11d50a3a") returned -1
	[0136.337] lstrcmpA (lpString1="..", lpString2="2.0.0.0__b03f5f7f11d50a3a") returned -1
	[0136.337] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers\\*.*") returned="*.*"
	[0136.337] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers\\", lpString2="2.0.0.0__b03f5f7f11d50a3a" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a") returned="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a"
	[0136.337] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x735e34d0, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x735e34d0, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x735e34d0, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cb6d0
	[0136.337] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.338] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x735e34d0, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x735e34d0, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x735e34d0, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0136.338] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.338] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.338] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54be8474, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x54be8474, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xc9702f00, ftLastWriteTime.dwHighDateTime=0x1d29451, nFileSizeHigh=0x0, nFileSizeLow=0x10e00, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="CustomMarshalers.dll", cAlternateFileName="")) returned 1
	[0136.338] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.338] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="CustomMarshalers.dll") returned 1
	[0136.338] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="CustomMarshalers.dll") returned 1
	[0136.338] lstrcmpiA (lpString1="", lpString2="CustomMarshalers.dll") returned -1
	[0136.338] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*"
	[0136.338] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a\\"
	[0136.338] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.338] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.338] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\custommarshalers\\2.0.0.0__b03f5f7f11d50a3a\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.338] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\custommarshalers\\2.0.0.0__b03f5f7f11d50a3a\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0136.339] WriteFile (in: hFile=0x214, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0136.340] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.340] CloseHandle (hObject=0x214) returned 1
	[0136.340] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a\\", lpString2="CustomMarshalers.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll") returned="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll"
	[0136.340] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54be8474, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x54be8474, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xc9702f00, ftLastWriteTime.dwHighDateTime=0x1d29451, nFileSizeHigh=0x0, nFileSizeLow=0x10e00, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="CustomMarshalers.dll", cAlternateFileName="")) returned 0
	[0136.340] FindClose (in: hFindFile=0x7cb6d0 | out: hFindFile=0x7cb6d0) returned 1
	[0136.340] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x735e34d0, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x735e34d0, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x735e34d0, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="2.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="200~1.0__")) returned 0
	[0136.340] FindClose (in: hFindFile=0x7cb990 | out: hFindFile=0x7cb990) returned 1
	[0136.340] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7362f993, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x7362f993, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7362f993, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="ISymWrapper", cAlternateFileName="ISYMWR~1")) returned 1
	[0136.340] lstrcmpA (lpString1=".", lpString2="ISymWrapper") returned -1
	[0136.340] lstrcmpA (lpString1="..", lpString2="ISymWrapper") returned -1
	[0136.340] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\*.*") returned="*.*"
	[0136.340] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\", lpString2="ISymWrapper" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\ISymWrapper") returned="C:\\Windows\\assembly\\GAC_32\\ISymWrapper"
	[0136.340] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\ISymWrapper\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7362f993, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x7362f993, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7362f993, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb990
	[0136.341] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.341] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7362f993, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x7362f993, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7362f993, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.342] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.342] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.342] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7362f993, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x7362f993, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7362f993, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="200~1.0__")) returned 1
	[0136.342] lstrcmpA (lpString1=".", lpString2="2.0.0.0__b03f5f7f11d50a3a") returned -1
	[0136.342] lstrcmpA (lpString1="..", lpString2="2.0.0.0__b03f5f7f11d50a3a") returned -1
	[0136.342] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\ISymWrapper\\*.*") returned="*.*"
	[0136.342] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\ISymWrapper\\", lpString2="2.0.0.0__b03f5f7f11d50a3a" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\ISymWrapper\\2.0.0.0__b03f5f7f11d50a3a") returned="C:\\Windows\\assembly\\GAC_32\\ISymWrapper\\2.0.0.0__b03f5f7f11d50a3a"
	[0136.342] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\ISymWrapper\\2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7362f993, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x7362f993, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7362f993, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cb810
	[0136.342] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.342] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7362f993, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x7362f993, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7362f993, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0136.342] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.342] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.342] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54be8474, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x54be8474, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xc9702f00, ftLastWriteTime.dwHighDateTime=0x1d29451, nFileSizeHigh=0x0, nFileSizeLow=0x11a00, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="ISymWrapper.dll", cAlternateFileName="")) returned 1
	[0136.342] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.342] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="ISymWrapper.dll") returned -1
	[0136.342] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="ISymWrapper.dll") returned -1
	[0136.342] lstrcmpiA (lpString1="", lpString2="ISymWrapper.dll") returned -1
	[0136.342] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\ISymWrapper\\2.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*"
	[0136.342] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_32\\ISymWrapper\\2.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\ISymWrapper\\2.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_32\\ISymWrapper\\2.0.0.0__b03f5f7f11d50a3a\\"
	[0136.342] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_32\\ISymWrapper\\2.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_32\\ISymWrapper\\2.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.342] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\ISymWrapper\\2.0.0.0__b03f5f7f11d50a3a\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\ISymWrapper\\2.0.0.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC_32\\ISymWrapper\\2.0.0.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.342] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_32\\ISymWrapper\\2.0.0.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\isymwrapper\\2.0.0.0__b03f5f7f11d50a3a\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.342] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_32\\ISymWrapper\\2.0.0.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\isymwrapper\\2.0.0.0__b03f5f7f11d50a3a\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0136.343] WriteFile (in: hFile=0x214, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0136.344] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.344] CloseHandle (hObject=0x214) returned 1
	[0136.344] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\ISymWrapper\\2.0.0.0__b03f5f7f11d50a3a\\", lpString2="ISymWrapper.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\ISymWrapper\\2.0.0.0__b03f5f7f11d50a3a\\ISymWrapper.dll") returned="C:\\Windows\\assembly\\GAC_32\\ISymWrapper\\2.0.0.0__b03f5f7f11d50a3a\\ISymWrapper.dll"
	[0136.344] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54be8474, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x54be8474, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xc9702f00, ftLastWriteTime.dwHighDateTime=0x1d29451, nFileSizeHigh=0x0, nFileSizeLow=0x11a00, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="ISymWrapper.dll", cAlternateFileName="")) returned 0
	[0136.344] FindClose (in: hFindFile=0x7cb810 | out: hFindFile=0x7cb810) returned 1
	[0136.344] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7362f993, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x7362f993, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7362f993, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="200~1.0__")) returned 0
	[0136.344] FindClose (in: hFindFile=0x7cb990 | out: hFindFile=0x7cb990) returned 1
	[0136.344] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21eb84de, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd4ff75af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21eb84de, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.Ink", cAlternateFileName="MICROS~1.INK")) returned 1
	[0136.344] lstrcmpA (lpString1=".", lpString2="Microsoft.Ink") returned -1
	[0136.344] lstrcmpA (lpString1="..", lpString2="Microsoft.Ink") returned -1
	[0136.345] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\*.*") returned="*.*"
	[0136.345] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\", lpString2="Microsoft.Ink" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink") returned="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink"
	[0136.345] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21eb84de, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd4ff75af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21eb84de, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb810
	[0136.345] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.345] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21eb84de, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd4ff75af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21eb84de, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.345] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.345] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.345] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21eb84de, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd4ff7e50, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x76b7cd4d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6.1.0.0__31bf3856ad364e35", cAlternateFileName="610~1.0__")) returned 1
	[0136.345] lstrcmpA (lpString1=".", lpString2="6.1.0.0__31bf3856ad364e35") returned -1
	[0136.345] lstrcmpA (lpString1="..", lpString2="6.1.0.0__31bf3856ad364e35") returned -1
	[0136.345] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink\\*.*") returned="*.*"
	[0136.345] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink\\", lpString2="6.1.0.0__31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink\\6.1.0.0__31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink\\6.1.0.0__31bf3856ad364e35"
	[0136.345] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21eb84de, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd4ff7e50, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x76b7cd4d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cb650
	[0136.345] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.345] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21eb84de, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd4ff7e50, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x76b7cd4d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0136.345] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.345] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.345] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41982330, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x2a329cb7, ftLastAccessTime.dwHighDateTime=0x1d2fa0d, ftLastWriteTime.dwLowDateTime=0x41982330, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x7b000, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1
	[0136.345] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.345] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft.Ink.dll") returned -1
	[0136.345] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft.Ink.dll") returned -1
	[0136.345] lstrcmpiA (lpString1="", lpString2="Microsoft.Ink.dll") returned -1
	[0136.346] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\*.*") returned="*.*"
	[0136.346] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\"
	[0136.346] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\") returned=""
	[0136.346] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.346] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\microsoft.ink\\6.1.0.0__31bf3856ad364e35\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.346] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\microsoft.ink\\6.1.0.0__31bf3856ad364e35\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0136.347] WriteFile (in: hFile=0x214, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0136.348] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.348] CloseHandle (hObject=0x214) returned 1
	[0136.348] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\", lpString2="Microsoft.Ink.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\Microsoft.Ink.dll") returned="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\Microsoft.Ink.dll"
	[0136.348] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41982330, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x2a329cb7, ftLastAccessTime.dwHighDateTime=0x1d2fa0d, ftLastWriteTime.dwLowDateTime=0x41982330, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x7b000, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 0
	[0136.348] FindClose (in: hFindFile=0x7cb650 | out: hFindFile=0x7cb650) returned 1
	[0136.348] FindNextFileA (in: hFindFile=0x7cb810, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21eb84de, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd4ff7e50, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x76b7cd4d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6.1.0.0__31bf3856ad364e35", cAlternateFileName="610~1.0__")) returned 0
	[0136.348] FindClose (in: hFindFile=0x7cb810 | out: hFindFile=0x7cb810) returned 1
	[0136.348] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21d60f47, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd4ff887c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21d60f47, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.Interop.Security.AzRoles", cAlternateFileName="MICROS~1.AZR")) returned 1
	[0136.348] lstrcmpA (lpString1=".", lpString2="Microsoft.Interop.Security.AzRoles") returned -1
	[0136.348] lstrcmpA (lpString1="..", lpString2="Microsoft.Interop.Security.AzRoles") returned -1
	[0136.348] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\*.*") returned="*.*"
	[0136.348] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\", lpString2="Microsoft.Interop.Security.AzRoles" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles") returned="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles"
	[0136.348] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21d60f47, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd4ff887c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21d60f47, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb650
	[0136.349] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.349] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21d60f47, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd4ff887c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21d60f47, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.349] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.349] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.349] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21d60f47, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd4ff9624, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21d60f47, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.0.0__31bf3856ad364e35", cAlternateFileName="200~1.0__")) returned 1
	[0136.349] lstrcmpA (lpString1=".", lpString2="2.0.0.0__31bf3856ad364e35") returned -1
	[0136.349] lstrcmpA (lpString1="..", lpString2="2.0.0.0__31bf3856ad364e35") returned -1
	[0136.349] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles\\*.*") returned="*.*"
	[0136.349] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles\\", lpString2="2.0.0.0__31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles\\2.0.0.0__31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles\\2.0.0.0__31bf3856ad364e35"
	[0136.349] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles\\2.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21d60f47, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd4ff9624, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21d60f47, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x12, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbc50
	[0136.349] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.349] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21d60f47, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd4ff9624, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21d60f47, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x12, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.349] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.349] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.349] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cf7d30b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6cf7d30b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6cf7d30b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13000, dwReserved0=0x12, dwReserved1=0x0, cFileName="Microsoft.Interop.Security.AzRoles.dll", cAlternateFileName="")) returned 1
	[0136.349] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.349] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft.Interop.Security.AzRoles.dll") returned -1
	[0136.349] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft.Interop.Security.AzRoles.dll") returned -1
	[0136.349] lstrcmpiA (lpString1="", lpString2="Microsoft.Interop.Security.AzRoles.dll") returned -1
	[0136.349] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles\\2.0.0.0__31bf3856ad364e35\\*.*") returned="*.*"
	[0136.349] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles\\2.0.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles\\2.0.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles\\2.0.0.0__31bf3856ad364e35\\"
	[0136.349] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles\\2.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles\\2.0.0.0__31bf3856ad364e35\\") returned=""
	[0136.350] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles\\2.0.0.0__31bf3856ad364e35\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles\\2.0.0.0__31bf3856ad364e35\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles\\2.0.0.0__31bf3856ad364e35\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.350] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles\\2.0.0.0__31bf3856ad364e35\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\microsoft.interop.security.azroles\\2.0.0.0__31bf3856ad364e35\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.350] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles\\2.0.0.0__31bf3856ad364e35\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\microsoft.interop.security.azroles\\2.0.0.0__31bf3856ad364e35\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0136.350] WriteFile (in: hFile=0x214, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0136.351] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.351] CloseHandle (hObject=0x214) returned 1
	[0136.351] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles\\2.0.0.0__31bf3856ad364e35\\", lpString2="Microsoft.Interop.Security.AzRoles.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles\\2.0.0.0__31bf3856ad364e35\\Microsoft.Interop.Security.AzRoles.dll") returned="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles\\2.0.0.0__31bf3856ad364e35\\Microsoft.Interop.Security.AzRoles.dll"
	[0136.352] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cf7d30b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6cf7d30b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6cf7d30b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13000, dwReserved0=0x12, dwReserved1=0x0, cFileName="Microsoft.Interop.Security.AzRoles.dll", cAlternateFileName="")) returned 0
	[0136.352] FindClose (in: hFindFile=0x7cbc50 | out: hFindFile=0x7cbc50) returned 1
	[0136.352] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21d60f47, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd4ff9624, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21d60f47, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.0.0__31bf3856ad364e35", cAlternateFileName="200~1.0__")) returned 0
	[0136.352] FindClose (in: hFindFile=0x7cb650 | out: hFindFile=0x7cb650) returned 1
	[0136.352] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7354ab25, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x7354ab25, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7354ab25, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.Transactions.Bridge.Dtc", cAlternateFileName="MICROS~1.DTC")) returned 1
	[0136.352] lstrcmpA (lpString1=".", lpString2="Microsoft.Transactions.Bridge.Dtc") returned -1
	[0136.352] lstrcmpA (lpString1="..", lpString2="Microsoft.Transactions.Bridge.Dtc") returned -1
	[0136.352] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\*.*") returned="*.*"
	[0136.352] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\", lpString2="Microsoft.Transactions.Bridge.Dtc" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\Microsoft.Transactions.Bridge.Dtc") returned="C:\\Windows\\assembly\\GAC_32\\Microsoft.Transactions.Bridge.Dtc"
	[0136.352] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Transactions.Bridge.Dtc\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7354ab25, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x7354ab25, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7354ab25, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbad0
	[0136.353] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.353] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7354ab25, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x7354ab25, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7354ab25, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.353] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.353] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.353] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7354ab25, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x7354ab25, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7354ab25, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="300~1.0__")) returned 1
	[0136.353] lstrcmpA (lpString1=".", lpString2="3.0.0.0__b03f5f7f11d50a3a") returned -1
	[0136.353] lstrcmpA (lpString1="..", lpString2="3.0.0.0__b03f5f7f11d50a3a") returned -1
	[0136.353] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\Microsoft.Transactions.Bridge.Dtc\\*.*") returned="*.*"
	[0136.353] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\Microsoft.Transactions.Bridge.Dtc\\", lpString2="3.0.0.0__b03f5f7f11d50a3a" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\Microsoft.Transactions.Bridge.Dtc\\3.0.0.0__b03f5f7f11d50a3a") returned="C:\\Windows\\assembly\\GAC_32\\Microsoft.Transactions.Bridge.Dtc\\3.0.0.0__b03f5f7f11d50a3a"
	[0136.353] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Transactions.Bridge.Dtc\\3.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7354ab25, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x7354ab25, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7354ab25, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x12, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb990
	[0136.353] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.353] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7354ab25, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x7354ab25, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7354ab25, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x12, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.353] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.353] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.353] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9095b89b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6571a090, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x6571a090, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x12, dwReserved1=0x0, cFileName="Microsoft.Transactions.Bridge.Dtc.dll", cAlternateFileName="")) returned 1
	[0136.353] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.353] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft.Transactions.Bridge.Dtc.dll") returned -1
	[0136.353] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft.Transactions.Bridge.Dtc.dll") returned -1
	[0136.353] lstrcmpiA (lpString1="", lpString2="Microsoft.Transactions.Bridge.Dtc.dll") returned -1
	[0136.353] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\Microsoft.Transactions.Bridge.Dtc\\3.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*"
	[0136.353] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_32\\Microsoft.Transactions.Bridge.Dtc\\3.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\Microsoft.Transactions.Bridge.Dtc\\3.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_32\\Microsoft.Transactions.Bridge.Dtc\\3.0.0.0__b03f5f7f11d50a3a\\"
	[0136.353] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_32\\Microsoft.Transactions.Bridge.Dtc\\3.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_32\\Microsoft.Transactions.Bridge.Dtc\\3.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.353] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\Microsoft.Transactions.Bridge.Dtc\\3.0.0.0__b03f5f7f11d50a3a\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\Microsoft.Transactions.Bridge.Dtc\\3.0.0.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC_32\\Microsoft.Transactions.Bridge.Dtc\\3.0.0.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.353] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Transactions.Bridge.Dtc\\3.0.0.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\microsoft.transactions.bridge.dtc\\3.0.0.0__b03f5f7f11d50a3a\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.354] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Transactions.Bridge.Dtc\\3.0.0.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\microsoft.transactions.bridge.dtc\\3.0.0.0__b03f5f7f11d50a3a\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0136.354] WriteFile (in: hFile=0x214, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0136.355] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.355] CloseHandle (hObject=0x214) returned 1
	[0136.355] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\Microsoft.Transactions.Bridge.Dtc\\3.0.0.0__b03f5f7f11d50a3a\\", lpString2="Microsoft.Transactions.Bridge.Dtc.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\Microsoft.Transactions.Bridge.Dtc\\3.0.0.0__b03f5f7f11d50a3a\\Microsoft.Transactions.Bridge.Dtc.dll") returned="C:\\Windows\\assembly\\GAC_32\\Microsoft.Transactions.Bridge.Dtc\\3.0.0.0__b03f5f7f11d50a3a\\Microsoft.Transactions.Bridge.Dtc.dll"
	[0136.355] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9095b89b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6571a090, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x6571a090, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x12, dwReserved1=0x0, cFileName="Microsoft.Transactions.Bridge.Dtc.dll", cAlternateFileName="")) returned 0
	[0136.355] FindClose (in: hFindFile=0x7cb990 | out: hFindFile=0x7cb990) returned 1
	[0136.355] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7354ab25, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x7354ab25, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7354ab25, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="300~1.0__")) returned 0
	[0136.355] FindClose (in: hFindFile=0x7cbad0 | out: hFindFile=0x7cbad0) returned 1
	[0136.356] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736a20bf, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736a20bf, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736a20bf, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="MSBuild", cAlternateFileName="")) returned 1
	[0136.356] lstrcmpA (lpString1=".", lpString2="MSBuild") returned -1
	[0136.356] lstrcmpA (lpString1="..", lpString2="MSBuild") returned -1
	[0136.356] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\*.*") returned="*.*"
	[0136.356] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\", lpString2="MSBuild" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\MSBuild") returned="C:\\Windows\\assembly\\GAC_32\\MSBuild"
	[0136.356] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\MSBuild\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736a20bf, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736a20bf, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736a20bf, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb650
	[0136.356] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.356] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736a20bf, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736a20bf, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736a20bf, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.356] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.356] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.356] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736a20bf, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736a20bf, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736a20bf, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.5.0.0__b03f5f7f11d50a3a", cAlternateFileName="350~1.0__")) returned 1
	[0136.357] lstrcmpA (lpString1=".", lpString2="3.5.0.0__b03f5f7f11d50a3a") returned -1
	[0136.357] lstrcmpA (lpString1="..", lpString2="3.5.0.0__b03f5f7f11d50a3a") returned -1
	[0136.357] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\MSBuild\\*.*") returned="*.*"
	[0136.357] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\MSBuild\\", lpString2="3.5.0.0__b03f5f7f11d50a3a" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a") returned="C:\\Windows\\assembly\\GAC_32\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a"
	[0136.357] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736a20bf, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736a20bf, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736a20bf, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cb890
	[0136.357] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.357] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736a20bf, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736a20bf, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736a20bf, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0136.357] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.357] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.357] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54be8474, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x54be8474, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xd6cc5900, ftLastWriteTime.dwHighDateTime=0x1d2837e, nFileSizeHigh=0x0, nFileSizeLow=0x15a98, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="MSBuild.exe", cAlternateFileName="")) returned 1
	[0136.357] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.357] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="MSBuild.exe") returned -1
	[0136.357] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="MSBuild.exe") returned -1
	[0136.357] lstrcmpiA (lpString1="", lpString2="MSBuild.exe") returned -1
	[0136.357] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*"
	[0136.357] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_32\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_32\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a\\"
	[0136.357] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_32\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_32\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.357] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC_32\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.357] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_32\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\msbuild\\3.5.0.0__b03f5f7f11d50a3a\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.357] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_32\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\msbuild\\3.5.0.0__b03f5f7f11d50a3a\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0136.359] WriteFile (in: hFile=0x214, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0136.360] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.360] CloseHandle (hObject=0x214) returned 1
	[0136.360] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a\\", lpString2="MSBuild.exe" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a\\MSBuild.exe") returned="C:\\Windows\\assembly\\GAC_32\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a\\MSBuild.exe"
	[0136.360] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54be8474, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x54be8474, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xd6cc5900, ftLastWriteTime.dwHighDateTime=0x1d2837e, nFileSizeHigh=0x0, nFileSizeLow=0x62d, dwReserved0=0x0, dwReserved1=0x0, cFileName="msbuild.exe.config", cAlternateFileName="")) returned 1
	[0136.360] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.360] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="msbuild.exe.config") returned -1
	[0136.360] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="msbuild.exe.config") returned -1
	[0136.360] lstrcmpiA (lpString1="", lpString2="msbuild.exe.config") returned -1
	[0136.360] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a\\MSBuild.exe") returned="MSBuild.exe"
	[0136.360] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_32\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_32\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a\\"
	[0136.360] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_32\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_32\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.360] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC_32\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.360] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_32\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\msbuild\\3.5.0.0__b03f5f7f11d50a3a\\how-to-decrypt-files.htm")) returned 0x20
	[0136.361] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a\\", lpString2="msbuild.exe.config" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a\\msbuild.exe.config") returned="C:\\Windows\\assembly\\GAC_32\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a\\msbuild.exe.config"
	[0136.361] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54be8474, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x54be8474, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xd6cc5900, ftLastWriteTime.dwHighDateTime=0x1d2837e, nFileSizeHigh=0x0, nFileSizeLow=0x62d, dwReserved0=0x0, dwReserved1=0x0, cFileName="msbuild.exe.config", cAlternateFileName="")) returned 0
	[0136.361] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1
	[0136.361] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736a20bf, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736a20bf, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736a20bf, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.5.0.0__b03f5f7f11d50a3a", cAlternateFileName="350~1.0__")) returned 0
	[0136.361] FindClose (in: hFindFile=0x7cb650 | out: hFindFile=0x7cb650) returned 1
	[0136.361] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7367be59, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x7367be59, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7367be59, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="mscorlib", cAlternateFileName="")) returned 1
	[0136.361] lstrcmpA (lpString1=".", lpString2="mscorlib") returned -1
	[0136.361] lstrcmpA (lpString1="..", lpString2="mscorlib") returned -1
	[0136.361] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\*.*") returned="*.*"
	[0136.361] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\", lpString2="mscorlib" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib"
	[0136.361] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\mscorlib\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7367be59, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x7367be59, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7367be59, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbad0
	[0136.361] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.361] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7367be59, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x7367be59, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7367be59, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.361] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.361] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.361] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7367be59, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736a20bf, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736a20bf, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.0.0__b77a5c561934e089", cAlternateFileName="200~1.0__")) returned 1
	[0136.361] lstrcmpA (lpString1=".", lpString2="2.0.0.0__b77a5c561934e089") returned -1
	[0136.361] lstrcmpA (lpString1="..", lpString2="2.0.0.0__b77a5c561934e089") returned -1
	[0136.361] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\*.*") returned="*.*"
	[0136.362] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\", lpString2="2.0.0.0__b77a5c561934e089" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089"
	[0136.362] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7367be59, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736a20bf, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736a20bf, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cb750
	[0136.362] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.362] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7367be59, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736a20bf, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736a20bf, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0136.362] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.362] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.363] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54c5ab8e, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x54c5ab8e, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x94eee300, ftLastWriteTime.dwHighDateTime=0x1d2837d, nFileSizeHigh=0x0, nFileSizeLow=0x104a8, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="big5.nlp", cAlternateFileName="")) returned 1
	[0136.363] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.363] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="big5.nlp") returned 1
	[0136.363] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="big5.nlp") returned 1
	[0136.363] lstrcmpiA (lpString1="", lpString2="big5.nlp") returned -1
	[0136.363] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\*.*") returned="*.*"
	[0136.363] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\"
	[0136.363] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned=""
	[0136.363] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.363] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.363] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0136.364] WriteFile (in: hFile=0x214, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0136.365] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.365] CloseHandle (hObject=0x214) returned 1
	[0136.365] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\", lpString2="big5.nlp" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\big5.nlp") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\big5.nlp"
	[0136.365] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54c5ab8e, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x54c5ab8e, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x94eee300, ftLastWriteTime.dwHighDateTime=0x1d2837d, nFileSizeHigh=0x0, nFileSizeLow=0x140fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="bopomofo.nlp", cAlternateFileName="")) returned 1
	[0136.365] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.365] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bopomofo.nlp") returned 1
	[0136.365] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bopomofo.nlp") returned 1
	[0136.365] lstrcmpiA (lpString1="", lpString2="bopomofo.nlp") returned -1
	[0136.365] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\big5.nlp") returned="big5.nlp"
	[0136.365] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\"
	[0136.365] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned=""
	[0136.365] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.365] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\how-to-decrypt-files.htm")) returned 0x20
	[0136.366] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\", lpString2="bopomofo.nlp" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\bopomofo.nlp") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\bopomofo.nlp"
	[0136.366] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54fa2058, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x54fa2058, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x96201000, ftLastWriteTime.dwHighDateTime=0x1d2837d, nFileSizeHigh=0x0, nFileSizeLow=0x1c814, dwReserved0=0x48002e, dwReserved1=0x4d0054, cFileName="ksc.nlp", cAlternateFileName="")) returned 1
	[0136.366] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.366] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="ksc.nlp") returned -1
	[0136.366] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="ksc.nlp") returned -1
	[0136.366] lstrcmpiA (lpString1="", lpString2="ksc.nlp") returned -1
	[0136.366] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\bopomofo.nlp") returned="bopomofo.nlp"
	[0136.366] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\"
	[0136.366] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned=""
	[0136.366] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.366] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\how-to-decrypt-files.htm")) returned 0x20
	[0136.366] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\", lpString2="ksc.nlp" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\ksc.nlp") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\ksc.nlp"
	[0136.366] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54c0e67a, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x54c0e67a, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xcaa15c00, ftLastWriteTime.dwHighDateTime=0x1d29451, nFileSizeHigh=0x0, nFileSizeLow=0x458000, dwReserved0=0x48002e, dwReserved1=0x4d0054, cFileName="mscorlib.dll", cAlternateFileName="")) returned 1
	[0136.366] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.366] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="mscorlib.dll") returned -1
	[0136.366] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="mscorlib.dll") returned -1
	[0136.366] lstrcmpiA (lpString1="", lpString2="mscorlib.dll") returned -1
	[0136.366] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\ksc.nlp") returned="ksc.nlp"
	[0136.366] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\"
	[0136.366] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned=""
	[0136.366] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.366] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\how-to-decrypt-files.htm")) returned 0x20
	[0136.367] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\", lpString2="mscorlib.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\mscorlib.dll") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\mscorlib.dll"
	[0136.367] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cb8940d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9cb8940d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9cb8940d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe7ce, dwReserved0=0x48002e, dwReserved1=0x4d0054, cFileName="normidna.nlp", cAlternateFileName="")) returned 1
	[0136.367] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.367] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="normidna.nlp") returned -1
	[0136.367] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="normidna.nlp") returned -1
	[0136.367] lstrcmpiA (lpString1="", lpString2="normidna.nlp") returned -1
	[0136.367] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\mscorlib.dll") returned="mscorlib.dll"
	[0136.367] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\"
	[0136.367] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned=""
	[0136.367] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.367] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\how-to-decrypt-files.htm")) returned 0x20
	[0136.367] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\", lpString2="normidna.nlp" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\normidna.nlp") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\normidna.nlp"
	[0136.367] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54fee4fc, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x54fee4fc, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x97513d00, ftLastWriteTime.dwHighDateTime=0x1d2837d, nFileSizeHigh=0x0, nFileSizeLow=0xb2e2, dwReserved0=0x48002e, dwReserved1=0x4d0054, cFileName="normnfc.nlp", cAlternateFileName="")) returned 1
	[0136.367] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.367] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="normnfc.nlp") returned -1
	[0136.368] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="normnfc.nlp") returned -1
	[0136.368] lstrcmpiA (lpString1="", lpString2="normnfc.nlp") returned -1
	[0136.368] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\normidna.nlp") returned="normidna.nlp"
	[0136.368] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\"
	[0136.368] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned=""
	[0136.368] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.368] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\how-to-decrypt-files.htm")) returned 0x20
	[0136.368] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\", lpString2="normnfc.nlp" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\normnfc.nlp") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\normnfc.nlp"
	[0136.368] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54fee4fc, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x54fee4fc, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x97513d00, ftLastWriteTime.dwHighDateTime=0x1d2837d, nFileSizeHigh=0x0, nFileSizeLow=0x9974, dwReserved0=0x48002e, dwReserved1=0x4d0054, cFileName="normnfd.nlp", cAlternateFileName="")) returned 1
	[0136.368] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.368] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="normnfd.nlp") returned -1
	[0136.368] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="normnfd.nlp") returned -1
	[0136.368] lstrcmpiA (lpString1="", lpString2="normnfd.nlp") returned -1
	[0136.368] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\normnfc.nlp") returned="normnfc.nlp"
	[0136.368] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\"
	[0136.368] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned=""
	[0136.368] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.368] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\how-to-decrypt-files.htm")) returned 0x20
	[0136.368] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\", lpString2="normnfd.nlp" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\normnfd.nlp") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\normnfd.nlp"
	[0136.368] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54fee4fc, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x54fee4fc, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x97513d00, ftLastWriteTime.dwHighDateTime=0x1d2837d, nFileSizeHigh=0x0, nFileSizeLow=0x10350, dwReserved0=0x48002e, dwReserved1=0x4d0054, cFileName="normnfkc.nlp", cAlternateFileName="")) returned 1
	[0136.368] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.368] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="normnfkc.nlp") returned -1
	[0136.368] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="normnfkc.nlp") returned -1
	[0136.368] lstrcmpiA (lpString1="", lpString2="normnfkc.nlp") returned -1
	[0136.368] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\normnfd.nlp") returned="normnfd.nlp"
	[0136.369] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\"
	[0136.369] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned=""
	[0136.369] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.369] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\how-to-decrypt-files.htm")) returned 0x20
	[0136.369] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\", lpString2="normnfkc.nlp" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\normnfkc.nlp") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\normnfkc.nlp"
	[0136.369] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55014775, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x55014775, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x97513d00, ftLastWriteTime.dwHighDateTime=0x1d2837d, nFileSizeHigh=0x0, nFileSizeLow=0xeb86, dwReserved0=0x48002e, dwReserved1=0x4d0054, cFileName="normnfkd.nlp", cAlternateFileName="")) returned 1
	[0136.369] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.369] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="normnfkd.nlp") returned -1
	[0136.369] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="normnfkd.nlp") returned -1
	[0136.369] lstrcmpiA (lpString1="", lpString2="normnfkd.nlp") returned -1
	[0136.369] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\normnfkc.nlp") returned="normnfkc.nlp"
	[0136.369] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\"
	[0136.369] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned=""
	[0136.369] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.369] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\how-to-decrypt-files.htm")) returned 0x20
	[0136.369] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\", lpString2="normnfkd.nlp" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\normnfkd.nlp") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\normnfkd.nlp"
	[0136.369] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55014775, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x55014775, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x97513d00, ftLastWriteTime.dwHighDateTime=0x1d2837d, nFileSizeHigh=0x0, nFileSizeLow=0x14724, dwReserved0=0x48002e, dwReserved1=0x4d0054, cFileName="prc.nlp", cAlternateFileName="")) returned 1
	[0136.369] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.369] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="prc.nlp") returned -1
	[0136.369] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="prc.nlp") returned -1
	[0136.369] lstrcmpiA (lpString1="", lpString2="prc.nlp") returned -1
	[0136.369] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\normnfkd.nlp") returned="normnfkd.nlp"
	[0136.369] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\"
	[0136.369] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned=""
	[0136.370] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.370] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\how-to-decrypt-files.htm")) returned 0x20
	[0136.370] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\", lpString2="prc.nlp" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\prc.nlp") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\prc.nlp"
	[0136.370] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55014775, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x55014775, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x97513d00, ftLastWriteTime.dwHighDateTime=0x1d2837d, nFileSizeHigh=0x0, nFileSizeLow=0x14724, dwReserved0=0x48002e, dwReserved1=0x4d0054, cFileName="prcp.nlp", cAlternateFileName="")) returned 1
	[0136.370] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.370] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="prcp.nlp") returned -1
	[0136.370] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="prcp.nlp") returned -1
	[0136.370] lstrcmpiA (lpString1="", lpString2="prcp.nlp") returned -1
	[0136.370] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\prc.nlp") returned="prc.nlp"
	[0136.370] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\"
	[0136.370] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned=""
	[0136.370] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.370] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\how-to-decrypt-files.htm")) returned 0x20
	[0136.370] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\", lpString2="prcp.nlp" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\prcp.nlp") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\prcp.nlp"
	[0136.370] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55014775, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x55014775, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x97513d00, ftLastWriteTime.dwHighDateTime=0x1d2837d, nFileSizeHigh=0x0, nFileSizeLow=0x40004, dwReserved0=0x48002e, dwReserved1=0x4d0054, cFileName="sortkey.nlp", cAlternateFileName="")) returned 1
	[0136.370] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.370] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="sortkey.nlp") returned -1
	[0136.370] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="sortkey.nlp") returned -1
	[0136.370] lstrcmpiA (lpString1="", lpString2="sortkey.nlp") returned -1
	[0136.370] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\prcp.nlp") returned="prcp.nlp"
	[0136.370] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\"
	[0136.370] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned=""
	[0136.370] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.370] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\how-to-decrypt-files.htm")) returned 0x20
	[0136.371] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\", lpString2="sortkey.nlp" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp"
	[0136.371] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55014775, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x55014775, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x97513d00, ftLastWriteTime.dwHighDateTime=0x1d2837d, nFileSizeHigh=0x0, nFileSizeLow=0x4f60, dwReserved0=0x48002e, dwReserved1=0x4d0054, cFileName="sorttbls.nlp", cAlternateFileName="")) returned 1
	[0136.371] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.371] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="sorttbls.nlp") returned -1
	[0136.371] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="sorttbls.nlp") returned -1
	[0136.371] lstrcmpiA (lpString1="", lpString2="sorttbls.nlp") returned -1
	[0136.371] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp") returned="sortkey.nlp"
	[0136.371] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\"
	[0136.371] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned=""
	[0136.371] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.371] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\how-to-decrypt-files.htm")) returned 0x20
	[0136.371] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\", lpString2="sorttbls.nlp" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp"
	[0136.371] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55014775, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x55014775, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x97513d00, ftLastWriteTime.dwHighDateTime=0x1d2837d, nFileSizeHigh=0x0, nFileSizeLow=0x6e80, dwReserved0=0x48002e, dwReserved1=0x4d0054, cFileName="xjis.nlp", cAlternateFileName="")) returned 1
	[0136.371] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.371] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="xjis.nlp") returned -1
	[0136.371] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="xjis.nlp") returned -1
	[0136.371] lstrcmpiA (lpString1="", lpString2="xjis.nlp") returned -1
	[0136.371] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp") returned="sorttbls.nlp"
	[0136.371] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\"
	[0136.371] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned=""
	[0136.371] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.371] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\how-to-decrypt-files.htm")) returned 0x20
	[0136.371] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\", lpString2="xjis.nlp" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\xjis.nlp") returned="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\xjis.nlp"
	[0136.372] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55014775, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x55014775, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x97513d00, ftLastWriteTime.dwHighDateTime=0x1d2837d, nFileSizeHigh=0x0, nFileSizeLow=0x6e80, dwReserved0=0x48002e, dwReserved1=0x4d0054, cFileName="xjis.nlp", cAlternateFileName="")) returned 0
	[0136.372] FindClose (in: hFindFile=0x7cb750 | out: hFindFile=0x7cb750) returned 1
	[0136.372] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7367be59, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736a20bf, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736a20bf, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.0.0__b77a5c561934e089", cAlternateFileName="200~1.0__")) returned 0
	[0136.372] FindClose (in: hFindFile=0x7cbad0 | out: hFindFile=0x7cbad0) returned 1
	[0136.372] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7360970b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x7360970b, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7360970b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="PresentationCore", cAlternateFileName="PRESEN~1")) returned 1
	[0136.372] lstrcmpA (lpString1=".", lpString2="PresentationCore") returned -1
	[0136.372] lstrcmpA (lpString1="..", lpString2="PresentationCore") returned -1
	[0136.372] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\*.*") returned="*.*"
	[0136.372] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\", lpString2="PresentationCore" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\PresentationCore") returned="C:\\Windows\\assembly\\GAC_32\\PresentationCore"
	[0136.372] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7360970b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x7360970b, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7360970b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb9d0
	[0136.372] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.372] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7360970b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x7360970b, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7360970b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.372] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.372] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.372] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7360970b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x7360970b, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7360970b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.0.0.0__31bf3856ad364e35", cAlternateFileName="300~1.0__")) returned 1
	[0136.372] lstrcmpA (lpString1=".", lpString2="3.0.0.0__31bf3856ad364e35") returned -1
	[0136.372] lstrcmpA (lpString1="..", lpString2="3.0.0.0__31bf3856ad364e35") returned -1
	[0136.372] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\*.*") returned="*.*"
	[0136.372] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\", lpString2="3.0.0.0__31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35"
	[0136.373] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7360970b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x7360970b, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7360970b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cb750
	[0136.373] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.373] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7360970b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x7360970b, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7360970b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0136.373] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.373] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.373] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x574bd2f8, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x574bd2f8, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x13985000, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x407000, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="PresentationCore.dll", cAlternateFileName="")) returned 1
	[0136.373] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.373] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PresentationCore.dll") returned -1
	[0136.373] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PresentationCore.dll") returned -1
	[0136.373] lstrcmpiA (lpString1="", lpString2="PresentationCore.dll") returned -1
	[0136.373] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\*.*") returned="*.*"
	[0136.373] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\"
	[0136.373] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\") returned=""
	[0136.373] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.373] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\presentationcore\\3.0.0.0__31bf3856ad364e35\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.373] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\presentationcore\\3.0.0.0__31bf3856ad364e35\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0136.375] WriteFile (in: hFile=0x214, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0136.376] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.376] CloseHandle (hObject=0x214) returned 1
	[0136.376] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\", lpString2="PresentationCore.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\PresentationCore.dll") returned="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\PresentationCore.dll"
	[0136.377] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x574bd2f8, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x574bd2f8, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x13985000, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0xa1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFontCache.exe.config", cAlternateFileName="")) returned 1
	[0136.377] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.377] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="PresentationFontCache.exe.config") returned -1
	[0136.377] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="PresentationFontCache.exe.config") returned -1
	[0136.377] lstrcmpiA (lpString1="", lpString2="PresentationFontCache.exe.config") returned -1
	[0136.377] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\PresentationCore.dll") returned="PresentationCore.dll"
	[0136.377] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\"
	[0136.377] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\") returned=""
	[0136.377] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.377] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\presentationcore\\3.0.0.0__31bf3856ad364e35\\how-to-decrypt-files.htm")) returned 0x20
	[0136.377] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\", lpString2="PresentationFontCache.exe.config" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe.config") returned="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe.config"
	[0136.377] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x574e3557, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x574e3557, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x13985000, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x1a84a0, dwReserved0=0x540050, dwReserved1=0x46002d, cFileName="wpfgfx_v0300.dll", cAlternateFileName="")) returned 1
	[0136.377] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.377] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="wpfgfx_v0300.dll") returned -1
	[0136.377] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="wpfgfx_v0300.dll") returned -1
	[0136.377] lstrcmpiA (lpString1="", lpString2="wpfgfx_v0300.dll") returned -1
	[0136.377] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe.config") returned="PresentationFontCache.exe.config"
	[0136.377] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\"
	[0136.377] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\") returned=""
	[0136.377] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.377] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\presentationcore\\3.0.0.0__31bf3856ad364e35\\how-to-decrypt-files.htm")) returned 0x20
	[0136.377] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\", lpString2="wpfgfx_v0300.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\wpfgfx_v0300.dll") returned="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\wpfgfx_v0300.dll"
	[0136.378] FindNextFileA (in: hFindFile=0x7cb750, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x574e3557, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x574e3557, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x13985000, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x1a84a0, dwReserved0=0x540050, dwReserved1=0x46002d, cFileName="wpfgfx_v0300.dll", cAlternateFileName="")) returned 0
	[0136.378] FindClose (in: hFindFile=0x7cb750 | out: hFindFile=0x7cb750) returned 1
	[0136.378] FindNextFileA (in: hFindFile=0x7cb9d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7360970b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x7360970b, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7360970b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.0.0.0__31bf3856ad364e35", cAlternateFileName="300~1.0__")) returned 0
	[0136.378] FindClose (in: hFindFile=0x7cb9d0 | out: hFindFile=0x7cb9d0) returned 1
	[0136.378] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe96b5bec, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xd5149223, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe96b5bec, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="srmlib", cAlternateFileName="")) returned 1
	[0136.378] lstrcmpA (lpString1=".", lpString2="srmlib") returned -1
	[0136.378] lstrcmpA (lpString1="..", lpString2="srmlib") returned -1
	[0136.378] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\*.*") returned="*.*"
	[0136.378] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\", lpString2="srmlib" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\srmlib") returned="C:\\Windows\\assembly\\GAC_32\\srmlib"
	[0136.378] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\srmlib\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe96b5bec, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xd5149223, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe96b5bec, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbad0
	[0136.378] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.378] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe96b5bec, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xd5149223, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe96b5bec, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.378] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.378] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.378] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe96b5bec, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xd514a2a7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe96b5bec, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.0__31bf3856ad364e35", cAlternateFileName="100~1.0__")) returned 1
	[0136.378] lstrcmpA (lpString1=".", lpString2="1.0.0.0__31bf3856ad364e35") returned -1
	[0136.378] lstrcmpA (lpString1="..", lpString2="1.0.0.0__31bf3856ad364e35") returned -1
	[0136.378] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\srmlib\\*.*") returned="*.*"
	[0136.378] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\srmlib\\", lpString2="1.0.0.0__31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\srmlib\\1.0.0.0__31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_32\\srmlib\\1.0.0.0__31bf3856ad364e35"
	[0136.378] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\srmlib\\1.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe96b5bec, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xd514a2a7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe96b5bec, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cb990
	[0136.379] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.379] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe96b5bec, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xd514a2a7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe96b5bec, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0136.379] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.379] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.379] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78d7eb03, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd4f875db, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd4f875db, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x16000, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="srmlib.dll", cAlternateFileName="")) returned 1
	[0136.379] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.379] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="srmlib.dll") returned -1
	[0136.379] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="srmlib.dll") returned -1
	[0136.379] lstrcmpiA (lpString1="", lpString2="srmlib.dll") returned -1
	[0136.379] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\srmlib\\1.0.0.0__31bf3856ad364e35\\*.*") returned="*.*"
	[0136.379] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_32\\srmlib\\1.0.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\srmlib\\1.0.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_32\\srmlib\\1.0.0.0__31bf3856ad364e35\\"
	[0136.379] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_32\\srmlib\\1.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_32\\srmlib\\1.0.0.0__31bf3856ad364e35\\") returned=""
	[0136.379] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\srmlib\\1.0.0.0__31bf3856ad364e35\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\srmlib\\1.0.0.0__31bf3856ad364e35\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC_32\\srmlib\\1.0.0.0__31bf3856ad364e35\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.379] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_32\\srmlib\\1.0.0.0__31bf3856ad364e35\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\srmlib\\1.0.0.0__31bf3856ad364e35\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.379] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_32\\srmlib\\1.0.0.0__31bf3856ad364e35\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\srmlib\\1.0.0.0__31bf3856ad364e35\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0136.380] WriteFile (in: hFile=0x214, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0136.380] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.381] CloseHandle (hObject=0x214) returned 1
	[0136.381] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\srmlib\\1.0.0.0__31bf3856ad364e35\\", lpString2="srmlib.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\srmlib\\1.0.0.0__31bf3856ad364e35\\srmlib.dll") returned="C:\\Windows\\assembly\\GAC_32\\srmlib\\1.0.0.0__31bf3856ad364e35\\srmlib.dll"
	[0136.381] FindNextFileA (in: hFindFile=0x7cb990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78d7eb03, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd4f875db, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd4f875db, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x16000, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="srmlib.dll", cAlternateFileName="")) returned 0
	[0136.381] FindClose (in: hFindFile=0x7cb990 | out: hFindFile=0x7cb990) returned 1
	[0136.381] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe96b5bec, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xd514a2a7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe96b5bec, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.0__31bf3856ad364e35", cAlternateFileName="100~1.0__")) returned 0
	[0136.381] FindClose (in: hFindFile=0x7cbad0 | out: hFindFile=0x7cbad0) returned 1
	[0136.381] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7360970b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x7360970b, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7360970b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="System.Data", cAlternateFileName="SYSTEM~1.DAT")) returned 1
	[0136.381] lstrcmpA (lpString1=".", lpString2="System.Data") returned -1
	[0136.381] lstrcmpA (lpString1="..", lpString2="System.Data") returned -1
	[0136.381] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\*.*") returned="*.*"
	[0136.381] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\", lpString2="System.Data" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\System.Data") returned="C:\\Windows\\assembly\\GAC_32\\System.Data"
	[0136.381] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Data\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7360970b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x7360970b, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7360970b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb650
	[0136.381] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.381] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7360970b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x7360970b, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7360970b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.381] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.381] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.381] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7360970b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x7362f993, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7362f993, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.0.0__b77a5c561934e089", cAlternateFileName="200~1.0__")) returned 1
	[0136.382] lstrcmpA (lpString1=".", lpString2="2.0.0.0__b77a5c561934e089") returned -1
	[0136.382] lstrcmpA (lpString1="..", lpString2="2.0.0.0__b77a5c561934e089") returned -1
	[0136.382] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\System.Data\\*.*") returned="*.*"
	[0136.382] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\System.Data\\", lpString2="2.0.0.0__b77a5c561934e089" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\System.Data\\2.0.0.0__b77a5c561934e089") returned="C:\\Windows\\assembly\\GAC_32\\System.Data\\2.0.0.0__b77a5c561934e089"
	[0136.382] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Data\\2.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7360970b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x7362f993, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7362f993, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cb690
	[0136.382] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.382] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7360970b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x7362f993, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7362f993, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0136.382] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.382] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.382] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5752fa1e, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x5752fa1e, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xcaa15c00, ftLastWriteTime.dwHighDateTime=0x1d29451, nFileSizeHigh=0x0, nFileSizeLow=0x2d6800, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="System.Data.dll", cAlternateFileName="")) returned 1
	[0136.382] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.382] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="System.Data.dll") returned -1
	[0136.382] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="System.Data.dll") returned -1
	[0136.382] lstrcmpiA (lpString1="", lpString2="System.Data.dll") returned -1
	[0136.382] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\System.Data\\2.0.0.0__b77a5c561934e089\\*.*") returned="*.*"
	[0136.382] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_32\\System.Data\\2.0.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\System.Data\\2.0.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_32\\System.Data\\2.0.0.0__b77a5c561934e089\\"
	[0136.382] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_32\\System.Data\\2.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_32\\System.Data\\2.0.0.0__b77a5c561934e089\\") returned=""
	[0136.382] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\System.Data\\2.0.0.0__b77a5c561934e089\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\System.Data\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC_32\\System.Data\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.382] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Data\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\system.data\\2.0.0.0__b77a5c561934e089\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.382] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Data\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\system.data\\2.0.0.0__b77a5c561934e089\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0136.383] WriteFile (in: hFile=0x214, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0136.384] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.384] CloseHandle (hObject=0x214) returned 1
	[0136.384] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\System.Data\\2.0.0.0__b77a5c561934e089\\", lpString2="System.Data.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\System.Data\\2.0.0.0__b77a5c561934e089\\System.Data.dll") returned="C:\\Windows\\assembly\\GAC_32\\System.Data\\2.0.0.0__b77a5c561934e089\\System.Data.dll"
	[0136.384] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5752fa1e, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x5752fa1e, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xcaa15c00, ftLastWriteTime.dwHighDateTime=0x1d29451, nFileSizeHigh=0x0, nFileSizeLow=0x2d6800, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="System.Data.dll", cAlternateFileName="")) returned 0
	[0136.384] FindClose (in: hFindFile=0x7cb690 | out: hFindFile=0x7cb690) returned 1
	[0136.384] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7360970b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x7362f993, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7362f993, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.0.0__b77a5c561934e089", cAlternateFileName="200~1.0__")) returned 0
	[0136.384] FindClose (in: hFindFile=0x7cb650 | out: hFindFile=0x7cb650) returned 1
	[0136.385] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736a20bf, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736a20bf, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736a20bf, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="System.Data.OracleClient", cAlternateFileName="SYSTEM~1.ORA")) returned 1
	[0136.385] lstrcmpA (lpString1=".", lpString2="System.Data.OracleClient") returned -1
	[0136.385] lstrcmpA (lpString1="..", lpString2="System.Data.OracleClient") returned -1
	[0136.385] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\*.*") returned="*.*"
	[0136.385] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\", lpString2="System.Data.OracleClient" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\System.Data.OracleClient") returned="C:\\Windows\\assembly\\GAC_32\\System.Data.OracleClient"
	[0136.385] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Data.OracleClient\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736a20bf, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736a20bf, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736a20bf, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb6d0
	[0136.385] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.385] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736a20bf, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736a20bf, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736a20bf, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.385] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.385] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.385] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736a20bf, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736a20bf, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736a20bf, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.0.0__b77a5c561934e089", cAlternateFileName="200~1.0__")) returned 1
	[0136.385] lstrcmpA (lpString1=".", lpString2="2.0.0.0__b77a5c561934e089") returned -1
	[0136.385] lstrcmpA (lpString1="..", lpString2="2.0.0.0__b77a5c561934e089") returned -1
	[0136.385] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\System.Data.OracleClient\\*.*") returned="*.*"
	[0136.385] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\System.Data.OracleClient\\", lpString2="2.0.0.0__b77a5c561934e089" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\System.Data.OracleClient\\2.0.0.0__b77a5c561934e089") returned="C:\\Windows\\assembly\\GAC_32\\System.Data.OracleClient\\2.0.0.0__b77a5c561934e089"
	[0136.385] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Data.OracleClient\\2.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736a20bf, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736a20bf, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736a20bf, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb650
	[0136.386] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.386] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736a20bf, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736a20bf, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736a20bf, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.386] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.386] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.386] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x575097b7, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x575097b7, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xcaa15c00, ftLastWriteTime.dwHighDateTime=0x1d29451, nFileSizeHigh=0x0, nFileSizeLow=0x77000, dwReserved0=0x3, dwReserved1=0x0, cFileName="System.Data.OracleClient.dll", cAlternateFileName="")) returned 1
	[0136.386] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.386] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="System.Data.OracleClient.dll") returned -1
	[0136.386] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="System.Data.OracleClient.dll") returned -1
	[0136.386] lstrcmpiA (lpString1="", lpString2="System.Data.OracleClient.dll") returned -1
	[0136.386] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\System.Data.OracleClient\\2.0.0.0__b77a5c561934e089\\*.*") returned="*.*"
	[0136.386] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_32\\System.Data.OracleClient\\2.0.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\System.Data.OracleClient\\2.0.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_32\\System.Data.OracleClient\\2.0.0.0__b77a5c561934e089\\"
	[0136.386] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_32\\System.Data.OracleClient\\2.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_32\\System.Data.OracleClient\\2.0.0.0__b77a5c561934e089\\") returned=""
	[0136.386] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\System.Data.OracleClient\\2.0.0.0__b77a5c561934e089\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\System.Data.OracleClient\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC_32\\System.Data.OracleClient\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.386] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Data.OracleClient\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\system.data.oracleclient\\2.0.0.0__b77a5c561934e089\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.386] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Data.OracleClient\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\system.data.oracleclient\\2.0.0.0__b77a5c561934e089\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0136.387] WriteFile (in: hFile=0x214, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0136.388] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.388] CloseHandle (hObject=0x214) returned 1
	[0136.388] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\System.Data.OracleClient\\2.0.0.0__b77a5c561934e089\\", lpString2="System.Data.OracleClient.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\System.Data.OracleClient\\2.0.0.0__b77a5c561934e089\\System.Data.OracleClient.dll") returned="C:\\Windows\\assembly\\GAC_32\\System.Data.OracleClient\\2.0.0.0__b77a5c561934e089\\System.Data.OracleClient.dll"
	[0136.389] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x575097b7, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x575097b7, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xcaa15c00, ftLastWriteTime.dwHighDateTime=0x1d29451, nFileSizeHigh=0x0, nFileSizeLow=0x77000, dwReserved0=0x3, dwReserved1=0x0, cFileName="System.Data.OracleClient.dll", cAlternateFileName="")) returned 0
	[0136.389] FindClose (in: hFindFile=0x7cb650 | out: hFindFile=0x7cb650) returned 1
	[0136.389] FindNextFileA (in: hFindFile=0x7cb6d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736a20bf, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736a20bf, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736a20bf, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.0.0__b77a5c561934e089", cAlternateFileName="200~1.0__")) returned 0
	[0136.389] FindClose (in: hFindFile=0x7cb6d0 | out: hFindFile=0x7cb6d0) returned 1
	[0136.389] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736ee56c, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736ee56c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736ee56c, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="System.EnterpriseServices", cAlternateFileName="SYSTEM~1.ENT")) returned 1
	[0136.389] lstrcmpA (lpString1=".", lpString2="System.EnterpriseServices") returned -1
	[0136.389] lstrcmpA (lpString1="..", lpString2="System.EnterpriseServices") returned -1
	[0136.389] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\*.*") returned="*.*"
	[0136.389] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\", lpString2="System.EnterpriseServices" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices") returned="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices"
	[0136.389] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736ee56c, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736ee56c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736ee56c, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb650
	[0136.389] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.389] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736ee56c, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736ee56c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736ee56c, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.389] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.389] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.389] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736ee56c, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736ee56c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736ee56c, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="200~1.0__")) returned 1
	[0136.389] lstrcmpA (lpString1=".", lpString2="2.0.0.0__b03f5f7f11d50a3a") returned -1
	[0136.389] lstrcmpA (lpString1="..", lpString2="2.0.0.0__b03f5f7f11d50a3a") returned -1
	[0136.389] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\*.*") returned="*.*"
	[0136.389] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\", lpString2="2.0.0.0__b03f5f7f11d50a3a" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\2.0.0.0__b03f5f7f11d50a3a") returned="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\2.0.0.0__b03f5f7f11d50a3a"
	[0136.390] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736ee56c, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736ee56c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736ee56c, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbad0
	[0136.390] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.390] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736ee56c, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736ee56c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736ee56c, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.390] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.390] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.390] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57555c84, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x57555c84, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xcaa15c00, ftLastWriteTime.dwHighDateTime=0x1d29451, nFileSizeHigh=0x0, nFileSizeLow=0x3f000, dwReserved0=0x2, dwReserved1=0x0, cFileName="System.EnterpriseServices.dll", cAlternateFileName="")) returned 1
	[0136.390] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.390] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="System.EnterpriseServices.dll") returned -1
	[0136.390] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="System.EnterpriseServices.dll") returned -1
	[0136.390] lstrcmpiA (lpString1="", lpString2="System.EnterpriseServices.dll") returned -1
	[0136.390] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\2.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*"
	[0136.390] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\2.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\2.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\2.0.0.0__b03f5f7f11d50a3a\\"
	[0136.390] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\2.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\2.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.390] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\2.0.0.0__b03f5f7f11d50a3a\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\2.0.0.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\2.0.0.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.390] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\2.0.0.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\system.enterpriseservices\\2.0.0.0__b03f5f7f11d50a3a\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.390] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\2.0.0.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\system.enterpriseservices\\2.0.0.0__b03f5f7f11d50a3a\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0136.392] WriteFile (in: hFile=0x214, lpBuffer=0x7ce980*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x7ce980*, lpNumberOfBytesWritten=0x406561*=0x39e, lpOverlapped=0x0) returned 1
	[0136.394] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.394] CloseHandle (hObject=0x214) returned 1
	[0136.394] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\2.0.0.0__b03f5f7f11d50a3a\\", lpString2="System.EnterpriseServices.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\2.0.0.0__b03f5f7f11d50a3a\\System.EnterpriseServices.dll") returned="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\2.0.0.0__b03f5f7f11d50a3a\\System.EnterpriseServices.dll"
	[0136.394] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57555c84, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x57555c84, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xcaa15c00, ftLastWriteTime.dwHighDateTime=0x1d29451, nFileSizeHigh=0x0, nFileSizeLow=0x1bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.EnterpriseServices.Wrapper.dll", cAlternateFileName="")) returned 1
	[0136.394] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.394] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="System.EnterpriseServices.Wrapper.dll") returned -1
	[0136.394] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="System.EnterpriseServices.Wrapper.dll") returned -1
	[0136.394] lstrcmpiA (lpString1="", lpString2="System.EnterpriseServices.Wrapper.dll") returned -1
	[0136.394] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\2.0.0.0__b03f5f7f11d50a3a\\System.EnterpriseServices.dll") returned="System.EnterpriseServices.dll"
	[0136.394] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\2.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\2.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\2.0.0.0__b03f5f7f11d50a3a\\"
	[0136.394] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\2.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\2.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.394] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\2.0.0.0__b03f5f7f11d50a3a\\", lpString2="HOW-TO-DECRYPT-FILES.HTM" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\2.0.0.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM") returned="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\2.0.0.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM"
	[0136.394] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\2.0.0.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\system.enterpriseservices\\2.0.0.0__b03f5f7f11d50a3a\\how-to-decrypt-files.htm")) returned 0x20
	[0136.394] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\2.0.0.0__b03f5f7f11d50a3a\\", lpString2="System.EnterpriseServices.Wrapper.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\2.0.0.0__b03f5f7f11d50a3a\\System.EnterpriseServices.Wrapper.dll") returned="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\2.0.0.0__b03f5f7f11d50a3a\\System.EnterpriseServices.Wrapper.dll"
	[0136.394] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57555c84, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x57555c84, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xcaa15c00, ftLastWriteTime.dwHighDateTime=0x1d29451, nFileSizeHigh=0x0, nFileSizeLow=0x1bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.EnterpriseServices.Wrapper.dll", cAlternateFileName="")) returned 0
	[0136.394] FindClose (in: hFindFile=0x7cbad0 | out: hFindFile=0x7cbad0) returned 1
	[0136.394] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736ee56c, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736ee56c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736ee56c, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="200~1.0__")) returned 0
	[0136.395] FindClose (in: hFindFile=0x7cb650 | out: hFindFile=0x7cb650) returned 1
	[0136.395] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73596fd2, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x73596fd2, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x73596fd2, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="System.Printing", cAlternateFileName="SYSTEM~1.PRI")) returned 1
	[0136.395] lstrcmpA (lpString1=".", lpString2="System.Printing") returned -1
	[0136.395] lstrcmpA (lpString1="..", lpString2="System.Printing") returned -1
	[0136.395] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\*.*") returned="*.*"
	[0136.395] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_32\\", lpString2="System.Printing" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\System.Printing") returned="C:\\Windows\\assembly\\GAC_32\\System.Printing"
	[0136.395] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Printing\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73596fd2, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x73596fd2, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x73596fd2, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb790
	[0136.395] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.395] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73596fd2, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x73596fd2, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x73596fd2, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.395] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.395] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.395] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73596fd2, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x73596fd2, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x73596fd2, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.0.0.0__31bf3856ad364e35", cAlternateFileName="300~1.0__")) returned 1
	[0136.395] lstrcmpA (lpString1=".", lpString2="3.0.0.0__31bf3856ad364e35") returned -1
	[0136.395] lstrcmpA (lpString1="..", lpString2="3.0.0.0__31bf3856ad364e35") returned -1
	[0136.395] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\System.Printing\\*.*") returned="*.*"
	[0136.395] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Printing\\3.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73596fd2, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x73596fd2, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x73596fd2, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cbad0
	[0136.395] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.395] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73596fd2, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x73596fd2, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x73596fd2, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0136.395] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.395] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.395] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57555c84, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x57555c84, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x13985000, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x5b000, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="System.Printing.dll", cAlternateFileName="")) returned 1
	[0136.396] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.396] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="System.Printing.dll") returned -1
	[0136.396] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="System.Printing.dll") returned -1
	[0136.396] lstrcmpiA (lpString1="", lpString2="System.Printing.dll") returned -1
	[0136.396] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\System.Printing\\3.0.0.0__31bf3856ad364e35\\*.*") returned="*.*"
	[0136.396] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_32\\System.Printing\\3.0.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\System.Printing\\3.0.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_32\\System.Printing\\3.0.0.0__31bf3856ad364e35\\"
	[0136.396] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_32\\System.Printing\\3.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_32\\System.Printing\\3.0.0.0__31bf3856ad364e35\\") returned=""
	[0136.396] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Printing\\3.0.0.0__31bf3856ad364e35\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\system.printing\\3.0.0.0__31bf3856ad364e35\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.396] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Printing\\3.0.0.0__31bf3856ad364e35\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\system.printing\\3.0.0.0__31bf3856ad364e35\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0136.400] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.400] CloseHandle (hObject=0x214) returned 1
	[0136.400] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57555c84, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x57555c84, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x13985000, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x5b000, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="System.Printing.dll", cAlternateFileName="")) returned 0
	[0136.400] FindClose (in: hFindFile=0x7cbad0 | out: hFindFile=0x7cbad0) returned 1
	[0136.400] FindNextFileA (in: hFindFile=0x7cb790, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73596fd2, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x73596fd2, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x73596fd2, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.0.0.0__31bf3856ad364e35", cAlternateFileName="300~1.0__")) returned 0
	[0136.400] FindClose (in: hFindFile=0x7cb790 | out: hFindFile=0x7cb790) returned 1
	[0136.400] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736ee56c, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736ee56c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736ee56c, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="System.Transactions", cAlternateFileName="SYSTEM~1.TRA")) returned 1
	[0136.400] lstrcmpA (lpString1=".", lpString2="System.Transactions") returned -1
	[0136.400] lstrcmpA (lpString1="..", lpString2="System.Transactions") returned -1
	[0136.400] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\*.*") returned="*.*"
	[0136.400] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Transactions\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736ee56c, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736ee56c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736ee56c, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbb90
	[0136.401] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.401] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736ee56c, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736ee56c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736ee56c, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.401] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.401] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.401] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736ee56c, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736ee56c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736ee56c, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.0.0__b77a5c561934e089", cAlternateFileName="200~1.0__")) returned 1
	[0136.401] lstrcmpA (lpString1=".", lpString2="2.0.0.0__b77a5c561934e089") returned -1
	[0136.401] lstrcmpA (lpString1="..", lpString2="2.0.0.0__b77a5c561934e089") returned -1
	[0136.401] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\System.Transactions\\*.*") returned="*.*"
	[0136.401] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736ee56c, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736ee56c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736ee56c, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb690
	[0136.401] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.401] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736ee56c, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736ee56c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736ee56c, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.401] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.401] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.401] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57555c84, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x57555c84, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xcaa15c00, ftLastWriteTime.dwHighDateTime=0x1d29451, nFileSizeHigh=0x0, nFileSizeLow=0x3fe00, dwReserved0=0x4, dwReserved1=0x0, cFileName="System.Transactions.dll", cAlternateFileName="")) returned 1
	[0136.401] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.401] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="System.Transactions.dll") returned -1
	[0136.401] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="System.Transactions.dll") returned -1
	[0136.401] lstrcmpiA (lpString1="", lpString2="System.Transactions.dll") returned -1
	[0136.401] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\*.*") returned="*.*"
	[0136.401] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\"
	[0136.401] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\") returned=""
	[0136.401] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\system.transactions\\2.0.0.0__b77a5c561934e089\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.401] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\system.transactions\\2.0.0.0__b77a5c561934e089\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0136.403] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.403] CloseHandle (hObject=0x214) returned 1
	[0136.404] FindNextFileA (in: hFindFile=0x7cb690, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57555c84, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x57555c84, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xcaa15c00, ftLastWriteTime.dwHighDateTime=0x1d29451, nFileSizeHigh=0x0, nFileSizeLow=0x3fe00, dwReserved0=0x4, dwReserved1=0x0, cFileName="System.Transactions.dll", cAlternateFileName="")) returned 0
	[0136.404] FindClose (in: hFindFile=0x7cb690 | out: hFindFile=0x7cb690) returned 1
	[0136.404] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736ee56c, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736ee56c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736ee56c, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.0.0__b77a5c561934e089", cAlternateFileName="200~1.0__")) returned 0
	[0136.404] FindClose (in: hFindFile=0x7cbb90 | out: hFindFile=0x7cbb90) returned 1
	[0136.404] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736ee56c, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736ee56c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736ee56c, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="System.Web", cAlternateFileName="")) returned 1
	[0136.404] lstrcmpA (lpString1=".", lpString2="System.Web") returned -1
	[0136.404] lstrcmpA (lpString1="..", lpString2="System.Web") returned -1
	[0136.404] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\*.*") returned="*.*"
	[0136.404] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Web\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736ee56c, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736ee56c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736ee56c, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb7d0
	[0136.404] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.404] FindNextFileA (in: hFindFile=0x7cb7d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736ee56c, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736ee56c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736ee56c, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.404] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.404] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.404] FindNextFileA (in: hFindFile=0x7cb7d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736ee56c, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736ee56c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736ee56c, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="200~1.0__")) returned 1
	[0136.404] lstrcmpA (lpString1=".", lpString2="2.0.0.0__b03f5f7f11d50a3a") returned -1
	[0136.404] lstrcmpA (lpString1="..", lpString2="2.0.0.0__b03f5f7f11d50a3a") returned -1
	[0136.404] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\System.Web\\*.*") returned="*.*"
	[0136.404] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Web\\2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736ee56c, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736ee56c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736ee56c, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cb910
	[0136.404] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.405] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736ee56c, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736ee56c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736ee56c, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0136.405] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.405] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.405] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57555c84, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x57555c84, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xcaa15c00, ftLastWriteTime.dwHighDateTime=0x1d29451, nFileSizeHigh=0x0, nFileSizeLow=0x50b000, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="System.Web.dll", cAlternateFileName="")) returned 1
	[0136.405] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.405] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="System.Web.dll") returned -1
	[0136.405] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="System.Web.dll") returned -1
	[0136.405] lstrcmpiA (lpString1="", lpString2="System.Web.dll") returned -1
	[0136.405] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_32\\System.Web\\2.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*"
	[0136.405] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_32\\System.Web\\2.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_32\\System.Web\\2.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_32\\System.Web\\2.0.0.0__b03f5f7f11d50a3a\\"
	[0136.405] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_32\\System.Web\\2.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_32\\System.Web\\2.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.405] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Web\\2.0.0.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\system.web\\2.0.0.0__b03f5f7f11d50a3a\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.405] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Web\\2.0.0.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_32\\system.web\\2.0.0.0__b03f5f7f11d50a3a\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0136.406] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.406] CloseHandle (hObject=0x214) returned 1
	[0136.407] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57555c84, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x57555c84, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xcaa15c00, ftLastWriteTime.dwHighDateTime=0x1d29451, nFileSizeHigh=0x0, nFileSizeLow=0x50b000, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="System.Web.dll", cAlternateFileName="")) returned 0
	[0136.407] FindClose (in: hFindFile=0x7cb910 | out: hFindFile=0x7cb910) returned 1
	[0136.407] FindNextFileA (in: hFindFile=0x7cb7d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736ee56c, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736ee56c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736ee56c, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="200~1.0__")) returned 0
	[0136.407] FindClose (in: hFindFile=0x7cb7d0 | out: hFindFile=0x7cb7d0) returned 1
	[0136.407] FindNextFileA (in: hFindFile=0x7cb5d0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736ee56c, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736ee56c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736ee56c, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="System.Web", cAlternateFileName="")) returned 0
	[0136.407] FindClose (in: hFindFile=0x7cb5d0 | out: hFindFile=0x7cb5d0) returned 1
	[0136.407] FindNextFileA (in: hFindFile=0x7cb590, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x736ee56c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736ee56c, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GAC_64", cAlternateFileName="")) returned 1
	[0136.407] lstrcmpA (lpString1=".", lpString2="GAC_64") returned -1
	[0136.407] lstrcmpA (lpString1="..", lpString2="GAC_64") returned -1
	[0136.407] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\*.*") returned="*.*"
	[0136.407] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x736ee56c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736ee56c, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cbb90
	[0136.408] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.408] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x736ee56c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736ee56c, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0136.408] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.408] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.408] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7362f993, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x7362f993, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7362f993, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="CustomMarshalers", cAlternateFileName="CUSTOM~1")) returned 1
	[0136.408] lstrcmpA (lpString1=".", lpString2="CustomMarshalers") returned -1
	[0136.408] lstrcmpA (lpString1="..", lpString2="CustomMarshalers") returned -1
	[0136.408] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_64\\*.*") returned="*.*"
	[0136.408] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\CustomMarshalers\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7362f993, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x7362f993, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7362f993, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cbc50
	[0136.409] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.409] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7362f993, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x7362f993, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7362f993, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0136.409] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.409] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.409] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7362f993, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x7362f993, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7362f993, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="2.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="200~1.0__")) returned 1
	[0136.409] lstrcmpA (lpString1=".", lpString2="2.0.0.0__b03f5f7f11d50a3a") returned -1
	[0136.409] lstrcmpA (lpString1="..", lpString2="2.0.0.0__b03f5f7f11d50a3a") returned -1
	[0136.409] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_64\\CustomMarshalers\\*.*") returned="*.*"
	[0136.409] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7362f993, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x7362f993, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7362f993, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cb650
	[0136.409] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.409] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7362f993, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x7362f993, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7362f993, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0136.409] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.409] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.409] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510003b4, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x510003b4, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xf8e96600, ftLastWriteTime.dwHighDateTime=0x1d29f3e, nFileSizeHigh=0x0, nFileSizeLow=0x13c00, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="CustomMarshalers.dll", cAlternateFileName="")) returned 1
	[0136.409] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.409] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="CustomMarshalers.dll") returned 1
	[0136.409] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="CustomMarshalers.dll") returned 1
	[0136.409] lstrcmpiA (lpString1="", lpString2="CustomMarshalers.dll") returned -1
	[0136.409] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_64\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_64\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.409] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_64\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_64\\custommarshalers\\2.0.0.0__b03f5f7f11d50a3a\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.410] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_64\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_64\\custommarshalers\\2.0.0.0__b03f5f7f11d50a3a\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0136.411] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.411] CloseHandle (hObject=0x214) returned 1
	[0136.411] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510003b4, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x510003b4, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xf8e96600, ftLastWriteTime.dwHighDateTime=0x1d29f3e, nFileSizeHigh=0x0, nFileSizeLow=0x13c00, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="CustomMarshalers.dll", cAlternateFileName="")) returned 0
	[0136.411] FindClose (in: hFindFile=0x7cb650 | out: hFindFile=0x7cb650) returned 1
	[0136.417] FindNextFileA (in: hFindFile=0x7cbc50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7362f993, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x7362f993, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7362f993, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="2.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="200~1.0__")) returned 0
	[0136.417] FindClose (in: hFindFile=0x7cbc50 | out: hFindFile=0x7cbc50) returned 1
	[0136.417] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736a20bf, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736a20bf, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736a20bf, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="ISymWrapper", cAlternateFileName="ISYMWR~1")) returned 1
	[0136.417] lstrcmpA (lpString1=".", lpString2="ISymWrapper") returned -1
	[0136.417] lstrcmpA (lpString1="..", lpString2="ISymWrapper") returned -1
	[0136.417] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\ISymWrapper\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736a20bf, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736a20bf, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736a20bf, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbad0
	[0136.418] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.418] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736a20bf, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736a20bf, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736a20bf, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.418] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.418] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.418] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736a20bf, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736a20bf, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736a20bf, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="200~1.0__")) returned 1
	[0136.418] lstrcmpA (lpString1=".", lpString2="2.0.0.0__b03f5f7f11d50a3a") returned -1
	[0136.418] lstrcmpA (lpString1="..", lpString2="2.0.0.0__b03f5f7f11d50a3a") returned -1
	[0136.418] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\ISymWrapper\\2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736a20bf, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736a20bf, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736a20bf, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cb650
	[0136.418] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.418] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736a20bf, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736a20bf, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736a20bf, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0136.418] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.418] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.418] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510003b4, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x510003b4, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xfa1a9300, ftLastWriteTime.dwHighDateTime=0x1d29f3e, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="ISymWrapper.dll", cAlternateFileName="")) returned 1
	[0136.418] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.418] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="ISymWrapper.dll") returned -1
	[0136.418] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="ISymWrapper.dll") returned -1
	[0136.418] lstrcmpiA (lpString1="", lpString2="ISymWrapper.dll") returned -1
	[0136.418] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_64\\ISymWrapper\\2.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_64\\ISymWrapper\\2.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.419] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_64\\ISymWrapper\\2.0.0.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_64\\isymwrapper\\2.0.0.0__b03f5f7f11d50a3a\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.419] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_64\\ISymWrapper\\2.0.0.0__b03f5f7f11d50a3a\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_64\\isymwrapper\\2.0.0.0__b03f5f7f11d50a3a\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0136.420] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.420] CloseHandle (hObject=0x214) returned 1
	[0136.420] FindNextFileA (in: hFindFile=0x7cb650, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510003b4, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x510003b4, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xfa1a9300, ftLastWriteTime.dwHighDateTime=0x1d29f3e, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="ISymWrapper.dll", cAlternateFileName="")) returned 0
	[0136.420] FindClose (in: hFindFile=0x7cb650 | out: hFindFile=0x7cb650) returned 1
	[0136.420] FindNextFileA (in: hFindFile=0x7cbad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x736a20bf, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x736a20bf, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x736a20bf, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="200~1.0__")) returned 0
	[0136.421] FindClose (in: hFindFile=0x7cbad0 | out: hFindFile=0x7cbad0) returned 1
	[0136.421] FindNextFileA (in: hFindFile=0x7cbb90, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21df98e7, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd537ea9f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21df98e7, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.Ink", cAlternateFileName="MICROS~1.INK")) returned 1
	[0136.421] lstrcmpA (lpString1=".", lpString2="Microsoft.Ink") returned -1
	[0136.421] lstrcmpA (lpString1="..", lpString2="Microsoft.Ink") returned -1
	[0136.421] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft.Ink\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21df98e7, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd537ea9f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21df98e7, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890
	[0136.421] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.421] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21df98e7, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd537ea9f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21df98e7, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0136.421] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.421] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0136.421] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21df98e7, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd537f424, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x76b7cd4d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6.1.0.0__31bf3856ad364e35", cAlternateFileName="610~1.0__")) returned 1
	[0136.421] lstrcmpA (lpString1=".", lpString2="6.1.0.0__31bf3856ad364e35") returned -1
	[0136.421] lstrcmpA (lpString1="..", lpString2="6.1.0.0__31bf3856ad364e35") returned -1
	[0136.421] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21df98e7, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd537f424, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x76b7cd4d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7cb910
	[0136.421] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0136.421] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21df98e7, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd537f424, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x76b7cd4d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1
	[0136.421] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0136.421] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463d4edd, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xc2004e62, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463d4edd, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x7b000, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1
	[0136.421] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.421] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft.Ink.dll") returned -1
	[0136.422] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft.Ink.dll") returned -1
	[0136.422] lstrcmpiA (lpString1="", lpString2="Microsoft.Ink.dll") returned -1
	[0136.422] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_64\\Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_64\\Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\") returned=""
	[0136.422] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_64\\microsoft.ink\\6.1.0.0__31bf3856ad364e35\\how-to-decrypt-files.htm")) returned 0xffffffff
	[0136.422] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\HOW-TO-DECRYPT-FILES.HTM" (normalized: "c:\\windows\\assembly\\gac_64\\microsoft.ink\\6.1.0.0__31bf3856ad364e35\\how-to-decrypt-files.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0136.424] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.424] CloseHandle (hObject=0x214) returned 1
	[0136.424] FindNextFileA (in: hFindFile=0x7cb910, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463d4edd, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xc2004e62, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463d4edd, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x7b000, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 0
	[0136.424] FindClose (in: hFindFile=0x7cb910 | out: hFindFile=0x7cb910) returned 1
	[0136.424] FindNextFileA (in: hFindFile=0x7cb890, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21df98e7, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd537f424, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x76b7cd4d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6.1.0.0__31bf3856ad364e35", cAlternateFileName="610~1.0__")) returned 0
	[0136.424] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1
	[0136.426] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.426] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft.Interop.Security.AzRoles.dll") returned -1
	[0136.426] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft.Interop.Security.AzRoles.dll") returned -1
	[0136.426] lstrcmpiA (lpString1="", lpString2="Microsoft.Interop.Security.AzRoles.dll") returned -1
	[0136.426] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_64\\Microsoft.Interop.Security.AzRoles\\2.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_64\\Microsoft.Interop.Security.AzRoles\\2.0.0.0__31bf3856ad364e35\\") returned=""
	[0136.429] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.429] CloseHandle (hObject=0x214) returned 1
	[0136.432] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.432] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="Microsoft.Transactions.Bridge.Dtc.dll") returned -1
	[0136.432] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="Microsoft.Transactions.Bridge.Dtc.dll") returned -1
	[0136.432] lstrcmpiA (lpString1="", lpString2="Microsoft.Transactions.Bridge.Dtc.dll") returned -1
	[0136.432] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_64\\Microsoft.Transactions.Bridge.Dtc\\3.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_64\\Microsoft.Transactions.Bridge.Dtc\\3.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.434] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0136.434] CloseHandle (hObject=0x214) returned 1
	[0136.437] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.437] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="MSBuild.exe") returned -1
	[0136.437] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="MSBuild.exe") returned -1
	[0136.438] lstrcmpiA (lpString1="", lpString2="MSBuild.exe") returned -1
	[0136.438] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_64\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_64\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.441] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.441] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="msbuild.exe.config") returned -1
	[0136.441] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="msbuild.exe.config") returned -1
	[0136.441] lstrcmpiA (lpString1="", lpString2="msbuild.exe.config") returned -1
	[0136.441] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_64\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_64\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.443] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.443] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="big5.nlp") returned 1
	[0136.443] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="big5.nlp") returned 1
	[0136.443] lstrcmpiA (lpString1="", lpString2="big5.nlp") returned -1
	[0136.443] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned=""
	[0136.444] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.444] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="bopomofo.nlp") returned 1
	[0136.444] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="bopomofo.nlp") returned 1
	[0136.444] lstrcmpiA (lpString1="", lpString2="bopomofo.nlp") returned -1
	[0136.444] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned=""
	[0136.444] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.444] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="ksc.nlp") returned -1
	[0136.444] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="ksc.nlp") returned -1
	[0136.444] lstrcmpiA (lpString1="", lpString2="ksc.nlp") returned -1
	[0136.444] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned=""
	[0136.445] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.445] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="mscorlib.dll") returned -1
	[0136.445] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="mscorlib.dll") returned -1
	[0136.445] lstrcmpiA (lpString1="", lpString2="mscorlib.dll") returned -1
	[0136.445] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned=""
	[0136.445] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.445] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="normidna.nlp") returned -1
	[0136.445] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="normidna.nlp") returned -1
	[0136.445] lstrcmpiA (lpString1="", lpString2="normidna.nlp") returned -1
	[0136.445] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned=""
	[0136.445] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.445] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="normnfc.nlp") returned -1
	[0136.445] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="normnfc.nlp") returned -1
	[0136.445] lstrcmpiA (lpString1="", lpString2="normnfc.nlp") returned -1
	[0136.446] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned=""
	[0136.446] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.446] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="normnfd.nlp") returned -1
	[0136.446] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="normnfd.nlp") returned -1
	[0136.446] lstrcmpiA (lpString1="", lpString2="normnfd.nlp") returned -1
	[0136.446] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned=""
	[0136.446] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.446] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="normnfkc.nlp") returned -1
	[0136.446] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="normnfkc.nlp") returned -1
	[0136.446] lstrcmpiA (lpString1="", lpString2="normnfkc.nlp") returned -1
	[0136.446] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned=""
	[0136.446] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.446] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="normnfkd.nlp") returned -1
	[0136.446] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="normnfkd.nlp") returned -1
	[0136.446] lstrcmpiA (lpString1="", lpString2="normnfkd.nlp") returned -1
	[0136.446] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned=""
	[0136.446] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.446] lstrcmpiA (lpString1="\xca\xc0\xca\x2d\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x2d\xd4\xc0\xc9\xcb\xdb\x2e\x48\x54\x4d", lpString2="prc.nlp") returned -1
	[0136.447] lstrcmpiA (lpString1="HOW-TO-DECRYPT-FILES.HTM", lpString2="prc.nlp") returned -1
	[0136.447] lstrcmpiA (lpString1="", lpString2="prc.nlp") returned -1
	[0136.447] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned=""
	[0136.447] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.447] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned=""
	[0136.447] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.447] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned=""
	[0136.447] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.447] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned=""
	[0136.447] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.447] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\") returned=""
	[0136.448] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.448] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_64\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_64\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\") returned=""
	[0136.451] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.451] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_64\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_64\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\") returned=""
	[0136.451] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.451] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_64\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_64\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\") returned=""
	[0136.452] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.452] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_64\\srmlib\\1.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_64\\srmlib\\1.0.0.0__31bf3856ad364e35\\") returned=""
	[0136.453] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.453] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_64\\System.Data\\2.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_64\\System.Data\\2.0.0.0__b77a5c561934e089\\") returned=""
	[0136.455] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.455] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_64\\System.Data.OracleClient\\2.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_64\\System.Data.OracleClient\\2.0.0.0__b77a5c561934e089\\") returned=""
	[0136.457] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.457] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_64\\System.EnterpriseServices\\2.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_64\\System.EnterpriseServices\\2.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.460] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.460] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_64\\System.EnterpriseServices\\2.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_64\\System.EnterpriseServices\\2.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.461] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.461] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_64\\System.Printing\\3.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_64\\System.Printing\\3.0.0.0__31bf3856ad364e35\\") returned=""
	[0136.462] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.462] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_64\\System.Transactions\\2.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_64\\System.Transactions\\2.0.0.0__b77a5c561934e089\\") returned=""
	[0136.464] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.464] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_64\\System.Web\\2.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_64\\System.Web\\2.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.469] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.469] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Accessibility\\2.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Accessibility\\2.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.470] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.471] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\AspNetMMCExt\\2.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\AspNetMMCExt\\2.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.472] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.472] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\ComSvcConfig\\3.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\ComSvcConfig\\3.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.474] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.474] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\cscompmgd\\8.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\cscompmgd\\8.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.477] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.477] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\dfsvc\\2.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\dfsvc\\2.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.479] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.479] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\IEExecRemote\\2.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\IEExecRemote\\2.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.480] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.480] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\IEHost\\2.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\IEHost\\2.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.482] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.482] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\IIEHost\\2.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\IIEHost\\2.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.484] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.484] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Build.Conversion.v3.5\\3.5.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Build.Conversion.v3.5\\3.5.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.490] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.490] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Build.Engine\\2.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Build.Engine\\2.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.493] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.493] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Build.Engine\\3.5.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Build.Engine\\3.5.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.495] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.495] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Build.Framework\\2.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Build.Framework\\2.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.497] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.497] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Build.Framework\\3.5.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Build.Framework\\3.5.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.499] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.499] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Build.Tasks\\2.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Build.Tasks\\2.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.501] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.501] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Build.Tasks.v3.5\\3.5.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Build.Tasks.v3.5\\3.5.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.502] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.502] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Build.Utilities\\2.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Build.Utilities\\2.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.505] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.505] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Build.Utilities.v3.5\\3.5.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Build.Utilities.v3.5\\3.5.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.507] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.507] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Ink.Resources\\6.1.0.0_en_31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Ink.Resources\\6.1.0.0_en_31bf3856ad364e35\\") returned=""
	[0136.509] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.509] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.JScript\\8.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.JScript\\8.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.510] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.510] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.ManagementConsole\\3.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.ManagementConsole\\3.0.0.0__31bf3856ad364e35\\") returned=""
	[0136.512] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.512] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.ManagementConsole.Resources\\3.0.0.0_en_31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.ManagementConsole.Resources\\3.0.0.0_en_31bf3856ad364e35\\") returned=""
	[0136.514] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.514] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Interop.Access\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Interop.Access\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.516] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.516] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Interop.Access.Dao\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Interop.Access.Dao\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.518] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.518] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Interop.Excel\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Interop.Excel\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.520] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.520] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Interop.Graph\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Interop.Graph\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.522] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.522] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Interop.MSProject\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Interop.MSProject\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.524] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.524] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Interop.OneNote\\12.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Interop.OneNote\\12.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.526] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.526] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Interop.OneNote\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Interop.OneNote\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.528] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.528] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Interop.Outlook\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Interop.Outlook\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.530] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.530] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Interop.OutlookViewCtl\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Interop.OutlookViewCtl\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.534] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.534] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Interop.PowerPoint\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Interop.PowerPoint\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.537] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.539] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Interop.Publisher\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Interop.Publisher\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.541] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.541] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Interop.SmartTag\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Interop.SmartTag\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.543] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.543] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Interop.Visio\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Interop.Visio\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.545] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.545] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Interop.Visio.SaveAsWeb\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Interop.Visio.SaveAsWeb\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.549] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.549] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Interop.VisOcx\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Interop.VisOcx\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.551] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.551] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Interop.Word\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Interop.Word\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.553] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.553] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Tools.Common.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Tools.Common.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.555] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.555] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Tools.Excel.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Tools.Excel.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.556] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.557] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Tools.Outlook.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Tools.Outlook.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.558] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.558] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Tools.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Tools.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.560] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.560] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Tools.Word.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.Tools.Word.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.562] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.562] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\") returned=""
	[0136.564] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.564] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics.Resources\\1.0.0.0_en_31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics.Resources\\1.0.0.0_en_31bf3856ad364e35\\") returned=""
	[0136.566] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.566] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\") returned=""
	[0136.568] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.569] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\") returned=""
	[0136.617] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.617] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\") returned=""
	[0136.619] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.619] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility.Resources\\1.0.0.0_en_31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility.Resources\\1.0.0.0_en_31bf3856ad364e35\\") returned=""
	[0136.621] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.621] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\") returned=""
	[0136.626] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.626] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\") returned=""
	[0136.627] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.627] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\") returned=""
	[0136.628] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.628] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security.Resources\\1.0.0.0_en_31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security.Resources\\1.0.0.0_en_31bf3856ad364e35\\") returned=""
	[0136.630] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.631] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Transactions.Bridge\\3.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Transactions.Bridge\\3.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.632] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.632] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vbe.Interop\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vbe.Interop\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.635] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.635] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vbe.Interop.Forms\\11.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vbe.Interop.Forms\\11.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.637] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.637] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\8.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\8.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.639] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.639] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualBasic.Compatibility\\8.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualBasic.Compatibility\\8.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.640] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.640] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualBasic.Compatibility.Data\\8.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualBasic.Compatibility.Data\\8.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.643] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.643] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualBasic.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualBasic.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.644] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.644] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualC\\8.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualC\\8.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.646] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.646] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualC.STLCLR\\1.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualC.STLCLR\\1.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.648] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.648] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.651] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.651] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.655] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.655] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.658] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.658] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.661] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.661] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.663] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.663] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.667] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.667] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.670] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.670] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.673] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.673] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.676] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.676] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.679] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.679] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.682] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.682] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.685] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.685] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.688] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.688] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.693] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.693] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.696] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.696] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.700] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.700] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.703] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.703] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.707] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.707] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.709] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.709] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.713] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.713] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.716] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.716] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.723] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.723] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.725] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.726] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.729] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.729] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.732] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.732] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.735] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.735] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.737] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.737] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.738] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.738] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\") returned=""
	[0136.740] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.740] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\") returned=""
	[0136.742] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.742] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\") returned=""
	[0136.744] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.744] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\") returned=""
	[0136.746] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.746] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\") returned=""
	[0136.748] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.748] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\") returned=""
	[0136.750] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.750] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\") returned=""
	[0136.752] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.752] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\") returned=""
	[0136.753] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.754] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\office\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\office\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.757] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.757] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.759] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.759] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.763] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.763] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.764] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.764] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.766] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.766] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.768] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.768] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.769] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.769] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.771] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.771] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.773] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.773] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.775] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.775] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.777] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.777] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.779] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.779] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.780] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.780] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.782] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.782] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.784] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.784] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.786] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.786] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.787] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.787] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.789] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.789] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.791] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.791] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.792] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.792] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.794] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.794] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.795] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.795] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.797] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.797] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.799] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.799] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.800] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.801] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.802] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.802] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.804] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.804] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.806] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.806] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.807] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.807] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0136.931] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0136.932] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0137.097] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0137.097] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0137.099] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0137.099] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0137.101] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0137.101] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0137.102] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0137.105] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0137.106] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0137.106] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0137.111] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0137.111] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0137.112] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0137.112] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0137.114] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0137.114] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0137.120] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0137.120] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0137.122] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0137.122] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0137.123] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0137.123] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0137.124] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0137.124] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0137.126] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0137.126] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0137.128] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0137.128] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0137.131] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0137.131] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0137.133] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0137.133] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0137.136] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0137.136] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0137.137] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0137.137] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0137.138] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0137.138] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0137.140] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0137.140] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0137.142] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0137.142] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0137.144] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0137.144] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0137.146] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0
	[0137.146] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\15.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\15.0.0.0__71e9bce111e9429c\\") returned=""
	[0152.652] SetFileTime (hFile=0x218, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0152.653] CloseHandle (hObject=0x218) returned 1
	[0152.783] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\ApplicationConfigurationPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\app_code\\applicationconfigurationpage.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\ApplicationConfigurationPage.cs.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\app_code\\applicationconfigurationpage.cs.exe")) returned 1
	[0152.786] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\app_code\\navigationbar.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\app_code\\navigationbar.cs.exe")) returned 1
	[0152.792] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\app_code\\passwordvaluetextbox.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\app_code\\passwordvaluetextbox.cs.exe")) returned 1
	[0152.795] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\app_code\\providerspage.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\app_code\\providerspage.cs.exe")) returned 1
	[0152.798] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\app_code\\securitypage.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\app_code\\securitypage.cs.exe")) returned 1
	[0152.801] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\app_code\\webadminpage.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\app_code\\webadminpage.cs.exe")) returned 1
	[0152.804] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\app_code\\wizardpage.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\app_code\\wizardpage.cs.exe")) returned 1
	[0152.827] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\alert_lrg.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\alert_lrg.gif.exe")) returned 1
	[0152.831] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg.exe")) returned 1
	[0152.834] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\aspx_file.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\aspx_file.gif.exe")) returned 1
	[0152.837] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\branding_full2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\branding_full2.gif.exe")) returned 1
	[0152.839] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\darkblue_grad.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\darkblue_grad.jpg.exe")) returned 1
	[0152.841] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif.exe")) returned 1
	[0152.852] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\folder.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\folder.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\folder.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\folder.gif.exe")) returned 1
	[0152.877] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onblue.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onblue.gif.exe")) returned 1
	[0152.881] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onwhite.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onwhite.gif.exe")) returned 1
	[0152.884] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\headergradient_tall.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\headergradient_tall.gif.exe")) returned 1
	[0152.887] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\help.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\help.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\help.jpg.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\help.jpg.exe")) returned 1
	[0152.890] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\helpicon_solid.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\helpicon_solid.gif.exe")) returned 1
	[0152.893] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\image1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image1.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\image1.gif.exe")) returned 1
	[0152.900] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image2.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\image2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image2.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\image2.gif.exe")) returned 1
	[0152.903] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\requiredbang.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\requiredbang.gif.exe")) returned 1
	[0152.904] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\security_watermark.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\security_watermark.jpg.exe")) returned 1
	[0152.905] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif.exe")) returned 1
	[0152.907] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif.exe")) returned 1
	[0152.908] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif.exe")) returned 1
	[0152.911] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\topgradrepeat.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\topgradrepeat.jpg.exe")) returned 1
	[0152.912] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif.exe")) returned 1
	[0152.914] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif.exe")) returned 1
	[0152.917] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\yellowcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\yellowcorner.gif.exe")) returned 1
	[0153.079] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ApplicationConfigurationPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\applicationconfigurationpage.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ApplicationConfigurationPage.cs.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\applicationconfigurationpage.cs.exe")) returned 1
	[0153.083] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\navigationbar.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\navigationbar.cs.exe")) returned 1
	[0153.087] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\passwordvaluetextbox.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\passwordvaluetextbox.cs.exe")) returned 1
	[0153.090] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\providerspage.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\providerspage.cs.exe")) returned 1
	[0153.093] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\securitypage.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\securitypage.cs.exe")) returned 1
	[0153.096] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\webadminpage.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\webadminpage.cs.exe")) returned 1
	[0153.099] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\wizardpage.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\wizardpage.cs.exe")) returned 1
	[0153.163] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\alert_lrg.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\alert_lrg.gif.exe")) returned 1
	[0153.168] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg.exe")) returned 1
	[0153.171] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\aspx_file.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\aspx_file.gif.exe")) returned 1
	[0153.174] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\branding_full2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\branding_full2.gif.exe")) returned 1
	[0153.177] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\darkblue_grad.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\darkblue_grad.jpg.exe")) returned 1
	[0153.179] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif.exe")) returned 1
	[0153.183] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\folder.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\folder.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\folder.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\folder.gif.exe")) returned 1
	[0153.186] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onblue.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onblue.gif.exe")) returned 1
	[0153.189] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onwhite.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onwhite.gif.exe")) returned 1
	[0153.191] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\headergradient_tall.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\headergradient_tall.gif.exe")) returned 1
	[0153.196] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\help.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\help.jpg.exe")) returned 1
	[0153.199] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\helpicon_solid.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\helpicon_solid.gif.exe")) returned 1
	[0153.202] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\image1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image1.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\image1.gif.exe")) returned 1
	[0153.204] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image2.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\image2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image2.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\image2.gif.exe")) returned 1
	[0153.207] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\requiredbang.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\requiredbang.gif.exe")) returned 1
	[0153.209] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\security_watermark.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\security_watermark.jpg.exe")) returned 1
	[0153.210] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif.exe")) returned 1
	[0153.212] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif.exe")) returned 1
	[0153.213] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif.exe")) returned 1
	[0153.217] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\topgradrepeat.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\topgradrepeat.jpg.exe")) returned 1
	[0153.219] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif.exe")) returned 1
	[0153.221] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif.exe")) returned 1
	[0153.224] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\yellowcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\yellowcorner.gif.exe")) returned 1
	[0153.387] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\ApplicationConfigurationPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\app_code\\applicationconfigurationpage.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\ApplicationConfigurationPage.cs.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\app_code\\applicationconfigurationpage.cs.exe")) returned 1
	[0153.391] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\app_code\\navigationbar.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\app_code\\navigationbar.cs.exe")) returned 1
	[0153.394] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\app_code\\passwordvaluetextbox.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\app_code\\passwordvaluetextbox.cs.exe")) returned 1
	[0153.397] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\app_code\\providerspage.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\app_code\\providerspage.cs.exe")) returned 1
	[0153.400] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\app_code\\securitypage.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\app_code\\securitypage.cs.exe")) returned 1
	[0153.403] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\app_code\\webadminpage.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\app_code\\webadminpage.cs.exe")) returned 1
	[0153.407] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\app_code\\wizardpage.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\app_code\\wizardpage.cs.exe")) returned 1
	[0153.425] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\alert_lrg.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\alert_lrg.gif.exe")) returned 1
	[0153.426] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\alert_sml.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\alert_sml.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\alert_sml.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\alert_sml.gif.exe")) returned 1
	[0153.430] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg.exe")) returned 1
	[0153.433] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\aspx_file.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\aspx_file.gif.exe")) returned 1
	[0153.436] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\branding_full2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\branding_full2.gif.exe")) returned 1
	[0153.439] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\darkblue_grad.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\darkblue_grad.jpg.exe")) returned 1
	[0153.440] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif.exe")) returned 1
	[0153.444] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\folder.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\folder.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\folder.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\folder.gif.exe")) returned 1
	[0153.447] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onblue.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onblue.gif.exe")) returned 1
	[0153.450] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onwhite.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onwhite.gif.exe")) returned 1
	[0153.453] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\headergradient_tall.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\headergradient_tall.gif.exe")) returned 1
	[0153.456] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\help.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\help.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\help.jpg.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\help.jpg.exe")) returned 1
	[0153.459] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\helpicon_solid.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\helpicon_solid.gif.exe")) returned 1
	[0153.462] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image1.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\image1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image1.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\image1.gif.exe")) returned 1
	[0153.464] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image2.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\image2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image2.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\image2.gif.exe")) returned 1
	[0153.467] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\requiredbang.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\requiredbang.gif.exe")) returned 1
	[0153.469] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\security_watermark.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\security_watermark.jpg.exe")) returned 1
	[0153.470] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif.exe")) returned 1
	[0153.472] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif.exe")) returned 1
	[0153.473] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif.exe")) returned 1
	[0153.476] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\topgradrepeat.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\topgradrepeat.jpg.exe")) returned 1
	[0153.479] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif.exe")) returned 1
	[0153.480] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif.exe")) returned 1
	[0153.483] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\yellowcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\yellowcorner.gif.exe")) returned 1
	[0153.797] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ApplicationConfigurationPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\app_code\\applicationconfigurationpage.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ApplicationConfigurationPage.cs.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\app_code\\applicationconfigurationpage.cs.exe")) returned 1
	[0153.800] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\app_code\\navigationbar.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\app_code\\navigationbar.cs.exe")) returned 1
	[0153.804] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\app_code\\passwordvaluetextbox.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\app_code\\passwordvaluetextbox.cs.exe")) returned 1
	[0153.807] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\app_code\\providerspage.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\app_code\\providerspage.cs.exe")) returned 1
	[0153.810] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\app_code\\securitypage.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\app_code\\securitypage.cs.exe")) returned 1
	[0153.815] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\app_code\\webadminpage.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\app_code\\webadminpage.cs.exe")) returned 1
	[0153.820] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\app_code\\wizardpage.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\app_code\\wizardpage.cs.exe")) returned 1
	[0153.837] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\alert_lrg.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\alert_lrg.gif.exe")) returned 1
	[0153.839] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_sml.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\alert_sml.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_sml.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\alert_sml.gif.exe")) returned 1
	[0153.843] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg.exe")) returned 1
	[0153.846] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\aspx_file.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\aspx_file.gif.exe")) returned 1
	[0153.849] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\branding_full2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\branding_full2.gif.exe")) returned 1
	[0153.853] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\darkblue_grad.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\darkblue_grad.jpg.exe")) returned 1
	[0153.854] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif.exe")) returned 1
	[0153.859] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\folder.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\folder.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\folder.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\folder.gif.exe")) returned 1
	[0153.861] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onblue.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onblue.gif.exe")) returned 1
	[0153.864] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onwhite.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onwhite.gif.exe")) returned 1
	[0153.866] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\headergradient_tall.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\headergradient_tall.gif.exe")) returned 1
	[0153.869] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\help.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\help.jpg.exe")) returned 1
	[0153.872] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\helpicon_solid.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\helpicon_solid.gif.exe")) returned 1
	[0153.874] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image1.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\image1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image1.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\image1.gif.exe")) returned 1
	[0153.877] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image2.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\image2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image2.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\image2.gif.exe")) returned 1
	[0153.879] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\requiredbang.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\requiredbang.gif.exe")) returned 1
	[0153.880] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\security_watermark.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\security_watermark.jpg.exe")) returned 1
	[0153.881] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif.exe")) returned 1
	[0153.882] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif.exe")) returned 1
	[0153.883] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif.exe")) returned 1
	[0153.886] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\topgradrepeat.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\topgradrepeat.jpg.exe")) returned 1
	[0153.887] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif.exe")) returned 1
	[0153.889] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif.exe")) returned 1
	[0153.893] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\yellowcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\yellowcorner.gif.exe")) returned 1
	[0154.355] MoveFileA (lpExistingFileName="C:\\Windows\\Prefetch\\AgAppLaunch.db" (normalized: "c:\\windows\\prefetch\\agapplaunch.db"), lpNewFileName="C:\\Windows\\Prefetch\\AgAppLaunch.db.exe" (normalized: "c:\\windows\\prefetch\\agapplaunch.db.exe")) returned 1
	[0154.360] MoveFileA (lpExistingFileName="C:\\Windows\\Prefetch\\AgCx_SC4.db" (normalized: "c:\\windows\\prefetch\\agcx_sc4.db"), lpNewFileName="C:\\Windows\\Prefetch\\AgCx_SC4.db.exe" (normalized: "c:\\windows\\prefetch\\agcx_sc4.db.exe")) returned 1
	[0154.366] MoveFileA (lpExistingFileName="C:\\Windows\\Prefetch\\AgCx_SC5.db" (normalized: "c:\\windows\\prefetch\\agcx_sc5.db"), lpNewFileName="C:\\Windows\\Prefetch\\AgCx_SC5.db.exe" (normalized: "c:\\windows\\prefetch\\agcx_sc5.db.exe")) returned 1
	[0154.375] MoveFileA (lpExistingFileName="C:\\Windows\\Prefetch\\AgGlFaultHistory.db" (normalized: "c:\\windows\\prefetch\\agglfaulthistory.db"), lpNewFileName="C:\\Windows\\Prefetch\\AgGlFaultHistory.db.exe" (normalized: "c:\\windows\\prefetch\\agglfaulthistory.db.exe")) returned 1
	[0154.391] MoveFileA (lpExistingFileName="C:\\Windows\\Prefetch\\AgGlFgAppHistory.db" (normalized: "c:\\windows\\prefetch\\agglfgapphistory.db"), lpNewFileName="C:\\Windows\\Prefetch\\AgGlFgAppHistory.db.exe" (normalized: "c:\\windows\\prefetch\\agglfgapphistory.db.exe")) returned 1
	[0154.425] MoveFileA (lpExistingFileName="C:\\Windows\\Prefetch\\AgGlGlobalHistory.db" (normalized: "c:\\windows\\prefetch\\agglglobalhistory.db"), lpNewFileName="C:\\Windows\\Prefetch\\AgGlGlobalHistory.db.exe" (normalized: "c:\\windows\\prefetch\\agglglobalhistory.db.exe")) returned 1
	[0154.431] MoveFileA (lpExistingFileName="C:\\Windows\\Prefetch\\AgGlUAD_P_S-1-5-21-1051304884-625712362-2192934891-1000.db" (normalized: "c:\\windows\\prefetch\\aggluad_p_s-1-5-21-1051304884-625712362-2192934891-1000.db"), lpNewFileName="C:\\Windows\\Prefetch\\AgGlUAD_P_S-1-5-21-1051304884-625712362-2192934891-1000.db.exe" (normalized: "c:\\windows\\prefetch\\aggluad_p_s-1-5-21-1051304884-625712362-2192934891-1000.db.exe")) returned 1
	[0154.443] MoveFileA (lpExistingFileName="C:\\Windows\\Prefetch\\AgGlUAD_S-1-5-21-1051304884-625712362-2192934891-1000.db" (normalized: "c:\\windows\\prefetch\\aggluad_s-1-5-21-1051304884-625712362-2192934891-1000.db"), lpNewFileName="C:\\Windows\\Prefetch\\AgGlUAD_S-1-5-21-1051304884-625712362-2192934891-1000.db.exe" (normalized: "c:\\windows\\prefetch\\aggluad_s-1-5-21-1051304884-625712362-2192934891-1000.db.exe")) returned 1
	[0154.471] MoveFileA (lpExistingFileName="C:\\Windows\\Prefetch\\AgRobust.db" (normalized: "c:\\windows\\prefetch\\agrobust.db"), lpNewFileName="C:\\Windows\\Prefetch\\AgRobust.db.exe" (normalized: "c:\\windows\\prefetch\\agrobust.db.exe")) returned 1
	[0154.608] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk.exe")) returned 1
	[0154.617] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk.exe")) returned 1
	[0154.621] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk.exe")) returned 1
	[0154.624] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk.exe")) returned 1
	[0154.627] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk.exe")) returned 1
	[0154.630] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk.exe")) returned 1
	[0154.636] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk.exe")) returned 1
	[0154.639] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk.exe")) returned 1
	[0154.642] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk.exe")) returned 1
	[0154.645] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk.exe")) returned 1
	[0154.648] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk.exe")) returned 1
	[0154.651] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk.exe")) returned 1
	[0154.653] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - NetworkStatus.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - networkstatus.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - NetworkStatus.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - networkstatus.lnk.exe")) returned 1
	[0154.656] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk.exe")) returned 1
	[0154.660] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - SystemAbout.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - systemabout.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - SystemAbout.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - systemabout.lnk.exe")) returned 1
	[0154.663] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk.exe")) returned 1
	[0154.666] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - PowerAndSleep.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - powerandsleep.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - PowerAndSleep.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - powerandsleep.lnk.exe")) returned 1
	[0154.668] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk.exe")) returned 1
	[0154.672] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - AppsAndFeatures.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - appsandfeatures.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - AppsAndFeatures.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - appsandfeatures.lnk.exe")) returned 1
	[0154.687] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.exe")) returned 1
	[0154.690] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.exe")) returned 1
	[0154.704] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk.exe")) returned 1
	[0154.712] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk.exe")) returned 1
	[0154.715] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk.exe")) returned 1
	[0154.718] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk.exe")) returned 1
	[0154.722] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk.exe")) returned 1
	[0154.732] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk.exe")) returned 1
	[0154.736] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk.exe")) returned 1
	[0154.738] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk.exe")) returned 1
	[0154.741] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk.exe")) returned 1
	[0154.743] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk.exe")) returned 1
	[0154.750] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk.exe")) returned 1
	[0154.752] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk.exe")) returned 1
	[0154.755] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk.exe")) returned 1
	[0154.759] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk.exe")) returned 1
	[0154.775] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk.exe")) returned 1
	[0154.781] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk.exe")) returned 1
	[0154.819] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk.exe")) returned 1
	[0154.822] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk.exe")) returned 1
	[0154.825] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk.exe")) returned 1
	[0154.827] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk.exe")) returned 1
	[0154.833] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk.exe")) returned 1
	[0154.836] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk.exe")) returned 1
	[0154.839] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk.exe")) returned 1
	[0154.841] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk.exe")) returned 1
	[0154.844] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk.exe")) returned 1
	[0154.849] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk.exe")) returned 1
	[0154.852] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - NetworkStatus.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - networkstatus.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - NetworkStatus.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - networkstatus.lnk.exe")) returned 1
	[0154.855] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk.exe")) returned 1
	[0154.857] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - SystemAbout.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - systemabout.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - SystemAbout.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - systemabout.lnk.exe")) returned 1
	[0154.897] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk.exe")) returned 1
	[0154.901] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - PowerAndSleep.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - powerandsleep.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - PowerAndSleep.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - powerandsleep.lnk.exe")) returned 1
	[0154.904] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk.exe")) returned 1
	[0154.907] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - AppsAndFeatures.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - appsandfeatures.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - AppsAndFeatures.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - appsandfeatures.lnk.exe")) returned 1
	[0154.922] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.exe")) returned 1
	[0154.924] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.exe")) returned 1
	[0154.932] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk.exe")) returned 1
	[0154.991] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk.exe")) returned 1
	[0154.995] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk.exe")) returned 1
	[0154.997] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk.exe")) returned 1
	[0155.001] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk.exe")) returned 1
	[0155.013] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk.exe")) returned 1
	[0155.015] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk.exe")) returned 1
	[0155.017] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk.exe")) returned 1
	[0155.019] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk.exe")) returned 1
	[0155.022] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk.exe")) returned 1
	[0155.058] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk.exe")) returned 1
	[0155.061] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk.exe")) returned 1
	[0155.063] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk.exe")) returned 1
	[0155.066] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk.exe" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk.exe")) returned 1
	[0157.902] MoveFileA (lpExistingFileName="C:\\Windows\\Setup\\Scripts\\setupcomplete.cmd" (normalized: "c:\\windows\\setup\\scripts\\setupcomplete.cmd"), lpNewFileName="C:\\Windows\\Setup\\Scripts\\setupcomplete.cmd.exe" (normalized: "c:\\windows\\setup\\scripts\\setupcomplete.cmd.exe")) returned 1
	[0169.005] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_eventviewersettings_31bf3856ad364e35_10.0.15063.0_none_060bb1403c81dd6a\\Event Viewer.lnk" (normalized: "c:\\windows\\winsxs\\amd64_eventviewersettings_31bf3856ad364e35_10.0.15063.0_none_060bb1403c81dd6a\\event viewer.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_eventviewersettings_31bf3856ad364e35_10.0.15063.0_none_060bb1403c81dd6a\\Event Viewer.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_eventviewersettings_31bf3856ad364e35_10.0.15063.0_none_060bb1403c81dd6a\\event viewer.lnk.exe")) returned 0
	[0173.124] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.15063.0_none_ec056a6583c87c56\\Steps Recorder.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.15063.0_none_ec056a6583c87c56\\steps recorder.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.15063.0_none_ec056a6583c87c56\\Steps Recorder.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.15063.0_none_ec056a6583c87c56\\steps recorder.lnk.exe")) returned 0
	[0173.190] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.15063.0_none_bffab419244e0aae\\Task Manager.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.15063.0_none_bffab419244e0aae\\task manager.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.15063.0_none_bffab419244e0aae\\Task Manager.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.15063.0_none_bffab419244e0aae\\task manager.lnk.exe")) returned 0
	[0177.090] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-c..s-admin-compsvclink_31bf3856ad364e35_10.0.15063.0_none_e3a62b031347d52f\\Component Services.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-c..s-admin-compsvclink_31bf3856ad364e35_10.0.15063.0_none_e3a62b031347d52f\\component services.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-c..s-admin-compsvclink_31bf3856ad364e35_10.0.15063.0_none_e3a62b031347d52f\\Component Services.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-c..s-admin-compsvclink_31bf3856ad364e35_10.0.15063.0_none_e3a62b031347d52f\\component services.lnk.exe")) returned 0
	[0177.334] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-c..termanagementsnapin_31bf3856ad364e35_10.0.15063.0_none_5c29f964af25b39d\\Computer Management.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-c..termanagementsnapin_31bf3856ad364e35_10.0.15063.0_none_5c29f964af25b39d\\computer management.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-c..termanagementsnapin_31bf3856ad364e35_10.0.15063.0_none_5c29f964af25b39d\\Computer Management.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-c..termanagementsnapin_31bf3856ad364e35_10.0.15063.0_none_5c29f964af25b39d\\computer management.lnk.exe")) returned 0
	[0177.336] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-c..termanagementsnapin_31bf3856ad364e35_10.0.15063.608_none_e05ae487dc8303b1\\Computer Management.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-c..termanagementsnapin_31bf3856ad364e35_10.0.15063.608_none_e05ae487dc8303b1\\computer management.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-c..termanagementsnapin_31bf3856ad364e35_10.0.15063.608_none_e05ae487dc8303b1\\Computer Management.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-c..termanagementsnapin_31bf3856ad364e35_10.0.15063.608_none_e05ae487dc8303b1\\computer management.lnk.exe")) returned 0
	[0177.685] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-charmap_31bf3856ad364e35_10.0.15063.0_none_036d9697dd29e050\\Character Map.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-charmap_31bf3856ad364e35_10.0.15063.0_none_036d9697dd29e050\\character map.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-charmap_31bf3856ad364e35_10.0.15063.0_none_036d9697dd29e050\\Character Map.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-charmap_31bf3856ad364e35_10.0.15063.0_none_036d9697dd29e050\\character map.lnk.exe")) returned 0
	[0177.742] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.15063.0_none_7e580f9a965a8a9b\\Disk Cleanup.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.15063.0_none_7e580f9a965a8a9b\\disk cleanup.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.15063.0_none_7e580f9a965a8a9b\\Disk Cleanup.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.15063.0_none_7e580f9a965a8a9b\\disk cleanup.lnk.exe")) returned 0
	[0177.917] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-commandprompt-shortcut_31bf3856ad364e35_10.0.15063.0_none_4ad22eda27de7766\\Command Prompt.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-commandprompt-shortcut_31bf3856ad364e35_10.0.15063.0_none_4ad22eda27de7766\\command prompt.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-commandprompt-shortcut_31bf3856ad364e35_10.0.15063.0_none_4ad22eda27de7766\\Command Prompt.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-commandprompt-shortcut_31bf3856ad364e35_10.0.15063.0_none_4ad22eda27de7766\\command prompt.lnk.exe")) returned 0
	[0178.790] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.15063.0_none_aa29e7f7c913acd1\\dfrgui.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.15063.0_none_aa29e7f7c913acd1\\dfrgui.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.15063.0_none_aa29e7f7c913acd1\\dfrgui.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.15063.0_none_aa29e7f7c913acd1\\dfrgui.lnk.exe")) returned 0
	[0179.764] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\01 - Command Prompt.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\01 - command prompt.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\01 - Command Prompt.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\01 - command prompt.lnk.exe")) returned 0
	[0179.766] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\01 - File Explorer.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\01 - file explorer.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\01 - File Explorer.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\01 - file explorer.lnk.exe")) returned 0
	[0179.768] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\01a - Windows PowerShell.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\01a - windows powershell.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\01a - Windows PowerShell.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\01a - windows powershell.lnk.exe")) returned 0
	[0179.769] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\02 - Command Prompt.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\02 - command prompt.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\02 - Command Prompt.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\02 - command prompt.lnk.exe")) returned 0
	[0179.771] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\02a - Windows PowerShell.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\02a - windows powershell.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\02a - Windows PowerShell.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\02a - windows powershell.lnk.exe")) returned 0
	[0179.773] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\03 - Computer Management.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\03 - computer management.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\03 - Computer Management.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\03 - computer management.lnk.exe")) returned 0
	[0179.774] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\03 - Documents.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\03 - documents.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\03 - Documents.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\03 - documents.lnk.exe")) returned 0
	[0179.776] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\04 - Disk Management.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\04 - disk management.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\04 - Disk Management.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\04 - disk management.lnk.exe")) returned 0
	[0179.777] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\04 - Downloads.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\04 - downloads.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\04 - Downloads.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\04 - downloads.lnk.exe")) returned 0
	[0179.779] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\04-1 - NetworkStatus.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\04-1 - networkstatus.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\04-1 - NetworkStatus.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\04-1 - networkstatus.lnk.exe")) returned 0
	[0179.780] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\05 - Device Manager.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\05 - device manager.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\05 - Device Manager.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\05 - device manager.lnk.exe")) returned 0
	[0179.801] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\05 - Music.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\05 - music.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\05 - Music.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\05 - music.lnk.exe")) returned 0
	[0179.803] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\06 - Pictures.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\06 - pictures.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\06 - Pictures.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\06 - pictures.lnk.exe")) returned 0
	[0179.804] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\06 - SystemAbout.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\06 - systemabout.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\06 - SystemAbout.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\06 - systemabout.lnk.exe")) returned 0
	[0179.806] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\07 - Event Viewer.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\07 - event viewer.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\07 - Event Viewer.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\07 - event viewer.lnk.exe")) returned 0
	[0179.807] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\07 - Videos.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\07 - videos.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\07 - Videos.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\07 - videos.lnk.exe")) returned 0
	[0179.809] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\08 - Homegroup.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\08 - homegroup.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\08 - Homegroup.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\08 - homegroup.lnk.exe")) returned 0
	[0179.810] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\08 - PowerAndSleep.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\08 - powerandsleep.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\08 - PowerAndSleep.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\08 - powerandsleep.lnk.exe")) returned 0
	[0179.812] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\09 - Mobility Center.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\09 - mobility center.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\09 - Mobility Center.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\09 - mobility center.lnk.exe")) returned 0
	[0179.814] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\09 - Network.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\09 - network.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\09 - Network.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\09 - network.lnk.exe")) returned 0
	[0179.816] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\1 - Desktop.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\1 - desktop.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\1 - Desktop.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\1 - desktop.lnk.exe")) returned 0
	[0179.817] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\1 - Run.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\1 - run.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\1 - Run.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\1 - run.lnk.exe")) returned 0
	[0179.819] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\10 - AppsAndFeatures.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\10 - appsandfeatures.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\10 - AppsAndFeatures.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\10 - appsandfeatures.lnk.exe")) returned 0
	[0179.820] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\10 - UserProfile.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\10 - userprofile.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\10 - UserProfile.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\10 - userprofile.lnk.exe")) returned 0
	[0179.822] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\2 - Search.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\2 - search.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\2 - Search.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\2 - search.lnk.exe")) returned 0
	[0179.823] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\3 - Windows Explorer.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\3 - windows explorer.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\3 - Windows Explorer.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\3 - windows explorer.lnk.exe")) returned 0
	[0179.825] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\4 - Control Panel.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\4 - control panel.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\4 - Control Panel.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\4 - control panel.lnk.exe")) returned 0
	[0179.826] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\5 - Task Manager.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\5 - task manager.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\5 - Task Manager.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\5 - task manager.lnk.exe")) returned 0
	[0179.828] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\computer.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\computer.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\computer.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\computer.lnk.exe")) returned 0
	[0179.830] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\Control Panel.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\control panel.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\Control Panel.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\control panel.lnk.exe")) returned 0
	[0179.831] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\File Explorer.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\file explorer.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\File Explorer.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\file explorer.lnk.exe")) returned 0
	[0179.833] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\Run.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\run.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\Run.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\run.lnk.exe")) returned 0
	[0179.834] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\Shows Desktop.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\shows desktop.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\Shows Desktop.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\shows desktop.lnk.exe")) returned 0
	[0179.836] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\Window Switcher.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\window switcher.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\Window Switcher.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\window switcher.lnk.exe")) returned 0
	[0179.872] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.15063.0_none_8a0d85a061351e49\\Fax Recipient.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.15063.0_none_8a0d85a061351e49\\fax recipient.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.15063.0_none_8a0d85a061351e49\\Fax Recipient.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.15063.0_none_8a0d85a061351e49\\fax recipient.lnk.exe")) returned 0
	[0179.876] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.15063.0_none_8a0d85a061351e49\\Windows Fax and Scan.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.15063.0_none_8a0d85a061351e49\\windows fax and scan.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.15063.0_none_8a0d85a061351e49\\Windows Fax and Scan.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.15063.0_none_8a0d85a061351e49\\windows fax and scan.lnk.exe")) returned 0
	[0182.940] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_10.0.15063.0_none_e8ff03ea94e0988c\\iSCSI Initiator.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_10.0.15063.0_none_e8ff03ea94e0988c\\iscsi initiator.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_10.0.15063.0_none_e8ff03ea94e0988c\\iSCSI Initiator.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_10.0.15063.0_none_e8ff03ea94e0988c\\iscsi initiator.lnk.exe")) returned 0
	[0183.349] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.15063.0_none_5563c0977685c595\\ODBC Data Sources (64-bit).lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.15063.0_none_5563c0977685c595\\odbc data sources (64-bit).lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.15063.0_none_5563c0977685c595\\ODBC Data Sources (64-bit).lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.15063.0_none_5563c0977685c595\\odbc data sources (64-bit).lnk.exe")) returned 0
	[0183.683] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-m..diagnostic-schedule_31bf3856ad364e35_10.0.15063.0_none_a4ea7575b2863db1\\Memory Diagnostics Tool.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-m..diagnostic-schedule_31bf3856ad364e35_10.0.15063.0_none_a4ea7575b2863db1\\memory diagnostics tool.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-m..diagnostic-schedule_31bf3856ad364e35_10.0.15063.0_none_a4ea7575b2863db1\\Memory Diagnostics Tool.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-m..diagnostic-schedule_31bf3856ad364e35_10.0.15063.0_none_a4ea7575b2863db1\\memory diagnostics tool.lnk.exe")) returned 0
	[0184.728] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.15063.0_none_7f41b0a5d17e992b\\Magnify.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.15063.0_none_7f41b0a5d17e992b\\magnify.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.15063.0_none_7f41b0a5d17e992b\\Magnify.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.15063.0_none_7f41b0a5d17e992b\\magnify.lnk.exe")) returned 0
	[0184.876] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-mediaplayer-shortcut_31bf3856ad364e35_10.0.15063.0_none_bfe54b7d868416ee\\Windows Media Player.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-mediaplayer-shortcut_31bf3856ad364e35_10.0.15063.0_none_bfe54b7d868416ee\\windows media player.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-mediaplayer-shortcut_31bf3856ad364e35_10.0.15063.0_none_bfe54b7d868416ee\\Windows Media Player.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-mediaplayer-shortcut_31bf3856ad364e35_10.0.15063.0_none_bfe54b7d868416ee\\windows media player.lnk.exe")) returned 0
	[0186.429] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.15063.0_none_eb8e17bcd68ec9f9\\System Configuration.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.15063.0_none_eb8e17bcd68ec9f9\\system configuration.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.15063.0_none_eb8e17bcd68ec9f9\\System Configuration.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.15063.0_none_eb8e17bcd68ec9f9\\system configuration.lnk.exe")) returned 0
	[0186.449] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.15063.0_none_bcf04010327d02a0\\System Information.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.15063.0_none_bcf04010327d02a0\\system information.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.15063.0_none_bcf04010327d02a0\\System Information.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.15063.0_none_bcf04010327d02a0\\system information.lnk.exe")) returned 0
	[0186.452] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.15063.483_none_40c5a695601fb93b\\System Information.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.15063.483_none_40c5a695601fb93b\\system information.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.15063.483_none_40c5a695601fb93b\\System Information.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.15063.483_none_40c5a695601fb93b\\system information.lnk.exe")) returned 0
	[0186.551] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.15063.0_none_9f315fde27607282\\Paint.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.15063.0_none_9f315fde27607282\\paint.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.15063.0_none_9f315fde27607282\\Paint.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.15063.0_none_9f315fde27607282\\paint.lnk.exe")) returned 0
	[0186.553] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.15063.413_none_235275d754ca6586\\Paint.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.15063.413_none_235275d754ca6586\\paint.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.15063.413_none_235275d754ca6586\\Paint.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.15063.413_none_235275d754ca6586\\paint.lnk.exe")) returned 0
	[0186.784] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.15063.0_none_cf31b229dc87b1a1\\Narrator.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.15063.0_none_cf31b229dc87b1a1\\narrator.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.15063.0_none_cf31b229dc87b1a1\\Narrator.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.15063.0_none_cf31b229dc87b1a1\\narrator.lnk.exe")) returned 0
	[0186.786] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.15063.447_none_533659870a065dd4\\Narrator.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.15063.447_none_533659870a065dd4\\narrator.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.15063.447_none_533659870a065dd4\\Narrator.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.15063.447_none_533659870a065dd4\\narrator.lnk.exe")) returned 0
	[0187.146] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.15063.0_none_802e66b4a8ce74db\\Notepad.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.15063.0_none_802e66b4a8ce74db\\notepad.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.15063.0_none_802e66b4a8ce74db\\Notepad.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.15063.0_none_802e66b4a8ce74db\\notepad.lnk.exe")) returned 0
	[0187.381] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-osk_31bf3856ad364e35_10.0.15063.0_none_bbd0aca592bd6ae9\\On-Screen Keyboard.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-osk_31bf3856ad364e35_10.0.15063.0_none_bbd0aca592bd6ae9\\on-screen keyboard.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-osk_31bf3856ad364e35_10.0.15063.0_none_bbd0aca592bd6ae9\\On-Screen Keyboard.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-osk_31bf3856ad364e35_10.0.15063.0_none_bbd0aca592bd6ae9\\on-screen keyboard.lnk.exe")) returned 0
	[0187.495] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-p..erandprintui-pmcppc_31bf3856ad364e35_10.0.15063.0_none_1c7c1b25b9805ef0\\Print Management.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-p..erandprintui-pmcppc_31bf3856ad364e35_10.0.15063.0_none_1c7c1b25b9805ef0\\print management.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-p..erandprintui-pmcppc_31bf3856ad364e35_10.0.15063.0_none_1c7c1b25b9805ef0\\Print Management.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-p..erandprintui-pmcppc_31bf3856ad364e35_10.0.15063.0_none_1c7c1b25b9805ef0\\print management.lnk.exe")) returned 0
	[0187.895] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.15063.0_none_ad1d9764d9c2a978\\Performance Monitor.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.15063.0_none_ad1d9764d9c2a978\\performance monitor.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.15063.0_none_ad1d9764d9c2a978\\Performance Monitor.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.15063.0_none_ad1d9764d9c2a978\\performance monitor.lnk.exe")) returned 0
	[0187.897] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.15063.0_none_ad1d9764d9c2a978\\Resource Monitor.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.15063.0_none_ad1d9764d9c2a978\\resource monitor.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.15063.0_none_ad1d9764d9c2a978\\Resource Monitor.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.15063.0_none_ad1d9764d9c2a978\\resource monitor.lnk.exe")) returned 0
	[0187.905] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.15063.483_none_30f2fdea07656013\\Performance Monitor.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.15063.483_none_30f2fdea07656013\\performance monitor.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.15063.483_none_30f2fdea07656013\\Performance Monitor.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.15063.483_none_30f2fdea07656013\\performance monitor.lnk.exe")) returned 0
	[0187.906] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.15063.483_none_30f2fdea07656013\\Resource Monitor.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.15063.483_none_30f2fdea07656013\\resource monitor.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.15063.483_none_30f2fdea07656013\\Resource Monitor.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.15063.483_none_30f2fdea07656013\\resource monitor.lnk.exe")) returned 0
	[0188.013] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-powershell-ise_31bf3856ad364e35_10.0.15063.0_none_79f996cb3b264dfd\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-powershell-ise_31bf3856ad364e35_10.0.15063.0_none_79f996cb3b264dfd\\windows powershell ise (x86).lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-powershell-ise_31bf3856ad364e35_10.0.15063.0_none_79f996cb3b264dfd\\Windows PowerShell ISE (x86).lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-powershell-ise_31bf3856ad364e35_10.0.15063.0_none_79f996cb3b264dfd\\windows powershell ise (x86).lnk.exe")) returned 0
	[0188.015] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-powershell-ise_31bf3856ad364e35_10.0.15063.0_none_79f996cb3b264dfd\\Windows PowerShell ISE.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-powershell-ise_31bf3856ad364e35_10.0.15063.0_none_79f996cb3b264dfd\\windows powershell ise.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-powershell-ise_31bf3856ad364e35_10.0.15063.0_none_79f996cb3b264dfd\\Windows PowerShell ISE.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-powershell-ise_31bf3856ad364e35_10.0.15063.0_none_79f996cb3b264dfd\\windows powershell ise.lnk.exe")) returned 0
	[0188.362] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.15063.0_none_0f14a5b4a7919f86\\Quick Assist.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.15063.0_none_0f14a5b4a7919f86\\quick assist.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.15063.0_none_0f14a5b4a7919f86\\Quick Assist.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.15063.0_none_0f14a5b4a7919f86\\quick assist.lnk.exe")) returned 0
	[0189.527] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-s..ment-policytools-ex_31bf3856ad364e35_10.0.15063.0_none_6a732ed779e4583b\\Security Configuration Management.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-s..ment-policytools-ex_31bf3856ad364e35_10.0.15063.0_none_6a732ed779e4583b\\security configuration management.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-s..ment-policytools-ex_31bf3856ad364e35_10.0.15063.0_none_6a732ed779e4583b\\Security Configuration Management.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-s..ment-policytools-ex_31bf3856ad364e35_10.0.15063.0_none_6a732ed779e4583b\\security configuration management.lnk.exe")) returned 0
	[0191.303] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-servicessnapin_31bf3856ad364e35_10.0.15063.0_none_e077bbdd7e899e4b\\services.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-servicessnapin_31bf3856ad364e35_10.0.15063.0_none_e077bbdd7e899e4b\\services.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-servicessnapin_31bf3856ad364e35_10.0.15063.0_none_e077bbdd7e899e4b\\services.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-servicessnapin_31bf3856ad364e35_10.0.15063.0_none_e077bbdd7e899e4b\\services.lnk.exe")) returned 0
	[0191.913] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_10.0.15063.0_none_aad7db68c271ad4a\\Snipping Tool.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_10.0.15063.0_none_aad7db68c271ad4a\\snipping tool.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_10.0.15063.0_none_aad7db68c271ad4a\\Snipping Tool.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_10.0.15063.0_none_aad7db68c271ad4a\\snipping tool.lnk.exe")) returned 0
	[0192.014] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_10.0.15063.0_none_2d1dc944849b5924\\Speech Recognition.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_10.0.15063.0_none_2d1dc944849b5924\\speech recognition.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_10.0.15063.0_none_2d1dc944849b5924\\Speech Recognition.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_10.0.15063.0_none_2d1dc944849b5924\\speech recognition.lnk.exe")) returned 0
	[0192.435] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-t..etpc-mathinputpanel_31bf3856ad364e35_10.0.15063.0_none_dbb55c5189ba2ad8\\Math Input Panel.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-t..etpc-mathinputpanel_31bf3856ad364e35_10.0.15063.0_none_dbb55c5189ba2ad8\\math input panel.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-t..etpc-mathinputpanel_31bf3856ad364e35_10.0.15063.0_none_dbb55c5189ba2ad8\\Math Input Panel.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-t..etpc-mathinputpanel_31bf3856ad364e35_10.0.15063.0_none_dbb55c5189ba2ad8\\math input panel.lnk.exe")) returned 0
	[0192.597] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.15063.0_none_5ef026ce59e64966\\Remote Desktop Connection.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.15063.0_none_5ef026ce59e64966\\remote desktop connection.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.15063.0_none_5ef026ce59e64966\\Remote Desktop Connection.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.15063.0_none_5ef026ce59e64966\\remote desktop connection.lnk.exe")) returned 0
	[0195.118] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.15063.0_none_3ece526ca5b43e29\\Wordpad.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.15063.0_none_3ece526ca5b43e29\\wordpad.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.15063.0_none_3ece526ca5b43e29\\Wordpad.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.15063.0_none_3ece526ca5b43e29\\wordpad.lnk.exe")) returned 0
	[0195.122] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.15063.483_none_c2a3b8f1d356f4c4\\Wordpad.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.15063.483_none_c2a3b8f1d356f4c4\\wordpad.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.15063.483_none_c2a3b8f1d356f4c4\\Wordpad.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.15063.483_none_c2a3b8f1d356f4c4\\wordpad.lnk.exe")) returned 0
	[0195.287] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-xpsreachviewer_31bf3856ad364e35_10.0.15063.0_none_262f2cb987063af6\\XPS Viewer.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-xpsreachviewer_31bf3856ad364e35_10.0.15063.0_none_262f2cb987063af6\\xps viewer.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-xpsreachviewer_31bf3856ad364e35_10.0.15063.0_none_262f2cb987063af6\\XPS Viewer.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-xpsreachviewer_31bf3856ad364e35_10.0.15063.0_none_262f2cb987063af6\\xps viewer.lnk.exe")) returned 0
	[0198.531] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_networking-mpssvc-shortcut_31bf3856ad364e35_10.0.15063.0_none_966ace434593e6ab\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\windows\\winsxs\\amd64_networking-mpssvc-shortcut_31bf3856ad364e35_10.0.15063.0_none_966ace434593e6ab\\windows firewall with advanced security.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_networking-mpssvc-shortcut_31bf3856ad364e35_10.0.15063.0_none_966ace434593e6ab\\Windows Firewall with Advanced Security.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_networking-mpssvc-shortcut_31bf3856ad364e35_10.0.15063.0_none_966ace434593e6ab\\windows firewall with advanced security.lnk.exe")) returned 0
	[0200.274] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_taskschedulersettings_31bf3856ad364e35_10.0.15063.0_none_5bfedd033d2b9dee\\Task Scheduler.lnk" (normalized: "c:\\windows\\winsxs\\amd64_taskschedulersettings_31bf3856ad364e35_10.0.15063.0_none_5bfedd033d2b9dee\\task scheduler.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_taskschedulersettings_31bf3856ad364e35_10.0.15063.0_none_5bfedd033d2b9dee\\Task Scheduler.lnk.exe" (normalized: "c:\\windows\\winsxs\\amd64_taskschedulersettings_31bf3856ad364e35_10.0.15063.0_none_5bfedd033d2b9dee\\task scheduler.lnk.exe")) returned 0
	[0242.661] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\wow64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.15063.0_none_5fb86ae9aae68790\\ODBC Data Sources (32-bit).lnk" (normalized: "c:\\windows\\winsxs\\wow64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.15063.0_none_5fb86ae9aae68790\\odbc data sources (32-bit).lnk"), lpNewFileName="C:\\Windows\\WinSxS\\wow64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.15063.0_none_5fb86ae9aae68790\\ODBC Data Sources (32-bit).lnk.exe" (normalized: "c:\\windows\\winsxs\\wow64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.15063.0_none_5fb86ae9aae68790\\odbc data sources (32-bit).lnk.exe")) returned 0
	[0249.147] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd" (normalized: "c:\\windows10upgrade\\enablewifitracing.cmd"), lpNewFileName="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd.exe" (normalized: "c:\\windows10upgrade\\enablewifitracing.cmd.exe")) returned 1
	[0249.152] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\PostOOBEScript.cmd" (normalized: "c:\\windows10upgrade\\postoobescript.cmd"), lpNewFileName="C:\\Windows10Upgrade\\PostOOBEScript.cmd.exe" (normalized: "c:\\windows10upgrade\\postoobescript.cmd.exe")) returned 1
	[0249.159] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwcompat.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt.exe" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwcompat.txt.exe")) returned 1
	[0249.162] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwexclude.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt.exe" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwexclude.txt.exe")) returned 1
	[0249.178] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt" (normalized: "c:\\windows10upgrade\\resources\\hwcompatshared.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt.exe" (normalized: "c:\\windows10upgrade\\resources\\hwcompatshared.txt.exe")) returned 1
	[0249.204] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwcompat.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt.exe" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwcompat.txt.exe")) returned 1
	[0249.208] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwexclude.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt.exe" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwexclude.txt.exe")) returned 1
	[0249.215] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\block.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\block.png.exe")) returned 1
	[0249.221] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bluelogo.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\bluelogo.png.exe")) returned 1
	[0249.224] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\bullet.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bullet.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\bullet.png.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\bullet.png.exe")) returned 1
	[0249.228] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.htm.exe")) returned 1
	[0249.232] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.htm.exe")) returned 1
	[0249.236] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.htm.exe")) returned 1
	[0249.258] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ar-sa.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ar-sa.htm.exe")) returned 1
	[0249.263] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_bg-bg.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_bg-bg.htm.exe")) returned 1
	[0249.267] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_cs-cz.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_cs-cz.htm.exe")) returned 1
	[0249.271] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_da-dk.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_da-dk.htm.exe")) returned 1
	[0249.275] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_de-de.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_de-de.htm.exe")) returned 1
	[0249.282] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_el-gr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_el-gr.htm.exe")) returned 1
	[0249.286] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-gb.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-gb.htm.exe")) returned 1
	[0249.293] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-us.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-us.htm.exe")) returned 1
	[0249.311] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-es.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-es.htm.exe")) returned 1
	[0249.316] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-mx.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-mx.htm.exe")) returned 1
	[0249.319] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_et-ee.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_et-ee.htm.exe")) returned 1
	[0249.323] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fi-fi.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fi-fi.htm.exe")) returned 1
	[0249.329] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-ca.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-ca.htm.exe")) returned 1
	[0249.333] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-fr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-fr.htm.exe")) returned 1
	[0249.347] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_he-il.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_he-il.htm.exe")) returned 1
	[0249.372] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hr-hr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hr-hr.htm.exe")) returned 1
	[0249.378] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hu-hu.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hu-hu.htm.exe")) returned 1
	[0249.381] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_it-it.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_it-it.htm.exe")) returned 1
	[0249.386] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ja-jp.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ja-jp.htm.exe")) returned 1
	[0249.877] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ko-kr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ko-kr.htm.exe")) returned 1
	[0249.989] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lt-lt.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lt-lt.htm.exe")) returned 1
	[0250.008] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lv-lv.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lv-lv.htm.exe")) returned 1
	[0250.012] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nb-no.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nb-no.htm.exe")) returned 1
	[0250.016] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nl-nl.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nl-nl.htm.exe")) returned 1
	[0250.019] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pl-pl.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pl-pl.htm.exe")) returned 1
	[0250.022] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-br.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-br.htm.exe")) returned 1
	[0250.025] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-pt.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-pt.htm.exe")) returned 1
	[0250.029] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ro-ro.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ro-ro.htm.exe")) returned 1
	[0250.035] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ru-ru.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ru-ru.htm.exe")) returned 1
	[0250.039] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sk-sk.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sk-sk.htm.exe")) returned 1
	[0250.042] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sl-si.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sl-si.htm.exe")) returned 1
	[0250.066] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sr-latn-cs.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sr-latn-cs.htm.exe")) returned 1
	[0250.070] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sv-se.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sv-se.htm.exe")) returned 1
	[0250.075] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_th-th.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_th-th.htm.exe")) returned 1
	[0250.078] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_tr-tr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_tr-tr.htm.exe")) returned 1
	[0250.085] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_uk-ua.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_uk-ua.htm.exe")) returned 1
	[0250.089] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-cn.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-cn.htm.exe")) returned 1
	[0250.093] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-hk.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-hk.htm.exe")) returned 1
	[0250.097] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-tw.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-tw.htm.exe")) returned 1
	[0250.125] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstarted.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstarted.png.exe")) returned 1
	[0250.128] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstartedhoverover.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstartedhoverover.png.exe")) returned 1
	[0250.131] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\loading.gif" (normalized: "c:\\windows10upgrade\\resources\\ux\\loading.gif"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\loading.gif.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\loading.gif.exe")) returned 1
	[0250.142] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\lock.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\lock.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\lock.png.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\lock.png.exe")) returned 1
	[0250.145] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\logo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\logo.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\logo.png.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\logo.png.exe")) returned 1
	[0250.148] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\marketing.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\marketing.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\marketing.png.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\marketing.png.exe")) returned 1
	[0250.200] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\base.js"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\base.js.exe")) returned 1
	[0250.267] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\ui.js"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\ui.js.exe")) returned 1
	[0250.270] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnection.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnection.png.exe")) returned 1
	[0250.273] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnectionhoverover.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnectionhoverover.png.exe")) returned 1
	[0250.304] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\pass.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\pass.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\pass.png.exe" (normalized: "c:\\windows10upgrade\\resources\\ux\\pass.png.exe")) returned 1
	[0250.307] SHGetSpecialFolderPathA (in: hwnd=0x0, pszPath=0x405250, csidl=16, fCreate=1 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1
	[0250.319] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop" | out: lpString1="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop"
	[0250.319] FindResourceA (hModule=0x0, lpName="lolaloud123", lpType=0x2) returned 0x4083a0
	[0250.319] SizeofResource (hModule=0x0, hResInfo=0x4083a0) returned 0x75736
	[0250.319] LoadResource (hModule=0x0, hResInfo=0x4083a0) returned 0x40859c
	[0250.319] LockResource (hResData=0x40859c) returned 0x40859c
	[0250.319] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\jpflbhmcioekpflb.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\jpflbhmcioekpflb.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0250.321] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0250.321] WriteFile (in: hFile=0x21c, lpBuffer=0x40859c*, nNumberOfBytesToWrite=0x75736, lpNumberOfBytesWritten=0x19ff60, lpOverlapped=0x0 | out: lpBuffer=0x40859c*, lpNumberOfBytesWritten=0x19ff60*=0x75736, lpOverlapped=0x0) returned 1
	[0250.332] SetFileTime (hFile=0x21c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0250.332] CloseHandle (hObject=0x21c) returned 1
	[0250.332] SystemParametersInfoA (in: uiAction=0x14, uiParam=0x0, pvParam="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\jpflbhmcioekpflb.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\jpflbhmcioekpflb.bmp"), fWinIni=0x3 | out: pvParam=0x406e19) returned 1
	[0252.385] FreeResource (hResData=0x40859c) returned 0
	[0252.394] ExitProcess (uExitCode=0x0) 

Thread:
	id = 2
	os_tid = 0xd28